LoveTok — HackTheBox — Web Exploitation — Challenge — Writeup
https://0x1rootjkqsta.medium.com/lovetok-hackthebox-web-exploitation-challenge-writeup-75729ae81fbe?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello guys I am back to posting another writeup. This is a web challenge. The challenge was created on 13th February 2021. It is a…Continue reading on Medium » (https://0x1rootjkqsta.medium.com/lovetok-hackthebox-web-exploitation-challenge-writeup-75729ae81fbe?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Hunt-Sleeping-Beacons - Aims To Identify Sleeping Beacons

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiXIEDDUdA9cYgVvs-twIPdW9tRYEzXFrBolBd-Ez86F_YtQNRSM80IrxVKNAbs5f39N4slV-iRw2JflRhTy0MeBFqVZCljjxd8r3Hz4QqYj_qGNZgnmTDyWKl4BLGxSdAlxUkxR036EmLzJbuT-93zZJVdXxYka_hMQd9JYmuEOU-6LzY3dY1rZLlQ/w640-h474/h135.png The idea of this project is to identify beacons which are unpacked at runtime or running in the context of another process.

To do so, I make use of the observation that beacons tend to call Sleep between their callbacks. A call to sleep sets the state of the thread to DelayExecution which is taken as a first indiciator that a thread might be executing a beacon.

After enumerating all threads whose state is DelayExecution, multiple metrics are applied to identify potential beacons Metrics1. If the beacon does not make use of file backed memory, the callstack to NtDelayExecution includes memory regions which can not be associated with a file on disk.
2. If the beacon uses module stomping, one of the modules in the callstack to NtDelayExecution is modified

Projects, such as Threadstackspoofer, hook Sleep to spoof the callstack or to use another technique to wait between callbacks. Thus, I added two more metrics:

1. Inline Hooks of Sleep can be fingerprinted by enumerating memory areas marked as private (not shared) storing the .text segment of Kernel32. This also applies if the hook is removed temporarily
2. Since a beacon spends more time waiting for commands than actually executing code, it can be fingerprinted by comparing the fields KernelTimeand UserTimeof SYSTEM_THREAD_INFORMATION. Initially I thought that the time sleeping would count as time spent in Kernelmode, but it turned out the other way. I am not sure why :'P Additionally, both fields increase only after the operator executed some commands with the beacon. Also here, I am not sure why :'P

To decrease false positives, I decided to considerate only processes with loaded wininet.dll or winhttp.dll. Additionally, I had to ignore jitted processes (.NET) and modifications to ntdll.dll which also seems to happen legitimately. Metric three and four are still applied though. ExamplesSample non file backed beacon: [!] Suspicious Process: PhantomDllHollower.exe

[*] Thread (9192) has State: DelayExecution and abnormal calltrace:

NtDelayExecution -> C:\WINDOWS\SYSTEM32\ntdll.dll
SleepEx -> C:\WINDOWS\System32\KERNELBASE.dll
0x00007FF8C13A103F -> Unknown or modified module
0x000001E3C3F48FD0 -> Unknown or modified module
0x00007FF700000000 -> Unknown or modified module
0x00007FF7C00000BB -> Unknown or modified module

[*] Suspicious Sleep() found
[*] Sleep Time: 600s Sample beacon using module stomping: [!] Suspicious Process: beacon.exe (5296)

[*] Thread (2968) has State: DelayExecution and uses potentially stomped module
[*] Potentially stomped module: C:\Windows\SYSTEM32\xpsservices.dll

NtDelayExecution -> C:\Windows\SYSTEM32\ntdll.dll
SleepEx -> C:\Windows\System32\KERNELBASE.dll
DllGetClassObject -> C:\Windows\SYSTEM32\xpsservices.dll

[*] Suspicious Sleep() found
[*] Sleep Time: 5s Sample beacon inline hooking sleep [!] Suspicious Process: ThreadStackSpoofer.exe (4876). Potentially hooked Sleep / Modifies Kernel32.dll Identification of generic beaconing behaviour by comparing KernelTimeand UserTime: [!] Suspicious Process: ThreadStackSpoofer.exe (4876). Thread 1132 has state DelayExecution and spends 94% of the time in usermode MiscThere are of course many ways to bypass this project. :-) Credits* forrestorr for documenting the detection of modified dlls based on shared/private memory areas link
* waldoirc for general support :-) Download Hunt-Sleeping-Beacons

___________________________
@hacking_Attack
@Hacking_Video

LoveTok — HackTheBox — Web Exploitation — Challenge — Writeup

Hello guys I am back to posting another writeup. This is a web challenge. The challenge was created on 13th February 2021. It is a…Continue reading on Medium »
Read more...

hacking: security in practice
At what point is hacking considered illegal?

Everyone know that hacking in itself is not illegal but where is that line where legal boundaries become overstepped?

submitted by /u/Intelligent-Way1288
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Bait and Switch Attack they don’t talk about

Using trusted marketing methods such as paid-for advertising on websites, attackers can trick you into visiting malicious sites. When websites sell advertising space, it can be purchased by rogue attackers. The bona fide advertisement can be replaced with a ‘bad’ link that can be used to download malware, lock up your browser, or compromise your systems.

Alternatively, the advertisement may link to a legitimate website, but it will be programmed to redirect you to a harmful site. So be careful out there mates

submitted by /u/Novel_Pin3731
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
https://twitter.com/YourAnonPublish/status/1538347576365547521?s=20&t=Mipd2qcPt92YTdt6bWQ7IQ

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Nullbyte WonderHowTo

Does anyone knows what happened to nullbyte? Their videos from YouTube were one year ago. I didn't see any update on their Twitter as well.

That guy is amazing in explaining cybersecurity. What a loss it would be if he is gone 😥.

submitted by /u/DogTime3470
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How an broken link got me over €250

Hey! This is Prath. I’m here to tell you about an old finding I made, in which I found an broken link.Continue reading on Medium »
Read more...

How an broken link got me over €250
https://medium.com/@prathameshbagul/how-an-broken-link-got-me-over-250-10bbac924231?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hey! This is Prath. I’m here to tell you about an old finding I made, in which I found an broken link.Continue reading on Medium » (https://medium.com/@prathameshbagul/how-an-broken-link-got-me-over-250-10bbac924231?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty Tips
https://medium.com/@anggaid/bug-bounty-tips-550b27496599?source=rss------bug_bounty-5

Oke disini saya akan berbagi pengalaman tips yang mungkin cukup berguna bagi bug hunter, sebelumnya saya akan menjelaskan apa itu postman.Continue reading on Medium » (https://medium.com/@anggaid/bug-bounty-tips-550b27496599?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty Tips

Oke disini saya akan berbagi pengalaman tips yang mungkin cukup berguna bagi bug hunter, sebelumnya saya akan menjelaskan apa itu postman.Continue reading on Medium »
Read more...

Hacking on Medium
HT-WPS BREAKER — WPS Pin Cracker : Wifi Hacking

https://cdn-images-1.medium.com/max/640/0*vlaQjHiQOsL-zWqV.png
HT-WPS BREAKER

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Why Chrome Loader is reaching height, Organizations need to do something

https://cdn-images-1.medium.com/max/640/0*D2xsqk7HwURs0C4O.jpg
Cybersecurity Expert

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video