I am Shubham Sudhir Sawant a Security Researcher, super thrilled to write my very first blog.Continue reading on Medium » (https://medium.com/@sc0p3hacker/cve-2022-37700-directory-transversal-in-zentao-easy-soft-alm-2573c1f0fc21?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Did I disclose a vulnerability improperly?

I work in IT and they have us working on Macs. I spotted a few things that an employee could abuse. So I sent 3 emails regarding each vulnerability, and each email was sent as i found them. Keep in mind, this process was along-side my training and nesting. So I was supposed to be doing my work, however, I was probing and enumerating my Mac for vulns on the side as well.

After the 3rd email, the security team asked to have a meeting with me. The meeting went well, except there was a moment when the head of security accused me of sneaking around due to not talking to security first.

Thoughts on this?

EDIT: clarification:

When i found the first privesc vulnerability, i notified my direct supervisors and they supported my decision to let someone know. They helped get those emails sent up the chain.

submitted by /u/EnthusiasmWorried496
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Getting Paid With Just Picking Color — Bug Bounty

Suppppp guysss, this is my first write-up about bug bounty, let me introduce myself, my name is Redza you can call me za, ja, dza, red, or…Continue reading on Medium »
Read more...

Getting Paid With Just Picking Color — Bug Bounty
https://medium.com/@rdzsp/getting-paid-with-just-picking-color-bug-bounty-d3dbbac277fa?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Suppppp guysss, this is my first write-up about bug bounty, let me introduce myself, my name is Redza you can call me za, ja, dza, red, or…Continue reading on Medium » (https://medium.com/@rdzsp/getting-paid-with-just-picking-color-bug-bounty-d3dbbac277fa?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Does anyone know if Daryl Gibson has a book for Pentest+ or any study material on pentesting in general. Any study material would be greatly appreciated! #cyber #security #Pentest+ #Pentesting
https://www.reddit.com/r/Pentesting/comments/xg44g6/does_anyone_know_if_daryl_gibson_has_a_book_for/

submitted by /u/RoyD389 (https://www.reddit.com/user/RoyD389)
[link] (https://www.reddit.com/r/Pentesting/comments/xg44g6/does_anyone_know_if_daryl_gibson_has_a_book_for/) [comments] (https://www.reddit.com/r/Pentesting/comments/xg44g6/does_anyone_know_if_daryl_gibson_has_a_book_for/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Analyze obfuscated Microsoft Office files

https://cdn-images-1.medium.com/max/1686/1*23tBpzwTpGsT-RgjK0S2ZA.png
When you are under incident investigation, the time does the different to provide the right solution to your stakeholders. Sometimes to go…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Why Uber’s ‘No Evidence’ Claim of Stolen User Data Is PR Bullshit

https://cdn-images-1.medium.com/max/2600/1*l5zUwJhULZIVGz3Z-64TFA.jpeg
Uber has released an official security update at 10:30 PST on September 16th, 2022 regarding the breach that allowed a hacker to gain…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
All-in-One post. How Uber was hacked in 2022

https://external-preview.redd.it/w2lfSJsr9fSSi6mSShofydy7gWNKzLoFoG8-HmI19Io.jpg?width=640&crop=smart&auto=webp&s=8983b6538b5c87dbe545791507539618365b86e0 submitted by /u/Ivan_Wallarm
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Interview

Hello. I have a podcast and am looking for some interesting guests. If you know a lot about hacking and have some interesting stories I’d love to have you on. Thanks.

submitted by /u/More_Kaleidoscope888
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Silent Crypto Miner Tutorial (First YT Video :D)

submitted by /u/Adventurous-Tap-1540
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Ookeenga Official Testnet and Bug Bounty Event — $3,000 Prize Pool
https://ookeenga.medium.com/ookeenga-official-testnet-and-bug-bounty-event-3-000-prize-pool-2f4261906fa0?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Chieftains, we’re thrilled to announce an exciting new milestone for Ookeenga — Our Testnet is finally here!Continue reading on Medium » (https://ookeenga.medium.com/ookeenga-official-testnet-and-bug-bounty-event-3-000-prize-pool-2f4261906fa0?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
XLL_Phishing : XLL Phishing Tradecraft

XLL_Phishing, With Microsoft’s recent announcement regarding the blocking of macros in documents originating from the internet (email AND web download), attackers have began aggressively exploring other options to achieve user driven access (UDA). There are several considerations to be weighed and balanced when looking for a viable phishing for access method:

* Complexity – The more steps that are required on the user’s part, the less likely we are to be successful.
* Specificity – Are most victim machines susceptible to your attack? Is your attack architecture specific? Does certain software need to be installed?
* Delivery – Are there network/policy mitigations in place on the target network that limit how you could deliver your maldoc?
* Defenses – Is application whitelisting enforced?
* Detection – What kind of AV/EDR is the client running?

These are the major questions, however there are certainly more. Things get more complex as you realize that these factors compound each other; for example, if a client has a web proxy that prohibits the download of executables or DLL’s, you may need to stick your payload inside a container (ZIP, ISO, etc). Doing so can present further issues down the road when it comes to detection. More robust defenses require more complex combinations of techniques to defeat.

