Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Why Choose a Cold Wallet?
https://cdn-images-1.medium.com/max/1408/0*WZ69BORa2VJDqN3B.png
Cryptocurrency has seen its fair share of hacks and cybersecurity risks.
Continue reading on Medium »
Why Choose a Cold Wallet?
https://cdn-images-1.medium.com/max/1408/0*WZ69BORa2VJDqN3B.png
Cryptocurrency has seen its fair share of hacks and cybersecurity risks.
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Network Attacks Tutorials | Insecure Lab
https://cdn-images-1.medium.com/max/940/1*2seDR5kJirYz5xk7qJtG3w.jpeg
Network attacks tutorials are a valuable resource for security professionals and ethical hackers to gain insight into potential…
Continue reading on Medium »
Network Attacks Tutorials | Insecure Lab
https://cdn-images-1.medium.com/max/940/1*2seDR5kJirYz5xk7qJtG3w.jpeg
Network attacks tutorials are a valuable resource for security professionals and ethical hackers to gain insight into potential…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Hacking Obsidian: Frontmatter and Templater
https://cdn-images-1.medium.com/max/833/1*_WA1wh2J7_wZjj5arXBzjg.jpeg
Prevent frontmatter from templater templates from showing up as metdata.
Continue reading on Obsidian Observer »
Hacking Obsidian: Frontmatter and Templater
https://cdn-images-1.medium.com/max/833/1*_WA1wh2J7_wZjj5arXBzjg.jpeg
Prevent frontmatter from templater templates from showing up as metdata.
Continue reading on Obsidian Observer »
Black Hat Ethical Hacking
Hackers Use New PowerExchange Malware to Target Microsoft Exchange Servers
Hackers Use New PowerExchange Malware to Target Microsoft Exchange ServersPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes
FortiGuard Labs Threat Research team has recently uncovered a highly sophisticated and alarming cyber threat: a new PowerShell-based malware named PowerExchange. This malware has been utilized by the notorious Iranian state-backed hacking group known as APT34 or Oilrig. Their primary target? On-premise Microsoft Exchange servers, which are widely used by organizations for email communication.
The attack vector employed by APT34 involves luring unsuspecting victims through phishing emails. These emails contain an archived malicious executable that, when executed, allows the threat actors to gain unauthorized access to the targeted mail server. Once inside, they deploy a web shell called ExchangeLeech, which was first identified by the Digital14 Incident Response team back in 2020. This web shell operates stealthily in the background, enabling the hackers to steal crucial user credentials.
What sets PowerExchange apart from other malware is its unique communication method with a command-and-control (C2) server. Unlike traditional malware that relies on direct network connections, PowerExchange communicates via emails using the Exchange Web Services (EWS) API. The malware sends stolen information and receives base64-encoded commands through text attachments within emails that have the subject line “Update Microsoft Edge.” By utilizing the victim’s Exchange server as the C2 channel, the backdoor can effectively blend in with benign network traffic, making it extremely difficult to detect and remediate by network-based security measures.
https://www.bleepstatic.com/images/news/u/1109292/2023/PowerExchange_infection_chain.png PowerExchange infection chain (FortiGuard Labs)
See Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses PowerExchange Malware – Advanced Tool for Remote Control and Data TheftOnce the hackers have established control over the compromised servers, they have a wide range of capabilities at their disposal. PowerExchange allows them to execute commands remotely, delivering additional malicious payloads to the hacked servers and exfiltrating sensitive files from the victim’s network. Furthermore, during the forensic investigation conducted by FortiGuard Labs, additional backdoored endpoints with various other malicious implants were discovered, indicating a more extensive compromise.
FortiGuard Labs has drawn connections between the PowerExchange malware and APT34’s previous activities, specifically their use of TriFive malware to backdoor the servers of Kuwaiti government organizations. Both backdoors share significant similarities, such as being written in PowerShell, activation through a periodic scheduled task, and leveraging the organization’s Exchange server with the EWS API for C2 communication. While there are notable differences in the code, the researchers speculate that PowerExchange represents an evolved and improved form of TriFive.
Trending: Maximizing IDOR Detection with Burp Suite’s Autorize Trending: Recon Tool: Dome It’s worth noting that APT34 has a history of utilizing phishing emails as an initial infection vector and has previously breached various entities in the United Arab Emirates. The discovery of PowerExchange reinforces the group’s relentless pursuit of sophisticated cyberattacks and highlights the increasing need for robust security measures to protect critical infrastructure.[...]
