Exploit Collector
Wipro Holmes Orchestrator 20.4.1 File Disclosure

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
ThreatBox - A Standard And Controlled Linux Based Attack Platform

https://blogger.googleusercontent.com/img/a/AVvXsEgRobES1W6DgyKwt2Nob5ffeRkoRwiA7-Jqan0YkieJ0solg_MJ_Ay5fdyne2InOvczfnTo8euCIfuGJ66-XfbYdvbaLR8i7vfWC1pqBhlVkmEz-385Kx7Hi8_P9jn4nGyFa-HMcOOiyypwYxdBF2XQ9SFY96UlclINZMsD3jpDO6nsA9G3OOYmizu3sg=w640-h392 ThreatBox is a standard and controlled Linux based attack platform. I've used a version of this for years. It started as a collection of scripts, lived as a rolling virtual machine, existed as code to build a Linux ISO, and has now been converted to a set of ansible playbooks. Why Ansible? Why not? This seemed to be the next natural evolution to the configuration of standard attack platforms.

This project uses ansible playbooks and roles to perform post deployment configuration on a linux target (Tested on Ubuntu 18.04).

The project is designed to be used as a starter process in creating, managing, and using a standard attack platform for red teaming or penetration testing.

Detail on the concept of a Standard Attack Platform can be found it the book Red Team Development and Operations - A practical guide, written by Joe Vest and James Tubberville. Features* Standard tools defined as ansible roles
* Customizations designed to make security testing easier
* Variable list to add or remove git repositories, OS packages, or python modules. (threatbox.yml)
* Version tracking of the deployed instance version and the deploy tool version. This is helpful it meeting compliance rules and can help minimize fear by actively tracking all tools.
* Threatbox version created at deployment and displayed in desktop wallpaper
* Deployed software tracked in ~/Desktop/readme

* SSH port auto-switching. The deployment starts on port 22, but reconfigures the target system to the desired SSH port using the ansible_portvariable in threatbox.yml* Download and compile several .net toolkits (i.e. SeatBelt.exe from Ghostpack https://github.com/GhostPack/Seatbelt)
* Most python projects installed using pipenv. Use pipenv shellin the project directory to access. See https://realpython.com/pipenv-guide/ for pipenv usage guidance Project FilesThe following list highlights key components of this project.
File/DirectoryDescriptionUsagehostAnsible hosts fileUpdate with IP addresses of target ansible systemsgroup_vars/threatbox.ymlcommon variablesvariable used for the project. update as needed.threatbox_playbox.ymlPrimary ansible playbookUpdate as need to add additional roles or featuresroles/commonCommon OS platform configurationSetup common OS settings (i.e set version in background or build)roles/.other specific roles to configure or deploy toolsadd or modify roles in roles/ QuickstartProvisionProvision one or more targets.

Note: This project was tested on Ubuntu 18.04 deployed in Digitalocean Configuration1. Copy hosts.sampleto hosts2. Edit hostswith the IP(s) of your target systems
3. Copy group_vars\threatbox.yml.sampleto group_vars\threatbox.yml4. Edit group_vars\threatbox.ymlwith the updated variables you would like to use
* Don't forget to update SSH key with a key that has access to the remote target Ansible commands# OSX issue https://github.com/ansible/ansible/issues/32499
if [[ "$(uname)" == "Darwin" ]]
then
export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=yes;
fi

# Ansible Logging
rm ./ansible.log
export ANSIBLE_LOG_PATH="ansible.log"

# Ansible Debugging
export ANSIBLE_DEBUG=False

# Execute playbook
ansible-playbook -e ansible_python_interpreter=/usr/bin/python3 -i hosts threatbox_playbook.yml Note: Consider using Mitogen for Ansible to gain a significant performance boost. https://mitogen.networkgenom[...]

