KitPloit - PenTest Tools!
DetectionLabELK - A Fork From DetectionLab With ELK Stack Instead Of Splunk

http://3.bp.blogspot.com/-FRPqw2CF_-s/YaBJP6W5WqI/AAAAAAAA4ic/fC7NtLYr7Pw4f4u6S9o1Z3hDTxGDysYRwCK4BGAYYCw/w640-h402/DetectionLabELK_1_DetectionLabELK-new-751362.png DetectionLabELK is a fork from Chris Long's DetectionLab with ELK stack instead of Splunk. Description:DetectionLabELK is the perfect lab to use if you would like to build effective detection capabilities. It has been designed with defenders in mind. Its primary purpose is to allow blueteams to quickly build a Windows domain that comes pre-loaded with security tooling and some best practices when it comes to system logging configurations. It can easily be modified to fit most needs or expanded to include additional hosts. Use cases:A popular use case for DetectionLabELK is when you consider adopting MITRE ATT&CK framework and would like to develop detections for its tactics. You can use DetectionLabELK to quickly run atomic tests, see what logs are being generated and compare it to your production environment. This way you can:

* Validate that your production logging is working as expected.
* Ensure that your SIEM is collecting the correct events.
* Enhance alerts quality by reducing false positives and eliminating false negatives.
* Minimize coverage gaps. Lab Information:* Domain Name: windomain.local
* Windows Admininstrator login: vagrant:vagrant
* Fleet login: https://192.168.38.105:8412 - vagrant:vagrant
* Kibana login: http://192.168.38.105:5601 - vagrant:vagrant
* Microsoft ATA login: https://192.168.38.103 - vagrant:vagrant
* Guacamole login: http://192.168.38.105:8080/guacamole - vagrant:vagrant
* Velociraptor: https://192.168.38.105:9999 - vagrant:vagrant Primary Lab Features:* Microsoft Advanced Threat Analytics is installed on the WEF machine, with the lightweight ATA gateway installed on the DC
* Windoes Evenet forwarder along with Winlogbeat are pre-installed and all indexes are pre-created on ELK. Technology add-ons for Windows are also preconfigured.
* A custom Windows auditing configuration is set via GPO to include command line process auditing and additional OS-level logging
* Palantir's Windows Event Forwarding subscriptions and custom channels are implemented
* Powershell transcript logging is enabled. All logs are saved to \\wef\pslogs* osquery comes installed on each host and is pre-configured to connect to a Fleet server via TLS. Fleet is preconfigured with the configuration from Palantir's osquery Configuration
* Sysmon is installed and configured using Olaf's open-sourced configuration
* All autostart items are logged to Windows Event Logs via AutorunsToWinEventLog
* SMBv1 Auditing is enabled Lab Hosts:1.
DC - Windows 2016 Domain Controller

* WEF Server Configuration GPO
* Powershell logging GPO
* Enhanced Windows Auditing policy GPO
* Sysmon
* osquery
* Elastic Beats Forwarder (Forwards Sysmon & osquery)
* Sysinternals Tools
* Microsft Advanced Threat Analytics Lightweight Gateway

2.
WEF - Windows 2016 Server

* Microsoft Advanced Threat Analytics
* Windows Event Collector
* Windows Event Subscription Creation
* Powershell transcription logging share
* Sysmon
* osquery
* Elastic Beats Forwarder (Forwards WinEventLog & Powershell & Sysmon & osquery)
* Sysinternals tools

3.
Win10 - Windows 10 Workstation

* Simulates employee workstation
* Sysmon
* osquery
* Sysinternals Tools

4.
Logger - Ubuntu 18.04

* Kibana
* Fleet osquery Manager
* Bro
* Suricata
* Elastic Beats Forwarder (Forwards Bro logs & Suricata & osquery)
* Guacamole
* Velociraptor Requirements* 55GB+ of free disk space
* 16GB+ of RAM
* Vagrant 2.2.2 or newer
* Virtualbox Deployment Options1.
Use Vagrant Cloud Boxes - ETA ~2 hours.

*[...]

