Hacking Articles Tips Tricks Videos Tutorials
468 subscribers
65.9K photos
15 videos
157 files
132K links
Exploit
Pentesting
Hacking
Red Team
Blue Team
Kali Linux
Bug Bounty
Black Hat
Cyber security etc

@Hacking_Video
@Hacking_attack
Download Telegram
Need help targetting users via android phone
https://www.reddit.com/r/redteamsec/comments/q451vr/need_help_targetting_users_via_android_phone/

Hi all, Next week, I will start working on a red team project which involves social engineering mobile only users. General email phishing with macro docs won't work. I am looking for ways to compromise users via their phone. Other than writing custom backdoored apks and luring victims to install them. Is there any other way to compromise the android phone? Also, custom apks might be flagged by Google Play Protect. submitted by /u/lutalop (https://www.reddit.com/user/lutalop)
[link] (https://www.reddit.com/r/redteamsec/comments/q451vr/need_help_targetting_users_via_android_phone/) [comments] (https://www.reddit.com/r/redteamsec/comments/q451vr/need_help_targetting_users_via_android_phone/)

___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Offensive Security Tool: Whispers

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Offensive Security Tool: WhispersPost Views: 230 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 4 Minutes

Offensive Security Tool: Whispers GitHub Link WhispersHardcoded secrets have always been a problem in organizations and are one of the first things Bug Bounty Hunters / Pentesters look for during a penetration test. When developers write secrets such as passwords and API keys directly into source code, these secrets can make their way to public repos or application packages, then into an attacker’s hands. As microservice architectures and API-centric applications become mainstream, developers often need to exchange credentials and other secrets programmatically. This means that developers can sometimes make mistakes when handling sensitive data.

Whispers by Skyscanner, is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can integrate it in your CI/CD pipeline. Detects* Passwords
* API tokens
* AWS keys
* Private keys
* Hashed credentials
* Authentication tokens
* Dangerous functions
* Sensitive files
See Also: Microsoft is disabling Excel 4.0 macros by default to protect users Supported FormatsWhispers is intended to be a structured text parser, not a code parser.

The following commonly used formats are currently supported:

* YAML
* JSON
* XML
* npmrc
* pypirc
* htpasswd
* properties
* pip.conf
* conf / ini
* Dockerfile
* Dockercfg
* Shell scripts
* Python3
Python3 files are parsed as ASTs because of native language support.
See Also: Offensive Security & Ethical Hacking Course Declaration & Assignment FormatsThe following language files are parsed as text, and checked for common variable declaration and assignment patterns:

* JavaScript
* Java
* Go
* PHP Special Formats* AWS credentials files
* JDBC connection strings
* Jenkins config files
* SpringFramework Beans config files
* Java Properties files
* Dockercfg private registry auth files
* Github tokens InstallationFrom PyPIpip3 install whispers From GitHubgit clone https://github.com/Skyscanner/whispers
cd whispers
make install UsageCLIwhispers –help
whispers –info
whispers source/code/fileOrDir
whispers –config config.yml source/code/fileOrDir
whispers –output /tmp/secrets.yml source/code/fileOrDir
whispers –rules aws-id,aws-secret source/code/fileOrDir
whispers –severity BLOCKER,CRITICAL source/code/fileOrDir
whispers –exitcode 7 source/code/fileOrDir Pythonfrom whispers.cli import parse_args
from whispers.core import run

src = “tests/fixtures”
configfile = “whispers/config.yml”
args = parse_args([“-c”, configfile, src])
for secret in run(args):
print(secret) ConfigThere are several configuration options available in Whispers. It’s possible to include/exclude results based on file path, key, or value. File path specifications are interpreted as globs. Keys and values accept regular expressions and several other parameters. There is a default configuration file built-in that will be used if you don’t provide a custom one.

config.yml should have the following structure:

include:
files:
– “**/*.yml”

exclude:
files:
– “**/test/**/*”
– “**/tests/**/*”
keys:
– ^foo
values:
– bar$

rules:
starks:
message: Whispers from the North
severity: CRITICAL
value:
regex: (Aria|Ned) Stark
ignorecase: True
The fastest way to tweak detection (ie: remove false positives and unwanted results) is[...]