Hackers Use New PowerExchange Malware to Target Microsoft Exchange Servers
Hackers Use New PowerExchange Malware to Target Microsoft Exchange ServersPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes
FortiGuard Labs Threat Research team has recently uncovered a highly sophisticated and alarming cyber threat: a new PowerShell-based malware named PowerExchange. This malware has been utilized by the notorious Iranian state-backed hacking group known as APT34 or Oilrig. Their primary target? On-premise Microsoft Exchange servers, which are widely used by organizations for email communication.
The attack vector employed by APT34 involves luring unsuspecting victims through phishing emails. These emails contain an archived malicious executable that, when executed, allows the threat actors to gain unauthorized access to the targeted mail server. Once inside, they deploy a web shell called ExchangeLeech, which was first identified by the Digital14 Incident Response team back in 2020. This web shell operates stealthily in the background, enabling the hackers to steal crucial user credentials.
What sets PowerExchange apart from other malware is its unique communication method with a command-and-control (C2) server. Unlike traditional malware that relies on direct network connections, PowerExchange communicates via emails using the Exchange Web Services (EWS) API. The malware sends stolen information and receives base64-encoded commands through text attachments within emails that have the subject line “Update Microsoft Edge.” By utilizing the victim’s Exchange server as the C2 channel, the backdoor can effectively blend in with benign network traffic, making it extremely difficult to detect and remediate by network-based security measures.
https://www.bleepstatic.com/images/news/u/1109292/2023/PowerExchange_infection_chain.png PowerExchange infection chain (FortiGuard Labs)
See Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses PowerExchange Malware – Advanced Tool for Remote Control and Data TheftOnce the hackers have established control over the compromised servers, they have a wide range of capabilities at their disposal. PowerExchange allows them to execute commands remotely, delivering additional malicious payloads to the hacked servers and exfiltrating sensitive files from the victim’s network. Furthermore, during the forensic investigation conducted by FortiGuard Labs, additional backdoored endpoints with various other malicious implants were discovered, indicating a more extensive compromise.
FortiGuard Labs has drawn connections between the PowerExchange malware and APT34’s previous activities, specifically their use of TriFive malware to backdoor the servers of Kuwaiti government organizations. Both backdoors share significant similarities, such as being written in PowerShell, activation through a periodic scheduled task, and leveraging the organization’s Exchange server with the EWS API for C2 communication. While there are notable differences in the code, the researchers speculate that PowerExchange represents an evolved and improved form of TriFive.
Trending: Maximizing IDOR Detection with Burp Suite’s Autorize Trending: Recon Tool: Dome It’s worth noting that APT34 has a history of utilizing phishing emails as an initial infection vector and has previously breached various entities in the United Arab Emirates. The discovery of PowerExchange reinforces the group’s relentless pursuit of sophisticated cyberattacks and highlights the increasing need for robust security measures to protect critical infrastructure.[...]
Black Hat Ethical Hacking
Hackers Use New PowerExchange Malware to Target Microsoft Exchange Servers | Black Hat Ethical Hacking
FortiGuard Labs Threat Research team has recently uncovered a highly sophisticated and alarming cyber threat: a new PowerShell-based malware named PowerExchange.
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Hackers Use New PowerExchange Malware to Target Microsoft Exchange Servers Hackers Use New PowerExchange Malware to Target Microsoft Exchange ServersPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/…
The cybersecurity community and organizations utilizing Microsoft Exchange servers are urged to remain vigilant, implement strong security practices, and promptly apply relevant patches and updates to safeguard against evolving threats like PowerExchange.
Trending: Hackers Exploit Critical WordPress Plugin Vulnerability Within Hours of Public PoC Release Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Store.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/05/Images-for-the-News-posts-13-1-300x150.png AhRat Malware Strikes Again with Trojanized Screen Recording AppMay 24, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/05/Images-for-the-News-posts-12-1-300x150.png BlackCat Ransomware Evades Security Software with Signed Malicious Windows Kernel DriversMay 23, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/05/Images-for-the-News-posts-11-1-300x150.png BrutePrint Attack: Researchers Unveil New Technique to Bypass Smartphone Fingerprint AuthenticationMay 22, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/05/Images-for-the-News-posts-10-1-300x150.png WordPress Websites at Risk – Hackers Exploit Critical Flaw in Essential Addons for ElementorMay 19, 2023 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now! https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Solutions.png Information Security SolutionsFind out how Pentesting Services can help you.
