Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
HacktheBox — Writeup Jerry No/MSF
https://cdn-images-1.medium.com/max/600/1*AG_dkAjQH9SsgPjUdidWZw.png
Maquina relativamente sencilla, no fue necesario escalar privilegios, con el acceso inicial se obtuvo privilegios de SYSTEM
Continue reading on Medium »
HacktheBox — Writeup Jerry No/MSF
https://cdn-images-1.medium.com/max/600/1*AG_dkAjQH9SsgPjUdidWZw.png
Maquina relativamente sencilla, no fue necesario escalar privilegios, con el acceso inicial se obtuvo privilegios de SYSTEM
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Symfonos 1 — Walkthrough
https://cdn-images-1.medium.com/max/800/1*9VHCOPAe82fKzJVekXmmfQ.png
This is the twelfth post of a series of posts I’m creating to study for OSCP. You can find the previous post by clicking here.
Continue reading on Medium »
Symfonos 1 — Walkthrough
https://cdn-images-1.medium.com/max/800/1*9VHCOPAe82fKzJVekXmmfQ.png
This is the twelfth post of a series of posts I’m creating to study for OSCP. You can find the previous post by clicking here.
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
The peculiar case of HTML Injection
https://cdn-images-1.medium.com/max/910/1*yoTPoP3Pf9gBC4B_gxzxwA.png
This is a Writeup for an unusual HTML Injection bug I found on a private bug bounty program.
Continue reading on InfoSec Write-ups »
The peculiar case of HTML Injection
https://cdn-images-1.medium.com/max/910/1*yoTPoP3Pf9gBC4B_gxzxwA.png
This is a Writeup for an unusual HTML Injection bug I found on a private bug bounty program.
Continue reading on InfoSec Write-ups »
The peculiar case of HTML Injection
This is a Writeup for an unusual HTML Injection bug I found on a private bug bounty program.Continue reading on InfoSec Write-ups »
Read more...
This is a Writeup for an unusual HTML Injection bug I found on a private bug bounty program.Continue reading on InfoSec Write-ups »
Read more...
Brave — Stealing your cookies remotely
Brave for Android had a vulnerability that allowed a malicious webpage to steal your cookies remotely.Continue reading on InfoSec Write-ups »
Read more...
Brave for Android had a vulnerability that allowed a malicious webpage to steal your cookies remotely.Continue reading on InfoSec Write-ups »
Read more...
Open Redirection bug on Linkedin Sales Navigator Login panel
Hi Folks!! I’m disclosing this bug after a very long time, This is my first write-up about how I found Open URL redirection on Linkedin…Continue reading on Medium »
Read more...
Hi Folks!! I’m disclosing this bug after a very long time, This is my first write-up about how I found Open URL redirection on Linkedin…Continue reading on Medium »
Read more...
The Art of Reconnaissance| Introduction to Info Gathering & Reconnaissance
Introduction: Guide to Info Gathering & Recon for absolute beginnerContinue reading on Medium »
Read more...
Introduction: Guide to Info Gathering & Recon for absolute beginnerContinue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Defense Evasion: Windows Event Logging (T1562.002)
Defense Evasion is a cyber kill chain attack strategy that includes strategies used by attackers to prevent detection during their violation. MITRE TACTIC: Defenses Evasion (TA0005) MITRE TECHNIQUE: Impair Defence (T1562) SUBTITLE: Disable Windows Event Logging (T1562.002) Table of Contents Clear Event log using Wevtutil Command Clear Event log using
The post Defense Evasion: Windows Event Logging (T1562.002) appeared first on Hacking Articles.
Defense Evasion: Windows Event Logging (T1562.002)
Defense Evasion is a cyber kill chain attack strategy that includes strategies used by attackers to prevent detection during their violation. MITRE TACTIC: Defenses Evasion (TA0005) MITRE TECHNIQUE: Impair Defence (T1562) SUBTITLE: Disable Windows Event Logging (T1562.002) Table of Contents Clear Event log using Wevtutil Command Clear Event log using
The post Defense Evasion: Windows Event Logging (T1562.002) appeared first on Hacking Articles.
Deep Web
Dark web site for organ trade?
Does anyone know of a dark web market for selling and buying organs, such as kidneys, liver, etc.?
I'm working on a project for school about the black market trade for organs, since they're illegal in the US, and would like to explore some forums firsthand. Please help!
submitted by /u/sisyphusPB23
[link] [comments]
Dark web site for organ trade?
Does anyone know of a dark web market for selling and buying organs, such as kidneys, liver, etc.?
I'm working on a project for school about the black market trade for organs, since they're illegal in the US, and would like to explore some forums firsthand. Please help!
submitted by /u/sisyphusPB23
[link] [comments]
reddit
Dark web site for organ trade?
