Hacking on Medium
A Web Server For Bug Bounty Hunters (Part 1)

https://cdn-images-1.medium.com/max/1920/1*ZHgUws5rwKn6ndqyLObZLg.jpeg
To be able to completely compromise a server, you have to understand the theory of a web server and its architecture. A web server is…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
A Complete Guide About CSRF

https://cdn-images-1.medium.com/max/1415/1*5b9CjlYVsqUmTfNYsvzNbw.png
Before proceeding to CSRF we need to know some basics about Session Management in Web applications.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
[HackTheBox] Arctic

https://cdn-images-1.medium.com/max/1692/1*UCOTKbAD4L-LuVho23TozA.png
This is a slow box but once you get going, its a breeze.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Install Kali Linux Tools in Windows WSL for Bug Hunting/Pentesting

Objectives:Continue reading on Medium »
Read more...

BruteLoops - Protocol Agnostic Online Password Guessing API

A dead simple library providing the foundational logic for efficient password brute force attacks against authentication interfaces. See various Wiki sections for more information. A "modular" example is included with the library that demonstrates how to use this package. It's fully functional and provides multiple brute force modules. Below is a sample of its capabilities: authentication module for training/testing ">http.accellion_ftp Accellion FTP HTTP interface login modulehttp.basic_digest Generic HTTP basic digest authhttp.basic_ntlm Generic HTTP basic NTLM authenticationhttp.global_protect Global Protect web interfacehttp.mattermost Mattermost login web interfacehttp.netwrix Netwrix web loginhttp.okta Okta JSON APIhttp.owa2010 OWA 2010 web interfacehttp.owa2016 OWA 2016 web interfacesmb.smb Target a single SMB servertesting.fake Fake authentication module for training/testing Key Features Protocol agnostic - If a callback can be written in Python, BruteLoops can be used to attack it SQLite support - All usernames, passwords, and credentials are maintained in an SQLite database. A companion utility (dbmanager.py) that creates and manages input databases accompanies BruteLoops Spray and Stuffing Attacks in One Tool - BruteLoops supports both spray and stuffing attacks in the same attack logic and database, meaning that you can configure a single database and run the attack without heavy reconfiguration and confusion. Guess scheduling - Each username in the SQLite database is configured with a timestamp that is updated after each authentication event. This means we can significantly reduce likelihood of locking accounts by scheduling each authentication event with precision. Fine-grained configurability to avoid lockout events - Microsoft's lockout policies can be matched 1-to-1 using BruteLoop's parameters: auth_threshold = Lockout Threshold max_auth_jitter = Lockout Observation Window Timestampes associated with each authentication event are tracked in BruteLoops' SQLite database. Each username receives a distinct timestamp to assure that authentication events are highly controlled. Attack resumption - Stopping and resuming an attack is possible without worrying about losing your place in the attack or locking accounts. Multiprocessing - Speed up attacks using multiprocessing! By configuring the`parallel guess count, you're effectively telling BruteLoops how many usernames to guess in parallel. Logging - Each authentication event can optionally logged to disk. This information can be useful during red teams by providing customers with a detailed attack timeline that can be mapped back to logged events. Dependencies BruteLoops requires Python3.7 or newer and SQLAlchemy 1.3.0, the latter of which can be obtained via pip and the requirements.txt file in this repository: python3.7 -m pip install -r requirements.txt Installation git clone https://github.com/arch4ngel/bruteloopscd bruteloopspython3 -m pip install -r requirements.txt How do I use this Damn Thing? Jeez, alright already...we can break an attack down into a few steps: Find an attackable service If one isn't already available in the example.py1 directory, build a callback Find some usernames, passwords, and credentials Construct a database by passing the authentication data to dbmanager.py2 If relevant, Enumerate or request the AD lockout policy to intelligently configure the attack Execute the attack in alignment with the target lockout policy134 Download BruteLoops
Read more...

___________________________
@hacking_Attack
@Hacking_Video

BruteLoops - Protocol Agnostic Online Password Guessing API
http://www.kitploit.com/2021/10/bruteloops-protocol-agnostic-online.html

___________________________
@hacking_Attack
@Hacking_Video

authentication module for training/testing ">http.accellion_ftp Accellion FTP HTTP interface login module
http.basic_digest Generic HTTP basic digest auth
http.basic_ntlm Generic HTTP basic NTLM authentication
http.global_protect
Global Protect web interface
http.mattermost Mattermost login web interface
http.netwrix Netwrix web login
http.okta Okta JSON API
http.owa2010 OWA 2010 web interface
http.owa2016 OWA 2016 web interface
smb.smb Target a single SMB server
testing.fake Fake authentication module for training/testing

