Hacking on Medium
What a False Negative is and why it should be your primary criteria for a SAST tool

https://cdn-images-1.medium.com/max/2600/0*UzX2lkVNcRY3Og0S
In our earlier post, we discussed False Positives and why having some of them is a good thing for your teams. This blog is about a term…

Continue reading on ShiftLeft Blog »

Deep Web
Need help with adding a PGP to kelopatra

Anyone?

submitted by /u/XTLight
[link] [comments]

Operational Mental Models - Jackson T
https://www.reddit.com/r/redteamsec/comments/pkeywj/operational_mental_models_jackson_t/

submitted by /u/WM-M-GM (https://www.reddit.com/user/WM-M-GM)
[link] (http://jackson-t.ca/operational-mental-models.html) [comments] (https://www.reddit.com/r/redteamsec/comments/pkeywj/operational_mental_models_jackson_t/)

hacking: security in practice
Trying to automate the login on a Captive Portal

Hi there,

So I was just trying to automate the login on a Captive Portal on an AP that I use for work in order to be able to connect my headless Raspberry Pito the network. (I am unable to Run X-Server in this host, neither w3mor elinksdid work on rendering such a portal) Since this is considered "ilegal" by many Network Admins I post it in here , but the purpose is legitimate and it would be nice that all of us share the knowledge.

So I have been learning the protocols behind it, and this Captive Portalmay be of the type Redirect by DNS

I have indexed the landing page of the application form which is https://captiveportal.com/guest/guest_register_3.php?_browser=1

Inspeting the HTML I can see:

1st) The form is of the type POST 2nd) The parameters to be filled are the following ones (according to the rendered HTML) : visitor_name and email Despite this the html form input elements doesn't exactly correspond to the ones that the HTTP request make afterwards. I Can find email But then I find a bunch of them unrelated

```
Unused field

Unused field

Unused field
```

Where in checkbox and submit I recognise their function as well , but the hidden one for example is a mistery to me its function.

Well so the second part of the analisis is to spoof (everything have to sound hackerish haha) my own 'http' traffic while authenticating to it.

