hacking: security in practice
Debugging phone traffic using Charles on Android 10 not trusted

Im currently tring to debug phone traffic using Charles.

I installed the charles certificate using http://charlesproxy.com/getssl and connected to my proxy, however when I activate SSL proxying all connections fail due to SSL handshake with client failed: When access control was applied the certificate was rejected (access_denied)and the note You may need to configure your browser or application to trust the Charles Root Certificate. See SSL Proxying in the Help menu.What could cause this?Any help is appreciated!

submitted by /u/_BlackPhoenix14
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Sky ECC was hacked 4 months earlier than international law enforcement has admitted

This story gets to the bottom of the hack in a... ummm ... visceral way

https://www.shadowbanker.io/2022/01/clout-chasing-serbian-narco-it-moron-holds-key-to-performative-europol-shade-in-icij-story/

submitted by /u/Shadow-Banker
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Defeating firewall active probing using specialized DNAT rules: is it this simple?

Some advanced corporate/government content filters are setup to connect to HTTPS websites being visited by users to evaluate what sorts of content is on the websites. However, in many of these cases, the device doing the active probing would likely not be on the same network as the user.

Given this, couldn't someone set up two HTTPS-encrypted web servers with the same certificate/private key and domain name: one of a legitimate-looking site, and one of a shadier site. From there, they could set their router to DNAT inbound connections on port 443 with a source IP of the target network, to the shady site, and DNAT inbound connections on port 443 with a different source IP address to the legitimate-looking site.

Are there countermeasures for this, or is this a gaping oversight in the logic of active probing?

submitted by /u/Serialtorrenter
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Attacking ARP: Learn Networking By Breaking Stuff For Bug Bounty Hunters, Penetration Testers, and…

https://cdn-images-1.medium.com/max/1875/0*YI4lVH_4g3eG-h6E.jpg
An introduction to the fundamentals of one of the most important protocols on the internet and the methodology to exploit it for fun and…

Continue reading on Dev Genius »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
learning prerequisites for hacking and bug bounty?

hey computer geeks. i am writing this cause i have faced very problems in getting started in “cyber security” cause of i don’t know where…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How To Use John The Ripper Tool In Linux For Cracking Passwords?

https://cdn-images-1.medium.com/max/800/1*v8QnvLc5qeoCq2mbiKRotQ.jpeg
John The Ripper is one of the fastest hash cracking tools.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

How to attack Offensive Security Web Expert (OSWE)

In this article, we will discuss about one of the toughest exams from Offensive Security, the web expert one (OSWE).Continue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
Patch Management Today: A Risk-Based Strategy to Defeat Cybercriminals

By combining risk-based vulnerability prioritization and automated patch intelligence, organizations can apply patches based on threat level. Part 2 of 3.

Kali Linux Tutorials
pwnSpoof : Generates realistic spoofed log files for common web servers with customisable attack scenarios

pwnSpoof (from Punk Security) generates realistic spoofed log files for common web servers with customizable attack scenarios.

Every log bundle is unique and completely customisable, making it perfect for generating CTF scenarios and for training serials.

Can you find the attacker session and build the incident picture?

About The Project

pwnSpoof was created on the back of a threat hunting training exercise Punk Security delivered for a customer. The training exercise was to use a log analytic tool such as Splunk (other log analysing tools are available) and IIS logs to find login brute-force attacks and command injections.

The idea behind the pwnSpoof application is to;

* Provide a quick CTF style training environment
* Create unique logs every run
* Test threat hunting in IIS, Apache and NGINX logs

Once you have created a set of logs, the idea is to load them in to Splunk and use various techniques to answer the following questions;

* What was the attackers IP address and user_agent?
* Did the attacker authenticate and if so, with what account?
* Where was geo-location of the attacker?
* When did the attack occur?
* What kind of attack was it?
* What happened during the attack?
* What artifacts may remain on the server?
* What steps can be taken to remediate? Getting Started

The following will explain how to get started with pwnSpoof Prerequisites

pwnSpoof is written in python and is tested with python3. No extra modules are needed, we only use the standard library.

If you get the following error message, please specifiy python3 when running pwnSpoof. Python2 is not supported.

