❌

Normal view

There are new articles available, click to refresh the page.
Today — 29 October 2026Main stream

3 ways a Raspberry Pi can cut your bills this weekend, starting with free DVR (Oct 30 - Nov 1)

✇How-To Geek
By: Patrick Campanale
29 October 2026 at 10:00

Your Raspberry Pi is actually capable of helping you save money if you put it to use in the right way. If you’re currently paying for cable with a DVR service, your Raspberry Pi can take over that task. Still paying for a password manager? The Raspberry Pi can handle that, too. Need to track prices for Black Friday? Yep, your Pi is fully capable of doing that, as well. So, here are three projects you can do this weekend on your Raspberry Pi—and none of them will take long to set up.

Password Cracking: Stealing Credentials with PCredz

✇Hackersking
By: noreply@blogger.com (Ratnesh Mishra)
29 October 2026 at 00:06

PCredz is a network credential analysis tool that examines packet captures to identify potentially exposed authentication data. Security professionals can use it to investigate insecure protocols, understand credential exposure, and identify weaknesses in network authentication.

Welcome back, fellow cybersecurity enthusiasts!

In this tutorial, we will explore PCredz, a tool used for network traffic analysis, credential exposure assessment, PCAP analysis, and authentication security testing. Rather than manually inspecting every packet, PCredz can help identify supported authentication artifacts within captured network traffic.

Understanding how credentials travel across a network is an important part of ethical hacking, penetration testing, incident response, and defensive cybersecurity. Analyzing these artifacts can help organizations discover legacy authentication protocols and reduce the risk of credential theft.

Official GitHub repository: PCredz on GitHub

1. What Is PCredz?

PCredz is an open-source tool designed to extract supported credential artifacts and other sensitive information from network packet captures. It is useful when examining traffic generated by older protocols or authentication mechanisms that may expose sensitive information.

Depending on the protocol and the available packet data, PCredz can identify artifacts associated with authentication mechanisms such as NTLM and Kerberos, as well as certain HTTP authentication methods and credentials associated with services such as FTP, POP, SMTP, and IMAP.

It may also identify other sensitive data patterns, including certain payment-card number patterns and SNMP community strings. Detection depends on the capture contents, protocol support, and tool version.

A critical distinction is that finding an authentication artifact does not automatically mean that a valid, reusable password has been recovered. Some protocols expose hashes, challenge-response exchanges, or other material that requires further analysis.

2. Key Features and Capabilities of PCredz

Network Packet Capture Analysis

PCredz can process supported packet capture files, making it useful for investigating previously recorded traffic. PCAP files may contain evidence of insecure authentication, accidental data exposure, or legacy protocols that should be reviewed.

Authentication Artifact Identification

The tool can help identify supported authentication-related data, including certain NTLM and Kerberos artifacts. These findings can support a wider security assessment of authentication configurations and network exposure.

Multiple Protocols

Depending on the captured traffic and implementation, the tool can inspect authentication exchanges associated with several common network services. Support for IPv4 and IPv6 traffic also makes it relevant to mixed network environments.

Structured Output

PCredz can write discovered artifacts to output files, including a credential dump file. Structured output helps security analysts review findings, document evidence, and investigate potential exposure without manually collecting every result.

3. When Would You Use PCredz?

PCredz is relevant to both offensive security assessments and defensive network investigations when its use is explicitly authorized.

Internal Security Assessments

Security teams can analyze approved packet captures to determine whether legacy services or authentication configurations expose sensitive data. The results can help prioritize the migration of insecure services and the improvement of network segmentation.

Incident Response

During an investigation, analysts may inspect existing packet captures for authentication artifacts associated with suspicious activity. Any discovered credentials or hashes should be handled as sensitive evidence and stored securely.

Legacy Protocol Audits

Older business environments may still contain services that use outdated authentication mechanisms or transmit information without adequate protection. PCredz can help identify evidence of these weaknesses when relevant traffic is available.

