Hacking on Medium
BugBounty Writeup: XSS, JWT none attack, Improper Error Handling

https://cdn-images-1.medium.com/max/700/0*s2RFkB0IhfUXRim7
Hackers around the world hunt bugs and, in some cases, earn full-time incomes.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Access control worth $2000 (everyone missed this IDOR+Access control between two admins.)

Tribute to Binit GhimireContinue reading on Pentester Nepal »
Read more...

Access control worth $2000 (everyone missed this IDOR+Access control between two admins.)
https://medium.com/pentesternepal/access-control-worth-2000-everyone-missed-this-idor-access-control-between-two-admins-9745eaf15d21?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Tribute to Binit GhimireContinue reading on Pentester Nepal » (https://medium.com/pentesternepal/access-control-worth-2000-everyone-missed-this-idor-access-control-between-two-admins-9745eaf15d21?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Giveaway #2: The Ultimate Guide to Hunt Account Takeover(2022)
https://faiyazhacks.medium.com/giveaway-2-the-ultimate-guide-to-hunt-account-takeover-2022-c0f163d0f636?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

INTRODUCTIONContinue reading on Medium » (https://faiyazhacks.medium.com/giveaway-2-the-ultimate-guide-to-hunt-account-takeover-2022-c0f163d0f636?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
C2concealer : Command Line Tool That Generates Randomized C2 Malleable Profiles For Use In Cobalt Strike

C2concealer is a command line tool that generates randomized C2 malleable profiles for use in Cobalt Strike. Installationchmod u+x install.sh
./install.sh Building Docker Imagedocker build -t C2concealer . Running with Dockerdocker container run -it -v Example UsageUsage:
$ C2concealer –hostname google.com –variant 3
Flags:
(optional)
–hostname
The hostname used in HTTP client and server side settings. Default is None.
–variant
An integer defining the number of HTTP client/server variants to generate.
Recommend between 1 and 5. Max 10. Example Console Outputroot@kali:~# C2concealer –variant 1 –hostname google.com
[i] Searching for the c2lint tool on your system (part of Cobalt Strike). Might take 10-20 seconds.
[i] Found c2lint in the /opt/cobaltstrike/c2lint directory.
Choose an SSL option:
Self-signed SSL cert (just input a few details)
LetsEncrypt SSL cert (requies a temporary A record for the relevant domain to be pointed to this machine)
Existing keystore
No SSL
[?] Option [1/2/3/4]: How It WorksWe poured over the Cobalt Strike documentation and defined ranges of values that would make sense for each profile attribute. Sometimes that data is as simple as a random integer within some range and other times we need to pick a random value from a python dictionary. Either way, we started tool creation with defining the data that would make a valid profile.

Then we divided each malleable profile section (or block) into a separate .py file, which contains the logic to draw random appropriate values for each attribute and then output a formatted string for that profile block. We concatenate all profile blocks together, run a few quick consistency checks and then run the profile through the Cobalt Strike linter (c2lint). The output is a profile that should work for your engagements. We always recommend testing the profile (including process injection and spawning) prior to running a campaign.

If you’re looking into the code, we recommend starting with these two files: /C2concealer/main.py and /C2concealer/profile.py. After reviewing the comments, check out individuals profile block generators in the folder: /C2concealer/components. Customizing the toolThis is crucial. This is an open sourced version of a tool we’ve been using privately for about a year. Our private repo has several additional IOCs and a completely different data set. While running the tool provides an excellent start for building a Cobalt Strike malleable profile, we recommend digging into the following areas to customize the data that is randomly populating the tool:

/C2concealer/data/

* dns.py (customize the dns subdomains)
* file_type_prepend.py (customize how http-get-server repsonses look … aka c2 control instructions)
* params.py (two dictionaries containing common parameter names and a generic wordlist)
* post_ex.py (spawn_to process list…definitely change this one)
* reg_headers.py (typical http headers like user-agent and server)
* smb.py (smb pipenames for use when comms go over smb)
* stage.py (data for changing IOCs related to the stager)
* transform.py (payload data transformations…no need to change this)
* urls.py (filetypes and url path components used for building URIs all across the tool…definitely change this)

In addition, you can customize various attributes all throughout the profile generation process. As an example, in the file: “/C2concealer/components/stageblock.py”, you can change the range from which PE image size value is drawn from (near lines 73-74). Please look through all the different files in the components directory.

If you’ve made it this far, then we know you’ll get a lot of use out of th[...]

___________________________
@hacking_Attack
@Hacking_Video

is tool. The way we recommend viewing this tool is that we’ve built the skeleton code to automatically generate these profiles, now it’s up to you to think through what values make sense for each attribute for your campaigns and update the data sources. Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Xepor : Web Routing Framework For Reverse Engineers And Security Researchers

Xepor (pronounced /ˈzɛfə/, zephyr), a web routing framework for reverse engineers and security researchers. It provides a Flask-like API for hackers to intercept and modify HTTP request and/or HTTP response in a human-friendly coding style.

