Hacking on Medium
THE STELLAR ONE

When the universe was young the sky was filled with planets, and stars, and stardust, and many many rocks.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacked a Windows Machine

https://cdn-images-1.medium.com/max/797/1*61Msp_EWh1YgxMxMYjcdzA.png
In this article, I have hacked into the Windows Virtual
Machine using Kali Linux.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
CTF Write-Up: Kryptonite

https://cdn-images-1.medium.com/max/600/1*u55rgUXRGzcJdo62ZUze3Q.png
CTF challenge available at ctf-mystiko.com.

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Bounty hunter HackTheBox Walkthrough

Bounty hunter is a CTF Linux machine with an Easy difficulty rating on the Hack the Box platform. So let's get started and take a deep dive into disassembling this machine utilizing the methods outlined below. Pentesting Methodology● nmapExploitation● burp suitePrivilege Escalation● sshLevel: EasyTo begin, we'll perform nmap scan to look for open ports. As can be seen, two ports are open:22.80 is used to run the http service.nmap -sC -sV 10.129.95.166portal."vulnerable. ___________________________
@hacking_Attack
@Hacking_Video

db.php file, nothing intruding was discovered.dirb http://10.129.95.166 -X .phpIt signifies that there is a database file available in which all of the data will be stored.ExploitationWe will now begin our exploitation procedure with the burp suite. Try to capture its data by submitting a request for a more in-depth investigation. As a result, we used similar strategies on the beta version of the Bounty Report submission page.dbserver = "localhost"https://blogger.googleusercontent.com/img/a/AVvXsEjInj-7vYOrJo1AqARhb4NB2EjGu-RT4Mno6bkmTSo1YhHe-CReG5sbFI9tmWTxzWFmcy1Pv01pSHzY1KLunoXzeBVoXePHxAyYndd1bWur52vFbE9EL0AFq72QpRcZ2MhgiDiME9eDhSCtC7oBxQ_NtNeeXfoPEbiibjkDkc0-SdYNZ23awnus3YOB8g=s16000 /etc/passwdfile using this mechanism must obtain its encoded value in order to request this file from the target machine.development.___________________________
@hacking_Attack
@Hacking_Video

iCy-m23hkwDzGn8KmsPU9zgSho232Y3BPBpK7zNv-1nAT8A-Pss2IvEDLVGCs_duYdztfx9glQwc6Ox0abCbpT76k4SKfBWs1xaCahWFK84bWDXg9hbg=s16000 Privilege EscalationWe have credentials, and we know that ssh is operating on port 22. Now is the optimal moment to begin the privilege escalation process using an ssh login with the password which we got earlier.ssh development@10.129.95.166We successfully logged into the development and immediately we checked its id to verify its details. Searching for a little bit we found the user flag.cat user.txthttps://blogger.googleusercontent.com/img/a/AVvXsEi12-lTXyxuz4WFFLIhTt9ZPfyyzDQLT7BjxotbJWcwMckNLR8heq7wSAKK4p5kiZLrzsGvqdE9xQUI3dvEjAre9NNDf0DtcRNgo6dswePFu_2hnngGLlo9W2TgIUGnHK2TfeGxhGeJIvoiSNN-0Mn2G5mI9vz1-eUFbauEmohKC7lylYQrlwxQ9hllaQ=s16000 sudo -lSo, we reviewed this file to analyse it, and we got some points, but nothing exciting came out of it.file.md).cat file.mdfile.md).sudo /usr/bin/python3.8 /opt/skytrain_inc/ticketValidator.pyYippee!! We found the root. We immediately went to the root directory and received our well-deserved root flag.Author: Shubham Sharma is a passionate Cybersecurity Researcher, contact LinkedInand Twitter.___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Log4j 2.17.1 out now, fixes new remote code execution bug

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Log4j 2.17.1 out now, fixes new remote code execution bugPost Views: 200 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute
Apache has released another Log4j version, 2.17.1 fixing a newly discovered remote code execution (RCE) vulnerability in 2.17.0, tracked as CVE-2021-44832.
Prior to today, 2.17.0 was the most recent version of Log4j and deemed the safest release to upgrade to, but that advice has now evolved. Fifth Log4j CVE in under a monthMass exploitation of the original Log4Shell vulnerability (CVE-2021-44228) by threat actors began around December 9th, when a PoC exploit for it surfaced on GitHub.

