king.com/wp-content/uploads/2022/04/Amazon-EC2-90x90.jpg Internal AWS credentials swiped by researcher via SQL payload2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/spring4shell-90x90.jpg Attackers are abusing Spring4Shell vulnerability to spread Mirai botnet malware3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-1-90x90.jpg Attackers Spoof WhatsApp Voice-Message Alerts to Steal Info4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/f956-article-211015-apple-body-text-90x90.jpg Apple paid out $36,000 bug bounty for HTTP request smuggling flaws1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/3e41-article-210226-vmware-body-text-90x90.jpg VMware warns of critical vulnerabilities in multiple products1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/A-New-Borat-RAT-Capable-Of-Conducting-Ransomware-DDOS-Activities-90x90.png No-Joke Borat RAT Propagates Ransomware, DDoS1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/php-pear-hacked-packages-malware-90x90.png Supply chain flaws in PHP package manager PEAR lay undiscovered for 15 years1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/php-hack-90x90.jpg PHP bug allows attackers to bypass domain filters, stage DoS attacks against servers2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/apple-iphone-hacking-90x90.jpg Apple emergency update fixes zero-days used to hack iPhones, Macs2 weeks ago
The post Microsoft Zero-Days, Wormable Bugs Spark Concern first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Creating a Full Kill Chain Attack With MITRE’s Engenuity Evaluation APTs

submitted by /u/zakijoshuaclark
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How I passed my CEH (Practical) in first attempt

First of all, I am not a complete beginner in infosec/cyber security community. I have been doing bugbounty for past 3 years and also my…Continue reading on Medium »
Read more...

Hacking on Medium
Hack The Box — Previse

https://cdn-images-1.medium.com/max/700/0*OVBYXZXS9ZhoH4kX
This is the 1st of what I hope will be at least a bi-weekly series of blogs. Although this will be a hard journey, my thirst for knowledge…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe: [Day 13] Networking They Lost The Plan!

https://cdn-images-1.medium.com/max/1920/1*psaTaSfd9sQyajFeYTLO-w.png
Complete the username: p…..

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How I passed my CEH (Practical) in first attempt

https://cdn-images-1.medium.com/max/1847/1*ajjikC23u8F0G5eVQpwLGg.jpeg
First of all, I am not a complete beginner in infosec/cyber security community. I have been doing bugbounty for past 3 years and also my…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Detecting Re-Entrancy Attack in Smart Contracts

https://cdn-images-1.medium.com/max/756/1*XVlRslIltXMG5apSpyQuEA.png
On 30 April 2016, the DAO was launched on Ethereum Block 1428757. It was an thrilling concept: a decentralized autonomous organization…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HackFridays with Cyrex

https://cdn-images-1.medium.com/max/1920/0*qjQu2iyFWe6jOiT4.jpg
At Cyrex we are all about innovating new ideas and collaborating both with our team and clients.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

How I passed my CEH (Practical) in first attempt
https://jayateerthag.medium.com/how-i-passed-my-ceh-practical-in-first-attempt-ceadf719a376?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

First of all, I am not a complete beginner in infosec/cyber security community. I have been doing bugbounty for past 3 years and also my…Continue reading on Medium » (https://jayateerthag.medium.com/how-i-passed-my-ceh-practical-in-first-attempt-ceadf719a376?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

modifyCertTemplate - ADCS Cert Template Modification And ACL Enumeration
http://www.kitploit.com/2022/04/modifycerttemplate-adcs-cert-template.html

___________________________
@hacking_Attack
@Hacking_Video

This tool is designed to aid an operator in modifying ADCS certificate templates so that a created vulnerable state can be leveraged for privilege escalation (https://www.kitploit.com/search/label/Privilege%20Escalation) (and then reset the template to its previous state afterwards). This is specifically designed for a scenario where WriteProperty rights over a template have been compromised, but the operator is unsure which properties the right applies to. In this scenairo, the template's ACL can be queried and the applicable ACE information can be cross-referenced with property GUIDs to determine the modifiable properties. Associated blog post (https://www.fortalicesolutions.com/posts/adcs-playing-with-esc4) on the tool and topic.
Usage Active Directory certificate template positional arguments: target [[domain/]username[:password] optional arguments: -h, --help show this help message and exit -template template name Name of the target certificate template -property property name Name of the target template property -value new value Value to set the specified template property to -get-acl Print the certificate's ACEs -dn distinguished name Explicitly set the distinguished name of the certificate template -raw Output the raw certificate template attributes -add flag name Add a flag to an attribute, maintaining the existing flags -debug Turn DEBUG output ON authentication: -hashes LMHASH:NTHASH NTLM hashes, format is LMHASH:NTHASH -no-pass don't ask for password (useful for -k) -k Use Kerberos authentication. Grabs credentials (https://www.kitploit.com/search/label/Credentials) from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line -aesKey hex key AES key to use for Kerberos Authentication (https://www.kitploit.com/search/label/Authentication) (128 or 256 bits) connection: -dc-ip ip address IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter -ldaps Use LDAPS instead of LDAP">usage: modifyCertTemplate.py [-h] -template template name [-property property name] [-value new value] [-get-acl] [-dn distinguished name] [-raw] [-add flag name] [-debug]
[-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address] [-ldaps]
target

