Hacking on Medium
How To Reverse Engineer Executable Files

https://cdn-images-1.medium.com/max/926/1*T9nHrQOGXSBr4-lN71qzkw.png
Hi readers! In this blog I will show you step by step on how to reverse engineer an executable file written in C. Reverse engineering can…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Unlock any blur text/picture without membership/subscription on Scribd.com |By Neuchi

hi, im Neil Harvey Miñano  5 days ago i found a vulnerability on scribd.com when i finding an dork for google sqliContinue reading on Medium »
Read more...

hacking: security in practice
Trying to recover old photos from Galaxy S5.

Not sure if this is the right place for this but if not I'm sorry.

I was going through my old phone and found the old photo vault app and I am trying to see what photos I stored in it, but I forgot my passcode. Since it's an old version of the app and an old version of Android I was hoping to find some exploit to break in, I'm currently an IT student so I don't know much, my classes have had us working with Linux Kali and other pentesting tools, any help would be appreciated. Details below.

App downloaded from Google Play store: "Private Photo Vault - Hide Private Photos & Videos" previously known as "Photo Vault". Version 2.1.2

Link to current version: https://play.google.com/store/apps/details?id=com.enchantedcloud.photovault

Old Version: https://apkfun.com/down_Private-Photo-Vault.13697036.html

Phone: Samsung Galaxy S5 SM-G900V running Android 5.0

Other info: I know the passcode to open the App but the I set up a second password on the album I have the photos in.

Note: This is my old phone and my old photos.

Edit1. I have found that there appears to be no lockout for incorrect attempts, so I have unlimited guesses, if anyone know a way to automate brute forcing the app, I believe that would work.

Edit2. I found someone who was able to break the 2019 version of the app for iOS, but I don't fully understand the method, or know if it is applicable to the android version. Link: https://forensicmike1.com/2019/06/26/ios-photo-vault-app-still-pwnable-in-2019/

submitted by /u/Senguin117
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Some guidance regarding Kali Linux, I don't think it was mentioned here.

Hello everyone,

I am a software engineer but recently got into hacking, currently enrolled on this course (let me know what you think). I am currently using Kali Linux as a virtual machine and will keep it this way for a while but I was wondering what If I want to install Kali Linux as an actual OS? I have windows 11 and a powerful gaming pc. I don't want to remove windows I like it. I heard of dua booting or something like that..it's like a way of handling two different operating systems on your computer. There is also the option of turning a Raspberry Pi into my hacking computer and install kali linux on it. How did you do it on your end? just left your current OS, whether it's OSX or Windows and went straight into kali linux? Also is a Raspberry Pi powerful enough for a hacking pc.

I honestly love this field I hope I don't get spit on by you, this will be my first interaction with your community. I hope I will stay.

currently learning about information gathering and using some tools.

Side note: The harvester is horrible, I don't get why people praise it so much, I used it and can't find anything, I even watched people on youtube use it for a tutorial and they can't find anything.

Thank you for reading.

submitted by /u/Substantial-Place526
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Unlock any blur text/picture without membership/subscription on Scribd.com |By Neuchi
https://medium.com/@neilharveycodex13/unlock-any-blur-text-picture-without-membership-subscription-on-scribd-com-by-neuchi-69237776e24?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

hi, im Neil Harvey Miñano 
5 days ago i found a vulnerability on scribd.com when i finding an dork for google sqliContinue reading on Medium » (https://medium.com/@neilharveycodex13/unlock-any-blur-text-picture-without-membership-subscription-on-scribd-com-by-neuchi-69237776e24?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Bypass the Docker Firewall by Abusing REST API
https://www.reddit.com/r/redteamsec/comments/ubfi6w/bypass_the_docker_firewall_by_abusing_rest_api/

submitted by /u/tbhaxor (https://www.reddit.com/user/tbhaxor)
[link] (https://tbhaxor.com/bypass-the-docker-firewall-by-abusing-rest-api/) [comments] (https://www.reddit.com/r/redteamsec/comments/ubfi6w/bypass_the_docker_firewall_by_abusing_rest_api/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Adrian Lamo: The Boy Inside the Man

https://cdn-images-1.medium.com/max/600/1*psgNgSIB369QxE-sZjNSzA.jpeg
He was among the first celebrity hackers, a genius to some and a traitor to others— a spy who tried to come in from the cold but found…

Continue reading on ILLUMINATION »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
EARN BIG TODAY!

HOT DEALS!!!!! WhatsApp:+1(202) 503–9187? HOT DEALS!!I

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Log4Shell vulnerability in AWS allows full host takeover

Log4Shell vulnerability in AWS allows full host takeoverPost Views: 11
Premium Content

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
Due to the severity of Log4Shell, AWS released “hot patch” services that run on servers and spot and fix unpatched Java applications and containers on the fly.
The hot patches apply to standalone servers, Kubernetes clusters, and Elastic Container Service (ECS) clusters. Aside from AWS, these patches can also be installed in other cloud environments or standalone servers. Escaping the containerResearchers at Palo Alto Networks Unit 42 discovered the vulnerability, which could be exploited to take over the server or cluster running the patch service.

According to their findings, every container in a cluster can exploit the vulnerability for container escape and privilege escalation. Aside from containers, unprivileged processes can also exploit the patch service to escalate privileges and gain root code execution.

“We discovered this vulnerability soon after the tool was released as we were curious on how it patched containers,” Yuval Avrahami, principal security researcher at Palo Alto Networks, told The Daily Swig.

