Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
QLOG - Windows Security Logging
https://1.bp.blogspot.com/-0CNZScA0sq4/YUON6V-lfQI/AAAAAAAAuug/xjavC5KDHcQVEUB8BmaMUVRy8ioMz3uUgCNcBGAsYHQ/w640-h426/code-light-keyboard.jpg
QLOG provides enriched Event Logging for security related events on Windows based systems. It is under heavy development and currently in alpha state. QLOG doesn’t use API hooks and it doesn’t require a driver to be installed on the target system, QLOG only uses ETW to retrieve its telemetry. Currently QLOG supports “process create” events only, but other enriched events will follow soon. QLOG runs as a Windows Services, but can also run in console mode, if you want to stream the enriched events to console directly.
How does it work
QLOG reads from ETW, enriches events and writes enriched events to Event Channel “QLOG”. It creates and uses a new event source named “QMonitor” to write to Windows Eventlog.
Here is sequence of event processing:
* Create ETW session & Subscribe to relevant kernel and userland ETW providers
* Read Events from ETW providers
* Enrich Events
* Write enriched events to eventlog channel QLOG
Development & License
QLOG is being developed by threathunters.io community and will be open sourced once it reaches production grade maturity.
Why we created QLOG?
Sysmon does a great job, but we wanted to create a tool which is open source and doesn't require drivers to be installed on target systems. Also, Sysmon is NOT SUPPORTED by Microsoft at all. So, if you run into problems in prod, you're at your own. Sure, QLOG doesn't have support either, but it will be open sourced so we can fix issues with the power of the security community and develop new features based on the requirements of the community.
Usage & install
QLOG requires .NET Framework >=4.7.2 to be installed.
To run in interactive console mode, just run
To install / deinstall as Windows service, run:
Do you want to contribute?
Please see https://threathunters.io/ on how to join threathunters.io community.
Example output of enriched PROCESS CREATE events
<div class="snippet-clipboard-content position-relative" data-snippet-clipboard-copy-content="{ "eventguid": "68795fe8-67e7-410b-a5c0-8364746d[...]
QLOG - Windows Security Logging
https://1.bp.blogspot.com/-0CNZScA0sq4/YUON6V-lfQI/AAAAAAAAuug/xjavC5KDHcQVEUB8BmaMUVRy8ioMz3uUgCNcBGAsYHQ/w640-h426/code-light-keyboard.jpg
QLOG provides enriched Event Logging for security related events on Windows based systems. It is under heavy development and currently in alpha state. QLOG doesn’t use API hooks and it doesn’t require a driver to be installed on the target system, QLOG only uses ETW to retrieve its telemetry. Currently QLOG supports “process create” events only, but other enriched events will follow soon. QLOG runs as a Windows Services, but can also run in console mode, if you want to stream the enriched events to console directly.
How does it work
QLOG reads from ETW, enriches events and writes enriched events to Event Channel “QLOG”. It creates and uses a new event source named “QMonitor” to write to Windows Eventlog.
Here is sequence of event processing:
* Create ETW session & Subscribe to relevant kernel and userland ETW providers
* Read Events from ETW providers
* Enrich Events
* Write enriched events to eventlog channel QLOG
Development & License
QLOG is being developed by threathunters.io community and will be open sourced once it reaches production grade maturity.
Why we created QLOG?
Sysmon does a great job, but we wanted to create a tool which is open source and doesn't require drivers to be installed on target systems. Also, Sysmon is NOT SUPPORTED by Microsoft at all. So, if you run into problems in prod, you're at your own. Sure, QLOG doesn't have support either, but it will be open sourced so we can fix issues with the power of the security community and develop new features based on the requirements of the community.
Usage & install
QLOG requires .NET Framework >=4.7.2 to be installed.
To run in interactive console mode, just run
qlog.exe
To install / deinstall as Windows service, run:
#install service
qlog.exe -i
#deinstall service
qlog.exe -u
Do you want to contribute?
Please see https://threathunters.io/ on how to join threathunters.io community.
Example output of enriched PROCESS CREATE events
<div class="snippet-clipboard-content position-relative" data-snippet-clipboard-copy-content="{ "eventguid": "68795fe8-67e7-410b-a5c0-8364746d[...]
