Black Hat Ethical Hacking
AWS fixes security flaws that exposed AWS customer data

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png AWS fixes security flaws that exposed AWS customer dataPost Views: 112 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute
Amazon Web Services (AWS) has addressed an AWS Glue security issue that allowed attackers to access and alter data linked to other AWS customer accounts. AWS Glue is a serverless cloud data integration service that helps discover, prepare, and combine data for app development, machine learning, and analytics.

The flaw stemmed from an exploitable AWS Glue feature and an internal service API misconfiguration that allowed Orca Security security researchers to escalate privileges to gain access to all service resources in the region.

“During our research, we were able to identify a feature in AWS Glue that could be exploited to obtain credentials to a role within the AWS service’s own account, which provided us full access to the internal service API,” explained Yanir Tsarimi, a Cloud Security Researcher at Orca Security.

“In combination with an internal misconfiguration in the Glue internal service API, we were able to further escalate privileges within the account to the point where we had unrestricted access to all resources for the service in the region, including full administrative privileges.”
See Also: Complete Offensive Security and Ethical Hacking Course
The researchers added that their findings were uncovered using only Orca Security-owned AWS accounts and that they didn’t access information or data belonging to other AWS customers during their research.
https://www.bleepstatic.com/images/news/security/attack-flow.gif
While investigating the vulnerability, the researchers assumed roles trusted by the Glue service in other AWS customers’ accounts (every account with Glue access has at least one such role).

They were also able to query and alter AWS Glue service-related resources in an AWS region, including but not limited to metadata for Glue jobs, dev endpoints, workflows, crawlers, and triggers.

The AWS Glue service team reproduced and confirmed the flaw within hours after receiving Orca Security’s report and partially mitigated the issue globally by the following morning.
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Microsoft: New critical Windows HTTP vulnerability is wormable They deployed full mitigation for the Superglue vulnerability in just a few days, preventing potential attackers from accessing AWS Glue customers’ data.

Analysis of logs going back to the launch of the service have been conducted and we have conclusively determined that the only activity associated with this issue was between accounts owned by the researcher. No other customer’s accounts were impacted. All actions taken by AWS Glue in a customer’s account are logged in CloudTrail records controlled and viewable by customers. — AWS

AWS’ Security Team has also patched a second vulnerability found by Orca Security in the AWS CloudFormation service (dubbed BreakingFormation).

According to the researchers, this XXE (XML External Entity) flaw led to file and credential disclosure of internal AWS infrastructure services.

“Our research team believes, given the data found on the host (including credentials and dat[...]

___________________________
@hacking_Attack
@Hacking_Video

a involving internal endpoints), that an attacker could abuse this vulnerability to bypass tenant boundaries, giving them privileged access to any resource in AWS,” Orca Security’s Tzah Pahima added.

However, AWS VP Colm MacCárthaigh denied the security firm’s claims, saying that the BreakingFormation bug could have only been used to access host-level credentials and that AWS CloudFormation hosts don’t have access to resources in all AWS accounts.
See Also: Offensive Security Tool: Osmedeus O.k. here's my quick synopsis of this issue: @orcasec discovered and reported an issue that lead to SSRF on hosts and could fetch some local host-level creds and configuration. Great find! 1/n https://t.co/R2UsSrOdZ7

