Dark Reading: Attacks/Breaches
How Should I Think About Security When Considering Digital Transformation Projects?

Digital transformation helps businesses keep operating and to stay competitive. Here are the ways to think about security so that businesses reap the benefits without taking on associated risks.

Hacking on Medium
What is XML external entity injection?

https://cdn-images-1.medium.com/max/638/0*8VPnaHAvq_zlq1xK
ในส่วนนี้ เราจะอธิบายว่า XML external entity injection คืออะไร ใช้ประโยชน์จากการ XXE injection ประเภทโจมตีต่างๆ…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Offensive Security Tool: Mobile Security Framework (MobSF)

Offensive Security Tool: Mobile Security Framework (MobSF)Post Views: 4
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 4 Minutes GitHub Link Mobile Security Framework (MobSF)Performing Pentesting on Mobile Application by the Red Team means you are dealing with either APK (Android), IPA (IOS), or EXE (Windows), you need to have a vast knowledge of how you can perform not only automated tests and attacks but also Dynamic, which requires a special setup and specific tools, with special knowledge on how you can look under the hood within the source code itself, trying to find various range of vulnerabilities.

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. MobSF supports mobile app binaries (APK, XAPK, IPA & APPX) along with zipped source code and provides REST APIs for seamless integration with your CI/CD or DevSecOps pipeline. The Dynamic Analyzer helps you to perform runtime security assessment and interactive instrumented testing.
See Also: OSINT Tool: Metabigor Documentation* Try MobSF Static Analyzer Online: mobsf.live
* MobSF in CI/CD: mobsfscan
* Conference Presentations: Slides & Videos
* What’s New: See Changelog Static Analysis – Androidhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Static-Analysis-Android.png Static Analysis – Android Source Tree-viewhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Static-Analysis-Android-Source-Tree-view.png Static Analysis – iOShttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Static-Analysis-iOS.png Dynamic Analysis – Android APKhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Dynamic-Analysis-Android-APK.png Web API Viewerhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Web-API-Viewer.png See Also: The Difference between Vulnerability Assessment and Pentesting https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/metabigor-90x90.png OSINT Tool: Metabigor6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Domain-Analyzer-90x90.png Recon Tool: Domain Analyzer2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/deepsleep-90x90.png Offensive Security Tool: DeepSleep3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/qsreplace-90x90.png Recon Tool: qsreplace3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Arjun-90x90.png Offensive Security Tool: Arjun4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Dorks-collections-list-90x90.png Recon Tool: Dorks collections list4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/malicious-pdf-90x90.png Offensive Security Tool: malicious-pdf1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/scanmycode-90x90.png Static Code Analysis Tool: scanmycode-ce1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/MOSINT-1-90x90.png OSINT Tool: MOSINT2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/findomain-90x90.png Recon Tool: Findomain2 months ago
The post Offensive Security Tool: Mobile Security Framework (MobSF) first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Admin-Panel_Finder - A Burp Suite Extension That Enumerates Infrastructure And Application Admin Interfaces (OTG-CONFIG-005)
http://www.kitploit.com/2022/06/admin-panelfinder-burp-suite-extension.html

___________________________
@hacking_Attack
@Hacking_Video

A burp suite extension (https://www.kitploit.com/search/label/Burp%20Suite%20Extension) that enumerates infrastructure (https://www.kitploit.com/search/label/Infrastructure) and application Admin Interfaces.

