StayKit - Cobalt Strike Kit For Persistence

StayKit is an extension for Cobalt Strike persistence by leveraging the execute_assembly function with the SharpStay .NET assembly. The aggressor script handles payload creation by reading the template files for a specific execution type. IMPORTANT: To use the script a user will only need to load the StayKit.cna aggressor script. Additionally, the SharpStay assembly will need to be compiled and placed into the directory where StayKit.cna is located. Finally, if selecting a template for the payload some may require dynamic compiling which will uses Mono. The persistence menu will be added to the beacon. Due to the nature of how each technique is different there is only a GUI menu and no beacon commands. Available options: ElevatedRegistryKey UserRegistryKey UserInitMprLogonScriptKey ElevatedUserInitKey ScheduledTask ListScheduledTasks ScheduledTaskAction SchTaskCOMHijack CreateService ListRunningServices WMIEventSub GetScheduledTaskCOMHandler JunctionFolder StartupDirectory NewLNK BackdoorLNK ListTaskNames Dependencies Mono (MCS) for compiling .NET assemblies (Used with dynamic payload creation) Credits WMI Event Subscription - WQL Query from Empire Project and Matt Graeber's research Scheduled Task COM Handler Hijack - idea from enigma0x3's research Junction Folder - code and idea comes from matterpreter's OffensiveCSharp project Backdoor LNK - comes from harmj0y's LNKBackdoor script Download StayKit
Read more...

___________________________
@hacking_Attack
@Hacking_Video

StayKit - Cobalt Strike Kit For Persistence
http://www.kitploit.com/2022/02/staykit-cobalt-strike-kit-for.html

___________________________
@hacking_Attack
@Hacking_Video

StayKit is an extension for Cobalt Strike persistence by leveraging the execute_assembly function with the SharpStay .NET assembly. The aggressor (https://www.kitploit.com/search/label/Aggressor) script handles payload creation by reading the template files for a specific execution type. IMPORTANT: To use the script a user will only need to load the StayKit.cna aggressor script. Additionally, the SharpStay (https://github.com/0xthirteen/SharpStay) assembly (https://www.kitploit.com/search/label/Assembly) will need to be compiled and placed into the directory (https://www.kitploit.com/search/label/Directory) where StayKit.cna is located. Finally, if selecting a template for the payload some may require dynamic compiling which will uses Mono. The persistence menu will be added to the beacon. Due to the nature of how each technique is different there is only a GUI menu and no beacon commands.
Available options: ElevatedRegistryKey UserRegistryKey UserInitMprLogonScriptKey ElevatedUserInitKey ScheduledTask ListScheduledTasks ScheduledTaskAction SchTaskCOMHijack CreateService ListRunningServices WMIEventSub GetScheduledTaskCOMHandler JunctionFolder StartupDirectory NewLNK BackdoorLNK ListTaskNames Dependencies Mono (MCS) for compiling .NET assemblies (https://www.kitploit.com/search/label/Assemblies) (Used with dynamic payload creation) Credits WMI Event Subscription - WQL Query from Empire Project (https://github.com/EmpireProject/Empire) and Matt Graeber's (https://twitter.com/mattifestation) research Scheduled Task COM Handler Hijack - idea from enigma0x3's (https://twitter.com/enigma0x3) research Junction Folder - code and idea comes from matterpreter's (https://twitter.com/matterpreter) OffensiveCSharp project Backdoor LNK - comes from harmj0y's (https://twitter.com/harmj0y) LNKBackdoor script

Download StayKit (https://github.com/0xthirteen/StayKit)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
ZPHISHER

https://cdn-images-1.medium.com/max/600/1*eYh4VFmeqslCAgAK5hR34Q.png
(Create your own Phishing page)

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Internal Walkthrough(Hard) — THM

https://cdn-images-1.medium.com/max/1390/1*XcbGUVF9I5j5SGLB1xq_SA.png
we are going to solve a CTF call internal on Tryhackme called internal.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
StayKit - Cobalt Strike Kit For Persistence

https://blogger.googleusercontent.com/img/a/AVvXsEgmChTZn6lqdEdu6vhVy_6VsQ-DL5RdTJ0VkvUcVeeT0x7YphVF4S_nmOEDsY89ZNWuzeQNi3R-CagLff9sh5jksCq-qMTkrqTBQ-mRBx0e5hAVTUogYA-jwF7Lz-7mt5CzDaThUs00TXu5E0kv_LLR7J2-cpVRxsIi54ayOnev9LRUQtVZ6cNKw-9v=w640-h428
StayKit is an extension for Cobalt Strike persistence by leveraging the execute_assembly function with the SharpStay .NET assembly. The aggressor script handles payload creation by reading the template files for a specific execution type.