— Colm MacCárthaigh (@colmmacc) January 13, 2022
See Also: Hacking stories – Rafael Núñez (aka RaFa), hacking NASA with the hacking group: World of Hell
Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/image-apple-releases-15-2-1-update-for-ios-and-ipados-to-fix-bugs-164203308032302-90x90.jpg Apple fixes doorLock bug that can disable iPhones and iPads1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/0_Windows-headpic-90x90.jpg Microsoft: New critical Windows HTTP vulnerability is wormable2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/powerdir-exploit-microsoft-90x90.jpg Microsoft: powerdir bug gives access to protected macOS user data3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/using-npm-create-javascript-icon-libraries-90x90.png Dev corrupts NPM libs ‘colors’ and ‘faker’ breaking thousands of apps4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-7-90x90.jpg Partially Unpatched VMware Bug Opens Door to Hypervisor Takeover7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Apple-iPhone-13-Pro-90x90.png iOS malware can fake iPhone shut downs to snoop on camera, microphone1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/0358ad020c37-article-cache-poisoning-article-90x90.png Researcher discovers 70 web cache poisoning vulnerabilities, nets $40k in bug bounty rewards1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/1200x0-90x90.jpg Apple iOS vulnerable to HomeKit ‘doorLock’ denial of service bug1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/exchange-90x90.png Microsoft releases emergency fix for Exchange – 2022 bug2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/maxresdefault-90x90.jpg Have I Been Pwned adds 441K accounts stolen by RedLine malware2 weeks ago
The post AWS fixes security flaws that exposed AWS customer data first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Why do I keep receiving "Bitcoin" e-mails?

So I invested some money into crypto and I started receiving e-mails from scam "Bitcoin investors", "metamask support", "trust wallet support" etc. How do they know that I use those? I don't think everyone gets these kind of email's so where does the sender of the email know from that I use these different services? Does anyone here care to explain how something like this works like?

submitted by /u/Humongous_Ego
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is malware analysis?

https://cdn-images-1.medium.com/max/742/1*BXZKK51ZUDa_ZinUEKg-CA.png
It sounds great right? But what is malware, how the bad guys use it and what is so important today?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top 10 Instagram accounts on Cybersecurity to follow in 2022

https://cdn-images-1.medium.com/max/2600/0*Y-QNp-L6n2zdyW-K
Hey Everyone! Welcome to my blog, I hope you all are doing good. In this article I will list all the best instagram accounts to follow on…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Les 10 comptes instagram sur la cybersécurité à suivre

https://cdn-images-1.medium.com/max/2600/0*oBvLdzN2dP5FHUzm
1. Cyber Courses

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Raven - Advanced Cyber Threat Map (Simplified, Customizable, Responsive)
http://www.kitploit.com/2022/01/raven-advanced-cyber-threat-map.html

___________________________
@hacking_Attack
@Hacking_Video

Raven - Advanced Cyber (https://www.kitploit.com/search/label/Cyber) Threat (https://www.kitploit.com/search/label/Threat) Map (Simplified, customizable (https://www.kitploit.com/search/label/Customizable) and responsive. It uses D3.js with TOPO JSON, has 247 countries, ~100,000 cities, and can be used in an isolated environment without external lookups!.
Live - Demo https://qeeqbox.github.io/raven/ (https://qeeqbox.github.io/raven/index.html) Offline - Demo

___________________________
@hacking_Attack
@Hacking_Video

Features Uses D3.js (Not Anime.js) Active threat map (Live and replay) IP, country, city, and port info for each attack Attacks stats for countries (Only known attacks) Responsive interface (Move, drag, zoom in and out) Customize options for countries and cites 247 countries are listed on the interface (Not 174) Optimized worldmap for faster rendering Includes IP lookup, port information Random simulation (https://www.kitploit.com/search/label/Simulation) (IP, country, city) Can be used online or offline (Static) Theme picker module Functions Init the worldmap qb_raven_map() //raven object constructor takes the following:

svg_id //SVG ID
world_type //round or 2d
selected_countries = [] //List of ISO_3166 alpha 2 countries that will be selected
remove_countries = [] //List of ISO_3166 alpha 2 countries that will be removed from the map
height //height of the worldmap
width //width of the worldmap
orginal_country_color //Hex color for all countries
clicked_country_color //Hex color will be applied to any clickable countries
selected_country_color //Hex color will be applied to any selected countries
countries_json_location //Countries JSON file (qcountries.json)< br/>cities_json_location //Cities JSON file (qcities.json)
global_timeout //Global timeout for animation
db_length //Size of the db that stores attack events
global_stats_limit //Limit attack stats of a country
verbose //Verbose output should be off unless (use only for debugging)