___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Offensive Security Tool: Whispers https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Offensive Security Tool: WhispersPost Views: 230 https://www.blackhatethicalhacking.com/wp-content/uploa…
to copy the default config.yml into a new file, adapt it, and pass it as an argument to Whispers.

whispers –config config.yml –rules starks src/file/or/dir Custom RulesRules specify the actual things that should be pulled out from key-value pairs. There are several common ones that come built-in, such as AWS keys and passwords, but the tool is made to be easily expandable with new rules.
* Custom rules can be defined in the main config file under rules:
* Custom rules can be added to whispers/rules
rule-id: # unique rule name
description: Values formatted like AWS Session Token
message: AWS Session Token # report will show this message
severity: BLOCKER # one of BLOCKER, CRITICAL, MAJOR, MINOR, INFO

key: # specify key format
regex: (aws.?session.?token)?
ignorecase: True # case-insensitive matching

value: # specify value format
regex: ^(?=.*[a-z])(?=.*[A-Z])[A-Za-z0-9\+\/]{270,450}$
ignorecase: False # case-sensitive matching
minlen: 270 # value is at least this long
isBase64: True # value is base64-encoded
isAscii: False # value is binary data when decoded
isUri: False # value is not formatted like a URI

similar: 0.35 # maximum allowed similarity between key and value
# (1.0 being exactly the same) PluginsAll parsing functionality is implemented via plugins. Each plugin implements a class with the pairs() method that runs through files and returns the key-value pairs to be checked with rules.

class PluginName:
def pairs(self, file):
yield “key”, “value”
See Also: Offensive Security Tool: URL Hunter Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/Screenshot_20211001_133045-90x90.png Offensive Security Tool: URL Hunter1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unknown-90x90.png Offensive Security Tool: Discover2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/116777794-e9447880-aaa0-11eb-9697-af5f5617b279-90x90.png Offensive Security Tool: SniperPhish3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/jenkins-90x90.png Offensive Security Tool: Jenkins Attack Framework4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/pegasus-90x90.png Offensive Security Tool: Pegasus Spyware – Decompiled1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/FIbbZME-90x90.png Offensive Security Tool: Starkiller1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/0URVvVK54SOsx1MEq-90x90.png Offensive Security Tool: FFUF2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/687474703a2f2f633666632e696f2f77617263616e6e6f6e2d636c692e706e67-90x90.png Offensive Security Tool: Warcannon2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/2-7-90x90.png Offensive Security Tool: Mimikatz2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Screenshot_20210729_145513-90x90.png Offensive Security Tool: Ruler2 months ago
The post Offensive Security Tool: Whispers first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video
Viper is a graphical intranet penetration tool, which modularizes and weaponizes the tactics and technologies commonly used in the process of Intranet penetrationViper integrates basic functions such as bypass anti-virus software, intranet tunnel, file management, command line (https://www.kitploit.com/search/label/Command%20Line) and so onViper has integrated 80+ modules, covering Resource Development / Initial Access / Execution / Persistence / Privilege Escalation (https://www.kitploit.com/search/label/Privilege%20Escalation) / Defense Evasion / Credential Access / Discovery / Lateral Movement (https://www.kitploit.com/search/label/Lateral%20Movement) / Collection and other categoriesViper's goal is to help red team engineers improve attack efficiency, simplify operation and reduce technical thresholdViper supports running native msfconsole in browser and multi - person collaboration

