contains a HOW_TO_USE.md file and a QUERIES.md file. In the HOW_TO_USE.md file you can find the best queries to perform an investigation on how to escalate privileges (for Purple, Blue, and Red Teams). In the QUERIES.md file you will find all proposed queries to investigate the data easier. How to visualize the data in graphs Follow the instructions indicated in VISUALIZE_GRAPHS.md (https://github.com/carlospolop/PurplePanda/blob/master/VISUALIZE_GRAPHS.md) How to Contribute In the root folder and in each folder inside intel/ you will find a TODO.md file. You can find in those files how you can help. Just send a PR with the addition. PRs with fixes are also welcome :) Moreover, if you have other ideas that aren't in those TODO files feel free to send a PR. By Polop(TM)

Download PurplePanda (https://github.com/carlospolop/PurplePanda)

___________________________
@hacking_Attack
@Hacking_Video

Looking for a certain utility key
https://www.reddit.com/r/Pentesting/comments/tgbe6f/looking_for_a_certain_utility_key/

From the front it looks like a circle with a line through one side, kinda like a Q or a Ø. From the side it looks like a regular key blank, but the shaft is a hollow cylinder only about an inch long, with a small groove from the line. All help is appreciated, thanks submitted by /u/Maninblue69 (https://www.reddit.com/user/Maninblue69)
[link] (https://www.reddit.com/r/Pentesting/comments/tgbe6f/looking_for_a_certain_utility_key/) [comments] (https://www.reddit.com/r/Pentesting/comments/tgbe6f/looking_for_a_certain_utility_key/)

___________________________
@hacking_Attack
@Hacking_Video

Unraveling Assets from Android Apps at Scale - An OSINT API allows you to scan over half a million Android apps for subdomains, S3 buckets, URL Params and more
https://www.reddit.com/r/redteamsec/comments/tgc9od/unraveling_assets_from_android_apps_at_scale_an/

submitted by /u/alt-glitch (https://www.reddit.com/user/alt-glitch)
[link] (https://bevigil.com/blog/unraveling-assets-from-android-apps-at-scale/) [comments] (https://www.reddit.com/r/redteamsec/comments/tgc9od/unraveling_assets_from_android_apps_at_scale_an/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Enhancing DLP With Natural Language Understanding for Better Email Security

Natural language understanding is well-suited for scanning enterprise email to detect and filter out spam and other malicious content. Armorblox introduces a data loss prevention service to its email security platform using NLU.

Dark Reading: Attacks/Breaches
Cut Down on Alert Overload and Leverage Layered Security Measures

Feeling overwhelmed by the number of alerts? It doesn't have to be that way.

Cansina — Open Source Hidden Content Discovery Tool on Linux

Reconnaissance is one of the first steps to conduct within a pen test engagement. During this stage, information is gathered using…Continue reading on Medium »
Read more...

Kali Linux Tutorials
Elfloader : An Architecture-Agnostic ELF File Flattener For Shellcode

Elfloaderis a super simple loader for ELF files that generates a flat in-memory representation of the ELF.

Pair this with Rust and now you can write your shellcode in a proper, safe, high-level language. Any target that LLVM can target can be used, including custom target specifications for really exotic platforms and ABIs. Enjoy using things like u64s on 32-bit systems, bounds checked arrays, drop handling of allocations, etc https://s.w.org/images/core/emoji/13.1.0/72x72/1f642.png

It simply concatenates all LOADsections together, using zero-padding if there are gaps, into one big flat file.

This file includes zero-initialization of .bsssections, and thus can be used directly as a shellcode payload.

If you don’t want to waste time with fail-open linker scripts, this is probably a great way to go.

