In this article, we will discuss about one of the toughest exams from Offensive Security, the web expert one (OSWE).Continue reading on Medium » (https://corneacristian.medium.com/how-to-attack-offensive-security-web-expert-oswe-e1aca380ebfe?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
RAUDI - A Repo To Automatically Generate And Keep Updated A Series Of Docker Images Through GitHub Actions

https://blogger.googleusercontent.com/img/a/AVvXsEjC6XnoVfgQpldAgF40OiyjY5hPMdXEMIM-899Sj4Jr9NHBpYRfjXhXiiNvXRXQ2BDdv8aKTOlIa82N4nZOC_mCRfNl_KLxQ_oF-QtuHwvu_mats2DKQ0q-z23py7cvPloB8c016v75JQ2CQELP4FGIc9pg4xqd6_AxHYRVjKQ2gM1LFBq3TN_s2MJG=w640-h388 RAUDI (Regularly and Automatically Updated Docker Images) automatically generates and keep updated a series of Docker Images through GitHub Actions for tools that are not provided by the developers. What is RAUDIRAUDI is what will save you from creating and managing a lot of Docker Images manually. Every time a software is updated you need to update the Docker Image if you want to use the latest features, the dependencies are not working anymore.

This is messy and time-consuming.

Don't worry anymore, we got you covered. SetupThis repo can also be executed locally. The requirements to be met are the following:

* Python 3.x
* Docker

The setup phase is pretty straightforward, you just need the following commands: git clone https://github.com/cybersecsi/RAUDI
cd RAUDI
pip install -r requirements.txt You're ready to go! UsageRAUDI can build and push all the tools that are put into the tools directory. There are different options that can be used when running it. Execution ModesNormal ExecutionIn this mode RAUDI tries to build all the tools if needed. The command to run it is simply: ./raudi.py --all Single BuildIn this mode RAUDI tries to build only the specified tool. The command in this case is: ./raudi.py --single tool_name MUST be the name of the directory inside the tools folder. Show toolsIf you want to know the available tools you can run this command: ./raudi.py --list OptionsOption Description Default Value --push Whether automatically push to Docker Hub False --remote Whether check against Docker Hub instead of local Docker before build False Available ToolsThis is the current list of tools that have been added. Those are all tools that do not have an official Docker Image provided by the developer:
Name Docker Image Source Apktool secsi/apktool https://github.com/iBotPeaches/Apktool bfac secsi/bfac https://github.com/mazen160/bfac dirb secsi/dirb http://dirb.sourceforge.net/ dirhunt secsi/dirhunt https://github.com/Nekmo/dirhunt dirsearch secsi/dirsearch https://github.com/maurosoria/dirsearch ffuf secsi/ffuf https://github.com/ffuf/ffuf fierce secsi/fierce https://github.com/mschwager/fierce Findsploit secsi/findsploit https://github.com/1N3/Findsploit Gitrob secsi/gitrob https://github.com/michenriksen/gitrob gobuster secsi/gobuster https://github.com/OJ/gobuster hydra secsi/hydra https://github.com/vanhauser-thc/thc-hydra The JSON Web Token Toolkit secsi/jwt_tool https://github.com/ticarpi/jwt_tool knock secsi/knockpy https://github.com/guelfoweb/knock LFI Suite secsi/lfisuite https://github.com/D35m0nd142/LFISuite MASSCAN secsi/masscan https://github.com/robertdavidgraham/masscan MassDNS secsi/massdns https://github.com/blechschmidt/massdns Race The Web secsi/race-the-web https://github.com/TheHackerDev/race-the-web Retire.js secsi/retire https://github.com/RetireJS/retire.js Sandcastle secsi/sandcastle https://github.com/0xSearches/sandcastle sqlmap secsi/sqlmap https://github.com/sqlmapproject/sqlmap Sublist3r secsi/sublist3r https://github.com/aboul3la/Sublist3r theHarvester secsi/theharvester https://github.com/laramies/theHarvester RestfulHarvest secsi/restfulharvest https://github.com/laramies/theHarvester waybackpy secsi/waybackpy https://github.com/akamhy/waybackpy WhatWeb secsi/whatweb https://github.com/urbanadventurer/WhatWeb Tool StructureEvery tool in the tools directory cont[...]

___________________________
@hacking_Attack
@Hacking_Video

ains at least two file:

* config.py
* Dockerfile.
* README.md (optional README for Docker Hub)

If you want to add a new tool you just have to create a folder for that specific tool inside the tools directory. In this folder you have to insert the Dockerfile with defined build args to customize and automate the build. Once you created the Dockerfile you have to create a config.py in the same directory with a function called get_config(organization, common_args). Be careful: the function MUST be called this way and MUST have those two parameters (even if you do not use them). The returning value is the config for that specific tool and has the following structure: config = {
'name': organization+'/The four keys are:

* name: the name of the Docker Image (e.g. secsi/ExamplesThis section provides examples for the currently added Network Security Tools. As you can see the images do provide only the tool, so if you need to use a wordlist you need to mount it. Generic Exampledocker run -it --rm secsi/Specific exampledocker run -it --rm -v Roadmap* Add GitHub Actions
* Add '--local' option Add '--remote' option (by default it is local)
* Add README for every tool Add general README for all RAUDI Docker Image
* Add custom logger
* Config file for customization (like the organization name) Customizable organization name in tools/main.py
* Add GitHub page (different repo)
* Switch to Alpine-based images
* Automate Docker Hub README updates (doesn't seems to work with Docker Free Plan)
* Add tests for each tool (that allows it)
* Add auto-commit
* Better error handling ContributionsEveryone is invited to contribute! If you are a user of the tool and have a suggestion for a new feature or a bug to report, please do so through the issue tracker. CreditsRAUDI is proudly developed @SecSI by:

* Angelo Delicato
* Daniele Capone
* Gaetano Perrone LicenseRAUDI is an open-source and free software released under the GNU GPL v3. Download RAUDI

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Beating a key logger

When typing in sensitive numbers eg, card numbers, I've taken to clicking off the box, entering a few random numbers and then clicking back on and continuing with the real number. Not that I suspect my pc is infected more just in case. Anyway would this work at all or should I give up the practice?

submitted by /u/InfamousCommand
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Debugging phone traffic using Charles on Android 10 not trusted

Im currently tring to debug phone traffic using Charles.

I installed the charles certificate using http://charlesproxy.com/getssl and connected to my proxy, however when I activate SSL proxying all connections fail due to SSL handshake with client failed: When access control was applied the certificate was rejected (access_denied)and the note You may need to configure your browser or application to trust the Charles Root Certificate. See SSL Proxying in the Help menu.What could cause this?Any help is appreciated!

submitted by /u/_BlackPhoenix14
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Sky ECC was hacked 4 months earlier than international law enforcement has admitted

This story gets to the bottom of the hack in a... ummm ... visceral way

https://www.shadowbanker.io/2022/01/clout-chasing-serbian-narco-it-moron-holds-key-to-performative-europol-shade-in-icij-story/

submitted by /u/Shadow-Banker
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Defeating firewall active probing using specialized DNAT rules: is it this simple?

Some advanced corporate/government content filters are setup to connect to HTTPS websites being visited by users to evaluate what sorts of content is on the websites. However, in many of these cases, the device doing the active probing would likely not be on the same network as the user.

Given this, couldn't someone set up two HTTPS-encrypted web servers with the same certificate/private key and domain name: one of a legitimate-looking site, and one of a shadier site. From there, they could set their router to DNAT inbound connections on port 443 with a source IP of the target network, to the shady site, and DNAT inbound connections on port 443 with a different source IP address to the legitimate-looking site.

Are there countermeasures for this, or is this a gaping oversight in the logic of active probing?

submitted by /u/Serialtorrenter
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Attacking ARP: Learn Networking By Breaking Stuff For Bug Bounty Hunters, Penetration Testers, and…

https://cdn-images-1.medium.com/max/1875/0*YI4lVH_4g3eG-h6E.jpg
An introduction to the fundamentals of one of the most important protocols on the internet and the methodology to exploit it for fun and…

Continue reading on Dev Genius »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
learning prerequisites for hacking and bug bounty?

hey computer geeks. i am writing this cause i have faced very problems in getting started in “cyber security” cause of i don’t know where…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How To Use John The Ripper Tool In Linux For Cracking Passwords?

https://cdn-images-1.medium.com/max/800/1*v8QnvLc5qeoCq2mbiKRotQ.jpeg
John The Ripper is one of the fastest hash cracking tools.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

How to attack Offensive Security Web Expert (OSWE)

In this article, we will discuss about one of the toughest exams from Offensive Security, the web expert one (OSWE).Continue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
Patch Management Today: A Risk-Based Strategy to Defeat Cybercriminals

By combining risk-based vulnerability prioritization and automated patch intelligence, organizations can apply patches based on threat level. Part 2 of 3.

Kali Linux Tutorials
pwnSpoof : Generates realistic spoofed log files for common web servers with customisable attack scenarios

pwnSpoof (from Punk Security) generates realistic spoofed log files for common web servers with customizable attack scenarios.

Every log bundle is unique and completely customisable, making it perfect for generating CTF scenarios and for training serials.

Can you find the attacker session and build the incident picture?

About The Project

pwnSpoof was created on the back of a threat hunting training exercise Punk Security delivered for a customer. The training exercise was to use a log analytic tool such as Splunk (other log analysing tools are available) and IIS logs to find login brute-force attacks and command injections.

The idea behind the pwnSpoof application is to;

* Provide a quick CTF style training environment
* Create unique logs every run
* Test threat hunting in IIS, Apache and NGINX logs

Once you have created a set of logs, the idea is to load them in to Splunk and use various techniques to answer the following questions;

* What was the attackers IP address and user_agent?
* Did the attacker authenticate and if so, with what account?
* Where was geo-location of the attacker?
* When did the attack occur?
* What kind of attack was it?
* What happened during the attack?
* What artifacts may remain on the server?
* What steps can be taken to remediate? Getting Started

The following will explain how to get started with pwnSpoof Prerequisites

pwnSpoof is written in python and is tested with python3. No extra modules are needed, we only use the standard library.

