IDOR leads to revoke access from third party user account
https://medium.com/@anonymouuss/idor-leads-to-revoke-access-from-third-party-user-account-83401e5ab6a6?source=rss------bug_bounty-5

Hello everyone ,Continue reading on Medium » (https://medium.com/@anonymouuss/idor-leads-to-revoke-access-from-third-party-user-account-83401e5ab6a6?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

IDOR leads to revoke access from third party user account

Hello everyone ,Continue reading on Medium »
Read more...

Writing your own Burpsuite Extensions: Complete Guide

Recently I had to create some extensions for Burpsuite. I tried finding resources that could help me but couldn’t find much. Most of them…Continue reading on Medium »
Read more...

hacking: security in practice
Anonymous browsing

Hi, i want to browse on web completely anonymously. Is it possible to be untraceable via using tor browser? Or do i need to set up vpn anyway?

submitted by /u/Freyarex
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Does anyone know a program through which I can call another country using that country's number?

For example, I want to call Germany and I need a country number to make everything look as it should.

submitted by /u/lozalas
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
RogueAssemblyHunter : Rogue Assembly Hunter Is A Utility For Discovering ‘Interesting’ .NET CLR Modules

Rogue Assembly Hunter is a utility for discovering ‘interesting’ .NET CLR modules in running processes. Background.NET is a very powerful and capable development platform and runtime framework for building and running .NET managed applications. Over the last several years, .NET has been adopted by Red Teams (and likes thereof) for instrumenting tradecraft to support offensive operations. In particular, the shift from offensive PowerShell to .NET was a logical leap (for many) due to the increased optics and opportunistic visibility present in PowerShell v5+. As such, .NET offensive tooling and tradecraft has been successfully used to evade host-based defensive capabilities, bypass application control, and to build/stage/deliver/execute malicious code (similar to PowerShell).

From a prevention perspective, Microsoft is doing more to combat .NET instrumented threats and to minimize the overall .NET attack surface. For example, Microsoft has added AMSI inspection capabilities in .NET Framework 4.8, and WDAC/WLDP mechanisms are quite effective. From a detection/response perspective, further visibility and introspection into the .NET ecosystem is always advantageous for discovering new ways to combat .NET-focused threats.

In 2017, Joe Desimone (@dez_) wrote a fantastic article called Hunting For In-Memory .NET Attacks. Still relevant today, the article outlines modern .NET attack vectors as well as on-demand and event-based techniques for detection. Accompanying the article, Joe released a tool (Get-ClrReflection) to proactively detect (and retrieve) in-memory .NET CLR modules that lack a proper disk reference. Inspired by Joe’s work and taking advantage of the introspection capabilities of the CLRMD runtime diagnostics library (+ subsequent data access capabilities of mscordacwks.dll), Rogue Assembly Hunter was created to:

* Inspect (all) running .NET (‘managed’) processes for interesting CLR modules (e.g. module(s) that form an ‘assembly’)
* Inspect a single .NET (‘managed’) process (by PID) for interesting CLR modules
* Watch for newly spawned processes and attempt to inspect for interesting CLR modules
* Support several ‘hunt’ capabilities to discover in-memory loaded modules, signature status of modules (if loaded from disk), modules loaded from interesting directories, and imposter modules (e.g. fake file references).
* Support CLR module export functionality (a quick port from Get-ClrReflection)
* Inspire more interesting tooling and tradecraft Major Requirements & Dependencies* Run under a privileged user/process context
* .NET Framework 4.6.1+
* .NET CLRMD – Microsoft.Diagnostics.Runtime Introspection Library (NuGet Package)
* ILMerge – Static Linker (NuGet Package)
* …and supporting NuGet packages in Visual Studio. Notes, Tips, & Caveats* Run as a privileged user with high/system integrity.
* ‘Hunts’ are experimental and not guaranteed to provide complete/correct results. Beware of false positives (e.g. signed modules) and validate accordingly.
* RogueAssemblyHunter uses the CLRMD to connect to live processes, which could introduce interesting results.
* Due to the scanning nature of RogueAssemblyHunter, there is a possibility of race conditions and missed results. Consider tuning with the –checks and –sleep switches to help (especially in ‘watch’ mode). In some cases, it may be difficult to ‘catch’ a particular assembly load due to speed of execution (such as execute-assembly and sacrificial processes).
* Architecture (‘bitness’) and .NET versions matter (e.g. 4+) for interacting with remote processes with the .NET CLRMD libraries.
* For maximum inspection/coverage, build and run this program for x86 and x64 use cases.
* Process sweep mode will attempt to connect to all running processes regardless of ‘bitness’. It will otherwis[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Process_Overwriting : Yet Another Variant Of Process Hollowing

