Black Hat Ethical Hacking
QBot returns for a new wave of infections using Squirrelwaffle

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png QBot returns for a new wave of infections using SquirrelwafflePost Views: 112
Reading Time: 1 Minute
The activity of the QBot (also known as Quakbot) banking trojan is spiking again, and analysts from multiple security research firms attribute this to the rise of Squirrelwaffle.
Squirrelwaffle emerged last month as one of the most likely candidates to fill the void left by the take-down of Emotet, and unfortunately, these predictions are quickly being confirmed. A new wave of attacksResearchers at TrendMicro have observed a new distribution campaign for QBot relying on Visual Basic Macros (VBA) macros in Microsoft Word documents sent as attachments in phishing emails.

Previous Qbot campaigns used Excel macros, which are still present in some cases, even if they are more scarce now.
https://www.bleepstatic.com/images/news/u/1220909/Security/qbot%20infections.jpg
<figcaptionAll of QBot’s arrival variations
Source: TrendMicro
See Also: Complete Offensive Security and Ethical Hacking Course
The victim still has to manually open the document and “Enable Content” on their Microsoft Office suite to let the macro code run, dropping a QBot payload on the system.

The rest of the process chain hasn’t changed much compared to previous versions, still downloading a DLL file as the core payload and setting the same scheduled task for persistence as before.

Qbot is also known to partner with ransomware operations to provide them with initial access to a network. QBot has previously collaborated with ransomware gangs to deploy REvil, Egregor, ProLock, PwndLocker, and MegaCortex strains.

We shouldn’t forget that even if these compromises never evolve to file-encryption events, QBot can do significant damage on its own.

The additional modules downloaded by the QBot malware can grab browser cookies, passwords, emails, drop Cobalt Strike, enable lateral movement, and turn the infected machine into a proxy for C2 traffic.
See Also: All Windows versions impacted by new LPE zero-day vulnerability Riding the SquirrelSentinel Labs published a report on the rise of the SquirrelWaffle malware loader, linking it directly to QBot, which is dropped as second stage malware.

Researchers at Minerva Labs have also drawn a similar conclusion, seeing the following delivery scheme:
https://www.bleepstatic.com/images/news/u/1220909/Diagrams/infection%20chain.jpg
<figcaptionSquirrelWaffle’s infection chain
Source: Minerva Labs
See Also: Offensive Security Tool: Pentesting Tools SquirrelWaffle also uses VBA macros to execute a PowerShell command that retrieves its payload and launches it.

Unlike Emotet, who used a wide range of phishing lures, the SquirrelWaffle is not doing a great job creating convincing spam mails, keeping the infections in check.

The creation of more convincing phishing emails could be outsourced or quickly resolved by contacting an expert in that part of phishing operations, leading to a more significant number of SquirrelWaffle infections.
See Also: Hacking stories – Operation Troy – How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/face-malware-virus-infected-red-network-90x90.jpg BotenaGo botnet targets millions of IoT devices with 33 exploits3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.c[...]

om-gif-maker-90x90.jpg Microsoft patches Excel zero-day used in attacks, asks Mac users to wait4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Microsoft-Exchange-90x90.png Microsoft urges Exchange admins to patch bug exploited in the wild5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/b57e07db-82a4-43ef-be64-a15c45b31804-90x90.jpg Robinhood discloses data breach impacting 7 million customers6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Pwn2OwnBlur-90x90.png Pwn2Own – Over 1 million dollars in Bounties, Samsung Galaxy S21 hacked twice, Printer plays AC/DC1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/maxresdefault-1024x576-1-90x90.jpg Microsoft Exchange ProxyShell exploits used to deploy Babuk ransomware1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Mekotio-Banking-Trojan-90x90.png Mekotio Banking Trojan Resurges with Tweaked Code, Stealthy Campaign2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/GitLab-90x90.jpg Over 30,000 GitLab servers still unpatched against critical bug2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/trojan-source-invisible-vulnerabilities-in-most-code-showcase_image-7-a-17833-90x90.jpg ‘Trojan Source’ attack method can hide bugs into open-source code2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-4-90x90.jpg Chaos ransomware targets gamers via fake Minecraft alt lists2 weeks ago
The post QBot returns for a new wave of infections using Squirrelwaffle first appeared on Black Hat Ethical Hacking.

Cumulus - Web Application Weakness Monitoring, It Would Be Working By Add Just 3 Codelines
http://www.kitploit.com/2021/11/cumulus-web-application-weakness.html

Cumulus is a service that helps you monitor and fix security weakness in realtime. The issues will be reported on web dashboard. It's very simple and powerful.