___________________________
@hacking_Attack
@Hacking_Video

Install Vagrant on your system.
* Install Packer on your system.
* Install the Vagrant-Reload plugin by running the following command: vagrant plugin install vagrant-reload.
* Download DetectionLabELK to your local machine by running git clone https://github.com/cyberdefenders/DetectionLabELK.gitfrom command line OR download it directly via this link.
* cdto "DetectionLabELK/Vagrant" and execute vagrant up.

2.
Build Boxes From Scratch - ETA ~5 hours.

* Install Vagrant on your system.
* Install Packer on your system.
* Install "Vagrant-Reload" plugin by running the following command: vagrant plugin install vagrant-reload.
* Download DetectionLabELK to your local machine by running git clone https://github.com/cyberdefenders/DetectionLabELK.gitfrom command line OR download it directly via this link.
* cdto "DetectionLabELK" base directory and build the lab by executing ./build.sh virtualbox(Mac & Linux) or ./build.ps1 virtualbox(Windows). Troubleshooting:* To verify that building process completed successfully, ensure you are in DetectionLabELK/Vagrantdirectory and run vagrant status. The four machines (wef,dc,logger and win10) should be running. if one of the machines was not running, execute vagrant reload . If you would like to pause the whole lab, execute vagrant suspendand resume it using vagrant resume.
* Deployment logs will be present in the Vagrantfolder as vagrant_up_Lab Access:* Navigate to https://192.168.38.105:8080/guacamole in a browser to access Guacamole. Default credentials are vagrant:vagrant.
* Navigate to https://192.168.38.105:5601 in a browser to access the Kibana dashboard on logger. Default credentials are vagrant:vagrant.
* Navigate to https://192.168.38.105:8412 in a browser to access the Fleet server on logger. Default credentials are vagrant:vagrant.
* Navigate to https://192.168.38.103 in a browser to access Microsoft ATA. Default credentials are vagrant:vagrant.
* Navigate to https://192.168.38.105:9999 in a browser to access velociraptor. Default credentials are vagrant:vagrant.

Support: If you face any problem, please open a new issue and provide relevant log file. Download DetectionLabELK

___________________________
@hacking_Attack
@Hacking_Video

Looking for a tool to visualize data as I enumerate a network
https://www.reddit.com/r/Pentesting/comments/r4gso6/looking_for_a_tool_to_visualize_data_as_i/

I like using Visio to visualize connectivity between network components. But the standard templates need a decent amount of customization to use during a pentest. As I enumerate a network or a system I'd like to be able to update data fields for a shape in the diagram, for example having fields like Open Ports, Services, Usernames, passwords, etc. Does anyone know of pentest specific Visio templates or other tools that do something similar? submitted by /u/bishop527 (https://www.reddit.com/user/bishop527)
[link] (https://www.reddit.com/r/Pentesting/comments/r4gso6/looking_for_a_tool_to_visualize_data_as_i/) [comments] (https://www.reddit.com/r/Pentesting/comments/r4gso6/looking_for_a_tool_to_visualize_data_as_i/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
An Intro to Pagefile Forensic

https://cdn-images-1.medium.com/max/600/0*L_Rx5A_4-PNPJUMn.png
In this short write up, we will learn about pagefile and how pagefile forensic can help the investigator to get digital evidence from the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
WiFi blocking memories

So I remember one of my friends bringing this green computer chip and he somehow (i think) completely disrupted an internet signal. One distinct thing I remember was with the same device, he also created new networks with custom names in which he named it with varies funny names. It astounded me but he never told us how he did it. I just now remembered it and wanted to ask if any of you know how he did it or have an idea

submitted by /u/jac5423
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Would brute forcing a phone like this actually work?

https://vm.tiktok.com/ZM8tsVeTa/

submitted by /u/flyingsample
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What should I learn next?

I have just finished the basics of hacking and pentration testing and did a lot of practical work and know a lot of tools now, but i dont know where to next.

More books? or messing around on hack the box and stuff

submitted by /u/BigSausajey
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Looking for similar tools on github? What are your favorite tools on github?

