Hacking on Medium
CC: Pen Testing WriteUp — TryHackMe

https://cdn-images-1.medium.com/max/1024/0*5q3VzUY5gGtHjvzO
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe Writeup: KENOBI.

https://cdn-images-1.medium.com/max/1920/1*7uNJ7S6T_Bf9y7tsjqKpng.png
ENUMERATION:

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to get Started in Cyber Security?

https://cdn-images-1.medium.com/max/600/1*tyzEQRZorAtRgr0pHqfa0A.jpeg
Cyberattacks are happening all the time, meaning that keeping software, hardware, and data safe and secure is more important than ever.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Bug Bounty Methodology V3.0: Hunt like a rat

https://cdn-images-1.medium.com/max/1532/1*WD6Z0zQqHjOnZxUX3hyZkA.png
Over time i ran into some issues when i was following other people’s methodologies. I was testing like my mentors and my hero’s but it…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Web App Pen Testing - Learning SQL Injection
https://www.reddit.com/r/Pentesting/comments/nmawn4/web_app_pen_testing_learning_sql_injection/

<!-- SC_OFF -->Hello Everyone, I'm on my journey to become a web app pen tester and I have started with the Portswigger Web Security Academy which I'm finding incredibly useful so far. I have started on the SQL injection topic and I've just started looking at blind SQL injection and its the first time where I have relied heavily on hints/solutions to assist me in completing the labs. What I'm struggling with is the many extra variables you may potentially have to include in order to be successful. So my question is how would you know whether to use URL encoding vs concatenation vs a comment trailer or even a combination of these? Is it simply trial and error or is there a set pattern you should always try when discovering a potential injectable field? Some examples below. Lab example with double concatenation encased in quotes TrackingId=xyz'||(SELECT ' ')||' Lab example with concatenation and comment trailer TrackingId=x'||pg_sleep(10)-- Lab example with some URL encoding and + TrackingId=x'%3BSELECT+CASE+WHEN+(1=1)+THEN+pg_sleep(10)+ELSE+pg_sleep(0)+END-- At the moment these labs feel impossible without these hints/walkthroughs so any advice would be greatly appreciated. Thanks in advance :) <!-- SC_ON --> submitted by /u/lewis20188 (https://www.reddit.com/user/lewis20188)
[link] (https://www.reddit.com/r/Pentesting/comments/nmawn4/web_app_pen_testing_learning_sql_injection/) [comments] (https://www.reddit.com/r/Pentesting/comments/nmawn4/web_app_pen_testing_learning_sql_injection/)

Bug Bounty Methodology V3.0: Hunt like a rat
https://thexssrat.medium.com/bug-bounty-methodology-v3-0-hunt-like-a-rat-9e030fc54363?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Over time i ran into some issues when i was following other people’s methodologies. I was testing like my mentors and my hero’s but it…Continue reading on Medium » (https://thexssrat.medium.com/bug-bounty-methodology-v3-0-hunt-like-a-rat-9e030fc54363?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Demo for Mr. Beast's Self Updating Thumbnail Hack

https://external-preview.redd.it/Zj-byydGu0QD2Ijxe2jVSU2FwRFAiw86iAvg_rjm0io.jpg?width=320&crop=smart&auto=webp&s=04019f1fe1a7655152291c2626f9471e9d65d402 submitted by /u/EmergencyCloud2080
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Enterprise Scale Threat Hunting: C2 Beacon Detection with Unsupervised ML and KQL — Part 2
https://www.reddit.com/r/redteamsec/comments/nmhys3/enterprise_scale_threat_hunting_c2_beacon/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://mergene.medium.com/enterprise-scale-threat-hunting-network-beacon-detection-with-unsupervised-ml-and-kql-part-2-bff46cfc1e7e) [comments] (https://www.reddit.com/r/redteamsec/comments/nmhys3/enterprise_scale_threat_hunting_c2_beacon/)

