Exploiting Cisco AnyConnect to Gain System Priv
https://www.reddit.com/r/redteamsec/comments/14hr2jp/exploiting_cisco_anyconnect_to_gain_system_priv/

<!-- SC_OFF -->In this week's video, I exploit Cisco AnyConnect to gain system privileges. Using this POC CVE-2023-20178 (https://github.com/Wh04m1001/CVE-2023-20178) I show how quickly you could move from user to system privileges. Check it out. https://youtu.be/nr_j5TOeNj4 <!-- SC_ON --> submitted by /u/Infosecsamurai (https://www.reddit.com/user/Infosecsamurai)
[link] (https://www.reddit.com/r/redteamsec/comments/14hr2jp/exploiting_cisco_anyconnect_to_gain_system_priv/) [comments] (https://www.reddit.com/r/redteamsec/comments/14hr2jp/exploiting_cisco_anyconnect_to_gain_system_priv/)

Kali Linux Tutorials
Wa-Tunnel : Tunneling Internet Traffic Over Whatsapp

DisclaimerUsing this library may get your WhatsApp account banned, use with a temporary number or at your own risk.

This is a Baileys based piece of code that lets you tunnel TCP data through two Whatsapp accounts.

This can be usable in different situations, for example network carriers that give unlimited whatsapp data or airplanes where you also get unlimited social network data.

It’s using Baileys since it’s a WS based multi-device whatsapp library and therefore could be used in android in the future, using Termux for example.

The idea is to use it with a proxy setup on the server like this: [Client (restricted access) -> Whatsapp -> Server -> Proxy -> Internet]

Apologizes in advance since Javascript it’s not one of my primary coding languages :/

Use only for educational purpose. How does it work?It sends TCP network packages through WhatsApp text and file messages, depending on the amount of characters it splits them into different text messages or files.

To not get timed out by WhatsApp by default it’s limited at 20k characters per message, at the moment it’s hardcoded in wasocket.js. I have done multiple tests and anything below that may get you banned for sending too many messages and any above 80k may timeout.

If a network package is over the limit (20k chars by default) it will be sent as a file if enabled. Also if multiple network packages are cached it will use the same cryteria.

File messages are sent as binary files, TCP responses are concatenated with a delimiter and compressed using brotli to reduce data usage.

It caches TCP socket responses to group them and send the maximum amount of data in a message therefore reducing the amount of messages, improving the speed and reducing the probability of getting banned. Performance improvementsBefore: (without files and no response caching) curl -x localhost:12345 https://www.youtube.com
- 50-80 messages
- 30-40 seconds After: (with files and response caching) curl -x localhost:12345 https://www.youtube.com
- 6-8 messages
- 7-15 seconds In case you are not allowed to send files use the --disable-filesflag when starting the server and client to disable this functionality. Why?I got the idea While travelling through South America network data on carriers is usually restricted to not many GBs but WhatsApp is usually unlimited, I tried to create this library since I didn’t find any usable at the date. SetupYou must have access to two Whatsapp accounts, one for the server and one for the client. You can forward a local port or use an external proxy. Server sideClone the repository on your server and install node dependencies.

1. cd path/to/wa-tunnel2. npm installThen you can start the server with the following command where port is the proxy port and host is the proxy host you want to forward. And number is the client WhatsApp number with the country code alltogether and without +. npm run server host port number You can use a local proxy server like follows: npm run server localhost 3128 12345678901 Or you can use a normal proxy server like follows: npm run server 192.168.0.1 3128 12345678901 Client SideClone the repository on your server and install node dependencies.

1. cd path/to/wa-tunnel2. npm installThen you can start the server with the following command where port is the local port where you will connect and number is the server WhatsApp number with the country code alltogether and without +. npm run client port number For example npm run client 8080 1234567890 UsageThe first time you open the script Baileys will ask you to scan the QR code with the whatsapp app, after that the session[...]

is saved for later usage.

It may crash, that’s normal after that just restart the script and you will have your client/server ready!

Once you have both client and server ready you can test using curl and see the magic happen. curl -v -x proxyHost:proxyPort https://httpbin.org/ip With the example commands would be: curl -v -x localhost:8080 https://httpbin.org/ip It has been tested also with a normal browser like Firefox, it’s slow but can be used.

