hacking: security in practice
In os query how to get the list of files that a user can execute with sudo?

I have a task to find binaries to be executed with root permission and using osquery find the path of the program. I found a few tables and tried the following but no luck

1. select * from sudoers;
2. select * from shell_history where uid=1234;

Please help

submitted by /u/tbhaxor
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Execute ELF files on a machine without dropping an ELF

https://external-preview.redd.it/XYWGQnK2cNnLHCM7gvtuLgDgUaXH0lTPghWSJxa9CXc.jpg?width=640&crop=smart&auto=webp&s=6f93c099157407462305f748b55f5c0cdf7ea2a0 submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
SillyRAT - A Cross Platform multifunctional (Windows/Linux/Mac) RAT.

https://github.com/hash3liZer/SillyRAT

A cross platform RAT written in pure Python. The RAT accept commands alongside arguments to either perform as the server who accepts connections or to perform as the client/target who establish connections to the server. The generate command uses the module pyinstaller to compile the actual payload code. So, in order to generate payload file for your respective platform, you need to be on that platform while generating the file. Moreover, you can directly get the source file as well.

submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

DetectionLabELK - A Fork From DetectionLab With ELK Stack Instead Of Splunk
http://www.kitploit.com/2021/11/detectionlabelk-fork-from-detectionlab.html

___________________________
@hacking_Attack
@Hacking_Video

DetectionLabELK is a fork from Chris Long's DetectionLab (https://github.com/clong/DetectionLab) with ELK stack instead of Splunk.
Description: DetectionLabELK is the perfect lab to use if you would like to build effective detection capabilities. It has been designed with defenders in mind. Its primary purpose is to allow blueteams to quickly build a Windows domain that comes pre-loaded with security tooling and some best practices when it comes to system logging configurations. It can easily be modified to fit most needs or expanded to include additional hosts. Use cases: A popular use case for DetectionLabELK is when you consider adopting MITRE ATT&CK framework and would like to develop detections for its tactics. You can use DetectionLabELK to quickly run atomic tests, see what logs are being generated and compare it to your production environment. This way you can: Validate that your production logging is working as expected. Ensure that your SIEM is collecting the correct events. Enhance alerts quality by reducing false positives and eliminating false negatives. Minimize coverage gaps. Lab Information: Domain Name: windomain.local Windows Admininstrator login: vagrant:vagrant Fleet login: https://192.168.38.105:8412 (https://192.168.38.105:8412/) - vagrant:vagrant Kibana login: http://192.168.38.105:5601 (http://192.168.38.105:5601/) - vagrant:vagrant Microsoft ATA login: https://192.168.38.103 (https://192.168.38.103/) - vagrant:vagrant Guacamole login: http://192.168.38.105:8080/guacamole - vagrant:vagrant Velociraptor: https://192.168.38.105:9999 (https://192.168.38.105:9999/) - vagrant:vagrant Primary Lab Features: Microsoft Advanced Threat Analytics (https://www.microsoft.com/en-us/cloud-platform/advanced-threat-analytics) is installed on the WEF machine, with the lightweight ATA gateway installed on the DC Windoes Evenet forwarder along with Winlogbeat are pre-installed and all indexes are pre-created on ELK. Technology add-ons for Windows are also preconfigured. A custom Windows auditing configuration is set via GPO to include command line (https://www.kitploit.com/search/label/Command%20Line) process auditing and additional OS-level logging Palantir's Windows Event Forwarding (http://github.com/palantir/windows-event-forwarding) subscriptions and custom channels are implemented Powershell transcript logging is enabled. All logs are saved to \\wef\pslogs osquery comes installed on each host and is pre-configured to connect to a Fleet (https://kolide.co/fleet) server via TLS. Fleet is preconfigured with the configuration from Palantir's osquery Configuration (https://github.com/palantir/osquery-configuration) Sysmon is installed and configured using Olaf's open-sourced configuration All autostart items are logged to Windows Event Logs (https://www.kitploit.com/search/label/Windows%20Event%20Logs) via AutorunsToWinEventLog (https://github.com/palantir/windows-event-forwarding/tree/master/AutorunsToWinEventLog) SMBv1 Auditing is enabled Lab Hosts: DC - Windows 2016 Domain Controller WEF Server Configuration GPO Powershell logging GPO Enhanced Windows Auditing policy GPO Sysmon osquery Elastic Beats Forwarder (Forwards Sysmon & osquery) Sysinternals Tools Microsft Advanced Threat Analytics Lightweight Gateway WEF - Windows 2016 Server Microsoft Advanced Threat Analytics Windows Event Collector Windows Event Subscription Creation Powershell transcription logging share Sysmon osquery Elastic Beats Forwarder (Forwards WinEventLog & Powershell & Sysmon & osquery) Sysinternals tools Win10 - Windows 10 Workstation Simulates employee workstation Sysmon osquery Sysinternals Tools Logger - Ubuntu 18.04 Kibana Fleet osquery Manager Bro Suricata Elastic Beats Forwarder (Forwards Bro logs & Suricata & osquery) Guacamole Velociraptor Requirements 55GB+ of free disk space 16GB+ of RAM Vagrant 2.2.2 or newer Virtualbox

