TrelloC2 - Simple C2 Over The Trello API
http://www.kitploit.com/2022/06/trelloc2-simple-c2-over-trello-api.html

___________________________
@hacking_Attack
@Hacking_Video

Simple C2 over Trello's API (Proof-of-Concept) By: Fabrizio Siciliano (@0rbz_ (https://www.twitter.com/0rbz_)) Update 12/30/2019 Removed hardcoded (https://www.kitploit.com/search/label/Hardcoded) API key and Token, use input() instead.
Requirements Python 3.x Setup Create a Trello account: https://trello.com/signup Once logged in, get your API key: https://trello.com/app-key Generate a Token (same page as app-key, follow the "Token" link) Save both API key and Token, they're used in both the agent and operator scripts. Browse to your board https://trello.com/b/[random]/[membername].json (https://trello.com/b/%5Brandom%5D/%5Bmembername%5D.json) to get the list ID which is required in the agent script. You can find this in the json output under the "lists" item and within the "Things To Do" item "id" value. Usage Run agent.py on the target system. This is the implant, and once run, will supply the operator with a "CID" value. This is the card ID and is needed on the operator-side. Run the operator.py script on the attacker host. It will prompt for the agent's CID which is provided at agent.py runtime. Do what thou wilt... The operator script currently only has two commands; "show_commands" and "kill_implant". The "show_commands" command simply prints the help menu while the "kill_implant" command deletes the card associated with agent which terminates the agent connection. Typing "?" at the operator prompt will also display the commands menu. Limitations The Trello API "description" field for cards, which is used for temporarily storing commands and resulting command output, is limited in size. I think it's something around 16k characters. This is OK for most commands, however, commands that return large output will cause the agent to die due to the Trello API returning a 400 Bad Request (size too large) status. Be mindful of commands and their expected outputs. I'll eventually work in some logic to determine command output size before sending it back to trello's servers for operator consumption. This is not OPSEC-safe. All commands and command output will temporarily pass through Trello's servers and output will exist (https://www.kitploit.com/search/label/EXIST) in the agents' "card" in cleartext temporarily. Although the traffic (https://www.kitploit.com/search/label/Traffic) is TLS encrypted (in-transit) courtesy of Trello, and although the operator script makes an effort to "wipe the slate" clear of the command output, there's no telling whether this information is stored indefinitely. Ideally, the commands and command output should be saved to a "card" in an encrypted format, (i.e., AES), pulled down, and decrypted locally. This hasn't been built into the tool yet, and in its current state would require the machine the agent lives on to have certain libraries which might not be present in a default situtation. (Something to work on) The operator script and implant are currently both designed to be run on Linux-based boxes. Windows (https://www.kitploit.com/search/label/Windows) implants are a work in progress at this point in time. Misc Note: This is simply a proof-of-concept to demonstrate legitimate services as command and control infrastructure (https://www.kitploit.com/search/label/Infrastructure) and is 100% in alpha dev. Use at your own risk and on systems you've been authorized to access. (i.e., wherever the agent lives) Credits (ideas and concepts inspired by other works): https://github.com/daniel-infosec/wikipedia-c2 https://github.com/PaulSec/twittor https://github.com/Coalfire-Research/Slackor

Download TrelloC2 (https://github.com/secmode/TrelloC2)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Chinese APT Group Likely Using Ransomware Attacks as Cover for IP Theft

Bronze Starlight’s use of multiple ransomware families and its victim-targeting suggest there’s more to the group’s activities than just financial gain, security vendor says.

Dark Reading: Attacks/Breaches
Johnson Controls Acquires Tempered Networks to Bring Zero Trust Cybersecurity to Connected Buildings

Johnson Controls will roll out the Tempered Networks platform across deployments of its OpenBlue AI-enabled platform.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Information Leak: Posted, Discovered & Misused! How easy for Criminals to get your data?

https://cdn-images-1.medium.com/max/800/1*9Ex782OkBErVbbueMSuyzA.jpeg
NOTE: This article explains about How easy to accumulate Personal Data which are then allegedly used for offensive purposes by…

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe: Hashing -Crypto 101 — Walkthrough

https://cdn-images-1.medium.com/max/808/1*gHYQiFwu69VI2vue7BB2tA.png
Hi! I am making these walkthroughs to keep myself motivated to learn cyber security, and ensure that I remember the knowledge gained by…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Find SSRF , LFI , XSS using httpx , waybackurls , gf , gau , qsreplace

https://cdn-images-1.medium.com/max/600/1*aPcGEHIbYlL_lj2KqQodqQ.gif
Hello Beautiful hackers

