hacking: security in practice
How we hacked the kicksharing

https://external-preview.redd.it/dBjycHv9bFFFUMpG3VXtCPrIJO9Fups_EQnHhB8mco8.jpg?width=640&crop=smart&auto=webp&s=3e1ae398760a61c180e91a89fb78b2e3b29b929e submitted by /u/pimterry
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Internal AWS credentials swiped by researcher via SQL payload

Internal AWS credentials swiped by researcher via SQL payloadPost Views: 24
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png Advanced Enumeration techniques with NMAP, Zenmap and Hydra

Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
A security researcher said they seized credentials for an internal AWS service by exploiting a local file read vulnerability on a Relational Database Service (RDS) EC2 instance.
Credit for the discovery goes to Gafnit Amiga, director of security research at Israeli cloud security firm Lightspin, who told The Daily Swig that the research was noteworthy “because the final payload is all SQL commands”.

The impact was obscured by the fact AWS declined to divulge the purpose or implementation of the vulnerable internal service, but it did tell Amiga that any abuse would not have imperilled customer data.

While recognizing the appeal of AWS services, the finding showed that “wrapping third-party services such as PostgreSQL and trying to provide users with advanced features is sometimes a double-edged sword”, said Amiga.

AWS has comprehensively addressed the vulnerability and said it had found no evidence of hostile exploitation, according to the researcher. Path to the breakthroughAmiga began the research by spinning up an RDS instance using the Amazon Aurora PostgreSQL engine and connecting to the database using psql, according to a blog post documenting the process.

She set out to access the underlying machine running PostgreSQL, “so I searched for something that will allow me to run OS commands, send network requests or read local files,” the researcher explained.
See Also: Complete Offensive Security and Ethical Hacking Course
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png
“After trying all simple known techniques, I decided to go over the extensions.”

RDS supports many extensions for PostgreSQL, “but I felt that the chances they will miss something there are higher because it is not that simple to do a secure integration to a third-party code”, she continued.

The researcher examined the functionality of 8-10 such extensions and the objects they created within Postgres before alighting on one that yielded a potential breakthrough: log_fdw. Bypassing validationUsing the log_fdw extension, Amiga attempted a path traversal when creating a foreign table, but this prompted an exception saying “the log file path specified was invalid”.

After testing another relative path, she identified the source of the error as a validation function.

AWS created a custom foreign data wrapper – which can obtain data from external files – for log_fdw with handler and validator functions.

A potential breakthrough arose when it transpired that the validator function is optional for foreign data.
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Amiga potentially had permission to update the validator function using the rds_superuser role. “I just hoped that they validate the path only in the validation function,” she said.

This hope was fulfilled when the researcher dropped the validator function and the path traversal succeeded.

She then found temporary identity and access management (IAM) credentials at csd-grover-credentials.json, comprising a publicKey and privateKey, that turned out to be connected to an internal role by the name of csd-grover-role.

Amiga was then able to discover and access a corresponding internal, ‘Grover’ service. See Also: Offensive Security Tool: Scapy
The vulnerability was reported to AWS on December 9. AWS applied an initial patch [...]

___________________________
@hacking_Attack
@Hacking_Video

for recent versions of RDS and Aurora PostgreSQL engines on December 14, then confirmed on March 22 that all current supported versions were fixed and that potentially affected customers had been given mitigation instructions. Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Hacking stories: MafiaBoy, the hacker who took down the Internet
Source: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/spring4shell-90x90.jpg Attackers are abusing Spring4Shell vulnerability to spread Mirai botnet malware1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-1-90x90.jpg Attackers Spoof WhatsApp Voice-Message Alerts to Steal Info2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/f956-article-211015-apple-body-text-90x90.jpg Apple paid out $36,000 bug bounty for HTTP request smuggling flaws5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/3e41-article-210226-vmware-body-text-90x90.jpg VMware warns of critical vulnerabilities in multiple products6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/A-New-Borat-RAT-Capable-Of-Conducting-Ransomware-DDOS-Activities-90x90.png No-Joke Borat RAT Propagates Ransomware, DDoS1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/php-pear-hacked-packages-malware-90x90.png Supply chain flaws in PHP package manager PEAR lay undiscovered for 15 years1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/php-hack-90x90.jpg PHP bug allows attackers to bypass domain filters, stage DoS attacks against servers1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/apple-iphone-hacking-90x90.jpg Apple emergency update fixes zero-days used to hack iPhones, Macs2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Google-Campus-90x90.jpg Google Chrome Bug Actively Exploited as Zero-Day2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/685f-article-211221-chrome-site-isolation-body-text-90x90.jpg HTML parser bug triggers Chromium XSS security flaw2 weeks ago
The post Internal AWS credentials swiped by researcher via SQL payload first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
BEST WAY TO HACK YOUR HUSBAND CELLPHONE WITHOUT HIM KNOWING

As a wife, you will be curious who your husband is always texting and chatting with online. If he is prone to do this, you will need hard…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Start learn pentesting/hacking. The Red Team

Useful materials for those who starting to learn pentesting/hacking. All materials checked by myself.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How hackers impersonate email-id’s : Email Spoofing and Phishing Attacks

https://cdn-images-1.medium.com/max/960/1*bNTMMFDZgG-McLeQx_qbwg.jpeg
Email Spoofing is a cyberattack where the attacker impersonates emails. It is a common tactic for carrying phishing attacks and spamming.