___________________________
@hacking_Attack
@Hacking_Video

BHIS | Getting Started in Pentesting The Cloud: Azure | Beau Bullock (1-Hour)
https://www.reddit.com/r/redteamsec/comments/nmhze0/bhis_getting_started_in_pentesting_the_cloud/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://youtu.be/fCbVMWvncuw) [comments] (https://www.reddit.com/r/redteamsec/comments/nmhze0/bhis_getting_started_in_pentesting_the_cloud/)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Pulse Secure VPNs Get Quick Fix for Critical RCE

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Pulse Secure VPNs Get Quick Fix for Critical RCEPost Views: 160
Reading Time: 1 Minute
Pulse Secure has issued a workaround for a critical remote-code execution (RCE) vulnerability in its Pulse Connect Secure (PCS) VPNs that may allow an unauthenticated, remote attacker to execute code as a user with root privileges.
Pulse Secure’s parent company, Ivanti, issued an out-of-band advisory on May 14. The company explained that this high-severity bug – identified as CVE-2021-22908 and rated CVSS 8.5 – affects Pulse Connect Secure versions 9.0Rx and 9.1Rx.

“Buffer Overflow in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user,” according to the advisory. “As of version 9.1R3, this permission is not enabled by default.”

The CERT Coordination Center issued a report about the vulnerability, explaining that the problem stems from a buffer overflow vulnerability in the PCS gateway. CERT/CC explained that the gateway’s ability to connect to Windows file shares through a number of CGI endpoints could be leveraged to carry out an attack.

“When specifying a long server name for some SMB operations, the smbcltapplication may crash due to either a stack buffer overflow or a heap buffer overflow, depending on how long of a server name is specified,” CERT/CC noted. PCS 9.1R11.4 systems are vulnerable: CERT/CC said that it’s  managed to trigger the vulnerability by targeting the CGI script /dana/fb/smb/wnf.cgi, although “Other CGI endpoints may also trigger the vulnerable code.”
See Also: 100M Android Users Hit By Rampant Cloud Leaks There’s currently no practical solution to this problem, at least not that CERT/CC is aware of, according to Will Dormann, who both discovered the vulnerability and wrote up the CERT/CC report. He offered two workarounds: Fix No. 1: Apply XML WorkaroundPulse Secure has published a quick fix: a Workaround-2105.xml file with a mitigation to protect against the vulnerability. “Importing this XML workaround will activate the protections immediately,” according to Dormann’s report, and “does not require any downtime for the VPN system.

The workaround blocks requests that match these URI patterns: ^/+dana/+fb/+smb^/+dana-cached/+fb/+smbDormann advised users to note that Workaround-2105.xmlwill automatically deactivate the mitigations applied by an earlier workaround, Workaround-2104.xml. That makes it “imperative that a PCS system is running 9.1R11.4 before applying the Workaround-2105.xmlmitigation,” he said, to ensure that the vulnerabilities outlined in SA44784 aren’t reintroduced as the result of applying the workaround.

The workaround will block the ability to use Windows File Share Browser.
See Also: Offensive Security Tool: Snallygaster Fix No. 2: Set a Windows File Access PolicyDormann said that a PCS system that started as 9.1R2 or earlier will retain the default Initial File Browsing Policy of Allow for \\*SMB connections, which will expose this vulnerability. He advised users to check out the administrative page for the PCS, at Users -> Resource Policies -> Windows File Access Policiesto view current SMB policy.

A PCS policy that explicitly allows \\*or otherwise “may allow users to initiate connections to arbitrary SMB server names,” Dormann advised, telling users to “configure the PCS to Deny connections to such resources to minimize [...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
PDF Feature ‘Certified’ Widely Vulnerable to Attack

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg PDF Feature ‘Certified’ Widely Vulnerable to AttackPost Views: 161
Reading Time: 1 Minute
Certified portable document format (PDF) files are used to securely sign agreements between two parties while keeping the contents’ integrity protected, but a new report found the security protections on most certified PDF applications were inadequate and left organizations exposed to a number of attacks.
Researchers from Ruhr University Bochum explained certified PDFs use two specific signatures to authenticate the document, an Approval signature and a Certification signature. Certification signatures are the more flexible and made to handle complicated agreements between multiple parties and allow some changes to the document within a set of parameters while still maintaining its validity.

