KitPloit - PenTest Tools!
Totp-Ssh-Fluxer - Take Security By Obscurity To The Next Level (This Is A Bad Idea, Don'T Really Use This Please)

https://1.bp.blogspot.com/-AKkC7r7JH88/YLc4c7ouPTI/AAAAAAAAXu8/xUUwB4NfrB4AxMzYryAxlY0lzRMw35hOgCNcBGAsYHQ/w640-h470/totp-ssh-fluxer_1.gif
Some people change their SSH port on their servers so that it is slightly harder to find for bots or other nasties, and while that is generally viewed as an action of security through obscurity it does work very well at killing a lot of the automated logins you always see in /var/log/auth.log

However what if we could go take this to a ridiculous level? What if we could use TOTP codes that are normally used as 2nd factor codes to login to websites to actually know what port the sshd server is listening on?

For this, I present totp-ssh-flux, a way to make sure your sshd port changes every 30 seconds, and possibly causing your adversaries a small period of frustration.
What you can see here is my phone (using a generic TOTP client) generating codes, that I can then use as the port to SSH into on a server.

The software behind it is fairly simple, It runs in a loop that does the following

* Generates a TOTP token
* Takes the last digit, if the result is above 65536, do that again
* Adds a iptables PREROUTING rule to redirect that number generated above
* Waits 30 seconds, removes that rule, repeat.

The neat thing is, because this is done in PREROUTING, even if the code expires, established connections stay connected.

Installation

You will most likely find more up to date instructions on the totp-ssh-flux project readme

Beware, currently I would not really recommend running this software, it was only written as a joke.

At the time of writing the project is just a single file, You will need to install golang and then go getand go build

Run the program as root ( it needs to, sorry, it's editing iptables )

Upon first run, the program will generate a token for the host in /etc/ssh-flux-key( you can use the -keypathoption to change that ) and you can input that into your phone or other clients.

You can confirm it works by running watch iptables -vL -t natand waiting for the iptables rules to be inserted and removed.
Want to see more insanity like this? Follow me on twitter @benjojo12
Download Totp-Ssh-Fluxer

___________________________
@hacking_Attack
@Hacking_Video

As computer security auditors, what is your experience most similar to a hacker movie?
https://www.reddit.com/r/Pentesting/comments/nuq9c4/as_computer_security_auditors_what_is_your/

I'm dedicated to offensive security on websites, and once in a while I have found myself in almost comical situations where you can glimpse the occasional similarity to some exaggerated hacker movie. However other times things can get tense. Have you had an intense experience that you consider almost cinematic? submitted by /u/TimeTravel_07 (https://www.reddit.com/user/TimeTravel_07)
[link] (https://www.reddit.com/r/Pentesting/comments/nuq9c4/as_computer_security_auditors_what_is_your/) [comments] (https://www.reddit.com/r/Pentesting/comments/nuq9c4/as_computer_security_auditors_what_is_your/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
First Known Malware Surfaces Targeting Windows Containers

Siloscape is designed to create a backdoor in Kubernetes clusters to run malicious containers.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe Walkthrough: Steel Mountain (with &without Metasploit)

https://cdn-images-1.medium.com/max/856/1*b_VRnFaXvplraQZFznKkCQ.png
This room is a box hosting two web services, and one of them is hosting a vulnerable service. We are able to use an exploit to achieve…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack Android Dengan Mudah Menggunakan Metasploit Framework

https://cdn-images-1.medium.com/max/1920/1*fNCv8ixjU9IjqYaTJtas3Q.png
Di era teknologi yang semakin pesat melaju ini, informasi menjadi hal yang sangat mudah didapatkan. Dan karena itu juga, keamanan menjadi…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Colonial Pipeline Hack Timeline and How Ransom Funds Were Retrieved

https://cdn-images-1.medium.com/max/2600/0*8i7WyXPRad4mfNn2
An easy to understand guide from a cyber security/computer info systems major

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Anyone has a good guide on how to be as safe as possible using Tor browser?

and maybe something that briefly explains all the connection configurations one may have to know about. I was a reckless kid and spent lots of time on tor and weird onion sites but now that I'm old I don't know if I can just download it and use it like nothing lol

submitted by /u/lovemusicsuckatmusic
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
possible to hack canvas?

how hard would it be to unlock a locked assignment on canvas

submitted by /u/Fuzz_from_the_floor
[link] [comments]

Kali Linux Tutorials
SQLFluff : A SQL Linter And Auto-Formatter For Humans

SQLFluff is a dialect-flexible and configurable SQL linter. Designed with ELT applications in mind, SQLFluff also works with jinja templating and dbt. SQLFluff will auto-fix most linting errors, allowing you to focus your time on what matters. Getting Started To get started, install the package and run sqlfluff lint or sqlfluff fix. $ pip install sqlfluff$ echo ” […]

The post SQLFluff : A SQL Linter And Auto-Formatter For Humans appeared first on Kali Linux Tutorials.