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Clickjacking: Think twice before you click!

https://cdn-images-1.medium.com/max/2600/0*6zDBT_8yOk6JChJD
You receive a link to a website that sells really cheap villas in Mexico. Who doesn’t want a cheap estate in Mehico? But what catches your…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Melody - A Transparent Internet Sensor Built For Threat Intelligence
http://www.kitploit.com/2022/04/melody-transparent-internet-sensor.html

___________________________
@hacking_Attack
@Hacking_Video

Melody Monitor the Internet's background noiseMelody is a transparent internet sensor built for threat intelligence (https://www.kitploit.com/search/label/Threat%20Intelligence) and supported by a detection rule framework which allows you to tag packets of interest for further analysis and threat monitoring.
Features Here are some key features of Melody : Transparent capture Write detection rules and tag specific packets to analyze them at scale Mock vulnerable (https://www.kitploit.com/search/label/Vulnerable) websites using the builtin HTTP/S server Supports the main internet protocols over IPv4 and IPv6 Handles log rotation for you : Melody is designed to run forever on the smallest VPS Minimal configuration required Standalone mode : configure Melody using only the CLI Easily scalable : Statically compiled binary Up-to-date Docker image Wishlist Since I have to focus on other projects right now, I can't put much time in Melody's development. There is a lot of rom for improvement though, so here are some features that I'd like to implement someday : Dedicated helper program to create, test and manage rules -> Check Meloctl in cmd/meloctl Centralized rules management Per port mock application Use cases Internet facing sensor Extract trends and patterns from Internet's noise Index malicious activity, exploitation (https://www.kitploit.com/search/label/Exploitation) attempts and targeted scanners Monitor emerging threats exploitation Keep an eye on specific threats Stream analysis Build a background noise profile to make targeted attacks stand out Replay captures to tag malicious packets in a suspicious stream Preview

___________________________
@hacking_Attack
@Hacking_Video

Quickstart Quickstart details. (https://bonjourmalware.github.io/melody/installation) TL;DR Release Get the latest release at https://github.com/bonjourmalware/melody/releases. make install # Set default outfacing interface
make cap # Set network capabilities to start Melody without elevated privileges
make certs # Make self signed certs for the HTTPS fileserver
make enable_all_rules # Enable the default rules
make service # Create a systemd service to restart the program automatically and launch it at startup

sudo systemctl stop melody # Stop the service while we're configuring it Update the filter.bpf file to filter out unwanted packets. sudo systemctl start melody # Start Melody
sudo systemctl status melody # Check that Melody is running The logs should start to pile up in /opt/melody/logs/melody.ndjson. tail -f /opt/melody/logs/melody.ndjson # | jq From source git clone https://github.com/bonjourmalware/melody /opt/melody
cd /opt/melody
make build Then continue with the steps from the release (https://github.com/bonjourmalware/melody#release) TL;DR. Docker make certs # Make self signed certs for the HTTPS fileserver
make enable_all_rules # Enable the default rules
mkdir -p /opt/melody/logs
cd /opt/melody/

docker pull bonjourmalware/melody:latest

MELODY_CLI="" # Put your CLI options here. Example : export MELODY_CLI="-s -i 'lo' -F 'dst port 5555' -o 'server.http.port: 5555'"

