hacking: security in practice
Why do I keep receiving "Bitcoin" e-mails?

So I invested some money into crypto and I started receiving e-mails from scam "Bitcoin investors", "metamask support", "trust wallet support" etc. How do they know that I use those? I don't think everyone gets these kind of email's so where does the sender of the email know from that I use these different services? Does anyone here care to explain how something like this works like?

submitted by /u/Humongous_Ego
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is malware analysis?

https://cdn-images-1.medium.com/max/742/1*BXZKK51ZUDa_ZinUEKg-CA.png
It sounds great right? But what is malware, how the bad guys use it and what is so important today?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top 10 Instagram accounts on Cybersecurity to follow in 2022

https://cdn-images-1.medium.com/max/2600/0*Y-QNp-L6n2zdyW-K
Hey Everyone! Welcome to my blog, I hope you all are doing good. In this article I will list all the best instagram accounts to follow on…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Les 10 comptes instagram sur la cybersécurité à suivre

https://cdn-images-1.medium.com/max/2600/0*oBvLdzN2dP5FHUzm
1. Cyber Courses

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Raven - Advanced Cyber Threat Map (Simplified, Customizable, Responsive)
http://www.kitploit.com/2022/01/raven-advanced-cyber-threat-map.html

___________________________
@hacking_Attack
@Hacking_Video

Raven - Advanced Cyber (https://www.kitploit.com/search/label/Cyber) Threat (https://www.kitploit.com/search/label/Threat) Map (Simplified, customizable (https://www.kitploit.com/search/label/Customizable) and responsive. It uses D3.js with TOPO JSON, has 247 countries, ~100,000 cities, and can be used in an isolated environment without external lookups!.
Live - Demo https://qeeqbox.github.io/raven/ (https://qeeqbox.github.io/raven/index.html) Offline - Demo

___________________________
@hacking_Attack
@Hacking_Video

Features Uses D3.js (Not Anime.js) Active threat map (Live and replay) IP, country, city, and port info for each attack Attacks stats for countries (Only known attacks) Responsive interface (Move, drag, zoom in and out) Customize options for countries and cites 247 countries are listed on the interface (Not 174) Optimized worldmap for faster rendering Includes IP lookup, port information Random simulation (https://www.kitploit.com/search/label/Simulation) (IP, country, city) Can be used online or offline (Static) Theme picker module Functions Init the worldmap qb_raven_map() //raven object constructor takes the following:

svg_id //SVG ID
world_type //round or 2d
selected_countries = [] //List of ISO_3166 alpha 2 countries that will be selected
remove_countries = [] //List of ISO_3166 alpha 2 countries that will be removed from the map
height //height of the worldmap
width //width of the worldmap
orginal_country_color //Hex color for all countries
clicked_country_color //Hex color will be applied to any clickable countries
selected_country_color //Hex color will be applied to any selected countries
countries_json_location //Countries JSON file (qcountries.json)< br/>cities_json_location //Cities JSON file (qcities.json)
global_timeout //Global timeout for animation
db_length //Size of the db that stores attack events
global_stats_limit //Limit attack stats of a country
verbose //Verbose output should be off unless (use only for debugging)

raven = new qb_raven_map("#qb-worldmap-svg", null, [], ["aq"], window.innerHeight, window.innerWidth, "#4f4f4f", "#6c4242", "#ff726f", "qcountries.json", "qcities.json", 2000, 100, 10, true)

raven.init_world() //Init the worldmap (The worldmap should be ready for you to use at this point) Plotting data raven.add_marker_by_name() //Plot info by country or city name
raven.add_marker_by_ip() //Plot data by IP address
raven.add_marker_by_coordinates() //Plot data by coordinates

marker_object //An object {'from':'','to':""} see examples
colors_object //An object {'line: {'from': ''#FF0000','to': 'FF0000'}} this the color of the line between 2 points - (if null, then a random color will be picked)
timeout //Animation time out
marker = [] //A list of animation marker, use ['line'] for now

raven.add_marker_by_name({'from':'seattle,wa,us','to':'delhi,in'},{'line':{'from':null,'to':null}},2000,['line'])
raven.add_marker_by_ip({'from':'0.0.0.0','to':'0.0.0.0:53'},{'line': {'from':'#FF0000','to':'#FF0000'}},1000,['line')
raven.add_marker_by_coordinates({'from':['-11.074920','-51.648929'],'to':['51.464957','-107.583864']},{'line':{'from':null,'to':'#FFFF00'}},1000,['line']) Plotting data + adding it to the output table raven.add_to_data_to_table() //Plot info and add them to the output table

method //Name, IP or coordinates
marker_object //An object {'from':'','to':""} see examples
colors_object //An object {'line: {'from': ''#FF0000','to': 'FF0000'}} this the color of the line between 2 points - (if null, then a random color will be picked)
timeout //Animation time out
marker = [] //A list of animation marker, use ['line'] for now

raven.add_to_data_to_table('name',{'from':'seattle,wa,us','to':'delhi,in'},{'line':{'from':null,'to':null}},2000,['line'])
raven.add_to_data_to_table('ip',{'from':'0.0.0.0','to':'0.0.0.0:3389'},{'line':{'from':'#FF0000','to':'#FF00 00'}},1000,['line')

