Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
MY WEB SERVER: 1 | Vulnhub Walkthrough
https://cdn-images-1.medium.com/max/803/1*sTozj9jqhJGzQz2mhlRJMA.png
You can download the machine from
Continue reading on Medium »
MY WEB SERVER: 1 | Vulnhub Walkthrough
https://cdn-images-1.medium.com/max/803/1*sTozj9jqhJGzQz2mhlRJMA.png
You can download the machine from
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Hack Track: Bitfinex Hack (2016) Recent Fund Movement Analysis
https://cdn-images-1.medium.com/max/960/1*7AcnDrMhLzyVIfB1y_9NuQ.png
Merkle Science Hack Track provides digestible insights on the movement of stolen funds from the latest cryptocurrency heists.
Continue reading on Merkle Science »
Hack Track: Bitfinex Hack (2016) Recent Fund Movement Analysis
https://cdn-images-1.medium.com/max/960/1*7AcnDrMhLzyVIfB1y_9NuQ.png
Merkle Science Hack Track provides digestible insights on the movement of stolen funds from the latest cryptocurrency heists.
Continue reading on Merkle Science »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
WordPress could treat Google FloC as a security issue
https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg WordPress could treat Google FloC as a security issuePost Views: 55
Reading Time: 1 Minute
The backlash against Google’s Federated Learning of Cohorts (FLoC) has continued, with a proposal raised in WordPress Core to block the controversial alternative identifier to third-party cookies by default.
The WordPress proposal would see the blogging system use its weight to thwart FLoC.
“WordPress powers approximately 41% of the web — and this community can help combat racism, sexism, anti-LGBTQ+ discrimination, and discrimination against those with mental illness with four lines of code,” it states.
For users that want to enable FLoC, the proposal states those users would likely be able to do so themselves, and a little more code would allow FLoC to be toggled on and off in blog settings.
“When balancing the stakeholder interests, the needs of website administrators who are not even aware that this is something that they need to mitigate — and the interests of the users and visitors to those sites, is simply more compelling,” the proposal states.
In order to get the block out to current users, WordPress has floated that FLoC be treated as a security problem and backported, rather than waiting until the next major release in July.
“Currently, 5.8. is only scheduled for July 2021. FLoC will likely be rolling out this month,” it states.
“Furthermore, a significant number of WordPress sites only update to minor versions. By back-porting, we can protect more sites and more visitors to those sites — and amplify the impact.”
FLoC has received some stinging criticism, mostly based on how it would share a summary of recent browser history with marketers, something third-party cookies could try to do, but were never guaranteed to be able to do so.
See Also: Attackers Target ProxyLogon Exploit to Install Cryptojacker “Its core design involves sharing new information with advertisers,” Chromium-based browser maker Vivaldi said last week.
“You might visit a website that relates to a highly personal subject that may or may not use FLoC ads, and now every other site that you visit gets told your FLoC ID, which shows that you have visited that specific kind of site.”
Vivaldi said FLoC has very serious implications for people who live in an environment where aspects of their personality are persecuted, such as their sexuality, political viewpoint, or religion.
“All can become a part of your FLoC ID,” it said.
See Also: Offensive Security Tool: Hunt “This is no longer about privacy but goes beyond. It crosses the line into personal safety.
The Electronic Frontiers Foundation said the era of third-party cookies was over, and the decision was now whether to allow users to decide what information to share, or have a behavioural label attached to users that is “rich with meaning to those in the know”.
“Their recent history, distilled into a few bits, is ‘democratized’ and shared with dozens of nameless actors that take part in the service of each web page,” it said.
“Users begin every interaction with a confession: Here’s what I’ve been up to this week, please treat me accordingly.” See Also: Hacking Stories: When two young hackers played war games with PentagonSource: www.zdnet.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Crypto_Mining_Bitcoin-90x90.jpg Attackers Target ProxyLogon Exploit to Install Cryptojacker3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/pat[...]
