KitPloit - PenTest Tools!
MITM_Intercept - A Little Bit Less Hackish Way To Intercept And Modify non-HTTP Protocols Through Burp And Others

___________________________
@hacking_Attack
@Hacking_Video

MitM attack over RDP scary easy
https://www.reddit.com/r/Pentesting/comments/v38mtd/mitm_attack_over_rdp_scary_easy/

So I’ve been dabbling in kali and pen testing for years off an on starting in highschool. So my roommate has a server and gave me a challenge to find a way into it with no physical attacks. I decided it would be a great chance to really get back into pen testing. I’ve only ever used vulnerabilities on dated vms running known exploitable services. After attempting to use specific vulnerabilities I found through the services he had running to no success, I decided I would try a man in the middle attack. I had no experience so it was a lot of fun using ettercap, and after successfully getting in the middle I found as I had predicted there was nothing but encrypted data. I almost let it go there, but then I started thinking about how he logs into his server, through Remote Desktop for windows from his laptop. I had the idea that if I can get in the middle of his laptop and server as he is logging in, there could be very important data to be had. He decided to help me when I explained this to him as he was very interested if it could be done. Fast forward to 2 hours later that night and we found a git for a program called Seth, which uses ARP poisoning to get in the middle of the RDP session as the user is logging in, then clones the certificate of the session and swipes both the user/pass hash and then the plaintext username and pass. All that is required of the victim is accepting the unauthenticated certificate created by the program. I’m sure most people on this sub would know not to accept unknown certs, but I think you would be surprised how many people don’t even think twice. submitted by /u/Source256 (https://www.reddit.com/user/Source256)
[link] (https://www.reddit.com/r/Pentesting/comments/v38mtd/mitm_attack_over_rdp_scary_easy/) [comments] (https://www.reddit.com/r/Pentesting/comments/v38mtd/mitm_attack_over_rdp_scary_easy/)

___________________________
@hacking_Attack
@Hacking_Video

Searching for Sources
https://www.reddit.com/r/Pentesting/comments/v3b39i/searching_for_sources/

Hi, I'm new to this. I started using Linux and try to scan my own network as a practice, But this is not enough to become a professional. I need sources like books or websites to learn how to use tools like "Nmap" as a professional Pentester.
Thanks submitted by /u/Primm_Slimm69 (https://www.reddit.com/user/Primm_Slimm69)
[link] (https://www.reddit.com/r/Pentesting/comments/v3b39i/searching_for_sources/) [comments] (https://www.reddit.com/r/Pentesting/comments/v3b39i/searching_for_sources/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Best USB WiFi Adapters for Kali Linux

https://external-preview.redd.it/FYNNUWIXd48854pGTT_gwbQKvf_EZ1UGUMSl0khnAuM.jpg?width=640&crop=smart&auto=webp&s=d3e39483bca61800ffb30df47fb4a6ced132c2a1 submitted by /u/ArifSagar
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Mounted hard drive encryption

Hi everybody,

It is possible to mount encrypted hard drive(Windows 10) on linux without having private key ??

submitted by /u/JackLemaitre
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Product Show Room Site 1.0 Cross Site Scripting

https://3.bp.blogspot.com/-D2NV3HnXxpM/WWlu9YoBNhI/AAAAAAAAIJs/rLrqFdeLLWYSGUQPyN0O7DuhnXu7T_FjQCLcBGAs/s1600/h114.png Product Show Room Site version 1.0 suffers from multiple persistent cross site scripting vulnerabilities.

SHA-256 | a796961a488458cb4bb41f2e00c8a65730ac1bded2e03daff8ea9786a74d591eDownload # Product Show Room Site - 'Telephone' Stored Cross-Site Scripting(XSS)
#### Exploit Title: Product Show Room Site - 'Telephone' Stored Cross-Site Scripting(XSS)
#### Exploit Author: webraybtl@webray.com.cn inc
#### Vendor Homepage: https://www.sourcecodester.com/php/15370/product-show-room-site-phpoop-free-source-code.html
#### Software Link: https://www.sourcecodester.com/download-code?nid=15370&title=Product+Show+Room+Site+in+PHP%2FOOP+Free+Source+Code
#### Version: Product Show Room Site 1.0
#### Tested on: Windows Server 2008 R2 Enterprise, Apache ,Mysql

#### Description
Persistent XSS (or Stored XSS) attack is one of the three major categories of XSS attacks, the others being Non-Persistent (or Reflected) XSS and DOM-based XSS. In general, XSS attacks are based on the victim’s trust in a legitimate, but vulnerable, website or web application.Product Show Room Site does not filter the content correctly at the "Contact info-Telephone" module, resulting in the generation of stored XSS.

