Hacking Articles Tips Tricks Videos Tutorials
468 subscribers
65.8K photos
15 videos
157 files
132K links
Exploit
Pentesting
Hacking
Red Team
Blue Team
Kali Linux
Bug Bounty
Black Hat
Cyber security etc

@Hacking_Video
@Hacking_attack
Download Telegram
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Backdooring PE Files

https://cdn-images-1.medium.com/max/1167/1*AwlMsR6zXEy4hsUjALyQZw.png
A Trojan is designed to fool the end user. It can be software mimicking the real program, running malware under the hood, or a real…

Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
ReconAIzer – Enhancing Burp Suite With OpenAI

ReconAIzer is a powerful Jython extension for Burp Suite that leverages OpenAI to help bug bounty hunters optimize their recon process.

This extension automates various tasks, making it easier and faster for security researchers to identify and exploit vulnerabilities.

Once installed, ReconAIzer add a contextual menu and a dedicated tab to see the results:

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2-ZQpy2YJdVWI8j_yGCXoP0gwp8fqKc2xaqSLrdtAt5DHhtcvFOpabUzJtZQOvNJ7bNJyJxEo52UETfJpGNw5J8dnaF_5K9j6kqewjbkkMCBv1PpjMFpgn7Srdhthf4arEXIJ7hiBwVIVZWSKfPoJTXrdm1L03LbE9uYuvzWa22UwqlnBapHM9J-ajam1/s16000/229282506-ea5bc46b-b4d9-4f1b-9ec1-5dcd987de0bc.webp

Prerequisites

* Burp Suite
* Jython Standalone Jar

Installation

Follow these steps to install the ReconAIzer extension on Burp Suite:

Step 1: Download Jython

1. Download the latest Jython Standalone Jar from the official.
2. Save the Jython Standalone Jar file in a convenient location on your computer.

Step 2: Configure Jython In Burp Suite

1. Open Burp Suite.
2. Go to the “Extensions” tab.
3. Click on the “Extensions settings” sub-tab.
4. Under “Python Environment,” click on the “Select file…” button next to “Location of the Jython standalone JAR file.”
5. Browse to the location where you saved the Jython Standalone Jar file in Step 1 and select it.
6. Wait for the “Python Environment” status to change to “Jython (version x.x.x) successfully loaded,” where x.x.x represents the Jython version.

Step 3: Download And Install ReconAIzer

1. Download the latest release of ReconAIzer
2. Open Burp Suite
3. Go back to the “Extensions” tab in Burp Suite.
4. Click the “Add” button.
5. In the “Add extension” dialog, select “Python” as the “Extension type.”
6. Click on the “Select file…” button next to “Extension file” and browse to the location where you saved the ReconAIzer.py file in Step 3.1. Select the file and click “Open.”
7. Make sure the “Load” checkbox is selected and click the “Next” button.
8. Wait for the extension to be loaded. You should see a message in the “Output” section stating that the ReconAIzer extension has been successfully loaded.

Congratulations! You have successfully installed the ReconAIzer extension in Burp Suite. You can now start using it to enhance your bug bounty hunting experience.

Once it’s done, you must configure your OpenAI API key on the “Config” tab under “ReconAIzer” tab.

* Your OpenAI API key can be found here.

Feel free to suggest prompts improvements or anything you would like to see on ReconAIzer!

Happy bug hunting!
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqUogw0GEsRrTBjOsKcs_l72toAMiyUYuQRZvwR4xI0q9jqVaNMYfOrjOpYzjNaIfr84BMsZPMPCwp7wIiY3wwdwPxlaYuUncOHldzK-rCFpIvMQs_sf-zdy1q6LS4Gpj4LenylsZ3Bit6zGKTegyG9lAgQq4dg6LDlw_yhI9XfZga300TJYIQcfFBZG7e/s16000/229282837-da0c0314-0882-4ef2-9203-018682330f76.webp
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
SMShell - Send Commands And Receive Responses Over SMS From Mobile Broadband Capable Computers

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEUP2kJiHpHSz8be_u-LNqVXu1RRbGJRLtKGpYI-wG-X7DizrCzsSpJIIkx4rn1bTz0Vp86FiFywTSXu2JB5-TjXl2lsMmq3eeieOY9QLCDm0Q3Hy3i_gyl59yDID1eJJy-eQi1IO5A8XLvSDOl5WKtc7dsCGvCc4fwgbQRhxPc27rZssY2awnp0xnKfWY/w640-h338/SMShell_1.gif
PoC for an SMS-based shell. Send commands and receive responses over SMS from mobile broadband capable computers.

This tool came as an insipiration during a research on eSIM security implications led by Markus Vervier, presented at Offensivecon 2023
Disclaimer

This is not a complete C2 but rather a simple Proof of Concept for executing commands remotely over SMS.

