You should put scope over exploits! Or should you?

Continue reading on Medium »
Read more...

Black Hat Ethical Hacking
Write up: Find hidden and encrypted secrets from any website

Write up: Find hidden and encrypted secrets from any websitePost Views: 20
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.
Reading Time: 4 Minutes IntroductionMany companies already have a lot of security layers that can make it more difficult to bypass them. From a defensive perspective, this is great you may think.

Starting from Cloudflare WAF, then to the next-generation firewall, their combination makes it more difficult for the attacker to get into the network of a company using commercial techniques and tools.

Hacking it’s not about how much expensive is the tool or the machine, it’s about the time you spent and the experience you have with how things work.

Forex trade companies, banks, and similar companies they at risk, using many API Keys from payment solutions providers to give you more solutions for payment transition, keys may leak from any organization in numerous ways.

Developers of each company add secrets into their code for many reasons. The secret could be a unique identifier that authenticates requests associated with your project for usage and billing purposes.

Properly transferring secrets to a web application using a secret vault software can be complicated, and it can also make debugging difficult in later stages. In those cases, firewalls, will never stop hackers to find API keys, access tokens, authorizations, JSON Web Token, etc.

Secrets are highly valued, but can also be dangerous in the wrong hands. In most cases developers forgot even after the production stage has finished removing the label name and password, giving the ability to the attacker to know the source of the API key and easily perform a callback success. If no label exists, the attacker has challenges finding the source of that API to perform the necessary actions correctly.

That’s why offense is always the best defense, by performing penetration testing to find and fix the vulnerabilities before the bad guys do.
See Also: Write up: Hacking is an art, and so is subdomain enumeration. Prerequisites:1. SecretFinder
2. Hakrawler
3. Burp Suite
SecretFinder: is a python script based on Linkfinder, to discover sensitive data such as API keys, access tokens, and authorization JSON Web Token in JavaScript files using jsbeautifier in combination with a large list of regular expressions that are responsible to find and search anything in JavaScript files.

Hakrawler: Fast and simple web crawler to quickly discover endpoints and link gathering from JavaScript files.

Burp Suite: is a dynamic web application security tool developed by PortSwigger, used by many penetration testers and bug bounty hunters, providing you good reporting capabilities.

The Role at this example we will show, how to add the SecretFinder extension into the Burp Suite as an add-on tool, by doing that you have a better view of the scope. Manage and analyze vulnerabilities easily in one place.

Note: Make sure to setup a Jython runtime environment that allows you to enable adding the extension.

1. Visit Jython and download the latest version Jython standalone JAR file.
2. In Burp Suite, go to Extender ➡️ Options. Under the section Python Environment, click Select file. Navigate to the saved location and click on the download Jython JAR file.
See Also: Complete Offensive Security and Ethical Hacking Course Technical part:In this scenario, we will see how to use Hakrawler, which is a tool written in GO to perform fast web crawler for gathering URLs and JavaScript endpoints combined with SecretFinder to detect secrets.
Hakrawler performing web crawler for gathering UR[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Write up: Find hidden and encrypted secrets from any website

___________________________
@hacking_Attack
@Hacking_Video

What way is currently best for SE payload attacks?
https://www.reddit.com/r/redteamsec/comments/uix06u/what_way_is_currently_best_for_se_payload_attacks/

Microsoft did a huge crackdown on the "evil macros" on office docs about 9 months ago. https://www.zdnet.com/article/microsoft-...el-macros/ (https://www.zdnet.com/article/microsoft-were-cracking-down-on-malware-that-uses-excel-macros/) It now seems that ANY attempt of creating a shell object on VBS instantly gets flagged by windows defender. This used to be bypassed by using an "external" program to create such shell i.e: Outlook. So, how can I send my payload now? Sending exes in mail is frown upon by any spam agency and a plethora of alerts pop up when I do so. Sending a .bat is too sketchy as well and the .lnk trick has been also fixed. submitted by /u/ErikDz11 (https://www.reddit.com/user/ErikDz11)
[link] (https://www.reddit.com/r/redteamsec/comments/uix06u/what_way_is_currently_best_for_se_payload_attacks/) [comments] (https://www.reddit.com/r/redteamsec/comments/uix06u/what_way_is_currently_best_for_se_payload_attacks/)

