Hacking Articles|Raj Chandel's Blog
Bounty hunter HackTheBox Walkthrough

Bounty hunter is a CTF Linux machine with an Easy difficulty rating on the Hack the Box platform. So let's get started and take a deep dive into disassembling this machine utilizing the methods outlined below. Pentesting Methodology● nmapExploitation● burp suitePrivilege Escalation● sshLevel: EasyTo begin, we'll perform nmap scan to look for open ports. As can be seen, two ports are open:22.80 is used to run the http service.nmap -sC -sV 10.129.95.166portal."vulnerable. ___________________________
@hacking_Attack
@Hacking_Video

db.php file, nothing intruding was discovered.dirb http://10.129.95.166 -X .phpIt signifies that there is a database file available in which all of the data will be stored.ExploitationWe will now begin our exploitation procedure with the burp suite. Try to capture its data by submitting a request for a more in-depth investigation. As a result, we used similar strategies on the beta version of the Bounty Report submission page.dbserver = "localhost"https://blogger.googleusercontent.com/img/a/AVvXsEjInj-7vYOrJo1AqARhb4NB2EjGu-RT4Mno6bkmTSo1YhHe-CReG5sbFI9tmWTxzWFmcy1Pv01pSHzY1KLunoXzeBVoXePHxAyYndd1bWur52vFbE9EL0AFq72QpRcZ2MhgiDiME9eDhSCtC7oBxQ_NtNeeXfoPEbiibjkDkc0-SdYNZ23awnus3YOB8g=s16000 /etc/passwdfile using this mechanism must obtain its encoded value in order to request this file from the target machine.development.___________________________
@hacking_Attack
@Hacking_Video

iCy-m23hkwDzGn8KmsPU9zgSho232Y3BPBpK7zNv-1nAT8A-Pss2IvEDLVGCs_duYdztfx9glQwc6Ox0abCbpT76k4SKfBWs1xaCahWFK84bWDXg9hbg=s16000 Privilege EscalationWe have credentials, and we know that ssh is operating on port 22. Now is the optimal moment to begin the privilege escalation process using an ssh login with the password which we got earlier.ssh development@10.129.95.166We successfully logged into the development and immediately we checked its id to verify its details. Searching for a little bit we found the user flag.cat user.txthttps://blogger.googleusercontent.com/img/a/AVvXsEi12-lTXyxuz4WFFLIhTt9ZPfyyzDQLT7BjxotbJWcwMckNLR8heq7wSAKK4p5kiZLrzsGvqdE9xQUI3dvEjAre9NNDf0DtcRNgo6dswePFu_2hnngGLlo9W2TgIUGnHK2TfeGxhGeJIvoiSNN-0Mn2G5mI9vz1-eUFbauEmohKC7lylYQrlwxQ9hllaQ=s16000 sudo -lSo, we reviewed this file to analyse it, and we got some points, but nothing exciting came out of it.file.md).cat file.mdfile.md).sudo /usr/bin/python3.8 /opt/skytrain_inc/ticketValidator.pyYippee!! We found the root. We immediately went to the root directory and received our well-deserved root flag.Author: Shubham Sharma is a passionate Cybersecurity Researcher, contact LinkedInand Twitter.___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Log4j 2.17.1 out now, fixes new remote code execution bug

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Log4j 2.17.1 out now, fixes new remote code execution bugPost Views: 200 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute
Apache has released another Log4j version, 2.17.1 fixing a newly discovered remote code execution (RCE) vulnerability in 2.17.0, tracked as CVE-2021-44832.
Prior to today, 2.17.0 was the most recent version of Log4j and deemed the safest release to upgrade to, but that advice has now evolved. Fifth Log4j CVE in under a monthMass exploitation of the original Log4Shell vulnerability (CVE-2021-44228) by threat actors began around December 9th, when a PoC exploit for it surfaced on GitHub.

Given Log4j’s vast usage in the majority of Java applications, Log4Shell soon turned into a nightmare for enterprises and governments worldwide.

While the critical risk posed by the original Log4Shell exploit is paramount, milder variants of the vulnerability emerged in Log4j versions, including 2.15 and 2.16—previously believed to be fully patched.

