art of the statusbar will bring up a menu with all available configuration profiles, and selecting from this list will change the configuration profile.<o:p

<o:p https://1.bp.blogspot.com/-xi6a2dvFPHs/YHXRTTufMZI/AAAAAAAAvY8/ZHDs6JDElyEXXAdxWFHO6jGBKTg1M3emgCLcBGAsYHQ/s16000/32.png <o:p

Start packet capture <o:p

The following methods can be used to start capturing packets <o:p

<o:p

You can double-click on interface in the welcome screen of Wireshark <o:p

If you already know the name of the capture interface then you can start Wireshark from the command line by running the following command:<o:p

<o:p

Wireshark -I eth0 -k<o:p

<o:p

This will start Wireshark capturing on interface eth0 <o:p

<o:p

Working with captured packets<o:p

Once you have captured some packets you can view the packets that are displayed in packet list pane by simply clicking on a packet on a packet list pane, which will bring up the selected packet in the tree view and byte view panes. As soon you capture some traffic then you need to apply some filter to make it easily understandable. <o:p

<o:p

Wireshark has two filtering languages <o:p

· Capture filters<o:p

· Display filters<o:p

<o:p

Capture filters are used for filtering when capturing packets and display filters are used for filtering which packets are displayed. Wireshark provides a display filter language that enables you to precisely control which packets are displayed<o:p

<o:p

Display filter fields<o:p

Wireshark's display filter a bar located right above the column display section. To only display packets containing a particular protocol, type the protocol into Wireshark’s display filter toolbar Wireshark offers a list of suggestion based on the text that you typed. <o:p

<o:p

For example, to only display TCP packets, type tcp into Wireshark’s display filter toolbar.<o:p https://1.bp.blogspot.com/-NyqAdW5Qq6M/YHXRXXxSQTI/AAAAAAAAvZA/aByav3xUykUFcJ-2yphcFNYfnAXDH2jPACLcBGAsYHQ/s16000/33.png <o:p

Similarly, to only display packets containing a particular field, type the field into Wireshark’s display filter toolbar. For example, to only display HTTP requests, type http.request into Wireshark’s display filter toolbar and it will accept the expression and works as intended <o:p https://1.bp.blogspot.com/-AGLeSIQ1b1E/YHXRbSD3X0I/AAAAAAAAvZE/UTSjClc73AYIyzSi0SEnbrcfdVP60cucwCLcBGAsYHQ/s16000/34.png <o:p

Similar example of Wireshark display filter accepting an expression but it does not work as intended such as type dns and ip.addr !=10.96.203.66<o:p

<o:p https://1.bp.blogspot.com/-rcyJ6qL8SqA/YHXRfSZFHJI/AAAAAAAAvZM/TFu10OGn7g0K0_Y5QOJTQSMcMH5whp3XACLcBGAsYHQ/s16000/35.png <o:p

As you saw above the expression works but not intended.<o:p

<o:p

As we have noticed these packet captures have different colours. So, what are these colours intended for...?<o:p

Don’t get confused with different type of colour packets. These colours are intended for <o:p

· Gray – TCP packets <o:p

· Black with red letters – TCP Packets with errors<o:p

· Green – HTTP Packets<o:p

· Light Blue – UDP Packets <o:p

· Pale Blue – ARP Packets <o:p

· Lavender – ICMP Packets <o:p

· Black with green letters – ICMP Packets with errors <o:p <o:pNote: - Colourings can be changed under View -> Colouring Rules<o:p<o:p

Building Display Filter expressions.<o:p

we can build display filters that compares values using different type of comparison operator. <o:p

For example to only display packets to or from the IP address 10.96.200.253 use ip.addr==10.96.200.253 . Wireshark display filter uses Boolean expressions, so we can specify values and chain them together. A complete list of available comparison operators is shown below.<o:p

<o:p https://1.bp[...]

