LDAP Password Hunter got persistence
https://www.reddit.com/r/redteamsec/comments/pxquo8/ldap_password_hunter_got_persistence/

Hello Everyone, posted already about LDAP Password hunter some time ago receiving a discrete amount of good feedback. Among all the feedbacks some of the latter became new features so here i m again. LPH got persistence now, Results are saved in a sqlite3 database and printed on a file only when new entries are discovered. DB has only one table showing DistinguishedName, AttributeName, Value, Domain. Output is made less verbose and more clean, this is all made in a perspective of continuous attacker mode and monitoring. Thanks in advance for all the feedback regardless it s gonna become new feature or not. Check LPH out here: https://github.com/oldboy21/LDAP-Password-Hunter Cheers! ​ submitted by /u/oldboy21 (https://www.reddit.com/user/oldboy21)
[link] (https://www.reddit.com/r/redteamsec/comments/pxquo8/ldap_password_hunter_got_persistence/) [comments] (https://www.reddit.com/r/redteamsec/comments/pxquo8/ldap_password_hunter_got_persistence/)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
CrowdSec : An Open-Source Massively Multiplayer Firewall Able To Analyze Visitor Behavior And Provide An Adapted Response To All Kinds Of Attacks

CrowdSec is a free, modern & collaborative behavior detection engine, coupled with a global IP reputation network. It stacks on fail2ban’s philosophy but is IPV6 compatible and 60x faster (Go vs Python), uses Grok patterns to parse logs and YAML scenario to identify behaviors. CrowdSec is engineered for modern Cloud / Containers / VM based infrastructures (by decoupling detection and remediation). Once detected you can remedy threats with various bouncers (firewall block, nginx http 403, Captchas, etc.) while the aggressive IP can be sent to CrowdSec for curation before being shared among all users to further improve everyone’s security. See FAQ or read bellow for more. 2 Mins Install

Installing it through the Package system of your OS is the easiest way to proceed. Otherwise, you can install it from source. From package (Debian)

curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
sudo apt-get update
sudo apt-get install crowdsec

From package (rhel/centos/amazon linux)

curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.rpm.sh | sudo bash
sudo yum install crowdsec

From package (FreeBSD)

sudo pkg update
sudo pkg install crowdsec

From source

wget https://github.com/crowdsecurity/crowdsec/releases/latest/download/crowdsec-release.tgz
tar xzvf crowdsec-release.tgz
cd crowdsec-v* && sudo ./wizard.sh -i

About The CrowdSec Project

Crowdsec is an open-source, lightweight software, detecting peers with aggressive behaviors to prevent them from accessing your systems. Its user friendly design and assistance offers a low technical barrier of entry and nevertheless a high security gain.

The architecture is as follows :
https://1.bp.blogspot.com/-XuFJkdHOxds/YUx1wJlrJfI/AAAAAAAAK6g/JxO1qbftRyoJr12S1DslU08lSOX9hT49ACLcBGAsYHQ/s851/crowdsec_architecture.png
Once an unwanted behavior is detected, deal with it through a bouncer. The aggressive IP, scenario triggered and timestamp are sent for curation, to avoid poisoning & false positives. (This can be disabled). If verified, this IP is then redistributed to all CrowdSec users running the same scenario. Outnumbering Hackers All Together

By sharing the threat they faced, all users are protecting each-others (hence the name Crowd-Security). Crowdsec is designed for modern infrastructures, with its “Detect Here, Remedy There” approach, letting you analyse logs coming from several sources in one place and block threats at various levels (applicative, system, infrastructural) of your stack.

CrowdSec ships by default with scenarios (brute force, port scan, web scan, etc.) adapted for most context, but you can easily extend it by picking more of them from the HUB. It is also easy to adapt an existing one or create one yourself.

What It Is Not

CrowdSec is not a SIEM, storing your logs (neither locally nor remotely). Your data are analyzed locally and forgotten.

Signals sent to the curation platform are limited to the very strict minimum: IP, Scenario, Timestamp. They are only used to allow the system to spot new rogue IPs, rule out false positives or poisoning attempts.

Install It

Crowdsec is available for various platforms :

* Use our debian repositories or the official debian packages
* An image is available for docker
* Prebuilt release packages are also available (suitable for amd64)
* You can as well build it from source

Or look directly at installation documentation for other methods and platforms.

