DetectionLabELK is a fork from Chris Long's DetectionLab (https://github.com/clong/DetectionLab) with ELK stack instead of Splunk.
Description: DetectionLabELK is the perfect lab to use if you would like to build effective detection capabilities. It has been designed with defenders in mind. Its primary purpose is to allow blueteams to quickly build a Windows domain that comes pre-loaded with security tooling and some best practices when it comes to system logging configurations. It can easily be modified to fit most needs or expanded to include additional hosts. Use cases: A popular use case for DetectionLabELK is when you consider adopting MITRE ATT&CK framework and would like to develop detections for its tactics. You can use DetectionLabELK to quickly run atomic tests, see what logs are being generated and compare it to your production environment. This way you can: Validate that your production logging is working as expected. Ensure that your SIEM is collecting the correct events. Enhance alerts quality by reducing false positives and eliminating false negatives. Minimize coverage gaps. Lab Information: Domain Name: windomain.local Windows Admininstrator login: vagrant:vagrant Fleet login: https://192.168.38.105:8412 (https://192.168.38.105:8412/) - vagrant:vagrant Kibana login: http://192.168.38.105:5601 (http://192.168.38.105:5601/) - vagrant:vagrant Microsoft ATA login: https://192.168.38.103 (https://192.168.38.103/) - vagrant:vagrant Guacamole login: http://192.168.38.105:8080/guacamole - vagrant:vagrant Velociraptor: https://192.168.38.105:9999 (https://192.168.38.105:9999/) - vagrant:vagrant Primary Lab Features: Microsoft Advanced Threat Analytics (https://www.microsoft.com/en-us/cloud-platform/advanced-threat-analytics) is installed on the WEF machine, with the lightweight ATA gateway installed on the DC Windoes Evenet forwarder along with Winlogbeat are pre-installed and all indexes are pre-created on ELK. Technology add-ons for Windows are also preconfigured. A custom Windows auditing configuration is set via GPO to include command line (https://www.kitploit.com/search/label/Command%20Line) process auditing and additional OS-level logging Palantir's Windows Event Forwarding (http://github.com/palantir/windows-event-forwarding) subscriptions and custom channels are implemented Powershell transcript logging is enabled. All logs are saved to \\wef\pslogs osquery comes installed on each host and is pre-configured to connect to a Fleet (https://kolide.co/fleet) server via TLS. Fleet is preconfigured with the configuration from Palantir's osquery Configuration (https://github.com/palantir/osquery-configuration) Sysmon is installed and configured using Olaf's open-sourced configuration All autostart items are logged to Windows Event Logs (https://www.kitploit.com/search/label/Windows%20Event%20Logs) via AutorunsToWinEventLog (https://github.com/palantir/windows-event-forwarding/tree/master/AutorunsToWinEventLog) SMBv1 Auditing is enabled Lab Hosts: DC - Windows 2016 Domain Controller WEF Server Configuration GPO Powershell logging GPO Enhanced Windows Auditing policy GPO Sysmon osquery Elastic Beats Forwarder (Forwards Sysmon & osquery) Sysinternals Tools Microsft Advanced Threat Analytics Lightweight Gateway WEF - Windows 2016 Server Microsoft Advanced Threat Analytics Windows Event Collector Windows Event Subscription Creation Powershell transcription logging share Sysmon osquery Elastic Beats Forwarder (Forwards WinEventLog & Powershell & Sysmon & osquery) Sysinternals tools Win10 - Windows 10 Workstation Simulates employee workstation Sysmon osquery Sysinternals Tools Logger - Ubuntu 18.04 Kibana Fleet osquery Manager Bro Suricata Elastic Beats Forwarder (Forwards Bro logs & Suricata & osquery) Guacamole Velociraptor Requirements 55GB+ of free disk space 16GB+ of RAM Vagrant 2.2.2 or newer Virtualbox

