كيف حصلت على 2500 دولار من اكتشاف الثغرات
السلام عليكم ورحمة الله وبركاتهContinue reading on Medium »
Read more...
السلام عليكم ورحمة الله وبركاتهContinue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
ADenum : A Pentesting Tool That Allows To Find Misconfiguration Through The The Protocol LDAP And Exploit Some Of Those Weaknesses With Kerberos
ADenum is a pentesting tool that allows to find misconfiguration through the protocol LDAP and exploit some of those weaknesses with Kerberos.
Requirement
* Impacket (https://github.com/SecureAuthCorp/impacket)
* John (https://github.com/openwall/john)
* Python 3
* If you are using debian or ubuntu
$ sudo apt-get install libsasl2-dev python-dev libldap2-dev libssl-dev
If you are using kali
$ sudo apt-get install libsasl2-dev python2-dev libldap2-dev libssl-dev
pip3
$ pip3 install -r requirements.txt
Features and Functionality
LDAP
* Enum Domain Admin users
* Enum Domain Controllers
* Enum Domain users with Password Not Expire
* Enum Domain users with old password
* Enum Domain users with interesting description
* Enum Domain users with not the default encryption
* Enum Domain users with Protecting Privileged Domain Accounts
Kerberos
* AS-REP Roastable
* Kerberoastable
* Password cracking with john (krb5tgs and krb5asrep)
Download
ADenum : A Pentesting Tool That Allows To Find Misconfiguration Through The The Protocol LDAP And Exploit Some Of Those Weaknesses With Kerberos
ADenum is a pentesting tool that allows to find misconfiguration through the protocol LDAP and exploit some of those weaknesses with Kerberos.
Requirement
* Impacket (https://github.com/SecureAuthCorp/impacket)
* John (https://github.com/openwall/john)
* Python 3
* If you are using debian or ubuntu
$ sudo apt-get install libsasl2-dev python-dev libldap2-dev libssl-dev
If you are using kali
$ sudo apt-get install libsasl2-dev python2-dev libldap2-dev libssl-dev
pip3
$ pip3 install -r requirements.txt
Features and Functionality
LDAP
* Enum Domain Admin users
* Enum Domain Controllers
* Enum Domain users with Password Not Expire
* Enum Domain users with old password
* Enum Domain users with interesting description
* Enum Domain users with not the default encryption
* Enum Domain users with Protecting Privileged Domain Accounts
Kerberos
* AS-REP Roastable
* Kerberoastable
* Password cracking with john (krb5tgs and krb5asrep)
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
CloudSpec : An Open Source Tool For Validating Your Resources In Your Cloud Providers Using A Logical Language
CloudSpec is an open source tool for validating your resources in your cloud providers using a logical language that everybody can understand. With its reasonably simple syntax, you can validate the configuration of your cloud resources, avoiding mistakes that can lead to availability or confidentiality issues.
Introduction
With CloudSpec you validate resources in your cloud provider. A resource can be anything, from an EC2 Instance to an SES rule. Anything that a CloudSpec provider implements.
Resources have properties and associations. Properties define the shape, or configuration, of the resource, while associations define its relationships with other resources. With CloudSpec, you not only can validate the configuration of the resource, but also the configuration of its associated resources. For example, let’s take an EC2 Instance. It has properties defining its shape, like its unique instance ID, its name, its type, and the such. But it also has associations like the subnet it belongs to, the EBS volumes attached to it, the AMI it uses, and the such. You not only can validate whether an EC2 Instance is of a particular instance type, or has the delete termination flag enabled, but also the size of its attached volumes, the CIDR block of its subnet, or any other property in its associated resources, or associated resources to its associated resources, and so on. You follow me.
Your cloud resources are entangled together, creating a graph. A graph that you can traverse and validate as you see fit according to your best practices or compliance policies. That ability, plus its logical language, is the beauty of CloudSpec.
set aws:regions = [“us-east-1”, “eu-west-1”]
use “./my_module” as my_module
rule “Buckets must have access logs enabled”
on aws:s3:bucket
assert access_logs is enabled
end rule
rule “Instances must use ‘gp2’ volumes and be at least 50GiBs large.”
on aws:ec2:instance
with tags[“environment”] equal to “production”
assert devices (
> volume (
type equal to “gp2” and
size gte 50
)
)
end
You can find the full syntax in the CloudSpec Reference documentation. Providers
CloudSpec itself does not support any resource. The core of CloudSpec is the syntax interpreter for the specification files and its validation engine. However, CloudSpec does use providers, which are extensions to CloudSpec supporting each different type of resource.
A provider defines the shape of each resource type, properties and associations, and the logic to load those resources.
