___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Fileless-Xec - Stealth Dropper Executing Remote Binaries Without Dropping Them On Disk

http://3.bp.blogspot.com/-tz50D7qAN80/YZ3UJhIVkPI/AAAAAAAA4Vs/Cqfd4D3bxuU1ruoKYc6ae_RqI0mhg-w3ACK4BGAYYCw/w640-h282/fileless-xec_1_fileless-xec-706129.gif Certainly useful , mainly for fun, rougly inspired by 0x00 articlePentest use: fileless-xecis used on target machine to stealthy execute a binary file located on attacker machine Short storyfileless-xecenable us to execute a remote binary on a local machine directly from memory without dropping them on disk ➪ Install

* simple usage fileless-xec (~curl | sh for binaries)
* execute binary with specified program name: fileless-xec -n /usr/sbin/sshd * detach program execution from tty: setsid fileless-xec [...]http://3.bp.blogspot.com/-tz50D7qAN80/YZ3UJhIVkPI/AAAAAAAA4Vs/Cqfd4D3bxuU1ruoKYc6ae_RqI0mhg-w3ACK4BGAYYCw/w640-h282/fileless-xec_1_fileless-xec-706129.gif ExplanationWe want to execute writeNsleepbinary locate on a remote machine, locally.
We first start a python http server on remote. Locally we use fileless-xecand impersonate the /usr/sbin/sshdname for the execution of the binary writeNsleep(for stealthiness & fun). Once writeNsleep started fileless-xec will delete itself (--self-remove) Other use cases* Execute binary with stdout/stdin
* Execute binary with arguments
* fileless-xecself remove
* Bypass network restriction using ICMP
* Bypass firewall with HTTP3
* "Remote go": execute go binaries without having go installed locally
* Execute a shell script
* fileless-xecserver mode
* RAT (Remote Access Trojan) scenario

* fileless-xecon windows Stealthiness story* The binary file is not mapped into the host file system
* The execution program name could be customizable
* Bypass 3rd generation firewall could be done with http3 support
* fileless-xecself removes once launched memfd_createThe remote binary file is stored locally using memfd_createsyscall, which store it within a memory disk which is not mapped into the file system (ie you can't find it using ls). fexecveThen we execute it using fexecvesyscall (as it is currently not provided by syscallgolang library we implem it).

With fexecve, we could but we reference the program to run using a file descriptor, instead of the full path. HTTP3/QUICEnable it with -Q/http3 flag.
You can setup a light web rootfs server supporting http3 by running go run ./test/http3/light-server.go -p LISTENING PORT(This is http3 equivalent of python3 -m http.server )
use test/http3/genkey.shto generate cert and key. QUICUDP aka http3is a new generation Internet protocol that speeds online web applications that are susceptible to delay, such as searching, video streaming etc., by reducing the round-trip time (RTT) needed to connect to a server.

Because QUIC uses proprietary encryption equivalent to TLS (this will change in the future with a standardized version), 3rd generation firewalls that provide application control and visibility encounter difficulties to control and monitor QUIC traffic.

If you actually use fileless-xecas a dropper (Only for testing purpose or with the authorization), you likely want to execute some type of malwares or other file that could be drop by packet analysis. Hence, with Quic enables you could bypass packet analysis and GET a malware.

Also, in case firewall is only used for allowing/blocking t[...]

___________________________
@hacking_Attack
@Hacking_Video

raffic it could happen that firewall rules forget the udp protocol making your requests go under the radars other skill for stealthinessAlthough not present on the memory disk, the running program can still be detected using pscommand for example.

1. Cover the tracks with a fake program name fileless-xec --name by default the name is [kworker/u:0]1. Detach from tty to map behaviour of deamon process setsid fileless-xec . WIP call setsidfrom code CaveatsYou could still be detected with: $ lsof | grep memfd Download Fileless-Xec

___________________________
@hacking_Attack
@Hacking_Video

How I made $8OO in 0.0001 sec from bug bounty

Hey, I am ski mask also this is my first writeup enjoy !! :)Continue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
Ripple Effects Felt Across the Internet With AWS Outage

AWS Console was among the many services that were unavailable during the outage at Amazon Web Services.

