hacking: security in practice
Could hackers DDOS SWIFT in Russia if the international community refuses to remove them?

It looks like they are VPN tunnels, even if you couldn't intercept the data could you prevent it from transferring?

submitted by /u/Libertechian
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to hack a mobile app undetected?

I know nothing about hacking, but this game I am playing offers some prizes and it is obvious that a lot of people are cheating. How do I proceed?

submitted by /u/RJ2999
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
RPC Firewall : Stopping Lateral Movement via the RPC Firewall

RPC Firewall is the underlying mechanism which is used for numerous lateral movement techniques,
reconnaissances, relay attacks, or simply to exploit vulnerable RPC services.

DCSync attack? over RPC. Remote DCOM? over RPC. WMIC? over RPC. SharpHound? over RPC. PetitPotam? over RPC. PsExec? over RPC. ZeroLogon? over RPC… well, you get the idea https://s.w.org/images/core/emoji/13.1.0/72x72/1f642.png What is it used for? Research

Install the RPC Firewall and configure it to audit all remote RPC calls. Once executing any remote attack tools, you will see which RPC UUIDs and Opnums were called remotely. Remote RPC Attacks Detection

When the RPC Firewall is configured to audit, it write events to the Windows Event Log.

Forward this log to your SIEM, and use it to create baselines of remote RPC traffic for your servers.

Once an abnormal RPC call is audited, use it to trigger an alert for your SOC team. Remote RPC Attacks Protection

The RPC Firewall can be configured to block & audit only potentially malicious RPC calls. All other RPC calls are not audited to reduce noise and improve performance.

Once a potentially malicious RPC call is detected, it is blocked and audited. This could be used to alert your SOC team, while keeping your servers protected. What are the RPC Firewall Components?

It is made up from 3 components:

* RpcFwManager.exe – In charge of managing the RPC Firewall.
* RpcFirewall.dll – Injected DLL which performs the audit & filtering of RPC calls.
* RpcMessages.dll – A common library for sharing functions, and logic that writes data into Windows Event Viewer. How to use? Installing / Uninstalling

Installation simply drops the RPC Firewall DLLs into the %SystemRoot%\System32, and configures the RPCFWP application log for the Event Viewer.

Make sure the event viewer is closed during install/uninstall.

RpcFwManager.exe /install

Uninstalling does the opposite.

RpcFwManager.exe /uninstall

Protecting Process(es)

The RpcFwManager tried to inject the rpcFirewall.dll only to processes which have the RPCRT4.DLL loaded into them.

Once the rpcFirewall.dll is loaded, it verifies that the host process has a valid RPC interface, and is listening for remote connections.

Otherwise, the rpcFirewall.dll unloaded itself from the target process.

If the process is a valid RPC server, the rpcFirewall starts to audit & monitor incoming RPC calls, according to the configuration file.

To protect a single process by pid:

RpcFwManager.exe /pid

To protect a single process by name:

RpcFwManager.exe /process

To protect all process, simply leave the or parametes blank.

RpcFwManager.exe /process
RpcFwManager.exe /pid

Unprotecting Processes

To disable the RPC Firewall, either uninstall it, or use the unprotect parameter:

RpcFwManager.exe /unprotect

This will unload the rpcFirewall.dll from all processes. Persistency
RPC Firewall is not persistent on its own. One method of making sure that processes are continuesly protected is to create a scheduled task that executes a protection command. The following is a powershell command which does just that, just replace match a specific uuid
* opnum -> match a RPC opnum
* addr -> match a remote IP address
* action -> can be either allo[...]

___________________________
@hacking_Attack
@Hacking_Video

w or block (default allow)
* audit -> true or false, controls whether events are written to the RPCFWP log (default false)
* verbose -> when true, outputs debug informaiton for specific RPC calls (default false)

The configuration order is important, as the first match determines the outcome of the RPC call.

For example, the following configuration will protect a DC from a DCSync attack by disabling the MS-DRSR UUID from non-domain machines. Also, notice that audit is enabled only for blocked MS-DRSR attempts, which could alert your SOC to a potential attack!

uuid:e3514235-4b06-11d1-ab04-00c04fc2dcd2 addr: action:allow
uuid:e3514235-4b06-11d1-ab04-00c04fc2dcd2 addr: action:allow
uuid:e3514235-4b06-11d1-ab04-00c04fc2dcd2 action:block audit:true

Whenever the configuration changes, you need to notify the rpcFirewall.dll via the update command:

RpcFwManager.exe /update Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Msmailprobe : Office 365 And Exchange Enumeration

Msmailprobe is widely known that OWA (Outlook Web app) is vulnerable to time-based user enumeration attacks. This tool leverages all known, and even some lesser-known services exposed by default Exchange installations to enumerate users. It also targets Office 365 for error-based user enumeration.

Getting Started

If you want to download and compile the simple, non-dependant code, you must first install GoLang! I will let the incredible documentation, and other online resources help you with this task.

https://golang.org/doc/install

You may also download the compiled release here.

