Hacking Articles Tips Tricks Videos Tutorials

Hey guys, I am back again with another writeup about how I found a seviour bug in my college’s student portal which leads to a data leak…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/how-i-hacked-my-colleges-student-portal-f51775d75a3d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

How I Hacked my College’s student portal

Hey guys, I am back again with another writeup about how I found a seviour bug in my college’s student portal which leads to a data leak of…

8 viewsedited 08:04

Hacking Articles Tips Tricks Videos Tutorials

9 views08:06

Hacking Articles Tips Tricks Videos Tutorials

8 views08:06

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
SharpImpersonation : A User Impersonation Tool – Via Token Or Shellcode Injection

SharpImpersonation is a User Impersonation Tool – Via Token Or Shellcode Injection. This was a learning by doing project from my side. Well known techniques are used to built just another impersonation tool with some improvements in comparison to other public tools. The code base was taken from:

* https://github.com/0xbadjuju/Tokenvator

A blog post for the intruduction can be found here:

* https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/

List user processes
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJyz6KZjw5gUqilJYsCPckmCjwbctvNimJGn2YqUKZu5v01Ky4M0T_GrNc8xNPUTQnT04s0SBnnfQQEvQZyyLgtBWe10MNcAjuT_xw_YWnsasuTok5nd93E1ilG4oOLycG4PEVT1kynp9CPMYzuhAsbclByhYohxLZHL6s43eI788lZ77kktHbrRce/s720/v.png
List only elevated processes

PS > PS C:\temp> SharpImpersonation.exe list elevated

Impersonate the first process of the target user to start a new binary

PS > PS C:\temp> SharpImpersonation.exe user: binary:

Inject base64 encoded shellcode into the first process of the target user

PS > PS C:\temp> SharpImpersonation.exe user: shellcode:

Inject shellcode loaded from a webserver into the first process of the target user

PS > PS C:\temp> SharpImpersonation.exe user: shellcode:

Impersonate the target user via ImpersonateLoggedOnuser for the current session

PS > PS C:\temp> SharpImpersonation.exe user: technique:ImpersonateLoggedOnuser
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

SharpImpersonation : A User Impersonation Tool Token Shellcode Injection

SharpImpersonation is a User Impersonation Tool - Via Token Or Shellcode Injection. This was a learning by doing project from my side.

17 viewsedited 08:06

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
kics : Find security vulnerabilities, compliance issues, and infrastructure misconfigurations

KICS, which stands for Keeping Infrastructure as Code Secure, is an essential component of every cloud-native project and is open source. Use KICS by Checkmarx to identify security flaws, legal compliance problems, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code.

How it Works

KICS’s built-in extensibility is what makes it so strong and well-liked. Achieving this extensibility entails:

Queries are fully flexible and changeable heuristic rules. These are simple to alter, expand upon, and include.

a robust but still straightforward architecture that makes it simple to add support for new Infrastructure as Code solutions quickly.

KICS was developed using Open Policy Agent and is entirely open source (OPA).

Rego was a natural choice as a query language to implement security queries, while Golang’s speed, simplicity, and dependability made it the ideal choice for creating KICS.

For AWS, GCP, Azure, and other cloud providers, we have created more than a thousand ready-to-use queries that cover a wide range of vulnerabilities checks.

High-Level Architecture

KICS’s extendable pipeline of IaC language parsers and pluggable architecture make it simple to incorporate additional IaC languages and queries.

A command-line interface, parser, queries execution engine, IaC providers, security queries, and results writer are the key parts of KICS at a high level.

* Provides CLI input to KICS using the command line interface.
* The parser is in charge of processing the input IaC files (terraform and others)
* Providers of IaC => IaC language is transformed into a normalised JSON \sQueries Execution Engine: uses pre-built REGO queries for each security and misconfiguration against normalised JSON Security Queries.
* Writer => Outputs data in JSON format.

Execution Flow
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHp3dLwy4dbX6UdFtHQWOwV-UQhN-Ljz4ceevanfZ8EAc1p7RdKbNx7ecD0hrjcgndsMl0T_ge3u2dzU4_hD8XVxb4SdX0vgUkIDDJMEuQBe2xGhgYh8dBMGnAfxYTnX9al1_N_oZgvCJO4TWjQ1tGOlR51UZWWJGjzAfdV4ITqff1wA6iH_0sM7PA/s688/exec-flow-1.webp

Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

kics : Find security vulnerabilities, compliance issues, infrastructure

KICS, which stands for Keeping Infrastructure as Code Secure, is an essential component of every cloud-native project and is open source.

9 viewsedited 08:06

Hacking Articles Tips Tricks Videos Tutorials

question regarding win10 privilege escalation without cmd or powershell
https://www.reddit.com/r/redteamsec/comments/xfm2wx/question_regarding_win10_privilege_escalation/

currently doing a ctf challenge where you need to unencrypt a heavily locked down drive encrypted with bitlocker. i've done some tinkering and i think i've landed on a solution involving using a powershell privilege escalation exploit to create a new admin user, logging in to it and disabling bitlocker from the control panel. however, part of the exercise involves both powershell and the command prompt being but behind a blacklist, meaning i can't use something like powershdll to run powershell scripts from cmd. is there any other way to do this? or is my approach to this problem completely wrong? submitted by /u/Xianthu_Exists (https://www.reddit.com/user/Xianthu_Exists)
[link] (https://www.reddit.com/r/redteamsec/comments/xfm2wx/question_regarding_win10_privilege_escalation/) [comments] (https://www.reddit.com/r/redteamsec/comments/xfm2wx/question_regarding_win10_privilege_escalation/)

___________________________
@hacking_Attack
@Hacking_Video

r/redteamsec on Reddit: question regarding win10 privilege escalation without cmd or powershell

Posted by u/Xianthu_Exists - 2 votes and 4 comments

7 viewsedited 09:27

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
social media data plan Bypass ?

Facebook, Instagram, snapshat, Whatssap and Twitter are all Unlimited in my data plan, but I can't access regular internet

Is there a way I can use regular internet for using this plan?

Maybe somehow disguise regular web traffic as Facebook traffic or something like that

submitted by /u/Amine5284
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

social media data plan Bypass ?

Facebook, Instagram, snapshat, Whatssap and Twitter are all Unlimited in my data plan, but I can't access regular internet Is there a way I can...

8 viewsedited 09:30

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Hashcat w/ known words and delimiters

I have a hash, and a list of words and three possible delimiters.

Ex word list:

cat dog rabbit 2992 . , $

The first letter is capital. The words can be in any combination separated by any delimiter and the numbers in that order could be treated as a word.

Ex password:

Cat.dog.rabbit

Dog.rabbit.2992

Rabbit,dog$cat

Question: How do I handle this with hashcat? Right now I am running:

hashcat -m11300 -a3 hash.txt --increment --increment-min=8 --increment-max=20 -2 $,.4579abcdegimortuxy ?u?2?2?2?2?2?2?2?2?2?2?2?2?2?2?2?2?2?2?2

I didn't know how to do it a dictionary route, so I took all the unique letters that made up the pass words, then started the cracking. It says 83 days to finish.

Any thoughts how to take a word list with special characters and find all the combinations possible with the first letter capital?

Thanks.

submitted by /u/terrorEagle
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hashcat w/ known words and delimiters

I have a hash, and a list of words and three possible delimiters. Ex word list: cat dog rabbit 2992 . , $ The first...

9 viewsedited 09:31

About

Blog

Apps

Platform