Kali Linux Tutorials
vAPI : Vulnerable Adversely Programmed Interface Which Is Self-Hostable API

vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios in the means of Exercises.

Requirements

* PHP
* MySQL
* PostMan
* MITM Proxy

Installation (Docker)

docker-compose up -d

Installation (Manual)

Copying the Code

cd Setting up the Database

Import vapi.sqlinto MySQL Database

Configure the DB Credentials in the vapi/.env

Starting MySQL service

Run following command (Linux)

service mysqld start

Starting Laravel Server

Go to vapidirectory and Run

php artisan serve

Setting Up Postman

* Import vAPI.postman_collection.jsonin Postman
* Import vAPI_ENV.postman_environment.jsonin Postman

OR

Use Public Workspace

Usage

Browse http://localhost/vapi/for Documentation

After Sending requests, refer to the Postman Tests or Environment for Generated Tokens

Deployment

Helm can be used to deploy to a Kubernetes namespace. The chart is in the vapi-chartfolder. The chart requires one secret named vapiwith the following values:

DB_PASSWORD:
DB_USERNAME:

Sample Helm Install Command: helm upgrade --install vapi ./vapi-chart --values=./vapi-chart/values.yaml

*** Important ***

The MYSQL_ROOT_PASSWORD on line 232 in the values.yamlmust match that on line 184 in order to work.
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Kraken : A Multi-Platform Distributed Brute-Force Password Cracking System

Kraken is an online distributed brute force password cracking tool. It allows you to parallelize dictionaries and crunch word generator based cracking across multiple machines both as a web app in a web browser and as a standalone electron based client. Kraken aims to be easy to use, fault tolerant and scalable.

I wrote Kraken because I wanted to learn more about offensive security and to write an easy solution to overcome the limitation of using a single device when attempting distribute brute force workloads.

Installation

Server and Browser Client

Kraken is a dockerized application using docker-compose which will launch the db (Postgres), s3 compliant file storage (Minio), the server and the browser client. You can find the docker-compose file at the root directory of the repository. You can deploy it using the following command:

docker-compose up

Kraken’s Browser Client should be accessible at:

* HTTP : localhost:8080 (use server url http://localhost:5000/api [default])
* HTTPS : https://localhost:8443 (use server url https://localhost:8443/api)

Note: To run the Browser Client from a remote machine, you MUST use HTTPS for both server url and browser url. Eg. If you are hosting the server on 192.168.1.2, then browser client will be available at https://192.168.1.2:8443 and the server url should be https://192.168.1.2:8443/api

To upload password lists or dictionaries, upload them to Minio Console at localhost:9001. View steps below for a detailed guide Otherwise, you can generate word lists dynamically using crunch. See crunch options and how to use them here: crunch man page

Kraken’s server runs on localhost:5000 and also hosts swagger documentation at localhost:5000/swagger.

Portable Desktop Client

The desktop client is an electron based portable application and can be run on Mac, Windows and Linux. Due to sensitive permissions required to function, it is highly recommended that you compile and it yourself by cloning the repo and using :

cd kraken-client
npm install
npm run electron-start
Windows
Note: Window EXE portable client needs to run in the folder with its hashcat dependencies. Hashcat files can be dowloaded from their home page or here. Ive included a compressed zip file with the portable executable and required hashcat files. They can be downloaded:

* Portable Exe
* Compressed Zip
Linux
Releases include a Linux AppImage which only requires hashcat to be installed.

* AppImage

Install hashcat:

sudo apt-get install hashcat

You will have to give AppImage permission via properties to execute.
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
OWASP Coraza WAF : A Golang Modsecurity Compatible Web Application Firewall Library

OWASP Coraza Web Application Firewall, OWASP Coraza is a golang enterprise-grade Web Application Firewall framework that supports Modsecurity’s seclang language and is 100% compatible with OWASP Core Ruleset.

