\ | |
\ | |
\ |Hidden |
-|signature3 |
+-----------+
Validation Part To find who leaked the document, you just need to provide the leaked file to wholeaked, and it will reveal the responsible person by comparing the signatures in the database. |wholeaked|| |--------+ | | | || | b@gov |Hidden | +---------+| | |Signature2 | | | +-----------+ +---------+ ">+-----------+ +---------+
|Top Secret | |Signature|
|.pdf | +---------+|Database |
| | |utkusen/ || | Document leaked by
| |->|wholeaked|| |--------+
| | | || | b@gov
|Hidden | +---------+| |
|Signature2 | | |
+-----------+ +---------+

Demonstration Video
File Types and Detection Modes wholeaked can add the unique signature to different sections of a file. Available detection modes are given below: File Hash: SHA256 hash of the file. All file types are supported. Binary: The signature is directly added to the binary. Almost all file types are supported. Metadata: The signature is added to a metadata (https://www.kitploit.com/search/label/Metadata) section of a file. Supported file types: PDF, DOCX, XLSX, PPTX, MOV, JPG, PNG, GIF, EPS, AI, PSD Watermark: An invisible (https://www.kitploit.com/search/label/Invisible) signature is inserted into the text. Only PDF files are supported. Installation From Binary You can download the pre-built binaries from the releases (https://github.com/utkusen/wholeaked/releases/latest) page and run. For example: unzip wholeaked_0.1.0_macOS_amd64.zip ./wholeaked --help From Source Install Go on your system Run: go install github.com/utkusen/wholeaked@latest Installing Dependencies wholeaked requires exiftool for adding signatures to metadata section of files. If you don't want to use this feature, you don't need to install it. Debian-based Linux: Run apt install exiftool macOS: Run brew install exiftool Windows: Download exiftool (https://www.kitploit.com/search/label/ExifTool) from here https://exiftool.org/ and put the exiftool.exe in the same directory (https://www.kitploit.com/search/label/Directory) with wholeaked. wholeaked requires pdftotext for verifying watermarks inside PDF files. If you don't want to use this feature, you don't need to install it. Download "Xpdf command line (https://www.kitploit.com/search/label/Command%20Line) tools" for Linux, macOS or Windows from here: https://www.xpdfreader.com/download.html Extract the archive and navigate to bin64 folder. Copy the pdftotext (or pdftotext.exe) executable to the same folder with wholeaked For Debian Based Linux: Run apt install libfontconfig command. Usage Basic Usage wholeaked requires a project name -n, the path of the base file which the signatures will add -f and a list of target recipients -t Example command: ./wholeaked -n test_project -f secret.pdf -t targets.txt The targets.txt file should contain name and the e-mail address in the following format: Utku Sen,utku@utkusen.com
Bill Gates,bill@microsoft.com

___________________________
@hacking_Attack
@Hacking_Video

After execution is completed, the following unique files will be generated: test_project/files/Utku_Sen/secret.pdf
test_project/files/Bill_Gates/secret.pdf
By default, wholeaked adds signatures to all available places that are defined in the "File Types and Detection Modes" section. If you don't want to use a method, you can define it with a false flag. For example: ./wholeaked -n test_project -f secret.pdf -t targets.txt -binary=false -metadata=false -watermark=false Sending E-mails In order to send e-mails, you need to fill some sections in the CONFIG file. If you want to send e-mails via Sendgrid, type your API key to the SENDGRID_API_KEY section. If you want to send e-mails via AWS SES integration, you need to install awscli on your machine and add the required AWS key to it. wholeaked will read the key by itself. But you need to fill the AWS_REGION section in the config file. If you want to send e-mails via a SMTP server, fill the SMTP_SERVER, SMTP_PORT, SMTP_USERNAME, SMTP_PASSWORD sections. The other necessary fields to fill: EMAIL_TEMPLATE_PATH Path of the e-mail's body. You can specify use HTML or text format. EMAIL_CONTENT_TYPE Can be html or text EMAIL_SUBJECT Subject of the e-mail FROM_NAME From name of the e-mail FROM_EMAIL From e-mail of the e-mail To specify the sending method, you can use -sendgrid, -ses or -smtp flags. For example: ./wholeaked -n test_project -f secret.pdf -t targets.txt -sendgrid Validating a Leaked File You can use the -validate flag to reveal the owner of a leaked file. wholeaked will compare the signatures detected in the file and the database located in the project folder. Example: ./wholeaked -n test_project -f secret.pdf -validate Important: You shouldn't delete the project_folder/db.csv file if you want to use the file validation feature. If that file is deleted, wholeaked won't be able to compare the signatures.

