days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-5-90x90.jpg Hackers used billing software zero-day to deploy ransomware6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-4-90x90.jpg Popular NPM library hijacked to install password-stealers, miners1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/youtube-logo-90x90.jpg Massive campaign uses YouTube to push password-stealing malware1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-3-90x90.jpg Google: YouTubers’ accounts hijacked with cookie-stealing malware2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-2-90x90.jpg Acer hacked twice in a week by the same threat actor2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif-6-e5d8ed29a830-90x90.jpg Credit card PINs can be guessed even when covering the ATM pad2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/REVIL-headpic-90x90.jpg REvil ransomware shuts down again after Tor sites were hijacked2 weeks ago
The post Chaos ransomware targets gamers via fake Minecraft alt lists first appeared on Black Hat Ethical Hacking.

How I was able to send SMS from target and get their OTP.

Hey fellow hackers and bug hunters,Continue reading on InfoSec Write-ups »
Read more...

Melting-Cobalt - A Cobalt Strike Scanner That Retrieves Detected Team Server Beacons Into A JSON Object
http://www.kitploit.com/2021/11/melting-cobalt-cobalt-strike-scanner.html

A tool to hunt/mine for Cobalt Strike (https://www.kitploit.com/search/label/Cobalt%20Strike) beacons and "reduce" their beacon configuration for later indexing. Hunts can either be expansive and internet wide using services like SecurityTrails, Shodan, or ZoomEye or a list of IP's.
Getting started
Install (https://github.com/splunk/melting-cobalt#installation) melting-cobalt Configure (https://github.com/splunk/melting-cobalt#configuration) your tokens to begin the hunt Mine (https://github.com/splunk/melting-cobalt#search-examples) Beacons to begin reducing them Review results cat results.json | jq
Installation
Requirements: virtualenv, and python3.8+ git clone https://github.com/splunk/melting-cobalt && cd melting-cobalt Clone project and cd into the project dir. pip install virtualenv && virtualenv -p python3 venv && source venv/bin/activate && pip install -r requirements.txt Create Virtualenv and install requirements. Continue to configuring (https://github.com/splunk/melting-cobalt#configuration) for SecurityTrails, Shodan, or ZoomEye API key.
Configuration melting-cobalt.conf
Copy melting-cobalt.conf.example to melting-cobalt.conf! Make sure to set a token for one of the available providers (https://github.com/splunk/melting-cobalt/blob/main/melting-cobalt.conf.example#L18-L25). If you need to create one for your account follow [these](htt://need wiki page) instructions. Configuration example: scanning service provider (eg shodan, zoomeye, security trails) when hunting for team servers. shodan_token = TOKENHERE # shodan token for searching zoomeye_token = TOKENHERE # zoomeye token for searching securitytrails_token = TOKENHERE # security trails token for searching ">[global]
output = results.json
# stores matches in JSON here

log_path = melting-cobalt.log
# Sets the log_path for the logging file

log_level = INFO
# Sets the log level for the logging
# Possible values: INFO, ERROR, VERBOSE

nse_script = grab_beacon_config.nse
# path to the nse script that rips down cobalt configs. This is specifically using https://github.com/whickey-r7/grab_beacon_config

searches = search.yml
# contains the different searches to run on each internet scanning service provider (eg shodan, zoomeye, security trails) when hunting for team servers.

shodan_token = TOKENHERE
# shodan token for searching

zoomeye_token = TOKENHERE
# zoomeye token for searching

securitytrails_token = TOKENHERE
# security trails token for searching

Search The Internet
To modify the default mining performed across different providers, customize search.yml. The default melting-cobalt Search Examples (https://github.com/splunk/melting-cobalt#search-examples) below. Run: python melting-cobalt.py
Search IP list
populate ips.txt with potential Cobalt Strike C2 IPs a new line delimeted, example: 1.1.1.1
2.2.2.2
3.3.3.3
Run: python melting-cobalt.py -i ips.txt If you need inspiration from hunters we highly recommend: The DFIR Report (https://twitter.com/TheDFIRReport) Awesome-Cobalt-Strike (https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence) CobaltStrikeBot (https://twitter.com/cobaltstrikebot)
Usage
usage: melting-cobalt.py [-h] [-c CONFIG] [-o OUTPUT] [-v] [-i INPUT]

scans for open cobalt strike team servers and grabs their beacon configs and write this as a json log to be analyzed by any analytic tools
like splunk, elastic, etc..

optional arguments:
-h, --help show this help message and exit
-c CONFIG, --config CONFIG
config file path
-o OUTPUT, --output OUTPUT
file to write to the results, defaults to results.json.log
-v, --version shows current melting-cobalt version
-i INPUT, --input INPUT
newline delimeted file of cobalt strike server ips to grab beacon configs from. example ips.txt

Search Examples

The following searches are provided out of the box and more may be added to search.yml for more data.
Shodan

Find specific JARM (https://blog.cobaltstrike.com/2020/12/08/a-red-teamer-plays-with-jarm/) signatures, out of the box we track Cobalt Strike 4.x
'ssl.jarm:07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1'
Filter by HTTP headers and ports to reduce noisy results
'ssl.jarm:07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1 port:"22, 80, 443, 444, 1234, 2000, 2222, 3000, 3780, 4000, 4443, 6379, 7443, 8443, 8080, 8081, 8082, 8087, 8088, 8099, 8089, 8090, 8181, 8888, 8889, 9443, 50050" HTTP/1.1 404 Not Found Content-Length: 0'
Team server detected by Shodan
'product:"cobalt strike team server"' note: will generate lots of noisy results, do not actually schedule this unless you want to burn your license credits.
Team server certificate serial
'ssl.cert.serial:146473198'
SecurityTrails

