Dark Reading: Attacks/Breaches
Newly Found Authentication Flaws Highlight Dangers of Coding From Scratch

Two vulnerabilities in a call-center software suite could allow an attacker to take over the application server, researchers found.

Dark Reading: Attacks/Breaches
Trickbot-Infected Machines Drop Emotet Samples

It's reportedly the first time this has happened since the takedown of Emotet in January 2021, say the researchers who made the discovery.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Claroty Raises $400M More, Acquires Healthcare IoT Security Firm Medigate

Industrial control systems security firm reaches $635M in funding with this Series E round.

___________________________
@hacking_Attack
@Hacking_Video

SMBeagle - Fileshare Auditing Tool That Hunts Out All Files It Can See In The Network And Reports If The File Can Be Read And/Or Written
http://www.kitploit.com/2021/12/smbeagle-fileshare-auditing-tool-that.html

___________________________
@hacking_Attack
@Hacking_Video

SMBeagle is an (SMB) fileshare auditing tool that hunts out all files it can see in the network and reports if the file can be read and/or written. All these findings are streamed out to either a CSV file or an elasticsearch (https://www.kitploit.com/search/label/Elasticsearch) host, or both!?
SMBeagle tries to make use of the win32 APIs for maximum speed, but fails back to a slower ACL check. It has 2 primary use cases: Cast a spotlight on weak share permissions. Businesses of all sizes often have file shares with awful file permissions. Large businesses have sprawling shares on file servers and its not uncommon to find sensitive data with misconfigured permissions. Small businesses often have a small NAS in the corner of the office with no restrictions (https://www.kitploit.com/search/label/Restrictions) at all! SMBeagle crawls these shares and lists out all the files it can read and write. If it can read them, so can ransomware. Lateral movement and privilege escalation SMBeagle can provide penetration testers with the less obvious routes to escalate privileges and move laterally. By outputting directly into elasticsearch, testers can quickly find readable scripts and writeable executables. Finding watering hole attacks and unprotected passwords never felt so easy! ‍ Kibana Dashboard Please see Kibana readme (https://github.com/punk-security/SMBeagle/blob/main/kibana/README.md) Usage The only mandatory parameter is to set an output, which should be either an elasticsearch hosts IP address or a csv file. A good starting point is to enable fast mode and output to csv, but this CSV could get huge! SMBeagle -c out.csv -f
Full Usage discovery and provide manual networks: SMBeagle -D -e 127.0.0.1 -n 192.168.12.0/23 192.168.15.0/24 Scan local filesystem (https://www.kitploit.com/search/label/Filesystem) too (SLOW): SMBeagle -e 127.0.0.1 -l Do not enumerate ACLs (FASTER): SMBeagle -A -e 127.0.0.1 -c, --csv-file (Group: output) Output results to a CSV file by providing filepath -e, --elasticsearch-host (Group: output) Output results to elasticsearch by providing elasticsearch hostname (port is set to 9200 automatically) -f, --fast Enumerate only one files permissions per directory -l, --scan-local-drives Scan local drives on this machine -L, --exclude-local-shares Do not scan local drives on this machine -D, --disable-network-discovery Disable network discovery -n, --network Manually add network to scan -N, --exclude-network Exclude a network from scanning -h, --host Manually add host to scan -H, --exclude-host Exclude a host from scanning -q, --quiet Disable unneccessary output -v, --verbose Give more output -m, --max-network-cidr-size (Default: 20) Maximum network size to scan for SMB Hosts -A, --dont-enumerate-acls (Default: false) Skip enumeration (https://www.kitploit.com/search/label/Enumeration) of file ACLs --help Display this help screen. --version Display version information. ">USAGE:
Output to a CSV file:
SMBeagle -c out.csv
Output to elasticsearch (Preffered):
SMBeagle -e 127.0.0.1
Disable network discovery and provide manual networks:
SMBeagle -D -e 127.0.0.1 -n 192.168.12.0/23 192.168.15.0/24
Scan local filesystem too (SLOW):
SMBeagle -e 127.0.0.1 -l
Do not enumerate ACLs (FASTER):
SMBeagle -A -e 127.0.0.1

