Hacking on Medium
Hacking new steps in 2020


Ethical hacking

Continue reading on Medium »

hacking: security in practice
Here it is! deserter is the first of its kind (at least to my knowledge) targeted DNS cache poisoner

https://external-preview.redd.it/lyc9mJV0MTQaAQyZ6VBxml62OJwEi7tGA7_sF0-UTxU.jpg?width=640&crop=smart&auto=webp&s=e8408507f66e85be189b9bf145c71bef41b07297 submitted by /u/b4ckslash0
[link] [comments]

hacking: security in practice
The AOL Screen Name Exploit of 2000

https://external-preview.redd.it/oj7ClJuRuWdQuknfPGGHjfr2vW6jqJBQl6C7U6OhvbI.jpg?width=640&crop=smart&auto=webp&s=cfbaf19ef161b01f61e24b77a8af2d478463569a submitted by /u/endless
[link] [comments]

hacking: security in practice
How secure is data saved on iCloud locked notes + VPN?

Discussion with a friend, can't find a clear answer online. How secure is information saved on locked apple iOS notes when accessing the internet via VPN? How would a hacker exploit this situation? Curious to learn! Thanks

submitted by /u/possiblyai
[link] [comments]

hacking: security in practice
CVE-2021-28663 - POC - Explanation

Hello,

I have come across the poc for this exploit for Mali GPUs: https://github.com/lntrx/CVE-2021-28663 . I would like to run it on my android smartphone (Huawei P30 Pro), as it has a vulnerable Mali GPU.

​

The issue is that I am not very proficient at C and thus do not understand much of the exploit. The exploit fails very early on (https://github.com/lntrx/CVE-2021-28663/blob/main/mali_poc.c#L42). Could someone explain to me the workings of it, as the best I can do is add a bunch of print statements to see what is happening.

submitted by /u/reujea0
[link] [comments]

Wordlistgen - Quickly Generate Context-Specific Wordlists For Content Discovery From Lists Of URLs Or Paths
http://www.kitploit.com/2021/09/wordlistgen-quickly-generate-context.html

wordlistgen is a tool to pass a list of URLs and get back a list of relevant words for your wordlists. Wordlists (https://www.kitploit.com/search/label/Wordlists) are much more effective when you take the application's context into consideration. wordlistgen (https://www.kitploit.com/search/label/WordListGen) pulls out URL components, such as subdomain (https://www.kitploit.com/search/label/Subdomain) names, paths, query strings, etc. and spits them back to stdout so you can easily add them to your wordlists
Installation
If you don't have Go installed, "go" do that! go get -u github.com/ameenmaali/wordlistgen
Usage
wordlistgen takes URLs and paths from stdin, of which you will most likely want in a file such as: $ cat file.txt
https://google.com/home/?q=2&d=asd
http://my.site
/api/v2/auth/me?id=123
Get unique URL components from a file of URLs and/or paths: cat hosts.txt | wordlistgen Get unique URL components from a file of URLs and/or paths, including query string values, and save to a file: cat hosts.txt | wordlistgen -qv > urlComponents.txt wordlistgen works at it's best when chained with other tools, such as @tonnomnom's (https://github.com/tomnomnom) waybackurls (https://github.com/tomnomnom/waybackurls) : cat hosts.txt | waybackurls (https://www.kitploit.com/search/label/Waybackurls) | wordlistgen
Help
$ wordlistgen -h
Usage of wordlistgen:
-fq
If enabled, filter out query strings (e.g. if enabled /?q=123 - q would NOT be included in results
-qv
If enabled, include query string values (e.g. if enabled /?q=123 - 123 would be included in results


Download Wordlistgen (https://github.com/ameenmaali/wordlistgen)

Black Hat Ethical Hacking
Unpatched Apple Zero-Day in macOS Finder Allows Code Execution

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Unpatched Apple Zero-Day in macOS Finder Allows Code ExecutionPost Views: 134
Reading Time: 1 Minute
A zero-day security vulnerability in Apple’s macOS Finder system could allow remote attackers to trick users into running arbitrary commands, according to researchers – and a silent patch hasn’t fixed it.
For those not in the Apple camp, the macOS Finder is the default file manager and GUI front-end used on all Macintosh operating systems. It’s the first thing users see upon booting, and it governs the launching of other applications and the overall user management of files, disks and network volumes. It’s the overlord application for everything else on the Mac, in other words.

According to an SSD Secure Disclosure advisory this week, the vulnerability exists in the way macOS Finder handles .Inetloc files. Inetloc files are Apple-specific, and function as shortcuts to internet locations, such as an RSS feed or a telnet location; or they can be used to open documents locally on someone’s Mac within a browser using the “file://” format (in place of http://). It’s the latter function that’s at issue with the zero day, researchers said.

