KitPloit - PenTest Tools!
OffensivePipeline - Tool To Download, Compile (Without Visual Studio) And Obfuscate C# Tools For Red Team Exercises

https://1.bp.blogspot.com/-rE0u73muQuY/YE6H5C_EIZI/AAAAAAAAVmw/Bua9alQCLKoQU2ElfOlHCStyQeE1H5X7QCNcBGAsYHQ/w640-h288/OffensivePipeline_1_2021-02-18-20-54-21.png OffensivePipeline allows to download, compile (without Visual Studio) and obfuscate C# tools for Red Team exercises.

OffensivePipeline downloads the tool from the git repository, then compiles it with msbuild and finally obfuscates it with ConfuserEx. Examples* List all tools: OffensivePipeline.exe list * Build all tools: OffensivePipeline.exe all * Build a tool OffensivePipeline.exe t toolName https://1.bp.blogspot.com/-jwefLcOfEHQ/YE6IHgNNsrI/AAAAAAAAVm0/ai1guvgBJvY-GaWAlSZAKC3w8qx2ofw2gCNcBGAsYHQ/w640-h326/OffensivePipeline_2_2021-02-18-20-58-21.png Add new toolsThe scripts for downloading the tools are in the Tools folder in yml format. New tools can be added by creating new yml files with the following format:

* Rubeus.yml file: tool:
- name: Rubeus
description: Rubeus is a C# toolset for raw Kerberos interaction and abuses
gitLink: https://github.com/GhostPack/Rubeus
solutionPath: Rubeus\Rubeus.slnRequirements for the release version (Visual Studio 2019 is not required)* Microsoft .NET Framework 3.5 Service Pack 1 (for some tools): https://www.microsoft.com/en-us/download/details.aspx?id=22
* Build Tools for Visual Studio 2019: https://visualstudio.microsoft.com/thank-you-downloading-visual-studio/?sku=BuildTools&rel=16
* Install .NET desktop build tools https://1.bp.blogspot.com/-MXyYKJfoXkk/YE6IOrAIHFI/AAAAAAAAVm8/BVfKCswGC-I-E5ISmdu7qXmUqh94mTPLACNcBGAsYHQ/w640-h322/OffensivePipeline_3_lib01.png * Disable the antivirus :D
* Teste on Windows 10 Pro - Version 20H2 - Build 19042.631 Requirements for build* Net framework 3.5.1 (for some tools): https://www.microsoft.com/en-us/download/details.aspx?id=22
* Visual Studio 2019 -> https://visualstudio.microsoft.com/thank-you-downloading-visual-studio/?sku=Community&rel=16
* Install .NET desktop build tools Supported tools* Internal-Monologue:
* Description: Retrieving NTLM Hashes without Touching LSASS
* GitLink: https://github.com/eladshamir/Internal-Monologue

* InveighZero:
* Description: InveighZero is a C# LLMNR/NBNS/mDNS/DNS/DHCPv6 spoofer and man-in-the-middle tool
* GitLink: https://github.com/Kevin-Robertson/InveighZero

* Rubeus:
* Description: Rubeus is a C# toolset for raw Kerberos interaction and abuses
* GitLink: https://github.com/GhostPack/Rubeus

* Seatbelt:
* Description: Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.
* GitLink: https://github.com/GhostPack/Seatbelt

* SharpChromium:
* Description: SharpChromium is a .NET 4.0+ CLR project to retrieve data from Google Chrome, Microsoft Edge, and Microsoft Edge Beta. Currently, it can extract
* GitLink: https://github.com/djhohnstein/SharpChromium

* SharpDPAPI:
* Description: SharpDPAPI is a C# port of some DPAPI functionality from @gentilkiwi's Mimikatz project.
* GitLink: https://github.com/GhostPack/SharpDPAPI

* SharpGPOAbuse:
* Description: SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.
* GitLink: https://github.com/FSecureLABS/SharpGPOAbuse

* SharpHound3:
* Description: C# Rewrite of the BloodHound Ingestor
* GitLink: https://github.com/BloodHoundAD/SharpHound3

* SharpMove:
* Description: .NET authenticated execution for remote hosts
* GitLink: https://github.com/0xthirteen/SharpMov[...]

e

* SharpRDP:
* Description: Remote Desktop Protocol Console Application for Authenticated Command Execution
* GitLink: https://github.com/0xthirteen/SharpRDP

* Sharp-SMBExec:
* Description: A native C# conversion of Kevin Robertsons Invoke-SMBExec powershell script
* GitLink: https://github.com/checkymander/Sharp-SMBExec

* SharpSpray:
* Description: SharpSpray a simple code set to perform a password spraying attack against all users of a domain using LDAP and is compatible with Cobalt Strike.
* GitLink: https://github.com/jnqpblc/SharpSpray

* SharpStay:
* Description: .NET Persistence
* GitLink: https://github.com/0xthirteen/SharpStay

* SharpUp:
* Description: SharpUp is a C# port of various PowerUp functionality
* GitLink: https://github.com/GhostPack/SharpUp

* SharpView:
* Description: .NET port of PowerView
* GitLink: https://github.com/tevora-threat/SharpView

* SharpWMI:
* Description: SharpWMI is a C# implementation of various WMI functionality.
* GitLink: https://github.com/GhostPack/SharpWMI

* ThreatCheck:
* Description: Modified version of Matterpreter's DefenderCheck
* GitLink: https://github.com/rasta-mouse/ThreatCheck

* Watson:
* Description: Watson is a .NET tool designed to enumerate missing KBs and suggest exploits for Privilege Escalation vulnerabilities.
* GitLink: https://github.com/rasta-mouse/Watson

* winPEAS:
* Description: Privilege Escalation Awesome Scripts SUITE
* GitLink: https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite Download OffensivePipeline

hacking: security in practice
XSS vulnerability in a hidden field in a website.

