Black Hat Ethical Hacking
Cisco Secure Email bug can let attackers bypass authentication

Cisco Secure Email bug can let attackers bypass authenticationPost Views: 1
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
Cisco notified customers this week to patch a critical vulnerability that could allow attackers to bypass authentication and login into the web management interface of Cisco email gateway appliances with non-default configurations.
The security flaw (tracked as CVE-2022-20798) was found in the external authentication functionality of virtual and hardware Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager appliances.

CVE-2022-20798 is due to improper authentication checks on affected devices using Lightweight Directory Access Protocol (LDAP) for external authentication.

“An attacker could exploit this vulnerability by entering a specific input on the login page of the affected device,” Cisco explained.

“A successful exploit could allow the attacker to gain unauthorized access to the web-based management interface of the affected device.”

An advisory published on Wednesday says the bug was discovered during the resolution of a Cisco TAC (Technical Assistance Center) support case.

Cisco’s Product Security Incident Response Team (PSIRT) said it’s not aware of any publicly available exploits for this security bug or malicious use of the vulnerability in the wild.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Doesn’t affect default configurationsThis bug only affects appliances configured to use external authentication and LDAP as the authentication protocol.

Luckily, according to Cisco, the external authentication feature is disabled by default, meaning only devices with non-default configurations are impacted.

To check if external auth is enabled on your appliance, log into the web-based management interface, go to System Administration > Users, and look for a green check box next to “Enable External Authentication.”
See Also: This new Linux malware is ‘almost impossible’ to detect Cisco also says this vulnerability does not affect its Cisco Secure Web Appliance product, previously known as Cisco Web Security Appliance (WSA).

Admins who cannot immediately install CVE-2022-20798 security updates can also apply a workaround that requires disabling anonymous binds on the external authentication server.

Another Secure Email gateway flaw patched in February could allow remote attackers to crash unpatched appliances using maliciously crafted email messages.
See Also: Recon Tool: Domain Analyzer Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Today, Cisco also announced it wouldn’t fix a critical zero-day bug affecting end-of-life RV110W, RV130, RV130W, and RV215W SMB routers, allowing attackers to execute arbitrary commands with root-level privileges.
See Also: The Difference between Vulnerability Assessment and Pentesting
Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/android-malware-90x90.jpg Android malware on the Google Play Store gets 2 million downloads1 day [...]

___________________________
@hacking_Attack
@Hacking_Video

ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Linux-90x90.jpg New Linux rootkit, Syslogk uses magic packets to trigger backdoor2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Header-Python-Packages-Blog-Final-Image-90x90.jpg PyPI package ‘keep’ mistakenly included a password stealer3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/venom_superhero_movie_tom11_hardy-wallpaper-1920x1080-980x551-1-90x90.jpg This new Linux malware is ‘almost impossible’ to detect6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/ran-download-33-1-e1639685560151-90x90.jpeg Black Basta Ransomware Teams Up with Malware Stalwart Qbot7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/InstallerFileTakeOver-Zero-Day-Security-Vulnerability-All-Windows-OS-Versions-90x90.jpg New ‘DogWalk’ Windows zero-day bug gets free unofficial patches1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/ipad_update_1200x675-90x90.jpg Security Fixes Won’t Require Full iOS Update in iOS 16, Will Be Installed Automatically1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Confluence-90x90.jpg Exploit released for Atlassian Confluence RCE bug, update now1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/be60-article-210907-confluence-body-text-90x90.png Critical Atlassian Confluence zero-day actively used in attacks2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Microsoft-releases-solutions-for-a-zero-day-vulnerability-90x90.jpg New Windows Search zero-day added to Microsoft protocol nightmare2 weeks ago
The post Cisco Secure Email bug can let attackers bypass authentication first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

CSRF leads to account takeover in Yahoo!

How I managed to hack the accounts of arbitrary users of a Yahoo! application in only 30 minutes.Continue reading on Medium »
Read more...

https://b.thumbs.redditmedia.com/6Z40vf9sR6iSxrQUxRr8Qf40PDX-BqnKIIsNyCGdjUM.jpg submitted by /u/DrinkMoreCodeMore
[link] [comments]

Dark Reading: Attacks/Breaches
How Should I Think About Security When Considering Digital Transformation Projects?

Digital transformation helps businesses keep operating and to stay competitive. Here are the ways to think about security so that businesses reap the benefits without taking on associated risks.

Hacking on Medium
What is XML external entity injection?

https://cdn-images-1.medium.com/max/638/0*8VPnaHAvq_zlq1xK
ในส่วนนี้ เราจะอธิบายว่า XML external entity injection คืออะไร ใช้ประโยชน์จากการ XXE injection ประเภทโจมตีต่างๆ…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Offensive Security Tool: Mobile Security Framework (MobSF)

Offensive Security Tool: Mobile Security Framework (MobSF)Post Views: 4
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 4 Minutes GitHub Link Mobile Security Framework (MobSF)Performing Pentesting on Mobile Application by the Red Team means you are dealing with either APK (Android), IPA (IOS), or EXE (Windows), you need to have a vast knowledge of how you can perform not only automated tests and attacks but also Dynamic, which requires a special setup and specific tools, with special knowledge on how you can look under the hood within the source code itself, trying to find various range of vulnerabilities.