___________________________
@hacking_Attack
@Hacking_Video

raven.add_to_data_to_table('coordinates',{'from':['-11.074920','-51.648929'],'to':['51.464957','-107.583864']},{'line':{'from':null,'to':'#FFFF00'}},1000,['line']) Timeline Optimize the IP filters <- queued for testing (https://www.kitploit.com/search/label/Testing) (If you run this in an isolated environment, it should not be an issue) Add Theme Picker Resources Wikipedia, naturalearthdata, d3.js, topojson, jquery, font-awesome, OSINT package, iana, geonames, AFRINIC, APNIC, ARIN, LACNIC and RIPE Let me know if I missed a reference or resource! Disclaimer\Notes The dark grey style is typical in my projects (You can change that if you want) If you need help improving your world map or cyber threat map, reach out, and I might be able to help you! Please spend some time in understanding how this project works before opening any issues or leaving any inquiries or comments If you want to see other examples of worldmaps that DO NOT have all the features listed in this project (Google image search -> world map dark grey)

Download Raven (https://github.com/qeeqbox/raven)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Stacs : Static Token And Credential Scanner

Stacs is a YARA powered static credential scanner which supports binary file formats, analysis of nested archives, composable rulesets and ignore lists, and SARIF reporting. What does STACS support?

Currently, STACS supports recursive unpacking of tarballs, gzips, bzips, zips, 7z, iso, rpm and xz files. As STACS works on detected file types, rather than the filename, propriatary file formats based on these types are automatically supported (such as Docker images, Android APKs, and Java JAR fles). Who should use STACS?

STACS is designed for use by any teams who release binary artifacts. STACS provides developers the ability to automatically check for accidental inclusion of static credentials and key material in their releases.

However, this doesn’t mean STACS can’t help with SaaS applications, enterprise software, or even source code!

As an example, STACS can be used to find static credentials in Docker images uploaded to public and private container registries. It can also be used to find credentials accidentally compiled in to executables, packages for mobile devices, and “enterprise archives” – such as those used by Java application servers. How does it work?

STACS detects static credentials using “rule packs” provided to STACS when run. These rule packs define a set of YARA rules to run against files provided to STACS. When a match against a rule is found, a “finding” is generated. These findings represent potential credentials inside of a file, and are reported on for a developer to remediate or “ignore”.

If the finding is found to be a false positive – that is, a match on something other than a real credential – the developer can generate a set of “ignore lists” to ensure that these matches don’t appear in future reports.

The real power from STACS comes from the automatic detection and unpacking of nested archives, and composable ignore lists and rule packs. Ignore lists?

In order to allow flexible and collaborative usage, STACS supports composable ignore lists. This allows for an ignore list to include other ignore lists which enable composition of a “tree of ignores” based on organisational guidelines. These ignore lists are especially useful in organisations where many of the same frameworks or products are used. If a team has already marked a finding as a false positive, other teams get the benefit of not having to triage the same finding. Rule packs?

In the same manner as ignore lists, rule packs are also composable. This enables an organisation to define a baseline set of rules for use by all teams, while still allowing teams to maintain rulesets specific to their products. How do I use it?

The easiest way to use STACS is using the Docker images published to Docker Hub. However, STACS can also be installed directly from Python’s PyPI, or by cloning this repository. See the relevant sections below to get started!

A cloud based service is coming soon which allows integration directly in build and release pipelines to enable detection of static credentials before release! Docker

Using the published images, STACS can be used to scan artifacts right away! The STACS Docker images provides a number of volume mounts for files wanted to be scanned to be mounted directly into the scan container.

As an example, to scan everything in the current folder, the following command can be run (Docker must be installed).

docker run \
–rm \
–mount type=bind,source=$(pwd),target=/mnt/stacs/input \
stacscan/stacs:latest

By default, STACS will output any findings in SARIF format directly to STDOUT and in order to keep things orderly, all log messages will be sent to STDERR. For more advanced use cases, a number of other volume mounts are provided. These allow the user to control the rule packs, ignore lists, and a cache directories to use. PyPi

STACS ca[...]

___________________________
@hacking_Attack
@Hacking_Video

n also be installed directly from Python’s PyPi. This provides a stacscommand which can then be used by developers to scan projects directly in their local development environments.

