Kali Linux Tutorials
PyShell : Multiplatform Python WebShell

PyShell is Multiplatform Python WebShell. This tool helps you to obtain a shell-like interface on a web server to be remotely accessed. Unlike other webshells, the main goal of the tool is to use as little code as possible on the server side, regardless of the language used or the operating system of the server.

Thanks to this, you can use different types of shells (aspx, php, jsp, sh, py…) both in Windows and Linux, with command history, upload and download files and even, moving through directories as if it were a standard shell.

Requirements

* Python 3
* Install requirements.txt

Download

It is recommended to clone the complete repository or download the zip file. You can do this by running the following command:

git clone https://github.com/JoelGMSec/PyShell

Usage

./PyShell.py -h
██████ ▓██ ░██ ██████ ██░ ██ ▓█████ ██▓ ██▓
▓██░ ██▒██░ ██▒██ ▒ ▓██ ██▒▓██ ▓██▒ ▓██▒
▓██░ ██▒ ██ ██░░ ▓███ ▒██████░▒████ ▒██░ ▒██░
▒██████ ▒ ░████▓░ ▒ ██▒░██ ░██ ▒██ ▒██░ ▒██░
▒██▒ ░ ░ ░ ██▒▓░▒██████▒▒░██▒░██▓░█████▒░██████▒░██████▒
▒██░ ░ ░ ██▒▒▒ ▒ ▒▓▒ ▒ ░ ▒ ░░▒░▒░░ ▒░ ░░ ▒░▓ ░░ ▒░▓ ░
░▒ ░ ▓██ ░▒░ ░ ░▒ ░ ▒ ░ ░ ░ ░ ░ ░░ ░ ▒ ░░ ░ ▒ ░
░░ ░ ▒ ▒ ░░ ░ ░ ░ ░ ░░ ░ ░ ░ ░ ░
░ ░ ░ ░ ░ ░ ░
————– by @JoelGMSec & @3v4Si0N —————
usage: pyshell.py [-h] [-a AUTH] [-c COOKIES] [-p PARAM] [-pi] [-su] [-ps] url method
positional arguments:
url Webshell URL
method HTTP Method to execute command (GET or POST)
optional arguments:
-h, –help show this help message and exit
-a AUTH, –auth AUTH Authorization header to use on each request
-c COOKIES, –cookies COOKIES
Cookie header to use on each request
-p PARAM, –param PARAM
Parameter to use with custom WebShell
-pi, –pipe Pipe all commands after parameter
-su, –sudo Sudo command execution (Only on Linux hosts)
-ps, –PowerShell PowerShell command execution (Only on Windows hosts)
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Authz0 : An Automated Authorization Test Tool

Authz0 is an automated authorization test tool. Unauthorized access can be identified based on URLs and Roles & Credentials.

URLs and Roles are managed as YAML-based templates, which can be automatically created and added through authz0. You can also test based on multiple authentication headers and cookies with a template file created/generated once.

Key Features

* Generate scan template $ authz0 new
* Include URLs
* Include Roles
* Include ZAP history (Select URLS > Save Selected Entiries as HAR)
* Include Burp history (Select URLs > Save item)
* Include HAR file

* Easy modify scan template (Role, URL) $ authz0 setUrl$ authz0 setRoleauthz0 setCred
* Scanning authorization(access-control) with template $ authz0 scan

Installation

go install

go install github.com/hahwul/authz0@latest

homebrew

brew tap hahwul/authz0
brew install authz0

Usage

Available Commands:

completion Generate the autocompletion script for the specified shell
help Help about any command
new Generate new template
scan Scanning
setCred Append Credential to Template
setRole Append Role to Template
setUrl Append URL to Template
version Show version

Generate template

authz0 new [flags]

e.g

authz0 new target.yaml –include-urls urls.txt
authz0 new target.yaml –include-zap zapurls.har
authz0 new target.yaml –include-burp burpurl.xml

Modify template

authz0 setCred [flags]
authz0 setRole [flags]
authz0 setUrl [flags]

e.g

authz0 setUrl target.yaml setUrl -u https://www.hahwul.com
authz0 setRole target.yaml -n User1
authz0 setCred target.yaml -n User1 -H “X-API-Key: 1234” -H “TestHeader: 12344”

Scanning

authz0 scan [flags]

e.g

authz0 scan target.yaml
authz0 scan target.yaml -r TestUser1 -H “Cookie: 1234=1234” -H “X-API-Key: 1234555”
Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking Smart Contracts: Beginners Guide

Overview of the basics of smart contracts.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Microsoft obtiene una orden judicial para eliminar los dominios utilizados para apuntar a Ucrania

https://cdn-images-1.medium.com/max/1484/0*eSz47eYSVWC_nts-
PUBLICADO EN 8 ABRIL, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
When Someone Hacks Your Computer

https://cdn-images-1.medium.com/max/2600/0*QuIREeCNeEb2vJJr
Treat it like John Wick treats a home invasion.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
2 vulnerabilidades críticas en los switches Aruba Instant On 1930

https://cdn-images-1.medium.com/max/1233/0*S3M-Po8-gI7yp1tm
PUBLICADO EN 7 ABRIL, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
i need a hacker to change my university school grades and transcripts

https://cdn-images-1.medium.com/max/626/0*-xXsTQdO0lqSFtAe
Changing school grades or credentials is not a game; it needs expert hacking skills and abilities, as well as a complex server capable of…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to hack mobile Camera ? It’s scary easy!

https://cdn-images-1.medium.com/max/767/1*sIKWOwoqrgaTlSJaL38kxw.jpeg
VISIT US : HACKRSHUB

