o has notified Alibaba of its findings but hasn’t received a response yet.

If you are using Alibaba’s cloud service, ensure that your security settings are correct and follow best practices.

Moreover, avoid running apps under root privilege, use cryptographic keys for access, and follow the principle of least privilege.

In the case of ECS, its built-in malware protection isn’t enough, so adding a second layer of detection for malware and vulnerabilities on the cloud environment should be part of your standard security practice.
See Also: Hacking stories – Operation Troy – How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-1-90x90.jpg QBot returns for a new wave of infections using Squirrelwaffle1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/face-malware-virus-infected-red-network-90x90.jpg BotenaGo botnet targets millions of IoT devices with 33 exploits4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-90x90.jpg Microsoft patches Excel zero-day used in attacks, asks Mac users to wait5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Microsoft-Exchange-90x90.png Microsoft urges Exchange admins to patch bug exploited in the wild6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/b57e07db-82a4-43ef-be64-a15c45b31804-90x90.jpg Robinhood discloses data breach impacting 7 million customers1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Pwn2OwnBlur-90x90.png Pwn2Own – Over 1 million dollars in Bounties, Samsung Galaxy S21 hacked twice, Printer plays AC/DC1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/maxresdefault-1024x576-1-90x90.jpg Microsoft Exchange ProxyShell exploits used to deploy Babuk ransomware2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Mekotio-Banking-Trojan-90x90.png Mekotio Banking Trojan Resurges with Tweaked Code, Stealthy Campaign2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/GitLab-90x90.jpg Over 30,000 GitLab servers still unpatched against critical bug2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/trojan-source-invisible-vulnerabilities-in-most-code-showcase_image-7-a-17833-90x90.jpg ‘Trojan Source’ attack method can hide bugs into open-source code2 weeks ago
The post Alibaba ECS instances actively hijacked by cryptomining malware first appeared on Black Hat Ethical Hacking.

Fhex - A Full-Featured HexEditor
http://www.kitploit.com/2021/11/fhex-full-featured-hexeditor.html

This project is born with the aim to develop a lightweight, but useful tool. The reason is that the existing hex editors have some different limitations (e.g. too many dependencies, missing hex coloring features, etc.).

 This project is based on qhexedit2, capstone and keystone engines. New features could be added in the future, PRs are welcomed.
Features
Chunks loader - Used to load only a portion of large files without exhaust the memory (use alt + left/right arrows to move among chunks). Please note that in chunk mode, all the operations (https://www.kitploit.com/search/label/Operations) (e.g. search) applies only to the current chunk except for file save (the entire file is saved). However, each time you edit a chunk, save it before to move to another chunk, otherwise you will lose your changes.Search and replace (UTF-8, HEX, regex, reverse search supported) [CTRL + F]Colored output (white spaces, ASCII characters, 0xFF, UTF-8 and NULL bytes have different colors)Interpret selected bytes as integer, long, unsigned long [CTRL + B]Copy & Paste [CTRL + C and CTRL + V]Copy selected unicode characters [CTRL + Space]Zeroing all the selected bytes [Delete or CTRL + D]Undo & Redo [CTRL + Z and CTRL + Y]Drag & Drop (Hint: Drag&Drop two files to diff them)Overwrite the same file or create a new one [CTRL + S]Goto offset [CTRL + G]Insert mode supported in order to insert new bytes instead to overwrite the existing one [INS]Create new instances [CTRL + N]Basic text viewer for the selected text [CTRL + T]Reload the current file [F5]Compare two different files at byte levelBrowsable Binary Chart (see later for details) [F1]Hex - Dec number converter (https://www.kitploit.com/search/label/Converter) [F2]Hex String escaper (e.g from 010203 to \x01\x02\x03) [F3]Pattern Matching Engine (see later for details)Disassebler based on Capstone Engine (https://www.kitploit.com/search/label/Capstone%20Engine) [F4]Assembler based on Keystone Engine (https://www.kitploit.com/search/label/Keystone%20Engine) [F4]Zoom-Out/Zoom-In bytes view (CTRL + Up/Down or CTRL + -/+)Shortcuts for all these features
Pattern Matching Engine
Fhex can load at startup a configuration file (from ~/fhex/config.json) in JSON format with a list of strings or bytes to highlight and a comment/label to add close to the matches.Examples:{
"PatternMatching":
[
{
"string" : "://www.",
"color" : "rgba(250,200,200,50)",
"message" : "Found url"
},
{
"bytes" : "414243",
"color" : "rgba(250,200,200,50)",
"message" : "Found ABC"
}
]
}To activate pattern matching (https://www.kitploit.com/search/label/Pattern%20Matching) press CTRL + PAt the end, Fhex will show also an offset list with all the result references. Note: Labels with comments are added only if the window is maximized, if labels are not displayed correctly please try to run pattern matching again.
Binary Chart
Fhex has the feature to chart the loaded binary file (Note: In order to compile the project, now you need also qt5-charts installed on the system). The y-axis range is between 0 and 255 (in hex 0x0 and 0xff, i.e. the byte values). The x-axis range is between 0 and the filesize.The chart plots the byte values of the binary file and let you focus only on the relevant sections. For example, if in a binary file there is an area full of null bytes, you can easily detect it from the chart.
License
GPL-3

