hacking: security in practice
Knowing how a ddos attack works, how is it possible to block it?

I know ciber security companies know methods to block these kind of attacks by redirecting all the useless data to a remote memory but how does it work?

submitted by /u/Pollokonkeso
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Anyone knows how to run a reverse shell in COBOL?

Hello!

I'm working on a internal infrastructure pentest, and we've just discovered a vector of attack where we may be able to run COBOL scripts hopefully under SYSTEM. However, none of us has any experience with COBOL, so I figured that asking for help here could be faster than figuring it out, since google results for "COBOL reverse shell" didn't help. And, I think that it's actually a pretty cool question/exercise which I don't suppose happens often.

So, any COBOL experts here that could tell us if it's even possible (so we don't waste time trying something that can't be done), and could please point us in the right direction?

When COBOL was a thing, I wasn't even alive and I've only heard horror stories about it, so I'm afraid what we're getting ourselves into :D I will start my own research in the meantime, but any answer would help me a lot!

Thank you!

submitted by /u/Mikina
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Sensitive Information disclosure through unrestricted Directories

Hello Hackers and Security community..

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Eternal Blue — Lab and Process Report

https://cdn-images-1.medium.com/max/824/1*6lhVKJfHxXLL4eXwLefAiQ.png
Lab goals (I forgot to take a screenshot of one section before I answered them all, so I’ll omit it in case you don’t wan to see the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
My First Blind SQL Injection

https://cdn-images-1.medium.com/max/767/1*oUYINf0XN6NxTWOqb0mf-Q.png
Hello Hackers and security community..

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Hundreds of GoDaddy-hosted sites backdoored in a single day

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hundreds of GoDaddy-hosted sites backdoored in a single dayPost Views: 58
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 2 Minutes
Internet security analysts have spotted a spike in backdoor infections on WordPress websites hosted on GoDaddy’s Managed WordPress service, all featuring an identical backdoor payload.
The case affects internet service resellers such as MediaTemple, tsoHost, 123Reg, Domain Factory, Heart Internet, and Host Europe Managed WordPress.

The discovery comes from Wordfence, whose team first observed the malicious activity on March 11, 2022, with 298 websites infected by the backdoor within 24 hours, 281 of which were hosted on GoDaddy.
https://www.bleepstatic.com/images/news/u/1220909/Diagrams/diagram(5).jpg
Old template spammerThe backdoor infecting all sites is a 2015 Google search SEO-poisoning tool implanted on the wp-config.php to fetch spam link templates from the C2 that are used to inject malicious pages into search results.

The campaign uses predominately pharmaceutical spam templates, served to visitors of the compromised websites instead of the actual content.
See Also: Complete Offensive Security and Ethical Hacking Course
The goal of these templates is likely to entice the victims to make purchases of fake products, losing money and payment details to the threat actors.

Additionally, the actors can harm a website’s reputation by altering its content and making the breach evident, but this doesn’t seem to be the actors’ aim at this time.

This type of attack is harder to detect and stop from the user’s side due to this taking place on the server and not on the browser, and as such, local internet security tools won’t detect anything suspicious. Supply chain attack?The intrusion vector hasn’t been determined, so while this looks suspiciously close to a supply chain attack, it hasn’t been confirmed.

Bleeping Computer has contacted GoDaddy to find out more about this possibility, but we have not heard back yet.

Notably, GoDaddy disclosed a data breach in November 2021 that affected 1.2 million customers and multiple Managed WordPress service resellers, including the six mentioned in the introduction.
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH That breach involved unauthorized access to the system that provisions the company’s Managed WordPress sites. As such, it’s not far-fetched to suggest that the two occurrences might be linked.

In any case, if your website is hosted on GoDaddy’s Managed WordPress platform, make sure to scan your wp-config.php file to locate potential backdoor injections.
https://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/backdoor(1).png
Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com[...]