WordPress could treat Google FloC as a security issue
https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg WordPress could treat Google FloC as a security issuePost Views: 55
Reading Time: 1 Minute
The backlash against Google’s Federated Learning of Cohorts (FLoC) has continued, with a proposal raised in WordPress Core to block the controversial alternative identifier to third-party cookies by default.
The WordPress proposal would see the blogging system use its weight to thwart FLoC.
“WordPress powers approximately 41% of the web — and this community can help combat racism, sexism, anti-LGBTQ+ discrimination, and discrimination against those with mental illness with four lines of code,” it states.
For users that want to enable FLoC, the proposal states those users would likely be able to do so themselves, and a little more code would allow FLoC to be toggled on and off in blog settings.
“When balancing the stakeholder interests, the needs of website administrators who are not even aware that this is something that they need to mitigate — and the interests of the users and visitors to those sites, is simply more compelling,” the proposal states.
In order to get the block out to current users, WordPress has floated that FLoC be treated as a security problem and backported, rather than waiting until the next major release in July.
“Currently, 5.8. is only scheduled for July 2021. FLoC will likely be rolling out this month,” it states.
“Furthermore, a significant number of WordPress sites only update to minor versions. By back-porting, we can protect more sites and more visitors to those sites — and amplify the impact.”
FLoC has received some stinging criticism, mostly based on how it would share a summary of recent browser history with marketers, something third-party cookies could try to do, but were never guaranteed to be able to do so.
See Also: Attackers Target ProxyLogon Exploit to Install Cryptojacker “Its core design involves sharing new information with advertisers,” Chromium-based browser maker Vivaldi said last week.
“You might visit a website that relates to a highly personal subject that may or may not use FLoC ads, and now every other site that you visit gets told your FLoC ID, which shows that you have visited that specific kind of site.”
Vivaldi said FLoC has very serious implications for people who live in an environment where aspects of their personality are persecuted, such as their sexuality, political viewpoint, or religion.
“All can become a part of your FLoC ID,” it said.
See Also: Offensive Security Tool: Hunt “This is no longer about privacy but goes beyond. It crosses the line into personal safety.
The Electronic Frontiers Foundation said the era of third-party cookies was over, and the decision was now whether to allow users to decide what information to share, or have a behavioural label attached to users that is “rich with meaning to those in the know”.
“Their recent history, distilled into a few bits, is ‘democratized’ and shared with dozens of nameless actors that take part in the service of each web page,” it said.
“Users begin every interaction with a confession: Here’s what I’ve been up to this week, please treat me accordingly.” See Also: Hacking Stories: When two young hackers played war games with PentagonSource: www.zdnet.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Crypto_Mining_Bitcoin-90x90.jpg Attackers Target ProxyLogon Exploit to Install Cryptojacker3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/pat[...]
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking WordPress could treat Google FloC as a security issue https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg WordPress could treat Google FloC as a security issuePost Views: 55 Reading…
chtues1-90x90.jpg Microsoft to Patch multiple Zero-Days, 110 vulnerabilities in total4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Google-Chrome-Browser-90x90.jpg Chrome Zero-Day Exploit Posted on Twitter5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Clubhouse2-e1618258606781-90x90.png 1.3M Clubhouse Users’ Data Dumped in Hacker Forum for Free6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/linkedin-90x90.png Data from 500M LinkedIn Users Posted for Sale Online1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/cisco-patch-90x90.png Zero-Day Bug Impacts Problem-Plagued Cisco SOHO Routers1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/google-play-90x90.jpg Fake Netflix App on Google Play Spreads Malware Via WhatsApp2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/vmware-patch-90x90.jpg Critical Cloud Bug in VMWare Carbon Black Allows Takeover2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/eggs-chickens-e1617650984482-90x90.jpg LinkedIn Spear-Phishing Campaign Targets Job Hunters2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/pf9bzNs3hHRgAcgDQTPPa3-1200-80-90x90.jpg Facebook data on 533 million users posted online2 weeks ago
The post WordPress could treat Google FloC as a security issue first appeared on Black Hat Ethical Hacking.
