jwcrux

15 ms·

121.
by jwcrux 11y ago
There are a ton of bug bounties nowadays, but it's a nice change of pace to have a company give some data on backend stack, subdomains, and purpose of the services up front. Great move on Uber's part!
122.
by jwcrux 11y ago
It's important to note that in addition to the big breaches, this site also collects database dumps from paste sites such as Pastebin. Specifically, I've been feeding logs from my twitter bot, @dumpmon, into HIBP to help build the
123.
by jwcrux 11y ago
gophish - https://getgophish.com . It's awesome because it provides phishing simulation/training to everyone for free. Traditional solutions cost $$$$$, so gophish makes this type of training available to anyone regar
124.
by jwcrux 11y ago
Thanks! Eventually we will have a full online demo where users can see what the product looks like without having to download it.
125.
Show HN: Gophish – An Open-Source Phishing Framework(getgophish.com)
21 points by jwcrux 11y ago|4 comments
126.
by jwcrux 11y ago
I guess I'm a bit confused.. it looks like MapD is a company, but I can't find an actual product to download (if it's OSS), or pricing to buy (if it's not). All I see is a link to the whitepaper, which requests contact i
127.
by jwcrux 11y ago
I've been taking this course recently. Due to time constraints, I haven't kept up with the rest of the course, but the content is phenomenal. If you want to learn machine learning, check out the course.
128.
by jwcrux 11y ago
Basically, it looks like this affects servers that still support SSLv2. From the mitigation notes: > To protect against DROWN, server operators need to ensure that their private keys are not used anywhere with server software that allows
129.
by jwcrux 11y ago
Great feedback, thanks! We're working on a new landing page that hopefully shows this in action a bit more, as well as provides a bit more information on why you might want to use gophish and when. I'll keep this feedback in mind.
130.
by jwcrux 11y ago
Sadly these spoofed emails from high ups are becoming all too common. Shameless plug - if anyone is in need of an open source phishing training solution, I recently launched gophish to great feedback so far, and have a new version being dro
131.
by jwcrux 11y ago
If only there were a way to bypass that paywall.
132.
by jwcrux 11y ago
I've had nothing but great experiences with gorm.
133.
by jwcrux 11y ago
Previous discussion: https://news.ycombinator.com/item?id=11093779 Previous discussion before that: https://news.ycombinator.com/item?id=11074638 And the one before that: https://news.ycombinator
134.
by jwcrux 11y ago
How do you feel this will compete with the growing popularity of bug bounties that are a crowdsourced pay-per-bug model?
135.
by jwcrux 11y ago
Well the fact that gmail launched the same month this journal was published would have made that difficult for the author..
136.
by jwcrux 11y ago
Assuming the source of the credentials (malware, other breaches, etc) is correct, 320k isn't outlandish by any means. My Twitter bot, @dumpmon, comes across thousands of leaked creds per day, and that's only on pastebin. This, com
137.
by jwcrux 11y ago
I'd be interested in hearing more about it and how it compares to other established honeypots (e.g. Kippo). Is there a place I can go now to learn more?
138.
by jwcrux 11y ago
Seeing the "_id" : ObjectId() fields indicates to me that this is likely a mongodb instance that was available to everyone. There's been a lot of talk about these recently[1] that I'm surprised this didn't come up s
139.
by jwcrux 11y ago
Oh, hi there! Author here. Glad y'all like the post! I've been on a break recently working on other projects, but I'm finishing up a post for this series soon, so stay tuned! I'll be hanging around off and on, and am hap
140.
by jwcrux 11y ago
The "-g GOOGLEDORK" and the "--tor" flags are key to any script kiddies arsenal. That's why you see so many low-level db breaches posted on things like Pastebin. Set those two flags and you have automated sql inject
141.
by jwcrux 11y ago
Any good resources where CS folks typically upload their papers? I've used the Google/Twitter/etc. "published research" pages, but those are obviously company-specific.
142.
by jwcrux 11y ago
There was an interesting talk [0] and paper [1] presented at some security conferences about crawling the DHT for different purposes. It's been a while, but I remember these to be a great read. [0] https://www.defcon.org&#x2
143.
How to Download a List of All Registered Domain Names(jordan-wright.com)
170 points by jwcrux 11y ago|53 comments
144.
How to Download a List of All Registered Domain Names(jordan-wright.com)
3 points by jwcrux 11y ago|0 comments
145.
by jwcrux 11y ago
Or the cyber security company LookingGlass[1] [1] https://lgscout.com/
146.
by jwcrux 11y ago
Currently working on an open-source phishing framework called gophish [1]. It will let businesses and pen testers conduct phishing simulations/engagements easily. And it's a full web app sitting on a go backend. [1] http:/&#
147.
by jwcrux 11y ago
Anyone interested in this would also like Corakmi's excellent ELF101 diagram: https://code.google.com/p/corkami/wiki/ELF101
148.
by jwcrux 11y ago
Neat! I really like the easy pricing model. Quick question - are you concerned about trademarks (Amazon and such) being included as the phishing templates? Reason I ask is that I'm working on a hosted project [1] similar to this and ha
149.
by jwcrux 11y ago
It is... just not on Twitter anymore. The account was suspended about a week or two ago and I haven't heard anything back on my appeal from Twitter.
150.
by jwcrux 11y ago
I created a Twitter bot called @dumpmon (recently suspended for no apparent reason) that scraped paste sites looking for password dumps and tweeting if one was found. You can find the code here: http://github.com/jordan-wrig

More ›