Hacking Articles Tips Tricks Videos Tutorials
468 subscribers
65.8K photos
15 videos
157 files
132K links
Exploit
Pentesting
Hacking
Red Team
Blue Team
Kali Linux
Bug Bounty
Black Hat
Cyber security etc

@Hacking_Video
@Hacking_attack
Download Telegram
Hacking Articles Tips Tricks Videos Tutorials
mand to convert this p12 certificate into a pem file.<o:p "C:\Program Files\OpenSSL-Win64\bin\openssl.exe" pkcs12 -in ignite-DC1-CA.p12 -out newfile.pemHere, you need to enter the import password 12345. You can set a new password for this pem file. We kept…
X-HdGkuxHQbgVp_BTjNLnK35UM8F7EViMuppBwI1vb3f8q3ba3AahsuYslkhfcKFUO2zAHFDiY-bsAGfhyU5egpStXLeGjtOAPw=s16000 Extracting admin NTLM hash<o:pWith this ticket.kirbi, we can do pass the ticket attacks, extract NTLM hashes among other things. Since, we don’t know admin’s new password now, let us try to extract his credentials.<o:p

For that we will run mimikatz on user (windows 10 compromised non admin system on the AD), import the ticket.kirbi using Kerberos::ptt mmodule and then perform a DCSync attack. Since, the ticket is the domain admin’s ticket, we can perform functions that require elevated privileges.<o:p kerberos::ptt ticket.kirbi<o:plsadump::dcsync /domain:ignite.local /user:administrator<o:pThis gives us a fresh set of admin’s NTLM hash<o:p

<v:shape<v:imagedata<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjVfxxGlYn0_Z3LrOcWyI33tfm1AGEeiUxI0ZuUCi8GOHw-wO3HHxKA3-bin5WG1ZY5nxUuCUTgnGdH7rGG8bXlS8aBOOnw2O55fsUYc3kH1bJ7NQesLJF9XYS1Dli-E0tsiHNQEKLK9CH5GYgMUOMm64G-i6_DtV559CIVZxla3exxaHcpkhMP3Gn86A=s16000 Performing PtH (Pass the Hash) attack<o:pWe can further perform Pass the hash attack using these credentials, or crack them using john/hashcat. We head over to our Kali terminal and use pth-winexe binary, which is a part of the pass the hash toolkit by byt3bl33d3r. This comes built-in in new kali os.<o:p pth-winexe -U Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.188 cmd.exe<o:pAs you can see that we have added 32 bits of 0s before the hash we dumped. As from the release of Windows 10,Microsoft made a change that LM hashes are not used anymore. But the tools that we are going to use in the practical are being used since the old NT and LM times. So, in those tools, we will be using a string of 32 zeros instead of the LM hash.<o:p

Also, to be noted, when we say NTLM in modern times, we mean NTHash. NTLM is a common name that stuck around.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgZRtq1O93tTfC3pIC42mERPeAxmKA1MrGSPqhu81UF2OPaELM_JBkC8KgoZfRIz0_bgWLII9oARCnDxIVtYCo9dbsEv0VfahS9IMvAWd9wrHkK0EfyhtlRmsH5oZ3PrTsmBVwm6ZNATy7CzB7B3HdyyqZHRhvZFXV6pEl98EOqVIuhM_1pye5fqR-p9Q=s16000 <v:shape<v:imagedata<o:p

