Kali Linux Tutorials
Weakpass : Rule-Based Online Generator To Create A Wordlist Based On A Set Of Words

Weakpass is a tool generates a wordlist based on a set of words entered by the user.

For example, during penetration testing, you need to gain access to some service, device, account, or Wi-Fi network that is password protected. For example, let it be the Wi-Fi network of EvilCorp. Sometimes, a password is a combination of device/network/organization name with some date, special character, etc. Therefore, it is simpler and easier to test some combinations before launching more complex and time-consuming checks. For example, cracking a Wi-Fi password with a wordlist can take several hours and can fail, even if you choose a great wordlist because there was no such password in it like Evilcorp2019.

Therefore, using the generated wordlist, it is possible to organize a targeted and effective online password check.

Link: https://zzzteph.github.io/weakpass/

Secondary: https://weakpass.com/generate Features

The hashcat rule syntax is used to generate the wordlist. By default, the generator uses a set of rules “online.rule”, which performs the following mutations:

* Adding special characters and popular endings to the end of the word – !,!@, !@#, 123! etc. evilcorp!, evilcorp!123
* Adding digits from 1 to 31, from 01 to 12 – evilcorp01, evilcorp12.
* Adding the date 2018-2023 – evilcorp2018, evilcorp2019
* Various combinations of 1-3 – evilcorp2018!
* Capitalize the first letter and lower the rest, apply 1-4. Evilcorp!2021

As a result, for the word evilcorp, the following passwords will be generated (216 in total):

* evilcorp
* Evilcorp
* EVILCORP
* evilcorp123456
* evilcorp2018
* Evilcorp!2021
* Evilcorp!2022
* Evilcorp2018!@#

You can use your own hashcat rules, just click “Show rules” and put in the “Rules” textarea them with the list of rules you like best. Rules that are supported (source https://hashcat.net/wiki/doku.php?id=rule_based_attack):
NameFunctionDescriptionExample RuleInput WordOutput WordNothing:Do nothing (passthrough):p@ssW0rdp@ssW0rdLowercaselLowercase all letterslp@ssW0rdp@ssw0rdUppercaseuUppercase all lettersup@ssW0rdP@SSW0RDCapitalizecCapitalize the first letter and lower the restcp@ssW0rdP@ssw0rdInvert CapitalizeCLowercase first found character, uppercase the restCp@ssW0rdp@SSW0RDToggle CasetToggle the case of all characters in word.tp@ssW0rdP@SSw0RDToggle @TNToggle the case of characters at position NT3p@ssW0rdp@sSW0rdReverserReverse the entire wordrp@ssW0rddr0Wss@pDuplicatedDuplicate entire worddp@ssW0rdp@ssW0rdp@ssW0rdDuplicate NpNAppend duplicated word N timesp2p@ssW0rdp@ssW0rdp@ssW0rdp@ssW0rdReflectfDuplicate word reversedfp@ssW0rdp@ssW0rddr0Wss@pRotate Left{Rotate the word left.{p@ssW0rd@ssW0rdpRotate Right}Rotate the word right}p@ssW0rddp@ssW0rAppend Character$XAppend character X to end$1p@ssW0rdp@ssW0rd1Prepend Character^XPrepend character X to front^1p@ssW0rd1p@ssW0rdTruncate left[Delete first character[p@ssW0rd@ssW0rdTrucate right]Delete last character]p@ssW0rdp@assW0rDelete @ NDNDelete character at position ND3p@ssW0rdp@sW0rdExtract rangexNMExtract M characters, starting at position Nx04p@ssW0rdp@ssOmit rangeONMDelete M characters, starting at position NO12p@ssW0rdpsW0rdInsert @ NiNXInsert character X at position Ni4!p@ssW0rdp@ss!W0rdOverwrite @ NoNXOverwrite character at position N with Xo3$p@ssW0rdp@s$W0rdTruncate @ N‘NTruncate word at position N‘6p@ssW0rdp@ssW0ReplacesXYReplace all instances of X with Yss$p@ssW0rdp@$$W0rdPurge@XPurge all instances of X@sp@ssW0rdp@W0rdDuplicate first NzNDuplicate first character N timesz2p@ssW0rdppp@ssW0rdDuplicate last NZNDuplicate last character N timesZ2p@ssW0rdp@ssW0rdddDuplicate allqDuplicate every characterqp@ssW0rdpp@@ssssWW00rrdd
The generator automatically removes duplicate passwords.

By pressing the Wi-Fi, all passwords less than 8 cha[...]

___________________________
@hacking_Attack
@Hacking_Video

racters long will be automatically deleted.

