Kali Linux Tutorials
Registry-Spy : Cross-platform Registry Browser For Raw Windows Registry Files

Registry-Spy is a free, open-source cross-platform Windows Registry viewer. It is a fast, modern, and versatile explorer for raw registry files.

Features include:

* Fast, on-the-fly parsing means no upfront overhead
* Open multiple hives at a time
* Searching
* Hex viewer
* Modification timestamps

Requirements

* Python 3.8+

Installation

Download the latest version from the releases page. Alternatively, use one of the following methods.

pip (recommended)

* pip install registryspy
* registryspy

Manual

* pip install -r requirements.txt
* python setup.py install
* registryspy

Standalone

* pip install -r requirements.txt
* python registryspy.py

Screenshots

Main Window
https://blogger.googleusercontent.com/img/a/AVvXsEjPzPE3NIv7DJIrZd_7YHEvT9ZKqiu-yes82AyF5iwQStvdX3WEuUsebzx2X-Hx2WSMvqnNcjp66a4roK-IR4tRqwriwHUksbD9kX94HysY9cmc9_10v6zx3Ex_sO_0bp8WRGHmVqy7zD75fVoaH4kz8czuWuQ62F1v2Vn1kfw7tX0oAsvwqj0Mrh_L=s791
Find Dialog
https://blogger.googleusercontent.com/img/a/AVvXsEj73-tSNeitt7bjIVKW7U5ZpIhzzqleQywF8-XCXmq5Pc4kqZ9MFI4KfWC7QVSHrNfx9ZT2uoJ3w4zM5KrWj8mTo4cN2EYEL8w_uO5AyunrD6kGGCFiY3w2qv1OhoblNNic3fTrKIv-SE9zlotL-5E-Lbxj8pBerhDJn8PwJg9xCZxZxXKTbDrzX5B4=s402
Building

Dependencies:

* PyInstaller 4.5+

Regular building: pyinstaller registryspy_install.spec

Creating a single file: pyinstaller registryspy_onefile.spec
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Inject-Assembly : Inject .NET Assemblies Into An Existing Process

Inject-Assembly is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon, similar to the behavior of execute-assembly.

There are two components of inject-assembly:

* BOF initializer: A small program responsible for injecting the assembly loader into a remote process with any arguments passed. It uses Beacon Inject Process to perform the injection, meaning this behavior can be customized in a Malleable C2 profile or with process injection BOFs (as of version 4.5).
* PIC assembly loader: The bulk of the project. The loader will initialize the .NET runtime, load the provided assembly, and execute the assembly. The loader will create a new App Domain in the target process so that the loaded assembly can be totally unloaded when execution is complete.

Communication between the remote process and Beacon occurs through a named pipe. The Aggressor script generates a pipe name and then passes it to the BOF initializer.

Notable Features

* Patches Environment.Exit() to prevent the remote process from exiting.
* .NET assembly header stomping (MZ bytes, e_lfanew, DOS Header, Rich Text, PE Header).
* Random pipe name generation based on SourcePoint.
* No blocking of the Beacon, even if the assembly is loaded into the current process.

Usage

Download and load the inject-assembly.cna Aggressor script into Cobalt Strike. You can then execute assemblies using the following command:

inject-assembly pid assembly [args…]

Specify 0 as the PID to execute in the current Beacon process.

It is recommended to use another tool, like FindObjects-BOF, to locate a process that already loads the .NET runtime, but this is not a requirement for inject-assembly to function.
Download

___________________________
@hacking_Attack
@Hacking_Video

($$$) IDOR via GET Request which can SOLD all User Products

Hi everyone,Continue reading on Medium »
Read more...

hacking: security in practice
aircrack in VM

so i am trying to use aircrack on VM but it says something like wireless card undetected . so how can i use my laptop wireless in VM?
are there is any other way for wifi hacking?

submitted by /u/UnkownWithUnkownprsn
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
The Dirty Pipe Vulnerability

submitted by /u/donutloop
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
POST requests can accept URL Query parameters.

Was doing a pentest and i encountered a situation whereby there was a POST request API which takes a sensitive secret as a parameter. The interesting thing was that this API would also accept and parse the parameter even if it was sent as a query parameter.

