Hacking Articles Tips Tricks Videos Tutorials

AWS Top 10 Vulnerabilities

This contains the labs for top 10 aws security vulnerabilities and increases info about cloud security.Continue reading on Bug Bounty Hunting »
Read more...

7 views13:48

Should u do Bug Bounty in 2021?

This article is for people who are looking to go into bug bounty in this year or maybe just started.Continue reading on Medium »
Read more...

6 views13:48

Hacking Articles Tips Tricks Videos Tutorials

6 views14:08

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking Articles|Raj Chandel's Blog
Simple CTF TryHackMe Walkthrough

Today it is time to solve another challenge called “Simple CTF”. It is available at TryHackMe for penetration testing practice. This challenge is of easy difficulty if you have the right basic knowledge and are attentive to little details that are required in the enumeration process. Breakdown of the machine with redacted flag is as follows. Level: Easy· Network Scanningo Nmap Scan Enumerationo Directory BruteforceExploitationo Running the SQL Injection ExploitPrivilege Escalationo Enumerating the Sudo permissionsWalkthrough There are two flags in this machine after booting up the target machine from the TryHackMe: Simple CTF pageand IP will be assigned to the machine and will be visible on that page as well. Apart from the two flags we have the ten questions that are need to be answered for the completion of this machine. We will answer those questions as their answers appear.IP address: 10.10.146.189We will start a nmap scan with the- sC for default scripts and -sT for the TCP scan of the target machine.nmap -sC -sT 10.10.146.189https://1.bp.blogspot.com/-bIP66Dral9g/YSDXc2MLcKI/AAAAAAAAyQ8/MrRajokBvaAdjUsP2Z02gsFN-eLPUAstwCLcBGAsYHQ/s16000/1.png We were able to identify three services running on the target machine. FTP or the file transfer protocol service running on the 21 port., 80 with the HTTP service. And last but not the least. 2222 port running the service. Ethernet IP- 1.Q.1 How many services are running under port 1000?EnumerationWe can see that from the nmap scan that the target machine is running anonymous. FTP user access. However, when we tried to access the FTP service, we found that there was a note that was accessible as anonymous user and it was rabbit hole for us to go down in. Next, we try to browse the IP address on the browser, as HTTP service was running on the machine and we found the Ubuntu default HTTP works page displayed. Since we don’t have any other clue to move on when decided to perform or directory brute force attack on the target machine using the dirb tool.dirb http://10.10.146.189https://1.bp.blogspot.com/-CdgWcloVY3A/YSDXg2PhQOI/AAAAAAAAyRA/znV94Loud7MyqUY9C0LUHONIQVtoIaVRACLcBGAsYHQ/s16000/2.png By bruteforcing the directories, dirb was able to identify the robot.txt page on the target machine, as well as a directory called Simple. We tried to browse the simple directory using the web browser and found that the target machine has installed CMS made simple CMShttp://10.10.146.189/simple/https://1.bp.blogspot.com/-7mMNZ4J2ASM/YSDXk4FAHuI/AAAAAAAAyRE/B--nivBdBYg3uZ2UaEkvVfLOd_T5VhQOQCLcBGAsYHQ/s16000/3.png Next, we tried to find any other clues regarding the CMS made simple. But we were unable to do so, so we moved on to the next directory that the dirb found, that is, robot.txt. Upon opening the robot.txt, we found that there is an entry in the disallow section that is /openemr-5_0_1_3___________________________
@hacking_Attack
@Hacking_Video

Blogspot

Simple CTF TryHackMe Walkthrough

Hacking Articles is a very interesting blog about information security, penetration testing and vulnerability assessment managed by Raj Chandel.

8 viewsedited 14:08

Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog Simple CTF TryHackMe Walkthrough Today it is time to solve another challenge called “Simple CTF”. It is available at TryHackMe for penetration testing practice. This challenge is of easy difficulty if you have the right…

