The purpose of this module is to automate the deployment of an Active Directory (https://www.kitploit.com/search/label/Active%20Directory) lab for practicing internal penetration testing. Credits to Joe Helle (https://twitter.com/joehelle) and his PowerShell for (https://github.com/dievus/PowerShellForPentesters/)Pentesters (https://www.kitploit.com/search/label/Pentesters) course regarding the generation of the attack vectors.
Instructions

Preparation

Optional but recommended: Move Module into PSModulePath
# Display PSModulePath
$env:PSModulePath.split(";")

# Move module to path
Move-Item .\ADLab\ "C:\Windows\system32\WindowsPowerShell\v1.0\Modules\"
Import-Module
# Import global module
Import-Module ADLab

# Import local module
Import-Module .\ADLab.psm1
Initial Lab Setup

Invoke-DCPrep
This function prepares the current VM/computer to be used as a domain controller (https://www.kitploit.com/search/label/Domain%20Controller) for the new forest. It sets a static IP address, sets the DNS server to be the localhost and renames the computer. # Prepare the current VM with all default values while displaying verbose output
Invoke-DCPrep -Verbose

# Set custom hostname and use Google DNS for Internet access
Invoke-DCPrep -Hostname "DC" -NewIPv4DNSServer "8.8.8.8"

# Use custom IP and default gateway and display verbose output
Invoke-DCPrep -Verbose -NewIPv4Address "192.168.1.99" -NewIPv4Gateway "192.168.1.1"
Invoke-ForestDeploy
The function installs the AD DS feature and sets up a new Active Directory forest, without requiring any user input. Restarts the computer upon completion. # Installs a new forest with FQDN of "bufu-sec.local" with default DSRM password of "Password!"
Invoke-ForestDeploy -Domain bufu-sec.local

# Installs a new forest with FQDN of "bufu-sec.local" with the DSRM password set to "P@ssword!" and displaying debug messages
Invoke-ForestDeploy -Domain "bufu-sec.local" -DSRMPassword "P@ssword!" -Verbose
Invoke-DNSDeploy
The function begins by installing the DNS feature. It then adds the primary zone and configures the server forwarder. # Install and configure DNS on the current host and display verbose output.
Invoke-DNSDeploy -Verbose -NetworkID 192.168.47.0/24 -ZoneFile "192.168.47.2.in-addr.arpa.dns" -ServerForwarder 1.1.1.1
Invoke-DHCPDeploy
The function begins by installing the DHCP feature on the current machine. It then adds the necesarry security groups and authorizes the new DHCP server with the domain controller. Finally, it configures the new DHCP scope with the supplied values. # Install and configure DHCP on the local DC.
Invoke-DHCPDeploy -Verbose -ScopeName "Default" -ScopeID 192.168.47.0 -StartIP 192.168.47.100 -EndIP 192.168.47.200 -SubnetMask 255.255.255.0 -DNSServer 192.168.47.10 -Router 192.168.47.10

# Install and configure DHCP on the specified DC.
Invoke-DHCPDeploy -Verbose -ScopeName "Default" -ScopeID 192.168.47.0 -StartIP 192.168.47.100 -EndIP 192.168.47.200 -SubnetMask 255.255.255.0 -DNSServer 192.168.47.10 -Router 192.168.47.10 -DCFQDN DC01.bufu-sec.local
Content

Invoke-ADLabFill
The function begins by creating the groups and OUs defined in the global Groups variable. It then generates 10 user objects for each OU by default. # Fill forest with objects and display verbose output
Invoke-ADLabConfig -Verbose

# Create 50 users for each OU and display verbose output
Invoke-ADLabConfig -Verbose -UserCount 50
Attack Vectors

Set-ASREPRoasting
The function gets a certain amount of random user from the domain and sets the DoesNotRequirePreAuth flag for each. Excludes default accounts like Administrator and krbtgt. Makes 5% of users ASREP-Roastable by default. # Make 5% of users ASREP-Roastable and display verbose output
Set-ASREPRoasting -Verbose

# Make 10 random users in the domain ASREP-Roastable
Set-ASREPRoasting -VulnerableUsersCount 10

# Make user bufu ASREP-Roastable and display verbose output
Set-ASREPRoasting -Users bufu -Verbose

___________________________
@hacking_Attack
@Hacking_Video

# Make supplied list of users ASREP-roastable and display verbose output
Set-ASREPRoasting -Users ("bufu", "pepe") -Verbose
Set-Kerberoasting
The function gets a certain amount of random user from the domain and adds a SPN for each. Excludes default accounts like Administrator and krbtgt. Makes 5% of users kerberoastable by default. # Make 5% of users ASREP-Roastable and display verbose output
Set-Kerberoasting -Verbose