Unsurprisingly, Certified signatures are where the team found vulnerabilities to two specific novel attacks they dubbed, “Evil Annotation” (EAA) and “Sneaky Signature” (SSA). Both allow an attacker to overlay malicious content (PDF) on top of the certified information without showing any signs it was altered. Novel Certified PDF Attacks EAAs display malicious content in the document’s annotations and then sends it on with its digital signature intact. SSAs add malicious content over legitimate content in the PDF itself.

The team said the results of its evaluation of the 26 most popular PDF applications were “alarming.”
See Also: Pulse Secure VPNs Get Quick Fix for Critical RCE “In only 2 cases, we could not find a vulnerability; 15 viewers were vulnerable to EAA, 8 to SSA, including Adobe, Foxit, and LibreOffice,” the report said. “We additionally analyzed the standard-compliant implementation of PDF certification applications and found issues in 11 of them.”

Adobe had an additional flaw that allowed certified documents to execute JavaScript code, opening these users to code in injection attacks.

https://media.threatpost.com/wp-content/uploads/sites/103/2021/05/26161319/Evil-Annotation-PDF-Research_10-300x187.jpg “For example, a high-level JavaScript can call an arbitrary URL without user confirmation to deanonymize a user. Our research reveals that such code is also executed if it is added as an allowed incremental update. We are the first to reveal that this behavior allows attackers to directly embed malicious code into a certified document.

The team said it disclosed their findings to the appropriate vendors and provided a comprehensive vulnerability report, including exploits, to CERT-Bund (BSI). The report also lists the specific certified PDF security flaws found in each application.

“Adobe, Foxit, and LibreOffice responded quickly and provided patches for late 2020 (CVE-2020-35931) or early 2021 (CVE2021-28545, CVE-2021-28546),” the report said. “Adobe fixed the code injection vulnerability in early Nov. 2020 within a patch outside the regular update cycle (CVE-2020-24432). Currently, we participate in the standardization process via the German National Organization for Standardization (DIN) and the International Organization for Standardization (ISO) to address the reported attacks in the next PDF specification.”
See Also: Offensive Security Tool: Snallygaster Stopping Certified PDF AttacksTo fend off Evil Annotation Attacks, the researchers recommend admins prohibit three particularly risky annotations that allow text or images to be added to a certified PDF, “FreeText, Stamp and Redact.”

Sneaky Signatures can be blocked by reducing permissions, but that is not a guarantee SSAs won’t g[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Pulse Secure VPNs Get Quick Fix for Critical RCE

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
7 out of 10 businesses are not prepared to respond to a Cyber Attack

