Hacking on Medium
What is LXC & LXD | How to escalate privileges using LXD in linux systems

https://cdn-images-1.medium.com/max/977/1*0ICh8FBZ_426IeOx3Bo86g.png
Hey Hackers!!!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
CodeAnalysis - Static Code Analysis

https://blogger.googleusercontent.com/img/a/AVvXsEhh10PnIKy45SPiRpjS2fjFf4x2ie5fqMsOWno8LL015kvaQAdZcxDGcSxlreb_koP3N8mnWUbuSYR420hyHT9LzS2sW-U_lEAsST0z8ktQFShEW2mPlJWMxIZFDNRz_L5Kh4AL2qpUMAdwJE1HthKuSp-Pj4yFzgB-s2wRyedKc0vC7x5KO9zgpjcY=w400-h384 Tencent Cloud Code Analysis (TCA for short, code-named CodeDog inside the company early) is a comprehensive platform for code analysis and issue tracking. TCA consist of three components, server, web and client. It also supports the integration of other code analysis tools.
Code analysis is a technology, using lexical analysis, syntax analysis, control-flow analysis, data-flow analysis to make a comprehensive analysis of the code, so as to verify whether the code meets the requirements of normative, security, reliability, maintainability and other indicators.

Using TCA can help team find normative, structural, security vulnerabilities and other issues in the code, continuously monitor the quality of the project code and issue alerts. At the same time, TCA opens up APIs to support connection with upstream and downstream systems, so as to integrate code analysis capabilities, ensure code quality, and be more conducive to inheriting an excellent team code culture. https://blogger.googleusercontent.com/img/a/AVvXsEiSOSLbVVncbTqw4UTbVh_y_GLxNSsz9vd_mVw1meiRgaBbKBrWp9vdXcjmk51U8bHHepPYWI-uXWyRFsV9gvj2CaQLb8xIGYH3LM_Rqwghz36GhT96VISbpNPDg1Jo2YUM7iC2tvPBarsNZ6XhuNRl-KU15PCvhlprGyYtK5kLcoi9X0JhFfadIWwW=w640-h104 https://blogger.googleusercontent.com/img/a/AVvXsEiSHNogeee8uZtBhrc4HyZycbcqQGtwQT3SoUC5htOiVskKfFXSlfbfsh4Gd44MyiRMBIW8biSAv3fN4YWgeApvuStLJw89hbjHGpWlYBUt_5O1p0KQfm7byjKtVSbjJDw2bzsnN6AWZZ7b3uoIBjVsbjJPKnzIeH3fV-2Je18RjWL4jooQmREMdX04=w640-h304 ExperienceApply Link Key Features1. Language support: It supports Java/C++/Objective-C/C#/JavaScript/Python/Go/PHP and more, covering common programming languages.
2. Code inspection: Discover code quality defects, code specification problems, code security vulnerabilities, invalid codes, etc. At present, many self-developed and well-known open source analysis tools have been integrated. The layered architecture can support rapid self-service management tools for teams.
3. Code measurement: Support comprehensive measurement of code from the three dimensions of code cyclomatic complexity, code repetition rate and code statistics.
4. DevOps integration: The client can be started via the command line. Standard APIs support connection to upstream and downstream systems, and various DevOps systems. Getting Started* How to get start
* How to deploy server and web
* How to deploy server and web with docker-compose
* How to use client
* Deploy Q&A Community* QQ Group: 361791391
* Discussion
* Wiki
* White Paper Changelogs* Check our Changelog Contributing* Check out CONTRIBUTING to see how to develop with TCA.
* Tencent Open Source Incentive Program encourages the participation and contribution of developers. We look forward to your active participation. LicenseTCA is MIT licensed Download CodeAnalysis

___________________________
@hacking_Attack
@Hacking_Video

CodeAnalysis - Static Code Analysis
http://www.kitploit.com/2022/03/codeanalysis-static-code-analysis.html

___________________________
@hacking_Attack
@Hacking_Video

Tencent Cloud Code Analysis (https://www.kitploit.com/search/label/Code%20Analysis) (TCA for short, code-named CodeDog inside the company early) is a comprehensive platform for code analysis and issue tracking. TCA consist of three components, server, web and client. It also supports the integration of other code analysis tools.
Code analysis is a technology, using lexical analysis, syntax analysis, control-flow analysis, data-flow analysis to make a comprehensive analysis of the code, so as to verify whether the code meets the requirements (https://www.kitploit.com/search/label/Requirements) of normative, security, reliability, maintainability and other indicators. Using TCA can help team find normative, structural, security vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) and other issues in the code, continuously monitor the quality of the project code and issue alerts. At the same time, TCA opens up APIs to support connection with upstream and downstream systems, so as to integrate code analysis capabilities, ensure code quality, and be more conducive to inheriting an excellent team code culture.