___________________________
@hacking_Attack
@Hacking_Video

Deployment Options Use Vagrant Cloud Boxes - ETA ~2 hours. Install Vagrant (https://www.vagrantup.com/downloads.html) on your system. Install Packer (https://packer.io/downloads.html) on your system. Install the Vagrant-Reload plugin by running the following command: vagrant plugin install vagrant-reload. Download DetectionLabELK to your local machine by running git clone https://github.com/cyberdefenders/DetectionLabELK.git from command line OR download it directly via this link (https://github.com/cyberdefenders/DetectionLabELK/archive/master.zip). cd to "DetectionLabELK/Vagrant" and execute vagrant up. Build Boxes From Scratch - ETA ~5 hours. Install Vagrant (https://www.vagrantup.com/downloads.html) on your system. Install Packer (https://packer.io/downloads.html) on your system. Install "Vagrant-Reload" plugin by running the following command: vagrant plugin install vagrant-reload. Download DetectionLabELK to your local machine by running git clone https://github.com/cyberdefenders/DetectionLabELK.git from command line OR download it directly via this link (https://github.com/cyberdefenders/DetectionLabELK/archive/master.zip). cd to "DetectionLabELK" base directory and build the lab by executing ./build.sh virtualbox (Mac & Linux) or ./build.ps1 virtualbox (Windows). Troubleshooting: To verify that building process completed successfully, ensure you are in DetectionLabELK/Vagrant directory and run vagrant status. The four machines (wef,dc,logger and win10) should be running. if one of the machines was not running, execute vagrant reload . If you would like to pause the whole lab, execute vagrant suspend and resume it using vagrant resume. Deployment logs will be present in the Vagrant folder as vagrant_up_.log Lab Access: Navigate to https://192.168.38.105:8080/guacamole in a browser to access Guacamole. Default credentials (https://www.kitploit.com/search/label/Credentials) are vagrant:vagrant. Navigate to https://192.168.38.105:5601 (https://192.168.38.105:5601/) in a browser to access the Kibana dashboard on logger. Default credentials are vagrant:vagrant. Navigate to https://192.168.38.105:8412 (https://192.168.38.105:8412/) in a browser to access the Fleet server on logger. Default credentials are vagrant:vagrant. Navigate to https://192.168.38.103 (https://192.168.38.103/) in a browser to access Microsoft ATA. Default credentials are vagrant:vagrant. Navigate to https://192.168.38.105:9999 (https://192.168.38.105:9999/) in a browser to access velociraptor. Default credentials are vagrant:vagrant. Support: If you face any problem, please open a new issue (https://github.com/cyberdefenders/DetectionLabELK/issues) and provide relevant log file.