With linux ngrepyou can do this like a charm so we can sudo ngrep -W byline -d 'wlp1s0' -t '^(GET|POST) ' 'tcp and port 80' So I go for it and this is what I capture

``` (OUTPUT SIMPLIFIED)

T 2021/09/08 18:16:12.901797 90.80.121.128:58788 -> 20.200.140.191:80 [AP] #54 POST / HTTP/1.1. Host: ocsp.quovadisglobal.com. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0. Accept: /. Accept-Language: en-US,en;q=0.5. Accept-Encoding: gzip, deflate. Content-Type: application/ocsp-request. Content-Length: 87. Connection: keep-alive. . 0U0S0Q0O0M0...+..............1:l....] o......I=..y.............f...lO..$.. 6...py8..B4.

T 2021/09/08 18:16:43.733225 90.80.121.128:58824 -> 20.200.140.191:80 [AP] #184 POST / HTTP/1.1. Host: ocsp.quovadisglobal.com. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0. Accept: /. Accept-Language: en-US,en;q=0.5. Accept-Encoding: gzip, deflate. Content-Type: application/ocsp-request. Content-Length: 87. Connection: keep-alive. . 0U0S0Q0O0M0...+..............1:l....] o......I=..y.............f....l?....P$........F.. ```

Pretty unintelligible , but been a bit smart and with the index of the page that I already downloaded by wget \ --recursive \ --no-clobber \ --page-requisites \ --html-extension \ --max-redirect=0 \ --no-check-certificate \ --convert-links \ --restrict-file-names=unix \ -H \ --random-wait \ --limit-rate=200K \ --user-agent=Mozilla \ --level=3 \ https://www.captiveportal.com/guest/guest_register_3.php An placing that on my own apache2hosted server , then I listen to my own communication by the loopbackdevice sudo ngrep -W byline -d 'lo' -t '^(GET|POST) ' 'tcp and port 80' I can see the POST's bodies of the HTTP communication like visitor_name=Ferenc+Donest&email=ferensi45donest%40gmail.com&expire_after=168&role_id=2&create_time=2021-09-08+17%3A59%3A34&mac=&remote_addr=100.120.121.128&essid=&apgroup=&apname=&vcname=&auto_update_account=1&creator_accept_terms=1 (the next step cannot replicate it as the next page doesn't load locally , but is just a button to press OK

. I know later on I will be able to create a command with curl(or maybe 2 scripted them) in order to perform this process aut[...]

___________________________
@hacking_Attack
@Hacking_Video

omatically

My main question: It looks like the Real Captive Portal uses some sort of encription . But I believe that is available on the HTML code as the POST needs to be done client side. - Is this Encryption process perform by some of the javascript of this landing page? - Am I wrong about many of this assumptions?

Thanks for your help , I will keep you updated with my advatanges as I still need to inspect the JS code and maybe some more php files (although chances are that those have not been indexed)

submitted by /u/brohermano [link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to get a reverse shell in my netcat from outside LAN

I am trying to get a reverse shell from outside my LAN on my netcat but I am unable to do so I am on my linux machine and using my laptop for sending a connection request but I am not getting a callback on my linux machine.

So what are the techniques to get shell from outside my network .

submitted by /u/CoolNCocky
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Sorry if I'm asking in the wrong subreddit. But if one wasn't using a VPN or anything that would have a proxy how off would an IP be location wise?

I'm really not smart when it comes to this stuff so I apologize if this is not the place to ask but would an IP address show several states away... Several hundred miles... if a VPN was not being used? I know that an IP is not an exact location, and that some apps like Gmail use a proxy but usually if those aren't being used it shows an IP within a close radius of the actual spot. In this case the person I'm looking at is hundreds of miles away. This is a domestic abuse situation so we're trying to determine if the person we're attempting to hide from is on vacation or something

submitted by /u/Drinking-Lightning
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Bridging the gap for the newcomers - gamified experience

Hey Community!

Last week, World Wide Hack by Lotus Innovations has its Kickstarter launched. I had the opportunity to play the alpha versions and I find this game has a great potential, it is very stable and there is a lot more than just "another hacking MMO". I'm myself a propagator of learning cybersecurity on my blog and I have written the first impression here: https://blog.cyberethical.me/world-wide-hack-alpha-first-impression

Gamified experience can be sometimes enough to bridge the gap for people wanting to try offensive security for the first time.

I'm not associated or sponsored by the developers of the WWH, just want to game to get as much exposure as it is possible, without force-advertising.

submitted by /u/Asentinn
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Should I learn to write shellcodes? Or assembly in general?

I'm new to the field of exploit development. The reason I'm asking this is because recently, I started this course on writing assembly and shellcodes, and tbh I'm really hooked.

But I'm always thinking if this stuff is still relevant today? Like the course I'm doing is really old from I guess 2009-2010. I want to know if this knowledge is going to help me, maybe write exploits in the real world if I take it seriously. Also, the fact that most of the shellcodes are readily available from metasploit, makes me wonder if i should learn it.

Sorry if this is the wrong sub to ask.

submitted by /u/scaryAstronaut
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Vaccine has been Pwned!

https://cdn-images-1.medium.com/max/1280/1*ZTVO613o26a5KhNCNioIhA.jpeg
Hack The Box Vaccine walkthrough. This machine requires service enumeration, File Transfer Protocol, SQL Injection and further enumeration.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
[BEST OFFERS] Get Certified online

https://cdn-images-1.medium.com/max/672/1*iugaYQyXvZ7RDiGLsLDKmw.jpeg
ATTENTION students!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
SnakeOil

https://cdn-images-1.medium.com/max/630/0*XB0MfbLhDL8SGPyR.png
Link: https://www.vulnhub.com/entry/snakeoil-1,738/

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How Cyber Attackers Can Hack Your Car?

https://cdn-images-1.medium.com/max/2600/0*hGhZp4WXxfx_qba0
Technology Cyber Attacks.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
¿QUÉ ES UN FIREWALL AS A SERVICE (FWAAS)?

https://cdn-images-1.medium.com/max/1013/0*rU1HFoAtxpvn2jPE
PUBLICADO EN 8 SEPTIEMBRE, 2021 POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

SharpStrike - A Post Exploitation Tool Written In C# Uses Either CIM Or WMI To Query Remote Systems
http://www.kitploit.com/2021/09/sharpstrike-post-exploitation-tool.html