Mass Assignment — Entendendo o que é, Como explorar, Caso de estudo e Corrigindo a falha
https://gabrieldkgh.medium.com/mass-assignment-entendendo-o-que-%C3%A9-como-explorar-caso-de-estudo-e-corrigindo-a-falha-3165f9971b60?source=rss------bug_bounty-5

Neste artigo falaremos sobre uma falha popular classificada como TOP 6 na OWASP TOP 10 API 2019, uma falha que permite que um atacante…Continue reading on Medium » (https://gabrieldkgh.medium.com/mass-assignment-entendendo-o-que-%C3%A9-como-explorar-caso-de-estudo-e-corrigindo-a-falha-3165f9971b60?source=rss------bug_bounty-5)

Nimplant - A Cross-Platform Implant Written In Nim
http://www.kitploit.com/2021/08/nimplant-cross-platform-implant-written.html

Nimplant is a cross-platform (Linux & Windows) implant written in Nim as a fun project to learn about Nim and see what it can bring to the table for red team (https://www.kitploit.com/search/label/Red%20Team) tool development. Currently, Nimplant lacks extensive evasive tradecraft; however, overtime Nimplant will become much more sophisticated.
Installation
To install Nimplant, you'll need Mythic (https://www.kitploit.com/search/label/Mythic) installed on a remote computer. You can find installation instructions for Mythic at the Mythic project page (https://github.com/its-a-feature/Mythic/). From the Mythic install root, run the command: ./install_agent_from_github.sh https://github.com/MythicAgents/Nimplant Once installed, restart Mythic to build a new agent.
Highlighted Agent Features
Cross-platform Fully asynchronous Can generate agents compiled from both C and C++ source code
Commands Manual Quick Reference
Command Syntax Description cat cat [file] Retrieve the output of a file. cd cd [dir] Change working directory. cp cp [source] [destination] Copy a file from source to destination. Modal popup. curl curl [url] [method] [headers] [body] Execute a single web request. download download [path] Download a file off the target system. exit exit Exit a callback. getenv getenv Get all of the current environment variables. jobs jobs List all running jobs. kill kill [pid] Attempt to kill the process specified by [pid]. ls ls [path] [recurse] List files and folders in [path] with optional param to list recursively. Defaults to current working directory. mkdir mkdir [dir] Create a directory. mv mv [source] [destination] Move a file from source to destination. Modal popup. ps ps List process information. pwd pwd Print working directory. rm rm [path] Remove a file specified by [path] shell shell [command] Run a shell command which will translate to a process being spawned with command line: cmd.exe /r[command] unsetenv setenv [envname] [value] Sets an environment variable to your choosing. sleep sleep [seconds] Set the callback interval of the agent in seconds. unsetenv unsetenv [envname] Unset an environment variable. upload upload Upload a file to a remote path on the machine. Modal popup.
Supported C2 Profiles
Currently, only one C2 profile is available to use when creating a new Nimplant agent: HTTP.
HTTP Profile
The HTTP profile calls back to the Mythic server over the basic, non-dynamic profile. When selecting options to be stamped into Nimplant at compile time, all options are respected with the exception of those parameters relating to GET requests.
More coming soon!
Roadmap
[] Ability to compile to Objective-C for macOS capabilities [] Integration of Donut (https://github.com/theWover/Donut) to allow user to generate shellcode as output [] Communication via WebSockets [] Screenshotting capabilities [] Remote (https://www.kitploit.com/search/label/Remote) process injection (https://www.kitploit.com/search/label/Injection) capabilities

Download Nimplant (https://github.com/MythicAgents/Nimplant)

