Dark Reading: Attacks/Breaches
Handcuffs Over AI: Solving Security Challenges With Law Enforcement

We've tried everything else ... now it's time to make the prospect of getting caught -- and punished -- a real deterrent to cybercrime.

Kali Linux Tutorials
Kics : Find Security Vulnerabilities & Compliance Issues

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx. KICS stands for Keeping Infrastructure as Code Secure, it is open source and is a must-have for any cloud native project. Supported Platforms Support of other solutions and additional cloud providers are on the roadmap. […]

The post Kics : Find Security Vulnerabilities & Compliance Issues appeared first on Kali Linux Tutorials.

Hacking on Medium
Playing The Chain Game

https://cdn-images-1.medium.com/max/600/1*GQhp2wOV4wtSfONoDPvoZA.jpeg
#First Valid Bug

Continue reading on Medium »

Hacking on Medium
HOW I GOT MY NAME IN BBC’S HALL OF FAME

https://cdn-images-1.medium.com/max/600/1*HQmIX9n4miVy5j8FTvtWsA.gif
Hi Everyone, Hope you all are doing well and hunting bugs ;)

Continue reading on Medium »

Hacking on Medium
How Virtual Servers are vulnerable to exploitation

https://cdn-images-1.medium.com/max/1200/1*H880iByZ7oETOM_2y-IfpQ.jpeg
Companies are working with petabytes of data every day. This data is collected across thousands of inputs from questionnaires to cookies…

Continue reading on Shadowscape »

Hacking on Medium
Algunas reflexiones sobre filosofía

https://cdn-images-1.medium.com/max/2600/1*UKXnPGs-jKN_HNztxx1XeA.jpeg
Artículo sobre algunas reflexiones de temas filosóficos como el tiempo, la muerte, el equilibrio, el poder y la libertad.

Continue reading on Medium »

Iran’s APT34 Returns with an Updated Arsenal
https://www.reddit.com/r/redteamsec/comments/mmz48y/irans_apt34_returns_with_an_updated_arsenal/

submitted by /u/malware_bender (https://www.reddit.com/user/malware_bender)
[link] (https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/) [comments] (https://www.reddit.com/r/redteamsec/comments/mmz48y/irans_apt34_returns_with_an_updated_arsenal/)

Deep Web
forex trader

Does anyone know a forum link, community on the deepweb about forex trader?

submitted by /u/Trader_Kamikaze
[link] [comments]

hacking: security in practice
I would like to scrape all posts in a subreddit?

I’d like to compile all the “Jim Cramer does xxxxxxx xxx” comments in /gme

Reason: pure gold comments

This is my first hack, I am inspired

P.S, Jim Cramer eats cereal with water instead of milk.

Please halp.

submitted by /u/SasquatchAquatica
[link] [comments]

hacking: security in practice
Wifi Deauth

I’m sorry if this is a dumb question but let’s say I know the password of Wifi-A but not Wifi-B. Can I use a deauth attack via Kali Linux on both Wifi-A and Wifi-B or just Wifi-A?

Basically do I need to be connected to the wifi that I want to kick devices off of?

submitted by /u/Imamassivedickhead
[link] [comments]

hacking: security in practice
If You Had $300 to $400 To Burn What Learning Stuff Would You Spend It On?

I have about $400 to burn on learning material. What would you spend it on?

So far I am going to get HackTheBox membership and TryHackMe subscription.

submitted by /u/jrosend963
[link] [comments]

Max - Maximizing BloodHound
http://www.kitploit.com/2021/04/max-maximizing-bloodhound.html

Maximizing BloodHound.