___________________________
@hacking_Attack
@Hacking_Video

Graphql-Threat-Matrix - GraphQL Threat Framework Used By Security Professionals To Research Security Gaps In GraphQL Implementations
http://www.kitploit.com/2022/05/graphql-threat-matrix-graphql-threat.html

___________________________
@hacking_Attack
@Hacking_Video

Why graphql-threat-matrix? graphql-threat-matrix (https://github.com/nicholasaleks/graphql-threat-matrix) was built for bug bounty hunters, security researchers and hackers (https://www.kitploit.com/search/label/Hackers) to assist with uncovering vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) across multiple GraphQL implementations. The differences in how GraphQL implementations interpret and conform to the GraphQL specification may lead to security gaps and unique attack vectors. By analyzing and comparing the factors that drive the security risks across different implementations the GraphQL ecosystem can make safer deployment decisions as well as collectively advance the security maturity of all implementations.
Legend
✅ - Enabled by Default ⚠️ - Disabled by Default ❌ - No Support Implementation Validations Field Suggestions Query Depth limit Query Cost Analysis Automatic Persisted Queries Introspection Debug Mode Batch Requests wp-graphql (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/wp-graphql.md) 38 (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/wp-graphql.md#Request-Validations) ✅ ⚠️ ❌ ❌ ⚠️ ⚠️ ✅ graphql-php (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/graphql-php.md) 37 (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/graphql-php.md#Request-Validations) ✅ ⚠️ ⚠️ ❌ ✅ ⚠️ ⚠️ Apollo (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/apollo.md) 34 (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/apollo.md#Request-Validations) ✅ ⚠️ ⚠️ ✅ ✅ ✅ ✅ graphql-yoga (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/graphql-yoga.md) 34 (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/graphql-yoga.md#Request-Validations) ✅ ⚠️ ❌ ❌ ⚠️ ⚠️ ⚠️ graphene (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/graphene.md) 34 (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/graphene.md#Request-Validations) ✅ ❌ ❌ ❌ ✅ ❌ ⚠️ Ariadne (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/ariadne.md) 34 (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/ariadne.md#Request-Validations) ✅ ⚠️ ⚠️ ❌ ✅ ⚠️ ❌ Strawberry (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/strawberry.md) 34 (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/strawberry.md#Request-Validations) ✅ ⚠️ ❌ ❌ ✅ ❌ ❌ graphql-ruby (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/graphql-ruby.md) 28 (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/graphql-ruby.md#%23Request-Validations) ✅ ❌ ⚠️ ⚠️ ✅ ❌ ✅ Sangria (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/sangria.md) 27 (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/sangria.md#Request-Validations) ✅ ⚠️ ⚠️ ❌ ✅ ❌ ⚠️ Tartiflette (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/tartiflette.md) 26 (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/tartiflette.md#Request-Validations) ❌ ❌ ❌ ❌ ✅ ❌ ❌ graphql-java (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/graphql-java.md) 26 (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/graphql-java.md#Request-Validations) ✅ ⚠️ ⚠️ ❌ ✅ ❌ ⚠️ gqlgen (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/gqlgen.md) 25

