or domain backup key – allowing you to dump cookies remotely over SMB!

When carrying out Red Teaming, I sometimes need to dump a user’s cookies multiple times over a sustained period (e.g. daily/weekly). Using a .NET assembly, Reflective DLL or other in-memory execution technique to extract individual cookies from the cookie file directly on the target system is unneccesary and exposes the operator to increased risk of detection. Instead you can simply dump the state key once, and copy the Cookiesdatabase file off whenever you need fresh cookies, without requiring additional execution. Password Import/ExportChloniumUIalso supports password import and export. To use this feature, simply supply the Login Datadatabase path instead of the Cookiesdb, along with the state key, and select the browser you wish to import them into (for export this doesn’t matter). This allows you to either export passwords in plaintext to a file, or import them into your browser. As with cookies, you can import Chrome passwords into Edge, Edge passwords into Vivaldi etc. Offline Statekey DecryptionChlonium supports offline state key decryption whereby you can decrypt the users statekey offline if you have all of the following files:

* The Local State file from: C:\Users\<user\AppData\Local\<browser\User Data\Local State* The DPAPI masterkey files from: C:\Users\<user\AppData\Roaming\Microsoft\Protect\<sid\and one of the following:

* Domain backup key .pvk file (e.g. from NTDS.dit)
* Domain backup key in base64 (e.g. from Mimikatz/SharpDPAPI LsaRetrievePrivateDataAPI method)
* The user’s password

Now simply provide these values under the “Offline statekey decryption” tab, and Chlonium will attempt to decrypt the encrypted statekey by first decrypting the DPAPI masterkeys (using the backup key or password), and then using these keys to decrypt the statekey. Once the statekey is decrypted, this can be used in the “Import or Export Database” tab to retrieve cookies/passwords.

Usage Note: When using the user’s password to decrypt the DPAPI masterkey, Chlonium will first attempt to extract the user’s SID from the BK-<netbiosdomainnamefile from within the DPAPI masterkey folder. If this fails (or if the file does not exist), it will try to get the SID from the DPAPI masterkey folder name instead (which by default will be named after the user’s SID). If you have renamed the folder, or do not have a copy of the BK file, you will not be able to decrypt the masterkey using a password.

This feature makes use of the excellent SharpChrome and SharpDPAPI projects by @harmj0y. Full credit goes to the original authors of SharpDPAPI. DetectionSet a SACL on the Chrome Local Stateand Cookiesfiles (as well as other sensitive files such as Login Dataand History). Look for suspicious (e.g. non browser related) processes opening any of these files.

Take a look at this great blog post from @cryps1s about setting up SACLs for detection.

For AV vendors that use a file system filter driver, consider blocking non browser-related processes from opening these files. e.g. PowerShell opening the Cookiesfile. Download

Assets Discovery solution to discover all technologies used by a company
https://www.reddit.com/r/Pentesting/comments/vk8kwx/assets_discovery_solution_to_discover_all/

submitted by /u/Hudson_Rock (https://www.reddit.com/user/Hudson_Rock)
[link] (https://www.youtube.com/watch?v=p-tJ6wIG3DI) [comments] (https://www.reddit.com/r/Pentesting/comments/vk8kwx/assets_discovery_solution_to_discover_all/)

Hacking on Medium
Follina Vulnerability To Hack Over Wan

https://cdn-images-1.medium.com/max/1200/1*BBEidxDSdGeAmkgsoT6bcg.png
by Blackstorm(Dipanshu)

Continue reading on Medium »

MSA Weekly 1 — “5 OS untuk Cyber Security”
https://medium.com/@cakraadi/msa-weekly-1-5-os-untuk-cyber-security-6bd4670440a7?source=rss------bug_bounty-5

Jika kita membicarakan yang namanya Operating System (OS), sangatlah banyak diluar sana developer yang membuat/mendevelop Operating System…Continue reading on Medium » (https://medium.com/@cakraadi/msa-weekly-1-5-os-untuk-cyber-security-6bd4670440a7?source=rss------bug_bounty-5)

Challenge
https://www.reddit.com/r/Pentesting/comments/vkau3v/challenge/

<!-- SC_OFF -->http://165.232.184.219 (http://165.232.184.219/) Find vulnerability and exploit it. Reward 50$ Poc needed <!-- SC_ON --> submitted by /u/Far-Perspective-287 (https://www.reddit.com/user/Far-Perspective-287)
[link] (https://www.reddit.com/r/Pentesting/comments/vkau3v/challenge/) [comments] (https://www.reddit.com/r/Pentesting/comments/vkau3v/challenge/)

hacking: security in practice
Awesome-RCE-techniques: A list of step by step techniques to achieve Remote Code Execution on various apps!

https://external-preview.redd.it/DyU4RB7xbHUOFhSVLPo0_zTfmkG2LGaTkC9Xp6uuqFM.jpg?width=640&crop=smart&auto=webp&s=37106006ce7a15ce7e034fcb55a6a7ec8d85a991 submitted by /u/Podalirius_
[link] [comments]

hacking: security in practice
Getting into old YouTube account?

Hi, I’m not sure where else to go but I am completely new to this and need help getting into an old YouTube account I want to remove. I know it might sound a bit odd or suspicious but they’re basically channels I made when I was young (I know 🤦‍♂️) that I don’t remember the email (I think it was an elementary school email that doesn’t exist anymore) and I also can’t remember the passwords. They only have like 5 subscribers and a couple crappy videos. Is there anyway to “hack” into these accounts to retrieve the email at least? Sorry if this isn’t allowed or I’m in the wrong place but any help is appreciated:)

submitted by /u/brscxs
[link] [comments]

MSA Weekly 1 — “5 OS untuk Cyber Security”

Jika kita membicarakan yang namanya Operating System (OS), sangatlah banyak diluar sana developer yang membuat/mendevelop Operating System…Continue reading on Medium »
Read more...

Hacking on Medium
F.B.I asked Pegasus Spyware From Israel’s NSO Group for Investigations!

https://cdn-images-1.medium.com/max/640/0*NnaXl6BIMf9ljzV5.jpg
Pegasus Spyware is a powerful spying tool developed by Israel’s NSO Group, capable of exploiting both Android and iOS devices to install…

Continue reading on Medium »

Hacking on Medium
Declared: The Data was accessed via “OAuth Tokens” |Github|

https://cdn-images-1.medium.com/max/640/0*grxxBdf0lmhS_k9F.jpg
What is Github?

Continue reading on Medium »

Hacking on Medium
Cyber Attackers Hit Hard to Puma Servers stealing 50% of its employees’ database by Kronos…

https://cdn-images-1.medium.com/max/640/0*p938YAW3p_RRJC5y.png
Puma data breach by Kronos Ransomware Attacks

Continue reading on Medium »