Hacking on Medium
Red Team’s Best Friend Nexpose

https://cdn-images-1.medium.com/max/2185/1*4QUhzv5HBU54q91VmBjovw.jpeg
Nexpose is one of the main vulnerability evaluation tools. The Nexpose community version is a free program, and different releases are…

Continue reading on Medium »

Hacking on Medium
Open Source Vulnerability Assessment Tool “OpenVAS”

https://cdn-images-1.medium.com/max/2185/1*lunU1jxvs2aCgLEQuPGb3g.jpeg
OpenVAS is a full-highlighted vulnerability scanner. Its abilities incorporate unauthenticated testing, validated testing, different…

Continue reading on Medium »

How to run exe upon logon with GPO (Commandline)
https://www.reddit.com/r/redteamsec/comments/mf5xeh/how_to_run_exe_upon_logon_with_gpo_commandline/

<!-- SC_OFF -->I am working on this keylogger project of mine. I have successfully implemented registry, scheduled tasks persistence but am stuck with GPO logon persistence. All online resources i saw are providing info on adding GPO in GUI. I need the command that can be run to register the EXE file in GPO logon. I located the feature i need in the GUI version of Group Policy Editor. Can someone point me in the right direction on achieving my goal with commandline? Thanks. <!-- SC_ON --> submitted by /u/gopi1711 (https://www.reddit.com/user/gopi1711)
[link] (https://www.reddit.com/r/redteamsec/comments/mf5xeh/how_to_run_exe_upon_logon_with_gpo_commandline/) [comments] (https://www.reddit.com/r/redteamsec/comments/mf5xeh/how_to_run_exe_upon_logon_with_gpo_commandline/)

Hacking Articles
Comprehensive Guide on ffuf

In this article, we will learn how we can use ffuf, which states for “Fuzz Faster U Fool”, which is an interesting open-source web fuzzing tool. Since its release, many people have gravitated towards ffuf, particularly in the bug bounty scenario. So, let’s dive into this learning process. Table of

The post Comprehensive Guide on ffuf appeared first on Hacking Articles.

CSRF to Full Account Takeover
https://medium.com/@ashrafharb997/csrf-to-full-account-takeover-5196cef9d166?source=rss------bug_bounty-5

بسم الله الرحمن الرحيمContinue reading on Medium » (https://medium.com/@ashrafharb997/csrf-to-full-account-takeover-5196cef9d166?source=rss------bug_bounty-5)

BadOutlook - (Kinda) Malicious Outlook Reader
http://www.kitploit.com/2021/03/badoutlook-kinda-malicious-outlook.html

A simple PoC which leverages the Outlook (https://www.kitploit.com/search/label/Outlook) Application Interface (COM Interface) to execute shellcode on a system based on a specific trigger subject line. By utilizing the Microsoft.Office.Interop.Outlook namespace, developers can represent the entire Outlook Application (or at least according to Microsoft (https://docs.microsoft.com/en-us/dotnet/api/microsoft.office.interop.outlook.application?view=outlook-pia)). This means that the new application should be able to do anything from reading emails (yes this also includes archives, trash, etc.) to sending them out. Building on the millions of pre-existing C# shellcode loaders, an email with a trigger subject line and base64 encoded shellcode in the body can be sent to the host with a weaponized instance of this program. The program will then read the email and execute the shellcode embedded (https://www.kitploit.com/search/label/Embedded) in the email.
Additional Notes:
This can be used to build an Entire C2 Framework (https://www.kitploit.com/search/label/C2%20Framework) that relies on E-Mails as a mean of communication (Where the Implant never speaks to the internet directly) There does appear to be a security warning which informs the user of an application attempting to access Outlook data This can be turned off with when an administrator modifies the registry (https://www.kitploit.com/search/label/Registry) as shown here. (https://docs.microsoft.com/en-us/outlook/troubleshoot/security/a-program-is-trying-to-send-an-email-message-on-your-behalf) Minor testing (https://www.kitploit.com/search/label/Testing) showed that Injecting this process into an Outlook client does not cause the alert to appear (Additional testing would be much appriciated
PoC
Applicaiton Polling Outlook for Trigger

Trigger Email With Shellcode Creation

Email Recived By Outlook Client

Shellcode Execution by BadOutlook Application

Download BadOutlook (https://github.com/S4R1N/BadOutlook)

CSRF to Full Account Takeover

بسم الله الرحمن الرحيمContinue reading on Medium »
Read more...

Hacking on Medium
SANS Holiday Hack Challenge 2020: Objective 7 — Solve the Sleigh’s CAN-D-BUS Problem

https://cdn-images-1.medium.com/max/1666/1*rhPwCkeXt3ijhZXlqWGULw.png
Each year, the SANS and Counter Hack Challenges teams put together my favorite capture the flag (CTF) competition, the SANS Holiday Hack…

Continue reading on Medium »