hacking: security in practice
I found out I can inject html into my school’s online hall pass system.

If I use a

___________________________
@hacking_Attack
@Hacking_Video

OffSecOps: Using Jenkins For Red Team Tooling
https://www.reddit.com/r/redteamsec/comments/tjxgbj/offsecops_using_jenkins_for_red_team_tooling/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://http418infosec.com/offsecops-using-jenkins-for-red-team-tooling) [comments] (https://www.reddit.com/r/redteamsec/comments/tjxgbj/offsecops_using_jenkins_for_red_team_tooling/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Account Takeovers Follow LinkedIn Data Breach, 2012 & 2016

On June 6th, 2012, LinkedIn responded to a seemingly harmless data breach that had occurred the day before. It appeared as though Russian…

Continue reading on Medium »

hacking: security in practice
Is there a way to tell if your computer activity is monitored?

Is there a way to tell if your computer activity is monitored on Windows 11? Long story short, my neighbors have been stalking me on social media after an argument about noise. I doubt they can hack, but I want to be sure anything I view or do isn't being watched or recorded. I've confirmed they were stalking me on social media, so it's not just paranoia. Any suggestions? I've already changed my network details and deactivated my social media accounts.

submitted by /u/bananasrulethisworld
[link] [comments]

hacking: security in practice
FBI Seizes $2.3 Million in Ransomware Payments from Russian Affiliate of REvil and GandCrab RaaS Operations

https://external-preview.redd.it/8TYCfir_LcjgUZV5GyohRQOQd7lsOuCeOydrjD4IFpM.jpg?width=320&crop=smart&auto=webp&s=e9f961e945fb6f1107adaa604fe24d333b81be03 submitted by /u/IleenRyder
[link] [comments]

A Bottle Message to Bug Hunters!
https://infosecwriteups.com/a-bottle-message-to-bug-hunters-18e5835069e6?source=rss------bug_bounty-5

Bug Bounty = PatienceContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/a-bottle-message-to-bug-hunters-18e5835069e6?source=rss------bug_bounty-5)

A Bottle Message to Bug Hunters!

Bug Bounty = PatienceContinue reading on InfoSec Write-ups »
Read more...

Black Hat Ethical Hacking
Browser-in-the-Browser Attack Makes Phishing Nearly Invisible

Browser-in-the-Browser Attack Makes Phishing Nearly InvisiblePost Views: 73
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 2 Minutes
The novel method takes advantage of third-party single sign-on (SSO) options embedded on websites that issue popup windows for authentication, such as “Sign in with Google,” Facebook, Apple or Microsoft.
Can we trust web browsers to protect us, even if they say “https?” Not with the novel BitB attack, which fakes popup SSO windows to phish away credentials for Google, Facebook and Microsoft, et al.
We’ve had it beaten into our brains: Before you go wily-nily clicking on a page, check the URL. First things first, the tried-and-usually-but-not-always-true advice goes, check that the site’s URL shows “https,” indicating that the site is secured with TLS/SSL encryption.

If only it were that easy to avoid phishing sites. In reality, URL reliability hasn’t been absolute for a long time, given things like homograph attacks that swap in similar-looking characters in order to create new, identical-looking but malicious URLs, as well as DNS hijacking, in which Domain Name System (DNS) queries are subverted.

Now, there’s one more way to trick targets into coughing up sensitive info, with a coding ruse that’s invisible to the naked eye. The novel phishing technique, described last week by a penetration tester and security researcher who goes by the handle mr.d0x, is called a browser-in-the-browser (BitB) attack.
See Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions.png The researcher used Canva as an example: In the log-in window for Canva shown below, the popup asks users to authenticate via their Google account. https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/21194343/Legit-login-to-Canva-e1647906237286.png Login to Canva using Google account credentials. Source: mr.d0x It’s Easy to Fabricate an Identical, Malicious PopupThese days, SSO popups are a routine way to authenticate when you sign in.

But according to mr.d0x’s post, completely fabricating a malicious version of a popup window is a snap: It’s “quite simple” using basic HTML/CSS, the researcher said. The concocted popups simulate a browser window within the browser, spoofing a legitimate domain and making it possible to stage convincing phishing attacks.

