Hacking on Medium
Exploit Development: The Most Important Skill A Hacker Can Learn

https://cdn-images-1.medium.com/max/2560/1*rKNLpfBUgaezi0mKKy3_cg.jpeg
While knowing about all the latest hacking technologies is certainly helpful for a wannabe hacker, it isn’t the only thing you need to…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe : Colddbox Write-up

https://cdn-images-1.medium.com/max/1400/0*gZrkwfmQXK0WDz1O.png
author — SATYAM PATHANIA

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

How I secured ISP (Internet Service Provider)
https://medium.com/@maramsaiharsha128/how-i-secured-isp-internet-service-provider-60920cb7d51e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello everyone hope all are safe and doing good. I am Cypher_Jerry Aka Harsha from Telangana, and a part-time bug bounty hunter.Continue reading on Medium » (https://medium.com/@maramsaiharsha128/how-i-secured-isp-internet-service-provider-60920cb7d51e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Caldera: Red Team Emulation (Part 1)

This article aims to demonstrate an open-source breach & emulation framework through which red team activity can be conducted with ease. It focuses on MITRE simulation and has tons of other functions that can be used in the activity.

Table of Contents· Pre-requisite & dependenciesCampaigns· Step1: Abilities ConclusionMitre Att&ckMitre framework provides list of all the Tactics, Techniques and Procedure (TTPs) & their corresponding sub-techniques arranged in a well-structured form which can be used in red team activities.CalderaCALDERA breach & emulation tool designed to easily automate adversary emulation, assist manual red-teams, and automate incident response.The core system:This is the framework code, consisting of what is available in this repository. Included is an asynchronous command-and-control (C2) server with a REST API and a web interface.Plugins:These repositories expand the core framework capabilities and providing additional functionality. Examples include agents, reporting, collections of TTPs and more.Pre-requisite & dependenciesThese requirements are for the computer running the core framework:InstallationFollow these steps for setting up caldera:git clone https://github.com/mitre/caldera.git --recursivehttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEguVaqh-QQaeCGiN858M7A8pkWvV3BFyuS_E_xiSE2UQ0LXWXHXbh_SImDaDrr_T-dztmDY9guusDhaTbi10jfAxQLRfGH5fKT63MNfgc51NKgJPSuG-o85_RNzqdVM7ZFPiQuZxdjulRt7RjvA-VZqAUSRWyNRpoMgJT7aqu0b6vZ9AelZb_go1AtylA/s16000/1.png cd caldera –insecurehttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAIfh3Ra6ydFJ1f1HfltbyY_HHC9yNugHIwLh-a-w7Rf2Aok45aJS3B9w2-acduxLE_PYEdqeZGpPYzly9z6iNF1yc5l6tbWll-O9pJ1-HH9a4bJtnQg9b2hERJovEedd5y1t2YnuyiuWFTGm5zKQPMth1TGj6Wtk6yIuGS6B_WU_OICGvEncD5PLxow/s16000/2.png InterfaceCaldera provides web interface which is simple to navigate and use.http://127.0.0.1:8888https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEic7DYVpDLQI-0W8-JpQIt-lioSTPCd4nKRQ_l1x4guI0iw0KL7sSYz_CdLjfFMd763sAGHPlHynOFi9lMXWwR6JoA6zSUEFPX2tFvE-Db-28a1rk-1yW-yo6Te9sXB2Wr-sr3xxo0tzD8hXYR4UEgatg-PYMfGC-8rrWan1QEfqKw54JjnpkMt3_E-8A/s16000/3.png https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgP3STTZlSiz1H01unjLETZOAshF9WXCrE3RI5RIpiS5QvH2WmSznsuQeodXBb4yBGRZ8trCKnT3Oza6oKM8XzS8PF1dvtfytvSGrItr41dIfF1p50KENWl76JRK166jDoOReds2Ctmjr0izlEUwzfCgI8oKqzpTfXpi8Gqqw0YnyHHC6x0iC6-fepiww/s16000/4.png PluginsThe Plugins category offers a list of all current plugins and allows you to quickly and easily access their functionality. ___________________________
@hacking_Attack
@Hacking_Video

p

· Builder (Dynamically compile payloads)CampaignsAgents, adversaries, and operations make up the Campaigns category, which may be used to build up the numerous agents, adversaries, and operations needed for a red team operation or adversary emulation.Step1: Deploy an AgentsTo begin with initial access we need to implant an agent inside the target system. Darwin [mac OS]) (Bypass the execution policy first)___________________________
@hacking_Attack
@Hacking_Video