Kali Linux Tutorials
goEnumBruteSpray : User Enumeration And Password Bruteforce On Azure, ADFS, OWA, O365 And Gather Emails On Linkedin

goEnumBruteSpray is recommended module is o365 for user enumeration and passwords bruteforce / spray . Additional information can be retrieved to avoid account lockout, to know that the password is good but expired, MFA enabled,…

Linkedin

This module should be used to retrieve a list of email addresses before validating them through a user enumeration module. The company will be searched on Linkedin and all people working at these companies will be returned in the specified format.

The Linkedin’s session cookie li_atis required.
https://blogger.googleusercontent.com/img/a/AVvXsEi1FJWRYc4oN_pNFJixk8kkUB4yzF4tu44RcgsPYeXK3MUF9IujRqHN13FvZP41RhNbclrn5JT2mPAs9uwFXGQNX85DmQTGKA9YBXLJK1NlV1-wcAThBTwRz8RiG1PB0Vng6UfiugPZDN43G2aK9_SqXoTtlzycgpAW4yhlCOtE33fHBqMJxnXFeC0h=s1007
SearchEngine

This module should be used to retrieve a list of email addresses before validating them through a user enumeration module. The company name will be searched on Google and Bing with a dork to find people working in the company (site:linkedin.com/in+"%s"). The results title will be parsed to output email addresses in the specified format.
https://blogger.googleusercontent.com/img/a/AVvXsEi_eYGFWzCUg8S4ySwZR_9sfHmGlgep1StyB6nu_khEJDpCFA1jqS082C6VLNGqW0taNdCrKUpmBO0lHdfGUYZFy8kxiJlGFZSd4SLiptrU4yQS_pmHqV-QF27SpvgttCAGfw6D0ynHh0lKOlJYp8MgU4rHu-PLp5j9fjMAMaRWGm7rpbUqA6ynjCKp=s1066
Azure

User enumeration

The Azure module is only available to enumerate the users of a tenant. The authentication request will be made on https://autologon.microsoftazuread-sso.com, a detailed response shows if the account does not exist, a MFA is required, if the account is locked, …
https://blogger.googleusercontent.com/img/a/AVvXsEiYyMYaly8QbfT5CA97L0OiPe3U80Rjye_DzO9512jOCIYs9TGQuoObvUdxsE55qsb2FSiXAH87IWcx5DRoW1vLJMkKm_wBGY1TD04bwxXE_Eo96MbIshLUHH4FLXrKMfqLViesDRajD54uJA-mCVN9Xe9uFo4g-VzpEd_qMZNZEaopO9Dd4r6aqOBD=s1524
ADFS

Passwords bruteforce / spray

The ADFS module is only available to bruteforce or spray a password. The authentication request is sent to https://. An error message can informs the user if the password is expired
https://blogger.googleusercontent.com/img/a/AVvXsEiTAnumon70TzBGZHHKr1gxnWYO-rtuwvedrBxXo02cQQMaUL25VBxzC0bjayCCUqgLuBr_N1GhFsGqLPbs2VV7lVcUZHgN1KuDso__BgN7YklP7vgizAVW_pTJGchP9dSY6J2jYEWkVHHkIuqIAxVcYOxpJkARIC2x70QlNPlHkI6Q1cXpajH-zNxx=s1154
O365

This module allows to enumerate users and bruteforce / spray passwords.

