> Are the images really safe?Continue reading on Medium » (https://prasan26.medium.com/types-of-steganography-methods-that-are-used-for-hiding-confidential-data-b3c00132b972?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Types of Steganography methods that are used for hiding confidential data.

> Are the images really safe?Continue reading on Medium »
Read more...

Kali Linux Tutorials
Osmedeus : A Workflow Engine For Offensive Security

Osmedeus is a Workflow Engine for Offensive Security.

Installation

NOTE that you need some essential tools like curl, wget, git, zipand login as root to start

bash -c “$(curl -fsSL https://raw.githubusercontent.com/osmedeus/osmedeus-base/master/install.sh)”

Build the engine from source

Make sure you installed golang >= v1.17

mkdir -p $GOPATH/src/github.com/j3ssie
git clone –depth=1 https://github.com/j3ssie/osmedeus $GOPATH/src/github.com/j3ssie/osmedeus
cd $GOPATH/src/github.com/j3ssie/osmedeus
make build

Usage

Scan Usage:
osmedeus scan -f [flowName] -t [target]
osmedeus scan -m [modulePath] -T [targetsFile]
osmedeus scan -f /path/to/flow.yaml -t [target]
osmedeus scan -m /path/to/module.yaml -t [target] –params ‘port=9200’
osmedeus scan -m /path/to/module.yaml -t [target] -l /tmp/log.log
cat targets | osmedeus scan -f sample
Practical Scan Usage:
osmedeus scan -T list_of_targets.txt -W custom_workspaces
osmedeus scan -t target.com -w workspace_name –debug
osmedeus scan -f general -t www.sample.com
osmedeus scan -f gdirb -T list_of_target.txt
osmedeus scan -m ~/.osmedeus/core/workflow/test/dirbscan.yaml -t list_of_urls.txt
osmedeus scan –wfFolder ~/custom-workflow/ -f your-custom-workflow -t list_of_urls.txt
Provider Usage:
osmedeus provider build
osmedeus provider build –token xxx –rebuild –ic
osmedeus provider create –name ‘sample’
osmedeus provider health –debug
Cloud Usage:
osmedeus cloud -f [flowName] -t [target]
osmedeus cloud -m [modulePath] -t [target]
osmedeus cloud -c 10 -f [flowName] -T [targetsFile]
osmedeus cloud –token xxx -G -c 10 -f [flowName] -T [targetsFile]
osmedeus cloud –chunk -c 10 -f [flowName] -t [targetsFile]
Utilities Usage:
osmedeus health
osmedeus version –json
osmedeus utils tmux ls
osmedeus utils tmux logs -A -l 10
osmedeus utils ps
osmedeus utils ps –proc ‘jaeles’
osmedeus utils cron –cmd ‘osmdeus scan -t example.com’ –sch 60
osmedeus utils cron –for –cmd ‘osmedeus scan -t example.com’
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Fastfuz-Chrome-Ext : Site Fast Fuzzing With Chorme Extension

Fastfuz-Chrome-Ext is a Fast fuzzing websites with chrome extension.

Screenshot
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgo_ZJ6iSuZE9vy9icxT36oQJjfPPezJ8mGDUv6EO_L22pxeYij2YMdaPx32Ee0lrQ6pS32OmMoG60btxMHs9w5RdxV6D91ghky2_6xX-rmhGZmgUdGvUJu8xJkWzoxwzV4C0WEAaQeZJyqzFyIbHPaYbPnlrqEaspk6zg2ZT7pOCsiSPuRptWWY7uH/s1206/115.png
Install
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi5I_agzXBEK2UEe4YchcJsRfyQHE5fX55VGtiHImQVbe69zpS1V3hKqVcVoBHc1NEtvGUcsX3Yg9E1fOXiGXJ3EHN6F6U9kXPpjEwJB_UnqPEYo7rbexzR487v1QaxJ9Bkz_VOQ9YpdzRVz_SeksxUaT09aZDQsx1-O-6vWpPG6-5my3mq6X-Z_Yrn/s480/68747470733a2f2f696d672e796f75747562652e636f6d2f76692f5a2d4f655574466f4476302f302e6a7067.jpg
Add Your Custom Files

* Open files.txt
* Paste your file or directory name in line by line
* Happy Hunting
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
GraphQL Cop : Security Auditor Utility For GraphQL APIs

GraphQL Cop is a small Python utility to run common security tests against GraphQL APIs. GraphQL Cop is perfect for running CI/CD checks in GraphQL. It is lightweight, and covers interesting security issues in GraphQL.