You can find the available providers and resources they provide in the CloudSpec Reference documentation. Running CloudSpec docker image
You can either build and run the CloudSpec jar yourself, or you can run the latest docker image straight from the Docker Hub registry.
To use the Docker image, you first need to put your spec files (e.g.
export AWS_ACCESS_KEY_ID=* export AWS_SECRET_ACCESS_KEY=*
export AWS_REGION=eu-west-1
docker run -v “/my_module:/my_module” -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_REGION efoncubierta/cloudspec run -d my_module
If you are running the docker container in AWS with a dedicated IAM role attached, you can omit the AWS environment variables.
For more options of the CloudSpec command, see help:
docker run efoncubierta/cloudspec -h
Build CloudSpec
If you want to build CloudSpec yourself, follow these instructions.
Requirements:
* Git
* Maven 3
* OpenJDK 8
* Docker
Pull the source code and build CloudSpec:
Clone git repo
git clone https://github.com/efoncubierta/cloudspec
cd cl[...]
CloudSpec : An Open Source Tool For Validating Your Resources In Your Cloud Providers Using A Logical Language
CloudSpec is an open source tool for validating your resources in your cloud providers using a logical language that everybody can understand. With its reasonably simple syntax, you can validate the configuration of your cloud resources, avoiding mistakes that can lead to availability or confidentiality issues.
Introduction
With CloudSpec you validate resources in your cloud provider. A resource can be anything, from an EC2 Instance to an SES rule. Anything that a CloudSpec provider implements.
Resources have properties and associations. Properties define the shape, or configuration, of the resource, while associations define its relationships with other resources. With CloudSpec, you not only can validate the configuration of the resource, but also the configuration of its associated resources. For example, let’s take an EC2 Instance. It has properties defining its shape, like its unique instance ID, its name, its type, and the such. But it also has associations like the subnet it belongs to, the EBS volumes attached to it, the AMI it uses, and the such. You not only can validate whether an EC2 Instance is of a particular instance type, or has the delete termination flag enabled, but also the size of its attached volumes, the CIDR block of its subnet, or any other property in its associated resources, or associated resources to its associated resources, and so on. You follow me.
Your cloud resources are entangled together, creating a graph. A graph that you can traverse and validate as you see fit according to your best practices or compliance policies. That ability, plus its logical language, is the beauty of CloudSpec.
set aws:regions = [“us-east-1”, “eu-west-1”]
use “./my_module” as my_module
rule “Buckets must have access logs enabled”
on aws:s3:bucket
assert access_logs is enabled
end rule
rule “Instances must use ‘gp2’ volumes and be at least 50GiBs large.”
on aws:ec2:instance
with tags[“environment”] equal to “production”
assert devices (
> volume (
type equal to “gp2” and
size gte 50
)
)
end
You can find the full syntax in the CloudSpec Reference documentation. Providers
CloudSpec itself does not support any resource. The core of CloudSpec is the syntax interpreter for the specification files and its validation engine. However, CloudSpec does use providers, which are extensions to CloudSpec supporting each different type of resource.
A provider defines the shape of each resource type, properties and associations, and the logic to load those resources.
You can find the available providers and resources they provide in the CloudSpec Reference documentation. Running CloudSpec docker image
You can either build and run the CloudSpec jar yourself, or you can run the latest docker image straight from the Docker Hub registry.
To use the Docker image, you first need to put your spec files (e.g.
specs/my_module) in a directory to mount it in the Docker container. Otherwise, the CloudSpec will not be able to open the spec files outside the container.export AWS_ACCESS_KEY_ID=* export AWS_SECRET_ACCESS_KEY=*
export AWS_REGION=eu-west-1
docker run -v “/my_module:/my_module” -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_REGION efoncubierta/cloudspec run -d my_module
If you are running the docker container in AWS with a dedicated IAM role attached, you can omit the AWS environment variables.
For more options of the CloudSpec command, see help:
docker run efoncubierta/cloudspec -h
Build CloudSpec
If you want to build CloudSpec yourself, follow these instructions.
Requirements:
* Git
* Maven 3
* OpenJDK 8
* Docker
Pull the source code and build CloudSpec:
Clone git repo
git clone https://github.com/efoncubierta/cloudspec
cd cl[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials CloudSpec : An Open Source Tool For Validating Your Resources In Your Cloud Providers Using A Logical Language CloudSpec is an open source tool for validating your resources in your cloud providers using a logical language that everybody…
oudspec
Build CloudSpec
mvn clean install
Run CloudSpec
java -jar runner/target/cloudspec-${VERSION}.jar -h Download
Build CloudSpec
mvn clean install
Run CloudSpec
java -jar runner/target/cloudspec-${VERSION}.jar -h Download
LDAP-Password-Hunter - Password Hunter In The LDAP Infamous Database
http://www.kitploit.com/2022/02/ldap-password-hunter-password-hunter-in.html
http://www.kitploit.com/2022/02/ldap-password-hunter-password-hunter-in.html
It happens that due to legacy services requirements (https://www.kitploit.com/search/label/Requirements) or just bad security practices password are world-readable in the LDAP database by any user who is able to authenticate.