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Google-Chrome-Browser-90x90.jpg Chrome Zero-Day Exploit Posted on Twitter5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Clubhouse2-e1618258606781-90x90.png 1.3M Clubhouse Users’ Data Dumped in Hacker Forum for Free6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/linkedin-90x90.png Data from 500M LinkedIn Users Posted for Sale Online1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/cisco-patch-90x90.png Zero-Day Bug Impacts Problem-Plagued Cisco SOHO Routers1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/google-play-90x90.jpg Fake Netflix App on Google Play Spreads Malware Via WhatsApp2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/vmware-patch-90x90.jpg Critical Cloud Bug in VMWare Carbon Black Allows Takeover2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/eggs-chickens-e1617650984482-90x90.jpg LinkedIn Spear-Phishing Campaign Targets Job Hunters2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/pf9bzNs3hHRgAcgDQTPPa3-1200-80-90x90.jpg Facebook data on 533 million users posted online2 weeks ago
The post WordPress could treat Google FloC as a security issue first appeared on Black Hat Ethical Hacking.
Cypheroth - Automated, Extensible Toolset That Runs Cypher Queries Against Bloodhound's Neo4j Backend And Saves Output To Spreadsheets
Automated, extensible toolset that runs cypher queries against Bloodhound's Neo4j backend and saves output to spreadsheets.Description This is a bash script that automates running cypher queries against Bloodhound data stored in a Neo4j database. I found myself re-running the same queries through the Neo4j web interface on multiple assessments and figured there must be an easier way. The list of cypher queries to run is fully extensible. The formatting example below shows how to add your own. Please share any additional useful queries so I can add them to this project! Fully tested to be working in Bash on Linux, macOS, and Windows DemoPrereqs The cypher-shell command comes bundled with Neo4j, and is required for this script to function If Neo4j is installed and cypher-shell is not found, you may have an outdated version of Neo4j The latest version can always be found at this location On Kali, upgrade to the latest version using Neo4j's Debian repository Optional: If the ssconvert command is present, the script will combine all .csv output to sheets within a .xls file Install the gnumeric toolset with apt or brew to gain access to ssconvert On Windows we recommend using WSL to run this script, while the neo4j database runs on Windows. You will just need to install the cypher-shell package in WSL (Linux). Usage Flags: -u Neo4J Username (Required) -p Neo4J Password (Required) -d Fully Qualified Domain Name (Required) (Case Sensitive) -a Bolt address (Optional) (Default: localhost:7687) -t Query Timeout (Optional) (Default: 30s) -v Verbose mode (Optional) (Default:FALSE) -h Help text and usage example (Optional) Example with Defaults: ./cypheroth.sh -u neo4j -p BloodHound -d TESTLAB.LOCAL Example with All Options: ./cypheroth.sh -u neo4j -p hunter2 -d BigTech.corp -a 10.0.0.1:7687 -t 5m -v true Files are added to a subdirectory named after the FQDN. Cypher Queries There are nearly 60 queries in the script currently. This is a sample of the information you'll receive: Full User Property List Full Computer Property List Full Domain Property List Full OU Property List Full GPO Property List Full Group Property List Computers with Admins Computers without Admins Kerberoastable users and computers where they are admins To add additional queries, edit the queries array within cypheroth.sh and add a line using the following format: Description;Cypher Query;Output File If adding a query that requires the Domain value to be set, save it as $DOMAIN. Example 1: All Usernames;MATCH (u:User) RETURN u.name;usernames.csv Example 2: All Domain Admins;MATCH (u:User) MATCH (g:Group {name:'DOMAIN ADMINS@$DOMAIN'}) RETURN u.displayname;domainAdmins.csv Analyze several domains If you need to analyze several domains, you can run multiple instances of Cypheroth in parallel with each one working on its domain. You can use the following script for example (10 in parallel). #!/usr/bin/env bashDOMAINS=(domA.example.net domB.example.net ...)parallel -j10 --lb ./cypheroth.sh <args> -d {} ::: "${DOMAINS@}" Troubleshooting If you are running an outdated version of cypher-shell you may receive the following error: DateTime is not supported as a return type in Bolt protocol version 1.Please make sure driver supports at least protocol version 2.Driver upgrade is most likely required. To fix, update Neo4j to the latest version. Author Chris Farrell (@seajay) Acknowledgments This tool wouldn't exist without BloodHound - developed by @_wald0, @CptJesus, and @harmj0y. Shoutout to the Bloodhound Slack #cypher_queries channel for assistance Big ups to @TinkerSec - the bones of this project were straight up copy/pasted from his procdump script Many thanks to @awsmhacks, @haus3c and @ScoubiMtl for collecting useful cypher queries (here, here and here) Hugely appreciate contributions from @chryzsh and @mubix!! All of the amazing contributions from @cnotin Download Cypheroth
Read more...
