403 Forbidden Page Bypass — Rare Exploitation of frequently seen Vulnerability
https://medium.com/@uduthalavankumar/403-forbidden-page-bypass-rare-exploitation-of-frequently-seen-vulnerability-ee16c434add7?source=rss------bug_bounty-5

Welcome to my knowledge hub spot and Hope you all are doing Good. During my hunting time, I have seen many URL’s which is showing 403…Continue reading on Medium » (https://medium.com/@uduthalavankumar/403-forbidden-page-bypass-rare-exploitation-of-frequently-seen-vulnerability-ee16c434add7?source=rss------bug_bounty-5)

Strafer - A Tool To Detect Potential Infections In Elasticsearch Instances

Elasticsearch infections are rising exponentially. The adversaries are exploiting open and exposed Elasticsearch interfaces to trigger infections in the cloud and non-cloud deployments. During this talk, we will release a tool named "STRAFER" to detect potential infections in the Elasticsearch instances. The tool allows security researchers, penetration testers, and threat intelligence experts to detect compromised and infected Elasticsearch instances running malicious code. The tool also enables you to conduct efficient research in the field of malware targeting cloud databases. In this version of the tool, the following modules are supported: Elasticsearch instance information gathering and reconnaissance Elasticsearch instance exposure on the Internet Detecting potential ransomware infections in the Elasticsearch instances Detecting potential botnet infections such as meow botnet. Detecting infected indices in the Elasticsearch instances Detecting Elasticsearch honeypots Note: This is the first release of the tool and we expect to add more modules in the nearby future. Researched and Developed By: Aditya K Sood and Rohit Bansal Download Strafer
Read more...

KitPloit - PenTest Tools!
Strafer - A Tool To Detect Potential Infections In Elasticsearch Instances

https://1.bp.blogspot.com/-3uVRHmgMPzw/YEGeAYwHheI/AAAAAAAAVlI/J5tPR986h1MC24GWzCA0yeATaQ_GZmvjQCNcBGAsYHQ/w640-h276/strafer_1_strafer.png
Elasticsearch infections are rising exponentially. The adversaries are exploiting open and exposed Elasticsearch interfaces to trigger infections in the cloud and non-cloud deployments. During this talk, we will release a tool named "STRAFER" to detect potential infections in the Elasticsearch instances. The tool allows security researchers, penetration testers, and threat intelligence experts to detect compromised and infected Elasticsearch instances running malicious code. The tool also enables you to conduct efficient research in the field of malware targeting cloud databases. In this version of the tool, the following modules are supported:

* Elasticsearch instance information gathering and reconnaissance
* Elasticsearch instance exposure on the Internet
* Detecting potential ransomware infections in the Elasticsearch instances
* Detecting potential botnet infections such as meow botnet.
* Detecting infected indices in the Elasticsearch instances
* Detecting Elasticsearch honeypots
Note: This is the first release of the tool and we expect to add more modules in the nearby future.

Researched and Developed By: Aditya K Sood and Rohit Bansal
Download Strafer

Deep Web
What's the difference deep web v dark web

Hi, sorry if it has already been asked a zillion times here, but I'm just very curious what's the difference between deep web v dark web? I tried looking for an answer myself, so the best explanation that I read was - all non-indexed content refers to deep web, whereas dark web involves illegal niches specifically (found it here). Correct me if I'm wrong !

submitted by /u/NoDomes
[link] [comments]

hacking: security in practice
Telegram RAT coded in Python

https://b.thumbs.redditmedia.com/LsBCtR_v_CzSHerKsCM_nTXg8I9oTvAyLz1dOXu0vzc.jpg submitted by /u/TorchedXorph
[link] [comments]

hacking: security in practice
USB traffic emulation?