Security Training and Research

In a controlled lab, PCredz can demonstrate why encrypted transport, modern authentication, and strong network security policies matter. Students can compare insecure and secure authentication configurations using traffic generated specifically for the exercise.

Important: Only inspect traffic that you own or are explicitly authorized to analyze. Captured network traffic can contain personal information, session tokens, credentials, and other confidential data.

4. Installing PCredz on Linux

PCredz is available through its official GitHub repository. Before installation, review the repository's current instructions and dependencies. The commands below illustrate a basic Linux setup; exact requirements may vary with the current version of the project and your distribution.

Step 1: Install the Required Packages

On Debian-based systems, such as Kali Linux, update the package index and install Python virtual environment support and relevant development dependencies.

sudo apt update
sudo apt install python3 python3-venv python3-pip
sudo apt install libpcap-dev file git

Step 2: Clone the Official Repository

git clone https://github.com/lgandx/pcredz.git
cd pcredz

Step 3: Create a Virtual Environment

A Python virtual environment keeps project dependencies separate from system-wide Python packages. This is particularly useful on recent Kali Linux and Debian releases, where system Python environments are managed by the operating system.

python3 -m venv pcredz-env
source pcredz-env/bin/activate

Step 4: Review and Install Dependencies

Check the repository for its current dependency instructions before installing packages. If the project provides a requirements file, review it and install the documented dependencies inside the activated environment.

python -m pip install --upgrade pip
# If the repository provides requirements.txt:
python -m pip install -r requirements.txt

Do not assume that every version of PCredz uses the same dependency list. If installation fails, consult the official repository documentation and the error message before changing system packages.

5. Understanding Live Network Traffic Analysis

Live traffic analysis involves examining packets as they pass through a network interface. It can help authorized network administrators identify insecure authentication exchanges and investigate suspicious network activity.

Before performing live capture, identify the correct interface and verify that the capture is approved by the network owner. Interface names differ between systems, so do not assume that every machine uses eth0.

To list available interfaces, use:

ip -br addr

For an authorized assessment, follow the current usage instructions provided by the official PCredz repository. Confirm that the selected interface is appropriate and that the capture scope is limited to the approved environment.

Capturing on an interface does not guarantee visibility into all network traffic. Switching infrastructure, VLAN configuration, Wi-Fi encryption, virtualization, and network topology can affect which packets are observable.

6. Analyzing Existing PCAP Files

Offline PCAP analysis allows investigators to examine previously captured network traffic without continuously monitoring a live interface. This can be useful for incident response, security audits, and controlled training exercises.

PCAP files are commonly generated by packet analysis tools such as Wireshark and tcpdump.

Inspecting a Capture with Wireshark

Open the authorized PCAP file in Wireshark and examine the relevant protocols, endpoints, and authentication exchanges. Display filters can help narrow the investigation to specific protocols or conversations.

When reviewing a capture, pay particular attention to:

  • Services that use unencrypted or inadequately protected communication.
  • Authentication exchanges involving legacy protocols.
  • Unexpected connections to internal services.
  • Sensitive information accidentally included in application traffic.
  • Repeated authentication failures or unusual communication patterns.

Using PCredz for Offline Analysis

When using PCredz against an authorized capture, consult the current repository documentation for the supported command-line options.

The project's documented usage includes options for processing a capture file or a directory of captures. Confirm the precise syntax for your installed version before running an analysis.

After processing, store the results in a protected directory. Review the output carefully, because a discovered artifact may require additional context before it can be classified as a security finding.

Evidence-handling tip: Preserve the original capture, record its cryptographic hash when appropriate, document the analysis environment, and restrict access to extracted data. Avoid transferring confidential PCAP files to third-party systems unless that transfer is explicitly authorized.

7. PCredz and Hashcat: Understanding the Difference

PCredz and Hashcat serve different purposes in a security assessment.

PCredz identifies supported credential-related artifacts in captured network traffic. Hashcat is a password recovery and password-strength auditing tool that supports many hash formats.