Automated, extensible toolset that runs cypher queries against Bloodhound's Neo4j backend and saves output to spreadsheets.Description This is a bash script that automates running cypher queries against Bloodhound data stored in a Neo4j database. I found myself re-running the same queries through the Neo4j web interface on multiple assessments and figured there must be an easier way. The list of cypher queries to run is fully extensible. The formatting example below shows how to add your own. Please share any additional useful queries so I can add them to this project! Fully tested to be working in Bash on Linux, macOS, and Windows DemoPrereqs The cypher-shell command comes bundled with Neo4j, and is required for this script to function If Neo4j is installed and cypher-shell is not found, you may have an outdated version of Neo4j The latest version can always be found at this location On Kali, upgrade to the latest version using Neo4j's Debian repository Optional: If the ssconvert command is present, the script will combine all .csv output to sheets within a .xls file Install the gnumeric toolset with apt or brew to gain access to ssconvert On Windows we recommend using WSL to run this script, while the neo4j database runs on Windows. You will just need to install the cypher-shell package in WSL (Linux). Usage Flags: -u Neo4J Username (Required) -p Neo4J Password (Required) -d Fully Qualified Domain Name (Required) (Case Sensitive) -a Bolt address (Optional) (Default: localhost:7687) -t Query Timeout (Optional) (Default: 30s) -v Verbose mode (Optional) (Default:FALSE) -h Help text and usage example (Optional) Example with Defaults: ./cypheroth.sh -u neo4j -p BloodHound -d TESTLAB.LOCAL Example with All Options: ./cypheroth.sh -u neo4j -p hunter2 -d BigTech.corp -a 10.0.0.1:7687 -t 5m -v true Files are added to a subdirectory named after the FQDN. Cypher Queries There are nearly 60 queries in the script currently. This is a sample of the information you'll receive: Full User Property List Full Computer Property List Full Domain Property List Full OU Property List Full GPO Property List Full Group Property List Computers with Admins Computers without Admins Kerberoastable users and computers where they are admins To add additional queries, edit the queries array within cypheroth.sh and add a line using the following format: Description;Cypher Query;Output File If adding a query that requires the Domain value to be set, save it as $DOMAIN. Example 1: All Usernames;MATCH (u:User) RETURN u.name;usernames.csv Example 2: All Domain Admins;MATCH (u:User) MATCH (g:Group {name:'DOMAIN ADMINS@$DOMAIN'}) RETURN u.displayname;domainAdmins.csv Analyze several domains If you need to analyze several domains, you can run multiple instances of Cypheroth in parallel with each one working on its domain. You can use the following script for example (10 in parallel). #!/usr/bin/env bashDOMAINS=(domA.example.net domB.example.net ...)parallel -j10 --lb ./cypheroth.sh <args> -d {} ::: "${DOMAINS@}" Troubleshooting If you are running an outdated version of cypher-shell you may receive the following error: DateTime is not supported as a return type in Bolt protocol version 1.Please make sure driver supports at least protocol version 2.Driver upgrade is most likely required. To fix, update Neo4j to the latest version. Author Chris Farrell (@seajay) Acknowledgments This tool wouldn't exist without BloodHound - developed by @_wald0, @CptJesus, and @harmj0y. Shoutout to the Bloodhound Slack #cypher_queries channel for assistance Big ups to @TinkerSec - the bones of this project were straight up copy/pasted from his procdump script Many thanks to @awsmhacks, @haus3c and @ScoubiMtl for collecting useful cypher queries (here, here and here) Hugely appreciate contributions from @chryzsh and @mubix!! All of the amazing contributions from @cnotin Download Cypheroth
Read more...
hacking: security in practice
What are my IPTV details?
