Hacking on Medium
The network data and utf-8 decoded text

https://cdn-images-1.medium.com/max/1080/1*AbxYh2MJLdkQvBkDe-y-OA.png
Today I want to share something about the network data and the utf-8 decoded text. I think we really should know what is going on during…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hack your Brain - DIY brain-computer interfaces have arrived

https://github.com/Ildaron/EEGwithRaspberryPI

submitted by /u/SpecificAd3444
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is port 4444 malicious?

I ran a netstat command on windows and found a destination port 4444. I searched web for what it was for but found keywords like malware , metasploit and trojan. So should I be worried? Ps: I am just a beginner student studying for comptia a+ so please excuse my tech lingo Update:- hey guys so i used tcpVeiw tool from sysinternals and found out process named firefox.exe is using port 4444 as remote port

submitted by /u/serverghost_exe
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is Ethical Hacking?

https://cdn-images-1.medium.com/max/2000/1*FbpCSKZbXm8bIDPtHgxyBg.png
We now live in a digital age, in which nearly everything is online and connected to the Internet. Keeping everything digital makes life a…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Dump Information for Process using GetTokenInformation
https://www.reddit.com/r/redteamsec/comments/sp2l5t/dump_information_for_process_using/

<!-- SC_OFF -->In this post, you will get a very thorough step-by-step walkthrough on building your own process token dumper in the c++ which will help you in knowing your target better before launching another post exploitation attack. https://tbhaxor.com/dumping-token-information-in-windows/ <!-- SC_ON --> submitted by /u/tbhaxor (https://www.reddit.com/user/tbhaxor)
[link] (https://www.reddit.com/r/redteamsec/comments/sp2l5t/dump_information_for_process_using/) [comments] (https://www.reddit.com/r/redteamsec/comments/sp2l5t/dump_information_for_process_using/)

Black Hat Ethical Hacking
PHP Everywhere RCE flaws threaten thousands of WordPress sites

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png PHP Everywhere RCE flaws threaten thousands of WordPress sitesPost Views: 176 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute
Researchers found three critical remote code execution (RCE) vulnerabilities in the ‘PHP Everywhere’ plugin for WordPress, used by over 30,000 websites worldwide.
PHP Everywhere is a plugin that allows WordPress admins to insert PHP code in pages, posts, the sidebar, or any Gutenberg block, and use it to display dynamic content based on evaluated PHP expressions. Three RCE flawsThe three vulnerabilities were discovered by security analysts at Wordfence and can be exploited by contributors or subscribers, affecting all WordPress versions from 2.0.3 and below.

Here’s a short description of the flaws:

* CVE-2022-24663 – Remote code execution flaw exploitable by any subscriber  by allowing them to send a request with the ‘shortcode’ parameter set to PHP Everywhere, and execute arbitrary PHP code on the site. (CVSS v3 score: 9.9)
* CVE-2022-24664 – RCE vulnerability exploitable by contributors via the plugin’s metabox. An attacker would create a post, add a PHP code metabox, and then preview it. (CVSS v3 score: 9.9)
* CVE-2022-24665 – RCE flaw exploitable by contributors who have the ‘edit_posts’ capability and can add PHP Everywhere Gutenberg blocks. Default security setting on vulnerable plugin versions isn’t on ‘admin-only’ as it should be. (CVSS v3 score: 9.9)

While the last two flaws aren’t easily exploitable as they require contributor-level permissions, the first vulnerability is a lot more open to broader exploitation as it can be exploited by just being a subscriber on the site.

For example, a logged-in customer on a site is considered a ‘subscriber,’ so merely registering on the target platform would be enough to gain enough privileges for malicious PHP code execution.

In all cases, executing arbitrary code on a site can lead to a complete site takeover, which is the worst possible scenario in website security.
See Also: Complete Offensive Security and Ethical Hacking Course Fix only for Block editorWordfence’s team discovered the vulnerabilities on January 4, 2022, and informed the author of PHP Everywhere of its findings.

The vendor released a security update on January 10, 2022, with version 3.0.0, which took a major version number bump because it required a substantial code rewrite.

