Hacking Articles Tips Tricks Videos Tutorials

9 views13:53

Anti-Cheat Systems: Security through Obscurity

Hacking on Medium
Anti-Cheat Systems: Security through Obscurity

https://cdn-images-1.medium.com/max/1110/0*Ht0aNT9fvx_PMzhJ.jpg
Anti-cheat solutions are a common sight in online games. Most studios even have their own proprietary anti-cheat system.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Anti-cheat solutions are a common sight in online games. Most studios even have their own proprietary anti-cheat system.

10 viewsedited 13:53

8 views13:53

Vulnerability Capstone — Tryhackme

Hacking on Medium
Vulnerability Capstone — Tryhackme

https://cdn-images-1.medium.com/max/2600/0*t9yz4dzMCbnMAvBx
Vulnerability Researching

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Vulnerability Researching

10 viewsedited 13:53

10 views13:59

Kali Linux Tutorials
IAM Vulnerable : Use Terraform To Create Your Own Vulnerable By Design AWS IAM Privilege Escalation Playground

IAM Vulnerable is to use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground.. IAM Vulnerable uses the Terraform binary and your AWS credentials to deploy over 250 IAM resources into your selected AWS account. Within minutes, you can start learning how to identify and exploit vulnerable IAM configurations that allow for privilege escalation.

Recommended Approach

1. Select or create an AWS account – Do NOT use an account that has any production resources or sensitive data.
2. Create your vulnerable playground – Use this repo to create the IAM principals and policies that support 31 unique AWS IAM privesc paths.
3. Do your homework – Learn about the 21 original privesc paths pioneered by Spencer Gietzen.
4. Hacky, hack – Practice exploitation in your new playground using Gerben Kleijn’s guide.
5. Level up – Run your tools against your new IAM privesc playground account (i.e., Cloudsplaining, AWSPX, Principal Mapper, Pacu).

Quick Start

This quick start outlines an opinionated approach to getting IAM Vulnerable up and running in your AWS account as quickly as possible. You might have many of these steps already completed, or you might want to tweak things to work with your current configuration. Check out the Other Use Cases section in this repository for some additional configuration options.

1. Select or create an AWS account. (Do NOT use an account that has any production resources or sensitive data!)
2. Create a non-root user with administrative access that you will use when running Terraform.
3. Create an access key for that user.
4. Install the AWS CLI.
5. Configure your AWS CLI with your newly created admin user as the default profile.
6. Confirm your CLI is working as expected by executing aws sts get-caller-identity.
7. Install the Terraform binary and add the binary location to your path.
8. git clone https://github.com/BishopFox/iam-vulnerable9. cd iam-vulnerable/10. terraform init11. (Optional) export TF_VAR_aws_local_profile=PROFILE_IN_AWS_CREDENTIALS_FILE_IF_OTHER_THAN_DEFAULT12. (Optional) export TF_VAR_aws_local_creds_file=FILE_LOCATION_IF_NON_DEFAULT13. (Optional) terraform plan14. terraform apply15. (Optional) Add the IAM vulnerable profiles to your AWS credentials file, and change the account number.
* The following commands make a backup of your current AWS credentials file, then takes the example credentials file from the repo and replaces the placeholder account with your target account number, and finally adds all of the IAM Vulnerable privesc profiles to your credentials file so you can use them:
* cp ~/.aws/credentials ~/.aws/credentials.backup*

tail -n +7 aws_credentials_file_example | sed s/111111111111/$(aws sts get-caller-identity | grep Account | awk -F\" '{print $4}')/g >> ~/.aws/credentials

Cleanup

Whenever you want to remove all of the IAM Vulnerable-created resources, you can run these commands:

1. cd iam-vulnerable/2. terraform destroyWhat resources were just created?

The Terraform binary just used your default AWS account profile credentials to create:

* 31 users, roles, and policies each with a unique exploit path to administrative access of the playground account
* Some additional users, groups, roles, and policies that are required to fully realize certain exploit paths
* Some additional users, roles, and policies that test the detection capabilities of other tools

By default, every role created by this Terraform module is assumable by the user or role you used to run Terraform.