GraphQL Cop allows you to reproduce the findings by providing cURL commands upon any identified vulnerabilities.

Requirements

* Python3
* Requests Library

Detections

* Alias Overloading (DoS)
* Batch Queries (DoS)
* GET based Queries (CSRF)
* GraphQL Tracing / Debug Modes (Info Leak)
* Field Duplication (DoS)
* Field Suggestions (Info Leak)
* GraphiQL (Info Leak)
* Introspection (Info Leak)
* Directives Overloading (DoS)

Usage

$ python graphql-cop.py -h
Usage: graphql-cop.py -t http://example.com -o json
Options:
-h, –help show this help message and exit
-t URL, –target=URL target url with the path
-H HEADER, –header=HEADER
Append Header to the request ‘{“Authorization”:
“Bearer eyjt”}’
-o OUTPUT_JSON, –output=OUTPUT_JSON
Output results to stdout (JSON)
-x, –proxy Sends the request through http://127.0.0.1:8080 proxy
-v, –version Print out the current version and exit

Test a website

$ python3 graphql-cop.py -t https://mywebsite.com/graphql
GraphQL Cop 1.1
Security Auditor for GraphQL
Dolev Farhi & Nick Aleks
Starting…
[HIGH] Introspection Query Enabled (Information Leakage)
[LOW] GraphQL Playground UI (Information Leakage)
[HIGH] Alias Overloading with 100+ aliases is allowed (Denial of Service)
[HIGH] Queries are allowed with 1000+ of the same repeated field (Denial of Service)

Test a website, dump to a parse-able JSON output, cURL reproduction command

python3 main.py -t https://mywebsite.com/graphql -o json
{‘curl_verify’: ‘curl -X POST -H “User-Agent: graphql-cop/1.2” -H ‘
‘”Accept-Encoding: gzip, deflate” -H “Accept: /” -H ‘
‘”Connection: keep-alive” -H “Content-Length: 33” -H ‘
‘”Content-Type: application/json” -d \'{“query”: “query { ‘
‘__typename }”}\’ \’http://localhost:5013/graphql\”,
‘description’: ‘Tracing is Enabled’,
‘impact’: ‘Information Leakage’,
‘result’: False,
‘severity’: ‘INFO’,
‘title’: ‘Trace Mode’},
{‘curl_verify’: ‘curl -X POST -H “User-Agent: graphql-cop/1.2” -H ‘
‘”Accept-Encoding: gzip, deflate” -H “Accept: /” -H ‘
‘”Connection: keep-alive” -H “Content-Length: 64” -H ‘
‘”Content-Type: application/json” -d \'{“query”: “query { ‘
‘__typename @aa@aa@aa@aa@aa@aa@aa@aa@aa@aa }”}\’ ‘
“‘http://localhost:5013/graphql'”,
‘description’: ‘Multiple duplicated directives allowed in a query’,
‘impact’: ‘Denial of Service’,
‘result’: True,
‘severity’: ‘HIGH’,
‘title’: ‘Directive Overloading’}]

Test a website using graphql-copthrough a proxy (e.g. Burp Suite) with custom headers (e.g. Authorization):

$ python3 graphql-cop.py -t https://mywebsite.com/graphql –proxy –header ‘{“Authorization”: “Bearer token_here”}’
GraphQL Cop 1.2
Security Auditor for GraphQL
Dolev Farhi & Nick Aleks
Starting…
[HIGH] Introspection Query Enabled (Information Leakage)
[LOW] GraphQL Playground UI (Information Leakage)
[HIGH] Alias Overloading with 100+ aliases is allowed (Denial of Service)
[HIGH] Queries are allowed with 1000+ of the same repeated field (Denial of Service)
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
PwnKit-Exploit : Proof Of Concept (PoC) CVE-2021-4034

PwnKit-Exploit, a local privilege escalation vulnerability was found on polkit’s pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies.