File “pwnspoof.py”, line 176
print(“{:6.2f}% “.format(y * x), end=”\r”, flush=True)
^
SyntaxError: invalid syntax

Installation

* Git clone the pwnSpoof repo

git clone https://github.com/punk-security/pwnspoof

change directory to pwnSpoof

cd pwnspoof

Run pwnSpoof

python pwnspoof.py –help

Usage Switches

positional arguments:
{banking,wordpress,generic}
App to emulate
optional arguments:
-h, –help show this help message and exit
–out OUT Output file (default: pwnspoof.log)
–iocs Do you want to know the attackers iocs for easier searching? (default: False)
log generator settings:
–log-start-date LOG_START_DATE
Initial start of logs, in the format YYYYMMDD i.e. “20210727”
–log-end-date LOG_END_DATE
End date for logs, in the format YYYYMMDD i.e. “20210727”
–session-count SESSION_COUNT
Number of legitimate sessions to spoof (default: 2000)
–max-sessions-per-user MAX_SESSIONS_PER_USER
Max number of legitimate sessions per user (default: 3)
–server-fqdn SERVER_FQDN
Override the emulated web apps default fqdn
–server-ip SERVER_IP
Override the emulated web apps randomised IP
–server-type {IIS,NGINX,CLF}
Server to spoof (default: IIS)
–uri-file URI_FILE File containing web uris to override defaults, do not include extensions
–noise-file NOISE_FILE
File containing noise uris to override defaults, include extensions
attack settings:
–spoofed-attacks SPOOFED_ATTACKS
Number of attacker sequences to spoof (default: 1)
–attack-type {bruteforce,command_injection}
Number of attacker sequences to spoof (default: bruteforce)
–attacker-geo ATTACKER_GEO
Set the attackers geo by 2 letter region. Use RD for random (default: RD)
–attacker-user-agent ATTACKER_USER_AGENT
Set the attackers user-agent. Use RD for random (default: RD)

Examples

The following example will create a set of IIS logs for bruteforce against pwnedbank.co.uk.

python pwnspoof.py banking –server-fqdn pwnedbank.co.uk –attack-type bruteforce –server-type IIS –out iis-output.log

The following example will create a set of NGINX logs for command_injection against pwnedbank.co.uk.

python pwnspoof[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Registry-Recon : Cobalt Strike Aggressor Script That Performs System/AV/EDR Recon

Registry-Recon is a Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon.

Description

As a red-team practitioner, we are often using tools that attempt to fingerprint details about a compromised system, preferably in the most stealthy way possible. Some of our usual tooling for this started getting flagged by EDR products, due to the use of Windows CLI commands. This aggressor script aims to solve that problem by only probing the system using native registry queries, no CLI commands.

Setup

Simply load reg.cnainto Cobalt Strike using the Script Manager. Then right-click on the beacon you want to run registry recon on, and choose Registrythen Recon, or type regenuminto the beacon console.
https://blogger.googleusercontent.com/img/a/AVvXsEiVn6FJLPatBpMhcWZxPcEaPxy2w90g_jUt4GluRV10RKOQot6kXu5CvRDfEP0QfXW5VQJa5TPBIOS1JjLI392JgNuVugPARYwV6lPBUJ5A-hghiH9XiUlGywojhHcUKVmREc1hQsWTIxjDx2__xPPvvNxEEMLO3Xii5_-fmgkFo00RbYXgDuqsb9m2=s977 https://blogger.googleusercontent.com/img/a/AVvXsEgkJRyCMVbf2aOiasFjL78_9wKIp4BLoJ-4iYWvtpS9yYkCN5o_GNIm-dzAehgh0KKyVgYUUJUsmFW9ZZYmOr77lAA-7TMAjG_nH8yD70-85PRx_TbJr7nMOC4Y60tQNNJ6TfxTP_vXMNn1pjIuolyh3pAyx58IF8BU-tpBmEiVxBeFm4Fw02x1XrcL=s385
How does this work?

Primarily, using Cobalt Strike’s breg_queryand breg_queryvfunctions. Then, all beacon output is hijacked with beacon_output, looking for specific values. When a positive match is made, the output will be highlighted in the beacon output. Since there is no beacon_output_regor something similar, like beacon_output_lsand beacon_output_ps, all output must be captured for parsing.

What if my AV/EDR product isn’t detected? / How can I help?

This is expected. We couldn’t test for every AV/EDR solution, and we knew that many would be missing. You can help us out by submitting a GitHub issue including the following info:

* If this is a System/AV/EDR entry
* The name of the product
* Relevant registry entries that can be used to positively ID the product
Download

___________________________
@hacking_Attack
@Hacking_Video

.py banking –server-fqdn pwnedbank.co.uk –attack-type command_injection –server-type NGINX

The following example will create a set of logs with 5000 routine sessions and 3 attack sessions

python pwnspoof.py banking –session-count 5000 –spoofed-attacks 3

The following example will create a set of logs and output the attackers IP addresses

python pwnspoof.py banking –spoofed-attacks 3 –iocs Download

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
DMCA.com Improper Access Control / Cross Site Scripting

https://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png
DMCA.com suffers from improper access control, persistent cross site scripting, and improper input validation vulnerabilities.

MD5 | de3eab0ce1d4e59fca59fb8cb0848dc7

Download
Publisher: Joel Aviad Ossi

Company: Pentest
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video