Some authentication artifacts identified by PCredz may be suitable for further analysis with a compatible password-auditing tool. Compatibility depends on the exact artifact format, the protocol, and the supported mode in the installed version.

For example, Hashcat documents different modes for certain NTLM and Kerberos-related formats. A mode number must not be selected solely from a generic label: analysts should verify the exact format against the official documentation.

Hash analysis can help organizations determine whether their password policies resist common guessing attacks. A recovered password, however, does not by itself establish that an account is currently accessible or that the account has elevated privileges.

Official resource: Hashcat.

8. Security Risks and Defensive Measures

Credential exposure can allow an attacker to impersonate users, access internal services, or attempt further compromise. The actual risk depends on the credential type, account privileges, network architecture, and additional security controls.

Use Encrypted Protocols

Replace insecure protocols with appropriately configured encrypted alternatives. Use HTTPS for web applications and secure configurations for remote administration, email, and file transfer.

Strengthen Authentication

Use modern authentication mechanisms wherever possible. Disable obsolete authentication methods when they are no longer required, and enforce multifactor authentication for sensitive accounts and remote access.

Reduce Credential Reuse

Encourage unique passwords and use an approved password manager. Privileged accounts should have separate credentials and carefully controlled access.

Apply Least Privilege

Give users and services only the permissions they need. Segment sensitive systems and restrict unnecessary communication between network zones.

Monitor and Respond

Monitor authentication logs for suspicious access, repeated failures, unusual source systems, and unexpected use of privileged accounts. If credential exposure is confirmed, follow the incident response process, rotate affected credentials, and revoke compromised sessions where appropriate.

9. Common Misconceptions About PCredz

Does PCredz Crack Every Password?

No. PCredz is primarily used to identify supported artifacts in network traffic. Whether a password can be recovered depends on the data captured, the authentication protocol, and the availability of a compatible analysis method.

Can It Read Every HTTPS Password?

No. Properly configured HTTPS encrypts application traffic in transit. A normal packet capture generally cannot reveal the protected application contents simply because PCredz is being used.

Does Finding a Hash Mean an Account Is Compromised?

Not necessarily. A hash or authentication exchange must be assessed in context. Its security impact depends on the protocol, account status, password strength, and whether the artifact can be abused.

Is Live Capture Always Better Than Offline Analysis?

No. Live capture may help investigate current activity, while offline analysis is often more suitable for examining preserved evidence. The right approach depends on the investigation scope, authorization, and operational requirements.

10. Conclusion

PCredz is a useful tool for understanding credential exposure in network traffic. By examining authorized packet captures, cybersecurity professionals can identify authentication artifacts, investigate legacy protocols, and discover weaknesses that require remediation.

However, the value of PCredz goes beyond extracting data. Its findings can help organizations improve encryption, modernize authentication, reduce password reuse, and strengthen their incident response practices.

For anyone learning network security, the key takeaway is simple: understanding how authentication data moves across a network is essential to protecting it.

For more cybersecurity tutorials, ethical hacking resources, OSINT guides, and network security insights, visit Hackersking.