Download DetectionLabELK (https://github.com/cyberdefenders/DetectionLabELK)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
DetectionLabELK - A Fork From DetectionLab With ELK Stack Instead Of Splunk

http://3.bp.blogspot.com/-FRPqw2CF_-s/YaBJP6W5WqI/AAAAAAAA4ic/fC7NtLYr7Pw4f4u6S9o1Z3hDTxGDysYRwCK4BGAYYCw/w640-h402/DetectionLabELK_1_DetectionLabELK-new-751362.png DetectionLabELK is a fork from Chris Long's DetectionLab with ELK stack instead of Splunk. Description:DetectionLabELK is the perfect lab to use if you would like to build effective detection capabilities. It has been designed with defenders in mind. Its primary purpose is to allow blueteams to quickly build a Windows domain that comes pre-loaded with security tooling and some best practices when it comes to system logging configurations. It can easily be modified to fit most needs or expanded to include additional hosts. Use cases:A popular use case for DetectionLabELK is when you consider adopting MITRE ATT&CK framework and would like to develop detections for its tactics. You can use DetectionLabELK to quickly run atomic tests, see what logs are being generated and compare it to your production environment. This way you can:

* Validate that your production logging is working as expected.
* Ensure that your SIEM is collecting the correct events.
* Enhance alerts quality by reducing false positives and eliminating false negatives.
* Minimize coverage gaps. Lab Information:* Domain Name: windomain.local
* Windows Admininstrator login: vagrant:vagrant
* Fleet login: https://192.168.38.105:8412 - vagrant:vagrant
* Kibana login: http://192.168.38.105:5601 - vagrant:vagrant
* Microsoft ATA login: https://192.168.38.103 - vagrant:vagrant
* Guacamole login: http://192.168.38.105:8080/guacamole - vagrant:vagrant
* Velociraptor: https://192.168.38.105:9999 - vagrant:vagrant Primary Lab Features:* Microsoft Advanced Threat Analytics is installed on the WEF machine, with the lightweight ATA gateway installed on the DC
* Windoes Evenet forwarder along with Winlogbeat are pre-installed and all indexes are pre-created on ELK. Technology add-ons for Windows are also preconfigured.
* A custom Windows auditing configuration is set via GPO to include command line process auditing and additional OS-level logging
* Palantir's Windows Event Forwarding subscriptions and custom channels are implemented
* Powershell transcript logging is enabled. All logs are saved to \\wef\pslogs* osquery comes installed on each host and is pre-configured to connect to a Fleet server via TLS. Fleet is preconfigured with the configuration from Palantir's osquery Configuration
* Sysmon is installed and configured using Olaf's open-sourced configuration
* All autostart items are logged to Windows Event Logs via AutorunsToWinEventLog
* SMBv1 Auditing is enabled Lab Hosts:1.
DC - Windows 2016 Domain Controller

* WEF Server Configuration GPO
* Powershell logging GPO
* Enhanced Windows Auditing policy GPO
* Sysmon
* osquery
* Elastic Beats Forwarder (Forwards Sysmon & osquery)
* Sysinternals Tools
* Microsft Advanced Threat Analytics Lightweight Gateway

2.
WEF - Windows 2016 Server

* Microsoft Advanced Threat Analytics
* Windows Event Collector
* Windows Event Subscription Creation
* Powershell transcription logging share
* Sysmon
* osquery
* Elastic Beats Forwarder (Forwards WinEventLog & Powershell & Sysmon & osquery)
* Sysinternals tools

3.
Win10 - Windows 10 Workstation

* Simulates employee workstation
* Sysmon
* osquery
* Sysinternals Tools

4.
Logger - Ubuntu 18.04

* Kibana
* Fleet osquery Manager
* Bro
* Suricata
* Elastic Beats Forwarder (Forwards Bro logs & Suricata & osquery)
* Guacamole
* Velociraptor Requirements* 55GB+ of free disk space
* 16GB+ of RAM
* Vagrant 2.2.2 or newer
* Virtualbox Deployment Options1.
Use Vagrant Cloud Boxes - ETA ~2 hours.

*[...]

___________________________
@hacking_Attack
@Hacking_Video

Install Vagrant on your system.
* Install Packer on your system.
* Install the Vagrant-Reload plugin by running the following command: vagrant plugin install vagrant-reload.
* Download DetectionLabELK to your local machine by running git clone https://github.com/cyberdefenders/DetectionLabELK.gitfrom command line OR download it directly via this link.
* cdto "DetectionLabELK/Vagrant" and execute vagrant up.

