𝑺𝒆𝒄𝒖𝒓𝒊𝒕𝒚 𝑩𝒐𝒚

https://x.com/i/status/2049153209982140718

$1,605: average annual ad value of a U.S. Google user Article, Comments

$1,605: average annual ad value of a U.S. Google user Article, Comments

Is OPPO using a bot to triage bug reports? We have been seeing lots of automated bots flooding bug bounty submissions and this seems the kick back. This reminds me what our professor did this year. He gave us an assignment to review a research paper and of course everybody used AI to do the review. He returned the favor by grading our assignment using an AI. I have never received such a loooong and nonsense feedback for an assignment in my entire life😂

2030?

"How One Fake Text Message Empties a Bank Account" 💁‍♀️ I'm going to walk you guys through the exact 4-steps chain attackers use Step 1: THE TEXT (smishing) 👀 It arrives looking like this :- "CBE Alert: Your account has been temporarily suspended due to unusual activity. Verify now: [shortened link]" or "Ethio Telecom: Your airtime will expire in 24 hours. Click here to extend: [shortened link]" 😈Red flags: =>Urgency ("within 24 hours") =>Shortened links (bit.ly, tinyurl, or random .xyz domains) =>A sender claiming to be CBE or EthioTelecom but often a personal number 💀At this point, the victim is worried. That's exactly what the attacker wants. STEP 2: THE FAKE PAGE Victim clicks the link. It opens a website that looks exactly like: =>CBE Birr login =>Ethio Telecom self-care portal =>Even Chapa or Telebirr Same logos, Same colors and Same layout 👿The victim enters: =>Account number or phone number =>Password or PIN (Sometimes) the temporary code sent via SMS 🙌🏾Here's what many of us don't know: This isn't just a fake page. It's a phishing kit that sends the credentials to the attacker in real time. STEP 3: THE SESSION COOKIE THEFT (The Session Hijack) 😎This is where it gets technical When you log into CBE Birr or any banking app through a browser, your session gets a cookie. It's like a digital key that says "this person is already verified." The fake page doesn't just steal your password. It steals that cookie. Now the attacker pastes that cookie into their browser. Result: They're logged in as you. No password prompt. No additional verification. Just in. STEP 4: THE MONEY MOVE Once they get inside: =>They check your balance =>They transfer via Telebirr, CBE Birr, or bank transfer =>They send money to mule accounts (often other Ethiopian accounts opened with fake IDs) =>They change your PIN or password and locking you out🤦‍♀️ ☠️From first text to account drained? No "hacking skills." Just a fake page and your trust.

[1] Brought to us by the creator of Signal (the messaging app) . 1. confer.to

12 must know network protocol @insactc

https://anshu19981.github.io/Pentestcheatsheet @AfroSec

This is the golden rule when it comes to asking people, you have to be as specific as possible to get the best feedback.

https://support.brave.app/hc/en-us/articles/360021218111-How-do-I-set-up-Sync

https://support.brave.app/hc/en-us/articles/360021218111-How-do-I-set-up-Sync

What percentage of the Human-Built apps do you think have security flaws?

How i stopped wasting time in bug bounty (took me way too long to figure this out)? so i kept jumping between random youtube videos and blog posts for months and getting nowhere. no structure, no direction. what finally clicked was doing things in the RIGHT ORDER. sounds obvious but nobody actually spells it out clearly. week 1 - just setup, nothing else - burp suite community + foxyproxy - subfinder, nmap, ffuf installed - do 3 portswigger XSS labs. thats it. - dont touch a real target yet week 2 - recon only, dont test anything - pick ONE program on hackerone - passive first: crt.sh, github dorking, google dorks - then active: subfinder on the domain, ffuf for directories - write everything down in a txt file - seriously dont test anything yet week 3 - now test, but only what you found in recon - XSS on every input field using burp repeater - IDOR: make 2 test accounts, check every numeric ID - SQLi: single quote on every parameter, watch the response - nothing random week 4 - write and submit - title format: [vuln type] in [feature] allows [impact] - paste the raw HTTP request from burp into the report - suggest a fix at the end (increases payout) - first report will probably be a dupe. thats fine. submit anyway. one thing i wish someone told me earlier: A01 and A03 from OWASP produce more valid reports for beginners than everything else combined. start there every single time. ©copied from Reddit

#News We are at the Era where malwares get vibecoded and became a Thing #VibeWare lol😭😂😂 Am Really Scared of My Country, Soon all of our Data will be on Darkweb for sell😭, We cant Handle a single APT(even skids) enkuan Ai-Backed APT Hackers😭 https://ww…

#News We are at the Era where malwares get vibecoded and became a Thing #VibeWare lol😭😂😂 Am Really Scared of My Country, Soon all of our Data will be on Darkweb for sell😭, We cant Handle a single APT(even skids) enkuan Ai-Backed APT Hackers😭 https://www.bitdefender.com/en-us/blog/businessinsights/apt36-nightmare-vibeware @geeztechgroup @geezsecurity #geeztech

Another Job vacancy Core Objective: Protect infrastructure, prevent attacks (DDoS, SQL injection, etc.), and ensure 24/7 uptime of our platform. Required Skills & Expertise Offensive Security (Ethical Hacking) Strong knowledge of: Penetration testing (web, API) Vulnerability assessment Familiar with tools like: Burp Suite, Metasploit, Nmap Understands attack types like: SQL Injection, Cross-Site Scripting (XSS), DDoS (defense-focused) Experience with: Firewalls (WAF), Intrusion Detection/Prevention Systems (IDS/IPS), Anti-DDoS protection (Cloudflare, AWS Shield, etc.) Strong knowledge of: Cloud platforms (AWS, Azure, GCP), Linux server hardening, Load balancing and failover systems, Database protection. Depending on the specialist; the salary may go up to 300 USD per week. If you are qualified enough contact @aar_VVIP

Good luck with that!

#Random_Tip If you are looking in to taking Security+ certification, here is a way to get a 30% discount: ✅ Apply for the course Google Cybersecurity Professional Certificate[1] on Coursera (You should complete all 8 courses under this program). If you can't afford to pay, you can apply for financial aid. ✅ Once you complete this course, which by the way will tech you a lot of new stuff and prepare you for the actual Security+ exam, you will get a 30% voucher. 1. https://www.coursera.org/professional-certificates/google-cybersecurity #certifications