All data is generated using Javascript so that you can use the generator without internet access. How-To
https://1.bp.blogspot.com/-22meQ-TFneo/YUyFqrdJH2I/AAAAAAAAK7g/5aRzZiIhAPsIiENI0QvO0DAfhusQqAGiQCLcBGAsYHQ/s334/howto.gif
* To generate a wordlist, enter in the Words field, words that can be used as part of the password.
* Click on the Generate button
* Copy the received content or click on the Copy to clipboard button for automatic copying.
* …
* Profit! Download

___________________________
@hacking_Attack
@Hacking_Video

Force Browsing bug at Facebook business plan ($500 Bounty)
https://dewcode.medium.com/force-browsing-bug-at-facebook-business-plan-500-bounty-73d1bb4883af?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi bug hunters! this article is about my last finding on Facebook.Continue reading on Medium » (https://dewcode.medium.com/force-browsing-bug-at-facebook-business-plan-500-bounty-73d1bb4883af?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

https://a.thumbs.redditmedia.com/yeM66DfvhWS8urd8Pz1g5lv5knmRjuGBCKYHXTojtM4.jpg Here is the command I launch and the result:

​

https://preview.redd.it/0a25zrzd4gq71.png?width=771&format=png&auto=webp&s=753e3930f7c9038ecbb0c086871d3301083a458c

The zip file secret_files.zipcontains three files, file1.txtcontaining the string "blablabla", and files 2 and 3 containing nothing. The password of the archive is listed in the dictionary provided. What am I doing wrong?

submitted by /u/ultome
[link] [comments]

hacking: security in practice
New way for malware to evade detection (involves attacking digital signature)

https://cybersecuritynews.com/hackers-have-figured-out-a-new-malware-evasion-technique-to-fly-under-the-radar/

submitted by /u/JDrisc3480
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Bounty Hacker Tryhackme Walkthrough

Hello guys and welcome back , Ayush this side, today we’ll talk about one of the tryhackme room “Bounty Hacker”, it’s a quite easy room in…
Read more...

ASP.NET CORE Path Traversal

A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the webroot…
Read more...

Hacking on Medium
h@cktivitycon 2021 CTF writeup: Reactor Android Challenge

https://cdn-images-1.medium.com/max/600/1*v-8D_EkkYDx5SD3CfqiwBg.png
Hey there, HackerOne hosted h@activitycon 2021 CTF a few weeks back. I got time to play around with a few challenges. Here is the write-up…

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Introduction to Windows Stack Buffer Overflow — TryHackMe Brainpan Walkthrough

https://cdn-images-1.medium.com/max/2000/0*JXqkTHvdMH_Ojj08.png
The OSCP exam consists of a 25 point Buffer Overflow machine. Some people make the mistake of leaving out this topic, even though these…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Force Browsing bug at Facebook business plan ($500 Bounty)

https://cdn-images-1.medium.com/max/723/1*zfptnHV8R_ejILPooxIZZA.png
Hi bug hunters! this article is about my last finding on Facebook.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
La decisión del FBI de retener las claves de descifrado del ransomware Kaseya despierta debate.

https://cdn-images-1.medium.com/max/1388/0*EcqSjZ6DRXJbQ5NE
PUBLICADO EN 29 SEPTIEMBRE, 2021POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Love HacktheBox Walkthrough

Love is a CTF hosted on Hack the Box with Beginner categories. The objective for the participant is to identify the files user.txt and root.txt on the victim’s system. Penetration MethodlogiesRecon1stMethodNmapLet's begin with a Nmap version scan to discover open and running services and their versions.Enumeration Then, in the web browser, we investigate the target IP through port 443, but it returns Forbidden and prevents us from accessing that page.DirbWithout further ado, we will do a web directory brute force attack using dirb, which will return two web directories: /admin and /image. ExploitReturning to the File Scanner web page, we'll attempt to test SSRF by scanning the following URL.Server Side Request Forgery (SSRF), leading in the display of the Password Dashboard. As a response, it will give credentials to the administrator, which we may use to access the voting system.___________________________
@hacking_Attack
@Hacking_Video

Besides the update profile option, the admin dashboard contains no relevant information when logging into the web app.Unrestricted File Upload to RCEWe discovered upload feature for uploading profile photographs while updating the admin profile. We'll attempt to upload a PHP backdoor here.Reverse ShellLet's try the reverse connection by running metasploit payload via simple-backdoor.php. In this case, we will utilise the following module to create a malicious HTA file.Post EnumerationYou will find your first flag at C:\Users\Phoebe\Desktop. Let's crawl some more and look for weak or misconfigured links in order to elevate privilege for Phoebe.Winpeas.exeIn order to elevate privileges, we need to enumerate different files, directories, permissions, logs and SAM files. The number of files inside a Windows OS is very overwhelming. We will be using winpeasto enumerate vulnerable vector that can be exploited for privilege escalation.Privilege EscalationBecause AlwaysInstallElevated was enabled, we may do post-exploitation using the metas[...]

___________________________
@hacking_Attack
@Hacking_Video