Hacking on Medium
Blockchain attacks

https://cdn-images-1.medium.com/max/788/1*HjsZCdJ0yO9rxstIrNjKyw.jpeg
Any new technologies always bring not only benefits for civilization, but also contain new threats, including risks associated with…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
BSSN Diretas, Puan Maharani Tunjukkan Rasa Kecewa Berat

https://cdn-images-1.medium.com/max/1280/1*0DcGASM7CHKGIIYuNjWpmw.jpeg
Baru minggu ini, ada peretasan pada situs resmi milik Badan Siber dan Sandi Negara (BSSN). Sudah seminggu sampai akhirnya terungkap ke…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Threat Analysis Honey Pot — Tokyo

https://cdn-images-1.medium.com/max/800/0*DgZJ0aalxYDsfcFE
INTRODUCTION

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Thanks for checking out my profile, just found this site by accident.

If you still use IRC (yes, people still use it) feel free to join #9x/EFNet to connect with a bunch of my long time hax0r friends,.. many…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Sensitive data of 400,000 German students exposed by API flaw

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Sensitive data of 400,000 German students exposed by API flawPost Views: 89
Reading Time: 1 Minute
Approximately 400,000 users of Scoolio, a student community app widely used in Germany, had sensitive information exposed due to an API flaw in the platform. Lilith Wittmann, a security researcher from the IT security collective “Zerforchung” discovered the bug and immediately disclosed their findings to the Scoolio team. A “student” businessScoolio is a German student community app that aims to build better time management skills, tutoring, homework planning, and group chats to network with peers. The app also allows companies to network with students to share job openings or internship opportunities.

Scoolio makes money by collecting data generated through these tools and features and then monetizing it with targeted advertising. However, Scoolio states that they do not collect or share any information from students without their consent.

To build student membership, Scoolio has partnered with schools around Germany to use their platform as a remote teaching assistance tool for file exchanges or remote digital homework collection.

It’s very development was financially backed by three state-owned investment groups, namely SIB Innovations – und Beteiligungsgesellschaft mbH, Technologiegründerfonds Sachsen, and Kreissparkasse Bautzen.

Due to the partnerships and government backings, many students use the app as a standard tool in their classes.
See Also: Complete Offensive Security and Ethical Hacking Course Data exposed by leaky APIIn Zerforchung’s report, Wittmann explains how she exploited Scoolio API flaws to retrieve extremely sensitive data for any user ID used on the app.

The exposed personal data includes:

* User nickname
* User and parent email addresses
* GPS location at which the app was last opened
* Name of school and class
* Interests
* UUID details
* Personality traits (origin, religion, sexuality)

Wittman shared a fictitious sample of the types of data exposed by the flaw below.
https://www.bleepstatic.com/images/news/security/scoolio-data.jpg
Fix released after thirty daysZerforchung states that they disclosed the flaw to Scoolio on September 21, 2021, but it took the software developer until October 25, 2021 to deploy a patch.

However, due to the simplicity of the fix and the sensitive nature of the exposed data, Wittmann believes the fix should have been released more quickly. “I would like to thank Ms. Wittmann for the information and the SDS for the exchange and thank you for your feedback on our security measures,” Danny Roller, CEO andFounder of the Scoolio app, shared in a statement.

“Fortunately, after extensive testing, we can confirm that No user data was intercepted by third parties prior to the investigation by Ms. Wittmann and we have successfull[...]

___________________________
@hacking_Attack
@Hacking_Video

y closed the gaps found.”
See Also: OSINT Tool: Osintgram
See Also: Hacking stories – Operation Aurora: When China hacked Google Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/hacked-90x90.jpg Brutal WordPress plugin bug allows subscribers to wipe sites1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-5-90x90.jpg Hackers used billing software zero-day to deploy ransomware2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-4-90x90.jpg Popular NPM library hijacked to install password-stealers, miners3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/youtube-logo-90x90.jpg Massive campaign uses YouTube to push password-stealing malware6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-3-90x90.jpg Google: YouTubers’ accounts hijacked with cookie-stealing malware1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-2-90x90.jpg Acer hacked twice in a week by the same threat actor1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif-6-e5d8ed29a830-90x90.jpg Credit card PINs can be guessed even when covering the ATM pad1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/REVIL-headpic-90x90.jpg REvil ransomware shuts down again after Tor sites were hijacked1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/google-chrome-adblocker-uai-1440x900-1-90x90.jpg Malicious Chrome ad blocker injects ads behind the scenes2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/maxresdefault-90x90.jpg Brizy WordPress Plugin Exploit Chains Allow Full Site Takeovers2 weeks ago
The post Sensitive data of 400,000 German students exposed by API flaw first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