BleepingComputer earlier reported on four different CVEs impacting Log4j and one discovered in the ‘logback’ framework. After the discovery of a DoS flaw in version 2.16, the advice had swiftly shifted towards upgrading to version 2.17.0, deemed the safest of all.

But now a fifth vulnerability—an RCE flaw, tracked as CVE-2021-44832 has been discovered in 2.17.0, with a patch applied to the newest release 2.17.1 which is out.

Rated ‘Moderate’ in severity and assigned a 6.6 score on the CVSS scale, the vulnerability stems from the lack of additional controls on JDNI access in log4j.

“JDBC Appender should use JndiManager when accessing JNDI. JNDI access should be controlled via a system property,” states the issue description seen by BleepingComputer.
See Also: Complete Offensive Security and Ethical Hacking Course
“Related to CVE-2021-44832 where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code.”

Checkmarx security researcher Yaniv Nizry claimed credit for reporting the vulnerability to Apache:
Stay tuned for a blogpost 😉 pic.twitter.com/D56WpVsuF3

— Yaniv Nizry (@YNizry) December 28, 2021
Nizry’s tweet quickly exploded in traffic, attracting remarks and memes from security experts and ‘victims’ of the ongoing log4j-patching fatigue.

“I hope this is a joke, I hope so much… #log4j,” tweeted one user in response.

“We are LONG past the point where the only responsible thing to do is put up a giant flashing neon sign that reads ‘LOG4J CANNOT BE FIXED, DO NOT USE IT FOR ANYTHING.'” taunted another.

Security expert Kevin Beaumont labeled the instance another “failed Log4j disclosure in motion” during the holidays.
See Also: Hackers start pushing malware in worldwide Log4Shell attacks Disclosed too soon?At the time of Nizry’s tweet, BleepingComputer did not see an official advisory or memo indicating the presence of an RCE bug in log4j 2.17.

The tweet itself contained no details about the vulnerability or how it could be exploited but, within minutes, led a pack of security pros and netizens to start investigating the claim.

Disclosing security vulnerabilities prematurely can lure threat actors to conduct malicious scanning and exploitation activities, as evident from the Log4Shell exploit leak of December 9th.


Marc Rogers, VP of cybersecurity at Okta first disclosed the vul[...]

___________________________
@hacking_Attack
@Hacking_Video

nerability identifier (CVE-2021-44832) and that the exploitation of the bug depends on a non-default log4j setup where configuration is being loaded from a remote server: Looks like log4j CVE-2021-44832 has non default preconditions: “You are loading configuration from a remote server and/or someone can hijack/modify your log4j configuration file
You are using the JDBC log appender with a dynamic URL address.”

— Marc Rogers (@marcwrogers) December 28, 2021
See Also: Offensive Security Tool: log4j Honeypot Flask Up until now, log4j vulnerabilities have been exploited by all kinds of threat actors from state-backed hackers to ransomware gangs and others to inject Monero miners on vulnerable systems.

The Conti ransomware gang has been seen  eying vulnerable VMWare vCenter servers. Whereas attackers breaching the Vietnamese crypto platform, ONUS, via log4shell demanded a $5 million ransom.

Log4j users should immediately upgrade to the latest release 2.17.1 (for Java 8). Backported versions 2.12.4 (Java 7) and 2.3.2 (Java 6) containing the fix are also expected to be released shortly.

BleepingComputer has reached out to Checkmarx for comment in advance of writing and we are awaiting their response.
See Also: Hacking stories – Rafael Núñez (aka RaFa), hacking NASA with the hacking group: World of Hell
Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/qnap-logo-white-90x90.jpg QNAP NAS devices hit in surge of ech0raix ransomware attacks1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/shutterstock_495927541-90x90.jpg Wireless coexistence – New attack technique exploits Bluetooth, WiFi performance features2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/apple-store-tower-90x90.jpg Apple fixes macOS security flaw behind Gatekeeper bypass5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/5157-article-201208-ms-team_body_text-90x90.jpg Microsoft Teams bug allowing phishing unpatched since March6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-6-90x90.jpg 800K WordPress sites still impacted by critical SEO plugin flaw1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-5-90x90.jpg Microsoft warns of easy Windows domain takeover via Active Directory bugs1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-4-90x90.jpg TellYouThePass ransomware revived in Linux, Windows Log4j attacks1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-3-1-90x90.jpg Log4j attackers switch to injecting Monero miners via RMI2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/Hackers-Using-Malicious-IIS-Server-Module-to-Steal-Microsoft-Exchange-560x380-1-90x90.jpg Hackers steal Microsoft Exchange credentials using IIS module2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/how-ransomware-works-1024x535-1-90x90.png New ransomware now being deployed in Log4Shell attacks2 weeks ago
The post Log4j 2.17.1 out now, fixes new remote code execution bug first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it safe to use your home vpn in a untrusted wifi (public)?