Key Benefits Fast assisted installation, no technical barrier

Initial configuration is automated, providing functional out-of-the-box setup
https://1.bp.blogspot.com/-NhfkXihzIXo/YUx3XpqGO_I/AAAAAAAAK6[...]

___________________________
@hacking_Attack
@Hacking_Video

o/xiHWWc9YZuMxp8n-10XA5VNsXkwAp1TNQCLcBGAsYHQ/s900/3.gif
Out of the box detection

Baseline detection is effective out-of-the-box, no fine-tuning required (click to expand)
https://1.bp.blogspot.com/-xr0eoPHfTdU/YUx4kJLMDVI/AAAAAAAAK6w/tpiuWzQRvbgOQhAhuX4c8Z8eecXS1ruyACLcBGAsYHQ/s900/4.gif
Easy bouncer deployment

It’s trivial to add bouncers to enforce decisions of crowdsec (click to expand)
https://1.bp.blogspot.com/-hy7fkFBq9gw/YUx5NJx-OdI/AAAAAAAAK64/4PSV3M5L0_Exz9nGz_jPamPZlH0wOrloACLcBGAsYHQ/s900/5.gif
Easy dashboard access

It’s easy to deploy a metabase interface to view your data simply with cscli (click to expand)
https://1.bp.blogspot.com/-cF7coFZ9Vtg/YUx58KFfqUI/AAAAAAAAK7A/149UR6ppSHwLFY5YX0WVFJ-9IaEG1hNUwCLcBGAsYHQ/s900/6.gif
Hot & Cold logs

Process cold logs, for forensic, tests and chasing false-positives & false negatives (click to expand)
https://1.bp.blogspot.com/-YLDwDIV-OV0/YUx6q2klpNI/AAAAAAAAK7I/dhKF4wKbSJQopM3fD1KmUuKKN8Sp-JG2QCLcBGAsYHQ/s900/7.gif Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Massive Phishing Campaign Impacted 75K Email Inboxes

https://external-preview.redd.it/6OygA_mjK08u-0eBVLCX3I6mcEgF0YsV7nV0GlwwXLI.jpg?width=640&crop=smart&auto=webp&s=018cd24dc8769f66a1c1cee3b8e3d089aec14d71 submitted by /u/george-alexander2k
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Message me if you can hack something for me

I’ll send you like 10 bucks. Should be fairly easy. I’m just unskilled

submitted by /u/mclmnop
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

6 Simple Steps to Fix Clickjacking on NGINX Server
https://infosecwriteups.com/6-simple-steps-to-fix-clickjacking-on-nginx-server-dbf4b3858446?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

What is Clickjacking?Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/6-simple-steps-to-fix-clickjacking-on-nginx-server-dbf4b3858446?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is Hacking? How to learn Hacking?

https://cdn-images-1.medium.com/max/1600/1*zyWnxoBjgnVtJhmePjpWQA.jpeg
What is Hacking?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to save from being a website hack and what to do if you are hacked?

https://cdn-images-1.medium.com/max/600/1*REpi-uO7-TW-RUFtBYL5hw.png
1) Password & Username don’t tell anyone

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
6 Simple Steps to Fix Clickjacking on NGINX Server

https://cdn-images-1.medium.com/max/2240/1*JUOqnOdIbeTRg7UCriqQ5g.png
What is Clickjacking?

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to start information gathering?

https://cdn-images-1.medium.com/max/1370/0*zHOY-CztIjNM5mHe
Control is an Illusion is what I believe in and it’s the showtime now. Yes! today we’ll move towards this quote by understanding how to do…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
FinFisher malware hijacks Windows Boot Manager with UEFI bootkit

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png FinFisher malware hijacks Windows Boot Manager with UEFI bootkitPost Views: 156
Reading Time: 1 Minute
Commercially developed FinFisher malware now can infect Windows devices using a UEFI bootkit that it injects in the Windows Boot Manager. FinFisher (also known as FinSpy and Wingbird) is a surveillance solution developed by Gamma Group that also comes with malware-like capabilities often found in spyware strains.