Key Features
Protocol agnostic - If a callback can be written in Python, BruteLoops can be used to attack it SQLite support - All usernames, passwords, and credentials are maintained in an SQLite database. A companion utility (dbmanager.py) that creates and manages input databases accompanies BruteLoops Spray and Stuffing Attacks in One Tool - BruteLoops supports both spray and stuffing attacks in the same attack logic and database, meaning that you can configure a single database and run the attack without heavy reconfiguration and confusion. Guess scheduling - Each username (https://www.kitploit.com/search/label/Username) in the SQLite database is configured with a timestamp that is updated after each authentication event. This means we can significantly reduce likelihood of locking accounts by scheduling each authentication event with precision. Fine-grained configurability to avoid lockout events - Microsoft's lockout policies can be matched 1-to-1 using BruteLoop's parameters: auth_threshold = Lockout Threshold max_auth_jitter = Lockout Observation Window Timestampes associated with each authentication event are tracked in BruteLoops' SQLite database. Each username receives a distinct timestamp to assure that authentication events are highly controlled. Attack resumption - Stopping and resuming an attack is possible without worrying about losing your place in the attack or locking accounts. Multiprocessing - Speed up attacks using multiprocessing! By configuring the`parallel guess count, you're effectively telling BruteLoops how many usernames to guess in parallel. Logging - Each authentication event can optionally logged to disk. This information can be useful during red teams (https://www.kitploit.com/search/label/Red%20Teams) by providing customers with a detailed attack timeline that can be mapped back to logged events.
Dependencies
BruteLoops requires Python3.7 or newer and SQLAlchemy 1.3.0 (https://www.sqlalchemy.org/), the latter of which can be obtained via pip and the requirements.txt file in this repository: python3.7 -m pip install -r requirements.txt
Installation
git clone https://github.com/arch4ngel/bruteloops
cd bruteloops
python3 -m pip install -r requirements.txt

How do I use this Damn Thing?
Jeez, alright already...we can break an attack down into a few steps: Find an attackable service If one isn't already available in the example.py[1 (https://github.com/arch4ngel/BruteLoops/wiki/Using-example.py-to-Execute-Brute-Force-Attacks)] directory, build a callback Find some usernames, passwords, and credentials Construct a database by passing the authentication data to dbmanager.py[2 (https://github.com/arch4ngel/BruteLoops/wiki/Using-dbmanager.py-To-Manage-Databases)] If relevant, Enumerate or request the AD lockout policy to intelligently configure the attack Execute the attack in alignment with the target lockout policy[1 (https://github.com/arch4ngel/BruteLoops/wiki/Using-example.py-to-Execute-Brute-Force-Attacks)][3 (https://github.com/arch4ngel/BruteLoops/wiki/Explanation-of-Configuration-Parameters)][4 (https://github.com/arch4ngel/BruteLoops/wiki/Jitter-Time-Format-Specification)]

___________________________
@hacking_Attack
@Hacking_Video

Download BruteLoops (https://github.com/arch4ngel/BruteLoops)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
BruteLoops - Protocol Agnostic Online Password Guessing API

https://blogger.googleusercontent.com/img/a/AVvXsEiynbTny5paC-TASW4GINVX5-gUP8IcMKT8lhd3uMG7SCkMRINEXQUEB-h8pxBHjgA9vdeD1oTWPxocmBuhat1vlkLoMnuzh6juoNMW2ckmPz80hO3rDiKUd4g2KlyD3R3I5sBBtBEyRCVLJw4u4F0VZky6nRU1j_hH9PpiQkU56po-9viGh9GPtYyCAw=w640-h322 A dead simple library providing the foundational logic for efficient password brute force attacks against authentication interfaces.

See various Wiki sections for more information.

A "modular" example is included with the library that demonstrates how to use this package. It's fully functional and provides multiple brute force modules. Below is a sample of its capabilities:
authentication module for training/testing ">http.accellion_ftp Accellion FTP HTTP interface login module
http.basic_digest Generic HTTP basic digest auth
http.basic_ntlm Generic HTTP basic NTLM authentication
http.global_protect
Global Protect web interface
http.mattermost Mattermost login web interface
http.netwrix Netwrix web login
http.okta Okta JSON API
http.owa2010 OWA 2010 web interface
http.owa2016 OWA 2016 web interface
smb.smb Target a single SMB server
testing.fake Fake authentication module for training/testing Key Features* Protocol agnostic - If a callback can be written in Python, BruteLoops can be used to attack it
* SQLite support - All usernames, passwords, and credentials are maintained in an SQLite database.
* A companion utility (dbmanager.py) that creates and manages input databases accompanies BruteLoops

* Spray and Stuffing Attacks in One Tool - BruteLoops supports both spray and stuffing attacks in the same attack logic and database, meaning that you can configure a single database and run the attack without heavy reconfiguration and confusion.
* Guess scheduling - Each username in the SQLite database is configured with a timestamp that is updated after each authentication event. This means we can significantly reduce likelihood of locking accounts by scheduling each authentication event with precision.
* Fine-grained configurability to avoid lockout events - Microsoft's lockout policies can be matched 1-to-1 using BruteLoop's parameters:
* auth_threshold= Lockout Threshold
* max_auth_jitter= Lockout Observation Window
* Timestampes associated with each authentication event are tracked in BruteLoops' SQLite database. Each username receives a distinct timestamp to assure that authentication events are highly controlled.