OWASP References: Classification: Web Application Security Testing > 02-Configuration and Deployment Management (https://www.kitploit.com/search/label/Management) Testing OTG v4: OWASP OTG-CONFIG-005 WSTG: WSTG-CONF-05 (https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/05-Enumerate_Infrastructure_and_Application_Admin_Interfaces)

Why should I use this extension? Multi-thread Different and configurable levels of test. Includable status codes Excludable status codes More than 1000 built-in payloads. You can load your dictionary. Editable root directory Automatic detection of used technologies to generate custom payloads. Passive listening to find login pages. Installation The quickest way is to load the jar file (adminPanelFinder.jar) in the extender tab of the Burpsuite.
Extender -> Extensions -> Add
A new tab will be added to the burp suite.
Quick Start Select a request of a target host from any tab of the burp suite (https://www.kitploit.com/search/label/Burp%20Suite) (it must have a response with any status code) In the "Admin Panel Finder -> options" tab, apply your configurations. Go to the "Admin Panel Finder -> Finder -> Finder" tab and click on the "start" button. Some of the options These options can be used to customize the detection: Level: Level of tests to perform (1-5, default 3) Thread: num of threads (1-50, default 10) Built-in dictionary: there is a built-in dictionary (https://www.kitploit.com/search/label/Dictionary) containing the most used directory and file names to be used for static payload generation. Loadable dictionary: you can use your dictionary file for static payload generation. HTTP method: HTTP method to be used in requests (HEAD, GET)(default: Head) Extension: The extension used in application pages. [Example: php, asp, aspx, jsp, ...] Root Dir: The path to the root directory of the web application. (Default: /) Includable status codes Excludable status codes Disclaimer This program is for educational purpose ONLY. Do not use it without permission. The usual disclaimer applies, especially the fact that I'm not liable for any damages caused by the direct or indirect use of the information or functionality provided by these programs. The author or any Internet provider bears NO responsibility for content or misuse of these programs or any derivatives thereof. By using these programs you accept the fact that any damage (data loss, system crash, system compromise, etc.) caused by the use of this program is not my responsibility. Contact If you have any further questions, please don't hesitate to contact me via my twitter (https://twitter.com/MoeinFatehi) account.

Download Admin-Panel_Finder (https://github.com/moeinfatehi/Admin-Panel_Finder)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it possible to get hacked just by getting redirected to a compromissed website?

Is it really possible that you could get hacked so easy?

And what operating systems are most vulnerable?

submitted by /u/yowhaazzup
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
BITB : Browser In The Browser (BITB) Templates

BITB is a Browser templates for Browser In The Browser (BITB) attack.

Usage

Each folder has a index.htmlfile which has 4 variables that must be modified:

* XX-TITLE-XX – The title that shows up for the page (e.g. Sign in to your account now)
* XX-DOMAIN-NAME-XX – Domain name you’re masquerading as. (e.g. gmail.com)
* XX-DOMAIN-PATH-XX – Domain path (e.g. /auth/google/login)
* XX-PHISHING-LINK-XX – Phishing link which will be embedded into the iFrame (e.g. https://example.com)

Furthermore, if you’re using a Windows template you should update the logo.svgwhich is the icon of the website you’re masquerading as. The default logo is Microsoft.

Windows-DarkMode-Delay

The Windows-DarkMode-Delay folder makes use of jQuery’s fadeIn() function to add a slight delay to the pop-up window as it appears. This is only one way of making the Window appear in a delayed fashion, there’s various other ways to do the same.

Detecting Color Preference

To get the most out of this you should determine the OS from the user agent and the color preference and display the appropriate template.

To find out if you should use dark or light templates check out: https://stackoverflow.com/questions/50840168/how-to-detect-if-the-os-is-in-dark-mode-in-browsers

Detecting BITB

Dragging the Window

One way of detecting BITB is by attempting to drag the window to the edge of the browser. If the window cannot escape the browser then it’s not a real window.

Browser Extension

@odacavo released a great browser extension that can detect and warn users about embedded iframes. It’s available here: https://github.com/odacavo/enhanced-iframe-protection.
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
O365-Doppelganger : A Quick Handy Script To Harvest Credentials Off Of A User

O365-Doppelganger is NOT a replacement for hardcore phishing activities. There are several other tools which perform OAuth and OTA capture which is not the aim of O365-Doppelganger.

