iOHs0E2AbsOMBEl3whAzA0srpyM5ZNQRoH2diNoz6OGd4gDfLtNgcztgSTn50BgJJjOc4Aks3GshEpMlcmQ9rM5kY4jaTzA0efzMQBOxG5IEfcTTEcY2e-1n9iOEPoZ_NOaBhE2fiTQNc-shoGMGxkA3CkGXMPfTefVyujBboNNH-3z4IysnTmLKrTwg=s16000 As you can see below we have been able to upload our shell.war file in the tomcat application manager. /cat/etc/passwd would show us the list of available users. We have luis user. We also have a backup file which has trigger our attention. So let’s dig into that also browser the complete directory to find any kind of files that ca help. run.yml.What its actually doing, it’s backing up all files in the path /var/liv/tomcat9/webapps/ROOT/admin/dashboardand keeping it in destination /opt/backups/archives/backup-date and time. So if you can put any file in the source directory that can be helpful to us, it’s going to be automatically be zipped the destination folder and we will be able to get access to it. So let’s browse to the home directory of the user we find above, that is, Luis. tar -xvf backup.gzhttps://blogger.googleusercontent.com/img/a/AVvXsEgZnUc8y2DW3KH-g0EpQkFlPYVZlC7PY_ZAyGjM_zr6isqc_kVOM3ad88bdSc6NLgI7mdYOycw4AmTNY78xue0cw-7p0nwpG5jqZjlWf4DXnLx85jTDMw31KG13oq95J2s3gGL7MHENQsqzmMmVWd3MjKrMmp2Npkr6fulQTk-Zc2aw9yyah079YmRfrA=s16000 So now if we browse to the dashboard/uploads, we can find the .ssh folder. And when browsin[...]

___________________________
@hacking_Attack
@Hacking_Video

g the .ssh folder we can find 3 files including the id_rsa. Now we can cat this file to find the private key.Privilege EscalationNow that we have been able to login as luis, lets run the command sudo -l to verify any suoders privilege escalation. We can see that luis can run ansible-playbook as sudo. Now we are going to create a file called test.yml put in those command below:-name: "ignite"The task part is very important here. What it is actually doing is, it’s putting suid bin on bash binary. Once the suid bit has been put on a bash binary, we will execute it.sudo /usr/bin/ansible-playbook ./test.ymlAs show above we have a suid bin and we have root access. ___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
EXIF data help

doing some OSINT and could use some leads... anyone have some good info on photo EXIF, software or web. thanks

submitted by /u/polarchimp91
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Cant get a shell_reverse_tcp (Metasploit)

When using openVPN to a ctf box I cant get a metasploit reverse shell. when init msploit db it defaults my ip address to my local IP. Ill go in and set LHOST to the openvpn IP but when running the exploit it seems that it falls back on the local IP 0.0.0.0:4444 .. I cant figure out what I'm doing wrong. I've tried both with and without using the database and always the same results. Any ideas? I have both a ethernet and wifi NIC. both initialize when starting up. Is it possible that is the issue? what does the syntax look like to set the interface?? "set SRVHOST 10.2.10.10etho0" ??

submitted by /u/Dnozz
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I am running a simple reverse Shell python scrypt on my local machine from bash terminal. The scrypt work. I have access to a shell. But I want to know, after running a command, how to back to the command line or close the scrypt? I tried CTRL + C , CTRL + Z, CTRL + BREAK. Not working.

https://external-preview.redd.it/IHQKM6rvBTeKDN4cuh6DUnuDgqaAXvrQgEkd6eajuXU.jpg?width=640&crop=smart&auto=webp&s=a7447498ac16ebb6296403ff7232024638f7d6cf submitted by /u/guizmole
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How does twitter account gets hacked ?