“Combine the window design with an iframe pointing to the malicious server hosting the phishing page, and [it’s] basically indistinguishable,” mr.d0x wrote. The report provided an image, included below, that shows a side-by-side of a fake window next to the real window. https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/21194525/real-v-fake-login-pages-e1647906342234.png Nearly identical real vs. fake login pages. Source: mr.d0x.
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH “Very few people would notice the slight differences between the two,” according to the report.

JavaScript can make the window appear on a link, button click or page loading screen, the report continued. As well, libraries – such as the popular JQuery JavaScript library – can make the window appear visually appealing … or, at least, visually bouncy, as depicted in the .gif provided in the researcher’s demo and shown below. https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/21154801/BitB-demo.gif BitB demo. Source: mr.d0x. Hovering Over Links: Another Easily Fooled Security SafeguardThe BitB attack can also flummox those who use the [...]

Kali Linux Tutorials
AWS-Loot : Pull Secrets From An AWS Environment

AWS-Loot tool allows quick enumeration over large sets of AWS instances and services.

Install

pip install -r requirements.txt

An AWS credential file (.aws/credentials) is required for authentication to the target environment

* Access Key
* Access Key Secret

How it works

Awsloot works by going through EC2, Lambda, CodeBuilder instances and searching for high entropy strings. The EC2 Looter works by querying all available instance ID’s in all regions and requesting instance’s USERDATA where often developers leave secrets. The Lambda looter operates across regions as well. Lambada looter can search all available versions of a found function. It starts by searching the functions environment variables then downloads the source code and scans the source for secrets. The Codebuilder Looter works by searching for build instances and searching those builds for environment variables that might contain secrets.

Usage

Python3 awsloot.py

Next Features

* Allow users to specify an ARN to scan
* Looter for additional services
Download

Kali Linux Tutorials
LDAP-Password-Hunter : Password Hunter In The LDAP Infamous Database

LDAP Password Hunter is a tool which wraps features of getTGT.py (Impacket) and ldapsearch in order to look up for password stored in LDAP database. Impacket getTGT.py script is used in order to authenticate the domain account used for enumeration and save its TGT kerberos ticket. TGT ticket is then exported in KRB5CCNAME variable which is used by ldapsearch script to authenticate and obtain TGS kerberos tickets for each domain/DC LDAP-Password-Hunter is ran for. Basing on the CN=Schema,CN=Configuration export results a custom list of attributes is built and filtered in order to identify a big query which might contains interesting results. Results are shown and saved in a sqlite3 database. The DB is made of one table containing the following columns:

* DistinguishedName
* AttributeName
* Value
* Domain

Results are way more clean than the previous version and organized in the SQL DB. The output shows the entries found only if they are not in DB, so new entries pop up but the overall outcome of the analysis is still saved in a file with a timestamp.

Requirements

* Ldapsearch
* Impacket
* Sqlite

Usage

Be sure your krb5.conf file is clean and the domains.txt and conf.txt are filled properly.

From the project folder:

./run.sh
Download

Kali Linux Tutorials
TerraGoat : Vulnerable Terraform Infrastructure

TerraGoat is Bridgecrew’s “Vulnerable by Design” Terraform repository. TerraGoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments. IntroductionTerraGoat was built to enable DevSecOps design and implement a sustainable misconfiguration prevention strategy. It can be used to test a policy-as-code framework like Bridgecrew & Checkov, inline-linters, pre-commit hooks or other code scanning methods.

TerraGoat follows the tradition of existing *Goat projects that provide a baseline training ground to practice implementing secure development best practices for cloud infrastructure. Important notes* Where to get help: the Bridge crew Community Slack

Before you proceed please take a not of these warning:

Terra Goat creates intentionally vulnerable AWS resources into your account. DO NOT deploy TerraGoat in a production environment or alongside any sensitive AWS resources. Requirements* Terraform 0.12
* aws cli
* azure cli

