Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How Do Hackers Actually Hack?
https://cdn-images-1.medium.com/max/2600/1*3S4XtPaa_fq4rWa9bF3mSQ.jpeg
Hacking is unauthorized access to or control of a computer network security system for some illegal purpose. Hacking requires a complete…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
How Do Hackers Actually Hack?
https://cdn-images-1.medium.com/max/2600/1*3S4XtPaa_fq4rWa9bF3mSQ.jpeg
Hacking is unauthorized access to or control of a computer network security system for some illegal purpose. Hacking requires a complete…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
How Do Hackers Actually Hack?
Hacking is unauthorized access to or control of a computer network security system for some illegal purpose. Hacking requires a complete…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
What is Burpsuit and its uses?
In this post I gonna tell about burpsuit which play important role
In hacking ecpacially in bug hunting.you must have knowledge about this…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
What is Burpsuit and its uses?
In this post I gonna tell about burpsuit which play important role
In hacking ecpacially in bug hunting.you must have knowledge about this…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
What is Burpsuit and its uses?
In this post I gonna tell about burpsuit which play important role In hacking ecpacially in bug hunting.you must have knowledge about this…
hacking: security in practice
URGENT: What's the best mac app to find & delete “maalware which uses a low-level device driver build-in CPU and updates its signatures every 4 hours to keep antivirus silent”?
I received this email recently and would like to find/confirm if any malware is in my macOS System::
"Hello!
I'm the Chinese software engineer who hacked into your device OS.
I've been watching you for month now. The thing is, you've been infected with malware through the adult website you visited... I have downloaded all confidential information from your system and I got some more evidence.
In case you're not familiar with it, I'll explain.
The virus gives me full access and control over your computer or any other device on your network. It means that I can see everything on your screen, turn on your camera and microphone, but you don't know about it. I also have access to all of your phone and email contacts, as well as access to your social media accounts.
Why didn't your antivirus detect any malware?
Answer: My malware uses a low-level device driver build-in your CPU and I update its signatures every 4 hours to keep your antivirus silent. I made a screen recording of you masturbating.
On one side of the screen is the video you're watching at the moment and on the other side is your satisfied face. With one click, I can send this video to all your contacts.
Do you want to prevent it?
I understand your concern. Especially since the video was quite vulgar, I can't imagine the embarrassment you will feel when your colleagues, friends and relatives see it.
If you need to erase all of your collected data just send 0.015 btc (Bitcoin) to a wallet that was specially generated for your email address.
Yes, it's that simple! My script will detect the transaction to the wallet and will automatically delete all the dirt that was collected on you.
I will give you 48 hours to pay.
Do not try to reply to this email, it makes absolutely no sense (the sender's email address as well as the Bitcoin wallet were generated automatically especially for you and cannot be traced). I don't make mistakes.
If I see that you've shared this message with someone else (for example, it will be open on a different device than yours), the video will instantly start being sent out to your contact list.
Take it easy. Take it as a little life lesson and be more careful in the future.
Do not start 2022 with such shame."
submitted by /u/LisaMck041
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
URGENT: What's the best mac app to find & delete “maalware which uses a low-level device driver build-in CPU and updates its signatures every 4 hours to keep antivirus silent”?
I received this email recently and would like to find/confirm if any malware is in my macOS System::
"Hello!
I'm the Chinese software engineer who hacked into your device OS.
I've been watching you for month now. The thing is, you've been infected with malware through the adult website you visited... I have downloaded all confidential information from your system and I got some more evidence.
In case you're not familiar with it, I'll explain.
The virus gives me full access and control over your computer or any other device on your network. It means that I can see everything on your screen, turn on your camera and microphone, but you don't know about it. I also have access to all of your phone and email contacts, as well as access to your social media accounts.
Why didn't your antivirus detect any malware?
Answer: My malware uses a low-level device driver build-in your CPU and I update its signatures every 4 hours to keep your antivirus silent. I made a screen recording of you masturbating.
On one side of the screen is the video you're watching at the moment and on the other side is your satisfied face. With one click, I can send this video to all your contacts.
Do you want to prevent it?
I understand your concern. Especially since the video was quite vulgar, I can't imagine the embarrassment you will feel when your colleagues, friends and relatives see it.
If you need to erase all of your collected data just send 0.015 btc (Bitcoin) to a wallet that was specially generated for your email address.
Yes, it's that simple! My script will detect the transaction to the wallet and will automatically delete all the dirt that was collected on you.
I will give you 48 hours to pay.
Do not try to reply to this email, it makes absolutely no sense (the sender's email address as well as the Bitcoin wallet were generated automatically especially for you and cannot be traced). I don't make mistakes.