___________________________
@hacking_Attack
@Hacking_Video

Deployment Options Use Vagrant Cloud Boxes - ETA ~2 hours. Install Vagrant (https://www.vagrantup.com/downloads.html) on your system. Install Packer (https://packer.io/downloads.html) on your system. Install the Vagrant-Reload plugin by running the following command: vagrant plugin install vagrant-reload. Download DetectionLabELK to your local machine by running git clone https://github.com/cyberdefenders/DetectionLabELK.git from command line OR download it directly via this link (https://github.com/cyberdefenders/DetectionLabELK/archive/master.zip). cd to "DetectionLabELK/Vagrant" and execute vagrant up. Build Boxes From Scratch - ETA ~5 hours. Install Vagrant (https://www.vagrantup.com/downloads.html) on your system. Install Packer (https://packer.io/downloads.html) on your system. Install "Vagrant-Reload" plugin by running the following command: vagrant plugin install vagrant-reload. Download DetectionLabELK to your local machine by running git clone https://github.com/cyberdefenders/DetectionLabELK.git from command line OR download it directly via this link (https://github.com/cyberdefenders/DetectionLabELK/archive/master.zip). cd to "DetectionLabELK" base directory and build the lab by executing ./build.sh virtualbox (Mac & Linux) or ./build.ps1 virtualbox (Windows). Troubleshooting: To verify that building process completed successfully, ensure you are in DetectionLabELK/Vagrant directory and run vagrant status. The four machines (wef,dc,logger and win10) should be running. if one of the machines was not running, execute vagrant reload . If you would like to pause the whole lab, execute vagrant suspend and resume it using vagrant resume. Deployment logs will be present in the Vagrant folder as vagrant_up_.log Lab Access: Navigate to https://192.168.38.105:8080/guacamole in a browser to access Guacamole. Default credentials (https://www.kitploit.com/search/label/Credentials) are vagrant:vagrant. Navigate to https://192.168.38.105:5601 (https://192.168.38.105:5601/) in a browser to access the Kibana dashboard on logger. Default credentials are vagrant:vagrant. Navigate to https://192.168.38.105:8412 (https://192.168.38.105:8412/) in a browser to access the Fleet server on logger. Default credentials are vagrant:vagrant. Navigate to https://192.168.38.103 (https://192.168.38.103/) in a browser to access Microsoft ATA. Default credentials are vagrant:vagrant. Navigate to https://192.168.38.105:9999 (https://192.168.38.105:9999/) in a browser to access velociraptor. Default credentials are vagrant:vagrant. Support: If you face any problem, please open a new issue (https://github.com/cyberdefenders/DetectionLabELK/issues) and provide relevant log file.

Download DetectionLabELK (https://github.com/cyberdefenders/DetectionLabELK)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
DetectionLabELK - A Fork From DetectionLab With ELK Stack Instead Of Splunk

http://3.bp.blogspot.com/-FRPqw2CF_-s/YaBJP6W5WqI/AAAAAAAA4ic/fC7NtLYr7Pw4f4u6S9o1Z3hDTxGDysYRwCK4BGAYYCw/w640-h402/DetectionLabELK_1_DetectionLabELK-new-751362.png DetectionLabELK is a fork from Chris Long's DetectionLab with ELK stack instead of Splunk. Description:DetectionLabELK is the perfect lab to use if you would like to build effective detection capabilities. It has been designed with defenders in mind. Its primary purpose is to allow blueteams to quickly build a Windows domain that comes pre-loaded with security tooling and some best practices when it comes to system logging configurations. It can easily be modified to fit most needs or expanded to include additional hosts. Use cases:A popular use case for DetectionLabELK is when you consider adopting MITRE ATT&CK framework and would like to develop detections for its tactics. You can use DetectionLabELK to quickly run atomic tests, see what logs are being generated and compare it to your production environment. This way you can:

* Validate that your production logging is working as expected.
* Ensure that your SIEM is collecting the correct events.
* Enhance alerts quality by reducing false positives and eliminating false negatives.
* Minimize coverage gaps. Lab Information:* Domain Name: windomain.local
* Windows Admininstrator login: vagrant:vagrant
* Fleet login: https://192.168.38.105:8412 - vagrant:vagrant
* Kibana login: http://192.168.38.105:5601 - vagrant:vagrant
* Microsoft ATA login: https://192.168.38.103 - vagrant:vagrant
* Guacamole login: http://192.168.38.105:8080/guacamole - vagrant:vagrant
* Velociraptor: https://192.168.38.105:9999 - vagrant:vagrant Primary Lab Features:* Microsoft Advanced Threat Analytics is installed on the WEF machine, with the lightweight ATA gateway installed on the DC
* Windoes Evenet forwarder along with Winlogbeat are pre-installed and all indexes are pre-created on ELK. Technology add-ons for Windows are also preconfigured.
* A custom Windows auditing configuration is set via GPO to include command line process auditing and additional OS-level logging
* Palantir's Windows Event Forwarding subscriptions and custom channels are implemented
* Powershell transcript logging is enabled. All logs are saved to \\wef\pslogs* osquery comes installed on each host and is pre-configured to connect to a Fleet server via TLS. Fleet is preconfigured with the configuration from Palantir's osquery Configuration
* Sysmon is installed and configured using Olaf's open-sourced configuration
* All autostart items are logged to Windows Event Logs via AutorunsToWinEventLog
* SMBv1 Auditing is enabled Lab Hosts:1.
DC - Windows 2016 Domain Controller

* WEF Server Configuration GPO
* Powershell logging GPO
* Enhanced Windows Auditing policy GPO
* Sysmon
* osquery
* Elastic Beats Forwarder (Forwards Sysmon & osquery)
* Sysinternals Tools
* Microsft Advanced Threat Analytics Lightweight Gateway

2.
WEF - Windows 2016 Server

* Microsoft Advanced Threat Analytics
* Windows Event Collector
* Windows Event Subscription Creation
* Powershell transcription logging share
* Sysmon
* osquery
* Elastic Beats Forwarder (Forwards WinEventLog & Powershell & Sysmon & osquery)
* Sysinternals tools

3.
Win10 - Windows 10 Workstation

* Simulates employee workstation
* Sysmon
* osquery
* Sysinternals Tools

4.
Logger - Ubuntu 18.04

* Kibana
* Fleet osquery Manager
* Bro
* Suricata
* Elastic Beats Forwarder (Forwards Bro logs & Suricata & osquery)
* Guacamole
* Velociraptor Requirements* 55GB+ of free disk space
* 16GB+ of RAM
* Vagrant 2.2.2 or newer
* Virtualbox Deployment Options1.
Use Vagrant Cloud Boxes - ETA ~2 hours.

*[...]

___________________________
@hacking_Attack
@Hacking_Video

Install Vagrant on your system.
* Install Packer on your system.
* Install the Vagrant-Reload plugin by running the following command: vagrant plugin install vagrant-reload.
* Download DetectionLabELK to your local machine by running git clone https://github.com/cyberdefenders/DetectionLabELK.gitfrom command line OR download it directly via this link.
* cdto "DetectionLabELK/Vagrant" and execute vagrant up.