Two amazing tools that I have found on github are:

https://github.com/sherlock-project/sherlock

and

https://github.com/thewhiteh4t/seeker

Anybody have any favorite tools that they use on github that are similar to these?

submitted by /u/Simshaffer
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Automatic target scanning

Hi everyone, recently I've read about how most black hats don't actually search for specific targets but rather just set up an automatic scan of lots of random IP addresses, go to bed and come back in the morning to see the result.

How do they do that? Do they simply use nmap? Which commands do they use?

submitted by /u/Danilomba
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
How to Protect Small and Medium-Sized Businesses From Cyberattacks

Many small and medium-sized business owners mistakenly believe that their businesses will not fall victim to cyberattacks due to low turnover and a small amount of data. They believe that only large companies are exposed to such threats. However, most often in any company, it is employees who neglect security measures that pose a threat.

As a result, the personal information of the workers, as well as the company’s customers, leaks into the network. This ends in either fraud or theft. In any case, each owner should pay attention in advance to how to protect their business and their customers.

Today we will tell you about the steps you need to go through to minimize the risks.

https://kalilinuxtutorials.com/wp-content/uploads/2021/11/image-1-816x1024.png Stage one: check the storage of informationFirst, you should pay attention to where all your data is stored and who can view it. Next, you need to determine what vulnerabilities you have.

It should be said that such work cannot be done on your own if you do not understand cybersecurity issues. You can only do a cursory check.

It is advisable to have employees who specialize in these matters or to hire contractors. This is due to the fact that the check must be carried out regularly. If you do not do it, then you may not notice how your data was stolen.

After checking, answer the following questions:

* Is there a person on your staff who can secure your data?
* Is the anti-virus installed on the computers of all employees of the company?
* Are employees familiar with the rules of network security?
* Do you use programs to encrypt your data?
* How can you set up a Threat Alert System?
* Do you have a ready-made action plan in case of a threat?

If you answered negatively to most of the questions, then you have serious problems. At the end of the check, proceed to the next step. Stage two: inform the staffFirst of all, you must inform each employee that any careless and rash action can destroy what you have been working on. This applies to absolutely everyone, even those who are not directly associated with valuable data.

For instance, your designer, who does not interact with information about employees or clients, can sit in a cafe, use free Wi-Fi and create designs for your website or product illustrations, removing the background at retoucher.online or creating a company logo, may not even suspect that his actions could lead to a data leak.

More than 80% of successful hacker actions were committed due to reckless actions of employees.

https://kalilinuxtutorials.com/wp-content/uploads/2021/11/image-2.png

That is why it is necessary to hold a collective meeting and inform employees about what actions can lead to the vulnerability of the company. You can invite specialists to teach your staff how to use security programs, create complex passwords and work with external media. Stage three: use the official softwareMany companies are reluctant to use licensed software because it is too expensive. However, it should be borne in mind that manufacturers of official software constantly test their programs and identify unprotected places. When they find them, they release updated programs that are more secure.

Attackers do not need to target a specific company. They can find a flaw in the software that is used by the majority and hit everyone at once. Using the licensed software will allow you to receive improved versions of the software in a timely manner. Stage four: generating complex passwordsIt may seem that this little thing cannot do significant harm. However, research shows that 17% of hacks are due to the creation of too simple passwords.

When creating mail for work, many use personal i[...]

___________________________
@hacking_Attack
@Hacking_Video

nformation that they can easily remember. However, not everyone understands that your mail will be able to provide access to the corporate network and disclose all information of interest to hackers.

https://kalilinuxtutorials.com/wp-content/uploads/2021/11/image-3.png

In this regard, it is recommended to perform the following actions:

* Each account must have a unique password;
* Passwords should be updated at least every six months;
* If possible, then set two-factor verification;
* Use password generators to create complex combinations;
* Don’t save passwords in your browser;
* Disable autocomplete. Stage five: test the backup servicesIn the event of an attack, you risk losing all the information you need to run your business. If you have backups, then it will not be difficult for you to quickly restore your data.

