Dark Reading: Attacks/Breaches
NSA, CISA Issue Guidelines for Selecting and Securing VPNs

Joint document includes configuration recommendations for hardening VPNs, and recommendations on how to select the most secure ones.

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
PS2EXE : Module To Compile Powershell Scripts To Executables

PS2EXE is a Module To Compile Powershell Scripts To Executables. Overworking of the great script of Ingo Karstein with GUI support. The GUI output and input is activated with one switch, real windows executables are generated. With Powershell 5.x support and graphical front end.

Module version.

You find the script based version here (https://github.com/MScholtes/TechNet-Gallery) and here: PS2EXE-GUI: “Convert” PowerShell Scripts to EXE Files with GUI.

Author: Markus Scholtes

Version: 1.0.10

Date: 2021-04-10

Installation

PS C:> Install-Module ps2exe

(on Powershell V4 you may have to install PowershellGet before) or download from here: https://www.powershellgallery.com/packages/ps2exe/.

Usage

Invoke-ps2exe .\source.ps1 .\target.exe

or

ps2exe .\source.ps1 .\target.exe

compiles “source.ps1” into the executable target.exe (if “.\target.exe” is omitted, output is written to “.\source.exe”).

or start Win-PS2EXE for a graphical front end with

Win-PS2EXE

Parameter

ps2exe [-inputFile] ” [[-outputFile] ”] [-prepareDebug]
[-x86|-x64] [-lcid ] [-STA|-MTA] [-noConsole] [-UNICODEEncoding]
[-credentialGUI] [-iconFile ”] [-title ”] [-description ‘ 260 characters) if enabled on OS (works only with Windows 10)

A generated executable has the following reserved parameters:

-debug Forces the executable to be debugged. It calls “System.Diagnostics.Debugger.Launch()”.
-extract: Extracts the powerShell script[...]

___________________________
@hacking_Attack
@Hacking_Video

inside the executable and saves it as FILENAME.
The script will not be executed.
-wait At the end of the script execution it writes “Hit any key to exit…” and waits for a key to be pressed.
-end All following options will be passed to the script inside the executable.
All preceding options are used by the executable itself and will not be passed to the script. Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Resource for finding published exploits in web frameworks

I'm a web developer and have a client who uses an old javascript framework that is years behind on security updates. Is there a resource where I can find exploits for particular versions of software so I can demonstrate what type of exploits are possible by not updating their code? I can find a list of why patches have been issued but no practical application of the exploit.

submitted by /u/baronoffeces
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do you find someone's IP address using command prompt?

Education purposes only, I just want to learn how.

submitted by /u/judahthelion014
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
OSCP worthy?

Hello all! In short: I want to know if I am prepared to complete the OSCP/CEH certifications; 1) are they worth it?,

2) fluent in python, Java, sql, (each 4 ish years), and adept in C++ (still learning),

3) have been grinding on tryhackme/hackthebox/ctftime.org - and have actually done well in some CTFs,

4) have ~ 2 1/2 years of experience with both Kali Linux and Ubuntu.

What more, if anything, can I do to prepare for CEH and OSCP? I feel as if I’ve jumped through all the necessary hoops but have no idea what to expect. I just really don’t want to waste my money if I’m truly not “ready”. Possibly experiencing some imposter syndrome, but at the same time how can I actually gauge my readiness?

Any feedback would be greatly appreciated!

submitted by /u/smokeyrb9
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Utilizing proxy authentication and ssl bypass in order to get through a proxy

Hi, wondering if there's already a tool that does something like utilizing proxy authentication and or ssl bypasses to get info out

Not going to do this been working a lot closer to proxies and just generally curious

submitted by /u/onequestion1168
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
lets say i give u my ip address can u hack me

i want to get educated on is it possible for a hacker to hack me with my ip address. Will they ableto access the notepad files on my desktop?

lets say i keep 100$ of bitcoin keys declare it publicly with ip address just for a test do u guys think i will get haked.
SYSTEM specs: windows 10 AME last security patch march 21, with no firewall, no antivirus but its a clean install with sure zero virus.

i also have a deep freeze installed it cleans everything at every reboot.

​

submitted by /u/abhilodha
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor | Microsoft Security Blog
https://www.reddit.com/r/redteamsec/comments/pxntg3/foggyweb_targeted_nobelium_malware_leads_to/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/) [comments] (https://www.reddit.com/r/redteamsec/comments/pxntg3/foggyweb_targeted_nobelium_malware_leads_to/)

___________________________
@hacking_Attack
@Hacking_Video

Simple Parameter Tampering → Account Takeover
https://darshan-jogi.medium.com/simple-parameter-tampering-account-takeover-3fec3cb51eb6?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Introduction:Continue reading on Medium » (https://darshan-jogi.medium.com/simple-parameter-tampering-account-takeover-3fec3cb51eb6?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Password-Checker CSAW CTF 2021 Write-Up

https://cdn-images-1.medium.com/max/625/1*A3-3K-PtQ6Mxo9VjUoxBMQ.png
This is a warm-up challenge for Binary Exploitation.

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
BlackArch Linux

https://cdn-images-1.medium.com/max/1920/0*uVuIUh5cX51euJW8.jpg
BlackArch Linux is an Arch Linux-based penetration testing distribution for penetration testers and security researchers. The repository…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Simple Parameter Tampering → Account Takeover

https://cdn-images-1.medium.com/max/758/1*S55NPFmsgZEAsVxM4mitpw.jpeg
Introduction:

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Simple Parameter Tampering → Account Takeover

Introduction:Continue reading on Medium »
Read more...

LDAP Password Hunter got persistence
https://www.reddit.com/r/redteamsec/comments/pxquo8/ldap_password_hunter_got_persistence/

Hello Everyone, posted already about LDAP Password hunter some time ago receiving a discrete amount of good feedback. Among all the feedbacks some of the latter became new features so here i m again. LPH got persistence now, Results are saved in a sqlite3 database and printed on a file only when new entries are discovered. DB has only one table showing DistinguishedName, AttributeName, Value, Domain. Output is made less verbose and more clean, this is all made in a perspective of continuous attacker mode and monitoring. Thanks in advance for all the feedback regardless it s gonna become new feature or not. Check LPH out here: https://github.com/oldboy21/LDAP-Password-Hunter Cheers! ​ submitted by /u/oldboy21 (https://www.reddit.com/user/oldboy21)
[link] (https://www.reddit.com/r/redteamsec/comments/pxquo8/ldap_password_hunter_got_persistence/) [comments] (https://www.reddit.com/r/redteamsec/comments/pxquo8/ldap_password_hunter_got_persistence/)

___________________________
@hacking_Attack
@Hacking_Video