Bugs, Bounties & Peace of Mind

As a Bug Bounty Hunter, finding Bugs or security vulnerabilities in websites always feels like finding some hidden treasure in unknown…Continue reading on Medium »
Read more...

Bugs, Bounties & Peace of Mind
https://suneets1ngh.medium.com/bugs-bounties-peace-of-mind-f8a885fb75ec?source=rss------bug_bounty-5

As a Bug Bounty Hunter, finding Bugs or security vulnerabilities in websites always feels like finding some hidden treasure in unknown…Continue reading on Medium » (https://suneets1ngh.medium.com/bugs-bounties-peace-of-mind-f8a885fb75ec?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Pentesting AWS NAT Gateways
https://www.reddit.com/r/Pentesting/comments/nuxzxf/pentesting_aws_nat_gateways/

Hi all, So recently I was given a set of public AWS IP addresses to conduct a pentest on and when I ran a port scan (all ports UDP and TCP) on the said IP addresses I nothing was showing, which led me to sort of realise that these are NAT gateways most likely. Is there anything else that I can continue to pentest on AWS NAT GATEWAYS? I'm not sure what else I can look out for to be honest and I was hoping someone here would have some ideas. Thanks! submitted by /u/sg_pepehands69 (https://www.reddit.com/user/sg_pepehands69)
[link] (https://www.reddit.com/r/Pentesting/comments/nuxzxf/pentesting_aws_nat_gateways/) [comments] (https://www.reddit.com/r/Pentesting/comments/nuxzxf/pentesting_aws_nat_gateways/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Colleges that support CTF teams

I know that a group like PPP is running out of Carnegie Mellon but I don't know many other teams working out of colleges. If you know any feel free to drop a link to their website on this post or PM me.

submitted by /u/jesus-da-wizard
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Windows Container Malware Targets Kubernetes Clusters

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Windows Container Malware Targets Kubernetes ClustersPost Views: 78
Reading Time: 2 Minutes
“Siloscape”, the first malware to target Windows containers, breaks out of Kubernetes clusters to plant backdoors and raid nodes for credentials.
Windows containers have been victimized for over a year by the first known malware to target Windows containers. The ongoing campaign pierces Kubernetes clusters so as to plant backdoors, allowing attackers to steal data and user credentials, or even hijack an entire databases hosted in a cluster

The malware was discovered by Unit 42 security researcher Daniel Prizmant. He dubbed it Siloscape, which he pronounces “Silo escape.” The malware pries open known vulnerabilities in web servers and databases so as to compromise Kubernetes nodes and to backdoor clusters.

In a post published on Monday, Prizmant wrote that Siloscape is heavily obfuscated malware targeting Kubernetes clusters through Windows containers, with the main purpose of opening “a backdoor into poorly configured Kubernetes clusters in order to run malicious containers.”
See Also: GitHub’s new policies allow removal of PoC exploits used in attacks Striking at the Heart of Ever-More-Popular ContainersIn a separate post, Unit 42 researchers Ariel Zelivansky and Matthew Chiodi compared containers to those used to package different materials together on cargo ships. They’re an easy way to run applications in the cloud, in that they pack different materials together for greater efficiency, allowing development teams to move fast and operate “at almost any scale.”

Running an application in a container this way is referred to as containerization, and like other remote ways to work, it’s picked up steam due to COVID-19. “We’ve seen more and more organizations using containers in the cloud in recent years, especially since the COVID-19 pandemic caused many to seek to move faster and deploy cloud workloads more efficiently,” the researchers noted. https://media.threatpost.com/wp-content/uploads/sites/103/2021/06/07123256/Kubernetes-components-e1623083589461.png Components of Kubernetes. Source: Kubernetes Windows: An Unwelcome FirstAccording to Zelivansky and Chiodi, this is the first time researchers have seen malware targeting Windows containers. The Linux operating system in cloud environments has been far more popular, they said.