Heya, I've monitored some traffic through a USB port (Just some basics to create directories) although I would like to know if there is a method I can use to emulate the traffic I've saved.

eg. Plug another USB in and replicate the exact data transfer.

submitted by /u/pilchard2002
[link] [comments]

Strafer - A Tool To Detect Potential Infections In Elasticsearch Instances
http://www.kitploit.com/2021/03/strafer-tool-to-detect-potential.html

Elasticsearch infections are rising exponentially. The adversaries are exploiting (https://www.kitploit.com/search/label/Exploiting) open and exposed Elasticsearch (https://www.kitploit.com/search/label/Elasticsearch) interfaces to trigger infections in the cloud and non-cloud deployments. During this talk, we will release a tool named "STRAFER" to detect potential infections in the Elasticsearch instances. The tool allows security researchers, penetration testers, and threat intelligence (https://www.kitploit.com/search/label/Threat%20Intelligence) experts to detect compromised and infected Elasticsearch instances running malicious code. The tool also enables you to conduct efficient research in the field of malware targeting cloud databases. In this version of the tool, the following modules are supported: Elasticsearch instance information gathering (https://www.kitploit.com/search/label/Information%20Gathering) and reconnaissance Elasticsearch instance exposure on the Internet Detecting potential ransomware infections in the Elasticsearch instances Detecting potential botnet infections such as meow botnet. Detecting infected indices in the Elasticsearch instances Detecting Elasticsearch honeypots
Note: This is the first release of the tool and we expect to add more modules in the nearby future. Researched and Developed By: Aditya K Sood and Rohit Bansal

Download Strafer (https://github.com/adityaks/strafer)

Improper Validation of Certificate with Host Mismatch [CWE-297] — The Hacktivists

This weakness describes Improper Validation of Certificate with Host Mismatch.Continue reading on Medium »
Read more...

Hacking Articles|Raj Chandel's Blog
Thick Client Penetration Testing: Traffic Analysis

Traffic analysis is one of the crucial parts of any successful penetration test. In this article we’re going to discuss some of the different techniques that can be used to analyze thick client applications. If a thick client using HTTP traffic then it is pretty straight forward to intercept the traffic.  We can use the tools like

<o:p

To Intercept the HTTP like Traffic: -<o:p

· Burp Suite<o:p

<o:p

To Intercept TCP like Traffic: -<o:p

· Wireshark<o:p

· MITM Relay + Burp Suite <o:p

· Echo Mirage (Properly Maintained)<o:p

<o:p

As we’re pen-testing Damn Vulnerable thick client applications and DVTA is using non-HTTP protocols for example., FTP. It doesn’t make any HTTP connections so we can’t use Burp Suite directly. So, we have another option to monitor the traffic by using a tool like Wireshark but it doesn’t allow you to tamper the traffic you can only monitor and understand the traffic. But if our goal is to intercept and modify the traffic, we will have to go with a tool called Echo Mirage.<o:p

So, without wasting much time let’s begin the Traffic Analysis.<o:p

<o:p

Table of content <o:p

· Prerequisites <o:p

· What is Traffic Analysis <o:p

· Traffic Analysis Via Wireshark<o:p

· Traffic Analysis Via Echo Mirage<o:p

· Traffic Analysis Via Burp Suite + MITM Relay<o:p

<o:p

Traffic Analysis <o:p

Any Thick client application communicating with the backend means they are sending some data to its backend components like web server, FTP Server, database server, etc. Analyzing the data during transfer is a very crucial part of the analysis of an application. some applications perform data transit without enforcing any encryption. So, the concept of intercepting traffic of thick clients is not much different than thin clients, the tools will differ depending on the protocols used by the application also these applications are non-proxy aware as well the intercepting techniques also will slightly vary.<o:p

<o:p

Prerequisites <o:p

· Wireshark <o:p

· Python 3<o:p

· Burp Suite<o:p

· Echo Mirage<o:p

· Python pip script<o:p

· MITM Relay <o:p

<o:p

Traffic Analysis via Wireshark<o:p

As a penetration tester, you must have good knowledge how to use a network packet sniffer is essential for day-to-day operations. Whether you are trying to understand a protocol, debug a network client or analyze traffic, you’ll always end up needing a network sniffer.<o:p