In an exploit scenario for the bug, the .Inetloc files can be specially crafted to contain embedded commands. The crafted files can then be attached to (or linked in) malicious emails, researchers added – and if users are socially engineered into clicking on them, those commands embedded inside automatically execute in stealth mode, with no alert or prompt given to victims.

“A vulnerability in the way macOS processes .Inetloc files causes it to run commands embedded inside, the commands it runs can be local to the macOS allowing the execution of arbitrary commands by the user without any warning/prompts,” according to the advisory.
See Also: Complete Offensive Security and Ethical Hacking Course It’s a simple exploitation scenario – as demoed in an SSD video included in the alert.

Independent security researcher Park Minchan reported the vulnerability to SSD, noting that the bug affects the macOS Big Sur edition and all those prior to it. In response, Apple chose not to issue a CVE and instead silently patched the issue. However, the fix was botched, researchers said.

“The vendor has notified us that file:// [function] has been silently patched,” the advisory explained. However, researchers added that the bug can still be exploited by using a mangled value, like FiLe:// in the file’s execution routine.

“Newer versions of macOS (from Big Sur) have blocked the file:// prefix…however they did case-matching causing File:// or fIle:// to bypass the check,” they explained.

“We…have not received any response from them since the report has been made,” according to the advisory. “As far as we know, at the moment, the vulnerability has not been patched.”
See Also: Windows MSHTML zero-day defenses bypassed as new info emerges There’s no word on whether it’s been exploited in the wild, and Apple did not immediately return a request for comment.

The computing giant has had its share of zero days this year. In May, it patched a critical bug in macOS that could be exploited to take screenshots of someone’s computer and to capture images of their activity within applications or on videoconferences without that person knowing. In July, it patched an actively exploited zero-day flaw in both its iOS and macOS platforms that could allow attackers to take over an affected system. And earlier this month, it rushed an emergency patch for the “ForcedEntry” zer[...]

o-click zero-day, which was being exploited by NSO Group to install spyware.
See Also: Offensive Security Tool: SniperPhish Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-1-90x90.jpg New macOS zero-day bug lets attackers run commands remotely1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Windows-attack-90x90.jpg Hacked sites push TeamViewer using fake expired certificate alert2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/hackers-waging-living-off-land-attacks-on-azure-showcase_image-7-a-16158-90x90.jpg Azure Zero-Day Flaws Highlight Lurking Supply-Chain Risk3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Anonymous-90x90.png Anonymous leaks gigabytes of data from alt-right web host Epik6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-90x90.jpg New malware uses Windows Subsystem for Linux for stealthy attacks6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Google-Chrome-Browser-90x90.jpg Pair of Google Chrome Zero-Day Bugs Actively Exploited1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/banner-2021.3-release-90x90.jpg Kali Linux 2021.3 released: Kali NetHunter on a smartwatch, wider OpenSSL compatibility, new tools1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-exploit-90x90.jpg Microsoft Patches Actively Exploited Windows Zero-Day Bug1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Apple-marketing-communications-mix-90x90.jpg Apple Issues Emergency Fix for NSO Zero-Click Zero Day1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/zeroday-90x90.png Windows MSHTML zero-day exploits shared on hacking forums1 week ago
The post Unpatched Apple Zero-Day in macOS Finder Allows Code Execution first appeared on Black Hat Ethical Hacking.

Wordlistgen - Quickly Generate Context-Specific Wordlists For Content Discovery From Lists Of URLs Or Paths

wordlistgen is a tool to pass a list of URLs and get back a list of relevant words for your wordlists. Wordlists are much more effective when you take the application's context into consideration. wordlistgen pulls out URL components, such as subdomain names, paths, query strings, etc. and spits them back to stdout so you can easily add them to your wordlists Installation If you don't have Go installed, "go" do that! go get -u github.com/ameenmaali/wordlistgen Usage wordlistgen takes URLs and paths from stdin, of which you will most likely want in a file such as: $ cat file.txthttps://google.com/home/?q=2&d=asdhttp://my.site/api/v2/auth/me?id=123 Get unique URL components from a file of URLs and/or paths: cat hosts.txt | wordlistgen Get unique URL components from a file of URLs and/or paths, including query string values, and save to a file: cat hosts.txt | wordlistgen -qv > urlComponents.txt wordlistgen works at it's best when chained with other tools, such as @tonnomnom's waybackurls : cat hosts.txt | waybackurls | wordlistgen Help $ wordlistgen -hUsage of wordlistgen: -fq If enabled, filter out query strings (e.g. if enabled /?q=123 - q would NOT be included in results -qv If enabled, include query string values (e.g. if enabled /?q=123 - 123 would be included in results Download Wordlistgen
Read more...