Topics covered: PCredz tutorial, PCredz Kali Linux, network credential analysis, PCAP analysis, network traffic analysis, NTLM authentication, Kerberos authentication, Hashcat, password security, ethical hacking tools, cybersecurity tools, incident response, network security, penetration testing, information security.
```

Yesterday — 28 October 2026Main stream

Trenton Johnston sentenced in $13M Bitcoin scam after Discord boasts

✇Crypto News
By: Lawrence Mondal
28 October 2026 at 15:49
Trenton Johnston has been sentenced in Miami for his role in a cryptocurrency laundering scheme involving more than $13 million in stolen funds, after investigators linked the Canadian to fake support calls and demonstrations of his methods on Discord. According…

Before yesterdayMain stream

Attackers Abuse Legitimate Infrastructure to Distribute Phishing Emails

✇KnowBe4 Security
By: KnowBe4 Team
27 October 2026 at 12:00

Researchers at Cisco Talos are tracking a significant increase in phishing campaigns that abuse legitimate platforms. Attackers abused more than 25 legitimate services over the past year, including “collaboration, productivity, file-sharing, survey, payment and AI-related platforms.”

In two campaigns, attackers used order notifications from Staples and Dell to distribute phishing messages. The organizations themselves were not compromised, but the threat actors inserted phishing content into the fields that were supposed to contain shipping information.

How Bad Is That Bridge: A Government Database

✇Hackaday
By: Zoe Skyforest
27 October 2026 at 10:40

Bridges! We kind of expect them to just be there and do their job, ad infinitum. They are built into the landscape, and we often take them and the routes they open up for granted.

The reality, as any civil engineer will tell you, is that bridges are living, breathing things that require endless maintenance and monitoring to keep them safe, standing, and functional. A great example of this is found in the US Department of Transportation, and its publicly accessible register of bridge health reports.

Stay Standing

The thing about bridges is that we rely on them. They serve as vital transport links in our communities, ferrying people to and from work and school, and acting as the very arteries of commerce as trucks and trains haul goods to and fro. When a bridge crossing has to close, either for maintenance or at end of life, this link is severed, often with serious economic and logistical impacts. For that reason, we tend to like to keep our bridges in service as long as possible. The result, of course, is that if pursuing this goal means that proper maintenance and repairs aren’t seen to, there is a risk of collapse—which often comes with worse consequences. Loss of life is common when bridges fail, and replacing a collapsed bridge is often much harder and more time consuming than handling things properly ahead of time.

In the United States, it’s a well known fact that the bridges are getting old. The average bridge is 44 years old, which is bumping up against the 50-year service limit many were originally built for. Being an average number, it’s indicative that many bridges are exceeding that figure significantly. Obviously, a bridge’s age isn’t a perfect proxy for its condition, but closer examinations indicate there’s definitely a problem. A 2024 report from the American Road & Transportation Builders Association noted that 36 percent of US bridges are in need of repair or replacement, a total of 221,800 spans. 42,067 spans were considered to be in “poor” condition, which in their total see 168.5 million motorists crossing them every day. It’s a particularly sobering figure as it highlights the size of the disaster possible if these structures are to fail.

InfoBridge quickly lets you sort through data by all kinds of different factors. If you’re looking for the worst bridges in town, it’s easy to flick through CAT10 – BRIDGE CONDITION to see which bridges as listed as Good, Fair, or Poor. Bridges are rated on the condition of their deck, superstructure, and substructure, and the lowest scoring section influences which bin the bridge lands in, as per federal code—specifically, 23 CFR 490 Subpart D. Credit: InfoBridge screenshot

You can drill down into the data yourself if you desire. Within the Department of Transport, the Federal Highway Administration maintains LTBP InfoBridge, a database of information on bridges all across the country. It was developed by the Long Term Bridge Performance program, because the goal of the project is to understand how these structures hold up and perform over the decades. The database is publicly accessible, and serves as a portal for all the available data and statistics on how US bridges are doing. It hopes to enable everyone from state and federal authorities, to university students, faculty, and other researchers, to dive into bridge data and visualize and understand it better.