Nimplant - A Cross-Platform Implant Written In Nim

Nimplant is a cross-platform (Linux & Windows) implant written in Nim as a fun project to learn about Nim and see what it can bring to the table for red team tool development. Currently, Nimplant lacks extensive evasive tradecraft; however, overtime Nimplant will become much more sophisticated.Installation To install Nimplant, you'll need Mythic installed on a remote computer. You can find installation instructions for Mythic at the Mythic project page. From the Mythic install root, run the command: ./install_agent_from_github.sh https://github.com/MythicAgents/Nimplant Once installed, restart Mythic to build a new agent. Highlighted Agent Features Cross-platform Fully asynchronous Can generate agents compiled from both C and C++ source code Commands Manual Quick Reference Command Syntax Description cat cat file Retrieve the output of a file. cd cd dir Change working directory. cp cp source destination Copy a file from source to destination. Modal popup. curl curl url method headers body Execute a single web request. download download path Download a file off the target system. exit exit Exit a callback. getenv getenv Get all of the current environment variables. jobs jobs List all running jobs. kill kill pid Attempt to kill the process specified by pid. ls ls path recurse List files and folders in path with optional param to list recursively. Defaults to current working directory. mkdir mkdir dir Create a directory. mv mv source destination Move a file from source to destination. Modal popup. ps ps List process information. pwd pwd Print working directory. rm rm path Remove a file specified by path shell shell command Run a shell command which will translate to a process being spawned with command line: cmd.exe /rcommand unsetenv setenv envname value Sets an environment variable to your choosing. sleep sleep seconds Set the callback interval of the agent in seconds. unsetenv unsetenv envname Unset an environment variable. upload upload Upload a file to a remote path on the machine. Modal popup. Supported C2 Profiles Currently, only one C2 profile is available to use when creating a new Nimplant agent: HTTP. HTTP Profile The HTTP profile calls back to the Mythic server over the basic, non-dynamic profile. When selecting options to be stamped into Nimplant at compile time, all options are respected with the exception of those parameters relating to GET requests. More coming soon! Roadmap Ability to compile to Objective-C for macOS capabilities Integration of Donut to allow user to generate shellcode as output Communication via WebSockets Screenshotting capabilities Remote process injection capabilities Download Nimplant
Read more...

hacking: security in practice
Can a small sized files be cracked faster than a large sized file with the same encryption?

e.g. a text file with less than 1kb in size vs a file with 1gb in size with the same level of encryption.

submitted by /u/7758258-
[link] [comments]

https://b.thumbs.redditmedia.com/fWOhrZB3Dl-sSbGuHHdU4IJLtS8_TP5FCWlnpVncptk.jpg ​

https://preview.redd.it/yocj6serj7h71.png?width=2208&format=png&auto=webp&s=7ae1361cc45932cf625fba9212e0adaa04e3273c

Hey r/hacking!

I've recently built a Password Manager in Python for the terminal. It's my first public repo on GitHub and I built it to improve my understanding of data security and encryption. I've gotten a lot of feedback from r/Python and r/crypto, and one Redditor told me that you guys might also appreciate the project - so feel free to hack it!

From all recommendations from the past couple of days, I've:

- Improved the encryption from PBKDF2 to Scrypt. I'd like to use Argon2id, but I'm not sure how to do it yet. Any insight into that would be helpful!

- Added a timeout feature so that the application can't be left open and vulnerable for more than 90 seconds.

- Changed the PM from showing the passwords to directly copying them to the clipboard. This prevents keyloggers from knowing if anything was manually copied or if the passwords were typed out.

- Added a password generator.

- Data is scrubbed from the terminal.

I'd love to hear how else it could improve!

Check out the DIY Password Manager on GitHub: https://github.com/MarkMcKinney/DIY-Password-Manager

​

submitted by /u/M2com
[link] [comments]

hacking: security in practice
Hacking myself due to lost 2FA recovery codes

Here is my situation.

Factory reset my phone without getting recovery codes from accounts linked to Google Authenticator. Was able to contact support and get back every account EXCEPT my Snapchat. They completely refuse to help. It seems to me, that after entering user/pass and getting to verification code screen, they don't seem to limit number of attempts at this stage.

With Authenticator producing 6 digit codes refreshing every 30 secs or so, this seems somewhat brute forceable. What would be a good method for doing this other than hand manually?

submitted by /u/Kiurin
[link] [comments]

Hacking on Medium
Crypto platform Poly Network rewards hackers with A $500,000 ‘bug bounty.

HONG KONG, Aug 13 (Reuters) — Poly Network, the cryptographic money stage which lost $610 million in a hack recently, affirmed on Friday…

Continue reading on Medium »

Hacking on Medium
PunkSpider Reborn at Defcon

https://cdn-images-1.medium.com/max/1284/1*_eKv8bj8M4l5Xs4w9Z6HQw.png
So as You are all probably aware punkspider has been released for a second time which excites me more than You know as I literally still…

Continue reading on Medium »

Hacking on Medium
Vulnerable Dependency Management Cheat Sheet For JavaScript Developers

https://cdn-images-1.medium.com/max/2000/0*WiipqBcfj5jyOq6G
Introduction

Continue reading on JavaScript in Plain English »

Hacking on Medium
“Defend the Web” write-up (Intro 10— JavaScript code exposure and decryption)

https://cdn-images-1.medium.com/max/1000/1*cFBS174gph_Q5yN23YipJA.jpeg
The Intro 10 challenge is very similar to Intro 3 and 5. We are not going to explain it in detail here since we have already done it. For…

Continue reading on Purple TEAM »