LDAP Password Hunter is a tool which wraps features of getTGT.py (Impacket) and ldapsearch in order to look up for password stored in LDAP database. Impacket getTGT.py script is used in order to authenticate the domain account used for enumeration (https://www.kitploit.com/search/label/Enumeration) and save its TGT kerberos ticket. TGT ticket is then exported in KRB5CCNAME variable which is used by ldapsearch script to authenticate and obtain TGS kerberos tickets for each domain/DC LDAP-Password-Hunter is ran for. Basing on the CN=Schema,CN=Configuration export results a custom list of attributes is built and filtered in order to identify a big query which might contains interesting results. Results are shown and saved in a sqlite3 database. The DB is made of one table containing the following columns: DistinguishedName AttributeName Value Domain Results are way more clean than the previous version and organized in the SQL DB. The output shows the entries found only if they are not in DB, so new entries pop up but the overall outcome of the analysis (https://www.kitploit.com/search/label/Analysis) is still saved in a file with a timestamp.
Usage Be sure your krb5.conf file is clean and the domains.txt and conf.txt are filled properly. From the project folder: ./run.sh Easy-peasy :) Credits SecureAuthCorp: For the work on Impacket (https://github.com/SecureAuthCorp/impacket) project Alberto Solino (@agsolino): For the work on kerberoast (https://www.kitploit.com/search/label/Kerberoast) modules based on the Impacket framework Retrospected (https://github.com/Retrospected): For helping out every Friday with debugging (https://www.kitploit.com/search/label/Debugging) the code and brainstorming on new features
Download LDAP-Password-Hunter (https://github.com/oldboy21/LDAP-Password-Hunter)
LDAP Password Hunter is a tool which wraps features of getTGT.py (Impacket) and ldapsearch in order to look up for password stored in LDAP database. Impacket getTGT.py script is used in order to authenticate the domain account used for enumeration (https://www.kitploit.com/search/label/Enumeration) and save its TGT kerberos ticket. TGT ticket is then exported in KRB5CCNAME variable which is used by ldapsearch script to authenticate and obtain TGS kerberos tickets for each domain/DC LDAP-Password-Hunter is ran for. Basing on the CN=Schema,CN=Configuration export results a custom list of attributes is built and filtered in order to identify a big query which might contains interesting results. Results are shown and saved in a sqlite3 database. The DB is made of one table containing the following columns: DistinguishedName AttributeName Value Domain Results are way more clean than the previous version and organized in the SQL DB. The output shows the entries found only if they are not in DB, so new entries pop up but the overall outcome of the analysis (https://www.kitploit.com/search/label/Analysis) is still saved in a file with a timestamp.
Usage Be sure your krb5.conf file is clean and the domains.txt and conf.txt are filled properly. From the project folder: ./run.sh Easy-peasy :) Credits SecureAuthCorp: For the work on Impacket (https://github.com/SecureAuthCorp/impacket) project Alberto Solino (@agsolino): For the work on kerberoast (https://www.kitploit.com/search/label/Kerberoast) modules based on the Impacket framework Retrospected (https://github.com/Retrospected): For helping out every Friday with debugging (https://www.kitploit.com/search/label/Debugging) the code and brainstorming on new features
Download LDAP-Password-Hunter (https://github.com/oldboy21/LDAP-Password-Hunter)
Watch "Welcome to C0V3RT - Exploration of ALL THINGS "Covert Entry"" on YouTube
https://www.reddit.com/r/redteamsec/comments/sp4ul4/watch_welcome_to_c0v3rt_exploration_of_all_things/
submitted by /u/Can0pen3r (https://www.reddit.com/user/Can0pen3r)
[link] (https://youtu.be/vyoaBI9DSqk) [comments] (https://www.reddit.com/r/redteamsec/comments/sp4ul4/watch_welcome_to_c0v3rt_exploration_of_all_things/)
https://www.reddit.com/r/redteamsec/comments/sp4ul4/watch_welcome_to_c0v3rt_exploration_of_all_things/
submitted by /u/Can0pen3r (https://www.reddit.com/user/Can0pen3r)
[link] (https://youtu.be/vyoaBI9DSqk) [comments] (https://www.reddit.com/r/redteamsec/comments/sp4ul4/watch_welcome_to_c0v3rt_exploration_of_all_things/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Learning SQL & SQLI Attacks
https://cdn-images-1.medium.com/max/1024/1*MpcGJ0p4aNib7PCd-klBuQ.jpeg
As a beginner, we struggled with databases. and the main reason behind this was lack of foundational knowledge.