KitPloit - PenTest Tools!
Wordlistgen - Quickly Generate Context-Specific Wordlists For Content Discovery From Lists Of URLs Or Paths

https://1.bp.blogspot.com/-Ady00T1Rchw/YUq1gcP9-OI/AAAAAAAAvR4/W7Kfw8YwuzM_w-8RcjOTBtXPkFoguK10wCNcBGAsYHQ/w640-h176/words.png

wordlistgen is a tool to pass a list of URLs and get back a list of relevant words for your wordlists. Wordlists are much more effective when you take the application's context into consideration. wordlistgen pulls out URL components, such as subdomain names, paths, query strings, etc. and spits them back to stdout so you can easily add them to your wordlists
Installation

If you don't have Go installed, "go" do that!

go get -u github.com/ameenmaali/wordlistgen

Usage

wordlistgen takes URLs and paths from stdin, of which you will most likely want in a file such as:

$ cat file.txt
https://google.com/home/?q=2&d=asd
http://my.site
/api/v2/auth/me?id=123


Get unique URL components from a file of URLs and/or paths:

cat hosts.txt | wordlistgen

Get unique URL components from a file of URLs and/or paths, including query string values, and save to a file:

cat hosts.txt | wordlistgen -qv > urlComponents.txt

wordlistgen works at it's best when chained with other tools, such as @tonnomnom's waybackurls :

cat hosts.txt | waybackurls | wordlistgen

Help

$ wordlistgen -h
Usage of wordlistgen:
-fq
If enabled, filter out query strings (e.g. if enabled /?q=123 - q would NOT be included in results
-qv
If enabled, include query string values (e.g. if enabled /?q=123 - 123 would be included in results

Download Wordlistgen

Kali Linux Tutorials
WWWGrep : OWASP Foundation Web Respository

WWWGrep is a rapid search “grepping” mechanism that examines HTML elements by type and permits focused (single), multiple (file based URLs) and recursive (with respect to root domain or not) searches to be performed. Header names and values may also be recursively searched in this manner. WWWGrep was designed to help both breakers and builders to quickly examine code bases under inspection, some use cases and examples are shown below.

Installation

git clone
pip3 install -r requirements.txt
python3 wwwgrep.py

Dependencies (pip3 install -r requirements.txt)

* Python 3.5+
* BeautifulSoup 4
* UrlLib.parse
* requests_html
* argparse
* requests
* re
* os.path

Breakers

* Quickly locate login pages by searching for input fields named “username” or “password” on a site an using a recursion flag
* Quickly check headers for the use of specific technologies
* Quickly locate cookies and JWT tokens by search response headers
* Use with a proxy tool to automate recursion through a set links rapidly
* Locate all input sinks on a page (or site) by search for input fields and parameter processing symbology
* Locate all developer comments on a page to identify commented out code (or To Do’s)
* Quickly test consistency of site controls implemented during recursion (headers, HSTS, CSP etc)
* Quickly find vulnerable JavaScript code present in web pages
* Identify API tokens and access keys present in page code Builders

* Quickly test multiple sites under management for the use of vulnerable code
* Quickly test multiple sites under management for the use of vulnerable frameworks/technologies
* Find sites which may share a common codebase to determine the impact of flaws/vulnerabilities
* Find sites which share a common authentication token (header auth token)
* Find sites which may contain developer comments for server hygiene purposes Command line switches

wwwgrep.py [target/file] [search_string] [search params/criteria/recursion etc]

Search Inputs
search_string Specify the string to search for or alternatively “”
for all objects of type specified in search parameters
-t –target Specify a single URL as a target for the search
-f –file Specify a file containing a list of URLs to search
Recursion
-rr –recurse-root Limits URL recursion to the domain provided in the target
-ra –recurse-any Allows recursion to extend beyond the domain of the target
Matching Criteria
-i –ignore-case Performs case insensitive matching (default is to respect case)
-d –dedupe Allow duplicate findings per page (default is to de-duplicate findings)
-r –no-redirects Do not allow redirects (default is to allow redirects)
-b –no-base-url Omit the URL of the match from the output (default is to include the URL)
-x –regex Allows the use of RegEX matches (search_string is treated as a RegEX, default is off)
-e –separator Specify and output specifier (default is : )
-j –java-render Turns on JavaScript rendering of page objects and text (default is off)
-p –linked-js-on Turns on searching of linked (script src tags) Java Script (default is off)
Request Parameters
-ps –https-proxy Specify a proxy for the HTTPS protocol in https://: format
-pp –http-proxy Specify a proxy for the HTTP protocol in http://: format
-hu –user-agent Specify a string to use as the user agent in the request
-ha –auth-header Specify a bearer token or other auth string to use in the request header
Search Parameters
-s –all Search all page HTML and scripts for terms that match the search specification
-sr –relative Search page links that match the search specification as relative URLs
-sa –absolute Search page links that match the search specification as absolute URLs
-si –input-fields Search page input fields that match the search specification
-ss –scripts Search scripts tags that match the search spe[...]