Requirements

For the shell to work you need to devices capable of sending SMS. The victim's computer should be equiped with WWAN module with either a physical SIM or eSIM deployed.

On the operator's end, two tools are provided:

* .NET binary which uses an embedded WWAN module
* Python script which uses an external Huaweu MiFi thourgh its API

Of course, you could in theory use any online SMS provider on the operator's end via their API.

Usage

On the victim simply execute the client-agent.exe binary. If the agent is compiled as a Console Application you should see some verbose messages. If it's compiled as a Windows Application (best for real engagements), there will be no GUI.

The operator must specify the victim's phone number as a parameter:

server-console.exe +306912345678


Whereas if you use the python script you must additionally specify the MiFi details:

python3 server-console.py --mifi-ip 192.168.0.1 --mifi-username admin --mifi-password 12345678 --number +306912345678 -v


A demo as presented by Markus at Offensive is shown below. On the left is the operator's VM with a MiFi attached, whereas on the right window is client agent.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEUP2kJiHpHSz8be_u-LNqVXu1RRbGJRLtKGpYI-wG-X7DizrCzsSpJIIkx4rn1bTz0Vp86FiFywTSXu2JB5-TjXl2lsMmq3eeieOY9QLCDm0Q3Hy3i_gyl59yDID1eJJy-eQi1IO5A8XLvSDOl5WKtc7dsCGvCc4fwgbQRhxPc27rZssY2awnp0xnKfWY/w640-h338/SMShell_1.gif
Download SMShell
SMShell - Send Commands And Receive Responses Over SMS From Mobile Broadband Capable Computers
http://www.kitploit.com/2023/09/smshell-send-commands-and-receive.html
PoC for an SMS-based shell. Send commands and receive responses over SMS from mobile broadband capable computers. This tool came as an insipiration during a research (https://www.kitploit.com/search/label/Research) on eSIM security implications led by Markus Vervier, presented at Offensivecon 2023 (https://www.offensivecon.org/speakers/2023/markus-vervier.html)
Disclaimer This is not a complete C2 but rather a simple Proof of Concept for executing commands remotely over SMS. Requirements For the shell to work you need to devices capable of sending SMS. The victim's computer should be equiped with WWAN module with either a physical SIM or eSIM deployed. On the operator's end, two tools are provided: .NET binary (https://www.kitploit.com/search/label/Binary) which uses an embedded (https://www.kitploit.com/search/label/Embedded) WWAN module Python script which uses an external Huaweu MiFi thourgh its API Of course, you could in theory use any online SMS provider on the operator's end via their API. Usage On the victim simply execute the client-agent.exe binary. If the agent is compiled as a Console Application you should see some verbose messages. If it's compiled as a Windows Application (best for real engagements), there will be no GUI. The operator must specify the victim's phone number (https://www.kitploit.com/search/label/Phone%20Number) as a parameter: server-console.exe +306912345678
Whereas if you use the python script you must additionally specify the MiFi details: python3 server-console.py --mifi-ip 192.168.0.1 --mifi-username admin --mifi-password 12345678 --number +306912345678 -v
A demo as presented by Markus at Offensive is shown below. On the left is the operator's VM with a MiFi attached, whereas on the right window is client agent.
Dark Reading: Attacks/Breaches
'ShroudedSnooper' Backdoors Use Ultra-Stealth in Mideast Telecom Attacks

The threat cluster hasn't been seen before, but its custom Windows server backdoors have researchers intrigued thanks to their extremely effective stealth mechanisms.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
12,000 Juniper Firewalls and Switches Vulnerable to Critical Flaw

12,000 Juniper Firewalls and Switches Vulnerable to Critical Flaw
Post Views: 35 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes
An estimated 12,000 Juniper SRX firewalls and EX switches are facing a severe vulnerability that could lead to remote code execution without authentication.

In August, Juniper disclosed a series of vulnerabilities, including ‘PHP environment variant manipulation’ (CVE-2023-36844/CVE-2023-36845) and ‘Missing Authentication for Critical Function’ (CVE-2023-36846/CVE-2023-36847). On their own, these vulnerabilities had a ‘medium’ severity rating of 5.3.

However, when these vulnerabilities are chained together, they result in a critical remote code execution flaw with a rating of 9.8.

WatchTowr Labs released a proof of concept (PoC) that exploited the CVE-2023-36845 and CVE-2023-36846 vulnerabilities. This PoC allowed researchers to execute code remotely by uploading two files to a vulnerable device.

Recently, VulnCheck vulnerability researcher Jacob Baines presented another PoC exploit that only utilizes CVE-2023-36845. This bypasses the need to upload files while still achieving remote code execution.
See Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses
As part of Baines’ report, he shared a free scanner on GitHub designed to identify vulnerable deployments. The scanner revealed thousands of vulnerable devices exposed on the internet.

