Author: HackWatchit
Chris has been working in security for 30 years, mainly doing penetration testing in both consulting and corporate environments. Chris is the author of the Nikto web scanner, founder of the RVAsec conference, and has been involved in many OSS projects and community efforts. Dirsearch is an open-source multi-threaded “web path discovery” tool first released in 2014. The program, written in Python, is similar to other tools such as Dirbuster or Gobuster, and aims to quickly find hidden content on web sites. Dirsearch is still under active development, unlike Dirbuster (and possibly Gobuster), and is focused on path discovery unlike…
U.S. Sanctions Russia’s Aeza Group for aiding crooks with bulletproof hosting Pierluigi Paganini July 02, 2025 U.S. Treasury sanctions Russia-based Aeza Group and affiliates for aiding cybercriminals via bulletproof hosting services. The U.S. Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Russia-based Aeza Group for aiding global cybercriminals via bulletproof hosting services. A bulletproof hosting service is a type of internet hosting provider that knowingly allows cybercriminals to host malicious content or run illegal operations, and helps them stay online even when authorities try to shut them down. Unlike regular hosting companies, bulletproof hosts often ignore abuse reports, turn a…
I last wrote about the Model Context Protocol (MCP) in December 2024, shortly before the topic’s exponential growth into what it is today. I recall thinking at the time that one of the key things I felt had to happen to MCP to make the technology a game changer was the ability for MCP clients to access non-local MCP servers. That’s already happening, of course, but what if you want a piece of this action? How do you go about writing a remote MCP server, crafting useful tools for it, testing it, then deploying it to the cloud, for example, so…
As U.S. federal agencies sharpen their focus on cyber defense and resilience, new leadership is taking shape across top cyber posts. This week, the Senate Homeland Security and Governmental Affairs Committee advanced the nomination of Sean Cairncross to serve as National Cyber Director, while the Federal Bureau of Investigation (FBI) named Brett Leatherman to head its Cyber Division. Meanwhile, the Cybersecurity and Infrastructure Security Agency (CISA) welcomed two new senior officials to help steer its mission. These shifts reflect a broader push to bolster the measures rolled out by the administration of President Donald Trump to counter fast-evolving digital threats.…
In brief Flappy Racquet is a Flappy Bird clone with a tennis twist, featuring stars of the sport like Nick Kyrgios as playable NFT characters. Gamers can earn gems that they can later swap for SCOR tokens after its token generation event on The Open Network. The CEO of developer Sweet says that Telegram gaming isn’t dead, but it still plans to expand beyond the app. Scor on Sweet, a Telegram mini-app ecosystem, has launched a clone of the classic mobile game Flappy Bird—but this time with a tennis twist, featuring stars of the real-world game. Flappy Racquet arrives as…
A report published this week by Netcraft, a provider of a platform for combating phishing attacks, finds that large language models (LLMs) might not be a reliable source when it comes to identifying where to log in to various websites. The post Report Finds LLMs Are Prone to Be Exploited by Phishing Campaigns appeared first on Security Boulevard.
Elon Musk-funded xAI is skipping Grok 3.5 and releasing Grok 4 after Independence Day in the United States, and it could be the best model from the company. Grok 3.5 was originally supposed to be a huge leap from the previous models, but xAI later made several changes to the training model, and that warranted a new version. As spotted by testers on X and confirmed independently by BleepingComputer, xAI Console, which allows developers to access the Grok API, now has references to Grok 4 availability posts. “We’re proud to bring you Grok 4 access on the API. Grok 4…
Qantas has suffered a cyber incident that has lead to a data breach. “The incident occurred when a cyber criminal targeted a call centre and gained access to a third-party customer servicing platform,” the Australian airline announced today, but said that all of its systems remain secure and its operations haven’t been affected. What is known about the cyber incident? Qantas does not say which call center was affected, but the Australian Frequent Flyer reports it’s the one in Manila, which apparently handles most calls and emails related to Qantas Business Rewards, the Qantas Frequent Flyer program, and Qantas Club.…
Truth Social malfunctioned on Saturday night amid President Donald Trump’s announcement that the United States had bombed Iran’s nuclear facilities.Starting around 8 pm ET on Saturday, attempts to load the social network, which is owned by Trump Media & Technology Group (TMTG), displayed error messages. “Network failed,” a message on Truth Social reads. “Please try again.”Trump’s initial Truth Social announcement that the United States had entered Israel’s war against Iran posted at 7:46 pm ET, stating that the US had waged a “very successful attack on the three Nuclear sites in Iran, including Fordow, Natanz, and Esfahan.” Trump’s account on…