Hello Guys, Today Indian Prime minister Narendra modi's twitter account was hacked second time and this make me wonder if it's something wrong with twitter or could be the individual who is at risk ? i am also wondering if i should be without worry if i have 2FA enable ? or there is no guarantee of anything ?

submitted by /u/deepak8717
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
KaliLinux proxychains CA issue

I’m using Kali-Linux using the default SOCK5 Tor proxy and a SOCK5 USA proxy I’m trying to just surf the web and everytime I try to go anywhere it says that the certs. are invalid and I need to goto advanced options to go the “unsafe” option. Anyway I can fix this? Btw I’m using proxychains4

Config

Tor service is on Using proxychains4 Proxy_dns is on Using dynamic_chain

Testing by using the command:

proxychains Firefox google.com (won’t let me access)

But using:

proxychains Firefox whatsmyip.com (Asks if I would like to proceed “unsafe”)

submitted by /u/KeepYaGuessin
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Haptyc - Test Generation Framework
http://www.kitploit.com/2021/12/haptyc-test-generation-framework.html

___________________________
@hacking_Attack
@Hacking_Video

Haptyc is a python library (https://www.kitploit.com/search/label/Python%20Library) which was built to add payload position support and Sniper/Clusterbomb/Batteringram/Pitchfork attack types into Turbo Intruder. While Haptyc accomplishes these goals fairly well it also introduces a simpler way to express test sequences in general. While this library was meant to target Turbo Intruder it has no hard dependencies on Turbo Intruder and can be used anywhere one requires test generation in a Python context. Unfortunately at this time since Haptyc was built for a jython interpreter it only supports Python 2.7 (however future changes will fix this).
What are Haptyc tags?Haptyc tags are tags which a tester can use to annotate an original input payload. A tester can use multiple tags to surround key pieces of data in an HTTP request to wrap it as a positional payload. When tests are being generated Haptyc will parse all the tags in the original payload and generate tests in accordance to the functions associated with the tag names. When Haptyc evaluates a Haptyc tag it will execute the associated tag function (this is called a Haptyc Transform) for a test payload to place in position of the associated tag in the request. Every tag function will receive a data argument and a state argument. The data argument may contain the inner data of the tag or may contain some other test payload sequence. The state argument is a state object associated with the tag where state can be stored between test iterations. Let's review an example.Example 1: Simple list iterationOriginal Payload:GET /animal/[+GuessAnimal]dog[+end] HTTP/1.1Haptyc Class & Haptyc Transform:from haptyc import *

original = "GET /animal/[+GuessAnimal]dog[+end] HTTP/1.1"

class TestLogic(Transform):
@ApplyList(["snake","cat","owl","lion"])
def test_GuessAnimal(self, data, state):
return data + "?original=" + self.inner() + "&attempt=" + str(state.iter)

TestFactory = TestLogic(original)
for test in TestFactory:
print(test)Tests Generated:GET /animal/snake?original=dog&attempt=0 HTTP/1.1
GET /animal/cat?original=dog&attempt=1 HTTP/1.1
GET /animal/owl?original=dog&attempt=2 HTTP/1.1
GET /animal/lion?original=dog&attempt=3 HTTP/1.1In the example above we how one can express tests in a simple way using Haptyc. First the Haptyc library is imported. Second we have defined the original data with our Haptyc tag annotations (GuessAnimal). Next the TestLogic class is defined and extended as a Transform class. Inside this class every method that starts with test_ will get registered as a Haptyc tag for evaluation (https://www.kitploit.com/search/label/Evaluation) in the original payload. We use a logic decorator to apply the state logic for this Haptyc transform. In this case we use the @ApplyList(list) decorator to tell Haptyc to generate a test for every item in the specified list and place that item into the Haptyc transform as the data argument. Inside the transform we return a mutated version of the data to insert back into the position of the tag. In this case the mutation is the list item as data concatenated with the data surrounded by the tag (dog) and then concatentated with the iter value in the state object. Lastly the remaining python shows the TestFactory object being created and all tests being generated in a for loop iterator. This is an example of a standard sniper-style attack which targets a single payload position. Next lets look at other style of attacks.Example 2: ClusterbombOriginal Payload:GET /animal?type=[%type]dog[%end]&name=[%name]fido[%end] HTTP/1.1Haptyc Class & Haptyc Transform:from haptyc import *

original = "GET /animal?type=[%type]dog[%end]&name=[%name]fido[%end] HTTP/1.1"

class TestLogic(Transform):
@ApplyList("snake","cat","owl","lion")
def test_type(self, data, state):
return data

