’s coming to a close, XLL’s present an attractive option for phishing campaigns. With some creativity they can be used in conjunction with other techniques to bypass many layers of defenses implemented by organizations and security teams. Thank you for reading and I hope you learned something useful! Download

___________________________
@hacking_Attack
@Hacking_Video

Ookeenga Official Testnet and Bug Bounty Event — $3,000 Prize Pool

Chieftains, we’re thrilled to announce an exciting new milestone for Ookeenga — Our Testnet is finally here!Continue reading on Medium »
Read more...

hacking: security in practice
Looking for a game that was created to be hacked and for educational purposes

Hello,

There was this really awesome game these hackers once made and it had little objectives to accomplish by hacking the code. Such as, unlocking all the characters, and these mini games. One of them was really fun where these aliens attacked you and you had to type the correct code in decimal from hexidecimal and the missile would kill it.

The game was on steam and I just remembered it. But I can't recall nor find for the life of me what it was called? Having 1400 games, I wasn't sure if it would even be on there because I don't believe it costed money. It's totally possible that it was never even on steam and I just think that.

It was an awesome idea and game and hoping to find it again.

submitted by /u/CPPNewGuy
[link] [comments]

hacking: security in practice
Someone hacked into my wifi?

Around 3am my gf woke up to a text saying that a device had connected to our wifi. She changed the password and the next morning she saw that the user who disconnected (had a Chinese username) had also been disconnected. A few hours ago I got a text message from Coinbase saying “xxxx- is your verification code. Do not share with anyone else”. Not sure if these are coincidence or not. Any steps I should be taking besides changing the passwords?

submitted by /u/DancingTotem
[link] [comments]

hacking: security in practice
How'd they pull this off?

I was at the bar tonight and talked to someone about my involvement in cybersecurity, and all the top level stuff a new person would be willing to talk about. (I'm a 2nd year web developer in a cybersecurity company, but also do packet/wifi/rf hacking in my freetime and have gone to defcon a few times now) They mentioned that last year they had received a phishing text posing as the Illinois secretary of state only a day or so after submitting their Drivers license renewal form online. The phishing campaign itself is already well known, as reported here ( https://abc7chicago.com/phishing-illinois-secretary-of-state-ides-social-security-number/10840281/ )

The campaign itself isn't surprising, it's another phishing attack. My question is, how did they manage to find and target these people. Most of them received the messages after having recently been on the Illinois secretary of state website. What would the attackers have likely compromised to be able to find these targets?

submitted by /u/00101100BendertheRob
[link] [comments]

How i made the multiple hall of fame in Nokia within 2 minutes

HoF (HALL OF FAME) for reporting a sinlge bug on their several domains through their Nokia vulnerability disclosureContinue reading on System Weakness »
Read more...

How i made the multiple hall of fame in Nokia within 2 minutes
https://systemweakness.com/how-i-made-the-multiple-hall-of-fame-in-nokia-within-2-minutes-535056fcb66d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

HoF (HALL OF FAME) for reporting a sinlge bug on their several domains through their Nokia vulnerability disclosureContinue reading on System Weakness » (https://systemweakness.com/how-i-made-the-multiple-hall-of-fame-in-nokia-within-2-minutes-535056fcb66d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Complete Ethical Hacking Online Course: Beginner to Advanced

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Some Mitigation Against Phishing and MITM

Regular phishing awareness should be done in the organization.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Kubeeye : Audit Tool For Kubernetes

KubeEye is an inspection tool for Kubernetes to discover Kubernetes resources (by OPA ), cluster components, cluster nodes (by Node-Problem-Detector) and other configurations are meeting with best practices, and giving suggestions for modification.