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
CISA: Los exploits Log4Shell todavía se utilizan para piratear servidores VMware

https://cdn-images-1.medium.com/max/1598/0*Sjkq9_sCE9vvAFJ4
PUBLICADO EN 23 JUNIO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
TrelloC2 - Simple C2 Over The Trello API

https://blogger.googleusercontent.com/img/a/AVvXsEhYBbHXwyhm74b8IQwmi-Wc-tE9lBbgcf0WU4kT9UfioRNG-DQPHJKs60BO3fiuhb0xYt7Ay1ERuT1VhtZ5iF1Iqpf8s_uKxFg1k2jmZgs8wHsj9GxN0lpNmrCqJS4uqFmU9aCtmnSw59QZty9hJhCtrLtrijfj4kMuRQzQD493lr0vyn0XZDou9LIP=w640-h228 Simple C2 over Trello's API (Proof-of-Concept)

By: Fabrizio Siciliano (@0rbz_) Update 12/30/2019Removed hardcoded API key and Token, use input() instead. RequirementsPython 3.x Setup1. Create a Trello account: https://trello.com/signup
2. Once logged in, get your API key: https://trello.com/app-key
3. Generate a Token (same page as app-key, follow the "Token" link)
4. Save both API key and Token, they're used in both the agent and operator scripts.
5. Browse to your board https://trello.com/b/[random]/[membername].json to get the list ID which is required in the agent script. You can find this in the json output under the "lists" item and within the "Things To Do" item "id" value. Usage1. Run agent.py on the target system. This is the implant, and once run, will supply the operator with a "CID" value. This is the card ID and is needed on the operator-side.
2. Run the operator.py script on the attacker host. It will prompt for the agent's CID which is provided at agent.py runtime.
3. Do what thou wilt...
4. The operator script currently only has two commands; "show_commands" and "kill_implant". The "show_commands" command simply prints the help menu while the "kill_implant" command deletes the card associated with agent which terminates the agent connection. Typing "?" at the operator prompt will also display the commands menu. Limitations*
The Trello API "description" field for cards, which is used for temporarily storing commands and resulting command output, is limited in size. I think it's something around 16k characters. This is OK for most commands, however, commands that return large output will cause the agent to die due to the Trello API returning a 400 Bad Request (size too large) status. Be mindful of commands and their expected outputs. I'll eventually work in some logic to determine command output size before sending it back to trello's servers for operator consumption.

*
This is not OPSEC-safe. All commands and command output will temporarily pass through Trello's servers and output will exist in the agents' "card" in cleartext temporarily. Although the traffic is TLS encrypted (in-transit) courtesy of Trello, and although the operator script makes an effort to "wipe the slate" clear of the command output, there's no telling whether this information is stored indefinitely. Ideally, the commands and command output should be saved to a "card" in an encrypted format, (i.e., AES), pulled down, and decrypted locally. This hasn't been built into the tool yet, and in its current state would require the machine the agent lives on to have certain libraries which might not be present in a default situtation. (Something to work on)

*
The operator script and implant are currently both designed to be run on Linux-based boxes. Windows implants are a work in progress at this point in time. MiscNote: This is simply a proof-of-concept to demonstrate legitimate services as command and control infrastructure and is 100% in alpha dev. Use at your own risk and on systems you've been authorized to access. (i.e., wherever the agent lives) Credits (ideas and concepts inspired by other works):* https://github.com/daniel-infosec/wikipedia-c2
* https://github.com/PaulSec/twittor
* https://github.com/Coalfire-Research/Slackor Download TrelloC2

___________________________
@hacking_Attack
@Hacking_Video

Recon — All In One, Fast, Easy Recon Tool (HydraRecon)
https://medium.com/@imdon2126/recon-all-in-one-fast-easy-recon-tool-hydrarecon-990cf9e9f9ca?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

HydraRecon tool is an automated tool developed in the Python language which performs the task of Information Gathering and Crawling the…Continue reading on Medium » (https://medium.com/@imdon2126/recon-all-in-one-fast-easy-recon-tool-hydrarecon-990cf9e9f9ca?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

NahamCon CTF 2022 — Web Exploitation — All Challenges — Writeup
https://medium.com/@0x34rootjkqsta/nahamcon-ctf-2022-web-exploitation-all-challenges-writeup-ae6e5f4454fb?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video