Description
New Release: dpat (https://github.com/knavesec/Max/blob/master/wiki/dpat.md) - The BloodHound Domain Password Audit Tool (DPAT) A simple suite of tools: get-info (https://github.com/knavesec/Max/blob/master/wiki/get-info.md) - Pull lists of information from the Neo4j database mark-owned (https://github.com/knavesec/Max/blob/master/wiki/mark-owned.md) - Mark a list of objects as Owned mark-hvt (https://github.com/knavesec/Max/blob/master/wiki/mark-hvt.md) - Mark a list of objects as High Value Targets query (https://github.com/knavesec/Max/blob/master/wiki/query.md) - Run a raw Cypher query and return output export (https://github.com/knavesec/Max/blob/master/wiki/export.md) - Export all outbound controlling privileges of a domain object to a CSV file del-edge (https://github.com/knavesec/Max/blob/master/wiki/del-edge.md) - Delete an edge from the database add-spns (https://github.com/knavesec/Max/blob/master/wiki/add-spns.md) - Create HasSPNConfigured relationships, new attack primitive add-spw (https://github.com/knavesec/Max/blob/master/wiki/add-spw.md) - Create SharesPasswordWith relationships dpat (https://github.com/knavesec/Max/blob/master/wiki/dpat.md) - The BloodHound Domain Password Audit Tool (DPAT) pet-max (https://github.com/knavesec/Max/blob/master/wiki/pet-max.md) - Dogsay, happiness for stressful engagements This was released with screenshots & use-cases on the following blogs: Max Release (https://whynotsecurity.com/blog/max/), Updates & Primitives (https://whynotsecurity.com/blog/max2/) & DPAT (https://whynotsecurity.com/blog/max3/) A new potential attack primitive was added to this tool during my research, see the add-spns section for full details.
Usage

Installation
Ideally there shouldn't be much to install, but I've included a requirements.txt file just in case. Tested on Kali Linux (https://www.kitploit.com/search/label/Kali%20Linux) & Windows 10, all functionality should work for both linux and Windows operating systems. pip3 install -r requirements.txt
Neo4j Creds
Neo4j credentials (https://www.kitploit.com/search/label/Credentials) can be hardcoded at the beginning of the script OR they can be provided as CLI. If both areas are left blank, you will be prompted for the uname/password. python3 max.py -u neo4j -p neo4j {module} {args}
python3 max.py {module} {args}
Neo4j Username: neo4j
Neo4j Password:

Quick Use
Getting help in general, and module specific python3 max.py -h
python3 max.py {module} -h
Importing owned objects into BH python3 max.py mark-owned -f owned.txt
python3 max.py mark-owned -f owned.txt --add-note "Owned by repeated local admin"
Get list of users python3 max.py get-info --users
python3 max.py get-info --users --enabled

USER01@DOMAIN.LOCAL
USER02@DOMAIN.LOCAL
...
Get list of objects in a target group python3 max.py get-info --group-members "domain controllers@domain.local"
Get a list of computers that a user has administrative rights to python3 max.py get-info --adminto USER01@DOMAIN.LOCAL
Get a list of owned objects with the notes for each python3 max.py get-info --owned --get-note
Running a query - return a list of all users with a path to DA python3 max.py query -q "MATCH (n:User),(m:Group {name:'DOMAIN ADMINS@DOMAIN.LOCAL'}) MATCH (n)-[*1..]->(m) RETURN DISTINCT(n.name)"
Delete an edge from the database python3 max.py del-edge CanRDP
Add HasSPNConfigured relationship using the information stored within BloodHound, or with a GetUserSPNs impacket (https://www.kitploit.com/search/label/Impacket) file python3 max.py add-spns -b
python3 max.py add-spns -i getuserspns-raw-output.txt
DPAT python3 max.py dpat -n ~/client/ntds.dit -p ~/.hashcat/hashcat.potfile -o ouputdir --html --sanitize
Pet max python3 max.py pet-max

Object Files & Specification

Objects in file, must contain FQDN within, capitalization does not matter. This also applies to whenever a CLI username/computer name is supplied. user01@domain.local <- will be added / correct CLI input
group01@domain.local <- will be added / correct CLI input
computer01.domain.local <- will be added / correct CLI input
ComPutEr01.doMAIn.LOcaL <- will be added / correct CLI input
user02 <- will not be added / incorrect CLI input
computer02 <- will not be added / incorrect CLI input

Further work
I hope to include an analyze function to provide some sort functionality similar to PlumHound/Cypheroth. Lastly, thinking about creating a Powershell version for those running Neo4j on Windows, but I'm trash at Powershell so TBD. Any other features and improvements welcome, find me @knavesec in the BloodHoundGang Slack channel and on Twitter
Contributors
I'd like to especially thank those who have contributed their time to developing & improving this tool: Nic Losby @blurbdust (https://twitter.com/blurbdust) (DPAT Module) Scott Brink @_sandw1ch (https://twitter.com/_sandw1ch) (Various)

Download Max (https://github.com/knavesec/Max)