So, as you can see using the golden certificate, we were able to extract admin tickets, dump hashes and perform Pass the hash or pass the ticket attacks.<o:p Conclusion<o:p95% of the Fortune 500 companies are using Active Directory in one way or the other. Attackers or analysts often conduct pentest on the corporate AD. Golden certificate attack is a domain persistence attack that could allow an attacker upto an year of persistence on a compromised machine even if the admin password gets changed or new admins are added. It is a useful technique with a potential to have various other sub attacks in the future on ADCS. Hope you enjoyed the article. Thanks for reading.<o:p
Supply a list of dorks and, optionally, one of the following: a user (-u) a file with a list of users (-uf) an organization (-org) a file with a list of organizations (-of) a repo (-r) You can also pass: an output directory (https://www.kitploit.com/search/label/Directory) to store results (-o) a filename to store valid items, if your users or org file may contain nonexistent users/orgs (-vif) All input files (dorks, users, or orgs) should be newline-separated.
Usage Clone the repository, then run pip install -r requirements.txt The only required parameter is the dorks file (-d). See techguan's github-dorks.txt (https://github.com/techgaun/github-dorks/blob/master/github-dorks.txt) for ideas. If an output directory is specified, a file will be created for each dork in the dorks list, and results will be saved there as well as printed. Only use an empty/nonexistent directory or it will be cleared and its contents replaced. If your users or orgs files haven't already been filtered to remove non-existent users/orgs or those without any public code, it's highly recommended that you pass in a --valid-items-filename (-vif). This will filter out any invalid users/orgs when searching for the first dork, and avoid searching against them for subsequent dorks. The output file can also then be used as the input users/orgs file to speed up later script runs. Example usage: python gh-dork.py -d dorks.txt # Basic usage
python gh-dork.py -d dorks.txt -u molly # Search repos of a specific user
python gh-dork.py -d dorks.txt -uf users.txt # Search repos of all users in the list
python gh-dork.py -d dorks.txt -uf users.txt -vif valid_users.txt # Search repos of all users in the list, filtering out nonexistent users
python gh-dork.py -d dorks.txt -org github # Search repos of a specific organization
python gh-dork.py -d dorks.txt -of orgs.txt # Search repos of all orgs in the list
python gh-dork.py -d dorks.txt -of orgs.txt -vif valid_orgs.txt # Search repos of all orgs in the list, filtering out nonexistent orgs
pyth on gh-dork.py -d dorks.txt -r molly/gh-dork # Search the specified repo
python gh-dork.py -d dorks.txt -o results # Store results in files in the results/ directory, *overwriting any directory contents*
Authentication Authentication is done with environment variables. You can authenticate with a Github private access token (https://www.kitploit.com/search/label/Access%20Token) (GH_TOKEN), or username and password (GH_USER and GH_PASS). If you have two-factor (https://www.kitploit.com/search/label/Two-Factor) authentication (https://www.kitploit.com/search/label/Authentication) enabled, you will be prompted for a two-factor code. You can also pass a Github Enterprise base URL (GH_URL) to search against that Github instance; if omitted, this will run against github.com. If no credentials (https://www.kitploit.com/search/label/Credentials) are provided or if credentials are invalid, the script will still run, but will be limited by the much lower rate limits (https://docs.github.com/en/rest/reference/search) for unauthenticated users. Credits Loosely based on techgaun/github-dorks (https://github.com/techgaun/github-dorks).

Download Gh-Dork (https://github.com/molly/gh-dork)
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
Gh-Dork - Github Dorking Tool

https://blogger.googleusercontent.com/img/a/AVvXsEgzWtLotPeSL0AYg1-D5d_TytFdd4y03vIIl33p9-ra7Zw2RQ1AEi7sLvUeNZPKh9maTbUPAOjIFmdIt9qOIrlcrhpNhH4Du-OnmNrNz9Tu_SFpT7IkxkDg6Qzu63zWkEjxqLYeS_D8zmuEYuuGNEoPkkZLs8vOmAekB8TOtpX_ycrTDlMXPriuH6At=w640-h286 Supply a list of dorks and, optionally, one of the following:

* a user (-u)
* a file with a list of users (-uf)
* an organization (-org)
* a file with a list of organizations (-of)
* a repo (-r)

You can also pass:

* an output directory to store results (-o)
* a filename to store valid items, if your users or org file may contain nonexistent users/orgs (-vif)

All input files (dorks, users, or orgs) should be newline-separated. UsageClone the repository, then run pip install -r requirements.txtThe only required parameter is the dorks file (-d). See techguan's github-dorks.txt for ideas.

If an output directory is specified, a file will be created for each dork in the dorks list, and results will be saved there as well as printed. Only use an empty/nonexistent directory or it will be cleared and its contents replaced.

If your users or orgs files haven't already been filtered to remove non-existent users/orgs or those without any public code, it's highly recommended that you pass in a --valid-items-filename(-vif). This will filter out any invalid users/orgs when searching for the first dork, and avoid searching against them for subsequent dorks. The output file can also then be used as the input users/orgs file to speed up later script runs.