2.
Build Boxes From Scratch - ETA ~5 hours.

* Install Vagrant on your system.
* Install Packer on your system.
* Install "Vagrant-Reload" plugin by running the following command: vagrant plugin install vagrant-reload.
* Download DetectionLabELK to your local machine by running git clone https://github.com/cyberdefenders/DetectionLabELK.gitfrom command line OR download it directly via this link.
* cdto "DetectionLabELK" base directory and build the lab by executing ./build.sh virtualbox(Mac & Linux) or ./build.ps1 virtualbox(Windows). Troubleshooting:* To verify that building process completed successfully, ensure you are in DetectionLabELK/Vagrantdirectory and run vagrant status. The four machines (wef,dc,logger and win10) should be running. if one of the machines was not running, execute vagrant reload . If you would like to pause the whole lab, execute vagrant suspendand resume it using vagrant resume.
* Deployment logs will be present in the Vagrantfolder as vagrant_up_Lab Access:* Navigate to https://192.168.38.105:8080/guacamole in a browser to access Guacamole. Default credentials are vagrant:vagrant.
* Navigate to https://192.168.38.105:5601 in a browser to access the Kibana dashboard on logger. Default credentials are vagrant:vagrant.
* Navigate to https://192.168.38.105:8412 in a browser to access the Fleet server on logger. Default credentials are vagrant:vagrant.
* Navigate to https://192.168.38.103 in a browser to access Microsoft ATA. Default credentials are vagrant:vagrant.
* Navigate to https://192.168.38.105:9999 in a browser to access velociraptor. Default credentials are vagrant:vagrant.

Support: If you face any problem, please open a new issue and provide relevant log file. Download DetectionLabELK

___________________________
@hacking_Attack
@Hacking_Video

Looking for a tool to visualize data as I enumerate a network
https://www.reddit.com/r/Pentesting/comments/r4gso6/looking_for_a_tool_to_visualize_data_as_i/

I like using Visio to visualize connectivity between network components. But the standard templates need a decent amount of customization to use during a pentest. As I enumerate a network or a system I'd like to be able to update data fields for a shape in the diagram, for example having fields like Open Ports, Services, Usernames, passwords, etc. Does anyone know of pentest specific Visio templates or other tools that do something similar? submitted by /u/bishop527 (https://www.reddit.com/user/bishop527)
[link] (https://www.reddit.com/r/Pentesting/comments/r4gso6/looking_for_a_tool_to_visualize_data_as_i/) [comments] (https://www.reddit.com/r/Pentesting/comments/r4gso6/looking_for_a_tool_to_visualize_data_as_i/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
An Intro to Pagefile Forensic

https://cdn-images-1.medium.com/max/600/0*L_Rx5A_4-PNPJUMn.png
In this short write up, we will learn about pagefile and how pagefile forensic can help the investigator to get digital evidence from the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
WiFi blocking memories

So I remember one of my friends bringing this green computer chip and he somehow (i think) completely disrupted an internet signal. One distinct thing I remember was with the same device, he also created new networks with custom names in which he named it with varies funny names. It astounded me but he never told us how he did it. I just now remembered it and wanted to ask if any of you know how he did it or have an idea

submitted by /u/jac5423
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Would brute forcing a phone like this actually work?

https://vm.tiktok.com/ZM8tsVeTa/

submitted by /u/flyingsample
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What should I learn next?

I have just finished the basics of hacking and pentration testing and did a lot of practical work and know a lot of tools now, but i dont know where to next.

More books? or messing around on hack the box and stuff

submitted by /u/BigSausajey
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Looking for similar tools on github? What are your favorite tools on github?

Two amazing tools that I have found on github are:

https://github.com/sherlock-project/sherlock

and

https://github.com/thewhiteh4t/seeker

Anybody have any favorite tools that they use on github that are similar to these?

submitted by /u/Simshaffer
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Automatic target scanning

Hi everyone, recently I've read about how most black hats don't actually search for specific targets but rather just set up an automatic scan of lots of random IP addresses, go to bed and come back in the morning to see the result.

How do they do that? Do they simply use nmap? Which commands do they use?

submitted by /u/Danilomba
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video