___________________________
@hacking_Attack
@Hacking_Video

ics.com/ansible_detailed.html Tested with this ansible.cfg[defaults]
host_key_checking = False
pipelining = True
forks = 100
timeout = 600
stdout_callback = yaml
bin_ansible_callbacks = True
callback_whitelist = profile_roles, profile_tasks, timer

#mitogen
strategy_plugins = ~/Documents/mitogen-0.2.9/ansible_mitogen/plugins/strategy
strategy = mitogen_linear Remotely Access the systemConsole access with SSHNote: SSH may be set to a non-standard port during setup. This value is set in the group_vars/threatbox.ymlfiles threatboxip=10.10.10.10
sshport=52222
ssh -p $sshport -i ~/.ssh/threatbox_id_rsa root@$threatboxip GUI Access with VNC over SSHNote: VNC is setup but not allowed over the network. You must use an SSH tunnel to access. threatboxip=10.10.10.10
sshport=52222
ssh -p $sshport -i ~/.ssh/threatbox_id_rsa -L 5901:localhost:5901 root@$threatboxip Notes on the projectThis project uses ansbile roles. These roles may not exactly follow the ansible style. They were designed to be used as part of this project and use a single 'variable' file to control the project. The roles can easily be used in other project with minor tweaks. FeaturesThreatBox Custom Commands https://blogger.googleusercontent.com/img/a/AVvXsEivvIysUdsh9aJooEws9pZrWXvbdks_z7nnitLeeUmuVnl-xRsAW96_B64btF5SJS-d3AfDgMlL_R4mSAP3FZvWVpCMx_Jx0ILw7HQymB8JwAXlCOsjDPElykv5ybat5hExMRFjR4kU-B68tK7eh1hcC2Jrloe-BPVadUFrefUo1NJUq_4_ZKoCHcirGg=w640-h458 Tool Categories https://blogger.googleusercontent.com/img/a/AVvXsEjkGTLMrVeq48Kqr5EwQnQc_BNRNwA_F9EGOSKpLNqmiyGd1uhTMqWMivwfC1-x4wZCrqLW4ztPpFFrOp7zlYYl-nlZLcd-a1V5cNC_JuexI9gyyJSLU8SNoLGxSjdBHlR2B4AITju63Yp0XHtHvAmDl7Dj5bvqtz1ZZ7vz8GlD_x_z7X6mqXryVsEyxA=w640-h270 Tracking of all installed tools https://blogger.googleusercontent.com/img/a/AVvXsEglsEAE8hNxhHpa9-rfbLP0XLI2rUg74YyipeZ_mTd4H0YKrVG7YWETyAVgdNPCFymlUzCwJMNLGnV8t_oHYiq1DNijY_IH6RZY_kTOD_Zp16mYum2x5J6MbhzR32Z95ebn8tJHsahusgPakCOh4VNz7BCCUqus_T21GPTq3vf8hPIAn-_uAUQrTGDZNg=w640-h356 Automatic terminal logging https://blogger.googleusercontent.com/img/a/AVvXsEhGeb-u7ier9WMGtF-n2rzx9yWrt2az6naSQEGUhnYcbjHcr1OZDCAIFQ1mohMdQTTtP29MxIKsWIheE1IIFvOKiFZwajR7_P_CCFe6ZOIYF4ql2gw4FB2gMoNgPVOzXeAL3AN5oIgr2aYm-FWnWl4Gfq8HPqgva_kVyC-Z16sy_8h38WOPMxLWuajTSA=w640-h244 Custom terminal options provide more context https://blogger.googleusercontent.com/img/a/AVvXsEgqF0QWjw91_twXViqmFM2qRZFUnZfneW5zWXfvfhB_r_Km4kUy2vYbNt56ZAtGU4nFZpoNE0jQM3-yL5_aUk0Vb0WdM7ZlwSMdG2J636u5iMNQikBLqzgUQ_7aY77246JtO8d2CS74VvlHZN1oSyweDrWqq3Ap8lUMjpjFVkC3Yw-ZnUsxEpnw4DlKAA=w640-h248 Light version of the terminal

Pipenv keep Python projects independent https://blogger.googleusercontent.com/img/a/AVvXsEg1aFsbPe-cnhEsuDzbJ9-Fwm6SaRq2Xig7g_wWNKT4ZDVMCUS-Zg1a1jA1K8lNheP1fGLXG9QoVwzw8iQ4V3s24inXk56xS_hlkHdmDChQI86DXEQKeEfhWP4OfU2JWjPI9b87RfMJt4CaTBv1epQVHRqb1CTXjG8TomtOW4zrYNqfDVEJPbd1x7iwFQ=w640-h40 Example of SilentTrinity running in pipenv environment https://blogger.googleusercontent.com/img/a/AVvXsEh9bpESOyPjiyIIHdTmzW9PTz3Nan0l2Z5OU3EZ7YJFt6IsaCkYJ2o-F8vW482JQ5qu0H3uwO9LtWcS1dppBmgGzgIBd0D4yUIH0HOh49ulpVMHRwUvGwjSR8Vbilrz4OqgrENg-RH4_IIO0hRtcAifm4YLIX26uyK2oSip87tm8-w19Xog0EIqftVESA=w640-h292 Download Threatbox

