Hacking on Medium
Develop your Cyber Security skills and knowledge with these cool projects

https://cdn-images-1.medium.com/max/2600/0*UQXxJ25bPyuLIoRm
Cybersecurity is a vast and complex field, and it can be difficult to know where to start if you’re interested in getting into it. However…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Mount external directories into your Kubernetes container

https://cdn-images-1.medium.com/max/1125/0*0z14DYvmgLBfYNfs
I wondered how it is possible to get a volume mount into your Kubernetes cluster.

Continue reading on Geek Culture »

___________________________
@hacking_Attack
@Hacking_Video

Xss_Vulnerability_Challenges - This Repository Is A Docker Containing Some "XSS Vulnerability" Challenges And Bypass Examples
http://www.kitploit.com/2022/06/xssvulnerabilitychallenges-this.html

___________________________
@hacking_Attack
@Hacking_Video

This repository is a Dockerized php application containing some XSS vulnerability challenges.
The ideas behind challenges are:
Javascript validation bypass html entities bypass WAF bypass Black-list validation bypass Basic XSS validation bypass Double encode bypass of WAF to exploit XSS Exploiting XSS by bypassing (https://www.kitploit.com/search/label/Bypassing) escape characters
Quick Start Using Docker Using docker hub (Quickest): To access (https://www.kitploit.com/search/label/Access) the challenges, you need docker (https://docs.docker.com/install) installed.
Run this command to pull and run the image from docker hub:
sudo docker run -d -p 9003:80 moeinfatehi/xss_vulnerability_challenges Access the challenges with this URL: http://localhost:9003 (http://localhost:9003/)

Help: -d: detached mode (You can use terminal after running command
-p: specifies port (you can change 8008 to whatever you want. If you don't have a web server on your host, set it to 80)
Using docker-compose: To access the challenges, you need docker (https://docs.docker.com/install) and docker-compose (https://docs.docker.com/compose/install/) installed.
Clone the repository
git clone https://github.com/moeinfatehi/xss_vulnerability_challenges.git Open the main directory (https://www.kitploit.com/search/label/Directory) of the project (where docker-compose.yml file exists) and run: docker-compose up Access the challenges with this URL: http://localhost:9003 (http://localhost:9003/)

___________________________
@hacking_Attack
@Hacking_Video

Disclaimer This project is for Educational purpose ONLY. The usual disclaimer applies, especially the fact that I'm not liable for any damages caused by direct or indirect use of the information or functionality provided by these programs. The author or any Internet provider bears NO responsibility for content or misuse of these programs or any derivatives thereof. By using these project you accept the fact that any damage (dataloss, system crash, system compromise, etc.) caused by the use of this program is not my responsibility. Hack and have fun ! If you have any further questions, please don't hesitate to contact me via my twitter (https://twitter.com/MoeinFatehi) account.

Download Xss_Vulnerability_Challenges (https://github.com/moeinfatehi/xss_vulnerability_challenges)

___________________________
@hacking_Attack
@Hacking_Video

A tool I made for Active Directory
https://www.reddit.com/r/Pentesting/comments/vgjzo1/a_tool_i_made_for_active_directory/

I have been lately working on a few security projects. I recently created the tool ActiveDirectoryAttackTool (ADAT). This tool is designed to take some basic input and print out commands which can be easily run against a Domain Controller. Some of the protocols ADAT prints out commands for: DNS Kerberos LDAP MSSQL NTP RDP SMB WinRM Some of the tools ADAT prints out commands for: BloodHound Crackmapexec (Including modules and PowerShell commands) Impacket toolset Metasploit Nmap ldapdomaindump ldapsearch pywerview xfreerdp ADAT also provides commands for post exploitation. ADAT: https://github.com/The-Viper-One/ActiveDirectoryAttackTool I also have plenty of notes and documentation on penetration testing Active directory as linked below in my Gitbook. Gitbook: https://viperone.gitbook.io/pentest-everything/ ​ Hope this is helpful for some of you. submitted by /u/AkimboViper (https://www.reddit.com/user/AkimboViper)
[link] (https://www.reddit.com/r/Pentesting/comments/vgjzo1/a_tool_i_made_for_active_directory/) [comments] (https://www.reddit.com/r/Pentesting/comments/vgjzo1/a_tool_i_made_for_active_directory/)