found and 404 error as shown in the image below.searchsploit cms made simplehttps://1.bp.blogspot.com/-dy-lXoa1dMc/YSDXwEvM48I/AAAAAAAAyRU/eOuzYPH9bIglPTN5GoMjSRhq8geQ_ZiywCLcBGAsYHQ/s16000/6.png Q. 3. What's the CVE you're using against the application?ExploitationWe ran the pip for installing some prerequisites that were required to run this particular exploit. After that we. Run the exploit with- u parameter providing the URL for the target machine. Followed by the --crack. And -w with the rockyou.txt wordlist path.python 46635.py -u http://10.10.146.189/simple/ --crack -w /usr/share/wordlists/rockyou.txt https://1.bp.blogspot.com/-IY3O2EXdMhY/YSDX0byPwRI/AAAAAAAAyRc/wdtlYHss5mAMcp2kGwTeg53yDtnBCzvYQCLcBGAsYHQ/s16000/7.png After sequentially running through each and every character with various kinds of entries, such as the salt, username, email, password, etcetera, we were able to decrypt the password as secret.Q. 5. What's the password?With the help of the hint provided by the official try Hackney Page, we were able to figure out that the service running on port too too too too was SSH service with the help of the recently extracted credential for the user patch, we were able to. Login as the match user via SSH. Upon logging in, we tried to list the contents of the current directory and found the user dot TXT flag. On the machine.Q. 6. Where can you login with the details obtained?ssh mitch@10.10.146.189 -p 2222https://1.bp.blogspot.com/-ZBd5Ndezwy0/YSDX9SG0eWI/AAAAAAAAyRw/nh8c3hJZlFkr5ZMeM8nmBlHmmZB6cDyjQCLcBGAsYHQ/s16000/9.png Privilege EscalationWe listed all the binaries that are accessible for match to run as root and found that match was able to run women with elevated access. Q. 7. Is there any other user in the home directory? What's its name?So we use sudo with Wim to invoke an SH shell. We were able to do so without any issues and we got the root shell in no time. We ran the ID command to confirm that the shell that we have is for the root user. We use the CAT command to read the root flag and conclude this machine.ls /homehttps://1.bp.blogspot.com/-PA24bXKHR-A/YSDYBSt9amI/AAAAAAAAyR4/ENgUMtFO4T00oRigwRXpXZHU_XrgqQDjACLcBGAsYHQ/s16000/10.png

___________________________
@hacking_Attack
@Hacking_Video

10 viewsedited 14:08

Hacking Articles Tips Tricks Videos Tutorials

Brutus - An Educational Exploitation Framework Shipped On A Modular And Highly Extensible Multi-Tasking And Multi-Processing Architecture
http://www.kitploit.com/2021/08/brutus-educational-exploitation.html

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Brutus - An Educational Exploitation Framework Shipped On A Modular And Highly Extensible Multi-Tasking And Multi-Processing Architecture

8 viewsedited 14:19

Hacking Articles Tips Tricks Videos Tutorials

8 views14:19

Hacking Articles Tips Tricks Videos Tutorials

Demos
Web Scanning and Payload Compilation Demo: watch mp4 (https://streamable.com/scybvn)
Installation
You will probably want the following dependencies: sslstrip pipenv Brutus is optimized for Kali Linux. There's lots of information online about how to run Kali Linux in a VM. To install: pipenv install
Usage
Run: pipenv run brutus Test: pipenv run test Lint: pipenv run lint Setup Git Hooks for Development: pipenv run setup Feel free to open PRs with feature proposals, bugfixes, et al. Note that much of this project is still in progress. The base is there and ready for you to build upon.
Brutus: Features and Included Modules
Brutus includes several modules which can be generalized as belonging to three macro-categories: network-based, web-based, and payloads. The latter category is a library of compilers and accompanying payloads - payloads can be compiled via Brutus' interactive command-line menu; compiled payloads can subsequently be loaded into many of Brutus' applicable network-based modules. The base layer of Brutus utilizes POSIX threads for concurrent multi-tasking. Some modules - i.e. essentially anything heavily I/O bound - instead utilize Python's async I/O libraries and run on an abstraction atop Python's default event loop. Included Utilities/Scripts IP Table Management Downgrade HTTPS to HTTP Enable Monitor Mode Enable Port Forwarding Keylogger
Documentation

48-bit MAC Address Changer (view source (https://github.com/MatthewZito/Brutus/blob/master/packages/mac_changer/mac_changer.py))
NOTE: This tool is for 48-bit MACs, with a %02x default byte format. MAC (Media Access Control) is a permanent, physical, and unique address assigned to network interfaces by device manufacturers. This means even your wireless card, for instance, has its own unique MAC address. The MAC address, analogous to an IP on the internet, is utilized within a network in order to facilitate the proper delivery of resources and data (i.e. packets). An interaction will generally consist of a source MAC and a destination MAC. MAC addresses can identify you, be filtered, or otherwise access-restricted. Important to note is these unique addresses are not ephemeral; they are persistent and will remain associated with a device were a user to install it in another machine. But the two don't have to be inextricably intertwined... This module will accept as user-input any given wireless device and any valid MAC address to which the user wishes to reassign said device. The program is simple such that I need not explain it much further: it utilizes the subprocess module to automate the sequence of the necessary shell commands to bring the wireless interface down, reassign the MAC, and reinitialize it. If you are actively changing your MAC address, it might be prudent to have some sort of validation structure or higher order method to ensure that 1) the wireless device exists, 2) the wireless device accommodates a MAC address, 3) the user-input MAC address is of a valid format, and 4) the wireless device's MAC address has successfully been updated. This tool automates these functions. By selecting the 'generate' option in lieu of a specific MAC address, the program will generate a valid MAC address per IEEE specifications. I'm excited to have implemented extended functionality for generating not only wholly random (and valid) MAC addresses, but MAC addresses which either begin with a specific vendor prefix (OUI), or are generated with multicast and/or UAA options. These options trigger byte-code logic in the generator method, which are augmented per IEEE specifications. Learn more about MAC addresses here (https://en.wikipedia.org/wiki/Organizationally_unique_identifier#Bit-reversed_representation).
ARP-Based Network Scanner (view source (https://github.com/MatthewZito/Brutus/blob/master/packages/network_scanner/network_scanner.py))