2.
Build Boxes From Scratch - ETA ~5 hours.

* Install Vagrant on your system.
* Install Packer on your system.
* Install "Vagrant-Reload" plugin by running the following command: vagrant plugin install vagrant-reload.
* Download DetectionLabELK to your local machine by running git clone https://github.com/cyberdefenders/DetectionLabELK.gitfrom command line OR download it directly via this link.
* cdto "DetectionLabELK" base directory and build the lab by executing ./build.sh virtualbox(Mac & Linux) or ./build.ps1 virtualbox(Windows). Troubleshooting:* To verify that building process completed successfully, ensure you are in DetectionLabELK/Vagrantdirectory and run vagrant status. The four machines (wef,dc,logger and win10) should be running. if one of the machines was not running, execute vagrant reload . If you would like to pause the whole lab, execute vagrant suspendand resume it using vagrant resume.
* Deployment logs will be present in the Vagrantfolder as vagrant_up_Lab Access:* Navigate to https://192.168.38.105:8080/guacamole in a browser to access Guacamole. Default credentials are vagrant:vagrant.
* Navigate to https://192.168.38.105:5601 in a browser to access the Kibana dashboard on logger. Default credentials are vagrant:vagrant.
* Navigate to https://192.168.38.105:8412 in a browser to access the Fleet server on logger. Default credentials are vagrant:vagrant.
* Navigate to https://192.168.38.103 in a browser to access Microsoft ATA. Default credentials are vagrant:vagrant.
* Navigate to https://192.168.38.105:9999 in a browser to access velociraptor. Default credentials are vagrant:vagrant.

Support: If you face any problem, please open a new issue and provide relevant log file. Download DetectionLabELK

___________________________
@hacking_Attack
@Hacking_Video

Looking for a tool to visualize data as I enumerate a network
https://www.reddit.com/r/Pentesting/comments/r4gso6/looking_for_a_tool_to_visualize_data_as_i/

I like using Visio to visualize connectivity between network components. But the standard templates need a decent amount of customization to use during a pentest. As I enumerate a network or a system I'd like to be able to update data fields for a shape in the diagram, for example having fields like Open Ports, Services, Usernames, passwords, etc. Does anyone know of pentest specific Visio templates or other tools that do something similar? submitted by /u/bishop527 (https://www.reddit.com/user/bishop527)
[link] (https://www.reddit.com/r/Pentesting/comments/r4gso6/looking_for_a_tool_to_visualize_data_as_i/) [comments] (https://www.reddit.com/r/Pentesting/comments/r4gso6/looking_for_a_tool_to_visualize_data_as_i/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
An Intro to Pagefile Forensic

https://cdn-images-1.medium.com/max/600/0*L_Rx5A_4-PNPJUMn.png
In this short write up, we will learn about pagefile and how pagefile forensic can help the investigator to get digital evidence from the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
WiFi blocking memories

So I remember one of my friends bringing this green computer chip and he somehow (i think) completely disrupted an internet signal. One distinct thing I remember was with the same device, he also created new networks with custom names in which he named it with varies funny names. It astounded me but he never told us how he did it. I just now remembered it and wanted to ask if any of you know how he did it or have an idea

submitted by /u/jac5423
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Would brute forcing a phone like this actually work?

https://vm.tiktok.com/ZM8tsVeTa/

submitted by /u/flyingsample
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What should I learn next?

I have just finished the basics of hacking and pentration testing and did a lot of practical work and know a lot of tools now, but i dont know where to next.

More books? or messing around on hack the box and stuff

submitted by /u/BigSausajey
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Looking for similar tools on github? What are your favorite tools on github?

Two amazing tools that I have found on github are:

https://github.com/sherlock-project/sherlock

and

https://github.com/thewhiteh4t/seeker

Anybody have any favorite tools that they use on github that are similar to these?

submitted by /u/Simshaffer
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Automatic target scanning

Hi everyone, recently I've read about how most black hats don't actually search for specific targets but rather just set up an automatic scan of lots of random IP addresses, go to bed and come back in the morning to see the result.

How do they do that? Do they simply use nmap? Which commands do they use?

submitted by /u/Danilomba
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
How to Protect Small and Medium-Sized Businesses From Cyberattacks

Many small and medium-sized business owners mistakenly believe that their businesses will not fall victim to cyberattacks due to low turnover and a small amount of data. They believe that only large companies are exposed to such threats. However, most often in any company, it is employees who neglect security measures that pose a threat.

As a result, the personal information of the workers, as well as the company’s customers, leaks into the network. This ends in either fraud or theft. In any case, each owner should pay attention in advance to how to protect their business and their customers.