raven = new qb_raven_map("#qb-worldmap-svg", null, [], ["aq"], window.innerHeight, window.innerWidth, "#4f4f4f", "#6c4242", "#ff726f", "qcountries.json", "qcities.json", 2000, 100, 10, true)

raven.init_world() //Init the worldmap (The worldmap should be ready for you to use at this point) Plotting data raven.add_marker_by_name() //Plot info by country or city name
raven.add_marker_by_ip() //Plot data by IP address
raven.add_marker_by_coordinates() //Plot data by coordinates

marker_object //An object {'from':'','to':""} see examples
colors_object //An object {'line: {'from': ''#FF0000','to': 'FF0000'}} this the color of the line between 2 points - (if null, then a random color will be picked)
timeout //Animation time out
marker = [] //A list of animation marker, use ['line'] for now

raven.add_marker_by_name({'from':'seattle,wa,us','to':'delhi,in'},{'line':{'from':null,'to':null}},2000,['line'])
raven.add_marker_by_ip({'from':'0.0.0.0','to':'0.0.0.0:53'},{'line': {'from':'#FF0000','to':'#FF0000'}},1000,['line')
raven.add_marker_by_coordinates({'from':['-11.074920','-51.648929'],'to':['51.464957','-107.583864']},{'line':{'from':null,'to':'#FFFF00'}},1000,['line']) Plotting data + adding it to the output table raven.add_to_data_to_table() //Plot info and add them to the output table

method //Name, IP or coordinates
marker_object //An object {'from':'','to':""} see examples
colors_object //An object {'line: {'from': ''#FF0000','to': 'FF0000'}} this the color of the line between 2 points - (if null, then a random color will be picked)
timeout //Animation time out
marker = [] //A list of animation marker, use ['line'] for now

raven.add_to_data_to_table('name',{'from':'seattle,wa,us','to':'delhi,in'},{'line':{'from':null,'to':null}},2000,['line'])
raven.add_to_data_to_table('ip',{'from':'0.0.0.0','to':'0.0.0.0:3389'},{'line':{'from':'#FF0000','to':'#FF00 00'}},1000,['line')

___________________________
@hacking_Attack
@Hacking_Video

raven.add_to_data_to_table('coordinates',{'from':['-11.074920','-51.648929'],'to':['51.464957','-107.583864']},{'line':{'from':null,'to':'#FFFF00'}},1000,['line']) Timeline Optimize the IP filters <- queued for testing (https://www.kitploit.com/search/label/Testing) (If you run this in an isolated environment, it should not be an issue) Add Theme Picker Resources Wikipedia, naturalearthdata, d3.js, topojson, jquery, font-awesome, OSINT package, iana, geonames, AFRINIC, APNIC, ARIN, LACNIC and RIPE Let me know if I missed a reference or resource! Disclaimer\Notes The dark grey style is typical in my projects (You can change that if you want) If you need help improving your world map or cyber threat map, reach out, and I might be able to help you! Please spend some time in understanding how this project works before opening any issues or leaving any inquiries or comments If you want to see other examples of worldmaps that DO NOT have all the features listed in this project (Google image search -> world map dark grey)

Download Raven (https://github.com/qeeqbox/raven)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Stacs : Static Token And Credential Scanner

Stacs is a YARA powered static credential scanner which supports binary file formats, analysis of nested archives, composable rulesets and ignore lists, and SARIF reporting. What does STACS support?

Currently, STACS supports recursive unpacking of tarballs, gzips, bzips, zips, 7z, iso, rpm and xz files. As STACS works on detected file types, rather than the filename, propriatary file formats based on these types are automatically supported (such as Docker images, Android APKs, and Java JAR fles). Who should use STACS?

STACS is designed for use by any teams who release binary artifacts. STACS provides developers the ability to automatically check for accidental inclusion of static credentials and key material in their releases.

However, this doesn’t mean STACS can’t help with SaaS applications, enterprise software, or even source code!

As an example, STACS can be used to find static credentials in Docker images uploaded to public and private container registries. It can also be used to find credentials accidentally compiled in to executables, packages for mobile devices, and “enterprise archives” – such as those used by Java application servers. How does it work?

