Kali Linux Tutorials
SQLFluff : A SQL Linter And Auto-Formatter For Humans

SQLFluff is a dialect-flexible and configurable SQL linter. Designed with ELT applications in mind, SQLFluff also works with jinja templating and dbt. SQLFluff will auto-fix most linting errors, allowing you to focus your time on what matters. Getting Started To get started, install the package and run sqlfluff lint or sqlfluff fix. $ pip install sqlfluff$ echo ” […]

The post SQLFluff : A SQL Linter And Auto-Formatter For Humans appeared first on Kali Linux Tutorials.

Bugs, Bounties & Peace of Mind

As a Bug Bounty Hunter, finding Bugs or security vulnerabilities in websites always feels like finding some hidden treasure in unknown…Continue reading on Medium »
Read more...

Bugs, Bounties & Peace of Mind
https://suneets1ngh.medium.com/bugs-bounties-peace-of-mind-f8a885fb75ec?source=rss------bug_bounty-5

As a Bug Bounty Hunter, finding Bugs or security vulnerabilities in websites always feels like finding some hidden treasure in unknown…Continue reading on Medium » (https://suneets1ngh.medium.com/bugs-bounties-peace-of-mind-f8a885fb75ec?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Pentesting AWS NAT Gateways
https://www.reddit.com/r/Pentesting/comments/nuxzxf/pentesting_aws_nat_gateways/

Hi all, So recently I was given a set of public AWS IP addresses to conduct a pentest on and when I ran a port scan (all ports UDP and TCP) on the said IP addresses I nothing was showing, which led me to sort of realise that these are NAT gateways most likely. Is there anything else that I can continue to pentest on AWS NAT GATEWAYS? I'm not sure what else I can look out for to be honest and I was hoping someone here would have some ideas. Thanks! submitted by /u/sg_pepehands69 (https://www.reddit.com/user/sg_pepehands69)
[link] (https://www.reddit.com/r/Pentesting/comments/nuxzxf/pentesting_aws_nat_gateways/) [comments] (https://www.reddit.com/r/Pentesting/comments/nuxzxf/pentesting_aws_nat_gateways/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Colleges that support CTF teams

I know that a group like PPP is running out of Carnegie Mellon but I don't know many other teams working out of colleges. If you know any feel free to drop a link to their website on this post or PM me.

submitted by /u/jesus-da-wizard
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Windows Container Malware Targets Kubernetes Clusters

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Windows Container Malware Targets Kubernetes ClustersPost Views: 78
Reading Time: 2 Minutes
“Siloscape”, the first malware to target Windows containers, breaks out of Kubernetes clusters to plant backdoors and raid nodes for credentials.
Windows containers have been victimized for over a year by the first known malware to target Windows containers. The ongoing campaign pierces Kubernetes clusters so as to plant backdoors, allowing attackers to steal data and user credentials, or even hijack an entire databases hosted in a cluster

The malware was discovered by Unit 42 security researcher Daniel Prizmant. He dubbed it Siloscape, which he pronounces “Silo escape.” The malware pries open known vulnerabilities in web servers and databases so as to compromise Kubernetes nodes and to backdoor clusters.

In a post published on Monday, Prizmant wrote that Siloscape is heavily obfuscated malware targeting Kubernetes clusters through Windows containers, with the main purpose of opening “a backdoor into poorly configured Kubernetes clusters in order to run malicious containers.”
See Also: GitHub’s new policies allow removal of PoC exploits used in attacks Striking at the Heart of Ever-More-Popular ContainersIn a separate post, Unit 42 researchers Ariel Zelivansky and Matthew Chiodi compared containers to those used to package different materials together on cargo ships. They’re an easy way to run applications in the cloud, in that they pack different materials together for greater efficiency, allowing development teams to move fast and operate “at almost any scale.”