Examining the traffic between the tested thick client application and the server might reveal sensitive and unencrypted data such as:<o:p

· Most Sensitive data transferred over an unencrypted tunnel such as clear-text credentials/secrets/API Keys etc.<o:p

· HTTP and HTTPS web endpoints <o:p

· File blobs/chunks sent over the wire<o:p

· Proprietary protocols used by the program<o:p

<o:p

We are going to analyze FTP traffic that’s generated by DVTA. For this we are going to use Loop Back address. So, first of all Launch Wireshark and choose “Adapter for loopback Traffic Capture”.<o:p https://1.bp.blogspot.com/-nsCNLxEMnRU/YFNBxrDZWdI/AAAAAAAAuwM/uHxZJ6Bw3ag503IJpNqli4Lm4TyvQriiwCLcBGAsYHQ/s16000/1.png <o:p

Then after launch modified DVTA application and login to the application by using admin credentials as shown below.<o:p https://1.bp.blogspot.com/-d7gZuDEJbkw/YFNB3mCjDsI/AAAAAAAAuwQ/XOzI8JWvd4IxAb2h_pCbxebSx-BHzwJegCLcBGAsYHQ/s16000/2.png As you can see, we have successfully logged in and it showing Backup data to FTP server <o:p https://1.bp.blogspot.com/-allZ6bSpxZ8/YFNB8DgpkfI/AAAAAAAAuwU/0sFFyx77kPU2SbWgL4xCnpbAKLlPaBR1ACLcBGAsYHQ/s16000/3.png When [...]

you click backup data to FTP server it will make an FTP connection with the FTP server and it will try to upload some data to FTP server. After uploading the data, it will show you a Success message as shown below.<o:p https://1.bp.blogspot.com/-vAO35-j_PkI/YFNCAdsLgUI/AAAAAAAAuwY/ZIaSzYRSQ2gZ2havjpPm39P_JbFCYdFrQCLcBGAsYHQ/s16000/4.png Just after Backup data to FTP server come back to the Wireshark and stop capturing the data so that it won’t capture unnecessary data as shown in below image. Apply the filter of FTP protocol so that is only shows the traffic captured of DVTA application while uploading data to the FTP server.<o:p https://1.bp.blogspot.com/-6Xt2f4cYWks/YFNCEDO1zDI/AAAAAAAAuwg/75jVdase2tQFdzeNWFRUXCZPheK7lNrWACLcBGAsYHQ/s16000/5.png Now what we are interested in is the credentials that might be used by DVTA application to login to the FTP server. We can check them by observing the captured FTP traffics. If you notice the first packet is the response from the FileZilla server and then we have a command “USER and the USER name: DVTA”. Then after in third line there is a response from the FTP server saying password is Required for DVTA and in the next line there is a “Password: p@ssw0rd” that was sent by the client.<o:p https://1.bp.blogspot.com/-_Wf6oJbUNco/YFNCIlv7S5I/AAAAAAAAuwk/vcKk_uFdEK01uCCqz_k4eA_PuJ6aSTQpACLcBGAsYHQ/s16000/6.png Now it’s pretty clear that the user name and password are available for us. So, let’s quickly open a browser and surf to ftp://127.0.0.1and try to use the credentials here that we have captured as shown below.<o:p https://1.bp.blogspot.com/-TCZSOqLaWAQ/YFNCPbeUBpI/AAAAAAAAuws/ipLVu9mpObUSjpmmZgDK1GpiW-gleoHOwCLcBGAsYHQ/s16000/7.png And here you go…, as you can see, we have successfully connected to the FTP server and we can download everything that is available in that folder as shown below. This is how an attacker grab credentials that are being used by the application in the client site. They can probably do some Wireshark capture and if the credentials are found in clear text, they can easily login to the FTP server and can tamper or download the data easily.<o:p https://1.bp.blogspot.com/-mZo_d59G3nc/YFNCSyWMNTI/AAAAAAAAuw0/Dc4wytHAzQYF1Q2ibsh9-Yx1rYssVVlGwCLcBGAsYHQ/s16000/8.png <o:p

