ByPass SSL Pinning with IP Forwarding | iptables

After struggling with common tools to bypass SSL pinning, because the app that I’m testing won’t show some HTTPS traffic that I try to…
Read more...

Bolt — TryHackMe

Writeup
Read more...

Just a click !! — Any unverified data submitted in behalf of your name #GoogleForms [Unpatched️]

Disclaimer: This issue isn’t patched and I publish this write-up as a source of Information. I am not responsible for any kind of misuse…
Read more...

A short story of Content Spoofing to HTML Injection in Apple using Dangling Markup Injection

Content Spoofing to HTML Injection in Apple. During the recon phase, I found itunesconnect.apple.com, subdomain of apple and after digging
Read more...

FIN13: A Cybercriminal Threat Actor Focused on Mexico
https://www.reddit.com/r/redteamsec/comments/rblz7b/fin13_a_cybercriminal_threat_actor_focused_on/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.mandiant.com/resources/fin13-cybercriminal-mexico) [comments] (https://www.reddit.com/r/redteamsec/comments/rblz7b/fin13_a_cybercriminal_threat_actor_focused_on/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Seeking advice and resources on bypassing android lock screen and potentially sim card security

submitted by /u/WhimsicalKnight
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
27 flaws in USB-over-network SDK affect millions of cloud users

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png 27 flaws in USB-over-network SDK affect millions of cloud usersPost Views: 136 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 2 Minutes
Researchers have discovered 27 vulnerabilities in Eltima SDK, a library used by numerous cloud providers to remotely mount a local USB device.
Due to the pandemic and the rising trend of working from home, organizations have begun to rely heavily on cloud-based services. This necessity also increased cloud providers utilizing Eltima’s SDK that allow employees to mount local USB mass storage devices for use on their cloud-based virtual desktops.
https://www.bleepstatic.com/images/news/u/1220909/Security/connecting_USB_via_ethernet.jpg
CVE-2021-42972, CVE-2021-42973, CVE-2021-42976, CVE-2021-42977, CVE-2021-42979,
CVE-2021-42980, CVE-2021-42983, CVE-2021-42986, CVE-2021-42987, CVE-2021-42988,
CVE-2021-42990, CVE-2021-42993, CVE-2021-42994, CVE-2021-42996, CVE-2021-43000, CVE-2021-43002, CVE-2021-43003, CVE-2021-43006, CVE-2021-43637, CVE-2021-43638, CVE-2021-42681, CVE-2021-42682, CVE-2021-42683, CVE-2021-42685, CVE-2021-42686, CVE-2021-42687, CVE-2021-42688These vulnerabilities have been responsibly disclosed to Eltima, who has already released fixes for affected versions. However, it is now up to cloud services to upgrade their software to utilize the updated Eltima SDK.

According to SentinelOne, the affected software and cloud platforms are:

* Amazon Nimble Studio AMI, before 2021/07/29
* Amazon NICE DCV, below: 2021.1.7744 (Windows), 2021.1.3560 (Linux), 2021.1.3590 (Mac), 2021/07/30
* Amazon WorkSpaces agent, below: v1.0.1.1537, 2021/07/31
* Amazon AppStream client version below: 1.1.304, 2021/08/02
* NoMachine [all products for Windows], above v4.0.346 below v.7.7.4 (v.6.x is being updated as well)
* Accops HyWorks Client for Windows: version v3.2.8.180 or older
* Accops HyWorks DVM Tools for Windows: version 3.3.1.102 or lower (Part of Accops HyWorks product earlier than v3.3 R3)
* Eltima USB Network Gate below 9.2.2420 above 7.0.1370
* Amzetta zPortal Windows zClient
* Amzetta zPortal DVM Tools
* FlexiHub below 5.2.14094 (latest) above 3.3.11481
* Donglify below 1.7.14110 (latest) above 1.0.12309

It is important to note that Sentinel Labs hasn’t looked into all possible products that could incorporate the vulnerable Eltima SDK, so there could be more products affected by the set of flaws.

Also, some services are vulnerable on[...]

___________________________
@hacking_Attack
@Hacking_Video

the client-side, others on the server-side, and a few on both, depending on code-sharing policies.
See Also: New Windows zero-day with public exploit lets you become an admin Defending against these vulnerabilitiesSentinel Labs clarifies that it has seen no evidence that threat actors have exploited these vulnerabilities. Still, now that a technical report has been released, we will likely see exploitation in the future.

Out of an abundance of caution, admins should revoke privileged credentials before applying the security updates, and logs should be scrutinized for signs of suspicious activity.

Most vendors have patched the flaws and pushed them through automatic updates. However, some require end-user action to apply the security updates, like upgrading the client app to the latest available version.
See Also: Offensive Security Tool: GoMapEnum Below is a list of fixes released by different vendors:

* Amazon – Released fixes to all regions on June 25, 2021
* Eltima – Released fixes on September 6, 2021
* Accops – Released fixes on September 5, 2021, and notified customers to upgrade. Additionally, released utility to detect vulnerable endpoints on December 4, 2021
* Mechdyne – Has not responded to the researchers yet
* Amzetta – Released fixes on September 3, 2021
* NoMachine – Released fixes on October 21, 2021
See Also: Hacking stories – Operation Troy – How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/5fdb9e7105edc00d5378b856_kafkalogo-90x90.jpg Apache Kafka Cloud Clusters Expose Sensitive Data for Large Companies1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/Excel-als-Malware-Schleuder-Gefahr-durch-XLL-Dateien-Twitter-90x90.png Malicious Excel XLL add-ins push RedLine password-stealing malware2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-1-90x90.jpg New malware hides as legit nginx process on e-commerce servers5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-90x90.jpg Microsoft Exchange servers hacked to deploy BlackByte ransomware6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/80-percent-e-commerce-android-apps-leak-personal-data-765x383-1-90x90.jpg Android banking malware infects 300,000 Google Play users1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/PKM201070290_resize-90x90.jpg Panasonic discloses data breach after network hack1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/0_Windows-headpic-90x90.jpg New Windows 10 zero-day gives admin rights, gets unofficial patch1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/1_pD_YMyWDg8A2grOrbaNS6g-90x90.jpg New Linux malware hides in cron jobs with invalid dates2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Microsoft-Vulnerability-RCE-MSHTML-90x90.jpg Hackers exploit Microsoft MSHTML bug to steal Google, Instagram creds2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/windows-hacking-90x90.jpg Malware now trying to exploit new Windows Installer zero-day2 weeks ago
The post 27 flaws in USB-over-network SDK affect millions of cloud users first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Fileless-Xec - Stealth Dropper Executing Remote Binaries Without Dropping Them On Disk

Certainly useful , mainly for fun, rougly inspired by 0x00 article Pentest use: fileless-xec is used on target machine to stealthy execute a binary file located on attacker machine Short story fileless-xec enable us to execute a remote binary on a local machine directly from memory without dropping them on disk ➪ Install simple usage fileless-xec (~curl | sh for binaries) execute binary with specified program name: fileless-xec -n /usr/sbin/sshd detach program execution from tty: setsid fileless-xec ... Explanation We want to execute writeNsleep binary locate on a remote machine, locally. We first start a python http server on remote. Locally we use fileless-xec and impersonate the /usr/sbin/sshd name for the execution of the binary writeNsleep(for stealthiness & fun). Once writeNsleep started fileless-xec will delete itself (--self-remove) Other use cases Execute binary with stdout/stdin Execute binary with arguments fileless-xec self remove Bypass network restriction using ICMP Bypass firewall with HTTP3 "Remote go": execute go binaries without having go installed locally Execute a shell script fileless-xec server mode RAT (Remote Access Trojan) scenario fileless-xec on windows Stealthiness story The binary file is not mapped into the host file system The execution program name could be customizable Bypass 3rd generation firewall could be done with http3 support fileless-xec self removes once launched memfd_create The remote binary file is stored locally using memfd_create syscall, which store it within a memory disk which is not mapped into the file system (ie you can't find it using ls). fexecve Then we execute it using fexecve syscall (as it is currently not provided by syscall golang library we implem it). With fexecve , we could but we reference the program to run using a file descriptor, instead of the full path. HTTP3/QUIC Enable it with -Q/http3 flag. You can setup a light web rootfs server supporting http3 by running go run ./test/http3/light-server.go -p LISTENING PORT (This is http3 equivalent of python3 -m http.server ) use test/http3/genkey.sh to generate cert and key. QUIC UDP aka http3 is a new generation Internet protocol that speeds online web applications that are susceptible to delay, such as searching, video streaming etc., by reducing the round-trip time (RTT) needed to connect to a server. Because QUIC uses proprietary encryption equivalent to TLS (this will change in the future with a standardized version), 3rd generation firewalls that provide application control and visibility encounter difficulties to control and monitor QUIC traffic. If you actually use fileless-xec as a dropper (Only for testing purpose or with the authorization), you likely want to execute some type of malwares or other file that could be drop by packet analysis. Hence, with Quic enables you could bypass packet analysis and GET a malware. Also, in case firewall is only used for allowing/blocking traffic it could happen that firewall rules forget the udp protocol making your requests go under the radars other skill for stealthiness Although not present on the memory disk, the running program can still be detected using ps command for example. Cover the tracks with a fake program name fileless-xec --name by default the name is kworker/u:0 Detach from tty to map behaviour of deamon process setsid fileless-xec . WIP call setsid from code Caveats You could still be detected with: $ lsof | grep memfd Download Fileless-Xec
Read more...

___________________________
@hacking_Attack
@Hacking_Video

An Effective 5 min recon leads to a Hall of Fame

Hi There,
Read more...

Request Smuggling In Major Crypto Site  — road to disappointment

Let me introduce myself since this is my first writing ever. In the beginning sorry if I make mistakes in my writing since English is not…
Read more...

Hacking on Medium
5 Things John Learned Fighting Hackers of His App — A must-read for PM’s and CISO’s

https://cdn-images-1.medium.com/max/1920/1*Tdv4aa6EJuSnd_HF-CRKmg.png
BetterVision is a popular app for the blind and visually impaired. John’s app suffered a cloning attack, and his In-App purchases got…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cheating at a Company Group Activity Using Unix Tools

https://cdn-images-1.medium.com/max/1440/1*5FEjuf6P0XY-P7BajMtqag.jpeg
The tools you didn’t know you need

Continue reading on Fundbox Engineering »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
BitMart Updates Deposit Addresses to Enhance Security — Action Required

https://cdn-images-1.medium.com/max/2600/1*wD-XRYA_Q5FTIMXZ6hjYCQ.png
BitBook BBT tokens were unaffected by the BitMart hack last week, and BitMart is being extremely proactive in the face of the security…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Skills Required to Become an Ethical Hacker

https://cdn-images-1.medium.com/max/648/0*FudcEt4SliqRWDlv.png
Skills allow you to achieve your desired goals within the available time and resources. As a hacker, you will need to develop skills that…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video