hacking: security in practice
Zip Bomb VS VirtualBox

Will a zip bomb opened on virtualbox crash the virtual pc or your actual pc? i've been wondering for quite a while, but i don't feel like testing it myself

submitted by /u/Nervous_Ear_5269
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
R77 Rootkit : Fileless Ring 3 Rootkit With Installer And Persistence

R77 is a ring 3 Rootkit that hides following entities from all processes: Files, directories, junctions, named pipes, scheduled tasks Processes CPU usage Registry keys & values Services TCP & UDP connections It is compatible with Windows 7 and Windows 10 in both x64 and x86 editions. Hiding By Prefix All entities where the name […]

The post R77 Rootkit : Fileless Ring 3 Rootkit With Installer And Persistence appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Laboratory HackTheBox Walkthrough

Today we are going to crack a machine called the Laboratory. It was created by 0xc45. This is a Capture the Flag type of challenge. This machine is hosted on HackTheBox. Let’s get cracking! Penetration Testing Methodology· Network Scanningo Nmap ScanEnumerationo Enumerating HTTPS service Exploitationo Exploiting GitLab RCEPrivilege Escalationo Enumerating SUID permissionsWalkthroughTo Attack any machine, we need the IP Address. Machine hosted on HackTheBox have a static IP Address.IP Address assigned: 10.129.148.89Now that we have the IP Address. We need to enumerate open ports on the machine. For this, we will be running a nmap scan.nmap -A 10.129.148.89https://1.bp.blogspot.com/-ulsi3pB7IbQ/YLC54IhJsAI/AAAAAAAAwRc/B91Y1WB9OdsmanKtJX1tjFQgUYMpS8uxgCLcBGAsYHQ/s16000/1.png The Nmap scan quickly gave us some great information. It positively informed that the following ports and services are running: SSH (22), HTTP (80), HTTPS (443). Upon reading the nmap scan it was observed that the Common Name is laboratory.htb. We make the entry in the /etc/hosts file with the IP address. Enumeration Since we have added an entry in the /etc/hosts file with the IP Address, we can use the laboratory.htb in the Web browser to enumerate the HTTPS service. The website that is hosted is created to promote a company that is dedicated to Security and Development Services. https://laboratory.htbhttps://1.bp.blogspot.com/-q0v3W4mGUrc/YLC58zKQcqI/AAAAAAAAwRg/Dr15S5k-Q3YFwkJ4gveMtNTfIQbqaGOWACLcBGAsYHQ/s16000/2.png We got a clue from the nmap scan that there is possibility of subdomains from the details that were enumerated while checking the certificate information. To confirm the suspicion and to potentially enumerate for any other subdomains. We use gobuster for this task. We can see that we have successfully enumerated the git.laboratory.htb.gobuster dir --url https://laboratory.htb/ --wordlist /usr/share/dirbuster/wordlists/directory-list-lowcase-2.3-small.txt -t 50https://1.bp.blogspot.com/-gQ2XTjp8jHQ/YLC6AhelXSI/AAAAAAAAwRk/7j6DSRgn9gsWg9O-tXSZSmhi3kz0fbpqwCLcBGAsYHQ/s16000/3.png As we have found this new subdomain, we need to make an edit in our /etc/hosts file so that we are able to access it on our web browser. nano /etc/hostshttps://1.bp.blogspot.com/-LIJSu6g5xHw/YLC6EAzJh2I/AAAAAAAAwRo/5Xf9J9nZUkwHKKfvcdAJxWSEDc_7PiGKwCLcBGAsYHQ/s16000/4.1.png Upon opening the git.laboratory.htb we see that it is an installation of GitLab. https://git.laboratory.htb/users/sign_inhttps://1.bp.blogspot.com/-brOkcdzD5Ys/YLC6HJEpvcI/AAAAAAAAwRs/suEXWkG2KFs9BIVYyAgQJJG4s8DsmwLDQCLcBGAsYHQ/s16000/4.png Since, we didn’t have any credentials for the users, we tired to register for a new user. But we are given an error that the email domain is not the one that it would accept. So, in order to circumvent this error, we tried to change the email address to the domain of the application i.e., laboratory.htb.___________________________
@hacking_Attack
@Hacking_Video

