Azur3Alph4 - A PowerShell Module That Automates Red-Team Tasks For Ops On Objective
http://www.kitploit.com/2021/10/azur3alph4-powershell-module-that.html

___________________________
@hacking_Attack
@Hacking_Video

Azur3Alph4 is a PowerShell (https://www.kitploit.com/search/label/PowerShell) module that automates red-team (https://www.kitploit.com/search/label/Red-Team) tasks for ops on objective. This module situates in a post-breach (RCE achieved) position. Token extraction and many other tools will not execute successfully without starting in this position. This module should be used for further enumeration (https://www.kitploit.com/search/label/Enumeration) and movement in a compromised app that is part of a managed identity.
Azur3Alph4 is currently in development. Modules are being worked on and updated. Most of this is still untested. Scripts are in repo for individual use and easy identification, but the .psm1 file is what will be consistently updated.
Installation & Usage
Import-Module Azur3Alph4 Point the $envendpoint to cmd execution passing "env" to the Azure backend.
Updates - 8/10/2021
Added Get-ResourceActions.ps1 and updated Azur3Alph4.psm1
Updates - 8/5/2021
Made Azur3Alph4 modular Added Get-SubscriptionId function
Why This Was Built
I built this because I wanted to learn more about both PowerShell and Azure, two things I'd definitely like to get better at. To help automate and eliminate a lot of repetitive PS commands. To build off my current knowledge of Azure red teaming
Function List

Get-Endpoint
Enumerates an Azure endpoint to verify whether or not it belongs to a managed identity
Get-ManagedIdentityToken
Grabs the Managed Identity Token from the endpoint using the extracted secret. Stores the value in a given variable
Connect-AzAccount
Takes a username (https://www.kitploit.com/search/label/Username) and password variable and automates SecureString conversion and connects to an Azure account
Get-SubscriptionId
Gets the subscription ID using the REST API (https://www.kitploit.com/search/label/REST%20API) for Azure
Get-ManagedIdentityResources
Uses the subscription ID to enumerate all resources that are accessible
Get-ResourceActions.ps1
Enumerates all resources available using Azure token and lists permissions of each resource directly below it
Credits
Big shout out to @nikhil_mitt for the CARTP course that got me started in Azure

Download Azur3Alph4 (https://github.com/hyd3sec/Azur3Alph4)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Azur3Alph4 - A PowerShell Module That Automates Red-Team Tasks For Ops On Objective

http://1.bp.blogspot.com/-KaBlz1S53R0/YV0MNS8s4iI/AAAAAAAAvrg/84gd6Oy14x8aySddb3xL8NmBqaqS_WNDACK4BGAYYCw/w640-h162/Azur3Alph4_1_azur3alph4-716871.png

Azur3Alph4 is a PowerShell module that automates red-team tasks for ops on objective. This module situates in a post-breach (RCE achieved) position. Token extraction and many other tools will not execute successfully without starting in this position. This module should be used for further enumeration and movement in a compromised app that is part of a managed identity.
Azur3Alph4 is currently in development. Modules are being worked on and updated. Most of this is still untested.

Scripts are in repo for individual use and easy identification, but the .psm1 file is what will be consistently updated.
Installation & Usage

Import-Module Azur3Alph4

Point the $envendpoint to cmd execution passing "env" to the Azure backend.

Updates - 8/10/2021

* Added Get-ResourceActions.ps1 and updated Azur3Alph4.psm1

Updates - 8/5/2021

* Made Azur3Alph4 modular
* Added Get-SubscriptionId function

Why This Was Built

* I built this because I wanted to learn more about both PowerShell and Azure, two things I'd definitely like to get better at.
* To help automate and eliminate a lot of repetitive PS commands.
* To build off my current knowledge of Azure red teaming

Function List

Get-Endpoint

Enumerates an Azure endpoint to verify whether or not it belongs to a managed identity

Get-ManagedIdentityToken

Grabs the Managed Identity Token from the endpoint using the extracted secret. Stores the value in a given variable

