To clarify, with the comments upload drag-and-drop trick, you can't upload any file extensions outside of this allowlist (i,e., executable files not allowed): GIF, JPEG, JPG, MOV, MP4, PNG, SVG, WEBM, CPUPROFILE, CSV, DMP, DOCX, FODG, FODP, FODS, FODT, GZ, JSON, JSONC, LOG, MD, ODF, ODG, ODP, ODS, ODT, PATCH, PDF, PPTX, TGZ, TXT, XLS, XLSX or ZIP. Nothing stopping you from putting things in a release asset, though 😜 That trick looks to be doable on Gitlab just as well.
Or just put an EXE in a password-protected zip and make a project with an issue, which you report on an alt, with logs in a zip, which has a password, and you fake a conversation between you and the alt, saying that it has a password, and then the alt sends real logs in a zip; There would be no evidence of malicious intent.
I see you changed the title of the video and thumbnail with the quickness.. I'm guessing "How to use Github to hack" wasn't as viable as you thought :D
The issues-based file hosting is wild. You would think a person would at least need to submit the issue to have their files stored on a server for any length of time. I wonder how long those links are valid.
I was once following your tutorial on burpsuite and I downloaded foxy-proxy extension on my Linux machine. Whenever I tried to use terminal as sudo the terminal freezed. I cannot recall the exact extension developer but clearly it was some variation of foxy-proxy. I uninstalled the extension and the terminal worked again. You should do a video on this
We can detect Hearless selenium's presence easly with cpu spike... 😂 but in windows it's doesn't make a dent, so it's fine but linux user would easly find it
That would be great if websites weren't able to detect things like selenium and chrome driver. Js and the dev tools are to blame. The people making browsers just aren't hardening them against developer tools being detected, so a site can refuse to work if you open it in selenium or even open the dev tools (like aniwave or 9anime)
I can imagine having a command of some sort in a file hosted on github and malware hosted on a device which occasionally checks that repo for a commit to that file, or perhaps a comment in a reply chain or something... I was specifically thinking that your command & control changes a file on the repo and at some point the malware will pull that file (during a poll :P) and do the command like taking a screenshot and uploading it back to the repo. Idk Very interesting video. I'm already using github to share memes, but now I'm getting ideas about how I can use other sites I'd otherwise never touch, like Truth Social.
Why does the Linux community ignore this? Especially Linus Torvalds? Because they're also hackers. And by the way RMS, hacker is also ambiguous . Hacking is also dangerous because of its black hat definition.
So i am currently doing a cyber security course and theres a project coming up where we have to setup a metaspoiltable 2 box.. could anyone tell me some tools to use to pentest the box if i am on team red and or some tools to defend the box etc on team blue? Would i need to have python knowledge as i am very new to it and i am starting to dip my toes in it
Hay John, I hope you're doing well, so I'm trying to find a websites Directory with Linux like Ubuntu, but I'm not sure how, can you make a video on how to find a websites directory please Thanks. 😊
![The State of Cybercrime [2024]](http://i.ytimg.com/vi/E40WYnGKhsc/mqdefault.jpg)
To clarify, with the comments upload drag-and-drop trick, you can't upload any file extensions outside of this allowlist (i,e., executable files not allowed): GIF, JPEG, JPG, MOV, MP4, PNG, SVG, WEBM, CPUPROFILE, CSV, DMP, DOCX, FODG, FODP, FODS, FODT, GZ, JSON, JSONC, LOG, MD, ODF, ODG, ODP, ODS, ODT, PATCH, PDF, PPTX, TGZ, TXT, XLS, XLSX or ZIP. Nothing stopping you from putting things in a release asset, though 😜
That trick looks to be doable on Gitlab just as well.
6hrs ago wtf
I hope you have properly reset your GitHub session... 😅
@@tomashublik5586 Video gets uploaded the day prior for scheduling. Can comment on it as much as you want, until then.
Or just put an EXE in a password-protected zip and make a project with an issue, which you report on an alt, with logs in a zip, which has a password, and you fake a conversation between you and the alt, saying that it has a password, and then the alt sends real logs in a zip; There would be no evidence of malicious intent.