* If you’d like Terraform to use a profile other than the default pr[...]

___________________________
@hacking_Attack
@Hacking_Video

IAM Vulnerable : Use Terraform To Create Your Own Vulnerable

IAM Vulnerable is to use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground.

13 viewsedited 13:59

Kali Linux Tutorials IAM Vulnerable : Use Terraform To Create Your Own Vulnerable By Design AWS IAM Privilege Escalation Playground IAM Vulnerable is to use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground.. IAM Vulnerable…

ofile, or you’d like to hard-code the assume_role_policyARN, see Other Use Cases. How much is this going to cost?

Deploying IAM vulnerable in its default configuration will cost nothing. See the next section to learn how to enable non-default modules that do incur cost, and how much each module will cost per month if you deploy it. A Modular Approach

IAM Vulnerable groups certain resources together in modules. Some of the modules are enabled by default (the ones that don’t have any cost implications), and others are disabled by default (the ones that incur cost if deployed). This way, you can enable specific modules as needed.

For example, when you are ready to play with the exploit paths like ssm:StartSessionthat involve resources outside of IAM, you can deploy and tear down these resources on demand by uncommenting the module in the iam-vulnerable/main.tffile, and re-running terraform apply:

Uncomment the next four lines to create an ec2 instance and related resources
module “ec2” {
source = “./modules/non-free-resources/ec2”
aws_assume_role_arn = (var.aws_assume_role_arn != “” ? var.aws_assume_role_arn : data.aws_caller_identity.current.arn)
}

After you uncomment the ec2module, run:

terraform init
terraform apply

You have now deployed the required components to try the SSM privesc paths. Free Resource Modules

There is no cost to anything deployed within free-resources:
NameDefault StatusEstimated CostDescriptionprivesc-pathsEnabledNoneContains all of the IAM privesc pathstool-testingEnabledNoneContains test cases that evaluate the capabilities of the different IAM privesc tools Non-free Resource Modules

Deploying these additional modules can result in cost:
NameDefault StatusEstimated CostDescriptionRequired forEC2Disabledhttps://s.w.org/images/core/emoji/13.1.0/72x72/1f4b2.png
$4.50/monthCreates an EC2 instance and a security group that allows SSH from anywheressm-SendCommand ssm-StartSessionec2InstanceConnect-SendSSHPublicKeyLambdaDisabledhttps://s.w.org/images/core/emoji/13.1.0/72x72/1f642.png
Monthly cost depends on usage (cost should be zero)Creates a Lambda functionLambda-EditExistingLambdaFunctionWithRoleGlueDisabledhttps://s.w.org/images/core/emoji/13.1.0/72x72/1f4b2.png https://s.w.org/images/core/emoji/13.1.0/72x72/1f4b2.png https://s.w.org/images/core/emoji/13.1.0/72x72/1f4b2.png https://s.w.org/images/core/emoji/13.1.0/72x72/1f4b2.png
$4/hourCreates a Glue dev endpointGlue-UpdateExistingGlueDevEndpointSageMakerDisabledNot sure yetCreates a SageMaker notebooksageMakerCreatePresignedNotebookURLCloudFormationDisabledhttps://s.w.org/images/core/emoji/13.1.0/72x72/1f642.png
$0.40/month for the secret created via CloudFormation. Nothing or barely nothing for the stack itselfCreates a CloudFormation stack that creates a secret in secret managerprivesc-cloudFormationUpdateStack Supported Privilege Escalation Paths
Path NameIAM Vulnerable Profile NameNon-Default Modules RequiredExploitation ReferencesCategory: IAM Permissions on Other UsersIAM-CreateAccessKeyprivesc4Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 04
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 3IAM-CreateLoginProfileprivesc5Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 05
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 3IAM-UpdateLoginProfileprivesc6Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 06
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 3Category: PassRole to ServiceCloudFormation-PassExistingRoleToCloudFormationprivesc20Nonehttps://s.w.org/imag[...]

