submitted by /u/stewtech3 (https://www.reddit.com/user/stewtech3)
[link] (https://portswigger.net/web-security) [comments] (https://www.reddit.com/r/Pentesting/comments/rpdml6/legit_or_not_so_much/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Weapons in my quiver: Tools and extension I use in bounties

https://cdn-images-1.medium.com/max/2500/1*MxnhUEq-rHvDaOGO76YZyg.jpeg
As this blog already describes, I will be putting some info about tools and extensions which I use daily in my bounties. For an early…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What would be your methodology in this case?

Hello, I'm trying to understand the methodology or workflow of people more experienced than me.

What would you do in this scenario:

HOST: Port 445 open along with other ports, Windows 7 2016 RDC

You need to get inside this to delete some logs or something

how would you get inside like, what would you use (rdcclient + metasploit for example) what would you look for (ports, other stuff) and what would you do once you get a foothold

Thanks to whoever will reply

Edit:typos

submitted by /u/SantoIsBack
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Common Nginx Misconfiguration leads to Path Traversal
https://mikekitckchan.medium.com/common-nginx-misconfiguration-leads-to-path-traversal-d58701e997bc?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Recently, I have been invited by my friend to participate into a private pentest project. The target has been using Nginx as its Reverse…Continue reading on Medium » (https://mikekitckchan.medium.com/common-nginx-misconfiguration-leads-to-path-traversal-d58701e997bc?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

XSS via file upload
https://sharmajijvs.medium.com/xss-via-file-upload-a2bcc1e5d7f7?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

I found xss via file upload here i uploaded svg file which stored in google cloud and reflected with xssContinue reading on Medium » (https://sharmajijvs.medium.com/xss-via-file-upload-a2bcc1e5d7f7?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Weapons in my quiver: Tools and extension I use in bounties

As this blog already describes, I will be putting some info about tools and extensions which I use daily in my bounties. For an early…Continue reading on Medium »
Read more...

Common Nginx Misconfiguration leads to Path Traversal

Recently, I have been invited by my friend to participate into a private pentest project. The target has been using Nginx as its Reverse…Continue reading on Medium »
Read more...

XSS via file upload

I found xss via file upload here i uploaded svg file which stored in google cloud and reflected with xssContinue reading on Medium »
Read more...

Kali Linux Tutorials
Ad-Honeypot-Autodeploy : Deploy A Small, Intentionally Insecure, Vulnerable Windows Domain For RDP Honeypot Fully Automatically

Ad-Honeypot-Autodeploy a tool to Deploy a small, intentionally insecure, vulnerable Windows Domain for RDP Honeypot fully automatically.

Runs on self-hosted virtualization using libvirt with QEMU/KVM (but it can be customized easily for cloud-based solutions).

Used for painlessly set up a small Windows Domain from scratch automatically (without user interaction) for the purpose of RDP Honeypot testing.

Features a Domain Controller, a Desktop Computer and a configured Graylog server for logging the actions of the bad guys. Automatic deployment phases

1. Packer: download the necessary install media and setup the automated base virtual machine images unattended.
2. Terraform: provision the libvirt virtualization infrastructure (network + virtual machines) using the packer-prepared virtual machine images.
3. Ansible: Configure the infrastructure (DC, Desktop, Graylog) automatically, without user interaction.

After going through the Packer+Terraform+Ansible pipeline, the configured Windows Domain should be up and running, you could attach the RDP service of the Desktop to the public internet, and let’s monitor the events through the Graylog. Features

Features of the running system are:

* a Windows Server 2016 as a Domain Controller
* a Windows 10 Desktop (version 2004) as a Domain Computer
* a Graylog 3.3 (Open Source edition) running as a Log Collector on Ubuntu 18.04 LTS
* Using VirtIO drivers for best performance
* Enabled RDP and WinRM Services
* Populated Windows Active Directory with random users
* Sysmon (from Windows Sysinternals) installed and running on Domain Computers
* NXLog Collector running a Domain Computers and forwarding logs to Graylog
* Configured Graylog GeoIP lookup table and pipeline for IP addresses (useful for showing a map of invalid RDP login attempts)
* Graylog World Map of RDP attacks Host System Requirements

Virtualization needs some power of your host system:

* ~80 GB disk space for the base images and the sparse images of the guest computers.
* at least 3 x 4 GB memory for the guest machines (may run with less than 12 GB because of overcommitment)
* installed up-to-date libvirt with QEMU/KVM (official current packages in Ubuntu 18.04 LTS should work)
* Python 3 (preferably with venv) for Ansible