___________________________
@hacking_Attack
@Hacking_Video

Streamable

Watch brutus_demo1 | Streamable

Watch "brutus_demo1" on Streamable.

9 viewsedited 14:19

Hacking Articles Tips Tricks Videos Tutorials

The network scanner is another very useful tool, and a formidable one when used in conjunction with the aforementioned MAC changer. This scanner utilizes ARP request functionality by accepting as user input a valid ipv4 or ipv6 IP address and accompanying - albeit optional - subnet range. The program then takes the given IP and/or range, then validates them per IEEE specifications (again, this validation is run against ipv4 and ipv6 standards). Finally, a broadcast object is instantiated with the given IP and a generated ethernet frame; this object returns to us a list of all connected devices within the given network and accompanying range, mapping their IPs to respective MAC addresses. The program outputs a table with these associations, which then might be used as input for the MAC changer should circumstances necessitate it.
Automated ARP Spoofing (https://www.kitploit.com/search/label/ARP%20Spoofing) (view source (https://github.com/MatthewZito/Brutus/blob/master/packages/arp_spoofer/arp_spoof.py))
The ARP Spoof module enables us to redirect the flow of packets in a given network by simultaneously manipulating the ARP tables of a given target client and its network's gateway. This module auto-enables port forwarding (https://www.kitploit.com/search/label/Port%20Forwarding) during this process, and dynamically constructs and sends ARP packets. When the module is terminated by the user, the targets' ARP tables are reset, so as not to leave the controller in a precarious situation (plus, it's the nice thing to do). Because this process places the controller in the middle of the packet-flow between the client and AP, the controller therefore has access to all dataflow (dealing with potential encryption of said data is a task for another script). From here, the myriad options for packet-flow orchestration become readily apparent: surrogation of code by way of automation and regular expressions, forced redirects, remote access, et al. Fortunately, Brutus can automate this, too.
HTTP Packet Sniffer (https://www.kitploit.com/search/label/Packet%20Sniffer) (view source (https://github.com/MatthewZito/Brutus/blob/master/packages/packet_sniffer/packet_sniff.py))
The packet sniffer is an excellent module to employ after running the ARP Spoofer; it creates a dataflow of all intercepted HTTP packets' data which includes either URLs, or possible user credentials. The script is extensible and can accommodate a variety of protocols by instantiating the listener object with one of many available filters. Note that Brutus automatically downgrades HTTPS, so unless HSTS is involved, the dataflow should be viable for reconnaissance. Disclaimer: This software and all contents therein were created for research use only. I neither condone nor hold, in any capacity, responsibility for the actions of those who might intend to use this software in a manner malicious or otherwise illegal.

Download Brutus (https://github.com/MatthewZito/brutus)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.

18 viewsedited 14:19

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
How is Hamachi dangerous?

I read about Hamachi and I see things as "Play only with friends" or "You can get viruses". But nothing explained.

So OK. Let's say that I will make Hamachi network and allow some stranger connect. What could that stranger do? And how?

How is dangerous to let some stranger connect to my Windows 10 computer?

submitted by /u/throwawayjdtyidftyf
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

From the hacking community on Reddit: How is Hamachi dangerous?

Explore this post and more from the hacking community

14 viewsedited 16:37

Hacking Articles Tips Tricks Videos Tutorials

15 views17:08

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
TryHackMe OWSAP juice shop deep dive. More than a CTF Walkthrough.

https://cdn-images-1.medium.com/max/777/1*2t8r5VuHGjJ4dBeCz5m47w.png
What is OWASP Juice Shop?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

TryHackMe OWSAP juice shop deep dive. More than a CTF Walkthrough.

What is OWASP Juice Shop?

14 viewsedited 17:08