___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
Viper - Intranet Pentesting Tool With Webui

https://blogger.googleusercontent.com/img/a/AVvXsEh9_mHAZUpTIaIoGsPkQm0u2YRo-Wx1SGyZCknpAg9UP_dod4zC0AJZznippACOWjrwvTnVPpFAHAGHP1_OTO9DsnayqIA84C0_0rHqlHIVHp2ganKiW_FcJJvbPl7c0QCDtrnKT79mgntch61745UbkZMwT7fw_Vi7X0zybh1aOsXQaUkBMbykQDV_mQ=w640-h354 * Viper is a graphical intranet penetration tool, which modularizes and weaponizes the tactics and technologies commonly used in the process of Intranet penetration
* Viper integrates basic functions such as bypass anti-virus software, intranet tunnel, file management, command line and so on
* Viper has integrated 80+ modules, covering Resource Development / Initial Access / Execution / Persistence / Privilege Escalation / Defense Evasion / Credential Access / Discovery / Lateral Movement / Collection and other categories
* Viper's goal is to help red team engineers improve attack efficiency, simplify operation and reduce technical threshold
* Viper supports running native msfconsole in browser and multi - person collaboration https://blogger.googleusercontent.com/img/a/AVvXsEh9_mHAZUpTIaIoGsPkQm0u2YRo-Wx1SGyZCknpAg9UP_dod4zC0AJZznippACOWjrwvTnVPpFAHAGHP1_OTO9DsnayqIA84C0_0rHqlHIVHp2ganKiW_FcJJvbPl7c0QCDtrnKT79mgntch61745UbkZMwT7fw_Vi7X0zybh1aOsXQaUkBMbykQDV_mQ=w640-h354 https://blogger.googleusercontent.com/img/a/AVvXsEixTaCKU_08HlXwJY6RCOXHOFtXxyEZfYzcqr-3WQzjkSI5JZkON9HfnHfFqsspm6Vag5AzDQpC_wrCCn98FcaxOdHU2mJKaqPqAkWxpXldEZ3iuxI6lpRnQuczOoFNm3TcvPiIK1hwHmQQv2w8m_7CaSwyf41r37IZEEVF3Ze3u7rb-GaSXXnvj4aKUA=w640-h354 https://blogger.googleusercontent.com/img/a/AVvXsEh1PztTO_zXrGKfXvcQSne-_p8-WiYoakuyx8WJUACU2x5VQ9cQXrRG1IPisJ8c36gtOO0KXGgnZxJ5rU8YhF2yTusE0koEIR9kv9r9dSF1VqOQSntXcNBDKyHLq5-Jl-9-1pmuiO32wqnrNbI0jIUJOf4j-d07Fx1EW6gFk-Vh-IaCQU3te1p20pEJ2Q=w640-h354 https://blogger.googleusercontent.com/img/a/AVvXsEhljdSAtDKSQ_tv7pNhB8UCcExxDxI679h244SMI9g8dHnaLQOV4UYaOII9qSqghuVYj55-ax4AKjNGtfBK-QZPgoKh0-AH9X28pHqaR3j0rHjHHf9en48VKoSxa5z_YRzcDQpma4ruWMwYMsTjyU9swanJDTuue_u9hUTBo_1ZFZZnxJ61t2VZz0oUFQ=w640-h354 Website* https://www.yuque.com/viper-en Installation manual* Installation manual FAQ* FAQ Issues* github issues : https://github.com/FunnyWolf/Viper/issues
* https://github.com/knownsec/404StarLink2.0-Galaxy#community Modules* Document link System architecture diagramhttps://blogger.googleusercontent.com/img/a/AVvXsEhvKz-L2sksG-sTJDr9K_TlbsKheGKjz__CPQmqqcu6QPvBNGTOFixuFThxVk546UxpgaXbgP25bYrn5S_bCloi01CkOBxOBuU2Zld4j6G7ceLz4XkqW_8_UaKtcU0j_--uNQpNDC6PvSD3jHHuFtIoCGms1G6TMc_MbrNq1mqvZqkzZogmAcdtPPW9FA=w640-h348 Development Manual* Development Manual Source Code* viperjs (Frontend) https://github.com/FunnyWolf/viperjs

* viperpython (Backend) https://github.com/FunnyWolf/viperpython

* vipermsf (MSFRPC) https://github.com/FunnyWolf/vipermsf AcknoladgementEdward_Snowdeng exp Fnzer0qingyun00脸谱 NoobFTW Somd5-小宇 timwhitezViCrackxiaobei97yumusb Download Viper

___________________________
@hacking_Attack
@Hacking_Video
Dark Reading: Attacks/Breaches
North American Orgs Hit With an Average of 497 Cyberattacks per Week

A new analysis confirms a surge in global cyberattacks since the COVID-19 pandemic began.
hacking: security in practice
Offensive Cloud Security - SecurityLabs

Hey everyone,

We are excited to share the first Offensive Cloud Security platform being released for early access.

Signup now and be among the first few to get exclusive access and upscale yourself :)

Visit : SecurityLabs

-- Founder

0xdeadbeef0000

submitted by /u/0xdeadbeef0000
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video
hacking: security in practice
Books to learn hacking with python?

Just wondering if the book “Violent Python” is good for beginners in python learning to hack. I want to get it but it uses python 2 and i’ll be using python 3. Is this a deal breaker? Keep in mind i’m not a complete beginner and have taken some courses to learn the basics.

submitted by /u/RJQWE
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video
Viper - Intranet Pentesting Tool With Webui

Viper is a graphical intranet penetration tool, which modularizes and weaponizes the tactics and technologies commonly used in the process of Intranet penetrationViper integrates basic functions such as bypass anti-virus software, intranet tunnel, file management, command line and so onViper has integrated 80+ modules, covering Resource Development / Initial Access / Execution / Persistence / Privilege Escalation / Defense Evasion / Credential Access / Discovery / Lateral Movement / Collection and other categoriesViper's goal is to help red team engineers improve attack efficiency, simplify operation and reduce technical thresholdViper supports running native msfconsole in browser and multi - person collaborationWebsitehttps://www.yuque.com/viper-enInstallation manualInstallation manualFAQFAQIssuesgithub issues : https://github.com/FunnyWolf/Viper/issueshttps://github.com/knownsec/404StarLink2.0-Galaxy#communityModulesDocument linkSystem architecture diagramDevelopment ManualDevelopment ManualSource Codeviperjs (Frontend)https://github.com/FunnyWolf/viperjsviperpython (Backend)https://github.com/FunnyWolf/viperpythonvipermsf (MSFRPC)https://github.com/FunnyWolf/vipermsfAcknoladgementEdward_Snowdeng exp Fnzer0qingyun00脸谱 NoobFTW Somd5-小宇 timwhitezViCrackxiaobei97yumusbDownload Viper
Read more...

___________________________
@hacking_Attack
@Hacking_Video