0:00 Music 0:06 Why hack websites? 0:09 So people are posting the malicious link. 0:12 They take the database. 0:16 They, you know, drain the CMS or source code for their own purpose. 0:22 They are doing some raking or maybe some political activities, hacktivism, revenge, whatever. 0:32 So some other reasons for hacking. 0:37 You know, mostly people are searching to hack your PC or your credentials to 0:45 sell it or to overuse it or to install some miners or to use your computer for DDoS attacks. 0:55 Obviously, you know, some websites are for sale on the internet. 1:02 So if you want to buy some database, you know, people are selling that stuff for bitcoins or for any other crypto. 1:10 This is example of Bitcoin talk forum. 1:14 On sale database, half of million people who were using the bitcoins or who are using the bitcoins. 1:21 Yeah, some like around 1 million people who use the browsers, adult website are for sale. 1:31 And, you know, $600 only. 1:34 And uTorrent. 1:35 So this is just an example. 1:37 Millions, millions of data like this. 1:41 So this is what we just discussed. 1:45 So how the database got leaked? 1:48 This is what I was like showing you, but usually it is from DORCs. 1:53 It is from the CMS vulnerabilities. 1:55 It is from the backups or from unsafe databases. 2:01 Some docs which you can check, for example, we pick on fig backup. 2:06 TXT. 2:07 It is also a backup of configuration file or database backup, backups, backup, back, old, 2:18 all of that stuff is the same. 2:21 So I was just showing you the most default, like dump scale, but people can use like old or people can use like big, big KP, whatever, like this. 2:35 Yeah. 2:38 So some websites with training, and this is what we just recently discussed. 2:48 So some stories how you can be hacked through stories about you. 2:54 So you register to a dating website on forum or social network. 2:59 And, you know, from that moment, your data already under security risk because that site can be compromised. 3:09 Obviously. 3:10 Or your system administrator put a weak password on your server and you was compromised even in your company, right, where you work. 3:22 So you always rely on somebody with your data. 3:26 And based on the statistics, 3:30 your data is already leaked. 3:32 I think if you use internet for two years, at least you are already leaked. 3:39 But if you just start to use internet and you don't have email and you just sit there without anything, maybe you're good. 3:48 But I'm just saying, if you're doing some activities, 3:51 If you're registering on some forums and using some messengers, most likely the data is in hands of some hackers. 3:59 How they will use it? 4:00 Maybe they will never use it. 4:03 Maybe you change your password, you know, so the data is invalid. 4:08 So something like this. 4:10 Also, very important stuff. 4:14 Have you ever been in the situation when you restored the password and you got your password back? 4:20 So you went, I forgot my password and you get your password back on your email. 4:24 Sometimes people go, I forget password. 4:27 And they ask for password. 4:29 And password comes back to them. 4:32 I mean, for example, you just forgot your password from like, I don't know, Instagram, whatever. 4:38 And you just say, I forgot my password. 4:40 And sometimes you can get the clear text password on your email back. 4:46 What this means, if they send you the temporary password, the temporary password can be brute forced, especially for me personally. 4:55 I had experience with one website, which was like a freelance website. 5:01 So people just provide work there. 5:03 It's like app work, similar. 5:05 And what happened? 5:08 When you go and say, I forgot my password, it will generate you like six digits password. 5:15 And it said, please use it. 5:19 You will have like maybe like five minutes to use it. 5:23 And after, you need to ask it again. 5:26 So what was done? 5:28 It was created a script which took the best guys on this web. 5:34 the top guys, the best talented guys, after they were sorted by the time when they accessed the website. 5:42 If they didn't access the website for one year, it means that that profile can be stolen. 5:49 And after all those guys were like... 5:53 Sent to the page, like forget the password. 5:56 I mean, the usernames were like input, like forgot password. 6:00 So why many guys? 6:01 Because if you take like 50 guys and you say like forget password for 50 guys, like right away, it doesn't have the rate limit, right? 6:09 For like asking, this guy forgot, now this guy forgot, now this guy forgot, doesn't matter, right? 6:15 They would just send 50 keys. 6:18 With six digit numbers and you have one million tries, right? 6:24 One million tries, you divide on 50, you already have like, you know, like 20,000, I think, tries. 6:31 So 20,000 tries, you can easily do within like five minutes using your script or browser. 6:39 So when you're doing this in rotation, like within one hour, you will get all guys.