Process Overwriting is a PE injection technique, closely related to Process Hollowing and Module Overloading

Process Hollowing (aka RunPE) is an old and popular PE injection technique. It comes in has variety of flavors, but there are some steps in common:

* Start by creating a process in a suspended state
* Write our own PE module in its memory
* Redirect to the new module
* Resume the thread

Process Hollowing does not require manual loading of payload’s imports. Thanks to the step 3 Windows loader treat our PE implant as the main module of the process, and will load imports automatically when its execution resumes.

To make our implant recognized by Windows loader, its Module Base must be set in the PEB. It is usually done by one of the two ways:

* in the most classic variant, the original PE is unmapped from memory, and the new PE is mapped on its place, at the same address.
* in another, yet common variant, the old module is left as is, and another PE is mapped in a new memory region. Then the new module’s base address is manually written into the PEB (this variant was demonstrated here)

As a result of those classic implementations we get a payload running as main module, yet it is mapped as MEM_PRIVATE(not as MEM_IMAGElike typically loaded PEs). To obtain payload mapped as MEM_IMAGEwe can use some closely related techniques, such as Transacted Hollowing or its variant “Ghostly Hollowing”.

Process Overwriting is yet another take on solving this problem.

In contrast to the classic Process Hollowing, we are not unmapping the original PE, but writing over it. No new memory is allocated: we are using the memory that was originally allocated for the main module of the process.

Pros:

* the implanted PE looks like if it was loaded by Windows loader:
* mapped as MEM_IMAGE
* divided into sections with specific access rights
* the image is named

* convenience of loading:
* no need to manually relocate the implant prior to injection: Windows loader will take care of this (in classic Process Hollowing we have to relocate the module)
* no need to fill imports (like in every variant of Process Hollowing)
* no need to allocate new memory in the process
Cons:

* It doesn’t work if the target has GFG (Control Flow Guard) enabled (yet it is possible to disable it on process creation)
* The target’s ImageSize must not be smaller than payload’s ImageSize (remember we are using only the memory that was already allocated!) – this limitation does not occur in other flavors of Process Hollowing
* Can be detected by comparing of the module in memory with corresponding file (PE-sieve detects it) – just like every variant of Process Hollowing

Demo

The demo payload (demo.bin) injected into Windows Calc (default target)
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjp8B1qR9vO5jWgFSfTlSrX1p1IiGvVzxsuoILM0Ba9INLYGicBw3RsCE4hyf4PJh_RHQNlpLaEIE9bGd_gtCQPgB_G29nwR3qdnk74fXQ2uKim3gP3fLsLqPWByaqHelibucB8xxdcx6MXVa5lbo7beI2g5NpYcOKuv0G8g2VKVTmJ53VBgNyaSAjX/s597/demo1.png
Clone

Use recursive clone to get the repo together with all the submodules:

git clone –recursive https://github.com/hasherezade/process_overwriting.git
Download

___________________________
@hacking_Attack
@Hacking_Video

e fail accordingly for architecture mismatches.