Download Wholeaked (https://github.com/utkusen/wholeaked)

___________________________
@hacking_Attack
@Hacking_Video

Types of Steganography methods that are used for hiding confidential data.
https://prasan26.medium.com/types-of-steganography-methods-that-are-used-for-hiding-confidential-data-b3c00132b972?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

> Are the images really safe?Continue reading on Medium » (https://prasan26.medium.com/types-of-steganography-methods-that-are-used-for-hiding-confidential-data-b3c00132b972?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Types of Steganography methods that are used for hiding confidential data.

> Are the images really safe?Continue reading on Medium »
Read more...

Kali Linux Tutorials
Osmedeus : A Workflow Engine For Offensive Security

Osmedeus is a Workflow Engine for Offensive Security.

Installation

NOTE that you need some essential tools like curl, wget, git, zipand login as root to start

bash -c “$(curl -fsSL https://raw.githubusercontent.com/osmedeus/osmedeus-base/master/install.sh)”

Build the engine from source

Make sure you installed golang >= v1.17

mkdir -p $GOPATH/src/github.com/j3ssie
git clone –depth=1 https://github.com/j3ssie/osmedeus $GOPATH/src/github.com/j3ssie/osmedeus
cd $GOPATH/src/github.com/j3ssie/osmedeus
make build

Usage

Scan Usage:
osmedeus scan -f [flowName] -t [target]
osmedeus scan -m [modulePath] -T [targetsFile]
osmedeus scan -f /path/to/flow.yaml -t [target]
osmedeus scan -m /path/to/module.yaml -t [target] –params ‘port=9200’
osmedeus scan -m /path/to/module.yaml -t [target] -l /tmp/log.log
cat targets | osmedeus scan -f sample
Practical Scan Usage:
osmedeus scan -T list_of_targets.txt -W custom_workspaces
osmedeus scan -t target.com -w workspace_name –debug
osmedeus scan -f general -t www.sample.com
osmedeus scan -f gdirb -T list_of_target.txt
osmedeus scan -m ~/.osmedeus/core/workflow/test/dirbscan.yaml -t list_of_urls.txt
osmedeus scan –wfFolder ~/custom-workflow/ -f your-custom-workflow -t list_of_urls.txt
Provider Usage:
osmedeus provider build
osmedeus provider build –token xxx –rebuild –ic
osmedeus provider create –name ‘sample’
osmedeus provider health –debug
Cloud Usage:
osmedeus cloud -f [flowName] -t [target]
osmedeus cloud -m [modulePath] -t [target]
osmedeus cloud -c 10 -f [flowName] -T [targetsFile]
osmedeus cloud –token xxx -G -c 10 -f [flowName] -T [targetsFile]
osmedeus cloud –chunk -c 10 -f [flowName] -t [targetsFile]
Utilities Usage:
osmedeus health
osmedeus version –json
osmedeus utils tmux ls
osmedeus utils tmux logs -A -l 10
osmedeus utils ps
osmedeus utils ps –proc ‘jaeles’
osmedeus utils cron –cmd ‘osmdeus scan -t example.com’ –sch 60
osmedeus utils cron –for –cmd ‘osmedeus scan -t example.com’
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Fastfuz-Chrome-Ext : Site Fast Fuzzing With Chorme Extension

Fastfuz-Chrome-Ext is a Fast fuzzing websites with chrome extension.

Screenshot
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgo_ZJ6iSuZE9vy9icxT36oQJjfPPezJ8mGDUv6EO_L22pxeYij2YMdaPx32Ee0lrQ6pS32OmMoG60btxMHs9w5RdxV6D91ghky2_6xX-rmhGZmgUdGvUJu8xJkWzoxwzV4C0WEAaQeZJyqzFyIbHPaYbPnlrqEaspk6zg2ZT7pOCsiSPuRptWWY7uH/s1206/115.png
Install
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi5I_agzXBEK2UEe4YchcJsRfyQHE5fX55VGtiHImQVbe69zpS1V3hKqVcVoBHc1NEtvGUcsX3Yg9E1fOXiGXJ3EHN6F6U9kXPpjEwJB_UnqPEYo7rbexzR487v1QaxJ9Bkz_VOQ9YpdzRVz_SeksxUaT09aZDQsx1-O-6vWpPG6-5my3mq6X-Z_Yrn/s480/68747470733a2f2f696d672e796f75747562652e636f6d2f76692f5a2d4f655574466f4476302f302e6a7067.jpg
Add Your Custom Files

* Open files.txt
* Paste your file or directory name in line by line
* Happy Hunting
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
GraphQL Cop : Security Auditor Utility For GraphQL APIs

GraphQL Cop is a small Python utility to run common security tests against GraphQL APIs. GraphQL Cop is perfect for running CI/CD checks in GraphQL. It is lightweight, and covers interesting security issues in GraphQL.

