Hacking on Medium
What are Command Injection vulnerabilities?

https://cdn-images-1.medium.com/max/2600/0*6Hmz77Xo2H6Hs-JU
How command injection vulnerabilities allow attackers to take over your machine, and how you can prevent these vulnerabilities.

Continue reading on ShiftLeft Blog »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Smuggling Script via URL: Short HTML-based XSS payload

https://cdn-images-1.medium.com/max/820/1*PfXVCUs0WfKBjKkyiOHwHg@2x.png
Let’s learn a neat trick on having the XSS payload in the URL for achieving shorter XSS payloads — straight from the greats!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Google Chrome → DevTools disabled by your Company’s IT Dept on Microsoft Windows? Try this…

https://cdn-images-1.medium.com/max/1950/0*vtdf2WS4GPqhSJPr
NOTE: You will need Local Admin privileges for this to work on your Windows machine

Continue reading on Code Kings »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Burp’s Recursive Grep for Owning Emdee five for life HTB Challenge

https://cdn-images-1.medium.com/max/600/1*ye-Tb-2PiktFPNwsQ26shw.png
A super special h@shtalk for a hashing challenge.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
SlowMist: Tracking possible identification clues related to Poly Network attackers

https://cdn-images-1.medium.com/max/600/1*bJHoQ4gh6wc7akYzVdrBbQ.jpeg
Further tracking and detailed vulnerabilities and technical details are being analyzed by the SlowMist security team.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Kenobi TryHackMe Walkthrough

Today it is time to solve another challenge called “Kenobi”. It is available at TryHackMe for penetration testing practice. The challenge is an easy difficulty if you have the right basic knowledge and are attentive to little details that are required in the enumeration process. The breakdown of the Machine with redacted flags is as follow: Level: Easy· Network Scanningo Nmap ScanEnumerationo Connecting SMB ServiceExploitationo Searching for exploit using SearchsploitPrivilege Escalationo Enumerating SUID PermissionsWalkthroughThere are two flags in this machine to discover. After Booting up the target machine from the TryHackMe: Kenobi Page, an IP will be assigned to the machine and will be visible on that page as well.IP Address: 10.10.101.175We will start a Nmap scan with the -sV from performing a Version Scan and -sC for default scripts on the target machine. nmap -sV -sC 10.10.101.175https://1.bp.blogspot.com/-fiAfgwHbELM/YRKpsbkt_mI/AAAAAAAAyIA/TZGZwfyU1HMxVxyXUpNJ1coE-IUwAw-7gCLcBGAsYHQ/s16000/1.png We have five services running on the target machine. We have 21 (FTP), 22 (SSH), 80 (HTTP), 111 & 2049 (RPC), 139 & 445 (SMB). EnumerationTo enumerate the SMB service, we will use the smbclient with the IP address of the target machine as shown in the image. We can see that there is a share by the name of anonymous. Upon accessing the share, we find a text file by the name of log.txt. We transfer the log file to our Kali machine to take a better look at it.smbclient -L \\10.10.101.175https://1.bp.blogspot.com/-YW9uMwqYc1M/YRKp5TgXoiI/AAAAAAAAyII/qeDqrwgPo-UzQ-bdwKBwNB-TZL-hllS1ACLcBGAsYHQ/s16000/2.png Reading the log, we can see that it contains the path for the id_rsa key stored on the target machine. Also, it points to the fact that the FTP service running on the target machine is ProFTPD. cat log.txthttps://1.bp.blogspot.com/-Zzo_jGcQKqs/YRKpxyjR3QI/AAAAAAAAyIE/Uk3UekyFbgsaQX5QL6Q3QbK-TxpvzTXpwCLcBGAsYHQ/s16000/3.png ExploitationAs we need to get our hands on the id_rsa file and we see that we have the ProFTPD on the target, we need to figure out a way to get access to that file through the FTP service. To check if we have any known vulnerabilities regarding the ProFTPD using Searchsploit. We see that we have the vulnerability named File Copy. We used the searchsploit to download the exploit file using the -m option. Here, we see that we need to run two significant commands: CPFR which means Copy From, and CPTO means Copy To.  So we can use these commands to copy the id_rsa file from its location to a place from where we can acquire it.searchsploit ProFTPD 1.3.5https://1.bp.blogspot.com/-fv3BVdRRGKg/YRKqGdVZrgI/AAAAAAAAyIM/DX5dalHWgMk5VPz0WWvPBbz2-rxd2u6kwCLcBGAsYHQ/s16000/4.png We used netcat to connect to the FTP service on the target machine.[...]