Its developer says it’s sold exclusively to government agencies and law enforcement worldwide, but cybersecurity firms have also detected it while being delivered via spearphishing campaigns and the infrastructure of Internet Service Providers (ISPs). Evasiveness and persistence powerhouse “During our research, we found a UEFI bootkit that was loading FinSpy. All machines infected with the UEFI bootkit had the Windows Boot Manager (bootmgfw.efi) replaced with a malicious one,” Kasperksy researchers revealed today.

“This method of infection allowed the attackers to install a bootkit without the need to bypass firmware security checks. UEFI infections are very rare and generally hard to execute, and they stand out due to their evasiveness and persistence.”

UEFI (Unified Extensible Firmware Interface) firmware allows for highly persistent bootkit malware as it’s installed within SPI flash storage soldered to computers’ motherboard making it impossible to get rid of via hard drive replacement or even OS re-installation.

Bootkits are malicious code planted in the firmware invisible to security solutions within the operating system since it’s designed to load before everything else, in the initial stage of a device’s booting sequence.
See Also: Complete Offensive Security and Ethical Hacking Course
They provide attackers with control over an operating systems’ boot process and make it possible to sabotage OS defenses bypassing the Secure Boot mechanism depending on the system’s boot security mode (enabling “full boot” or “thorough boot” mod would block the malware as the NSA explains).

Publicly documented attacks and malware using bootkits in the wild are extremely rare — Lojax used by the Russian-backed APT28 hacker group, MosaicRegressor was deployed by Chinese-speaking hackers, TrickBot’s TrickBoot module, and Moriya which Chinese-speaking threat actors likely used for espionage since 2018.

“While in this case the attackers did not infect the UEFI firmware itself, but its next boot stage, the attack was particularly stealthy, as the malicious module was installed on a separate partition and could control the boot process of the infected machine,” the researchers added.

Older computers that don’t come with UEFI support were infected using a similar tactic, through the MBR (Master Boot Record) with a bootkit first detected in 2014.
See Also: Hackers exploiting critical VMware vCenter CVE-2021-22005 bug Advanced obfuscation and anti-analysis measuresFor other malware samples used in the attacks analyzed by Kaspersky, the spyware’s developers also used four layers of obfuscation and anti-analysis measures designed to make FinFisher one of the “hardest-to-detect spywares to date.”

Their efforts were highly effective since the malware samples could evade almost any detection attempt and were virtually impossible to analyze (every sample spotted by Kaspersky required “overwhelming” amounts of work to unscramble).

“The amount of work put into making FinFisher not accessible to security researchers is particularly worrying and somewhat impress[...]

___________________________
@hacking_Attack
@Hacking_Video

ive,” added Igor Kuznetsov, principal security researcher at Kaspersky’s Global Research and Analysis Team (GReAT).
See Also: Offensive Security Tool: Discover
“It seems like the developers put at least as much work into obfuscation and anti-analysis measures as in the Trojan itself. As a result, its capabilities to evade any detection and analysis make this spyware particularly hard to track and detect.”

You can find further details and indicators of compromise (IOCs) related to FinFisher’s Windows, Linux, and macOS infection vectors at the end of Kaspersky’s report.
Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/computer-3923644_1920_1627303851339_1632808464296-90x90.jpg New malware steals Steam, Epic Games Store, and EA Origin accounts1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/VMware-90x90.jpg Hackers exploiting critical VMware vCenter CVE-2021-22005 bug2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/malware-800x449-1-90x90.jpg Malware devs trick Windows validation with malformed certs5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-1-1-90x90.jpg Unpatched Apple Zero-Day in macOS Finder Allows Code Execution6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-1-90x90.jpg New macOS zero-day bug lets attackers run commands remotely1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Windows-attack-90x90.jpg Hacked sites push TeamViewer using fake expired certificate alert1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/hackers-waging-living-off-land-attacks-on-azure-showcase_image-7-a-16158-90x90.jpg Azure Zero-Day Flaws Highlight Lurking Supply-Chain Risk1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Anonymous-90x90.png Anonymous leaks gigabytes of data from alt-right web host Epik2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-90x90.jpg New malware uses Windows Subsystem for Linux for stealthy attacks2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Google-Chrome-Browser-90x90.jpg Pair of Google Chrome Zero-Day Bugs Actively Exploited2 weeks ago
The post FinFisher malware hijacks Windows Boot Manager with UEFI bootkit first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video