You can also forward other protocol ports like SSH by setting up the server like this: npm run server localhost 22 12345678901 And then connect to the server by using in the client: ssh root@localhost -p 8080 Usage on AndroidTo use on Android, you can use it with Termux using the following commands: pkg update && pkg upgrade
pkg install git nodejs -y
git clone https://github.com/aleixrodriala/wa-tunnel.git
cd wa-tunnel
npm install LicenseMIT Click Here To Download
Please consider following and supporting us to stay updated with the latest info

msLDAPDump - LDAP Enumeration Tool
http://www.kitploit.com/2023/06/msldapdump-ldap-enumeration-tool.html

msLDAPDump simplifies LDAP enumeration in a domain environment by wrapping the lpap3 library from Python in an easy-to-use interface. Like most of my tools, this one works best on Windows. If using Unix, the tool will not resolve hostnames that are not accessible via eth0 currently.
Binding Anonymously Users can bind to LDAP anonymously through the tool and dump basic information about LDAP, including domain naming context, domain controller (https://www.kitploit.com/search/label/Domain%20Controller) hostnames, and more.

Credentialed Bind

Users can bind to LDAP utilizing valid user account credentials (https://www.kitploit.com/search/label/Credentials) or a valid NTLM hash. Using credentials will obtain the same information as the anonymously binded request, as well as checking for the following: Subnet scan for systems with ports 389 and 636 open Basic Domain Info (Current user permissions, domain SID, password policy, machine account quota) Users Groups Kerberoastable Accounts ASREPRoastable Accounts Constrained Delegation Unconstrained Delegation Computer Accounts - will also attempt DNS lookups on the hostname to identify IP addresses Identify Domain Controllers Identify Servers Identify Deprecated Operating Systems Identify MSSQL Servers Identify Exchange Servers Group Policy Objects (GPO) Passwords in User description fields Each check outputs the raw contents to a text file, and an abbreviated, cleaner version of the results in the terminal environment. The results in the terminal are pulled from the individual text files. Add support for LDAPS (LDAP Secure) NTLM Authentication Figure out why Unix only allows one adapter to make a call out to the LDAP server (removed resolution from Linux until resolved) Add support for querying child domain information (currently does not respond nicely to querying child domain controllers) Figure out how to link the name to the Description field dump at the end of the script mplement command line (https://www.kitploit.com/search/label/Command%20Line) options rather than inputs Check for deprecated operating systems in the domain Mandatory Disclaimer Please keep in mind that this tool is meant for ethical hacking (https://www.kitploit.com/search/label/Ethical%20Hacking) and penetration testing (https://www.kitploit.com/search/label/Penetration%20Testing) purposes only. I do not condone any behavior that would include testing targets that you do not currently have permission to test against.

Download msLDAPDump (https://github.com/dievus/msLDAPDump)

How To Abuse A Password Manager
https://blog.devgenius.io/how-to-abuse-a-password-manager-7ea9cbe4dbd0?source=rss------bug_bounty-5

Getting The Master Key to HeavenContinue reading on Dev Genius » (https://blog.devgenius.io/how-to-abuse-a-password-manager-7ea9cbe4dbd0?source=rss------bug_bounty-5)

Deep Web
I’m one of the Saki Sanobashi hunters. . .

Alright, so this is gonna sound weird, but on the discord we only have one possible video website listed and I already ruled it out. And since OP listed he saw this on the dark web I’m thinking it was either on TorTube or some other obscure video website platform. Would anyone have some links to help me go on the search?

submitted by /u/RubyTheSilkWing
[link] [comments]

https://preview.redd.it/q6q4qm6ejy7b1.jpg?width=640&crop=smart&auto=webp&s=ab5f42a22c57d21437d1fd4b133214b1c28861dd submitted by /u/HeadSpade
[link] [comments]

https://preview.redd.it/wxchg0w4cz7b1.jpg?width=640&crop=smart&auto=webp&s=e5697f47b2c2128a9dd0f4229b6b5f84a0e07391 submitted by /u/Stoney666222
[link] [comments]

hacking: security in practice
Usefulness of links that provide location of people when clicked

https://external-preview.redd.it/F6AGihc6sjMmnVLm-XWIe0jcP2vPZpBwjOqH2PhZX-c.jpg?width=108&crop=smart&auto=webp&s=0563ade4652d2408b81c0d4fd5f4ad1c26458007 The website https://linklocator.net has basically scripted a bunch of things and made it simple to create a tinyurl link that can be sent to someone and if they click it, it will record their location for the person who made the link. The person who creates the link can actually even dictate where the link forwards onto after the geolocation info is retrieved.

This was sort of a side gig I did for some bail bondsmen who weren’t very tech savvy, but it probably has more application than I can think of. Just looking for other ideas.

submitted by /u/newmanog
[link] [comments]