STACS detects static credentials using “rule packs” provided to STACS when run. These rule packs define a set of YARA rules to run against files provided to STACS. When a match against a rule is found, a “finding” is generated. These findings represent potential credentials inside of a file, and are reported on for a developer to remediate or “ignore”.

If the finding is found to be a false positive – that is, a match on something other than a real credential – the developer can generate a set of “ignore lists” to ensure that these matches don’t appear in future reports.

The real power from STACS comes from the automatic detection and unpacking of nested archives, and composable ignore lists and rule packs. Ignore lists?

In order to allow flexible and collaborative usage, STACS supports composable ignore lists. This allows for an ignore list to include other ignore lists which enable composition of a “tree of ignores” based on organisational guidelines. These ignore lists are especially useful in organisations where many of the same frameworks or products are used. If a team has already marked a finding as a false positive, other teams get the benefit of not having to triage the same finding. Rule packs?

In the same manner as ignore lists, rule packs are also composable. This enables an organisation to define a baseline set of rules for use by all teams, while still allowing teams to maintain rulesets specific to their products. How do I use it?

The easiest way to use STACS is using the Docker images published to Docker Hub. However, STACS can also be installed directly from Python’s PyPI, or by cloning this repository. See the relevant sections below to get started!

A cloud based service is coming soon which allows integration directly in build and release pipelines to enable detection of static credentials before release! Docker

Using the published images, STACS can be used to scan artifacts right away! The STACS Docker images provides a number of volume mounts for files wanted to be scanned to be mounted directly into the scan container.

As an example, to scan everything in the current folder, the following command can be run (Docker must be installed).

docker run \
–rm \
–mount type=bind,source=$(pwd),target=/mnt/stacs/input \
stacscan/stacs:latest

By default, STACS will output any findings in SARIF format directly to STDOUT and in order to keep things orderly, all log messages will be sent to STDERR. For more advanced use cases, a number of other volume mounts are provided. These allow the user to control the rule packs, ignore lists, and a cache directories to use. PyPi

STACS ca[...]

___________________________
@hacking_Attack
@Hacking_Video

n also be installed directly from Python’s PyPi. This provides a stacscommand which can then be used by developers to scan projects directly in their local development environments.

STACS can be installed directly from PyPi using:

pip install stacs Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
ThreadBoat : Program Uses Thread Execution Hijacking To Inject Native Shell-code Into A Standard Win32 Application

ThreadBoat is a Program uses Thread Hijacking to Inject Native Shellcode into a Standard Win32 Application.

About

I developed this small project to continue my experiences of different code injection methods and to allow RedTeam security professionals to utilize this method as a unique way to perform software penetration testing. With Thread hijacking, it allows the hijacker.exe program to susepend a thread within the target.exe program allowing us to write shellcode to that target thread, and later be executed (via; WriteProcessMemory(), SetThreadContext(), ResumeThread(), CreateThread()).

Example GIF (Credits To Endgame)
https://blogger.googleusercontent.com/img/a/AVvXsEirSHxMxNwF5KmUw5oEQMobIsnih0D4pqb_uUL47Ab7v3UVuVOlcg3pba7R4cIKABISJrMdRJYEgWt9meeQgKoqYhvoUoVdJL5UmpmJhIbtAzSYbJ6llJwbDEU8h4FiMh9srkg7aB0nAg4lnztQOTfDop6CLe11qb61nVHP3n9hyWpiER3I4DHgRhYi=s640
Usage

int main()
{
System sys;
Interceptor incp;
Exception exp;
sys.returnVersionState();
if (sys.returnPrivilegeEscalationState())
{
std::cout <<
}
if (DWORD m_procId = incp.FindWin32ProcessId((PCHAR)m_win32ProcessName))
{
incp.ExecuteWin32Shellcode(m_procId);
}
system(“PAUSE”);
return 0;
}

Environment

* Windows Vista+sssss
* Visual C++

Libs

* Winapi
* user32.dll
* kernel32.dll

* ntdll.dll
Download

___________________________
@hacking_Attack
@Hacking_Video