* Tested on Windows 10 Pro 2H1H and Windows Server 2016 Standard 1607. It may run on other versions with the relevant .NET Framework.
* Visual Studio project source with NuGet packages, PowerShell script, and release binaries are included with this project.
* Notice.md includes project disclaimers and license information.
* Run at your own risk (and don’t mind my horrible code https://s.w.org/images/core/emoji/14.0.0/72x72/1f609.png )! Usage[*] Parameters:
–mode=<. : Required | Select analysis mode. Options include sweep, process, and watch.
–hunt=<. : Optional | Select the hunt scan type to find interesting CLR modules. Specify all (default), memory-only, unusual-dir,
sig-status, imposter-file, or list.
–export=<. : Optional, Experimental | Specify a file path to export loaded CLR modules for in-memory hunt scans and imposter-file hunt scans
(e.g. –hunt=memory-only/imposter-file/all).
–pid=<. : Optional | Specify a targeted process by PID. Must be used with –mode=process parameter/value.
–checks=<. : Optional | Specify a value for scan cycles. This may help reduce race condition misses during scans but could also repeat result output.
Default value is 1.
–sleep=<. : Optional | Specify a value for sleep seconds. This may help reduce race condition misses during scans by delaying the check cycle.
Default value is 0 seconds.
–debug : Optional | Display exception information (e.g. process connect errors).
–nobanner : Optional | Suppress the display banner. Useful for executing with the PowerShell script or for use cases that leverage automation.
–suppress : Optional | Do not scan the RogueAssemblyHunter process during –mode=sweep or –mode=watch.
–help : Optional | Show this help. This will override any other cmdline parameters and exit the application. *This is the default without parameters.
[] Modes (–mode=) – sweep : Scan/iterate through all processes (Note: Only processes of like architecture/’bitness’ will be successfully scanned. Compile to run for x86/x64/etc.). – process : Scan a single process. Use with –pid=. – watch : Scan new processes when created. Adjust scan attributes with –checks and –sleep. (Note: This is experimental. Race conditions are likely.) [] Hunts (–hunt=)
– all : Default value. Analyze with all hunt options (Except ‘list’).
– memory-only : Memory hunt. Analyze CLR modules that are not backed by disk.
– unusual-dir : Unusual directory hunt. Analyze CLR modules loaded outside of ‘normal’ directories.
Edit ‘_huntUnusualDirectoryFilter’ to customize.
– sig-status : File signature hunt. Analyze CLR modules with anomalous signature status (e.g. unsigned). Note: This is experimental. False positives are possible.
Edit ‘_huntSigExclusionsFilter’ to customize.
imposter-file : Unexpected CLR module hunt. Analyze CLR module with suspicious disk file backing. Experimental.
– list : Iterate through all CLR modules and list accordingly.
[*] Example Usage
– Example 1 : Scan processes and run through all hunts for accessible 64-bit processes (except ‘list’) –
RogueAssemblyHunter_x64.exe –mode=sweep
– Example 2 : Scan processes, list all CLR modules in accessible 32-bit managed processes, and show error information –
RogueAssemblyHunter_x86.exe –mode=sweep –hunt=list –debug
– Example 3 : Watch for new processes, scan all CLR modules (if managed and 64-bit), do not scan the RogueAssemblyHunter process, and do 2 checks with a 3 second delay between –
RogueAssemblyHunter_x64.exe –mode=watch –suppress –checks=2 –sleep=3
– Example 4 : Scan single process by PID, list in-memory only CLR module findings, and export CLR modules to specified path –
RogueAssemblyHunter_x86.exe –mode=process –pid=4650 –hunt=memory-only –export=c:\evilassemblies\
– Example 5 : Scan processes, list in-memory only CLR module findings for accessible 64-bit processes, do no scan RogueAssemblyHunter process, and do not show title banner –
RogueAssemblyHunter_x64.exe –mode=sweep –hunt=memory[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Heyserial : Programmatically Create Hunting Rules For Deserialization Exploitation

Heyserial will Programmatically create hunting rules for deserialization exploitation with multiple

* keywords (e.g. cmd.exe)
* gadget chains (e.g. CommonsCollection)
* object types (e.g. ViewState, Java, Python Pickle, PHP)
* encodings (e.g. Base64, raw)
* rule types (e.g. Snort, Yara)

Usage

Help: python3 heyserial.py -h

Examples:

python3 heyserial.py -c ‘ExampleChain::condition1+condition2’ -t JavaObj
python3 heyserial.py -k cmd.exe whoami ‘This file cannot be run in DOS mode’
python3 heyserial.py -k Process.Start -t NETViewState -e base64 “base64+utf16le”

Utils

utils/checkyoself.py

This is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.

