The default level is 5.

The following is the breakdown of the error levels:

0: FATAL

1: ALERT

2: CRITICAL

3: ERROR

4: WARNING

5: NOTICE

6: INFO

7: DEBUG

8: DEBUG-AUDIT

9: DEBUG- SERVER

10: DEBUG – MODULE
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp -w 0
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp -w 06
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp -w 07
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTPQb2w7vwj-4w9iVrex24-EERAxUHDhX8y6tB4zZyKN9GOaWny74GB-_4QIfhahuk4ocbqQOO2-kVPJfZ-AMIhvdLH9u2ChWoQiYeCEp6MgAN_ZNIfHnp4dYK37auWFMqYk3Hn34sKdL1hTxz2_N_lYdlWC1yDSZGU2nPSSPUdJS0mA17LSvl6QKj7A/s16000/15.png?w=640&ssl=1 Using Combo EntriesMedusa gives an option of using combo entries while brute forcing. The option -C uses a file containing combo entries. Combo files are colon separated and in the following format: host:user:password. If any of the three fields are left empty, the respective information should be provided either as single global value or as a list in a file. You can use following combinations.

host:user:password

host:user:

host::

username:password

username:

password

host::username
medusa -M ftp -C userpass.txt
So here first userpass.txt file is created where data is stored in form of host:username:password. And then medusa brute force attack is performed using -C option. You can take reference from screenshot attached.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgfGBlp7sZPZWGYx1TymPzeheLobq38-ANeKK6E0sFpCKOIibdprCK3hihkQbXyEBixkqXG9hI_SHQzlZ8GSG0XEd_TkGQx8b2e0z5ctdOaKEDR2QmEtlLY6HOIcEq5hnUPuQMSSjOU4F_wHMjB8WWx11aTh3mr2VwoPnSRyNw8yPt-xYg6_gE-_j1x9A/s16000/16.png?w=640&ssl=1 Concurrent testing on multiple loginsIf you want to perform concurrent testing on multiple logins so for that you use -t option. After that mention the number of logins you want to test concurrently and hence medusa will brute force on respective logins.
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp -t 4
So, while performing the attack it tested concurrently 4 logins at specified port and printed results for all four concurrently.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEixT7WOCJbo2eYBwqrq3b2XLusdplUnxqyli5K1QiEvm3QzEtWcEl1sQ0Yi1bWzc8sqZrJX8eRMefoJNydxUFXkXSW2dnz9KsxCmJckHr_gph6LloAkTJPDkadyKf9Vm33E2R1nNsrXo_AG_hMichWqXIdQCRNfJp3bS6F3VV7Q7b2nt_EdtUH-OFMkaw/s16000/17.png?w=640&ssl=1 Display Module Usage InformationYou can use a new option -q which will display module’s usage information. This should be used in conjunction with the “-M” option.
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp -q
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEL2iiRp_sGmZIQfcLVD0ZF_s6QxZNPyn9KBT6-cqeeh5xO0lghWVGfEs-4r2gwnKeMMO123MtWtoW15vW6BE7XX44TtYs5rgVnoMk4hsnxv2gWN8h9N4krue7tffr2Ra5Qb8fXvw82pv77tstT2GFS7qpAzBsvc7Qf1ntDJX4uiA6VJFtd-k6zZph_Q/s16000/18.png?w=640&ssl=1

Author: Divya Adwani is a researcher and technical writer who is very much keen to learn and enthusiastic to learn ethical hacking Contact here

The post A Detailed Guide on Medusa appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Stored XSS, SQL, IDOR and Hall Of Fames

Hello, today I am going to be writing about how I found stored XSS, reflected XSS, SQL and IDOR all within a software that was in scope…Continue reading on Medium »
Read more...

Mining Liquidity for Bug Bounty Contribution
https://hatsfinance.medium.com/mining-liquidity-for-bug-bounty-contribution-bfc6f4b22525?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hats Finance is excited to introduce Protocol Protection Mining starting in Q2 2022, allowing anyone in the ecosystem to become a…Continue reading on Medium » (https://hatsfinance.medium.com/mining-liquidity-for-bug-bounty-contribution-bfc6f4b22525?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Stored XSS, SQL, IDOR and Hall Of Fames
https://medium.com/@tobydavenn/stored-xss-sql-idor-and-hall-of-fames-938fbcf479b8?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello, today I am going to be writing about how I found stored XSS, reflected XSS, SQL and IDOR all within a software that was in scope…Continue reading on Medium » (https://medium.com/@tobydavenn/stored-xss-sql-idor-and-hall-of-fames-938fbcf479b8?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
how to control mobile through kali

As the title says how to control someone mobile without installing the oblivious app and giving permission like blind is there any way to do it without other getting know?

submitted by /u/ujjwalus7
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Find someone from California.

How can I find someone from California by an approximation of the birthday date and last name? I'm tring to find a friend I had but lost contact with, I know this isn't exactly hacking but I need help and didn't knew where to ask. Is there any official site that shows that information or something else I can use?

submitted by /u/Psycho0075
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Want to create a group on telegram

Anyone interested?

submitted by /u/JazzyLandlord
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Find out the Admin Password?

Hi,

i have my work laptop and want to play some games on it while its easter.

