KitPloit - PenTest Tools!
source
photo

https://1.bp.blogspot.com/-LCTv-onjDL4/YTq40wtG_uI/AAAAAAAAulk/KGxLZkJ5hmgyHonTr_leuXHV1Wztq_7YACNcBGAsYHQ/w640-h480/wwwgrep.png
WWWGrep is a rapid search “grepping” mechanism that examines HTML elements by type and permits focused (single), multiple (file based URLs) and recursive (with respect to root domain or not) searches to be performed. Header names and values may also be recursively searched in this manner. WWWGrep was designed to help both breakers and builders to quickly examine code bases under inspection, some use cases and examples are shown below.
Installation

git clone
pip3 install -r requirements.txt
python3 wwwgrep.py

Dependencies (pip3 install -r requirements.txt)

- Python 3.5+
- BeautifulSoup 4
- UrlLib.parse
- requests_html
- argparse
- requests
- re
- os.path


Breakers

* Quickly locate login pages by searching for input fields named “username” or “password” on a site an using a recursion flag
* Quickly check headers for the use of specific technologies
* Quickly locate cookies and JWT tokens by search response headers
* Use with a proxy tool to automate recursion through a set links rapidly
* Locate all input sinks on a page (or site) by search for input fields and parameter processing symbology
* Locate all developer comments on a page to identify commented out code (or To Do’s)
* Quickly test consistency of site controls implemented during recursion (headers, HSTS, CSP etc)
* Quickly find vulnerable JavaScript code present in web pages
* Identify API tokens and access keys present in page code

Builders

* Quickly test multiple sites under management for the use of vulnerable code
* Quickly test multiple sites under management for the use of vulnerable frameworks/technologies
* Find sites which may share a common codebase to determine the impact of flaws/vulnerabilities
* Find sites which share a common authentication token (header auth token)
* Find sites which may contain developer comments for server hygiene purposes

Command line switches

wwwgrep.py [target/file] [search_string] [search params/criteria/recursion etc]
[...]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
The top keywords used in phishing email subject lines

https://external-preview.redd.it/x4PyEtb0krJ6PmdFWVCEHlv6RvW3AGDcW87XMmJGFxo.jpg?width=640&crop=smart&auto=webp&s=98d3f24180a0972946c365963dedbe60688cd2ec submitted by /u/Anastasia_IT
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What tools would someone use to exploit sweet32 vulnerability?

How would an attacker launch a birthday attack? Sorry if my questions aren't well phrased or if this is a dumb question, I'm a beginner

submitted by /u/alexgiann2
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Microsoft advierte sobre un error de adquisición de cuentas cruzadas en Azure Container Instances


PUBLICADO EN 10 SEPTIEMBRE, 2021POR EHACKING

Continue reading on Medium »

I've got a good buddy who's streaming on Twitch from time to time. Trying to help him out by getting some viewers that can give some input/collaboration help. He's working toward OSCP. Also he's a web app pen tester for a large company.
https://www.reddit.com/r/redteamsec/comments/plz2d9/ive_got_a_good_buddy_whos_streaming_on_twitch/

https://www.twitch.tv/beauknowstech submitted by /u/sfitzo (https://www.reddit.com/user/sfitzo)
[link] (https://www.reddit.com/r/redteamsec/comments/plz2d9/ive_got_a_good_buddy_whos_streaming_on_twitch/) [comments] (https://www.reddit.com/r/redteamsec/comments/plz2d9/ive_got_a_good_buddy_whos_streaming_on_twitch/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Do you guys know an app like droidsheep or faceniff ?

I just want to spy on my mom's phone because it seems like she's cheating. We just connect on the same network and she won't even let me touch her phone. I can't use droidsheep or faceniff because my phone is not rooted. I'm afraid to root my phone. Thank you

submitted by /u/lie_be
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do I know if my cellphone and computer have been hacked?

I have this suspicion that my brother hacked my devices, I think he is the network admin and did it by having access to them and hacking though the Wifi.

I think he is monitoring what I do.

submitted by /u/Necessary-Prize2300
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
CVE-2021-29011 XSS Exploit To Escalate Privileges (DMASOFTLAB)

https://external-preview.redd.it/2bfFN8fAoGIr88cj6n-A_7r9jDoAU0t8VLy190G30ac.jpg?width=640&crop=smart&auto=webp&s=6e5db6eb8dc101d4d91c96b8766ff9a9e3b62962 submitted by /u/TorchedXorph
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
PDFSimpli: a website for illegal hacking?

