Hacking on Medium
How a simple manipulation let me buy anything for free?


Hello guys, as you all know my name is Mayank Garg and this is my second blog on my medium. This is not any kind of a write-up or a…

Continue reading on Medium »

Deep Web
How do i enter the deep web without having to pay for VPN, and how can i find and use links?

submitted by /u/Konmanhit
[link] [comments]

Kali Linux TutorialsKnockOutlook : A Little Tool To Play With Outlook
KnockOutlook is a C# project that interacts with Outlook’s COM object in order to perform a number of operations useful in red team engagements.

Command Line Usage

_ _ _ _ _ _ / /// / // _ _ / // / _ / /_ / ,< / _ \/ _ \/ / /// / / / / / / / / \/ _ \/ ///
/ /| |/ / / / // / // ,< / // / // / // / // / // / ,< // |// //__/___//_\___/__,/_//___/____/_/_\
Parameters:
–operation : specify the operation to run
–keyword : specify a keyword for the ‘search’ operation
–id : specify an EntryID for the ‘save’ operation
–bypass : bypass the Programmatic Access Security settings (requires admin)
Operations:
check : perform a number of checks to ensure operational security
contacts : extract all contacts of every account
mails : extract mailbox metadata of every account
search : search for the provided keyword in every mailbox
save : save a specified mail by its EntryID
Examples:
KnockOutlook.exe –operation check
KnockOutlook.exe –operation contacts
KnockOutlook.exe –operation mails –bypass
KnockOutlook.exe –operation search –keyword password
KnockOutlook.exe –operation save –id {EntryID} –bypass

Operations

* checkEnumerates the Outlook installation details in order to construct the correct registry key and retrieve the Programmatic Access Security setting.If this value is set to Warn when antivirus is inactive or out-of-date it queries WMI for any installed antivirus products and parses their current state.
* contactsEnumerates the contacts of every configured account and extracts the following information:
* Full Name
* Email Address

* mailsEnumerates the mails of every configured account and extracts the following metadata:
* ID
* Timestamp
* Subject
* From
* To
* Attachments

* searchSearches inside the mailbox of every configured account using Outlook’s built-in search engine and returns the EntryID of mails that contain the provided keyword in their body.
* saveUses Outlook’s built-in Save As mechanism to export a mail referenced by its EntryID.

Object Model Guard Bypass

The --bypass switch can be used in conjunction with contacts, mails, search and save operations given the fact that the current process is running with high integrity level.

It will attempt to snapshot the current security policy of Outlook, patch it in a way that the Programmatic Access Security prompt is auto-allowed and finally revert it to its initial state after the operation has finished.

Output

All operations will output basic information on screen.

The contacts and mails operations will output results in JSON format to a Gzip compressed file.

The save operation will export the requested mail in .MSG format.

All filenames are randomly generated during runtime.

By default, Outlook’s Secure Temp Folder is used as a destination for all exported files.


Download

Access more than 10k premium API keys | python exploit
https://4bdoz.medium.com/access-more-than-10k-premium-api-keys-python-exploit-c728fdf5eae?source=rss------bug_bounty-5

What is the Wayback Machine?Continue reading on Medium » (https://4bdoz.medium.com/access-more-than-10k-premium-api-keys-python-exploit-c728fdf5eae?source=rss------bug_bounty-5)

: Ganhando até $ , reportando vulnerabilidades…
https://josuepedro.medium.com/ganhando-at%C3%A9-reportando-vulnerabilidades-e80d16cfc50b?source=rss------bug_bounty-5

Projeto Bug bounty: Apresentando a melhor plataforma de Bugbounty que você pode usar para ganhar até R$ 100.000,00 Procurando…Continue reading on Medium » (https://josuepedro.medium.com/ganhando-at%C3%A9-reportando-vulnerabilidades-e80d16cfc50b?source=rss------bug_bounty-5)

InlineExecute-Assembly - A PoC Beacon Object File (BOF) That Allows Security Professionals To Perform In Process .NET Assembly Execution
http://www.kitploit.com/2021/09/inlineexecute-assembly-poc-beacon.html