I assume hackers could get my vpn ip (home router ip) and exploit things? My setup is: all ports closed except vpn, torrent (not webui, just sharing port).

submitted by /u/herkom
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
BountyHunter HackTheBox Walkthrough

Bounty hunter is a CTF Linux machine with an Easy difficulty rating on the Hack the Box platform. So let’s get started and take a

The post BountyHunter HackTheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty Tool List

Bug Bounty Tool List Which are useful for Hunting
Read more...

Dark Reading: Attacks/Breaches
7 Steps for Navigating a Zero-Trust Journey

Don't think of zero trust as a product. Think of it as "how you actually practice security."

Dark Reading: Attacks/Breaches
Why Cyber Due Diligence Is Essential to the M&A Process

That announcement may feel good, but if your prospective acquisition's cybersecurity levels are substandard, it might be best to hold off.

Kali Linux Tutorials
Gotanda : Browser Web Extension For OSINT

Gotanda is OSINT(Open Source Intelligence) Web Extension for Firefox/Chrome.

This Web Extension could search OSINT information from some IOC in web page.(IP,Domain,URL,SNS…etc)

This Repository partly the studying and JavaScript practice.

Download link below.

* FireFox
* Chrome

Usage

Right click highlighted IOC strings, It will show contextmenus.(Or right clicking any link. )

When You want to search using some engine, You choose one of list.

Search Engine List
NameURLCategoryDomain Toolshttps://whois.domaintools.com/whois LookupSecurity Trailshttps://securitytrails.com/whois lookupwhoisdshttps://whoisds.com/whois lookupThreatCrowdhttps://www.threatcrowd.org/Domain, IPv4AbuseIPDBhttps://www.abuseipdb.com/IPv4HackerTargethttps://hackertarget.com/IPv4Censyshttps://censys.io/IP, DomainShodanhttps://shodan.io/IP, DomainFOFAhttps://fofa.so/IP, DomainVirusTotalhttps://virustotal.com/IP, Domain, URL,HashGreyNoisehttps://viz.greynoise.io/IPv4IPAlyzerhttps://ipalyzer.com/IPv4Tor Relay Searchhttps://metrics.torproject.org/IP,DomainDomain Watchhttps://domainwat.ch/Domain, Email,whois lookupcrt.shhttps://crt.sh/SSL-certificateSecurityHeadershttps://securityheaders.com/URL, DomainDNSlyticshttps://dnslytics.com/IPv4,IPv6,ASNURLscanhttps://urlscan.io/URLUltratoolshttps://www.ultratools.com/IPv6Wayback Machinehttps://web.archive.orgURLagusehttps://www.aguse.jp/URLcheck-hosthttps://check-host.net/URLCIRCLhttps://cve.circl.lu/CVEFortiGuardhttps://fortiguard.com/CVESploitushttps://sploitus.com/CVEVulmonhttps://vulmon.com/CVECXSecurityhttps://cxsecurity.com/CVEVulncode-DBhttps://www.vulncode-db.com/CVEMalsharehttps://malshare.com/MD5 HashThreatCrowdhttps://www.threatcrowd.org/IP,DomainHybrid Analysishttps://www.hybrid-analysis.com/hashTwitterhttps://twitter.com/SNS, w/TimeLineQiitahttps://qiita.comSNSGitHubhttps://github.comSNSFacebookhttps://www.facebook.com/SNS, w/TimeLineInstagramhttps://www.instagram.com/SNSLinkedInhttps://linkedin.com/SNSPinteresthttps://www.pinterest.jpSNSreddithttps://www.reddit.com/SNS
About Twitter and FaceBook could search timeline with any words.
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
JVMXRay : Make Java Security Events Of Interest Visible For Analysis

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Hyenae Ng : An Advanced Cross-Platform Network Packet Generator And The Successor Of Hyenae

Hyenae Ng (Next Generation) is a re-write of the original Hyenae tool which was originally published back in the year 2010.