___________________________
@hacking_Attack
@Hacking_Video

Experience Apply Link (https://cloud.tencent.com/apply/p/44ncv4hzp1) Key Features Language support: It supports Java/C++/Objective-C/C#/JavaScript/Python/Go/PHP and more, covering common programming languages. Code inspection: Discover code quality (https://www.kitploit.com/search/label/Code%20Quality) defects, code specification problems, code security vulnerabilities, invalid codes, etc. At present, many self-developed and well-known open source analysis tools have been integrated. The layered architecture can support rapid self-service management (https://www.kitploit.com/search/label/Management) tools for teams. Code measurement: Support comprehensive measurement of code from the three dimensions of code cyclomatic complexity, code repetition rate and code statistics. DevOps integration: The client can be started via the command line. Standard APIs support connection to upstream and downstream systems, and various DevOps systems. Getting Started How to get start (https://github.com/Tencent/CodeAnalysis/blob/main/GettingStart(%E5%BF%AB%E9%80%9F%E5%85%A5%E9%97%A8).md) How to deploy server and web (https://github.com/Tencent/CodeAnalysis/blob/main/doc/deploy.md) How to deploy server and web with docker-compose (https://github.com/Tencent/CodeAnalysis/blob/main/doc/deploy_dc.md) How to use client (https://github.com/Tencent/CodeAnalysis/blob/main/doc/client.md) Deploy Q&A (https://github.com/Tencent/CodeAnalysis/blob/main/doc/Q&A.md) Community QQ Group: 361791391 Discussion (https://github.com/Tencent/CodeAnalysis/discussions) Wiki (https://github.com/Tencent/CodeAnalysis/wiki) White Paper (https://github.com/Tencent/CodeAnalysis/blob/main/%E8%85%BE%E8%AE%AF%E4%BA%91%E4%BB%A3%E7%A0%81%E5%88%86%E6%9E%90%E7%99%BD%E7%9A%AE%E4%B9%A6.pdf) Changelogs Check our Changelog (https://github.com/Tencent/CodeAnalysis/blob/main/CHANGELOG.md) Contributing Check out CONTRIBUTING (https://github.com/Tencent/CodeAnalysis/blob/main/CONTRIBUTING.md) to see how to develop with TCA. Tencent Open Source Incentive Program (https://opensource.tencent.com/contribution) encourages the participation and contribution of developers. We look forward to your active participation. License TCA is MIT licensed (https://github.com/Tencent/CodeAnalysis/blob/main/LICENSE)

Download CodeAnalysis (https://github.com/Tencent/CodeAnalysis)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Governments Should Decide Who Gets to Buy Spyware

And the world must face the fact that offensive cyber tools have evolved into weapons that are no different from tanks, drones, or missiles.

Kali Linux Tutorials
Bluffy : Convert Shellcode Into Different Formats

Bluffy is a utility which was used in experiments to bypass Anti-Virus products (statically) by formatting shellcode into realistic looking data formats.

Proof-of-concept tools, such as 0xBoku’s Ninja_UUID_Runner and ChoiSG’s UuidShellcodeExec, inspired the initial concept for Bluffy.