For example the original request was to be

POST abc.com
Content-type: application/json /u/sg_pepehands69
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hash identification

I'm not sure if this is the right place. So this hash is meant to be "admin" 84e8e3c1c19a6a2cba961c4a58d2699b but I can't figure out the hash. It looks MD4/5 but can't make a copy. This was off of a device running VxWorks 6.9 from a file called auth.txt. I'm not sure if it's actually vxworks using this file.

I don't need to crack it, since I set the passwords on my own device. Just would like to figure out the hashes it's using.

Thanks!

submitted by /u/tommykw
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Learn SQL interactively!

https://cdn-images-1.medium.com/max/1916/1*w0nfDbNA9mwE-_-Kp3VFvQ.png
Intro

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

GraphQL Cop - Security Auditor Utility For GraphQL APIs
http://www.kitploit.com/2022/03/graphql-cop-security-auditor-utility.html

___________________________
@hacking_Attack
@Hacking_Video

GraphQL Cop is a small Python utility to run common security tests against GraphQL (https://www.kitploit.com/search/label/GraphQL) APIs.
Requirements Python3 Requests Library Detections Alias Overloading (DoS) Batch Queries (DoS) GET based Queries (CSRF) GraphQL Tracing (https://www.kitploit.com/search/label/Tracing) / Debug Modes (Info Leak) Field Duplication (DoS) Field Suggestions (Info Leak) GraphiQL (Info Leak) Introspection (Info Leak) Directives Overloading (DoS) Usage Starting... [HIGH] Introspection Query Enabled (Information Leakage) [LOW] GraphQL Playground UI (Information Leakage) [HIGH] Alias Overloading with 100+ aliases is allowed (Denial of Service) [HIGH] Queries are allowed with 1000+ of the same repeated field (Denial of Service) python3 main.py -t https://mywebsite.com/graphql -o json {'Field Suggestions': {'severity': 'LOW', 'impact': 'Information Leakage', 'description': 'Field Suggestions are Enabled'}, 'Introspection': {'severity': 'HIGH', 'impact': 'Information Leakage', 'description': 'Introspection Query Enabled'}, 'Possible CSRF (GET)': {'severity': 'LOW', 'impact': 'Possible CSRF', 'description': 'HTTP GET method supported (maybe CSRF)'}, 'Alias Overloading': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Alias Overloading with 100+ aliases is allowed'}, 'Field Duplication': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Queries are allowed with 1000+ of the same repeated field'}, 'Directive Overloading': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Multiple duplicated directives allowed in a query'}}">python3 main.py -t https://mywebsite.com/graphql

GraphQL Cop 1.0
Security Auditor for GraphQL
Dolev Farhi

Starting...
[HIGH] Introspection Query Enabled (Information Leakage)
[LOW] GraphQL Playground UI (Information Leakage)
[HIGH] Alias Overloading with 100+ aliases is allowed (Denial of Service)
[HIGH] Queries are allowed with 1000+ of the same repeated field (Denial of Service)

python3 main.py -t https://mywebsite.com/graphql -o json

{'Field Suggestions': {'severity': 'LOW', 'impact': 'Information Leakage', 'description': 'Field Suggestions are Enabled'}, 'Introspection': {'severity': 'HIGH', 'impact': 'Information Leakage', 'description': 'Introspection Query Enabled'}, 'Possible CSRF (GET)': {'severity': 'LOW', 'impact': 'Possible CSRF', 'description': 'HTTP GET method supported (maybe CSRF)'}, 'Alias Overloading': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Alias Overloading with 100+ aliases is allowed'}, 'Field Duplication': {'severity': ' HIGH', 'impact': 'Denial of Service', 'description': 'Queries are allowed with 1000+ of the same repeated field'}, 'Directive Overloading': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Multiple duplicated directives allowed in a query'}}


Download Graphql-Cop (https://github.com/dolevf/graphql-cop)

___________________________
@hacking_Attack
@Hacking_Video

Full Account Takeover due to improper validation of old password

Hello Hackers and Security community. I’m going to share how I’m able find the bug.Continue reading on Medium »
Read more...

Black Hat Ethical Hacking
New Linux bug gives root on all major distros, exploit released

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png New Linux bug gives root on all major distros, exploit releasedPost Views: 2
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 2 Minutes
A new Linux vulnerability known as ‘Dirty Pipe’ allows local users to gain root privileges through publicly available exploits.
Today, security researcher Max Kellermann responsibly disclosed the ‘Dirty Pipe’ vulnerability and stated that it affects Linux Kernel 5.8 and later versions, even on Android devices.