Chaining bugs for better bounties
https://infosecwriteups.com/chaining-bugs-for-better-bounties-f14d6b2129de?source=rss------bug_bounty-5
https://infosecwriteups.com/chaining-bugs-for-better-bounties-f14d6b2129de?source=rss------bug_bounty-5
Chaining some low level bugs to a higher level is always fun and challenging at the same time and best thing is you get higher reward if…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/chaining-bugs-for-better-bounties-f14d6b2129de?source=rss------bug_bounty-5)
https://external-preview.redd.it/_gD0ZP_x9RL1xTfjIYNjvo_-VE3h5n8b4kItzROsOdY.jpg?width=640&crop=smart&auto=webp&s=68207b8e9cc33ed65ced002107ba76ee90efc9a9 So today I have learnt how to bypass windows defender and other AVs by executing encrypted shellcodes via TCP. You can find the code snippets on GitHub: https://github.com/tbhaxor/csharp-and-infosec
https://preview.redd.it/enw38czwtfo71.png?width=1920&format=png&auto=webp&s=fa01b7f10a2f65ba1b4f7b0bfa4330ca19bf25b8
submitted by /u/tbhaxor
[link] [comments]
https://preview.redd.it/enw38czwtfo71.png?width=1920&format=png&auto=webp&s=fa01b7f10a2f65ba1b4f7b0bfa4330ca19bf25b8
submitted by /u/tbhaxor
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Mass scanning activity detected from checking for Azure Linux OMI endpoints vulnerable to remote code execution
https://external-preview.redd.it/-c5lCAkvBeF3XrM8gD8ZTxEC4UTdb47jO2qdfacIS3c.jpg?width=320&crop=smart&auto=webp&s=f776b9f986fc0ab587dd0021c1a2366121897cd6 submitted by /u/egobum
[link] [comments]
Mass scanning activity detected from checking for Azure Linux OMI endpoints vulnerable to remote code execution
https://external-preview.redd.it/-c5lCAkvBeF3XrM8gD8ZTxEC4UTdb47jO2qdfacIS3c.jpg?width=320&crop=smart&auto=webp&s=f776b9f986fc0ab587dd0021c1a2366121897cd6 submitted by /u/egobum
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Koiprtic Level 1 - Walkthrough
It was pretty simple compared to my last venture, still wanted to share my walkthrough, so here it is,
https://medium.com/@sarangiprateek80/kioptrix-level-1-af7a4c4386cc
submitted by /u/psarangi112
[link] [comments]
Koiprtic Level 1 - Walkthrough
It was pretty simple compared to my last venture, still wanted to share my walkthrough, so here it is,
https://medium.com/@sarangiprateek80/kioptrix-level-1-af7a4c4386cc
submitted by /u/psarangi112
[link] [comments]
hacking: security in practice
Are there any hackers who are late bloomers/were late bloomers?
I read about many hackers and most common pattern that I have noticed is that, they start very young. Many hackers are teens who hack CIA, DDOS Yahoo and damage systems.
For example, mark Hutchins who stopped and reverse engineered wanna cry ransomware was so young.
Also one more thing is that, all of them are statistical genuises. Iq above 140 and all!
submitted by /u/Good-Bottle7238
[link] [comments]
Are there any hackers who are late bloomers/were late bloomers?
I read about many hackers and most common pattern that I have noticed is that, they start very young. Many hackers are teens who hack CIA, DDOS Yahoo and damage systems.
For example, mark Hutchins who stopped and reverse engineered wanna cry ransomware was so young.
Also one more thing is that, all of them are statistical genuises. Iq above 140 and all!
submitted by /u/Good-Bottle7238
[link] [comments]
Reddit
From the hacking community on Reddit
Explore this post and more from the hacking community
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Assless-Chaps : Crack MSCHAPv2 Challenge/Responses Quickly Using A Database Of NT Hashes
Assless-CHAPs is an efficient way to recover the NT hash used in a MSCHAPv2/NTLMv1 exchange if you have the challenge and response (e.g. from a WiFi EAP WPE attack).
It requires a database of NT hashes, instructions on how to make these from existing lists or using hashcat with wordlists and rules are available below. I’ve included a sample database from SecLists. You’ll need to bunzip it.
Technique
An MSCHAPv2 exchange does not require the clear-text password to be “cracked”, rather we merely need the NThash used.
MSCHAPv2 splits the NThash into three parts, and uses each part as different keys to DES encrypt the same challenge (derived from the peer and authenticator challenges). The NTHash is split into two 7-byte keys, and one 2-byte key. This means the last key is padded with NULLs to make a key of the required length. This can be rapidly brute forced due to the efficiency of DES operation and a keyspace of 65 535. Once we have those two bytes, we can look up all NThashes in our database, that end in those two bytes. This provides a much smaller set of possible hashes to check.
