Black Hat Ethical Hacking
Offensive Security Tool: malicious-pdf

Offensive Security Tool: malicious-pdfPost Views: 9
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes

Offensive Security Tool: malicious-pdf GitHub Link Malicious PDF GeneratorSocial Engineering attacks combined with Phishing Attack simulation, when performing assessments as a Red-Team Penetration tester, requires a certain preparation beforehand. It’s about choosing the right tools and testing the attacks before launching them in real-time. You only have one or very few limited attempts before the victim would realize, something is wrong. Therefore, it’s crucial to understand how important preparation is, and the specific tool, that allows you to generate PDFs containing payloads, with some specific purpose.

Malicious-pdf by jonaslejon, allows you to generate ten different malicious pdf files with phone-home functionality. It can be used with Burp Collaborator or Interact.sh
See Also: Recon Tool: ReconFTW Usagepython3 malicious-pdf.py burp-collaborator-urlOutput will be written as: test1.pdf, test2.pdf, test3.pdf etc in the current directory.

Do not use the https:// etc prefix on the url argument. Purpose* Test web pages/services accepting PDF-files
* Test security products
* Test PDF readers
* Test PDF converters
See Also: Write up: Find hidden and encrypted secrets from any website https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/scanmycode-90x90.png Static Code Analysis Tool: scanmycode-ce7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/MOSINT-1-90x90.png OSINT Tool: MOSINT2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/findomain-90x90.png Recon Tool: Findomain2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/keethief-90x90.png Offensive Security Tool: KeeThief3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/reconftw-90x90.png Recon Tool: ReconFTW3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/smap-demo-90x90.png Recon Tool: Smap4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Proxmark3-90x90.png Offensive Security Tool: Proxmark31 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/boomerang-90x90.png Offensive Security Tool: Boomerang1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/unknown-90x90.png Recon Tool: PSRecon1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/SysWhispers3-90x90.png Offensive Security Tool: SysWhispers32 months ago
The post Offensive Security Tool: malicious-pdf first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Process_Overwriting - Yet Another Variant Of Process Hollowing
http://www.kitploit.com/2022/05/processoverwriting-yet-another-variant.html

Process Overwriting is a PE injection (https://www.kitploit.com/search/label/Injection) technique, closely related to Process Hollowing (https://github.com/hasherezade/libpeconv/tree/master/run_pe) and Module Overloading (https://github.com/hasherezade/module_overloading) Process Hollowing (aka RunPE) is an old and popular PE injection technique. It comes in has variety of flavors, but there are some steps in common: Start by creating a process in a suspended state Write our own PE module in its memory Redirect to the new module Resume the thread
Process Hollowing does not require manual loading of payload's imports. Thanks to the step 3 Windows (https://www.kitploit.com/search/label/Windows) loader treat our PE implant as the main module of the process, and will load imports automatically when its execution resumes. To make our implant recognized by Windows loader, its Module Base must be set in the PEB. It is usually done by one of the two ways: in the most classic variant, the original PE is unmapped from memory, and the new PE is mapped on its place, at the same address. in another, yet common variant, the old module is left as is, and another PE is mapped in a new memory (https://www.kitploit.com/search/label/Memory) region. Then the new module's base address is manually written into the PEB (this variant was demonstrated here (https://github.com/hasherezade/libpeconv/tree/master/run_pe)) As a result of those classic implementations we get a payload (https://www.kitploit.com/search/label/Payload) running as main module, yet it is mapped as MEM_PRIVATE (not as MEM_IMAGE like typically loaded PEs). To obtain payload mapped as MEM_IMAGE we can use some closely related techniques, such as Transacted Hollowing (https://github.com/hasherezade/transacted_hollowing) or its variant "Ghostly Hollowing" (https://github.com/hasherezade/transacted_hollowing#ghostly-hollowing). Process Overwriting is yet another take on solving this problem. In contrast to the classic Process Hollowing, we are not unmapping the original PE, but writing over it. No new memory is allocated: we are using the memory that was originally allocated for the main module of the process. Pros: the implanted PE looks like if it was loaded by Windows loader: mapped as MEM_IMAGE divided into sections with specific access (https://www.kitploit.com/search/label/Access) rights the image is named convenience of loading: no need to manually relocate the implant prior to injection: Windows loader will take care of this (in classic Process Hollowing we have to relocate the module) no need to fill imports (like in every variant of Process Hollowing) no need to allocate new memory in the process Cons: It doesn't work if the target has GFG (Control Flow Guard) (https://docs.microsoft.com/en-us/windows/win32/secbp/control-flow-guard) enabled (yet it is possible to disable it on process creation) The target's ImageSize must not be smaller than payload's ImageSize (remember we are using only the memory that was already allocated!) - this limitation does not occur in other flavors of Process Hollowing Can be detected by comparing of the module in memory with corresponding file (PE-sieve (https://github.com/hasherezade/pe-sieve/) detects it) - just like every variant of Process Hollowing Demo: The demo payload (demo.bin) injected into Windows Calc (default target):

