hacking: security in practice
TOR relay Locater.

Hello, I am a software and network engineer. Recently discovered an easy exploit that displays all TOR users on the network even when the IP is being changed. Each time a new relay is created it is attached to the already existing relay. Which is then backtracked and original location is presented thru the software I created. Proof of concept will be shown to people of real interest. Not bad people.

submitted by /u/crownedcunt
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Installing Python on Windows Reverse Shell

Hey there first post, I'm using a Linux server to reverse shell into my windows machine where I'm trying to install python remotely, so far I've found only one way to install python through powershell which is through choco. If anybody can come up with any other way of installing python through my reverse shell, please feel free to do so in the comments! :)

submitted by /u/Cyrtux
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
My stepdad bought some Wyze cameras and I hate them

Like the title says, my stepdad caught me and my girlfriend getting carried away upstairs in my room. Honestly I said sorry and meant it because they hadn’t met her yet and I wanted them to meet on better terms. So his solution was to set up some cameras around the house. Ever since I’ve discovered the one in our kitchen I feel so fucking uncomfortable, which is not how I want to be in my own home. I don’t exactly know if this is the subreddit for this kind of question, but how do I deal with this? I don’t want to destroy them or permanently make them useless in any way, I just want to be able to find where they all are and how to temporarily disable them or basically go on the “defensive” for a lack of better words. I have the Fing app, and I did the free trial to try and identify the cameras on the Wi-Fi, but I didn’t have any luck. All I know is that I’m sure there’s more based off of Context clues from convos with my stepdad and that the one I’ve found in the Kitchen is a Wyze v.2. Any help or ideas is greatly appreciated!

submitted by /u/The_OG_Lucas
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Server Side Template Injection-Something Distinct!
https://sagarsajeev.medium.com/server-side-template-injection-something-distinct-f0ac234e379?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

How’s it going guys! My name is Sagar Sajeev and this is my writeup about one of my recent SSTI (Server Side Template Injection) finding.Continue reading on Medium » (https://sagarsajeev.medium.com/server-side-template-injection-something-distinct-f0ac234e379?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Massive China-Linked Disinformation Campaign Taps PR Firm for Help

A global network of inauthentic news sites present themselves as independent news outlets, offering content favoring China's government and articles critical of the US.

Dark Reading: Attacks/Breaches
Phylum Releases a Free Community Edition to Make Software Supply Chain Security More Accessible

Users can identify risks across five domains, work on multiple projects, and take advantage of exclusive community benefits.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
How Email Security Is Evolving

Securing email communication has never been more critical for organizations, and it has never been more challenging to do so. Attack volumes have increased and become more sophisticated.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
High-Severity Bug in Kaspersky VPN Client Opens Door to PC Takeover

The CVE-2022-27535 local privilege-escalation security vulnerability in the security software threatens remote and work-from-home users.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Time to Patch VMware Products Against a Critical New Vulnerability

A dangerous VMware authentication-bypass bug could give threat actors administrative access over virtual machines.

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty For TOP Cross-Chain Bridge Open Test Is Launched

The TOP cross-chain bridge testnet version is now LIVE! Test and find bugs from TOP bridge and get up to 15,000,000 per issue! Happy…Continue reading on TOP Network »
Read more...

Bug Bounty For TOP Cross-Chain Bridge Open Test Is Launched
https://medium.com/top-network/bug-bounty-for-top-cross-chain-bridge-open-test-is-launched-d96ce9956dc8?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

The TOP cross-chain bridge testnet version is now LIVE! Test and find bugs from TOP bridge and get up to 15,000,000 per issue! Happy…Continue reading on TOP Network » (https://medium.com/top-network/bug-bounty-for-top-cross-chain-bridge-open-test-is-launched-d96ce9956dc8?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
New Linux malware called RapperBot brute-forces Linux SSH servers to breach networks

New Linux malware called RapperBot brute-forces Linux SSH servers to breach networksPost Views: 19 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes A new botnet called ‘RapperBot’ is being used in attacks since mid-June 2022, focusing on brute-forcing its way into Linux SSH servers to establish a foothold on the device.The researchers show that RapperBot is based on the Mirai trojan but deviates from the the original malware’s normal behavior, which is uncontrolled propagation to as many devices as possible.

Instead, RapperBot is more tightly controlled, has limited DDoS capabilities, and its operation appears geared towards initial server access, likely to be used as stepping stones for lateral movement within a network.

Over the past 1.5 months since its discovery, the new botnet used over 3,500 unique IPs worldwide to scan and attempt brute-forcing Linux SSH servers.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Mirai-based, but differentThe new botnet was discovered in the wild by threat hunters at Fortinet, who noticed the IoT malware featured some unusual SSH-related strings and decided to investigate further.

RapperBot proved to be a Mirai fork, but with its own command and control (C2) protocol, unique features, and atypical (for a botnet) post-compromise activity.