GAsYHQ/s16000/6.png After logging in with the newly created credentials, we see that we have the GitLab Community Edition installed on the target machine. The version is 12.8.1.ExploitationAfter, going through some exploration for the version of the GitLab, we found that this version is vulnerable to Remote Code Execution Attack. It is possible to use a direct exploit that can be found on exploitdb. However, we found that it is possible to use an exploit this vulnerability using Metasploit. It requires some set parameters such as the IP Address and port of the target machine, vhost which is the git.laboratory.htb. Then it requires the username and password that was created earlier. After running for a moment, the exploit provides with a shell on the target machine. We prompt the shell to the bash which tells us that the session that we have procured is for the user git. use exploit/multi/http/gitlab_file_read_rceHow to reset user password | GitLab - GitLab Docsbash -ihttps://1.bp.blogspot.com/-rfKNiRYyU8s/YLC6bk7D6TI/AAAAAAAAwSM/Nq7kyK1NMGAWcfY1ZP9sweaixPQUyXd7gCLcBGAsYHQ/s16000/16.png Now that we have the access for the user dexter user account, we get back to the GitLab instance on our Web Browser and login using the credentials for dexter. After a successful login, we start to enumerate the files that are accessible for the dexter user and find a SSH private key as shown in the image below.Privilege EscalationWe copy the private key and create a key on the Kali Linux and named it key. We used this key to connect to the target machine via the SSH. You can read the User flag at this point. After logging in, one of the first enumeration task we did was check for the SUID permissions. It prints a huge list of binaries, among which we find the docker-security. It can be used to elevate our access to root. ssh -i key dexter@10.129.148.89/dev/nullhttps://1.bp.blogspot.com/-zdUZIP4rkRc/YLC6mp4VnjI/AAAAAAAAwSc/IlPCym7Cro4ADe9JrHCkvbO22lm4s8EZQCLcBGAsYHQ/s16000/18.png Since, it’s a binary that we are not that familiar with, the usual course of action is to reverse engineer it. Although you can use ltrace com[...]

___________________________
@hacking_Attack
@Hacking_Video

mand to understand the working of the binary. It will tell you that it runs the command chmod to change the permissions for /usr/bin/docker. Since it doesn’t use the complete path of the chmod, we can exploit by creating a chmod with shell invocation in the same directory and run the binary. Rather than using the original chmod, it will use the chmod that we created and give us the root access on the machine. We now can read the root flag and conclude this machine.echo “/bin/bash” > chmodhttps://1.bp.blogspot.com/-fvQG_LWSnsc/YLC6vIAwqgI/AAAAAAAAwSg/scOOiBSD2Xs7mD0Dfe6R2HrMnPIldvbIQCLcBGAsYHQ/s16000/19.png ___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Laboratory HackTheBox Walkthrough

Today we are going to crack a machine called the Laboratory. It was created by 0xc45. This is a Capture the Flag type of challenge. This machine is hosted on HackTheBox. Let’s get cracking! Penetration Testing Methodology Network Scanning Nmap Scan Enumeration Enumerating HTTPS service Enumerating Subdomains Enumerating GitLab Enumerating

The post Laboratory HackTheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

AnalyticsRelationships - Get Related Domains / Subdomains By Looking At Google Analytics IDs
http://www.kitploit.com/2021/05/analyticsrelationships-get-related.html

___________________________
@hacking_Attack
@Hacking_Video

Get related domains / subdomains by looking at Google Analytics (https://www.kitploit.com/search/label/Analytics) IDs > Python/GO versions > By @JosueEncinar "> Get related domains /
> Get related domains / subdomains by looking at Google Analytics IDs
> Python/GO versions
> By @JosueEncinar
This script try to get related domains / subdomains by looking at Google Analytics IDs from a URL. First search for ID of Google Analytics in the webpage and then request to builtwith with the ID. Note: It does not work with all websites.It is searched by the following expressions: "www\.googletagmanager\.com/ns\.html\?id=[A-Z0-9\-]+" -> GTM-[A-Z0-9]+ -> "UA-\d+-\d+" '>-> "www\.googletagmanager\.com/ns\.html\?id=[A-Z0-9\-]+"
-> GTM-[A-Z0-9]+
-> "UA-\d+-\d+"

