hacking: security in practice
Codecov compromise

submitted by /u/profshmex
[link] [comments]

hacking: security in practice
How did Russia infiltrate the SolarWinds build system network?

I just read this excellent article explaining in detail how the Russian state-sponsored hackers were able to pull off the SolarWinds Orion hack.

https://www.npr.org/2021/04/16/985439655/a-worst-nightmare-cyberattack-the-untold-story-of-the-solarwinds-hack

However, it does not make mention of how the hackers were initially able to get into the SolarWinds network. Does anyone know if this information has been released to the public?

submitted by /u/FutureCoolDad
[link] [comments]

hacking: security in practice
Is Nmaping/port scanning illegal?

I've seen a lot of post about people saying they've done their first ever nmap/port scanning session and talked about what they did and found and what not. I understand this is kind of like the first step into hacking so I was wondering if that's why so many people make a post about it.

I'm new and havent done anything like that yet but have been thinking of doing one soon but I just wanted to ask if it was illegal cuz I've seen a few different answers to this question. Thanks!

submitted by /u/Sapron12
[link] [comments]

Playing With iframes: Bypassing Content-Security-Policy

Hi fellow hackers and bug bounty hunters! I’m JM Sanchez, and today I’ll be sharing how I found my first bug in a bug bounty program. I…Continue reading on Medium »
Read more...

Hacking on Medium
How to carding step by step full tutorial

https://cdn-images-1.medium.com/max/1440/1*4yTW4w0VrWXWAxOjyJSn2A.jpeg
Today I’m gonna tell you that carding is legal or illegal and how to do it in 2021 and how to buy cc what is the importance of cc (credit…

Continue reading on Medium »

Hacking on Medium
Playing With iframes: Bypassing Content-Security-Policy

https://cdn-images-1.medium.com/max/698/1*xIYACNg4aZY8aDXnmUbNbA.png
Hi fellow hackers and bug bounty hunters! I’m JM Sanchez, and today I’ll be sharing how I found my first bug in a bug bounty program. I…

Continue reading on Medium »

Hacking on Medium
CVE-2020–29247 WonderCMS 3.1.3 — ‘page’ Persistent Cross-Site Scripting

https://cdn-images-1.medium.com/max/1797/1*q25Zwx3ZujZDFUkOfcaGEw.png
# Exploit Title: WonderCMS 3.1.3 — ‘page’ Persistent Cross-Site Scripting
# Date: 20–11–2020
# Exploit Author: Mayur Parmar
# Vendor…

Continue reading on System Weakness »

Hacking on Medium
CVE-2020–29472 Under Construction Page with CPanel 1.0 — SQL injection

https://cdn-images-1.medium.com/max/1534/1*_G4XA82NRmsFCCK5m706uQ.png
# Exploit Title: Under Construction Page with CPanel 1.0 — SQL injection
# Date: 17–11–2020
# Exploit Author: Mayur Parmar(th3cyb3rc0p)
#…

Continue reading on System Weakness »

BetterXencrypt - A Better Version Of Xencrypt - Xencrypt It Self Is A Powershell Runtime Crypter Designed To Evade AVs
http://www.kitploit.com/2021/04/betterxencrypt-better-version-of.html

A better version of Xencrypt.Xencrypt it self is a Powershell runtime crypter designed to evade AVs. cause Xencrypt is not FUD anymore and easily get caught by AMSI,i recode the stub and now it FUD again. And the original Xencrypt,if you see on the screenshot (https://www.kitploit.com/search/label/Screenshot) proof,he's tested on Windows 8,and if i test it on the newest Windows 10,it doesnt FUD, cause that i want to make it FUD again and make everyone happy :D
This tool tested on Windows 10 (https://www.kitploit.com/search/label/Windows%2010) v20H2

Proof-Of-FUDness (if you dont trust my word)
kinda lazy to fireup my windows VM and retest it again 
Features
Bypasses AMSI,Behavior Monitoring,and all modern AVs in use on MetaDefender (dont wanna test it VirusTotal.MetaDefender is more than enough) Compresses and encrypts powershell (https://www.kitploit.com/search/label/PowerShell) scripts Has a minimal and often even negative (thanks to the compression) overhead Randomizes variable names to further obfuscate the decrypter stub Super easy to modify to create your own crypter variant Supports recursive layering (crypter crypting the crypted output), tested up to 500 layers. Supports Import-Module as well as standard running as long as the input script also supported it All features in a single file so you can take it with you anywhere!
Thanks To
Me for not dying when creating this tool Xentropy and SecForce for creating the original Xencrypt (https://github.com/the-xentropy/xencrypt) Ed Wilson AKA Microsoft (https://www.kitploit.com/search/label/Microsoft) Scripting Guy for the great Powershell scripting tutorials and the last one is Emeric Nasi for the research on bypassing (https://www.kitploit.com/search/label/Bypassing) AV dynamics
Usage
Its better to run BetterXencrypt script on Linux Powershell,cause i never try it on Windows Powershell. (Surprised that Linux have Powershell?Take a look at this (https://docs.microsoft.com/en-us/powershell/scripting/install/installing-powershell-core-on-linux?view=powershell-7.1)) Import-Module ./betterxencrypt.ps1
Invoke-BetterXencrypt -InFile invoke-mimikatz.ps1 -OutFile xenmimi.ps1
You will now have an encrypted xenmimi.ps1 file in your current working directory. You can use it in the same way as you would the original script, so in this case: Import-Module ./xenmimi.ps1
Invoke-Mimikatz
It also supports recursive layering via the -Iterations flag. Invoke-BetterXencrypt -InFile invoke-mimikatz.ps1 -OutFile xenmimi.ps1 -Iterations 100
Warning though, the files can get big and generating the output file can take a very long time depending on the scripts and number of iterations requested.