Unit 42 researchers have identified 23 Siloscape victims and said that evidence points to the campaign having been launched over a year ago.

Prizmant determined the campaign’s start date – Jan. 12, 2020 – by gleaning the creation date of the server that it’s coming from. This doesn’t necessarily mean that Siloscape was created on that date, he noted; rather, that’s likely when the malware campaign started.

After particularly arduous reverse-engineering, Prizmant was able to connect to the Siloscape command-and-control (C2) server, where he discovered that it was hosting a total of 313 users. That implies that Siloscape is “a small part of a broader campaign,” he observed.
See Also: Offensive Security Tool: Pacu – The Amazon Web Services Exploitation Framework How Siloscape EscapesThe malware starts by targeting known vulnerabilities – “1-days” – in common cloud applications, such as web servers. This initial access is presumably gained by using exploits found in the wild. Last year, Prizmant documented one such way to break Windows container boundaries. In a report published in 2020, he described what attackers could do if they [...]

___________________________
@hacking_Attack
@Hacking_Video

escaped from a container.

He chose to focus on the current scenario: An escape from a Windows cluster node in Kubernetes that would allow an attacker to gain access outside the node and spread into the cluster. https://media.threatpost.com/wp-content/uploads/sites/103/2021/06/07123538/Execution-flow-of-Siloscape.-Source-Unit-42-e1623083752331.jpeg Execution flow of Siloscape. Source: Unit 42
After it compromises web servers, Siloscape uses container escape tactics to achieve code execution on the Kubernetes node. Prizmant said that Siloscape’s heavy use of obfuscation made it a chore to reverse-engineer. “There are almost no readable strings in the entire binary. While the obfuscation logic itself isn’t complicated, it made reversing this binary frustrating,” he explained.

The malware obfuscates functions and module names – including simple APIs – and only deobfuscates them at runtime. Instead of just calling the functions, Siloscape “made the effort to use the Native API (NTAPI) version of the same function,” he said. “The end result is malware that is very difficult to detect with static analysis tools and frustrating to reverse engineer.”

“Siloscape is being compiled uniquely for each new attack, using a unique pair of keys,” Prizmant continued. “The hardcoded key makes each binary a little bit different than the rest, which explains why I couldn’t find its hash anywhere. It also makes it impossible to detect Siloscape by hash alone.” See Also: Jeff Moss, aka Dark Tangent, the person who founded DEF CON and Black Hat What Siloscape Does After EscapeAfter Siloscape compromises nodes, the malware sniffs around for credentials that enable it to spread to other nodes in the Kubernetes cluster. Then, it reaches out to its C2 server via IRC – an old protocol – over the Tor anonymous communication network and sits idle, waiting for commands.

Prizmant adopted a username that he figured would look legitimate when he connected to the C2 server. Once he successfully connected, he found it was still working and that there were 23 “active victims”, plus a channel operator named admin.

But his presence didn’t go undetected. After about 2 minutes, he was kicked out of the server. Two minutes after that, the server was shut down – at least, it was no longer active at the original oniondomain that he used to connect.

But that was just a slice of the entire campaign. He actually saw that in the #WindowsKubernetes channel he accessed there were far more than those 23 users. In fact there were a total of 313 users. He wouldn’t be able to identify, contact or warn any of them, however.

“Sadly, when I connected to the server, the channels list was empty, indicating that the server was configured to not reveal its channels,” Prizmant wrote. “Therefore, I couldn’t get more information from the channel names.”

But the researcher did manage to glean an important detail. Namely, the convention used for the victims’ names. Unit 42 researchers used the name “php_35”, which its sample of Siloscape executed through a vulnerable php instance. Other names that included the string “sqlinj” indicate that the attacker probably managed to achieve code execution via SQL injection. Danger of Cryptojacking, Supply-Chain Poisoning & MoreIn his July 2020 post, Prizmant said that his research suggested that “running any code in [Windows Server Containers] should be considered as dangerous as running admin on the host. These containers are not designed for sandboxing, and I found that escaping them is easy.”

This could enable an attacker to steal critical credentials, confidential and internal files, or even entire databases hosted in the cluster, he warned in Monday’s post. It could even lead to a ransomware attack if attackers take an organization’s files hostage. Even worse, he said, is the threat presented by organizations’ mass move to the cloud. Given that many are using Kubern[...]

___________________________
@hacking_Attack
@Hacking_Video