I'm not sure if stories are allowed, but many months ago, my bank account was hacked.
The thing is the transactions were from "Simpli" as far as I remember.
It may be that I clicked the wrong ad that redirected me to a hacked site, but I'm pretty sure its weird how I got hacked by a website that says it only changes files from PDF to Word.

Any experience? And how can I check?

submitted by /u/imlitdyingshit
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
MR. ROBOT (CTF)


This is intermediate level CTF based on mr.robot show, so without furthur ado, let’s start!!!

Continue reading on Medium »

Kali Linux TutorialsEDD : Enumerate Domain Data
EDD (Enumerate Domain Data) is designed to be similar to Power View but in .NET. Power View is essentially the ultimate domain enumeration tool, and we wanted a .NET implementation that we worked on ourselves. This tool was largely put together by viewing implementations of different functionality across a wide range of existing projects and combining them into EDD.

Usage

To use EDD, you just need to call the application, provide the function that you want to run (listed below) and provide any optional/required parameters used by the function.

Functions

The following functions can be used with the -f flag to specify the data you want to enumerate/action you want to take.

Forest/Domain Information

getdomainsid – Returns the domain sid (by default current domain if no domain is provided)
getforest – returns the name of the current forest
getforestdomains – returns the name of all domains in the current forest
convertsidtoname – Converts a SID to the corresponding group or domain name (use the -u option for providing the SID value)
getadcsservers – Get a list of servers running AD CS within the current domain

Computer Information

getdomaincomputers – Get a list of all computers in the domain
getdomaincontrollers – Gets a list of all domain controllers
getdomainshares – Get a list of all accessible domain shares

User Information

getnetlocalgroupmember – Returns a list of all users in a local group on a remote system
getnetdomaingroupmember – Returns a list of all users in a domain group
getdomainuser – Retrieves info about specific user (name, description, SID, Domain Groups)
getnetsession – Returns a list of accounts with sessions on the targeted system
getnetloggedon – Returns a list of accounts logged into the targeted system
getuserswithspns – Returns a list of all domain accounts that have a SPN associated with them

Chained Information

finddomainprocess – Search for a specific process across all systems in the domain (requires admin access on remote systems)
finddomainuser – Searches the domain environment for a specified user or group and tries to find active sessions (default searches for Domain Admins)
findinterestingdomainsharefile – Searches the domain environment for all accessible shares. Once found, it parses all filenames for “interesting” strings
findwritableshares – Enumerates all shares in the domain and then checks to see if the current account can create a text file in the root level share, and one level deep.


Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux TutorialsPSPKIAudit : PowerShell toolkit for auditing Active Directory Certificate Services (AD CS)
PSPKIAudit is a PowerShell toolkit for auditing Active Directory Certificate Services (AD CS).

It is built on top of PKISolution’s PSPKI toolkit (Microsoft Public License). This repo contains a newer version of PSPKI than what’s available in the PSGallery (see the PSPKI directory). Vadims Podans (the creator of PSPKI) graciously provided this version as it contains patches for several bugs.

This README is only meant as a starting point- for complete details and defensive guidance, please see the “Certified Pre-Owned” whitepaper.

The module contains the following main functions:

1. Invoke-PKIAudit – Audits the current Forest’s AD CS settings, primarily analyzing the CA server and published templates for potential privilege escalation opportunities.
2. Get-CertRequest – Examines a CA’s issued certificates by querying the CA’s database. Primary intention is to discover certificate requests that may have abused a certificate template privilege escalation vulnerability. In addition, if a user or computer is compromised, incident responders can use it to find certificates the CA server had issued to the compromised user/computer (which should then be revoked).

WARNING: This code is beta! We are confident that Invoke-PKIAudit will not impact the environment as the amount of data it queries is quite limited. We have not done rigorous testing with Get-CertRequest against typical CA server workloads. Get-CertRequest queries the CA’s database directly and may have to process thousands of results, which might impact performance.

IF THERE ARE NO RESULTS, THIS IS NOT A GUARANTEE THAT YOUR ENVIRONMENT IS SECURE!!