.blogspot.com/-Z_rKS6ZyCok/YHXRk5Qm-hI/AAAAAAAAvZU/0GLMCT8vgToS4eniAxIL2SJMcjR7xKtAQCLcBGAsYHQ/s16000/36.png <o:p

Some useful filters <o:p

Here are some filter expressions that can be used as a way to quickly review web traffic.<o:p

Let’s understand this with some sort of methods like how we are going to filter some infectious traffic.<o:p

Open the packet capture and apply the following filter: “http.request”. This filter will show all HTTP post requests. Also, you can find total no. of packets at the bottom of the Wireshark screen that are 16 of these packets. <o:p

<o:p

Filter: - http.request<o:phttps://1.bp.blogspot.com/-7flqN1yRtsY/YHXRr0qusII/AAAAAAAAvZg/Cb_Ff2WszQ0NVT7lBIqac_etcaTnqq3gwCLcBGAsYHQ/s16000/37.png <o:p

After that to reveal all the URLs for HTTP requests, Domain names we can use the following expression as a way to quickly review web traffic <o:p

<o:p http.request or ssl.handshake.type == 1<o:p<o:p

The value http.requestreveals URLs for HTTP requests, and ssl.handshake.type == 1reveal domain names used in HTTPS or SSL/TLS traffic. Filtering with this display filter can outline the flow of events for the web traffic.<o:p

<o:p https://1.bp.blogspot.com/-fw6T0TebOeo/YHXRwjsRqoI/AAAAAAAAvZo/8jsLVM2EqRYMnBHAgnbllFURjhK15Hn4gCLcBGAsYHQ/s16000/38.png <o:p

By modifying these types of filters, you can drill down the infectious traffic.<o:p

<o:p

Questionnaire<o:p

<o:p Let’s understand Wireshark with some sort of Questions <o:p<o:p Q1.Find out the total no. of TCP syn packet for port 80<o:p

<o:p Answer: -To reveal all the TCP syn packets we can use the following expression as a way to quickly review web traffic for the port 80. Also, you can find total no. of packets at the bottom of the Wireshark screen that are 4 of these packets.<o:p

<o:p Filter: - tcp.flags.syn == 1 and tcp.flags.ack == 0 && tcp.port == 80<o:p<o:p https://1.bp.blogspot.com/-CYcSreE6sTk/YHXR1t3vDAI/AAAAAAAAvZw/Xn9kCVoJXYITbcSBg9ssCR6esGVIr25bwCLcBGAsYHQ/s16000/39.png <o:p Q2.Filter out all the packet with the http response code 200.<o:p

<o:p Answer: -The value http.responsereveals URLs for HTTP responses, and HTTP status code 200means success. The client has requested documents from the server. The server has replied to the client and given the client the documents. Filtering with this display filter can outline the flow of events for the web traffic.<o:p

<o:p Filter: - http.response.code == 200<o:p<o:p https://1.bp.blogspot.com/-Gp60YIN6DYo/YHXSMrfoqTI/AAAAAAAAvaE/wqO0egj_tysiStgVkDIe5tiFip2eyK1qQCLcBGAsYHQ/s16000/40.png <o:p Q.3Attacker try to download the malicious file from www.ethereal.com. Write down the filter to identify the http host.<o:p

<o:p Answer: -In this case we have to find out the host who have visited on the malicious website. As we know each website have own URL. So simply we can find out the host by using the following expression who have visited on malicious website.<o:p

<o:p Filter: - http.host=="www.ethereal.com”<o:pOr http.host=="URL”<o:p<o:p https://1.bp.blogspot.com/---dIkSADfAc/YHXSR_iOkPI/AAAAAAAAvaI/u0WIicj3mt42Ec3_Vl5Zt4Y9LYSRosyegCLcBGAsYHQ/s16000/41.png <o:p Q4.Write down the filter to identify the destination port 23.<o:p

<o:p Answer: -Answer is quite simple… you can use the following expression to filter out the destination port 23 <o:p

<o:p Filter: - tcp.dstport == 23<o:phttps://1.bp.blogspot.com/-hvnNVDvl5dQ/YHXScTc3kJI/AAAAAAAAvaM/3sul0VPJHf42Lom2IqTTpBYmSR3XwfhHgCLcBGAsYHQ/s16000/42.png <o:p Q5.Filter out the packets on behalf of the mac address.<o:p

<o:p Answer: -Apply the following expression[...]

to filter out the traffic for the specific mac address.<o:p

<o:p Filter: - eth.addr == 00:a0:cc:3b:bf:fa <o:pOr eth.addr == “mac addr”<o:p<o:phttps://1.bp.blogspot.com/-jndGk7FA2nY/YHXShuDENyI/AAAAAAAAvaQ/wf0m4DFJGygGJQ1h8247vhpXaWvHS8v6wCLcBGAsYHQ/s16000/43.png <o:p Q6.Write down the filter to identify the IP address 10.96.203.66 for the port 80 also including the IP address 10.121.1.161. find out the total no. of packet.<o:p