# Make 10 random users in the domain ASREP-Roastable
Set-Kerberoasting -VulnerableUsersCount 10

# Make user bufu ASREP-Roastable and display verbose output
Set-Kerberoasting -Users bufu -Verbose

# Make supplied list of users ASREP-roastable and display verbose output
Set-Kerberoasting -Users ("bufu", "pepe") -Verbose
Set-BadACLs
The function begins by granting the Chads group GenericAll rights on the Domain Admins. It then grants the Degens group GenericALl rights on the Chads group. Finally, it grants GenericAll rights on some users from the Degens group to some users of the Normies group. vulnerable ACLs and display verbose output Set-BadACLs -Verbose "># Create vulnerable ACLs and display verbose output
Set-BadACLs -Verbose
Set-PSRemoting
The function first configures GPO to allow WinRM over TCP port 5985 to domain-joined systems. It then enables PS Remoting through GPO. # Enable PS Remoting and display verbose output
Set-PSRemoting -Verbose

Download ADLab (https://github.com/xbufu/ADLab)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Burp suite pro worth it?

Tldr: is burp suite professional with $400

I'm still kinda new to bug bounty hunting and I really want to use automated tools to make it easier. I have used burp suite community and it's fairly strait forward but it looks like the pro version has a ton of automation tools that could make it easier. So anyone who has used it, is it worth it? What are the tools like and do they ever run it on sale? Thanks

submitted by /u/knockout350
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Check Every IP detail and User-Agent as well Free Service: WhatLeaks.site

Whatleaks was a very popular service to check DNS leaks and IP address leaks if there are any and to check what type of data is still being shared. Since it has gone down I am trying to make another one.
https://whatleaks.site/
Right now you can see the details about your IP address below but I am adding more very soon just wanted to share
Details IP Address: Country Name: Country Code: Region Code: Region Name: City: Zipcode: Latitude: Longitude: Time Zone: User Agent:
submitted by /u/Acrobatic_Stretch_27
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Advice on getting into a deceased person's phone. (Legally my phone now) .

My dad died in a few months ago and the police disabled his phone trying to access it. So now it is telling me to connect to iTunes. I don't have any of his information to do that. Unlocking the phone could be the difference in getting justice for his death or not. Please help if you have experience with iPhone recovery. Thank you.

submitted by /u/pi35
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Sunset1: Vulnhub Walkthrough

https://cdn-images-1.medium.com/max/746/0*6RXkeMt-BxiPr8t9.png
Merhabalar,

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack The Box: Impossible Password Reverse Engineering Challenge

https://cdn-images-1.medium.com/max/655/0*mTnS5LlyKPF3Vp6g
This week I’m going to be completing the impossible password reverse engineering challenge from Hack The Box. This challenge is ranked…

Continue reading on TestingOnProd »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
ADLab - Custom PowerShell Module To Setup An Active Directory Lab Environment To Practice Penetration Testing

https://blogger.googleusercontent.com/img/a/AVvXsEgXmtgNezfGhzNghppnMEKs3PxCeR8g1kRECDwULkfVOmzWi45WZjZ1Wdr4-MCIitjAwf8wavmb5s6RX1fFS9318IbTmosRcrVKSDxgOevNEQnzK5sff3TJy2wvuO6WaMPpmzsL26PQU-MmEYR560NcuBPOLcVzr-P9wX6WJl9hu6LNDj9vqtJdzoL-rw=w640-h314 The purpose of this module is to automate the deployment of an Active Directory lab for practicing internal penetration testing.

Credits to Joe Helle and his PowerShell for Pentesters course regarding the generation of the attack vectors. InstructionsPreparationOptional but recommended: Move Module into PSModulePath# Display PSModulePath
$env:PSModulePath.split(";")

# Move module to path
Move-Item .\ADLab\ "C:\Windows\system32\WindowsPowerShell\v1.0\Modules\"Import-Module# Import global module
Import-Module ADLab

# Import local module
Import-Module .\ADLab.psm1Initial Lab SetupInvoke-DCPrepThis function prepares the current VM/computer to be used as a domain controller for the new forest. It sets a static IP address, sets the DNS server to be the localhost and renames the computer. # Prepare the current VM with all default values while displaying verbose output
Invoke-DCPrep -Verbose

# Set custom hostname and use Google DNS for Internet access
Invoke-DCPrep -Hostname "DC" -NewIPv4DNSServer "8.8.8.8"

# Use custom IP and default gateway and display verbose output
Invoke-DCPrep -Verbose -NewIPv4Address "192.168.1.99" -NewIPv4Gateway "192.168.1.1"Invoke-ForestDeployThe function installs the AD DS feature and sets up a new Active Directory forest, without requiring any user input. Restarts the computer upon completion. # Installs a new forest with FQDN of "bufu-sec.local" with default DSRM password of "Password!"
Invoke-ForestDeploy -Domain bufu-sec.local