Today we will tell you about the steps you need to go through to minimize the risks.

https://kalilinuxtutorials.com/wp-content/uploads/2021/11/image-1-816x1024.png Stage one: check the storage of informationFirst, you should pay attention to where all your data is stored and who can view it. Next, you need to determine what vulnerabilities you have.

It should be said that such work cannot be done on your own if you do not understand cybersecurity issues. You can only do a cursory check.

It is advisable to have employees who specialize in these matters or to hire contractors. This is due to the fact that the check must be carried out regularly. If you do not do it, then you may not notice how your data was stolen.

After checking, answer the following questions:

* Is there a person on your staff who can secure your data?
* Is the anti-virus installed on the computers of all employees of the company?
* Are employees familiar with the rules of network security?
* Do you use programs to encrypt your data?
* How can you set up a Threat Alert System?
* Do you have a ready-made action plan in case of a threat?

If you answered negatively to most of the questions, then you have serious problems. At the end of the check, proceed to the next step. Stage two: inform the staffFirst of all, you must inform each employee that any careless and rash action can destroy what you have been working on. This applies to absolutely everyone, even those who are not directly associated with valuable data.

For instance, your designer, who does not interact with information about employees or clients, can sit in a cafe, use free Wi-Fi and create designs for your website or product illustrations, removing the background at retoucher.online or creating a company logo, may not even suspect that his actions could lead to a data leak.

More than 80% of successful hacker actions were committed due to reckless actions of employees.

https://kalilinuxtutorials.com/wp-content/uploads/2021/11/image-2.png

That is why it is necessary to hold a collective meeting and inform employees about what actions can lead to the vulnerability of the company. You can invite specialists to teach your staff how to use security programs, create complex passwords and work with external media. Stage three: use the official softwareMany companies are reluctant to use licensed software because it is too expensive. However, it should be borne in mind that manufacturers of official software constantly test their programs and identify unprotected places. When they find them, they release updated programs that are more secure.

Attackers do not need to target a specific company. They can find a flaw in the software that is used by the majority and hit everyone at once. Using the licensed software will allow you to receive improved versions of the software in a timely manner. Stage four: generating complex passwordsIt may seem that this little thing cannot do significant harm. However, research shows that 17% of hacks are due to the creation of too simple passwords.

When creating mail for work, many use personal i[...]

___________________________
@hacking_Attack
@Hacking_Video

nformation that they can easily remember. However, not everyone understands that your mail will be able to provide access to the corporate network and disclose all information of interest to hackers.

https://kalilinuxtutorials.com/wp-content/uploads/2021/11/image-3.png

In this regard, it is recommended to perform the following actions:

* Each account must have a unique password;
* Passwords should be updated at least every six months;
* If possible, then set two-factor verification;
* Use password generators to create complex combinations;
* Don’t save passwords in your browser;
* Disable autocomplete. Stage five: test the backup servicesIn the event of an attack, you risk losing all the information you need to run your business. If you have backups, then it will not be difficult for you to quickly restore your data.

However, many people forget that it is necessary to regularly check the correctly configured services that save your data. In order to prevent gray hair from appearing on your head in an instant, check your backups regularly. Stage six: secure Wi-Fihttps://kalilinuxtutorials.com/wp-content/uploads/2021/11/image-4.png
Your router should be configured for maximum protection against hacking. Manually review any settings that will prevent an unauthorized user from gaining access to your network. OutputStop thinking that if you own a small or medium business, then hackers are not interested in stealing your data and not selling it to third parties or demanding a huge amount of money from you to get it back. Conduct regular security checks, inform your employees about possible oversights that could lead to data breaches.

___________________________
@hacking_Attack
@Hacking_Video

Price Manipulation Bypass Using Integer Overflow Method
https://marxchryz.medium.com/price-manipulation-bypass-using-integer-overflow-method-36ff23ebe91d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello everyone, I am Marx Chryz and I do bug bounty hunting for about a year now.Continue reading on Medium » (https://marxchryz.medium.com/price-manipulation-bypass-using-integer-overflow-method-36ff23ebe91d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video