Download Fhex (https://github.com/echo-devim/fhex)

Hacking on Medium
FBI email was accessed by a hacker who spammed many people

FBI email got hacked and the hacker used the server to spam many people

Continue reading on Medium »

Fhex - A Full-Featured HexEditor

This project is born with the aim to develop a lightweight, but useful tool. The reason is that the existing hex editors have some different limitations (e.g. too many dependencies, missing hex coloring features, etc.). This project is based on qhexedit2, capstone and keystone engines. New features could be added in the future, PRs are welcomed.FeaturesChunks loader - Used to load only a portion of large files without exhaust the memory (use alt + left/right arrows to move among chunks). Please note that in chunk mode, all the operations (e.g. search) applies only to the current chunk except for file save (the entire file is saved). However, each time you edit a chunk, save it before to move to another chunk, otherwise you will lose your changes.Search and replace (UTF-8, HEX, regex, reverse search supported) CTRL + FColored output (white spaces, ASCII characters, 0xFF, UTF-8 and NULL bytes have different colors)Interpret selected bytes as integer, long, unsigned long CTRL + BCopy & Paste CTRL + C and CTRL + VCopy selected unicode characters CTRL + SpaceZeroing all the selected bytes Delete or CTRL + DUndo & Redo CTRL + Z and CTRL + YDrag & Drop (Hint: Drag&Drop two files to diff them)Overwrite the same file or create a new one CTRL + SGoto offset CTRL + GInsert mode supported in order to insert new bytes instead to overwrite the existing one INSCreate new instances CTRL + NBasic text viewer for the selected text CTRL + TReload the current file F5Compare two different files at byte levelBrowsable Binary Chart (see later for details) F1Hex - Dec number converter F2Hex String escaper (e.g from 010203 to \x01\x02\x03) F3Pattern Matching Engine (see later for details)Disassebler based on Capstone Engine F4Assembler based on Keystone Engine F4Zoom-Out/Zoom-In bytes view (CTRL + Up/Down or CTRL + -/+)Shortcuts for all these featuresPattern Matching EngineFhex can load at startup a configuration file (from ~/fhex/config.json) in JSON format with a list of strings or bytes to highlight and a comment/label to add close to the matches.Examples:{ "PatternMatching": { "string" : "://www.", "color" : "rgba(250,200,200,50)", "message" : "Found url" }, { "bytes" : "414243", "color" : "rgba(250,200,200,50)", "message" : "Found ABC" } }To activate pattern matching press CTRL + PAt the end, Fhex will show also an offset list with all the result references. Note: Labels with comments are added only if the window is maximized, if labels are not displayed correctly please try to run pattern matching again.Binary ChartFhex has the feature to chart the loaded binary file (Note: In order to compile the project, now you need also qt5-charts installed on the system). The y-axis range is between 0 and 255 (in hex 0x0 and 0xff, i.e. the byte values). The x-axis range is between 0 and the filesize.The chart plots the byte values of the binary file and let you focus only on the relevant sections. For example, if in a binary file there is an area full of null bytes, you can easily detect it from the chart.LicenseGPL-3Download Fhex
Read more...

Hacking Articles
Msfvenom Cheatsheet: Windows Exploitation

In this post, you will learn how to use MsfVenom to generate all types of payloads for exploiting the windows platform. Read beginner guide from

The post Msfvenom Cheatsheet: Windows Exploitation appeared first on Hacking Articles.