Modify the attributes of an Active Directory certificate template

positional arguments:
target [[domain/]username[:password]

optional arguments:
-h, --help show this help message and exit
-template template name
Name of the target certificate template
-property property name
Name of the target template property
-value new value Value to set the specified template property to
-get-acl Print the certificate's ACEs
-dn distinguishe d name
Explicitly set the distinguished name of the certificate template
-raw Output the raw certificate template attributes
-add flag name Add a flag to an attribute, maintaining the existing flags
-debug Turn DEBUG output ON

authentication:
-hashes LMHASH:NTHASH
NTLM hashes, format is LMHASH:NTHASH
-no-pass don't ask for password (useful for -k)
-k Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will
use the ones specified in the command line

___________________________
@hacking_Attack
@Hacking_Video

-aesKey hex key AES key to use for Kerberos Authentication (128 or 256 bits)

connection:
-dc-ip ip address IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target param eter
-ldaps Use LDAPS instead of LDAP
Examples Querying a Template or Property Value Query a certificate template (all attributes) python3 modifyCertTemplate.py -template KerberosAuthentication ez.lab/administrator:pass
Query a single attribute from a certificate template python3 modifyCertTemplate.py -template KerberosAuthentication -property msPKI-Certificate-Name-Flag ez.lab/administrator:pass
Query the raw values of all template attributes python3 modifyCertTemplate.py -template KerberosAuthentication -raw ez.lab/administrator:pass
Querying ACL Info Query the ACL for a certificate template python3 modifyCertTemplate.py -template KerberosAuthentication -get-acl ez.lab/administrator:pass
Although unrelated to certificate templates, any object's ACL can be queried by providing the object's distinguished name python3 modifyCertTemplate.py -dn "CN=ws1,CN=computers,DC=ez,DC=lab" -get-acl ez.lab/administrator:pass
Modifying a Template Add the ENROLLEE_SUPPLIES_SUBJECT flag to the template's msPKI-Certificate-Name-Flag property python3 modifyCertTemplate.py -template KerberosAuthentication -add enrollee_supplies_subject -property msPKI-Certificate-Name-Flag ez.lab/administrator:pass
Update the value of a certificate template attribute (non-list properties) python3 modifyCertTemplate.py -template KerberosAuthentication -property msPKI-Certificate-Name-Flag -value -150994944 ez.lab/administrator:pass
Add an EKU to the pKIExtendedKeyUsage property python3 modifyCertTemplate.py -template KerberosAuthentication -add "client authentication" -property pKIExtendedKeyUsage ez.lab/administrator:pass
Update the value of a list-formatted attribute (i.e. explicitly set the value of pKIExtendedKeyUsage) python3 modifyCertTemplate.py -template KerberosAuthentication -value "'1.3.6.1.5.5.7.3.4', '1.3.6.1.5.5.7.3.2'" -property pKIExtendedKeyUsage ez.lab/administrator:pass
References, Credits and Other Projects to Check Out! PyWhisker (https://github.com/ShutdownRepo/pywhisker) Certi (https://github.com/zer1t0/certi) StandIn (https://github.com/FuzzySecurity/StandIn)

Download modifyCertTemplate (https://github.com/fortalice/modifyCertTemplate)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Find the protected user data on whois

So I just got a DM saying I was whitelisted for some mint and they give me URL to claim it (Of course I knew it was a scam)
Just to play along with it I followed the URL and did a quick whois lookup to see if I can get any details of them but they were protected by this With held for privacy service. Is there any way I can find the details of them?

submitted by /u/Weeby_Otaku
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Kali linux backdoor

Hello, i am using VMWare to run 2 kali linux PCs.

From pc1 i got access into pc 2 by cracking the password.

I want to create a backdoor from pc 1 in order to be able to access pc 2 in case they change password and i lose access.

​

Any ideas ? i have ftp access and ssh.

submitted by /u/imaGallex
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Apa itu Cyber Security? Jenis dan Peran Pentingnya

https://cdn-images-1.medium.com/max/1200/0*pgnwiw8xBapzEueh
Cyber security ialah salah satu praktik keamanan yang harus dikuasai pengguna internet, lho! Apa itu cyber security? Yuk, cek…

Continue reading on TechnoScape BNCC »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
FBI blames North Korean hackers for the $620 million theft from Axie Infinity

https://cdn-images-1.medium.com/max/840/1*rN_LmIoFGKSkxaWDuNPeMw.png
GM everyone 🧠 and TGIF🤌

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
modifyCertTemplate - ADCS Cert Template Modification And ACL Enumeration

___________________________
@hacking_Attack
@Hacking_Video