WE ALSO CANNOT GUARANTEE THAT OUR MITIGATION ADVICE WILL MAKE YOUR ENVIRONMENT SECURE OR WILL NOT DISRUPT OPERATIONS!

It is your responsibility to talk to your Active Directory/PKI/Architecture team(s) to determine the best mitigations for your environment.

If the code breaks, or we missed something, please submit an issue or pull request for a fix!

* Setup
* Auditing AD CS Misconfigurations
* Output Explanation
* ESC1 – Misconfigured Certificate Templates
* ESC2 – Misconfigured Certificate Templates
* ESC3 – Misconfigured Enrollment Agent Templates
* ESC4 – Vulnerable Certificate Template Access Control
* ESC5 – Vulnerable PKI AD Object Access Control
* ESC6 – EDITF_ATTRIBUTESUBJECTALTNAME2
* ESC7 – Vulnerable Certificate Authority Access Control
* ESC8 – NTLM Relay to AD CS HTTP Endpoints
* Misc – Explicit Mappings

* Triaging Existing Issued Certificate Requests

Setup

Requirements

* Install the following using an elevated PowerShell prompt:

* RSAT’s Certificate Services and Active Directory features. Install with the following command:

Get-WindowsCapability -Online -Name “Rsat.*” | where Name -match “CertificateServices|ActiveDirectory” | Add-WindowsCapability -Online

Import

Download the module extract it to a folder. Then, import the module using the following commands:

cd PSPKIAudit
Get-ChildItem -Recurse | Unblock-File
Import-Module .\PSPKIAudit.psm1

Auditing AD CS Misconfigurations

Running Invoke-PKIAudit [-CAComputerName CA.DOMAIN.COM | -CAName X-Y-Z] will run all auditing checks for your existing AD CS environment, including enumerating various Certificate Authority and Certificate Template settings.

Any misconfigurations (ESC1-8) will appear as properties on the CA/template results displayed to identify the specific misconfiguration found.

If you want to change the groups/users used to test enrollment/[...]

___________________________
@hacking_Attack
@Hacking_Video

access control, modify the $CommonLowprivPrincipals regex at the top of Invoke-PKIAudit.ps1

If you want to export all CA information to a csv, run: Get-AuditCertificateAuthority [-CAComputerName CA.DOMAIN.COM | -CAName X-Y-Z] | Export-Csv -NoTypeInformation CAs.csv

If you want to export ALL published template information to a csv (not just vulnerable templates), run: Get-AuditCertificateTemplate [-CAComputerName CA.DOMAIN.COM | -CAName X-Y-Z] | Export-Csv -NoTypeInformation templates.csv

Output Explanation

There are two main sections of output, details about discovered CAs and details about potentially vulnerable templates.

For certificate authority results:
Certificate Authority PropertyDescriptionComputerNameThe system the CA is running on.CANameThe name of the CA.ConfigStringThe full COMPUTER\CA_NAME configuration string.IsRootIf the CA is a root CA.AllowsUserSuppliedSansIf the CA has the EDITF_ATTRIBUTESUBJECTALTNAME2 flag set.VulnerableACLWhether the CA has a vulnerable ACL setting.EnrollmentPrincipalsPrincipals who have the Enroll privilege at the CA level.EnrollmentEndpointsThe CA’s web services enrollment endpoints.NTLMEnrollmentEndpointsThe CA’s web services enrollment endpoints that have NTLM enabled.DACLThe full access control information.MisconfigurationsESCX indicating the specific misconfiguration present (if any).
For certificate template results:
PropertyDescriptionCAThe full CA ConfigString the template is published on (null for not published).NameThe template name.SchemaVersionThe schema version (1/2/3) of the template.OIDThe unique object identifier for the template.VulnerableTemplateACLTrue if the template has a vulnerable ACL setting.LowPrivCanEnrollTrue if low-privileged users can enroll in the template.EnrolleeSuppliesSubjectTrue if the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag is present (i.e., users can supply arbitrary SANs).EnhancedKeyUsageThe usage EKUs enabled in the template.HasAuthenticationEkuTrue if the template has an EKU that allows for authentication.HasDangerousEkuTrue if the template has a “dangerous” (Any Purpose or null) EKU.EnrollmentAgentTemplateTrue if the template has the “Certificate Request Agent” EKU.CAManagerApprovalTrue if manager approvals are needed for enrollment.IssuanceRequirementsAuthorized signature information.ValidityPeriodHow long the certificate is valid for.RenewalPeriodThe renewal period for the certificate.OwnerThe principal who owns the certificate.DACLThe full access control information.MisconfigurationsESCX indicating the specific misconfiguration present (if any).
ESC1 – Misconfigured Certificate Templates

