4VI/AAAAAAAAKgg/xryq3ZulLu8H2EgOjl-pdpjCoTYmZZg8gCLcBGAsYHQ/s410/list_implant.png
How to Interact

After receiving the implant shell you can interact with it through

interact [Implant_Name]
https://1.bp.blogspot.com/-qresdLaMxP4/YSRtdPcuoMI/AAAAAAAAKgo/jgTe7_4sPsEoc6t4CVX2PHBtu376inKXgCLcBGAsYHQ/s394/interact.png
After entering the interact section you can use help command to show the interact commands.
https://1.bp.blogspot.com/-bIe_-Qg71ns/YSRts6N6Q-I/AAAAAAAAKgw/_Fdw3OuG8nIgkCXDjVAM2ZnOafzaeon9wCLcBGAsYHQ/s799/help_interact.png
Execute Powershell

There is an option to execute a PowerShell Command through

powershell [Command]
https://1.bp.blogspot.com/-MnOMbQ28ctA/YSRt89uVjKI/AAAAAAAAKg4/4EGBYao_MAgoI2nsfV6wObLoDR7BKZ_2ACLcBGAsYHQ/s562/execute_powershell.png
Execute CMD

There is an option to execute a CMD command through

cmd [Command]
https://1.bp.blogspot.com/-0ziGzvm35tM/YSRuO3IAbKI/AAAAAAAAKhA/Bu01IYMzhNQuG-6eMarRwF98v3UAghbkQCLcBGAsYHQ/s485/execute_cmd.png
Invoke Module
https://1.bp.blogspot.com/-ei8HLJsPb9U/YSRunQJuyCI/AAAAAAAAKhI/oKG_owR7LSEf5TMBczEmf4Yh9NChBO_swCLcBGAsYHQ/s555/list_module.png
There is an options to invoke a PowerShell script through

module [Module_Name]
https://1.bp.blogspot.com/-vVF88M8d8OI/YSRvQD3xNII/AAAAAAAAKhY/l4xNhQ1bifsfl5c56V_feskoilpXCtfnACLcBGAsYHQ/s964/module.png
Set Sleep

There is an option to set a delay time through

sleep [Secounds]
https://1.bp.blogspot.com/-bc9hBifppFU/YSRvm8u6rVI/AAAAAAAAKhg/xHppxfN_vYobNq2TmoXMXfnxjHCmUGvZwCLcBGAsYHQ/s396/sleep.png
Exit Implant

There is an option to end the implant activity through

exit
https://1.bp.blogspot.com/-dmc-_0BpHFg/YSRv3g34tJI/AAAAAAAAKho/OZ2UHZUXXqgd0-OhM2JzFxve_lSL1mPAgCLcBGAsYHQ/s542/exit.png
PickleC2 Modules

PickleC2 supports to anyone who would like to add his own powershell script to invoke in his target through adding his powershell module in the modules folder and add his module in the database.

Add PowerShell Module

For anyone who would like to add his powershell module must follow the following steps:

* Run AddModule.py script.
https://1.bp.blogspot.com/-1aswXs7hpnU/YSRywnn1PII/AAAAAAAAKhw/nQNDoN0NJ50hy0jCXu8_3r66TgzDgn7DQCLcBGAsYHQ/s868/add_module.png
* Add the powershell module in modules Folder.
https://1.bp.blogspot.com/--jnpZMytTAU/YSSOexj3w3I/AAAAAAAAKh4/_5nCsjI0egEMQjzg_11oyo5fIBbM6fe7QCLcBGAsYHQ/s418/module_folder.png
Use Module

PickleC2 is so simple to use all you need to do to use a module is

* interact <target_name
https://1.bp.blogspot.com/-at_Aep2Nsyg/YSSOyzNoXQI/AAAAAAAAKiA/jgS2Q9s2_fcnlIEInErqz8s9y436m-gIACLcBGAsYHQ/s394/interact.png
* module <module_name
https://1.bp.blogspot.com/-6qI9c_LwHcU/YSSPA26mK1I/AAAAAAAAKiE/GOZS5OwWnRIINeQOBn-iKX4-WzFe_1ZiwCLcBGAsYHQ/s964/module.png Download

* -db genquick

Adds the hashes from all modules in all processes to the clean hash database. Run this on a clean system.

* -db add

Adds all the files in the specified directory recursively to the clean hash database.

* -db rem

Removes all the files in the specified directory recursively from the clean hash database.

* -db clean

Clears the clean hash database.

