Hacking on Medium
Pumpkin Raising — Vulnhub

https://cdn-images-1.medium.com/max/600/1*1Dx34ctbZzHskCGjK4mKig.png
Here is another CTF from vulnhub called Pumpkin Raising. This CTF is a web application. We will also be handling a .PCAP file to find…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The SolarWinds hack — the debate and recriminations rages on…

https://cdn-images-1.medium.com/max/960/1*FEKsM-F2w6sXqC6srq8OHw.jpeg
With the rise of more Ransomware attacks — the most recent hitting Silicon Valley VC firms, I decided to re-post this reminder.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Buka Lapak BugBounty [ XSS Reflected ]

https://cdn-images-1.medium.com/max/2560/1*kUOAh1qJ3sm5nofc7ljRKA.png
Bagaimana kabar kalian semua ? semoga semuanya sehat, disini saya akan membahas mengenai program bug bounty yang disediakan oleh bukalapak…

Continue reading on Medium »

Hacking on Medium
Hacking Satellites: Analysis and Defense Lab

https://cdn-images-1.medium.com/max/1920/1*qSdHNhEDPx8-6l9i86eGXA.jpeg
Hack-A-Sat

Continue reading on CodeX »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Auth Bypass Bug Exploited, Affecting Millions of Routers

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Auth Bypass Bug Exploited, Affecting Millions of RoutersPost Views: 108
Reading Time: 1 Minute
An authentication-bypass vulnerability affecting multiple routers and internet-of-things (IoT) devices is being actively exploited in the wild, according to researchers.
A mere three days after disclosure, cyberattackers are hijacking home routers from 20 vendors & ISPs to add them to a Mirai-variant botnet used for carrying out DDoS attacks.
The security flaw, tracked as CVE-2021-20090, was disclosed last week by researchers at Tenable. It affects devices from 20 different vendors and ISPs (ADB, Arcadyan, ASMAX, ASUS, Beeline, British Telecom, Buffalo, Deutsche Telekom, HughesNet, KPN, O2, Orange, Skinny, SparkNZ, Telecom [Argentina], TelMex, Telstra, Telus, Verizon and Vodafone), all of which use the same firmware from Arcadyan. In all, millions of devices worldwide could be vulnerable.

Tenable demonstrated in a proof of concept (PoC) that it’s possible to modify a device’s configuration to enable Telnet on a vulnerable router and gain root level shell access to the device.

“The vulnerability exists due to a list of folders which fall under a ‘bypass list’ for authentication,” according to Tenable’s advisory on August 3. “For most of the devices listed, that means that the vulnerability can be triggered by multiple paths. For a device in which http://<ip/index.htm requires authentication, an attacker could access index.htm using the following paths:

* http://<ip/images/..%2findex.htm
* http://<ip/js/..%2findex.htm
* http://<ip/css/..%2findex.htm
See Also: Critical Cisco Bug in VPN Routers Allows Remote Takeover
“To have the pages load properly, one will need to use proxy match/replace settings to ensure any resources loaded which require authentication also leverage the path traversal,” the advisory continued. Exploited to Spread Mirai VariantJust three days after disclosure, on Friday, cybersecurity researchers from Juniper Networks said they had discovered active exploitation of the bug.

“We have identified some attack patterns that attempt to exploit this vulnerability in the wild coming from an IP address located in Wuhan, Hubei province, China,” they wrote in a post. “The attacker seems to be attempting to deploy a Mirai variant on the affected routers.”

Cleaving close to Tenable’s PoC, the attackers are modifying the configuration of the attacked device to enable Telnet using “ARC_SYS_TelnetdEnable=1” to take control, according to Juniper. Then, they proceed to download the Mirai variant from a command-and-control (C2) server and execute it.

Mirai is a long-running botnet that infects connected devices and can be used to mount distributed denial-of-service (DDoS) attacks. It burst on the scene in 2016, when it overwhelmed servers at the Dyn web hosting company, taking down more than 1,200 websites, including Netflix and Twitter. Its source code was leaked later that year, after which multiple Mirai variants began to crop up, in a barrage that continues to this day.

Some of the scripts in the current set of attacks bear resemblance to previously observed activity picked up in February and March, according to Juniper.

