Hacking on Medium
Malicious NPM Packages, are trying to hide which kinds of Intentions?

https://cdn-images-1.medium.com/max/640/0*FUzTfgvjXtHDPUP9.jpg
First, we should know what NPM Packages are? NPM is a Package Manager for Java Programme. It manages the modules so that nodes can easily…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack the pWnOS-1.0 (Boot To Root)

https://cdn-images-1.medium.com/max/950/1*aemknMmdVYJNObt0_jZTXA.png
Hey folks, Ashish this side. Today we are going to solve another CTF challenge “pWnOS-1.0”

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
IW Weekly #8: Cloudflare WAF, OAuth, TLS Fingerprinting, Talosplus, and more…

https://cdn-images-1.medium.com/max/2000/1*oxJXm1uK0Mk_X5h2iO5s1w.jpeg
Hey 👋

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
My First CTF Writeup!

https://cdn-images-1.medium.com/max/2600/0*q-WHqPhTa373H6_H
Hi! Just yesterday I posted my first CTF Writeup. For you who are unaware of CTF and Writeups, Let me start with that first.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Tofu - Windows Offline Filesystem Hacking Tool For Linux

https://blogger.googleusercontent.com/img/a/AVvXsEiRBblKzDIJUpBED4aFKrwcceuJwrAGbBsHbhYlR2qEJzpay49ageL-4FocWW4koV6DTl2ecr546jmm5DBNtX2wIcX3Pk7DaVhl3fVMriqDzh72wiFS_H_YGCYK59TfIbeL35Ct5CzwsMDfb3LsG8WK4iCMmcHluJk4HIqf6cPqUZXwocWNhtEVNMsi=w640-h436
A modular tool for hacking offline Windows filesystems and bypassing login screens. Can do hashdumps, OSK-Backdoors, user enumeration and more.
How it works :
When a Windows machine is shut down, unless it has Bitlocker or another encryption service enabled, it's storage device contains everything stored on the device as if it was unlocked. This means that you can boot from an operating system on a bootable USB and access it's files - or even just connect the filesystem to another computer.
This tool helps for when you can access the Windows filesystem from Linux (using one of the mentioned methods); it has utilities that can dump NTLM password hashes, list users, install backdoors to spawn an elevated command prompt at the login screen and more.
Modules :
Because tofu works on modules, it can be expanded for different purposes. See the 'modules' section for examples.
Current Modules:
1. hashdump.py- Dumps NTLM hashes from the target Windows filesystem
2. osk_backdoor.py- Backdoor osk.exe to bypass the login; also includes an 'unbackdoor' module
3. list_users.py- List the users with a profile on the Windows filesystem
4. chrome.py- Dump chrome history and login data of all users on the Windows filesystem
5. get_dpapi_masterkeys.py- Dump DPAPI master keys from the Windows filesystem
6. enum_unattend.py- Enumerate unattend files
7. memory_strings.py- Search through the memory of the computer to find data
8. startup.py- Inject a program into a user's startup directory
9. wifi.py- Get Wi-Fi passwords with DPAPI

Usage :
'list' : List all storage devices at /dev/ with a format of MSDOS, NTFS or -FVE-FS- (BITLOCKER) ; This will load the drive paths into memory
'usedrive' : Set the drive to use; can use numbers assigned from the 'list' command
'modules' : List modules ; This will load the module names into memory, so you need to run this command before selecting a module
'use' : Use the selected module

Setup :
(need to run as root because PyPyKatz' import path directory is dependent on the current user, and this needs to run as root)
sudo pip3 install -r requirements.txt
sudo python3 tofu.py
Built With :
PyCryptodome
PypyKatz

Warning : If you're writing a module, make sure it won't do any damage before running it

Download Tofu

___________________________
@hacking_Attack
@Hacking_Video

Tofu - Windows Offline Filesystem Hacking Tool For Linux
http://www.kitploit.com/2022/07/tofu-windows-offline-filesystem-hacking.html

___________________________
@hacking_Attack
@Hacking_Video

A modular tool for hacking offline Windows filesystems and bypassing login screens. Can do hashdumps, OSK-Backdoors, user enumeration (https://www.kitploit.com/search/label/User%20Enumeration) and more.