Connect-AzAccount

Takes a username and password variable and automates SecureString conversion and connects to an Azure account

Get-SubscriptionId

Gets the subscription ID using the REST API for Azure

Get-ManagedIdentityResources

Uses the subscription ID to enumerate all resources that are accessible

Get-ResourceActions.ps1

Enumerates all resources available using Azure token and lists permissions of each resource directly below it

Credits

* Big shout out to @nikhil_mitt for the CARTP course that got me started in Azure
Download Azur3Alph4

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Handling Threat Intelligence Across Billions of Data Points

Graph databases can play a role in threat intelligence and unraveling sprawling data.

Dark Reading: Attacks/Breaches
7 Smart Ways a Security Team Can Win Stakeholder Trust

By demonstrating the following behaviors, security teams can more effectively move their initiatives forward.

Dark Reading: Attacks/Breaches
Wiz Reaches $6B Valuation

Startup created by former leaders of Microsoft Cloud Security Group experiencing rapid growth.

___________________________
@hacking_Attack
@Hacking_Video

RocketPool and Lido Frontrunning Bug Fix Postmortem
https://medium.com/immunefi/rocketpool-lido-frontrunning-bug-fix-postmortem-e701f26d7971?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

SummaryContinue reading on Immunefi » (https://medium.com/immunefi/rocketpool-lido-frontrunning-bug-fix-postmortem-e701f26d7971?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Fucked up pentest scan... Now what?

The customer didn't want to spend that much money (on me), and the sales team fucked up. So Essentially I got twice the work in half the time, because they're a new customer with a lot of possible future business I decided to say it's fine, even though the sales team would've fixed it.

Anyways because I now had a lot of stuff in very few days I ran automated scans on most addresses.

I realized just now while writing my final report I got kicked off by 50 addresses (a few subnets). A Sonicwall automatically blocked my IP, I would assume.

So what do I do? Do I just tell the customer your security is top notch here, or do I run another scan trying to get under the threshold.

I CANNOT CALL THE CUSTOMER, TILL THE REPORT IS DUE HE IS ON HOLIDAY.

submitted by /u/comrade-linux
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
OhMyZsh, PowerLevel10 and showing IP addr in TTY?

How can I show my HTB IP in my TTY shell? I’m using PowerLevel10 and OMZsh Right now my TTY is showing my local IP addr

submitted by /u/ZenBuddhism
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Pentagon Official Resigns Saying US Cybersecurity Is No Match for China, Calling It 'Kindergarten Level'

https://external-preview.redd.it/_tOUVKpP3UBvir8cF5_d3h61HGw1Ta8gltJZv76QIzc.jpg?width=640&crop=smart&auto=webp&s=2f68305ce3fe9a03bf032a7c9d026e07088faff4 submitted by /u/Stevogangstar
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Understanding dll injection and other techniques used for videogame modding/hacking

Lately I have been really curious about how different mod menus or hacks for games work, there are some mods that require a mod loader and then that loads the mods, but there are also some that are external applications and somehow manage to connect to the internals of online games, how does this work exactly? I have heard the term dll injection a few times, but I am not sure if this is how these applications work, and if so, how does that work? How do dll's work? Where can I learn more about this?

My field of studies is not related to computers, so programming is no more than a hobby to me, so I don't really have a lot of knowledge about this

Also, this is learning-purposes only, I don't approve online game hacking, but I find this subject really interesting and would maybe be fun to learn about

submitted by /u/Rikai_
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cheat codes for fortnite v bucks ps4

https://cdn-images-1.medium.com/max/1280/1*3sfXekmxogWAf3MZ-1W1uQ.jpeg
The latest update to Epic’s award-winning battle royale, Fortnite Hacks v3.33, has been published. The Chili Chug Splashes consumable has…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Create Trojans with Windows Executables

https://cdn-images-1.medium.com/max/1260/1*TimSBOQm2I9c-MPSav3izA.jpeg
This will be the first in a series of articles discussing various methods to backdoor everyday Windows executables, providing us with…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video