Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
Wpscvn - Wpscvn Is A Tool For Pentesters, Website Owner To Test If Their Websites Had Some Vulnerable Plugins Or Themes
http://1.bp.blogspot.com/-tsLybwZtkHU/YON82hqVAuI/AAAAAAAAhFo/gRhGq83r02UBUlhpZhFnT8R6z-dgGlbBACK4BGAYYCw/w640-h404/wpscvn_1-766352.png
wpscvn is a tool for pentesters, website owner to test if their websites had some vulnerable plugins or themes
The author does not hold any responsibility for the bad use of this tool, remember that attacking targets without prior consent is illegal and punished by law.
requires : Python 3
usage : python3 script.py http://site\n
Download Wpscvn
___________________________
@hacking_Attack
@Hacking_Video
Wpscvn - Wpscvn Is A Tool For Pentesters, Website Owner To Test If Their Websites Had Some Vulnerable Plugins Or Themes
http://1.bp.blogspot.com/-tsLybwZtkHU/YON82hqVAuI/AAAAAAAAhFo/gRhGq83r02UBUlhpZhFnT8R6z-dgGlbBACK4BGAYYCw/w640-h404/wpscvn_1-766352.png
wpscvn is a tool for pentesters, website owner to test if their websites had some vulnerable plugins or themes
The author does not hold any responsibility for the bad use of this tool, remember that attacking targets without prior consent is illegal and punished by law.
requires : Python 3
usage : python3 script.py http://site\n
Download Wpscvn
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Wpscvn - Wpscvn Is A Tool For Pentesters, Website Owner To Test If Their Websites Had Some Vulnerable Plugins Or Themes
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Responding to Rabbit Finance’s New Contract Changes and Remaining Dangers to Users
https://cdn-images-1.medium.com/max/600/1*aqlVE1d8yt7q1oIxCXsFWw.jpeg
First of all, we applaud the members in Rabbit’s community that stood up and brought the aforementioned major security backdoors hidden in…
Continue reading on Medium »
Responding to Rabbit Finance’s New Contract Changes and Remaining Dangers to Users
https://cdn-images-1.medium.com/max/600/1*aqlVE1d8yt7q1oIxCXsFWw.jpeg
First of all, we applaud the members in Rabbit’s community that stood up and brought the aforementioned major security backdoors hidden in…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Article of the Day: Cyber Risk and US Nukes
https://cdn-images-1.medium.com/max/760/1*HMXoV3bmBLfjHwzZy2rMjQ.jpeg
Cyber Risk Across the U.S. Nuclear Enterprise — Herbert Lin, Texas National Security Review, Summer 2021
Continue reading on Hybrid Analyst »
Article of the Day: Cyber Risk and US Nukes
https://cdn-images-1.medium.com/max/760/1*HMXoV3bmBLfjHwzZy2rMjQ.jpeg
Cyber Risk Across the U.S. Nuclear Enterprise — Herbert Lin, Texas National Security Review, Summer 2021
Continue reading on Hybrid Analyst »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Ransomware Explained — Ending Ransomware
https://cdn-images-1.medium.com/max/1452/1*GqFTvlSx9cQxhtJv9YOhAQ.png
Stopping ransomware from being an impactful menace is the grand goal, but what are the specific criteria for success we should be striving…
Continue reading on Medium »
Ransomware Explained — Ending Ransomware
https://cdn-images-1.medium.com/max/1452/1*GqFTvlSx9cQxhtJv9YOhAQ.png
Stopping ransomware from being an impactful menace is the grand goal, but what are the specific criteria for success we should be striving…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Atom-HTB-Writeup
https://cdn-images-1.medium.com/max/1184/1*BXA0c1CmwBnbvBxhUGMjRg.png
I am solving Atom machine on HackTheBox this time
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Atom-HTB-Writeup
https://cdn-images-1.medium.com/max/1184/1*BXA0c1CmwBnbvBxhUGMjRg.png
I am solving Atom machine on HackTheBox this time
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Atom-HTB-Writeup
I am solving Atom machine on HackTheBox this time
Trouble with ChromePass and ChromeCookiesView
https://www.reddit.com/r/redteamsec/comments/okjcrb/trouble_with_chromepass_and_chromecookiesview/
ChromePass version: 1.55 ChromeCookiesView version: 1.65 Mates, anyone having trouble decrypting the login data and cookies file of Chrome? I've used this app many times on Windows and now cannot decrypt both files. I've re-copied the following files/folders 3 times to be sure: microsoft protect folder, Login Data, Local State, Cookies. If it's a help, I've tried 2 different domain-joined accounts and cannot decrypt login data or cookies. The password is correct for both accounts relative to the chrome files (and still active). Anyone have ideas? Cheers, Olly submitted by /u/ollyhill424 (https://www.reddit.com/user/ollyhill424)
[link] (https://www.reddit.com/r/redteamsec/comments/okjcrb/trouble_with_chromepass_and_chromecookiesview/) [comments] (https://www.reddit.com/r/redteamsec/comments/okjcrb/trouble_with_chromepass_and_chromecookiesview/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/redteamsec/comments/okjcrb/trouble_with_chromepass_and_chromecookiesview/
