hacking: security in practice
Securely erase iPhone data?

I've learned that data is not permanently deleted until it has been overwritten which iPhone's reset function doesn't do. Any software recommendations to overwrite/erase iPhone data?

submitted by /u/Wild-Treat-1562
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Does anyone know how to export audio assets from Unreal Engine 4?

Basically the title says it, I need to pull audio assets from poppy playtime and I can’t seem to find a way export the assets without getting a error. I’m asking here because there is not way that I have found to decompile the .pak and pull audio out. Anyone have any pointers.

submitted by /u/JunkBoi76
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
DuplicateDump - Dumping LSASS With A Duplicated Handle From Custom LSA Plugin

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEie3nSfB41hs0CJGekmcb_wnpRoyhp1ZHAOGgCMkl7f44Gg9JllQnzCCHRC2bn6N2ndJ0eAdm47ant28xRy3nL-RHvo7XYGz9XPEtcQq4HdfXdHEfzl_cSvmOoXcNhBbQ-Q28we1wxk3sgaCV3rXZyXUKG4RHTaMZbDrvGqbXJ3L1SWmCqQvdzVK56I/w640-h314/LSAPlugin.png
DuplicateDump is a fork of MirrorDump with following modifications:

* DInovke implementation
* LSA plugin DLL written in C++ which could be clean up after dumping LSASS. MirrorDump compile LSA plugin as .NET assembly which would not be unloaded by LSASS process. That's why MirrorDump failed to delete the plugin.
* PID of dump process (i.e., DuplicateDump) is shared to LSA plugin through named pipe
* Passing value "0" instead of LSASS PID to MiniDumpWriteDump. This prevent MiniDumpWriteDump from opening its own handle to LSASS

DuplicateDump add custom LSA plugin that duplicate LSASS process handle from the LSASS process to DuplicateDump. So DuplicateDump has a ready to use process handle to LSASS without invoking OpenProcess.
Testing

By loading DuplicateDump in memory, it was able to dump LSASS memory without detection on

* Symantec 14.3
* Kaspersky Enterprise
* Windows Defender

Detected by Cortex XDR, Crowdstrike. Failed to dump lsass without detection on SentinalOne.

Usage

Compile LSA plugin (export either SpLsaModeInitialize or dllMain function) and provide the full path of DLL to DuplicateDump

.\DuplicateDump.exe --help
-f, --filename=VALUE The path to write the dump file to
-p, --plugin=VALUE Full file path to LSA plugin
-c, --compress GZip and delete the dump file on disk
-d, --DebugPriv Obtain SeDebugPrivilege
-h, --help Display this help

Example

.\DuplicateDump.exe -f test -c -p C:\LSAPlugin.dll [+] Loading LSA security package [+] Named pipe connected and replying with current PID 6492 [+] Found duplicated LSASS process handle 0x3d0 [+] Compressed dump file saved to test.gz

Improvement

*
DuplicateDump use DInvoke to call API AddSecurityPackage to load a LSA plugin. You could use RPC call without having to invoke that API call directly. Check details in XPN's blog post

*
Recently, splinter_code discovered that SecLogon could be leveraged to dump LSASS. Strongly recommend you to study his blog post.
References

* https://github.com/CCob/MirrorDump
* https://rastamouse.me/dumping-lsass-with-duplicated-handles/
* https://github.com/jfmaes/SharpHandler
Download DuplicateDump
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

DuplicateDump - Dumping LSASS With A Duplicated Handle From Custom LSA Plugin
http://www.kitploit.com/2022/05/duplicatedump-dumping-lsass-with.html