Data available is from a wide number of sources, including the National Bridge Inventory and National Bridge Element datasets, as well as climatic data collected from NASA’s MERRA-2 database. There’s also construction and design data sourced by the LTBP program, along with non-destructive evaluations that have been carried out. Data from various other special projects is available too, such as from Federal Highway Administration projects investigating timber bridges, steel weathering, and the use of ultra-high performance concrete structures.

Just glancing at the Vincent Thomas bridge won’t tell you how the structure is doing. Credit: The Port of Authority, CC BY-SA 3.0

If you have a particular bridge of interest, it’s easy to get a quick break down of how it’s doing. For example, you might like to know about the Vincent Thomas Bridge, in Los Angeles, California: National Bridge Inventory number 53 1471. It links San Pedro with Terminal Island, and is a suspension bridge with a total length of 6,060 feet and a longest span of 1,500 feet. Built in 1963, we can see from the data alone that it’s now showing its age.

The bridge condition is listed as “Poor,” and if we dive deeper into the National Bridge Elements data, we can see why. The health indexes of the deck, substructure, and superstructure have all been trending down in recent years as the bridge’s age has increased, with a particular drop off from 2019 or so. In particular, the steel cables and girders on the bridge have been showing their age, and the concrete columns supporting the bridge have been similarly degrading. The deck, too, is in need of repair, with the California Department of Transport recently dedicating some $706 million to replace it ahead of the 2028 Olympic Games.

However, InfoBridge will let you drill down into detailed reports on the bridge conditions, down to a level which indicates which parts of the bridge are most in need of maintenance, repair, or replacement. Credit: Screenshot, InfoBridge

InfoBridge also offers condition forecasts for many bridges across the country. For example, the 24th Street Bridge over Rio Linda Creek is currently listed as being in “Good” condition. Current forecasts show that the deck and superstructure is expected to be in much poorer shape somewhere between 2035 and 2055, while the substructure is expected to hang on in good shape for a bit longer.

The Long Term Bridge Performance Program has developed a variety of models—base, survival, and machine-learning—to predict bridge condition over time. The aim is to guide maintenance efforts over time and allow for better planning. Credit: InfoBridge, screenshot

You might think that you’d have to query a government department and delve deep into some dusty records room to learn about the condition of your local bridges. Instead, thanks to the efforts of diligent civil servants, you can instead access all the rich inspection data you like from the comfort of your own web browser. It’s not just good for citizen oversight, either. It aids local authorities and bridge owners in making the right decisions, by putting the necessary data right at their fingertips.

It also creates a certain level of accountability—having the data available means there’s little room for anyone to make excuses that they were unaware of a bridge’s condition prior to something going wrong. Ultimately, it’s just one arm of a project that hopes to take US bridges safely long into the future.

Featured image: “Brooklyn Bridge – New York City” by [Simone Roda]

4 captivating Paramount+ movies to watch this week (October 26-November 1)

✇How-To Geek
By: Tyler Dupont
26 October 2026 at 16:16

Paramount has been one of the biggest names in the movie industry for a long time, and they have utilized that legacy to give us a strong streaming service with a pretty vast library. What I find so appealing about their platform is their catalog of movies, with hits from just about every era and genre ready to satisfy whatever craving I happen to have each week.

5 excellent new movies to watch this week across Netflix, Paramount+, and more (October 26-November 1)

✇How-To Geek
By: Dan Girolamo
26 October 2026 at 11:00

It's the final week of October, which means spooky season is coming to an end. There are plenty of horror movies to watch on Netflix, including Friday the 13th and The Texas Chain Saw Massacre. This week's list of movies heading to streaming is not made up entirely of horror movies, but there are some tense thrillers, including a wild documentary on Paramount+.

WHOOP to Study Wearable Coaching for Blood Sugar and Blood Pressure

✇TechRepublic
By: Liz Ticong
26 October 2026 at 07:24

WHOOP plans to test whether wearable coaching can help improve blood sugar and blood pressure. See how its Abu Dhabi study could affect future health wearables.

The post WHOOP to Study Wearable Coaching for Blood Sugar and Blood Pressure appeared first on TechRepublic.

WHOOP to Study Wearable Coaching for Blood Sugar and Blood Pressure

✇TechRepublic
By: Liz Ticong
26 October 2026 at 07:24

WHOOP plans to test whether wearable coaching can help improve blood sugar and blood pressure. See how its Abu Dhabi study could affect future health wearables.