Tested on Ubuntu 18.04 LTS host. Installation and Usage

First, clone the repo:

git clone https://github.com/tothi/ad-honeypot-autodeploy
cd ad-honeypot-autodeploy

Before starting with Packer, set up the intial passwords:

./init_passwords.sh

Packer

Now build the initial images.

cd packer

Windows Server 2016 and Ubuntu installation media should be downloaded by the Packer script. VirtIO needs to be downloaded by the attached get-virtio.sh script:

./get-virtio.sh

Windows 10 should be downloaded manually by getting a temporary download link and save it to the ISO folder. The download link could be obtained from here. Select the English (International), 64-bit version and save the ISO to ISO/Win10_2004_EnglishInternational_x64.iso.

For mapping IP locations on a World Map in Graylog, the MaxMind GeoIP database is needed. Unfortunately due to licensing terms it cannot be redistributed, so you have to download it manually (after registering) from the MaxMind site. The free GeoLite2 version should work, get the “GeoLite2 City” Database in MMDB format (download the GZIP and untar) and put it at resources/GeoLite2-City.mmdb.

If you do not have Packer, get the latest version from the packer.io site (download the pre-compiled binary) or try to add the Hashicorp repository to your packaging system (useful for Terrafrom also).

If you are rebuilding the images, do not forget to clea[...]

___________________________
@hacking_Attack
@Hacking_Video

n up previous builds:

rm -fr output_*

If you want to re-download the images, remove packer_cache:

rm -fr packer_cache

After these preparing steps, run the Packer builds in parallel:

./packer-build-all.sh

The images should be ready in a reasonable time (~20-30 mins depending on your host hardware power). Terraform

Now the infrastructure can be deployed using Terraform.

Get Terraform (>=0.13) if you do not have it (look at the install methods at Packer, above).

Terraform provider for libvirt is also needed, get the appropriate binary from the github releases page, and also look for Terraform v13 migration notes for proper installation.

Enter Terraform folder:

cd ../terraform

Initialize the working directory (only needed for first time use):

terraform init

Build and launch the infrastructure (“apply the changes”):

terraform apply

After a short time (~2-3 mins), the network and virtual machines are up and running.

WARNING: You should take care of protecting your private network. The terraform config (main.tf) provided here just contains a custom firewall rule for my own testing environment (blocking 192.168.0.0/16 destination traffic from the 192.168.3.0/24 honeypot network).

Next is the configuration phase. Ansible

Get into the ansible folder:

cd ../ansible

Recommended installation method is installing the latest Ansible with some required additional dependencies in a Python venv virtualized environment:

python3 -m venv venv
. ./venv/bin/activate
pip install ansible pywinrm faker

For later use just activate the venv by

. ./venv/bin/activate

And just deactivateif it is not needed anymore in your current session.

You should put an SSH public key with filename id.pubinto the ansible folder for accessing the Ubuntu Graylog machine with the ubuntu user (ansible will add it to ~ubuntu/.ssh/authorized_keys).

The wordlist.txtfile contains some (intentionally weak) passwords for the populated domain users which can be customized.

Run the configuration phase:

ansible-playbook -i hosts setup-domain.yml -v

After 20-25 mins everything is ready. The deployed system
hostnameip addressoperating systemroledc1192.168.3.100Windows Server 2016Domain Controllerdesktop12192.168.3.112Windows 10 (version 2004)Domain Member Workstationgraylog192.168.3.191Ubuntu 18.04 LTSGraylog Server
According to the libvirt network configuration (NAT), the hosts can access the public internet (if your host system allows it).

Accessing the hosts is possible through the host system. Practically using an SSH socks tunnel and proxychains for RDP or WinRM access is very comfortable.

For example, if your libvirt host IP is 192.168.0.10, create a socks tunnel listening on localhost:5000by

ssh 192.168.0.10 -D5000 -NTv

And access the Windows 10 desktop (using an appropriate /etc/proxychains.confconfigured for the :5000 tunnel):

proxychains xfreerdp /v:192.168.3.112 /u:administrator

Or, access the Graylog web interface listening on :9000 locally on the Graylog Ubuntu server by SSH ProxyJump and custom forward tunnel:

ssh -J 192.168.0.10 ubuntu@192.168.3.191 -NTv -L9000:127.0.0.1:9000

Then open URL http://localhost:9000and you reach the Graylog web interface.