Usage: python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcap

Examples: python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_misses

utils/generate_payloads.ps1

YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.

* Source: https://github.com/pwntester/ysoserial.net
* License: ysoserial.net_LICENSE.txt

utils/generate_payloads.sh

YSoSerial payload generation. Run on Linux from the ./utils directory.

* Source: https://github.com/frohoff/ysoserial
* License: ysoserial_LICENSE.txt

utils/install_snort.sh

Installing Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.

Use at your own risk in a VM that you have snapshotted recently.

utils/server.py

Simple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.

Handy for generating test PCAPs.
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
BWASP : BoB Web Application Security Project

BWASP is BoB Web Application Security Project (BWASP) is an open-source, analysis tool to support for Web Vulnerability Manual Analysis hackers.

The BWASP tool basically provides predicted information through vulnerability analysis without proceeding with an attack.

BWASP supports performing automated analysis and manual analysis.

The BWASP Project supports:

* Find Attack vector automatically. (e.g. SQL Injection, Cross-site Scripting)
* Detect website technology.
* Log4J vulnerability scan (Partially supports java language)
* HTTP REST API
* GuideLine Result
* Test payload option(attack test)

Getting started

pip3 install -r requirements.txt
python3 start.py
Download

___________________________
@hacking_Attack
@Hacking_Video

-only –suppress –nobanner Release Files: Invoke-RogueAssemblyHunter & Compiled BinariesFor convinience, a PowerShell script along with two compiled binaries (RogueAssemblyHunter_x64.exe and RogueAssemblyHunter_x86.exe) have been included in the \Release folder. Feel free to modify to fit your use cases (e.g. deployment, embedding, checks, sleep, etc.).

Example Usage

Run Invoke-RogueAssemblyHunter in sweep mode and check for all hunt options

cd c:\path\to\RogueAssemblyHunter
import-module .\Invoke-RogueAssemblyHunter.ps1
Invoke-RogueAssemblyHunter

Run Invoke-RogueAssemblyHunter in watch mode and check for all hunt options

cd c:\path\to\RogueAssemblyHunter
import-module .\Invoke-RogueAssemblyHunter.ps1
Invoke-RogueAssemblyHunter -ScanMode watch

SHA256 Hashes

e804711a8b6469f1b13b388de47dfa6dde1c85279d365db7b6e19e1644990fa6 Invoke-RogueAssemblyHunter.ps1
cc985d918e566671aa209142abc55bd798ca6c1a18730b785ac8c18d489736c3 RogueAssemblyHunter_x64.exe
ae3aead43871e263cd8465d5356c4daaae0635714321f872c931ec825008287a RogueAssemblyHunter_x86.exe Download

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Without Conti On The Scene, LockBit 2.0 Leads Ransomware Attacks

Analysts say an 18% drop in ransomware attacks seen in May is likely fleeting, as Conti actors regroup.

Dark Reading: Attacks/Breaches
The Cybersecurity Talent Shortage Is a Myth

We have a tech innovation problem, not a staff retention (or recruitment) problem.

Dark Reading: Attacks/Breaches
7 Steps to Stronger SaaS Security

Continuous monitoring is key to keeping up with software-as-a-service changes, but that's not all you'll need to get better visibility into your SaaS security.

Writing your own Burpsuite Extensions: Complete Guide
https://cirius.medium.com/writing-your-own-burpsuite-extensions-complete-guide-cb7aba4dbceb?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Recently I had to create some extensions for Burpsuite. I tried finding resources that could help me but couldn’t find much. Most of them…Continue reading on Medium » (https://cirius.medium.com/writing-your-own-burpsuite-extensions-complete-guide-cb7aba4dbceb?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video