Another project extends their long term commitment to security! Shoutout to Paraswap for depositing 1M PSP tokens to their bug bounty in…Continue reading on Medium » (https://hatsfinance.medium.com/paraswap-deposits-1m-psp-to-their-bug-bounty-via-hats-finance-5dd39a87825e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Paraswap Deposits 1M PSP to Their Bug Bounty via Hats Finance

Another project extends their long term commitment to security! Shoutout to Paraswap for depositing 1M PSP tokens to their bug bounty in…Continue reading on Medium »
Read more...

Hacking Articles
MimiKatz for Pentester: Kerberos

This write-up will be part of a series of articles on the tool called Mimikatz which was created in the programming language C. it is mostly used for extracting Kerberos ticket from the memory and generating golden tickets. Table of Content* Kerberos::list
* Kerberos::list /export
* Kerberos::ppt ticket.kirbi
* Kerberos::tgt
* Kerberos::ask
* Kerberos::hash
* Kerberos::golden
* Kerberos::ptc
* Kerberos::clist
* Kerberos::purge

In this scenario, we will be using Mimikatz inside the client machine to find out tickets available within the client system. Kerberos::listWe will use the command:
kerberos::list
This list command will display all the tickets available on the client machine.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTW8qEyjWivBVwqSZko5NNLNyPO5efU5EpDaJa1wrXOVis3vmy4m7JnQqYt-QnNTEp9ojbKNWWEqiO32OpbJrfD2CEUg3voGTZWlPpDDVB_3AULKRYBOPpLJ_wM0OFoB_5bFaXDbNxMZ3nsRludJn0G1gZ8sv8ws3ddoINhEyOWYshHjsmmQ1y1wjReg/s16000/1.png?w=640&ssl=1

As you can see from the above screenshot, there are 2 tickets within our client machine. The list command will provide information such as:

1. Start/End time of ticket
2. Server name
3. Client name
4. and the Flag Kerberos::list /exportNow once this information has been available and if we want to save those for future use or reference, we will use the following command:
kerberos::list /export
This will save the above TGT tickets in the Mimikatz folder in the kirbi format.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIkGqyvqFMenygH4KHaIoJMREsOFyKY8XNkWNjbg9KKfBFjcVhG81ynvTFfjvS-fgozaWP5t7I9iKuG-xCYZH_ZicoriMWWPz8X0f_cI8jUtlETOeaTf2xtiQlWuvEqwdEIHkF5hzBMcFW7suc3xNnyK5EhiTNQZo4erme4ygF6tNQdSrfbkWLRyNj8g/s16000/2.png?w=640&ssl=1

Now that the ticket has been saved in the Mimikatz folder, we renamed it to ticket.kirbi for ease of use. Note that this is not a mandatory process.

Since we have this ticket, we will now see how it can be used later on for lateral movement so that we can perform pass the ticket attack.

To perform the pass the ticket attach (ptt) we will issue the following command: Kerberos::ppt ticket.kirbiOnce the command has been executed successfully, we will issue another command misc::cmd which will open a command prompt session. We can see that the command prompt session has been opened with the domain user ignite\aarti.

Let’s try to browse the directory of the server with the user aarti by typing the following command in the command prompt:

dir \\192.168.1.188\c$ (192.168.1.188 is the server IP address)

As you can see, we are able to view all the directories of the server.

So being a non-administrator domain account, the user aarti was able to check the directory of the C drive of the server by using a PTT attack.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEguLzjT2RdAh94Odvlluz5Jktra4gtn7jPjXVBMxlJFGeIDhY_XG1-f3a5rZmQJ6_me42CF_2J42-VEnp5gcLniSGMz4gQ0cxwBSNhSzBD2899ze3eiV6ketXxWKOcHO1rQwhGiSP6VZdL8jdL-2K15uUUCM6aBgmNU-O31jVQSu0IFRF0JwBlZZktmXw/s16000/3.png?w=640&ssl=1 Kerberos TGTTo display all TGT (Ticket Granting Ticket), we can use the following command:
kerberos::tgt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiH55LEUZQBls7QQXjNFth-16XvOBXjyxMPrgQnzwWCZSTABcreFNZind-1Xkfyyq0n4xi1wOkcvK0W1mjV35KdKy0ooF2iCGNfWy2haRExTVq-XRM_WdZEjWloXZdhVDyYNStpre2LE0YU_1UAIBaOZI8yKc9fIgQQr7i785BziJ2gx9URuK6AI--RSw/s16000/4.png?w=640&ssl=1 Kerberos ASKIt helps you to access the service ticket. The syntax for running this command is as follows:

Kerberos::ask /target/spn name ,where spn name is cifs:/dc1.ignite.local
kerberos::ask /target:cifs/dc1.ignite.local
To display all the service tickets, we issue the command:
kerberos::list
As we can see, we have 3 tickets listed below.

https://i0.wp.com/blog[...]