The post Hackers Use New PowerExchange Malware to Target Microsoft Exchange Servers first appeared on Black Hat Ethical Hacking.
Trending: Hackers Exploit Critical WordPress Plugin Vulnerability Within Hours of Public PoC Release Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Store.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/05/Images-for-the-News-posts-13-1-300x150.png AhRat Malware Strikes Again with Trojanized Screen Recording AppMay 24, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/05/Images-for-the-News-posts-12-1-300x150.png BlackCat Ransomware Evades Security Software with Signed Malicious Windows Kernel DriversMay 23, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/05/Images-for-the-News-posts-11-1-300x150.png BrutePrint Attack: Researchers Unveil New Technique to Bypass Smartphone Fingerprint AuthenticationMay 22, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/05/Images-for-the-News-posts-10-1-300x150.png WordPress Websites at Risk – Hackers Exploit Critical Flaw in Essential Addons for ElementorMay 19, 2023 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now! https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Solutions.png Information Security SolutionsFind out how Pentesting Services can help you.
The post Hackers Use New PowerExchange Malware to Target Microsoft Exchange Servers first appeared on Black Hat Ethical Hacking.
Price Manipulation Vulnerability: Potential Exploitation in Dating Website
https://medium.com/@cyber.jemin/price-manipulation-vulnerability-potential-exploitation-in-dating-website-d1a7438c5eeb?source=rss------bug_bounty-5
https://medium.com/@cyber.jemin/price-manipulation-vulnerability-potential-exploitation-in-dating-website-d1a7438c5eeb?source=rss------bug_bounty-5
Parameter Tempering !!Continue reading on Medium » (https://medium.com/@cyber.jemin/price-manipulation-vulnerability-potential-exploitation-in-dating-website-d1a7438c5eeb?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Anyone have any idea what MyIPHide does differently?
So recently I was trying to find a way to get a VPN/proxy onto my school's computers and tried running a lot of different VPNs, paid (Surfshark, Nord) and free (Proton, HotSpotShield, etc.) and some proxies and nothing worked no matter the protocol until MyIPHide. Whilst you needed to connect to a hotspot for a second and use it to log in as the MyIPHide servers were blocked, the proxy could then be used as you like. I originally tested these on a BYO laptop but then to get it onto the school PCs I pulled all the dependencies/installation files together with Enigma Virtualbox and then hid it inside an MS Word file as you couldn't download an EXE off of Google Drive onto them. This worked but once again it requires you to connect your mobile hotspot for a bit and it's quite slow.
So then another project I also tried before this was building my own Wireshark VPN over DoH/Web sockets (not really sure of the terminology here pls read the notes) as every other port is blocked in the school following these notes. This did not work, I suspect due to Deep Packet Inspection on the school's part.
Now I would like to have a go at building my own VPN/Proxy like MyIPHide but routed to my own home rather than MyIPHide's US servers, which are quite a bit further. The problem is, MyIPHide is not open-source, nor are its workings available anywhere I can find. This is where I was hoping someone here could help, does anyone have any idea what MyIPHide does to make this work? Or am I being stupid here and this project isn't possible? I'm in Y9 and quite new to networking/hacking so I think it might be the latter but would appreciate any help.
Thanks in advance!
submitted by /u/RSCoder7
[link] [comments]
Anyone have any idea what MyIPHide does differently?
So recently I was trying to find a way to get a VPN/proxy onto my school's computers and tried running a lot of different VPNs, paid (Surfshark, Nord) and free (Proton, HotSpotShield, etc.) and some proxies and nothing worked no matter the protocol until MyIPHide. Whilst you needed to connect to a hotspot for a second and use it to log in as the MyIPHide servers were blocked, the proxy could then be used as you like. I originally tested these on a BYO laptop but then to get it onto the school PCs I pulled all the dependencies/installation files together with Enigma Virtualbox and then hid it inside an MS Word file as you couldn't download an EXE off of Google Drive onto them. This worked but once again it requires you to connect your mobile hotspot for a bit and it's quite slow.
So then another project I also tried before this was building my own Wireshark VPN over DoH/Web sockets (not really sure of the terminology here pls read the notes) as every other port is blocked in the school following these notes. This did not work, I suspect due to Deep Packet Inspection on the school's part.