Download BetterXencrypt (https://github.com/GetRektBoy724/BetterXencrypt)

BetterXencrypt - A Better Version Of Xencrypt - Xencrypt It Self Is A Powershell Runtime Crypter Designed To Evade AVs

A better version of Xencrypt.Xencrypt it self is a Powershell runtime crypter designed to evade AVs. cause Xencrypt is not FUD anymore and easily get caught by AMSI,i recode the stub and now it FUD again. And the original Xencrypt,if you see on the screenshot proof,he's tested on Windows 8,and if i test it on the newest Windows 10,it doesnt FUD, cause that i want to make it FUD again and make everyone happy :DThis tool tested on Windows 10 v20H2 Proof-Of-FUDness (if you dont trust my word) kinda lazy to fireup my windows VM and retest it again  Features Bypasses AMSI,Behavior Monitoring,and all modern AVs in use on MetaDefender (dont wanna test it VirusTotal.MetaDefender is more than enough) Compresses and encrypts powershell scripts Has a minimal and often even negative (thanks to the compression) overhead Randomizes variable names to further obfuscate the decrypter stub Super easy to modify to create your own crypter variant Supports recursive layering (crypter crypting the crypted output), tested up to 500 layers. Supports Import-Module as well as standard running as long as the input script also supported it All features in a single file so you can take it with you anywhere! Thanks To Me for not dying when creating this tool Xentropy and SecForce for creating the original Xencrypt Ed Wilson AKA Microsoft Scripting Guy for the great Powershell scripting tutorials and the last one is Emeric Nasi for the research on bypassing AV dynamics Usage Its better to run BetterXencrypt script on Linux Powershell,cause i never try it on Windows Powershell. (Surprised that Linux have Powershell?Take a look at this) Import-Module ./betterxencrypt.ps1Invoke-BetterXencrypt -InFile invoke-mimikatz.ps1 -OutFile xenmimi.ps1 You will now have an encrypted xenmimi.ps1 file in your current working directory. You can use it in the same way as you would the original script, so in this case: Import-Module ./xenmimi.ps1Invoke-Mimikatz It also supports recursive layering via the -Iterations flag. Invoke-BetterXencrypt -InFile invoke-mimikatz.ps1 -OutFile xenmimi.ps1 -Iterations 100 Warning though, the files can get big and generating the output file can take a very long time depending on the scripts and number of iterations requested. Download BetterXencrypt
Read more...

KitPloit - PenTest Tools!
BetterXencrypt - A Better Version Of Xencrypt - Xencrypt It Self Is A Powershell Runtime Crypter Designed To Evade AVs

https://1.bp.blogspot.com/-ADhbAONpIT0/YH5guT7U0hI/AAAAAAAAV6E/VfOU1Mjc2ncvWqgUV8oy2nWLu_RO4tLcgCNcBGAsYHQ/w640-h338/bypass.png
A better version of Xencrypt.Xencrypt it self is a Powershell runtime crypter designed to evade AVs. cause Xencrypt is not FUD anymore and easily get caught by AMSI,i recode the stub and now it FUD again. And the original Xencrypt,if you see on the screenshot proof,he's tested on Windows 8,and if i test it on the newest Windows 10,it doesnt FUD, cause that i want to make it FUD again and make everyone happy :D
This tool tested on Windows 10 v20H2

Proof-Of-FUDness (if you dont trust my word)

kinda lazy to fireup my windows VM and retest it again



Features

* Bypasses AMSI,Behavior Monitoring,and all modern AVs in use on MetaDefender (dont wanna test it VirusTotal.MetaDefender is more than enough)
* Compresses and encrypts powershell scripts
* Has a minimal and often even negative (thanks to the compression) overhead
* Randomizes variable names to further obfuscate the decrypter stub
* Super easy to modify to create your own crypter variant
* Supports recursive layering (crypter crypting the crypted output), tested up to 500 layers.
* Supports Import-Module as well as standard running as long as the input script also supported it
* All features in a single file so you can take it with you anywhere!

Thanks To

* Me for not dying when creating this tool
* Xentropy and SecForce for creating the original Xencrypt
* Ed Wilson AKA Microsoft Scripting Guy for the great Powershell scripting tutorials
* and the last one is Emeric Nasi for the research on bypassing AV dynamics

Usage

Its better to run BetterXencrypt script on Linux Powershell,cause i never try it on Windows Powershell. (Surprised that Linux have Powershell?Take a look at this)
Import-Module ./betterxencrypt.ps1
Invoke-BetterXencrypt -InFile invoke-mimikatz.ps1 -OutFile xenmimi.ps1

You will now have an encrypted xenmimi.ps1 file in your current working directory. You can use it in the same way as you would the original script, so in this case:
Import-Module ./xenmimi.ps1
Invoke-Mimikatz

It also supports recursive layering via the -Iterations flag.
Invoke-BetterXencrypt -InFile invoke-mimikatz.ps1 -OutFile xenmimi.ps1 -Iterations 100

Warning though, the files can get big and generating the output file can take a very long time depending on the scripts and number of iterations requested.
Download BetterXencrypt

How i got from 0 knowledge to where i am today

How to become a hacker — Seen as Uncle RatContinue reading on Medium »
Read more...

How i got from 0 knowledge to where i am today
https://thexssrat.medium.com/how-i-got-from-0-knowledge-to-where-i-am-today-94782cb26104?source=rss------bug_bounty-5