___________________________
@hacking_Attack
@Hacking_Video

11 viewsedited 13:59

ofile, or you’d like to hard-code the assume_role_policyARN, see Other Use Cases. How much is this going to cost? Deploying IAM vulnerable in its default configuration will cost nothing. See the next section to learn how to enable non-default modules that…

es/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 20CodeBuild-CreateProjectPassRoleprivesc-codeBuildProjectNoneDataPipeline-PassExistingRoleToNewDataPipelineprivesc21Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 21EC2-CreateInstanceWithExistingProfileprivesc3Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 03
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 2Glue-PassExistingRoleToNewGlueDevEndpointprivesc18Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 18Lambda-PassExistingRoleToNewLambdaThenInvokeprivesc15Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 15Lambda-PassRoleToNewLambdaThenTriggerprivesc16Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 16SageMaker-CreateNotebookPassRoleprivesc-sageNotebookNonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98f.png AWS IAM Privilege Escalation – Method 2SageMaker-CreateTrainingJobPassRoleprivesc-sageTrainingNoneSageMaker-CreateProcessingJobPassRoleprivesc-sageProcessingNoneCategory: Permissions on PoliciesIAM-AddUserToGroupprivesc13Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 13IAM-AttachGroupPolicyprivesc8Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 08IAM-AttachRolePolicyprivesc9Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 09IAM-AttachUserPolicyprivesc7Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 07IAM-CreateNewPolicyVersionprivesc1Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 01
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 1IAM-PutGroupPolicyprivesc11Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 11IAM-PutRolePolicyprivesc12Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 12IAM-PutUserPolicyprivesc10Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 10IAM-SetExistingDefaultPolicyVersionprivesc2Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 02
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 2Category: Privilege Escalation using AWS ServicesEC2InstanceConnect-SendSSHPublicKeyprivesc-instanceConnectEC2CloudFormation-UpdateStackprivesc-cfUpdateStackCloudFormationGlue-UpdateExistingGlueDevEndpointprivesc19Gluehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 19Lambda-EditExistingLambdaFunctionWithRoleprivesc17Lambdahttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 17
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 4SageMakerCreatePresignedNotebookURLprivesc-sageUpdateURLSagemakerhttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98f.png AWS IAM Privilege Escalation – Method 3SSM-SendCommandprivesc-ssm-commandEC2SSM-StartSessionprivesc-ssm-sessionEC2STS-AssumeRoleprivesc-assumeroleNoneCategory: Updating an AssumeRole PolicyIAM-UpdatingAssumeRolePolicyprivesc14Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 14 Other Use Cases Default – No terraform.tfvarsconfigured* Deploy using your default AWS profile (Default)
* All created roles are assumable by the principal used to run Terraform (specified in your default profile) Use a profile other than the default to run Terraform*[...]

___________________________
@hacking_Attack
@Hacking_Video

7 viewsedited 13:59

7 views13:59

7 views13:59

Kali Linux Tutorials
AirStrike : Automatically Grab And Crack WPA-2 Handshakes With Distributed Client-Server Architecture

AirStrike is a tool that automates cracking of WPA-2 Wi-Fi credentials using client-server architecture.

Requirements

Airstrike uses Hashcat Brain Architecture, aircrack-ngsuite, entrutility and some helper scripts.

You can use install.shscript to download all dependencies (if you’re on system which has an access to apt or pacman, but if you’re using Gentoo, you’d have to install hcxtools by hand, they’re not available in their repos, or maybe I’ve missed something. Some other uncommon distros are not included, for example Alpine doesn’t have hashcat package, but if you’re distro is exotic, you can use Nix on that, all needed packages are in nixpkgs.)

If you’re using Nix/NixOS, you can jump into Nix-Shell with needed dependencies with: nix-shell -p hashcat hashcat-utils aircrack-ng entr hcxtools

Usage

Run aircrack_server.shon the machine on which you want to crack passwords. This script builds aircrack_client.shfile, which can be executed on any Linux host that is able to connect with the server started earlier. Upon execution, the client automatically captures handshakes, connects with the server and sends captured data.

Whenever a password is successfully cracked by the server, the watcher.shscript prints it out to terminal on the server side.

The only required option flag for airstrike_client.shis the -wflag: it specifies the wordlist that should be used by the server. Listening interface can be specified with -iflag. By default, a current wireless interface is automatically selected. Additionally, airstrike_client.shlistens for WPA-2 data without any filter, so it will capture and crack all of the passwords of all Wi-Fi networks in range (whenever handshakes are exchanged).