0:00 Music 0:06 Why hack websites? 0:09 So people are posting the malicious link. 0:12 They take the database. 0:16 They, you know, drain the CMS or source code for their own purpose. 0:22 They are doing some raking or maybe some political activities, hacktivism, revenge, whatever. 0:32 So some other reasons for hacking. 0:37 You know, mostly people are searching to hack your PC or your credentials to 0:45 sell it or to overuse it or to install some miners or to use your computer for DDoS attacks. 0:55 Obviously, you know, some websites are for sale on the internet. 1:02 So if you want to buy some database, you know, people are selling that stuff for bitcoins or for any other crypto. 1:10 This is example of Bitcoin talk forum. 1:14 On sale database, half of million people who were using the bitcoins or who are using the bitcoins. 1:21 Yeah, some like around 1 million people who use the browsers, adult website are for sale. 1:31 And, you know, $600 only. 1:34 And uTorrent. 1:35 So this is just an example. 1:37 Millions, millions of data like this. 1:41 So this is what we just discussed. 1:45 So how the database got leaked? 1:48 This is what I was like showing you, but usually it is from DORCs. 1:53 It is from the CMS vulnerabilities. 1:55 It is from the backups or from unsafe databases. 2:01 Some docs which you can check, for example, we pick on fig backup. 2:06 TXT. 2:07 It is also a backup of configuration file or database backup, backups, backup, back, old, 2:18 all of that stuff is the same. 2:21 So I was just showing you the most default, like dump scale, but people can use like old or people can use like big, big KP, whatever, like this. 2:35 Yeah. 2:38 So some websites with training, and this is what we just recently discussed. 2:48 So some stories how you can be hacked through stories about you. 2:54 So you register to a dating website on forum or social network. 2:59 And, you know, from that moment, your data already under security risk because that site can be compromised. 3:09 Obviously. 3:10 Or your system administrator put a weak password on your server and you was compromised even in your company, right, where you work. 3:22 So you always rely on somebody with your data. 3:26 And based on the statistics, 3:30 your data is already leaked. 3:32 I think if you use internet for two years, at least you are already leaked. 3:39 But if you just start to use internet and you don't have email and you just sit there without anything, maybe you're good. 3:48 But I'm just saying, if you're doing some activities, 3:51 If you're registering on some forums and using some messengers, most likely the data is in hands of some hackers. 3:59 How they will use it? 4:00 Maybe they will never use it. 4:03 Maybe you change your password, you know, so the data is invalid. 4:08 So something like this. 4:10 Also, very important stuff. 4:14 Have you ever been in the situation when you restored the password and you got your password back? 4:20 So you went, I forgot my password and you get your password back on your email. 4:24 Sometimes people go, I forget password. 4:27 And they ask for password. 4:29 And password comes back to them. 4:32 I mean, for example, you just forgot your password from like, I don't know, Instagram, whatever. 4:38 And you just say, I forgot my password. 4:40 And sometimes you can get the clear text password on your email back. 4:46 What this means, if they send you the temporary password, the temporary password can be brute forced, especially for me personally. 4:55 I had experience with one website, which was like a freelance website. 5:01 So people just provide work there. 5:03 It's like app work, similar. 5:05 And what happened? 5:08 When you go and say, I forgot my password, it will generate you like six digits password. 5:15 And it said, please use it. 5:19 You will have like maybe like five minutes to use it. 5:23 And after, you need to ask it again. 5:26 So what was done? 5:28 It was created a script which took the best guys on this web. 5:34 the top guys, the best talented guys, after they were sorted by the time when they accessed the website. 5:42 If they didn't access the website for one year, it means that that profile can be stolen. 5:49 And after all those guys were like... 5:53 Sent to the page, like forget the password. 5:56 I mean, the usernames were like input, like forgot password. 6:00 So why many guys? 6:01 Because if you take like 50 guys and you say like forget password for 50 guys, like right away, it doesn't have the rate limit, right? 6:09 For like asking, this guy forgot, now this guy forgot, now this guy forgot, doesn't matter, right? 6:15 They would just send 50 keys. 6:18 With six digit numbers and you have one million tries, right? 6:24 One million tries, you divide on 50, you already have like, you know, like 20,000, I think, tries. 6:31 So 20,000 tries, you can easily do within like five minutes using your script or browser. 6:39 So when you're doing this in rotation, like within one hour, you will get all guys.