Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog
Love HacktheBox Walkthrough

Love is a CTF hosted on Hack the Box with Beginner categories. The objective for the participant is to identify the files user.txt and root.txt on the victim’s system. Penetration MethodlogiesRecon1stMethodNmapLet's begin with a Nmap version scan to discover open and running services and their versions.Enumeration Then, in the web browser, we investigate the target IP through port 443, but it returns Forbidden and prevents us from accessing that page.DirbWithout further ado, we will do a web directory brute force attack using dirb, which will return two web directories: /admin and /image. ExploitReturning to the File Scanner web page, we'll attempt to test SSRF by scanning the following URL.Server Side Request Forgery (SSRF), leading in the display of the Password Dashboard. As a response, it will give credentials to the administrator, which we may use to access the voting system.___________________________
@hacking_Attack
@Hacking_Video

Blogspot

Love HacktheBox Walkthrough

Hacking Articles is a very interesting blog about information security, penetration testing and vulnerability assessment managed by Raj Chandel.

9 viewsedited 19:25

Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog Love HacktheBox Walkthrough Love is a CTF hosted on Hack the Box with Beginner categories. The objective for the participant is to identify the files user.txt and root.txt on the victim’s system. Penetration Methodlogi…

Besides the update profile option, the admin dashboard contains no relevant information when logging into the web app.Unrestricted File Upload to RCEWe discovered upload feature for uploading profile photographs while updating the admin profile. We'll attempt to upload a PHP backdoor here.Reverse ShellLet's try the reverse connection by running metasploit payload via simple-backdoor.php. In this case, we will utilise the following module to create a malicious HTA file.Post EnumerationYou will find your first flag at C:\Users\Phoebe\Desktop. Let's crawl some more and look for weak or misconfigured links in order to elevate privilege for Phoebe.Winpeas.exeIn order to elevate privileges, we need to enumerate different files, directories, permissions, logs and SAM files. The number of files inside a Windows OS is very overwhelming. We will be using winpeasto enumerate vulnerable vector that can be exploited for privilege escalation.Privilege EscalationBecause AlwaysInstallElevated was enabled, we may do post-exploitation using the metas[...]

___________________________
@hacking_Attack
@Hacking_Video

11 viewsedited 19:25

Hacking Articles Tips Tricks Videos Tutorials

ploit module shown below.2ndMethod Exploitation We can use arbitrary RCE to inject a malicious exe file onto the target system. For this, we will use msfvenom to build a malicious exe with the command given below, and then establish a Python HTTP server to send data.shell.exe Privilege EscalationWhen you run winpeas.exe, it will identify misconfigurations that may assist you obtain the vector vulnerable to privilege escalation. The system was improperly configured to ALwaysInstallElevated privileges. priv.msi___________________________
@hacking_Attack
@Hacking_Video

11 viewsedited 19:25

Hacking Articles Tips Tricks Videos Tutorials

wCLcBGAsYHQ/s16000/59.png You will get new netcat session with administrative privileges.___________________________
@hacking_Attack
@Hacking_Video

11 viewsedited 19:25

Hacking Articles Tips Tricks Videos Tutorials

11 views19:41

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking Articles
Love HacktheBox Walkthrough

Love is a CTF hosted on Hack the Box with Beginner categories. The objective for the participant is to identify the files user.txt and root.txt on the victim’s system. Penetration Methodlogies 1st Method Recon Nmap Enumeration Dirb Exploit SSRF Unrestricted file upload to RCE Reverse Shell via Metasploit Post Enumeration

The post Love HacktheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles

Love HacktheBox Walkthrough - Hacking Articles

Love is a CTF hosted on Hack the Box with Beginner categories. The objective for the participant is to identify the files user.txt and root.txt