I have an android TV box. A local company sells the service that I am using. They won't allow me to install the software and set it up. I took the box in and they made it work.
The interface has the login details removed, so it works, but logs in without me having to type anything.
Question: How can I find out what the server address, user details etc. are? Surely all this info must be written to a file somewhere on the Android system?
submitted by /u/L-Jaxx
[link] [comments]
What are my IPTV details?
I have an android TV box. A local company sells the service that I am using. They won't allow me to install the software and set it up. I took the box in and they made it work.
The interface has the login details removed, so it works, but logs in without me having to type anything.
Question: How can I find out what the server address, user details etc. are? Surely all this info must be written to a file somewhere on the Android system?
submitted by /u/L-Jaxx
[link] [comments]
reddit
What are my IPTV details?
I have an android TV box. A local company sells the service that I am using. They won't allow me to install the software and set it up. I took the...
hacking: security in practice
Holy Grail of hacking
Hello everyone,
/r/askhacking is mostly dead, I hope my somewhat simple-minded question fits this sub.
In your opinion, what is the Holy Grail of hacking as a malicious activity? What is something that is extremely hard to pull off and could do enermous amount of damage if made public?
Pushing a malicious forced windows update through legitimate Windows Update channels?
Taking over a NASA Mars rover?
Dumping all data from a big pharma company or something like Google Brain?
Or something US military/IC community related?
Or making people unable to play Fortnite for weeks? :)
I don’t want to give ideas to anyone, only I was wondering about this recently.
Looking forward to your answers. :)
submitted by /u/TastyPoint2
[link] [comments]
Holy Grail of hacking
Hello everyone,
/r/askhacking is mostly dead, I hope my somewhat simple-minded question fits this sub.
In your opinion, what is the Holy Grail of hacking as a malicious activity? What is something that is extremely hard to pull off and could do enermous amount of damage if made public?
Pushing a malicious forced windows update through legitimate Windows Update channels?
Taking over a NASA Mars rover?
Dumping all data from a big pharma company or something like Google Brain?
Or something US military/IC community related?
Or making people unable to play Fortnite for weeks? :)
I don’t want to give ideas to anyone, only I was wondering about this recently.
Looking forward to your answers. :)
submitted by /u/TastyPoint2
[link] [comments]
reddit
Holy Grail of hacking
Hello everyone, /r/askhacking is mostly dead, I hope my somewhat simple-minded question fits this sub. In your opinion, what is the Holy Grail...
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
CyberPandemic on the Horizon
NORAD had drills of jets as weapons. We get 9/11
A tabletop exercise, Event 201, simulated a global pandemic. We get Coronavirus
CyberPolygon 2021 is a global cyberattack simulation that will take place this coming July. Hmmmmm.....
https://unlimitedhangout.com/2021/02/investigative-reports/from-event-201-to-cyber-polygon-the-wefs-simulation-of-a-coming-cyber-pandemic/
submitted by /u/Kyedmipy
[link] [comments]
CyberPandemic on the Horizon
NORAD had drills of jets as weapons. We get 9/11
A tabletop exercise, Event 201, simulated a global pandemic. We get Coronavirus
CyberPolygon 2021 is a global cyberattack simulation that will take place this coming July. Hmmmmm.....
https://unlimitedhangout.com/2021/02/investigative-reports/from-event-201-to-cyber-polygon-the-wefs-simulation-of-a-coming-cyber-pandemic/
submitted by /u/Kyedmipy
[link] [comments]
hacking: security in practice
How is a docker different from a VM and why?