___________________________
@hacking_Attack
@Hacking_Video

(https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/gqlgen.md#Request-Validations) ✅ ❌ ⚠️ ⚠️ ✅ ⚠️ ⚠️ Dgraph (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/dgraph.md) 25 (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/dgraph.md#Request-Validations) ✅ ❌ ❌ ⚠️ ✅ ❌ ❌ graphql-go (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/graphql-go.md) 24 (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/graphql-go.md#Request-Validations) ✅ ❌ ❌ ❌ ✅ ⚠️ ❌ juniper (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/juniper.md) 24 (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/juniper.md#Request-Validations) ❌ ❌ ❌ ❌ ✅ ❌ ⚠️ Diana.jl (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/diana.md) 10 (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/diana.md#Request-Validations) ✅ ❌ ❌ ❌ ✅ ❌ ❌ gql-dart/gql (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/gql-dart.md) 9 (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/gql-dart.md#Request-Validations) ✅ ❌ ❌ ❌ ✅ ❌ ❌ Agoo (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/agoo.md) 0 (https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/agoo.md#Request-Validations) ❌ ❌ ❌ ❌ ✅ ⚠️ ❌ Want to provide a submission (or correction)? Interested in contributing? Found a discrepancy? Please create a GitHub issue or PR with your details. Contributors & Maintainers Nick Aleks (https://github.com/nicholasaleks) Dolev Farhi (https://github.com/dolevf)

Download Graphql-Threat-Matrix (https://github.com/nicholasaleks/graphql-threat-matrix/)

___________________________
@hacking_Attack
@Hacking_Video

I have 1% chance to hack this company
https://infosecwriteups.com/i-have-1-chance-to-hack-this-company-1044879f41a9?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Today I will share with you the first vulnerability I found on SerpApi, LLC.Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/i-have-1-chance-to-hack-this-company-1044879f41a9?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

You should put scope over exploits! Or should you?
https://thexssrat.medium.com/you-should-put-scope-over-exploits-or-should-you-e7a083538e25?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Continue reading on Medium » (https://thexssrat.medium.com/you-should-put-scope-over-exploits-or-should-you-e7a083538e25?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Why Security Matters Even More in Online Gaming

As the gaming sector booms, game publishers and gaming networks have been heavily targeted with distributed denial-of-service (DDoS) attacks in the last year.

Dark Reading: Attacks/Breaches
Docker Under Siege: Cybercriminals Compromise Honeypots to Ramp Up Attacks

Cloud containers are increasingly part of the cybercrime playbook, with researchers flagging ongoing scanning for Docker weaknesses along with rapid exploitation to infect systems with coin-miners, denial-of-service tools, and ransomware.

The curious case of mavinject.exe
https://www.reddit.com/r/redteamsec/comments/uizb40/the_curious_case_of_mavinjectexe/

submitted by /u/sciencestudent99 (https://www.reddit.com/user/sciencestudent99)
[link] (https://fourcore.io/blogs/mavinject-curious-process-injection) [comments] (https://www.reddit.com/r/redteamsec/comments/uizb40/the_curious_case_of_mavinjectexe/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Who here uses Rasberry Pi as a USB Rubber Ducky

So i programmed my rasberry pi to act like a rubber ducky.

Whenever i plug it into my laptop / computer it will disable volume change until the rickroll finishes.

submitted by /u/ncplayer5
[link] [comments]

hacking: security in practice
Is there a way I can get tor bridges to work on public wifi that blocks VPNs, tor, and its bridges?

I've tried obs4 bridges, no luck

submitted by /u/theonewithgeass
[link] [comments]

hacking: security in practice
Hashcat gave me a password that doesn't work?

Cracking some old af '97 ppt files that have a PW on them. Hashcat gave me passwords, but they don't work.
$oldoffice$3*ae0092f1e451d0e3fae35f43aa65bcd7*2a2f489f9dad13b0b20fb94b1edf0848*b9a799f47c4ed7a0d80c2ddf3610a3a0be6db596:2*\9{~ $oldoffice$3*85491defe7e3dc6b98ceef5286a1e55e*cbf532f91bd6f8a7afc1e853dcae7786*a113b0d70d02b3d7b1a1a7fa09ef690ac81c2c51:t;m\PU
My Hashcat cmd:
hashcat -m 9800 -a 3 dumb.txt -i ?a?a?a?a?a?a?a?a?a?a?
According to this: https://hashcat.net/forum/thread-7643.html

I have a collision because we're only using the first 40 bytes of a salt+digest. So, my passwords, 2*\9{~ and t;m\PU should work, but they do not.

submitted by /u/TheSlenderman871
[link] [comments]