KitPloit - PenTest Tools!
Toxssin - An XSS Exploitation Command-Line Interface And Payload Generator

https://blogger.googleusercontent.com/img/a/AVvXsEhrpuM_fn19iK6x050q5CR92yf8f9nwmwAIJCZfaruivV5I1gdgm_T1HuILTHzF7yg6wjhcraLXVg6qNGblQekqjcGmaIgvvIag8CQiwv3Icg_CKuVK6fuQF1Wxyko4CTSxdE7wzhfKm7YgA4Jh1T1l45anYQAUQRZbIhQ9OCfOs0j7bWETTmVhMNfT=w628-h640 toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting (XSS) vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool (toxin.js).

This project started as (and still is) a research-based creative endeavor to explore the exploitability depth that an XSS vulnerability may introduce by using vanilla JavaScript, trusted certificates and cheap tricks.

Disclaimer: The project is quite fresh and has not been widely tested. Video PresentationFind screenshots here. CapabilitiesBy default, toxssin intercepts:

* cookies (if HttpOnly not present),
* keystrokes,
* paste events,
* input change events,
* file selections,
* form submissions,
* server responses,
* table data (static as well as updates),

Most importantly, toxssin:

* attempts to maintain XSS persistence while the user browses the website by intercepting http requests & responses and re-writing the document,
* supports session management, meaning that, you can use it to exploit reflected as well as stored XSS,
* supports custom JS script execution against sessions,
* automatically logs every session. Installation & Usagegit clone https://github.com/t3l3machus/toxssin
cd ./toxssin
pip3 install -r requirements.txt To start toxssin.py, you will need to supply ssl certificate and private key files.

If you don't own a domain with a trusted certificate, you can issue and use self-signed certificates with the following command (although this won't take you far): openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 It is strongly recommended to run toxssin with a trusted certificate (see How to get a Valid Certificate in this document). That said, you can start the toxssin server like this: # python3 toxssin.py -u https://your.domain.com -c /your/certificate.pem -k /your/privkey.pem Visit the project's wiki for additional information. XSS Exploitation ObstaclesIn my experience, there are 4 major obstacles when it comes to Cross-Site Scripting attacks attempting to include external JS scripts:

1. the "Mixed Content" error, which can be resolved by serving the JavaScript payload via https (even with a self-signed certificate).
2. the "NET::ERR_CERT_AUTHORITY_INVALID" error, which indicates that the server's certificate is untrusted / expired and can be bypassed by using a certificate issued by a trusted Authority.
3. Cross-origin resource sharing (CORS), which is handled appropriately by the toxssin server.
4. Content-Security-Policyheader with the script-srcset to specific domain(s) only will block scripts with cross-domain src from loading. Toxssin relies on the eval()function to deliver its poison, so, if the website has a CSP and the unsafe-evalsource expression is not specified in the script-srcdirective, the attack will most likely fail (i'm working on a second poison delivery method to work around this).

Note: The "Mixed Content" error can of course occur when the target website is hosted via http and the JavaScript payload via https. This limits the scope of toxssin to https only webistes, as (by default) toxssin is started with ssl only. How to get a Valid CertificateFirst, you need to own a domain name. The fastest and most economic way to get one (in my knowledge) is via a cheap domain registrar service (e.g. https://www.namecheap.com[...]

___________________________
@hacking_Attack
@Hacking_Video

/). Search for a random string domain name (e.g. "fvcm98duf") and check the less popular TLDs, like .xyz, as they will probably cost around 3$ per year.

After you purchase a domain name, you can use certbot (Let's Encrypt) to get a trusted certificate in 5 minutes or less:

1. Append an A record to your Domain's DNS settings so that it points to your server ip,
2. Follow certbots official instructions.

Tip: Don't install and run certbot on your own, you might get unexpected errors. Stick with the instructions. Changelog2022-06-19- Added the exec prompt command (you can now execute custom JS scripts against a session). 2022-06-23- I added two simple, dirty scripts as templates for testing the exec prompt command. I also fixed the cmd prompt's backward history access and made some improvements. FutureThe idea is to make it sharper, more reliable and expand its capabilities. Currently, i'm working on improving file captures. Download Toxssin

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Advent of Cyber 3 (2021): Day 18 Write-up [TryHackMe]

https://cdn-images-1.medium.com/max/600/1*SRe9N2evKwzQdmtn1pcUvQ.png
Welcome to Day 18 of Advent of Cyber 3 write-up.