Prerequisites

* Linux distribution (Debian and Centos are recommended, Windows is not supported yet)
* Golang compiler v1.16+

Migrate from v1

* Rollback SecAuditLog to the legacy syntax (serial/concurrent)
* Attach an error log handler using waf.SetErrorLogCb(cb)(optional)
* the function Transaction.Clean() must be used to clear transaction data, files and take them back to the sync pool.
* If you are using low level APIs check the complete changelog as most of them were removed.
* OWASP CRS does not require any external dependency anymore

Running the tests

Run the go tests:

go test ./…
go test -race ./…

Using pre-commit

pip install pre-commit
pre-commit run –all-files

ou can also install the pre-commit git hook by running

pre-commit install

Coraza v2 differences with v1

* Full internal API refactor, public API has not changed
* Full audit engine refactor with plugins support
* New enhanced plugins interface for transformations, actions, body processors, and operators
* We are fully compliant with Seclang from modsecurity v2
* Many features removed and transformed into plugins: XML (Mostly), GeoIP and PCRE regex
* Better debug logging
* New error logging (like modsecurity)
* Better performance

Your first Coraza WAF project

package main
import(
“fmt”
“github.com/corazawaf/coraza/v2”
“github.com/corazawaf/coraza/v2/seclang”
)
func main() {
// First we initialize our waf and our seclang parser
waf := coraza.NewWaf()
parser, _ := seclang.NewParser(waf)
// Now we parse our rules
if err := parser.FromString(SecRule REMOTE_ADDR "@rx .*" "id:1,phase:1,deny,status:403"); err != nil {
fmt.Println(err)
}
// Then we create a transaction and assign some variables
tx := waf.NewTransaction()
defer func(){
tx.ProcessLogging()
tx.Clean()
}()
tx.ProcessConnection(“127.0.0.1”, 8080, “127.0.0.1”, 12345)
// Finally we process the request headers phase, which may return an interruption
if it := tx.ProcessRequestHeaders(); it != nil {
fmt.Printf(“Transaction was interrupted with status %d\n”, it.Status)
}
}
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
linWinPwn : A Bash Script That Automates A Number Of Active Directory Enumeration And Vulnerability Checks

linWinPwn is a bash script that automates a number of Active Directory Enumeration and Vulnerability checks. The script leverages and is dependent of a number of tools including: impacket, bloodhound, crackmapexec, ldapdomaindump, lsassy, smbmap, kerbrute, adidnsdump.

Setup

Git clone the repository and make the script executable

git clone https://github.com/lefayjey/linWinPwn
cd linWinPwn; chmod +x linWinPwn.sh

Install requirements on Kali machines using the install.shscript

chmod +x install.sh
sudo ./install.sh

On non-Kali machines, run the install_nonkali.shscript instead

chmod +x install_nonkali.sh
sudo ./install_nonkali.sh

If you’re having DNS issues or time sync errors, run the configure.shscript with -dfor DNS update and -nfor NTP sync

WARNING: The script will update /etc/resolv.conf

chmod +x configure.sh
sudo ./configure.sh -t -d -n

Usage

Modules

The linWinPwn script contains 4 modules that can be used either separately or simultaneously.

Default (fastest): ad_enum,kerberos (Optional: run OPSEC safe checks only by using -O)

./linWinPwn.sh -d -u -p -t -o

User modules: ad_enum,kerberos,scan_shares,vuln_checks,mssql_enum

./linWinPwn.sh -M user -d -u -p -t -o

All modules: ad_enum,kerberos,scan_shares,vuln_checks,mssql_enum,pwd_dump

./linWinPwn.sh -M all -d -u -p -t -o

Module ad_enum: Active Directory Enumeration

./linWinPwn.sh -M ad_enum -d -u -p -t -o

Use cases

For each of the cases described, the linWinPwn script performs different checks as shown below.

Case 1: Unauthenticated

* Module ad_enum
* rid bruteforce
* user enumeration
* ldapdomaindump anonymous enumeration
* Check if ldap-signing is enforced, check for LDAP Relay

* Module kerberos
* kerbrute user spray
* ASREPRoast using collected list of users (and cracking hashes using john-the-ripper and the rockyou wordlist)

* Module scan_shares
* SMB shares anonymous enumeration on identified servers

* Module vuln_checks
* Enumeration for WebDav and Spooler services on identified servers
* Check for zerologon, petitpotam, nopac weaknesses
./linWinPwn.sh -M user -t