“The similarity could indicate that the same threat actor is behind this new attack and attempting to upgrade their infiltration arsenal with yet another freshly disclosed vulnerability,” researchers wrote. “Given that most people may not even be aware of the security risk and won’t be upgrading their device anytime soon, this attack tactic can[...]

be very successful, cheap and easy to carry out.”
See Also: Offensive Security Tool: Mimikatz In addition to the router bug, Juniper researchers observed the following known vulnerabilities being exploited to gain initial access to target devices:

* CVE-2020-29557 (DLink routers)
* CVE-2021-1497 and CVE-2021-1498 (Cisco HyperFlex)
* CVE-2021-31755 (Tenda AC11)
* CVE-2021-22502 (MicroFocus OBR)
* CVE-2021-22506 (MicroFocus AM)

In fact, the attackers have been continuously adding new exploits to its arsenal, according to the posting, and CVE-2021-20090 is unlikely to be the last.

“It is clear that threat actors keep an eye on all disclosed vulnerabilities,” researchers concluded. “Whenever an exploit PoC is published, it often takes them very little time to integrate it into their platform and launch attacks.”

To avoid compromise, users should update their firmware on the router. See Also: Hacking Stories: Andrian Lamo – The ‘homeless’ Hacker “In the case of IoT devices or home gateways, the situation is much worse as most users are not tech-savvy and even those who are do not get informed about potential vulnerabilities and patches to apply,” according to Juniper. “The only sure way to remedy this issue is to require vendors to offer zero-down-time automatic updates.”
Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/cisco-patch-90x90.png Critical Cisco Bug in VPN Routers Allows Remote Takeover1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/delete-telegram-message-e1628177080885-90x90.jpg MacOS Flaw in Telegram Retrieves Deleted Messages4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/spam-call-90x90.jpg Black Hat: ‘I’m Calling About Your Car Warranty’, aka PII Hijinx5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Google-Chrome-Browser-Management-90x90.png Bugs in Chrome’s JavaScript engine can lead to powerful exploits. This project aims to stop them6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/chinese-flag-keyboard-internet-istock-90x90.jpg DeadRinger: Chinese APTs strike major telecommunications companies1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/public-wifi-90x90.jpg NSA Warns Public Networks are Hacker Hotbeds1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/iran-thumb-90x90.jpg Hackers used never-before-seen wiper in recent attack on Iranian train system2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/PunkSpider-90x90.png Reboot of PunkSpider Tool at DEF CON Stirs Debate2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/apple-mac-security-90x90.jpg Apple Patches Actively Exploited Zero-Day in iOS, MacOS2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Windows-Abstract-90x90.jpg Microsoft Rushes Fix for ‘PetitPotam’ Attack PoC2 weeks ago
style="display:block; text-align:center;"
data-ad-layout="in-article"
data-ad-format="fluid"
data-ad-client="ca-pub-6620833063853657"
data-ad-slot="4517761481">
The post Auth Bypass Bug Exploited, Affecting Millions of Routers first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
can I trust Hacktown on tor?

can I trust Hacktown on tor?

submitted by /u/Berry_2802
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
weirdo acted as another highschooler from my school for over an hour to get my explicit pics

hey guys i wanna start this off with no i did not send pictures. i just want help on how to get an IP address/ how to link a persons one social media to their other medias. i am a girl and this guy which i imagine is older because it seemed like so slid up on my snapchat saying he went to my school. he answered no questions about dress code or any of the school plans. he tried to get pictures out of me over a long time but im not a troglodyte so i dodged these. anyway he admitted so can someone tell me how to find the IP address!! i kinda wanna scare him for making me cry and making me uncomfy, but also let me know if this is a bad idea... also idk if IP grabbing is hacks either so

submitted by /u/urinalbutter420
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Elpscrk : An Intelligent Common User-Password Profiler Based On Permutations And Statistics

Elpscrk is an Intelligent common user-password profiler that’s named after the same tool in Mr. Robot series S01E01. In simple words, elpscrk will ask you about all info you know about your target then will try to generate every possible password the target could think of, it all depends on the information you give, the […]

The post Elpscrk : An Intelligent Common User-Password Profiler Based On Permutations And Statistics appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

UnhookMe - An Universal Windows API Resolver And Unhooker Addressing Problem Of Invoking Unmonitored System Calls From Within Of Your Red Teams Malware
http://www.kitploit.com/2021/08/unhookme-universal-windows-api-resolver.html

