Dockerized-Android - A Container-Based Framework To Enable The Integration Of Mobile Components In Security Training Platforms (https://www.kitploit.com/2021/10/dockerized-android-container-based.html)

Emp3R0R - Linux Post-Exploitation Framework Made By Linux User (https://www.kitploit.com/2021/01/emp3r0r-linux-post-exploitation.html)

MurMurHash - Tool To Calculate A MurmurHash Value Of A Favicon To Hunt Phishing Websites On The Shodan Platform (https://www.kitploit.com/2021/05/murmurhash-tool-to-calculate-murmurhash.html)

CiLocks - Android LockScreen Bypass (https://www.kitploit.com/2021/05/cilocks-android-lockscreen-bypass.html)

Viper - Intranet Pentesting Tool With Webui (https://www.kitploit.com/2021/10/viper-intranet-pentesting-tool-with.html)

Forbidden - Bypass 4Xx HTTP Response Status Codes (https://www.kitploit.com/2021/12/forbidden-bypass-4xx-http-response.html)

AzureHunter - A Cloud Forensics Powershell Module To Run Threat Hunting Playbooks On Data From Azure And O365 (https://www.kitploit.com/2021/11/azurehunter-cloud-forensics-powershell.html)

403Bypasser - Automates The Techniques Used To Circumvent Access Control Restrictions On Target Pages (https://www.kitploit.com/2021/09/403bypasser-automates-techniques-used.html)

Black Hat Ethical Hacking
QNAP NAS devices hit in surge of ech0raix ransomware attacks

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png QNAP NAS devices hit in surge of ech0raix ransomware attacksPost Views: 172 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute
Users of QNAP network-attached storage (NAS) devices are reporting attacks on their systems with the eCh0raix ransomware, also known as QNAPCrypt.
The threat actor behind this particular malware intensified their activity about a week before Christmas, taking control of the devices with administrator privileges. Attack count jumps before ChristmasBleepingComputer forum users managing QNAP and Synology NAS systems have been regularly reporting eCh0raix ransomware attacks but more of them started to disclose incidents around December 20.

The jump in the number of attacks is confirmed by the ID ransomware service, where submissions started to increase on December 19 and subsided towards December 26.
https://www.bleepstatic.com/images/news/u/1100723/2021/eCh0raixIDR.png
<figcaptionsource: ID Ransomware service
See Also: Complete Offensive Security and Ethical Hacking Course
The initial infection vector remains unclear at the moment. Some users admit they were reckless and did not secure the device properly (e.g. expose it to the internet over an insecure connection); others claim a vulnerability in QNAP’s Photo Station allowed the attackers to wreak havoc.

Yes I know I am a total idiot for leaving that open to this type of hack but I didnt take any of that seriously. I always thought no-one want the little guy and I will be the first to say I was wrong!

Regardless of the attack path, it appears that the eCh0raix ransomware actor creates a user in the administrator group, which allows them to encrypt all files on the NAS system.

QNAP users – some of them using the NAS device for business purposes – reported on the BleepingComputer forum that the malware encrypted pictures and documents.

Apart from the spike in the number of attacks, what stands out in this campaign is that the actor mistyped the extension for the ransom note and used the “.TXTT” extension.
https://www.bleepstatic.com/images/news/u/1100723/2021/eCh0raixNote.jpg
See Also: Hackers start pushing malware in worldwide Log4Shell attacks While this does not prevent viewing the instructions, it may create a problem for some users, who will have to point the operating system to open the file with a specific program (e.g. Notepad) or load it in said program.

BleepingComputer has seen ech0raix ransomware demands ranging from .024 ($1,200) to .06 bitcoins ($3,000) during these recent attacks.. Some users had no backup options and had to pay the threat actor to recover their files.

https://www.bleepstatic.com/images/news/u/1100723/2021/eCh0raixPaymentPage.jpg
It is important to note that there is a free decryptor for files locked with an older version (before July 17th, 2019) of eCh0raix ransomware. However, there is no free solution to decrypt data locked by the latest variants of the malware (versions 1.0.5 and 1.0.6).
See Also: Offensive Security Tool: log4j Honeypot Flask Attacks with eCh0raix/QNAPCrypt started in June 2019 and have been a constant threat ever since. QNAP earlier this year alerted its users of another flurry of eCh0raix attacks earlier this year, targeting devices with weak passwords.

Users should follow QNAP’s recommendations to ensure proper protection of their NAS devices and the data they store.
See Also: Hacking stories – Rafael Núñez (aka RaFa), hacking NASA [...]

with the hacking group: World of Hell
Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/shutterstock_495927541-90x90.jpg Wireless coexistence – New attack technique exploits Bluetooth, WiFi performance features1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/apple-store-tower-90x90.jpg Apple fixes macOS security flaw behind Gatekeeper bypass4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/5157-article-201208-ms-team_body_text-90x90.jpg Microsoft Teams bug allowing phishing unpatched since March5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-6-90x90.jpg 800K WordPress sites still impacted by critical SEO plugin flaw6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-5-90x90.jpg Microsoft warns of easy Windows domain takeover via Active Directory bugs1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-4-90x90.jpg TellYouThePass ransomware revived in Linux, Windows Log4j attacks1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-3-1-90x90.jpg Log4j attackers switch to injecting Monero miners via RMI2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/Hackers-Using-Malicious-IIS-Server-Module-to-Steal-Microsoft-Exchange-560x380-1-90x90.jpg Hackers steal Microsoft Exchange credentials using IIS module2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/how-ransomware-works-1024x535-1-90x90.png New ransomware now being deployed in Log4Shell attacks2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/0d73-article-201111-ubuntu-90x90.jpg Attackers can get root by crashing Ubuntu’s AccountsService2 weeks ago
The post QNAP NAS devices hit in surge of ech0raix ransomware attacks first appeared on Black Hat Ethical Hacking.

hacking: security in practice
What's the best way to vnc connect without password?

What's the best way to vnc connect without password? Edit: the other pc has port 5900 open for vnc service

submitted by /u/napraticaautomacao
[link] [comments]

hacking: security in practice
How was this done

i bought a gaming pc andI let the seller set it up without a password to save me time if i purchased. After all drivers checked out fine /virus free etc, I bought it and got round to putting a password on, but when I instantly logged out and in after it’s now not accepting the password.

How and why would a hacker /scammer do this

submitted by /u/Tcat03
[link] [comments]