Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
is this legit or if not is there a legit one?
i was wondering if this discord token logger was real it attached to chrome and a discord video i think and took the token https://www.youtube.com/watch?v=d6CGRGhpRc0&ab_channel=smarticaim (if you need me to delete i can)
submitted by /u/killmeplease___25
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
is this legit or if not is there a legit one?
i was wondering if this discord token logger was real it attached to chrome and a discord video i think and took the token https://www.youtube.com/watch?v=d6CGRGhpRc0&ab_channel=smarticaim (if you need me to delete i can)
submitted by /u/killmeplease___25
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
is this legit or if not is there a legit one?
i was wondering if this discord token logger was real it attached to chrome and a discord video i think and took the token...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
This is how I bypassed Cortex XDR
https://cdn-images-1.medium.com/max/754/1*wpTx5UE1_AfRJBw39bG9-A.png
First of all, let me introduce myself, my name is Omri Baso, I'm 24 years old from Israel and I'm a red teamer and security researcher…
Continue reading on Medium »
This is how I bypassed Cortex XDR
https://cdn-images-1.medium.com/max/754/1*wpTx5UE1_AfRJBw39bG9-A.png
First of all, let me introduce myself, my name is Omri Baso, I'm 24 years old from Israel and I'm a red teamer and security researcher…
Continue reading on Medium »
hacking: security in practice
Challenge: How to edit a on original video and produce clips without evidence of tampering?
The Gist:
How would you create 2 clips from an original video source file and make it seem that those 2 new clips are originally from the same recording device (iPhone) and not edited and post-produced in anyway.
Scenario:
If you have a 2 minute video straight from your phone (iOS), and you need to split and trim it to produce two 30 second clips from source, how would you do it so that the videos produce seems original unedited files recorded from your phone and no one could tell it came from a single source file?
Trimming and splitting it and using file naming conventions used by IOS on the new files is not enough because it is not all just in the file name, correct?
1. I understand there is META DATA that may leave clues - right? So can we edit/spoof the meta data to make it seem as if the file was written by iOS phone and not a computer or video editing software?
2. The modified and created dates of the files will be suspicious. Say the original video was taken sept 01, 2021 between 9:00 to 9:02AM, i assume we need to alter the modified / created dates to match the original source accurately, right? Is this possible?
3. Scrub any signatures or traces of the computer and editing software used to edit and produce the clips.
I assume these are the 3 factors that needs top be covered, right? Is there any other factors to consider?
submitted by /u/remivato69
[link] [comments]
Challenge: How to edit a on original video and produce clips without evidence of tampering?
The Gist:
How would you create 2 clips from an original video source file and make it seem that those 2 new clips are originally from the same recording device (iPhone) and not edited and post-produced in anyway.
Scenario:
If you have a 2 minute video straight from your phone (iOS), and you need to split and trim it to produce two 30 second clips from source, how would you do it so that the videos produce seems original unedited files recorded from your phone and no one could tell it came from a single source file?
Trimming and splitting it and using file naming conventions used by IOS on the new files is not enough because it is not all just in the file name, correct?
1. I understand there is META DATA that may leave clues - right? So can we edit/spoof the meta data to make it seem as if the file was written by iOS phone and not a computer or video editing software?
2. The modified and created dates of the files will be suspicious. Say the original video was taken sept 01, 2021 between 9:00 to 9:02AM, i assume we need to alter the modified / created dates to match the original source accurately, right? Is this possible?
3. Scrub any signatures or traces of the computer and editing software used to edit and produce the clips.
I assume these are the 3 factors that needs top be covered, right? Is there any other factors to consider?
submitted by /u/remivato69
[link] [comments]
reddit
Challenge: How to edit a on original video and produce clips...