___________________________
@hacking_Attack
@Hacking_Video

In the era of intrusive AVs and EDRs that introduce hot-patches to the running processes for their enhanced optics requirements, modern adversaries must have a robust tool to slide through these watchguards. The propsed implementation of dynamic (https://www.kitploit.com/search/label/Dynamic) imports resolver that would be capable of unhooking used functions in-the-fly is yet another step towards strengthening adversary resilience efforts. The solution I'm proposing here is to switch from using linker-resolved WinAPI imports, staying visibile in compiled executable's PE headers (Import Address Table specifically) to favor fully-dynamic approach insisting on resolving imports only in a dynamic fashion. Such dynamical resolver can be equipped with unhooking logic happening in the background, without any sort of guidance from the operator's side.
Showcase

___________________________
@hacking_Attack
@Hacking_Video

Here's how UnhookMe example works: It presents us with the first MessageBoxW that is not subject for hooking Then we hook MessageBoxW prologue ourselves to make it always return 0 without displaying it's message Finally, we resolve MessageBoxW dynamically using the UnhookingImportResolver resolver, which will detect applied prologue patches and restore original bytes, effectively unhooking MessageBoxW functionality. In the meantime of popping message boxes, these are the loglines printed to console's stdout: [~] Resolved symbol kernel32.dll!CreateFileA
[~] Resolved symbol kernel32.dll!ReadProcessMemory
[~] Resolved symbol kernel32.dll!MapViewOfFile
[~] Resolved symbol kernel32.dll!VirtualProtectEx
[#] Found trampoline hook in symbol: MessageBoxW . Restored original bytes from file.
[~] Resolved symbol user32.dll!MessageBoxW

How to use it?
There are in total 5 C++ source code/header files that your solution need to include. However your main program file needs to include only two required headers, as detailed below. resolver.h - header containing most of the UnhookingImportResolver implementation and handy macrodefinitions resolver.cpp - source code with global options defined usings.h - a one big and nasty header file containing tens of using type definitions for commonly used WinAPIs PE.cpp - custom PE parser source code file PE.h - custom PE parser header file
Required headers
Your program will require only two headers being included: #include "usings.h"
#include "resolver.h"
Global options
There are couple of global options that can be changed affecting the way in which Resolver (https://www.kitploit.com/search/label/Resolver) works or reports it's activity. These are defined in the very beginning of resolver.cpp file: Resolver global options: globalQuietOption - set to true if you don't want to have any sort of output globalVerboseOption - set to true if you want to have detailed verbose output globalAntiSplicingOption - unhook resolved functions if they're hooked. globalLogFilePath - where to redirect output log lines. If empty, pick stdout. bool globalQuietOption = false;
bool globalVerboseOption = true;
bool globalAntiSplicingOption = true;

wchar_t globalLogFilePath[MAX_PATH] = L"";
Custom API type specification
In order to use Resolver a function pointer type must be first declared with using statement of strict form: using fn_FunctionName = ReturnType WINAPI (
ParamType1 paramName1,
...,
ParamTypeN paramNameN,
); This repository comes with usings.h header file containing predefined using types for tens of popular Windows APIs. The FunctionName will correspond to the WinAPI that we want to have ImportResolver resolve and that function pointer must be marked as having WINAPI call convention ( __stdcall on x86 and __fastcall on x64). The ReturnType must precede WINAPI type modifier.
Function resolution and usage
Having function pointer type defined like specified above, we will be able to use it in the following manner: RESOLVE(libraryName, FunctionName);
ReturnType output = _FunctionName(param1, ..., paramN); The macro RESOLVE takes care of instantiating ImportResolver templated object and adjust specifed library's name. Resolver introduces several more Macrodefinitions offering easy to use (https://www.kitploit.com/search/label/Easy%20To%20Use) in various circumstances constructor invocation: #define RESOLVE(mod, func) RESOLVE_PARAMETERIZED(mod, func, ::globalVerboseOption, ::globalAntiSplicingOption)
#define RESOLVE_NO_UNHOOK(mod, func) RESOLVE_PARAMETERIZED(mod, func, ::globalVerboseOption, false)

#define RESOLVE_VERBOSE_UNHOOK(mod, func) RESOLVE_PARAMETERIZED(mod, func, true, true)
#define RESOLVE_VERBOSE_NOUNHOOK(mod, func) RESOLVE_PARAMETERIZED(mod, func, true, false)

___________________________
@hacking_Attack
@Hacking_Video