If you just have access to an AD environment but you don’t have any credentials/sessions you could: Pentest the network: Scan the network…Continue reading on Medium » (https://medium.com/@reconshell.com/ad-pentesting-notes-1f502814b3de?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
S1EM : This Project Is A SIEM With SIRP And Threat Intel, All In One

S1EM solution is based on the principle of bringing together the best products in their field, free of charge, and making them quickly interoperable.

S1EM is a SIEM with SIRP and Threat Intel, a full packet capture, all in one.

Inside the solution:

* Cluster Elasticsearch
* Kibana
* Filebeat
* Logstash
* Metricbeat
* Heartbeat
* Auditbeat
* N8n
* Spiderfoot
* Syslog-ng
* Elastalert
* TheHive
* Cortex
* MISP
* OpenCTI
* Arkime
* Suricata
* Zeek
* StoQ
* Mwdb
* Traefik
* Clamav
* Codimd
* Watchtower
* Homer

Note: Cortex v3.1 use ELK connector and the OpenCTI v4 connector

Installation Guide

Prerequisites

Solution works with Linux, docker, and docker-compose.
For auditbeat, you must have Kernel in the version 5.

On Linux, you must have in the “/etc/sysctl.conf” the line:

vm.max_map_count=262144

Physical

You must have:

* 64 Go Ram
* More than 100 Go of HDD in SSD ( Very Important for SSD )
* 8 cpu
* 1 network for management
* 1 network for monitoring

Installation

log in to your system as « root »

git clone https://github.com/V1D1AN/S1EM.git
cd S1EM

After, run the command:

bash 01_deploy.sh

On Linux, add this entry in your /etc/hosts file to access to this solution ( change s1em.cyber.local with the hostname entered during installation ).

vi /etc/hosts
XXX.XXX.XXX.XXX s1em.cyber.local

On Windows, add this entry in your hosts file to access to this solution ( change s1em.cyber.local with the hostname entered during installation ).

notepad C:\Windows\System32\drivers\etc\hosts
XXX.XXX.XXX.XXX s1em.cyber.local
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Epagneul : Graph Visualization For Windows Event Logs

Epagneul is a tool to visualize and investigate windows event logs.

Deployment

Requires docker and docker-compose to be installed.

Installing

make

Offline deployment

On a machine connected to internet, build an offline release:

make release

This will create a releasefolder containing ready to go docker images. Copy the project to your air gapped machine then run:

make load
make

This will install:

* epagneul web UI (port 8080)
* epagneul backend (port 8000)
* neo4j (port 7474)
Download

___________________________
@hacking_Attack
@Hacking_Video

O365-Doppelganger - A Quick Handy Script To Harvest Credentials Off Of A User During A Red Team And Get Execution Of A File From The User
http://www.kitploit.com/2022/04/o365-doppelganger-quick-handy-script-to.html

___________________________
@hacking_Attack
@Hacking_Video

O365-Doppelganger is NOT a replacement for hardcore phishing (https://www.kitploit.com/search/label/Phishing) activities. There are several other tools which perform OAuth and OTA capture which is not the aim of O365-Doppelganger. O365-Doppelganger is a quick handy script to harvest credentials (https://www.kitploit.com/search/label/Credentials) of a user during Red Teams. This repository is a quick hack of one of my old red team engagement (https://www.kitploit.com/search/label/Red%20Team%20Engagement) scripts which I've used several times to capture credentials and use them for making windows access tokens (https://www.kitploit.com/search/label/Access%20Tokens) for lateral movement. This code repository basically performs the below tasks:The GO code: hosts the O365 portal (can be replaced with anything in the index.html). It is recommended to use a valid cert and key file (LetsEncrypt?) instead of the one provided in the directory logs all user activity on the web portal in a seperate log file on the server logs the credentials captured in a seperate log file on the server can also be used to return a valid file to the user post capturing the credentials. This can be done by replacing the file named MacroFile.doc in the current directory (https://www.kitploit.com/search/label/Directory) and replacing it with HTA/ISO/MSI or anything else that the phisher wants. Theres also a small code in the GO code which would need to be modified to specify the user's file name which needs to be returned: content, err := ioutil.ReadFile("MacroFile.doc") Once modified, the target user when enters a valid email ID and password will be asked to save the above file. This file name can be changed using the below code in the GO file: response.Header().Set("Content-Disposition", "attachment; filename=Darkvortex Privacy Policy.doc") The index.html code: renders an O365 portal alongside a small regex which checks for a given user's domain name to make it look a bit more legit. The regex code looks like this: pattern="^([a-zA-Z0-9_\-\.]+)@darkvortex\.([a-zA-Z]{2,5})$" title=" Valid darkvortex email ID" The above regex checks if the given username contains a full valid email address else it will prompt the user to enter a correct username as follows:

___________________________
@hacking_Attack
@Hacking_Video

This same check is also performed in the GO code so that user's do not use something like burp to bypass the check: if strings.Contains(value[i], "@darkvortex") { It's recommended to change the name darkvortex in the index.html file to your own target company name. Once the correct email ID and the password is entered, the user will be asked to save the provided file as follows:

___________________________
@hacking_Attack
@Hacking_Video

Download O365-Doppelganger (https://github.com/paranoidninja/O365-Doppelganger)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
How Industry Leaders Should Approach Open Source Security

Here's how to reduce security risk and gain the benefits of open source software.

hacking: security in practice
Top 5 free cyber security certifications & badges with training

https://external-preview.redd.it/nkVDNbJgwPGqX2_BTwB_wZeSQ-Qo5-v7S7bYObUKODU.jpg?width=640&crop=smart&auto=webp&s=e40a2975562782da84d95624225317c3ee0dbc85 submitted by /u/hackersam
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Slow Loris attack against spammers coming to a public web server?

Hey folks,

I noticed a bunch of 404 hits for contact page files that don't exist on my website, like "./contact.php", "./contact-us.php", etc.

My assumption is that these are spammers, as the files don't exist, and have never existed, and so a crawler shouldn't be finding them. Instead, I feel it's more likely that it's spammers just guess and checking common paths for contact us pages to spam.

​

1) Is this assumption reasonable, or am I missing something?

2) If it is, I hypothesized that some type of slow loris attack could delay or slow and disrupt spamming efforts, in the same way that scambaiting is designed to waste the time of scammers. Hypothetically, how could this be implemented? Are there downsides and risks that should be considered?

submitted by /u/thejoshuawest
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
what to do when getting ddosed?

So a friend of mine hosts a game server. This game server is very primitive and unsecured. He did all he can to secure it, but it was on himself home network and the ip got leaked. This was due to the fact that some players, had to be banned and the began ddosing him, and his personal network. He has added a vpn to his server, but it did not stop the attacks. We did some investigation and found that these players are using a primitive form of attack. When my friend resets his router to get a new ip, he is clean for a while. The issue, is that regardless of the banned players having a ip and account ban, they have been able to switch their ip and buy a new account. We further tested this, and noticed that when the server went back up, a new player account would join then leave, then a ddos would begin. Checking server logs show that the new account and the banned player have almost identical ips and locations. We have contemplated talking to his isp, and plan on running a test with wire shark to compare the number of request of a normal player, vs the amount of requests made by the ip of the ddosers. Other than that, we are completely stumped on what to do. Any recommendations?

submitted by /u/ahradicaldude
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video