The Gist: How would you create 2 clips from an original video source file and make it seem that those 2 new clips are originally from the same...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
My story : How I get started in Cyber Security & How can you…
https://cdn-images-1.medium.com/max/600/1*NVII6KbY6kVnXp1sPzte2Q.jpeg
Hi readers, hope everyone’s doing fine and learning something continuously. It’s been a while since I published my last article on Nmap…
Continue reading on Medium »
My story : How I get started in Cyber Security & How can you…
https://cdn-images-1.medium.com/max/600/1*NVII6KbY6kVnXp1sPzte2Q.jpeg
Hi readers, hope everyone’s doing fine and learning something continuously. It’s been a while since I published my last article on Nmap…
Continue reading on Medium »
hacking: security in practice
How to get into ethical hacking without an IT background?
Been a dj/ techy all my life. Looking to make a couole changes, any help??
submitted by /u/Heavy_Revolution2973
[link] [comments]
How to get into ethical hacking without an IT background?
Been a dj/ techy all my life. Looking to make a couole changes, any help??
submitted by /u/Heavy_Revolution2973
[link] [comments]
reddit
How to get into ethical hacking without an IT background?
A subreddit dedicated to hacking and hackers. Constructive collaboration and learning about exploits, industry standards, grey and white hat...
hacking: security in practice
Getting better on CTFs
Hello all.
I've recently been paying more attention to Windows boxes and gaining system access on Windows as Windows machines are one of my weaker points but I want to apply my question to any system.
How do you guys learn? What makes you better? Any tips? Are reading writeups okay if you struggle?
submitted by /u/kebabogenerolas
[link] [comments]
Getting better on CTFs
Hello all.
I've recently been paying more attention to Windows boxes and gaining system access on Windows as Windows machines are one of my weaker points but I want to apply my question to any system.
How do you guys learn? What makes you better? Any tips? Are reading writeups okay if you struggle?
submitted by /u/kebabogenerolas
[link] [comments]
reddit
Getting better on CTFs
Hello all. I've recently been paying more attention to Windows boxes and gaining system access on Windows as Windows machines are one of my...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Gaming Industry Plagued by Hackers
https://cdn-images-1.medium.com/max/1920/1*XCiWmVIpkc8Em2RJYlUKsQ.jpeg
Given that the gaming industry continues to be plagued by hackers we felt it was time to address the very public attacks on several…
Continue reading on Medium »
Gaming Industry Plagued by Hackers
https://cdn-images-1.medium.com/max/1920/1*XCiWmVIpkc8Em2RJYlUKsQ.jpeg
Given that the gaming industry continues to be plagued by hackers we felt it was time to address the very public attacks on several…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Så blir du hackad
https://cdn-images-1.medium.com/max/900/0*C7dX4v8v3u_ct8dK.jpg
Så blir du hackad — Nog finns det ett heroiskt sken över fenomenet med fingerfärdiga och datakunniga hackers. Detta bottnar förmodligen i…
Continue reading on Medium »
Så blir du hackad
https://cdn-images-1.medium.com/max/900/0*C7dX4v8v3u_ct8dK.jpg
Så blir du hackad — Nog finns det ett heroiskt sken över fenomenet med fingerfärdiga och datakunniga hackers. Detta bottnar förmodligen i…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Microsoft Exchange ProxyShell exploits used to deploy Babuk ransomware
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange ProxyShell exploits used to deploy Babuk ransomwarePost Views: 147
Reading Time: 1 Minute
A new threat actor is hacking Microsoft Exchange servers and breaching corporate networks using the ProxyShell vulnerability to deploy the Babuk Ransomware.
The ProxyShell attacks against vulnerable Microsoft Exchange servers started several months ago, with LockFile and Conti being among the first ransomware groups to exploit them.
According to a report by researchers at Cisco Talos, a Babuk ransomware affiliate known as ‘Tortilla’ had joined the club in October, when the actor started using the ‘China Chopper’ web shell on breached Exchange servers.
The name Tortilla is based on malicious executables spotted in campaigns using the name Tortilla.exe. Starts with ExchangeThe Babuk ransomware attack starts with a DLL, or .NET executable dropped on the Exchange server using the ProxyShell vulnerability.
The Exchange IIS worker process w3wp.exe then executes this malicious payload to execute obfuscated PowerShell command that features endpoint protection bypassing, eventually invoking a web request to fetch a payload loader named ‘tortilla.exe.’