This is a form of space vs time tradeoff, similar to a rainbow table. It’s also a form of hash shucking.
Presentation
This was first presented at Defcon 29’s RF Hacking Village. The slides are included in this repository.
Speed
Here is the comparison for three sample challenge/response’s and three different wordlists, a small private one, rockyou, and the Have I Been Pwned list. These were done on my Macbook Pro 2016. Hashcat is using this hash schucking kernel and the two builtin GPUs and a pure rather than optimised kernel (as the latter doesn’t exist yet). Hash3 isn’t in the lists to simulate worst case performance. I’m not including the time hashcat takes to build the dictionary cache on first run.
Hash1
Small hashlist:
hashcat 0.50s user 0.27s system 55% cpu 1.405 total (8597.8 kH/s)
assless 0.05s user 0.00s system 294% cpu 0.018 total
Rockyou hashlist:
hashcat 2.67s user 0.51s system 93% cpu 3.413 total
assless 0.05s user 0.01s system 281% cpu 0.021 total
HIBP hashlist:
hashcat 59.97s user 11.72s system 136% cpu 52.603 total (5620.6 kH/s)
assless 0.05s user 0.00s system 292% cpu 0.018 total
Hash 2
Small hashlist:
hashcat 0.51s user 0.27s system 55% cpu 1.409 total (8704.7 kH/s)
assless 0.03s user 0.00s system 248% cpu 0.012 total
Rockyou hashlist:
hashcat 2.20s user 0.46s system 110% cpu 2.409 total (5798.4 kH/s)
assless 0.03s user 0.00s system 231% cpu 0.015 total
HIBP hashlist:
<p class="has-vivid-green-cyan-color has-black-background-color ha[...]
➖ Sent by @TheFeedReaderBot ➖
Assless-Chaps : Crack MSCHAPv2 Challenge/Responses Quickly Using A Database Of NT Hashes
Assless-CHAPs is an efficient way to recover the NT hash used in a MSCHAPv2/NTLMv1 exchange if you have the challenge and response (e.g. from a WiFi EAP WPE attack).
It requires a database of NT hashes, instructions on how to make these from existing lists or using hashcat with wordlists and rules are available below. I’ve included a sample database from SecLists. You’ll need to bunzip it.
Technique
An MSCHAPv2 exchange does not require the clear-text password to be “cracked”, rather we merely need the NThash used.
MSCHAPv2 splits the NThash into three parts, and uses each part as different keys to DES encrypt the same challenge (derived from the peer and authenticator challenges). The NTHash is split into two 7-byte keys, and one 2-byte key. This means the last key is padded with NULLs to make a key of the required length. This can be rapidly brute forced due to the efficiency of DES operation and a keyspace of 65 535. Once we have those two bytes, we can look up all NThashes in our database, that end in those two bytes. This provides a much smaller set of possible hashes to check.
This is a form of space vs time tradeoff, similar to a rainbow table. It’s also a form of hash shucking.
Presentation
This was first presented at Defcon 29’s RF Hacking Village. The slides are included in this repository.
Speed
Here is the comparison for three sample challenge/response’s and three different wordlists, a small private one, rockyou, and the Have I Been Pwned list. These were done on my Macbook Pro 2016. Hashcat is using this hash schucking kernel and the two builtin GPUs and a pure rather than optimised kernel (as the latter doesn’t exist yet). Hash3 isn’t in the lists to simulate worst case performance. I’m not including the time hashcat takes to build the dictionary cache on first run.
Hash1
Small hashlist:
hashcat 0.50s user 0.27s system 55% cpu 1.405 total (8597.8 kH/s)
assless 0.05s user 0.00s system 294% cpu 0.018 total
Rockyou hashlist:
hashcat 2.67s user 0.51s system 93% cpu 3.413 total
assless 0.05s user 0.01s system 281% cpu 0.021 total
HIBP hashlist:
hashcat 59.97s user 11.72s system 136% cpu 52.603 total (5620.6 kH/s)
assless 0.05s user 0.00s system 292% cpu 0.018 total
Hash 2
Small hashlist:
hashcat 0.51s user 0.27s system 55% cpu 1.409 total (8704.7 kH/s)
assless 0.03s user 0.00s system 248% cpu 0.012 total
Rockyou hashlist:
hashcat 2.20s user 0.46s system 110% cpu 2.409 total (5798.4 kH/s)
assless 0.03s user 0.00s system 231% cpu 0.015 total
HIBP hashlist:
<p class="has-vivid-green-cyan-color has-black-background-color ha[...]
➖ Sent by @TheFeedReaderBot ➖