<o:p Answer: -In this situation we can create our custom filter for these types of random scenarios by using logical operators such as <o:p

<o:p Filter: - ip.addr==10.96.203.66 and tcp.port==80 &&!(ip.addr==10.121.1.161)<o:p<o:p

By applying this filter, we can easily find out the total packets that are 3 of these packets. <o:p https://1.bp.blogspot.com/-WXX0c0QMieQ/YHXSrHitFKI/AAAAAAAAvaU/C1Fe3NF2VqUuVSjuzPEkUfAwne2PvGXqQCLcBGAsYHQ/s16000/44.png <o:p Q7.Find out the flag hidden in the provided pcap file that contains the user name for<o:p

1. All users of Ftp session <o:p

2. Find out the credentials used for the Telnet session <o:p

3. Find out which command is being executed during the telnet session.<o:p

<o:p Answer: -Do it by yourself. By getting the flag submit the flag in comment section.<o:p

All the best.<o:p

<o:p

You can download pcap file from here.<o:p

Dark Reading: Attacks/Breaches
Dark Reading to Upgrade Site Design, Performance

Improvements will make site content easier to navigate, faster, and more functional.

Anatomy of learning new things and keeping yourself updated in hacking

Hi homies, I hope you all are safe and doing your stuff constantly. Summer is up and we are increasing our speed:) I have so many plans to…
Read more...

Hacking on Medium
How to install dig on Kali Linux

https://cdn-images-1.medium.com/max/1341/1*QI8y97nU4nEY3YTc2Kfz5w.png
You must install dnsutils if you need to get information from DNS name servers

Continue reading on Medium »

Hacking on Medium
Web Uygulama Güvenliği Part V

https://cdn-images-1.medium.com/max/1000/1*De9UpeeHUKQbEh1PmP2aRA.jpeg
Server-side Template Injection

Continue reading on Medium »

Traitor - Automatic Linux Privesc Via Exploitation Of Low-Hanging Fruit E.G. GTFOBin
http://www.kitploit.com/2021/04/traitor-automatic-linux-privesc-via.html

Automatically exploit low-hanging fruit to pop a root shell. Linux privilege escalation (https://www.kitploit.com/search/label/Privilege%20Escalation) made easy! Traitor packages up a bunch of methods to exploit local misconfigurations (https://www.kitploit.com/search/label/Misconfigurations) and vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) (including most of GTFOBins (https://gtfobins.github.io/)) in order to pop a root shell. It'll exploit most sudo privileges listed in GTFOBins to pop a root shell, as well as exploiting issues like a writable docker.sock. More routes to root will be added over time too.
Usage
Run with no arguments to find potential vulnerabilities/misconfigurations which could allow privilege escalation. Add the -p flag if the current user password is known. The password will be requested if it's needed to analyse sudo permissions etc. traitor -p Run with the -a/--any flag to find potential vulnerabilities, attempting to exploit each, stopping if a root shell is gained. Again, add the -p flag if the current user password is known. traitor -a -p Run with the -e/--exploit flag to attempt to exploit a specific vulnerability (https://www.kitploit.com/search/label/Vulnerability) and gain a root shell. traitor -p -e docker:writable-socket
Supported Platforms
Traitor will run on all Unix-like systems, though certain exploits will only function on certain systems.
Getting Traitor
Grab a binary from the releases page (https://github.com/liamg/traitor/releases), or use go: CGO_ENABLED=0 go get -u github.com/liamg/traitor/cmd/traitor
If the machine you're attempting privesc on cannot reach GitHub to download the binary, and you have no way to upload the binary to the machine over SCP/FTP etc., then you can try base64 encoding the binary on your machine, and echoing the base64 encoded string to | base64 -d > /tmp/traitor on the target machine, remembering to chmod +x it once it arrives.