@ApplyList("Frank", "Lisa", "Jin", "Tooth")
def test_name(self, data, state):
return data

TestFactory = TestLogic(original)
for test in TestFactory:

___________________________
@hacking_Attack
@Hacking_Video

GET /animal?type=owl&name=Frank HTTP/1.1
GET /animal?type=owl&name=Lisa HTTP/1.1
GET /animal?type=owl&name=Jin HTTP/1.1
GET /animal?type=owl&name=Tooth HTTP/1.1
GET /animal?type=lion&name=Frank HTTP/1.1
GET /animal?type=lion&name=Lisa HTTP/1.1
GET /animal?type=lion&name=Jin HTTP/1.1
GET /animal?type=lion&name=Tooth HTTP/1.1Example 1 showed how to evaluate transforms sniper style by using the '+' sign annotation in the tag [+tag][+end]. Example 2 shows how we can use 2 transforms/positions to conduct a clusterbomb-style of attack. As you can see we use 2 separate transform tags called [%type][%end] and [%name][%end]. The '%' sign tells Haptyc to evaluate these transforms clusterbomb-style, for every payload in the first transform create a test with the payload from the second transform. The test count is the number of tests of every transform involved multiplied by each other.Example 3: Pitchfork/BatteringRamUsing the same exact python code we can switch the attack style from clusterbomb to pitchfork by changing the '%' to a '#'. Pitchfork style attacks will place the position payload all in parallel. The test count is the lowest number of tests given of all involved transforms.Original Payload:GET /animal?type=[#type]dog[#end]&name=[#name]fido[#end] HTTP/1.1Tests Generated:GET /animal?type=snake&name=Frank HTTP/1.1
GET /animal?type=cat&name=Lisa HTTP/1.1
GET /animal?type=owl&name=Jin HTTP/1.1
GET /animal?type=lion&name=Tooth HTTP/1.1Example 4: Persistent TransformsOriginal Payload:GET /animal?type=dog&id=[+idor]0[+end]&process=[@randbool]False[@end] HTTP/1.1Haptyc Class & Haptyc Transform:from haptyc import *
import random

original = "GET /animal?type=dog&id=[+idor]0[+end]&process=[@randbool]False[@end] HTTP/1.1"

class TestLogic(Transform):
@ApplyIteration(10)
def test_idor(self, data, state):
return str(state.iter)

def per_randbool(self, data):
return random.choice(["True", "False"])

TestFactory = TestLogic(original)
for test in TestFactory:
print(test)Tests Generated:GET /animal?type=dog&id=0&process=False HTTP/1.1
GET /animal?type=dog&id=1&process=True HTTP/1.1
GET /animal?type=dog&id=2&process=False HTTP/1.1
GET /animal?type=dog&id=3&process=True HTTP/1.1
GET /animal?type=dog&id=4&process=False HTTP/1.1
GET /animal?type=dog&id=5&process=True HTTP/1.1
GET /animal?type=dog&id=6&process=False HTTP/1.1
GET /animal?type=dog&id=7&process=True HTTP/1.1
GET /animal?type=dog&id=8&process=False HTTP/1.1
GET /animal?type=dog&id=9&process=False HTTP/1.1Persistent transforms are denoted by the '@' sign and the transform functions always start with per_ this is because these transforms are not iterative, they don't create tests or keep state. These transforms are just naive transformation which you can apply anywhere in the payload for a state-less transformation without affecting the stateful transforms. Since they don't prescribe any tests you cannot generate tests with persistent transforms alone, they are meant to be mixed with iterative transforms. In the example above we have a 10-test snipe style transform placing an incrementing id. Also we have a persistent transform which places a random boolean into its position.Example 5: Using state and state.initThere may be cases where prior to the start of a test sequence the tester may want to perform some processing/initialization. To support this Haptyc executes all involved transforms for an initialization phase prior to executing the transform for test generation. This initialization step can be used for performing whatever initialization the tester requires and placing it into the state object. For this the tester can use state.init as a boolean to determine if the execution is in initialization. Any returned data from the initialization step will be ignored.Original Payload:GET /animal?data=[+b64mutate]SGVsbG8gSGFja2VyIQ==[+end] HTTP/1.1Haptyc Class & Haptyc Transform:from haptyc import *
import base64

