Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
THORChain hacks — could they have been prevented?
https://cdn-images-1.medium.com/max/1502/1*dsUdgOLMtradPZrRmlaVFA.png
What the happened with ThorChain?
Continue reading on Medium »
THORChain hacks — could they have been prevented?
https://cdn-images-1.medium.com/max/1502/1*dsUdgOLMtradPZrRmlaVFA.png
What the happened with ThorChain?
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
GRANNY — HackTheBox WriteUp
https://cdn-images-1.medium.com/max/910/1*uSpwxfOOeSEbTRk3LR0FQQ.png
This box is a part of TJnull’s list of boxes. I am doing these boxes as a part of my preparation for OSCP. I will be sharing the writeups…
Continue reading on Medium »
GRANNY — HackTheBox WriteUp
https://cdn-images-1.medium.com/max/910/1*uSpwxfOOeSEbTRk3LR0FQQ.png
This box is a part of TJnull’s list of boxes. I am doing these boxes as a part of my preparation for OSCP. I will be sharing the writeups…
Continue reading on Medium »
Tko-Subs - A Tool That Can Help Detect And Takeover Subdomains With Dead DNS Records
http://www.kitploit.com/2021/08/tko-subs-tool-that-can-help-detect-and.html
http://www.kitploit.com/2021/08/tko-subs-tool-that-can-help-detect-and.html
go get github.com/gocarina/gocsv
go get github.com/google/go-github/github
go get github.com/olekukonko/tablewriter
go get golang.org/x/net/publicsuffix
go get golang.org/x/oauth2
go get github.com/miekg/dns
How to run?
Once you have everything installed, cd into the directory and type: tko-subs -domains=domains.txt -data=providers-data.csv -output=output.csv If you want to take over as well, the command would be: tko-subs -domains=domains.txt -data=providers-data.csv -output=output.csv -takeover -githubtoken= -herokuusername= -herokuapikey= -herokuappname= If you just want to check for a single domain, type: tko-subs -domain If you just want to check for multiple domains, type: tko-subs -domain , By default: the domains flag is set to domains.txt the data flag is set to providers-data.csv the output flag is set to output.csv the takeover flag is not set so no take over by default the domain flag is NOT set so it will always check for all the domains mentioned in the domains.txt file. If the domain flag is mentioned, it will only check that domain and ignore the domains.txt file, even if present the threads flag is set to 5 So, simply running tko-subs would run with the default values mentioned above.
How is providers-data.csv formatted?
name,cname,string,http name: The name of the provider (e.g. github) cname: The CNAME used to map a website to the provider's content (e.g. github.io) string: The error message returned for an unclaimed subdomain (e.g. "There isn't a GitHub Pages site here") http: Whether to use http (not https, which is the default) to connect to the site (true/false)
How is the output formatted?
Domain,CNAME,Provider,IsVulnerable,IsTakenOver,Response Domain: The domain checked CNAME: The CNAME of the domain Provider: The provider the domain was found to be using IsVulnerable: Whether the domain was found to be vulnerable (https://www.kitploit.com/search/label/Vulnerable) or not (true/false) IsTakenOver: Whether the domain was taken over or not (true/false) Response: The message that the subdomain was checked against If a dead DNS record is found, Provider is left empty. If a misbehaving nameserver is found, Provider and CNAME are left empty
What is going on under the hood?
This will iterate over all the domains (concurrently using GoRoutines) in the subdomains.txt file and: See if they have a misbehaving authoritative nameserver; if they do, we mark that domain as vulnerable. See if they have dangling CNAME records aka dead DNS records; if they do we mark that domain as vulnerable. If a subdomain passes these two tests, it tries to curl them and get back a response and then try to see if that response matches any of the data provider strings mentioned in the providers-data.csv (https://github.com/anshumanbh/tko-subs/blob/master/providers-data.csv) file. If the response matches, we mark that domain as vulnerable. Next, depending upon whether the takeover flag is mentioned or not, it will try to take over that vulnerable subdomain. For example, to takeover a Github Page, the code will: Create a repo Create a branch gh-pages in that repo Upload CNAME and index.html to the gh-pages branch in that repo. Here, CNAME contains the domain that needs to be taken over. index.html contains the text This domain is temporarily suspended that is to be displayed once the domain is taken over. Similarly, for Heroku apps, the code will: Add the dangling domain to your Heroku app (whose name you will be providing in the .env file) And, that's it!