While the developers fixed the update last month, it is not uncommon for admins to not regularly update their WordPress site and plugins. According to the download stats on WordPress.org, only 15,000 installs out of 30,000 have updated the plugin since the bugs were fixed.
See Also: Windows vulnerability with new public exploits lets you become admin Therefore, due to the severity of these vulnerabilities, all users of PHP Everywhere are strongly advised to make sure they have upgraded to PHP Everywhere version 3.0.0, which is the latest available at this time.

Note that if you’re using the Classic Editor on your site, you will need to uninstall the plugin and find another solution for hosting custom PHP code on its components.

That is because version 3.0.0 only supports PHP snippets via the Block editor, and it’s unlikely that the author will work on restoring functionality for the sun-setting Classic.
See Also: Offensive Security Tool: Stratus Red Team
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, O[...]

ffensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: How ILOVEYOU worm became the first global computer virus pandemic Source: www.bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/178-706-450-android-patch-770x439_c-90x90.jpg Google fixes remote escalation of privileges bug on Android1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/ezgif.com-gif-maker-4-90x90.jpg Qbot needs only 30 minutes to steal your credentials, emails2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/364-3648628_google-drive-90x90.jpg Google Drive integration errors created SSRF flaws in multiple applications3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/ezgif.com-gif-maker-3-90x90.jpg Cisco patches critical vulnerabilities in SMB routers, exploitation available6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/b2b-90x90.jpg ESET antivirus bug let attackers gain Windows SYSTEM privileges1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/image6-90x90.png Cloudflare launches a paid public bug bounty program1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/do-any-web-page-convert-into-elementor-pro-template-90x90.jpg 600K WordPress sites impacted by critical plugin RCE vulnerability1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/hacking-windows-10-evade-detection-netstat-tasklist.1280x600-90x90.jpg Windows vulnerability with new public exploits lets you become admin1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ryanpickrenapplehack-768x768-1-90x90.jpg Apple pays out $100k bounty for Safari webcam hack that imperiled victims’ online accounts2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Apple-glitch-90x90.jpg Apple fixes new zero-day exploited to hack macOS, iOS devices2 weeks ago
The post PHP Everywhere RCE flaws threaten thousands of WordPress sites first appeared on Black Hat Ethical Hacking.

كيف حصلت على 2500 دولار من اكتشاف الثغرات
https://medium.com/@angre.stonzy/%D9%83%D9%8A%D9%81-%D8%AD%D8%B5%D9%84%D8%AA-%D8%B9%D9%84%D9%89-2500-%D8%AF%D9%88%D9%84%D8%A7%D8%B1-%D9%85%D9%86-%D8%A7%D9%83%D8%AA%D8%B4%D8%A7%D9%81-%D8%A7%D9%84%D8%AB%D8%BA%D8%B1%D8%A7%D8%AA-e393d40b3092?source=rss------bug_bounty-5

السلام عليكم ورحمة الله وبركاتهContinue reading on Medium » (https://medium.com/@angre.stonzy/%D9%83%D9%8A%D9%81-%D8%AD%D8%B5%D9%84%D8%AA-%D8%B9%D9%84%D9%89-2500-%D8%AF%D9%88%D9%84%D8%A7%D8%B1-%D9%85%D9%86-%D8%A7%D9%83%D8%AA%D8%B4%D8%A7%D9%81-%D8%A7%D9%84%D8%AB%D8%BA%D8%B1%D8%A7%D8%AA-e393d40b3092?source=rss------bug_bounty-5)

hacking: security in practice
So I made a ctf for 2b2t.org

i would make the whole post here but im too lazy to make the whole post again.

CAUTION COMMENTS MAY CONTAIN SPOILERS

https://www.reddit.com/r/2b2t/comments/soz0uy/puzzle_w_reward/

edit: oh and the flag would take the form of a vector

​

submitted by /u/Hwcopeland
[link] [comments]

hacking: security in practice
Encrypting Deep Learning models files.

Hey everyone, I am working on encrypting the model files generated by a Deep Learning Algorithm, I need a technique to generate a passphrase that will be unique to every server the model runs on. Can you suggest some techniques of doing so?

​

It will be helpful to have literature proves for the techniques.

submitted by /u/psarangi112
[link] [comments]

كيف حصلت على 2500 دولار من اكتشاف الثغرات

السلام عليكم ورحمة الله وبركاتهContinue reading on Medium »
Read more...