e victim end was successful Step2: AbilitiesAn ability is a specific ATT&CK tactic/technique implementation which can be executed on running agents. Abilities will include the command(s) to run, the platforms / executors the commands can run on (ex: Windows / PowerShell), payloads to include, and a reference to a module to parse the output on the CALDERA server.Step3: Setting up OperationsAfter setting up the agent, now it is time to run the abilities or the set of instructions as shown above. For this we need to set up an operationAdversary Profiles are collections of ATT&CK TTPs, designed to create specific effects on a host or network. Profiles can be used for offensive or defensive use cases.) https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9O_BOgV4ntEJ8vvweuS5w0YpJS479h46XGM0z5MQT3E8ngK2I15uquRyJoAS1e7drC1-jPsqua6R_1e1Aq4--LZBah2iXv-yDpKZd8s_idEB-udPfWOpCT-79jqBE10vw61tz50oegHlai9GIoofAHk-Er_YXv8swVPlXkpz9ASFQRlwVmx7Djv2CXA/s16000/18.png 6. As you can see, all set of commands running is obfuscated in base64nopaddformat (also you can select other options specified), we can also see the command and also, we can view output of the command (Also, we can see the status of the task performed) https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0SJPpWNdI6yTpXOrmSEL4rmGqsYZtzaKci3YSFXx-0SinjwY8qljYq9dvFzaJXMc79FV58-ro1ejU57INFCW8nXjVEul_XsJA29RDvyud_uLlUnOMGFCf9WcezyL-qC6TmDu7lpPY3smtWUnwuusWRLRo90kxQ51maHC7XH4I3RFiwuUhfofh5yjdgw/s16000/19.png https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIg-dosfSEVftrsHmZ_A4ONUMZQbg-9HlOtFrlDLHdMbaCEWhRDbJV1Jpo8b7QFIRVm0vDlwlcNVZeEqyyPL1vlptRgONH9rgE-mnkVok8q5hI0t7KSOKthgIDQbdDjfuE5EJT6O2bJE-qbBoqqfmNv-FpFzRkoMXIiYBqzvLfXHazS7-9o5Z_W5f4Bg/s16000/20.png Step4: Exporting the resultAfter the activity has been completed,[...]

___________________________
@hacking_Attack
@Hacking_Video

we can extract the report in two ways:debrief tab, choose the pointers to be included in the report; then download the full report as PDFAuthor:Ankit Sinhais an infosec researcher___________________________
@hacking_Attack
@Hacking_Video

Are these skills are enough to get me a decent entry level job in pentesting ?
https://www.reddit.com/r/Pentesting/comments/vdtnb3/are_these_skills_are_enough_to_get_me_a_decent/

<!-- SC_OFF -->I am studying engineering (1.5 years left to graduate) and wanna drop out badly, i am based in Egypt and wondering if these skills are enough to get me a decent entry level job in pentesting (remote or not) once i drop out.
- 2 years experience in bug bounty hunting (only like 20 valid bugs cause it was besides college (xss, info disclosures, etc)) - solid programming experience ( been programming as a hobby for over 6 years honestly thats about it, i also know stuff like basic networking, linux (main OS), owasp top ten and more but the two points i mentioned earlier are best of what i can put on a resume.
i also went for OSCP once and failed, gonna retake it but don't wanna put it here as a certainty of course :)
Lets say i take a few months after dropping out to improve my resume, start a blog, write a few technical writeups, explain sec stuff and what not, also maybe find a few CVES to add to resume, is this enough to start applying ? how will not having a degree affect my chances? <!-- SC_ON --> submitted by /u/watermelonSoundsNice (https://www.reddit.com/user/watermelonSoundsNice)
[link] (https://www.reddit.com/r/Pentesting/comments/vdtnb3/are_these_skills_are_enough_to_get_me_a_decent/) [comments] (https://www.reddit.com/r/Pentesting/comments/vdtnb3/are_these_skills_are_enough_to_get_me_a_decent/)

hacking: security in practice
How to Browse the Dark Web Without Scarring Your Soul

"Across the world, people are growing increasingly and legitimately worried about corporate or government monitoring. In response to censorship of free speech on all major social networks, as well as whistleblower revelations concerning deep-reaching domestic surveillance programs, the dark web has experienced a surge in visitors."

https://noblesapien.com/mind/how-to-browse-the-dark-web-safely/

submitted by /u/Daniel_Brett_1976
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
CVE-2022-32969 - Insecure permissions vulnerability in MetaMask and other browser extension cryptocurrency wallets

submitted by /u/CyberMasterV
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
That Pipe is Still Leaking: Revisiting the RDP Named Pipe Vulnerability

https://external-preview.redd.it/pwRuG1RAN1S10LIDtwgWJv513XgwaRSMm1mG2Wgy4-0.jpg?width=640&crop=smart&auto=webp&s=9f0cc18fc3b6e86d1f48eed069a7ccbe8e2f1d46 submitted by /u/jat0369
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Frostbyte - FrostByte Is A POC Project That Combines Different Defense Evasion Techniques To Build Better Redteam Payloads
http://www.kitploit.com/2022/06/frostbyte-frostbyte-is-poc-project-that.html