So far, we implemented:

1. UUID
2. CLSID
3. SVG
4. CSS
5. CSV

Help

$ python3 bluffy.py -h
⣇⣿⠘⣿⣿⣿⡿⡿⣟⣟⢟⢟⢝⠵⡝⣿⡿⢂⣼⣿⣷⣌⠩⡫⡻⣝⠹⢿⣿⣷
⡆⣿⣆⠱⣝⡵⣝⢅⠙⣿⢕⢕⢕⢕⢝⣥⢒⠅⣿⣿⣿⡿⣳⣌⠪⡪⣡⢑⢝⣇
⡆⣿⣿⣦⠹⣳⣳⣕⢅⠈⢗⢕⢕⢕⢕⢕⢈⢆⠟⠋⠉⠁⠉⠉⠁⠈⠼⢐⢕⢽
⡗⢰⣶⣶⣦⣝⢝⢕⢕⠅⡆⢕⢕⢕⢕⢕⣴⠏⣠⡶⠛⡉⡉⡛⢶⣦⡀⠐⣕⢕
⡝⡄⢻⢟⣿⣿⣷⣕⣕⣅⣿⣔⣕⣵⣵⣿⣿⢠⣿⢠⣮⡈⣌⠨⠅⠹⣷⡀⢱⢕
⡝⡵⠟⠈⢀⣀⣀⡀⠉⢿⣿⣿⣿⣿⣿⣿⣿⣼⣿⢈⡋⠴⢿⡟⣡⡇⣿⡇⡀⢕
⡝⠁⣠⣾⠟⡉⡉⡉⠻⣦⣻⣿⣿⣿⣿⣿⣿⣿⣿⣧⠸⣿⣦⣥⣿⡇⡿⣰⢗⢄
⠁⢰⣿⡏⣴⣌⠈⣌⠡⠈⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣬⣉⣉⣁⣄⢖⢕⢕⢕
⡀⢻⣿⡇⢙⠁⠴⢿⡟⣡⡆⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣵⣵⣿
⡻⣄⣻⣿⣌⠘⢿⣷⣥⣿⠇⣿⣿⣿⣿⣿⣿⠛⠻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
⣷⢄⠻⣿⣟⠿⠦⠍⠉⣡⣾⣿⣿⣿⣿⣿⣿⢸⣿⣦⠙⣿⣿⣿⣿⣿⣿⣿⣿⠟
⡕⡑⣑⣈⣻⢗⢟⢞⢝⣻⣿⣿⣿⣿⣿⣿⣿⠸⣿⠿⠃⣿⣿⣿⣿⣿⣿⡿⠁⣠
⡝⡵⡈⢟⢕⢕⢕⢕⣵⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣶⣿⣿⣿⣿⣿⠿⠋⣀⣈⠙
⡝⡵⡕⡀⠑⠳⠿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠛⢉⡠⡲⡫⡪⡪⡣
Convert shellcode into https://s.w.org/images/core/emoji/13.1.0/72x72/2728.png different https://s.w.org/images/core/emoji/13.1.0/72x72/2728.png formats!
Written by:
~ Mez0
~ Michael Ranaldo
usage: Bluffy [-h] -b -o -m
optional arguments:
-h, –help show this help message and exit
-b , –bin Specify bin file to load
-m , –mask Specify the mask for the shellcode
-x , –xor XOR the payload
-p , –preview Preview the created format
-pp, –payload_preview Preview the payload prior to C formatting
–list List all the available masks

Written by:

* Michael Ranaldo
* Mez0

Requirements And Installation

The following items must be installed prior to using Bluff:

python3.9 or greater

sudo apt install python3.9

rich

sudo pip3 install rich

pcre2.8

Depending on whether its going to be ran on Kali, Ubuntu 18, 19, 20, and so on, the process of getting and building with pcre2.8may be different.

For us on Ubuntu, it was developed on

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 21.04
Release: 21.04
Codename: hirsute

In order to link libpcre2-8.a, the .afile had to be included within:

/usr/lib/gcc/x86_64-w64-mingw32/10-win32

As for obtaining the header and lib files, MSYS2 was used. But if you’re smarter than us, then just do it from source for Mingw64: https://pcre.org/.

The simplest way to thus acquire and install is to run the following commands (after double checking your architecture etc.):

sudo apt install mingw-64
sudo wget https://packages.msys2.org/package/mingw-w64-x86_64-pcre2?repo=mingw64 -P /usr/lib/gcc/x86_64-w64-mingw32/10-win32

Using Bluffy

To build a payload, get your binary file. For this example, we used calc.bin, which just loads calc.exe as a proof of concept. As Bluffy only seeks to evade static analysis using steganography, by hiding the binary within an otherwise innocuous file, you will need to do further research to ensure that your payload also evades dynamic detection.

