Hacking on Medium
Bounty Hacker TryHackMe Writeup | Walkthrough[TR]

https://cdn-images-1.medium.com/max/1000/1*xAE1a-KByPMPH5ljnM3lJg.jpeg
Makinemize enumuration ile başlayalım. Bir nmap taraması atalım ve açık olan portları tespit edelim.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Juicy Details — TryHackMe Writeup

https://cdn-images-1.medium.com/max/2600/1*r-7mmLXr1D7DPLCN_FFULA.png
by Cysec11

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
FalconEye - Real-time detection software for Windows process injections

http://2.bp.blogspot.com/-evr-g5bb7m0/YMZqSngj2lI/AAAAAAAAaDg/k68fHZQrOU4C76vvSH_y02ES5jzzWSvzwCK4BGAYYCw/w640-h432/FalconEye_1-770139.png FalconEye is a windows endpoint detection software for real-time process injections. It is a kernel-mode driver that aims to catch process injections as they are happening (real-time). Since FalconEye runs in kernel mode, it provides a stronger and reliable defense against process injection techniques that try to evade various user-mode hooks.

You can check our presentation at 2021 Blackhat ASIA Arsenal and slides. Project OverviewDetection CoverageThe table below shows the implementation status and the detection logic for the various process injection techniques. WPM stands for WriteProcessMemory. To test the detection, one can refer to the references section.
Technique Status Detection POC Used Atombombing ✓ Hook QueueUserAPC and look for GlobalGetAtom family of functions Pinjectra Instrumentation callback injection ✓ Detect if a new thread is created from floating code https://github.com/antonioCoco/Mapping-Injection Reflective DLL Injection ✓ Detect if a new thread is created from floating code and if PE header is being written into victim MInjector PROPagate ✓ Hook SetProp to get the address of the property being written and corelate with the previous WPM calls to get the address of floating code Pinjectra Process Hollowing ✓ Detected using PE header written into target process memory MInjector CreateRemoteThread with LoadLibrary ✓ New thread with start address pointing to LoadLibrary. MInjector version also writes DLL path using WPM which is also detected MInjector, Pinjectra CreateRemoteThread with MapViewOfFile ✓ Detect if a new thread is created from floating code Pinjectra Suspend-Inject-Resume ✓ Detect if a new thread is created from floating code(MInjector). DLL Path being written via WPM (MInjector). Detect if context set on a previously suspended thread (Pinjectra) MInjector, Pinjectra QueueUserAPC ✓ DLL path being written via WPM MInjector QueueUserAPC with memset (Stackbombing) ✓ Hook QueueUserAPC and look for memset Pinjectra SetWindowLong (Extra window memory injection) ✓ Hook SetWindowLong to get the address of the function pointer being written and corelate with the previous WPM calls to get the address of floating code Pinjectra Unmap + Overwrite ✓ Alert if attacker process is unmapping ntdll from the victim Pinjectra Kernel Ctrl Table ✓ Detect if WPM is overwriting KernelCallbackTable field in the PEB of the victim https://github.com/odzhan/injection/blob/master/kct USERDATA ✓ Check if WPM target address is in conhost.exe range. If so check if any relevant function pointers from conhost match previously stored WPM address https://github.com/odzhan/injection/blob/master/conhost Ctrl-inject ✓ Detect if the attacker does WPM in victim's KernelBase.dll range Pinjectra ALPC Callback ✓ Extract victim pid in NtConnectPort calls to ALPC port. For attacker-victim pid tuple check prior WPM calls and apply Floating code detection Pinjectra WNF Callback ✓ WPM followed by UpdateWNFStateData call https://github.com/odzhan/injection/tree/master/wnf SetWindowsHook ✓ Save module paths registered in NtUserSetWindowsHookEx hook. Later when a module matching this path loads in a different process, generate alert MInjector GhostWriting ✓ Detect if context is set (NtSetContextThread is called) on a previously suspended thread Pinjectra Service Control ✓ WPM overwriting Service IDE of a process (service) https://github.com/odzhan/injection/tree/master/svcctrl Shellcode injection ✓ New thread started from floating code. DLL path being written by WPM MInjector Image Mapping ✓ Thread started from floating code. PE header being written by WPM. DLL path being written by W[...]

