SQL Injection JR. Pentester -TryHackMe Part 2

Hi folks, welcome back to part 2 of SQL injection in JR. Pentester path.Continue reading on Medium »
Read more...

Analyzing Java Heap dumps via OQL queries

Java heap dumps contain sensitive data like Environment files, Passwords, Secret keys. This head dump is exposed by the Spring boot…Continue reading on Defmax »
Read more...

hacking: security in practice
hack this site? It's up check it's code

submitted by /u/Inevitable_Will_9378
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What are the different ways to hack into a static Wordpress website?

Hackers in mid 2000s used to hack static websites and completely change the CSS and pages. I was wondering how hackers used to do that and if those vulnerabilities are still present?

submitted by /u/Yellow_KingX
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Sensitive data of 400,000 German students exposed by API flaw

https://external-preview.redd.it/XpI8Yewz5tFzlMqeScj58O1_k2fgaUPLdYDEMhxBd_c.jpg?width=640&crop=smart&auto=webp&s=9ce2e581badbd83c1c726168649e92cc56d3b863 submitted by /u/CodePerfect
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Chack, Hacker Chess

submitted by /u/InformalGhost
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Forced OAuth profile linking

https://cdn-images-1.medium.com/max/1268/1*Lfijo7MBe5VnCydnBU4dPg.png
xigtadaan waxa ay la socotaa article kii kan ka horeeyey ee aan uga hadlayney…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
碎碎念隨筆（四）：資安體驗營之奧義桌遊爽爽玩

https://cdn-images-1.medium.com/max/600/1*PfFZOnXfubLAgdNqc9cc_g.png
2021/10/16

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cream Hacked Analysis，US $130 Million Hacked

https://cdn-images-1.medium.com/max/1000/1*VS55YxfS-VBpFMoD9QZu3A.png
On October 27, 2021, Cream Finance suffered another attack loss of approximately US$130 million.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Chrome Ad Heavy Bypass - Not Every Vulnerability Has a CVE

https://cdn-images-1.medium.com/max/2600/1*cA_iaE-ToJCVVc6B8-B3GQ.jpeg
Software and Hardware vendors and even some security researchers have a standard way to look at security vulnerabilities. They look at…

Continue reading on SSD Secure Disclosure »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Binance Hesabınızı Hackerlardan Nasıl Korursunuz?

https://cdn-images-1.medium.com/max/1602/0*gCzblmtQA3aF3ySG.png
Mayıs 2019'da hackerlar, kripto dünyasını şaşkına çevirecek şekilde Binance’dan 7000 Bitcoin çaldı. Binance, saldırının bütün detaylarını…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