This loader will connect to ‘pastebin.pl’ and download a payload that is loaded into memory and injected into a NET Framework process, which ultimately encrypts the device with the Babuk Ransomware.
https://www.bleepstatic.com/images/news/u/1220909/ransomware/stages.jpg
<figcaptionInfection chain diagram
Source: Cisco See Also: Complete Offensive Security and Ethical Hacking Course Although Cisco analysts found evidence of ProxyShell vulnerability exploitation in most infections, most notably the ‘China Chopper’ web shell, the telemetry data reflects a broad spectrum of attempted exploits.
More specifically, Tortilla followed these pathways to drop the DLL and .NET modules:
* Microsoft Exchange auto-discover server-side request forgery attempt
* Atlassian Confluence OGNL injection remote code execution attempt
* Apache Struts remote code execution attempt
* WordPress wp-config.php access via directory traversal attempt
* SolarWinds Orion authentication bypass attempt
* Oracle WebLogic Server remote command execution attempt
* Liferay arbitrary Java object deserialization attempt
As these attacks rely on patched vulnerabilities, it is strongly advised that all admins upgrade their servers to the latest versions to prevent them from being exploited in attacks. Using Babuk in new attacksBabuk Locker is a ransomware operation launched at the beginning of 2021 when it began targeting businesses and encrypting their data in double-extortion attacks.
After conducting an attack on the Washinton DC’s Metropolitan Police Department (MPD), and feeling the heat from U.S. law enforcement, the ransomware gang shut down their operation.
After the source code for the first version of Babuk and a builder were leaked on hacking forums, other threat actors began utilizing the ransomware to launch their own attacks.
It is unclear if Tortilla was an affiliate of Babuk back when the RaaS was active or if they just grabbed the strain’s source code when it came out to conduct new attacks.
However, as the ransom note used in these attacks ask for a low $10,000 in Monero, it is likely not conducted by the original Babuk operation, who demanded far larger ransomware in Bitcoin.
https://www.bleepstatic.com/images/news/u/1220909/ransomware/ransom%20note.png
<figcaptio[...]
Microsoft Exchange ProxyShell exploits used to deploy Babuk ransomware
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange ProxyShell exploits used to deploy Babuk ransomwarePost Views: 147
Reading Time: 1 Minute
A new threat actor is hacking Microsoft Exchange servers and breaching corporate networks using the ProxyShell vulnerability to deploy the Babuk Ransomware.
The ProxyShell attacks against vulnerable Microsoft Exchange servers started several months ago, with LockFile and Conti being among the first ransomware groups to exploit them.
According to a report by researchers at Cisco Talos, a Babuk ransomware affiliate known as ‘Tortilla’ had joined the club in October, when the actor started using the ‘China Chopper’ web shell on breached Exchange servers.
The name Tortilla is based on malicious executables spotted in campaigns using the name Tortilla.exe. Starts with ExchangeThe Babuk ransomware attack starts with a DLL, or .NET executable dropped on the Exchange server using the ProxyShell vulnerability.
The Exchange IIS worker process w3wp.exe then executes this malicious payload to execute obfuscated PowerShell command that features endpoint protection bypassing, eventually invoking a web request to fetch a payload loader named ‘tortilla.exe.’
This loader will connect to ‘pastebin.pl’ and download a payload that is loaded into memory and injected into a NET Framework process, which ultimately encrypts the device with the Babuk Ransomware.
https://www.bleepstatic.com/images/news/u/1220909/ransomware/stages.jpg
<figcaptionInfection chain diagram
Source: Cisco See Also: Complete Offensive Security and Ethical Hacking Course Although Cisco analysts found evidence of ProxyShell vulnerability exploitation in most infections, most notably the ‘China Chopper’ web shell, the telemetry data reflects a broad spectrum of attempted exploits.