IMPORTANT: To use the script a user will only need to load the StayKit.cnaaggressor script. Additionally, the SharpStay assembly will need to be compiled and placed into the directory where StayKit.cnais located. Finally, if selecting a template for the payload some may require dynamic compiling which will uses Mono.

The persistence menu will be added to the beacon. Due to the nature of how each technique is different there is only a GUI menu and no beacon commands.
Available options:

* ElevatedRegistryKey
* UserRegistryKey
* UserInitMprLogonScriptKey
* ElevatedUserInitKey
* ScheduledTask
* ListScheduledTasks
* ScheduledTaskAction
* SchTaskCOMHijack
* CreateService
* ListRunningServices
* WMIEventSub
* GetScheduledTaskCOMHandler
* JunctionFolder
* StartupDirectory
* NewLNK
* BackdoorLNK
* ListTaskNames

Dependencies

* Mono (MCS) for compiling .NET assemblies (Used with dynamic payload creation)

Credits

* WMI Event Subscription - WQL Query from Empire Project and Matt Graeber's research
* Scheduled Task COM Handler Hijack - idea from enigma0x3's research
* Junction Folder - code and idea comes from matterpreter's OffensiveCSharp project
* Backdoor LNK - comes from harmj0y's LNKBackdoor script
Download StayKit

___________________________
@hacking_Attack
@Hacking_Video

All about Account Takeover
https://infosecwriteups.com/all-about-account-takeover-825d8fcf2d57?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Account Takeover MethodsContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/all-about-account-takeover-825d8fcf2d57?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
This YouTube channel is one of the popular pro-Russian propaganda media. Can Reddit break it by spamming the live streams?

https://external-preview.redd.it/pkiGGnH_-HwYqPh1OT0nsXMWINg2XHF_aGGAXO9JjN0.jpg?width=640&crop=smart&auto=webp&s=51873d14db9747dd3260b52db2e58311f430e4e8 submitted by /u/tam_bu
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it possible to view someone’s DMs on Twitter without them knowing?

I don’t wanna do it, I wanna make sure it’s not happened to me. How quick and easy is it if so?

submitted by /u/Pristine_Gur
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
SyntheticSun : A Defense-In-Depth Security Automation And Monitoring Framework

SyntheticSun is a defense-in-depth security automation and monitoring framework which utilizes threat intelligence, machine learning, managed AWS security services and, serverless technologies to continuously prevent, detect and respond to threats.

You sleep in fragmented glass
With reflections of you,
But are you feeling alive?
Yeah let me ask you,
Are you feeling alive?

Synopsis

* Uses event- and time-based serverless automation (e.g. AWS CodeBuild, AWS Lambda) to collect, normalize, enrich, and correlate security telemetry in Kibana
* Leverages threat intelligence, geolocation data, open-source intelligence, machine learning (ML) backed anomaly detection and AWS APIs to further enrich security telemetry and identify potential threats
* Leverages Random Cut Forests (RCF) and IP Insights unsupervised ML algorithms to identify anomalies in timeseries and IP-entity pair data, respectively. Serverless, container-orchestrated resources are provided to train and deploy new IP Insights endpoints at will.
* Dynamically updates AWS WAFv2 IP Sets and Amazon GuardDuty threat intel sets to bolster protection of your account and infrastructure against known threats Description

SyntheticSun is built around the usage of the Malware Information Sharing Platform (MISP) and Anomali’s LIMO, which are community driven threat intelligence platforms (TIPs) that provide various types of indicators of compromise (IoC). Normalized and de-duplicated threat intel is looked up against in near-real time to quickly identify known threats in various types of network traffic. To add dynamism to the identification of potential threats IP Insights models are deployed to find anoamlies (and potential threats therein) between the pairing of IP addresses and entities (such as IAM principal ID’s, user-agents, etc.), native RCF detectors are also used in Elasticsearch to find anomalies in near real-time security telemetry as it is streamed into Kibana. To democratize the usage and fine-tuning of ML models within security teams, utilities to train IP Insights models are provided as an add-on to the core solution.