GraphQL Cop allows you to reproduce the findings by providing cURL commands upon any identified vulnerabilities.

Requirements

* Python3
* Requests Library

Detections

* Alias Overloading (DoS)
* Batch Queries (DoS)
* GET based Queries (CSRF)
* GraphQL Tracing / Debug Modes (Info Leak)
* Field Duplication (DoS)
* Field Suggestions (Info Leak)
* GraphiQL (Info Leak)
* Introspection (Info Leak)
* Directives Overloading (DoS)

Usage

$ python graphql-cop.py -h
Usage: graphql-cop.py -t http://example.com -o json
Options:
-h, –help show this help message and exit
-t URL, –target=URL target url with the path
-H HEADER, –header=HEADER
Append Header to the request ‘{“Authorization”:
“Bearer eyjt”}’
-o OUTPUT_JSON, –output=OUTPUT_JSON
Output results to stdout (JSON)
-x, –proxy Sends the request through http://127.0.0.1:8080 proxy
-v, –version Print out the current version and exit

Test a website

$ python3 graphql-cop.py -t https://mywebsite.com/graphql
GraphQL Cop 1.1
Security Auditor for GraphQL
Dolev Farhi & Nick Aleks
Starting…
[HIGH] Introspection Query Enabled (Information Leakage)
[LOW] GraphQL Playground UI (Information Leakage)
[HIGH] Alias Overloading with 100+ aliases is allowed (Denial of Service)
[HIGH] Queries are allowed with 1000+ of the same repeated field (Denial of Service)

Test a website, dump to a parse-able JSON output, cURL reproduction command

python3 main.py -t https://mywebsite.com/graphql -o json
{‘curl_verify’: ‘curl -X POST -H “User-Agent: graphql-cop/1.2” -H ‘
‘”Accept-Encoding: gzip, deflate” -H “Accept: /” -H ‘
‘”Connection: keep-alive” -H “Content-Length: 33” -H ‘
‘”Content-Type: application/json” -d \'{“query”: “query { ‘
‘__typename }”}\’ \’http://localhost:5013/graphql\”,
‘description’: ‘Tracing is Enabled’,
‘impact’: ‘Information Leakage’,
‘result’: False,
‘severity’: ‘INFO’,
‘title’: ‘Trace Mode’},
{‘curl_verify’: ‘curl -X POST -H “User-Agent: graphql-cop/1.2” -H ‘
‘”Accept-Encoding: gzip, deflate” -H “Accept: /” -H ‘
‘”Connection: keep-alive” -H “Content-Length: 64” -H ‘
‘”Content-Type: application/json” -d \'{“query”: “query { ‘
‘__typename @aa@aa@aa@aa@aa@aa@aa@aa@aa@aa }”}\’ ‘
“‘http://localhost:5013/graphql'”,
‘description’: ‘Multiple duplicated directives allowed in a query’,
‘impact’: ‘Denial of Service’,
‘result’: True,
‘severity’: ‘HIGH’,
‘title’: ‘Directive Overloading’}]

Test a website using graphql-copthrough a proxy (e.g. Burp Suite) with custom headers (e.g. Authorization):

$ python3 graphql-cop.py -t https://mywebsite.com/graphql –proxy –header ‘{“Authorization”: “Bearer token_here”}’
GraphQL Cop 1.2
Security Auditor for GraphQL
Dolev Farhi & Nick Aleks
Starting…
[HIGH] Introspection Query Enabled (Information Leakage)
[LOW] GraphQL Playground UI (Information Leakage)
[HIGH] Alias Overloading with 100+ aliases is allowed (Denial of Service)
[HIGH] Queries are allowed with 1000+ of the same repeated field (Denial of Service)
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
PwnKit-Exploit : Proof Of Concept (PoC) CVE-2021-4034

PwnKit-Exploit, a local privilege escalation vulnerability was found on polkit’s pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies.