ChromePass version: 1.55 ChromeCookiesView version: 1.65 Mates, anyone having trouble decrypting the login data and cookies file of Chrome? I've used this app many times on Windows and now cannot decrypt both files. I've re-copied the following files/folders 3 times to be sure: microsoft protect folder, Login Data, Local State, Cookies. If it's a help, I've tried 2 different domain-joined accounts and cannot decrypt login data or cookies. The password is correct for both accounts relative to the chrome files (and still active). Anyone have ideas? Cheers, Olly submitted by /u/ollyhill424 (https://www.reddit.com/user/ollyhill424)
[link] (https://www.reddit.com/r/redteamsec/comments/okjcrb/trouble_with_chromepass_and_chromecookiesview/) [comments] (https://www.reddit.com/r/redteamsec/comments/okjcrb/trouble_with_chromepass_and_chromecookiesview/)
___________________________
@hacking_Attack
@Hacking_Video
Reddit
r/redteamsec on Reddit: Trouble with ChromePass and ChromeCookiesView
Posted by u/ollyhill424 - 1 vote and no comments
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How I hacked the school examination website.
After the Covid blew up, everything has moved online. School started to teach online to its student and even decided to take exams online…
Continue reading on Medium »
How I hacked the school examination website.
After the Covid blew up, everything has moved online. School started to teach online to its student and even decided to take exams online…
Continue reading on Medium »
hacking: security in practice
nmap scripts don’t seem to be working
When I attempt to use an nmap script on a scan, there is no output relating to the scan and it only seems to do a normal search. I've tried using nmap in the scripts directory, specifiying the port for the script and tried many different scripts and nothing seems to work. Not sure what to do next.
sudo nmap --script sslv2-drown.nse https://nmap.org ) at 2021-07-14 13:48 EDT
Nmap scan report for https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 224.88 seconds
submitted by /u/notmaxbark
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
nmap scripts don’t seem to be working
When I attempt to use an nmap script on a scan, there is no output relating to the scan and it only seems to do a normal search. I've tried using nmap in the scripts directory, specifiying the port for the script and tried many different scripts and nothing seems to work. Not sure what to do next.
sudo nmap --script sslv2-drown.nse https://nmap.org ) at 2021-07-14 13:48 EDT
Nmap scan report for https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 224.88 seconds
submitted by /u/notmaxbark
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
nmap scripts don’t seem to be working
When I attempt to use an nmap script on a scan, there is no output relating to the scan and it only seems to do a normal search. I've tried using...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Windows Hello Bypass Fools Biometrics Safeguards in PCs
https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Windows Hello Bypass Fools Biometrics Safeguards in PCsPost Views: 36
Reading Time: 1 Minute
A vulnerability in Microsoft’s Windows 10 password-free authentication system has been uncovered that could allow an attacker to spoof an image of a person’s face to trick the facial-recognition system and take control of a device.
A Windows security bug would allow an attacker to fool a USB camera used in the biometric facial-recognition aspect of the system.
Windows Hello is a feature in Windows 10 that allows users to authenticate themselves without a password, using a PIN code or biometric identity—either a fingerprint or facial recognition—to access a device or machine. According to Microsoft, about 85 percent of Windows 10 users use the system.
The Windows Hello bypass vulnerability, tracked as CVE-2021-34466, requires an attacker to have physical access to a device to exploit it, according to researchers at CyberArk Labs who discovered the flaw in March.
From there, they can go on “to manipulate the authentication process by capturing or recreating a photo of the target’s face and subsequently plugging in a custom-made USB device to inject the spoofed images to the authenticating host,” Omer Tsarfati, cybersecurity researcher at CyberArk Labs, wrote in a report about the vulnerability published Tuesday.
Further, exploitation of the bypass can extend beyond Windows Hello systems to “any authentication system that allows a pluggable third-party USB camera to act as biometric sensor,” Tsarfati noted.
