How to hack wireless networks.Continue reading on System Weakness » (https://systemweakness.com/hacking-wireless-networks-around-the-globe-practical-wifi-hacking-f8bdc36536b8?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Malware dev open-sources CodeRAT after being exposed

Malware dev open-sources CodeRAT after being exposedPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes The source code of a remote access trojan (RAT) dubbed ‘CodeRAT’ has been leaked on GitHub after malware analysts confronted the developer about attacks that used the tool.The malicious operation, which appears to originate from Iran, targeted Farsi-speaking software developers with a Word document that included a Microsoft Dynamic Data Exchange (DDE) exploit.

The exploit downloads and executes CodeRAT from the threat actor’s GitHub repository, giving the remote operator a broad range of post-infection capabilities.

More specifically, CodeRAT supports about 50 commands and comes with extensive monitoring capabilities targeting webmail, Microsoft Office documents, databases, social network platforms, integrated development environment (IDEs) for Windows Android, and even individual websites like PayPal.

Cybersecurity company SafeBreach reports that the malware also spies on sensitive windows for tools like Visual Studio, Python, PhpStorm, and Verilog – a hardware description language for modeling electronic systems.

To communicate with its operator and to exfiltrate stolen data, CodeRAT uses a Telegram-based mechanism that relies on a public anonymous file upload API instead of the more common command and control server infrastructure.

Although the campaign stopped abruptly when the researchers contacted the malware developer, CodeRAT is likely to become more prevalent now that its author made the source code public.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course CodeRAT detailsThe malware supports  around 50 commands that include taking screenshots, copying clipboard content, getting a list of running processes, terminating processes, checking GPU usage, downloading, uploading, deleting files, executing programs.
https://www.bleepstatic.com/images/news/u/1220909/Software/command-builder.png
If the victim’s country has banned Telegram, CodeRAT offers an anti-filter functionality that establishes a separate request routing channel that can help bypass the blocks.https://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/proxy.png
___________________________
@hacking_Attack
@Hacking_Video

et Server and Data Center Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/ezgif.com-gif-maker-1-300x150.jpg WatchGuard firewall exploit threatens appliance takeoverSeptember 2, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Images-for-the-News-posts-4-300x150.png Apple patch for actively exploited iOS zero-day to older iPhonesSeptember 1, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-2-3-300x150.png Malware campaign relies on spaces images from James Webb telescopeAugust 31, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-5-1-300x150.png Windows malware delays coinminer install by a month to evade detectionAugust 30, 2022
Reading Time: 4 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Malware dev open-sources CodeRAT after being exposed first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
JuiceLedger Hackers Behind the Recent Phishing Attacks Against?

https://cdn-images-1.medium.com/max/728/0*Tptp3CTlDFtKCkel.jpg
More details have emerged about the operators behind the first-known phishing campaign specifically aimed at the Python Package Index…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Abusing ZeroLogon (CVE-2020–1472)

https://cdn-images-1.medium.com/max/780/0*v4h5sMTpDw8qD08E
In this attack we are capable of attacking the domain controller, setting the password to null, and then taking over the Domain Controller.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Someone has access to my valorant account, the only way I log into my valorant account is my email, is my email compromised?

Title

I am basically just trying to figure out how far this has gone and how many passwords and stuff I need to change to take care of this issue.

submitted by /u/Emperorofweirdos
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Pool on the roof - September 05, 2022

Have a no0b question? New to hacking? Looking for a script? Need help with your github project? Something wrong with your payload? Stuck on a CTF or bug bounty?

This is a weekly recurring post to make friends with other hackers, ask questions, and get any type of help you may need.

Make sure to read our wiki as it's full of resources for you.

Keep all beginner questions in this weekly stickied post.

submitted by /u/AutoModerator
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Aura - Python Source Code Auditing And Static Analysis On A Large Scale

https://blogger.googleusercontent.com/img/a/AVvXsEitYWFOhHDTy_LRW5sfl2xjynA5CJGpst7wwMiqvNaYwz8J4PQ3jxyEP3oDyMVeYk655I9fV3oYveoAZxrhZvbXvky-jq4qDuQ6ISNmg38knASV6V3AEAyjZEk8cn60oLmIok6Ak-CS8T5L_-WqKpA7_muxYwi2NltXRFGcXV5ci_rZJIyF3EH8cNOrww=w640-h222 Source code auditing and static code analysisAura is a static analysis framework developed as a response to the ever-increasing threat of malicious packages and vulnerable code published on PyPI.

Project goals:

* provide an automated monitoring system over uploaded packages to PyPI, alert on anomalies that can either indicate an ongoing attack or vulnerabilities in the code
* enable an organization to conduct automated security audits of the source code and implement secure coding practices with a focus on auditing 3rd party code such as python package dependencies
* allow researches to scan code repositories on a large scale, create datasets and perform analysis to further advance research in the area of vulnerable and malicious code dependencies

Feature list:

* Suitable for analyzing malware with a guarantee of a zero-code execution
* Advanced deobfuscation mechanisms by rewriting the AST tree - constant propagations, code unrolling, and other dirty tricks
* Recursive scanning automatically unpacks archives such as zips, wheels, etc.. and scans the content
* Support scanning also non-python files - plugins can work in a “raw-file” mode such as the built-in Yara integration
* Scan for hardcoded secrets, passwords, and other sensitive information
* Custom diff engine - you can compare changes between different data sources such as typosquatting PyPI packages to what changes were made
* Works for both Python 2.x and Python 3.x source code
* High performance, designed to scan the whole PyPI repository
* Output in numerous formats such as pretty plain text, JSON, SQLite, SARIF, etc…
* Tested on over 4TB of compressed python source code
* Aura is able to report on code behavior such as network communication, file access, or system command execution
* Compute the “Aura score” telling you how trustworthy the source code/input data is
* and much much more…