#### Payload used:
``

#### Proof of Concept

1. Login the CMS.
Default Admin Access
Username: admin
Password: admin123

1. Open Page http://172.24.5.107/psrs/admin/?page=system_info/contact_info and click View button

2. Put XSS payload (``) in the Telephone box and click on Update to publish the page
![image](https://user-images.githubusercontent.com/60683449/171591851-2068eea2-b789-464f-8afb-9f6b6f8eaedd.png)

3. Open http://172.24.5.107/psrs/?p=contact,Viewing the successfully published page,We can see the alert.
![image](https://user-images.githubusercontent.com/60683449/171591881-2962a429-f2de-4979-8e27-6fdd8f62c61c.png)
-------
# Product Show Room Site - 'Message' Stored Cross-Site Scripting(XSS)
#### Exploit Title: Product Show Room Site - 'Message' Stored Cross-Site Scripting(XSS)
#### Exploit Author: webraybtl@webray.com.cn inc
#### Vendor Homepage: https://www.sourcecodester.com/php/15370/product-show-room-site-phpoop-free-source-code.html
#### Software Link: https://www.sourcecodester.com/download-code?nid=15370&title=Product+Show+Room+Site+in+PHP%2FOOP+Free+Source+Code
#### Version: Product Show Room Site 1.0
#### Tested on: Windows Server 2008 R2 Enterprise, Apache ,Mysql

#### Description
Persistent XSS (or Stored XSS) attack is one of the three major categories of XSS attacks, the others being Non-Persistent (or Reflected) XSS and DOM-based XSS. In general, XSS attacks are based on the victim’s trust in a legitimate, but vulnerable, website or web application.Product Show Room Site does not filter the content correctly at the "Contact info-Telephone" module, resulting in the generation of stored XSS.

#### Payload used:
``

#### Proof of Concept

1. Login the CMS.
Default Admin Access
Username: admin
Password: admin123

1. Open Page http://172.24.5.107/psrs/?p=contact

2. Put XSS payload (``) in the Message box and click on Send Message to publish the page
![image](https://user-images.githubusercontent.com/60683449/171591580-cc3ca01c-9e37-4e05-9351-4b9d7c7749df.png)
![image](https://user-images.githubusercontent.com/60683449/171591599-be5e8d7f-1d95-43ad-875a-9884f7052fa6.png)
4. Open http://172.24.5.107/psrs/admin/?page=inquiries,Viewing the Top 1 of Inquiries page,We can see the alert.
![image](https://user-images.githubusercontent.com/60683449/171591660-c12ce9ac-aab1-45e9-b99f-7514dd28f698.png) Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Have we learned anything from the attacks by lapsus?

https://external-preview.redd.it/Kiskj3Bh1j8Z-6aX0gWi5N5wWAAlVr2R0Oyo9b0LhWg.jpg?width=320&crop=smart&auto=webp&s=b0ad207febbfb347015804c9bcea47463eafa24a submitted by /u/TheDigitalPrepper
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Fighting Follina: Application Vulnerabilities and Detection Possibilities

Although organizations should perform proper risk analysis and patch as soon as practical after there's a fix for this vulnerability, defenders still have options before that's released.

Dark Reading: Attacks/Breaches
'Clipminer' Malware Actors Steal $1.7 Million Using Clipboard Hijacking

The malware targets Windows users via Trojanized downloads of cracked or pirated software and then starts in on cryptocurrency mining and clipboard hijacking.

Dark Reading: Attacks/Breaches
Building America's Cybersecurity Infrastructure

The government is putting the right skills and expertise in place to fight the rising cyber threat.

Hacking on Medium
Hacking an AWS hosted Kubernetes backed product, and failing

https://cdn-images-1.medium.com/max/1920/1*Xl4Qt0EvIav3BuzlK4cCdw.jpeg
Tales from a recent pentest of a product hosted on the AWS cloud backed by Kubernetes (EKS) and a whole lot of secure design goodness that…

Continue reading on Appsecco »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Did you know that users can modify your JavaScript variables from Browser console?

https://cdn-images-1.medium.com/max/959/1*mXzNJ6aLwZUzbsFvMsfe6g.gif
You wouldn’t believe how easy it is to mess with client-side scripts. If you too use JS in your frontend to make backend calls, read along!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HOT QUICK Cashapp Paypal Western Union Transfer Secured High balance bank transfer

ALBERT’S CASH TEAM SERVICE WORLDWIDE(GET RICH NOW/SOLVE ALL PROBLEM NOW)

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How CoFix user’s got hacked 150K USDT

https://cdn-images-1.medium.com/max/1188/1*bqx3x8Um5ZA27cHJOXsJEA.png
Hello there and warm welcome to Elessar Labs! We are a Hong Kong based blockchain R&D team specialized in ecosystem security.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video