# Installs a new forest with FQDN of "bufu-sec.local" with the DSRM password set to "P@ssword!" and displaying debug messages
Invoke-ForestDeploy -Domain "bufu-sec.local" -DSRMPassword "P@ssword!" -VerboseInvoke-DNSDeployThe function begins by installing the DNS feature. It then adds the primary zone and configures the server forwarder. # Install and configure DNS on the current host and display verbose output.
Invoke-DNSDeploy -Verbose -NetworkID 192.168.47.0/24 -ZoneFile "192.168.47.2.in-addr.arpa.dns" -ServerForwarder 1.1.1.1Invoke-DHCPDeployThe function begins by installing the DHCP feature on the current machine. It then adds the necesarry security groups and authorizes the new DHCP server with the domain controller. Finally, it configures the new DHCP scope with the supplied values. # Install and configure DHCP on the local DC.
Invoke-DHCPDeploy -Verbose -ScopeName "Default" -ScopeID 192.168.47.0 -StartIP 192.168.47.100 -EndIP 192.168.47.200 -SubnetMask 255.255.255.0 -DNSServer 192.168.47.10 -Router 192.168.47.10

# Install and configure DHCP on the specified DC.
Invoke-DHCPDeploy -Verbose -ScopeName "Default" -ScopeID 192.168.47.0 -StartIP 192.168.47.100 -EndIP 192.168.47.200 -SubnetMask 255.255.255.0 -DNSServer 192.168.47.10 -Router 192.168.47.10 -DCFQDN DC01.bufu-sec.localContentInvoke-ADLabFillThe function begins by creating the groups and OUs defined in the global Groups variable. It then generates 10 user objects for each OU by default. # Fill forest with objects and display verbose output
Invoke-ADLabConfig -Verbose

# Create 50 users for each OU and display verbose output
Invoke-ADLabConfig -Verbose -UserCount 50Attack VectorsSet-ASREPRoastingThe function gets a certain amount of random user from the domain and sets the DoesNotRequirePreAuth flag for ea[...]

ch. Excludes default accounts like Administrator and krbtgt. Makes 5% of users ASREP-Roastable by default. # Make 5% of users ASREP-Roastable and display verbose output
Set-ASREPRoasting -Verbose

# Make 10 random users in the domain ASREP-Roastable
Set-ASREPRoasting -VulnerableUsersCount 10

# Make user bufu ASREP-Roastable and display verbose output
Set-ASREPRoasting -Users bufu -Verbose

# Make supplied list of users ASREP-roastable and display verbose output
Set-ASREPRoasting -Users ("bufu", "pepe") -VerboseSet-KerberoastingThe function gets a certain amount of random user from the domain and adds a SPN for each. Excludes default accounts like Administrator and krbtgt. Makes 5% of users kerberoastable by default. # Make 5% of users ASREP-Roastable and display verbose output
Set-Kerberoasting -Verbose

# Make 10 random users in the domain ASREP-Roastable
Set-Kerberoasting -VulnerableUsersCount 10

# Make user bufu ASREP-Roastable and display verbose output
Set-Kerberoasting -Users bufu -Verbose

# Make supplied list of users ASREP-roastable and display verbose output
Set-Kerberoasting -Users ("bufu", "pepe") -VerboseSet-BadACLsThe function begins by granting the Chads group GenericAll rights on the Domain Admins. It then grants the Degens group GenericALl rights on the Chads group. Finally, it grants GenericAll rights on some users from the Degens group to some users of the Normies group.

vulnerable ACLs and display verbose output Set-BadACLs -Verbose "># Create vulnerable ACLs and display verbose output
Set-BadACLs -Verbose Set-PSRemotingThe function first configures GPO to allow WinRM over TCP port 5985 to domain-joined systems. It then enables PS Remoting through GPO. # Enable PS Remoting and display verbose output
Set-PSRemoting -VerboseDownload ADLab

Dark Reading: Attacks/Breaches
Female-Founded Cybersecurity Startup Wabbi Raises Over $2M in Seed Funding

Wabbi enables companies to assimilate application security processes into development pipelines to produce and scale application security across enterprises.

Dark Reading: Attacks/Breaches
China Hosts More Malware Than Russia: Findings from DNSFilter's 2021 Domain Threat Report

Cryptomining has also had a resurgence over the last year as blockchain technology and NFTs rise in popularity.

Dark Reading: Attacks/Breaches
Microsoft Expands Security to AWS in Multicloud Push

Microsoft will expand its cloud security tools to AWS within a suite called Defender for Cloud and launch a new Defender for Business in preview later this month.

Dark Reading: Attacks/Breaches
Laika Raises $35M Series B to Help Companies Prepare for Security Audits

Laika helps companies establish robust compliance practices to meet the strict requirements from regulators and enterprise customers.

Dark Reading: Attacks/Breaches
FBI: Ransomware Actors Use Financial Events to Extort Victims

Attackers research financial information about an organization and threaten to disclose it if they don't receive ransom quickly.