Continue reading on Medium »
Learning SQL & SQLI Attacks
https://cdn-images-1.medium.com/max/1024/1*MpcGJ0p4aNib7PCd-klBuQ.jpeg
As a beginner, we struggled with databases. and the main reason behind this was lack of foundational knowledge.
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How Much is Cost to Hire a Hacker Online by Professionals?
https://cdn-images-1.medium.com/max/1200/1*YM7hdPR3GX7zXXe7sDfdJA.jpeg
There are some benefits of hiring a hacker for your project. A good online cyber expert has great skills and knowledge.
Continue reading on Medium »
How Much is Cost to Hire a Hacker Online by Professionals?
https://cdn-images-1.medium.com/max/1200/1*YM7hdPR3GX7zXXe7sDfdJA.jpeg
There are some benefits of hiring a hacker for your project. A good online cyber expert has great skills and knowledge.
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Trick your brain into doing tasks
https://cdn-images-1.medium.com/max/2600/1*Kp22ZcaR7H9LSW2HlKQFgg.png
4 Productivity tricks for your lazy butt
Continue reading on Medium »
Trick your brain into doing tasks
https://cdn-images-1.medium.com/max/2600/1*Kp22ZcaR7H9LSW2HlKQFgg.png
4 Productivity tricks for your lazy butt
Continue reading on Medium »
LDAP-Password-Hunter - Password Hunter In The LDAP Infamous Database
It happens that due to legacy services requirements or just bad security practices password are world-readable in the LDAP database by any user who is able to authenticate. LDAP Password Hunter is a tool which wraps features of getTGT.py (Impacket) and ldapsearch in order to look up for password stored in LDAP database. Impacket getTGT.py script is used in order to authenticate the domain account used for enumeration and save its TGT kerberos ticket. TGT ticket is then exported in KRB5CCNAME variable which is used by ldapsearch script to authenticate and obtain TGS kerberos tickets for each domain/DC LDAP-Password-Hunter is ran for. Basing on the CN=Schema,CN=Configuration export results a custom list of attributes is built and filtered in order to identify a big query which might contains interesting results. Results are shown and saved in a sqlite3 database. The DB is made of one table containing the following columns: DistinguishedName AttributeName Value Domain Results are way more clean than the previous version and organized in the SQL DB. The output shows the entries found only if they are not in DB, so new entries pop up but the overall outcome of the analysis is still saved in a file with a timestamp. Usage Be sure your krb5.conf file is clean and the domains.txt and conf.txt are filled properly. From the project folder: ./run.sh Easy-peasy :) Credits SecureAuthCorp: For the work on Impacket project Alberto Solino (@agsolino): For the work on kerberoast modules based on the Impacket framework Retrospected: For helping out every Friday with debugging the code and brainstorming on new features Download LDAP-Password-Hunter
Read more...
It happens that due to legacy services requirements or just bad security practices password are world-readable in the LDAP database by any user who is able to authenticate. LDAP Password Hunter is a tool which wraps features of getTGT.py (Impacket) and ldapsearch in order to look up for password stored in LDAP database. Impacket getTGT.py script is used in order to authenticate the domain account used for enumeration and save its TGT kerberos ticket. TGT ticket is then exported in KRB5CCNAME variable which is used by ldapsearch script to authenticate and obtain TGS kerberos tickets for each domain/DC LDAP-Password-Hunter is ran for. Basing on the CN=Schema,CN=Configuration export results a custom list of attributes is built and filtered in order to identify a big query which might contains interesting results. Results are shown and saved in a sqlite3 database. The DB is made of one table containing the following columns: DistinguishedName AttributeName Value Domain Results are way more clean than the previous version and organized in the SQL DB. The output shows the entries found only if they are not in DB, so new entries pop up but the overall outcome of the analysis is still saved in a file with a timestamp. Usage Be sure your krb5.conf file is clean and the domains.txt and conf.txt are filled properly. From the project folder: ./run.sh Easy-peasy :) Credits SecureAuthCorp: For the work on Impacket project Alberto Solino (@agsolino): For the work on kerberoast modules based on the Impacket framework Retrospected: For helping out every Friday with debugging the code and brainstorming on new features Download LDAP-Password-Hunter
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles Tips Tricks Videos Tutorials
Photo