WADComs
https://www.reddit.com/r/redteamsec/comments/qxb08x/wadcoms/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://wadcoms.github.io/#) [comments] (https://www.reddit.com/r/redteamsec/comments/qxb08x/wadcoms/)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Android malware BrazKing returns as a stealthier banking trojan

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Android malware BrazKing returns as a stealthier banking trojanPost Views: 146
Reading Time: 1 Minute
​The BrazKing Android banking trojan has returned with dynamic banking overlays and a new implementation trick that enables it to operate without requesting risky permissions.
A new malware sample was analyzed by IBM Trusteer researchers who found it outside the Play Store, on sites where people end up after receiving smishing (SMS) messages.

These HTTPS sites warn the prospective victim that they are using an outdated Android version and offer an APK that will allegedly update them to the latest version.
https://www.bleepstatic.com/images/news/u/1220909/Security/message.jpg
Only asking for a single permissionIf the user approves “downloads from unknown sources,” the malware is dropped on the device and requests access to the ‘Accessibility Service’.

This permission is abused to capture screenshots and keystrokes without requesting any additional permissions that would risk raising suspicions.

More specifically, the accessibility service is used by BrazKing for the following malicious activity:

* Dissect the screen programmatically instead of taking screenshots in picture format. This can be done programmatically but on a non-rooted device that would require the explicit approval of the user.
* Keylogger capabilities by reading the views on the screen.
* RAT capabilities—BrazKing can manipulate the target banking application by tapping buttons or keying text in.
* Read SMS without the ‘android.permission.READ_SMS’ permission by reading text messages that appear on the screen. This can give actors access to 2FA codes.
* Read contact lists without ‘android.permission.READ_CONTACTS’ permission by reading the contacts on the “Contacts” screen.

Starting on Android 11, Google has categorized the list of installed apps as sensitive information, so any malware that attempts to fetch it is flagged by Play Protect as malicious.
See Also: WordPress sites are being hacked in fake ransomware attacks
This is a new problem for all banking overlaying trojans that need to determine which bank apps are installed on the infected device to serve matching login screens.

BrazKing no longer uses the ‘getinstalledpackages’ API request as it used to but instead uses the screen dissection feature to view what apps are installed on the infected device.

When it comes to overlaying, BrazKing now does it without the ‘System_Alert_Window’ permission, so it can’t overlay a fake screen on top of the original app as other trojans do.

Instead, it loads the fake screen as an URL from the attacker’s server in a webview window, added from within the accessibility service. This covers the app and all its windows but doesn’t force an exit from it.
https://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/overlaying.png
___________________________
@hacking_Attack
@Hacking_Video

e banking apps or sites or add support for new banks.
See Also: Offensive Security Tool: Pentesting Tools Obfuscation and resistance to deletionThe new version of BrazKing protects internal resources by applying an XOR operation using a hardcoded key and then also encodes them with Base64.

Analysts can quickly reverse these steps, but they still help the malware go unnoticed when nested in the victim’s device.
https://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/obfuscated%20strings.png
(Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/redcurl-90x90.jpg RedCurl corporate espionage hackers resume attacks with updated tools21 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-1-1-90x90.jpg WordPress sites are being hacked in fake ransomware attacks2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ECS-Instance-Types-90x90.png Alibaba ECS instances actively hijacked by cryptomining malware3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-1-90x90.jpg QBot returns for a new wave of infections using Squirrelwaffle4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/face-malware-virus-infected-red-network-90x90.jpg BotenaGo botnet targets millions of IoT devices with 33 exploits1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-90x90.jpg Microsoft patches Excel zero-day used in attacks, asks Mac users to wait1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Microsoft-Exchange-90x90.png Microsoft urges Exchange admins to patch bug exploited in the wild1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/b57e07db-82a4-43ef-be64-a15c45b31804-90x90.jpg Robinhood discloses data breach impacting 7 million customers1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Pwn2OwnBlur-90x90.png Pwn2Own – Over 1 million dollars in Bounties, Samsung Galaxy S21 hacked twice, Printer plays AC/DC2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/maxresdefault-1024x576-1-90x90.jpg Microsoft Exchange ProxyShell exploits used to deploy Babuk ransomware2 weeks ago
The post Android malware BrazKing returns as a stealthier banking trojan first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Web Application Penetration Testing eXtreme (WAPTX) Review

https://cdn-images-1.medium.com/max/884/1*ks97WY3zv9o53z1rsVgnUg.png
Why I did this course

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
AArch 64 Bytes: Part 3 (Yet Another Upper)

https://cdn-images-1.medium.com/max/1280/1*Fvq5caqqhQunJGD_TEMBEA.png
For a complete table of contents of all the lessons please click below as it will give you a brief of each lesson in addition to the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can anyone provide some guidance?

I’d like a bot that I could use to send mass messages with an account on discord. For an example, I would input my login info on the bot, type a message or image, and have it bomb the server threads with it.

submitted by /u/Icy-Bat3449
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What in your opinion is a growing trend? What should people and organisations be paying attention to going forward?

Are there particular attack strategies we are seeing more of or something that is emerging thats hot right now?

submitted by /u/kai--zen
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Scraping Chrome extension users

Folks, any way I can efficiently scrape the users [or at least those who left a review] for a Chrome extension? TIA

submitted by /u/ale6rbd
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Msticpy - Microsoft Threat Intelligence Security Tools
http://www.kitploit.com/2021/11/msticpy-microsoft-threat-intelligence.html

___________________________
@hacking_Attack
@Hacking_Video

Microsoft Threat Intelligence (https://www.kitploit.com/search/label/Threat%20Intelligence) Python Security Tools.msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to:query log data from multiple sourcesenrich the data with Threat Intelligence, geolocations and Azure resource dataextract Indicators of Activity (IoA) from logs and unpack encoded dataperform sophisticated analysis such as anomalous session detection and time series decompositionvisualize data using interactive timelines, process trees and multi-dimensional Morph Charts
It also includes some time-saving notebook tools such as widgets to set query time boundaries, select and display items from lists, and configure the notebook environment.