Running an application in a container this way is referred to as containerization, and like other remote ways to work, it’s picked up steam due to COVID-19. “We’ve seen more and more organizations using containers in the cloud in recent years, especially since the COVID-19 pandemic caused many to seek to move faster and deploy cloud workloads more efficiently,” the researchers noted. https://media.threatpost.com/wp-content/uploads/sites/103/2021/06/07123256/Kubernetes-components-e1623083589461.png Components of Kubernetes. Source: Kubernetes Windows: An Unwelcome FirstAccording to Zelivansky and Chiodi, this is the first time researchers have seen malware targeting Windows containers. The Linux operating system in cloud environments has been far more popular, they said.

Unit 42 researchers have identified 23 Siloscape victims and said that evidence points to the campaign having been launched over a year ago.

Prizmant determined the campaign’s start date – Jan. 12, 2020 – by gleaning the creation date of the server that it’s coming from. This doesn’t necessarily mean that Siloscape was created on that date, he noted; rather, that’s likely when the malware campaign started.

After particularly arduous reverse-engineering, Prizmant was able to connect to the Siloscape command-and-control (C2) server, where he discovered that it was hosting a total of 313 users. That implies that Siloscape is “a small part of a broader campaign,” he observed.
See Also: Offensive Security Tool: Pacu – The Amazon Web Services Exploitation Framework How Siloscape EscapesThe malware starts by targeting known vulnerabilities – “1-days” – in common cloud applications, such as web servers. This initial access is presumably gained by using exploits found in the wild. Last year, Prizmant documented one such way to break Windows container boundaries. In a report published in 2020, he described what attackers could do if they [...]

___________________________
@hacking_Attack
@Hacking_Video

escaped from a container.

He chose to focus on the current scenario: An escape from a Windows cluster node in Kubernetes that would allow an attacker to gain access outside the node and spread into the cluster. https://media.threatpost.com/wp-content/uploads/sites/103/2021/06/07123538/Execution-flow-of-Siloscape.-Source-Unit-42-e1623083752331.jpeg Execution flow of Siloscape. Source: Unit 42
After it compromises web servers, Siloscape uses container escape tactics to achieve code execution on the Kubernetes node. Prizmant said that Siloscape’s heavy use of obfuscation made it a chore to reverse-engineer. “There are almost no readable strings in the entire binary. While the obfuscation logic itself isn’t complicated, it made reversing this binary frustrating,” he explained.

The malware obfuscates functions and module names – including simple APIs – and only deobfuscates them at runtime. Instead of just calling the functions, Siloscape “made the effort to use the Native API (NTAPI) version of the same function,” he said. “The end result is malware that is very difficult to detect with static analysis tools and frustrating to reverse engineer.”

“Siloscape is being compiled uniquely for each new attack, using a unique pair of keys,” Prizmant continued. “The hardcoded key makes each binary a little bit different than the rest, which explains why I couldn’t find its hash anywhere. It also makes it impossible to detect Siloscape by hash alone.” See Also: Jeff Moss, aka Dark Tangent, the person who founded DEF CON and Black Hat What Siloscape Does After EscapeAfter Siloscape compromises nodes, the malware sniffs around for credentials that enable it to spread to other nodes in the Kubernetes cluster. Then, it reaches out to its C2 server via IRC – an old protocol – over the Tor anonymous communication network and sits idle, waiting for commands.

Prizmant adopted a username that he figured would look legitimate when he connected to the C2 server. Once he successfully connected, he found it was still working and that there were 23 “active victims”, plus a channel operator named admin.

But his presence didn’t go undetected. After about 2 minutes, he was kicked out of the server. Two minutes after that, the server was shut down – at least, it was no longer active at the original oniondomain that he used to connect.

But that was just a slice of the entire campaign. He actually saw that in the #WindowsKubernetes channel he accessed there were far more than those 23 users. In fact there were a total of 313 users. He wouldn’t be able to identify, contact or warn any of them, however.

“Sadly, when I connected to the server, the channels list was empty, indicating that the server was configured to not reveal its channels,” Prizmant wrote. “Therefore, I couldn’t get more information from the channel names.”