___________________________
@hacking_Attack
@Hacking_Video

/wp-content/uploads/2022/03/79ohvicqaKcVP9KT2mDdTH-90x90.jpg Most QNAP NAS Devices Affected by ‘Dirty Pipe’ Linux Flaw1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Lapsus-group-has-hacked-Ubisoft-as-well-90x90.jpg Ubisoft has confirmed it was hacked by Lapsus$ group2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/raccoon-stealer-90x90.jpg Raccoon Stealer Crawls Into Telegram3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/kali-bright-90x90.jpg Kali Unkaputtbar – a new feature on Kali Linux5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/wolf-in-sheps-clothing-2-scaled-e1646927438585-90x90.jpeg Malware Posing as Russia DDoS Tool Bites Ukraine Hackers6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/FTDZNGKMCJPIDKR5RE7MSLIMB4-scaled-90x90.jpg Agencies in Ukraine targeted with MicroBackdoor malware1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/NINTCHDBPICT000622539771-90x90.png Microsoft Addresses 3 Zero-Days & 3 Critical Bugs for March1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/linux-kernel-double-free-vulnerability-90x90.png New Linux bug gives root on all major distros, exploit released1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/firefox-90x90.jpg Mozilla Firefox 97.0.2 fixes two actively exploited zero-day bugs1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/small-business-internet-security-90x90.jpg Google WAF bypassed via oversized POST requests2 weeks ago
The post Hundreds of GoDaddy-hosted sites backdoored in a single day first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

My First Blind SQL Injection

Hello Hackers and security community..Continue reading on Medium »
Read more...

Prioritizing Targets - Internal Network Assessment
https://www.reddit.com/r/Pentesting/comments/tg6hlz/prioritizing_targets_internal_network_assessment/

Hello Pentesters, I would like to start a discussion about prioritizing targets. Imagine the follwing, you are in a internal network assessment and you are done with NMAP and a Vulnerability Scanner of your choice. The network is well hardened, so there are no low hanging fruit vulnerabilities which are easily identified from your vuln scanner. Also the network does not allow for easy access through LLMNR Poisioning or Spoofing. You have an Asset list with 500-600 Assets, but no obvious entry point. How do you visualize the Asset inventory and prioritize targets to uniquely investigate and attack? submitted by /u/larryxt (https://www.reddit.com/user/larryxt)
[link] (https://www.reddit.com/r/Pentesting/comments/tg6hlz/prioritizing_targets_internal_network_assessment/) [comments] (https://www.reddit.com/r/Pentesting/comments/tg6hlz/prioritizing_targets_internal_network_assessment/)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Heaptrace : Helps Visualize Heap Operations For Pwn And Debugging

Heaptrace is a heap debugger for tracking glibc heap operations in ELF64 (x86_64) binaries. Its purpose is to help visualize heap operations when debugging binaries or doing heap pwn.

* replaces addresses with easy-to-understand symbols
* detects heap corruption and memory leakage issues
* can debug in gdb at any point (--break)
* supports all ELF64 (x86_64) binaries regardless of ASLR or compiler settings (including stripped binaries)

Installation

Ubuntu PPA

$ sudo add-apt-repository ppa:arinerron/heaptrace
$ sudo apt-get update
$ sudo apt-get install heaptrace Arch User Repository (PKGBUILD)Use your preferred AUR helper to install one of the two following packages:

* heaptrace-git— source package (PKGBUILD)
* heaptrace— binary package (PKGBUILD)

$ trizen -S heaptrace-git
… OR …
$ trizen -S heaptrace

Compile from Source

$ git clone https://github.com/Arinerron/heaptrace.git && cd heaptrace
$ make
$ sudo make install
…
$ heaptrace ./target UsageYou can specify arguments to heaptrace before specifying the binary name:

Usage:
heaptrace [options…] [args…]
heaptrace [options…] –attach
Options:
-p , –attach , –pid
Tells heaptrace to attach to the specified pid
instead of running the binary from the targetargument. Note that if you specify this argument
you do not have to specify target.
-b , –break=, –break-at=
Send SIGSTOP to the process when the specified expressionis satisfied and attach the GNU debugger
(gdb) to the process.
This argument supports complex expressions. Please
See the documentation for more information:
https://github.com/Arinerron/heaptrace/wiki/How-to-Create-Breakpoints
-B , –break-after=
Similar to --break. Replaces the tracer
process with gdb, but only after the heap function
returns. See the documentation for more information:
https://github.com/Arinerron/heaptrace/wiki/How-to-Create-Breakpoints
-e , –environ=, –environment=
Sets a single environmental variable. Useful for
setting runtime settings for the target such as
LD_PRELOAD=./libc.so.6 without having them affect
heaptrace’s runtime configuration. This option can
be used multiple times.
-s , –symbols=
Override the values heaptrace detects for the
malloc/calloc/free/realloc/reallocarray symbols.
Useful if heaptrace fails to automatically
identify heap functions in a stripped binary. See
the wiki for more info.
-F, –follow-fork, –follow
Tells heaptrace to detach the parent and follow
the child if the target calls fork(), vfork(), or
clone().
The default behavior is to detach the child and
only trace the parent.
-G , –gdb-path
Tells heaptrace to use the path to gdb specified
in pathinstead of /usr/bin/gdb (default).
-w , –width=, –term-width=
Force a certain terminal width.
-o , –output=
Write the heaptrace output to fileinstead of
/dev/stderr (which is the default output path).
-v, –verbose
Prints verbose information such as line numbers in
source code given the required debugging info is
stored in the ELF.
-V, –version
Displays the current heaptrace version.
-h, –help Shows this help menu.