Does anyone know of a dark web market for selling and buying organs, such as kidneys, liver, etc.? I'm working on a project for school about the...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles|Raj Chandel's Blog
Defenses Evasion: Windows Event Logging (T1562.002)
Defenses Evasion is a cyber kill chain attack strategy that includes strategies used by attackers to prevent detection during their violation.
MITRE TACTIC: Defenses Evasion (TA0005)<o:p
MITRE TECHNIQUE: Impair Defence (T1562)<o:p
SUBTITLE: Disable Windows Event Logging (T1562.002)<o:p
<o:p Table of Contents<o:p· Clear Event log using Wevtutil Command<o:p
· Clear Event log using Powershell<o:p
· Phantom<o:p
· Mimikatz<o:p
· MiniNT registry key<o:p
· Powershell Empire<o:p
· Metasploit<o:p
<o:p
To restrict the amount of data that can be used for detection and audits, an attacker can disable Windows event logging. Login attempts, process development, other user and device behavior are all recorded in Windows event logs. Intelligence software and analysts use this information to identify the artifacts.<o:p
Clear Event log using Wevtutil Command<o:p
It's a system tool that lets you look up details on event logs and publishers. You can also use this command for installing and uninstalling event manifests, exporting, archiving, and clearing logs.<o:p https://1.bp.blogspot.com/-Z9KXTUHyHQE/YIHIAmMJJNI/AAAAAAAAvcA/yY6NVSbCSA0xHA6depYOayn7Pd9LE09DACLcBGAsYHQ/s16000/1.png Execute the following command with administrator right:<o:p
wevtutil cl security<o:p https://1.bp.blogspot.com/-bmqH6HWcG10/YIHIE_jaBFI/AAAAAAAAvcE/M49ejjrQPmsgB_ef0lMtpupFt1uHQLoaACLcBGAsYHQ/s16000/2.png <o:p
😊 All logs are clear now, but one log will be generated with event ID 1102 for clearing logs<o:p https://1.bp.blogspot.com/-gilrIG_H4iU/YIHIJ6nhDdI/AAAAAAAAvcI/DNnWVnUc1xAX84jDXcec6JmVEN7c_sw6ACLcBGAsYHQ/s16000/3.png <o:p
Clear Event log using Powershell<o:p
Another method is to use PowerShell for clearing logs, as you can observe that the machine has a system & security log.<o:p https://1.bp.blogspot.com/-hR5diSkkIMQ/YIHIN2_rBPI/AAAAAAAAvcM/GyZVtUOKg7UVNf-vnRdzi-rSE5VgqCIDwCLcBGAsYHQ/s16000/4.1.png <o:p https://1.bp.blogspot.com/-PcGtgQN7neA/YIHIU6Z1O-I/AAAAAAAAvcY/oTwQ08HVGPgXF1Q-BEklRzz5r04eL78RwCLcBGAsYHQ/s16000/4.png Run Powershell as administrator and execute the following command:<o:p
Clear-Eventlog -LogName Security<o:p
Clear-Eventlog -LogName System <o:p
The above command will clear all logs from inside System & security.<o:p
<o:p https://1.bp.blogspot.com/-XcEoDz2233o/YIHIYhuaIgI/AAAAAAAAvcc/8uF0EYVw-2Q8To4NhyfB-c9P0qZ_yRlpACLcBGAsYHQ/s16000/5.1.png Phantom<o:p
This script walks thread stacks of the Event Log Service process (specific svchost.exe) and identifies Event Log Threads to kill Event Log Service Threads. So, the system will not be able to collect logs and at the same time, the Event Log Service will appear to be running. Download it from here<o:p
<o:p
powershell -ep bypass<o:p
.\Invoke-Phant0m.ps1<o:p https://1.bp.blogspot.com/-vtWcvamRcjM/YIHIcTNmKaI/AAAAAAAAvck/IqAgXIfZrmEZyyLSTsKb7TB6PzTHk_-owCLcBGAsYHQ/s16000/5.png <o:p
Mimikatz <o:p
<o:p
How can we forget the mimikatz when it comes to the red teaming approach? Mimikatz is the most effective method, allowing you to not only steal the credential but also clear the log from within the event viewer.<o:p
Run mimikatz as administrator and execute the following command:<o:p
privilege::debug<o:p
event::<o:p https://1.bp.blogspot.com/-dmEHYV4Fi7g/YIHIgU1673I/AAAAAAAAvcs/PU8kHhbIpjI1VqsBrQZ8BfmJP6f1TlZOwCLcBGAsYHQ/s16000/6.png MiniNT registry key<o:p
You can play with the registry, create a new registry key as mention below, and reboot the machine to reload the hive.<o:p
reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNt”<o:p https://1[...]