User enumeration

Several modes are available: office, oauth2 and onedrive (not implemented yet). The office mode is recommended as no authentication is made. Oauth2 can retrieve additional information through AADSTS error code (MFA enable, locked account, disabled account)
https://blogger.googleusercontent.com/img/a/AVvXsEiUFkQ1eUWtW9yfQx8rl69KVNzj4y4-SC9tPm_6lMwo1CAM9Ys7-UoR8Uf5Vk5zMsNu14R3-a437hM3R9vmaBsyajg7QpCrgzM3WHJsZhZ3ooNln0kK1B-ZkI1P-scG0Rcvli2pyC_v0iQCi_KZBvc6VOzT5kebikJrS125gQ608RgxLcd4YOfdL3K-=s1319
Passwords bruteforce / spray

As for the user enumeration, two modes are available: oauth2 and autodiscover (not implemented yet). The Oauth2 is the recommended mode, it allows to get much information thanks to the AADSTS error code.
https://blogger.googleusercontent.com/img/a/AVvXsEg0CPqFE9w4AKrGeedarxu5ctuP3xE_16eKEFgXNUeGVI0AhoYlpvNiGLgsgLbVc2ucvLrZrMSBrVucPuAvlCBFQKqrPO9C1rs6xT3C_Rnu3pJ5Av8i8vJd3FYFOnBbWpES_PG1S-XElhUD77zVgyCRDv_UjjQI64qLLzLzfNfAWI-MgrkKDZ6hosO-=s1472
OWA

This module allows to enumerate users and bruteforce / spray passwords.

User enumeration

Enumeration is made with authentication requests. Aut[...]

___________________________
@hacking_Attack
@Hacking_Video

hentication for a non-existent user will take longer than for a valid user. At first, the average response time for an invalid user will be calculated and then the response time for each authentication request will be compared.
https://blogger.googleusercontent.com/img/a/AVvXsEhFY8lTqa37f8j7lTGEpX5hNfRgGbc8uYUK9qnEfcyR_kb3QEkib6a5RpHvEQ611vCFKTBaIykLkDipBo5YhOJDiA79prG_3XV086UwyI2qcz6R3CYXnNkwaRWjruzwvmWA6uf5vGahI9jBACLLvcMQvethql7UvpZLR8Ka7kEiVcr0D83o5jXcMQO-=s831
Passwords bruteforce / spray

Please note that no account locking mechanism can be implemented because no information about it is returned.
https://blogger.googleusercontent.com/img/a/AVvXsEjmTnjW0ZNXvTSMzYKYi4kYh639SLyUhpOo6Qna8_PlgV6ZIvSkDYSim0_3_lnBiMlHBLYZfP_tqd0UTGT2CRSpeJx-fS_cBE0iijFCEXxZ0bbmgN6NpLqrwFgrAVvuZ2L_zPHF2QGXsO1TagGTBea3cbBELdDZxkJfLZ1KtjrgpaCklBv3-PF3uWr1=s1070 Download

___________________________
@hacking_Attack
@Hacking_Video

Bypassing Login Page in 2 Mins

Hi ppl! This is Gnana Aravind with another write-up on the most curious “Login Page Bypass”. Let’s jump into the story…Continue reading on Medium »
Read more...

Hacking on Medium
Discord: $7 billion Gamers Heaven at Risk

https://cdn-images-1.medium.com/max/768/1*I9UfCzGCUVoAg09P4GY4bQ.jpeg
What is the Discord Virus?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Network Sniffing

https://cdn-images-1.medium.com/max/1400/0*vHhCO3Jz1Mt-Q7Jg
Sniffing

Continue reading on FAUN Publication »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
My approach to CTF creation

I’ve been creating CTF challenges for a while for the ctf-mystiko.com platform, and in the process I have learned some lessons that could…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Malware Attack, Mitigation Techniques and Malware Analysis

https://cdn-images-1.medium.com/max/650/0*9Z7H4-vmH8sDgCBu
Here we are discussing about the malware types, performing attack using malware on the different platforms and performing malware analysis…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Data Hiding and Detection Techniques

https://cdn-images-1.medium.com/max/800/0*Z-eOJDwta_v_hF6j
Today, we are learning about data hiding and detection techniques. Here we take example of Alice and Bob as the criminals. The FBI…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Bypassing Login Page in 2 Mins
https://aravind07.medium.com/bypassing-login-page-in-2-mins-5b773d46f4d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video