The post WHOOP to Study Wearable Coaching for Blood Sugar and Blood Pressure appeared first on TechRepublic.

[Cybersecurity Awareness Month] Why Your Best Incident Reporting Tool Is Behavioral, Not Software

✇KnowBe4 Security
By: Javvad Malik
26 October 2026 at 10:00

During an incident, the most valuable intel is from people on the ground. Security teams rely on their colleagues across the organization to report issues quickly and without trying to fix things themselves.

3 exciting Netflix thrillers to watch this week (October 26-November 1)

✇How-To Geek
By: Dan Girolamo
25 October 2026 at 18:00

October is slowly coming to an end, but Halloween is still a top priority for Netflix. The streamer has plenty of horror hits for spooky season, including The Black Phone and Fear Street. I don't mind watching something that can scare me, but I prefer to stream thrillers.

FCA Proposes Crypto Crime Guidance On Wallet Checks And Blockchain Analytics

✇NewsBTC
By: NewsBTC Editorial Team
24 October 2026 at 16:00

TL;DR: The FCA is consulting on updated financial crime guidance for crypto businesses, including customer checks, blockchain analytics and the Travel Rule. Responses are due December 24, and the guide itself would not create new rules.

Crypto businesses preparing for the UK’s expanded regulatory regime have a more detailed picture of the controls the Financial Conduct Authority expects them to build.

The regulator’s October 23 consultation proposes changes to its Financial Crime Guide, covering cryptoassets alongside fraud, sanctions, data security and money laundering. The proposals apply to the FCA’s financial crime supervisory population, including cryptoasset businesses and firms overseen under the Money Laundering Regulations.

The practical focus is on how firms assess customers and transactions, and how they react when risk changes. A blockchain record can help an investigation, but a record alone does not decide whether a customer explanation is credible or a transfer needs further scrutiny.

Analytics Must Sit Inside A Working Control System

The consultation paper proposes examples of good and poor practice for enhanced due diligence, onboarding and transaction monitoring. It specifically addresses the use of blockchain analytics and further guidance on the Travel Rule, which concerns information accompanying certain transfers.

The paper also reminds firms that governance must evolve as their businesses grow. Its proposed changes include a question about whether policies and staff training distinguish obligations under proceeds-of-crime legislation from those under terrorism legislation.

For an exchange or provider of custody, the implication is that buying a screening product is only one part of the job. Someone still has to set its thresholds, review alerts and document decisions. A technically accurate warning is of limited use if it sits unreviewed while funds move elsewhere.

That matters for stablecoin transfers as much as for volatile tokens. A stable unit price does not establish the identity of a sender or the origin of funds. Transaction risk and market risk are different questions, and control systems need to reflect that distinction.

Guidance Now, A Wider Regime In 2027

The FCA says the guide contains no rules and imposes no new requirements. It is intended to help firms understand supervisory expectations and assess their own arrangements. The consultation closes on December 24, after which the regulator plans to publish feedback and the final text in a policy statement.

Separately, the FCA’s regime overview says the wider cryptoasset framework is expected to begin on October 25, 2027. Applications for authorization are already open, and the regulator published a package of final rules in June.

The distinction between those stages matters for firms planning investment in compliance. This consultation does not postpone existing anti-money-laundering duties until next year, nor does it bring the whole future regime into force immediately. It fills in the proposed guidance firms can use when translating their obligations into day-to-day decisions.

Written by the News Desk and edited by Samuel Rae.

3 sinister Paramount+ thrillers to watch this weekend (October 23-25)

✇How-To Geek
By: Tyler Dupont
24 October 2026 at 14:00

We're getting closer to Halloween by the day, and it is the perfect time for some content that will bring the thrills. While horror movies are great, some people prefer something a little more psychological, which is where the picks on this list come in. They might not feature the supernatural, but they will still haunt you long after you've switched off your TV.

5 new and returning shows to watch this weekend on Netflix, Prime Video, and more (October 23-25)

✇How-To Geek
By: Dan Girolamo
23 October 2026 at 18:00

What should you watch this weekend? If you're staying home to watch something on streaming, NBC has a sitcom about a newly married couple that might suit your interests. On Hulu, an intriguing mystery comedy premiered earlier this week and has already attracted attention.

❌
❌