Navigation

Ctrl + Swill send captured assets (Wi-Fi handshakes in .hccapxform) to the server. Ctrl + Idisplays information about capture progress.

Above shortcuts can be used inside a running instance of airstrike_client.sh
Download

___________________________
@hacking_Attack
@Hacking_Video

AirStrike : Automatically Grab And Crack WPA-2 Handshakes

AirStrike is a tool that automates cracking of WPA-2 Wi-Fi credentials using client-server architecture. It uses Hashcat Brain Architecture

6 viewsedited 13:59

5 views13:59

Copy terraform.tfvars.exampleto terraform.tvvars* Uncomment the line #aws_local_profile = "profile_name"and enter the profile name you’d like to use
* If you are using a non-default profile, and still want to use the aws_credentails_file_examplefile, you can use this command to generate an AWS credentials file that works with your non-default profile name (Thanks @scriptingislife)
* Remember to replace nondefaultuserwith the profile name you are using):
*

tail -n +7 aws_credentials_file_example | sed -e "s/111111111111/$(aws sts get-caller-identity | grep Account | awk -F\" '{print $4}')/g;s/default/nondefaultuser/g" >> ~/.aws/credentials

Use an ARN other than the caller as the principal that can assume the newly created roles* Copy terraform.tfvars.exampleto terraform.tvvars* Uncomment the line #aws_assume_role_arn = "arn:aws:iam::112233445566:user/you"and enter the ARN you’d like to use

Once created, each of the privesc roles will be assumable by the principal (ARN) you specified. Create the resource in account X, but use an ARN from account Y as the principal that can assume the newly created rolesIf you have configured AWS CLI profiles that assume roles into other accounts, you will want to specify the profile name AND manually specify the ARN you’d like to use to assume into the different roles.

In the example below, the resources will be created in the account that is tied to "prod-cross-org-access-role", but each role that Terraform creates can be accessed by "arn:aws:iam::112233445566:user/you", which belongs to another account.

aws_local_profile = “prod-cross-org-access-role”
aws_assume_role_arn = “arn:aws:iam::112233445566:user/you” Download

___________________________
@hacking_Attack
@Hacking_Video

7 viewsedited 13:59

Kali Linux Tutorials
Forbidden : Bypass 4Xx HTTP Response Status Codes

Forbidden is to Bypass 4xx HTTP response status codes. Based on PycURL.

Script uses multithreading, and is based on brute forcing so might have some false positives. Script uses colored output.

Results will be sorted by HTTP response status code ascending, content length descending, and ID ascending.

To filter out false positives, check each content length manually with the provided cURLcommand. If it does not results in bypass, just ignore all other results with the same content length.
TestScopeVarious HTTP methodsmethodVarious HTTP methods with ‘Content-Length: 0’ headermethodCross-site tracing (XST) with HTTP TRACE and TRACK methodsmethodFile upload with HTTP PUT methodmethodVarious HTTP method overridesmethod-overrideVarious HTTP headersheaderVarious URL overridesheaderURL override with two ‘Host’ headersheaderVarious URL path bypassespathVarious URL scheme overridesscheme-overrideBasic authentication/authorization including null sessionauthBroken URL parsersparser
Extend this script to your liking.

Good sources for HTTP headers:

* Common HTTP Response Headers

Tested on Kali Linux v2021.4 (64-bit).

Made for educational purposes. I hope it will help!

Future plans:

* add option to test only allowed HTTP methods,
* add option to test a specific/custom HTTP header for all the domains/subdomains,
* add option to test less common/application specific HTTP headers,
* separate HTTP headers in categories to reduce false positive results,
* do not ignore URL parameters and fragments.

How to Run

Open your preferred console from /src/ and run the commands shown below.

Install required tools:

apt-get install -y curl

Install required packages:

pip3 install -r requirements.txt

Run the script:

python3 forbidden.py

Be aware of rate limiting. Give it some time before you run the script again for the same domain in order to get better results.

Some websites require a user agent header. Download a user agent list from here.