DonPAPI - Dumping DPAPI Credz Remotely

Dumping revelant information on compromised targets without AV detection DPAPI dumping Lots of credentials are protected by DPAPI. We aim at locating those "secured" credentials, and retreive them using : User password Domaine DPAPI BackupKey Local machine DPAPI Key (protecting TaskScheduled blob)Curently gathered info Windows credentials (Taskscheduled credentials & a lot more) Windows Vaults Windows RDP credentials AdConnect (still require a manual operation) Wifi key Intenet explorer Creentials Chrome cookies & credentials Firefox cookies & credentials VNC passwords mRemoteNG password (with default config) Check for a bit of compliance SMB signing status OS/Domain/Hostname/Ip of the audited scope Operational use With local admin account on a host, we can : Gather machine protected DPAPI secrets ScheduledTask that will contain cleartext login/password of the account configured to run the task Wi-Fi passwords Extract Masterkey's hash value for every user profiles (masterkeys beeing protected by the user's password, let's try to crack them with Hashcat) Identify who is connected from where, in order to identify admin's personal computers. Extract other non-dpapi protected secrets (VNC/Firefox/mRemoteNG) Gather protected secrets from IE, Chrome, Firefox and start reaching the Azure tenant. With a user password, or the domain PVK we can unprotect the user's DPAPI secrets. Examples Dump all secrets of the target machine with an admin account : DonPAPI.py domain/user:passw0rd@target Using user's hash DonPAPI.py --hashes : domain/user@target Using kerberos (-k) and local auth (-localauth) DonPAPI.py -k domain/user@targetDonPAPI.py -local\auth user@target Using a user with LAPS password reading rights DonPAPI.py -laps domain/user:passw0rd@target It is also possible to provide the tool with a list of credentials that will be tested on the target. DonPAPI will try to use them to decipher masterkeys. This credential file must have the following syntax: user1:pass1 user2:pass2 ... user1:pass1user2:pass2... When a domain admin user is available, it is possible to dump the domain backup key using impacket dpapi.py tool. DonPAPI.py -credz credz_file.txt domain/user:passw0rd@target This backup key can then be used to dump all domain user's secrets! python DonPAPI.py -pvk domain_backupkey.pvk domain/user:passw0rd@domain_network_list Target can be an IP, IP range, CIDR, file containing list targets (one per line) Opsec consideration The RemoteOps part can be spoted by some EDR. It can be disabled using --no_remoteops flag, but then the machine DPAPI key won't be retrieved, and scheduled task credentials/Wi-Fi passwords won't be harvested. Installation dpapi.py backupkey --export Credits All the credits goes to these great guys for doing the hard research & coding : Benjamin Delpy (@gentilkiwi) for most of the DPAPI research (always greatly commented, <3 your code) Alberto Solino (@agsolino) for the tremendous work of Impacket (https://github.com/SecureAuthCorp/impacket). Almost everything we do here comes from impacket. Alesandro Z & everyone who worked on Lazagne (https://github.com/AlessandroZ/LaZagne/wiki) for the VNC & Firefox modules, and most likely for a lots of other ones in the futur. dirkjanm @_dirkjan for the base code of adconnect dump (https://github.com/fox-it/adconnectdump) & every research he ever did. I learned so much on so many subjects thanks to you. <3 @byt3bl33d3r for CME (lots of inspiration and code comes from CME : https://github.com/byt3bl33d3r/CrackMapExec ) All the Team at @LoginSecurite for their help in debugging my shity code (special thanks to @layno & @HackAndDo for that) Todo Finish ADSync/ADConnect password extraction CREDHISTORY full extraction Extract windows Certificates Further analysis ADAL/msteams Implement Chrome Read more...

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Hacking stories – Operation Troy – How researchers linked the cyberattacks

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hacking stories – Operation Troy – How researchers linked the cyberattackshttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Post Views: 128
Reading Time: 7 Minutes
South Korea was the victim of an enormous cyberattack on March 20, 2013. The attack was meant to cause damage and affected multiple organizations like South Korean TV networks and financial institutions by deleting thousands of computer hard drives using wiper-malware.
A lot of security firms provided insights into the likely source of these attacks and how they happened. The attack was initially known as “Dark Seoul” and now as “Operation Troy”. The name Troy comes from repeated citations of the ancient city found in the compile path strings of the malware code.

The analysis from the McAfee security firm showed that the attacks, in addition to the data losses of the master boot record (MBR), were actually the last part of the attack of a covert espionage campaign coming from North Korea.
The adversaries
Software developers or hackers tend to leave fingerprints and footprints in their code, little pieces of artifacts in the code that can be used by forensic investigators to try and determine the original source of the intended piece of code or program.
Researchers determine that the primary hacking group responsible for the attacks was the New Romanic Cyber Army Team, which significantly uses Roman terms in their code. The majority of wipers contained strings named “principes” and “hastati,” which also appear in a message left on one of the targeted websites in the form of a web pop-up.

The other hacking group was “The Whois Hacking Team”, where they defaced the website of the network provider LG on March 20th. Researchers found that some wiper components worked differently from the wipers employed by the New Romanic team, where it also included the same graphics (in a resource file in the binary) that appeared on the defaced LG website.
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/whoisgroup.png
Message by the Whois Hacking team on a defaced website - credit: Tracing the Lineage of DarkSeoul - David Martin.
Anatomy of the attack
What types of malware involved?

A few types of malware were involved in those attacks which had a direct result of the destruction of computer machines using the MBR wiper component and remote access to the targets for a period before the attack.

