I'm curious.
https://www.reddit.com/r/redteamsec/comments/po22zs/im_curious/

Does anyone know the least known C2 out there? I use beacon for most the time which is Unreliable.. if you have recommendation let me know please. submitted by /u/R3dd3v3l (https://www.reddit.com/user/R3dd3v3l)
[link] (https://www.reddit.com/r/redteamsec/comments/po22zs/im_curious/) [comments] (https://www.reddit.com/r/redteamsec/comments/po22zs/im_curious/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
CVE-2021-3437 | HP OMEN Gaming Hub Privilege Escalation Bug Hits Millions of Gaming Devices

https://external-preview.redd.it/MPfWmvQVkpJKXZ-0epCVld9HIgpPp6eWsK-xk-TLCkw.jpg?width=640&crop=smart&auto=webp&s=5254dff517b89b561ab454c5fb9d10045d0bc97b submitted by /u/GHIDRAdev
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What is the difference between a script kiddie and someone using a pre-built tool?

My understanding is that script-kiddies can't make/ code their programs and they don't understand what the code is doing only what the results are. Is this correct? or is there a better distinction?

submitted by /u/theUnholyVenom
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deri Protocol Bug Bounty Program

After the release of Perpetual Protocol on Binance Smart Chain and Polygon Network, we’re thrilled to reveal our bug bounty program with…Continue reading on Medium »
Read more...

Hacking on Medium
Who is a hacker?


Hey guys, in this blog lets talk some interesting stuffs about hacking and hackers.

Continue reading on Medium »

Hacking on Medium
How i hacked world wide Tiktok users


In this write up I am sharing a TikTok vulnerability reported via TikTok’s bug bounty program

Continue reading on Medium »

Powershell brute force attack via rdp
https://www.reddit.com/r/Pentesting/comments/po2xx9/powershell_brute_force_attack_via_rdp/

So I've been tasked with staging a brute force attack via rdp in powershell with no dependencies on external files. Essentially just running through a list of login names and random passwords. This is to test the functionality and response of our current SentinelOne implementation and verify it works as expected. Any ideas on this before I start going down this rabbit hole? submitted by /u/user257 (https://www.reddit.com/user/user257)
[link] (https://www.reddit.com/r/Pentesting/comments/po2xx9/powershell_brute_force_attack_via_rdp/) [comments] (https://www.reddit.com/r/Pentesting/comments/po2xx9/powershell_brute_force_attack_via_rdp/)

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
The Difference Between These 2 Subreddits

I was wondering whats the difference between this subreddit (r/deepweb) and the subreddit r/onions ?

submitted by /u/TheToxicNinja20
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!targetedKerberoast - Kerberoast With ACL Abuse Capabilities



targetedKerberoast is a Python script that can, like many others (e.g. GetUserSPNs.py), print "kerberoast" hashes for user accounts that have a SPN set. This tool brings the following additional feature: for each user without SPNs, it tries to set one (abuse of a write permission on the servicePrincipalNameattribute), print the "kerberoast" hash, and delete the temporary SPN set for that operation. This is called targeted Kerberoasting. This tool can be used against all users of a domain, or supplied in a list, or one user supplied in the CLI.

More information about this attack

* The Hacker Recipes - Kerberoast
* The Hacker Recipes - Targeted Kerberoasting



Usage

This tool supports the following authentications

* (NTLM) Cleartext password
* (NTLM) Pass-the-hash
* (Kerberos) Cleartext password
* (Kerberos) Pass-the-key / Overpass-the-hash
* (Kerberos) Pass-the-cache (type of Pass-the-ticket)

Among other things, targetedKerberoast supports multi-level verbosity, just append -v, -vv, ... to the command :)

Kerberos authentication. Grabs credentials from .ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line --no-pass don't ask for password (useful for -k) -p PASSWORD, --password PASSWORD password to authenticate with -H [LMHASH:]NTHASH, --hashes [LMHASH:]NTHASH NT/LM hashes, format is LMhash:NThash --aes-key hex key AES key to use for Kerberos Authentication (128 or 256 bits) ">usage: targetedKerberoast.py [-h] [-v] [-q] [-D TARGET_DOMAIN] [-U USERS_FILE] [--request-user username] [-o OUTPUT_FILE] [--use-ldaps] [--only-abuse] [--no-abuse] [--dc-ip ip address] [-d DOMAIN] [-u USER]
[-k] [--no-pass | -p PASSWORD | -H [LMHASH:]NTHASH | --aes-key hex key]

Queries target domain for SPNs that are running under a user account and operate targeted Kerberoasting

optional arguments:
-h, --help show this help message and exit
-v, --verbose verbosity level (-v for verbose, -vv for debug)
-q, --quiet show no information at all
-D TARGET_DOMAIN, --target-domain TARGET_DOMAIN
Domain to query/request if different than the domain of the user. Allows for Kerberoasting across trusts.
-U USERS_FILE, --users-file USERS_FILE
File with user per line to test
--request-user username
Requests TGS for the SPN associated to the user specified (just the username, no domain needed)
-o OUTPUT_FILE, --output-file OUTPUT_FILE
Output filename to write ciphers in JtR/hashcat format
--use-ldaps Use LDAPS instead of LDAP
--only-abuse Ignore accounts that already have an SPN and focus on targeted Kerberoasting
--no-abuse Don't attempt targeted Kerberoasting

authentication & connection:
--dc-ip ip address IP Address of the domain controller or KDC (Key Distribution Center) for Kerberos. If omitted it will use the domain part (FQDN) specified in the identity parameter
-d DOMAIN, --domain DOMAIN
(FQDN) domain to authenticate to
-u USER, --user USER user to authenticate with

secrets:
-k, --kerberos Use Kerberos authentication. Grabs credentials from .ccache file (KRB5CCNAME) based on target parameter s. If valid credentials cannot be found, it will use the ones specified in the
command line
--no-pass don't ask for password (useful for -k)
-p PASSWORD, --password PASSWORD
password to authenticate with
-H [LMHASH:]NTHASH, --hashes [LMHASH:]NTHASH
NT/LM hashes, format is LMhash:NThash
--aes-key hex key AES key to use for Kerberos Authentication (128 or 256 bits)


Below is an example what the tool can do.