Defenses Evasion: Windows Event Logging (T1562.002)
Defenses Evasion is a cyber kill chain attack strategy that includes strategies used by attackers to prevent detection during their violation.
MITRE TACTIC: Defenses Evasion (TA0005)<o:p
MITRE TECHNIQUE: Impair Defence (T1562)<o:p
SUBTITLE: Disable Windows Event Logging (T1562.002)<o:p
<o:p Table of Contents<o:p· Clear Event log using Wevtutil Command<o:p
· Clear Event log using Powershell<o:p
· Phantom<o:p
· Mimikatz<o:p
· MiniNT registry key<o:p
· Powershell Empire<o:p
· Metasploit<o:p
<o:p
To restrict the amount of data that can be used for detection and audits, an attacker can disable Windows event logging. Login attempts, process development, other user and device behavior are all recorded in Windows event logs. Intelligence software and analysts use this information to identify the artifacts.<o:p
Clear Event log using Wevtutil Command<o:p
It's a system tool that lets you look up details on event logs and publishers. You can also use this command for installing and uninstalling event manifests, exporting, archiving, and clearing logs.<o:p https://1.bp.blogspot.com/-Z9KXTUHyHQE/YIHIAmMJJNI/AAAAAAAAvcA/yY6NVSbCSA0xHA6depYOayn7Pd9LE09DACLcBGAsYHQ/s16000/1.png Execute the following command with administrator right:<o:p
wevtutil cl security<o:p https://1.bp.blogspot.com/-bmqH6HWcG10/YIHIE_jaBFI/AAAAAAAAvcE/M49ejjrQPmsgB_ef0lMtpupFt1uHQLoaACLcBGAsYHQ/s16000/2.png <o:p
😊 All logs are clear now, but one log will be generated with event ID 1102 for clearing logs<o:p https://1.bp.blogspot.com/-gilrIG_H4iU/YIHIJ6nhDdI/AAAAAAAAvcI/DNnWVnUc1xAX84jDXcec6JmVEN7c_sw6ACLcBGAsYHQ/s16000/3.png <o:p
Clear Event log using Powershell<o:p
Another method is to use PowerShell for clearing logs, as you can observe that the machine has a system & security log.<o:p https://1.bp.blogspot.com/-hR5diSkkIMQ/YIHIN2_rBPI/AAAAAAAAvcM/GyZVtUOKg7UVNf-vnRdzi-rSE5VgqCIDwCLcBGAsYHQ/s16000/4.1.png <o:p https://1.bp.blogspot.com/-PcGtgQN7neA/YIHIU6Z1O-I/AAAAAAAAvcY/oTwQ08HVGPgXF1Q-BEklRzz5r04eL78RwCLcBGAsYHQ/s16000/4.png Run Powershell as administrator and execute the following command:<o:p
Clear-Eventlog -LogName Security<o:p
Clear-Eventlog -LogName System <o:p
The above command will clear all logs from inside System & security.<o:p
<o:p https://1.bp.blogspot.com/-XcEoDz2233o/YIHIYhuaIgI/AAAAAAAAvcc/8uF0EYVw-2Q8To4NhyfB-c9P0qZ_yRlpACLcBGAsYHQ/s16000/5.1.png Phantom<o:p
This script walks thread stacks of the Event Log Service process (specific svchost.exe) and identifies Event Log Threads to kill Event Log Service Threads. So, the system will not be able to collect logs and at the same time, the Event Log Service will appear to be running. Download it from here<o:p
<o:p
powershell -ep bypass<o:p
.\Invoke-Phant0m.ps1<o:p https://1.bp.blogspot.com/-vtWcvamRcjM/YIHIcTNmKaI/AAAAAAAAvck/IqAgXIfZrmEZyyLSTsKb7TB6PzTHk_-owCLcBGAsYHQ/s16000/5.png <o:p
Mimikatz <o:p
<o:p
How can we forget the mimikatz when it comes to the red teaming approach? Mimikatz is the most effective method, allowing you to not only steal the credential but also clear the log from within the event viewer.<o:p
Run mimikatz as administrator and execute the following command:<o:p
privilege::debug<o:p
event::<o:p https://1.bp.blogspot.com/-dmEHYV4Fi7g/YIHIgU1673I/AAAAAAAAvcs/PU8kHhbIpjI1VqsBrQZ8BfmJP6f1TlZOwCLcBGAsYHQ/s16000/6.png MiniNT registry key<o:p
You can play with the registry, create a new registry key as mention below, and reboot the machine to reload the hive.<o:p
reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNt”<o:p https://1[...]