For activating the RDP honeypot, just allow public access to 192.168.3.112:3389 (for example with some port forwarding configuration on your router and iptables rules on the host machine; my helper script is rdp_public.sh) and keep watching the Graylog. https://s.w.org/images/core/emoji/13.1.0/72x72/1f609.png Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Abaddon : Make red team operations faster, more repeatable, stealthier, while including value-added tools and bringing numerous reporting capabilities

Abaddon is a Red team operations involve miscellaneous skills, last several months and are politically sensitive; they require a lot of monitoring, consolidating and caution. Wavestone’s red team operations management software, Abaddon, has been designed to make red team operations faster, more repeatable, stealthier, while including value-added tools and bringing numerous reporting capabilities.

Because:

* There are tons of tools used by red teamers
* … but no operation management (and free and open-source) software
* … and no aggregation between these tools, anyway
* … and “Operational security” failures are common

What did we want with Abaddon ?:

Abaddon aims at facilitating red team operations by:

* Reducing the time to build an infrastructure
* Enabling complex actions with 1 or 2 clicks
* Enabling easier reporting for long operations
* Reducing the “OPSEC failure” risk

The slides presenting Abaddon at RSAC2020 can be found here: (Abaddon, the red team angel) What You Can Deploy
https://blogger.googleusercontent.com/img/a/AVvXsEjd57Z7KZ8D3gnPG-DtW1oSyGO65xC-xImVYNdnS0A7X7Hc5iX-KqQNBh99Fc__qo8PwFvHV6crfxIxtYgBWn5GXEM_45Pe058iEwned9DGzm9XDSYPWtOYQ5XDThQFAWKrKyDJGF3uy9r5CFJa2Z5qzLtzZdS5lu1h15xJu2vZRewQmYslVaL_jIja=s1233
* Deployed within 30 minutes
* Throwable, authenticated, stealth
* Enables phishing as well as remote command execution Other Features

* Reconnaissance: graphical interface to NMAP, Recon-NG, HunterIO, and Amass
* Weaponization: generation of obfuscated payloads under development
* Delivery: one or two-clicks deployment of EC2 instances, Gophish, and of a fully functionnal, stealthy & dockerized C&C infrastructure as shown above
* Exploitation & Post-Exploitation: ideas under development https://s.w.org/images/core/emoji/13.1.0/72x72/1f642.png
* Reporting: a simple dashboard ready but still under development to follow your operations Installing And Launching Abaddon

Abaddon has been tested on Debian, LUbuntu, and of course KALI Linux (latest tests have been performed on the 5.4.0 amd64 version). You also need to have Internet access, and a public IP address if you want to deploy your C&C server locally.

Note that to configure your AWS environment, the easiest way is probably to install the aws-cli like indicated here: https://docs.aws.amazon.com/fr_fr/cli/latest/userguide/install-cliv2-linux.html

curl “https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip” -o “awscliv2.zip”
unzip awscliv2.zip
sudo ./aws/install

Clone this repository and move inside the repository folder

git clone git@github.com/wavestone-cdt/abaddon.git
cd abaddon

Create the files ~/.aws/credentials and ~/.aws/config with your AWS credentials and configuration, using the following command:

aws configure

Move settings.py.sample to settings.py. Add change the database user password (This password will be asked durring the setup process)

mv abaddon/settings.py.sample abaddon/settings.py
sed -i ‘s/yourPasswordHere//g’ abaddon/settings.py

Launch the following command in the abaddon/setup folder:

bash setup/install.sh

This script will:

* Update your OS
* Install the packages that are required by Django and Abaddon (including docker and docker-compose)
* Install all the python dependencies (including Django 3.X)
* Create a PostgreSQL database and a user with the right role (the password for the database that you need to give is inside the abaddon/settings.py file, it is recommended to change the password)
* Apply Django migrations
* Create a superuser for the Django application, that will be used to connect to the graphical interface of Abaddon.