How it works : When a Windows machine is shut down, unless it has Bitlocker or another encryption (https://www.kitploit.com/search/label/Encryption) service enabled, it's storage device contains everything stored on the device as if it was unlocked. This means that you can boot from an operating system on a bootable USB and access it's files - or even just connect the filesystem to another computer.
This tool helps for when you can access the Windows filesystem from Linux (using one of the mentioned methods); it has utilities that can dump NTLM password hashes, list users, install backdoors to spawn an elevated command prompt at the login screen and more.
Modules : Because tofu works on modules, it can be expanded for different purposes. See the 'modules' section for examples.
Current Modules:
1. hashdump.py - Dumps NTLM hashes from the target Windows filesystem
2. osk_backdoor.py - Backdoor osk.exe to bypass the login; also includes an 'unbackdoor' module
3. list_users.py - List the users with a profile on the Windows filesystem
4. chrome.py - Dump chrome history (https://www.kitploit.com/search/label/Chrome%20History) and login data of all users on the Windows filesystem
5. get_dpapi_masterkeys.py - Dump DPAPI master keys from the Windows filesystem
6. enum_unattend.py - Enumerate unattend files
7. memory_strings.py - Search through the memory of the computer to find data
8. startup.py - Inject a program into a user's startup directory
9. wifi.py - Get Wi-Fi passwords with DPAPI
Usage : 'list' : List all storage devices at /dev/ with a format of MSDOS, NTFS or -FVE-FS- (BITLOCKER) ; This will load the drive paths into memory
'usedrive' : Set the drive to use; can use numbers assigned from the 'list' command
'modules' : List modules ; This will load the module names into memory, so you need to run this command before selecting a module
'use' : Use the selected module
Setup : (need to run as root because PyPyKatz' import path directory is dependent on the current user, and this needs to run as root)
sudo pip3 install -r requirements.txt
sudo python3 tofu.py Built With : PyCryptodome (https://github.com/Legrandin/pycryptodome)
PypyKatz (https://github.com/skelsec/pypykatz)
Warning : If you're writing a module, make sure it won't do any damage before running it


Download Tofu (https://github.com/puckblush/tofu)

___________________________
@hacking_Attack
@Hacking_Video

MSA Weekly 3 — “How to Approach Your Target Machine — Nmap Technique”
https://medium.com/@miziimoklet/msa-weekly-3-how-to-approach-your-target-machine-nmap-technique-7648222f1c60?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hai Hai, Salam hangat teman teman. Semoga kita senantiasa dalam perlindungan tuhan yang maha esa.Continue reading on Medium » (https://medium.com/@miziimoklet/msa-weekly-3-how-to-approach-your-target-machine-nmap-technique-7648222f1c60?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

MSA Weekly 3 — “How to Approach Your Target Machine — Nmap Technique”

Hai Hai, Salam hangat teman teman. Semoga kita senantiasa dalam perlindungan tuhan yang maha esa.Continue reading on Medium »
Read more...

Hacking on a Private Program (Salseforce crm)

I was hunting on a private program of HackerOne so lets call it developer.target.com i found a register option so i registered there after…Continue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
New Phishing Attacks Shame, Scare Victims into Surrendering Twitter, Discord Credentials

Scams pressure victims to "resolve an issue that could impact their status, business."

Dark Reading: Attacks/Breaches
Diversity in Cybersecurity: Fostering Gender-Inclusive Teams That Perform Better

Proactive steps in recruiting women to cybersecurity teams, along with policies focused on diversity, equity, and inclusion, help make cybersecurity teams more effective. Addressing specific barriers that female candidates face will make those teams more inclusive and more representative.

Dark Reading: Attacks/Breaches
Proposed SEC Rules Require More Transparency About Cyber-Risk

The new guidelines would require public companies to file periodic disclosures about their cybersecurity practices and notify the SEC within 96 hours of a material breach.

Dark Reading: Attacks/Breaches
Omdia: Sustainability Ranks Top on Data Center Operators’ Agendas Despite Cost and Reliability Barriers

.

___________________________
@hacking_Attack
@Hacking_Video