Download Traitor (https://github.com/liamg/traitor)

Traitor - Automatic Linux Privesc Via Exploitation Of Low-Hanging Fruit E.G. GTFOBin

Automatically exploit low-hanging fruit to pop a root shell. Linux privilege escalation made easy! Traitor packages up a bunch of methods to exploit local misconfigurations and vulnerabilities (including most of GTFOBins) in order to pop a root shell. It'll exploit most sudo privileges listed in GTFOBins to pop a root shell, as well as exploiting issues like a writable docker.sock. More routes to root will be added over time too.Usage Run with no arguments to find potential vulnerabilities/misconfigurations which could allow privilege escalation. Add the -p flag if the current user password is known. The password will be requested if it's needed to analyse sudo permissions etc. traitor -p Run with the -a/--any flag to find potential vulnerabilities, attempting to exploit each, stopping if a root shell is gained. Again, add the -p flag if the current user password is known. traitor -a -p Run with the -e/--exploit flag to attempt to exploit a specific vulnerability and gain a root shell. traitor -p -e docker:writable-socket Supported Platforms Traitor will run on all Unix-like systems, though certain exploits will only function on certain systems. Getting Traitor Grab a binary from the releases page, or use go: CGO_ENABLED=0 go get -u github.com/liamg/traitor/cmd/traitor If the machine you're attempting privesc on cannot reach GitHub to download the binary, and you have no way to upload the binary to the machine over SCP/FTP etc., then you can try base64 encoding the binary on your machine, and echoing the base64 encoded string to | base64 -d > /tmp/traitor on the target machine, remembering to chmod +x it once it arrives. Download Traitor
Read more...

KitPloit - PenTest Tools!
Traitor - Automatic Linux Privesc Via Exploitation Of Low-Hanging Fruit E.G. GTFOBin

https://1.bp.blogspot.com/-bwv7NyL5Egk/YG0DGYBWZCI/AAAAAAAAV2E/uzu3cSqMVocc77fl9xd5XR4nUesRIJB9ACNcBGAsYHQ/w640-h380/traitor_1_demo.gif
Automatically exploit low-hanging fruit to pop a root shell. Linux privilege escalation made easy!

Traitor packages up a bunch of methods to exploit local misconfigurations and vulnerabilities (including most of GTFOBins) in order to pop a root shell.

It'll exploit most sudo privileges listed in GTFOBins to pop a root shell, as well as exploiting issues like a writable docker.sock. More routes to root will be added over time too.
Usage

Run with no arguments to find potential vulnerabilities/misconfigurations which could allow privilege escalation. Add the -pflag if the current user password is known. The password will be requested if it's needed to analyse sudo permissions etc.

traitor -p

Run with the -a/--any flag to find potential vulnerabilities, attempting to exploit each, stopping if a root shell is gained. Again, add the -pflag if the current user password is known.

traitor -a -p

Run with the -e/--exploit flag to attempt to exploit a specific vulnerability and gain a root shell.

traitor -p -e docker:writable-socket

Supported Platforms

Traitor will run on all Unix-like systems, though certain exploits will only function on certain systems.

Getting Traitor

Grab a binary from the releases page, or use go:
CGO_ENABLED=0 go get -u github.com/liamg/traitor/cmd/traitor

If the machine you're attempting privesc on cannot reach GitHub to download the binary, and you have no way to upload the binary to the machine over SCP/FTP etc., then you can try base64 encoding the binary on your machine, and echoing the base64 encoded string to | base64 -d > /tmp/traitoron the target machine, remembering to chmod +xit once it arrives.
Download Traitor

hacking: security in practice
Bug bounty hunting step by step (practical) resources?

I've been reading books and doing courses on penetration testing and bug hunting for a while, but I find most of them point to CTFs as the place to practice a hands-on approach. I've been doing that but can't help but notice a big difference between doing CTFs and real-world bug hunting. Only a handful of them are web apps (which I will be focusing on) and the vulnerabilities don't seem "real" enough. Feels like I have all the pieces of the puzzle and the picture on the box, but I don't know the methodology that people follow to complete them.

I know that I should just jump head first into HackerOne but I would like to see someone actually working on a real bounty and try to get a feel for the process. As an example I'm looking for something like a longer version of this video by InsiderPhd.

Any tip on a book/video/course/etc would be greatly appreciated, thanks in advance!

submitted by /u/Vanthian
[link] [comments]

Dark Reading: Attacks/Breaches
Compromised Microsoft Exchange Server Used to Host Cryptominer

Researchers say an unknown attacker is targeting vulnerable Exchange Servers with a payload hosted on a compromised Exchange Server.