Continue reading on DevOps.dev »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Advent of Cyber 3 (2021): Day 19 Write-up [TryHackMe]

https://cdn-images-1.medium.com/max/600/1*gb2A_Oq9x_AfTHw-9ULWug.jpeg
Welcome to Day 19 of Advent of Cyber 3 write-up.

Continue reading on DevOps.dev »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The number of companies caught up in recent hacks keeps growing

https://cdn-images-1.medium.com/max/800/0*G-AW_Uuz7bh-Dp7I.png
“Authy, LastPass, and DoorDash became a victim of a cyber attack, recently”

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Bandit Level (1–10) : OverTheWire

https://cdn-images-1.medium.com/max/1236/1*9s25lEeu-QFYGQaxBfIKaw.png
CTF Practice : Solution and explanation

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Redline Stealer
https://medium.com/@rangerwooz/redline-stealer-89623ceff9f5?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

The Redline StealerContinue reading on Medium » (https://medium.com/@rangerwooz/redline-stealer-89623ceff9f5?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Server Side Request Forgery (SSRF) Attacks
https://medium.com/@rajeevranjancom/server-side-request-forgery-ssrf-attacks-e8bdc5e17a68?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Server-side request forgery (SSRF) attacks exploit software vulnerabilities that could allow an attacker to trick the server-side…Continue reading on Medium » (https://medium.com/@rajeevranjancom/server-side-request-forgery-ssrf-attacks-e8bdc5e17a68?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Unsubscribe any user’s e-mail notifications via IDOR
https://sagarsajeev.medium.com/unsubscribe-any-users-e-mail-notifications-via-idor-2c2e05b79dac?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

IDOR allows attacker to unsubscribe any user from the Websites email service.Continue reading on Medium » (https://sagarsajeev.medium.com/unsubscribe-any-users-e-mail-notifications-via-idor-2c2e05b79dac?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Why you should secure your printers for greater data security

Most printers these days can connect wirelessly via Wi-Fi. This opens up a whole new world of hacking opportunities for cybercriminals, as they can target a Wi-Fi network and potentially access the devices connected to it without coming into direct contact with them.

Some printers that accept print jobs via File Transfer Protocol can be used to perform Nmap "bounce" scans, though this does not always necessitate administrative privileges.

Identifying the syslog server on a network and resetting the printer's IP address to that of the server, creating an IP confict and confusing log traffic, preventing security incidents from being logged partially or entirely, was one use I discovered back in the day.

Most network equipment, like routers and switches, can send Syslog messages.

Not only that, but *nix servers also have the ability to generate Syslog data, as do most firewalls, some printers, and even web-servers like Apache.

Windows-based servers don’t support Syslog natively, but a large number of third-party tools make it easy to collect Windows Event Log or IIS data and forward it to a Syslog server.

There are custom ROMs that masquerade as firmware upgrades and otherwise function normally, but install a small backdoor that grants access to the rest of the network (or can be used as a launching point for attacks on other networks). I won't go into detail because these aren't widely known or available. Because many printers support wifi printing, this would work on a network that is otherwise airgapped.

You can persuade the printer that it only prints postcards, much to the frustration of users whose jobs take up a small square on a series of otherwise blank pages.

Regularly updating your printer's firmware is the best way to keep its security features up to date. It can be the difference between protecting your printer and making it an easy target for attackers.

You should also disable wireless printing as much as possible on your printer, as it's often the wireless connection that increases the chances of a hack. If you only use your printer via a hardwire connection, you should permanently disable wireless printing.

While it's easy to assume that printers are pretty basic pieces of technology that need no protection, we know that printers are often the weakest link in a network and the most unsuspecting targets for an attack. So, if you want to lower the chance of a cyberattack on your facilities across the board, it may pay off to ensure that your printer is being taken care of, too.

submitted by /u/Simonvilla1
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video