Details

This privilege escalation scenario occurs when the following conditions are met:

1. The Enterprise CA grants low-privileged users enrollment rights. The Enterprise CA’s configuration must permit low-privileged users the ability to request certificates. See the “Background – Enrollment” section at the beginning of the whitepaper paper for more details.
2. Manager approval is disabled. This setting necessitates that a user with certificate “manager” permissions review and approve the requested certificate before the certificate is issued. See the “Background – Issuance Requirements” section at the beginning of the whitepaper paper for more details.
3. No authorized signatures are required. This setting requires any CSR to be signed by an existing authorized certificate. See the “Background – Issuance Requirements” section at the beginning of the whitepaper for more details.
4. An overly permissive certificate template security descriptor grants certificate enrollment rights to low-privileged users. Having certificate enrollment rights allo[...]

___________________________
@hacking_Attack
@Hacking_Video

ws a low-privileged attacker to request and obtain a certificate based on the template. Enrollment Rights are granted via the certificate template AD object’s security descriptor.
5. The certificate template defines EKUs that enable authentication. Applicable EKUs include Client Authentication (OID 1.3.6.1.5.5.7.3.2), PKINIT Client Authentication (OID 1.3.6.1.5.2.3.4), or Smart Card Logon (OID 1.3.6.1.4.1.311.20.2.2).
6. The certificate template allows requesters to specify a subjectAltName (SAN) in the CSR. If a requester can specify the SAN in a CSR, the requester can request a certificate as anyone (e.g., a domain admin user). The certificate template’s AD object specifies if the requester can specify the SAN in its mspki-certificate-name-flag property. The mspki-certificate-name-flag property is a bitmask and if the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag is present, a requester can specify the SAN.

TL;DR This situation means that a unprivileged users can request a certificate that can be used for domain authentication, where they can specify an arbitrary alternative name (like a domain admin). This can result in a working certificate for an elevated user like a domain admin!

Example

[!] Potentially vulnerable Certificate Templates:
CA : dc.theshire.local\theshire-DC-CA
Name : ESC1Template
SchemaVersion : 2
OID : ESC1 Template (1.3.6.1.4.1.311.21.8.10395027.10224472.4213181.15714845.1171465.9.10657968.9897558)
VulnerableTemplateACL : False
LowPrivCanEnroll : True
EnrolleeSuppliesSubject : True
EnhancedKeyUsage : Client Authentication (1.3.6.1.5.5.7.3.2)|Secure Email (1.3.6.1.5.5.7.3.4)|Encrypting File System (1.3.6.1.4.1.311.10.3.4)
HasAuthenticationEku : True
HasDangerousEku : False
EnrollmentAgentTemplate : False
CAManagerApproval : False
IssuanceRequirements : [Issuance Requirements]
Authorized signature count: 0
Reenrollment requires: same criteria as for enrollment.
ValidityPeriod : 1 years
RenewalPeriod : 6 weeks
Owner : THESHIRE\localadmin
DACL : NT AUTHORITY\Authenticated Users (Allow) – Read
THESHIRE\Domain Admins (Allow) – Read, Write, Enroll
THESHIRE\Domain Users (Allow) – Enroll
THESHIRE\Enterprise Admins (Allow) – Read, Write, Enroll
THESHIRE\localadmin (Allow) – Read, Write
Misconfigurations : ESC1

Mitigations

There are a few options. First, right click the affected certificate template in the Certificate Templates Console (certtmpl.msc) and click “Properties”

1. Remove the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag via “Subject Name”, unchecking “Supply in Request”.
* This prevents arbitrary SAN specification in the CSR. Unless alternate names are really needed for this template, this is probably the best fix.

2. Remove the “Client Authentication” and/or “Smart Card Logon” EKUS via “Extensions” -> “Application Policies”.
* This prevents domain authentication with this template.

3. Enable “CA Certificate Manager Approval” in “Issuance Requirements”.
* This puts requests for this template in the “Pending Requests” queue that must be manually approved by a certificate manager.