This article will be written with a fictional target organization in mind; this organization has employed several defensive measures including email filtering rules, blacklisting certain file types from being downloaded, application whitelisting on endpoints, and Microsoft Defender for Endpoint as an EDR solution.

Real organizations may employ none of these, some, or even more defenses which can simplify or complicate the techniques outlined in this research. As always, know your target. What are XLL’s?XLL’s are DLL’s, specifically crafted for Microsoft Excel. To the untrained eye they look a lot like normal excel documents.

XLL’s provide a very attractive option for UDA given that they are executed by Microsoft Excel, a very commonly encountered software in client networks; as an additional bonus, because they are executed by Excel, our payload will almost assuredly bypass Application Whitelisting rules because a trusted application (Excel) is executing it. XLL’s can be written in C, C++, or C# which provides a great deal more flexibility and power (and sanity) than VBA macros which further makes them a desirable choice.

The downside of course is that there are very few legitimate uses for XLL’s, so it SHOULD be a very easy box to check for organizations to block the download of that file extension through both email and web download. Sadly many organizations are years behind the curve and as such XLL’s stand to be a viable method of phishing for some time.

There are a series of different events that can be used to execute code within an XLL, the most notable of which is xlAutoOpen.

Upon double clicking an XLL, the user is greeted by this screen:
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgscQL0s6gdjkwE1RQAURKoDvSQKDDLIukCQLHtiecAB1HlVQ-c8YRuZJpbJ7QS9iAD9vmI0RGPb2NAbxKtBPpk0gwdnALwTr_FY-ZdQoLYKqY-IkraqHVukB5oM8QPwgk7YH0g3XdNwEoQPKpBMGOouACHC7xY-p9rzO_T9Z1h5CriJnIsDAoP79kf/s843/0.png
This single dialog box is all that stands between the user and code execution; with fairly thin social engineering, code execution is all but assured.

Something that must be kept in mind is that XLL’s, being executables, are architecture specific. This means that you must know your target; the version of Microsoft Office/Excel that the target organization utilizes will (usually) dictate what architecture you need to build your payload for.

There is a pretty clean break in Office versions that can be used as a rule of thumb:

Office 2016 or earlier: x86

Office 2019 or later: x64

It should be noted that i[...]

___________________________
@hacking_Attack
@Hacking_Video

t is possible to install the other architecture for each product, however these are the default architectures installed and in most cases this should be a reliable way to make a decision about which architecture to roll your XLL for. Of course depending on the delivery method and pretexting used as part of the phishing campaign, it is possible to provide both versions and rely on the victim to select the appropriate version for their system. ResourcesThe XLL payload that was built during this research was based on this project by edparcell. His repository has good instructions on getting started with XLL’s in Visual Studio, and I used his code as a starting point to develop a malicious XLL file.

A notable deviation from his repository is that should you wish to create your own XLL project, you will need to download the latest Excel SDK and then follow the instructions on the previously linked repo using this version as opposed to the 2010 version of the SDK mentioned in the README. DeliveryDelivery of the payload is a serious consideration in context of UDA. There are two primary methods we will focus on:

* Email Attachment
* Web Delivery Email AttachmentEither via attaching a file or including a link to a website where a file may be downloaded, email is a critical part of the UDA process. Over the years many organizations (and email providers) have matured and enforced rules to protect users and organizations from malicious attachments. Mileage will vary, but organizations now have the capability to:

* Block executable attachments (EXE, DLL, XLL, MZ headers overall)
* Block containers like ISO/IMG which are mountable and may contain executable content
* Examine zip files and block those containing executable content
* Block zip files that are password protected
* More

Fuzzing an organization’s email rules can be an important part of an engagement, however care must always be taken so as to not tip one’s hand that a Red Team operation is ongoing and that information is actively being gathered.

For the purposes of this article, it will be assumed that the target organization has robust email attachment rules that prevent the delivery of an XLL payload. We will pivot and look at web delivery. Web DeliveryEmail will still be used in this attack vector, however rather than sending an attachment it will be used to send a link to a website. Web proxy rules and network mitigations controlling allowed file download types can differ from those enforced in regards to email attachments. For the purposes of this article, it is assumed that the organization prevents the download of executable files (MZ headers) from the web. This being the case, it is worth exploring packers/containers.

The premise is that we might be able to stick our executable inside another file type and smuggle it past the organization’s policies. A major consideration here is native support for the file type; 7Z files for example cannot be opened by Windows without installing third party software, so they are not a great choice. Formats like ZIP, ISO, and IMG are attractive choices because they are supported natively by Windows, and as an added bonus they add very few extra steps for the victim.

The organization unfortunately blocks ISO’s and IMG’s from being downloaded from the web; additionally, because they employ Data Loss Prevention (DLP) users are unable to mount external storage devices, which ISO’s and IMG’s are considered.

Luckily for us, even though the organization prevents the download of MZ-headered files, it does allow the download of zip files containing executables. These zip files are actively scanned for malware, to include prompting the user for the password for password-protected zip files; however because the executable is zipped it is not blocked by the otherwise blanket deny for MZ files. Zip files and executionZip files were chosen as a container for our XLL payload because:

* They are natively compatible with Windows
* They [...]

___________________________
@hacking_Attack
@Hacking_Video