Hacking on Medium
The Fight Against The Attackers Continues

https://cdn-images-1.medium.com/max/2048/1*FGMSZJZ6yJNPGC-foJf7UQ.jpeg
For those who haven’t read it before, I suggest you take a look at my part 1 article.

Continue reading on Medium »

hacking: security in practice
EnemyBot malware adds exploits for critical VMware, F5 BIG-IP flaws expanding its reach by quickly adding exploits for recently disclosed critical vulnerabilities in web servers, content management systems, IoT, and Android devices.

https://external-preview.redd.it/gMcDeTAA7bdvruOFMuLW4Y8bxrGp-YeX8YW_jRv1c2s.jpg?width=640&crop=smart&auto=webp&s=6eb2465598d52f6a9b73d28a50b18906b6587b77 submitted by /u/Late_Ice_9288
[link] [comments]

hacking: security in practice
My card was stolen and used to purchase a Netflix subscription, how can u track their IP/location?

My car was broken into and countless things were stolen, my cards, shoes I only wore one time, a vintage pair of Versace sunglasses given to me by my grandmother, and other important items like my favorite concert hoodie and sweatpants, which hold no resale value whatsoever. Also, they took a photo of me and my friend and crumpled it up for no reason, and threw my neck pillow in a puddle of water. They already robbed me and then they have to act even more evil! The thieves are clearly poor seeing as they bought a Netflix subscription, things from CVS, Walmart, filled up their gas tank, and attempted to buy a $1000 bedroom set. At this point stop being so damn broke and lazy and get a job!!! I have a feeling they will keep all my items for personal use and hope to find them since the cops have already been notified, is there a way to track the IP of the Netflix account that was purchased with my credit card?

submitted by /u/pinksupremes
[link] [comments]

Introducing Melos Bug Bounty Program
https://medium.com/@mycoinisbitcoin/introducing-melos-bug-bounty-program-101846336465?source=rss------bug_bounty-5

We’re happy to see how quickly Melos Studio has grown so far, but with that comes some concerns. We have seen many recent crises and fraud…Continue reading on Medium » (https://medium.com/@mycoinisbitcoin/introducing-melos-bug-bounty-program-101846336465?source=rss------bug_bounty-5)

Black Hat Ethical Hacking
New Windows Subsystem for Linux malware steals browser auth cookies

New Windows Subsystem for Linux malware steals browser auth cookiesPost Views: 2
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
Hackers are showing an increased interest in the Windows Subsystem for Linux (WSL) as an attack surface as they build new malware, the more advanced samples being suitable for espionage and downloading additional malicious modules.
As the name of the feature implies, WSL allows running native Linux binaries to run on Windows in an environment that emulates the Linux kernel.

WSL-based malware samples discovered recently rely on open-source code that routes communication through the Telegram messaging service and gives the threat actor remote access to the compromised system. RATs and shellsMalicious Linux binaries for WSL were first discovered over a year ago, with researchers at Lumen Technologies’ Black Lotus Labs publishing a report on this new type of threat in September 2021.

Since then, their number has grown constantly, with all variants enjoying low detection rates, despite being based on publicly available code.

Black Lotus Labs researchers told BleepingComputer this week that they have tracked more than 100 samples of WSL-based malware since last fall.

Some are more advanced than others, the researchers said, adding that threat actors “show continued interest” in the malware they are tracking.

Of the samples analyzed, two of them are more notable due to their capabilities to function as a remote access tool (RAT) or to establish a reverse shell on the infected host.
See Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png The two samples were discovered after the Black Lotus Labs report in March that warned about WSL becoming a favored attack surface for adversaries of various technical skills levels.

One of the more recent samples relied on a Python-based open-source tool called RAT-via-Telegram Bot that allows control over Telegram and comes with functions for stealing authentication cookies from Google Chrome and Opera web browsers, running commands, or downloading files.

Black Lotus Labs researchers told BleepingComputer that the malware came with a live bot token and chat ID, indicating an active command and control mechanism.
https://www.bleepstatic.com/images/news/u/1100723/2022/WSL_new_sample.png
<figcaptionsource: Lumen Technologies Black Lotus Labs
Additional functions in this variant include taking screenshots and grabbing user and system information (username, IP address, OS version), which helps the attacker determine what malware or utilities they can use in the next phase of the compromise.

When Black Lotus Labs analyzed the sample, only two antivirus engines out of 57 on Virus Total flagged it as malicious, the researchers noted.

A second recently discovered WSL-based malware sample was built to set up a reverse TCP shell on the infected machine to communicate with the attacker.

Looking at the code, the researchers noticed that it used an IP address from Amazon Web Services that had been used previously by several entities.

One particularity that the researchers observed with this sample was that it displayed a pop-up message in Turkish, which translated to: “you’re screwed and there’s not much you can do.”

However, neither the pop-up message, which could indicate Turkish-speaking targets nor the code provided a clue about the author of the malware.

