We’re super proud to announce to the world that we are launching our official bug bounty program. While we always aim to establish the…Continue reading on Oda Product & Tech » (https://medium.com/oda-product-tech/oda-is-launching-our-bug-bounty-program-8e356d5ac0d3?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Live-Forensicator - Powershell Script To Aid Incidence Response And Live Forensics
http://www.kitploit.com/2022/04/live-forensicator-powershell-script-to.html

___________________________
@hacking_Attack
@Hacking_Video

Live Forensicator is part of the Black Widow Toolbox, its aim is to assist Forensic Investigators and Incidence responders in carrying out a quick live forensic investigation. It achieves this by gathering different system information for further review for anomalous behaviour or unexpected data entry, it also looks out for unusual files or activities and points it out to the investigator. It is paramount to note that this script has no inbuilt intelligence (https://www.kitploit.com/search/label/Intelligence) its left for the investigator to analyse the output and decide on a conclusion or decide on carrying out more deeper investigation.
Optional Dependencies This script is written in powershell (https://www.kitploit.com/search/label/PowerShell) for use on windows PCs and Servers. For additional features it depends on external binaries. It has a supporting file WINPMEM for taking RAM dumps https://github.com/Velocidex/WinPmem It also depends on Nirsoft's BrowserHistoryView for exporting browser history http://www.nirsoft.net/utils/browsing_history_view.html This script is expected to work out of the box. powershell 2.* or 3.* | winpmem_mini_x64_rc2.exe | BrowsingHistoryView64.exe | BrowsingHistoryView86.exe Usage "># copy the files to the computer
git clone https://github.com/Johnng007/Live-Forensicator.git

# Execution
run Forensicator.ps1 Examples # Basic Usage
.\Forensicator.ps1

# Extract Event Logs alongside Basic Usage
.\Forensicator.ps1 -EVTX EVTX

# Extract RAM Dump alongside Basic Usage
.\Forensicator.ps1 -RAM RAM

# Check for log4j with the JNDILookup.class
.\Forensicator.ps1 -log4j log4j

# Yes of course you can do all
.\Forensicator.ps1 -EVTX EVTX -RAM RAM -log4j log4j

# For Unattended Mode on Basic Usage
.\Forensicator.ps1 -OPERATOR "Ebuka John" -CASE 01123 -TITLE "Ransomeware Infected Laptop" -LOCATION Nigeria -DEVICE AZUZ

# You can use unattended mode for each of the other parameters
.\Forensicator.ps1 -OPERATOR "Ebuka John" -CASE 01123 -TITLE "Ransomeware Infected Laptop" -LOCATION Nigeria -DEVICE AZUZ -EVTX EVTX -RAM RAM -log4j log4j NOTE: Run the script as an administrator to get value.
NOTE: The results are outputed in nice looking html files with an index file.
You can find all extracted Artifacts in the script's working directory. Features =================================
USER AND ACCOUNT INFORMATION
=================================
1. GETS CURRENT USER.
2. SYSTEM DETAILS.
3. USER ACCOUNTS
4. LOGON SESSIONS
5. USER PROFILES
6. ADMINISTRATOR ACCOUNTS
7. LOCAL GROUPS

=================================
SYSTEM INFORMATION
=================================
1. INSTALLED PROGRAMS.
2. INSTALLED PROGRAMS FROM REGISTERY.
3. ENVIRONMENT VARIABLES
4. SYSTEM INFORMATION
5. OPERATING SYSTEM INFORMATION
6. HOTFIXES
8. WINDOWS DEFENDER STATUS AND DETAILS

=================================
NETWORK INFORMATION
=================================
1. NETWORK ADAPTER INFORMATION.
2. CURRENT IP CONFIGURATION IPV6 IPV4.
3. CURRENT CONNECTION PROFILES.
4. ASSOCIATED WIFI NETWORKS AND PASSWORDS.
5. ARP CACHES
6. CURRENT TCP CONNECTIONS AND ASSOCIATED PROCESSES
7. DNS CACHE
8. CURRENT FIREWALL RULES
9. ACTIVE SMB SESSIONS (IF ITS A SERVER)
10. ACTIVE SMB SHARES
11. IP ROUTES TO NON LOCAL DESTINATIONS
12. NETWORK ADAPTERS WITH IP ROUTES TO NON LOCAL DESTINATIONS
13. IP ROUTES WITH INFINITE VALID LIFETIME