___________________________
@hacking_Attack
@Hacking_Video

Attempting to branch out from IAM into Pen Testing. New to this field and looking for advice
https://www.reddit.com/r/Pentesting/comments/vgkrjz/attempting_to_branch_out_from_iam_into_pen/

What would you recommend for a complete newbie to this field? I have IT Audit and IAM experience and passed my CISSP and CISA. However, I know that holds 0 value in the world of pen testing. Where would you recommend me to start before I actually attempt to tackle a subset of “labs” my company has setup to vet people looking to join the team? I’m think TryHackMe, and maybe eJPT as well. submitted by /u/anonymous_mx5 (https://www.reddit.com/user/anonymous_mx5)
[link] (https://www.reddit.com/r/Pentesting/comments/vgkrjz/attempting_to_branch_out_from_iam_into_pen/) [comments] (https://www.reddit.com/r/Pentesting/comments/vgkrjz/attempting_to_branch_out_from_iam_into_pen/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Pool on the roof - {{%B %d, %Y}}

Have a no0b question? New to hacking? Looking for a script? Need help with your github project? Something wrong with your payload? Stuck on a CTF or bug bounty?

This is a weekly recurring post to make friends with other hackers, ask questions, and get any type of help you may need.

Make sure to read our wiki as it's full of resources for you.

Keep all beginner questions in this weekly stickied post.

submitted by /u/AutoModerator
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to Find Out Who’s Tracking You Through Your Smartphone

https://external-preview.redd.it/Agqsk8wCubznO46U9ZzgL3BaSf9GPc2e0Hd3tpcO_2s.jpg?width=640&crop=smart&auto=webp&s=9648fb5c6b5998341731892fa3cf271a0f686676 submitted by /u/panayiotisgeorgiou
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Why Rust for offensive security

https://external-preview.redd.it/dmNDaQbix-b1JK_8hJOkoag8_FsIBJxjmcy9sm60hq8.jpg?width=640&crop=smart&auto=webp&s=fcf9059c8b082e8ee9f073e309e2c7a165609586 submitted by /u/z0mbie42_
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Bug Bounty Hunting: Pros And Cons

submitted by /u/immunebytes
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

The mistakes of a novice

Who is Soheil vanaee?Continue reading on Medium »
Read more...

Every XSS is different

Today I’m going to talk about an XSS that I found on a public bugbounty program about a year ago, this program has multiple websites and…Continue reading on Medium »
Read more...

Kali Linux Tutorials
LDAPFragger : Command And Control Tool That Enables Attackers To Route Cobalt Strike Beacon Data

LDAPFragger is a Command and Control tool that enables attackers to route Cobalt Strike beacon data over LDAP using user attributes.

For background information, read the release blog: http://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes

Dependencies and installation

* Compiled with .NET 4.0, but may work with older and newer .NET frameworks as well

Usage

_ _ _ | | | | / |
| | | | _ _ _ | | _ _ _ _ _ _ _ _
| |/ |/ _| ‘ | | ‘/ |/ _|/ ` |/ \ ‘|
| | (| | (| | |) | | | | | (| | (| | (| | / | ||_,|_,| ./|| || _,|_, |__, |___|| | | / | / | || |/ |/
Fox-IT – Rindert Kramer
Usage:
–cshost: IP address or hostname of the Cobalt Strike instance
–csport: Port of the external C2 interface on the Cobalt Strike server
-u: Username to connect to Active Directory
-p: Password to connect to Active Directory
-d: FQDN of the Active Directory domain
–ldaps: Use LDAPS instead of LDAP
-v: Verbose output
-h: Display this message
If no AD credentials are provided, integrated AD authentication will be used.

Example usage

From network segment A, run

LDAPFragger –cshost –csport
LDAPFragger –cshost –csport -u -p -d

From network segment B, run

LDAPFragger
LDAPFragger -u -p -d

LDAPS can be used with the --LDAPSflag, however, regular LDAP traffic is encrypted as well. Please do note that the default Cobalt Strike payload will get caught by most AVs.
Download

___________________________
@hacking_Attack
@Hacking_Video