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. MobSF supports mobile app binaries (APK, XAPK, IPA & APPX) along with zipped source code and provides REST APIs for seamless integration with your CI/CD or DevSecOps pipeline. The Dynamic Analyzer helps you to perform runtime security assessment and interactive instrumented testing.
See Also: OSINT Tool: Metabigor Documentation* Try MobSF Static Analyzer Online: mobsf.live
* MobSF in CI/CD: mobsfscan
* Conference Presentations: Slides & Videos
* What’s New: See Changelog Static Analysis – Androidhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Static-Analysis-Android.png Static Analysis – Android Source Tree-viewhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Static-Analysis-Android-Source-Tree-view.png Static Analysis – iOShttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Static-Analysis-iOS.png Dynamic Analysis – Android APKhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Dynamic-Analysis-Android-APK.png Web API Viewerhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Web-API-Viewer.png See Also: The Difference between Vulnerability Assessment and Pentesting https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/metabigor-90x90.png OSINT Tool: Metabigor6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Domain-Analyzer-90x90.png Recon Tool: Domain Analyzer2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/deepsleep-90x90.png Offensive Security Tool: DeepSleep3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/qsreplace-90x90.png Recon Tool: qsreplace3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Arjun-90x90.png Offensive Security Tool: Arjun4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Dorks-collections-list-90x90.png Recon Tool: Dorks collections list4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/malicious-pdf-90x90.png Offensive Security Tool: malicious-pdf1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/scanmycode-90x90.png Static Code Analysis Tool: scanmycode-ce1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/MOSINT-1-90x90.png OSINT Tool: MOSINT2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/findomain-90x90.png Recon Tool: Findomain2 months ago
The post Offensive Security Tool: Mobile Security Framework (MobSF) first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Admin-Panel_Finder - A Burp Suite Extension That Enumerates Infrastructure And Application Admin Interfaces (OTG-CONFIG-005)
http://www.kitploit.com/2022/06/admin-panelfinder-burp-suite-extension.html

___________________________
@hacking_Attack
@Hacking_Video

A burp suite extension (https://www.kitploit.com/search/label/Burp%20Suite%20Extension) that enumerates infrastructure (https://www.kitploit.com/search/label/Infrastructure) and application Admin Interfaces.

OWASP References: Classification: Web Application Security Testing > 02-Configuration and Deployment Management (https://www.kitploit.com/search/label/Management) Testing OTG v4: OWASP OTG-CONFIG-005 WSTG: WSTG-CONF-05 (https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/05-Enumerate_Infrastructure_and_Application_Admin_Interfaces)

Why should I use this extension? Multi-thread Different and configurable levels of test. Includable status codes Excludable status codes More than 1000 built-in payloads. You can load your dictionary. Editable root directory Automatic detection of used technologies to generate custom payloads. Passive listening to find login pages. Installation The quickest way is to load the jar file (adminPanelFinder.jar) in the extender tab of the Burpsuite.
Extender -> Extensions -> Add
A new tab will be added to the burp suite.
Quick Start Select a request of a target host from any tab of the burp suite (https://www.kitploit.com/search/label/Burp%20Suite) (it must have a response with any status code) In the "Admin Panel Finder -> options" tab, apply your configurations. Go to the "Admin Panel Finder -> Finder -> Finder" tab and click on the "start" button. Some of the options These options can be used to customize the detection: Level: Level of tests to perform (1-5, default 3) Thread: num of threads (1-50, default 10) Built-in dictionary: there is a built-in dictionary (https://www.kitploit.com/search/label/Dictionary) containing the most used directory and file names to be used for static payload generation. Loadable dictionary: you can use your dictionary file for static payload generation. HTTP method: HTTP method to be used in requests (HEAD, GET)(default: Head) Extension: The extension used in application pages. [Example: php, asp, aspx, jsp, ...] Root Dir: The path to the root directory of the web application. (Default: /) Includable status codes Excludable status codes Disclaimer This program is for educational purpose ONLY. Do not use it without permission. The usual disclaimer applies, especially the fact that I'm not liable for any damages caused by the direct or indirect use of the information or functionality provided by these programs. The author or any Internet provider bears NO responsibility for content or misuse of these programs or any derivatives thereof. By using these programs you accept the fact that any damage (data loss, system crash, system compromise, etc.) caused by the use of this program is not my responsibility. Contact If you have any further questions, please don't hesitate to contact me via my twitter (https://twitter.com/MoeinFatehi) account.

Download Admin-Panel_Finder (https://github.com/moeinfatehi/Admin-Panel_Finder)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it possible to get hacked just by getting redirected to a compromissed website?

Is it really possible that you could get hacked so easy?

And what operating systems are most vulnerable?

submitted by /u/yowhaazzup
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
BITB : Browser In The Browser (BITB) Templates

BITB is a Browser templates for Browser In The Browser (BITB) attack.