This doesn’t handle any relocations, it’s on you to make sure the original ELF is based at the address you want it to be at. UsageTo use this tool, simply:

Usage: elfloader [–perms] [–binary] [–base=]
–binary – Don’t output a FELF, output the raw loaded image with no
metadata
–perms – Create a FELF0002 which includes permission data, overrides
–binary
–base= – Force the output to start at , zero padding from
the base to the start of the first LOAD segment if needed. is default hex, can be overrided with 0d, 0b, 0x, or 0oprefixes.
Warning: This does not relocate to base, it simply starts
the output at (adding zero bytes such that the
output image can be loaded at instead of the
original ELF base)
– Path to input ELF
– Path to output file

To install this tool run: cargo install --path .Now you can use elfloaderfrom anywhere in your shell! DevThis project was developed live here: ExampleThere’s an example in example_small_program, simply run makeor nmakeand this should generate an example.binwhich is 8 bytes.

pleb@gamey ~/elfloader/example_small_program $ make
cargo build –release
Finished release [optimized] target(s) in 0.03s
elfloader –binary target/aarch64-unknown-none/release/example_small_program example.bin
pleb@gamey ~/elfloader/example_small_program $ ls -l ./example.bin
-rw-r–r– 1 pleb pleb 8 Nov 8 12:27 ./example.bin
pleb@gamey ~/elfloader/example_small_program $ objdump -d target/aarch64-unknown-none/release/example_small_program
target/aarch64-unknown-none/release/example_small_program: file format elf64-littleaarch64
Disassembly of section .text:
00000000133700b0 <_start:
133700b0: 8b000020 add x0, x1, x0
133700b4: d65f03c0 ret

Now you can write your shellcode in Rust, and you don’t have to worry about whether you emit .data, .rodata, .bss, etc. This will handle it all for you!

There’s also an example with .bssand .rodatapleb@gamey ~/elfloader/example_program_with_data $ make
cargo build –release
Finished release [optimized] target(s) in 0.04s
elfloader –binary target/aarch64-unknown-none/release/example_program_with_data example.bin
pleb@gamey ~/elfloader/example_program_with_data $ ls -l ./example.bin
-rw-r–r– 1 pleb pleb 29 Nov 8 12:39 ./example.bin
pleb@gamey ~/elfloader/example_program_with_data $ objdump -d target/aarch64-unknown-none/release/example_program_with_data
target/aarch64-unknown-none/release/example_program_with_data: file format elf64-littleaarch64
Disassembly of section .text:
0000000013370124 <_start:
13370124: 90000000 adrp x0, 13370000 <_start-0x124
13370128: 90000008 adrp x8, 13370000 <_start-0x124
1337012c: 5280[...]

___________________________
@hacking_Attack
@Hacking_Video

0029 mov w9, #0x1 // #1
13370130: 91048000 add x0, x0, #0x120
13370134: 3904f109 strb w9, [x8, #316]
13370138: d65f03c0 ret
pleb@gamey ~/elfloader/example_program_with_data $ readelf -l target/aarch64-unknown-none/release/example_program_with_data
Elf file type is EXEC (Executable file)
Entry point 0x13370124
There are 4 program headers, starting at offset 64
Program Headers:
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
LOAD 0x0000000000000120 0x0000000013370120 0x0000000013370120
0x0000000000000004 0x0000000000000004 R 0x1
LOAD 0x0000000000000124 0x0000000013370124 0x0000000013370124
0x0000000000000018 0x0000000000000018 R E 0x4
LOAD 0x000000000000013c 0x000000001337013c 0x000000001337013c
0x0000000000000000 0x0000000000000001 RW 0x4
GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 RW 0x0
Section to Segment mapping:
Segment Sections…
00 .rodata
01 .text
02 .bss
03 InternalsThis tool doesn’t care about anything except for LOADsections. It determines the endianness (little vs big) and bitness (32 vs 64) from the ELF header, and from there it creates a flat image based on program header virtual addresses (where it’s loaded), file size (number of initialized bytes) and mem size (size of actual memory region). The bytes are initialized from the file based on the offset and file size, and this is then extended with zeros until mem size (or truncated if mem size is smaller than file size).

These LOADsections are then concatenated together with zero-byte padding for gaps.