In memory (via Process Hacker):

Clone: Use recursive clone to get the repo together with all the submodules: git clone --recursive https://github.com/hasherezade/process_overwriting.git

Download Process_Overwriting (https://github.com/hasherezade/process_overwriting)

Hacking on Medium
I’ve been hacked at work

https://cdn-images-1.medium.com/max/2600/1*TYpOYGoII4CH8co0oM7P1w.jpeg
This is the first time I’ve been hacked, well as far as I know, and at work.

Continue reading on Medium »

Hacking on Medium
What should I study to become Ethical Hacker

https://cdn-images-1.medium.com/max/1280/1*p_fus9nQt6KTZKTOaRP6fQ.jpeg
In this article, I will walk you through:

Continue reading on Medium »

Hacking on Medium
What is the definition of a social engineering attack?

https://cdn-images-1.medium.com/max/1280/1*RUfzVFArmqIXZG84rW1DcA.jpeg
Have you seen some alarming stories about a new “social engineering attack” going around but aren’t sure what it means? Then you’re in the…

Continue reading on Medium »

Hacking on Medium
How to Learn Termux? Beginner to Advanced level on Termux in one click | Termux Hacking

https://cdn-images-1.medium.com/max/640/1*ybqXeXx5fJ5mub7UK5Re3Q.jpeg
Termux

Continue reading on Medium »

Hacking on Medium
Hacking the Web With SQL Injections

https://cdn-images-1.medium.com/max/2600/0*7u_O4U-LAhWnIsvO
Focus on SQL Injections, PHP, and the Diwa Project

Continue reading on Better Programming »

From android app to access admin dashboard
https://medium.com/@odayalhalbe1/from-android-app-to-access-admin-dashboard-a8f825e8e806?source=rss------bug_bounty-5

One of easy and interesting vulnerability that I found and lead to access admin dashboard for company (internal system) :Continue reading on Medium » (https://medium.com/@odayalhalbe1/from-android-app-to-access-admin-dashboard-a8f825e8e806?source=rss------bug_bounty-5)

hacking: security in practice
Noob-Friendly CTF Team / Educational Opportunity

Good afternoon, r/hacking. I am looking to create a small group (roughly 8 more people) of hacking enthusiasts who are looking to get into the CTF space and are, in general, looking to learn more about Cybersecurity. This would basically be a CTF team, but also a group which could help those involved cultivate their skills, doing things like HTB, TryHackMe, etc. The group will, as of right now, be largely consolidated on Discord. The first target on my list is the upcoming HacktheBox Cyber Apocalypse CTF. Beyond that, I'll be keeping an eye out for other upcoming CTFs to get involved with.

I want to keep the group pretty relaxed, I know life happens, time zones are different, you have work/school/kids. For example, the HTB CTF runs from Tomorrow to this coming Thursday, but there is no need for every person to be active every single day at the same time. In my case, I sit for the Security+ next week so I won't be active on that day. If I find a CTF and send it in the Discord and a member decides to sit it out, then that's completely fine.

This group is N00b friendly, of course, but you l33t bois are more than welcome, too. All I ask is that you bring a desire to learn and have a good time in the process. I'll have to keep this limited to the first 8 people as of now, but plan to invite more people in the future (when I hopefully have this figured out.)

PM me if interested, I'll get that Discord up and running at some point today and send you a HTB Team Link, Discord Link, and my personal TryHackMe profile.

Take care.

TLDR: I'm starting a noob-friendly CTF team with a Discord chat, want to aim for 1 CTF per month. Opportunity for fun and educational experience, no stress. 8 people will be accepted, more to come in the future. PM if interested.

submitted by /u/SumComputerGuy
[link] [comments]