-c, --csv-file (Group: output) Output results to a CSV

___________________________
@hacking_Attack
@Hacking_Video

file by providing filepath
-e, --elasticsearch-host (Group: output) Output results to
elasticsearch by providing elasticsearch
hostname (port is set to 9200
automatically)
-f, --fast Enumerate only one files permissions per
directory
-l, --scan-local -drives Scan local drives on this machine
-L, --exclude-local-shares Do not scan local drives on this machine
-D, --disable-network-discovery Disable network discovery
-n, --network Manually add network to scan
-N, --exclude-network Exclude a network from scanning
-h, --host Manually add host to scan
-H, --exclude-host Exclude a host from scanning
-q, --quiet Disable unneccessary output
-v, --verbose Give more output
-m, --max-network-cidr-size (Default: 20) Maximum network size to scan
for SMB Hosts
-A, --dont-enumerate-acls (Default: false) Skip enumeration of file
ACLs
--help Display this help screen.
--version Display vers ion information.
Architecture There are a number of loosley coupled modules which hand off to each other.

___________________________
@hacking_Attack
@Hacking_Video

Download SMBeagle (https://github.com/punk-security/SMBeagle)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Developing with VBA for Script Kiddies — TrustedSec

INTRODUCTION

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How secure you are when a weak password secures your hotspot? Well, you aren’t secure at all!

https://cdn-images-1.medium.com/max/1920/1*Y0mZ2Pk6DdxnhYatH_Dk-Q.jpeg
To understand what can be considered a weak password, we must learn how passwords are broken and what techniques hackers use.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What can I do with cmd without admin

Is there a way to replace the boot password with cmd without admin or can I 'hack' admin via cmd?

I can get into cmd with python, us os.system and I can use all the other standard libraries and things I can install via pip but not the admin package for example.

submitted by /u/anynoimlis
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Should I have an "index.php"? My error.log is filled with requests for this non-existent file. Should I create one that simply writes the index.html, or does that open a different vector?

My apache website is fairly simple with "index.html" defined as the home page, but I see a lot of requests in error.log for the php file. I could make an index.php that simply serves index.html - but would I be "playing" into someone's hands by doing this? Any idea why I have so many requests for index.php?

submitted by /u/moronictransgression
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
SOCKS5 Proxy Server that dumps to .pcap

Hi,

I’ve been working on some projects at work, and I was looking for a SOCKS5 Proxy server that allows me to dump any traffic travelling through the server to a capture file, so I can get a better idea of what’s going on between a smart device and the iOS app. I’ve been using Burp but I am pretty sure there’s non-HTTP traffic at play (including UDP, hence SOCKS5).

If not I could probably hack one together, but if I can do it in an easier way, why not save the time and effort.

Thanks

submitted by /u/DubbieDubbie
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
The ultimate hack to make my stupid dream come true

Long story short: there's a woocommerce shop that sells merchandise for very, very niche artist. The name of the artist includes a string of digits / a number, let's say "3000" - that will be relevant later. From what I managed to find out after short research it's not supported by a company, it's most likely amateur, with basic wp free template etc. The thing is, I just ordered a Christmas gift for myself, a t-shirt from the shop. I realized my order number is "2967" which is relatively close to the "300" mentioned earlier, but too far away to just make x orders more to get to the desired order number.

As a side note, I'm a senior backend dev with medium PHP and WordPress familiarity, but never really had interest to hack anything.

Don't ask me why, don't ask me who or where, but I really, and I mean really want to make the "300"th order. The thing is I need to somehow be able to verify, for example, when order id=299starts existing in the database of a woocommerce. I don't need any additional data, I don't want to steal anything, I don't want to break in to the database. I don't even want to create a bulk of fake orders (to rape the Auto-Increment db field and get to my number), which would be a lot easier but would also give the shop maintainer a hard time. I hope this post doesn't get deleted.

Is this possible?

submitted by /u/throwawayitjobbad
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
So can someone make an easy program? Or does it allready exist?

So i Had an idea… Whenever someone put their USB stick in PC that all Data transfers automaticaly to other USB stick that is already stuck in PC… is that possible?

submitted by /u/Mini_Bato
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
How to Stop Hackers From Turning Your Systems Against You

Cybercriminals are increasingly adopting "living-off-the-land’ techniques, leveraging commonly used tools to fly under the radar of conventional detection tools. But with AI, thousands of organizations have regained the upper hand.