Proof of Concept
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwOAMbH6gZ2_kTUN_lO02kOrPeI3FMDYomWDhZq46xnVq4v587S9dkffvOgIM-0aVE9tHqJiMBa_AvgSWkbClCkTxac5KwTsxkvDedBV916XbjLTksFxOjRdcbnip_8LvQAkZuxjsF1gZYoTCoLbfYX7gNtpmofZ222Y3YEtx9CGYdzyg-s0K8rv2T/s988/68747470733a2f2f6a2e676966732e636f6d2f5851704c38382e676966.gif
debian@debian:~/PwnKit-Exploit$ make
cc -Wall exploit.c -o exploit
debian@debian:~/PwnKit-Exploit$ whoami
debian
debian@debian:~/PwnKit-Exploit$ ./exploit
Current User before execute exploit
hacker@victim$whoami: debian
Exploit written by @luijait (0x6c75696a616974)
[+] Enjoy your root if exploit was completed succesfully
root@debian:/home/debian/PwnKit-Exploit# whoami
root
root@debian:/home/debian/PwnKit-Exploit# FixCommandUsesudo chmod 0755 pkexecFix CVE 2021-4034
Installation & Use git clone https://github.com/luijait/PwnKit-Exploitcd PwnKit-Exploitmake./exploitwhoamiCommandUtilitymake cleanClean build to test code modified ExplanationBased blog.qualys.com

The beginning of pkexec’s main() function processes the command-line arguments (lines 534-568), and searches for the program to be executed, if its path is not absolute, in the directories of the PATH environment variable (lines 610-640):

435 main (int argc, char *argv[])
436 {
534 for (n = 1; n < (guint) argc; n++)
535 {
568 }
610 path = g_strdup (argv[n]);
629 if (path[0] != ‘/’)
630 {
632 s = g_find_program_in_path (path);
639 argv[n] = path = s;
640 }

unfortunately, if the number of command-line arguments argc is 0 – which means if the argument list argv that we pass to execve() is empty, i.e. {NULL} – then argv[0] is NULL. This is the argument list’s terminator. Therefore:

at line 534, the integer n is permanently set to 1; at line 610, the pointer path is read out-of-bounds from argv[1]; at line 639, the pointer s is written out-of-bounds to argv[1]. But what exactly is read from and written to this out-of-bounds argv[1]?

To answer this question, we must digress briefly. When we execve() a new program, the kernel copies our argument, environment strings, and pointers (argv and envp) to the end of the new program’s stack; for example:
argv[0]argv[1]…argv[argc]envp[0]envp[1]…envp[envc]V V V V V V
“program” “-option” NULL “value” “PATH=name” NULL

Clearly, because the argv and envp pointers are contiguous in memory, if argc is 0, then the out-of-bounds argv[1] is actually envp[0], the pointer to our first environment variable, “value”. Consequently:

At line 610, the path of the program to be executed is read out-of-bounds from argv[1] (i.e. envp[0]), and points to “value”; At line 632, this path “value” is passed to g_find_program_in_path() (because “value” does not start with a slash, at line 629); Then, g_find_program_in_path() searches for an executable file named “value” in the directories of our PATH environment variable; If such an executable file is found, its full path is returned to pkexec’s main() function (at line 632); Finally, at line 639, this full path is written out-of-bounds to argv[1] (i.e. envp[0]), thus overwriting our first environment variable. So, stated more precisely:

If our PATH environment variable is “PATH=name”, and if the directory “name” exists (in the current working directory) and contains an executable file named “value”, then a pointer to the string “name/value” is written out-of-bounds to envp[0]; OR

If our PATH is “PATH=name=.”, and if the directory “name=.” exists and contains an executable file named “value”, th[...]

___________________________
@hacking_Attack
@Hacking_Video

en a pointer to the string “name=./value” is written out-of-bounds to envp[0]. In other words, this out-of-bounds write allows us to re-introduce an “unsecure” environment variable (for example, LD_PRELOAD) into pkexec’s environment. These “unsecure” variables are normally removed (by ld.so) from the environment of SUID programs before the main() function is called. We will exploit this powerful primitive in the following section.

Last-minute note: polkit also supports non-Linux operating systems such as Solaris and *BSD, but we have not investigated their exploitability. However, we note that OpenBSD is not exploitable, because its kernel refuses to execve() a program if argc is 0. Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Débuter en crypto. Tenter de comprendre, et ne pas se faire piéger. Attention à Metamask.