Case 2: Standard Account (using password, NTLM hash or Kerberos ticket)

* DNS extraction using adidnsdump
* Module ad_enum
* BloodHound data collection
* ldapdomaindump enumeration
* Delegation information extraction
* GPP Passwords extraction
* Extract ADCS information using certipy
* Check if ldap-signing is enforced, check for LDAP Relay
* Extraction of MachineAccountQuota of user, Password Policy and users’ descriptions containing “pass”
* LAPS and gMSA dump

* Module kerberos
* kerbrute user=pass enumeration
* ASREPRoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)
* Kerberoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)

* Module scan_shares
* SMB shares enumeration on all domain servers

* Module vuln_checks
* Enumeration for WebDav and Spooler services on all domain servers
* Check for zerologon, petitpotam, nopac weaknesses

* Module mssql_enum
* Check mssql privilege escalation paths
./linWinPwn.sh -M user -d -u -p -t

Case 3: Administrator Account (using password, NTLM hash or Kerberos ticket)

* All of the “Standard User” checks
* Module pwd_dump
* secretsdump on all domain servers or on provided list of servers with -S
* lsassy on on all domain servers or on provided list of servers with -S
./linWinPwn.sh -M all -d -u -p -t -S
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Zircolite : A Standalone SIGMA-based Detection Tool For EVTX, Auditd And Sysmon For Linux Logs

Zircolite is a standalone tool written in Python 3. It allows to use SIGMA rules on MS Windows EVTX (EVTX and JSONL format), Auditd logs and Sysmon for Linux logs

* Zircolite can be used directly on the investigated endpoint (use releases) or in your forensic/detection lab
* Zircolite is fast and can parse large datasets in just seconds (check benchmarks)

Zircolite can be used directly in Python or you can use the binaries provided in releases (Microsoft Windows and Linux only). Documentation is here.

Requirements / Installation

You can install dependencies with : pip3 install -r requirements.txt

The use of evtx_dump is optional but required by default (because it is for now much faster), If you do not want to use it you have to use the --noexternaloption. The tool is provided if you clone the Zircolite repository (the official repository is here).

Quick start

EVTX files

Help is available with zircolite.py -h. If your EVTX files have the extension “.evtx”

python3 zircolite.py –evtx –ruleset
python3 zircolite.py –evtx sysmon.evtx –ruleset rules/rules_windows_sysmon.json

The SYSMON ruleset used here is a default one and it is for logs coming from endpoints where SYSMON installed. A generic ruleset is available too.

Auditd logs

python3 zircolite.py –evtx –ruleset –auditd
python3 zircolite.py –evtx auditd.log –ruleset rules/rules_linux.json –auditd

Sysmon for Linux logs

python3 zircolite.py –evtx –ruleset –sysmon4linux
python3 zircolite.py –evtx auditd.log –ruleset rules/rules_linux.json –sysmon4linux

JSONL/NDJSON files

python3 zircolite.py –evtx –ruleset rules/rules_windows_sysmon.json –jsononly
Download

___________________________
@hacking_Attack
@Hacking_Video

How I found my first ever XSS on a website.

So, I have been into web hacking lately. While into it, I have explored bug bounties but never found a bug in real website. I have tested…Continue reading on Medium »
Read more...

hacking: security in practice
Can someone get data from Eventbrite and upload into my database?

Hi, I am looking for some help if you could scrap events from Eventbrite with following filters

City, Free, Online

And then import that data into my SQL database.

Is there a tool available to do that? Or anyone has build any open-source tool? Or someone provides this service?

submitted by /u/harshalone
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Reverse engineering raspberrypi bootcode.bin in order to understand an OS problem? How to?