Future Work
Take CMS name and regex from user or .env file and then automatically hook them into the tool to be able to find it. DONE Add takeovers for more CMS Add more CMS providers
Credits
go get github.com/google/go-github/github
go get github.com/olekukonko/tablewriter
go get golang.org/x/net/publicsuffix
go get golang.org/x/oauth2
go get github.com/miekg/dns
How to run?
Once you have everything installed, cd into the directory and type: tko-subs -domains=domains.txt -data=providers-data.csv -output=output.csv If you want to take over as well, the command would be: tko-subs -domains=domains.txt -data=providers-data.csv -output=output.csv -takeover -githubtoken= -herokuusername= -herokuapikey= -herokuappname= If you just want to check for a single domain, type: tko-subs -domain If you just want to check for multiple domains, type: tko-subs -domain , By default: the domains flag is set to domains.txt the data flag is set to providers-data.csv the output flag is set to output.csv the takeover flag is not set so no take over by default the domain flag is NOT set so it will always check for all the domains mentioned in the domains.txt file. If the domain flag is mentioned, it will only check that domain and ignore the domains.txt file, even if present the threads flag is set to 5 So, simply running tko-subs would run with the default values mentioned above.
How is providers-data.csv formatted?
name,cname,string,http name: The name of the provider (e.g. github) cname: The CNAME used to map a website to the provider's content (e.g. github.io) string: The error message returned for an unclaimed subdomain (e.g. "There isn't a GitHub Pages site here") http: Whether to use http (not https, which is the default) to connect to the site (true/false)
How is the output formatted?
Domain,CNAME,Provider,IsVulnerable,IsTakenOver,Response Domain: The domain checked CNAME: The CNAME of the domain Provider: The provider the domain was found to be using IsVulnerable: Whether the domain was found to be vulnerable (https://www.kitploit.com/search/label/Vulnerable) or not (true/false) IsTakenOver: Whether the domain was taken over or not (true/false) Response: The message that the subdomain was checked against If a dead DNS record is found, Provider is left empty. If a misbehaving nameserver is found, Provider and CNAME are left empty
What is going on under the hood?
This will iterate over all the domains (concurrently using GoRoutines) in the subdomains.txt file and: See if they have a misbehaving authoritative nameserver; if they do, we mark that domain as vulnerable. See if they have dangling CNAME records aka dead DNS records; if they do we mark that domain as vulnerable. If a subdomain passes these two tests, it tries to curl them and get back a response and then try to see if that response matches any of the data provider strings mentioned in the providers-data.csv (https://github.com/anshumanbh/tko-subs/blob/master/providers-data.csv) file. If the response matches, we mark that domain as vulnerable. Next, depending upon whether the takeover flag is mentioned or not, it will try to take over that vulnerable subdomain. For example, to takeover a Github Page, the code will: Create a repo Create a branch gh-pages in that repo Upload CNAME and index.html to the gh-pages branch in that repo. Here, CNAME contains the domain that needs to be taken over. index.html contains the text This domain is temporarily suspended that is to be displayed once the domain is taken over. Similarly, for Heroku apps, the code will: Add the dangling domain to your Heroku app (whose name you will be providing in the .env file) And, that's it!
Future Work
Take CMS name and regex from user or .env file and then automatically hook them into the tool to be able to find it. DONE Add takeovers for more CMS Add more CMS providers
Credits
Thanks to Luke Young (@TheBoredEng) for helping me out with the go-github library. Thanks to Frans Rosen (@fransrosen) for helping me understand the technical details that are required for some of the takeovers. Thanks to Mohammed Diaa (@mhmdiaa) for taking time to implement the provider data functionality and getting the code going. Thanks to high-stakes for a much needed code refresh.
Changelog
5/27 Added new Dockerfile (https://www.kitploit.com/search/label/Dockerfile) reducing the size of the image Added sample domains.txt file to test against mhmdiaa added the logic for dead DNS takeovers. Updated documentation. Thanks a lot! 11/6 high-stakes issues a PR with a bunch of new code that fixes a few bugs and makes the code cleaner 9/22 Added an optional flag to check for single domain Made it easier to install and run 6/25 Made the code much more faster by implementing goroutines Instead of checking using Golang's net packages' LookupCNAME function, made it to just use dig since that gives you dead DNS records as well. More attack surface!!