This project is meant to be used with mitmproxy. User write scripts with xepor, and run the script inside mitmproxy with mitmproxy -s your-script.py.

If you want to step from PoC to production, from demo(e.g. http-reply-from-proxy.py, http-trailers.py, http-stream-modify.py) to something you could take out with your WiFi Pineapple, then Xepor is for you! Features* Code everything with @api.route(), just like Flask! Write everything in one script and no if..elseany more.
* Handle multiple URL routes, even multiple hosts in one InterceptedAPIinstance.
* For each route, you can choose to modify the request before connecting to server (or even return a fake response without connection to upstream), or modify the response before forwarding to user.
* Blacklist mode or whitelist mode. Only allow URL endpoints defined in scripts to connect to upstream, blocking everything else (in specific domain) with HTTP 404. Suitable for transparent proxying.
* Human readable URL path definition and matching powered by parse
* Host remapping. define rules to redirect to genuine upstream from your fake hosts. Regex matching is supported. Best for SSL stripping and server side license cracking!
* Plus all the bests from mitmproxy! ALL operation modes ( mitmproxy/ mitmweb+ regular/ transparent/ socks5/ reverse:SPEC/ upstream:SPEC) are fully supported. Use Case* Evil AP and phishing through MITM.
* Sniffing traffic from specific device by iptables + transparent proxy, modify the payload with xepor on the fly.
* Cracking cloud based software license. See examples/krisp/ as an example.
* Write complicated web crawler in ~100 lines of codes. See examples/polyv_scrapper/ as an example.
* … and many more.

SSL stripping is NOT provided by this project. Installationpip install xepor Quick startTake the script from examples/httpbin as an example.

In this example, we setup the mitmproxy server on 127.0.0.1. You could change it to any IP on your machine or alternatively to the IP of your VPS. The mitmproxy server running in reverse, upstream and transparent mode requires --set connection_strategy=lazyoption to be set so that Xepor could function correctly. I recommand this option always be on for best stability.

Set your Browser HTTP Proxy to http://127.0.0.1:8080, and access web interface at http://127.0.0.1:8081/.

Send a GET request from http://httpbin.org/#/HTTP_Methods/get_get , Then you could see the modification made by Xepor in mitmweb interface, browser devtools or Wireshark.

The httpbin.pydo two things.

* When user access http://httpbin.org/get, inject a query string parameter payload=evil_paraminside HTTP request.
* When user access http://httpbin.org/basic-auth/xx/xx/ (we just pretends we don’t know the password), sniff Authorizationheaders from HTTP requests and print the password to the attacker.

Just what mitmproxy always do, but with code written in xepor way. https://github.com/xepor/xepor-examples/tree/main/httpbin/httpbin.pyfrom mitmproxy.http import HTTPFlow
from xepor import InterceptedAPI, RouteType
HOST_HTTPBIN = “httpbin.org”
api = InterceptedAPI(HOST_HTTPBIN)
@api.route(“/get”)
def change_your_request(flow: HTTPFlow):
“””
Modify URL query param.
Test at:
http://httpbin.org/#/HTTP_Methods/get_get
“””
flow.request.query[“payload”] = “evil_param”
@api.route(“/basic-auth/{usr}/{pwd}”, rtype=RouteType.RESPONSE)
def capture_auth(flow: HTTPFlow, usr=None, pwd=None):
“””
Sniffing password.
Test at:
http://httpbin.org/#/Auth/get_basic_auth__user___passwd_
“””
print(
f”auth @ {usr} + {pwd}:”,
f”Captured {‘successful’ if flow.response.status_code < 300 else ‘unsuccessful’} login:”,
flow.request.headers.get(“Authorization”, “”),
)
addons = [api] Download

Giveaway #2: The Ultimate Guide to Hunt Account Takeover(2022)

INTRODUCTIONContinue reading on Medium »
Read more...

Hacking on Medium
How you got hacked: an overview of current 2FA/MFA exploits and security measures

https://cdn-images-1.medium.com/max/1200/1*JDsaQfhxWq8-5awXbvO87A.png
Let’s say you work at Some Company, doing Some Job. One day at work, you check your email and find that Some Company is mandating…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Researchers crack MEGA’s ‘privacy by design’ storage, encryption

Researchers crack MEGA’s ‘privacy by design’ storage, encryptionPost Views: 5
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
ETH Zurich cryptography researchers Matilda Backendal, Miro Haller, and Professor Kenneth Paterson analyzed MEGA’s source code and cryptographic architecture, uncovering a total of five vulnerabilities.
MEGA claims that its storage service is private by design, but according to researchers, the technology is beset with “serious” security issues.

Based in New Zealand, MEGA is a cloud storage service and messaging platform that offers end-to-end encryption to more than 250 million users. MEGA also allows users to make audio and video calls.

The company calls itself a “zero-knowledge” encryption service built with “privacy by design”.