Besides switching from C to C++, using modern design concepts, Hyenae NG was (just like the original Hyenae) written with maximum portability in mind. Since the original Hyenae had a very complex command line syntax Hyenae NG comes with a fast and intuitively usable command line menu that will allow you to effectively set up even complex stress-tests or attack scenarios within seconds.

Features

* Fully customizable and combinable data generators:
* Ethernet-Layer
* ARP-Layer
* IPv4-Layer
* IPv6-Layer
* ICMPv4-Layer
* ICMPv6-Layer
* TCP-Layer
* UDP-Layer
* Text-Buffer

* Fixed or Random Send Delay
* Pattern based address randomization
* Clean and easy to use command line menu (No RTFM’ing required;))
* Platform Independent Coverage

* ARP-Request flooding (DoS)
* ARP-Cache poisoning (MITM)
* ICMP-Echo flooding (DoS)
* ICMP-Smurf attack (DoS)
* TCP-SYN flooding (DoS)
* TCP-Land attack (DoS)
* Blind TCP-Connection reset (DoS)
* UDP flooding (DoS)
* and many more… Project Goals

The original Hyenae project started out as a study of network stack implementations but then quickly gained more complex features such as a remote daemon and an attack asistent. Even if it was widely accepted and is still a very commonly used tool in todays pen-testing workflows it has a complex command line syntax and requires some training and research in order to be used properly.

With Hyenae NG i would like to provide the complexity and felxibility of Hyenae in a clean and easy to use command line tool which can be instantly used without any futher research on the command line arguments to pass for the specific scenarios.

Basic Usage

Once you start Hyenae NG, it will enter the main menu state. From here you can set up your desired output, generator and dispatcher configuration.

* Output Setup
The output setup let you choose from several different output option. You can either have Hyenae NG’s output ignore by selecting “No Output” our you can have it send to either a file or a network adapter. Once you have selected an output, you can enter it’s sub setup by selecting it again by either entering it’s menu item number again or by simply pressing enter. Outputs that have a sub-setup are marked with a (…) once they are selected.
* Generator Setup
The generator setup let you chose from several different generators. Most generators provide a payload option for which you can select another generator and so on. Since network frame generators are nested in transport layers, their available payload generators will differ based on the previously chosen frame generator. Here is an example of a typical payload nesting for an ethernet packet:

Ethernet +-> ARP
|
+-> IPv4 +-> ICMPv4 -> ICMP Echo Payload
| +-> TCP
| +-> UDP
| +-> …
|
+-> IPv6 +-> ICMPv4 -> ICMP Echo Payload
+-> ICMPv6 -> ICMP Echo Payload
+-> TCP
+-> UPD
+-> …

* Dispatcher Setup
The dispatcher setup will let you set up the actual data dispatcher. You can define stop-limits or configure a fixed or random send delay in order to break flood detection mechanisms on your target system.IMPORTANT
It is reccomended to use a fixed send delay of at least 100 ms on low spec systems such as the GPD Pocket 2 in order to prevent key-press detection issues.
* Start Dispatcher
Once you have set a generator, you can choose this option to start up the dispatcher and start sending packets. If you haven’t set a generator yet, an error message will be shown instead. The dispatcher will operate until either a stop-limit (if set) is reached or the user presses any key. After the dispatcher has stopped you can either return to the main menu by ent[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
What is Crypto Margin Trading & How it Works?

There are different ways to catch a fish; similarly, there are numerous ways to trade cryptocurrency. You’ve probably heard of Crypto margin trading, shorting Bitcoin, or crypto trading with leverage. Although all these terms refer to the practice of leverage trading- they are used interchangeably, making it difficult to understand how it works.

In simple terms, crypto margin trade allows traders to borrow capital from other traders to access positions far greater than what they have in their account and increase buying power. Unlike regular trading, where traders invest their capital to fund trading transactions, crypto margin trading allows investors to multiply the funds they wish to trade.