Syntax

List examples of commands for this applications, but simply running the binary with the examplescommand:

./msmailprobe examples

You can also get more specific help by running the binary with the arguments you are interested in:

./msmailprobe identify
./msmailprobe userenum
./msmailprobe userenum –onprem
./msmailprobe userenum –o365

Usage

Identify Command

* Used for gathering information about a host that may be pointed towards an Exchange or o365 tied domain
* Queries for specific DNS records related to Office 365 integration
* Attempts to extract internal domain name for onprem instance of Exchange
* Identifies services vulnerable to time-based user enumeration for onprem Exchange
* Lists password-sprayable services exposed for onprem Exchange host

Flag to use:
-t to specify target host
Example:
./msmailprobe identify -t mail.target.com

Userenum (o365) Command

* Error-based user enumeration for Office 365 integrated email addresses

Flags to use:
-E for email list OR -e for single email address
-o [optional]to specify an out file for valid emails identified
–threads [optional] for setting amount of requests to be made concurrently
Examples:
./msmailprobe userenum –o365 -E emailList.txt -o validemails.txt –threads 25
./msmailprobe userenum –o365 -e admin@target.com

Userenum (onprem) Command

* Time-based user enumeration against multiple onprem Exchange services

Flags to use:
-t to specify target host
-U for user list OR -u for single username
-o [optional]to specify an out file for valid users identified
–threads [optional] for setting amount of requests to be made concurrently
Examples:
./msmailprobe userenum –onprem -t mail.target.com -U userList.txt -o validusers.txt –threads 25
./msmailprobe userenum –onprem -t mail.target.com -u admin
Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
SSH using Your Apple IIe Retro Computer & Get Stuff Done!

https://cdn-images-1.medium.com/max/1536/1*cluixlYh3mria7M5HPPJRw.jpeg
Want to do something completely pointless yet a lot of fun? Or perhaps you just want to use alternative tech to get away from the ads…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to make Canned Pasta Sauce Taste Homemade

https://cdn-images-1.medium.com/max/1125/1*i-7KX3R7lHRXAEby8N9ujA.jpeg
There are lots of ways to jazz up and inject some extra flavor to your canned Pasta Sauce.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

For people who do pentesting as a job, how frequently do you use Hydra?
https://www.reddit.com/r/Pentesting/comments/t23oox/for_people_who_do_pentesting_as_a_job_how/

Hello all of your wonderful red teamers, I'm on the blue side of the house. I'm going through hackthebox to widen my skills and better understand what's attackers are doing, and to have a bit of fun. I'm wondering how much people really use tools like Hydra in their pentesting gigs. ​ Kind regards submitted by /u/sma92878 (https://www.reddit.com/user/sma92878)
[link] (https://www.reddit.com/r/Pentesting/comments/t23oox/for_people_who_do_pentesting_as_a_job_how/) [comments] (https://www.reddit.com/r/Pentesting/comments/t23oox/for_people_who_do_pentesting_as_a_job_how/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Mifare classic card reading data

I have a mifare classic card I want to view the data from. I tried mfoc and it's ending with a error. So I tried milazycracker and that also ends with the same error after the first 13 keys. It does not go through to hardnested, just does mfoc.

So now I have mfcuk running and the guide says approx 30min but it's been running for more than 3 hours now and all I see is

Let me entertain you Uid 96475b1e Type 08 Key 000000000000 Block 03 Diff Nt 20798 (counting up) Auths 20798 (counting up)

Am I on the right track or just waisting time here?

Kali Linux Live usb on Intel i7 16gb ram, pn532 usb version.

submitted by /u/Dutchy_79
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How save is this, Mr and Mrs Hackers?

submitted by /u/FukoPup
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Gmail Critical Security Alert

Hello, I got an alert about my password being compromised for http://127.0.0.1:5000 . I don't really remember setting the username or password. The password looks auto generated

From what I've read, it seems like I should be fine since it's a local thing but wanted to hear some thoughts for peace of mind.

Thanks

submitted by /u/llllllXllllll
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Likelihood of 🇺🇸 looking the other for those taking a stand for 🇺🇦?

My red hat days are over but I read a headline the other day of 🇺🇦 pleading for the community to help. I can’t ignore this and I know I’m not the only one. What’s everyone’s take on this. Thinking we get some sort of immunity if things escalate?

submitted by /u/Dontnotknow
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacking group ‘Anonymous’ declares cyber war against Vladimir Putin’s government before taking down website of Russian TV channel RT (Photos)

submitted by /u/wawwuly
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
anti virus software

what anti software virus protection do you guys use i need to find a good one

submitted by /u/xKitsu
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Official Kremlin website down amid war in Ukraine

https://external-preview.redd.it/qibhD3Ks6SOFM3EKwfYI21AEikvlaLF0pMhlxmSuW-0.jpg?width=640&crop=smart&auto=webp&s=77d1c4738bd368539faf173e663dbfe1351d5063 submitted by /u/Motor-Ad-8858
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Ukraine is creating an IT army.

submitted by /u/Haldane-FRS
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video