Traffic Analysis via Echo mirage

Download and Extract Echo Mirage into your desirable folder. You can download Echo Mirage from here: https://mega.nz/file/bHhQ3QrA#l4d-lc3bL1tm8AOUcMzlkbN6SaMYFPXNjRr1caD0m1E<o:p

Let’s open up the EchoMirage application.<o:p https://1.bp.blogspot.com/-PbXYN-RpHJo/YFNChjUyzqI/AAAAAAAAuw8/rndsF-JMpvMUjhopwQB_ItT55QafBDGugCLcBGAsYHQ/s16000/9.png and it will open EchoMirage for us<o:p https://1.bp.blogspot.com/-MEOAjL4ALmI/YFNCl2Z6T7I/AAAAAAAAuxE/o5oc3WnPb84_FK4EMge_s_PU0jVqJxgawCLcBGAsYHQ/s16000/10.png But also remember one thing don’t forget to delete FTP CSV file that you have uploaded earlier by using DVTA application so that we can upload a new copy again. Now again open the DVTA application and login to the Application by using admin credentials.<o:p https://1.bp.blogspot.com/-HelyhMjBFn4/YFNCsOhH0KI/AAAAAAAAuxI/GW37SrYGY4Y2LpuU8ZiVAEigZrPEywSvgCLcBGAsYHQ/s16000/11.png So, we have successfully logged into DVTA application and when we click on “Backup data to FTP server”then we want be able to be able to see wht’s going on using EchoMirage. To do this create a new Rule by going to “Rule > New Rules” choose the direction to “Any” as we want to capture traffic only from the port of 21 so “set the Port to Port no. 21”then after click on “intercept”and then save the configuration by hitting “ok”as shown below <o:p https://1.bp.blogspot.com/-EskOgGxsjNc/YFNC3TwJSvI/AAAAAAAAuxQ/yI8jHErK9YgsSj_aCN-CGMDAC0_AmL4BgCLcBGAsYHQ/s16000/12.png Now here we can see the Rules created by us, as we can see we are going to intercept all [...]

the traffic that’s going to outbound and inbound also we are going to intercept the traffic of port 21 only. <o:p https://1.bp.blogspot.com/-Dc2oUGwB8d8/YFNDHGJBqtI/AAAAAAAAuxg/752QQULv-FY-eNtjR-7x5l2nBoChqcICwCLcBGAsYHQ/s16000/13.png Now, navigate to Process and click on inject<o:p https://1.bp.blogspot.com/-YQVzs6X2u6E/YFNDMfWBfjI/AAAAAAAAuxk/IpUZGzXrg-I2SA81YB8hi-y7kqN5L7oxQCLcBGAsYHQ/s16000/14.png and we are going to see all the process that are running on your machine. But we are interested to see the traffic only from DVTA.exe so select it and inject into process<o:p https://1.bp.blogspot.com/-ZIm51xBjoWs/YFNDQh6Qe7I/AAAAAAAAuxo/ydYCYKqxrqAtVp4t-5eyqtTyNyky1ydpACLcBGAsYHQ/s16000/15.png Navigate to the tab of Traffic.Log then go to the DVTA application and click on Backup Data to FTP Server. Come back to Echo Mirage and here If you see it started capturing traffic from DVTA.exe.<o:p