12 viewsedited 19:41

Hacking Articles Tips Tricks Videos Tutorials

11 views20:31

Hacking Articles Tips Tricks Videos Tutorials

Photo

KitPloit - PenTest Tools!
Webstor - A Script To Quickly Enumerate All Websites Across All Of Your Organization'S Networks, Store Their Responses, And Query For Known Web Technologies, Such As Those With Zero-Day Vulnerabilities

http://2.bp.blogspot.com/-ai803P5npL4/YUOviO4ImWI/AAAAAAAAu3c/-4U4dvLaQqQgEHxof1OYZJbih9CirRsngCK4BGAYYCw/w640-h378/webstor_1_webstor-789576.png WebStor is a tool implemented in Python under the MIT license for quickly enumerating all websites across all of your organization's networks, storing their responses, and querying for known web technologies and versions, such as those with zero-day vulnerabilities. It is intended, in particular, to solve the unique problem presented in mid to large sized organizations with decentralized administration, wherein it can be almost impossible to track all of the web technologies deployed by various administrators distributed across different units and networks.
WebStor achieves its goal by performing the following actions:

1. Performs DNS zone transfers to collect an organization's A and CNAME records.
2. Uses Masscan to scan for open HTTP/HTTPS ports on an organization's net ranges, as well as any IP addresses outside those ranges that were present in the organization's A and CNAME records.
3. Uses the Python requests library to collect all responses and store in a MariaDB database. All DNS names corresponding to an IP with open HTTP/HTTPS ports will be included in requests in addition to the IP address, so that sites using different headers will not cause a website to be missed.
4. Downloads Wappalyzer web technologies database and stores in MariaDB database, enabling users to query the location(s) of a common web technology by name.
5. Allows users to query the location(s) where custom regexes are contained within stored responses. Supported platformsWebStor presently will run on Linux systems. As it is written in Python, conversion to support Windows would be trivial and is likely to happen in the future. PrerequisitesApplications* Masscan
* If you will be using a cron job to update the database (typical), it is critical that you configure sudo nopasswd for any user executing Masscan scanning via WebStor.

* MariaDB 10.0.5 or later
* The default credentials tried by WebStor will be root and a blank password. See the "Secure options" section for configuring WebStor to use other usernames and passwords to connect to the database. Python libraries* pip3 install dnspython
* pip3 install beautifulsoup4
* pip3 install mysql-connector-python
* pip3 install js-regex
* pip3 install gevent
* pip3 install requests Availability via PyPI* If you are simply looking to run WebStor and not edit it, you may install the prerequisite applications and then use 'sudo pip3 install webstor'.
* After installing WebStor via PyPI, webstor will be in the path and can be run with at the command line regardless of working directory with 'webstor' instead of 'webstor.py', e.g. 'webstor -g'. Basic usageregular expression in WebStor database. --SEARCH-CUSTOM-FINGERPRINT SEARCHFINGERPRINT, -sC SEARCHFINGERPRINT Search for technology by name of user-provided custom fingerprint. --SEARCH-WAPPALYZER SEARCHWAPPALYZER, -sW SEARCHWAPPALYZER Search for technology by name (from Wappalyzer Tech DB) in WebStor DB. --NO-TSIG-KEY, -tN Do not use DNSSec TSIG key stored in database or a file, even if present. --TSIG-KEY-IMPORT IMPORTTSIGFILE, -tI IMPORTTSIGFILE Import a specified TSIG key file into the database --TSIG-KEY-REPLACE REPLACEMENTTSIGFILE, -tR REPLACEMENTTSIGFILE Replace a TSIG key in th[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Webstor - A Script To Quickly Enumerate All Websites Across All Of Your Organization'S Networks, Store Their Responses, And Query…

10 viewsedited 20:31

Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest & Hacking Tools

Webstor - A Script To Quickly Enumerate All Websites Across All Of Your Organization'S Networks, Store Their Responses, And Query…

9 viewsedited 20:31

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Cyberspace, Cybergames, and Cyberspies

How cyberspace has become a global cybergames stage, where all of us are actors.

9 views20:33

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
1Password and Fastmail Partner to Boost Online Privacy

Allows users to securely generate unique email aliases, adding an extra layer of online privacy.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

1Password and Fastmail Partner to Boost Online Privacy

Allows users to securely generate unique email aliases, adding an extra layer of online privacy.

9 viewsedited 20:33

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Dell Technologies Addresses Modern Support and Security

Services and security updates deliver customized IT support and secure PC experiences for work-from-anywhere employees.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Dell Technologies Addresses Modern Support and Security

Services and security updates deliver customized IT support and secure PC experiences for work-from-anywhere employees.

9 viewsedited 20:33

About

Blog

Apps

Platform