SQL Injection JR. Pentester -TryHackMe Part 2
https://mukibas37.medium.com/sql-injection-jr-pentester-tryhackme-part-2-3b9d106e9d7b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi folks, welcome back to part 2 of SQL injection in JR. Pentester path.Continue reading on Medium » (https://mukibas37.medium.com/sql-injection-jr-pentester-tryhackme-part-2-3b9d106e9d7b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Analyzing Java Heap dumps via OQL queries
https://blog.defmax.io/analyzing-java-heap-dumps-via-oql-queries-fef8a8416017?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Java heap dumps contain sensitive data like Environment files, Passwords, Secret keys. This head dump is exposed by the Spring boot…Continue reading on Defmax » (https://blog.defmax.io/analyzing-java-heap-dumps-via-oql-queries-fef8a8416017?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

DonPAPI - Dumping DPAPI Credz Remotely
http://www.kitploit.com/2021/10/donpapi-dumping-dpapi-credz-remotely.html

___________________________
@hacking_Attack
@Hacking_Video

Curently gathered info
Windows credentials (Taskscheduled credentials & a lot more) Windows Vaults Windows RDP credentials AdConnect (still require a manual operation) Wifi key Intenet explorer Creentials Chrome cookies & credentials Firefox cookies & credentials VNC passwords mRemoteNG password (with default config)
Check for a bit of compliance
SMB signing status OS/Domain/Hostname/Ip of the audited scope
Operational use
With local admin account on a host, we can : Gather machine protected DPAPI secrets ScheduledTask that will contain cleartext login/password of the account configured to run the task Wi-Fi passwords Extract Masterkey's hash value for every user profiles (masterkeys beeing protected by the user's password, let's try to crack them with Hashcat) Identify who is connected from where, in order to identify admin's personal computers. Extract other non-dpapi protected secrets (VNC/Firefox/mRemoteNG) Gather protected secrets from IE, Chrome, Firefox and start reaching the Azure tenant. With a user password, or the domain PVK we can unprotect the user's DPAPI secrets.
Examples
Dump all secrets of the target machine with an admin account : DonPAPI.py domain/user:passw0rd@target Using user's hash : domain/user@target ">DonPAPI.py --hashes : domain/user@target Using kerberos (-k) and local auth (-local_auth) DonPAPI.py -k domain/user@target
DonPAPI.py -local_auth user@target Using a user with LAPS password reading rights DonPAPI.py -laps domain/user:passw0rd@target It is also possible to provide the tool with a list of credentials that will be tested on the target. DonPAPI will try to use them to decipher masterkeys. This credential file must have the following syntax: user1:pass1 user2:pass2 ... user1:pass1
user2:pass2
...
When a domain admin user is available, it is possible to dump the domain backup key using impacket dpapi.py tool. DonPAPI.py -credz credz_file.txt domain/user:passw0rd@target This backup key can then be used to dump all domain user's secrets! python DonPAPI.py -pvk domain_backupkey.pvk domain/user:passw0rd@domain_network_list Target can be an IP, IP range, CIDR, file containing list targets (one per line)
Opsec consideration
The RemoteOps part can be spoted by some EDR. It can be disabled using --no_remoteops flag, but then the machine DPAPI key won't be retrieved, and scheduled task credentials/Wi-Fi passwords (https://www.kitploit.com/search/label/Passwords) won't be harvested.
Installation
dpapi.py backupkey --export
Credits
All the credits goes to these great guys for doing the hard research & coding : Benjamin Delpy (@gentilkiwi (https://twitter.com/gentilkiwi)) for most of the DPAPI research (always greatly commented, Alberto Solino (@agsolino (https://twitter.com/agsolino)) for the tremendous work of Impacket (https://www.kitploit.com/search/label/Impacket) (https://github.com/SecureAuthCorp/impacket). Almost everything we do here comes from impacket. Alesandro Z (https://github.com/AlessandroZ) & everyone who worked on Lazagne (https://github.com/AlessandroZ/LaZagne/wiki) for the VNC & Firefox modules, and most likely for a lots of other ones in the futur. dirkjanm @_dirkjan (https://twitter.com/_dirkjan) for the base code of adconnect dump (https://github.com/fox-it/adconnectdump) & every research he ever did. I learned so much on so many subjects thanks to you. @byt3bl33d3r (https://twitter.com/byt3bl33d3r) for CME (lots of inspiration and code comes from CME : https://github.com/byt3bl33d3r/CrackMapExec ) All the Team at @LoginSecurite (https://twitter.com/LoginSecurite) for their help in debugging (https://www.kitploit.com/search/label/Debugging) my shity code (special thanks to @layno (https://github.com/clayno) & @HackAndDo (https://twitter.com/HackAndDo) for that)
Todo

___________________________
@hacking_Attack
@Hacking_Video

Finish ADSync/ADConnect password extraction CREDHISTORY full extraction Extract windows Certificates Further analysis (https://www.kitploit.com/search/label/Analysis) ADAL/msteams Implement Chrome Find a way to implement Lazagne's great modules
Changelog
git clone https://github.com/login-securite/DonPAPI.git
cd DonPAPI
python3 -m pip install -r requirements.txt
python3 DonPAPI.py


Download DonPAPI (https://github.com/login-securite/DonPAPI)

___________________________
@hacking_Attack
@Hacking_Video