Hacking on Medium
Vulnerabilidad de lectura de archivos no autorizada sin parches que afecta al sistema operativo…

https://cdn-images-1.medium.com/max/1336/0*iDGSSYGWgKn7G_O0
PUBLICADO EN 30 NOVIEMBRE, 2021POR DPAB

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Just a friendly reminder that VM’s are not 100% safe. Kinda shocked that i still hear people describing VM’s like they are isolated.

submitted by /u/12AngrySnowflakes
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Permit Empty Password for SSHD

What would be a real consequence for allowing permitemptypassword to yes at sshd config file ? I know no password means no protection but curious why it would be required and could be exploited in real world.

submitted by /u/Harry_pentest
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

ZipExec - A Unique Technique To Execute Binaries From A Password Protected Zip
http://www.kitploit.com/2021/11/zipexec-unique-technique-to-execute.html

___________________________
@hacking_Attack
@Hacking_Video

ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected zip file on disk and execute it. This is done programmatically by using COM objects to access (https://www.kitploit.com/search/label/Access) the GUI-based functions in Windows (https://www.kitploit.com/search/label/Windows) via the generated JScript loader, executing the loader inside the password-protected zip without having to unzip it first. By password protecting the zip file, it protects the binary from EDRs and disk-based or anti-malware scanning (https://www.kitploit.com/search/label/Scanning) mechanisms.
Installation The first step as always is to clone the repo. Before you compile ZipExec you'll need to install the dependencies. To install them, run following commands: go get github.com/yeka/zip
Then build it go build ZipExec.go
or go get github.com/Tylous/ZipExec Help > \> <\ ___/\ \___ /_______ \|__| __/_______ /__/\_ \\___ >\___ > \/ |__| \/ \/ \/ \/ (@Tyl0us) Usage of ./ZipExec: -I string Path to the file containing binary to zip. -O string Name of output file (e.g. loader.js) -sandbox Enables sandbox evasion (https://www.kitploit.com/search/label/Evasion) using IsDomainedJoined. ">./ZipExec -h

__________.__ ___________
\____ /|__|_____\_ _____/__ ___ ____ ____
/ / | \____ \| __)_\ \/ // __ \_/ ___\
/ /_ | | |_> > \> <\ ___/\ \___
/_______ \|__| __/_______ /__/\_ \\___ >\___ >
\/ |__| \/ \/ \/ \/
(@Tyl0us)

Usage of ./ZipExec:
-I string
Path to the file containing binary to zip.
-O string
Name of output file (e.g. loader.js)
-sandbox
Enables sandbox evasion using IsDomainedJoined.


Download ZipExec (https://github.com/Tylous/ZipExec)

___________________________
@hacking_Attack
@Hacking_Video

Hydra nedir?Nasıl kullanılır?
https://mirabbasagalarov.medium.com/hydra-nedir-nas%C4%B1l-kullan%C4%B1l%C4%B1r-f251ddb57951?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hydra Nedir?Continue reading on Medium » (https://mirabbasagalarov.medium.com/hydra-nedir-nas%C4%B1l-kullan%C4%B1l%C4%B1r-f251ddb57951?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

ZipExec - A Unique Technique To Execute Binaries From A Password Protected Zip

ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected zip file on disk and execute it. This is done programmatically by using COM objects to access the GUI-based functions in Windows via the generated JScript loader, executing the loader inside the password-protected zip without having to unzip it first. By password protecting the zip file, it protects the binary from EDRs and disk-based or anti-malware scanning mechanisms. Installation The first step as always is to clone the repo. Before you compile ZipExec you'll need to install the dependencies. To install them, run following commands: go get github.com/yeka/zip Then build it go build ZipExec.go or go get github.com/Tylous/ZipExec Help sandbox evasion using IsDomainedJoined. ">./ZipExec -h. \ /||_ / / / | _ \| )\\ \/ // _ \_/ _\ / /_ | | |_> > \> <\ _/\ \_ /_ \|_| _/_ /_/\_ \\_ >\_ > \/ |_| \/ \/ \/ \/ (@Tyl0us)Usage of ./ZipExec: -I string Path to the file containing binary to zip. -O string Name of output file (e.g. loader.js) -sandbox Enables sandbox evasion using IsDomainedJoined. Download ZipExec
Read more...

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
ZipExec - A Unique Technique To Execute Binaries From A Password Protected Zip

http://1.bp.blogspot.com/-KNZqYc058e8/YZ3QB79eJDI/AAAAAAAA3_0/qYprCfc_n0QiAs9zCtdOMGGQ0SQdKSGeACK4BGAYYCw/w640-h360/ZipExec_1-745577.gif

ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected zip file on disk and execute it. This is done programmatically by using COM objects to access the GUI-based functions in Windows via the generated JScript loader, executing the loader inside the password-protected zip without having to unzip it first. By password protecting the zip file, it protects the binary from EDRs and disk-based or anti-malware scanning mechanisms.
Installation

The first step as always is to clone the repo. Before you compile ZipExec you'll need to install the dependencies. To install them, run following commands:

go get github.com/yeka/zip


Then build it

go build ZipExec.go


or

go get github.com/Tylous/ZipExec

Help

sandbox evasion using IsDomainedJoined. ">./ZipExec -h

__________.__ ___________
\____ /|__|_____\_ _____/__ ___ ____ ____
/ / | \____ \| __)_\ \/ // __ \_/ ___\
/ /_ | | |_> > \> <\
/_______ \|__| __/_______ /__/\_ \\___ >\___ >
\/ |__| \/ \/ \/ \/
(@Tyl0us)

Usage of ./ZipExec:
-I string
Path to the file containing binary to zip.
-O string
Name of output file (e.g. loader.js)
-sandbox
Enables sandbox evasion using IsDomainedJoined.

Download ZipExec

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
What’s the Difference Between SASE and SD-WAN?

While SD-WAN is a key part of a hybrid workplace and multicloud operation, it should be treated as a stepping stone to SASE, not an alternative.

Dark Reading: Attacks/Breaches
Attacker Sentenced in Multimillion-Dollar SIM Hijacking Scheme

A sixth member of international hacking group The Community was sentenced to 10 months in prison and ordered to pay $121,549.37 in restitution.

___________________________
@hacking_Attack
@Hacking_Video

Easy SQLi in Amazon subsidiary using Sqlmap
https://hector0x.medium.com/easy-sqli-in-amazon-subsidiary-using-sqlmap-ff469013671b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hey all,Continue reading on Medium » (https://hector0x.medium.com/easy-sqli-in-amazon-subsidiary-using-sqlmap-ff469013671b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
DAMDATA SCADA— Dam monitoring system in a physical infrastructure vulnerabilities

https://cdn-images-1.medium.com/max/600/1*w9YQQAVi7zIUn5-qMoMk9A.jpeg
DAMDATA is a web application for the comprehensive management of auscultation data.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video