Available versions:
Python (https://github.com/Josue87/AnalyticsRelationships/blob/main/Python) GO (https://github.com/Josue87/AnalyticsRelationships/blob/main/GO)
Installation:
Installation according to language.
Python
git clone https://github.com/Josue87/AnalyticsRelationships.git > cd AnalyticsRelationships/Python > sudo pip3 install -r requirements.txt ">> git clone https://github.com/Josue87/AnalyticsRelationships.git
> cd AnalyticsRelationships/Python
> sudo pip3 install -r requirements.txt

GO
git clone https://github.com/Josue87/AnalyticsRelationships.git > cd AnalyticsRelationships/GO > go build -ldflags "-s -w" '>> git clone https://github.com/Josue87/AnalyticsRelationships.git
> cd AnalyticsRelationships/GO
> go build -ldflags "-s -w"

Usage
Usage according to language
Python
python3 analyticsrelationships.py -u https://www.example.com ">> python3 analyticsrelationships.py -u https://www.example.com
Or redirect output to a file (banner or information messages are sent to the error output): /tmp/example.txt ">python3 analyticsrelationships.py -u https://www.example.com > /tmp/example.txt

GO
./analyticsrelationships --url https://www.example.com ">> ./analyticsrelationships --url https://www.example.com
Or redirect output to a file (banner or information messages are sent to the error output): ./analyticsrelationships --url https://www.example.com > /tmp/example.txt ">> ./analyticsrelationships --url https://www.example.com > /tmp/example.txt

Examples

Python
Output redirection to file /tmp/example.txt:

___________________________
@hacking_Attack
@Hacking_Video

Without redirection:

___________________________
@hacking_Attack
@Hacking_Video

GO
Without redirection:

___________________________
@hacking_Attack
@Hacking_Video

Working with file redirection works just like in Python.
Author
This project has been developed by: Josué Encinar García -- @JosueEncinar (https://twitter.com/JosueEncinar)
Disclaimer!
This is a PoC. The author is not responsible for any illegitimate use.

Download AnalyticsRelationships (https://github.com/Josue87/AnalyticsRelationships)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
OSINT Tool: LinkedIn Scraper

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg OSINT Tool: LinkedIn ScraperPost Views: 241 https://www.blackhatethicalhacking.com/wp-content/uploads/2020/11/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-8-1-300x120.png Reading Time: 5 Minutes
OSINT Tool: LinkedIn Scraper GitHub Link
Linkedin Scraper

LinkedIn Scraper by joeyism, is a library that scrapes LinkedIn for user data using only the terminal and Selenium for really fast data extracted publicly. As part of OSINT, ‘Reconnaissance’ is the most important part to learn and study about a person or a company, as part of an investigation, or even used to simulate targeted Phishing attacks. All this info is Open Source Intelligence techniques, thinking outside the box and using custom code to perform specific outcome.
Want to know how your coverage looks like to the public?

This is the tool to use, giving you more visibility on your company or an individual. It uses advanced techniques like bypassing the mechanisms so that you can use a cookie and authenticate through the terminal using selenium going through fields that are available already on LinkedIn.
Installation
pip3 install --user linkedin_scraper
Version 2.0.0 and before is called linkedin_user_scraperand can be installed via pip3 install --user linkedin_user_scraperSetup

First, you must set your chromedriver location by
export CHROMEDRIVER=~/chromedriver
Usage

To use it, just create the class.
Sample Usage
fromlinkedin_scraperimportPerson, actionsfromseleniumimportwebdriverdriver=webdriver.Chrome() email= "some-email@email.address"password= "password123"actions.login(driver, email, password) # if email and password isn'tgiven, it'll prompt in terminalperson=Person("https://www.linkedin.com/in/andre-iguodala-65b48ab5", driver=driver)
NOTE: The account used to log-in should have it’s language set English to make sure everything works as expected.
User Scraping
from linkedin_scraper import Person person = Person("https://www.linkedin.com/in/andre-iguodala-65b48ab5")
Company Scraping
from linkedin_scraper import Company company = Company("https://ca.linkedin.com/company/google")
Scraping sites where login is required first
1. Run ipythonor python2. In ipython/python, run the following code (you can modify it if you need to specify your driver)