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles|Raj Chandel's Blog Defenses Evasion: Windows Event Logging (T1562.002) Defenses Evasion is a cyber kill chain attack strategy that includes strategies used by attackers to prevent detection during their violation. MITRE TACTIC: Defenses…
.bp.blogspot.com/-Y5E4sbPPlG0/YIHIkL7GDEI/AAAAAAAAvcw/CkUvZOsT0a4bAXhUZVoPLo9UqoYzgPZkwCLcBGAsYHQ/s16000/7.png This key disables the event viewer and thus restricts it from generating the logs.<o:p https://1.bp.blogspot.com/-XLcZ9uQFR34/YIHInv_EEUI/AAAAAAAAvc4/bkE_8xWs1k8wICj_msEA9MdHFY_mXCh8QCLcBGAsYHQ/s16000/8.png <o:p
PowerShell Empire<o:p
The PowerShell empire can also be used to clear logs, classify Event Log threads, and destroy Event Log Service threads.<o:p
Use the following command to execute the module for respected agents:<o:p
usemodule management/phant0m<o:p
execute<o:p https://1.bp.blogspot.com/-bsqbO8mOlDg/YIHIr6z-ePI/AAAAAAAAvc8/7L56yxZ8g7Ig1ajeDHTdw7Tc78PP74FFACLcBGAsYHQ/s16000/50.png Metasploit<o:p
Last but not least, we have the Metasploit framework to clean applications, security & system logs from within the event viewer. In the meterperter session you can execute the following command.<o:p
clearev<o:p
<o:p https://1.bp.blogspot.com/-M_WAALaOFR0/YIHIvxXSWeI/AAAAAAAAvdA/sZm1qCehbjUpNH_xAlIXYjtfI0tHMCmkACLcBGAsYHQ/s16000/51.png Reference: https://svch0st.medium.com/event-log-tampering-part-1-disrupting-the-eventlog-service-8d4b7d67335c<o:p
PowerShell Empire<o:p
The PowerShell empire can also be used to clear logs, classify Event Log threads, and destroy Event Log Service threads.<o:p
Use the following command to execute the module for respected agents:<o:p
usemodule management/phant0m<o:p
execute<o:p https://1.bp.blogspot.com/-bsqbO8mOlDg/YIHIr6z-ePI/AAAAAAAAvc8/7L56yxZ8g7Ig1ajeDHTdw7Tc78PP74FFACLcBGAsYHQ/s16000/50.png Metasploit<o:p
Last but not least, we have the Metasploit framework to clean applications, security & system logs from within the event viewer. In the meterperter session you can execute the following command.<o:p
clearev<o:p
<o:p https://1.bp.blogspot.com/-M_WAALaOFR0/YIHIvxXSWeI/AAAAAAAAvdA/sZm1qCehbjUpNH_xAlIXYjtfI0tHMCmkACLcBGAsYHQ/s16000/51.png Reference: https://svch0st.medium.com/event-log-tampering-part-1-disrupting-the-eventlog-service-8d4b7d67335c<o:p
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Improving the Vulnerability Reporting Process With 5 Steps
Follow these tips for an effective and positive experience for both the maintainer and external vulnerability reporter.
Improving the Vulnerability Reporting Process With 5 Steps
Follow these tips for an effective and positive experience for both the maintainer and external vulnerability reporter.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Prometei Botnet Adds New Twist to Exchange Server Attacks
Attackers are using the well-known Microsoft Exchange Server flaw to add machines to a cryptocurrency botnet, researchers say.
Prometei Botnet Adds New Twist to Exchange Server Attacks
Attackers are using the well-known Microsoft Exchange Server flaw to add machines to a cryptocurrency botnet, researchers say.
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
I made a keylogger with an auto mailer
I am currently trying my best at learning python and I decided to make a keylogger. https://github.com/Autismo23/simplepythonkeylogger
I figured I might post it in here if anybody wants to take their time to give me some feedback. The keylogger has an auto-mailer and a black- and whitelist. Are there any improvements I could add to make it better (in technical terms, because I don't care too much about esthetics).
submitted by /u/LarryTheSnobster
[link] [comments]
I made a keylogger with an auto mailer
I am currently trying my best at learning python and I decided to make a keylogger. https://github.com/Autismo23/simplepythonkeylogger
I figured I might post it in here if anybody wants to take their time to give me some feedback. The keylogger has an auto-mailer and a black- and whitelist. Are there any improvements I could add to make it better (in technical terms, because I don't care too much about esthetics).
submitted by /u/LarryTheSnobster
[link] [comments]