Key features
Just install SDK to web front, can be found security weakness on serviceSDK detect weakness from Inner Layer, dinamically (ex_ DOM Event, XHR Request)Scanner detect weakness from Out Layer, statically (ex_ Crawl of web resources and analysis (https://www.kitploit.com/search/label/Analysis) that)NameOriginDescriptionXSSSDKWhen user input a xss (https://www.kitploit.com/search/label/XSS) pattern string, trigger detection of XSSSQLInjectionSDKWhen user input a sqlinjection pattern, trigger detection of SQLInjectionSensitive PayloadSDKWhen requesting with sensitive payload. for example, unencoded raw passwordFile UploadSDKWhen user embed any file worried for system. for example, web shellUnnecessary CommentScannerCode comments are on the served HTML or JSDirectory TraversalScannerDetect directory listing vulnerabilityGuessingScannerDetect sensitive page like adminUnobfuscated CodeScannerDetect unobfuscated vulnerable (https://www.kitploit.com/search/label/Vulnerable) codesIf you think about able to detect additional weakness, please contribute on SDK or Scanner
Cumulus SDK for JavaScript
The official Cumulus SDK for JavaScript, providing as npmNote: current version is unsupported version on typescript (https://www.kitploit.com/search/label/Typescript) project but we considering now and gonna make it, quickly! (#2 (https://github.com/tophat-cloud/cumulus/issues/2))
Installation
To install a SDK, simply add package like belows:npm install --save https://github.com/tophat-cloud/cumulus
yarn add https://github.com/tophat-cloud/cumulus
Setup and usage of SDK always follow the same principle.import { protect, captureMessage } from 'cumulus';

protect({
key: '__key__',
});

captureMessage('Hello, world!');If you haven't __key__, please sign-up (https://cumulus.tophat.cloud/signup) and create project to get to key
Contents
Official Site (https://cumulus.tophat.cloud/)Contributing (https://github.com/tophat-cloud/cumulus/blob/main/CONTRIBUTING.md)Change log (https://github.com/tophat-cloud/cumulus/blob/main/CHANGELOG.md)OpenSource License (https://cumulus.tophat.cloud/license.html)Documents (https://github.com/tophat-cloud/cumulus/wiki)Roadmap (https://github.com/tophat-cloud/cumulus/projects/1)
Resources
cumulus-scanner (https://github.com/tophat-cloud/cumulus-scanner)cumulus-front (https://github.com/tophat-cloud/cumulus-front)cumulus-back (https://github.com/tophat-cloud/cumulus-back)
Author@Jinny You (http://github.com/tinyjin)  from TopHat

Download Cumulus (https://github.com/tophat-cloud/cumulus)

Hacking on Medium
Tryhackme Bounty hacker writeup

https://cdn-images-1.medium.com/max/665/1*jmHm4TBbDW00n-Kvvmrxwg.png
first we make a nmap scan

Continue reading on Medium »

hacking: security in practice
Where to find scam email datasets?

Any idea where I could get a hold of scam email datasets for an ML project?

submitted by /u/EZ-Claps
[link] [comments]

hacking: security in practice
An 11 yr old did whaaat?

I'm not a hacker, but read this article and wanted to share it and ask...

At 11 yrs old, is it impressive that he was able to do this?

submitted by /u/J_Winn
[link] [comments]

Cumulus - Web Application Weakness Monitoring, It Would Be Working By Add Just 3 Codelines

Cumulus is a service that helps you monitor and fix security weakness in realtime. The issues will be reported on web dashboard. It's very simple and powerful.Key featuresJust install SDK to web front, can be found security weakness on serviceSDK detect weakness from Inner Layer, dinamically (ex DOM Event, XHR Request)Scanner detect weakness from Out Layer, statically (ex Crawl of web resources and analysis that)NameOriginDescriptionXSSSDKWhen user input a xss pattern string, trigger detection of XSSSQLInjectionSDKWhen user input a sqlinjection pattern, trigger detection of SQLInjectionSensitive PayloadSDKWhen requesting with sensitive payload. for example, unencoded raw passwordFile UploadSDKWhen user embed any file worried for system. for example, web shellUnnecessary CommentScannerCode comments are on the served HTML or JSDirectory TraversalScannerDetect directory listing vulnerabilityGuessingScannerDetect sensitive page like adminUnobfuscated CodeScannerDetect unobfuscated vulnerable codesIf you think about able to detect additional weakness, please contribute on SDK or ScannerCumulus SDK for JavaScriptThe official Cumulus SDK for JavaScript, providing as npmNote: current version is unsupported version on typescript project but we considering now and gonna make it, quickly! (#2)InstallationTo install a SDK, simply add package like belows:npm install --save https://github.com/tophat-cloud/cumulusyarn add https://github.com/tophat-cloud/cumulusSetup and usage of SDK always follow the same principle.import { protect, captureMessage } from 'cumulus';protect({ key: 'key',});captureMessage('Hello, world!');If you haven't _key_, please sign-up and create project to get to keyContentsOfficial SiteContributingChange logOpenSource LicenseDocumentsRoadmapResourcescumulus-scannercumulus-frontcumulus-backAuthor@Jinny You from TopHatDownload Cumulus
Read more...

