hacking: security in practice
New way for malware to evade detection (involves attacking digital signature)

https://cybersecuritynews.com/hackers-have-figured-out-a-new-malware-evasion-technique-to-fly-under-the-radar/

submitted by /u/JDrisc3480
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Bounty Hacker Tryhackme Walkthrough

Hello guys and welcome back , Ayush this side, today we’ll talk about one of the tryhackme room “Bounty Hacker”, it’s a quite easy room in…
Read more...

ASP.NET CORE Path Traversal

A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the webroot…
Read more...

Hacking on Medium
h@cktivitycon 2021 CTF writeup: Reactor Android Challenge

https://cdn-images-1.medium.com/max/600/1*v-8D_EkkYDx5SD3CfqiwBg.png
Hey there, HackerOne hosted h@activitycon 2021 CTF a few weeks back. I got time to play around with a few challenges. Here is the write-up…

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Introduction to Windows Stack Buffer Overflow — TryHackMe Brainpan Walkthrough

https://cdn-images-1.medium.com/max/2000/0*JXqkTHvdMH_Ojj08.png
The OSCP exam consists of a 25 point Buffer Overflow machine. Some people make the mistake of leaving out this topic, even though these…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Force Browsing bug at Facebook business plan ($500 Bounty)

https://cdn-images-1.medium.com/max/723/1*zfptnHV8R_ejILPooxIZZA.png
Hi bug hunters! this article is about my last finding on Facebook.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
La decisión del FBI de retener las claves de descifrado del ransomware Kaseya despierta debate.

https://cdn-images-1.medium.com/max/1388/0*EcqSjZ6DRXJbQ5NE
PUBLICADO EN 29 SEPTIEMBRE, 2021POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Love HacktheBox Walkthrough

Love is a CTF hosted on Hack the Box with Beginner categories. The objective for the participant is to identify the files user.txt and root.txt on the victim’s system. Penetration MethodlogiesRecon1stMethodNmapLet's begin with a Nmap version scan to discover open and running services and their versions.Enumeration Then, in the web browser, we investigate the target IP through port 443, but it returns Forbidden and prevents us from accessing that page.DirbWithout further ado, we will do a web directory brute force attack using dirb, which will return two web directories: /admin and /image. ExploitReturning to the File Scanner web page, we'll attempt to test SSRF by scanning the following URL.Server Side Request Forgery (SSRF), leading in the display of the Password Dashboard. As a response, it will give credentials to the administrator, which we may use to access the voting system.___________________________
@hacking_Attack
@Hacking_Video

Besides the update profile option, the admin dashboard contains no relevant information when logging into the web app.Unrestricted File Upload to RCEWe discovered upload feature for uploading profile photographs while updating the admin profile. We'll attempt to upload a PHP backdoor here.Reverse ShellLet's try the reverse connection by running metasploit payload via simple-backdoor.php. In this case, we will utilise the following module to create a malicious HTA file.Post EnumerationYou will find your first flag at C:\Users\Phoebe\Desktop. Let's crawl some more and look for weak or misconfigured links in order to elevate privilege for Phoebe.Winpeas.exeIn order to elevate privileges, we need to enumerate different files, directories, permissions, logs and SAM files. The number of files inside a Windows OS is very overwhelming. We will be using winpeasto enumerate vulnerable vector that can be exploited for privilege escalation.Privilege EscalationBecause AlwaysInstallElevated was enabled, we may do post-exploitation using the metas[...]