“We quickly reported the issue to the AWS security team and worked closely with the AWS engineering team as they developed patches.”
See Also: Complete Offensive Security and Ethical Hacking Course
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png
The hot patch searches for ‘java’ binaries inside containers and invokes them with its own server-level privileges and without containerizing them. This means the process runs without the limitations normally applied to container processes.

A malicious container can include a java binary to trick the patch into invoking it with elevated privileges, escape the container, and take over the underlying host.

The researchers posted a proof-of-concept that exploits the vulnerability to escape container limits, gain root code execution on the underlying host, and send a reverse shell to an attacker-controlled server. Possible ramificationsAvrahami said he was concerned about two main attack scenarios. First, if a publicly exposed container is compromised via some type of network attack, the threat actor can exploit the vulnerability to take over the underlying host, all neighboring containers, and possibly the hosting Kubernetes cluster.

“Unfortunately, it’s not uncommon for one container escape to be enough to take over an entire Kubernetes cluster,” Avrahami said.

“The vulnerability drastically increases the opportunity for lateral movement from a single compromised container to dozens and possibly hundreds.”

A second possible threat is an attacker infiltrating a container image registry to stage a supply-chain attack.

“The attacker injects the exploit to a container image, facilitating the compromise of any environment that runs the image and has the hot patch installed,” Avrahami said.

AWS has fixed the hot patch and released new versions.

“Organizations running container environments need to act as quickly as possible to confirm whether they’re using this tool and quickly patch if they are,” Avrahami said.
See Also: Cisco vulnerability lets hackers craft their own login credentials The challenges of container securityHot patches are makeshift solutions that are meant as short-term fixes until a permanent patch is installed.

Given the urgency surrounding Log4Shell, many users may have install[...]

___________________________
@hacking_Attack
@Hacking_Video

ed the hot patch at scale, putting container environments at risk, Avrahami warns. Even after patching their Java applications, they may have kept the hot patch running for added safety.

“Container isolation is difficult, and there are always risks involved when developing solutions that interact with containers,” Avrahami said.

“This also is a strong reminder that cloud security demands multiple layers of protections and that organizations should invest in security in depth as they increasingly transfer workloads to the cloud.” See Also: Offensive Security Tool: KeeThief Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Write up: How to schedule tasks the right way in Linux, using crontab Source: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/New-Java-Framework-Vulnerability-and-Mitigations-90x90.jpg Java encryption implementation error made it trivial to forge credentials4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-3-90x90.jpg CISA warns of attackers now exploiting Windows Print Spooler bug5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-3-90x90.jpg Newly found zero-click iPhone exploit used in NSO spyware attacks6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/2b93-article-220121-cisco-90x90.jpg Cisco vulnerability lets hackers craft their own login credentials1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/windows-patch-update-90x90.jpg Microsoft Zero-Days, Wormable Bugs Spark Concern1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-2-90x90.jpg Git security vulnerabilities prompt updates2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Amazon-EC2-90x90.jpg Internal AWS credentials swiped by researcher via SQL payload2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/spring4shell-90x90.jpg Attackers are abusing Spring4Shell vulnerability to spread Mirai botnet malware2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-1-90x90.jpg Attackers Spoof WhatsApp Voice-Message Alerts to Steal Info2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/f956-article-211015-apple-body-text-90x90.jpg Apple paid out $36,000 bug bounty for HTTP request smuggling flaws2 weeks ago
The post Log4Shell vulnerability in AWS allows full host takeover first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
powershell -executionpolicy remotesigned purpose in malware

I've recently encountered a malware that executes:
powershell -executionpolicy remotesigned on a powershell file he downloads from the internet.
after reading what remotesigned is, I found out the meaning is that Downloaded scripts must be signed by a trusted publisher before they can be run.

but if the malware being downloaded probably not signed, why would the malware execute this command? (does the script downloaded from the internet can be signed manually by the malware creator?)

submitted by /u/HybridToxic
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Possible hacking attempts in Wp website

Hello. I don't know if there is a better sub for that but ... I have a website under Wordpress + Woocommerce in which the Limit Login Attempts Reloaded plugin is also active. In the past few days I have been warned of several connexion attempts followed by lockouts from a IP which I was unable to trace. What really bother me is that the two IDs used for these attempts were existing ID and one with the admin rights. How could the potential hacker have found these IDs ? How could I increase the level of protection ? Thanks for your help.

submitted by /u/Best_Witness6682
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do I use hashcat to restore a mistaken password while I know the password targeted ?

When I set the password I made a mistake , How do I use hashcat with the password i wanted to use in the first place to find the one I set .

submitted by /u/bruno_thesonofmoses
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
SSTI Flask/Jinja2

Alright so I’m doing a machine on HackTheBox. I won’t mention the name so as not to spoil. I’m basically struggling a little with SSTI on Flask. I completely understand how it works and how to exploit it, but the issue is that I have to exploit it by uploading an image which is scanned by flask for text. The problem I’m getting is that I think adding quotes around the command run by subprocess.Popen() is causing the injection to not work. This is because it keeps saying something along the lines of “unexpected token at 49: “‘“” My question is: is there any way to bypass this? Maybe by using urlsafe injections or base64 or hex or something idk?

Edit 1: If any pictures of the error I’m running into need to be provided, I can provide them so just lmk.

submitted by /u/Garlic-George-420
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video