___________________________
@hacking_Attack
@Hacking_Video

ger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjnGeM1JinysuEUISOyGvRfxwEympUpIQLI5dAhvrvPs1CSngp-Dl93FmLalccCLWmwVWA2QvjWITzFbia3eKmGQ1FS7qwzDARJ1BitQFEtvJjrqtyt_AkXbeP3fXdPF65QTlPCZmQdzp68ajswzjM6qUM3ls37V6esZLY9l-LuGRXOw_us_fRv1bcAQ/s16000/5.png?w=640&ssl=1 Kerberos Hashkerberos::hash
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgF9jznzEbGQrfICFDxBh3c1wId4OXGczV2VOc3yS4v6ixlGre0ejDgYmG3xQCCGheatB5RQN6LYABPH9AbfFn91FhYdU9gnUp6m1lveS6kAGUaWIsbLDhCxHl9LwoCnDmuLbjAgJbVTGnv7Eimx0yu4yqYVsXZ4MXbrCMsmGxXh-FVWhaijDEwM2e17Q/s16000/6.png?w=640&ssl=1

This will dump all hashes available on the client machine. Kerberos ::goldenGolden Ticket Attack (GTA)

Golden Tickets are forged Ticket-Granting Tickets (TGTs), also called authentication tickets. Some basic information needed to perform this attack are:

1. Domain name: ignite.local
2. SID: S-1-5-21-1255168540-3690278322-1592948969
3. KRBTGT Hash: 5cced0cb593612f08cf4a0b4f0bcb017
4. And an impersonate user: raaz

So if we have the domain name, the SID and the hash value of krbtgt, then we can go for pass the ticket attack by generating a fake golden ticket attack.

So the command for performing GTA is as follows:
kerberos::golden /user:raaz /domain:ignite.local /sid S-1-5-21-1255168540-3690278322-1592948969 /krbtgt: 5cced0cb593612f08cf4a0b4f0bcb017 /id:500 /ptt
Where the id:500 is for administrator privilege

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjS6RBlJGmZ0ZOg-hoYLAUwU2ZTHXXk56Unx12kEh9a8wiG0D3kBd45Ef_o4z_qRmgyssm4PsImPuvKiwvFbnB0ubzLvridF4M0oyPWJc18hUG9ozRUlDN8WktAf0mKcyRcIhn2JSeS3IZKLEI0yvm5NREq59y8DaWMW10ebFWzjNJSmfzOSqVjoUI6yQ/s16000/7.png?w=640&ssl=1

As shown above, the command has been completed successfully. Now let’s launch the command prompt via Mimikatz by issuing the command: misc::cmd

Via the new command prompt, we will be able to access the server directories same as in previous examples.

Another method of golden ticket attack can be performed by using the tool impacket.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUzBhCTAVUWqCUaN5oiwsVr5vI82POBVYuWv_IjbefsOKS1i69XSObZKNkFxVC9INlbD2aZHCVlKGMiYx8Tca6koDSpfTk45dW12FRFU1MYAkUtQCRY8TYKHRtBl1UpJclpUUpA_iFS8-DTkHAIQxOrUpVlzKkrYKJkvzYZwpEYwv-ZyI1e6fHsyzveg/s16000/8.png?w=640&ssl=1

When using Mimikatz or Rubeus, they will generate the ticket in .kirbi format file. But if we use impacket for golden ticket attack so that we can get the ticket, it will not give you ticket in kirbi format. It will give you the ticket in .ccache format. Kerberos::ptcSo if we have the ticket in ccache format, then we can perform the pass the ccache as shown below. Command is:
kerberos::ptc Administrator.ccache
The misc::cmd will open a new command prompt via which we will be able to access the server directories, same as our previous examples.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLpdxmy-qzaPx-okk6o5AfRLm5CBSJ1FxTXGMTzwS_TdJsQNN4jkhbEwCYrLAZLfA0Vyfldb311NjkE3WayMr4dgx7ZJj2J7gDGMhZ93lveaKsqKOc-W0dmjI4hxrzk46QXRKOHlgcymCjQmlRtmG1DOWbwgxjPlz99y1APcwEiNEZ2Gsp0pg03ivV3Q/s16000/9.png?w=640&ssl=1 Kerberos::clistIf we want to list all the ccache files that exist on the client system, we use the following command:
kerberos::clist Administrator.cache
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRM3fHORKs08YzG3KKthRc1n2flpts_1qwnEEzvU0ECHW8Jb7fGOjgRmybtZK_2bhBcfPmLIoYqcX3SKZEXstbYAUv4J58arH9vi9i-P-XKL6lBuGoKTWFUI27asGvb1kqhhXFn5U-TYjpv9Y9cuO3r9gfcQZ9yCuYoW1IsAQh1V0d3td0YR8OHygGUA/s16000/10.png?w=640&ssl=1 Kerberos::purgeIf we want to delete all the tickets, either ccache or kirbi format, we can use the following command:
kerberos::purge
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjEuduJhgj6WcmAoVI7bGcBQ7HzCropyj8XQpa5PTYiFf6q8k-mWhfUz2UUetduxBbSHN5KsybfWpyR-V3q0h0yKkjp4bCst1b1fONq3KtUtyQYloBVnxekMSCq_6iKAg_gyyeb_3oMjuX5XsIrwb93UcOwACxB5Kr3bTyNvyQgLnVEHrMnhDXpkzptpQ/s16[...]