If I see that you've shared this message with someone else (for example, it will be open on a different device than yours), the video will instantly start being sent out to your contact list.
Take it easy. Take it as a little life lesson and be more careful in the future.
Do not start 2022 with such shame."
submitted by /u/LisaMck041
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
URGENT: What's the best mac app to find & delete “maalware which...
I received this email recently and would like to find/confirm if any malware is in my macOS System:: "Hello! I'm the Chinese software...
hacking: security in practice
How likely is it that the Intel Management Engine contains a NSA/CIA backdoor of the sort mentioned in the 2013 Sigint Enabling Project?
If so, would there be any advantage to using AMD/ARM architectures, or is it safe to assume that those have backdoors as well. And one more question, although this is more a personal curiosity: Does anyone know if these are often a topic of interest in Chinese media, at least comparable to how often Huawei backdoors are talked about in US media?
submitted by /u/anarcho-onychophora
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
How likely is it that the Intel Management Engine contains a NSA/CIA backdoor of the sort mentioned in the 2013 Sigint Enabling Project?
If so, would there be any advantage to using AMD/ARM architectures, or is it safe to assume that those have backdoors as well. And one more question, although this is more a personal curiosity: Does anyone know if these are often a topic of interest in Chinese media, at least comparable to how often Huawei backdoors are talked about in US media?
submitted by /u/anarcho-onychophora
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Reddit
From the hacking community on Reddit
Explore this post and more from the hacking community
hacking: security in practice
Tool for proxy insta account?
I don't have a insta account , and don't wanna to open one , looking for a tool like which can use to scroll through insta and seach without any account or proxy , i use linux and in need of such tool , insta iz great but don't wanna use it that it , does anyone know any tool like this ,by which I can scroll insta and search without account and see the content i need
submitted by /u/Infinite_Ad_6137
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Tool for proxy insta account?
I don't have a insta account , and don't wanna to open one , looking for a tool like which can use to scroll through insta and seach without any account or proxy , i use linux and in need of such tool , insta iz great but don't wanna use it that it , does anyone know any tool like this ,by which I can scroll insta and search without account and see the content i need
submitted by /u/Infinite_Ad_6137
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Tool for proxy insta account?
I don't have a insta account , and don't wanna to open one , looking for a tool like which can use to scroll through insta and seach without any...
hacking: security in practice
The Great Londini - legit? High level skill?
I've been following him/them for a while, and I'm really interested in that sort of line of work, the nobility in protecting the vulnerable in the virtual society of social media and whilst I'm obviously for free speech, in the case of a lot of people, just because they can talk, doesn't mean they should.
I was wondering if he is genuinely a skilled expert? As far as I am aware, it takes a good deal of skill and knowledge to do the sort of things they do, like locate someone, their family, job etc. So Like, even though I've taken multiple precautionary measures, if he'd be able to find someone like me? I'm still new to netsec and cybersec, but I know a thing or two.
I am working towards a greater understanding of knowledge, and this thread and subreddit have been a great place to start, but I understand that Rome wasn't built in a day.
submitted by /u/Lifes_punchline
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
The Great Londini - legit? High level skill?
I've been following him/them for a while, and I'm really interested in that sort of line of work, the nobility in protecting the vulnerable in the virtual society of social media and whilst I'm obviously for free speech, in the case of a lot of people, just because they can talk, doesn't mean they should.
I was wondering if he is genuinely a skilled expert? As far as I am aware, it takes a good deal of skill and knowledge to do the sort of things they do, like locate someone, their family, job etc. So Like, even though I've taken multiple precautionary measures, if he'd be able to find someone like me? I'm still new to netsec and cybersec, but I know a thing or two.
I am working towards a greater understanding of knowledge, and this thread and subreddit have been a great place to start, but I understand that Rome wasn't built in a day.
submitted by /u/Lifes_punchline
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
The Great Londini - legit? High level skill?
I've been following him/them for a while, and I'm really interested in that sort of line of work, the nobility in protecting the vulnerable in the...