Kali Linux Tutorials
ADenum : A Pentesting Tool That Allows To Find Misconfiguration Through The The Protocol LDAP And Exploit Some Of Those Weaknesses With Kerberos

ADenum is a pentesting tool that allows to find misconfiguration through the protocol LDAP and exploit some of those weaknesses with Kerberos.

Requirement

* Impacket (https://github.com/SecureAuthCorp/impacket)
* John (https://github.com/openwall/john)
* Python 3
* If you are using debian or ubuntu

$ sudo apt-get install libsasl2-dev python-dev libldap2-dev libssl-dev

If you are using kali

$ sudo apt-get install libsasl2-dev python2-dev libldap2-dev libssl-dev

pip3

$ pip3 install -r requirements.txt

Features and Functionality

LDAP

* Enum Domain Admin users
* Enum Domain Controllers
* Enum Domain users with Password Not Expire
* Enum Domain users with old password
* Enum Domain users with interesting description
* Enum Domain users with not the default encryption
* Enum Domain users with Protecting Privileged Domain Accounts

Kerberos

* AS-REP Roastable
* Kerberoastable
* Password cracking with john (krb5tgs and krb5asrep)
Download

Kali Linux Tutorials
CloudSpec : An Open Source Tool For Validating Your Resources In Your Cloud Providers Using A Logical Language

CloudSpec is an open source tool for validating your resources in your cloud providers using a logical language that everybody can understand. With its reasonably simple syntax, you can validate the configuration of your cloud resources, avoiding mistakes that can lead to availability or confidentiality issues.

Introduction

With CloudSpec you validate resources in your cloud provider. A resource can be anything, from an EC2 Instance to an SES rule. Anything that a CloudSpec provider implements.

Resources have properties and associations. Properties define the shape, or configuration, of the resource, while associations define its relationships with other resources. With CloudSpec, you not only can validate the configuration of the resource, but also the configuration of its associated resources. For example, let’s take an EC2 Instance. It has properties defining its shape, like its unique instance ID, its name, its type, and the such. But it also has associations like the subnet it belongs to, the EBS volumes attached to it, the AMI it uses, and the such. You not only can validate whether an EC2 Instance is of a particular instance type, or has the delete termination flag enabled, but also the size of its attached volumes, the CIDR block of its subnet, or any other property in its associated resources, or associated resources to its associated resources, and so on. You follow me.

Your cloud resources are entangled together, creating a graph. A graph that you can traverse and validate as you see fit according to your best practices or compliance policies. That ability, plus its logical language, is the beauty of CloudSpec.

set aws:regions = [“us-east-1”, “eu-west-1”]
use “./my_module” as my_module
rule “Buckets must have access logs enabled”
on aws:s3:bucket
assert access_logs is enabled
end rule
rule “Instances must use ‘gp2’ volumes and be at least 50GiBs large.”
on aws:ec2:instance
with tags[“environment”] equal to “production”
assert devices (
> volume (
type equal to “gp2” and
size gte 50
)
)
end

You can find the full syntax in the CloudSpec Reference documentation. Providers

CloudSpec itself does not support any resource. The core of CloudSpec is the syntax interpreter for the specification files and its validation engine. However, CloudSpec does use providers, which are extensions to CloudSpec supporting each different type of resource.

A provider defines the shape of each resource type, properties and associations, and the logic to load those resources.

You can find the available providers and resources they provide in the CloudSpec Reference documentation. Running CloudSpec docker image

You can either build and run the CloudSpec jar yourself, or you can run the latest docker image straight from the Docker Hub registry.

To use the Docker image, you first need to put your spec files (e.g. specs/my_module) in a directory to mount it in the Docker container. Otherwise, the CloudSpec will not be able to open the spec files outside the container.

export AWS_ACCESS_KEY_ID=* export AWS_SECRET_ACCESS_KEY=*
export AWS_REGION=eu-west-1
docker run -v “/my_module:/my_module” -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_REGION efoncubierta/cloudspec run -d my_module

If you are running the docker container in AWS with a dedicated IAM role attached, you can omit the AWS environment variables.

For more options of the CloudSpec command, see help:

docker run efoncubierta/cloudspec -h

Build CloudSpec

If you want to build CloudSpec yourself, follow these instructions.

Requirements:

* Git
* Maven 3
* OpenJDK 8
* Docker

Pull the source code and build CloudSpec:

Clone git repo
git clone https://github.com/efoncubierta/cloudspec
cd cl[...]