___________________________
@hacking_Attack
@Hacking_Video

000/11.png?w=640&ssl=1

Author: Tirut Hawoldar is a Cyber Security Enthusiast and CTF player with 15 years of experience in IT Security and Infrastructure. Can be Contacted on LinkedIn

The post MimiKatz for Pentester: Kerberos appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Online Payment Fraud Expected to Cost $343B Over Next 5 Years

Fraudster innovation will continue to drive successful phishing, business email compromise, and socially engineered attacks, researchers say.

hacking: security in practice
How To Install Kali Linux In Virtual Box - pcbegin.com

https://external-preview.redd.it/6hSeGnMC9a8kPl-dDMnNuIvpmqc--YJSUQrnCWP94zo.jpg?width=640&crop=smart&auto=webp&s=c9105c60631482f99b737e67ce6395d2b9203982 submitted by /u/Cinemablind
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Leveraging JavaScript Injection

Hey all, I would love some insight or ideas on how to leverage a JS injection vulnerability I found on an IoT device. I would first like to preface that I am in a lab environment under an internship, testing the security of a handful of IoT smart devices, on which one is vulnerable to JS injection. How the vulnerability works is that I have a web server running on my local machine and it has JS code running on it. I point the device to my web server and it runs any JS code I feed it. I have been able to get some interesting information out of it, but what I'm really after is an interactive shell. The device is running in a sand boxed browser that does not allow downloading. My goal is to download a malicious .apk file or have it run malicious code to reveal more information on it's file system (I currently have access to a basic user file system but it doesn't seem to contain much of anything super interesting). I would love any new ideas or attack vectors related to running client side code through a browser environment, and whats possible with that.

submitted by /u/dxrk-kali
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Nothing about 4Chans recent exploits?

For whom who cannot be named, if named such conversations are removed???

submitted by /u/biztelligence
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Unsure where to post exactly but assistance with xampp for some SQL Injection practice

Hey everyone,

First and foremost: I'm not sure if this is the right place to ask for this, if not kindly point me to the right sub.

I have xampp and it's setup, I'm running MySQL and Apache just fine. My issue is i'm following this blog and have downloaded his zip files but I'm not sure where to go from there. Where do I import these so that I can navigate to his site and start practising per his blog?

https://www.hackingarticles.in/beginner-guide-sql-injection-part-1/

​

I just want a site where I can practice SQL injections...i have DVWA setup but the SQL injection and Blind SQL injection examples they have there aren't a 1-1 like in this guys blog. I'm looking for something where I can replicate his examples since I need to present on this and it's much easier to practice it this way.

​

Thanks in advance!

submitted by /u/WATTHEBALL
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacking using mobile number

Insights required please

So my close friend (Girl) I were part of a whats app group for masters degree fall 22 in the US. There is this guy who always kinda Flirts with her and occasional direct message talks. she didn’t share any personal information with anyone in the group except me. But somehow this guy got access to the following information Her temporary address, her permanent address. Very private mobile number which even I don’t know. Which bank credit card she uses and other bank cards she have. Which bank card that her dad uses. Her friends friends address and Instagram ID.

When she asked how did he got this info he replied his laptop is coded by the company he works and he can access those details which should like BS. Now she is really scared what else he knows.

Is this possible ? Can companies allows this ? Or did he hacked his way for this info.

submitted by /u/The_last_PP_bender
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
'Luna Moth' Group Ransoms Data Without the Ransomware

Unsophisticated campaigns use off-the-shelf RATs and other tools to exfiltrate data and demand a ransom to keep it private.

Dark Reading: Attacks/Breaches
Fake Google Software Updates Spread New Ransomware

"HavanaCrypt" is also using a command-and-control server that is hosted on a Microsoft Hosting Service IP address, researchers say.

Dark Reading: Attacks/Breaches
Paladin Cloud Launches New Cloud Security and Governance Platform

The new open source security-as-code platform will help developers and security teams automatically detect security policy violations across the organization's cloud infrastructure.

Hacking on Medium
Article of the Day: Exploring the Social Engineering Kill Chain

https://cdn-images-1.medium.com/max/1004/1*eXN71KPI10GWp8K5-2jFag.jpeg
Social Engineering Kill–Chain: Predicting, Minimizing & Disrupting Attack Verticals — Christina Lekati, Ahead Threat Intelligence Blog on…

Continue reading on Hybrid Analyst »

___________________________
@hacking_Attack
@Hacking_Video