___________________________
@hacking_Attack
@Hacking_Video

PM MInjector Thread Reuse ✓ Thread started from floating code. DLL path being written by WPM MInjector Architecture Overviewhttp://2.bp.blogspot.com/-evr-g5bb7m0/YMZqSngj2lI/AAAAAAAAaDg/k68fHZQrOU4C76vvSH_y02ES5jzzWSvzwCK4BGAYYCw/w640-h432/FalconEye_1-770139.png 1. The driver is an on-demand load driver
2. The initialization includes setting up callbacks and syscall hooks via libinfinityhook
3. The callbacks maintain a map of Pids built from cross process activity such as OpenProcess but it is not limited to OpenProcess
4. Subsequent callbacks and syscall hooks use this Pid map to reduce the noise in processing. As a part of noise reduction, syscall hooks filter out same process activity.
5. The detection logic is divided into subcategories namely - stateless (example: Atombombing), stateful (Unmap+Overwrite) and Floating code(Shellcode from multiple techniques)
6. For stateful detections, syscall hooks record an ActionHistory which is implemented as a circular buffer. e.g. It records all the NtWriteVirtualMemory calls where the caller process is different from the target process.
7. The detection logic has common anomaly detection functionality such as floating code detection and detection for shellcode triggers in remote processes. Both callbacks and syscall hooks invoke this common functionality for actual detection.

NOTE: Our focus has been detection and not creating a performant detection engine. We’ll continue on these efforts past the BlackHat presentation. Files.
├── src
│ ├── FalconEye ---------------------------# FalconEye user and kernel space
│ └── libinfinityhook ---------------------# Kernel hook implementation
├── 2021BHASIA_FalconEye.pdf
└── README.mdGetting StartedPrerequisites1. Windows 10 Build 1903/1909
2. Microsoft Visual Studio 2019 onwards
3. Virtualization Software such as VmWare, Hyper-V (Optional) InstallationBuild1. Open the solution with Visual Studio 2019
2. Select x64 as build platform
3. Build solution. This should generate FalconEye.sys binary under src\kernel\FalconEye\x64\Debug or src\kernel\FalconEye\x64\Release Test Machine Setup1. Install Windows 10 Build 1903/1909 in a VM
2. Configure VM for testing unsigned driver

* Using bcdedit, disable integrity checks : BCDEDIT /set nointegritychecks ON1. Run DbgView from sysinternals in the VM or start a debugging connection using WinDbg. Usage1. Copy FalconEye.sys to the Test Machine (Windows 10 VM)
2. Load FalconEye.sys as 'On Demand' load driver using OSR Loader or similar tools
3. Run injection test tools such as pinjectra, minjector or other samples
4. Monitor debug logs either via WinDbg or DbgView ReferencesInfinityHook, 2019 Itzik Kotler and Amit Klein. Process Injection Techniques - Gotta Catch Them All, Blackhat USA Briengs, 2019 Pinjectra, 2019 Mapping-Injection, 2020 Atombombing: Brand new code injection for windows, 2016 Propagate - a new code injection trick, 2017 Windows process injection: Extra window bytes, 2018 Pavel Asinovsky. Diving into zberp's unconventional process injection technique, 2016 Rotem Kerner. Ctrl-inject, 2018 Windows process injection: Consolewindowclass, 2018 Windows process injection: Windows notication facility, 2018 A paradox: Writing to another process without openning it nor actually writing to it, 2007 Windows process injection: Service control handler, 2018 Marcos Oviedo. Memhunter - Automated hunting of memory resident malware at scale. Defcon Demo Labs, 2019 Download FalconEye

___________________________
@hacking_Attack
@Hacking_Video

Internship penetration testing reports
https://www.reddit.com/r/Pentesting/comments/o3slf3/internship_penetration_testing_reports/

Hey guys! ​ Is there any of you that made an internship in penetration testing ?. If yes, it would be very interesting for me if you could share the final report of your internship with me (if it's public ofc), so that I can see some of the results of those internships in the real world. Thank you submitted by /u/Adel_Maestro (https://www.reddit.com/user/Adel_Maestro)
[link] (https://www.reddit.com/r/Pentesting/comments/o3slf3/internship_penetration_testing_reports/) [comments] (https://www.reddit.com/r/Pentesting/comments/o3slf3/internship_penetration_testing_reports/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Figuring out how a phrase is generated from two values

Theres a phrase that gets generated by two values.