Didn't find what you are looking for? Aura's architecture is based on a robust plugin system, where you can customize almost anything, ranging from a set of data analyzers, transport protocols to custom out formats. Installation# Via pip:
pip install aura-security[full]
# or build from source/git
poetry install --no-dev -E full Or just use a prebuild docker image sourcecodeai/aura:devRunning Auradocker run -ti --rm sourcecodeai/aura:dev scan pypi://requests -v Aura uses a so-called URIs to identify the protocol and location to scan, if no protocol is used, the scan argument is treated as a path to the file or directory on a local system. https://blogger.googleusercontent.com/img/a/AVvXsEgnGJYrRR8Gv4sbidjDQfh2oIZlnYwOJouBcQfxUV84p2RHj5jgR3KgBQYfWdGBgrKSothKGeYmmj_WoYRG4boKQ-Pmiq2fEnSiSVOBHVc25m6uxRncfaD9dgRQ1-XCiYofggU64ps2ITt4lJkQ2zU5QJiEah7HFGnwZFHuneCmzZX_a_A29_4xM_-ySw=s16000 Diff packages: docker run -ti --rm sourcecodeai/aura:dev diff pypi://requests pypi://requests2 https://blogger.googleusercontent.com/img/a/AVvXsEgt0c2wL9dDhOjg74LAOHG9eiKUrNF17PNfA7SH4nIa7OQO1Ybtqh9D9PmKZ8cbzKjMCG3Ta98cshMxuDb8Mk0hBodBUQLN8YukIe26miR_Lz6ZtgDGV6CJ_Ml5HYUnQnRhBxyKPdD5EQHlvIflRBC0s4JBJ0owuSnC_o-bsrIvcWKP9pHaHyfRf4l7Ww=s16000 Find most popular typosquatted packages (you need to call aura updateto download the dataset first): aura find-typosquatting --max-distance 2 --limit 10 https://camo.githubusercontent.com/c8ada346e052a95b36bc37624d9c35ee81380d7b0995c94f16f32bc4fd1611d0/68747470733a2f2f61736369696e656d612e6f72672f612f3336373939392e737667 Why Aura?While there are othe[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Aura - Python Source Code Auditing And Static Analysis On A Large Scale

___________________________
@hacking_Attack
@Hacking_Video

Aura - Python Source Code Auditing And Static Analysis On A Large Scale
http://www.kitploit.com/2022/09/aura-python-source-code-auditing-and.html

___________________________
@hacking_Attack
@Hacking_Video

Source code auditing and static code analysis Aura is a static analysis framework (https://www.kitploit.com/search/label/Analysis%20Framework) developed as a response to the ever-increasing threat of malicious packages and vulnerable code published on PyPI. Project goals: provide an automated monitoring system over uploaded packages to PyPI, alert on anomalies that can either indicate an ongoing attack or vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) in the code enable an organization to conduct automated security audits of the source code and implement secure coding practices with a focus on auditing 3rd party code such as python package (https://www.kitploit.com/search/label/Python%20Package) dependencies allow researches to scan code repositories on a large scale, create datasets and perform analysis to further advance research in the area of vulnerable and malicious code dependencies Feature list: Suitable for analyzing malware with a guarantee of a zero-code execution Advanced deobfuscation (https://www.kitploit.com/search/label/Deobfuscation) mechanisms by rewriting the AST tree - constant propagations, code unrolling, and other dirty tricks Recursive scanning automatically unpacks archives such as zips, wheels, etc.. and scans the content Support scanning also non-python files - plugins can work in a “raw-file” mode such as the built-in Yara integration Scan for hardcoded secrets, passwords, and other sensitive information Custom diff engine - you can compare changes between different data sources such as typosquatting PyPI packages to what changes were made Works for both Python 2.x and Python 3.x source code High performance, designed to scan the whole PyPI repository Output in numerous formats such as pretty plain text, JSON, SQLite, SARIF, etc… Tested on over 4TB of compressed python source code Aura is able to report on code behavior such as network communication, file access, or system command execution Compute the “Aura score” telling you how trustworthy the source code/input data is and much much more… Didn't find what you are looking for? Aura's architecture is based on a robust plugin system, where you can customize almost anything, ranging from a set of data analyzers, transport protocols to custom out formats.
Installation # Via pip:
pip install aura-security[full]
# or build from source/git
poetry install --no-dev -E full
Or just use a prebuild docker image sourcecodeai/aura:dev Running Aura docker run -ti --rm sourcecodeai/aura:dev scan pypi://requests -v
Aura uses a so-called URIs to identify the protocol and location to scan, if no protocol is used, the scan argument is treated as a path to the file or directory on a local system.

___________________________
@hacking_Attack
@Hacking_Video

Diff packages: docker run -ti --rm sourcecodeai/aura:dev diff pypi://requests pypi://requests2

___________________________
@hacking_Attack
@Hacking_Video

Find most popular typosquatted packages (you need to call aura update to download the dataset first): aura find-typosquatting --max-distance 2 --limit 10

___________________________
@hacking_Attack
@Hacking_Video