3.
from linkedin_scraper import Person
from selenium import webdriver
driver = webdriver.Chrome()
person = Person(“https://www.linkedin.com/in/andre-iguodala-65b48ab5”, driver = driver, scrape=False)

4. Login to LinkedIn

5. [OPTIONAL] Logout of LinkedIn

6. In the same ipython/python code, run

person.scrape()
The reason is that LinkedIn has recently blocked people from viewing certain profiles without having previously signed in. So by setting scrape=False, it doesn’t automatically scrape the profile, but Chrome will open the LinkedIn page anyways. You can login and logout, and the cookie will stay in the browser and it won’t affect your profile views. Then when you run person.scrape(), it’ll scrape and close the browser. If you want to keep the browser on so you can scrape others, run it as

NOTE: For version >= 2.1.0, scraping can also occur while logged in. Beware that users will be able to see that you viewed their profile.
person.scrape(close_on_complete=False)
so it doesn’t close.
Scraping sites and[...]

___________________________
@hacking_Attack
@Hacking_Video

login automatically

From version 2.4.0 on, actionsis a part of the library that allows signing into LinkedIn first. The email and password can be provided as a variable into the function. If not provided, both will be prompted in terminal.
from linkedin_scraper import Person, actions from selenium import webdriver driver = webdriver.Chrome() email = "some-email@email.address" password = "password123" actions.login(driver, email, password) # if email and password isnt given, it'll prompt in terminal person = Person("https://www.linkedin.com/in/andre-iguodala-65b48ab5", driver=driver)
API
Person

A Person object can be created with the following inputs:
Person(linkedin_url=None, name=None, about=[], experiences=[], educations=[], interests=[], accomplishments=[], company=None, job_title=None, driver=None, scrape=True) linkedin_urlThis is the linkedin url of their profile nameThis is the name of the person aboutThis is the small paragraph about the person experiencesThis is the past experiences they have. A list of linkedin_scraper.scraper.ExperienceeducationsThis is the past educations they have. A list of linkedin_scraper.scraper.EducationinterestsThis is the interests they have. A list of linkedin_scraper.scraper.InterestaccomplishmentThis is the accomplishments they have. A list of linkedin_scraper.scraper.AccomplishmentcompanyThis the most recent company or institution they have worked at. job_titleThis the most recent job title they have. driverThis is the driver from which to scraper the LinkedIn profile. A driver using Chrome is created by default. However, if a driver is passed in, that will be used instead.
For example
driver = webdriver.Chrome() person = Person("https://www.linkedin.com/in/andre-iguodala-65b48ab5", driver = driver) scrapeWhen this is True, the scraping happens automatically. To scrape afterwards, that can be run by the scrape()function from the Personobject. scrape(close_on_complete=True)This is the meat of the code, where execution of this function scrapes the profile. If close_on_complete is True (which it is by default), then the browser will close upon completion. If scraping of other profiles are desired, then you might want to set that to false so you can keep using the same driver.
Company
Company(linkedin_url=None, name=None, about_us=None, website=None, headquarters=None, founded=None, company_type=None, company_size=None, specialties=None, showcase_pages=[], affiliated_companies=[], driver=None, scrape=True, get_employees=True) linkedin_urlThis is the linkedin url of their profile nameThis is the name of the company about_usThe description of the company websiteThe website of the company headquartersThe headquarters location of the company foundedWhen the company was founded company_typeThe type of the company company_sizeHow many people are employed at the company specialtiesWhat the company specializes in showcase_pagesPages that the company owns to showcase their products affiliated_companiesOther companies that are affiliated with this one driverThis is the driver from which to scraper the Linkedin profile. A driver using Chrome is created by default. However, if a driver is passed in, that will be used instead. get_employeesWhether to get all the employees of company
For example
driver = webdriver.Chrome() company = Company("https://ca.linkedin.com/company/google", driver=driver) scrape(close_on_complete=True)This is the meat of the code, where execution of this function scrapes the company. If close_on_complete is True (which it is by defa[...]

___________________________
@hacking_Attack
@Hacking_Video