More specifically, Tortilla followed these pathways to drop the DLL and .NET modules:
* Microsoft Exchange auto-discover server-side request forgery attempt
* Atlassian Confluence OGNL injection remote code execution attempt
* Apache Struts remote code execution attempt
* WordPress wp-config.php access via directory traversal attempt
* SolarWinds Orion authentication bypass attempt
* Oracle WebLogic Server remote command execution attempt
* Liferay arbitrary Java object deserialization attempt
As these attacks rely on patched vulnerabilities, it is strongly advised that all admins upgrade their servers to the latest versions to prevent them from being exploited in attacks. Using Babuk in new attacksBabuk Locker is a ransomware operation launched at the beginning of 2021 when it began targeting businesses and encrypting their data in double-extortion attacks.
After conducting an attack on the Washinton DC’s Metropolitan Police Department (MPD), and feeling the heat from U.S. law enforcement, the ransomware gang shut down their operation.
After the source code for the first version of Babuk and a builder were leaked on hacking forums, other threat actors began utilizing the ransomware to launch their own attacks.
It is unclear if Tortilla was an affiliate of Babuk back when the RaaS was active or if they just grabbed the strain’s source code when it came out to conduct new attacks.
However, as the ransom note used in these attacks ask for a low $10,000 in Monero, it is likely not conducted by the original Babuk operation, who demanded far larger ransomware in Bitcoin.
https://www.bleepstatic.com/images/news/u/1220909/ransomware/ransom%20note.png
<figcaptio[...]
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Microsoft Exchange ProxyShell exploits used to deploy Babuk ransomware https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange ProxyShell exploits used to deploy Babuk ransomwarePost…
nTortilla’s ransom note
Source: Cisco
See Also: All Windows versions impacted by new LPE zero-day vulnerability Targeting the USAAlthough Talos researchers noticed some attacks in Germany, Thailand, Brazil, and the U.K., most of Tortilla’s targets are U.S.-based.
The I.P. address of the download server is located in Moscow, Russia, which could indicate the origin of these attacks, but there are no attribution conclusions in the report.
Also, the ‘pastebin.pl’ domain used for the unpacking stage has been previously abused by AgentTesla and FormBook distribution campaigns.
https://www.bleepstatic.com/images/news/u/1220909/ransomware/victim%20map.jpg
<figcaptionVictim heatmap
Source: Cisco
See Also: Offensive Security Tool: ZipExec While a decryptor was previously released for Babuk ransomware, it can only decrypt victims whose private keys were part of the source code leak.
Therefore, threat actors can continue to use the Babuk ransomware strain to launch their own operations, such as what we are seeing with the Tortilla threat actor.
See Also: Hacking stories – Operation Troy – How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Mekotio-Banking-Trojan-90x90.png Mekotio Banking Trojan Resurges with Tweaked Code, Stealthy Campaign1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/GitLab-90x90.jpg Over 30,000 GitLab servers still unpatched against critical bug2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/trojan-source-invisible-vulnerabilities-in-most-code-showcase_image-7-a-17833-90x90.jpg ‘Trojan Source’ attack method can hide bugs into open-source code3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-4-90x90.jpg Chaos ransomware targets gamers via fake Minecraft alt lists4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png All Windows versions impacted by new LPE zero-day vulnerability1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/social_preview-scaled-90x90.jpg Sensitive data of 400,000 German students exposed by API flaw1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/hacked-90x90.jpg Brutal WordPress plugin bug allows subscribers to wipe sites1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-5-90x90.jpg Hackers used billing software zero-day to deploy ransomware1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-4-90x90.jpg Popular NPM library hijacked to install password-stealers, miners2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/youtube-logo-90x90.jpg Massive campaign uses YouTube to push password-stealing malware2 weeks ago
The post Microsoft Exchange ProxyShell exploits used to deploy Babuk ransomware first appeared on Black Hat Ethical Hacking.
Source: Cisco
See Also: All Windows versions impacted by new LPE zero-day vulnerability Targeting the USAAlthough Talos researchers noticed some attacks in Germany, Thailand, Brazil, and the U.K., most of Tortilla’s targets are U.S.-based.
The I.P. address of the download server is located in Moscow, Russia, which could indicate the origin of these attacks, but there are no attribution conclusions in the report.