___________________________
@hacking_Attack
@Hacking_Video

We used the CPFR command to copy the id_rsa from the home directory of the Kenobi user. Then we used the CPTO command to provide the destination address for the id_rsa file. We transferred the file to /var directory.nc 10.10.101.175 21https://1.bp.blogspot.com/-TFWw4aeR7Es/YRKqQpmRgOI/AAAAAAAAyIU/ZkyCGJn7MIwyQcip7NPNpS_wlIiUVxxEwCLcBGAsYHQ/s16000/5.png Now that we have successfully transferred the id_rsa into the var directory, we can mount the /var directory so that we can access the id_rsa files on our local machine. We created a directory by the name of /ignite inside the /mnt directory. Next, we used the mount command to mount the remote var directory to our local ignite folder. Moving to the ignite directory we found the id_rsa file. Changing the permissions of the id_rsa file to make it ready to connect via SSH.mkdir /mnt/ignite /mnt/ignitehttps://1.bp.blogspot.com/-O4M-gsWJEEE/YRKqXjxlf9I/AAAAAAAAyIc/Rd6ms_P1CXEKyb8pY84HdclnkSf2Zzm1ACLcBGAsYHQ/s16000/6.png With the help of the id_rsa key, we were able to connect to the target machine as the Kenobi user. Here we were able to read the first flag by the name of user.txt.Privilege EscalationNow that we have the session on the target machine and we have the user flag. Let’s move on to enumerating the permissions to figure out a way to elevate privileges. We used the find command to check for all the binaries with permissions and found /usr/bin/menu to not be usually found in Linux. It could be our way to root.ssh -i id_rsa kenobi@10.10.101.175/dev/nullhttps://1.bp.blogspot.com/--YMwezLZ-No/YRKqcISSe2I/AAAAAAAAyIg/dtPp4ztRCdcGU3OFCmHGrCnfsCf0ywy3ACLcBGAsYHQ/s16000/7.png We ran the menu binary to see that it prints a menu with options such as status check, kernel version, and running ifconfig. We ran the kernel version and got version 4.80. This binary must be running the command in the background to get these outputs. To understand better, we used the strings command to fetch all the human-readable snippets from the binary and found that it uses the curl command to get the localhost. As it doesn’t mention the full path of curl, we can create a malicious payload with the name curl and add it into the path. This will make the binary run our malicious file instead of the original curl./usr/bin/menuhttps://1.bp.blogspot.com/-4zwCyW0wYeg/YRKqgm9LTiI/AAAAAAAAyIo/29EgC7n7ApUGPxEpu9p1p1t-TO4UF0fBACLcBGAsYHQ/s16000/8.png We moved to the tmp directory and created a binary invoking the /bin/sh and named it to curl. Then we changed the permission of the binary to be executable. At last, we added this curl into the local path using the export command. Now running the menu binary, we choose an option from the menu and we got ourselves the root shell. We read the root flag and conclude this machine.cd /tmp curlhttps://1.bp.blogspot.com/-4_MSOMxiHpc/YRKqk096cQI/AAAAAAAAyIs/FrAkx3gV-bsXwk1re_UovY2QsOxzzgaTQCLcBGAsYHQ/s16000/9.png

___________________________
@hacking_Attack
@Hacking_Video

Help trouble shooting wlan0 down state
https://www.reddit.com/r/Pentesting/comments/p1usia/help_trouble_shooting_wlan0_down_state/

___________________________
@hacking_Attack
@Hacking_Video

Hey everyone After experimenting with airodump-ng and aircrack-ng on kali linux my wlan0 interface has been permanently down. I tried installing networkmanager and did a service NetworkManager restart, airodump-ng stop and aircrack-ng stop. Lastly I tried going into the NetworkManager.conf file and tried changing [ifupdown] Managed=true and still nothing. I have attached my iwconfig output and my ip addr state. Any suggestions are appreciated ​ https://preview.redd.it/hipo99lmmkg71.png?width=834&format=png&auto=webp&s=6d2616bf70082d85bac9ebc9412782d7992406d8 submitted by /u/Biscotti2776 (https://www.reddit.com/user/Biscotti2776)
[link] (https://www.reddit.com/r/Pentesting/comments/p1usia/help_trouble_shooting_wlan0_down_state/) [comments] (https://www.reddit.com/r/Pentesting/comments/p1usia/help_trouble_shooting_wlan0_down_state/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Kenobi TryHackMe Walkthrough

Today it is time to solve another challenge called “Kenobi”. It is available at TryHackMe for penetration testing practice. The challenge is an easy difficulty if you have the right basic knowledge and are attentive to little details that are required in the enumeration process. The breakdown of the Machine

The post Kenobi TryHackMe Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hide and compress your strings in executables and code using Unishox

C Library:

https://github.com/siara-cc/Unishox

Javascript Library:

https://github.com/siara-cc/Unishox_JS

submitted by /u/siara-cc
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can I get hacked through an imgur link ?

Some random 0 karma account just dmed me an imgur link after asking "can you guess my ethnicity". So is it possible to hack through Reddit imgur links ?

submitted by /u/Jager_21
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Harassment Calls

Hey everyone, how do I find out a private number? I have had a private number ring up and harass me, I think it could be someone I know. I am in the UK.

submitted by /u/Sea_Education8975
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How bad is Public Wifi with a VPN?

I see commercials about NordVPN and such saying how you can use public wifi without the fear of sniffing. Is this really the case? I know "pineapples" are always a thing, but if I had a correctly set up VPN, what are the chances that it would be compromised over public wifi?

submitted by /u/Snoo-33445
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video