Given Log4j’s vast usage in the majority of Java applications, Log4Shell soon turned into a nightmare for enterprises and governments worldwide.

While the critical risk posed by the original Log4Shell exploit is paramount, milder variants of the vulnerability emerged in Log4j versions, including 2.15 and 2.16—previously believed to be fully patched.

BleepingComputer earlier reported on four different CVEs impacting Log4j and one discovered in the ‘logback’ framework. After the discovery of a DoS flaw in version 2.16, the advice had swiftly shifted towards upgrading to version 2.17.0, deemed the safest of all.

But now a fifth vulnerability—an RCE flaw, tracked as CVE-2021-44832 has been discovered in 2.17.0, with a patch applied to the newest release 2.17.1 which is out.

Rated ‘Moderate’ in severity and assigned a 6.6 score on the CVSS scale, the vulnerability stems from the lack of additional controls on JDNI access in log4j.

“JDBC Appender should use JndiManager when accessing JNDI. JNDI access should be controlled via a system property,” states the issue description seen by BleepingComputer.
See Also: Complete Offensive Security and Ethical Hacking Course
“Related to CVE-2021-44832 where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code.”

Checkmarx security researcher Yaniv Nizry claimed credit for reporting the vulnerability to Apache:
Stay tuned for a blogpost 😉 pic.twitter.com/D56WpVsuF3

— Yaniv Nizry (@YNizry) December 28, 2021
Nizry’s tweet quickly exploded in traffic, attracting remarks and memes from security experts and ‘victims’ of the ongoing log4j-patching fatigue.

“I hope this is a joke, I hope so much… #log4j,” tweeted one user in response.

“We are LONG past the point where the only responsible thing to do is put up a giant flashing neon sign that reads ‘LOG4J CANNOT BE FIXED, DO NOT USE IT FOR ANYTHING.'” taunted another.

Security expert Kevin Beaumont labeled the instance another “failed Log4j disclosure in motion” during the holidays.
See Also: Hackers start pushing malware in worldwide Log4Shell attacks Disclosed too soon?At the time of Nizry’s tweet, BleepingComputer did not see an official advisory or memo indicating the presence of an RCE bug in log4j 2.17.

The tweet itself contained no details about the vulnerability or how it could be exploited but, within minutes, led a pack of security pros and netizens to start investigating the claim.

Disclosing security vulnerabilities prematurely can lure threat actors to conduct malicious scanning and exploitation activities, as evident from the Log4Shell exploit leak of December 9th.


Marc Rogers, VP of cybersecurity at Okta first disclosed the vul[...]

___________________________
@hacking_Attack
@Hacking_Video

nerability identifier (CVE-2021-44832) and that the exploitation of the bug depends on a non-default log4j setup where configuration is being loaded from a remote server: Looks like log4j CVE-2021-44832 has non default preconditions: “You are loading configuration from a remote server and/or someone can hijack/modify your log4j configuration file
You are using the JDBC log appender with a dynamic URL address.”

— Marc Rogers (@marcwrogers) December 28, 2021
See Also: Offensive Security Tool: log4j Honeypot Flask Up until now, log4j vulnerabilities have been exploited by all kinds of threat actors from state-backed hackers to ransomware gangs and others to inject Monero miners on vulnerable systems.

The Conti ransomware gang has been seen  eying vulnerable VMWare vCenter servers. Whereas attackers breaching the Vietnamese crypto platform, ONUS, via log4shell demanded a $5 million ransom.

Log4j users should immediately upgrade to the latest release 2.17.1 (for Java 8). Backported versions 2.12.4 (Java 7) and 2.3.2 (Java 6) containing the fix are also expected to be released shortly.

BleepingComputer has reached out to Checkmarx for comment in advance of writing and we are awaiting their response.
See Also: Hacking stories – Rafael Núñez (aka RaFa), hacking NASA with the hacking group: World of Hell
Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/qnap-logo-white-90x90.jpg QNAP NAS devices hit in surge of ech0raix ransomware attacks1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/shutterstock_495927541-90x90.jpg Wireless coexistence – New attack technique exploits Bluetooth, WiFi performance features2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/apple-store-tower-90x90.jpg Apple fixes macOS security flaw behind Gatekeeper bypass5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/5157-article-201208-ms-team_body_text-90x90.jpg Microsoft Teams bug allowing phishing unpatched since March6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-6-90x90.jpg 800K WordPress sites still impacted by critical SEO plugin flaw1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-5-90x90.jpg Microsoft warns of easy Windows domain takeover via Active Directory bugs1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-4-90x90.jpg TellYouThePass ransomware revived in Linux, Windows Log4j attacks1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-3-1-90x90.jpg Log4j attackers switch to injecting Monero miners via RMI2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/Hackers-Using-Malicious-IIS-Server-Module-to-Steal-Microsoft-Exchange-560x380-1-90x90.jpg Hackers steal Microsoft Exchange credentials using IIS module2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/how-ransomware-works-1024x535-1-90x90.png New ransomware now being deployed in Log4Shell attacks2 weeks ago
The post Log4j 2.17.1 out now, fixes new remote code execution bug first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it safe to use your home vpn in a untrusted wifi (public)?