However, many people forget that it is necessary to regularly check the correctly configured services that save your data. In order to prevent gray hair from appearing on your head in an instant, check your backups regularly. Stage six: secure Wi-Fihttps://kalilinuxtutorials.com/wp-content/uploads/2021/11/image-4.png
Your router should be configured for maximum protection against hacking. Manually review any settings that will prevent an unauthorized user from gaining access to your network. OutputStop thinking that if you own a small or medium business, then hackers are not interested in stealing your data and not selling it to third parties or demanding a huge amount of money from you to get it back. Conduct regular security checks, inform your employees about possible oversights that could lead to data breaches.

___________________________
@hacking_Attack
@Hacking_Video

Price Manipulation Bypass Using Integer Overflow Method
https://marxchryz.medium.com/price-manipulation-bypass-using-integer-overflow-method-36ff23ebe91d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello everyone, I am Marx Chryz and I do bug bounty hunting for about a year now.Continue reading on Medium » (https://marxchryz.medium.com/price-manipulation-bypass-using-integer-overflow-method-36ff23ebe91d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
PyRDP : RDP Monster-In-The-Middle (Mitm) And Library For Python With The Ability To Watch Connections Live Or After The Fact

PyRDP is a Python Remote Desktop Protocol (RDP) Monster-in-the-Middle (MITM) tool and library.

It features a few tools:

* RDP Monster-in-the-Middle
* Logs credentials used when connecting
* Steals data copied to the clipboard
* Saves a copy of the files transferred over the network
* Crawls shared drives in the background and saves them locally
* Saves replays of connections so you can look at them later
* Runs console commands or PowerShell payloads automatically on new connections

* RDP Player:
* See live RDP connections coming from the MITM
* View replays of RDP connections
* Take control of active RDP sessions while hiding your actions
* List the client’s mapped drives and download files from them during active sessions

* RDP Certificate Cloner:
* Create a self-signed X509 certificate with the same fields as an RDP server’s certificate
PyRDP was introduced in 2018 in which we demonstrated that we can catch a real threat actor in action. This tool is being developed with both pentest and malware research use cases in mind.

Supported Systems

PyRDP should work on Python 3.6 and up on the x86-64, ARM and ARM64 platforms.

This tool has been tested to work on Python 3.6 on Linux (Ubuntu 18.04), Raspberry Pi and Windows (see section Installing on Windows). It has not been tested on macOS.

Installing Using the Docker Image

This is the easiest installation method if you have docker installed and working.

docker pull gosecure/pyrdp:latest

As an alternative we have a slimmer image without the GUI and ffmpeg dependencies. This is the only provided image on ARM platforms.

docker pull gosecure/pyrdp:latest-slim

You can find the list of all our Docker images on the gosecure/pyrdp DockerHub page. From Git Source

We recommend installing PyRDP in a virtual environment to avoid dependency issues.

First, make sure to install the prerequisite packages (on Ubuntu). We provide two types of installs a full one and a slim one. Install the dependencies according to your use case.

#Full install (GUI, transcoding to MP4)
sudo apt install python3 python3-pip python3-dev python3-setuptools python3-venv \
build-essential python3-dev git openssl \
libdbus-1-dev libdbus-glib-1-dev libgl1-mesa-glx \
notify-osd dbus-x11 libxkbcommon-x11-0 libxcb-xinerama0 \
libavformat-dev libavcodec-dev libavdevice-dev \
libavutil-dev libswscale-dev libswresample-dev libavfilter-dev
#Slim install (no GUI, no transcoding)
sudo apt install python3 python3-pip python3-setuptools python3-venv \
build-essential python3-dev git openssl

Grab PyRDP’s source code:

git clone https://github.com/gosecure/pyrdp.git

Then, create your virtual environment in the venvdirectory inside PyRDP’s directory:

cd pyrdp
python3 -m venv venv

DO NOT use the root PyRDP directory for the virtual environment folder (python3 -m venv .). You will make a mess, and using a directory name like venvis more standard anyway.