That´s an social engineer's wet dream.
But the fact it works w/out even posting the issue is really the icing of the cake!
I see you changed the title of the video and thumbnail with the quickness..
I'm guessing "How to use Github to hack" wasn't as viable as you thought :D
this is why i love john. he's so passionate and eager to share!
No, he technically has a 'business' to run, i.e., his TH-cam channel. He posts what he knows will generate clicks while also using his skills.
@@idontexist-satoshi - While providing clear info understandable by most folks.
@@idontexist-satoshi so your saying he doesnt enjoy his job
The issues-based file hosting is wild. You would think a person would at least need to submit the issue to have their files stored on a server for any length of time. I wonder how long those links are valid.
I was once following your tutorial on burpsuite and I downloaded foxy-proxy extension on my Linux machine. Whenever I tried to use terminal as sudo the terminal freezed. I cannot recall the exact extension developer but clearly it was some variation of foxy-proxy. I uninstalled the extension and the terminal worked again. You should do a video on this
10:14 I love that that's the video, idk it's hilarious
Dude, this is awesome, great video!
Lol, Microsoft is still using AWS for Github and not Azure 😂😂
Migration is a pain on the ass even for msft
@@kcnl2522so are Russian hackers
github is the new discord (kind of)
who would've thought 😱
I keep reporting github malwares on a daily basis
Thanks for your service man. This is the essence of open source, we need more people like you.
Python Selenium would be a simple solution. Imitate a web browser, "upload" your file, get the url and send it to the c2 server / client .
We can detect Hearless selenium's presence easly with cpu spike... 😂 but in windows it's doesn't make a dent, so it's fine
but linux user would easly find it
Would Not be.
Its detected.
@@BluescreenDev Have you tried to run the script over a proxy ?
That would be great if websites weren't able to detect things like selenium and chrome driver. Js and the dev tools are to blame.
The people making browsers just aren't hardening them against developer tools being detected, so a site can refuse to work if you open it in selenium or even open the dev tools (like aniwave or 9anime)
Hi John, great video. How can I connect with you about learning more.
You forgot my kind of hackers: the ugly
I can imagine having a command of some sort in a file hosted on github and malware hosted on a device which occasionally checks that repo for a commit to that file, or perhaps a comment in a reply chain or something...
I was specifically thinking that your command & control changes a file on the repo and at some point the malware will pull that file (during a poll :P) and do the command like taking a screenshot and uploading it back to the repo.
Idk
Very interesting video. I'm already using github to share memes, but now I'm getting ideas about how I can use other sites I'd otherwise never touch, like Truth Social.
Why does the Linux community ignore this?
Especially Linus Torvalds?
Because they're also hackers. And by the way RMS, hacker is also ambiguous .
Hacking is also dangerous because of its black hat definition.
So i am currently doing a cyber security course and theres a project coming up where we have to setup a metaspoiltable 2 box.. could anyone tell me some tools to use to pentest the box if i am on team red and or some tools to defend the box etc on team blue? Would i need to have python knowledge as i am very new to it and i am starting to dip my toes in it
well that was a fun until it lasted!
Keep'er Security? I hardly know her!
When I Saw the title, what came to my mind was "Who Doesn't?"....
Hay John, I hope you're doing well, so I'm trying to find a websites Directory with Linux like Ubuntu, but I'm not sure how, can you make a video on how to find a websites directory please Thanks. 😊
discord was so much easier before they made the fix
You are talking about the cdn links ye?
Okay Sir that's what i want to do 🤣📈🚩
Are you Seth Rogens brother?
Seth Rogan sounding breh
Looks like web 1.0
I thought it was gonna be the zoo
love from nepal
there hasnt been a comment in six months
😀👍
❤
Lmao, this totally works 😂
Wow
Hahahhhhhhahahh so many malware
.
dang just 4 minutes and I'm already here
8th comment here
First!!!
nope
I've been a follower since 2018 but he never response to my comment 😂
no one gives a fucking shit
first
First
L, I am first