========================================
PROCESSES | SCHEDULED TASK | REGISTRY
========================================
1. PROCESSES.
2. STARTUP PROGRAMS
3. SCHEDULED TASK
4. SCHEDULED TASKS AND STATE
5. SERVICES
6. PERSISTANCE IN REGISTRY

=================================
OTHER CHECKS
=================================
1. LOGICAL DRIVES
2. CONNECTED AND DISCONNECTED WEBCAMS

___________________________
@hacking_Attack
@Hacking_Video

3. USB DEVICES
4. UPNP DEVICES
5. ALL PREVIOUSLY CONNECTED DRIVES
6. ALL FILES CREATED IN THE LAST 180 DAYS
7. 100 DAYS WORTH OF POWERSHELL HISTORY
8. EXECUTABLES IN DOWNLOADS FOLDER
9. EXECUTABLES IN APPDATA
10. EXECUATBLES IN TEMP
11. EXECUTABLES IN PERFLOGS
12. EXECUTABLES IN THE DOCUMENTS FOLDER

=========================================
ORTHER REPORTS IN THE HTML INDEX FILE
=========================================
1. GROUP POLICY REPORT
2. WINPMEM RAM CAPTURE
3. LOG4J
4. IIS LOGS
5. TOMCAT LOGS
6. BROWSING HISTORY OF ALL USERS
##ChangeLog 29/03/2022
Added unattended Mode Feature
Added Ability to grab browsing history of all users

2022
Initial Release
Screenshot

___________________________
@hacking_Attack
@Hacking_Video

Contributing Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change or add.

Download Live-Forensicator (https://github.com/Johnng007/Live-Forensicator)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe writeup: Game Zone

https://cdn-images-1.medium.com/max/1300/1*8OJCMStl3PV2Jzbfptsv1A.png
This is a room by TryHackMe which discussess an simple, but nonetheless interesting, means of privilege escalation.

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Weekly report: week 13 of 2022

https://cdn-images-1.medium.com/max/1000/1*XhpvAGSwF0dTjZcVje9fQw.png
🌊 Yet another algorithmic stablecoin venture. USDN has depegged this morning, and Vires lenders can’t get their money back. It appears…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Live-Forensicator - Powershell Script To Aid Incidence Response And Live Forensics

___________________________
@hacking_Attack
@Hacking_Video

My CTO is running a webinar on android app pen testing
https://www.reddit.com/r/Pentesting/comments/tw3z1z/my_cto_is_running_a_webinar_on_android_app_pen/

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/jeffreysan1996 (https://www.reddit.com/user/jeffreysan1996)
[link] (https://www.facebook.com/events/1157017475049398) [comments] (https://www.reddit.com/r/Pentesting/comments/tw3z1z/my_cto_is_running_a_webinar_on_android_app_pen/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Limited distribution: Russian Orthodox charity emails (15 GB)

https://external-preview.redd.it/2Do65IFl9XCE2r1KwfxHxTVpNzxlkKSAIFpRFTmIjRM.jpg?width=320&crop=smart&auto=webp&s=78061f6fd1162ae8b2768cc6d81d478466cb7530 submitted by /u/UrbanAbsconder
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
what does it mean when a website login swaps ' with a /

So out of habit i check every login screen with ' idk why i do this but I do it on every login page. the other day after typing ' into the login in bar and pressing login the initial ' that i wrote was then rewritten to /'

what does that mean?

submitted by /u/Yourgrannotranno
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Social Engineering to log IP?

I have very minimal knowledge on the subject matter of this subreddit. I was wondering if someone could suggest a way to navigate this situation. One of my best friends made a poor decision and fell for a facebook scam and now the scammer has control of his profile. They log in daily using photos of his children and family to try and scam more people. It's been going on months now, him, me, friends, family - a ton of people have reached out to Facebook yet the profile has remained. The fact they are exploiting his children really bothers me and since facebook won't shut it down I want to try and at least spook the scammer. I've began to engage with daily conversations with them and their guard is down on me. I was going to try and just get their IP, locate at least where they are hosted out of and try and use that to maybe spook them from continuing with his profile. It's clearly a very easily manipulated and unintelligent person from my convos. I know if I send an IPlog through Messenger it I'll just get the facebook server and plus I think facebook catchs those links now anyways. I was curious if anyone had an idea how through social engineering I can get the person to direct connect to me or click an IPlog link outside of facebook. Regardless of if this works, it's fun for me too.

submitted by /u/Poo_Panther
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Break The Code 2.0

https://btc2.tech/cRa3QN

submitted by /u/moonsoil
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video