“In this blog, we demonstrated how CVE-2023-36845, a vulnerability flagged as ‘Medium’ severity by Juniper, can be used to remotely execute arbitrary code without authentication,” explains VulnCheck’s report.

“We’ve turned a multi-step (but very good) exploit into an exploit that can be written using a single curl command and appears to affect more (older) systems.” Exploit

Baines conducted tests using an old Juniper SRX210 firewall but found that his device lacked the do_fileUpload() functionality necessary to upload files to the device. This disrupted watchTowr’s exploit chain, prompting Baines to explore alternative methods for achieving remote code execution.

Baines discovered that it was possible to bypass the need to upload files to the target servers by manipulating environment variables.

The Juniper firewall’s Appweb web server processes user HTTP requests via stdin when running a CGI script. Attackers can manipulate this process to recognize a pseudo “file,”/dev/fd/0, and adjust environment variables and HTTP requests to display sensitive data.

VulnCheck leveraged PHP’s ‘auto_prepend_file’ and ‘allow_url_include’ features to execute arbitrary PHP code using the data:// protocol without the need to upload any files.

The severity rating of CVE-2023-36845, originally 5.4, should now be re-evaluated as it has demonstrated the ability to achieve remote code execution without relying on other vulnerabilities.

https://www.bleepstatic.com/images/news/u/1220909/2023/APTs/46/PoC.jpg Proof of concept curl command (VulnCheck)
Trending: The Rise and Fall of Sabu: From Hacker Hero to FBI Informant Trending: Offensive Security Tool: Headerpwn
The impact of this security issue is more extensive and severe than its “medium” CVSS rating indicates. Administrators should take immediate action to address this vulnerability.

CVE-2023-36845 affects the following versions of Junos OS on EX Series and SRX Series:

* All versions before 20.4R3-S8
* 21.1 version 21.1R1 and later versions
* 21.2 versions before 21.2R3-S6
* 21.3 versions before 21.3R3-S5
* 21.4 versions before 21.4R3-S5
* 22.1 versions b[...]
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking 12,000 Juniper Firewalls and Switches Vulnerable to Critical Flaw 12,000 Juniper Firewalls and Switches Vulnerable to Critical Flaw Post Views: 35 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png…
efore 22.1R3-S3
* 22.2 versions before 22.2R3-S2
* 22.3 versions before 22.3R2-S2, 22.3R3
* 22.4 versions before 22.4R2-S1, 22.4R3

Juniper released security updates to address the vulnerability on August 17, 2023. However, due to its low initial severity rating, many affected users might have postponed applying the updates.

VulnCheck’s network scans identified 14,951 Juniper devices with internet-exposed web interfaces. From a sample size of 3,000 devices, Baines found that 79% were vulnerable to this remote code execution flaw.

https://www.bleepstatic.com/images/news/u/1220909/2023/APTs/46/shodan-scan.png Shodan scan result (VulnCheck)
Since hackers are already exploring the opportunity to leverage CVE-2023-36845 in attacks, Juniper admins must apply these updates as soon as possible, as they could be used to gain initial access to corporate networks.
Trending: New Phishing Campaign Exploits Microsoft Teams to Deliver DarkGate Loader Malware Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Store.png Recent News
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/09/Images-for-the-News-posts-5-300x150.png Facebook Business Accounts Under Attack: NodeStealer Variant Harvests Credentials
September 18, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/09/Images-for-the-News-posts-4-300x150.png MGM Resorts Hit by BlackCat Ransomware Affiliate: Data Stolen, Operations Halted
September 15, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/09/Images-for-the-News-posts-3-300x150.png Critical Kubernetes Flaws Expose Windows Endpoints to Remote Code Execution
September 14, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/09/Images-for-the-News-posts-2-300x150.png MetaStealer: New macOS Malware Targeting Intel-Based Computers Emerges
September 13, 2023 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking Course

Begin the learning curve of hacking now! https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Solutions.png Information Security Solutions

Find out how Pentesting Services can help you.
The post 12,000 Juniper Firewalls and Switches Vulnerable to Critical Flaw first appeared on Black Hat Ethical Hacking.
Unlocking Premium CV Features: My Journey to Downloading CVs for Free

So, there I was, just your average person looking to create a snazzy CV. But here’s the twist — I’m also a Pentester, which means I can’t…Continue reading on Medium »
Read more...
Bug Bounty Competition 2023 Attracts Students Interest

Since June 2023, the Center for Data and Information Technology (CfDIT/Pusdatin), the Ministry of Culture Education, Research, and…Continue reading on Medium »
Read more...