Just started to get my hands on kali linux and I've run into a few things that require the use of a docker. What is the difference? Not sure if this is a silly question but thank you in advance.
submitted by /u/bailsatan
[link] [comments]
How is a docker different from a VM and why?
Just started to get my hands on kali linux and I've run into a few things that require the use of a docker. What is the difference? Not sure if this is a silly question but thank you in advance.
submitted by /u/bailsatan
[link] [comments]
reddit
How is a docker different from a VM and why?
Just started to get my hands on kali linux and I've run into a few things that require the use of a docker. What is the difference? Not sure if...
hacking: security in practice
DEF CON 29 with be both in-person & virtual
submitted by /u/Alex5899
[link] [comments]
DEF CON 29 with be both in-person & virtual
submitted by /u/Alex5899
[link] [comments]
reddit
DEF CON 29 with be both in-person & virtual
Posted in r/hacking by u/Alex5899 • 1 point and 0 comments
hacking: security in practice
Is there a danger oh hackers making computers go on fire by overvolting hardware?
I read some meme about how hackers can make .ex robots choke you, so that made me wonder if hackers could actually cause physical harm like in movies and games.
The most realistic scenario I came up with is if someone made a computer turn on by itself at the middle of the night when no one is there to stop it, to run some stress program that would make the cpu and gpu work at 100% and to overvolt them, which may(?) cause a fire, which can then further do real damage.
Is something like that possible and were there ever such cases?
submitted by /u/jakers036
[link] [comments]
Is there a danger oh hackers making computers go on fire by overvolting hardware?
I read some meme about how hackers can make .ex robots choke you, so that made me wonder if hackers could actually cause physical harm like in movies and games.
The most realistic scenario I came up with is if someone made a computer turn on by itself at the middle of the night when no one is there to stop it, to run some stress program that would make the cpu and gpu work at 100% and to overvolt them, which may(?) cause a fire, which can then further do real damage.
Is something like that possible and were there ever such cases?
submitted by /u/jakers036
[link] [comments]
reddit
Is there a danger oh hackers making computers go on fire by...
I read some meme about how hackers can make .ex robots choke you, so that made me wonder if hackers could actually cause physical harm like in...
Cypheroth - Automated, Extensible Toolset That Runs Cypher Queries Against Bloodhound's Neo4j Backend And Saves Output To Spreadsheets
http://www.kitploit.com/2021/04/cypheroth-automated-extensible-toolset.html
http://www.kitploit.com/2021/04/cypheroth-automated-extensible-toolset.html
Automated, extensible toolset (https://www.kitploit.com/search/label/Toolset) that runs cypher (https://www.kitploit.com/search/label/Cypher) queries against Bloodhound's Neo4j backend and saves output to spreadsheets.
Description
This is a bash script that automates running cypher queries against Bloodhound data stored in a Neo4j database. I found myself re-running the same queries through the Neo4j web interface on multiple assessments and figured there must be an easier way. The list of cypher queries to run is fully extensible. The formatting example below shows how to add your own. Please share any additional useful queries so I can add them to this project! Fully tested to be working in Bash on Linux, macOS, and Windows
Demo (https://github.com/seajaysec/cypheroth/blob/master/img/demo_v1_4.svg)
Prereqs
The cypher-shell command comes bundled with Neo4j, and is required for this script to function If Neo4j is installed and cypher-shell is not found, you may have an outdated version of Neo4j The latest version can always be found at this location (https://neo4j.com/download-center/) On Kali, upgrade to the latest version using Neo4j's Debian repository (https://debian.neo4j.org/) Optional: If the ssconvert command is present, the script will combine all .csv output to sheets within a .xls file Install the gnumeric toolset with apt or brew to gain access (https://www.kitploit.com/search/label/Access) to ssconvert On Windows (https://www.kitploit.com/search/label/Windows) we recommend using WSL to run this script, while the neo4j database runs on Windows. You will just need to install the cypher-shell package in WSL (Linux).