To perform the both the orchestration and automation as well as extraction, transformation, and loading (ETL) of security telemetry into Kibana, various AWS serverless technologies such as AWS Lambda, Amazon DynamoDB, and AWS CodeBuild are used. Serverless technologies such as these are used for their scalability, ease of use, relatively cheap costs versus heavy MapReduce or Glue ETL-based solutions. A majority of the solution is deployed via CloudFormation with helper scripts in Python and shell provided throughout the various Stages to promote adoption and the potential deployment in continuous integration pipelines.

To make the “guts” of the solution as lean as possible basic Python modules such as boto3, requests, json, ipaddress, socketand reperform most of the extraction, transformation, and loading (ETL) into downstream services. Because all geolocation information is provided by ip-api.com, it does not require an account or paid tiers and has a great API which includes throttling information in their response headers. A majority of the Elasticsearch and Kibana dependencies are also provided in code (indices, mappings, visualizations, etc) to avoid heavy manual configuration. Setting Up

SyntheticSun is spread across three Stages due to the size of solution and the required dependencies. All architecture and installation instructions (and FAQs where appropriate) live within their own Stage. Add-ons modules (called an Appendix) are also provided to extend the functionality, which have their own architecture and installation instructions localized. Before you start: Cons[...]

___________________________
@hacking_Attack
@Hacking_Video

iderations for Production deployments

SyntheticSun, by virtue of being something you found on GitHub, is a proof-of-concept and therefore I did not go the extra mile for the first release to absolutely harden everything. Provided you are reading this at a point in time where I have not made the necessary changes, consider the following before you deploy this solution into a production environment (or any environment with heightened security needs). I will put these items on a roadmap and update them as appropiate.

* Train your own IP Insights models using the examples provided in Appendix A. Using your own data, and continually retraining the model, will help accurize findings.
* Deploy your CodeBuild projects, MISP server, and Elasticsearch Service domain in a VPC in order to harden against internet-borne attacks. Consider using AWS’ Client VPN, AWS Site-to-Site VPN, DirectConnect, Amazon Workspaces, and AppStream 2.0 or (if you absolutely have to) a reverse-proxy to access the MISP console and Kibana within a VPC.
* Consider using Cognito for AuthN into Kibana. Go a step further and federate your User Pool with your corporate IdP.
* Consider baking your own AMI for MISP or use Fargate to host it. I would also consider pre-baking Suricata and the Amazon CloudWatch Agent into future builds to help scale deployments of agents and HIDPS across your estate.
* Modify your Suricata configuration to suit the needs of your SecOps teams looking at the logs, since all this solution does is dump them in. You may also consider writing your own rules or importing other sources to harden your hosts against attacks. Download

___________________________
@hacking_Attack
@Hacking_Video

VM labs
https://www.reddit.com/r/Pentesting/comments/t2r2q1/vm_labs/

Hi, is there a trusted source where I can download ISO images for Windows? I’m learning how to pentest. I know there’s the official Microsoft ISO images for Windows 10, 11, and Server on Microsoft’s site. But I’m also looking for XP and 7 as well. Or does it not matter? submitted by /u/j_relic (https://www.reddit.com/user/j_relic)
[link] (https://www.reddit.com/r/Pentesting/comments/t2r2q1/vm_labs/) [comments] (https://www.reddit.com/r/Pentesting/comments/t2r2q1/vm_labs/)

___________________________
@hacking_Attack
@Hacking_Video

https://preview.redd.it/1icnz27ibek81.jpg?width=640&crop=smart&auto=webp&s=466f1367cc1a27ae88eb7dea8a5c1e7833fe0b21 submitted by /u/Kate7634
[link] [comments]

Hacking on Medium
Windows 10 Giriş Şifresini Kırma

https://cdn-images-1.medium.com/max/1400/1*UwfDiptsQFkvxUOiCkgtdQ.jpeg
Selamlar dostlar. Bu makalemde Windows 10 işletim sistemine sahip cihazlarda giriş şifresinin ne kadar basit bir şekilde…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Attacking IBM MQ — SWIFT to Steal Money$$$

What is IBM MQ?Continue reading on Medium »
Read more...