docker run \
--net=host \
-e "MELODY_CLI=$MELODY_CLI" \
--mount type=bind,source="$(pwd)/filter.bpf",target=/app/filter.bpf,readonly \
--mount type=bind,source="$(pwd)/config.yml",target=/app/config.yml,readonly \
--mount type=bind,source="$(pwd)/var",target=/app/var,readonly \
--mount type=bind,source="$(pwd)/rules",target=/app/rules,readonly \
--mount type=bind,source="$(pwd)/logs",target=/app/logs/ \
bonjourmalware/melody The logs should start to pile up in /opt/melody/logs/melody.ndjson. Rules Rule syntax details. (https://bonjourmalware.github.io/melody/installation) Example CVE-2020-14882 Oracle Weblogic Server RCE:
layer: http
meta:
id: 3e1d86d8-fba6-4e15-8c74-941c3375fd3e
version: 1.0
author: BonjourMalware
status: stable
created: 2020/11/07
modified: 2020/20/07
description: "Checking or trying to exploit CVE-2020-14882"
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2020-14882"
match:
http.uri:
startswith|any|nocase:
- "/console/css/"
- "/console/images"
contains|any|nocase:
- "console.portal"
- "consolejndi.portal?test_handle="
tags:
cve: "cve-2020-14882"
vendor: "oracle"
product: "weblogic"
impact: "rce" Logs Logs content details. (https://bonjourmalware.github.io/melody/layers) Example Netcat TCP packet over IPv4 : {
"tcp": {
"window": 512,
"seq": 1906765553,
"ack": 2514263732,
"data_offset": 8,
"flags": "PA",
"urgent": 0,
"payload": {
"content": "I made a discovery today. I found a computer.\n",
"base64": "SSBtYWRlIGEgZGlzY292ZXJ5IHRvZGF5LiAgSSBmb3VuZCBhIGNvbXB1dGVyLgo=",
"truncated": false
}
},
"ip": {
"version": 4,
"ihl": 5,
"tos": 0,
"length": 99,
"id": 39114,
"fragbits": "DF",
"frag_offset": 0,
"ttl": 64,
"protocol": 6
},
"timestamp": "2020-11-16T15:50:01.277828+01:00",
"session": "bup9368o4skolf20rt8g",
"type": "tcp",
"src_ip": "127.0.0.1",
"dst_port": 1234,
"matches": {},
"inline_matches": [],
"embedded": {}
}

Download Melody (https://github.com/bonjourmalware/melody)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Where to find "true/real" domains of hacking forums or anything else?

For example, I want to search a leaked database right now and looked up to forums containing leaks section. In this subreddit's wiki I found "leakforums" and on www this one seems like a popular one but how am I supposed to find the real "leakforums"? Is it .su, .co, .fr, .net (.com, .org forwards to .net) or anything else? Would appreciate the help. Thx.

submitted by /u/IHateFacelessPorn
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do i transfer a malicious file from my laptop to my vm

So I made a script that once deployed or downloaded it will immediately make random txt files in a very fast manner and spams it on the desktop and just overwhelms the pc. Now im just hella curious how i can transfer it from my desktop to my VM

submitted by /u/Barlie2
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Codecat v0.56 : An Open-Source Tool To Help You Find/Track User Input Sinks And Security Bugs

CodeCat is an open-source tool to help you find/track user input sinks and security bugs using static code analysis. These points follow regex rules. Current rules for C,C++,GO, Python, javascript, Swift, PHP, Ruby, ASP, Kotlin, Dart and Java.(you can create your rules).

How too install, step by step

Go to CodeCat directory, install backend and frontend libs:

$ apt install python3-venv python3-dev libffi-dev rustc libssl-dev
$ python3 -m venv .venv
$ . .venv/bin/activate
$ pip install wheel
$ pip install -r Frontend/requirements.txt
$ pip install -r Backend/requirements.txt

Run backend and frontend

$ cd Codecat
$ cd Frontend; python3 wsgi.py &
$ cd ..
$ cd Backend; python3 wsgi.py &

Next step you need save your user to login:

$ curl -i -X POST -H “Content-Type: application/json” -d ‘{“email”:”admin2@test.com”,”username”:”admin”,”password”:”rubrik123″}’ https://127.0.0.1:50001/api/users -k

These endpoint /API/users run only once in the first deployment. If you try to send a request again to insert a user, the endpoint return 404 is security to block resources of possible attacks.

Go to the following “https://127.0.0.1:50093/front/auth/”. Now you can enter this system-auth, use login “admin”, pass “rubrik123”.

Note About TLS: You can configure and load your TLS cert in “wsgi.py”.

Production

Suppose you need to run in production. So I recommend another way.

$ gunicorn -b 127.0.0.1:50001 wsgi:app

If you want, you can use TLS with CERT resources:

$ gunicorn –certfile=server.crt –keyfile=server.key -b 127.0.0.1:50001 wsgi:app

The same command to frontend, but you need to use port 50093.
Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How can I prevent Hackers from intruding into my Windows computer?

https://cdn-images-1.medium.com/max/1280/1*XorzWsJQmZ2pf0JbnJFRtg.png
Have you ever thought about frustrating hackers from intruding into your computer? This article lays down an analysis, and fingerprints a…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is the dark web, and what will you find there?

https://cdn-images-1.medium.com/max/1366/1*DwvB_jlcXImbItX4tBfjWg.png
The dark web is the sort of back alley of the internet world. You can find all sorts of illicit activities being conducted there

Continue reading on Mindaro »

___________________________
@hacking_Attack
@Hacking_Video