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg 7 out of 10 businesses are not prepared to respond to a Cyber AttackPost Views: 83 https://www.blackhatethicalhacking.com/wp-content/uploads/2020/11/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-8-1-300x120.png Reading Time: 3 Minutes
Fact: 7 out of 10 businesses are not prepared to respond to a Cyber Attack.
73% of companies, based on a statistic made by Hiscox in the UK, US, Spain, Germany & Netherlands are just not prepared.
The overheads were ranging from lack of resources, budget, awareness, down to not testing their infrastructure how they would withstand an attack by simulating real-life attacks out of services like Penetration testing, Vulnerability assessments and Social Engineering Phishing attacks.
See Also: Fact: Hacking Has Evolved
As IT Spending is growing exponentially, for example, IoT devices are on the rise with over 87% of healthcare organizations implementing their usage for patient monitoring followed by remote operation and location services (Source: Aruba Networks). It is estimated that by the year 2025 an estimated 64 billion connected IoT devices will be taking place, including the 5G Network which started taking place in several countries.
A lot of attacks are affecting major vendors, which most of the industry relies on when they use their products. This not only puts your company in a vulnerable state for any criminal hacker to take advantage of, through the CVES (Common Vulnerabilities and Exposures) that are being released on a daily basis but also the lack of knowledge and time for the IT team to respond on time, to patch these vulnerabilities.
When it comes to data, storage is important yet not many spends on reliable storage solutions, however when a company suffers data loss, suddenly they want to implement a decent storage solution.
When it comes to a Cyber Attack, sometimes there is no second chance to recover. A projected 146 billion records will be exposed between 2020 and 2023 done through a study by Juniper predicting and calculating the number of actual breaches and not just the reported ones.
See Also: PDF Feature ‘Certified’ Widely Vulnerable to Attack
The world is changing, stay always one step ahead of criminal hackers by consulting with Red-Team-oriented Information Security awareness training and solutions. Recent Facts* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Hacking-has-Evolved-Fact_Website-Template-90x90.png Hacking has Evolved4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/You-cant-protect-what-you-cant-see-Fact_Website-Template-90x90.png You can’t protect what you can’t see2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/02/Fact_Website-Template-90x90.png Manual Pentesting is more Effective than the Automated3 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/01/Fact_Website-Template-90x90.png 90% of the hacking process involves the Reconnaissance Phase5 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2020/11/Website-90x90.png A Hacker needs only one loophole to hack any system.6 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2020/10/Website_2-90x90.png Not all hackers are criminals7 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2020/08/Website-90x90.png Human Intelligence is the best defense against Phishing Attacks9 months ago
* https://www.blackhatethicalhacking.co[...]

___________________________
@hacking_Attack
@Hacking_Video

et through. Defined signature fields offer an additional layer of protection, the report said.

“Signature fields must be set up at defined locations in the PDF document before the document is certified,” the report explained. “A subsequent addition of signature fields must be penalized with an invalid certification status. Otherwise, it can always be used to add text or images included in the signature at any position.”

Adobe JavaScript code injections are trickier since in most cases the execution starts the moment the document is opened. “The only requirement is that the victim fully trusts the certificate used to certify the PDF document,” the report said. See Also: Hacking Stories: Xbox UndergroundEarlier this month Adobe Acrobat issued a patch for a zero-day bug targeting Windows users. Just days later, researchers at Microsoft Security Intelligence (MSI) found PDFs were being used by attackers to deliver StrRAT Java-based remote access tool (RAT) used to steal credentials, log keystrokes and take remote control over infected systems.

The flexibility offered by Certified signatures presents a massive, potentially catastrophic, security risk for many organizations and the report urges PDF applications to work quickly to come up with wide-scale fixes.

“The research community has struggled with similar problems on other data formats, such as XML or Email, without finding a satisfying solution so far,” they said. “In the case of PDF, the specification must be updated to address these issues.”
Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/vulnerability-e1621953424713-90x90.jpg Pulse Secure VPNs Get Quick Fix for Critical RCE2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-5-90x90.png 100M Android Users Hit By Rampant Cloud Leaks3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-3-2-90x90.png WP Statistics Bug Allows Attackers to Lift Data from WordPress Sites4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-4-90x90.png Windows PoC Exploit Released for Wormable RCE7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-3-1-90x90.png Microsoft, Google Clouds Hijacked for Gobs of Phishing1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-2-2-90x90.png Microsoft, Adobe Exploits Top List of Crooks’ Wish List1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-3-90x90.png Bizarro Banking Trojan Sports Sophisticated Backdoor1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Safari_Browser-90x90.jpg ‘Scheme Flooding’ Allows Websites to Track Users Across Browsers2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Mac-Malware-90x90.jpg Apple’s ‘Find My’ Network Exploited via Bluetooth2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-2-1-90x90.png GitHub Prepares to Move Beyond Passwords2 weeks ago
The post PDF Feature ‘Certified’ Widely Vulnerable to Attack first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

m/wp-content/uploads/2020/07/Website-90x90.png Firewalls are no longer enough10 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2020/06/Website-90x90.png Your Data in the Cloud is not as secure as you think12 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2020/05/Website-90x90.png The Weakest Link in a Security Chain is the Human Element12 months ago
The post 7 out of 10 businesses are not prepared to respond to a Cyber Attack first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video