O365-Doppelganger is a quick handy script to harvest credentials of a user during Red Teams. This repository is a quick hack of one of my old red team engagement scripts which I’ve used several times to capture credentials and use them for making windows access tokens for lateral movement. This code repository basically performs the below tasks:

* The GO code:
* hosts the O365 portal (can be replaced with anything in the index.html). It is recommended to use a valid cert and key file (LetsEncrypt?) instead of the one provided in the directory
* logs all user activity on the web portal in a seperate log file on the server
* logs the credentials captured in a seperate log file on the server
* can also be used to return a valid file to the user post capturing the credentials. This can be done by replacing the file named MacroFile.docin the current directory and replacing it with HTA/ISO/MSI or anything else that the phisher wants. Theres also a small code in the GO code which would need to be modified to specify the user’s file name which needs to be returned: content, err := ioutil.ReadFile("MacroFile.doc")
* Once modified, the target user when enters a valid email ID and password will be asked to save the above file. This file name can be changed using the below code in the GO file: response.Header().Set("Content-Disposition", "attachment; filename=Darkvortex Privacy Policy.doc")

* The index.html code:
* renders an O365 portal alongside a small regex which checks for a given user’s domain name to make it look a bit more legit. The regex code looks like this: pattern="^([a-zA-Z0-9_\-\.]+)@darkvortex\.([a-zA-Z]{2,5})$" title=" Valid darkvortex email ID"
* The above regex checks if the given username contains a full valid email address else it will prompt the user to enter a correct username as follows:

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1aaktcxuOneFbpyT4WuMdDagm1li4rCZyQXYL04Hg8JjFvF5aQRFwsj7jJG-lYTuOsFTVVuUlNi3X3taPpLNTK_1pAYySuUGFfUxTug1D3eWSmKErKVeD6LtAaDo36rL93aksW6knFgq4CHIdXu1607r920Q7YsWWbXSZYb6Pl3-phgRgJYKgSMDp/s1917/18.png
* This same check is also performed in the GO code so that user’s do not use something like burp to bypass the check: if strings.Contains(value[i], "@darkvortex") {
* It’s recommended to change the name darkvortex in the index.html file to your own target company name.
* Once the correct email ID and the password is entered, the user will be asked to save the provided file as follows:
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRsDQ9oYu3ikJGPIjzrtArkGxyRpZ_qsPO-NQnJTUgKQv1SsqDv7o3Ekn956Gmzs6-VXfKtkPT5_jaF1GiVtXph2oVY4fYsPbP6MYsr96Ifa1-pQPzWDMTLKc0iJKz6_uFRdREo8FjgAK_pKLbBeBb41FQBfl9zROPOzdQKsxJtD7aB_3Z6Xp4qgvu/s1907/img2.png

Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking into WordPress themes for CVEs and Fun.

Hi there! I hope all is well with you. In this writeup, I’ll discuss about the research I did on a WordPress theme, which taught me a lot…Continue reading on Pentester Nepal »
Read more...

Dark Reading: Attacks/Breaches
Are You Hiring Enough Entry-Level Security Pros?

New (ISC)² survey shows employment levels for entry-level cyber pros lag behind every other experience level.

Dark Reading: Attacks/Breaches
CISOs Gain False Confidence in the Calm After the Storm of the Pandemic

While CISOs may feel more confident in their security posture emerging from the pandemic, new research suggests that doesn't mean organizations are better prepared for large-scale attacks.

___________________________
@hacking_Attack
@Hacking_Video

Hacking into WordPress themes for CVEs and Fun.
https://medium.com/pentesternepal/hacking-into-wordpress-themes-for-cves-and-fun-bdde6c834344?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi there! I hope all is well with you. In this writeup, I’ll discuss about the research I did on a WordPress theme, which taught me a lot…Continue reading on Pentester Nepal » (https://medium.com/pentesternepal/hacking-into-wordpress-themes-for-cves-and-fun-bdde6c834344?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

$700 Bounty writeup
https://medium.com/@tobydavenn/700-bounty-writeup-28ec1f310831?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video