TryHackMe Room: https://tryhackme.com/room/owasptop10
Learn about and exploit each of the OWASP Top 10 vulnerabilities; the 10 most…Continue reading on Medium » (https://medium.com/@_Jota_/owasp-top-10-write-up-76e7f68e5a65?source=rss------bug_bounty-5)

Reverse Code Apk Notes
https://medium.com/@wicaksonoindra/reverse-code-apk-notes-980846d68915?source=rss------bug_bounty-5

Haloo,, Pada kali ini saya akan membagikan sedikit catatan yang telah saya pelajari dalam perjalanan saya belajar Reverse Mobile App…Continue reading on Medium » (https://medium.com/@wicaksonoindra/reverse-code-apk-notes-980846d68915?source=rss------bug_bounty-5)

Hacking on Medium
OWASP Top 10 Write-up

https://cdn-images-1.medium.com/max/600/0*Z2ZavGLaBw687T_N.png
TryHackMe Room: https://tryhackme.com/room/owasptop10
Learn about and exploit each of the OWASP Top 10 vulnerabilities; the 10 most…

Continue reading on Medium »

Hacking on Medium
Walkthrough: Basic Pentest [PT/BR]

https://cdn-images-1.medium.com/max/850/1*RdlNz0-erDNIR0L0XfRhkA.png
Ei, e aí! Tranquilo? Hoje vou resolver a máquina “Basic Pentest”.

Continue reading on Medium »

PART 2: How I Met Your Beacon - Cobalt Strike - @MDSecLabs
https://www.reddit.com/r/redteamsec/comments/w7jhk6/part_2_how_i_met_your_beacon_cobalt_strike/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.mdsec.co.uk/2022/07/part-2-how-i-met-your-beacon-cobalt-strike/) [comments] (https://www.reddit.com/r/redteamsec/comments/w7jhk6/part_2_how_i_met_your_beacon_cobalt_strike/)

Kali Linux Tutorials
Blackbird : An OSINT Tool To Search For Accounts By Username In 101 Social Networks

An OSINT tool to search fast for accounts by username across 142 sites.

The Lockheed SR-71 “Blackbird” is a long-range, high-altitude, Mach 3+ strategic reconnaissance aircraft developed and manufactured by the American aerospace company Lockheed Corporation.

Setup

Clone the repository

git clone https://github.com/p1ngul1n0/blackbird
cd blackbird

Install requirements

pip install -r requirements.txt

Usage

Search by username

python blackbird.py -u username

Run WebServer

python blackbird.py –web

Read results file

python blackbird.py -f username.json

List supportted sites

python blackbird.py –list-sites
Download

Kali Linux Tutorials
PacketStreamer : Distributed Tcpdump For Cloud Native Environments

PacketStreamer is a high-performance remote packet capture and collection tool. It is used by Deepfence’s ThreatStryker security observability platform to gather network traffic on demand from cloud workloads for forensic analysis.

Primary design goals:

* Stay light, capture and stream, no additional processing
* Portability, works across virtual machines, Kubernetes and AWS Fargate. Linux and Windows

PacketStreamer sensors are started on the target servers. Sensors capture traffic, apply filters, and then stream the traffic to a central reciever. Traffic streams may be compressed and/or encrypted using TLS.

The PacketStreamer receiver accepts PacketStreamer streams from multiple remote sensors, and writes the packets to a local pcapcapture file.

PacketStreamer sensors collect raw network packets on remote hosts. It selects packets to capture using a BPF filter, and forwards them to a central reciever process where they are written in pcap format. Sensors are very lightweight and impose little performance impact on the remote hosts. PacketStreamer sensors can be run on bare-metal servers, on Docker hosts, and on Kubernetes nodes.

The PacketStreamer receiver accepts network traffic from multiple sensors, collecting it into a single, central pcapfile. You can then process the pcap file or live feed the traffic to the tooling of your choice, such as Zeek, WiresharkSuricata, or as a live stream for Machine Learning models.

When to use PacketStreamer

PacketStreamer meets more general use cases than existing alternatives. For example, PacketBeat captures and parses the packets on multiple remote hosts, assembles transactions, and ships the processed data to a central ElasticSearch collector. ksniff captures raw packet data from a single Kubernetes pod.

Use PacketStreamer if you need a lightweight, efficient method to collect raw network data from multiple machines for central logging and analysis.

Quick Start

For full instructions, refer to the PacketStreamer Documentation.

You will need to install the golang toolchain and libpcap-devbefore building PacketStreamer.

Pre-requisites (Ubuntu): sudo apt install golang-go libpcap-dev
git clone https://github.com/deepfence/PacketStreamer.git
cd PacketStreamer/
make

Run a PacketStreamer receiver, listening on port 8081 and writing pcap output to /tmp/dump_file (see receiver.yaml):

./packetstreamer receiver –config ./contrib/config/receiver.yaml

Who uses PacketStreamer?