The vulnerability is tracked as CVE-2022-0847 and allows a non-privileged user to inject and overwrite data in read-only files, including SUID processes that run as root.

Kellerman discovered the bug after tracking down a bug that was corrupting web server access logs for one of his customers.

Kellerman states that the vulnerability is similar to the Dirty COW vulnerability (CVE-2016-5195) fixed in 2016.
See Also: Complete Offensive Security and Ethical Hacking Course Public exploits give root privileges As part of the Dirty Pipe disclosure, Kellerman released a proof-of-concept (PoC) exploit that allows local users to inject their own data into sensitive read-only files, removing restrictions or modifying configurations to provide greater access than they usually would have.

For example, security researcher Phith0n illustrated how they could use the exploit to modify the /etc/passwd file so that the root user does not have a password. Once this change is made, the non-privileged user could simply execute the ‘su root‘ command to gain access to the root account.
Why did I overwrite the /etc/passwd?
Because this file saves all the user information on Linux.
I remove the "x" flag behind the "root" user, it means that I set an empty password for this user. So I can use "su root" to escalate privilege without credentials.

— Phith0n (@phithon_xg) March 7, 2022
However, an updated exploit by security researcher BLASTY was also publicly released today that makes it even easier to gain root privileges by patching the /usr/bin/su command to drop a root shell at /tmp/sh and then executing the script.

Once executed, the user gains root privileges, as demonstrated by BleepingComputer below in Ubuntu 20.04.3 LTS running the 5.13.0-27-generic kernel.
https://www.bleepstatic.com/images/news/security/attacks/l/linux/dirtypipe/dirtypipe-poc.jpg
___________________________
@hacking_Attack
@Hacking_Video

These include privilege elevation vulnerabilities in the Linux iSCSI subsystem, another kernel bug, the Extended Berkeley Packet Filter (eBPF), and Polkit’s pkexec component. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Hacking stories: MafiaBoy, the hacker who took down the Internet
Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/firefox-90x90.jpg Mozilla Firefox 97.0.2 fixes two actively exploited zero-day bugs22 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/small-business-internet-security-90x90.jpg Google WAF bypassed via oversized POST requests4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-4-90x90.jpg Ukraine invasion: WordPress-hosted university websites hacked in ‘targeted attacks’5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-90x90.jpg RCE Bugs in WhatsApp, Other Hugely Popular VoIP Apps: Patch Now!6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/download-90x90.jpg Cyber-attack on Nvidia linked to Lapsus$ ransomware gang1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/GettyImages-802535150-1-90x90.jpg Conti ransomware’s internal chats leaked after siding with Russia1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/6469-article-220223-ukraine-body-text-90x90.jpg Data wiper deployed in cyber-attacks targeting Ukrainian systems2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/T8F9rL5Ub6TRWHtQwsVCK6-1200-80-90x90.jpg Samsung Shattered Encryption on 100M Phones2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/4346-article-220222-airtags-body-text-90x90.jpg AirTag clone bypassed Apple’s tracking-protection features, claims researcher2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Banner-Img-AWS-90x90.jpg Introducing Ghostbuster – AWS security tool protects against dangling elastic IP takeovers2 weeks ago
The post New Linux bug gives root on all major distros, exploit released first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Full Account Takeover due to improper validation of old password
https://medium.com/@vamshivaran110/full-account-takeover-due-to-improper-validation-of-old-password-d4b9f4eec3f8?source=rss------bug_bounty-5

Hello Hackers and Security community. I’m going to share how I’m able find the bug.Continue reading on Medium » (https://medium.com/@vamshivaran110/full-account-takeover-due-to-improper-validation-of-old-password-d4b9f4eec3f8?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