Depuis quelques années déjà, l’engouement est fort autour des crypto monnaies. Des centaines, des milliers, une myriade de choix s’offre à…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Tarefas de cybersegurança

https://cdn-images-1.medium.com/max/687/1*d4a49-dhMVltCQJMVSij4Q.png
Atores de ameaça não discriminam. Eles têm como alvo os dispositivos finais vulneráveis de usuários domésticos e empresas de pequeno a…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Unsecured emergency power supplies can create an emergency for you

https://cdn-images-1.medium.com/max/1500/1*-mLtckdUqlpLPZSXioH4OQ.jpeg
Uninterruptible power supplies offer emergency protection if the power goes down. But they can be an entry point for hackers.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Types of Steganography methods that are used for hiding confidential data.

https://cdn-images-1.medium.com/max/2600/0*F0C2LQ3I5DpWWVD5
> Are the images really safe?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Wholeaked - A File-Sharing Tool That Allows You To Find The Responsible Person In Case Of A Leakage

https://blogger.googleusercontent.com/img/a/AVvXsEgO-VckzRDAd2m4Q6rd5OahdeyzSx825Vv6hQwGlJrXXgl3zxcjO6oZi8UxpLKYw1shk17fNLpPSeVcdi2p2oW3bdbPggWLsBUFBx98xzmlk0W3P5EnrC4NNhqFMW9xnOcHHdBoVadseu-VbarfItxc-nL9rrytafjtVsLNOryizCsdAKtyOLQYZbcK=w640-h480 wholeaked is a file-sharing tool that allows you to find the responsible person in case of a leakage. It's written in Go. How?wholeaked gets the file that will be shared and a list of recipients. It creates a unique signature for each recipient and adds it to the file secretly. After then, it can automatically send files to the corresponding recipients by using Sendgrid, AWS SES or SMTP integrations. Instead of sending them by e-mail, you can also share them manually.

wholeaked works with every file type. However, it has additional features for common file types such as PDF, DOCX, MOV etc. Sharing Process+-----------+
|Top Secret |
|.pdf |
| |
-| |
/ | |
/ |Hidden |
a@gov / |signature1 |
/ +-----------+
/ +-----------+
+-----------++-----------+ / |Top Secret |
|Top Secret ||Recipient | / |.pdf |
|.pdf ||List | +---------+ / | |
| || | |utkusen/ | / b@gov | |
| ||a@gov |----->|wholeaked| /----------+ |
| ||b@gov | | | \ |Hidden |
| ||c@gov | +---------+ \ |signature2 |
| || | \ +-----------+
+-----------++-----------+ \ +-----------+
\ |Top Secret |
\ |.pdf |
c@gov \ | |
\ | |
\ | |
\ |Hidden |
-|signature3 |
+-----------+ Validation PartTo find who leaked the document, you just need to provide the leaked file to wholeaked, and it will reveal the responsible person by comparing the signatures in the database. +-----------+ +---------+
|Top Secret | |Signature|
|.pdf | +---------+|Database |
| | |utkusen/ || | Document leaked by
| |->|wholeaked|| |--------+
| | | || | b@gov
|Hidden | +---------+| |
|Signature2 | | |
+-----------+ +---------+ Demonstration VideoFile Types and Detection Modeswholeaked can add the unique signature to different sections of a file. Available detection modes are given below:

File Hash: SHA256 hash of the file. All file types are supported.

Binary: The signature is directly added to the binary. Almost all file types are supported.

Metadata: The signature is added to a metadata section of a file. Supported file types: PDF, DOCX, XLSX, PPTX, MOV, JPG, PNG, GIF, EPS, AI, PSD

Watermark: An invisible signature is inserted into the text. Only PDF files are supported. InstallationFrom BinaryYou can download the pre-built binaries from the releases page and run. For example: unzip wholeaked_0.1.0_macOS_amd64.zip./wholeaked --helpFrom Source1.
Install Go on your system

2.
Run: go install github.com/utkusen/wholeaked@latestInstalling Dependencieswholeaked requires exiftoolfor adding signatures to metadata section of files. If you don't want to use this feature, you don't need to install it.

1. Debian-based Linux: Run apt install exiftool2. macOS: Run brew install exiftool3. Windows: Download exiftool from here https://exiftool.org/ and put the exiftool.exein the same dir[...]