___________________________
@hacking_Attack
@Hacking_Video

original = "GET /animal?data=[+b64mutate]SGVsbG8gSGFja2VyIQ==[+end] HTTP/1.1"

class TestLogic(Transform):
@ApplyIteration(10)
def test_b64mutate(self, data, state):
if state.init:
state.decoded = base64.b64decode(data)
return
return base64.b64encode(random_insert(state.decoded, ["'"]))

TestFactory = TestLogic(original)
for test in TestFactory:
print(test)Tests Generated:GET /animal?data=SGVsbG8gSCdhY2tlciE= HTTP/1.1
GET /animal?data=SGVsbG8gSGFja2VyISc= HTTP/1.1
GET /animal?data=SGVsbG8gSGFjaydlciE= HTTP/1.1
GET /animal?data=SGVsbG8gSGEnY2tlciE= HTTP/1.1
GET /animal?data=SCdlbGxvIEhhY2tlciE= HTTP/1.1
GET /animal?data=SGVsbG8gSGFjaydlciE= HTTP/1.1
GET /animal?data=SGVsbG8gSGFja2VyISc= HTTP/1.1
GET /animal?data=SCdlbGxvIEhhY2tlciE= HTTP/1.1
GET /animal?data=SGVsbG8gSGFjJ2tlciE= HTTP/1.1
GET /animal?data=SGVsbG8gSGFjJ2tlciE= HTTP/1.1In the example above the test uses state.init to base64 decode the wrapped inner payload only once at the beginning of the test sequence and store that result into state.decoded. Then for all normal test generation executions state.decoded is used as the decoded inner data to be processed. This type of pattern is useful to improve the performance (https://www.kitploit.com/search/label/Performance) of your transform due to the fact that only 1 decode occurs at the beginning (vs decoding the same payload at the generation of every test).DocumentationTag Types[+tag]inner[+end] - Sniper style iterative transform[%tag]inner[%end] - Clusterbomb style iterative transform[#tag]inner[#end] - Batteringram/Pitchfork style iterative transform[@tag]inner[@end] - Stateless persistant transformLogic DecoratorsNameArgumentsdata inputDescription@ApplyIteration(n)n= # of Iterationsinner value of the haptyc tagLogic to generate N tests with inner as data@ApplyRange(b,e,s=1)b = begin value, e = max value, s = stepgenerated value of the rangeLogic to generate a test for every value stepped with the value given as data@ApplyList(L)L = python listitem of the listLogic to generate a test for every value in the list given as data@ApplyFilelist(path)path = filesystem (https://www.kitploit.com/search/label/Filesystem) pathitem of the listLogic to generate a test for every value in the filelist given as data@ApplyPayloads(name)name = builtin list nameitem of the listLogic to generate a test for every value in the built-in list given as dataHaptyc Class DecoratorsNameArgumentsDescription@CloneTransform(srcname, destname)srcname=string of a transform method copy from, destname=string of a non-existent transform method to copy intoCloneTransform is used to copy the implementation of one transform into another namespace without needing to copy/paste. This is useful in '%' and '#' style attacks when you need to re-use the same transform implementation in multiple positionsTransform Class Helper MethodsNameDescriptionself.inner()Retrives the inner payload of the tagself.stop()Will immediately stop test generation of that transformself.me()Will return the name of the current transform contextself.set_label(label)Will set the label for this current testself.get_label(label)Will get the label for this current testTransform Helper State AttributesNameDescriptionstate.iterCurrent iteration count of the transform (0-based)state.initBoolean that indicates if in the initialization stageHelper Mutation FunctionsNameDescriptionradamsa(data)This function will execute radamsa on the input data and returns its result (radamsa is required to be installed)index_insert(data, list, index)This function will insert a payload from the list into the supplied data at the supplied indexrandom_insert(data, list)This function will insert a payload from the list into the supplied data at a random indexBulitin Wordlists@ApplyPayloads("0-9")@ApplyPayloads("10 letter words")@ApplyPayloads("11 letter words")@ApplyPayloads("12 letter words")@ApplyPayloads("3