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
OffensiveNotion - Notion As A Platform For Offensive Operations

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyiLaa6rde8wUQlRxmq8NeqaGDfFI6MWmFMXdmqy5u_rjrKm_mYs76jFzIOzEvBooWoomyR_18ABxkO1ADH27fomv7RCy2XQIo2Y0oYKayGT6W6YKR-Oe_MELX3moS-S1myE6HuLREDDgOiegTtxO5sBFM6l_wV5HQsaoXHn0VOw-h_8uVhaMcm4cE/w640-h330/OffensiveNotion.png Notion (yes, the notetaking app) as a C2.Wait, What?Yes. But Why?What started as a meme grew into a full project. Just roll with it. Read more!Here's our blog post about it: We Put A C2 In Your Notetaking App: OffensiveNotion Features*
A full-featured C2 platform built on the Notion notetaking app.

*
Easy setup: set up your Notion developer API account, drop the Agent to the target, run and enjoy!

*
Cross-platform agent built in Rust that compiles for Linux, Windows, and macOS with the same code base. Includes a Python setup/controller script to simplify the process.

*
A range of capabilities including port-scanning, privilege escalation, asynchronous command execution, file download, and shellcode injection, all controlled from the comfort of a Notion page!

*
Document as you go! The agent identifies special syntax to run commands, so feel free to use the rest of the Notion page to document your operation.

*
Collaborative by design! Notion allows for multiple people to edit and view your notes. Your listener page can handle multiple agents and you can invite your red team friends to your page. Congratulations, that's a teamserver!

*
Mobile C2! Use the Notion application from your mobile device to issue commands to your agents from anywhere in the world.

*
Stealth! C2 comms ride over the Notion API natively. Your C2 traffic looks like someone is using Notion for its intended purpose. QuickstartSee the Quickstart guide on how to get going right away! DocumentationPlease see the Wiki for setup, usage, commands, and more! Thanks & AcknowledgementsThis project has been a blast for me! I learned a ton about Rust and how the mechanics of a C2 work. So thank you to my co-creator @mttaggart for helping me along the way. None of this would have been possible without your technical acumen and creativity.

Thank you to Joe Helle (@joehelle) for the POC steps for the fodhelper UAC bypass.

Thank you to all of the great red team devs who came before me, too numerous to list them all, who have created some of my favorite tools. I’m continually inspired by the red dev innovation in our field.

-Husky

As a fairly new security person, I had no idea I'd end up working with such a fantastically talented, kind, and reliable partner and hacker as @HuskyHacks. It's been a true privilege to build this alongside him.

I want to thank the Taggart Tech community for supporting us along the way and always offering helpful feedback. This would not be possible without you all.

-Taggart DisclaimerThere is no way to make an offensive security relevant research tool and release it open source without the possibility of it falling into the wrong hands. This tool is only to be used for legal, ethical purposes including, but not limited to, research, security assessment, education. The dev team is not responsible for the misuse of this tool by anyone if used for illegal/unethical purposes. No animals were harmed in the making of this code base (although Cosmo keeps climbing on my keyboard and I have to put him over on the couch, which I'm sure must feel like torture to him).

See the LICENSE for more details. Download OffensiveNotion

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Found a index.js file that displays the password policy/settings of how the password structure works for a website

Found this file whilst doing a bug bounty program. Given the explanation of the title, is this a valid vulnerability?

What could a malicious user do with this info?

submitted by /u/zoobyk12
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Tried and no luck anywhere

Someone sent me a screenshot of a video that looks to be my girl. I tried looking for it and no luck. Any recommendations? Dm for screenshot

Thanks everyone

submitted by /u/Sensitive-Economy804
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What can I do with my crypter?

I’ve been developing a crypter for a few months now which is coming along nicely.

0/38 Scantime 1/22 Runtime VB.NET 3.5 Completely Polymorphic 12kb Stub Anti-VM Unique decryption of payload Memory Injection

What are the practical uses of this? I really don’t want to license it and deal with that.

submitted by /u/MysticalTeamMember
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How would I become completely anonymous? And have new identity?

I’m just wondering how to stay 100% anonymous, from safe emails, VPN and real word advice to keep myself hidden as possible from big tech and anyone else trying to find my identity.

And how does one go about creating a new identity, seems very complicated to me. ( havnt done much research) Thabks in advance!

submitted by /u/Mr_T_fletcher
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Security Nihilism Is Putting Your Company — and Its Employees — at Risk

Some enterprise security tactics can backfire, pitting IT and security teams against the employees they’re trying to protect.

Dark Reading: Attacks/Breaches
ByteChek Founder AJ Yawn Brings Discipline to Everything He Does

Security Pro File: The former Army captain, whose security startup is on an upward trajectory, works hard to "make compliance suck less."

How a YouTube Video lead to pwning a web application via SQL Injection worth $4324 bounty
https://medium.com/@k4k4r07/how-a-youtube-video-lead-to-pwning-a-web-application-via-sql-injection-worth-4324-bounty-285f0a9b9f6c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

This write-up is regarding one of my findings on a private program on HackerOne. As this is a private program so I have made certain…Continue reading on Medium » (https://medium.com/@k4k4r07/how-a-youtube-video-lead-to-pwning-a-web-application-via-sql-injection-worth-4324-bounty-285f0a9b9f6c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How a YouTube Video lead to pwning a web application via SQL Injection worth $4324 bounty

This write-up is regarding one of my findings on a private program on HackerOne. As this is a private program so I have made certain…Continue reading on Medium »
Read more...