Hacking on Medium
Indian Hackers are being hired by the Israeli Private Detective Service for Russian Oligarchs!

https://cdn-images-1.medium.com/max/640/0*LSo_3bDCLpCMSv2q.jpg
The Israeli Private Detective used Indian hackers!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top 5 Hacking Book , Must Read !!

https://cdn-images-1.medium.com/max/800/1*BNbCYjofq0JDtmslfaMkkg.jpeg
A Hacking and cybersecurity books guide which tells you about top 10 Hacking books .

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Uma dádiva dos espiões

https://cdn-images-1.medium.com/max/2600/1*Z_Jq9G9xYAqAwLYff4Ztbw.jpeg
Quantas pessoas já pensaram sobre estarem sendo espionadas sem o seu consentimento?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack Hydra co-owner’s crypto wallet

https://cdn-images-1.medium.com/max/2000/0*JlRgk-mMgani_P0J.jpg
A Moscow court can confiscate a record amount for Russia from a drug dealer’s crypto wallet, but he does not give the password. We are…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack Quaoar Machine and get Admin Access.

https://cdn-images-1.medium.com/max/1086/1*Fc093DF5jMiZ1NINagUIDg.png
Quaoar is a boot2root virtual machine hosted in vulnhub, created by Viper for Hackfest 2016 CTF. This machine is good for those who have…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

During a pentest, how do you bypass AV to get tools in? I have worked in easier environments but when you run into crowdstrike how do you bypass to do work?
https://www.reddit.com/r/Pentesting/comments/v10efk/during_a_pentest_how_do_you_bypass_av_to_get/

submitted by /u/Upstairs_Lie_9379 (https://www.reddit.com/user/Upstairs_Lie_9379)
[link] (https://www.reddit.com/r/Pentesting/comments/v10efk/during_a_pentest_how_do_you_bypass_av_to_get/) [comments] (https://www.reddit.com/r/Pentesting/comments/v10efk/during_a_pentest_how_do_you_bypass_av_to_get/)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
PersistBOF - Tool To Help Automate Common Persistence Mechanisms

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggeS9H-8KfNEiS7wmPPWLTznqdP3xgqDqCQV8y_JrqW3xRX5AakIYR1avV_l8dcAdDFX4JSqdDIAVkrDp-FfgqEgduT7qhn1zpXJzxeZ3r2bqujWZ1OptNNnbXx7H9Dwtfy-J1d4t-tsYfo9KtEZ0FkyZaPGfcxeTct3WGCnYLf3p7lmv-MZnBgJn9/w640-h176/PersistBOF.png A tool to help automate common persistence mechanisms. Currently supports Print Monitor (SYSTEM), Time Provider (Network Service), Start folder shortcut hijacking (User), and Junction Folder (User) UsageClone, run make, add .cna to Cobalt Strike client.

run: help persist-ice in CS console

Syntax:

* persist-ice [PrintMon, TimeProv, Shortcut, Junction] [persist or clean] [key/folder name] [dll / lnk exe name]; Technique OverviewAll of these techniques rely on a Dll file to be seperately placed on disk. It is intentially not part of the BOF. Print MonitorThe Dll MUST be on disk and in a location in PATH (Dll search order) BEFORE you run the BOF. It will fail otherwise. The Dll will immediately be loaded by spoolsv.exe as SYSTEM. This can be used to elevate from admin to SYSTEM as well as for persistence. Will execute on system startup. Must be elevated to run.

* Demo Print Monitor Dll in project

Example:

1. upload NotMalware.dll to C:\Windows\NotMalware.dll
2. persist-ice PrintMon persist TotesLegitMonitor NotMalware.dll
3. Immediately executes as SYSTEM
4. Will execute on startup until removed
5. persist-ice PrintMon clean TotesLegitMonitor C:\Windows\NotMalware.dll > Will delete the registery keys and unload the Dll, then attempt to delete the dll if provided the correct path. Should succeed. Time ProviderLoaded by svchost.exe as NETWORK SERVICE (get your potatoes ready!) on startup after running the BOF. Must be elevated to run.

* Demo Time Provider Dll in project

Example:

* persist-ice TimeProv persist TotesLegitTimeProvider C:\anywhere\NotMalware.dll
* persist-ice TimeProv cleanup TotesLegitTimeProvider C:\anywhere\NotMalware.dll > Will delete the registry keys and attempt to delete the dll if provided the correct path. Will probably fail because the dll is not unloaded by the process. Junction FolderSame technique as demonstrated in Vault 7 leaks. Executed on user login. Non-elevated. Dll will be loaded into explorer.exe

Example:

* persist-ice Juction persist TotesLegitFolder C:\user-writable-folder\NotMalware.dll Save CLSID
* persist-ice Juction clean TotesLegitFolder C:\user-writable-folder\NotMalware.dll 6be5e092-90cc-452d-be83-208029e259e0 > Will delete the registry keys, junction folder, and attempt to delete the dll. Start Folder HijackCreate a new, user writeable folder, copy a hijackable windows binary to the folder, then create a shortcut in the startup folder. Executed on user login. Non-elevated.

Example:

* persist-ice Shortcut persist C:\TotesLegitFolder C:\Windows\System32\Dism.exe > upload your Dll as a proxy dll to dismcore.dll into C:\TotesLegitFolder
* persist-ice Shortcut persist C:\TotesLegitFolder C:\Windows\System32\Dism.exe > Will attempt delete all files in new folder then delete the folder itself. If the Dll is still loaded in the process then this will fail. Referenceshttps://stmxcsr.com/persistence/print-monitor.html https://stmxcsr.com/persistence/time-provider.html https://pentestlab.blog/2019/10/28/persistence-port-monitors/ https://blog.f-secure.com/hunting-for-junction-folder-persistence/ https://attack.mitre.org/techniques/T1547/010/ https://attack.mitre.org/techniques/T1547/003/ https://attack.mitre.org/techniques/T1547/009/ Download PersistBOF

___________________________
@hacking_Attack
@Hacking_Video

Top 5 Hacking Book , Must Read !!
https://infosecwriteups.com/top-5-hacking-book-must-read-72b37d7f885a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

A Hacking and cybersecurity books guide which tells you about top 10 Hacking books .Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/top-5-hacking-book-must-read-72b37d7f885a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Follina — A new 0-day vulnerability in Microsoft Office

https://external-preview.redd.it/Bhsna7Pu1xf9Wcgg_hcdBclstx4w230VYQDmbM9EXIY.jpg?width=320&crop=smart&auto=webp&s=9999850f774daa309a62885c71ca6dcb8ae21b63 submitted by /u/CyberMasterV
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
mimikatz.exe to evade av & edr detection

I've watched IppSec's video on how to evade AV detection using mimikatz.exe as a sample and wondering if you guys use similar approach?
https://www.youtube.com/watch?v=9pwMCHlNma4
Visual Studio is huge and heavy, wish there's alternative to compile and build exe without it. I wish there's a way to automate this process. Not sure if there's any tools build for this purpose.

From your experience, what is the best way to evade av/edr detection?

submitted by /u/w0lfcat
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Ransomware

Anybody who knows about ransomeware message me or if anybody knows about any good forums or articles about them please let me know

submitted by /u/ry1474
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video