Both malware pieces could be used for espionage purposes and can downloa[...]

d files that would extend their functionality, the researchers said.
See Also: Malicious PyPI package opens backdoors on Windows, Linux, and Macs WSL-based malware taking offBlack Lotus Labs warned in the past that threat actors are exploring the WSL vector deeper, even if many of the samples analyzed “did not yet appear to be fully functional due to the use of internal or non-routable IPs.”

Nevertheless, malware authors are making progress and have already created variants that work on both Windows and Linux and can upload and download files, or execute attacker commands.

Unlike previous WSL-based malware, the latest samples that Black Lotus Labs analyzed “would prove effective with an active C2 [command and control] infrastructure in place given the low detection rates of AV providers.” See Also: Offensive Security Tool: Arjun Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
The general recommendation for defending against WSL-based threats is to keep a close eye on the system activity (e.g. SysMon) to determine suspicious activity and investigate commands.
See Also: The Difference between Vulnerability Assessment and Pentesting
Source: www.bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/shutterstock_176459972-90x90.jpg LinkedIn bug bounty program goes public with rewards of up to $18k3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/vmware-cloudnerve-90x90.jpg New ‘Cheers’ Linux ransomware targets VMware ESXi servers4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/mozilla-releases-fixes-for-firefox-thunderbird-vulnerabilities-exploited-during-pwn2own-vancouver-2022-hacking-contest-90x90.jpg Mozilla fixes Firefox, Thunderbird zero-days exploited at Pwn2Own5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/4x3_1600x1200_highres-Word_Snake_News-90x90.jpg Snake Keylogger Spreads Through Malicious PDFs6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/FTYM512XsAArcFs-90x90.jpg Malicious PyPI package opens backdoors on Windows, Linux, and Macs1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/WordPress_headpic-90x90.jpg Critical Vulnerability in Premium WordPress Themes Allows for Site Takeover1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/3e41-article-210226-vmware-body-text-90x90.jpg April VMware Bugs Abused to Deliver Mirai Malware, Exploit Log4Shell2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/iphone-low-power-hacking_068D000001681697-90x90.jpg iPhones Vulnerable to Attack Even When Turned Off2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/ezgif.com-gif-maker-90x90.jpg Apple emergency update fixes zero-day used to hack Macs, Watches2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/banner-2022.2-release-90x90.jpg Kali Linux 2022.2 released with new tools, terminal tweaks and more2 weeks ago
The post New Windows Subsystem for Linux malware steals browser auth cookies first appeared on Black Hat Ethical Hacking.

Introducing Melos Bug Bounty Program

We’re happy to see how quickly Melos Studio has grown so far, but with that comes some concerns. We have seen many recent crises and fraud…Continue reading on Medium »
Read more...

How I found my first ever XSS on a website.
https://medium.com/@shellyshubh/how-i-found-my-first-ever-xss-on-a-website-e3a0d02e7649?source=rss------bug_bounty-5

So, I have been into web hacking lately. While into it, I have explored bug bounties but never found a bug in real website. I have tested…Continue reading on Medium » (https://medium.com/@shellyshubh/how-i-found-my-first-ever-xss-on-a-website-e3a0d02e7649?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Password Cracking

https://cdn-images-1.medium.com/max/863/0*VzcjBp_R1DAGmPnj.jpg
On hearing the term “password-cracking,” many will think this post will be about how to guess someone’s password or somewhat similar, but…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hunting Usernames With Sherlock

https://cdn-images-1.medium.com/max/1280/1*C_-Xr0fZF0f0hQQS9zkTXg.png
Learn how to use sherlock, a powerful command line OSINT tool used for hunting down usernames across social networks.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
EDRSandblast : Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protection

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
365Inspect : A PowerShell Script That Automates The Security Assessment Of Microsoft Office 365 Environments

365Inspect requires the administrative PowerShell modules for Microsoft Online, Azure AD (We recommend installing the AzureADPreview module), Exchange administration, Microsoft Graph, Microsoft Intune, Microsoft Teams, and Sharepoint administration.

The 365Inspect.ps1 PowerShell script will validate the installed modules.

If you do not have these modules installed, you will be prompted to install them, and with your approval, the script will attempt installation. Otherwise, you should be able to install them with the following commands in an administrative PowerShell prompt, or by following the instructions at the references below:

Install-Module -Name MSOnline
Install-Module -Name AzureADPreview
Install-Module -Name ExchangeOnlineManagement
Install-Module -Name Microsoft.Online.SharePoint.PowerShell
Install-Module -Name Microsoft.Graph
Install-Module -Name MicrosoftTeams
Install-Module -Name Microsoft.Graph.Intune

Once the above are installed, download the 365Inspect source code folder from Github using your browser or by using git clone.

As you will run 365Inspect with administrative privileges, you should place it in a logical location and make sure the contents of the folder are readable and writable only by the administrative user. This is especially important if you intend to install 365Inspect in a location where it will be executed frequently or used as part of an automated process. UsageTo run 365Inspect, open a PowerShell console and navigate to the folder you downloaded 365Inspect into:

cd 365Inspect

You will interact with 365Inspect by executing the main script file, 365Inspect.ps1, from within the PowerShell command prompt.