If you get the following error message, please specifiy python3 when running pwnSpoof. Python2 is not supported.

File “pwnspoof.py”, line 176
print(“{:6.2f}% “.format(y * x), end=”\r”, flush=True)
^
SyntaxError: invalid syntax

Installation

* Git clone the pwnSpoof repo

git clone https://github.com/punk-security/pwnspoof

change directory to pwnSpoof

cd pwnspoof

Run pwnSpoof

python pwnspoof.py –help

Usage Switches

positional arguments:
{banking,wordpress,generic}
App to emulate
optional arguments:
-h, –help show this help message and exit
–out OUT Output file (default: pwnspoof.log)
–iocs Do you want to know the attackers iocs for easier searching? (default: False)
log generator settings:
–log-start-date LOG_START_DATE
Initial start of logs, in the format YYYYMMDD i.e. “20210727”
–log-end-date LOG_END_DATE
End date for logs, in the format YYYYMMDD i.e. “20210727”
–session-count SESSION_COUNT
Number of legitimate sessions to spoof (default: 2000)
–max-sessions-per-user MAX_SESSIONS_PER_USER
Max number of legitimate sessions per user (default: 3)
–server-fqdn SERVER_FQDN
Override the emulated web apps default fqdn
–server-ip SERVER_IP
Override the emulated web apps randomised IP
–server-type {IIS,NGINX,CLF}
Server to spoof (default: IIS)
–uri-file URI_FILE File containing web uris to override defaults, do not include extensions
–noise-file NOISE_FILE
File containing noise uris to override defaults, include extensions
attack settings:
–spoofed-attacks SPOOFED_ATTACKS
Number of attacker sequences to spoof (default: 1)
–attack-type {bruteforce,command_injection}
Number of attacker sequences to spoof (default: bruteforce)
–attacker-geo ATTACKER_GEO
Set the attackers geo by 2 letter region. Use RD for random (default: RD)
–attacker-user-agent ATTACKER_USER_AGENT
Set the attackers user-agent. Use RD for random (default: RD)

Examples

The following example will create a set of IIS logs for bruteforce against pwnedbank.co.uk.

python pwnspoof.py banking –server-fqdn pwnedbank.co.uk –attack-type bruteforce –server-type IIS –out iis-output.log

The following example will create a set of NGINX logs for command_injection against pwnedbank.co.uk.

python pwnspoof[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Registry-Recon : Cobalt Strike Aggressor Script That Performs System/AV/EDR Recon

Registry-Recon is a Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon.

Description

As a red-team practitioner, we are often using tools that attempt to fingerprint details about a compromised system, preferably in the most stealthy way possible. Some of our usual tooling for this started getting flagged by EDR products, due to the use of Windows CLI commands. This aggressor script aims to solve that problem by only probing the system using native registry queries, no CLI commands.

Setup

Simply load reg.cnainto Cobalt Strike using the Script Manager. Then right-click on the beacon you want to run registry recon on, and choose Registrythen Recon, or type regenuminto the beacon console.
https://blogger.googleusercontent.com/img/a/AVvXsEiVn6FJLPatBpMhcWZxPcEaPxy2w90g_jUt4GluRV10RKOQot6kXu5CvRDfEP0QfXW5VQJa5TPBIOS1JjLI392JgNuVugPARYwV6lPBUJ5A-hghiH9XiUlGywojhHcUKVmREc1hQsWTIxjDx2__xPPvvNxEEMLO3Xii5_-fmgkFo00RbYXgDuqsb9m2=s977 https://blogger.googleusercontent.com/img/a/AVvXsEgkJRyCMVbf2aOiasFjL78_9wKIp4BLoJ-4iYWvtpS9yYkCN5o_GNIm-dzAehgh0KKyVgYUUJUsmFW9ZZYmOr77lAA-7TMAjG_nH8yD70-85PRx_TbJr7nMOC4Y60tQNNJ6TfxTP_vXMNn1pjIuolyh3pAyx58IF8BU-tpBmEiVxBeFm4Fw02x1XrcL=s385
How does this work?

Primarily, using Cobalt Strike’s breg_queryand breg_queryvfunctions. Then, all beacon output is hijacked with beacon_output, looking for specific values. When a positive match is made, the output will be highlighted in the beacon output. Since there is no beacon_output_regor something similar, like beacon_output_lsand beacon_output_ps, all output must be captured for parsing.

What if my AV/EDR product isn’t detected? / How can I help?

This is expected. We couldn’t test for every AV/EDR solution, and we knew that many would be missing. You can help us out by submitting a GitHub issue including the following info:

* If this is a System/AV/EDR entry
* The name of the product
* Relevant registry entries that can be used to positively ID the product
Download

___________________________
@hacking_Attack
@Hacking_Video