Crypto trading with margin doesn’t have to be complicated. Due to its high volatility nature, the price fluctuation eminent in the crypto markets enables crypto traders to profit from both bull and bear markets through margin trading. This post explains in detail how to bitcoin margin trading work and what it is.
https://lh3.googleusercontent.com/-wcaVvapdRvk/YcxeFHmNLgI/AAAAAAAAADU/YZSVH6dGM3MnfpAC23b9G0sul5rrRIWAgCNcBGAsYHQ/s16000/image.png What Is Crypto Margin Trading?Trying to understand the complex world of crypto trading with leverage can be quite overwhelming, especially to newbie traders. If you have been interested in crypto margin trading, you have probably come across a glossary of terms including margin calls, shorting, bull and bear markets, liquidation price, and leverage- which may have left you wondering if the niche is worth your effort.

Fortunately, the basics of margin trading are upfront and quite rewarding. Investors can gain far greater exposure to a crypto asset through crypto margin trading by borrowing capital from a lender on a dedicated exchange platform such as PrimeXBT.

Margin trading is also known as leverage trading, where the term leverage denotes the amount by which an investor can multiply their position. For instance, a bitcoin margin trader that trades with 100X leverage can multiply their potential profit as well as 4exposure by 100 times. Although the idea of multiplying profits by 100X sounds lucrative to any trader, a major downside to such an investment is that using leverage to amplify your position when trading results in a higher risk.

Luckily, when margin trading, the increase in risk is not proportional to leverage. This, even if you trade with, say, 100X leverage, your losses won’t be multiplied by 100X. It is often rare to lose more than what you originally committed to the trade. However, there are specific scenarios where losses can exceed the committed assets in a trade.

Nevertheless, margin trading, which has for the longest time been dominant in low-volatile and slow-moving markets such as Forex, currently enjoys its share of popularity in the highly volatile, fast-paced crypto market due to the presence of reliable exchange platforms such as PrimeXBT. How Does Crypto Margin Trading Work? Crypto margin trading is quite simple at a fundamental level. The investor invests a little capital in return for higher capital and risks all of it in hopes of making huge profits. Before you can margin trade, you are required to provide an initial deposit which is referred to as the initial margin. The initial margin allows you to open a position, and the trader must have a specified amount of capital to keep the position. This capital is known as the maintenance margin.

Depending on your specific crypto exchange, you may be offered limit leverage of up to 200Xwhich means that you can open a position that is 200 times the value of your deposit.

Moreover, the total cost of the margin position includes the interest for the borrowed funds and feed for opening the position within the ex[...]

___________________________
@hacking_Attack
@Hacking_Video

ering 0 or start it again by either entering 1 or simply pressing enter. Generator Patterns

A lot of packet generator parameters such as for address-, port- and number- fields can be providing with a generator pattern. These patterns will be used in order to generate a new value on every new packet. Here are some examples of a few basic patterns:

* Random 5-digit number: ****** Incremental 3-digit number: +++* Decremental 2-digit number: --* Random number between 100and 190: 1*0* Incremental number from 1to 991: ++1* Decremental number from 299to 200: 2--* Random IPv4 address between .200and .255: 129.168.0.2*** Incremental MAC address between :00and :FF: AA:BB:CC:DD:EE:++* Decremental IPv6 address between :FFFFand :FF00: 1000:2000:3000:4000:5000:6000:7000:FF--Configuration File

When Hyenae NG is started it will look for a configuration file named “hyenae.conf” in it’s startup folder. If the file does not exist it will automatically create it.

IMPORTANT
If the configuration file can not be parsed, Hyenae NG will give out an error message, requesting you to either fix or delete the configuration file.

* Frontend Section
* terminal_colors
If set to “on” (default), Hyenae will use ANSI terminal colors in order to enhance it’s user interface. If for some reasons the terminal you are using does not support ANSI colors, you should set this to “off”.
* line_chars
If set to “on” (default) hyenae will use special line characters for it’s menu separators (In ASCII on Windows and UniCode on *nix based systems). If you are encountering any strange separator outputs, you should set this to “off”. Download

___________________________
@hacking_Attack
@Hacking_Video