Download O365-Doppelganger (https://github.com/paranoidninja/O365-Doppelganger)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
How Industry Leaders Should Approach Open Source Security

Here's how to reduce security risk and gain the benefits of open source software.

hacking: security in practice
Top 5 free cyber security certifications & badges with training

https://external-preview.redd.it/nkVDNbJgwPGqX2_BTwB_wZeSQ-Qo5-v7S7bYObUKODU.jpg?width=640&crop=smart&auto=webp&s=e40a2975562782da84d95624225317c3ee0dbc85 submitted by /u/hackersam
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Slow Loris attack against spammers coming to a public web server?

Hey folks,

I noticed a bunch of 404 hits for contact page files that don't exist on my website, like "./contact.php", "./contact-us.php", etc.

My assumption is that these are spammers, as the files don't exist, and have never existed, and so a crawler shouldn't be finding them. Instead, I feel it's more likely that it's spammers just guess and checking common paths for contact us pages to spam.

​

1) Is this assumption reasonable, or am I missing something?

2) If it is, I hypothesized that some type of slow loris attack could delay or slow and disrupt spamming efforts, in the same way that scambaiting is designed to waste the time of scammers. Hypothetically, how could this be implemented? Are there downsides and risks that should be considered?

submitted by /u/thejoshuawest
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
what to do when getting ddosed?

So a friend of mine hosts a game server. This game server is very primitive and unsecured. He did all he can to secure it, but it was on himself home network and the ip got leaked. This was due to the fact that some players, had to be banned and the began ddosing him, and his personal network. He has added a vpn to his server, but it did not stop the attacks. We did some investigation and found that these players are using a primitive form of attack. When my friend resets his router to get a new ip, he is clean for a while. The issue, is that regardless of the banned players having a ip and account ban, they have been able to switch their ip and buy a new account. We further tested this, and noticed that when the server went back up, a new player account would join then leave, then a ddos would begin. Checking server logs show that the new account and the banned player have almost identical ips and locations. We have contemplated talking to his isp, and plan on running a test with wire shark to compare the number of request of a normal player, vs the amount of requests made by the ip of the ddosers. Other than that, we are completely stumped on what to do. Any recommendations?

submitted by /u/ahradicaldude
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
O que é um Ransomware?

https://cdn-images-1.medium.com/max/960/0*bSOUiZHQMxFYsMbm.jpg
O Ransomware é um tipo de malware que merece um artigo só para ele. 😲

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Tipos de Malware

https://cdn-images-1.medium.com/max/713/1*ch8qK5PONxZ4s0iL8y_a0g.png
Conforme falei no artigo O que é um malware? os três malware mais comuns são: vírus, cavalos de Tróia e worm (verme). Neste artigo cada um…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Web Pentesting Resources

[ How to Start? ] :
0. Do you Want to Know The step-by-step Path to Learn Hacking? = “ There is No step-by-step Path To Learn Hacking & it…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
BEANSTALK HACK ANALYSIS & POC

https://cdn-images-1.medium.com/max/1100/1*nSL5js-KzcB9pP6IDH3rWQ.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
2 hours of fun completing the game. 20+ hours of fun hacking the game.

https://cdn-images-1.medium.com/max/1280/0*ECFLhGc_7baTqHqi.png
A bit of curiosity can lead to a lot of learning.

Continue reading on Level Up Coding »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
O365-Doppelganger - A Quick Handy Script To Harvest Credentials Off Of A User During A Red Team And Get Execution Of A File From The User

https://blogger.googleusercontent.com/img/a/AVvXsEjnu3bza5lczEWmdNm_mbRAmPz8iZzGLMzZeSZO3SLYXCqAC4_K3KKvkNMCRRERCxacnPbhVv8qsCmNtWSmnlvW1OWWAUf2KSZqK918RFZHtHKT7tJ_TUJj37GhbBxX09oeKrilNNluGpFsKubEHr6oblJtomdMLntrZvO-FF7Lo7EojPY-diJtabJI=w640-h302 O365-Doppelganger is NOT a replacement for hardcore phishing activities. There are several other tools which perform OAuth and OTA capture which is not the aim of O365-Doppelganger.

O365-Doppelganger is a quick handy script to harvest credentials of a user during Red Teams. This repository is a quick hack of one of my old red team engagement scripts which I've used several times to capture credentials and use them for making windows access tokens for lateral movement. This code repository basically performs the below tasks:

* The GO code:
* hosts the O365 portal (can be replaced with anything in the index.html). It is recommended to use a valid cert and key file (LetsEncrypt?) instead of the one provided in the directory
* logs all user activity on the web portal in a seperate log file on the server
* logs the credentials captured in a seperate log file on the server
* can also be used to return a valid file to the user post capturing the credentials. This can be done by replacing the file named MacroFile.docin the current directory and replacing it with HTA/ISO/MSI or anything else that the phisher wants. Theres also a small code in the GO code which would need to be modified to specify the user's file name which needs to be returned: content, err := ioutil.ReadFile("MacroFile.doc")* Once modified, the target user when enters a valid email ID and password will be asked to save the above file. This file name can be changed using the below code in the GO file: response.Header().Set("Content-Disposition", "attachment; filename=Darkvortex Privacy Policy.doc")* The index.html code:
*
renders an O365 portal alongside a small regex which checks for a given user's domain name to make it look a bit more legit. The regex code looks like this: pattern="^([a-zA-Z0-9_\-\.]+)@darkvortex\.([a-zA-Z]{2,5})$" title=" Valid darkvortex email ID"*
The above regex checks if the given username contains a full valid email address else it will prompt the user to enter a correct username as follows: https://blogger.googleusercontent.com/img/a/AVvXsEjU3La_fI_Zyd3qLcBP4MIwv8any_wikGP8HS9Z__igRFv9CqQnKXjZ0QbtYu9aCmTwtZgTOwQGujGlkKOiLiwym-mVNZbuhFWAI9qD8kuer8yFR7wZCDLrulWpA09PIS7wO_0amFFsSM0qqROXWqrWC1_cmo9VJbRLNo8YOf7jv6xzqMMrAVJsMrxx=w640-h302 *
This same check is also performed in the GO code so that user's do not use something like burp to bypass the check: if strings.Contains(value[i], "@darkvortex") {*
It's recommended to change the name darkvortex in the index.html file to your own target company name.

*
Once the correct email ID and the password is entered, the user will be asked to save the provided file as follows: https://blogger.googleusercontent.com/img/a/AVvXsEjnu3bza5lczEWmdNm_mbRAmPz8iZzGLMzZeSZO3SLYXCqAC4_K3KKvkNMCRRERCxacnPbhVv8qsCmNtWSmnlvW1OWWAUf2KSZqK918RFZHtHKT7tJ_TUJj37GhbBxX09oeKrilNNluGpFsKubEHr6oblJtomdMLntrZvO-FF7Lo7EojPY-diJtabJI=w640-h302 Download O365-Doppelganger

___________________________
@hacking_Attack
@Hacking_Video

Bypassing WAF for $2222
https://divyanshsharma2401.medium.com/bypassing-waf-for-2222-f99b80cfdb9b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video