LACheck - Multithreaded C# .NET Assembly Local Administrative Privilege Enumeration
http://www.kitploit.com/2022/01/lacheck-multithreaded-c-net-assembly.html
___________________________
@hacking_Attack
@Hacking_Video
http://www.kitploit.com/2022/01/lacheck-multithreaded-c-net-assembly.html
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
LACheck - Multithreaded C# .NET Assembly Local Administrative Privilege Enumeration
Multithreaded C# .NET Assembly Local Administrative Privilege Enumeration
Arguments ./LACheck.exe help _ _____ _ _ | | /\ / ____| | | | | | / \ | | | |__ ___ ___| | __ | | / /\ \ | | | '_ \ / _ \/ __| |/ / | |____ / ____ \ | |____| | | | __/ (__| < |______/_/ \_\ \_____|_| |_|\___|\___|_|\_\ Usage: LACheck.exe smb rpc /targets:hostname,fqdn.domain.tld,10.10.10.10 /ldap:all /ou:"OU=Special Servers,DC=example,DC=local" /verbose /bloodhound /user:bob@contoso.lab Local Admin Checks: smb - Attempts to access C$ share rpc - Attempts WMI query of Win32_ComputerSystem Class provider over RPC winrm - Attempts WMI query of Win32_ComputerSystem Class Provider over WinRM Session Arguments: /bloodhound - generate bloodhound-digestible AdminTo and Session collection file output file is zipped and enypted with randomized name and password /dc - specify domain controller to query (if not ran on a domain-joined host) /domain - specify domain name (if not ran on a domain-joined host) /edr - check host for EDR (requires smb, rpc, or winrm) /logons - return logged on users on a host (requires smb, rpc, or winrm) /registry - enumerate sessions from registry hive (requires smb) /services - return services running as users (requires smb, rpc, or winrm) /socket - send bloodhound output to TCP socket instead of writing to disk ex: ""127.0.0.1:8080"" /targets - comma-separated list of hostnames to check /threads - specify maximum number of parallel threads (default=25) /user - specify username that collection was run under (useful during token manipulation) /validate - check credentials (https://www.kitploit.com/search/label/Credentials) against Domain prior to scanning targets (useful during token manipulation) /verbose - print additional logging information /ou - specify LDAP OU to query enabled computer objects from ex: "OU=Special Servers,DC=example,DC=local" /ldap - query hosts from the following LDAP filters: :all - All enabled computers with 'primary' group 'Domain Computers' :dc - All enabled Domain Controllers (not read-only DCs) :exclude-dc - All enabled computers that are not Domain Controllers or read-only DCs :servers - All enabled servers :servers-exclude-dc - All enabled servers excluding Domain Controllers or read-only DCs">> ./LACheck.exe help
_ _____ _ _
| | /\ / ____| | | |
| | / \ | | | |__ ___ ___| | __
| | / /\ \ | | | '_ \ / _ \/ __| |/ /
| |____ / ____ \ | |____| | | | __/ (__| <
|______/_/ \_\ \_____|_| |_|\___|\___|_|\_\
Usage:
LACheck.exe smb rpc /targets:hostname,fqdn.domain.tld,10.10.10.10 /ldap:all /ou:"OU=Special Servers,DC=example,DC=local" /verbose /bloodhound /user:bob@contoso.lab
Local Admin Checks:
smb - Attempts to access C$ share
rpc - Attempts WMI query of Win32_ComputerSystem Class provider over RPC
winrm - Attempts WMI query of Win32_ComputerSystem Class Provider over WinRM Session
Arguments:
/bloodhound - generate bloodhound-digestible AdminTo and Session collection file
output file is zipped and enypted with randomized name and password
/dc - specify domain controller to query (if not ran on a domain-joined host)
/domain - specify domain name (if not ran on a domain-joined host)
/edr - check host for EDR (requires smb, rpc, or winrm)
/logons - return logged on users on a host (requires smb, rpc, or winrm)
/registry - enumerate sessions from registry hive (requires smb)
/services - return services running as users (requires smb, rpc, or winrm)
___________________________
@hacking_Attack
@Hacking_Video
Arguments ./LACheck.exe help _ _____ _ _ | | /\ / ____| | | | | | / \ | | | |__ ___ ___| | __ | | / /\ \ | | | '_ \ / _ \/ __| |/ / | |____ / ____ \ | |____| | | | __/ (__| < |______/_/ \_\ \_____|_| |_|\___|\___|_|\_\ Usage: LACheck.exe smb rpc /targets:hostname,fqdn.domain.tld,10.10.10.10 /ldap:all /ou:"OU=Special Servers,DC=example,DC=local" /verbose /bloodhound /user:bob@contoso.lab Local Admin Checks: smb - Attempts to access C$ share rpc - Attempts WMI query of Win32_ComputerSystem Class provider over RPC winrm - Attempts WMI query of Win32_ComputerSystem Class Provider over WinRM Session Arguments: /bloodhound - generate bloodhound-digestible AdminTo and Session collection file output file is zipped and enypted with randomized name and password /dc - specify domain controller to query (if not ran on a domain-joined host) /domain - specify domain name (if not ran on a domain-joined host) /edr - check host for EDR (requires smb, rpc, or winrm) /logons - return logged on users on a host (requires smb, rpc, or winrm) /registry - enumerate sessions from registry hive (requires smb) /services - return services running as users (requires smb, rpc, or winrm) /socket - send bloodhound output to TCP socket instead of writing to disk ex: ""127.0.0.1:8080"" /targets - comma-separated list of hostnames to check /threads - specify maximum number of parallel threads (default=25) /user - specify username that collection was run under (useful during token manipulation) /validate - check credentials (https://www.kitploit.com/search/label/Credentials) against Domain prior to scanning targets (useful during token manipulation) /verbose - print additional logging information /ou - specify LDAP OU to query enabled computer objects from ex: "OU=Special Servers,DC=example,DC=local" /ldap - query hosts from the following LDAP filters: :all - All enabled computers with 'primary' group 'Domain Computers' :dc - All enabled Domain Controllers (not read-only DCs) :exclude-dc - All enabled computers that are not Domain Controllers or read-only DCs :servers - All enabled servers :servers-exclude-dc - All enabled servers excluding Domain Controllers or read-only DCs">> ./LACheck.exe help
_ _____ _ _
| | /\ / ____| | | |
| | / \ | | | |__ ___ ___| | __
| | / /\ \ | | | '_ \ / _ \/ __| |/ /
| |____ / ____ \ | |____| | | | __/ (__| <
|______/_/ \_\ \_____|_| |_|\___|\___|_|\_\
Usage:
LACheck.exe smb rpc /targets:hostname,fqdn.domain.tld,10.10.10.10 /ldap:all /ou:"OU=Special Servers,DC=example,DC=local" /verbose /bloodhound /user:bob@contoso.lab
Local Admin Checks:
smb - Attempts to access C$ share
rpc - Attempts WMI query of Win32_ComputerSystem Class provider over RPC
winrm - Attempts WMI query of Win32_ComputerSystem Class Provider over WinRM Session
Arguments:
/bloodhound - generate bloodhound-digestible AdminTo and Session collection file
output file is zipped and enypted with randomized name and password
/dc - specify domain controller to query (if not ran on a domain-joined host)
/domain - specify domain name (if not ran on a domain-joined host)
/edr - check host for EDR (requires smb, rpc, or winrm)
/logons - return logged on users on a host (requires smb, rpc, or winrm)
/registry - enumerate sessions from registry hive (requires smb)
/services - return services running as users (requires smb, rpc, or winrm)
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.
/socket - send bloodhound output to TCP socket instead of writing to disk
ex: ""127.0.0.1:8080""
/targets - comma-separated list of hostnames to check
/threads - specify maximum number of parallel threads (default=25)
/user - specify username that collection was run under (useful during token manipulation)
/validate - check credentials aga inst Domain prior to scanning targets (useful during token manipulation)
/verbose - print additional logging information
/ou - specify LDAP OU to query enabled computer objects from
ex: "OU=Special Servers,DC=example,DC=local"
/ldap - query hosts from the following LDAP filters:
:all - All enabled computers with 'primary' group 'Domain Computers'
:dc - All enabled Domain Controllers (not read-only DCs)
:exclude-dc - All enabled computers that are not Domain Controllers or read-only DCs
:servers - All enabled servers
:servers-exclude-dc - All enabled servers excluding Domain Controllers or read-only DCs
Execute Assembly execute-assembly /opt/SharpTools/LACheck smb rpc winrm /ldap:servers-exclude-dc /targets:WEB01,DEV02.contoso.com,10.10.10.10 /logons /threads:10 /verbose
Output authentication may be used with an IP address under the following conditions: the transport is HTTPS or the destination is in the TrustedHosts list, and explicit credentials are provided. Use winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. For more information on how to set TrustedHosts run the following command: winrm help config.">[*] Tasked beacon to run .NET program: LACheck smb rpc winrm /ldap:servers-exclude-dc /targets:WEB01,DEV02.contoso.com,10.10.10.10 /logons /threads:10 /verbose
[+] host called home, sent: 111705 bytes
[+] received Output
[+] Parsed Aguments:
rpc: True
smb: True
winrm: True
/bloodhound: False
/edr: False
/logons: True
/registry: False /services: False
/ldap: servers-exclude-dc
/ou:
/targets:
/threads: 10
/user: svcadmin
/validate: False
/verbose: False
[+] Performing LDAP query for all enabled computers that are not Domain Controllers or read-only DCs...