Proof of Concept
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwOAMbH6gZ2_kTUN_lO02kOrPeI3FMDYomWDhZq46xnVq4v587S9dkffvOgIM-0aVE9tHqJiMBa_AvgSWkbClCkTxac5KwTsxkvDedBV916XbjLTksFxOjRdcbnip_8LvQAkZuxjsF1gZYoTCoLbfYX7gNtpmofZ222Y3YEtx9CGYdzyg-s0K8rv2T/s988/68747470733a2f2f6a2e676966732e636f6d2f5851704c38382e676966.gif
debian@debian:~/PwnKit-Exploit$ make
cc -Wall exploit.c -o exploit
debian@debian:~/PwnKit-Exploit$ whoami
debian
debian@debian:~/PwnKit-Exploit$ ./exploit
Current User before execute exploit
hacker@victim$whoami: debian
Exploit written by @luijait (0x6c75696a616974)
[+] Enjoy your root if exploit was completed succesfully
root@debian:/home/debian/PwnKit-Exploit# whoami
root
root@debian:/home/debian/PwnKit-Exploit# FixCommandUsesudo chmod 0755 pkexecFix CVE 2021-4034
Installation & Use git clone https://github.com/luijait/PwnKit-Exploitcd PwnKit-Exploitmake./exploitwhoamiCommandUtilitymake cleanClean build to test code modified ExplanationBased blog.qualys.com

The beginning of pkexec’s main() function processes the command-line arguments (lines 534-568), and searches for the program to be executed, if its path is not absolute, in the directories of the PATH environment variable (lines 610-640):

435 main (int argc, char *argv[])
436 {
534 for (n = 1; n < (guint) argc; n++)
535 {
568 }
610 path = g_strdup (argv[n]);
629 if (path[0] != ‘/’)
630 {
632 s = g_find_program_in_path (path);
639 argv[n] = path = s;
640 }

unfortunately, if the number of command-line arguments argc is 0 – which means if the argument list argv that we pass to execve() is empty, i.e. {NULL} – then argv[0] is NULL. This is the argument list’s terminator. Therefore:

at line 534, the integer n is permanently set to 1; at line 610, the pointer path is read out-of-bounds from argv[1]; at line 639, the pointer s is written out-of-bounds to argv[1]. But what exactly is read from and written to this out-of-bounds argv[1]?

To answer this question, we must digress briefly. When we execve() a new program, the kernel copies our argument, environment strings, and pointers (argv and envp) to the end of the new program’s stack; for example:
argv[0]argv[1]…argv[argc]envp[0]envp[1]…envp[envc]V V V V V V
“program” “-option” NULL “value” “PATH=name” NULL

Clearly, because the argv and envp pointers are contiguous in memory, if argc is 0, then the out-of-bounds argv[1] is actually envp[0], the pointer to our first environment variable, “value”. Consequently:

At line 610, the path of the program to be executed is read out-of-bounds from argv[1] (i.e. envp[0]), and points to “value”; At line 632, this path “value” is passed to g_find_program_in_path() (because “value” does not start with a slash, at line 629); Then, g_find_program_in_path() searches for an executable file named “value” in the directories of our PATH environment variable; If such an executable file is found, its full path is returned to pkexec’s main() function (at line 632); Finally, at line 639, this full path is written out-of-bounds to argv[1] (i.e. envp[0]), thus overwriting our first environment variable. So, stated more precisely:

If our PATH environment variable is “PATH=name”, and if the directory “name” exists (in the current working directory) and contains an executable file named “value”, then a pointer to the string “name/value” is written out-of-bounds to envp[0]; OR

If our PATH is “PATH=name=.”, and if the directory “name=.” exists and contains an executable file named “value”, th[...]

___________________________
@hacking_Attack
@Hacking_Video

en a pointer to the string “name=./value” is written out-of-bounds to envp[0]. In other words, this out-of-bounds write allows us to re-introduce an “unsecure” environment variable (for example, LD_PRELOAD) into pkexec’s environment. These “unsecure” variables are normally removed (by ld.so) from the environment of SUID programs before the main() function is called. We will exploit this powerful primitive in the following section.

Last-minute note: polkit also supports non-Linux operating systems such as Solaris and *BSD, but we have not investigated their exploitability. However, we note that OpenBSD is not exploitable, because its kernel refuses to execve() a program if argc is 0. Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Débuter en crypto. Tenter de comprendre, et ne pas se faire piéger. Attention à Metamask.

Depuis quelques années déjà, l’engouement est fort autour des crypto monnaies. Des centaines, des milliers, une myriade de choix s’offre à…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Tarefas de cybersegurança

https://cdn-images-1.medium.com/max/687/1*d4a49-dhMVltCQJMVSij4Q.png
Atores de ameaça não discriminam. Eles têm como alvo os dispositivos finais vulneráveis de usuários domésticos e empresas de pequeno a…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Unsecured emergency power supplies can create an emergency for you

https://cdn-images-1.medium.com/max/1500/1*-mLtckdUqlpLPZSXioH4OQ.jpeg
Uninterruptible power supplies offer emergency protection if the power goes down. But they can be an entry point for hackers.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Types of Steganography methods that are used for hiding confidential data.

https://cdn-images-1.medium.com/max/2600/0*F0C2LQ3I5DpWWVD5
> Are the images really safe?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video