GraphQL Cop - Security Auditor Utility For GraphQL APIs

GraphQL Cop is a small Python utility to run common security tests against GraphQL APIs. Requirements Python3 Requests Library Detections Alias Overloading (DoS) Batch Queries (DoS) GET based Queries (CSRF) GraphQL Tracing / Debug Modes (Info Leak) Field Duplication (DoS) Field Suggestions (Info Leak) GraphiQL (Info Leak) Introspection (Info Leak) Directives Overloading (DoS) Usage CSRF (GET)': {'severity': 'LOW', 'impact': 'Possible CSRF', 'description': 'HTTP GET method supported (maybe CSRF)'}, 'Alias Overloading': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Alias Overloading with 100+ aliases is allowed'}, 'Field Duplication': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Queries are allowed with 1000+ of the same repeated field'}, 'Directive Overloading': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Multiple duplicated directives allowed in a query'}}">python3 main.py -t https://mywebsite.com/graphql GraphQL Cop 1.0 Security Auditor for GraphQL Dolev Farhi Starting...HIGH Introspection Query Enabled (Information Leakage)LOW GraphQL Playground UI (Information Leakage)HIGH Alias Overloading with 100+ aliases is allowed (Denial of Service)HIGH Queries are allowed with 1000+ of the same repeated field (Denial of Service)python3 main.py -t https://mywebsite.com/graphql -o json{'Field Suggestions': {'severity': 'LOW', 'impact': 'Information Leakage', 'description': 'Field Suggestions are Enabled'}, 'Introspection': {'severity': 'HIGH', 'impact': 'Information Leakage', 'description': 'Introspection Query Enabled'}, 'Possible CSRF (GET)': {'severity': 'LOW', 'impact': 'Possible CSRF', 'description': 'HTTP GET method supported (maybe CSRF)'}, 'Alias Overloading': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Alias Overloading with 100+ aliases is allowed'}, 'Field Duplication': {'severity': ' HIGH', 'impact': 'Denial of Service', 'description': 'Queries are allowed with 1000+ of the same repeated field'}, 'Directive Overloading': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Multiple duplicated directives allowed in a query'}} Download Graphql-Cop
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Full Account Takeover due to improper validation of old password

Hello Hackers and Security community. I’m going to share how I’m able find the bug.Continue reading on Medium »
Read more...

Kali Linux Tutorials
Considerations When Building A Future-Proof Security Strategy For Your Business

Developing a security strategy for your business shouldn’t just be about the here and now. If you want your business to grow, you need a security system to scale with you. If computer speeds double every 18 months, what does that mean for other technical aspects?

While there is no way to completely keep up with technological advancements, you can future-proof your security strategy to minimise disruption. Why Do You Need to Future-Proof Your Security? The security system you implement today will likely become outdated a few years down the line, if not more. While there is little you can do about that, you can ensure that your strategy stands the test of time. You may have to update security technology and software to keep up. However, this is part of your security strategy.

Here are a few reasons future-proofing your security strategy is a must:

* Reduce the risk of cyber and physical threats
* Enable your security system to scale with you
* Stay up to date on all your security matters
* React quickly to new threats
* Save yourself time and energy implementing new technology What Security Threats Will You Face?Traditionally, we thought of security as a physical presence, such as hiring a guard or using video security cameras to deter physical threats. Now, we might think of firewalls and software preventing phishing, hacking, or other cyber threats. However, cyber and physical threats are not two separate entities.

Security threats you might face:

* Internal security incidents
* External hacking attempts
* Accidental employee data breach
* Third-party risks
* Poor incident response

Your security strategy should detail each potential threat and the steps to mitigate risks. As time goes on, new types of security threats may emerge. Outlining a solid incident response will help prevent damage in such cases. Compliance Isn’t the EndgameEvery industry has its form of compliance. Usually, these are regulations that you’re legally bound to follow. However, laws change. Just because there are a particular set of rules in place today (e.g., GDPR) doesn’t mean that these will stay the same forever.

Relying on sticking to compliance as a baseline will lead to complacency. Instead, implementing your own set of rules will help manage your security and protect you if compliance regulations change. Proactively Manage Systems Proactively managing your networks will help you prevent threats before they arise. Even minor disruptions, such as high traffic causing slow loading times on your website, should be dealt with immediately. If you employ real-time management security, you can prevent downtime from causing a significant issue.

Additionally, proactive management will help you spot new threats as they appear. Your security strategy should always include a proactive management plan. Implement and Update Security TechnologySecurity technology improves day by day. While you cannot always buy the latest technology, your future-proofed security strategy should allow for regular updates. Plan to conduct routine analysis of your physical and cyber security systems. Check whether they’re still doing the job they’re supposed to and if there are more cost-effective solutions available. Merging Cyber and Physical SecurityThe best way to future-proof your security strategy is to start merging your cyber and physical security technology. Cloud-based physical security can integrate with your cyber platforms to keep all your data in one place. As technology advances, integrated systems are increasingly popular.

Physical and cyber security have the same goal: to prevent and respond to threats. When you start viewing them as the same[...]

___________________________
@hacking_Attack
@Hacking_Video