___________________________
@hacking_Attack
@Hacking_Video

DuplicateDump is a fork of MirrorDump (https://github.com/CCob/MirrorDump) with following modifications: DInovke implementation LSA plugin (https://www.kitploit.com/search/label/Plugin) DLL written in C++ which could be clean up after dumping LSASS. MirrorDump compile LSA plugin as .NET assembly (https://www.kitploit.com/search/label/Assembly) which would not be unloaded by LSASS process. That's why MirrorDump failed to delete the plugin. PID of dump process (i.e., DuplicateDump) is shared to LSA plugin through named pipe Passing value "0" instead of LSASS PID to MiniDumpWriteDump. This prevent MiniDumpWriteDump from opening its own handle to LSASS DuplicateDump add custom LSA plugin that duplicate LSASS process handle from the LSASS process to DuplicateDump. So DuplicateDump has a ready to use process handle to LSASS without invoking OpenProcess.
Testing By loading DuplicateDump in memory, it was able to dump LSASS memory (https://www.kitploit.com/search/label/Memory) without detection on Symantec 14.3 Kaspersky Enterprise Windows Defender Detected by Cortex (https://www.kitploit.com/search/label/Cortex) XDR, Crowdstrike. Failed to dump lsass without detection on SentinalOne. Usage Compile LSA plugin (export either SpLsaModeInitialize or dllMain function) and provide the full path of DLL to DuplicateDump .\DuplicateDump.exe --help
-f, --filename=VALUE The path to write the dump file to
-p, --plugin=VALUE Full file path to LSA plugin
-c, --compress GZip and delete the dump file on disk
-d, --DebugPriv Obtain SeDebugPrivilege
-h, --help Display this help Example .\DuplicateDump.exe -f test -c -p C:\LSAPlugin.dll [+] Loading LSA security package [+] Named pipe connected and replying with current PID 6492 [+] Found duplicated LSASS process handle 0x3d0 [+] Compressed dump file saved to test.gz Improvement DuplicateDump use DInvoke to call API AddSecurityPackage to load a LSA plugin. You could use RPC call without having to invoke that API call directly. Check details in XPN's blog post (https://blog.xpnsec.com/exploring-mimikatz-part-2/) Recently, splinter_code discovered that SecLogon could be leveraged to dump LSASS. Strongly recommend you to study his blog post (https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-2.html). References https://github.com/CCob/MirrorDump https://rastamouse.me/dumping-lsass-with-duplicated-handles/ https://github.com/jfmaes/SharpHandler

Download DuplicateDump (https://github.com/Hagrid29/DuplicateDump)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
PlainID Debuts Authorization-as-a-Service Platform

Platform powered by policy-based access control (PBAC).

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
España: destituyen a jefa de inteligencia por espionaje a políticos.

https://cdn-images-1.medium.com/max/940/0*RoqQFwHep5Y34pf_.jpg
PUBLICADO EN 11 MAYO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Tryhackme: Road

https://cdn-images-1.medium.com/max/600/1*1sBeWMcgHiWG355y45hfcg.png
Road is a tryhackme machine with a medium rating that was inspired by a real-world pentest.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Nuevas muestras de REvil indican que la banda de ransomware está de vuelta después de meses de…

https://cdn-images-1.medium.com/max/1509/0*LtGDfDoieWFAUyEW
PUBLICADO EN 10 MAYO, 2022 POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
My Uber driver asked if his IPhone can be hacked ?!

Coming soon….

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can a script be created to change attributes in windows registry editor to create a stealthy vm

I want to know if I can create a script that will automate the process of changing the information in the registry editor, to hide my vm. I want to disguise the fact that it's a vm. Usually I have to do it manually through the registry editor but if I can create a script - that would be great.

Edited.

submitted by /u/Repulsive_Problem272
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Anyone use tplmap?

I just discovered the world of SSTI, I managed to perform a manual exploitation (took me forever) but want to use a tool called tplmap to save time in the future.

Sadly I am getting an error that reads:

Exiting: module ‘collections’ has no attribute ‘Mapping’

My command is formatted:

Python3 tplmap.py -u http://site:port/InjectionPoint

Am I doing something wrong? If not on my end, is there an alternative automated tool for SSTI?

Sorry if this is a dumb question, or if I’m in the wrong place. Any help would be greatly appreciated!

submitted by /u/S_y_s_t_e_m_F_a_i_l
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Tell some discord channel
https://www.reddit.com/r/Pentesting/comments/unv5ko/tell_some_discord_channel/

submitted by /u/tmedichi1 (https://www.reddit.com/user/tmedichi1)
[link] (https://www.reddit.com/r/Pentesting/comments/unv5ko/tell_some_discord_channel/) [comments] (https://www.reddit.com/r/Pentesting/comments/unv5ko/tell_some_discord_channel/)

___________________________
@hacking_Attack
@Hacking_Video

Grpc ios traffic help
https://www.reddit.com/r/Pentesting/comments/unvud3/grpc_ios_traffic_help/

Hello guyz I am testing a IOS application with is using grpc protocol and I am not able to intercept the request is burpsuite , fiddler , wireshark . Do you guys have any idea how do I intercept the request of the App submitted by /u/legend13377 (https://www.reddit.com/user/legend13377)
[link] (https://www.reddit.com/r/Pentesting/comments/unvud3/grpc_ios_traffic_help/) [comments] (https://www.reddit.com/r/Pentesting/comments/unvud3/grpc_ios_traffic_help/)

___________________________
@hacking_Attack
@Hacking_Video