Usage
Flags: -u Neo4J Username (Required)
-p Neo4J Password (Required)
-d Fully Qualified Domain Name (Required) (Case Sensitive)
-a Bolt address (Optional) (Default: localhost:7687)
-t Query Timeout (Optional) (Default: 30s)
-v Verbose mode (Optional) (Default:FALSE)
-h Help text and usage example (Optional)
Example with Defaults: ./cypheroth.sh -u neo4j -p BloodHound (https://www.kitploit.com/search/label/BloodHound) -d TESTLAB.LOCAL Example with All Options: ./cypheroth.sh -u neo4j -p hunter2 -d BigTech.corp -a 10.0.0.1:7687 -t 5m -v true Files are added to a subdirectory named after the FQDN.
Cypher Queries
There are nearly 60 queries in the script currently. This is a sample of the information you'll receive: Full User Property List Full Computer Property List Full Domain Property List Full OU Property List Full GPO Property List Full Group Property List Computers with Admins Computers without Admins Kerberoastable users and computers where they are admins To add additional queries, edit the queries array within cypheroth.sh and add a line using the following format: Description;Cypher Query;Output File If adding a query that requires the Domain value to be set, save it as $DOMAIN. Example 1: All Usernames;MATCH (u:User) RETURN u.name;usernames.csv
Example 2: All Domain Admins;MATCH (u:User) MATCH (g:Group {name:'DOMAIN ADMINS@$DOMAIN'}) RETURN u.displayname;domainAdmins.csv
Analyze several domains
If you need to analyze several domains, you can run multiple instances of Cypheroth in parallel with each one working on its domain. You can use the following script for example (10 in parallel). #!/usr/bin/env bash
DOMAINS=(domA.example.net domB.example.net [...])
parallel -j10 --lb ./cypheroth.sh -d {} ::: "${DOMAINS[@]}"
Troubleshooting
If you are running an outdated version of cypher-shell you may receive the following error: DateTime is not supported as a return type in Bolt protocol version 1.
Please make sure driver supports at least protocol version 2.
Driver upgrade is most likely required.
To fix, update Neo4j (https://neo4j.com/download-center/) to the latest version.
Author
Chris Farrell (@seajay (https://twitter.com/seajay))
Acknowledgments
Description
This is a bash script that automates running cypher queries against Bloodhound data stored in a Neo4j database. I found myself re-running the same queries through the Neo4j web interface on multiple assessments and figured there must be an easier way. The list of cypher queries to run is fully extensible. The formatting example below shows how to add your own. Please share any additional useful queries so I can add them to this project! Fully tested to be working in Bash on Linux, macOS, and Windows
Demo (https://github.com/seajaysec/cypheroth/blob/master/img/demo_v1_4.svg)
Prereqs
The cypher-shell command comes bundled with Neo4j, and is required for this script to function If Neo4j is installed and cypher-shell is not found, you may have an outdated version of Neo4j The latest version can always be found at this location (https://neo4j.com/download-center/) On Kali, upgrade to the latest version using Neo4j's Debian repository (https://debian.neo4j.org/) Optional: If the ssconvert command is present, the script will combine all .csv output to sheets within a .xls file Install the gnumeric toolset with apt or brew to gain access (https://www.kitploit.com/search/label/Access) to ssconvert On Windows (https://www.kitploit.com/search/label/Windows) we recommend using WSL to run this script, while the neo4j database runs on Windows. You will just need to install the cypher-shell package in WSL (Linux).
Usage
Flags: -u Neo4J Username (Required)
-p Neo4J Password (Required)
-d Fully Qualified Domain Name (Required) (Case Sensitive)
-a Bolt address (Optional) (Default: localhost:7687)
-t Query Timeout (Optional) (Default: 30s)
-v Verbose mode (Optional) (Default:FALSE)
-h Help text and usage example (Optional)
Example with Defaults: ./cypheroth.sh -u neo4j -p BloodHound (https://www.kitploit.com/search/label/BloodHound) -d TESTLAB.LOCAL Example with All Options: ./cypheroth.sh -u neo4j -p hunter2 -d BigTech.corp -a 10.0.0.1:7687 -t 5m -v true Files are added to a subdirectory named after the FQDN.