Now I would like to have a go at building my own VPN/Proxy like MyIPHide but routed to my own home rather than MyIPHide's US servers, which are quite a bit further. The problem is, MyIPHide is not open-source, nor are its workings available anywhere I can find. This is where I was hoping someone here could help, does anyone have any idea what MyIPHide does to make this work? Or am I being stupid here and this project isn't possible? I'm in Y9 and quite new to networking/hacking so I think it might be the latter but would appreciate any help.
Thanks in advance!
submitted by /u/RSCoder7
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
SQL Injection into a MySQL update query
I have a web app that has a vulnerability that allows sql injection into an update query.
So for example, I have
UPDATE user SET name=$newname WHERE id=999;
I can control the $newname variable.
The server doesn’t allow concatenation of a 2nd query, so I somehow need to embed a query where $newname is.
Any ideas?
submitted by /u/IrskoCzeska
[link] [comments]
SQL Injection into a MySQL update query
I have a web app that has a vulnerability that allows sql injection into an update query.
So for example, I have
UPDATE user SET name=$newname WHERE id=999;
I can control the $newname variable.
The server doesn’t allow concatenation of a 2nd query, so I somehow need to embed a query where $newname is.
Any ideas?
submitted by /u/IrskoCzeska
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Problems ending lanschool process tree with process explorer.
So in my school we have lanschool and I want to disable it. Command prompt is disabled aswell as registry editing, and power options. I tried installing process explorer(v17.04) and I tried running it with the Ethernet plug disabled, but when I ran process explorer and tried ending the student.exe process tree it said access denied. Anyway to bypass this? Is there perhaps a third party process explorer that doesn’t require admin to install? Thanks.
submitted by /u/Hungry_Story
[link] [comments]
Problems ending lanschool process tree with process explorer.
So in my school we have lanschool and I want to disable it. Command prompt is disabled aswell as registry editing, and power options. I tried installing process explorer(v17.04) and I tried running it with the Ethernet plug disabled, but when I ran process explorer and tried ending the student.exe process tree it said access denied. Anyway to bypass this? Is there perhaps a third party process explorer that doesn’t require admin to install? Thanks.
submitted by /u/Hungry_Story
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
What would you ask a Cybercrime Prosecutor?
I'm making a documentary about cybersecurity and hackers, white hat ones and black hat ones, for my school. And I was asked to make questions that would be useful to ask a cybercrime prosecutor, as if I were, hypothetically, going to interview one.
What do you think that person could contribute? What could I ask them?
submitted by /u/Thomasitos
[link] [comments]
What would you ask a Cybercrime Prosecutor?
I'm making a documentary about cybersecurity and hackers, white hat ones and black hat ones, for my school. And I was asked to make questions that would be useful to ask a cybercrime prosecutor, as if I were, hypothetically, going to interview one.
What do you think that person could contribute? What could I ask them?
submitted by /u/Thomasitos
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
US: China-funded hackers attack critical infrastructure - Discover Politics
https://external-preview.redd.it/leFrUxFyb5x1X7JLgJ_X_gsT81RobJbYn0jDu7CDRkE.jpg?width=216&crop=smart&auto=webp&s=2d0b86811bbb9fe9a06e7e92437fa9106fdb0132 submitted by /u/v4r4d3r0
[link] [comments]
US: China-funded hackers attack critical infrastructure - Discover Politics
https://external-preview.redd.it/leFrUxFyb5x1X7JLgJ_X_gsT81RobJbYn0jDu7CDRkE.jpg?width=216&crop=smart&auto=webp&s=2d0b86811bbb9fe9a06e7e92437fa9106fdb0132 submitted by /u/v4r4d3r0
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Admin Access on work laptop.
Hey all!
I work as a receptionist and spend all day on this laptop, yet work is never busy, so I have nothing to do. The laptop has most of it's features locked unless you have admin access.
I'd like to find a way to give my account admin access.
The laptop is on a domain network for the company so logging into user accounts seems a little more complicated and protected; any advice?
submitted by /u/SW3910
[link] [comments]
Admin Access on work laptop.
Hey all!
I work as a receptionist and spend all day on this laptop, yet work is never busy, so I have nothing to do. The laptop has most of it's features locked unless you have admin access.
I'd like to find a way to give my account admin access.
The laptop is on a domain network for the company so logging into user accounts seems a little more complicated and protected; any advice?
submitted by /u/SW3910
[link] [comments]