See Also: Kaseya ransomware supply chain attack: What you need to know Researchers have no evidence that anyone has tried or used the attack in the wild, but someone with motive could potentially use it on a targeted espionage victim, such as “a researcher, scientist, journalist, activist or privileged user with sensitive IP on their device, for example,” according to the analysis.
Microsoft addressed the vulnerability — which affects both consumer and business versions of the feature — in its July Patch Tuesday update. Also, Windows users with Windows Hello Enhanced Sign-in Security — a new security feature in Windows that requires specialized and pre-installed hardware, drivers and firmware — are protected against the any attacks “which tamper with the biometrics pipeline,” according to Microsoft.
However, Tsarfati said that the solution may not fully mitigate the issue.
“Based on our preliminary testing of the mitigation, using Enhanced Sign-in Security with compatible hardware limits the attack surface but is dependent on users having specific cameras,” he said. “Inherent to system design, implicit trust of input from peripheral devices remains. To mitigate this inherent trust issue more comprehensively, the host should validate the integrity of the biometric authentication device before trusting it.” Biometric Weakest LinkCyberArk researchers posted a video of a proof-of-concept (PoC) for how to exploit the vulnerability, which can be used on both the consumer version, Windows Hello, and an enterprise version of the feature called Windows Hello for Business (WHfB) that businesses use with ActiveDirectory.
The bypass itself exploits a weakness in the biometric sensor of Windows Hello, which “transmits information on which the OS … makes its authentication decision,” he wrote. “Therefore, manipulating this information can lead to a potential bypass to the whole authentication system,” Tsarfati said.
See Also: Offensive Security Tool: It Was All A Dream (Windows Print Spooler RCE) [...]
Windows Hello Bypass Fools Biometrics Safeguards in PCs
https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Windows Hello Bypass Fools Biometrics Safeguards in PCsPost Views: 36
Reading Time: 1 Minute
A vulnerability in Microsoft’s Windows 10 password-free authentication system has been uncovered that could allow an attacker to spoof an image of a person’s face to trick the facial-recognition system and take control of a device.
A Windows security bug would allow an attacker to fool a USB camera used in the biometric facial-recognition aspect of the system.
Windows Hello is a feature in Windows 10 that allows users to authenticate themselves without a password, using a PIN code or biometric identity—either a fingerprint or facial recognition—to access a device or machine. According to Microsoft, about 85 percent of Windows 10 users use the system.
The Windows Hello bypass vulnerability, tracked as CVE-2021-34466, requires an attacker to have physical access to a device to exploit it, according to researchers at CyberArk Labs who discovered the flaw in March.
From there, they can go on “to manipulate the authentication process by capturing or recreating a photo of the target’s face and subsequently plugging in a custom-made USB device to inject the spoofed images to the authenticating host,” Omer Tsarfati, cybersecurity researcher at CyberArk Labs, wrote in a report about the vulnerability published Tuesday.
Further, exploitation of the bypass can extend beyond Windows Hello systems to “any authentication system that allows a pluggable third-party USB camera to act as biometric sensor,” Tsarfati noted.
See Also: Kaseya ransomware supply chain attack: What you need to know Researchers have no evidence that anyone has tried or used the attack in the wild, but someone with motive could potentially use it on a targeted espionage victim, such as “a researcher, scientist, journalist, activist or privileged user with sensitive IP on their device, for example,” according to the analysis.
Microsoft addressed the vulnerability — which affects both consumer and business versions of the feature — in its July Patch Tuesday update. Also, Windows users with Windows Hello Enhanced Sign-in Security — a new security feature in Windows that requires specialized and pre-installed hardware, drivers and firmware — are protected against the any attacks “which tamper with the biometrics pipeline,” according to Microsoft.
However, Tsarfati said that the solution may not fully mitigate the issue.
“Based on our preliminary testing of the mitigation, using Enhanced Sign-in Security with compatible hardware limits the attack surface but is dependent on users having specific cameras,” he said. “Inherent to system design, implicit trust of input from peripheral devices remains. To mitigate this inherent trust issue more comprehensively, the host should validate the integrity of the biometric authentication device before trusting it.” Biometric Weakest LinkCyberArk researchers posted a video of a proof-of-concept (PoC) for how to exploit the vulnerability, which can be used on both the consumer version, Windows Hello, and an enterprise version of the feature called Windows Hello for Business (WHfB) that businesses use with ActiveDirectory.
The bypass itself exploits a weakness in the biometric sensor of Windows Hello, which “transmits information on which the OS … makes its authentication decision,” he wrote. “Therefore, manipulating this information can lead to a potential bypass to the whole authentication system,” Tsarfati said.
See Also: Offensive Security Tool: It Was All A Dream (Windows Print Spooler RCE) [...]