___________________________
@hacking_Attack
@Hacking_Video

FrostByte Progolue: In the past few days I've been experimenting with the AppDomain manager injection (https://gist.github.com/djhohnstein/afb93a114b848e16facf0b98cd7cb57b) technique had a decent success with it in my previous Red Team engagements against certain EDRs. Although, this is really good for initial access vector, I wanted to release a POC which will help hiding your shellcode elsewhere. No more shellcode embedded DLL files!
The Problem! Although it is an excellent technique when used independently, but when coupled with a delivery technique like sending a C# ClickOnce inside an ISO/ZIP/VHD/VHDX file. The real problem is 1 out of 10 times the DLL for the appdomain was detected by AI/ML heurestics of the AV/EDR. This is because the DLL file needs to be dropped on the disk before initializing the appdomain. Ignoring the remote DLL loads for the time being (UNC paths in .config), the DLL for the appdomain would contain the shellcode and I strongly felt that is the reason for a probable static detection, because the rest of the code which is WINAPI calls can be dynamically resolved and pretty well obfuscated. I wanted to enhance this technique in terms of minimizing what the DLL would initially hold. I started by dropping encrypted shellcode in a separate file on disk along with the injector DLL but then I came across this amazing blog from Checkpoint on Zloader's Campaign (https://research.checkpoint.com/2022/can-you-trust-a-files-digital-signature-new-zloader-campaign-exploits-microsofts-signature-verification-putting-users-at-risk/) TLDR version: We can embed arbitrary data into some fields within the PE in a way that would not break the files Signature. So our data will get embedded and the exe will still remain digitally signed. More info on this - https://www.blackhat.com/docs/us-16/materials/us-16-Nipravsky-Certificate-Bypass-Hiding-And-Executing-Malware-From-A-Digitally-Signed-Executable-wp.pdf So the idea is to embed an encrypted shellcode stub into a known signed executable and still manage to keep it signed like how the Zloader malware did. By doing so the AppDomain Manager DLL will no longer contain the shellcode within itself, but will just have the logic to parse the shellcode from the PE binary that loads it to decrypt and execute as a seperate thread. Doing this might decrease the static detection rate for the DLL while your shellcode is nicely placed inside a signed binary. I was trying to achieve this by manually tampering with the ZLoader samples I got from VirusTotal, but later found about a project which had already implemented all of these techniques pretty well - Sigflip (https://github.com/med0x2e/SigFlip). In this POC I leveraged Sigflip's loader code to build the AppDomain DLL and SigFlip injector to embed the encrypted shellcode into our C# exe. Advantages: Large blobs of shellcode like Cobalt Strike's Stageless shellcode will no longer reside on an unsigned DLL on disk, irrespective of the obfuscation (https://www.kitploit.com/search/label/Obfuscation) / encoding techniques used. The DLL is cleaner, smaller and stealthier with minimal code thereby reducing the changes of detection. Working

___________________________
@hacking_Attack
@Hacking_Video

Steps to build Signed Shellcode Executable Pick any x64 Signed C# binary of your choice, a binary within which you would like cobalt strike beacon to reside and execute: E.g.: CasPol.exe etc. Generate your Cobalt Strike (https://www.kitploit.com/search/label/Cobalt%20Strike) Stageless Shellcode - x64-stageless.bin Place both of them into a folder where SigFlip (https://github.com/med0x2e/SigFlip) is also present and run the below command:
SigFlip.exe -i "Z:\ZLoader\CasPol.exe" "Z:\ZLoader\x64-stageless.bin" "Z:\ZLoader\update.exe" "S3cretK3y" Thanks to SigFlip now you have a (windows signed?) binary named update.exe which will be a digitally signed PE with encrypted shellcode embedded in it. Steps to build the AppDomain Loader DLL Take the C# Template Code from here (https://github.com/pwn1sher/frostbite/blob/main/test.cs) Replace your encryption (https://www.kitploit.com/search/label/Encryption) secret key with the one you chose while running SigFlip at Line:163 (you might have to adjust a few bytes to confirm if your CS shellcode is properly decrypted) Replace with the binary path at Line:146 Change the log file paths in lines: 158,165 Compile the code as DLL using the following command - csc /target:library /out:test.dll test.cs Place the compiled DLL and the update.exe.config (https://github.com/pwn1sher/frostbite/blob/main/Update.exe.config) file in same folder where your signed shellcode exe was placed. Execute update.exe. Conslusion: This POC is just an idea I had in mind to club two totally different defense evasive techniques together that would help me and other Red Teamers (https://www.kitploit.com/search/label/Red%20Teamers) in building better initial execution payloads for their operations. This project uses AppDomain Manager Injection as an example, but this idea is applicable for other injection techniques as well like - DLL SideLoading, DLL Hijacking etc Credits: Full Credits to med0x2e (https://github.com/med0x2e/), this POC is built based on his SigFlip (https://github.com/med0x2e/SigFlip) Project References: https://research.checkpoint.com/2022/can-you-trust-a-files-digital-signature-new-zloader-campaign-exploits-microsofts-signature-verification-putting-users-at-risk/ https://www.blackhat.com/docs/us-16/materials/us-16-Nipravsky-Certificate-Bypass-Hiding-And-Executing-Malware-From-A-Digitally-Signed-Executable-wp.pdf https://pentestlaboratories.com/2020/05/26/appdomainmanager-injection-and-detection/ https://github.com/med0x2e/SigFlip

Download Frostbyte (https://github.com/pwn1sher/frostbyte)

___________________________
@hacking_Attack
@Hacking_Video