[+] This may take some time depending on the size of the environment
[+] LDAP Search Results: 2
[SMB] Admin Success: WEB01 as svcadmin
[session] WEB01 - contoso\devadmin (svcadmin)
[session] WEB01 - contoso\devuser (svcadmin)
[session] WEB01 - contoso\WEB01$ (svcadmin)
[session] WEB01 - contoso\devadmin (svcadmin)
[session] WEB01 - contoso\devuser (svcadmin)
[rdp] WEB01 - contoso\devadmin rdp-tcp#2 Active Last Connection: 00:00:50:26 Last Input: 00:00:00:00 (svcadmin)
[session] WEB01 - contoso\devadmin 4/20/2021 11:00:05 AM (svcadmin)
[session] WEB01 - contoso\devuser 4/20/2021 1:40:52 PM (svcadmin)
[session] WEB01 - contoso\WEB01$ 4/20/2021 5:51:43 PM (svcadmin)
[session] WEB01 - contoso\devadmin 4/20/2021 09:54:38 AM (svcadmin)
[session] WEB01 - contoso\devuser 4/20/2021 10:14:32 AM (svcadmin)
[WinRM] Admin Success: DESKTOP-118GDCE as svcadmin
[WinRM] Admin Success: DEV02.contoso.com as svcadmin
[!] RPC on DEV02.contoso.com - Access denied.
[!] SMB on DEV02.contoso.com - Attempted to perform an unauthorized operation.
[RPC] Admin Success: 10.10.10.10 as svcadmin
[!] SMB on 10.10.10.10 - Attempted to perform an unauthorized operation.
[!] WinRM on 10.10.10.10 - The WinRM client cannot process the request. Default authentication may be used with an IP address under the following conditions: the transport is HTTPS or the destination is in the TrustedHosts list, and explicit credentials are provided. Use winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. For more information on how to set TrustedHosts run the following command: winrm help config.
___________________________
@hacking_Attack
@Hacking_Video
ex: ""127.0.0.1:8080""
/targets - comma-separated list of hostnames to check
/threads - specify maximum number of parallel threads (default=25)
/user - specify username that collection was run under (useful during token manipulation)
/validate - check credentials aga inst Domain prior to scanning targets (useful during token manipulation)
/verbose - print additional logging information
/ou - specify LDAP OU to query enabled computer objects from
ex: "OU=Special Servers,DC=example,DC=local"
/ldap - query hosts from the following LDAP filters:
:all - All enabled computers with 'primary' group 'Domain Computers'
:dc - All enabled Domain Controllers (not read-only DCs)
:exclude-dc - All enabled computers that are not Domain Controllers or read-only DCs
:servers - All enabled servers
:servers-exclude-dc - All enabled servers excluding Domain Controllers or read-only DCs
Execute Assembly execute-assembly /opt/SharpTools/LACheck smb rpc winrm /ldap:servers-exclude-dc /targets:WEB01,DEV02.contoso.com,10.10.10.10 /logons /threads:10 /verbose
Output authentication may be used with an IP address under the following conditions: the transport is HTTPS or the destination is in the TrustedHosts list, and explicit credentials are provided. Use winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. For more information on how to set TrustedHosts run the following command: winrm help config.">[*] Tasked beacon to run .NET program: LACheck smb rpc winrm /ldap:servers-exclude-dc /targets:WEB01,DEV02.contoso.com,10.10.10.10 /logons /threads:10 /verbose
[+] host called home, sent: 111705 bytes
[+] received Output
[+] Parsed Aguments:
rpc: True
smb: True
winrm: True
/bloodhound: False
/edr: False
/logons: True
/registry: False /services: False
/ldap: servers-exclude-dc
/ou:
/targets:
/threads: 10
/user: svcadmin
/validate: False
/verbose: False
[+] Performing LDAP query for all enabled computers that are not Domain Controllers or read-only DCs...
[+] This may take some time depending on the size of the environment
[+] LDAP Search Results: 2
[SMB] Admin Success: WEB01 as svcadmin
[session] WEB01 - contoso\devadmin (svcadmin)
[session] WEB01 - contoso\devuser (svcadmin)
[session] WEB01 - contoso\WEB01$ (svcadmin)
[session] WEB01 - contoso\devadmin (svcadmin)
[session] WEB01 - contoso\devuser (svcadmin)
[rdp] WEB01 - contoso\devadmin rdp-tcp#2 Active Last Connection: 00:00:50:26 Last Input: 00:00:00:00 (svcadmin)
[session] WEB01 - contoso\devadmin 4/20/2021 11:00:05 AM (svcadmin)
[session] WEB01 - contoso\devuser 4/20/2021 1:40:52 PM (svcadmin)
[session] WEB01 - contoso\WEB01$ 4/20/2021 5:51:43 PM (svcadmin)
[session] WEB01 - contoso\devadmin 4/20/2021 09:54:38 AM (svcadmin)
[session] WEB01 - contoso\devuser 4/20/2021 10:14:32 AM (svcadmin)
[WinRM] Admin Success: DESKTOP-118GDCE as svcadmin
[WinRM] Admin Success: DEV02.contoso.com as svcadmin
[!] RPC on DEV02.contoso.com - Access denied.