* Attack resumption - Stopping and resuming an attack is possible without worrying about losing your place in the attack or locking accounts.
* Multiprocessing - Speed up attacks using multiprocessing! By configuring the`parallel guess count, you're effectively telling BruteLoops how many usernames to guess in parallel.
* Logging - Each authentication event can optionally logged to disk. This information can be useful during red teams by providing customers with a detailed attack timeline that can be mapped back to logged events. DependenciesBruteLoops requires Python3.7 or newer and SQLAlchemy 1.3.0, the latter of which can be obtained via pip and the requirements.txt file in this repository: python3.7 -m pip install -r requirements.txtInstallationgit clone https://github.com/arch4ngel/bruteloops
cd bruteloops
python3 -m pip install -r requirements.txt How do I use this Damn Thing?Jeez, alright already...we can break an attack down into a few steps:

1. Find an attackable service
2. If one isn't already available in the example.py[1] directory, build a callback
3. Find some usernames, passwords, and credentials
4. Construct a database by[...]

___________________________
@hacking_Attack
@Hacking_Video

passing the authentication data to dbmanager.py[2]
5. If relevant, Enumerate or request the AD lockout policy to intelligently configure the attack
6. Execute the attack in alignment with the target lockout policy[1][3][4] Download BruteLoops

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Continuous Authentication Tech Looms Large in Deployment Plans

Security leaders are interested in continuous authentication technologies, especially behavioral-based capabilities.

Dark Reading: Attacks/Breaches
Applying Behavioral Psychology to Strengthen Your Incident Response Team

A deep-dive study on the inner workings of incident response teams leads to a framework to apply behavioral psychology principles to CSIRTs.

Kali Linux Tutorials
Pwncat : Fancy Reverse And Bind Shell Handler

Pwncat is a post-exploitation platform for Linux targets. It started out as a wrapper around basic bind and reverse shells and has grown from there. It streamlines common red team operations while staging code from your attacker machine, not the target.

pwncat used to only support Linux, but there has been a lot of work recently to support multiple platforms. Currently, there is alpha support for Windows targets. Please see the latest documentation for details on how to use pwncat with a Windows target.

pwncat intercepts the raw communication with a remote shell and allows the user to perform automated actions on the remote host including enumeration, implant installation and even privilege escalation.

After receiving a connection, pwncat will setup some common configurations for working with remote shells.

* Disable history in the remote shell
* Normalize shell prompt
* Locate useful binaries (using which)
* Attempt to spawn a pseudo-terminal (pty) for a full interactive session pwncatknows how to spawn pty’s with a few different methods and will cross-reference the methods with the executables previously enumerated. After spawning a pty, it will setup the controlling terminal in raw mode, so you can interact in a similar fashion to ssh. pwncatwill also synchronize the remote pty settings (such as rows, columns, TERMenvironment variable) with your local settings to ensure the shell behaves correctly with interactive applications such as vimor nano.

John Hammond and I presented pwncatat GRIMMCon. Our presentation, which can be found on YouTube here. This video demonstrates an early version of the API and interface. Please refer to the documentation for up to date usage and API documentation!

pwncat documentation is being built out on Read the Docs. Head there for the latest usage and development documentation!

pwncat requires Python 3.9+ on Linux Windows Support pwncatnow supports connections from Windows targets starting at v0.4.0a1. The Windows platform utilizes a .Net-based C2 library which is loaded automatically. Windows targets should connect with either a cmd.exeor powershell.exeshell, and pwncat will take care of the rest.

The libraries implementing the C2 are implemented at pwncat-windows-c2. The DLLs for the C2 will be automatically downloaded from the targeted release for you. If you do not have internet connectivity on your target machine, you can tell pwncat to pre-stage the DLLs using the --download-pluginsargument. If you are running a release version of pwncat, you can also download a tarball of all built-in plugins from the releases page.

The plugins are stored by default in ~/.local/share/pwncat, however this is configurable with the plugin_pathconfiguration. If you download the packaged set of plugins from the releases page, you should extract it to the path pointed to by plugin_path.

Aside from the main C2 DLLs, other plugins may also be available. Currently, the only provided default plugins are the C2 and an implementation of BadPotato. pwncat can reflectively load .Net binaries to be used a plugins for the C2. For more information on Windows C2 plugins, please see the documentation. Version Details

Currently, there are two versions of pwncat available. The last stable version is v0.3.1. There is a tagged commit for that version. It does not support multiple platforms or multi-session interaction. The documentation for that version is still available on Read the Docs as the stableversion.

The current masterbranch is v0.4.3. This version has overhauled a lot of the framework[...]

___________________________
@hacking_Attack
@Hacking_Video