The Art of Reconnaissance| Introduction to Info Gathering & Reconnaissance

Introduction: Guide to Info Gathering & Recon for absolute beginnerContinue reading on Medium »
Read more...

Hacking Articles
Defense Evasion: Windows Event Logging (T1562.002)

Defense Evasion is a cyber kill chain attack strategy that includes strategies used by attackers to prevent detection during their violation. MITRE TACTIC: Defenses Evasion (TA0005) MITRE TECHNIQUE: Impair Defence (T1562) SUBTITLE: Disable Windows Event Logging (T1562.002) Table of Contents Clear Event log using Wevtutil Command Clear Event log using

The post Defense Evasion: Windows Event Logging (T1562.002) appeared first on Hacking Articles.

Deep Web
Dark web site for organ trade?

Does anyone know of a dark web market for selling and buying organs, such as kidneys, liver, etc.?

I'm working on a project for school about the black market trade for organs, since they're illegal in the US, and would like to explore some forums firsthand. Please help!

submitted by /u/sisyphusPB23
[link] [comments]

Hacking Articles|Raj Chandel's Blog
Defenses Evasion: Windows Event Logging (T1562.002)

Defenses Evasion is a cyber kill chain attack strategy that includes strategies used by attackers to prevent detection during their violation.

MITRE TACTIC: Defenses Evasion (TA0005)<o:p

MITRE TECHNIQUE: Impair Defence (T1562)<o:p

SUBTITLE: Disable Windows Event Logging (T1562.002)<o:p

<o:p Table of Contents<o:p· Clear Event log using Wevtutil Command<o:p

· Clear Event log using Powershell<o:p

· Phantom<o:p

· Mimikatz<o:p

· MiniNT registry key<o:p

· Powershell Empire<o:p

· Metasploit<o:p

<o:p

To restrict the amount of data that can be used for detection and audits, an attacker can disable Windows event logging. Login attempts, process development, other user and device behavior are all recorded in Windows event logs. Intelligence software and analysts use this information to identify the artifacts.<o:p

Clear Event log using Wevtutil Command<o:p

It's a system tool that lets you look up details on event logs and publishers. You can also use this command for installing and uninstalling event manifests, exporting, archiving, and clearing logs.<o:p https://1.bp.blogspot.com/-Z9KXTUHyHQE/YIHIAmMJJNI/AAAAAAAAvcA/yY6NVSbCSA0xHA6depYOayn7Pd9LE09DACLcBGAsYHQ/s16000/1.png Execute the following command with administrator right:<o:p

wevtutil cl security<o:p https://1.bp.blogspot.com/-bmqH6HWcG10/YIHIE_jaBFI/AAAAAAAAvcE/M49ejjrQPmsgB_ef0lMtpupFt1uHQLoaACLcBGAsYHQ/s16000/2.png <o:p

😊 All logs are clear now, but one log will be generated with event ID 1102 for clearing logs<o:p https://1.bp.blogspot.com/-gilrIG_H4iU/YIHIJ6nhDdI/AAAAAAAAvcI/DNnWVnUc1xAX84jDXcec6JmVEN7c_sw6ACLcBGAsYHQ/s16000/3.png <o:p

Clear Event log using Powershell<o:p

Another method is to use PowerShell for clearing logs, as you can observe that the machine has a system & security log.<o:p https://1.bp.blogspot.com/-hR5diSkkIMQ/YIHIN2_rBPI/AAAAAAAAvcM/GyZVtUOKg7UVNf-vnRdzi-rSE5VgqCIDwCLcBGAsYHQ/s16000/4.1.png <o:p https://1.bp.blogspot.com/-PcGtgQN7neA/YIHIU6Z1O-I/AAAAAAAAvcY/oTwQ08HVGPgXF1Q-BEklRzz5r04eL78RwCLcBGAsYHQ/s16000/4.png Run Powershell as administrator and execute the following command:<o:p