Find specific JARM (https://blog.cobaltstrike.com/2020/12/08/a-red-teamer-plays-with-jarm/) signatures
'SELECT address, ports.port FROM ips WHERE jarm = "07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1"'
Filter by HTTP Headers (https://www.kitploit.com/search/label/Headers) and ports to reduce noisy nmap_results
'SELECT address, ports.port, isp.name_normalized, ports.port, address, asn.number, jarm, http.headers.raw FROM ips WHERE jarm = "07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1" OR jarm = "07d14d16d21d21d07c07d14d07d21d9b2f5869a6985368a9dec764186a9175" OR jarm = "2ad2ad16d2ad2ad22c42d42d00042d58c7162162b6a603d3d90a2b76865b53" AND http.headers.content_type = "text/plain" AND http.headers.raw = "content-length:0" AND ports.port IN (22, 80, 443, 444, 1234, 2000, 2222, 3000, 3780, 4000, 4443, 6379, 7443, 8443, 8080, 8081, 8082, 8087, 8088, 8099, 8089, 8090, 8181, 8888, 8889, 9443, 50050)'
Author
Michael Haag @M_haggis (https://twitter.com/M_haggis) Jose Hernandez @d1vious (https://twitter.com/d1vious)
Support 
Please use the GitHub issue tracker (https://github.com/splunk/melting-cobalt/issues) to submit bugs or request features. If you have questions or need support, you can: Join the #security-research (https://splunk-usergroups.slack.com/archives/C1S5BEF38) room in the Splunk Slack channel (http://splunk-usergroups.slack.com/)
Credits & References
Inspiration came from a handful of blogs: Much of this is only possible because whiskey-7 shared with us grab_beacon_config.nse
TODO
add zoomeye Dedup results before nmap add checking the most recent result by looking at the latest_updated field
License
Copyright 2020 Splunk Inc. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance (https://www.kitploit.com/search/label/Compliance) with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed (https://www.kitploit.com/search/label/Distributed) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Download Melting-Cobalt (https://github.com/splunk/melting-cobalt)

How I was able to send SMS from target and get their OTP.
https://infosecwriteups.com/how-i-was-able-to-send-sms-from-target-and-get-their-otp-6252bcc2ac9d?source=rss------bug_bounty-5

Hey fellow hackers and bug hunters,Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/how-i-was-able-to-send-sms-from-target-and-get-their-otp-6252bcc2ac9d?source=rss------bug_bounty-5)

hacking: security in practice
Hacking courses

Should I pursue computer science, information system or cybersecurity to advance into hacking? Please recommend available courses online for practice thanks!

submitted by /u/Plastic-Ad-8750
[link] [comments]

hacking: security in practice
You connect to my home's wi-fi network.

How do you hack me?

submitted by /u/TheN1ght0w1
[link] [comments]

hacking: security in practice
Are popup tabs dangerous on iOS?

Why are there still popup tabs even after blocking it on iOS settings? Are popup tabs safe if it is immediately closed without clicking into the content? Thanks!

submitted by /u/Plastic-Ad-8750
[link] [comments]

Hacking on Medium
How I was able to send SMS from target and get their OTP.

https://cdn-images-1.medium.com/max/1080/1*8mcSIDGXhTagyH33iuxieA.jpeg
Hey fellow hackers and bug hunters,

Continue reading on InfoSec Write-ups »

Hacking on Medium
Modern Password Theory in a Nutshell

https://cdn-images-1.medium.com/max/2600/0*-AAgGtJsWFizmM22
0u+_W!+h_+h3_01d • • and • • InWithTheNew! • • • In the beginning, there was the “hard to read” paradigm

Continue reading on Tangled Web »

Dark Reading: Attacks/Breaches
Understanding the Human Communications Attack Surface

Companies should recognize that collaboration platforms aren't isolated, secure channels where traditional threats don't exist.

hacking: security in practice
Modern browser without any client-side security protection for pentesting?

Hello!

In the last few pentests I've been doing, I've run into an issue with website being probably vulnerable to things like CSRF or XSS, but the vulnerability was prevented by browser security mechanism of all modern browsers (SameSite cookies, anti-XSS protection etc). This has raised a discussion inside our team, if it's something that should be reported (I think it definitely is), and more importantly how to test it. I think vulnerabilities that are present in the application, but prevented by modern browsers should be reported (with severity reflecting such fact), because otherwise you're pentesting the browser and not the application. (And it's only a matter of time before someone gets hacked because an admin used wget or elinks).

However, it is something that's hard to test for. It's no always feasible to keep pentesting such issues in MS Explorer, mostly because websites tend to not work properly (or at all) when accessed using such an old browser. And when pentesting with modern browsers, it's getting harder and harder to be sure whether there is some new browser security feature that prevented the attack, or whether the website is not vulnerable. Which leads me to my question, and a whole reason of this post:

Is there any modern browser fork/config file that does not implement any standards with security in mind (so, no cross-origin blocking, SameSite cookies by default, XSS-Protection etc), but still reliably works in place of a modern browser? I feel like this should be really useful tool for pentesting, and would make reports a lot clearer and issues easier to reproduce. I know that this could be done simply by using intercepting proxy/directly sending requests i.e by Burp, but that can get pretty cubersome when dealing with multi-step workflow, viewstates and who-knows what else, which is where a simple browser would shine.

submitted by /u/Mikina
[link] [comments]