All 365Inspect requires to inspect your O365 tenant is access via an O365 account with proper permissions, so most of the command line parameters relate to the organization being assessed and the method of authentication.

Execution of 365Inspect looks like this:

.\365Inspect.ps1 -OrgName -OutPath -Auth

For example, to log in by entering your credentials in a browser with MFA support:

.\365Inspect.ps1 -OrgName mycompany -OutPath ..\365_report -Auth MFA

365Inspect can be run with only specified Inspector modules, or conversely, by excluding specified modules.

For example, to log in by entering your credentials in a browser with MFA support:

.\365Inspect.ps1 -OrgName mycompany -OutPath ..\365_report -Auth MFA -SelectedInspectors inspector1, inspector2

or

.\365Inspect.ps1 -OrgName mycompany -OutPath ..\365_report -Auth MFA -ExcludedInspectors inspector1, inspector2, inspector3

To break down the parameters further:

* OrgName is the name of the core organization or “company” of your O365 instance, which will be inspected.
* If you do not know your organization name, you can navigate to the list of all Exchange domains in O365. The topmost domain should be named domain_name.onmicrosoft.com. In that example, domain_name is your organization name and should be used when executing 365Inspect.

* OutPath is the path to a folder where the report generated by 365Inspect will be placed.
* Auth is a selector that should be one of the literal values “MFA”, “CMDLINE”, or “ALREADY_AUTHED”.
* Auth controls how 365Inspect will authenticate to all of the Office 365 services.
* Auth MFA will produce a graphical popup in which you can type your credentials and even enter an MFA code for MFA-enabled accounts.
* Auth ALREADY_AUTHED instructs 365Inspect not to authenticate before scanning. This may be preferable if you are executing 365Inspect from a PowerShell prompt where you already have valid sessions for all of the described services, such as one where you have already executed 365Inspect.

* SelectedInspectors is the name or names of the inspector or inspectors you wish to run with 365Inspec[...]

___________________________
@hacking_Attack
@Hacking_Video

t. If multiple inspectors are selected they must be comma separated. Only the named inspectors will be run.
* ExcludedInspectors is the name or names of the inspector or inspectors you wish to prevent from running with 365Inspect. If multiple inspectors are selected they must be comma separated. All modules other included modules will be run.

When you execute 365Inspect with -Auth MFA, it may produce several graphical login prompts that you must sequentially log into. This is normal behavior as Exchange, SharePoint etc. have separate administration modules and each requires a different login session. If you simply log in the requested number of times, 365Inspect should begin to execute. This is the opposite of fun and we’re seeking a workaround, but needless to say we feel the results are worth the minute spent looking at MFA codes.

As 365Inspect executes, it will steadily print status updates indicating which inspection task is running.

365Inspect may take some time to execute. This time scales with the size and complexity of the environment under test. For example, some inspection tasks involve scanning the account configuration of all users. This may occur near-instantly for an organization with 50 users, or could take entire minutes (!) for an organization with 10000. Output365Inspect creates the directory specified in the out_path parameter. This directory is the result of the entire 365Inspect inspection. It contains four items of note:

* Report.html: graphical report that describes the O365 security issues identified by 365Inspect, lists O365 objects that are misconfigured, and provides remediation advice.
* Various text files named [Inspector-Name]: these are raw output from inspector modules and contain a list (one item per line) of misconfigured O365 objects that contain the described security flaw. For example, if a module Inspect-FictionalMFASettings were to detect all users who do not have MFA set up, the file “Inspect-FictionalMFASettings” in the report ZIP would contain one user per line who does not have MFA set up. This information is only dumped to a file in cases where more than 15 affected objects are discovered. If less than 15 affected objects are discovered, the objects are listed directly in the main HTML report body.
* Report.zip: zipped version of this entire directory, for convenient distribution of the results in cases where some inspector modules generated a large amount of findings.
* Log directory: 365Inspect logs any errors encountered during the scripts execution to a timestamped log file found in the Log directory Necessary Privileges365Inspect can’t run properly unless the O365 account you authenticate with has appropriate privileges. 365Inspect requires, at minimum, the following:

* Global Administrator
* SharePoint Administrator

We realize that these are extremely permissive roles, unfortunately due to the use of Microsoft Graph, we are restricted from using lesser prileges by Microsoft. Application and Cloud Application Administrator roles (used to grant delegated and application permissions) are restricted from granting permissions for Microsoft Graph or Azure AD PowerShell modules. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#application-administrator Developing Inspector Modules365Inspect is designed to be easy to expand, with the hope that it enables individuals and organizations to either utilize their own 365Inspect modules internally, or publish those modules for the O365 community.

All of 365Inspect‘s inspector modules are stored in the .\inspectors folder.

It is simple to create an inspector module. Inspectors have two files:

* ModuleName.ps1: the PowerShell source code of the inspector module. Should return a list of all O365 objects affected by a specific issue, represented as strings.
* ModuleName.json: metadata about the inspector itself. For example, the finding name, description, remediation information, and references.

The Power[...]

___________________________
@hacking_Attack
@Hacking_Video