But the researcher did manage to glean an important detail. Namely, the convention used for the victims’ names. Unit 42 researchers used the name “php_35”, which its sample of Siloscape executed through a vulnerable php instance. Other names that included the string “sqlinj” indicate that the attacker probably managed to achieve code execution via SQL injection. Danger of Cryptojacking, Supply-Chain Poisoning & MoreIn his July 2020 post, Prizmant said that his research suggested that “running any code in [Windows Server Containers] should be considered as dangerous as running admin on the host. These containers are not designed for sandboxing, and I found that escaping them is easy.”

This could enable an attacker to steal critical credentials, confidential and internal files, or even entire databases hosted in the cluster, he warned in Monday’s post. It could even lead to a ransomware attack if attackers take an organization’s files hostage. Even worse, he said, is the threat presented by organizations’ mass move to the cloud. Given that many are using Kubern[...]

___________________________
@hacking_Attack
@Hacking_Video

etes clusters to develop and test code, a breach “can lead to devastating software supply chain attacks,” he said.

In Monday’s post, he explained that compromising an entire cluster is much more severe than compromising an individual container, given that “a cluster could run multiple cloud applications whereas an individual container usually runs a single cloud application.”

He noted that Siloscape isn’t like most cloud malware, which typically focuses on resource hijacking for things like cryptomining and DoS. Siloscape, on the other hand, “doesn’t limit itself to any specific goal,” Prizmant said. “Instead, it opens a backdoor to all kinds of malicious activities.” Recent Supply-Chain & Kubernetes AttacksSupply-chain attacks similar to what Prizmant warned about have been linked to spyware installation, Operation SignSight, the compromise of Able Desktop, airline breaches, and the supply-chain whopper of them all: the SolarWinds breach of the U.S. government.

As far as other Kubernetes catastrophes go, a few recent headlines include an April 2021 security bug that allowed attackers to brick Kubernetes clusters: A vulnerability in one of the Go libraries that Kubernetes is based on that could lead to denial of service (DoS) for the CRI-O and Podman container engines. Earlier in April, an organized, self-propagating cryptomining campaign was uncovered that targeted misconfigured open Docker Daemon API ports. Thousands of container-compromise attempts were being observed every day related to the campaign.

Also in April, Microsoft’s cloud-container technology, Azure Functions, was found to harbor a weakness that allows attackers to directly write to files, researchers said. A few months earlier, in February 2021, a new malware was hjacking Kubernetes clusters to cryptomine Monero.

Another example of why cloud infrastructure needs strong security, a simple Docker container honeypot was used for four different criminal campaigns in the span of 24 hours, in a recent lab test. Having Your Cloud Cake & Eating It, TooTrevor Morgan, product manager with enterprise data security firm comforte AG, thinks that Siloscape is the kind of threat that can make organizations nervous about adopting cloud. “Enterprises adopt cloud native strategies because they want to accelerate their ability to innovate. Unfortunately, most organizations struggle with the right level of data security to avoid compromise with cloud native application architectures,” he told Threatpost via email on Monday.

“Malware like Siloscape complicates this endeavor by striking at the core of containerization and creates real hesitation on the part of cloud native development efforts, threatening to slow down these processes and defeat the very agility these organizations seek,” he pointed out. “Malware threats set up a false choice between being nimble and being cautious and secure with sensitive data.”

Morgan suggested that data-centric security such as tokenization, built specifically for cloud native applications, “can help strike the right balance between these two,” by protecting the data itself rather than “the layered, even amorphous borders surrounding cloud native application environments.

“Organizations can be assured that data security does not impede speed and agility, because tokenized sensitive information even in containers cannot be compromised if it falls into the wrong hands,” he said. “Organizations adopting cloud native strategies can have their data security while achieving agility too.” What to DoPrizmant recommended that users follow Microsoft’s advice to not use Windows containers as a security feature. Instead, Microsoft recommends using strictly Hyper-V containers for anything that relies on containerization as a security boundary, he noted.” Any process running in Windows Server containers should be assumed to have the same privileges as admin on the host, which in this case is the Kubernete[...]