But we’re not interested in this so just hit OK and forward the traffic.<o:p https://1.bp.blogspot.com/-x9Z-wdEFCbQ/YFNDVRQWQtI/AAAAAAAAuxw/XuSAXk_Scro2RvyP3PtlT5YADkxoG9EDACLcBGAsYHQ/s16000/16.png If you see there is response coming from files FileZilla server and click ok once again..<o:p https://1.bp.blogspot.com/-P1Kngu0LRH4/YFNDb1yuomI/AAAAAAAAux0/zAc47wE0ZMEheK9RREAerE0shcorEdA_QCLcBGAsYHQ/s16000/17.png And if you see here the user name is being sent to the FTP server <o:p https://1.bp.blogspot.com/-VtAbhB5dGRY/YFNDgob_QdI/AAAAAAAAux8/5PIfTQ5S8AsSD-zFip_zKd2KHPVBqdWvgCLcBGAsYHQ/s16000/18.png And the response from FTP server says that password required for DVTA. Hit ok and forward the Traffic.<o:p https://1.bp.blogspot.com/-0RRA5Q5VWFk/YFNDkMF5NSI/AAAAAAAAuyA/jD5ikDYajeUlAU1ocm52EvCpP0uxY0IXgCLcBGAsYHQ/s16000/19.png As you can see the password can bee seen in clear text “p@ssw0rd”. The DVTA client is sending its password to FTP server<o:p https://1.bp.blogspot.com/-SLAhVA0xQ1E/YFNDqr8plCI/AAAAAAAAuyE/Q0cLsIOZeUMYfFKwu6X6YF6ixzD15OYlwCLcBGAsYHQ/s16000/20.png And as you can see, you’re logged in now<o:p https://1.bp.blogspot.com/-VUCxFOPt418/YFND-I8p-OI/AAAAAAAAuyQ/8ElhT9jxNu8TT_tdJ_P1KiNS6Q40oybLwCLcBGAsYHQ/s16000/21.png If you are still observing the traffic then you should see some file being uploaded onto their FTP server just hit ok and forward the traffic.<o:p https://1.bp.blogspot.com/-aSl9Hy9h2E8/YFNEE1ipbgI/AAAAAAAAuyU/y4aPFGVkVjcVZIA1iCLl_NkciqSXVE0wACLcBGAsYHQ/s16000/22.png You can see here that ftp-admin.csv is being uploaded here.<o:p https://1.bp.blogspot.com/-6R3dp8QNh3Y/YFNEMimyTlI/AAAAAAAAuyY/fqAnPhIB0bUYelwPwHCdi6VNbdC7gIF-gCLcBGAsYHQ/s16000/23.png In the last you can see the response successfully transferred ftp-admin.csv and you can find that file on your desktop<o:p https://1.bp.blogspot.com/-TwgNbsovVVw/YFNEWxv4Y7I/AAAAAAAAuyk/4fkrg8SmZK8n16NE_W0fSnUPLLfSWdTSACLcBGAsYHQ/s16000/24.png <o:p

Traffic Analysis via Burp Suite + MITM Relay<o:p

First of all you need to download MITM Relay from GitHub or also you can directly download it from here: - https://github.com/jrmdev/mitm_relay<o:p

<o:p https://1.bp.blogspot.com/-i6X0Uy17iac/YFNEhZBZ-yI/AAAAAAAAuys/tNVxIuIEw-sCaF-tFrYXZQPzpCl5yhlVQCLcBGAsYHQ/s16000/25.png Download and Extract in your work folder <o:p https://1.bp.blogspot.com/-QlBzpQPdh04/YFNEmRk9_ZI/AAAAAAAAuy0/zrLmWmVhjs4n2zIEeZGVEvNfmLfkWCfgQCLcBGAsYHQ/s16000/26.png MITM Relay is a python script and it works fine with Python 3 so download and install it by going to the official website of python or you can also download it from here: - https://www.python.org/ftp/python/3.9.2/python-3.9.2-amd64.exe<o:p

<o:p https://1.bp.blogspot.com/-yzTINLjln-Q/YFNEtt_zsbI/AAAAAAAAuy4/0nNCPTqsBZMlwBjoM-38uqlHqHbwl-LiQCLcBGAsYHQ/s16000/27.png <o:p

In manner to download repositories from python, “get-pip”needs to be available in your system you can get it from here: - https://bootstrap.pypa.io/get-pip.py<o:p

All[...]