I downloaded some games but if i try to run them, it always ask for the admin password of my company i guess.

How can i find it? Or change it? Will it be changed for the whole company and they will notice?

​

Man i just want to play some CSS, wtf

submitted by /u/kokoloreszi
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What is the number one reason hackers get caught ?

and how often do hackers get caught

submitted by /u/SeaClassic03
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Shhhloader - SysWhispers Shellcode Loader
http://www.kitploit.com/2022/04/shhhloader-syswhispers-shellcode-loader.html

___________________________
@hacking_Attack
@Hacking_Video

Shhhloader is a SysWhispers (https://www.kitploit.com/search/label/SysWhispers) Shellcode Loader that is currently a Work in Progress. It takes raw shellcode as input and compiles a C++ stub that has been integrated with SysWhispers in order to bypass AV/EDR. The included python builder will work on any Linux system that has Mingw-w64 installed. The tool has been confirmed to successfully load Meterpreter (https://www.kitploit.com/search/label/Meterpreter) and a Cobalt Strike (https://www.kitploit.com/search/label/Cobalt%20Strike) beacon on fully updated systems with Windows Defender (https://www.kitploit.com/search/label/Windows%20Defender) enabled. The project itself is still in a PoC/WIP state, as it currently doesn't work with all payloads.
2/9/22 EDIT: Shhhloader now includes 5 different ways to execute your shellcode! See below for updated usage. Big thanks to @Snovvcrash (https://github.com/snovvcrash) and their DInjector (https://github.com/snovvcrash/DInjector) project for inspiration! I highly recommend taking a look at it for more information regarding the shellcode injection techniques and code that this tool is now based on. ┳┻|
┻┳|
┳┻|
┻┳|
┳┻| _
┻┳| •.•) - Shhhhh, AV might hear us!
┳┻|⊂ﾉ
┻┳|
usage: Shhhloader.py [-h] [-p explorer.exe] [-m QueueUserAPC] [-nr] [-v] [-d] [-o a.exe] file

ICYGUIDER'S CUSTOM SYSWHISPERS SHELLCODE LOADER

positional arguments:
file File containing raw shellcode

optional arguments:
-h, --help show this help message and exit
-p explorer.exe, --process explorer.exe
Process to inject into (Default: explorer.exe)
-m QueueUserAPC, --method QueueUserAPC
Method for shellcode execution (Options: ProcessHollow, QueueUserAPC,
RemoteThreadContext, RemoteThreadSuspended, CurrentThread) (Default: QueueUserAPC)
-nr , --no-randomize Disable syscall name randomization
-v, --verbose Enable debugging messages upon execution
-d, --dll-sandbox Use DLL based sandbox checks instead of the standard ones
-o a.exe, --outfile a.exe
Name of compiled file
Video Demo: https://www.youtube.com/watch?v=-KLGV_aGYbw Features: 5 Different Shellcode Execution Methods (ProcessHollow, QueueUserAPC, RemoteThreadContext, RemoteThreadSuspended, CurrentThread) PPID Spoofing Block 3rd Party DLLs Syscall Name Randomization XOR Encryption (https://www.kitploit.com/search/label/Encryption) with Dynamic Key Generation Sandbox Evasion via Loaded DLL Enumeration Sandbox Evasion via Checking Processors, Memory, and Time Tested and Confirmed Working on: Windows 10 21H1 (10.0.19043) Windows 10 20H2 (10.0.19042) Windows Server 2019 (10.0.17763) Scan Results as of 2/9/22 (x64 Meterpreter QueueUserAPC): https://antiscan.me/scan/new/result?id=tntuLnCkTCwz

___________________________
@hacking_Attack
@Hacking_Video

Greetz & Credit: Jthuraisamy for his amazing project SysWhispers: https://github.com/jthuraisamy/SysWhispers OutFlank for creating InlineWhispers (Mingw-w64 Compatible SysWhispers): https://github.com/outflanknl/InlineWhispers FalconForceTeam for their syscall generation tool that supports SysWhispers2: https://github.com/FalconForceTeam/SysWhispers2BOF Snovvcrash for their NimHollow project, which I used as a template for process hollowing: https://github.com/snovvcrash/NimHollow Snovvcrash again for their DInjector project, which I used as a template for many of the included injection techniques: https://github.com/snovvcrash/DInjector Cerbersec for their Ares project, whose code I used for PPID Spoofing, Blocking 3rd Party DLLs and Sandbox Evasion: https://github.com/Cerbersec/Ares

Download Shhhloader (https://github.com/icyguider/Shhhloader)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Lazarus Targets Chemical Sector With 'Dream Jobs,' Then Trojans

Chemical companies are the latest to be targeted by the well-known North Korean group, which has targeted financial firms, security researchers, and technology companies in the past.

Dark Reading: Attacks/Breaches
Cloud Cost, Reliability Raise IT Concerns

IT professionals worry most about cloud security, but other questions arise about training, functionality, and performance.

Hacking on Medium
#PwnItFridays hackthebox #StartingPoint Appointment

https://cdn-images-1.medium.com/max/1200/1*rVBAZsCYXDfUkYtSwKKqog.png
Another day, another challenge.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video