Subject References
This tool wouldn't exist without being able to piggyback off some really great research, tools, and code already published by members of the security community. So thank you. Lastly, if you feel anyone has been left out below, please let me know and I will be sure to get them added. HostingCLR - here (https://github.com/etormadiv/HostingCLR) - CLR/Executing assembly logic Dotnet-Loader-Shellcode - (by @modexpblog (https://twitter.com/modexpblog)) - here (https://modexp.wordpress.com/2019/05/10/dotnet-loader-shellcode/) - All around great research including on COM Interfaces for executing .NET in C -> Real MVP Donut - (by @TheRealWover (https://twitter.com/TheRealWover) and @modexpblog (https://twitter.com/modexpblog)) - here (https://github.com/TheWover/donut) - COM Interfaces Header Memory Patching AMSI Bypass - (by @_RastaMouse (https://twitter.com/_RastaMouse)) - here (https://rastamouse.me/memory-patching-amsi-bypass/) - AMSI memory patching research Metasploit-Execute-Assembly - (by @b4rtik (https://twitter.com/b4rtik)) - here (https://github.com/b4rtik/metasploit-execute-assembly) - Modified AMSI patching and used find .NET version function ExecuteAssembly - (by @med0x2e (https://twitter.com/med0x2e))- here (https://github.com/med0x2e/ExecuteAssembly) - Modified aggressor script Hiding Your .NET ETW - (by @xpn) - here (https://www.mdsec.co.uk/2020/03/hiding-your-net-etw/) - Great ETW research ETW BOF - (by @ajpc500 (https://twitter.com/ajpc500))- here (https://github.com/ajpc500/BOFs/tree/main/ETW) - Modified ETW patching ExecuteAssembly_Mailslot - (by @N4k3dTurtl3 (https://twitter.com/N4k3dTurtl3))- here (https://github.com/N4kedTurtle/ExecuteAssembly_Mailslot) - Modified using mailslots for console redirection @freefirex2 (https://twitter.com/freefirex2) - Was kind enough to share some good BOF inner workings and gotcha's.
Getting Started
Copy the inlineExecute-Assembly folder with all of its contents to a system you plan to connect with via the Cobalt Strike (https://www.kitploit.com/search/label/Cobalt%20Strike) GUI application. Load in the inlineExecute-Assembly.cna Aggressor script Run inlineExecute-Assembly --dotnetassembly /path/to/assembly.exe for most basic execution (see use cases below for specific flag examples)
Build Your Own
Run the below command inside the src directory via x64 Native Tools Command Prompt for VS 2019 cl.exe /c inlineExecute-Assembly.c /GS- /FoinlineExecute-Assemblyx64.o
Run the below command inside the src directory via x86 Native Tools Command Prompt for VS 2019 cl.exe /c inlineExecute-Assembly.c /GS- /FoinlineExecute-Assemblyx86.o

Flags
--dotnetassembly Directory path to your assembly **required**
--assemblyargs Assembly arguments to pass
--appdomain Change default name of AppDomain sent (default value is totesLegit and is set via the included aggressor script) *Domain always unloaded*
--amsi Attempts to disable AMSI via in memory patching (If successful AMSI will be disabled for the entire life of process)
--etw Attempts to disable ETW via in memory patching (If successful ETW will be disabled for the entire life of process unless reverted)
--revertetw Attempts to disable ETW via in memory patching and then repatches it back to original state
--pipe Change default name of named pipe (default value is totesLegit and is set via the included aggressor script)
--mailslot Switches to using mailslots to redirect console output. Changes default name of mailslot (If left blank, d efault value is totesLegit and is set via the included aggressor script)
--main Changes entry point to Main() (default value is Main(string[] args))


Use Case
Execute .NET assembly
Syntax

Syntax
inlineExecute-Assembly --dotnetassembly /root/Desktop/Seatbelt.exe --assemblyargs AntiVirus AppLocker --amsi ">beacon> inlineExecute-Assembly --dotnetassembly /root/Desktop/Seatbelt.exe --assemblyargs AntiVirus AppLocker --amsi

Use Case
Execute .NET assembly with arguments and disable ETW
Syntax
inlineExecute-Assembly --dotnetassembly /root/Desktop/Seatbelt.exe --assemblyargs AntiVirus AppLocker --etw ">beacon> inlineExecute-Assembly --dotnetassembly /root/Desktop/Seatbelt.exe --assemblyargs AntiVirus AppLocker --etw

Use Case
Execute .NET assembly with arguments and redirect output via mailslots instead of the default named pipe
Syntax
inlineExecute-Assembly --dotnetassembly /root/Desktop/Seatbelt.exe --mailslot ">beacon> inlineExecute-Assembly --dotnetassembly /root/Desktop/Seatbelt.exe --mailslot

Use Case
Execute .NET assembly with arguments and change the default named pipe name set in the aggressor script
Syntax
inlineExecute-Assembly --dotnetassembly /root/Desktop/Seatbelt.exe --pipe forRealLegit ">beacon> inlineExecute-Assembly --dotnetassembly /root/Desktop/Seatbelt.exe --pipe forRealLegit

Use Case
Execute .NET assembly and change the default app domain set in the aggressor script
Syntax
inlineExecute-Assembly --dotnetassembly /root/Desktop/Seatbelt.exe --appdomain forRealLegit ">beacon> inlineExecute-Assembly --dotnetassembly /root/Desktop/Seatbelt.exe --appdomain forRealLegit