___________________________
@hacking_Attack
@Hacking_Video

ploit module shown below.2ndMethod Exploitation We can use arbitrary RCE to inject a malicious exe file onto the target system. For this, we will use msfvenom to build a malicious exe with the command given below, and then establish a Python HTTP server to send data.shell.exe Privilege EscalationWhen you run winpeas.exe, it will identify misconfigurations that may assist you obtain the vector vulnerable to privilege escalation. The system was improperly configured to ALwaysInstallElevated privileges. priv.msi___________________________
@hacking_Attack
@Hacking_Video

wCLcBGAsYHQ/s16000/59.png You will get new netcat session with administrative privileges.___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Love HacktheBox Walkthrough

Love is a CTF hosted on Hack the Box with Beginner categories. The objective for the participant is to identify the files user.txt and root.txt on the victim’s system. Penetration Methodlogies 1st Method Recon Nmap Enumeration Dirb Exploit SSRF Unrestricted file upload to RCE Reverse Shell via Metasploit Post Enumeration

The post Love HacktheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Webstor - A Script To Quickly Enumerate All Websites Across All Of Your Organization'S Networks, Store Their Responses, And Query For Known Web Technologies, Such As Those With Zero-Day Vulnerabilities

http://2.bp.blogspot.com/-ai803P5npL4/YUOviO4ImWI/AAAAAAAAu3c/-4U4dvLaQqQgEHxof1OYZJbih9CirRsngCK4BGAYYCw/w640-h378/webstor_1_webstor-789576.png WebStor is a tool implemented in Python under the MIT license for quickly enumerating all websites across all of your organization's networks, storing their responses, and querying for known web technologies and versions, such as those with zero-day vulnerabilities. It is intended, in particular, to solve the unique problem presented in mid to large sized organizations with decentralized administration, wherein it can be almost impossible to track all of the web technologies deployed by various administrators distributed across different units and networks.
WebStor achieves its goal by performing the following actions:

1. Performs DNS zone transfers to collect an organization's A and CNAME records.
2. Uses Masscan to scan for open HTTP/HTTPS ports on an organization's net ranges, as well as any IP addresses outside those ranges that were present in the organization's A and CNAME records.
3. Uses the Python requests library to collect all responses and store in a MariaDB database. All DNS names corresponding to an IP with open HTTP/HTTPS ports will be included in requests in addition to the IP address, so that sites using different headers will not cause a website to be missed.
4. Downloads Wappalyzer web technologies database and stores in MariaDB database, enabling users to query the location(s) of a common web technology by name.
5. Allows users to query the location(s) where custom regexes are contained within stored responses. Supported platformsWebStor presently will run on Linux systems. As it is written in Python, conversion to support Windows would be trivial and is likely to happen in the future. PrerequisitesApplications* Masscan
* If you will be using a cron job to update the database (typical), it is critical that you configure sudo nopasswd for any user executing Masscan scanning via WebStor.

* MariaDB 10.0.5 or later
* The default credentials tried by WebStor will be root and a blank password. See the "Secure options" section for configuring WebStor to use other usernames and passwords to connect to the database. Python libraries* pip3 install dnspython
* pip3 install beautifulsoup4
* pip3 install mysql-connector-python
* pip3 install js-regex
* pip3 install gevent
* pip3 install requests Availability via PyPI* If you are simply looking to run WebStor and not edit it, you may install the prerequisite applications and then use 'sudo pip3 install webstor'.
* After installing WebStor via PyPI, webstor will be in the path and can be run with at the command line regardless of working directory with 'webstor' instead of 'webstor.py', e.g. 'webstor -g'. Basic usageregular expression in WebStor database. --SEARCH-CUSTOM-FINGERPRINT SEARCHFINGERPRINT, -sC SEARCHFINGERPRINT Search for technology by name of user-provided custom fingerprint. --SEARCH-WAPPALYZER SEARCHWAPPALYZER, -sW SEARCHWAPPALYZER Search for technology by name (from Wappalyzer Tech DB) in WebStor DB. --NO-TSIG-KEY, -tN Do not use DNSSec TSIG key stored in database or a file, even if present. --TSIG-KEY-IMPORT IMPORTTSIGFILE, -tI IMPORTTSIGFILE Import a specified TSIG key file into the database --TSIG-KEY-REPLACE REPLACEMENTTSIGFILE, -tR REPLACEMENTTSIGFILE Replace a TSIG key in th[...]

___________________________
@hacking_Attack
@Hacking_Video