___________________________
@hacking_Attack
@Hacking_Video

letter words")@ApplyPayloads("4 letter words")@ApplyPayloads("5 letter words")@ApplyPayloads("6 letter words")@ApplyPayloads("7 letter words")@ApplyPayloads("8 letter words")@ApplyPayloads("9 letter words")@ApplyPayloads("a-z")@ApplyPayloads("CGI scripts")@ApplyPayloads("Directories - long")@ApplyPayloads("Directories - short")@ApplyPayloads("dirsearch")@ApplyPayloads("Extensions - long")@ApplyPayloads("Extensions - short")@ApplyPayloads("Filenames - long")@ApplyPayloads("Filenames - short")@ApplyPayloads("Format strings")@ApplyPayloads("Form field names - long")@ApplyPayloads("Form field names - short")@ApplyPayloads("Form field values")@ApplyPayloads("Fuzzing - full")@ApplyPayloads("Fuzzing - JSON_XML injection")@ApplyPayloads("Fuzzing - out-of-band")@ApplyPayloads("Fuzzing - path traversal")@ApplyPayloads("Fuzzing - path traversal (https://www.kitploit.com/search/label/Path%20Traversal) (single file)")@ApplyPayloads("Fuzzing - quick")@ApplyPayloads("Fuzzing - SQL injection")@ApplyPayloads("Fuzzing - template injection")@ApplyPayloads("Fuzzing - XSS")@ApplyPayloads("HTTP headers")@ApplyPayloads("HTTP verbs")@ApplyPayloads("IIS files and directories")@ApplyPayloads("Interesting files and directories")@ApplyPayloads("Local files - Java")@ApplyPayloads("Local files - Linux")@ApplyPayloads("Local files - Windows")@ApplyPayloads("Passwords")@ApplyPayloads("Server-side variable names")@ApplyPayloads("Short words")@ApplyPayloads("SSRF targets")@ApplyPayloads("User agents - long")@ApplyPayloads("User agents - short")@ApplyPayloads("Usernames")How to installThere are 2 ways to install HaptycThe easy way using the release turbo-intruder-all_w_haptyc.jar attached to this repositoryThe manual wayEither way you choose these releases do not include radamsa and if you want radamsa support you must install it from this repo: (Optional) Installl radamsa via https://gitlab.com/akihe/radamsaHow to install - Pre-packaged (easy)Clone this repo and note turbo-intruder-all_w_haptyc.jar in the release dirOpen BurpGo to the Extender tabClick the Add buttonClick the Select File ... button and choose turbo-intruder-all_w_haptyc.jarHow to install - Manual (patching turbo-intruder-all.jar)Clone this repoIn bash execute ./install.sh In Burp reload Turbo Intruder

Download Haptyc (https://github.com/defparam/haptyc)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Seal HackTheBox Walkthrough

Seal is a CTF Linux machine rated as medium difficulty on Hack the Box platform. So let get started and deep dive into breaking down

The post Seal HackTheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Haptyc - Test Generation Framework

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Name That Toon: Modern-Day Frosty

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

Dark Reading: Attacks/Breaches
Bug-Bounty Programs Shift Focus to Most Critical Flaws

The number of bug bounty programs jumped by a third, the median payout for a critical vulnerability report rose to $3,000, but rewards for easier-to-find lower-severity flaws stagnated in 2021.

Dark Reading: Attacks/Breaches
40% of Corporate Networks Targeted by Attackers Seeking to Exploit Log4j

More than 60 variants of the original exploit were introduced over the last day alone.