* For example, if you wanted to automatically attach gdb at operation #3, you would execute heaptrace --break=3 ./my-binary. Please see the wiki documentation for more information on how to use this argument.
* See the wiki documentation for more information on how to use the -s/--symbol argument to debug stripped binaries that heaptrace failed to automatically identify functions in.
* Set the $NO_COLORargument to remove ANSI color codes from output. This option is still in development and will be converted into an argument soon. Down[...]

___________________________
@hacking_Attack
@Hacking_Video

load

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
wmiexec-RegOut : Modify Version Of Impacket Wmiexec.Py, Get Output(Data,Response) From Registry

wmiexec-RegOut is the modify version of impacket wmiexec.py, wmipersist.py. Got output(data, response) from registry, don’t need SMB connection, but I’m in the bad code.

Overview

In original wmiexec.py, it get response from smb connection (port 445,139). Unfortunately, some antivirus software are monitoring these ports as high risk.
In this case, I drop smb connection function and use others method to execute command.

* wmiexec-reg-sch-UnderNT6-wip.py: Executed command by using win32-scheduledjob class. According to xiangshan, win32-scheduledjob class only works under windows NT6 (windows-server 2003).
BTW, win32_scheduledjob has been disabled by default after windows NT6. Here is the way how to enable it.

Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration
Name: EnableAt
Type: REG_DWORD
Value: 1

* wmipersist-wip.py (Highly recommend, !!!only works on impacket v0.9.24!!!): A Python version of WMIHACKER, which I picked the vbs template from it. Attacker can use it to do lateral movement safety under antivirus-software running.
* wmiexec-regOut.py: Just a simple Win32_Process.create method example .

How it works?

* wmiexec-wip.py workflow:Step 1:
* WMIC authenticated remotly
Step 2:
* Use win32process class and call create method to execute command. Then, write down the result into C:\windows\temp directory named [uuid].txt
Step 3:
* Encode the file content to base64 strings (need to wait a few seconds)
Step 4:
* Add the converted base64 string into registry, and key name call [uuid]
Step 5:
* Get the base64 strings remotly and decode it locally.

* wmipersist-wip.py workflow:Step 1:
* Add custom vbs script into ActiveScriptEventConsumer class.
Step 2:
* Creating an Event Filter.
Step 3:
* Trigger FilterToConsumerBinding class to PWNED!
Requirements

Generally, you just need to install official impacket.

* Portal

Usage

* wmiexec-wip.py usage:With cleartext password

python3 wmiexec-reg.py administrator:111qqq…@192.168.10.90 ‘whoami’

wmipersist-wip.py usage (Default is no output):

With cleartext password (without output)

python3 wmipersist-wip.py administrator:111qqq…@192.168.10.20 ‘command’
Download

___________________________
@hacking_Attack
@Hacking_Video

Cansina — Open Source Hidden Content Discovery Tool on Linux

Reconnaissance is one of the first steps to conduct within a pen test engagement. During this stage, information is gathered using…Continue reading on Medium »
Read more...

Cansina — Open Source Hidden Content Discovery Tool on Linux
https://thenurhabib.medium.com/cansina-open-source-hidden-content-discovery-tool-on-linux-c2bfb3bfce17?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Reconnaissance is one of the first steps to conduct within a pen test engagement. During this stage, information is gathered using…Continue reading on Medium » (https://thenurhabib.medium.com/cansina-open-source-hidden-content-discovery-tool-on-linux-c2bfb3bfce17?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Parameter Pollution - Zero Day
https://shahjerry33.medium.com/parameter-pollution-zero-day-3feb86ee8a02?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video