Cypher Queries
There are nearly 60 queries in the script currently. This is a sample of the information you'll receive: Full User Property List Full Computer Property List Full Domain Property List Full OU Property List Full GPO Property List Full Group Property List Computers with Admins Computers without Admins Kerberoastable users and computers where they are admins To add additional queries, edit the queries array within cypheroth.sh and add a line using the following format: Description;Cypher Query;Output File If adding a query that requires the Domain value to be set, save it as $DOMAIN. Example 1: All Usernames;MATCH (u:User) RETURN u.name;usernames.csv
Example 2: All Domain Admins;MATCH (u:User) MATCH (g:Group {name:'DOMAIN ADMINS@$DOMAIN'}) RETURN u.displayname;domainAdmins.csv
Analyze several domains
If you need to analyze several domains, you can run multiple instances of Cypheroth in parallel with each one working on its domain. You can use the following script for example (10 in parallel). #!/usr/bin/env bash
DOMAINS=(domA.example.net domB.example.net [...])
parallel -j10 --lb ./cypheroth.sh -d {} ::: "${DOMAINS[@]}"
Troubleshooting
If you are running an outdated version of cypher-shell you may receive the following error: DateTime is not supported as a return type in Bolt protocol version 1.
Please make sure driver supports at least protocol version 2.
Driver upgrade is most likely required.
To fix, update Neo4j (https://neo4j.com/download-center/) to the latest version.
Author
Chris Farrell (@seajay (https://twitter.com/seajay))
Acknowledgments
This tool wouldn't exist without BloodHound - developed by @_wald0 (https://twitter.com/_wald0), @CptJesus (https://twitter.com/CptJesus), and @harmj0y (https://twitter.com/harmj0y). Shoutout to the Bloodhound Slack (https://bloodhoundgang.herokuapp.com/) #cypher_queries channel for assistance Big ups to @TinkerSec (https://twitter.com/TinkerSec) - the bones of this project were straight up copy/pasted from his procdump script (https://github.com/tinkersec/scratchpad/blob/master/BashScripts/grabDump.sh) Many thanks to @awsmhacks (https://twitter.com/awsmhacks), @haus3c (https://twitter.com/haus3c) and @ScoubiMtl (https://twitter.com/ScoubiMtl) for collecting useful cypher queries (here (https://github.com/awsmhacks/awsmBloodhoundCustomQueries), here (https://hausec.com/2019/09/09/bloodhound-cypher-cheatsheet/) and here (https://github.com/Scoubi/BloodhoundAD-Queries/blob/master/BH%20Red2Blue.txt)) Hugely appreciate contributions from @chryzsh (https://twitter.com/chryzsh) and @mubix (https://twitter.com/mubix)!! All of the amazing contributions from @cnotin (https://twitter.com/cnotin)
Download Cypheroth (https://github.com/seajaysec/cypheroth)
Download Cypheroth (https://github.com/seajaysec/cypheroth)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Max : Maximizing BloodHound With A Simple Suite Of Tools
Description New Release: dpat – The BloodHound Domain Password Audit Tool (DPAT) A simple suite of tools: get-info – Pull lists of information from the Neo4j database mark-owned – Mark a list of objects as Owned mark-hvt – Mark a list of objects as High Value Targets query – Run a raw Cypher query and […]
The post Max : Maximizing BloodHound With A Simple Suite Of Tools appeared first on Kali Linux Tutorials.
Max : Maximizing BloodHound With A Simple Suite Of Tools
Description New Release: dpat – The BloodHound Domain Password Audit Tool (DPAT) A simple suite of tools: get-info – Pull lists of information from the Neo4j database mark-owned – Mark a list of objects as Owned mark-hvt – Mark a list of objects as High Value Targets query – Run a raw Cypher query and […]
The post Max : Maximizing BloodHound With A Simple Suite Of Tools appeared first on Kali Linux Tutorials.