KitPloit - PenTest Tools!
Ransomware-Simulator - Ransomware Simulator Written In Golang

https://blogger.googleusercontent.com/img/a/AVvXsEgjAP0ObAUMq5lPna7dnteYffhlm1j2RJ4vi5wPK1iHnhiJCDAznktH0zK-opGAGn2D-hI53o5JtzGBAg_Ekpf5dOQ7P0t7NrUrtjzBi7uwtbBvHQlwTrc4ZmxchU7SgxpHWmA-OsdPv5sBuCP35jEeCGq7Z9TL3KA1Qql-sngplUviMRQaUsLukaBA=w640-h268
The goal of this repository is to provide a simple, harmless way to check your AV's protection on ransomware.

This tool simulates typical ransomware behaviour, such as:

* Staging from a Word document macro
* Deleting Volume Shadow Copies
* Encrypting documents (embedded and dropped by the simulator into a new folder)
* Dropping a ransomware note to the user's desktop

The ransomware simulator takes no action that actually encrypts pre-existing files on the device, or deletes Volume Shadow Copies. However, any AV products looking for such behaviour should still hopefully trigger.

Each step, as listed above, can also be disabled via a command line flag. This allows you to check responses to later steps as well, even if an AV already detects earlier steps.
Usage

Run command:
Run Ransomware Simulator

Usage:
ransomware-simulator run [flags]

Flags:
--dir string Directory where files that will be encrypted should be staged (default "./encrypted-files")
--disable-file-encryption Don't simulate document encryption
--disable-macro-simulation Don't simulate start from a macro by building the following process chain: winword.exe -> cmd.exe -> ransomware-simulator.exe
--disable-note-drop Don't drop pseudo ransomware note
--disable-shadow-copy-deletion Don't simulate volume shadow copy deletion
-h, --help help for run
--note-location string Ransomware note location (default "C:\\Users\\neo\\Desktop\\ransomware-simulator-note.txt")
Download Ransomware-Simulator

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
EvilSelenium : A Tool That Weaponizes Selenium To Attack Chromium Based Browsers

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Wholeaked : A File-Sharing Tool That Allows You To Find The Responsible Person In Case Of A Leakage

Wholeaked is a file-sharing tool that allows you to find the responsible person in case of a leakage. It’s written in Go. How?wholeaked gets the file that will be shared and a list of recipients. It creates a unique signature for each recipient and adds it to the file secretly. After then, it can automatically send files to the corresponding recipients by using Sendgrid, AWS SES or SMTP integrations. Instead of sending them by e-mail, you can also share them manually.

wholeaked works with every file type. However, it has additional features for common file types such as PDF, DOCX, MOV etc. Sharing Process+———–++———–+ / |Top Secret |
|Top Secret ||Recipient | / |.pdf |
|.pdf ||List | +———+ / | |
| || | |utkusen/ | / b@gov | |
| ||a@gov |—–>|wholeaked| /———-+ |
| ||b@gov | | | \ |Hidden |
| ||c@gov | +———+ \ |signature2 |
| || | \ +———–+
+———–++———–+ \ +———–+
\ |Top Secret |
\ |.pdf |
c@gov \ | |
\ | |
\ | |
\ |Hidden |
-|signature3 |
+———–+ Validation PartTo find who leaked the document, you just need to provide the leaked file to wholeaked, and it will reveal the responsible person by comparing the signatures in the database.

+———–+ +———+
|Top Secret | |Signature|
|.pdf | +———+|Database |
| | |utkusen/ || | Document leaked by
| |->|wholeaked|| |——–+
| | | || | b@gov
|Hidden | +———+| |
|Signature2 | | |
+———–+ +———+ File Types and Detection Modeswholeaked can add the unique signature to different sections of a file. Available detection modes are given below:

File Hash: SHA256 hash of the file. All file types are supported.

Binary: The signature is directly added to the binary. Almost all file types are supported.

Metadata: The signature is added to a metadata section of a file. Supported file types: PDF, DOCX, XLSX, PPTX, MOV, JPG, PNG, GIF, EPS, AI, PSD

Watermark: An invisible signature is inserted into the text. Only PDF files are supported. InstallationFrom BinaryYou can download the pre-built binaries from the releases page and run. For example: unzip wholeaked_0.1.0_macOS_amd64.zip./wholeaked --helpFrom Source* Install Go on your system
* Run: go install github.com/utkusen/wholeaked@latestInstalling Dependencieswholeaked requires exiftoolfor adding signatures to metadata section of files. If you don’t want to use this feature, you don’t need to install it.

1. Debian-based Linux: Run apt install exiftool2. macOS: Run brew install exiftool3. Windows: Download exiftool from here https://exiftool.org/ and put the exiftool.exein the same directory with wholeaked.

wholeaked requires pdftotextfor verifying watermarks inside PDF files. If you don’t want to use this feature, you don’t need to install it.

1. Download “Xpdf command line tools” for Linux, macOS or Windows from here: https://www.xpdfreader.com/download.html
2. Extract the archive and navigate to bin64folder.
3. Copy the pdftotext(or pdftotext.exe) executable to the same folder with wholeaked
4. For Debian Based Linux: Run apt install libfontconfigcommand. UsageBasic Usagewholeaked requires a project name -n, the path of the base file which the signatures will add -fand a list of target recipients -tExample command: ./wholeaked -n test_project -f secret.pdf -t targets.txtThe targets.txtfile should contain name and the e-mail address in the following format:

Utku Sen,utku@utkusen.com
Bill Gates,bill@microsoft.com

After execution is completed, the following unique files will be generated:

test_project/files/Utku_Sen/secret.pdf
test_project/files/Bill_Gates/secret.pdf

By default, whol[...]