___________________________
@hacking_Attack
@Hacking_Video

Protecting Yourself From Deceptive Bug Bounty Programs and Deceptive Scopes/Targets

The Theoretical Attack on the Researchers ThemselvesContinue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
10 Stocking Stuffers for Security Geeks

Check out our list of gifts with a big impact for hackers and other techie security professionals.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Bug Bounties Surge as Firms Compete for Talent

Companies such as GItLab, which today increased its payment for critical bugs by 75%, are raising bounties and bonuses to attract top-notch researchers.

Dark Reading: Attacks/Breaches
CISA Urges Critical Infrastructure to Be Alert for Holiday Threats

CISA and the FBI share steps organizations should take to better protect against security threats during holidays and weekends.

___________________________
@hacking_Attack
@Hacking_Video

Protecting Yourself From Deceptive Bug Bounty Programs and Deceptive Scopes/Targets
https://medium.com/@daniel.j.hunt/protecting-yourself-from-deceptive-bug-bounty-programs-and-deceptive-scopes-targets-1bfa62195110?source=rss------bug_bounty-5

The Theoretical Attack on the Researchers ThemselvesContinue reading on Medium » (https://medium.com/@daniel.j.hunt/protecting-yourself-from-deceptive-bug-bounty-programs-and-deceptive-scopes-targets-1bfa62195110?source=rss------bug_bounty-5)

Hacking on Medium
Web-scrapping in Python for job hunting (part 1)

https://cdn-images-1.medium.com/max/1920/1*WeZkJPHYfD27wwajqa-N3Q.jpeg
All around the world we are now living what has been called as “The Great Resignation”, and hundreds of thousands of people are looking…

Continue reading on Medium »

Hacking on Medium
Protecting Yourself From Deceptive Bug Bounty Programs and Deceptive Scopes/Targets

https://cdn-images-1.medium.com/max/1024/0*UhTiqX7AI5g_JtNh.jpg
The Theoretical Attack on the Researchers Themselves

Continue reading on Medium »

https://b.thumbs.redditmedia.com/zYo7a0rLhUrRwbtYL-8eyOkAw--HzyY7vOVWh3LN2fI.jpg I've got a presentation coming up on Thursday, so started prepping.I created rainbow tables lower alpha 1-7 chars, with table index 0-5I then sorted them with rtsort, and tried to rtmerge. All rtmerge does is copy the files back to /usr/shared/rainbow/*.rt. I'm not getting the single file I can compress?

Any help will be appreciated.The idea is to ask the audience to give me some hashes within the parameters of my tables, And I will crack them in less time of the presentation. Already know john the ripper takes about 2 hours 10 minutes for a 7 char password.

https://preview.redd.it/xhhijgs1v7181.png?width=687&format=png&auto=webp&s=1027718f70501a768d724fbf505869565bb50e75

submitted by /u/craftyza
[link] [comments]

hacking: security in practice
What wireless network adapter would you recommend?

I'm trying to learn cybersecurity, and it seems like a wifi adapter that supports monitor mode is necessary for a lot of things. What would you recommend? On a budget. Also, what kinda stuff can you do with one? From what I can tell, they just give you more access to a network.

submitted by /u/theoryofbang
[link] [comments]

hacking: security in practice
PM pls

If you have experience with Google Forms.

submitted by /u/TheLoraxLover89
[link] [comments]

hacking: security in practice
Does anyone know how to install kali Linux

Yes I have checked the internet thouroughly before anyone asks and unfortunately all approaches have failed

submitted by /u/Bigmanfrank2003
[link] [comments]

디파인, 이뮨파이(Immunefi)와 버그 바운티 프로그램 출시
https://medium.com/define-platform/%EB%94%94%ED%8C%8C%EC%9D%B8-%EC%9D%B4%EB%AE%A8%ED%8C%8C%EC%9D%B4-immunefi-%EC%99%80-%EB%B2%84%EA%B7%B8-%EB%B0%94%EC%9A%B4%ED%8B%B0-%ED%94%84%EB%A1%9C%EA%B7%B8%EB%9E%A8-%EC%B6%9C%EC%8B%9C-f8bb8c1d793a?source=rss------bug_bounty-5