“All your data on MEGA is encrypted with a key derived from your password; in other words, your password is your main encryption key,” the organization says. “MEGA does not have access to your password or your data.”

However, according to the ETH Zurich University, based in Switzerland, in-depth testing of the platform has revealed “security holes that would allow the provider to decrypt and manipulate customer data”, despite its marketing claims to the contrary.

ETH Zurich cryptography researchers Matilda Backendal, Miro Haller, and Professor Kenneth Paterson analyzed MEGA’s source code and cryptographic architecture, uncovering a total of five vulnerabilities.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Encryption crackedAfter recreating part of the MEGA platform and attempting to brute-force their own accounts, the team says they found that using one main key represents a “fundamental” weakness in the service.

A paper (PDF) describing the flaw says that the MEGA client derives an authentication key from a user’s password. This key is then used to encrypt other key material, files, and more.

A lack of integrity protection of ciphertexts containing keys breaks the confidentiality of the master key and overall encryption system, according to the researchers. This permits integrity attacks, RSA key and plaintext recovery attacks, and establishes an RSA decryption attack vector.

By hijacking only a session ID, it takes a maximum of 512 login attempts to break into a MEGA account.

“An additional manipulation of the MEGA software program on the computer of the victim can force their user account to constantly log in automatically,” the researchers said. “This shortens the time needed to fully reveal the key to just a few minutes.”

It then may be possible to compromise other keys used on the MEGA platform.

Potential post-attack vectors could include stealing user data or even uploading files – such as illegal or compromising images and video – locking up the account, and then blackmailing the targeted individual.
Trending: Internet scans find 1.6 million secrets leaked by websites MEGA responsePaterson said the team reported its findings to MEGA on March 24 and proposed ways to resolve the security holes.

While MEGA apparently “decided to react in ways that are different than what we suggested,” according to the researcher, the initial attack vector on the RSA key has now been patched.

When approached for comment, MEGA pointed us toward a security advisory which says the first fix has been rolled out and additional patches are being developed.

According to MEGA, only customers that have logged into th[...]

___________________________
@hacking_Attack
@Hacking_Video

eir account at least 512 times could be at risk – and this does not include resuming existing sessions.

Furthermore, the organization says that to take advantage of the cryptographic flaws, attackers would need to “gain control over the heart of MEGA’s server infrastructure or achieve a successful man[ipulator]-in-the-middle attack on the user’s TLS connection to MEGA”.

“The reported vulnerabilities would have required MEGA to become a bad actor against certain of its users, or otherwise could only be exploited if another party compromised MEGA’s API servers or TLS connections without being noticed,” the firm added.
Trending: Recon Tool: JFScan Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
The Daily Swig passed on this reaction to researchers at ETH Zurich who responded by saying MEGA had only resolved some of the security shortcomings that they had identified:

As detailed on the webpage of the paper [1], we contacted MEGA on March 24, 2022, to inform them of the vulnerabilities. They responded the same day and acknowledged the issues. They have been very open and communicative throughout. As part of our disclosure, we provided them with three sets of countermeasures, ranging from ‘immediate’ to ‘recommended’.

MEGA decided to go with a different patch, which protects against the first three out of our five attacks. You can read more about this in their blog post [2]. We continue to stand by our recommended countermeasures, which we believe would protect against our attacks (and others) in a more robust way than the fix that MEGA decided for.
Trending: Write up: How to schedule tasks the right way in Linux, using crontab
Source: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/f9ed623c5c-90x90.jpg Google Warns Spyware Being Deployed Against Android, iOS Users24 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/170720-poulsen-fancy-bear-tease_zzzwzw-90x90.jpg Fancy Bear Uses Nuke Threat Lure to Exploit 1-Click Bug4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/intro_toddycat_apt-800x450-1-90x90.jpg Elusive ToddyCat APT Targets Microsoft Exchange Servers5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/office-365-90x90.jpg Office 365 Config Loophole Opens OneDrive, SharePoint Data to Ransomware Attack6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/cyber-1-90x90.jpg Internet scans find 1.6 million secrets leaked by websites1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/malicious-chrome-extensions-feature-90x90.jpg Google Chrome extensions can be fingerprinted to track you online1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/android_malware-700x394-1-90x90.jpg New MaliBot Android banking malware spreads as a crypto miner2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Cisco_Systems_Bug-90x90.jpg Cisco Secure Email bug can let attackers bypass authentication2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/android-malware-90x90.jpg Android malware on the Google Play Store gets 2 million downloads2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Linux-90x90.jpg New Linux rootkit, Syslogk uses magic packets to trigger backdoor2 weeks ago
The post Researchers crack MEGA’s ‘privacy by design’ storage, encryption first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How To Tell You Have Been Hacked — Tips To Defend Your Network

https://cdn-images-1.medium.com/max/2600/1*90f-xU1ImcFWfmGCSJ0r5A.jpeg
There is no one way you can be hacked but many. And it is very important in today’s world that you know how to recognize these signs, so…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video