* -db ignore

Ignores the clean hash database when dumping a process this time. All modules will be dumped even if a match is found. Version History Version 2.1 (February 12th, 2017)

* Fixed a bug where the last section in some cases would instead be filled with zeros. Thanks to megastupidmonkey for reporting this issue.
* Fixed a bug where 64-bit base addresses would be truncated to a 32-bit address. It now properly keeps the full 64-bit module base address. Thanks to megastupidmonkey for reporting this issue.
* Addressed an issue where the processes dump close monitor would crash csrss.exe.
* Stopped Process Dump from hooking it’s own process in close monitor mode. Version 2.0 (September 18th, 2016)

* Added new flag ‘-closemon’ which runs Process Dump in a monitoring mode. It will pause and dump any process just as it closes. This is designed to work well with malware analysis sandboxes, to be sure to dump malware from memory beofre the malicious process closes.
* Upgraded Process Dump to be multi-threaded. Commands that dump or get hashes from multiple processes will run separate threads per operation. Default number of threads is 16, which speeds up the general Process Dump dumping processing significantly.
* Upgraded Process Dump to dump unattached code chunks found in memory. These are identified as executable regions in memory which are not attached to a module and do not have a PE header. It also requires that the codechunk refer to at least 2 imports to be considered valid in order to reduce noise. When dumped, a PE header is recreated along with an import table. Code chunks are fully supported by the clean hash database.
* Added flags to control the filepath to the clean hash database as well as the output folder for dumped files.
* Fix to generating clean hash database from user path that was causing a crash.
* Fix to the flag ‘-g’ that forces generation of PE headers. Before even if this flag was set, system dumps (-system), would ignore this flag when dumping a process.
* Various performance improvements.
* Upgraded project to VS2015. Version 1.5 (November 21st, 2015)

* Fixed bug where very large memory regions would cause Process Dump to hang.
* Fixed bug where some modules at high addresses would not be found under 64-bit Windows.
* More debug information now outputted under Verbose mode. Version 1.4 (April 18th, 2015)

* Added new aggressive import reconstruction approach. Now patches up all DWORDs and QWORDs in the module to the corresponding export match.
* Added ‘-a (address to dump)’ flag to dump a specific address. It will generate PE headers and build an import table for the address.
* Added ‘-ni’ flag to skip new import reconstruction algorithm.
* Added ‘-g’ flag to force generation of new PE header even if there exists one when dumping a module. This is good if the PE header is malformed for example.
* Various bug fixes. Version 1.3 (October 10th, 2013)

* Improved handling of PE headers with sections that specify invalid virtual sizes and addresses.
* Better module dumping methodology for dumping virtual sections down to disk sections. Version 1.1 (April 8th, 2013)

* Fixed a compatibility issue with Windows XP.
* Corrected bug where process dump would print it is dumping a module but not actually dump it.
* Implemented the ‘-pid ‘ dump flag. Version 1.0 (April 2nd, 2013)

* Initial release. Download

hacking: security in practice
Ep28 | How DARPA Stops IC Hardware Hackers in Their Tracks: Insights from Serge Leef - Engineering Podcast

https://external-preview.redd.it/q5KKGTZyQBs9qELZQn0FstS72vw8eQD-0tv_gPeq_uM.jpg?width=320&crop=smart&auto=webp&s=033cc8392beae5b0a0eb326ac175ae9ebf803745 submitted by /u/allaboutcircuits
[link] [comments]

Accessing Grofers Grafana Instance Using Shodan
https://infosecwriteups.com/accessing-grofers-grafana-instance-using-shodan-52c585ada797?source=rss------bug_bounty-5

Hello People….Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/accessing-grofers-grafana-instance-using-shodan-52c585ada797?source=rss------bug_bounty-5)

Hacking on Medium
INTRODUCTION TO CYBER SECURITY

https://cdn-images-1.medium.com/max/1200/1*BuFBq5NKiG2pCBDkG5AK7Q.jpeg
A computer hacker is the name given to the tech- folks on both sides of the internet battlefront. Bad guys or “black hat” hackers are the…

Continue reading on Medium »

Hacking on Medium
Phishing Attacks explained by a hacker

https://cdn-images-1.medium.com/max/1000/0*_gTSJ4E2uju4bvJk.jpg
Hi everyone! In this blog post, I will explain to you how hackers create phishing websites, emails, messages and phone calls as simple as…

Continue reading on Medium »

Hacking on Medium
Solucionadas vulnerabilidades críticas de Node.js

https://cdn-images-1.medium.com/max/1200/0*bbA7uahL-apjMkJ0
PUBLICADO EN 8 SEPTIEMBRE, 2021POR EHACKING

Continue reading on Medium »

Hacking on Medium
What a False Negative is and why it should be your primary criteria for a SAST tool

https://cdn-images-1.medium.com/max/2600/0*UzX2lkVNcRY3Og0S
In our earlier post, we discussed False Positives and why having some of them is a good thing for your teams. This blog is about a term…

Continue reading on ShiftLeft Blog »

Deep Web
Need help with adding a PGP to kelopatra

Anyone?

submitted by /u/XTLight
[link] [comments]

Operational Mental Models - Jackson T
https://www.reddit.com/r/redteamsec/comments/pkeywj/operational_mental_models_jackson_t/

submitted by /u/WM-M-GM (https://www.reddit.com/user/WM-M-GM)
[link] (http://jackson-t.ca/operational-mental-models.html) [comments] (https://www.reddit.com/r/redteamsec/comments/pkeywj/operational_mental_models_jackson_t/)

hacking: security in practice
Trying to automate the login on a Captive Portal

Hi there,

So I was just trying to automate the login on a Captive Portal on an AP that I use for work in order to be able to connect my headless Raspberry Pito the network. (I am unable to Run X-Server in this host, neither w3mor elinksdid work on rendering such a portal) Since this is considered "ilegal" by many Network Admins I post it in here , but the purpose is legitimate and it would be nice that all of us share the knowledge.