Credits and references

Credits to the [...]

___________________________
@hacking_Attack
@Hacking_Video

whole team behind Impacket and its contributors.



Download targetedKerberoast

___________________________
@hacking_Attack
@Hacking_Video

Vulnerability assessments vs penetration testing vs red teaming in your organization?
https://www.reddit.com/r/redteamsec/comments/po4huv/vulnerability_assessments_vs_penetration_testing/

Do you have similar or separate team for these roles? While they may have similar components, each one is different and should be used in different contexts. If similar, there might be more work for them as they need to cover 3 areas, depending on the size of your organization? If separate, what is the challenge since the objective is slightly different? submitted by /u/w0lfcat (https://www.reddit.com/user/w0lfcat)
[link] (https://www.reddit.com/r/redteamsec/comments/po4huv/vulnerability_assessments_vs_penetration_testing/) [comments] (https://www.reddit.com/r/redteamsec/comments/po4huv/vulnerability_assessments_vs_penetration_testing/)

___________________________
@hacking_Attack
@Hacking_Video

Bypass Server Upload Restrictions
https://infosecwriteups.com/bypass-server-upload-restrictions-69054c5e1be4?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

How to Get a Shell on a Website using a File [Tutorial]Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/bypass-server-upload-restrictions-69054c5e1be4?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How I Was Able To Send SMS From Google To Anyone | $$$ Google Vulnerability:
https://asterfiester.medium.com/how-i-was-able-to-send-sms-from-google-to-anyone-google-vulnerability-3277ea0cc9d1?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

An interesting write up about Google Vulnerability:Continue reading on Medium » (https://asterfiester.medium.com/how-i-was-able-to-send-sms-from-google-to-anyone-google-vulnerability-3277ea0cc9d1?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux TutorialsPantagrule : Large Hashcat Rulesets Generated From Real-World Compromised Passwords
Pantagrule is a series of rules for the hashcat password cracker generated from large amounts of real-world password compromise data. While Pantagrule rule files can be large, the rules are both tunable and perform better than many existing rule sets.

Pantagrule was generated using PACK’s Levenshtein Reverse Path algorithm for automated rule generation (Kacherginsky, 2013). PACK’s output was then sorted based upon the number of times PACK generated the rule to make the base ruleset. This process is similar to the rules generated by _NSAKEY for password cracking competitions in 2014 (_NSAKEY, 2014), however, Pantagrule was generated off a significantly larger set of passwords. Version 2 of Pantagrule was developed off of the publicly-available hashes.org “founds” corpus, a best-in-class public wordlist. This yields more transparent results than the original variant, which used a proprietary corpus containing 842,643,513 unique passwords.

When such large rulesets are fed through PACK, millions of rules result. However, since most of the rules generated appear only a handful of times, most of the useful rules are the ones that are most commonly generated by the algorithm. This repository contains a subset of rules generated by PACK whilst iterating through the existing corpus.

Optimised Variants

In order to generate a second-pass optimisation of the rules against real-world data, the top one million generated rules was run against the Pwned Passwords NTLM list using the rockyou wordlist. Any rule that cracked a password was added to its own list and poorer-performing rules were discarded.

Four optimisation types were created:

* popular.rule: pantagrule.1m run against the top 25,000,000 passwords of the HIBP set.
* random.rule: pantagrule.1m run against 25,000,000 randomly selected passwords from the HIBP set.
* hybrid.rule: A sorted list of a combination of the most successful popular and random rules, then cut in half, in an attempt to make a lighter, “balanced” ruleset that works across a larger sample set.
* one.rule: A version of OneRuleToRuleThemAll in which the top performing hybrid rules are appended, and the list is truncated to the size of the dive rule set. Interestingly, there is only a couple-thousand-rule overlap with OneRuleToRuleThemAll and the Pantagrule rules, making the two strategies complementary. Pantagrule’s one performs better than other known lists of this size, and it is recommended that you start with this ruleset before attempting one of the larger variants.

Pantagrule hashorg.v6

After the success of these large rulesets, an attempt was made of the inverse of the royce variant, in which the original Pantagrule methodology was used but both sets of data were different. Pantagrule now uses the public hashes.org “founds” list as its wordlist base for rule generation, and an optimisation pass was then made against the V6 NTLM list from Have I Been Pwned. Given the fully-public nature of the data used, it also allows the publication of raw reproducibility data, including pantagrule.v2.1m.rule, which are the top one million rules generated by this methodology. The data for V5 and V6 is the same for the top 25 million passwords.

For this version, the way one is generated has changed. To generate one, the full 1 million list was appended to OneRuleToRuleThemAll.rule and then the entire set calibrated on Pwned V6, vs. just appending rules and truncating.

Naming conventions for the rules have now ch[...]

___________________________
@hacking_Attack
@Hacking_Video