STACS can be installed directly from PyPi using:

pip install stacs Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
ThreadBoat : Program Uses Thread Execution Hijacking To Inject Native Shell-code Into A Standard Win32 Application

ThreadBoat is a Program uses Thread Hijacking to Inject Native Shellcode into a Standard Win32 Application.

About

I developed this small project to continue my experiences of different code injection methods and to allow RedTeam security professionals to utilize this method as a unique way to perform software penetration testing. With Thread hijacking, it allows the hijacker.exe program to susepend a thread within the target.exe program allowing us to write shellcode to that target thread, and later be executed (via; WriteProcessMemory(), SetThreadContext(), ResumeThread(), CreateThread()).

Example GIF (Credits To Endgame)
https://blogger.googleusercontent.com/img/a/AVvXsEirSHxMxNwF5KmUw5oEQMobIsnih0D4pqb_uUL47Ab7v3UVuVOlcg3pba7R4cIKABISJrMdRJYEgWt9meeQgKoqYhvoUoVdJL5UmpmJhIbtAzSYbJ6llJwbDEU8h4FiMh9srkg7aB0nAg4lnztQOTfDop6CLe11qb61nVHP3n9hyWpiER3I4DHgRhYi=s640
Usage

int main()
{
System sys;
Interceptor incp;
Exception exp;
sys.returnVersionState();
if (sys.returnPrivilegeEscalationState())
{
std::cout <<
}
if (DWORD m_procId = incp.FindWin32ProcessId((PCHAR)m_win32ProcessName))
{
incp.ExecuteWin32Shellcode(m_procId);
}
system(“PAUSE”);
return 0;
}

Environment

* Windows Vista+sssss
* Visual C++

Libs

* Winapi
* user32.dll
* kernel32.dll

* ntdll.dll
Download

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Offensive Security Tool: Ivy

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Offensive Security Tool: IvyPost Views: 110 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 5 Minutes

Offensive Security Tool: Ivy GitHub Link DescriptionStill, Social Engineering Attacks such as Phishing attacks that take place as part of an Offensive Security Solution require manually testing and crafting a payload that goes with the scenario. Although many FUDs (Fully Undetectable Payloads) in EXE formats can still be crafted, using VBS and Microsoft Office Files and this specific technique can bypass several mechanisms due to the way it executes arbitrary macro code into Visual Basic directly in Memory. The loader does this by utilizing programmatical access in the VBA object environment to load, decrypt and execute shellcode.

Ivy by optiv is a payload creation framework for the execution of arbitrary VBA (macro) source code in memory. Ivy’s loader does this by abusing programmatical access in the VBA object environment to load, decrypt, and execute shellcode. This technique is as close as possible to be truly fileless, as most fileless attacks these days require some sort of files being dropped on disk, as a result bypassing standard signature-based rules for detecting VBA code. Typical VBA payloads have the following characteristics:

* Exist in Macro enabled Office Documents
* These Macro Documents exist on disk
By running purely in memory, these behavior characteristics makes it harder to be detected by EDRs.

Ivy’s loaders are encrypted using RC4 encryption (AES encryption causes a lot of bloat and takes forever for VBA to decrypt) and then broken into separate strings, preventing any sandboxing from recognizing these strings as encrypted strings that should be investigated. This also prevents any decoding mechanism from recognizing these payloads as anything but garbage characters.

Ivy’s loader first performs a registry query to enable “Trust access to the VBA project object mode”. This registry key value is stored in user-mode which allows the user to modify the value without requiring any elevated permissions. The registry value is set from a zero to 1; if the registry key does not exist Ivy will create it with a value of “1”. With this value enabled, programmatical access is allowed to the VBA object environment from a different process.

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Trusted-Access.png

Once this is done the loader will then spawn a hidden Excel process and load the encrypted strings into a VBA function. This is done by using ActiveX to simulate the GUI actions of doing the same task. This helps bypass a lot of traditional controls in place to monitor for execution. As a result, the decrypt function and shellcode are moved from one memory buffer to another, never touching disk. Finally, the loader uses command-GUI calls and executes the run function, which simulates the act of clicking on the run macro button in the GUI panel of VBA, beginning the decryption function, followed by the actual execution of the shellcode. IMPORTANTThe target endpoint must have Microsoft Office installed and activated in order to run because Ivy relies on a abusing the programmatically access to the VBA environment of Microsoft office.
See Also: AWS fixes security flaws that exposed AWS customer data EDR Unhook ModeThis allows Ivy to use low-level system calls to build its own version of the Windows function WriteProcessMemory by referencing the direct memory address and register values indirectly. Ivy can overwrite sections of memory that are not writable without calling any of the memory ch[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Offensive Security Tool: Ivy

___________________________
@hacking_Attack
@Hacking_Video