Before installing the dependencies, you need to activate your virtual environment:

source venv/bin/activate

Finally, you can install the project with Pip:

pip3 install -U pip setuptools wheel
Without GUI and ffmpeg dependencies
pip3 install -U -e .
With GUI and ffmpeg dependencies
pip3 install -U -e ‘.[full]’

This should install the dependencies required to run PyRDP. If you choose to install without GUI or ffmpeg dependencies, it will not be possible to use pyrdp-playerwithout headless mode (--headless) or pyrdp-convert.

If you ever want to leave your virtual environment, you can simply deactivate it:

deactivate

Note that you will have to activate your environment every time you want to [...]

___________________________
@hacking_Attack
@Hacking_Video

have the PyRDP scripts available as shell commands. Installing on Windows

The steps are almost the same. There are two additional prerequisites.

* Any C compiler
* OpenSSL. Make sure it is reachable from your $PATH.

Then, create your virtual environment in PyRDP’s directory:

cd pyrdp
python3 -m venv venv

DO NOT use the root PyRDP directory for the virtual environment folder (python3 -m venv .). You will make a mess, and using a directory name like venvis more standard anyway.

Before installing the dependencies, you need to activate your virtual environment:

venv\Scripts\activate

Finally, you can install the project with Pip:

pip3 install -U pip setuptools wheel
pip3 install -U -e “.[full]”

This should install all the dependencies required to run PyRDP.

If you ever want to leave your virtual environment, you can simply deactivate it:

deactivate

Note that you will have to activate your environment every time you want to have the PyRDP scripts available as shell commands. Building the Docker Image

First of all, build the image by executing this command at the root of PyRDP (where Dockerfile is located):

docker build -t pyrdp .

As an alternative we have a slimmer image without the GUI and ffmpeg dependencies:

docker build -f Dockerfile.slim -t pyrdp .

Afterwards, you can execute PyRDP by invoking the pyrdpdocker container. See Usage instructions and the Docker specific instructions for details.

Cross-platform builds can be achieved using buildx:

docker buildx build –platform linux/arm,linux/amd64 -t pyrdp -f Dockerfile.slim

Migrating away from pycrypto

Since pycrypto isn’t maintained anymore, we chose to migrate to pycryptodome. If you get this error, it means that you are using the module pycrypto instead of pycryptodome.

[…]
File “[…]/pyrdp/pyrdp/pdu/rdp/connection.py”, line 10, in
from Crypto.PublicKey.RSA import RsaKey
ImportError: cannot import name ‘RsaKey’

You will need to remove the module pycrypto and reinstall PyRDP.

pip3 uninstall pycrypto
pip3 install -U -e .

Using PyRDP Using the PyRDP Monster-in-the-Middle

Use pyrdp-mitm.py or pyrdp-mitm.py to run the MITM.

Assuming you have an RDP server running on 192.168.1.10and listening on port 3389, you would run:

pyrdp-mitm.py 192.168.1.10

When running the MITM for the first time on Linux, a private key and certificate should be generated for you in ~/.config/pyrdp. These are used when TLS security is used on a connection. You can use them to decrypt PyRDP traffic in Wireshark, for example. Specifying the private key and certificate

If key generation didn’t work or you want to use a custom key and certificate, you can specify them using the -cand -karguments:

pyrdp-mitm.py 192.168.1.10 -k private_key.pem -c certificate.pem

Connecting to the PyRDP player

If you want to see live RDP connections through the PyRDP player, you will need to specify the ip and port on which the player is listening using the -iand -darguments. Note: the port argument is optional, the default port is 3000.

pyrdp-mitm.py 192.168.1.10 -i 127.0.0.1 -d 3000

Connecting to a PyRDP player when the MITM is running on a server

If you are running the MITM on a server and still want to see live RDP connections, you should use SSH remote port forwarding to forward a port on your server to the player’s port on your machine. Once this is done, you pass 127.0.0.1and the forwarded port as arguments to the MITM. For example, if port 4000 on the server is forwarded to the player’s port on your machine, this would be the command to use:

pyrdp-mitm.py 192.168.1.10 -i 127.0.0.1 -d 4000

* Running payloads on new connections

PyRDP has support for running console commands or[...]

___________________________
@hacking_Attack
@Hacking_Video