Dark Reading: Attacks/Breaches
The Human Element Is the Weakest Link

While the recent Facebook outage was a major inconvenience, the impact of leaked business operations documents is a much bigger issue than being down for a few hours.

Dark Reading: Attacks/Breaches
Open Source Security Foundation Raises $10M

Industry leaders from technology, financial services, telecom, and cybersecurity sectors respond to Biden's executive order and commit to a more secure future for software.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Entering a Windows 7 without a password

Apologies if this is the wrong sub...

Basically, in not my brightest moment, I decided to change the password of my PC for a more secure password than now I don't remember...

So I'm not sure how can I access without the password now, pc main harddrive is full of important information and I wonder how could I bypass the password to at least retrieve the data...

For more info, the windows version is not the official so I couldn't reset it via Microsoft,

Is there anything I could possibly do?

submitted by /u/ZaZenleaf
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Reset Company/Corporate laptop to Normal personal laptop...

Hello everyone, I hope you are doing fine. I've been wondering how to convert a company laptop to a normal personal laptop. Like, removing all the restrictions to install certain apps etc....thanks..

submitted by /u/Any-Boysenberry-9918
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Train SSIDS are EXTREMELY vulnerable aren't they?

So I'm sitting in the train using the free wifi provided (like in hotels) and I'm thinking that theoretically I could start a fake router with the exact same SSID and the same HUD and actually give the people connecting internet so they log in to everything and I just sniff them to oblivion.

Is there a logic flaw I'm not seeing? God fucking damnit should've connected to a VPN before logging on to Paypal fml.

Really that easy to screw people nowadays?

Thanks.

Edit: Title should be sth like "Public WiFi is dangerous isn't it?"

submitted by /u/KommissarKong
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hackthebox Monitors writeup | Monitor Hack the box walkthrough

https://cdn-images-1.medium.com/max/1185/0*W4C4eY5q3xnRfSOm.png
If you find this write-up helpful consider following me and a clap would really motivate me to write more such blogs.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Pronósticos de ciberseguridad 2022

https://cdn-images-1.medium.com/max/1612/0*5wm3BZxrbfK48LMb
PUBLICADO EN 14 OCTUBRE, 2021POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Can Hacking Get You Arrested?

https://cdn-images-1.medium.com/max/2600/0*b5mN7pPjT9ZNt_Rs
The Answer Is Probably Obvious

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
“OK Google. What Bin Do I Need To Put Out?”

https://cdn-images-1.medium.com/max/2600/0*a9c6FYHxUEjzTpI8
Reverse engineering my local council’s website, and a journey of Google Assistant Integration

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Windows Privilege Escalation: Insecure GUI Application

IntroductionIn the series of Privilege escalation, till now we have learned that Microsoft Windows offers a wide range of fine-grained permissions and privileges for controlling access to Windows components including services, files, and registry entries. Today through applications we are going to exploit the privileges .Many GUI applications need the higher privileges other than the current user have, to access some of its particular services. Secondly, just due to misconfiguration of application. Let’s deep dive into it.Table of Content· IntroductionPrerequisites:Machine A-Window 10 (Ignite as admin user)Lab Setup of Insecure GUI ApplicationMachine A, has ignite as an admin user. Whoami /privWe have to understand that if any user has admin access even though that user does not have full or higher privileges.Abusing Insecure GUI ApplicationAfter enumerate some time on windows applications, we found that Notepad++ application has a feature that allow us to open file, short key to open file is CTRL+O or by navigate to option File then go to open.Note: In lab set up we had alread[...]

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Windows Privilege Escalation: Unquoted Service Path

Unquoted Path or Unquoted Service path is reported as a critical vulnerability in Windows, such vulnerability allows an attacker to escalate the privilege for NT AUTHORITY/SYSTEM for a low-level privilege user account.

Table of Content· Introduction Unquoted Service PathIf the path to the service binary is not enclosed in quotes and contains white spaces, the name of a loophole for an installed service is Service Unquoted Path. As a result, a local user will be able to elevate the privilege to administrator privilege shell by placing an executable in a higher level directory within the path.Mitre ID:T1574.009Tactics:Privilege Escalation & Persistence Platforms:WindowsTarget Machine:Windows 10Attacker Machine:Kali LinuxTools: SubinACL, PowerUP.ps1, Winpeas.Condition:Compromise the target machine with low privilege access either using Metasploit or Netcat, etc. Objective:Escalate the NT Authority /SYSTEM privileges for a low privileged user by exploiting unquoted path Vulnerability.Steps to Setup Vulnerable EnvironmentCreate a new folder and Sub Folder and named it “Ignite Data” & “Vuln Service” respectively Step2:Create vulnerable service with name file.exeStep3:Grant writeable for BUILTIN\Users on Ignite Data folder with the help of icacls*icaclsare Microsoft Windows native command-line programmes that can display and modify permissions on directories and files.https://blogger.googleusercontent.com/img/a/AVvXsEgi7vvII1haOA4-I4LUR4_o1IjspA7iVGWeFCZPwj8GM4YEXKhPOeRy7SULa6Ld7oc3MmrD7LxIK07GP9Zv_aNXclaXwFqjoTHFlYTiz5jm6LnEShc5p6SLkWA7b8B3iOkBg5Is7A81CAIrmAVHrRb61HNgWjxTzMWCLfNNSqr0D5I5LNM3Xnnn0mo4SA=s16000 Step4:To create a vulnerable service we need to assign[...]

___________________________
@hacking_Attack
@Hacking_Video

y granted the permission to run as administrator, whenever we execute the Notepad++.___________________________
@hacking_Attack
@Hacking_Video

some toxic privilege with the help of SubinACL to change the permission of services. NOTE:SubInACL is a little-known command-line tool from Microsoft, yet it is one of the best tools to work with security permissions in Windows. This tool is capable of changing the permissions of files, folders, registry keys, services, printers, cluster shares and various other types of objects.In this case, we have granted a user permissions to suspend (pause/continue), start and stop (restart) a service. The full list of the available service permissions:Step5:After Download SubinACL, execute the following command to assign PTOC Permissions user “ignite” against “Pentest” service.Abusing Unquoted Service PathsAbusing unquoted service is a technique that exploits insecure file permission in order to escalated privileges for local users. Download the PowerUp.ps1 script inside Kali Linux which will return the name and binary path for services with unquoted paths that also have a space in the name.___________________________
@hacking_Attack
@Hacking_Video

OCV2sZ9nBGKsf5ENQQ=s16000 It’s time to exploit the weak configured services against unquoted paths in order to privilege for user Shreya. As we know unquoted folder name is Vuln Service thus we will create a file with the name Vuln.exe with the help of msfvenom. Vuln.exeMitigation Ensure that any services that contain a space in the path enclose the path in quotes. Restrict File and Directory Permissions:Restrict access by setting directory and file permissions that are not specific to users or privileged accountsExecution Prevention:Block execution of code on a system through application control, and/or script blocking.

___________________________
@hacking_Attack
@Hacking_Video