___________________________
@hacking_Attack
@Hacking_Video

s node. If you are running applications in Windows Server containers that need to be secured, we recommend moving these applications to Hyper-V containers,” he said.

Secure configuration of Kubernetes clusters is also crucial. “A secured Kubernetes cluster won’t be as vulnerable to this specific malware as the nodes’ privileges won’t suffice to create new deployments. In this case, Siloscape will exit,” Prizmant said.

“Siloscape shows us the importance of container security, as the malware wouldn’t be able to cause any significant damage if not for the container escape,” he wrote. “It is critical that organizations keep a well-configured and secured cloud environment to protect against such threats.”
Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/1_6QWMn0DApM4jmbubKuCmNA-90x90.png GitHub’s new policies allow removal of PoC exploits used in attacks1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-2-90x90.png Google PPC Ads Used to Deliver Infostealers4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-1-90x90.png Researchers Uncover Hacking Operations Targeting Government Entities in South Korea5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/ransomware-payment-90x90.jpg Cyber-Insurance Fuels Ransomware Payment Surge6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/banner-2021.2-release-90x90.png Kali Linux 2021.2 Release (Kaboxer, Kali-Tweaks, Bleeding-Edge & Privileged Ports)7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/ezgif.com-gif-maker-90x90.jpg Cyber attack hits JBS meat works in Australia, North America1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/HPE-corp-logo-1-90x90.jpg HPE Fixes Critical Zero-Day in Server Management Software1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/vmware-patch-90x90.jpg VMware Sounds Ransomware Alarm Over Critical Severity Bug2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-6-90x90.png PDF Feature ‘Certified’ Widely Vulnerable to Attack2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/vulnerability-e1621953424713-90x90.jpg Pulse Secure VPNs Get Quick Fix for Critical RCE2 weeks ago
The post Windows Container Malware Targets Kubernetes Clusters first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

What Is CSRF ? How To Perform CSRF Attack, Real Life Example OWASP Top 10
https://harshitdodia653.medium.com/what-is-csrf-how-to-perform-csrf-attack-real-life-example-owasp-top-10-1859c5ce5b88?source=rss------bug_bounty-5

In this blog we will explain what cross-site request forgery is, describe some examples of common CSRF vulnerabilities, explain how to…Continue reading on Medium » (https://harshitdodia653.medium.com/what-is-csrf-how-to-perform-csrf-attack-real-life-example-owasp-top-10-1859c5ce5b88?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

What Is CSRF ? How To Perform CSRF Attack, Real Life Example OWASP Top 10

In this blog we will explain what cross-site request forgery is, describe some examples of common CSRF vulnerabilities, explain how to…Continue reading on Medium »
Read more...

Hacking on Medium
How to Hack Website Database?

https://cdn-images-1.medium.com/max/766/0*vjRG8wQz9S9lbmT5.jpg
4 mins ago h4ckerspro

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Blockchain and Decentralization

https://cdn-images-1.medium.com/max/780/1*rMmmOU7UT-__UTFRaJ9HrA.jpeg
Can it be Hacked?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Mass Hunting XSS — Moodle

Hello friends! In this article, We are going to see How to Identify, Mass hunt and Exploit Moodle.Continue reading on Medium »
Read more...

Mass Hunting XSS — Moodle
https://dewangpanchal98.medium.com/mass-hunting-xss-moodle-ed4b50c82516?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello friends! In this article, We are going to see How to Identify, Mass hunt and Exploit Moodle.Continue reading on Medium » (https://dewangpanchal98.medium.com/mass-hunting-xss-moodle-ed4b50c82516?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

My name is Calogero and I just started my journey into Bug Bounty Hunting just a little under a…

When I was younger and playing video games, I seen kids cheating and hosting 10th prestige lobbys. Being a kid that had to know how…Continue reading on Medium »
Read more...