___________________________
@hacking_Attack
@Hacking_Video

eaked adds signatures to all available places that are defined in the “File Types and Detection Modes” section. If you don’t want to use a method, you can define it with a falseflag. For example: ./wholeaked -n test_project -f secret.pdf -t targets.txt -binary=false -metadata=false -watermark=falseSending E-mailsIn order to send e-mails, you need to fill some sections in the CONFIGfile.

* If you want to send e-mails via Sendgrid, type your API key to the SENDGRID_API_KEYsection.
* If you want to send e-mails via AWS SES integration, you need to install awsclion your machine and add the required AWS key to it. wholeaked will read the key by itself. But you need to fill the AWS_REGIONsection in the config file.
* If you want to send e-mails via a SMTP server, fill the SMTP_SERVER, SMTP_PORT, SMTP_USERNAME, SMTP_PASSWORDsections.

The other necessary fields to fill:

* EMAIL_TEMPLATE_PATHPath of the e-mail’s body. You can specify use HTML or text format.
* EMAIL_CONTENT_TYPECan be htmlor text* EMAIL_SUBJECTSubject of the e-mail
* FROM_NAMEFrom name of the e-mail
* FROM_EMAILFrom e-mail of the e-mail

To specify the sending method, you can use -sendgrid, -sesor -smtpflags. For example: ./wholeaked -n test_project -f secret.pdf -t targets.txt -sendgridValidating a Leaked FileYou can use the -validateflag to reveal the owner of a leaked file. wholeaked will compare the signatures detected in the file and the database located in the project folder. Example: ./wholeaked -n test_project -f secret.pdf -validateImportant: You shouldn’t delete the project_folder/db.csvfile if you want to use the file validation feature. If that file is deleted, wholeaked won’t be able to compare the signatures. Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to spoof my IP address?

During the summer I go to India even (though I hate India) because that's where I'm from and that's also where my grandparents live, anyway, when I go there I can't log into my Instagram account (I think social media, not forums like how reddit is sometimes, are dumb but I still want to check it from time to time). How do I spoof my IP address to match my regular one? I'm on Windows currently but I can do it on GNU/Linux too.

submitted by /u/ORCABOT-3
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Nmap scan my local network from the internet

How can I scan my local network from the internet, I want to make sure if my ports are just open locally or accessible from the internet.

submitted by /u/hazemslife
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Junior Penetration Tester Salary
https://www.reddit.com/r/Pentesting/comments/uyzquf/junior_penetration_tester_salary/

How much would you ask for your salary as a junior penetration tester? Knowing that you’ve been in this field for maybe 9 months with just one cert not really famous. And you’re in a third world country. No kidding, I just guess I asked for such a low salary cause I thought that gaining experience is better than a higher salary submitted by /u/ushioyuuki (https://www.reddit.com/user/ushioyuuki)
[link] (https://www.reddit.com/r/Pentesting/comments/uyzquf/junior_penetration_tester_salary/) [comments] (https://www.reddit.com/r/Pentesting/comments/uyzquf/junior_penetration_tester_salary/)

___________________________
@hacking_Attack
@Hacking_Video

I discovered a DoS vulnerability affecting thousands of video surveillance web servers all around the world.
https://www.reddit.com/r/redteamsec/comments/uz2bo7/i_discovered_a_dos_vulnerability_affecting/

Please share. link to article here (https://www.theoreticalstructures.io/2022/05/27/the-unbearable-lightness-of-web-vulnerabilities/) submitted by /u/0111001101110010 (https://www.reddit.com/user/0111001101110010)
[link] (https://www.reddit.com/r/redteamsec/comments/uz2bo7/i_discovered_a_dos_vulnerability_affecting/) [comments] (https://www.reddit.com/r/redteamsec/comments/uz2bo7/i_discovered_a_dos_vulnerability_affecting/)

___________________________
@hacking_Attack
@Hacking_Video

How I made it into the United Nations hall of fame as I slept
https://vikaran101.medium.com/how-i-made-it-into-the-united-nations-hall-of-fame-as-i-slept-f567c90be227?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

This article is going to be about how I got my name in the United Nations hall of fame for finding a reflected XSS bug as I slept.Continue reading on Medium » (https://vikaran101.medium.com/how-i-made-it-into-the-united-nations-hall-of-fame-as-i-slept-f567c90be227?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Android apps with millions of downloads exposed to high-severity vulnerabilities
https://www.reddit.com/r/redteamsec/comments/uz2uei/android_apps_with_millions_of_downloads_exposed/

submitted by /u/SCI_Rusher (https://www.reddit.com/user/SCI_Rusher)
[link] (https://aka.ms/AndroidVulnerability) [comments] (https://www.reddit.com/r/redteamsec/comments/uz2uei/android_apps_with_millions_of_downloads_exposed/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Physical Security Teams' Impact Is Far-Reaching

Here's how physical security teams can integrate with the business to identify better solutions to security problems.

Dark Reading: Attacks/Breaches
New Chaos Malware Variant Ditches Wiper for Encryption

The Chaos ransomware-builder was known for creating destructor malware that overwrote files and made them unrecoverable -- but the new Yashma version finally generates binaries that can encrypt files of all sizes.

Dark Reading: Attacks/Breaches
ChromeLoader Malware Hijacks Browsers With ISO Files

The malware’s abuse of PowerShell makes it more dangerous, allowing for more advanced attacks such as ransomware, fileless malware, and malicious code memory injections.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Scammer Behind $568M International Cybercrime Syndicate Gets 4 Years

The 14th defendant behind The Infraud Organization contraband marketplace has been sentenced, this time for one count of racketeering.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Scanning using Nmap

I like nmap. Please don’t call it a port scanner. It’s more than this.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video