Black Hat Ethical Hacking
OSINT Tool: Pagodo

___________________________
@hacking_Attack
@Hacking_Video

Finding SQL Injections through source code in .NET applications

CodeAllTheThingsContinue reading on Medium »
Read more...

APT Groups with AI Generated Images

I ran some APT Group names through Google’s AI image generator. Results are probably what you’d expect.Continue reading on Medium »
Read more...

Kali Linux Tutorials
Mitmproxy2Swagger : Automatically Reverse-Engineer REST APIs Via Capturing Traffic

Mitmproxy2Swagger is a tool for automatically converting mitmproxy captures to OpenAPI 3.0 specifications. This means that you can automatically reverse-engineer REST APIs by just running the apps and capturing the traffic.

Installation

First you will need python3 and pip3.

pip install mitmproxy2swagger
… or …
pip3 install mitmproxy2swagger

Then clone the repo and run mitmproxy2swaggeras per examples below.

Usage

Mitmproxy

To create a specification by inspecting HTTP traffic you will need to:

* Capture the traffic by using the mitmproxy tool. I personally recommend using mitmweb, which is a web interface built-in to mitmproxy.

$ mitmweb
Web server listening at http://127.0.0.1:8081/
Proxy server listening at http://*:9999
…

* IMPORTANTTo configure your client to use the proxy exposed by mitm proxy, please consult the mitmproxy documentation for more information.
* Save the traffic to a flow file.In mitmweb you can do this by using the “File” menu and selecting “Save”

Run the first pass of mitmproxy2swagger:

$ mitmproxy2swagger -i -o -p

Please note that you can use an existing schema, in which case the existing schema will be extended with the new data. You can also run it a few times with different flow captures, the captured data will be safely merged.

is the base url of the API you wish to reverse-engineer. You will need to obtain it by observing the requests being made in mitmproxy.

For example if an app has made requests like these:

https://api.example.com/v1/login
https://api.example.com/v1/users/2
https://api.example.com/v1/users/2/profile

* The likely prefix is https://api.example.com/v1.
* Running the first pass should have created a section in the schema file like this:

x-path-templates:
Remove the ignore: prefix to generate an endpoint with its URL
Lines that are closer to the top take precedence, the matching is greedy
ignore:/addresses
ignore:/basket
ignore:/basket/add
ignore:/basket/checkouts
ignore:/basket/coupons/attach/{id}
ignore:/basket/coupons/attach/104754

* You should edit the schema file with a text editor and remove the ignore:prefix from the paths you wish to be generated. You can also adjust the parameters appearing in the paths.
* Run the second pass of mitmproxy2swagger:

$ mitmproxy2swagger -i -o -p [–examples]

Run the command a second time (with the same schema file). It will pick up the edited lines and generate endpoint descriptions.

Please note that mitmproxy2swagger will not overwrite existing endpoint descriptions, if you want to overwrite them, you can delete them before running the second pass.

Passing --exampleswill add example data to requests and responses. Take caution when using this option, as it may add sensitive data (tokens, passwords, personal information etc.) to the schema.

HAR

* Capture and export the traffic from the browser DevTools.In the browser DevTools, go to the Network tab and click the “Export HAR” button.
* Continue the same way you would do with the mitmproxy dump. mitmproxy2swaggerwill automatically detect the HAR file and process it.

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
PersistBOF : Tool To Help Automate Common Persistence Mechanisms

PersistBOF is a tool to help automate common persistence mechanisms. Currently supports Print Monitor (SYSTEM), Time Provider (Network Service), Start folder shortcut hijacking (User), and Junction Folder (User)

Usage

Clone, run make, add .cna to Cobalt Strike client.

run: help persist-ice in CS console

Syntax:

* persist-ice [PrintMon, TimeProv, Shortcut, Junction] [persist or clean] [key/folder name] [dll / lnk exe name];

Technique Overview

All of these techniques rely on a Dll file to be seperately placed on disk. It is intentially not part of the BOF.

Print Monitor

The Dll MUST be on disk and in a location in PATH (Dll search order) BEFORE you run the BOF. It will fail otherwise. The Dll will immediately be loaded by spoolsv.exe as SYSTEM. This can be used to elevate from admin to SYSTEM as well as for persistence. Will execute on system startup. Must be elevated to run.

* Demo Print Monitor Dll in project

Example:

* upload NotMalware.dll to C:\Windows\NotMalware.dll
* persist-ice PrintMon persist TotesLegitMonitor NotMalware.dll
* Immediately executes as SYSTEM
* Will execute on startup until removed
* persist-ice PrintMon clean TotesLegitMonitor C:\Windows\NotMalware.dll > Will delete the registery keys and unload the Dll, then attempt to delete the dll if provided the correct path. Should succeed.