___________________________
@hacking_Attack
@Hacking_Video

ectory with wholeaked.

wholeaked requires pdftotextfor verifying watermarks inside PDF files. If you don't want to use this feature, you don't need to install it.

1. Download "Xpdf command line tools" for Linux, macOS or Windows from here: https://www.xpdfreader.com/download.html
2. Extract the archive and navigate to bin64folder.
3. Copy the pdftotext(or pdftotext.exe) executable to the same folder with wholeaked
4. For Debian Based Linux: Run apt install libfontconfigcommand. UsageBasic Usagewholeaked requires a project name -n, the path of the base file which the signatures will add -fand a list of target recipients -tExample command: ./wholeaked -n test_project -f secret.pdf -t targets.txtThe targets.txtfile should contain name and the e-mail address in the following format: Utku Sen,utku@utkusen.com
Bill Gates,bill@microsoft.com After execution is completed, the following unique files will be generated: test_project/files/Utku_Sen/secret.pdf
test_project/files/Bill_Gates/secret.pdf By default, wholeaked adds signatures to all available places that are defined in the "File Types and Detection Modes" section. If you don't want to use a method, you can define it with a falseflag. For example: ./wholeaked -n test_project -f secret.pdf -t targets.txt -binary=false -metadata=false -watermark=falseSending E-mailsIn order to send e-mails, you need to fill some sections in the CONFIGfile.

*
If you want to send e-mails via Sendgrid, type your API key to the SENDGRID_API_KEYsection.

*
If you want to send e-mails via AWS SES integration, you need to install awsclion your machine and add the required AWS key to it. wholeaked will read the key by itself. But you need to fill the AWS_REGIONsection in the config file.

*
If you want to send e-mails via a SMTP server, fill the SMTP_SERVER, SMTP_PORT, SMTP_USERNAME, SMTP_PASSWORDsections.
The other necessary fields to fill:

* EMAIL_TEMPLATE_PATHPath of the e-mail's body. You can specify use HTML or text format.
* EMAIL_CONTENT_TYPECan be htmlor text* EMAIL_SUBJECTSubject of the e-mail
* FROM_NAMEFrom name of the e-mail
* FROM_EMAILFrom e-mail of the e-mail

To specify the sending method, you can use -sendgrid, -sesor -smtpflags. For example: ./wholeaked -n test_project -f secret.pdf -t targets.txt -sendgridValidating a Leaked FileYou can use the -validateflag to reveal the owner of a leaked file. wholeaked will compare the signatures detected in the file and the database located in the project folder. Example: ./wholeaked -n test_project -f secret.pdf -validateImportant: You shouldn't delete the project_folder/db.csvfile if you want to use the file validation feature. If that file is deleted, wholeaked won't be able to compare the signatures. Download Wholeaked

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Having trouble understanding Website fundamentals, for hacking, any pointers?

I’ve been using THM and getting the hang of things, and big pictures, rather well lately. However exploiting websites is a little difficult and I don’t know what topic to study.

For example I get caught up in the “why” of certain things like how many “../“s to use to get a directory. Or how to know whether or not something is exploitable. Why I should use &ext=, what &ext= even means, why I needed to add a filter to the url, etc.

Like the dogcat room for THM is what prompted me to come here. I don’t want a handout of how to hack the room, just the name of the topic I should learn about to understand why certain exploits work for websites.

Sorry if this is all gibberish, hope someone can help, I know how to get better just don’t know where to look.

submitted by /u/OoooHeABigOlBoi
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Wordlist for password cracking

Hello, i am looking for a wordlist to perform a dictionary attack on 2 users.

am looking for a word list to crack these 2 password , can be done separatly in order to increase speed

User1 -> 8 characters long (lowercase)

User 2 -> 4 characters long (Upper case + lower case + symbols)

i am using kali linux.

submitted by /u/imaGallex
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
is this friendly challenge legal?

I am staying in a hotel with an unsecured wifi. A colleague of mine is there too but we are not on the same floor.We were joking about this unsecured network and he challenge me to get something from him across this network.

I didn't plan to get something else but am I allowed to perform some scan and more or is this forbidden?

Plus if someone have a source I can relay on about laws and restrictions to not ask the next time

Ty

​

Edit : I will not do it because of comments (thanks you mates) and also because I found something I was not supposed to found

submitted by /u/chanoir2303
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video