Automation

Bypass 403 ForbiddenHTTP response status code:

count=0; for subdomain in $(cat subdomains_403.txt); do count=$((count+1)); echo “#${count} | ${subdomain}”; python3 forbidden.py -u “${subdomain}” -t method,method-override,header,path,scheme-override -f GET -o “forbidden_403_results_${count}.json”; done

Bypass 401 UnauthorizedHTTP response status code:

count=0; for subdomain in $(cat subdomains_401.txt); do count=$((count+1)); echo “#${count} | ${subdomain}”; python3 forbidden.py -u “${subdomain}” -t auth -f GET -o “forbidden_401_results_${count}.json”; done

Broken URL parser check:

count=0; for subdomain in $(cat subdomains_live_long.txt); do count=$((count+1)); echo “#${count} | ${subdomain}”; python3 forbidden.py -u “${subdomain}” -t parser -f GET -o “forbidden_parser_results_${count}.json”; done

HTTP Methods

ACL
ARBITRARY
BASELINE-CONTROL
BIND
CHECKIN
CHECKOUT
CONNECT
COPY
DELETE
GET
HEAD
INDEX
LABEL
LINK
LOCK
MERGE
MKACTIVITY
MKCALENDAR
MKCOL
MKREDIRECTREF
MKWORKSPACE
MOVE
OPTIONS
ORDERPATCH
PATCH
POST
PRI
PROPFIND
PROPPATCH
PUT
REBIND
REPORT
SEARCH
SHOWMETHOD
SPACEJUMP
TEXTSEARCH
TRACE
TRACK
UNBIND
UNCHECKOUT
UNLINK
UNLOCK
UPDATE
UPDATEREDIRECTREF
VERSION-CONTROL

HTTP Headers

Method override HTTP headers:

X-HTTP-Method
X-HTTP-Method-Override
X-Method-Override

HTTP headers:

Client-IP
Cluster-Client-IP
Connection
Contact
Forwarded
Forwarded-For
Forwarded-For-Ip
From
Host
Origin
Referer
Stuff
True-Client-IP
X-Client-IP
X-Custom-IP-Authorization
X-Forward
X-Forwarded
X-Forwarded-By
X-Forwarded-For
X-Forwarded-For-Original
X-Forwarded-Host
X-Forwarded-Server
X-Forward-For
X-Forwared-Host
X-Host
X-HTTP-Host-Override
X-Original-URL
X-Originat[...]

___________________________
@hacking_Attack
@Hacking_Video

Forbidden : Bypass 4Xx HTTP Response Status Codes

Forbidden is to Bypass 4xx HTTP response status codes. Based on PycURL. Script uses multithreading, and is based on brute forcing.

7 viewsedited 13:59

Kali Linux Tutorials
Toutatis : A Tool That Allows You To Extract Information From Instagram Accounts Such As E-Mails, Phone Numbers And More

Toutatis is a tool that allows you to extract information from instagrams accounts such as e-mails, phone numbers and more
For BTC Donations : 1FHDM49QfZX6pJmhjLE5tB2K6CaTLMZpXZ

Prerequisite

Python 3

Installation

With PyPI

pip install toutatis

With Github

git clone https://github.com/megadose/toutatis.git
cd toutatis/
python3 setup.py install

Usage

toutatis -u username -s instagramsessionid

Example

Informations about : xxxusernamexxx
Full Name : xxxusernamesxx | userID : 123456789
Verified : False | Is buisness Account : False
Is private Account : False
Follower : xxx | Following : xxx
Number of posts : x
Number of tag in posts : x
External url : http://example.com
IGTV posts : x
Biography : example biography
Public Email : public@example.com
Public Phone : +00 0 00 00 00 00
Obfuscated email : mes@examplemail.com

Obfuscated phone : +00 0xx xxx xx 00

Profile Picture : https://scontent-X-X.cdninstagram.com/
Download

___________________________
@hacking_Attack
@Hacking_Video

Toutatis : A Tool That Allows You To Extract Information From Instagram

Toutatis is a tool that allows you to extract information from instagrams accounts such as e-mails, phone numbers and more

5 viewsedited 13:59