This is designed to be incredibly simple, and agnostic to the ELF input. It could be an executable, object file, shared object, core dump, etc, doesn’t really care. It’ll simply give you the flat representation of the memory, nothing more.

This allows you to turn any ELF into shellcode, or a simpler file format that is easier to load in hard-to-reach areas, like embedded devices. Personally, I developed this for my MIPS NT 4.0 loader which allows me to run Rust code. FELF0001 formatThis tool by default generates a FELF file format. This is a Falk ELF. This is a simple file format:

FELF0001 – Magic header
entry – 64-bit little endian integer of the entry point address
base – 64-bit little endian integer of the base address to load the image
– Rest of the file is the raw image, to be loaded at baseand jumped
into at entryFELF0002 format (when –perms flag is used)This tool by default generates a FELF file format. This is a Falk ELF. This is a simple file format with permissions:

FELF0002 – Magic header
entry – 64-bit little endian integer of the entry point address
base – 64-bit little endian integer of the base address to load the image
– Rest of the file is the raw image, to be loaded at baseand jumped
into at entry– Permissions, matching the bytes of where the byte contains
the following flags bitwise or-ed together:
0x01 – Executable, 0x02 – Writable, 0x04 – Readable
Padding bytes will be 0x00, and thus have no permissions for any
access Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
SQLRecon : A C# MS SQL Toolkit Designed For Offensive Reconnaissance And Post-Exploitation

SQLRecon is a C# MS-SQL toolkit designed for offensive reconnaissance and post-exploitation. For detailed usage information on each technique, refer to the wiki. UsageYou can grab a copy of SQLRecon from the releases page. Alternatively, feel free to compile the solution yourself This should be as straight forward as cloning the repo, double clicking the solution file and building. Mandatory ArgumentsThe mandatory arguments consist of an authentication type (either Windows, Local or Azure), connection parameters and a module.

* -a – Authentication Type
* -a Windows – Use Windows authentication. This uses the current users token.
* -a Local – Use local authentication. This requires the credentials for a local database user.
* -a Azure – Use Azure AD domain username and password authentication. This requires the credentials for a domain user.
If the authentication type is Windows, then you will need to supply the following parameters.

* -s SERVERNAME – SQL server hostname
* -d DATABASE – SQL server database name
* -m MODULE – The module you want to use

If the authentication type is Local, then you will need to supply the following parameters.

* -d DATABASE – SQL server database name
* -u USERNAME – Username of local SQL user
* -p PASSWORD – Password of local SQL user
* -m MODULE – The module you want to use

If the authentication type is Azure, then you will need to supply the following parameters.

* -d DATABASE – SQL server database name
* -r DOMAIN.COM – FQDN of Domain
* -u USERNAME – Username of domain user
* -p PASSWORD – Password of domain user
* -m MODULE – The module you want to use Standard ModulesStandard modules are used to interact against a single MS SQL server.

* query -o QUERY – Execute an arbitrary SQL query
* whoami – See what user you are logged in as
* mapped – See what user you are mapped to
* roles – Enumerate if the user has public and/or sysadmin roles mapped
* databases – Show all databases present on the SQL server
* tables – Show all tables in the database you are connected to
* search -o KEYWORD – Search column names within tables of the database you are connected to.
* smb -o SHARE – Capture NetNTLMv2 hash
* enablexp – Enable xp_cmdshell (requires sysadmin role or similar)
* disablexp – Disable xp_cmdshell (requires sysadmin role or similar)
* xpcmd -o COMMAND – Execute an arbitrary system command (requires sysadmin role or similar)
* enableole – Enable OLE Automation Procedures (requires sysadmin role or similar)
* disableole – Disable OLE Automation Procedures (requires sysadmin role or similar)
* olecmd -o COMMAND – Execute an arbitrary system command (requires sysadmin role or similar)
* enableclr – Enable Custom CLR Assemblies (requires sysadmin role or similar)
* disableclr – Disable Custom CLR Assemblies (requires sysadmin role or similar)
* impersonate – Enumerate any user accounts that can be impersonated
* links – Enumerate any linked SQL servers Impersonation ModulesImpersonation modules are used to interact against a single MS SQL server, under the context of an impersonated SQL user.