Clear-Eventlog -LogName Security<o:p

Clear-Eventlog -LogName System <o:p

The above command will clear all logs from inside System & security.<o:p

<o:p https://1.bp.blogspot.com/-XcEoDz2233o/YIHIYhuaIgI/AAAAAAAAvcc/8uF0EYVw-2Q8To4NhyfB-c9P0qZ_yRlpACLcBGAsYHQ/s16000/5.1.png Phantom<o:p

This script walks thread stacks of the Event Log Service process (specific svchost.exe) and identifies Event Log Threads to kill Event Log Service Threads. So, the system will not be able to collect logs and at the same time, the Event Log Service will appear to be running. Download it from here<o:p

<o:p

powershell -ep bypass<o:p

.\Invoke-Phant0m.ps1<o:p https://1.bp.blogspot.com/-vtWcvamRcjM/YIHIcTNmKaI/AAAAAAAAvck/IqAgXIfZrmEZyyLSTsKb7TB6PzTHk_-owCLcBGAsYHQ/s16000/5.png <o:p

Mimikatz <o:p

<o:p

How can we forget the mimikatz when it comes to the red teaming approach? Mimikatz is the most effective method, allowing you to not only steal the credential but also clear the log from within the event viewer.<o:p

Run mimikatz as administrator and execute the following command:<o:p

privilege::debug<o:p

event::<o:p https://1.bp.blogspot.com/-dmEHYV4Fi7g/YIHIgU1673I/AAAAAAAAvcs/PU8kHhbIpjI1VqsBrQZ8BfmJP6f1TlZOwCLcBGAsYHQ/s16000/6.png MiniNT registry key<o:p

You can play with the registry, create a new registry key as mention below, and reboot the machine to reload the hive.<o:p

reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNt”<o:p https://1[...]

.bp.blogspot.com/-Y5E4sbPPlG0/YIHIkL7GDEI/AAAAAAAAvcw/CkUvZOsT0a4bAXhUZVoPLo9UqoYzgPZkwCLcBGAsYHQ/s16000/7.png This key disables the event viewer and thus restricts it from generating the logs.<o:p https://1.bp.blogspot.com/-XLcZ9uQFR34/YIHInv_EEUI/AAAAAAAAvc4/bkE_8xWs1k8wICj_msEA9MdHFY_mXCh8QCLcBGAsYHQ/s16000/8.png <o:p

PowerShell Empire<o:p

The PowerShell empire can also be used to clear logs, classify Event Log threads, and destroy Event Log Service threads.<o:p

Use the following command to execute the module for respected agents:<o:p

usemodule management/phant0m<o:p

execute<o:p https://1.bp.blogspot.com/-bsqbO8mOlDg/YIHIr6z-ePI/AAAAAAAAvc8/7L56yxZ8g7Ig1ajeDHTdw7Tc78PP74FFACLcBGAsYHQ/s16000/50.png Metasploit<o:p

Last but not least, we have the Metasploit framework to clean applications, security & system logs from within the event viewer. In the meterperter session you can execute the following command.<o:p

clearev<o:p

<o:p https://1.bp.blogspot.com/-M_WAALaOFR0/YIHIvxXSWeI/AAAAAAAAvdA/sZm1qCehbjUpNH_xAlIXYjtfI0tHMCmkACLcBGAsYHQ/s16000/51.png Reference: https://svch0st.medium.com/event-log-tampering-part-1-disrupting-the-eventlog-service-8d4b7d67335c<o:p

Dark Reading: Attacks/Breaches
Improving the Vulnerability Reporting Process With 5 Steps

Follow these tips for an effective and positive experience for both the maintainer and external vulnerability reporter.