Usage

Each folder has a index.htmlfile which has 4 variables that must be modified:

* XX-TITLE-XX – The title that shows up for the page (e.g. Sign in to your account now)
* XX-DOMAIN-NAME-XX – Domain name you’re masquerading as. (e.g. gmail.com)
* XX-DOMAIN-PATH-XX – Domain path (e.g. /auth/google/login)
* XX-PHISHING-LINK-XX – Phishing link which will be embedded into the iFrame (e.g. https://example.com)

Furthermore, if you’re using a Windows template you should update the logo.svgwhich is the icon of the website you’re masquerading as. The default logo is Microsoft.

Windows-DarkMode-Delay

The Windows-DarkMode-Delay folder makes use of jQuery’s fadeIn() function to add a slight delay to the pop-up window as it appears. This is only one way of making the Window appear in a delayed fashion, there’s various other ways to do the same.

Detecting Color Preference

To get the most out of this you should determine the OS from the user agent and the color preference and display the appropriate template.

To find out if you should use dark or light templates check out: https://stackoverflow.com/questions/50840168/how-to-detect-if-the-os-is-in-dark-mode-in-browsers

Detecting BITB

Dragging the Window

One way of detecting BITB is by attempting to drag the window to the edge of the browser. If the window cannot escape the browser then it’s not a real window.

Browser Extension

@odacavo released a great browser extension that can detect and warn users about embedded iframes. It’s available here: https://github.com/odacavo/enhanced-iframe-protection.
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
O365-Doppelganger : A Quick Handy Script To Harvest Credentials Off Of A User

O365-Doppelganger is NOT a replacement for hardcore phishing activities. There are several other tools which perform OAuth and OTA capture which is not the aim of O365-Doppelganger.

O365-Doppelganger is a quick handy script to harvest credentials of a user during Red Teams. This repository is a quick hack of one of my old red team engagement scripts which I’ve used several times to capture credentials and use them for making windows access tokens for lateral movement. This code repository basically performs the below tasks:

* The GO code:
* hosts the O365 portal (can be replaced with anything in the index.html). It is recommended to use a valid cert and key file (LetsEncrypt?) instead of the one provided in the directory
* logs all user activity on the web portal in a seperate log file on the server
* logs the credentials captured in a seperate log file on the server
* can also be used to return a valid file to the user post capturing the credentials. This can be done by replacing the file named MacroFile.docin the current directory and replacing it with HTA/ISO/MSI or anything else that the phisher wants. Theres also a small code in the GO code which would need to be modified to specify the user’s file name which needs to be returned: content, err := ioutil.ReadFile("MacroFile.doc")
* Once modified, the target user when enters a valid email ID and password will be asked to save the above file. This file name can be changed using the below code in the GO file: response.Header().Set("Content-Disposition", "attachment; filename=Darkvortex Privacy Policy.doc")

* The index.html code:
* renders an O365 portal alongside a small regex which checks for a given user’s domain name to make it look a bit more legit. The regex code looks like this: pattern="^([a-zA-Z0-9_\-\.]+)@darkvortex\.([a-zA-Z]{2,5})$" title=" Valid darkvortex email ID"
* The above regex checks if the given username contains a full valid email address else it will prompt the user to enter a correct username as follows:

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1aaktcxuOneFbpyT4WuMdDagm1li4rCZyQXYL04Hg8JjFvF5aQRFwsj7jJG-lYTuOsFTVVuUlNi3X3taPpLNTK_1pAYySuUGFfUxTug1D3eWSmKErKVeD6LtAaDo36rL93aksW6knFgq4CHIdXu1607r920Q7YsWWbXSZYb6Pl3-phgRgJYKgSMDp/s1917/18.png
* This same check is also performed in the GO code so that user’s do not use something like burp to bypass the check: if strings.Contains(value[i], "@darkvortex") {
* It’s recommended to change the name darkvortex in the index.html file to your own target company name.
* Once the correct email ID and the password is entered, the user will be asked to save the provided file as follows:
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRsDQ9oYu3ikJGPIjzrtArkGxyRpZ_qsPO-NQnJTUgKQv1SsqDv7o3Ekn956Gmzs6-VXfKtkPT5_jaF1GiVtXph2oVY4fYsPbP6MYsr96Ifa1-pQPzWDMTLKc0iJKz6_uFRdREo8FjgAK_pKLbBeBb41FQBfl9zROPOzdQKsxJtD7aB_3Z6Xp4qgvu/s1907/img2.png

Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking into WordPress themes for CVEs and Fun.

Hi there! I hope all is well with you. In this writeup, I’ll discuss about the research I did on a WordPress theme, which taught me a lot…Continue reading on Pentester Nepal »
Read more...

Dark Reading: Attacks/Breaches
Are You Hiring Enough Entry-Level Security Pros?

New (ISC)² survey shows employment levels for entry-level cyber pros lag behind every other experience level.

Dark Reading: Attacks/Breaches
CISOs Gain False Confidence in the Calm After the Storm of the Pandemic

While CISOs may feel more confident in their security posture emerging from the pandemic, new research suggests that doesn't mean organizations are better prepared for large-scale attacks.

___________________________
@hacking_Attack
@Hacking_Video