[!] SMB on DEV02.contoso.com - Attempted to perform an unauthorized operation.
[RPC] Admin Success: 10.10.10.10 as svcadmin
[!] SMB on 10.10.10.10 - Attempted to perform an unauthorized operation.
[!] WinRM on 10.10.10.10 - The WinRM client cannot process the request. Default authentication may be used with an IP address under the following conditions: the transport is HTTPS or the destination is in the TrustedHosts list, and explicit credentials are provided. Use winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. For more information on how to set TrustedHosts run the following command: winrm help config.
___________________________
@hacking_Attack
@Hacking_Video
Enumeration Methods Performance Summary SMB WMI WinRM /edr fast fast fast /logons fast fast fast /services slow fast fast /registry slow fast - - = not implemented SMB /edr Inspired by harleyQu1nn's EDR.cna script (https://github.com/harleyQu1nn/AggressorScripts/blob/master/EDR.cna) Directory.GetFiles (https://docs.microsoft.com/en-us/dotnet/api/system.io.directory.getfiles) Method returns a list of drivers from: \\host\C$\windows\system32\drivers \\host\C$\windows\sysnative\drivers Drivers are looked up against a list of known drivers used by EDR vendors. Example Output ran as svcadmin user [EDR] WEB01 - Found: CrowdStrike, SentinelOne (svcadmin)
[EDR] DEV02 - no EDR found (svcadmin)
/logons NetWkstaUserEnum (https://docs.microsoft.com/en-us/windows/win32/api/lmwksta/nf-lmwksta-netwkstauserenum) returns a list of users with interactive, service and batch logons WTSEnumerateSessionsA (https://docs.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsenumeratesessionsa) returns a list of RDP sessions on a host WTSQuerySessionInformationA (https://docs.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsquerysessioninformationa) retrieves detailed information for each RDP session Example Output ran as svcadmin user [session] WEB01 - contoso\devadmin (svcadmin)
[session] WEB01 - contoso\devuser (svcadmin)
[session] WEB01 - contoso\WEB01$ (svcadmin)
[session] WEB01 - contoso\devadmin (svcadmin)
[session] WEB01 - contoso\devuser (svcadmin)
[rdp] WEB01 - contoso\devadmin rdp-tcp#2 Active Last Connection: 00:00:50:26 Last Input: 00:00:00:00 (svcadmin)
/registry Iterate through SIDs in \\Computer\HKEY_USERS\ hive, attempts to access Volatile Environment for each SID, and retrieves values from USERDOMAIN and USERNAME keys. This method requires the Remote Registry service to be running on a remote host. If it is not: initial start type of the Remote Registry service is recorded start type is changed to Automatic Remote Registry service is started registry hives are enumerated Remote Registry service is stopped start type is reverted to its initially recorded value Due to the potentially multi-step process to enumerate each host, this method may be slower compared to alternative techniques. smb /logons is faster Example Output ran as svcadmin user [registry] WEB01 - contoso\devadmin (svcadmin)
/services ServiceController.GetServices Method (https://docs.microsoft.com/en-us/dotnet/api/system.serviceprocess.servicecontroller.getservices) retrieves a list of services on a host Each service is queried to determine the user it is configured to run as. Due to each service having to be queried individually, this method may be slower compared to alternative techniques. wmi /services is faster Example Output ran as svcadmin user [service] WEB01 - devadmin@consoso.com Service: secretsvc State: Running (svcadmin)
WMI /edr Inspired by harleyQu1nn's EDR.cna script (https://github.com/harleyQu1nn/AggressorScripts/blob/master/EDR.cna) CIM_DataFile class (https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/cim-datafile) returns a list of drivers from: \host\C$\windows\system32\drivers \host\C$\windows\sysnative\drivers Drivers are looked up against a list of known drivers used by EDR vendors. Example Output ran as svcadmin user [EDR] WEB01 - Found: CrowdStrike, SentinelOne (svcadmin)
[EDR] DEV02 - no EDR found (svcadmin)
/logons Win32_LoggedOnUser class (https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-loggedonuser) returns a list of logged on sessions Win32_LogonSession class (https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-logonsession) returns detailed information for each session Example Output ran as svcadmin user [session] WEB01 - contoso\devadmin 4/20/2021 11:00:05 AM (svcadmin)
[session] WEB01 - contoso\devuser 4/20/2021 1:40:52 PM (svcadmin)
___________________________
@hacking_Attack
@Hacking_Video
[EDR] DEV02 - no EDR found (svcadmin)