Example usage: python gh-dork.py -d dorks.txt # Basic usage
python gh-dork.py -d dorks.txt -u molly # Search repos of a specific user
python gh-dork.py -d dorks.txt -uf users.txt # Search repos of all users in the list
python gh-dork.py -d dorks.txt -uf users.txt -vif valid_users.txt # Search repos of all users in the list, filtering out nonexistent users
python gh-dork.py -d dorks.txt -org github # Search repos of a specific organization
python gh-dork.py -d dorks.txt -of orgs.txt # Search repos of all orgs in the list
python gh-dork.py -d dorks.txt -of orgs.txt -vif valid_orgs.txt # Search repos of all orgs in the list, filtering out nonexistent orgs
pyth on gh-dork.py -d dorks.txt -r molly/gh-dork # Search the specified repo
python gh-dork.py -d dorks.txt -o results # Store results in files in the results/ directory, *overwriting any directory contents*
AuthenticationAuthentication is done with environment variables. You can authenticate with a Github private access token (GH_TOKEN), or username and password (GH_USER and GH_PASS). If you have two-factor authentication enabled, you will be prompted for a two-factor code.

You can also pass a Github Enterprise base URL (GH_URL) to search against that Github instance; if omitted, this will run against github.com.

If no credentials are provided or if credentials are invalid, the script will still run, but will be limited by the much lower rate limits for unauthenticated users. CreditsLoosely based on techgaun/github-dorks. Download Gh-Dork
Gh-Dork - Github Dorking Tool

Supply a list of dorks and, optionally, one of the following: a user (-u) a file with a list of users (-uf) an organization (-org) a file with a list of organizations (-of) a repo (-r) You can also pass: an output directory to store results (-o) a filename to store valid items, if your users or org file may contain nonexistent users/orgs (-vif) All input files (dorks, users, or orgs) should be newline-separated. Usage Clone the repository, then run pip install -r requirements.txt The only required parameter is the dorks file (-d). See techguan's github-dorks.txt for ideas. If an output directory is specified, a file will be created for each dork in the dorks list, and results will be saved there as well as printed. Only use an empty/nonexistent directory or it will be cleared and its contents replaced. If your users or orgs files haven't already been filtered to remove non-existent users/orgs or those without any public code, it's highly recommended that you pass in a --valid-items-filename (-vif). This will filter out any invalid users/orgs when searching for the first dork, and avoid searching against them for subsequent dorks. The output file can also then be used as the input users/orgs file to speed up later script runs. Example usage: python gh-dork.py -d dorks.txt # Basic usagepython gh-dork.py -d dorks.txt -u molly # Search repos of a specific userpython gh-dork.py -d dorks.txt -uf users.txt # Search repos of all users in the listpython gh-dork.py -d dorks.txt -uf users.txt -vif valid_users.txt # Search repos of all users in the list, filtering out nonexistent userspython gh-dork.py -d dorks.txt -org github # Search repos of a specific organizationpython gh-dork.py -d dorks.txt -of orgs.txt # Search repos of all orgs in the listpython gh-dork.py -d dorks.txt -of orgs.txt -vif valid_orgs.txt # Search repos of all orgs in the list, filtering out nonexistent orgspyth on gh-dork.py -d dorks.txt -r molly/gh-dork # Search the specified repopython gh-dork.py -d dorks.txt -o results # Store results in files in the results/ directory, *overwriting any directory contents* Authentication Authentication is done with environment variables. You can authenticate with a Github private access token (GHTOKEN), or username and password (GHUSER and GHPASS). If you have two-factor authentication enabled, you will be prompted for a two-factor code. You can also pass a Github Enterprise base URL (GHURL) to search against that Github instance; if omitted, this will run against github.com. If no credentials are provided or if credentials are invalid, the script will still run, but will be limited by the much lower rate limits for unauthenticated users. Credits Loosely based on techgaun/github-dorks. Download Gh-Dork
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
CSRF attack for beginners

https://cdn-images-1.medium.com/max/711/1*5eFvD3up96eYBqy510apYw.png
CSRF is an abbreviation for Cross-Site Request Forgery where the attacker induces the user to perform malicious activities in the web…

Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Termux Instagram Infoga : Gather Instagram info with Termux

https://cdn-images-1.medium.com/max/600/0*UYN3PcHMDB_Eifzj
Hey Guys🙋‍♂️, , it takes Instagram is one of the most widely used more than an hour to figure out about someone’s most used tags and who…

Continue reading on Medium »