Every XSS is different

Today I’m going to talk about an XSS that I found on a public bugbounty program about a year ago, this program has multiple websites and…Continue reading on Medium »
Read more...

Kali Linux Tutorials
LDAPFragger : Command And Control Tool That Enables Attackers To Route Cobalt Strike Beacon Data

LDAPFragger is a Command and Control tool that enables attackers to route Cobalt Strike beacon data over LDAP using user attributes.

For background information, read the release blog: http://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes

Dependencies and installation

* Compiled with .NET 4.0, but may work with older and newer .NET frameworks as well

Usage

_ _ _ | | | | / |
| | | | _ _ _ | | _ _ _ _ _ _ _ _
| |/ |/ _| ‘ | | ‘/ |/ _|/ ` |/ \ ‘|
| | (| | (| | |) | | | | | (| | (| | (| | / | ||_,|_,| ./|| || _,|_, |__, |___|| | | / | / | || |/ |/
Fox-IT – Rindert Kramer
Usage:
–cshost: IP address or hostname of the Cobalt Strike instance
–csport: Port of the external C2 interface on the Cobalt Strike server
-u: Username to connect to Active Directory
-p: Password to connect to Active Directory
-d: FQDN of the Active Directory domain
–ldaps: Use LDAPS instead of LDAP
-v: Verbose output
-h: Display this message
If no AD credentials are provided, integrated AD authentication will be used.

Example usage

From network segment A, run

LDAPFragger –cshost –csport
LDAPFragger –cshost –csport -u -p -d

From network segment B, run

LDAPFragger
LDAPFragger -u -p -d

LDAPS can be used with the --LDAPSflag, however, regular LDAP traffic is encrypted as well. Please do note that the default Cobalt Strike payload will get caught by most AVs.
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Cliam : Multi Cloud IAM Permissions Enumeration Tool

Cliam is a simple cloud permissions identifier. There are two main components to the CLI. Most of the enumerated permissions are list, describe or get permissions. Only permissions that does not require a specific resource are tested.

* enumeratewhich can be used to enumerate specific permissions (recommended)
* Some service providers have service groups that can check for permissions for a specific subset of services/resources. InstallationDownload the latest release. DEV tags are current, but not stable.

In order to build the binary locally, cd into the clidirectory and run make devUsageCliam works with credentials obtained from the services well known envars or from passing the commonly required flags from the cli.

It is highly recommond that command completions are set as most of the enumerateoptions have to be specific. To generate completions, use cliam completion [shell]and set according to your shells completion directory.

❯❯ cliam –help
Cloud Enumerate is a tool to enumerate cloud credentials for their permissions.
Usage:
cliam [command]
Available Commands:
aws Enumerate AWS credentials for their permissions.
completion Generate the autocompletion script for the specified shell
gcp Enumerate GCP service accounts for their permissions.
help Help about any command
Flags:
-h, –help help for cliam
Additional help topics:
cliam azure Enumerate Azure credentials for their permissions.
Use “cliam [command] –help” for more information about a command. AWSUses the AWS rest api to make a signed request using the passed in credentials. This greatly adds speed, but makes it a bit more challenging to keep up with adding new permissions. The issue of scale is that AWS uses 3 – 4 variety of requests at the service level

Supports obtaining credentials from AWS profile, flags, or default AWS environment variables like AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEYand optionally AWS_SESSION_TOKEN.

cliam aws –help
Enumerate AWS credentials for their permissions.
Usage:
cliam aws [command]
Available Commands:
common Enumerate permissions for common AWS resources.
compute Enumerate permissions for common compute AWS resources.
databases Enumerate permissions for common AWS database resources.
enumerate Enumerate permissions for specified AWS resources.
serverless Enumerate permissions for common serverless AWS resources.
storage Enumerate permissions for common storage AWS resources.
Flags:
–access-key-id string AWS Access Key ID
-h, –help help for aws
–profile string AWS Profile. When profile is set, access-key-id, secret-access-key, and session-token are ignored.
–region string AWS Region (default “us-east-1”)
–secret-access-key string AWS Secret Access Key
–session-token string AWS Session Token
Global Flags:
–max-threads int Maximum number of threads to use. (default 5)
–request-timeout int Timeout for each request in seconds. (default 10) Known resourcesCliam for AWS also supports enumerating certain permissions which requires a known value. For instance, when using awscli, we can get a function using aws lambda get-function --function-name .

This maps directly to cliam where we can use:

cliam aws enumerate lamda –known-value function-name=

This will enumerate all permissions for lambda which takes function-name as a valid argument. This will work with other AWS resources as well. (more coverage coming soon) ExamplesBruteforce all serverless resources from an AWS profile

❯❯ cliam aws serverless –profile=my-profile

Use temporary session tokens obtained to check all ec2 permissions

❯❯ cliam aws enumerate ec2 –session-json=creds.json
Where creds.json has
{
“Type” : “AWS-HMAC”,
“AccessKeyId” : “ASIA…”,
“SecretAccessKey[...]

___________________________
@hacking_Attack
@Hacking_Video

” : “…”,
“Token” : “…”,
}

Enumerate permissions for s3, iam and ec2

❯❯ cliam aws enumerate s3 iam ec2 GCPCurrently, permissions are enumerate using the cloudresourcemanagerAPI. This will fail if this service is not enabled, but there are future plans to extend using rest alls to confirm permissions.

GCP supports enumerating from a specific service account json file. Credentials from the GCP environment variables GOOGLE_APPLICATION_CREDENTIALSand CLOUDSDK_CORE_PROJECTare also supported.