___________________________
@hacking_Attack
@Hacking_Video

The msticpy package was initially developed to support Jupyter Notebooks (https://jupyter-notebook-beginner-guide.readthedocs.io/en/latest/)authoring for Azure Sentinel (https://azure.microsoft.com/en-us/services/azure-sentinel/). While Azure Sentinel is still a big focus of our work, we are extending the data query/acquisition components to pull log data from other sources (currently Splunk, Microsoft Defender for Endpoint and Microsoft Graph are supported but we are actively working on support for data from other SIEM platforms). Most of the components can also be used with data from any source. Pandas DataFrames are used as the ubiquitous input and output format of almost all components. There is also a data provider to make it easy to and process data from local CSV files and pickled DataFrames.The package addresses three central needs for security investigators and hunters:Acquiring and enriching dataAnalyzing dataVisualizing dataWe welcome feedback, bug reports, suggestions for new features and contributions.
Installing
For core install:pip install msticpyIf you are using MSTICPy with Azure Sentinel you should install with the "azsentinel" extra package:pip install msticpy[azsentinel]or for the latest dev buildpip install git+https://github.com/microsoft/msticpy
Documentation
Full documentation is at ReadTheDocs (https://msticpy.readthedocs.io/en/latest/)Sample notebooks for many of the modules are in the docs/notebooks (https://github.com/microsoft/msticpy/blob/master/docs/notebooks)folder and accompanying notebooks.You can also browse through the sample notebooks referenced at the end of this document to see some of the functionality used in context. You can play with some of the package functions in this interactive demo on mybinder.org.
Log Data Acquisition
QueryProvider is an extensible query library targeting Azure Sentinel/Log Analytics, Splunk, OData and other log data sources. It also has special support for Mordor (https://github.com/OTRF/mordor) data sets and using local data.Built-in parameterized queries allow complex queries to be run from a single function call. Add your own queries using a simple YAML schema.Data Queries Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/Data_Queries.ipynb)
Data Enrichment

Threat Intelligence providers
The TILookup class can lookup IoCs across multiple TI providers. built-in providers include AlienVault OTX, IBM XForce, VirusTotal and Azure Sentinel.The input can be a single IoC observable or a pandas DataFrame containing multiple observables. Depending on the provider, you may require an account and an API key. Some providers also enforce throttling (especially for free tiers), which might affect performing bulk lookups.TIProviders (https://msticpy.readthedocs.io/en/latest/data_acquisition/TIProviders.html)and TILookup Usage Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/TIProviders.ipynb)
GeoLocation Data
The GeoIP lookup classes allow you to match the geo-locations of IP addresses using either:GeoLiteLookup - Maxmind Geolite (see https://www.maxmind.com (https://www.maxmind.com/))IPStackLookup - IPStack (see https://ipstack.com (https://ipstack.com/))

___________________________
@hacking_Attack
@Hacking_Video

GeoIP Lookup (https://msticpy.readthedocs.io/en/latest/data_acquisition/GeoIPLookups.html)and GeoIP Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/GeoIPLookups.ipynb)
Azure Resource Data, Storage and Azure Sentinel API
The AzureData module contains functionality for enriching data regarding Azure host details with additional host details exposed via the Azure API. The AzureSentinel module allows you to query incidents, retrieve detector and hunting queries. AzureBlogStorage lets you read and write data from blob storage.Azure Resource APIs (https://msticpy.readthedocs.io/en/latest/data_acquisition/AzureData.html), Azure Sentinel APIs (https://msticpy.readthedocs.io/en/latest/data_acquisition/AzureSentinel.html), Azure Storage (https://msticpy.readthedocs.io/en/latest/data_acquisition/AzureBlobStorage.html)
Security Analysis
This subpackage contains several modules helpful for working on security investigations and hunting:
Anomalous Sequence Detection
Detect unusual sequences of events in your Office, Active Directory (https://www.kitploit.com/search/label/Active%20Directory) or other log data. You can extract sessions (e.g. activity initiated by the same account) and identify and visualize unusual sequences of activity. For example, detecting an attacker setting a mail forwarding rule on someone's mailbox.Anomalous Sessions (https://msticpy.readthedocs.io/en/latest/data_analysis/AnomalousSequence.html)and Anomalous Sequence Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/AnomalousSequence.ipynb)
Time Series Analysis
Time series analysis allows you to identify unusual patterns in your log data taking into account normal seasonal variations (e.g. the regular ebb and flow of events over hours of the day, days of the week, etc.). Using both analysis and visualization highlights unusual traffic flows or event activity for any data set.

___________________________
@hacking_Attack
@Hacking_Video

Time Series (https://msticpy.readthedocs.io/en/latest/visualization/TimeSeriesAnomalies.html)
Visualization

Event Timelines
Display any log events on an interactive timeline. Using the Bokeh (https://bokeh.org/)Visualization (https://www.kitploit.com/search/label/Visualization) Library the timeline control enables you to visualize one or more event streams, interactively zoom into specific time slots and view event details for plotted events.

___________________________
@hacking_Attack
@Hacking_Video