Also, the ‘pastebin.pl’ domain used for the unpacking stage has been previously abused by AgentTesla and FormBook distribution campaigns.
https://www.bleepstatic.com/images/news/u/1220909/ransomware/victim%20map.jpg
<figcaptionVictim heatmap
Source: Cisco
See Also: Offensive Security Tool: ZipExec While a decryptor was previously released for Babuk ransomware, it can only decrypt victims whose private keys were part of the source code leak.
Therefore, threat actors can continue to use the Babuk ransomware strain to launch their own operations, such as what we are seeing with the Tortilla threat actor.
See Also: Hacking stories – Operation Troy – How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Mekotio-Banking-Trojan-90x90.png Mekotio Banking Trojan Resurges with Tweaked Code, Stealthy Campaign1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/GitLab-90x90.jpg Over 30,000 GitLab servers still unpatched against critical bug2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/trojan-source-invisible-vulnerabilities-in-most-code-showcase_image-7-a-17833-90x90.jpg ‘Trojan Source’ attack method can hide bugs into open-source code3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-4-90x90.jpg Chaos ransomware targets gamers via fake Minecraft alt lists4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png All Windows versions impacted by new LPE zero-day vulnerability1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/social_preview-scaled-90x90.jpg Sensitive data of 400,000 German students exposed by API flaw1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/hacked-90x90.jpg Brutal WordPress plugin bug allows subscribers to wipe sites1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-5-90x90.jpg Hackers used billing software zero-day to deploy ransomware1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-4-90x90.jpg Popular NPM library hijacked to install password-stealers, miners2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/youtube-logo-90x90.jpg Massive campaign uses YouTube to push password-stealing malware2 weeks ago
The post Microsoft Exchange ProxyShell exploits used to deploy Babuk ransomware first appeared on Black Hat Ethical Hacking.
PyRDP - RDP Monster-In-The-Middle (Mitm) And Library For Python With The Ability To Watch Connections Live Or After The Fact
http://www.kitploit.com/2021/11/pyrdp-rdp-monster-in-middle-mitm-and.html
http://www.kitploit.com/2021/11/pyrdp-rdp-monster-in-middle-mitm-and.html
PyRDP is a Python Remote Desktop Protocol (https://www.kitploit.com/search/label/Remote%20Desktop%20Protocol) (RDP) Monster-in-the-Middle (MITM) tool and library.
It features a few tools: RDP Monster-in-the-Middle Logs credentials used when connecting Steals data copied to the clipboard Saves a copy of the files transferred over the network Crawls shared drives in the background and saves them locally Saves replays of connections so you can look at them later Runs console commands or PowerShell payloads automatically on new connections RDP Player: See live RDP connections coming from the MITM View replays of RDP connections Take control of active RDP sessions while hiding your actions List the client's mapped drives and download files from them during active sessions RDP Certificate Cloner: Create a self-signed X509 certificate with the same fields as an RDP server's certificate PyRDP was introduced in 2018 (https://www.gosecure.net/blog/2018/12/19/rdp-man-in-the-middle-smile-youre-on-camera) in which we demonstrated that we can catch a real threat actor in action (https://www.youtube.com/watch?v=eB7RC9FmL6Q). This tool is being developed with both pentest and malware research use cases in mind.
It features a few tools: RDP Monster-in-the-Middle Logs credentials used when connecting Steals data copied to the clipboard Saves a copy of the files transferred over the network Crawls shared drives in the background and saves them locally Saves replays of connections so you can look at them later Runs console commands or PowerShell payloads automatically on new connections RDP Player: See live RDP connections coming from the MITM View replays of RDP connections Take control of active RDP sessions while hiding your actions List the client's mapped drives and download files from them during active sessions RDP Certificate Cloner: Create a self-signed X509 certificate with the same fields as an RDP server's certificate PyRDP was introduced in 2018 (https://www.gosecure.net/blog/2018/12/19/rdp-man-in-the-middle-smile-youre-on-camera) in which we demonstrated that we can catch a real threat actor in action (https://www.youtube.com/watch?v=eB7RC9FmL6Q). This tool is being developed with both pentest and malware research use cases in mind.