“Unlike the majority of Mirai variants, which natively brute force Telnet servers using default or weak passwords, RapperBot exclusively scans and attempts to brute force SSH servers configured to accept password authentication,” explains the Fortinet report.

“The bulk of the malware code contains an implementation of an SSH 2.0 client that can connect and brute force any SSH server that supports Diffie-Hellmann key exchange with 768-bit or 2048-bit keys and data encryption using AES128-CTR.”

The SSH brute-forcing relies on a list of credentials downloaded from the C2 via host-unique TCP requests, while the malware reports back to the C2 when it succeeded.

Fortinet researchers followed the bot and continued to sample new variants, noticing that RapperBot used a self-propagation mechanism via a remote binary downloader, which was removed by the threat actors in mid-July.

The newer variants circulating at that time featured a shell command that replaced the victim’s SSH keys with the actor’s, essentially establishing persistence that’s maintained even after SSH password changes.

Moreover, RapperBot added a system to append the actor’s SSH key to the host’s “~/.ssh/authorized_keys,” which helps maintain access on the server between reboots or even if the malware is found and deleted.

In the most recent samples analyzed by the researchers, the bot adds the root user “suhelper” on the compromised endpoints and creates a Cron job that re-adds the user every hour in case an admin discovers the account and deletes it.
https://www.bleepstatic.com/images/news/u/1220909/Diagrams/attack-diagram(2).png
RapperBot’s goalMost botnets either pe[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Offensive Security Tool: Offensive-Azure

Offensive Security Tool: Offensive-AzurePost Views: 5 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes Offensive-AzureOffensive-Azure by blacklanternsecurity is a collection of offensive tools targeting Microsoft Azure written in Python to be platform agnostic. It offers various scripts that can be used against Microsoft Azure in different attack vectors ranging from token manipulation, domain enumeration getting info in regards to the tenant without requiring authentication and much more. Aimed at the red team and pentesters, to evaluate the setup of Azure in various environments.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course
The current list of tools can be found below with a brief description of their functionality.

* ./Device_Code/device_code_easy_mode.py

⦿ Generates a code to be entered by the target user
⦿ Can be used for general token generation or during a phishing/social engineering campaign.

* ./Access_Tokens/token_juggle.py

⦿ Takes in a refresh token in various ways and retrieves a new refresh token and an access token for the resource specified

* ./Access_Tokens/read_token.py

⦿ Takes in an access token and parses the included claims information, checks for expiration, attempts to validate signature

* ./Outsider_Recon/outsider_recon.py

⦿ Takes in a domain and enumerates as much information as possible about the tenant without requiring authentication

* ./User_Enum/user_enum.py

⦿ Takes in a username or list of usernames and attempts to enumerate valid accounts using one of three methods
⦿ Can also be used to perform a password spray

* ./Azure_AD/get_tenant.py

⦿ Takes in an access token or refresh token, outputs tenant ID and tenant Name
⦿ Creates text output file as well as BloodHound compatible aztenant file

* ./Azure_AD/get_users.py

⦿ Takes in an access token or refresh token, outputs all users in Azure AD and all available user properties in Microsoft Graph
⦿ Creates three data files, a condensed json file, a raw json file, and a BloodHound compatible azusers file

* ./Azure_AD/get_groups.py

⦿ Takes in an access token or refresh token, outputs all groups in Azure AD and all available group properties in Microsoft Graph
⦿ Creates three data files, a condensed json file, a raw json file, and a BloodHound compatible azgroups file

* ./Azure_AD/get_group_members.py

⦿ Takes in an access token or refresh token, outputs all group memberships in Azure AD and all available group member properties in Microsoft Graph
⦿ Creates three data files, a condensed json file, a raw json file, and a BloodHound compatible azgroups file

* ./Azure_AD/get_subscriptions.py

⦿ Takes in an ARM token or refresh token, outputs all subscriptions in Azure and all available subscription properties in Azure Resource Manager
⦿ Creates three data files, a condensed json file, a raw json file, and a BloodHound compatible azgroups file

* ./Azure_AD/get_resource_groups.py

⦿ Takes in an ARM token or refresh token, outputs all resource groups in Azure and all available resource group properties in Azure Resource Manager
⦿ Creates two data files, a raw json file, and a BloodHound compatible azgroups file

* ./Azure_AD/get_vms.py

⦿ Takes in an ARM token or refresh token, outputs all virtual machines in Azure and all available VM properties in Azure Resource Manager
⦿ Creates two data files, a raw json file, and a BloodHound compatible azgroups file
Trending: Offensive Security Tool: DDoS-Layer7-bheh InstallationOffensive Azure can be installed in a number of ways or not at all.

You are welcome to clone the repository and execute t[...]

___________________________
@hacking_Attack
@Hacking_Video