Dark Reading: Attacks/Breaches
Prometei Botnet Adds New Twist to Exchange Server Attacks

Attackers are using the well-known Microsoft Exchange Server flaw to add machines to a cryptocurrency botnet, researchers say.

hacking: security in practice
I made a keylogger with an auto mailer

I am currently trying my best at learning python and I decided to make a keylogger. https://github.com/Autismo23/simplepythonkeylogger

​

I figured I might post it in here if anybody wants to take their time to give me some feedback. The keylogger has an auto-mailer and a black- and whitelist. Are there any improvements I could add to make it better (in technical terms, because I don't care too much about esthetics).

submitted by /u/LarryTheSnobster
[link] [comments]

Got Nice catch by Google
https://parthdeshani.medium.com/got-nice-catch-by-google-5e6a8211371c?source=rss------bug_bounty-5

This is my story of finding multiple bugs in Google’s acquisition chain to increase the severity and get a Nice catch by GOOGLEContinue reading on Medium » (https://parthdeshani.medium.com/got-nice-catch-by-google-5e6a8211371c?source=rss------bug_bounty-5)

Hacking on Medium
The Art of Reconnaissance| Introduction to Info Gathering & Reconnaissance

https://cdn-images-1.medium.com/max/848/1*3da9unOfANT1Og3F8UIdmw.jpeg
Introduction: Guide to Info Gathering & Recon for absolute beginner

Continue reading on Medium »

KitPloit - PenTest Tools!
Vulnerablecode - A Free And Open Vulnerabilities Database And The Packages They Impact And The Tools To Aggregate And Correlate These Vulnerabilities

https://1.bp.blogspot.com/-iPGNBqD8FB8/YH5lvJZPTFI/AAAAAAAAV68/boQXXAGoUCMUdahqlVN5jjW7gbT80XYuQCNcBGAsYHQ/w640-h336/vulnerablecode_6_README.png VulnerableCode is a free and open database of FOSS software package vulnerabilities and the tools to create and keep the data current.

It is made by the FOSS community to improve and secure the open source software ecosystem. Why?The existing solutions are commercial proprietary vulnerability databases, which in itself does not make sense because the data is about FOSS (Free and Open Source Software).

The National Vulnerability Database which is a primary centralized data source for known vulnerabilities is not particularly well suited to address FOSS security issues because:

1. It predates the explosion of FOSS software usage
2. It's data format reflects a commercial vendor-centric point of view in part due to the usage of CPE to map vulnerabilities to existing packages.
3. CPEs are just not designed to map FOSS to vulnerabilities owing to their vendor-product centric semantics. This makes it really hard to answer the fundamental questions "Is package foo vulnerable" and "Is package foo vulnerable to vulnerability bar?" HowVulnerableCode independently aggregates many software vulnerability data sources and supports data re-creation in a decentralized fashion. These data sources (see complete list here) include security advisories published by Linux and BSD distributions, application software package managers and package repositories, FOSS projects, GitHub and more. Thanks to this approach, the data is focused on specific ecosystems yet aggregated in a single database that enables querying a richer graph of relations between multiple incarnations of a package. Being specific increases the accuracy and validity of the data as the same version of an upstream package across different ecosystems may or may not be vulnerable to the same vulnerability.

The packages are identified using Package URL PURL as primary identifiers rather than CPEs. This makes answers to questions such as "Is package foo vulnerable to vulnerability bar?" much more accurate and easy to interpret.

The primary access to the data is through a REST API.

In addition, an emerging web interface goal is to support vulnerabilities data browsing and search and progressively to enable community curation of the data with the addition of new packages and vulnerabilities, and reviewing and updating their relationships.

We also plan to mine for vulnerabilities which didn't receive any exposure due to various reasons like but not limited to the complicated procedure to receive CVE ID or not able to classify a bug as a security compromise.

Recent presentations:

* Open Source Summit 2020 Setting up VulnerableCodeFirst clone the source code: git clone https://github.com/nexB/vulnerablecode.git
cd vulnerablecode Using Docker ComposeAn easy way to set up VulnerableCode is with docker containers and docker compose. For this you need to have the following installed.

* Docker Engine. Find instructions to install it here
* Docker Compose. Find instructions to install it here

Use sudo docker-compose upto start VulnerableCode. Then access VulnerableCode at http://localhost:8000/ or at http://127.0.0.1:8000/

Important: Don't forget to run sudo docker-compose up -d --no-deps --build webto sync your instance after every git pull.

Use sudo docker-compose exec web bashto access the VulnerableCode container. From here you can access manage.pyand run management commands to import data as specified [...]