To prevent vulnerable infrastructure from arriving to production see: Bridgecrew & checkov, the open source static analysis tool for infrastructure as code. Getting startedAWS SetupInstallation (AWS)You can deploy multiple TerraGoat stacks in a single AWS account using the parameter TF_VAR_environment. Create an S3 Bucket backend to keep Terraform stateexport TERRAGOAT_STATE_BUCKET=”mydevsecops-bucket”
export TF_VAR_company_name=acme
export TF_VAR_environment=mydevsecops
export TF_VAR_region=”us-west-2″
aws s3api create-bucket –bucket $TERRAGOAT_STATE_BUCKET \
–region $TF_VAR_region –create-bucket-configuration LocationConstraint=$TF_VAR_region
Enable versioning
aws s3api put-bucket-versioning –bucket $TERRAGOAT_STATE_BUCKET –versioning-configuration Status=Enabled
Enable encryption
aws s3api put-bucket-encryption –bucket $TERRAGOAT_STATE_BUCKET –server-side-encryption-configuration ‘{
“Rules”: [
{
“ApplyServerSideEncryptionByDefault”: {
“SSEAlgorithm”: “aws:kms”
}
}
]
}’

Apply TerraGoat (AWS)

cd terraform/aws/
terraform init \
-backend-config=”bucket=$TERRAGOAT_STATE_BUCKET” \
-backend-config=”key=$TF_VAR_company_name-$TF_VAR_environment.tfstate” \
-backend-config=”region=$TF_VAR_region”
terraform apply

Remove TerraGoat (AWS)

terraform destroy Azure SetupInstallation (Azure)You can deploy multiple TerraGoat stacks in a single Azure subscription using the parameter TF_VAR_environment. Create an Azure Storage Account backend to keep Terraform stateexport TERRAGOAT_RESOURCE_GROUP=”TerraGoatRG”
export TERRAGOAT_STATE_STORAGE_ACCOUNT=”mydevsecopssa”
export TERRAGOAT_STATE_CONTAINER=”mydevsecops”
export TF_VAR_environment=”dev”
export TF_VAR_region=”westus”
Create resource group
az group create –location $TF_VAR_region –name $TERRAGOAT_RESOURCE_GROUP
Create storage account
az storage account create –name $TERRAGOAT_STATE_STORAGE_ACCOUNT –resource-group $TERRAGOAT_RESOURCE_GROUP –location $TF_VAR_region –sku Standard_LRS –kind StorageV2 –https-only true –encryption-services blob
Get storage account key
ACCOUNT_KEY=$(az storage account keys list –resource-group $TERRAGOAT_RESOURCE_GROUP –account-name $TERRAGOAT_STATE_STORAGE_ACCOUNT –query [0].value -o tsv)
Create blob container
az storage container create –name $TERRAGOAT_STATE_CONTAINER –account-name $TERRAGOAT_STATE_STORAGE_ACCOUNT –account-key $ACCOUNT_KEY GCP SetupInstallation (GCP)You can deploy multiple TerraGoat stacks in a single GCP project using the parameter TF_VAR_environment. Create a GCS backend to keep Terraform stateTo use terraform, a Service Account and matching set of credentials are required. If they do not exist, they must be manually [...]

created for the relevant project. To create the Service Account:

* Sign into your GCP project, go to IAM> Service Accounts.
* Click the CREATE SERVICE ACCOUNT.
* Give a name to your service account (for example – terragoat) and click CREATE.
* Grant the Service Account the Project> Editorrole and click CONTINUE.
* Click DONE.

To create the credentials:

* Sign into your GCP project, go to IAM> Service Accountsand click on the relevant Service Account.
* Click ADD KEY> Create new key> JSONand click CREATE. This will create a .jsonfile and download it to your computer.

We recommend saving the key with a nicer name than the auto-generated one (i.e. terragoat_credentials.json), and storing the resulting JSON file inside terraform/gcpdirectory of terragoat. Once the credentials are set up, create the BE configuration as follows:

export TF_VAR_environment=”dev”
export TF_TERRAGOAT_STATE_BUCKET=remote-state-bucket-terragoat
export TF_VAR_credentials_path= # example: export TF_VAR_credentials_path=terragoat_credentials.json
export TF_VAR_project=
Create storage bucket
gsutil mb gs://${TF_TERRAGOAT_STATE_BUCKET}

Apply TerraGoat (GCP)

cd terraform/gcp/
terraform init -reconfigure -backend-config=”bucket=$TF_TERRAGOAT_STATE_BUCKET” \
-backend-config “credentials=$TF_VAR_credentials_path” \
-backend-config “prefix=terragoat/${TF_VAR_environment}”
terraform apply

Remove TerraGoat (GCP)

terraform destroy Download