The dropper Trojan was primarily used to download the executable that destroyed the systems’ MBRs. MBR wiper, upon execution, it was immediately starting to wipe the system and render it unbootable. The dropper installed the wiper, which destroyed the MBRs, when the dropper was executed, the systems were wiped within minutes.

The remote-access Trojan, as McAfee researchers determine that the attackers had access to the systems before wiping them, the remote-access trojan was likely delivered to an internal machine via a successful spear-phishing attack.
They also used an IRC botnet that relied upon a network of hacked South Korean websites where they hosted their IRC servers. The infected machines communicated through the IRC servers and used functions imported from the Microsoft Cryptography API library, bs.dll, where they hardcoded the control domains in it.

NSTAR Trojan was the first in the production of the Troy family, dating back in 2009 when it was created for a phishing espionage campaign. NSTAR used c[...]

___________________________
@hacking_Attack
@Hacking_Video

omponents in the same way that the 7 later variants of the Troy family did, as it included a shared DLL (bs.dll) that was found in the 2010 and 2011 variants.

The next variants that will follow “Chang and EagleXP” 2010, “HTTP Troy” 2011, “Http Dr0pper” 2012,” Tong” 2012, “TDrop” 2013, haven’t had much of change in their core functionality but had more to do with the programming technique.

The researchers based their results to trace the legacy of the Troy variants on the fingerprints and footprints left from the malicious developers that were examined in the source code of the malware variants.

The compile paths, a type of fingerprint, that was tracked by the researchers, are the paths through the developer’s computer file directory (work directory) to the location at which the source code is stored, where documented in the report.
The NSTAR variant used the same DLL as Troy, Chang/EagleXP as we can see below.

The compile path of NSTAR was: E:\Work\BackUp\2011\nstar_1103\BackDoor\BsDllup\Release\BsDll.pdb whileHTTP Troy’s was:
Z:\source\1\HttpTroy\BsDll-up\Release\BsDll.pdb

Http Dr0pper, included the compile path: Z:\\1Mission\\Team_Project\\[2012.6~]\\HTTPTroy\\HttpDr0pper\\Win32\\Release, indicating that it was based on HTTP Troy variant as a more advanced version compiled in 2012.

Many of the variants were disguised as executable files of a security product. Http Dr0per was used to disguise its dropper component with the AhnlabUpdate.exe. Just as Http Dr0per , TDrop which was compiled on January 15, 2013, used the same executable (AhnlabUpdate.exe) to disguise its dropper.
They also shared the same file-mapping function and DLL as well.
Http Dr0per code:

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/http-dr0pper.png
TDrop code:
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/tdr0p.png
When the main Trojan file (Main.exe) executes, it launches RunCmd.exe, then launches AhnlabUpdate.exe. These files are created in a directory that sits in a temp directory created on the desktop. It was obvious for the researchers that the attackers knew what security software the victims used and attempted to make the malware appear as legitimate as possible.
AhnlabUpdate.exe then dropped and run an additional executable, a RAT payload that established the connection to the control server.
In early 2013, Concealment Troy Trojan had functional improvements to the first variants. It had better abilities to conceal itself from standard security techniques. The 3RAT client was the first version of troy to inject itself into Internet Explorer.
The wiper functionality was added in combination with the Concealment Trojan in the last attack named “DarkSeoul”, wherein in April 2013, crippled thousands of computers of financial services and media companies in South Korea.

This variant did not employ real-time IRC control as the earlier variants did. It was a typical HTTP botnet that used HTTP as its primary channel of communication. That solved potential problems that may arise with the earlier versions of the malware where the communications went through the installed IRC servers on the hacked South Korean websites.
The 2 main problems that arise with the previous Troy variants were that at any time, if the owners of the infected servers discovered the IRC process, they might remove it, thus making the attackers lose control of the servers that each Troy variant deployed.

The second problem was that the hackers hardcoded the name of the infected IRC server into each Troy variant source code. So, if the IRC server was compromised, they had to find another vulnerable server, install an IRC server and then recompile a new Troy variant with that specific IRC server.
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/campaign-malware1.png
The targeted attack Dark Seoul reached its culmination in March 2013,
but its roots go back at least to 2009, whe[...]

___________________________
@hacking_Attack
@Hacking_Video