Run bluffy, choosing a mask of your choice and providing your .bin file:

python ./bluffy.py -b calc.bin -m css -x

Check your payload, then build it. To build your payload, copy the .h file bluffy creates, rename it css.c, run make to build it to an executable, then test using the included examples directory:

mv css.h examples/css/css.h
cd examples/css
make

This will use the included “main.c” to build an Windows executable. Test this to confirm. If you have also used calc.bin, you should be greeted by a new Calc window opening. If so, congratulations!
Download

Kali Linux Tutorials
Kerbrute : An Script To Perform Kerberos Bruteforcing By Using Impacket

Kerbrute is a script to perform kerberos bruteforcing by using the Impacket library.

When is executed, as input it receives a user or list of users and a password or list of password. Then is performs a brute-force attack to enumerate:

* Valid username/passwords pairs
* Valid usernames
* Usernames without pre-authentication required

As a result, the script generates a list of valid credentials discovered, and the TGT’s generated due those valid credentials.

Installation

From pypi:

pip3 install kerbrute

From repo:

git clone https://github.com/TarlogicSecurity/kerbrute
cd kerbrute
pip install -r requirements.txt

Use

Help without arguments:

root@kali:~# kerbrute
Impacket v0.9.18 – Copyright 2018 SecureAuth Corporation
usage: kerbrute.py [-h] [-debug] (-user USER | -users USERS)
[-password PASSWORD | -passwords PASSWORDS] -domain DOMAIN
[-dc-ip ] [-threads THREADS]
[-outputfile OUTPUTFILE] [-no-save-ticket]
optional arguments:
-h, –help show this help message and exit
-debug Turn DEBUG output ON
-user USER User to perform bruteforcing
-users USERS File with user per line
-password PASSWORD Password to perform bruteforcing
-passwords PASSWORDS File with password per line
-domain DOMAIN Domain to perform bruteforcing
-dc-ip IP Address of the domain controller
-threads THREADS Number of threads to perform bruteforcing. Default = 1
-outputfile OUTPUTFILE
File to save discovered user:password
-no-save-ticket Do not save retrieved TGTs with correct credentials
Examples:
./kerbrute.py -users users_file.txt -passwords passwords_file.txt -domain contoso.com

Example of execution:

root@kali:~# kerbrute -domain jurassic.park -users users.txt -passwords passwords.txt -outputfile jurassic_passwords.txt
Impacket v0.9.18 – Copyright 2018 SecureAuth Corporation
[] Stupendous => triceratops:Sh4rpH0rns [] Saved TGT in triceratops.ccache
[] Valid user => velociraptor [NOT PREAUTH] [] Valid user => trex
[*] Saved discovered passwords in jurassic_passwords.txt
Download

hacking: security in practice
OffensiveNotion: Notion (yes, the notetaking app) as a C2.

https://external-preview.redd.it/0YahZV8lYY-ZbHCLr4cINtp1WnlXk4tdYWDC-7j2eWE.jpg?width=640&crop=smart&auto=webp&s=3e316a1887d2203bb5fec294847f6b85737e8a9e submitted by /u/DrinkMoreCodeMore
[link] [comments]

hacking: security in practice
Looking for some web advice

Hi!

I'm looking for a little advice regarding a site I'm trying to develop, I need to find a creative workaround for something regarding HTTP requests, iframes, and captcha.

Would love to sit and brainstorm on discord, hmu if it sounds fun :)

submitted by /u/GarlicBreadIsNice
[link] [comments]

Story about more than 3.5 million PII leakage in Yahoo!!!
https://dhakalbibek.medium.com/story-about-more-than-3-5-million-pii-leakage-in-yahoo-78f98bf69b49?source=rss------bug_bounty-5

Hello GUYS,Continue reading on Medium » (https://dhakalbibek.medium.com/story-about-more-than-3-5-million-pii-leakage-in-yahoo-78f98bf69b49?source=rss------bug_bounty-5)

Hacking on Medium
Nuevo error de Linux en el módulo de firewall de Netfilter permite a los atacantes obtener acceso…

https://cdn-images-1.medium.com/max/849/0*ggnAjCvamzrDcZuZ
PUBLICADO EN 14 MARZO, 2022POR EHACKING

Continue reading on Medium »