* iquery -i IMPERSONATEUSER -o QUERY – Execute an arbitrary SQL query as an impersonated user
* ienablexp -i IMPERSONATEUSER – Enable xp_cmdshell (requires sysadmin role or similar)
* idisablexp -i IMPERSONATEUSER– Disable xp_cmdshell (requires sysadmin role or similar)
* ixpcmd -i IMPERSONATEUSER -o COMMAND – Execute an arbitrary system command (requires sysadmin role or similar)
* ienableole -i IMPERSONATEUSER – Enable OLE Automation Procedures (requires sysadmin role or similar)
* idisableole -i IMPERSONATEUSER – Disable OLE Automation Procedures (requires sysadmin role or similar)
* iolecmd -i IMPERSONATEUSER -o COMMAND – Execute an arb[...]

___________________________
@hacking_Attack
@Hacking_Video

itrary system command (requires sysadmin role or similar) Linked SQL Server ModulesLinked SQL Server modules are effective when you are able to interact with a linked SQL server via an established connection.

* ldatabases -l LINKEDSERVERNAME – Show all databases present on the Linked SQL server
* ltables -l LINKEDSERVERNAME – Show all tables in the database you are connected to on the Linked SQL server
* lquery -l LINKEDSERVERNAME -o QUERY – Execute an arbitrary SQL query on a linked SQL server Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Who Am I ?

Hi guys, I'm your friendly neighborhood Jayachandran 😉. I want to share my knowledge on this platform. Ok, wait, who am I ? I'm a Blogger…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Online Book Store v1.0 exploit

https://cdn-images-1.medium.com/max/1199/1*eerGIgV5Ognd70x3nunkMg.png
Se ejecuta un simple RCE para realizar nuestras practicas de explotación

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to Become an Ethical Hacker in 2022?

https://cdn-images-1.medium.com/max/600/0*1NzIN4UsVNxxbfjn
What is Ethical Hacking?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
La botnet DirtyMoe obtiene nuevos exploits en el módulo Wormable para propagarse rápidamente

https://cdn-images-1.medium.com/max/1536/0*byWvJNd5EQZjT44R
PUBLICADO EN 17 MARZO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to Copy an Apartment Fob (HID ProxCard) with a Proxmark3 RDV4

https://cdn-images-1.medium.com/max/2297/1*Gc_L4h1vIAqM34Jnj4YdNw.png
If you’ve lived in an apartment complex you’re probably familiar with key fobs or cards used for access control systems, unfortunately…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Exploit completed, but no session was created. - proftp_telnet_iac

Hello, i just setup a kali VM and ran metasploit on it, when trying to use the proftp_telnet_iac exploit it throws back (Censored RHOST):

Started reverse TCP handler on 0.0.0.0:4444

[*] - Automatically detecting the target...

[*] - FTP Banner: 220 ProFTPD 1.3.3a Server (Debian) [::ffff:10.126.75.4]

[*] - Selected Target: ProFTPD 1.3.3a Server (Debian) - Squeeze Beta1

[*] Exploit completed, but no session was created.

What should i do to make it work?, pretty sure it's something related to the LPORT or LHOST, I put my IP on LHOST, and left LPORT on default without setting up anything, can someone give me a helping hand?

submitted by /u/HackerArgento
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to create a personal gpedit to change Group Policy for powershell execution policy bypass.

https://external-preview.redd.it/PYGzYQtMpbr3_8g6UMaY9hFhufw5RhrT5GTDRp1pOyY.jpg?width=108&crop=smart&auto=webp&s=6e8713c3fca180c7b1e56df0d002b644791a81ab submitted by /u/chaseNscores
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video