Dark Reading: Attacks/Breaches
Kaspersky Opens Doors to New Transparency Center in North America

The opening marks the fifth center opened globally, fulfilling a key milestone within the Global Transparency Initiative.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Darktrace Reports Information Technology and Communications Sector Most Targeted by Cyberattackers in 2021

Most targeted industry shifts from the financial and insurance sector in 2020.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
“FREE 350+ Tryhackme Rooms”

https://cdn-images-1.medium.com/max/1484/1*qlT8eQZH7Mzbb3TNbN6W_A.png
Hey Guys, I am Samrat Gupta aka Sm4rty, a Security Researcher and a Bug Bounty Hunter. In this blog, I will be sharing a list of 350+ Free…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
VULNERABILIDAD DE APACHE LOG4J — LOG4SHELL — AMPLIAMENTE BAJO ATAQUE ACTIVO

https://cdn-images-1.medium.com/max/833/1*9Y0zICBhSQV1xpSrpyybvw.jpeg
PUBLICADO EN 13 DICIEMBRE, 2021 POR DPAB

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cracking User Passwords Stored in Keycloak with Hashcat

https://cdn-images-1.medium.com/max/2395/1*K-Z3bSPbbYdIe0jDJjGSBw.png
It is faster and easier that you might have thought, even with crappy hardware and no profound knowledge. A brief how-to.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to hack a satellite

https://cdn-images-1.medium.com/max/1200/1*ZD98pzrjBww4S0PJjgf5zQ.png
The winner of the second annual Hack-A-Sat contest used an “ingenious tactic” to defeat the competition, offering lessons for U.S.

Continue reading on README_ »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Software company Polymer just raised millions to build the data loss prevention solution that will…

https://cdn-images-1.medium.com/max/1200/1*30LJKDeHd723x-HQtOOBLw.jpeg
Polymer’s no-code platform for automated data loss prevention (DLP) for software-as-a-service (SaaS) apps significantly leverages AI…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
BLACKCAT: UN NUEVO MALWARE RANSOMWARE BASADO EN RUST DETECTADO EN LA NATURALEZA

https://cdn-images-1.medium.com/max/1419/0*nffv7HOFA69N-UjU
PUBLICADO EN 13 DICIEMBRE, 2021POR DPAB

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Seal HackTheBox Walkthrough

Seal is a CTF Linux machine rated as medium difficulty on Hack the Box platform. So let get started and deep dive into breaking down this machine by using the following the methodology below. Pentesting Methodologies · NmapExploitation · Path TraversalPrivilege Escalation· Digging SSH Id_rsaPort Scanning & EnumerationFirst, we’ll start by running nmap aggressive scan to look for open ports. As you can see, 3 ports are open, namely:DIRBwhich is a web content scanner to brute force the directory and files name of the seal machine. GitBucket.We don’t have any credentials, so let’s create a new one. ___________________________
@hacking_Attack
@Hacking_Video

EjtnOvfUIO1GO360y8uCr13e1lv2D-L1ucYUtJuvNXilBisMAjGQBKqhpFvvhdp3x1NHLM4Yfw8KwysR6WRRnj52wD7Ueu41VowNaO3NfwbIgXL_efAIPtDXvWNPAbr4EVSnbOKJsD_mHXCNGZhlEe1cH70naxcvTDwYyRQwND4RbIPSXCoykN9U4hqaw=s16000 By expanding the comment, we can see that many configuration files have been changed. But the last configuration was done to the tomcat_user.xml file. It means that some information about users has been changed. While going through the configuration file, tomcat username and passwordcan be found. Exploitation;/html (;) character to bypass. /manager/;/html/upload?___________________________
@hacking_Attack
@Hacking_Video

iOHs0E2AbsOMBEl3whAzA0srpyM5ZNQRoH2diNoz6OGd4gDfLtNgcztgSTn50BgJJjOc4Aks3GshEpMlcmQ9rM5kY4jaTzA0efzMQBOxG5IEfcTTEcY2e-1n9iOEPoZ_NOaBhE2fiTQNc-shoGMGxkA3CkGXMPfTefVyujBboNNH-3z4IysnTmLKrTwg=s16000 As you can see below we have been able to upload our shell.war file in the tomcat application manager. /cat/etc/passwd would show us the list of available users. We have luis user. We also have a backup file which has trigger our attention. So let’s dig into that also browser the complete directory to find any kind of files that ca help. run.yml.What its actually doing, it’s backing up all files in the path /var/liv/tomcat9/webapps/ROOT/admin/dashboardand keeping it in destination /opt/backups/archives/backup-date and time. So if you can put any file in the source directory that can be helpful to us, it’s going to be automatically be zipped the destination folder and we will be able to get access to it. So let’s browse to the home directory of the user we find above, that is, Luis. tar -xvf backup.gzhttps://blogger.googleusercontent.com/img/a/AVvXsEgZnUc8y2DW3KH-g0EpQkFlPYVZlC7PY_ZAyGjM_zr6isqc_kVOM3ad88bdSc6NLgI7mdYOycw4AmTNY78xue0cw-7p0nwpG5jqZjlWf4DXnLx85jTDMw31KG13oq95J2s3gGL7MHENQsqzmMmVWd3MjKrMmp2Npkr6fulQTk-Zc2aw9yyah079YmRfrA=s16000 So now if we browse to the dashboard/uploads, we can find the .ssh folder. And when browsin[...]

___________________________
@hacking_Attack
@Hacking_Video

g the .ssh folder we can find 3 files including the id_rsa. Now we can cat this file to find the private key.Privilege EscalationNow that we have been able to login as luis, lets run the command sudo -l to verify any suoders privilege escalation. We can see that luis can run ansible-playbook as sudo. Now we are going to create a file called test.yml put in those command below:-name: "ignite"The task part is very important here. What it is actually doing is, it’s putting suid bin on bash binary. Once the suid bit has been put on a bash binary, we will execute it.sudo /usr/bin/ansible-playbook ./test.ymlAs show above we have a suid bin and we have root access. ___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
EXIF data help

doing some OSINT and could use some leads... anyone have some good info on photo EXIF, software or web. thanks

submitted by /u/polarchimp91
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video