Time Provider

Loaded by svchost.exe as NETWORK SERVICE (get your potatoes ready!) on startup after running the BOF. Must be elevated to run.

* Demo Time Provider Dll in project

Example:

* persist-ice TimeProv persist TotesLegitTimeProvider C:\anywhere\NotMalware.dll
* persist-ice TimeProv cleanup TotesLegitTimeProvider C:\anywhere\NotMalware.dll > Will delete the registry keys and attempt to delete the dll if provided the correct path. Will probably fail because the dll is not unloaded by the process.

Junction Folder

Same technique as demonstrated in Vault 7 leaks. Executed on user login. Non-elevated. Dll will be loaded into explorer.exe

Example:

* persist-ice Juction persist TotesLegitFolder C:\user-writable-folder\NotMalware.dll Save CLSID
* persist-ice Juction clean TotesLegitFolder C:\user-writable-folder\NotMalware.dll 6be5e092-90cc-452d-be83-208029e259e0 > Will delete the registry keys, junction folder, and attempt to delete the dll.

Start Folder Hijack

Create a new, user writeable folder, copy a hijackable windows binary to the folder, then create a shortcut in the startup folder. Executed on user login. Non-elevated.

Example:

* persist-ice Shortcut persist C:\TotesLegitFolder C:\Windows\System32\Dism.exe > upload your Dll as a proxy dll to dismcore.dll into C:\TotesLegitFolder
* persist-ice Shortcut persist C:\TotesLegitFolder C:\Windows\System32\Dism.exe > Will attempt delete all files in new folder then delete the folder itself. If the Dll is still loaded in the process then this will fail.
Download

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
What Do All of Those Cloud Cybersecurity Acronyms Mean?

Acronyms serve as a gatekeeper — if you don't sling the lingo, you don't belong. So here's a quick guide to the letter salad of cloud cybersecurity.

Dark Reading: Attacks/Breaches
ICYMI: Critical Cisco RCE Bug, Microsoft Breaks Down Hive, SHI Cyberattack

Dark Reading's digest of the other don't-miss stories of the week, including a new ransomware targeting QNAP gear, and a destructive attack against the College of the Desert that lingers on.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Impersonate

Hi everyone! Last night, while working on my laptop, a notepad I had open suddenly closed and I noticed that there was a green line surrounding my screen, like when you share your screen with another person during a virtual meeting. Well, I don't remember how exactly I found a log file, but the thing is that this log file was full of "impersonation log" and my computer user. As you may have noticed, a lot of thoughts came into my head that someone had hacked my computer, but I don't know what to do. Is there anything I can do?

submitted by /u/BorderDomin0
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Rolling-PWN attack vulnerability affecting all Honda vehicles allows anyone to permanently open the car door or even start the car engine from a long distance. CVE-2021-46145

submitted by /u/esp32s2
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What does (not associated) mean in airodump-ng?

when using airodump-ng...

if the Probeheader has a value but the bssid says (not associated)and the Framesvalue is increasing

does that mean the access point is hidden or that some device is failing to find the access point

submitted by /u/dominic_l
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
HackTheBox v4 API list

Hello mates, I was searching for a complete list of HTB APIs but I didn't find anything useful. Currently the most useful list is https://documenter.getpostman.com/view/13129365/TVeqbmeq but it has only GET requests.

In order to have a better control on the platform directly by console, I opened a repo with both useful GET and POST requests in Bash and PowerShell for anyone in the community would like to use or test these HTB APIs: https://github.com/D3vil0per/HackTheBox-API

Currently the repository has the main actions to do on the platform, during the free time I will insert the remaining APIs.

For any need, I'm available.

submitted by /u/D3vil0p
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is Their A CMD to get browser passwords??

Can We Get Our Browser Password Just Using CMD or PowerShell??

Or any Other Tool?? that can install to CMD?

submitted by /u/DoorExact9971
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How Burpsuite-pro helped me to get a 5 digit Bounty !

https://cdn-images-1.medium.com/max/600/1*eQLtg6m-rRKuet2JsfSEJQ.jpeg
Hello ppl, This is Aravind here with another awesome write-up. So now am gonna tell the story about how burpsuite pro helped me to get a 5…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TR | TryHackMe “Brooklyn Nine Nine” CTF Çözümü

https://cdn-images-1.medium.com/max/630/1*l1ZX2GjsAf63CEYGBR_PeA.jpeg
TryHackMe platformunda Brooklyn Nine Nine makinesini nasıl çözdüğümü anlatmaya çalışacağım. Çok temel bir makinaydı. Bakış açısı için…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video