* Deepfence ThreatStryker uses PacketStreamer to capture traffic from production platforms for forensics and anomaly detection.
Download

Hacking on Medium
Crypt 2 | Defend the Web

https://cdn-images-1.medium.com/max/700/0*SdwADKKNm7BWAq-t.jpg
Somehow I skipped this one by accident in my series

Continue reading on Medium »

MSA Weekly 5 — “How to Get Sensitive Data Exposure on Web Application”

Sensitive data exposure merupakan jenis kerentanan yang masuk ke dalam kategori A03 di dalam OWASP 2017. Dengan itu, jelas bahwa sensitive…Continue reading on Medium »
Read more...

MSA Weekly 5 — “How to Get Sensitive Data Exposure on Web Application”
https://medium.com/@frozzipies/msa-weekly-5-how-to-get-sensitive-data-exposure-on-web-application-a457fa7f8440?source=rss------bug_bounty-5

Sensitive data exposure merupakan jenis kerentanan yang masuk ke dalam kategori A03 di dalam OWASP 2017. Dengan itu, jelas bahwa sensitive…Continue reading on Medium » (https://medium.com/@frozzipies/msa-weekly-5-how-to-get-sensitive-data-exposure-on-web-application-a457fa7f8440?source=rss------bug_bounty-5)

Black Hat Ethical Hacking
QBot phishing uses Windows Calculator sideloading to infect devices

QBot phishing uses Windows Calculator sideloading to infect devicesPost Views: 24 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes The operators of the QBot malware have been using the Windows Calculator to side-load the malicious payload on infected computers.DLL side-loading is a common attack method that takes advantage of how Dynamic Link Libraries (DLLs) are handled in Windows. It consists of spoofing a legitimate DLL and placing it in a folder from where the operating system loads it instead of the legitimate one.

QBot, also known as Qakbot is a Windows malware strain that started as a banking trojan but evolved into a malware dropper, and is used by ransomware gangs in the early stages of the attack to drop Cobalt Strike beacons.

Security researcher ProxyLife recently discovered that Qakbot, has been abusing the the Windows 7 Calculator app for DLL side-loading attacks since at least July 11. The method continues to be used in malspam campaigns. #Qakbot – obama200 – html > .zip > .iso > .lnk > calc.exe > .dll > .dll

T1574 – DLL Search Order Hijacking

cmd.exe /q /c calc.exe

regsvr32 /s C:UsersUserAppDataLocalTempWindowsCodecs.dll

regsvr32.exe 102755.dllhttps://t.co/2Vgg6cuRFh

IOC'shttps://t.co/e7hkNW8eQu pic.twitter.com/sCH1xagkyR

— proxylife (@pr0xylife) July 11, 2022
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course New QBot infection chainTo help defenders protect against this threat, ProxyLife and researchers at Cyble documented the latest QBot infection chain.

The emails used in the latest campaign carry an HTML file attachment that downloads a password-protected ZIP archive with an ISO file inside.

The password for opening the ZIP file is shown in the HTML file, and the reason for locking the archive is to evade antivirus detection.
https://www.bleepstatic.com/images/news/u/1220909/Security/html.png
<figcaptionHTML attachment on QBot spam emails
The ISO contains a .LNK file, a copy of ‘calc.exe’ (Windows Calculator), and two DLL files, namely WindowsCodecs.dll and a payload named 7533.dll.
https://www.bleepstatic.com/images/news/u/1220909/Security/files(1).png
<figcaptionZIP archive contents
When the user mounts the ISO file, it only displays the .LNK file, which is masqueraded to look like a PDF holding important information or a file that opens with Microsoft Edge browser.

However, the shortcut points to the Calculator app in Windows, as seen in the properties dialog for the files.
https://www.bleepstatic.com/images/news/u/1100723/2022/DLL-SideloadQBot.jpg
<figcaptionProperties of the PDF file that triggers the infection
Trending: How do QR Codes work and how criminal hackers use them to generate phishing attacks – Demo
Trending: OSINT Tool: SARENKA
Clicking the shortcut triggers the infection by executing the Calc.exe through the Command Prompt.

When loaded, the Windows 7 Calculator automatically searches for and attempts to load the legitimate WindowsCodecs DLL file. However, it does not check for the DLL in certain hard coded paths, and will load any DLL with the same name if placed in the same folder as the Calc.exe executable.

The threat actors take advantage of this flaw by creating their own malicious WindowsCodecs.dll file that launches the other [numbered].dll file, which is the QBot malware.

By installing QBot through a trusted program like the Windows Calculator, some security software may not detect the malware when it is loaded, allowing the threat actors to evade[...]