Download Tko-Subs (https://github.com/anshumanbh/tko-subs)
Changelog
5/27 Added new Dockerfile (https://www.kitploit.com/search/label/Dockerfile) reducing the size of the image Added sample domains.txt file to test against mhmdiaa added the logic for dead DNS takeovers. Updated documentation. Thanks a lot! 11/6 high-stakes issues a PR with a bunch of new code that fixes a few bugs and makes the code cleaner 9/22 Added an optional flag to check for single domain Made it easier to install and run 6/25 Made the code much more faster by implementing goroutines Instead of checking using Golang's net packages' LookupCNAME function, made it to just use dig since that gives you dead DNS records as well. More attack surface!!
Download Tko-Subs (https://github.com/anshumanbh/tko-subs)
How I turned a Self-XSS into one-click Account Takeover through Bad Business Logic
Stored XSContinue reading on Medium »
Read more...
Stored XSContinue reading on Medium »
Read more...
How I turned a Self-XSS into one-click Account Takeover through Bad Business Logic
https://medium.com/@tushar.tilak.sharma/how-i-turned-a-self-xss-into-one-click-account-takeover-through-bad-business-logic-ff003c30e96?source=rss------bug_bounty-5
https://medium.com/@tushar.tilak.sharma/how-i-turned-a-self-xss-into-one-click-account-takeover-through-bad-business-logic-ff003c30e96?source=rss------bug_bounty-5
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Jarm : Active Transport Layer Security (TLS) server fingerprinting tool
JARM is an active Transport Layer Security (TLS) server fingerprinting tool. JARM fingerprints can be used to: Quickly verify that all servers in a group have the same TLS configuration. Group disparate servers on the internet by configuration, identifying that a server may belong to Google vs. Salesforce vs. Apple, for example. Identify default applications […]
The post Jarm : Active Transport Layer Security (TLS) server fingerprinting tool appeared first on Kali Linux Tutorials.
Jarm : Active Transport Layer Security (TLS) server fingerprinting tool
JARM is an active Transport Layer Security (TLS) server fingerprinting tool. JARM fingerprints can be used to: Quickly verify that all servers in a group have the same TLS configuration. Group disparate servers on the internet by configuration, identifying that a server may belong to Google vs. Salesforce vs. Apple, for example. Identify default applications […]
The post Jarm : Active Transport Layer Security (TLS) server fingerprinting tool appeared first on Kali Linux Tutorials.
hacking: security in practice
What nmap/nping command can I use to see if a network is susceptible to arp poisoning?
So, I was watching a video where a guy showed examples of arp poisoning by having 2 devices that he owned and trying to use a MiTM attack on one of them, and he showed that in a Starbucks wifi it didn't work, while in another wifi of a smaller cafe it worked. So I wondered, what command can you use to see if a network is susceptible to this kind of hacking?
submitted by /u/zisis_
[link] [comments]
What nmap/nping command can I use to see if a network is susceptible to arp poisoning?
So, I was watching a video where a guy showed examples of arp poisoning by having 2 devices that he owned and trying to use a MiTM attack on one of them, and he showed that in a Starbucks wifi it didn't work, while in another wifi of a smaller cafe it worked. So I wondered, what command can you use to see if a network is susceptible to this kind of hacking?
submitted by /u/zisis_
[link] [comments]
reddit
What nmap/nping command can I use to see if a network is...
So, I was watching a video where a guy showed examples of arp poisoning by having 2 devices that he owned and trying to use a MiTM attack on one...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Internship as a Penetration tester
https://www.reddit.com/r/Pentesting/comments/p4wo1q/internship_as_a_penetration_tester/
<!-- SC_OFF -->Hello there, I have a simple question, can one get an internship as a penetration tester and if so, what are the requirements and the skillset required in order to get an internship as a pentester? <!-- SC_ON --> submitted by /u/BigBoyLester (https://www.reddit.com/user/BigBoyLester)
[link] (https://www.reddit.com/r/Pentesting/comments/p4wo1q/internship_as_a_penetration_tester/) [comments] (https://www.reddit.com/r/Pentesting/comments/p4wo1q/internship_as_a_penetration_tester/)
https://www.reddit.com/r/Pentesting/comments/p4wo1q/internship_as_a_penetration_tester/
<!-- SC_OFF -->Hello there, I have a simple question, can one get an internship as a penetration tester and if so, what are the requirements and the skillset required in order to get an internship as a pentester? <!-- SC_ON --> submitted by /u/BigBoyLester (https://www.reddit.com/user/BigBoyLester)
[link] (https://www.reddit.com/r/Pentesting/comments/p4wo1q/internship_as_a_penetration_tester/) [comments] (https://www.reddit.com/r/Pentesting/comments/p4wo1q/internship_as_a_penetration_tester/)