KitPloit - PenTest Tools!
Fhex - A Full-Featured HexEditor

https://blogger.googleusercontent.com/img/a/AVvXsEi_rnUbgPkwJx0ndLAwLm3CvA-fUVBEb3GIqH6E2zv2ndEv_HUwkn_nCAkvJcSxdbGK7MiTXhQryOtspKv6x2uMWw06pCHiLunn1Iw6pC5OZI6w2TW9CnFDcgdsGVcOifvlc9Z4Or_cKzeq9PahnH_IyOV7uBZ2lzbm4PMk1-OJeZe_5T3J1WV3mrZyYQ=w640-h424 This project is born with the aim to develop a lightweight, but useful tool. The reason is that the existing hex editors have some different limitations (e.g. too many dependencies, missing hex coloring features, etc.). https://blogger.googleusercontent.com/img/a/AVvXsEh0TTemQDWWClkZ9d9AHMzu68Qm1IJHj2e4HfUIY28ezgThG0HFIfHc5qnkRkubC_w8WbbKl0m9q37KJ_WODAPodtiW0bajIWozlS6Lft8F7AbeoctOS0NUNg2hsEm8cpxNpvqSwqhMsgopHBPKfvmY3B2IbgjdKpTRvMuBZwZjJUCsVhCXVkeZIRb47g=w640-h332 https://blogger.googleusercontent.com/img/a/AVvXsEgQuJTtl9G_o2xVIV-f1lLGV0W6EYA7lKXkg0FZr6rgjKMZKGN5ulshzxj9pz2v9cybvDvn6OxLIgFjiRe6LG7U1x5INOtwFiaUrETbz-5-YqwOY4IZqxQ2of4I4Rd8K_XCaQIf4X9nxx-mHB4TAjRvXc7BxF0ViJEpmV9ppuQGIUmSyKQtQIRN2LKeUw=w640-h228 This project is based on qhexedit2, capstone and keystone engines. New features could be added in the future, PRs are welcomed. Features* Chunks loader - Used to load only a portion of large files without exhaust the memory (use alt + left/right arrows to move among chunks). Please note that in chunk mode, all the operations (e.g. search) applies only to the current chunk except for file save (the entire file is saved). However, each time you edit a chunk, save it before to move to another chunk, otherwise you will lose your changes.
* Search and replace (UTF-8, HEX, regex, reverse search supported) [CTRL + F]
* Colored output (white spaces, ASCII characters, 0xFF, UTF-8 and NULL bytes have different colors)
* Interpret selected bytes as integer, long, unsigned long [CTRL + B]
* Copy & Paste [CTRL + C and CTRL + V]
* Copy selected unicode characters [CTRL + Space]
* Zeroing all the selected bytes [Delete or CTRL + D]
* Undo & Redo [CTRL + Z and CTRL + Y]
* Drag & Drop (Hint: Drag&Drop two files to diff them)
* Overwrite the same file or create a new one [CTRL + S]
* Goto offset [CTRL + G]
* Insert mode supported in order to insert new bytes instead to overwrite the existing one [INS]
* Create new instances [CTRL + N]
* Basic text viewer for the selected text [CTRL + T]
* Reload the current file [F5]
* Compare two different files at byte level
* Browsable Binary Chart (see later for details) [F1]
* Hex - Dec number converter [F2]
* Hex String escaper (e.g from 010203 to \x01\x02\x03) [F3]
* Pattern Matching Engine (see later for details)
* Disassebler based on Capstone Engine [F4]
* Assembler based on Keystone Engine [F4]
* Zoom-Out/Zoom-In bytes view (CTRL + Up/Down or CTRL + -/+)
* Shortcuts for all these features Pattern Matching EngineFhex can load at startup a configuration file (from ~/fhex/config.json) in JSON format with a list of strings or bytes to highlight and a comment/label to add close to the matches.

Examples: {
"PatternMatching":
[
{
"string" : "://www.",
"color" : "rgba(250,200,200,50)",
"message" : "Found url"
},
{
"bytes" : "414243",
"color" : "rgba(250,200,200,50)",
"message" : "Found ABC"
}
]
}To activate pattern matching press CTRL + PAt the end, Fhex will show also an offset list with all the result references. Note: Labels with comments are added only if the window is maximized, if labels are not displayed correctly please try to run pattern matching again. Binary ChartFhex has the feature to chart the loaded binary [...]

file (Note: In order to compile the project, now you need also qt5-chartsinstalled on the system). The y-axis range is between 0 and 255 (in hex 0x0 and 0xff, i.e. the byte values). The x-axis range is between 0 and the filesize.

The chart plots the byte values of the binary file and let you focus only on the relevant sections. For example, if in a binary file there is an area full of null bytes, you can easily detect it from the chart. LicenseGPL-3 Download Fhex

Review Netlas.io for Bug Bounty
https://medium.com/@thebugbountyhunter/review-netlas-io-for-bug-bounty-c062a87b544f?source=rss------bug_bounty-5

Hi community!Continue reading on Medium » (https://medium.com/@thebugbountyhunter/review-netlas-io-for-bug-bounty-c062a87b544f?source=rss------bug_bounty-5)

How A bit of observation gave me my Second Account Takeover
https://medium.com/@sarafsaransh321/how-a-bit-of-observation-gave-me-my-second-account-takeover-707e76b9c9f2?source=rss------bug_bounty-5