/logons NetWkstaUserEnum (https://docs.microsoft.com/en-us/windows/win32/api/lmwksta/nf-lmwksta-netwkstauserenum) returns a list of users with interactive, service and batch logons WTSEnumerateSessionsA (https://docs.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsenumeratesessionsa) returns a list of RDP sessions on a host WTSQuerySessionInformationA (https://docs.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsquerysessioninformationa) retrieves detailed information for each RDP session Example Output ran as svcadmin user [session] WEB01 - contoso\devadmin (svcadmin)
[session] WEB01 - contoso\devuser (svcadmin)
[session] WEB01 - contoso\WEB01$ (svcadmin)
[session] WEB01 - contoso\devadmin (svcadmin)
[session] WEB01 - contoso\devuser (svcadmin)
[rdp] WEB01 - contoso\devadmin rdp-tcp#2 Active Last Connection: 00:00:50:26 Last Input: 00:00:00:00 (svcadmin)
/registry Iterate through SIDs in \\Computer\HKEY_USERS\ hive, attempts to access Volatile Environment for each SID, and retrieves values from USERDOMAIN and USERNAME keys. This method requires the Remote Registry service to be running on a remote host. If it is not: initial start type of the Remote Registry service is recorded start type is changed to Automatic Remote Registry service is started registry hives are enumerated Remote Registry service is stopped start type is reverted to its initially recorded value Due to the potentially multi-step process to enumerate each host, this method may be slower compared to alternative techniques. smb /logons is faster Example Output ran as svcadmin user [registry] WEB01 - contoso\devadmin (svcadmin)
/services ServiceController.GetServices Method (https://docs.microsoft.com/en-us/dotnet/api/system.serviceprocess.servicecontroller.getservices) retrieves a list of services on a host Each service is queried to determine the user it is configured to run as. Due to each service having to be queried individually, this method may be slower compared to alternative techniques. wmi /services is faster Example Output ran as svcadmin user [service] WEB01 - devadmin@consoso.com Service: secretsvc State: Running (svcadmin)
WMI /edr Inspired by harleyQu1nn's EDR.cna script (https://github.com/harleyQu1nn/AggressorScripts/blob/master/EDR.cna) CIM_DataFile class (https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/cim-datafile) returns a list of drivers from: \host\C$\windows\system32\drivers \host\C$\windows\sysnative\drivers Drivers are looked up against a list of known drivers used by EDR vendors. Example Output ran as svcadmin user [EDR] WEB01 - Found: CrowdStrike, SentinelOne (svcadmin)
[EDR] DEV02 - no EDR found (svcadmin)
/logons Win32_LoggedOnUser class (https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-loggedonuser) returns a list of logged on sessions Win32_LogonSession class (https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-logonsession) returns detailed information for each session Example Output ran as svcadmin user [session] WEB01 - contoso\devadmin 4/20/2021 11:00:05 AM (svcadmin)
[session] WEB01 - contoso\devuser 4/20/2021 1:40:52 PM (svcadmin)
___________________________
@hacking_Attack
@Hacking_Video
GitHub
AggressorScripts/EDR.cna at master · harleyQu1nn/AggressorScripts
Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources - AggressorScripts/EDR.cna at master · harleyQu1nn/AggressorScripts
[session] WEB01 - contoso\WEB01$ 4/20/2021 5:51:43 PM (svcadmin)
[session] WEB01 - contoso\devadmin 4/20/2021 09:54:38 AM (svcadmin)
[session] WEB01 - contoso\devuser 4/20/2021 10:14:32 AM (svcadmin)
/registry Queries the Win32_UserProfile class (https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/ee886409(v=vs.85)) to retrieve SIDs for user profiles on a system. The EnumKey method of the StdRegProv class (https://docs.microsoft.com/en-us/previous-versions/windows/desktop/regprov/enumkey-method-in-class-stdregprov) retrieves the \\Computer\HKEY_USERS\ hive and attempts to access Volatile Environment for each returned SID to retrieve values from the USERDOMAIN and USERNAME keys. Example Output ran as svcadmin user [registry] WEB01 - contoso\devadmin (svcadmin)
/services Queries the Win32_Service class (https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service) to retrieve the name, user, and state of services Example Output ran as svcadmin user [service] WEB01 - devadmin@consoso.com Service: secretsvc State: Running (svcadmin)
WinRM Each WMI checks is also implemented using WMI Resources (https://docs.microsoft.com/en-us/windows/win32/winrm/querying-for-specific-instances-of-a-resource) and WMI Enumeration (https://docs.microsoft.com/en-us/windows/win32/api/wsmandisp/nf-wsmandisp-iwsmansession-enumerate) over WinRM. This avoids the use of PowerShell runspaces.