Hello, I am working on this website. It had hidden inputs ,i tried injecting “onclick=alert(1)” in one of the inputs after making them from hidden to “display” . It worked and a pop up appeared. Does this mean i have to stop at this point and report to the website? Or what is next?

submitted by /u/Ramseesthe4th
[link] [comments]

hacking: security in practice
Decoding challenge

I have a homework assignment I need help with. The base64 piece of it is straightforward enough, but didn't get any further.

https://pastebin.com/xTThPgy5

submitted by /u/secureartisan
[link] [comments]

Hacking on Medium
HOW TO HACK EXAMPLIFY

https://cdn-images-1.medium.com/max/660/0*b7CgyA8waLurR4Oj.jpeg
CONTACT: QULIOUSHACKER@GMAIL.COM — -IF YOU HAVE HACKING RELATED ISSUES CONCERNING HOW TO HACK AND CHANGE YOUR UNIVERSITY GRADES AND…

Continue reading on Medium »

Hacking on Medium
在线订购廉价护照 (微信：cameron202)

https://cdn-images-1.medium.com/max/1800/1*cmu7YuhWHAQ_eXQ8lOC2mA.jpeg
护照，驾驶执照，身份证，签证，文凭和出生证明

Continue reading on Medium »

Hacking on Medium
HOW TO CHEAT ON AN ONLINE PROCTORED EXAM

https://cdn-images-1.medium.com/max/700/0*9xm5laavYW82nk1i.jpeg
CONTACT: QULIOUSHACKER@GMAIL.COM — -IF YOU HAVE HACKING RELATED ISSUES CONCERNING HOW TO HACK AND CHANGE YOUR UNIVERSITY GRADES AND…

Continue reading on Medium »

Hacking on Medium
How To Change Your Grades Online Hack CONTACT: QULIOUSHACKER@GMAIL.COM

CONTACT: QULIOUSHACKER@GMAIL.COM — -IF YOU HAVE HACKING RELATED ISSUES CONCERNING HOW TO HACK AND CHANGE YOUR UNIVERSITY GRADES AND…

Continue reading on Medium »

Hacking on Medium
I NEED A HACKER TO CHANGE MY UNIVERSITY TRANSCRIPT CONTACT: QULIOUSHACKER@GMAIL.COM

https://cdn-images-1.medium.com/max/600/0*UQ0w42Vre1HM3DTp.jpeg
CONTACT: QULIOUSHACKER@GMAIL.COM — -IF YOU HAVE HACKING RELATED ISSUES CONCERNING HOW TO HACK AND CHANGE YOUR UNIVERSITY GRADES AND…

Continue reading on Medium »

Hacking on Medium
I Need To Hire A Hacker To Change My Grade CREATIVEHACKERS2@GMAIL.COM

https://cdn-images-1.medium.com/max/799/0*nCKqQYhDmGez2z4D.jpg
I Need To Hire A Hacker To Change My Grade

Continue reading on Medium »

Hacking on Medium
HOW TO CHANGE YOUR GRADES ONLINE PERMANENTLY CONTACT: QULIOUSHACKER@GMAIL.COM

CONTACT: QULIOUSHACKER@GMAIL.COM — -IF YOU HAVE HACKING RELATED ISSUES CONCERNING HOW TO HACK AND CHANGE YOUR UNIVERSITY GRADES AND…

Continue reading on Medium »

hacking: security in practice
Emerging Domains

I wanted to round up some areas of emerging opportunity. The traditional areas of hacking revolve around the network and operating system, web applications, and software language specific exploits.

A long and glorious career can be devoted to focusing on any one of these, or by tackling each until one has a great breadth and depth.

But new opportunity for infosec can be found in the following areas:

1.
Cloud security

* persistence in an immutable and ephemeral environment?
* configuration screw ups

2.
Open source security

* poison deep transitive dependencies that wind up in ops
* identify dependency vulnerabilities that can be exploited

3.
Machine learning security

* what are the vulnerabilities of a machine learning model?
* apply ML to different infosec problems

4.
Container security

* Tiny OS hacking
* similar to open source dependency, what one might call supply chain attacks
* kubernetes configuration screw ups

5.
IoT/mobile

* drones
* robots
* cars
* phones
* thermostats

6.
Cryptocurrency

* look up a couple blogs about ethereum and the dark forest, and the maker dao hack; see the world of smart contract hacking
What else?

submitted by /u/Delicious_Context_53
[link] [comments]

hacking: security in practice
RAT usage

Hi there! I want to up my knowledge of things like rats in order to sort of protect myself better on the internet etc.

Now I have a question. Is the usage of quasar illegal? Or is it legal if I use it on VM’s for testing?

Let me just assure you all. I have literally NO plans of using anything like this for illegal activities. I don’t condone it and I’d screw up even if I tried. I 100% want to use it personally for virtual machine usage or on family members systems assuming they give me full permission.

Would it be illegal for me to use this software? Or as long as I use it legally. Will I be fine to access the software whenever I want for testing on virtual machines?

submitted by /u/Pear-Emergency
[link] [comments]