4. Enable Authorized Signatures” in “Issuance Requirements” (if you know what you’re doing).
* This forces CSRs to be co-signed by an Enrollment Agent certificate.

5. Remove the ability for low-privileged users from enrolling in this template via “Security” and removing the appropriate Enroll privilege.

ESC2 – Misconfigured Certificate Templates

Details

This privilege escalation scenario occurs when the following conditions are met:

1. The Enterprise CA grants low-privileged users enrollment rights. Details are the same as in ESC1.
2. Manager approval is disabled. Details are the same as in ESC1.
3.[...]

___________________________
@hacking_Attack
@Hacking_Video

No authorized signatures are required. Details are the same as in ESC1.
4. An overly permissive certificate template security descriptor grants certificate enrollment rights to low-privileged users. Details are the same as in ESC1.
5. The certificate template defines Any Purpose EKUs or no EKU. The Any Purpose (OID 2.5.29.37.0) can be used for (surprise!) any purpose, including client authentication. If no EKUs are specified – i.e. the pkiextendedkeyusage is empty or the attribute doesn’t exist – then the certificate is the equivalent of a subordinate CA certificate and can be used for anything.

TL;DR This is very similar to ESC1, however with the Any Purpose or no EKU, the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag does not need to be present.

Example

[!] Potentially vulnerable Certificate Templates:
CA : dc.theshire.local\theshire-DC-CA
Name : ESC2Template
SchemaVersion : 2
OID : ESC2 Template (1.3.6.1.4.1.311.21.8.10395027.10224472.4213181.15714845.1171465.9.7730030.4389735)
VulnerableTemplateACL : False
LowPrivCanEnroll : True
EnrolleeSuppliesSubject : False
EnhancedKeyUsage :
HasAuthenticationEku : True
HasDangerousEku : True
EnrollmentAgentTemplate : False
CAManagerApproval : False
IssuanceRequirements : [Issuance Requirements]
Authorized signature count: 0
Reenrollment requires: same criteria as for enrollment.
ValidityPeriod : 1 years
RenewalPeriod : 6 weeks
Owner : THESHIRE\localadmin
DACL : NT AUTHORITY\Authenticated Users (Allow) – Read
THESHIRE\Domain Admins (Allow) – Read, Write, Enroll
THESHIRE\Domain Users (Allow) – Enroll
THESHIRE\Enterprise Admins (Allow) – Read, Write, Enroll
THESHIRE\localadmin (Allow) – Read, Write
Misconfigurations : ESC2

Mitigations

There are a few options. First, right click the affected certificate template in the Certificate Templates Console (certtmpl.msc) and click “Properties”

1. Remove the ability for low-privileged users from enrolling in this template via “Security” and removing the appropriate Enroll privilege.
* This is likely the best fix, as these sensitive EKUs should not be available to low-privileged users!

2. Enable “CA Certificate Manager Approval” in “Issuance Requirements”.
* This puts requests for this template in the “Pending Requests” queue that must be manually approved by a certificate manager.

3. Enable Authorized Signatures” in “Issuance Requirements” (if you know what you’re doing).
* This forces CSRs to be co-signed by an Enrollment Agent certificate.


ESC3 – Misconfigured Enrollment Agent Templates

Details

This privilege escalation scenario occurs when the following conditions are met:

1. The Enterprise CA grants low-privileged users enrollment rights. Details are the same as in ESC1.
2. Manager approval is disabled. Details are the same as in ESC1.
3. No authorized signatures are required. Details are the same as in ESC1.
4. An overly permissive certificate template security descriptor grants certificate enrollment rights to low-privileged users. Details are the same as in ESC1.
5. The certificate template defines the Certificate Request Agent EKU. The Certificate Request Agent EKU (OID 1.3.6.1.4.1.311.20.2.1) allows a principal to enroll for another certificate template on behalf of another user.
6. Enrollment agents restrictions are not implemented on the CA.

TL;DR Someone with a Certificate Request (aka Enrollment) Agent certificate can enroll in other certificates on behalf of any user in the domain, for any Schema Version 1 template or any Schema Version 2+ template that requires the appropriate “Authorized Signatures/Application Policy” Issuance Requirement, unless “Enrollment Agent Restrictions” are implemented at the CA lev[...]

___________________________
@hacking_Attack
@Hacking_Video