Recon Experience with Trickest #1 — Subdomain Recon Tale in a Graph
https://trickest.medium.com/recon-experience-with-trickest-1-subdomain-recon-tale-in-a-graph-6220b5cf02fb?source=rss------bug_bounty-5

Main goalContinue reading on Medium » (https://trickest.medium.com/recon-experience-with-trickest-1-subdomain-recon-tale-in-a-graph-6220b5cf02fb?source=rss------bug_bounty-5)

KitPloit - PenTest Tools!
Cumulus - Web Application Weakness Monitoring, It Would Be Working By Add Just 3 Codelines

https://blogger.googleusercontent.com/img/a/AVvXsEiB3Ua1ekVkgbUcGdmlO9uxDrvg7MbezEVGZiK2NtUUUXlT3bwCROhxK7E-_WDQo7M7Prqgyo40k9NgSmiQZNBoECBe_5ggsrL4PYcN79WsTIhJPYMYDVpiR19bxK8FNmAdLuusr_L_yErJvw7XeEi4u_TT1sRz_yXwAHkZWqYb4AyQ4rNBKpuILQVlXQ=w640-h160 Cumulus is a service that helps you monitor and fix security weakness in realtime. The issues will be reported on web dashboard. It's very simple and powerful. https://blogger.googleusercontent.com/img/a/AVvXsEgBxMl1d4soZ6kNreqa9QbaoPC--WSnb48nC12tyCR9zVE4CiiNsrtyq_IySeE7Ac16QDcoAreRPqpOHKUbW8fPJmN88Xv_qE_Gk0FTnsvUAAxv31kGQM7KRxYrPYqnKqGEgShrTQRead2cv_zPLOtK9Fra1PvihALO6aQEtymSSdHhhMcWj0vwKodfOg=w640-h346 https://blogger.googleusercontent.com/img/a/AVvXsEg9a7cUxancgqyoztEd9QDrLW8OdlcrS1GTNzH0aulR9BpDNT8v9ay4mF-sDCfX5ofk1it-fTX-AV7tL3JHP-jPBs0hUyaguuyatw0ztstUjwWr8d9ms3blvPZMS7Ua7AFlC_UY6NhWGnO2TMd0GOpmmA_jum6U7-oRpg_Xm8QRfywDNBUDBhJVlcHlpQ=w640-h266 https://blogger.googleusercontent.com/img/a/AVvXsEjywHth1c3tvIevjK4Xu5iVj5LYiFQZTE6oTt7nT60RA2VvijFJwKoPfQ7u8I7nyKs8eCoGPdR7Xr99yUj_zXR_MgJ1dosMIZLkuXeZzU9ZBkrmZAXijTQhob38A1itKTPXeWWHHPxcKWA-stxPq8gcYOClkCp8nSmWgrjIor_q6uUaTUaMh1XGJ45O5A=w640-h368 Key featuresJust install SDK to web front, can be found security weakness on service

* SDK detect weakness from Inner Layer, dinamically (ex_ DOM Event, XHR Request)
* Scanner detect weakness from Out Layer, statically (ex_ Crawl of web resources and analysis that)
NameOriginDescriptionXSSSDKWhen user input a xss pattern string, trigger detection of XSSSQLInjectionSDKWhen user input a sqlinjection pattern, trigger detection of SQLInjectionSensitive PayloadSDKWhen requesting with sensitive payload. for example, unencoded raw passwordFile UploadSDKWhen user embed any file worried for system. for example, web shellUnnecessary CommentScannerCode comments are on the served HTML or JSDirectory TraversalScannerDetect directory listing vulnerabilityGuessingScannerDetect sensitive page like adminUnobfuscated CodeScannerDetect unobfuscated vulnerable codes
If you think about able to detect additional weakness, please contribute on SDK or Scanner Cumulus SDK for JavaScriptThe official Cumulus SDK for JavaScript, providing as npm

Note: current version is unsupported version on typescript project but we considering now and gonna make it, quickly! (#2) InstallationTo install a SDK, simply add package like belows: npm install --save https://github.com/tophat-cloud/cumulus
yarn add https://github.com/tophat-cloud/cumulus Setup and usage of SDK always follow the same principle. import { protect, captureMessage } from 'cumulus';

protect({
key: '__key__',
});

captureMessage('Hello, world!');If you haven't __key__, please sign-up and create project to get to key Contents* Official Site
* Contributing
* Change log
* OpenSource License
* Documents
* Roadmap Resources* cumulus-scanner
* cumulus-front
* cumulus-back Author@Jinny You  from TopHat Download Cumulus➖ Sent by @TheFeedReaderBot ➖