Start the Red Team Angel !

bash abaddon.sh

Open a browser, and go t[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Canadian Furious Beaver : A Tool For Monitoring IRP Handler In Windows Drivers, And Facilitating The Process Of Analyzing, Replaying And Fuzzing Windows Drivers For Vulnerabilities

Canadian Furious Beaver is a distributed tool for capturing IRPs sent to any Windows driver. It operates in 2 parts:

1. the “Broker” combines both a user-land agent and a self-extractable driver (IrpDumper.sys) that will install itself on the targeted system. Once running it will expose (depending on the compilation options) a remote named pipe (reachable from \\target.ip.address\pipe\cfb), or a TCP port listening on TCP/1337. The communication protocol was made to be simple by design (i.e. not secure) allowing any 3rd party tool to dump the driver IRPs from the same Broker easily (via simple JSON messages).
2. the GUI is a Windows 10 UWP app made in a ProcMon-style: it will connect to wherever the broker is, and provide a convienent GUI for manipulating the broker (driver enumeration, hooking and IRP capturing). It also offers facililties for forging/replaying IRPs, auto-fuzzing (i.e. apply specific fuzzing policies on each IRP captured), or extract IRP in various formats (raw, as a Python script, as a PowerShell script) for further analysis. The captured data can be saved on disk in an easily parsable format (*.cfb = SQLite) for further analysis, and/or reload afterwards in the GUI.

Although the GUI obviously requires a Windows 10 environment (UWP App), the Broker itself can be deployed on any Windows 7+ host (x86 or x64). The target host must have testsigningBCD policy enabled, as the self-extracting driver is not WHQL friendly. Screenshots Intercepted IRP view
https://blogger.googleusercontent.com/img/a/AVvXsEhTdkv8WkSAWv7q4dKU-p7yduaX39G9fupngmIHv_a1_uljlxYvwek1w9TV6-XjU4mNjW7PZfbqEGkTBDwbNSWOL4ABgXd9lvbYlfl2Y--wfwOU2bsVsO98SItXtMUlPiTVcLJbvAln159ngmESueV44REwAEuUD39qCY9VE7933oE0_jWxVLpsUQfK=s2229
IRP details
https://blogger.googleusercontent.com/img/a/AVvXsEiqlu-HDxB_Lq990NsjB4sef6PBXsR6ca-O--2sfmpUsuaR9aUU07SvFrVO0J30AGeQzEz834cl6lAmyRy-GncMPfYOSaH8df4NLdnXq8NY25RkyoE1U6dT2G4n_jbiZl_5Ip4yf6YH4H6bBOqoa7TRwEmZ-tPAdrzKb0emmw8WhwyRtasFJnXIk-Ed=s2388 https://blogger.googleusercontent.com/img/a/AVvXsEhlpynB1xzPMnbfyAes9XVAFKltFI6cKFJDPQSPTmUv-QULWJdMqVIzuCWXO3ya54Jk63cKSu3_VnfITWXLwV37wgex8TISjzTiUQ555VftyLwWl2VwnHVttLX78wcCtL5tRDJ672PSv8i2q_rCHDtPD7KYsfQNuCXr3NNnc8_N660sPfZTaoAZkGLt=s2388
IRP replay
https://blogger.googleusercontent.com/img/a/AVvXsEiw68SmFEwW8xsyUnQUQYZLnMRDt-5BX-lz6z_iG-uYrSr_SnNPLsTCkQOgCbpT1bCWfIohmU5-v9NuVRBSDUexYi-pnkTYOs4AfpQ3G3OcpPRGTtk4wfAWgc2StmuI7jH7o_gH9GVdr0thBCTqF36JA33vgA0kFkwoLtZaQWKuPcu42iMhgJ3YI3-P=s2388
Concept IrpDumper.sysis the driver part of the CFB Broker that will auto-extract and install when launched. The driver will be responsible for hooking the IRP Major Function table of the driver that is requested to be hooked, via an IOCTL passed from the Broker. Upon success, the IRP table of the driver will then be pointing to IrpDumper.sysinterception routine, as we can easily see with a debugger or tools like WinObjEx64.
https://blogger.googleusercontent.com/img/a/AVvXsEgSU2Zgiv-iqjpZe9pa6lQv96He1mHvUS33aMwbPUHySQglZ3IsFsgMGGFzek3O63lKSvXPnLgE-xEuWGuY1fjyttj4q4Zt1N1l-o-gIVkm-WjCWxBzeTb5pEr2b4yl2zb4SdOZIyROKu_tlaB6Rqk6r2rS7XrmYME6UT8DMg2p666xXKXaNQm30_bw=s751 IrpDumper.sysin itself then acts a rootkit, proxy-ing all calls to the targeted driver(s). When a DeviceIoControlis sent to a hooked driver, IrpDumperwill simply capture the data if any, and push a message to the user-land agent (Broker), and yield the execution back to the legitimate drivers, allowing the intended code to continue as expected. The Brokerstores all[...]

___________________________
@hacking_Attack
@Hacking_Video