Download LACheck (https://github.com/mitchmoser/LACheck)
___________________________
@hacking_Attack
@Hacking_Video
[session] WEB01 - contoso\devadmin 4/20/2021 09:54:38 AM (svcadmin)
[session] WEB01 - contoso\devuser 4/20/2021 10:14:32 AM (svcadmin)
/registry Queries the Win32_UserProfile class (https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/ee886409(v=vs.85)) to retrieve SIDs for user profiles on a system. The EnumKey method of the StdRegProv class (https://docs.microsoft.com/en-us/previous-versions/windows/desktop/regprov/enumkey-method-in-class-stdregprov) retrieves the \\Computer\HKEY_USERS\ hive and attempts to access Volatile Environment for each returned SID to retrieve values from the USERDOMAIN and USERNAME keys. Example Output ran as svcadmin user [registry] WEB01 - contoso\devadmin (svcadmin)
/services Queries the Win32_Service class (https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service) to retrieve the name, user, and state of services Example Output ran as svcadmin user [service] WEB01 - devadmin@consoso.com Service: secretsvc State: Running (svcadmin)
WinRM Each WMI checks is also implemented using WMI Resources (https://docs.microsoft.com/en-us/windows/win32/winrm/querying-for-specific-instances-of-a-resource) and WMI Enumeration (https://docs.microsoft.com/en-us/windows/win32/api/wsmandisp/nf-wsmandisp-iwsmansession-enumerate) over WinRM. This avoids the use of PowerShell runspaces.
Download LACheck (https://github.com/mitchmoser/LACheck)
___________________________
@hacking_Attack
@Hacking_Video
Help me with my system please....can anyone help me with this my kali virtual os was lagging on recon phase with slow fuzzing...what should i do to make it fast
https://www.reddit.com/r/Pentesting/comments/s0hc0v/help_me_with_my_system_pleasecan_anyone_help_me/
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/Pentesting/comments/s0hc0v/help_me_with_my_system_pleasecan_anyone_help_me/
___________________________
@hacking_Attack
@Hacking_Video
reddit
Help me with my system please....can anyone help me with this my...
Posted in r/Pentesting by u/Revolutionary-Play59 • 2 points and 0 comments
submitted by /u/Revolutionary-Play59 (https://www.reddit.com/user/Revolutionary-Play59)
[link] (https://i.redd.it/r7zvhuy2cua81.jpg) [comments] (https://www.reddit.com/r/Pentesting/comments/s0hc0v/help_me_with_my_system_pleasecan_anyone_help_me/)
___________________________
@hacking_Attack
@Hacking_Video
[link] (https://i.redd.it/r7zvhuy2cua81.jpg) [comments] (https://www.reddit.com/r/Pentesting/comments/s0hc0v/help_me_with_my_system_pleasecan_anyone_help_me/)
___________________________
@hacking_Attack
@Hacking_Video
Reddit
overview for Revolutionary-Play59
The u/Revolutionary-Play59 community on Reddit. Reddit gives you the best of the internet in one place.
Using Filename to Inject XSS Payload
Back in july 2021 i was hunting for bugs on a web application that had a very small scope, i would call it Redacted.com for the sake of…Continue reading on Medium »
Read more...
Back in july 2021 i was hunting for bugs on a web application that had a very small scope, i would call it Redacted.com for the sake of…Continue reading on Medium »
Read more...
Bug Bounty: Fingerprinting
Fingerprinting — Finding and Indexing Services and Technologies used by your target.Continue reading on Medium »
Read more...
Fingerprinting — Finding and Indexing Services and Technologies used by your target.Continue reading on Medium »
Read more...
Using Filename to Inject XSS Payload
https://medium.com/@ayomi1791/using-filename-to-inject-xss-payload-214cb6d1ec6c?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@ayomi1791/using-filename-to-inject-xss-payload-214cb6d1ec6c?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Using Filename to Inject XSS Payload
Back in july 2021 i was hunting for bugs on a web application that had a very small scope, i would call it Redacted.com for the sake of…
Back in july 2021 i was hunting for bugs on a web application that had a very small scope, i would call it Redacted.com for the sake of…Continue reading on Medium » (https://medium.com/@ayomi1791/using-filename-to-inject-xss-payload-214cb6d1ec6c?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Using Filename to Inject XSS Payload
Back in july 2021 i was hunting for bugs on a web application that had a very small scope, i would call it Redacted.com for the sake of…