I was trying to boot RTEMS for raspberry pi but the case the is, the firmware after the git tag 1.20200601 does not work but prior to that, everything works. I'm new to reverse engineering, I tried binwalk, got nothing. Used ghidra, found somewhat relevent things but not everything. anyone like to share anything about that?

submitted by /u/elecanic
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How to find & access Admin Panel by digging into JS files…
https://medium.com/@ratnadip1998/how-to-find-access-admin-panel-by-digging-into-js-files-282d89391a2d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello All,🙂Continue reading on Medium » (https://medium.com/@ratnadip1998/how-to-find-access-admin-panel-by-digging-into-js-files-282d89391a2d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

PersistBOF - Tool To Help Automate Common Persistence Mechanisms
http://www.kitploit.com/2022/05/persistbof-tool-to-help-automate-common.html

___________________________
@hacking_Attack
@Hacking_Video

A tool to help automate common persistence mechanisms. Currently supports Print Monitor (SYSTEM), Time Provider (Network Service), Start folder shortcut hijacking (https://www.kitploit.com/search/label/Hijacking) (User), and Junction Folder (User)
Usage Clone, run make, add .cna to Cobalt Strike (https://www.kitploit.com/search/label/Cobalt%20Strike) client. run: help persist-ice in CS console Syntax: persist-ice [PrintMon, TimeProv, Shortcut, Junction] [persist or clean] [key/folder name] [dll / lnk exe name]; Technique Overview All of these techniques rely on a Dll file to be seperately placed on disk. It is intentially not part of the BOF. Print Monitor The Dll MUST be on disk and in a location in PATH (Dll search order) BEFORE you run the BOF. It will fail otherwise. The Dll will immediately be loaded by spoolsv.exe as SYSTEM. This can be used to elevate from admin to SYSTEM as well as for persistence. Will execute on system startup. Must be elevated to run. Demo Print Monitor Dll in project Example: upload NotMalware.dll to C:\Windows\NotMalware.dll persist-ice PrintMon persist TotesLegitMonitor NotMalware.dll Immediately executes as SYSTEM Will execute on startup until removed persist-ice PrintMon clean TotesLegitMonitor C:\Windows\NotMalware.dll > Will delete the registery keys and unload the Dll, then attempt to delete the dll if provided the correct path. Should succeed. Time Provider Loaded by svchost.exe as NETWORK SERVICE (get your potatoes ready!) on startup after running the BOF. Must be elevated to run. Demo Time Provider Dll in project Example: persist-ice TimeProv persist TotesLegitTimeProvider C:\anywhere\NotMalware.dll persist-ice TimeProv cleanup TotesLegitTimeProvider C:\anywhere\NotMalware.dll > Will delete the registry (https://www.kitploit.com/search/label/Registry) keys and attempt to delete the dll if provided the correct path. Will probably fail because the dll is not unloaded by the process. Junction Folder Same technique as demonstrated in Vault 7 leaks. Executed on user login. Non-elevated. Dll will be loaded into explorer.exe Example: persist-ice Juction persist TotesLegitFolder C:\user-writable-folder\NotMalware.dll Save CLSID persist-ice Juction clean TotesLegitFolder C:\user-writable-folder\NotMalware.dll 6be5e092-90cc-452d-be83-208029e259e0 > Will delete the registry keys, junction folder, and attempt to delete the dll. Start Folder Hijack Create a new, user writeable folder, copy a hijackable windows (https://www.kitploit.com/search/label/Windows) binary (https://www.kitploit.com/search/label/Binary) to the folder, then create a shortcut in the startup folder. Executed on user login. Non-elevated. Example: persist-ice Shortcut persist C:\TotesLegitFolder C:\Windows\System32\Dism.exe > upload your Dll as a proxy dll to dismcore.dll into C:\TotesLegitFolder persist-ice Shortcut persist C:\TotesLegitFolder C:\Windows\System32\Dism.exe > Will attempt delete all files in new folder then delete the folder itself. If the Dll is still loaded in the process then this will fail. References https://stmxcsr.com/persistence/print-monitor.html https://stmxcsr.com/persistence/time-provider.html https://pentestlab.blog/2019/10/28/persistence-port-monitors/ https://blog.f-secure.com/hunting-for-junction-folder-persistence/ https://attack.mitre.org/techniques/T1547/010/ https://attack.mitre.org/techniques/T1547/003/ https://attack.mitre.org/techniques/T1547/009/

Download PersistBOF (https://github.com/IcebreakerSecurity/PersistBOF)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to find & access Admin Panel by digging into JS files…

https://cdn-images-1.medium.com/max/1206/0*gWmf1S7O7TT5Ctt3.jpeg
Hello All,🙂

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video