The image above basically says it all, Two-factor or Multi-factor Authentication is just a Waste of Time!
Instead of complicating and wasting time with 2, 3, 4, 1000, Multi or Infinite-factor Authentication, we must keep things as simple as possible, we need to make a strong and secure "One-factor Authentication", or, 1FA, if you prefer!
In order to use a strong and secure "One-factor Authentication" (1FA), you just need to use a real password manager like Multi One Password (Click here), a password manager that does not store passwords neither locally in the users devices nor in the cloud! (Note that, almost all password managers available out there are not really password managers, they are Note managers!)
Saying that, let's go back to Two-factor or Multi-factor Authentication, some big companies, like Google for example, are trying to make them standard since 2009 or 2010, but still almost all people refuse to use them because they bring too much unnecessary problems and headaches, and they are absolutely right for not using them!
As already said above, these big companies have been putting big money in 2FA/MFA since 2009/2010, now they want "Return on Investment" (ROI), so they want to force 2FA/MFA on everybody, even though 2FA/MFA is proving to be a Waste of Time and a Big Failure!
2FA/MFA is not the answer! If hackers can steal your passwords, they can steal your 2FA/MFA information as well!
There are a lot of people living nightmares because they decided to use 2FA/MFA, and now they regret for doing it so!
2FA/MFA makes use of backup codes! Backup codes can either be stolen or breached, thus, 2FA/MFA is just an extra headache that causes a lot of unnecessary problems!
If hackers ask you for your passwords and you give them your passwords, they will also ask you for your 2FA/MFA backup codes and you will give them the backup codes!
If Passwords can be breached from servers, 2FA/MFA backup codes can also be breached from servers!
If a data breach from a server contains passwords, it will certainly contain 2FA/MFA backup codes as well!
A data breach can also contain active-sessions, active-logged-in-devices, etc data, and hackers can use them to bypass 2FA\MFA as well!
If you use public wifi\wired networks with some frequency, hackers could easily intercept the data your devices send\receive in the network (cookies, active-session, etc) and use that data to bypass 2FA\MFA! (Especially public wifi networks that don't require passwords to access)
Websites decide if backup codes are used or not, and almost all of them use backup codes for their 2FA/MFA implementation, and if they don't, pray to GODS to never lose your 2FA/MFA devices or physical keys, because if you do, well, you must prepare yourself to live Nightmares after Nightmares, being locked from your accounts for 1, 2, 3 or even more months/years, and like in many cases, For Ever!
"Passcode-Factor Authentication", a Perfect Solution for Password Reuse! (Click Here)
Thirdly, in order to run codes in "Browser" console, "devtools.chrome.enabled" from "about:config" must be set to "true"! (See the image above for more details!)
Below is the code to Create "New Tor Circuit" for a given domain:
Change "w3schools.com" to any other domain you want! (It must be "Domain.com", not "www.Domain.com"! For example, "www.w3schools.com" does not work!)
After executing the code, open "w3schools.com" in a new "tab", or just reload the current open tab, and you will notice that the "Tor circuit" was changed!
Is it possible to DDOS by uploading files, logging-in, sending posts, sending emails, searching or just by sending multiple Http requests to websites?
Download the files from the videos and do your own tests!
Use at your own risk! (This is mainly to be used by developers on their own websites!)
v1.2:
https://www.mediafire.com/file/o15geddihh2bdjy/DDOS_File_Upload_%2528v1.2%2529.rar/file
v1.2:
- "Every" option added! (Send x number of "Request\s" at every given time!)
- "Server Response Timeout" option added!
- Some infos and codes related to "Freeing Ram Memory" added!
- "Response Text Contains" added! (Informs if a server response contains words such as "Cloudflare", "Access denied", "rate limit", etc!)
v1.1:
- "Repeat" option added! (When a "request" terminates, a new "request" initiates!)
Keywords:
#html #css #javascript #php #dos #ddos
 |
 |
 |
|---|
"spoofed.jpg.php" is a spoofed "jpg" file with a "php" code appended at the end of the image-binary-data with "HxD" binary\hex editor tool!
Extension check is useful to prevent files to be stored in the server with dangerous extensions such as ".php,.xml,.html, etc"!
"mime_content_type" and "exif_imagetype" should be used for identification purposes only, not for security purposes!
The above functions should not be used for security purposes because both of them allow spoofed files!
A spoofed file is, for example, a "jpg" image file with a "php" code appended at the end of the image-binary-data!
This page just demonstrates a simple example on how it's dangerous to use "$_FILES['file']['name']" with "mime_content_type" or "exif_imagetype" functions!
Download the files below and do your own tests:
https://www.mediafire.com/file/zm9q2a7uoel2zn9/PHP_-_Upload_Spoofed_Files.rar/file