Use Case
Execute .NET assembly with Main() entry point instead of the default Main(string[] args)
Syntax
inlineExecute-Assembly --dotnetassembly /root/Desktop/simpleMain.exe --main ">beacon> inlineExecute-Assembly --dotnetassembly /root/Desktop/simpleMain.exe --main

Use Case
Go HAM
Syntax
inlineExecute-Assembly --dotnetassembly /root/Desktop/Seatbelt.exe --assemblyargs AntiVirus AppLocker --amsi --etw --appdomain forRealLegit --mailslot forRealLegit ">beacon> inlineExecute-Assembly --dotnetassembly /root/Desktop/Seatbelt.exe --assemblyargs AntiVirus AppLocker --amsi --etw --appdomain forRealLegit --mailslot forRealLegit

Caveats
While I have tried to make this as stable as possible, there are no guarantees things will never crash and beacons won’t die. We don’t have the added luxury of fork and run where if something goes wrong our beacon lives. This is the tradeoff with BOFs. With that said, I can’t stress how important it is that you test your assemblies beforehand to make sure they will work properly with the tool. Since the BOF is executed in process and takes over the beacon while running, this should be taken into account before being used for long running assemblies. If you choose to run something that will take a long time to get back results, your beacon will not be active to run more commands till the results come back and your assembly finishes running. This also doesn’t adhere to sleep set. For example, if your sleep is set at 10 minutes and you run the BOF, you will get results back as soon as the BOF finishes executing. Unless modification is done to tools that load PE’s in memory (e.g., SafetyKatz), these will most likely kill your beacon. Many of these tools work fine with execute assembly because they are able to send their console output from the sacrificial process before exiting. When they exit via our in process BOF, they kill our process, which kills our beacon. These can be modified to work but I would advise running these types of assemblies via execute assembly since other non-OPSEC friendly things could be loaded into your process that don’t get removed. If your assembly uses Environment.Exit this will need to be removed as it will kill the process and beacon. Named pipes and mail slots need to be unique. If you don’t receive data back and your beacon is still alive, the issue is most likely you need to select a different named pipe or mail slot name.
Detection

Some detection and mitigation strategies that could be used: Uses PAGE_EXECUTE_READWRITE when performing AMSI and ETW memory patching. This was done on purpose and should be a red flag as very few programs have memory ranges with the memory protection (https://www.kitploit.com/search/label/Protection) of PAGE_EXECUTE_READWRITE. Default name of named pipe created is totesLegit. This was done on purpose and signature detections could be used to flag this. Default name of mailslot created is totesLegit. This was done on purpose and signature detections could be used to flag this. Default name of AppDomain loaded is totesLegit. This was done on purpose and signature detections could be used to flag this. Good tips on detecting malicious use of .NET (by @bohops (https://twitter.com/bohops)) here (https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/), (by F-Secure) here (https://blog.f-secure.com/detecting-malicious-use-of-net-part-1/), and here (https://blog.f-secure.com/detecting-malicious-use-of-net-part-2/) Looking for .NET CLR loading into suspicious processes, such as unmanaged processes which should never have the CLR loaded. Event Tracing here (https://docs.microsoft.com/en-us/windows/win32/etw/about-event-tracing) Looking for other known Cobalt Strike Beacon IOC's or C2 egress/communication IOC's.

Download InlineExecute-Assembly (https://github.com/anthemtotheego/InlineExecute-Assembly)

hacking: security in practice
New version of Kali with more tools

There is a newer version of Kali and it has some more tools for hacking.

https://cybersecuritynews.com/kali-linux-2021-3/

submitted by /u/JDrisc3480
[link] [comments]

hacking: security in practice
talk to me direct message

I need advice on something imperative to me.

submitted by /u/PuzzleheadedCold4702
[link] [comments]

hacking: security in practice
My notes from past 5 6 months. Suggestions appreciated

https://external-preview.redd.it/RuKGR6dRzpPMBerw-Y4Z6xfgWKiXvfSbSPKVH8cbttk.jpg?width=640&crop=smart&auto=webp&s=52aa0fd65051921fb57cfc27d02cc56bcd93ec65 submitted by /u/Nightkinnng
[link] [comments]

hacking: security in practice
Which are some the best forums for hacker?

Which you think are the best and most informative forums for hacker to connect and share knowledge

submitted by /u/faizannehal
[link] [comments]

Hacking on Medium
Cybersecurity Preparing for Non-IT Experts


Who needs cybersecurity training?

Continue reading on Medium »

Hacking on Medium
Access more than 10k premium API keys | python exploit


What is the Wayback Machine?

Continue reading on Medium »