Examples:

Score: 28, Time: 4, Phrase: 1470f1ced642036f02686683e8c1f374

Score: 14, Time: 8, Phrase: 54e74994e81d0903db5c544dec391f1f

Score: 1, Time: 4, Phrase: 1ec8f996b291f1273f41da8377ead4bd

Score: 25, Time: 4, Phrase: 0b05eddc375771a2f0290768d42ea4a1

Score: 48, Time: 11, Phrase: 3b8b55e71765c209b0942b5f0dde0171

Visible patterns:

1. 32 characters in length
2. Contains only lower case letters between a-f

I need to fabricate the correct phrase from a set of score and time values, so i need to figure out how the phrase is generated.

I feel like this is some kind of common algorithm so if you recognize this at all please let me know.

Any help would be greatly appreciated.

submitted by /u/MrDankYouTube
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Free Training on AZ-900 (Microsoft Azure Fundamentals) Will Cover Full Course

Hi everyone,

I'm currently doing free training on Microsoft's AZ-900 (Microsoft Azure Fundamentals) course. I'm also going to be doing training on most of their other courses for those that's interested. The training should be enough to be able to write the exam associated with each course plus it will greatly benefit you in the workplace.

I truly hope this helps someone out there that needs the held. I remember what it feels like wanting to learn something like these courses and needing to write the exams but not being able to find any resources, at least not any free ones that is.

I intend on doing this completely for free to help those that's sitting in the same boat I used to be in.

Free Training Microsoft Azure AZ-900!

submitted by /u/CraftyHuntress
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Are there any software or services available that can be used to track the location of mobile devices using their IMEI?

It can be free, paid or subscription based but it should be able to tack devices anywhere in the world.

submitted by /u/zizu_b
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Not sure if this is the right sub - is it safe to do this?

I'm thinking of following the instructions in this video to use tamper monkey to bypass the age restriction on youtube - Is this safe or can I be hacked / get malware by doing this?

https://www.youtube.com/watch?v=34Gme9f_15k&t=175s

submitted by /u/RichEmo
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Traceless pentesting box with Docker
https://www.reddit.com/r/Pentesting/comments/o3y6p0/traceless_pentesting_box_with_docker/

If you use pentesting Docker containers to do pentesting, then how would you get rid of all traces of those containers in the system? Wouldn't deleting those containers and/or Docker itself still keep leftover folders and/or logs in the system? submitted by /u/DonkeyForsaken (https://www.reddit.com/user/DonkeyForsaken)
[link] (https://www.reddit.com/r/Pentesting/comments/o3y6p0/traceless_pentesting_box_with_docker/) [comments] (https://www.reddit.com/r/Pentesting/comments/o3y6p0/traceless_pentesting_box_with_docker/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Bypass For Older Gen IPhone 5s That’s Disabled

I hope this doesn’t break rule 2 or 9, it’s kind of a shitty situation but if it does I do understand mods. So I was curious if there was a way to bypass (I will get OS version when I get home) an iPhone that’s disabled to get into the phone without doing a full restore. We do need the contents within the phone for a SA case proof, and Verizon can’t provide the content of the texts without a court order. Wanted to gauge out my potential options though because I know bypass’s for older gen os’s exist, but I’m not sure if it exists since the phone is already in a disabled state. Thanks again if anyone could point me in the right direction, and again mods I do understand since it does graze the rules

submitted by /u/TheVer7icaL
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacking an android phone with a portable charger?

I guy I know showed me his portable charger and said if he plugs it into my phone he can see everything on my phone and have access to all of my shit. Is this possible? Is it that well known and common of information that I could bump into someone who has that kinda of know-how on tech?

submitted by /u/SlitWristMafia77
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hackers Are Only Profession That Can Make You Work For Us

Write for us and how to make money online? If you have ever heard of writers block or a writer’s block, well you need to hire a hacker.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Authentication Bypass | Easy P1 in 10 minutes

Recon always wins
Read more...

Stored XSS via Invite leading to Mass Account Takeover at Opera.
https://sm4rty.medium.com/stored-xss-via-invite-leading-to-mass-account-takeover-at-opera-a85ed257dd12?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video