Because there are two modes for GCP enumeration, use enumerate if cloudresourcemanageris enabled or use restto enumerate specific permissions.

cliam gcp –help
Enumerate GCP service accounts for their permissions.
Usage:
cliam gcp [command]
Available Commands:
bruteforce Enumerate all GCP permissions
enumerate Enumerate specified GCP permissions
rest GCP permissions using the REST API
Flags:
-h, –help help for gcp
–project-id string GCP project id
–region string GCP Region (default “us-central1”)
–service-account string GCP service account path
–zone string GCP Zone (default “us-central1-a”)
Global Flags:
–max-threads int Maximum number of threads to use. (default 5)
–request-timeout int Timeout for each request in seconds. (default 10)
Use “cliam gcp [command] –help” for more information about a command. Debugcliam supports two environment variables to show debug output

* DEBUG=true (shows status codes of requests)
* VERBOSE=true (shows body of requests) Download

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Credential Sharing as a Service: The Hidden Risk of Low-Code/No-Code

Low-code/no-code platforms allow users to embed their existing user identities within an application, increasing the risk of credentials leakage.

Dark Reading: Attacks/Breaches
The Cybersecurity Diversity Gap: Advice for Organizations Looking to Thrive

Companies need to fill some of the 3.5 million empty cybersecurity seats with workers who bring different experiences, perspectives, and cultures to the table. Cut a few doors and windows into the security hiring box.

Hacking on Medium
TryHackMe Toolbox: Vim Walkthrough

https://cdn-images-1.medium.com/max/1660/1*1Ratotad0Vlo3w9gU3WhtA.png
Task 1

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The mistakes of a novice

Who is Soheil vanaee?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Every XSS is different

Today I’m going to talk about an XSS that I found on a public bugbounty program about a year ago, this program has multiple websites and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Autoridades cierran la botnet rusa RSOCKS que hackeó millones de dispositivos

https://cdn-images-1.medium.com/max/1696/0*o6gj1R7DqDPwMlle
PUBLICADO EN 20 JUNIO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

The mistakes of a novice
https://medium.com/@soheilvanaee.js/the-mistakes-of-a-novice-8c67f783f7dc?source=rss------bug_bounty-5

Who is Soheil vanaee?Continue reading on Medium » (https://medium.com/@soheilvanaee.js/the-mistakes-of-a-novice-8c67f783f7dc?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Every XSS is different
https://medium.com/@leomsec/every-xss-is-different-c98528fee5e0?source=rss------bug_bounty-5

Today I’m going to talk about an XSS that I found on a public bugbounty program about a year ago, this program has multiple websites and…Continue reading on Medium » (https://medium.com/@leomsec/every-xss-is-different-c98528fee5e0?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Xss_Vulnerability_Challenges - This Repository Is A Docker Containing Some "XSS Vulnerability" Challenges And Bypass Examples

https://blogger.googleusercontent.com/img/a/AVvXsEj_COmpFVTQwfwmYLnG0getTBC7BbM2W6hDybWXMreWejYTKxwO5RFAA__skJrEZpT3DzltvwZg5p-OqdvEH0xeDljhb9b4SPdLQsTiJKHzVK4Q6x4v3bdH6kzlAv_D6NSl-W_ya9KPWl07TXSi082vfjDq1I93UvrvriX5OuAgOGQtehQ0tDPDcSL0=s16000
This repository is a Dockerized php application containing some XSS vulnerability challenges.
The ideas behind challenges are:
* Javascript validation bypass
* html entities bypass
* WAF bypass
* Black-list validation bypass
* Basic XSS validation bypass
* Double encode bypass of WAF to exploit XSS
* Exploiting XSS by bypassing escape characters
Quick Start Using Docker

Using docker hub (Quickest):

1. To access the challenges, you need docker installed.

2. Run this command to pull and run the image from docker hub:
sudo docker run -d -p 9003:80 moeinfatehi/xss_vulnerability_challenges
3. Access the challenges with this URL: http://localhost:9003
Help:

-d: detached mode (You can use terminal after running command
-p: specifies port (you can change 8008 to whatever you want. If you don't have a web server on your host, set it to 80)


Using docker-compose:

1. To access the challenges, you need docker and docker-compose installed.

2. Clone the repository
git clone https://github.com/moeinfatehi/xss_vulnerability_challenges.git
3. Open the main directory of the project (where docker-compose.yml file exists) and run: docker-compose up
4. Access the challenges with this URL: http://localhost:9003
https://blogger.googleusercontent.com/img/a/AVvXsEj_COmpFVTQwfwmYLnG0getTBC7BbM2W6hDybWXMreWejYTKxwO5RFAA__skJrEZpT3DzltvwZg5p-OqdvEH0xeDljhb9b4SPdLQsTiJKHzVK4Q6x4v3bdH6kzlAv_D6NSl-W_ya9KPWl07TXSi082vfjDq1I93UvrvriX5OuAgOGQtehQ0tDPDcSL0=s16000

Disclaimer

This project is for Educational purpose ONLY. The usual disclaimer applies, especially the fact that I'm not liable for any damages caused by direct or indirect use of the information or functionality provided by these programs. The author or any Internet provider bears NO responsibility for content or misuse of these programs or any derivatives thereof. By using these project you accept the fact that any damage (dataloss, system crash, system compromise, etc.) caused by the use of this program is not my responsibility.

Hack and have fun !

If you have any further questions, please don't hesitate to contact me via my twitter account.
Download Xss_Vulnerability_Challenges

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What is the meaning of Cross Site in XSS & CSRF?

According to owasp;

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page.

https://owasp.org/www-community/attacks/xss/

Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker’s choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.

https://owasp.org/www-community/attacks/csrf

What is the actual meaning of Cross Site in both XSS & CSRF?

submitted by /u/w0lfcat
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video