I assume hackers could get my vpn ip (home router ip) and exploit things? My setup is: all ports closed except vpn, torrent (not webui, just sharing port).

submitted by /u/herkom
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
BountyHunter HackTheBox Walkthrough

Bounty hunter is a CTF Linux machine with an Easy difficulty rating on the Hack the Box platform. So let’s get started and take a

The post BountyHunter HackTheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty Tool List

Bug Bounty Tool List Which are useful for Hunting
Read more...

Dark Reading: Attacks/Breaches
7 Steps for Navigating a Zero-Trust Journey

Don't think of zero trust as a product. Think of it as "how you actually practice security."

Dark Reading: Attacks/Breaches
Why Cyber Due Diligence Is Essential to the M&A Process

That announcement may feel good, but if your prospective acquisition's cybersecurity levels are substandard, it might be best to hold off.

Kali Linux Tutorials
Gotanda : Browser Web Extension For OSINT

Gotanda is OSINT(Open Source Intelligence) Web Extension for Firefox/Chrome.

This Web Extension could search OSINT information from some IOC in web page.(IP,Domain,URL,SNS…etc)

This Repository partly the studying and JavaScript practice.

Download link below.

* FireFox
* Chrome

Usage

Right click highlighted IOC strings, It will show contextmenus.(Or right clicking any link. )

When You want to search using some engine, You choose one of list.

Search Engine List
NameURLCategoryDomain Toolshttps://whois.domaintools.com/whois LookupSecurity Trailshttps://securitytrails.com/whois lookupwhoisdshttps://whoisds.com/whois lookupThreatCrowdhttps://www.threatcrowd.org/Domain, IPv4AbuseIPDBhttps://www.abuseipdb.com/IPv4HackerTargethttps://hackertarget.com/IPv4Censyshttps://censys.io/IP, DomainShodanhttps://shodan.io/IP, DomainFOFAhttps://fofa.so/IP, DomainVirusTotalhttps://virustotal.com/IP, Domain, URL,HashGreyNoisehttps://viz.greynoise.io/IPv4IPAlyzerhttps://ipalyzer.com/IPv4Tor Relay Searchhttps://metrics.torproject.org/IP,DomainDomain Watchhttps://domainwat.ch/Domain, Email,whois lookupcrt.shhttps://crt.sh/SSL-certificateSecurityHeadershttps://securityheaders.com/URL, DomainDNSlyticshttps://dnslytics.com/IPv4,IPv6,ASNURLscanhttps://urlscan.io/URLUltratoolshttps://www.ultratools.com/IPv6Wayback Machinehttps://web.archive.orgURLagusehttps://www.aguse.jp/URLcheck-hosthttps://check-host.net/URLCIRCLhttps://cve.circl.lu/CVEFortiGuardhttps://fortiguard.com/CVESploitushttps://sploitus.com/CVEVulmonhttps://vulmon.com/CVECXSecurityhttps://cxsecurity.com/CVEVulncode-DBhttps://www.vulncode-db.com/CVEMalsharehttps://malshare.com/MD5 HashThreatCrowdhttps://www.threatcrowd.org/IP,DomainHybrid Analysishttps://www.hybrid-analysis.com/hashTwitterhttps://twitter.com/SNS, w/TimeLineQiitahttps://qiita.comSNSGitHubhttps://github.comSNSFacebookhttps://www.facebook.com/SNS, w/TimeLineInstagramhttps://www.instagram.com/SNSLinkedInhttps://linkedin.com/SNSPinteresthttps://www.pinterest.jpSNSreddithttps://www.reddit.com/SNS
About Twitter and FaceBook could search timeline with any words.
Download

___________________________
@hacking_Attack
@Hacking_Video