Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Anyone else here keeps getting hacked by someone owning an iOS 13?

On Chrome iOS 13.

Same with my Discord and Twitter.

Don't know how they got in and why discord isn't texting me or twitter.

I use Yandex. I don't know where the security breach was and how I got hacked.

submitted by /u/RedditislikeFB
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Anyone else here keeps getting hacked by someone owning an iOS 13?

On Chrome iOS 13. Same with my Discord and Twitter. Don't know how they got in and why discord isn't texting me or twitter. I use Yandex. I...

3 viewsedited 08:42

https://a.thumbs.redditmedia.com/KjkEKowXrXTOK2iXl5i6qEGfb3WQcvd_im7ozi-AFM4.jpg I know 6E stand for outsb, but what does 2 byte 65 4F means? In the hex view from 54 to 79 stand for a string(TimeBubbleOnApply), but comparing it with assembly code above, there's also some opcode i know inside (69 for imul, 6D for [RSP+BYTE], 6C for insb,...) and i get confused by this. So which one these bytes actually stand for? The opcode or the string?

https://preview.redd.it/lwu5hhb4nab91.jpg?width=750&format=pjpg&auto=webp&s=23b413ca04c96a9beadbdc4878ffee29e019099f

https://preview.redd.it/qdzgnkb4nab91.jpg?width=596&format=pjpg&auto=webp&s=51ce0b6751baf5c7de635e53e62038bea9b13cdd

submitted by /u/lenghia143
[link] [comments]

3 views08:42

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Interface reservation failed error on fluxion 6.9

I would like to use Fluxion 6.9 to create a fake access point if my home network just for testing purposes and I run kali in a vm with nat network. I also have one Realtek RTL8812AU adapter but Fluxion gives me an error saying “Interface reservation failed”. Has anyone experienced this issue before? Please help me!

submitted by /u/TheAppleSpot
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Interface reservation failed error on fluxion 6.9

I would like to use Fluxion 6.9 to create a fake access point if my home network just for testing purposes and I run kali in a vm with nat...

5 viewsedited 08:42

Hacking Articles Tips Tricks Videos Tutorials

6 views09:49

Hacking Articles Tips Tricks Videos Tutorials

8 views09:49

Hacking Articles Tips Tricks Videos Tutorials

Photo

Black Hat Ethical Hacking
News – new template post

News – new template postPost Views: 31 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Researchers have discovered a malicious campaign utilizing a never-before-seen technique for quietly planting fileless malware on target machines.The technique involves injecting shellcode directly into Windows event logs. This allows adversaries to use the Windows event logs as a cover for malicious late stage trojans, according to a Kaspersky research report released Wednesday

Researchers uncovered the campaign in February and believe the unidentified adversaries have been active for the past month.

“We consider the event logs technique, which we haven’t seen before, the most innovative part of this campaign,” wrote Denis Legezo, senior security researcher with Kaspersky’s Global Research and Analysis Team.

The attackers behind the campaign use a series of injection tools and anti-detection technique to deliver the malware payload. “With at least two commercial products in use, plus several types of last-stage RAT and anti-detection wrappers, the actor behind this campaign is quite capable,” Legezo wrote.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Fileless Malware Hides in Plain Sight (Event Logs)The first stage of the attack involves the adversary driving targets to a legitimate website and enticing the target to download a compressed .RAR file boobytrapped with the network penetration testing tools called Cobalt Strike and SilentBreak. Both tools are popular among hackers who use them as a vehicle for delivering shellcode to target machines.

Cobalt Strike and SilentBreak utilizing separate anti-detection AES decryptors, compiled with Visual Studio.

The digital certificate for the Cobalt Strike module varies. According to Kaspersky, “15 different stagers from wrappers to last stagers were signed.”

Next, attackers are then able to leverage Cobalt Strike and SilentBreak to “inject code into any process” and can inject additional modules into Windows system processes or trusted applications such as DLP.

“This layer of infection chain decrypts, maps into memory and launches the code,” they said.

The ability to inject malware into system’s memory classifies it as fileless. As the name suggests, fileless malware infects targeted computers leaving behind no artifacts on the local hard drive, making it easy to sidestep traditional signature-based security and forensics tools. The technique, where attackers hide their activities in a computer’s random-access memory and use a native Windows tools such as PowerShell and Windows Management Instrumentation (WMI), isn’t new.

What is new is new, however, is how the encrypted shellcode containing the malicious payload is embedded into Windows event logs. To avoid detection, the code “is divided into 8 KB blocks and saved in the binary part of event logs.”

Legezo said, “The dropper not only puts the launcher on disk for side-loading, but also writes information messages with shellcode into existing Windows KMS event log.”

“The dropped wer.dll is a loader and wouldn’t do any harm without the shellcode hidden in Windows event logs,” he continues. “The dropper searches the event logs for records with category 0x4142 (“AB” in ASCII) and having the Key Management Service as a source. If none is found, the 8KB chunks of shellcode are written into the information logging messages via the ReportEvent() Windows API function (lpRawData parameter).”

Next, a launcher is dropped into the Windows Tasks directory. “At the entry point, a separate thread combines all the aforementioned 8KB pieces into a complete shellcode and runs it,” the researcher wrote.

“Such[...]

___________________________
@hacking_Attack
@Hacking_Video

9 viewsedited 09:49

About

Blog

Apps

Platform