So I have been learning the protocols behind it, and this Captive Portalmay be of the type Redirect by DNS

I have indexed the landing page of the application form which is https://captiveportal.com/guest/guest_register_3.php?_browser=1

Inspeting the HTML I can see:

1st) The form is of the type POST 2nd) The parameters to be filled are the following ones (according to the rendered HTML) : visitor_name and email Despite this the html form input elements doesn't exactly correspond to the ones that the HTTP request make afterwards. I Can find email But then I find a bunch of them unrelated

```
Unused field

Unused field

Unused field
```

Where in checkbox and submit I recognise their function as well , but the hidden one for example is a mistery to me its function.

Well so the second part of the analisis is to spoof (everything have to sound hackerish haha) my own 'http' traffic while authenticating to it.

With linux ngrepyou can do this like a charm so we can sudo ngrep -W byline -d 'wlp1s0' -t '^(GET|POST) ' 'tcp and port 80' So I go for it and this is what I capture

``` (OUTPUT SIMPLIFIED)

T 2021/09/08 18:16:12.901797 90.80.121.128:58788 -> 20.200.140.191:80 [AP] #54 POST / HTTP/1.1. Host: ocsp.quovadisglobal.com. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0. Accept: /. Accept-Language: en-US,en;q=0.5. Accept-Encoding: gzip, deflate. Content-Type: application/ocsp-request. Content-Length: 87. Connection: keep-alive. . 0U0S0Q0O0M0...+..............1:l....] o......I=..y.............f...lO..$.. 6...py8..B4.

T 2021/09/08 18:16:43.733225 90.80.121.128:58824 -> 20.200.140.191:80 [AP] #184 POST / HTTP/1.1. Host: ocsp.quovadisglobal.com. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0. Accept: /. Accept-Language: en-US,en;q=0.5. Accept-Encoding: gzip, deflate. Content-Type: application/ocsp-request. Content-Length: 87. Connection: keep-alive. . 0U0S0Q0O0M0...+..............1:l....] o......I=..y.............f....l?....P$........F.. ```

Pretty unintelligible , but been a bit smart and with the index of the page that I already downloaded by wget \ --recursive \ --no-clobber \ --page-requisites \ --html-extension \ --max-redirect=0 \ --no-check-certificate \ --convert-links \ --restrict-file-names=unix \ -H \ --random-wait \ --limit-rate=200K \ --user-agent=Mozilla \ --level=3 \ https://www.captiveportal.com/guest/guest_register_3.php An placing that on my own apache2hosted server , then I listen to my own communication by the loopbackdevice sudo ngrep -W byline -d 'lo' -t '^(GET|POST) ' 'tcp and port 80' I can see the POST's bodies of the HTTP communication like visitor_name=Ferenc+Donest&email=ferensi45donest%40gmail.com&expire_after=168&role_id=2&create_time=2021-09-08+17%3A59%3A34&mac=&remote_addr=100.120.121.128&essid=&apgroup=&apname=&vcname=&auto_update_account=1&creator_accept_terms=1 (the next step cannot replicate it as the next page doesn't load locally , but is just a button to press OK

. I know later on I will be able to create a command with curl(or maybe 2 scripted them) in order to perform this process aut[...]

___________________________
@hacking_Attack
@Hacking_Video

omatically

My main question: It looks like the Real Captive Portal uses some sort of encription . But I believe that is available on the HTML code as the POST needs to be done client side. - Is this Encryption process perform by some of the javascript of this landing page? - Am I wrong about many of this assumptions?

Thanks for your help , I will keep you updated with my advatanges as I still need to inspect the JS code and maybe some more php files (although chances are that those have not been indexed)

submitted by /u/brohermano [link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to get a reverse shell in my netcat from outside LAN

I am trying to get a reverse shell from outside my LAN on my netcat but I am unable to do so I am on my linux machine and using my laptop for sending a connection request but I am not getting a callback on my linux machine.

So what are the techniques to get shell from outside my network .

submitted by /u/CoolNCocky
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Sorry if I'm asking in the wrong subreddit. But if one wasn't using a VPN or anything that would have a proxy how off would an IP be location wise?

I'm really not smart when it comes to this stuff so I apologize if this is not the place to ask but would an IP address show several states away... Several hundred miles... if a VPN was not being used? I know that an IP is not an exact location, and that some apps like Gmail use a proxy but usually if those aren't being used it shows an IP within a close radius of the actual spot. In this case the person I'm looking at is hundreds of miles away. This is a domestic abuse situation so we're trying to determine if the person we're attempting to hide from is on vacation or something

submitted by /u/Drinking-Lightning
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video