KubeEye supports custom inspection rules and plugins installation. Through KubeEye Operator, you can view the inspection results and modification suggestions by the graphical display on the web page. ArchitectureKubeEye get cluster resource details by the Kubernetes API, inspect the resource configurations by inspection rules and plugins, and generate inspection results. See Architecture for details.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLM0QI2V-V4bpG8xExppRa_Em4ChHcwSBYDTXT7EN6mrXEv9qjyewctXW0yEBb5XE-cLzM1gSeFt1xSZtSkVki6PGE7hKARj1p16vQjQkgQZOI5p2A3WKDRvBL-fk2O81w2CJen5wvoTGA68GLXtybrMMogValeuCSEjkaXs9fD8PheFMMTKdRi7nb/s728/kubeeye-architecture-svg.png How to use* Install KubeEye on your machine
* Download pre built executables from Releases.
* Or you can build from source codeNote: make install will create kubeeye in /usr/local/bin/ on your machine.
git clone https://github.com/kubesphere/kubeeye.git
cd kubeeye
make installke

* [Optional] Install Node-problem-Detector

Note: This will install npd on your cluster, only required if you want detailed report.

kubeeye install npd

* Run KubeEye

Note: The results of kubeeye sort by resource kind.

kubeeye audit
KIND NAMESPACE NAME REASON LEVEL MESSAGE
Node docker-desktop kubelet has no sufficient memory available warning KubeletHasNoSufficientMemory
Node docker-desktop kubelet has no sufficient PID available warning KubeletHasNoSufficientPID
Node docker-desktop kubelet has disk pressure warning KubeletHasDiskPressure
Deployment default testkubeeye NoCPULimits
Deployment default testkubeeye NoReadinessProbe
Deployment default testkubeeye NotRunAsNonRoot
Deployment kube-system coredns NoCPULimits
Deployment kube-system coredns ImagePullPolicyNotAlways
Deployment kube-system coredns NotRunAsNonRoot
Deployment kubeeye-system kubeeye-controller-manager ImagePullPolicyNotAlways
Deployment kubeeye-system kubeeye-controller-manager NotRunAsNonRoot
DaemonSet kube-system kube-proxy NoCPULimits
DaemonSet k ube-system kube-proxy NotRunAsNonRoot
Event kube-system coredns-558bd4d5db-c26j8.16d5fa3ddf56675f Unhealthy warning Readiness probe failed: Get “http://10.1.0.87:8181/ready”: dial tcp 10.1.0.87:8181: connect: connection refused
Event kube-system coredns-558bd4d5db-c26j8.16d5fa3fbdc834c9 Unhealthy warning Readiness probe failed: HTTP probe failed with statuscode: 503
Event kube-system vpnkit-controller.16d5ac2b2b4fa1eb BackOff warning Back-off restarting failed container
Event kube-system vpnkit-controller.16d5fa44d0502641 BackOff warning Back-off restarting failed container
Event kubeeye-system kubeeye-controller-manager-7f79c4ccc8-f2njw.16d5fa3f5fc3229c Failed warning Failed to pull image “controller:latest”: rpc error: code = Unknown desc = Error response from daemon: pull access denied for controller, repository does not exist or may require ‘docker login’: denied: requested access to the resource is denied
Event kubeeye-system kubeeye-controller-manager-7f79c4ccc8-f2njw.16d5fa3f61b28527 Failed warning Error: ImagePullBackOff
Role kubeeye-system kubeeye-leader-election-role CanDeleteResources
ClusterRole kubeeye-manager-role CanDeleteResources
ClusterRole kubeeye-manager-role CanModifyWorkloads
ClusterRole vpnkit-controller CanImpersonateUser
ClusterRole vpnkit-controller CanDeleteResources What KubeEye can do* KubeEye inspects cluster resources according with Kubernetes best practices, to make cluster stable.
* KubeEye can find problems of your cluster control plane, including kube-apiserver/kube-controller-manager/etcd, etc.
* KubeEye helps you detect all kinds of cluster nodes[...]

___________________________
@hacking_Attack
@Hacking_Video

problems, including memory/cpu/disk pressure, unexpected kernel error logs, etc. ChecklistYES/NOCHECK ITEMDescriptionLevelhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png PrivilegeEscalationAllowedPrivilege escalation is alloweddangerhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png CanImpersonateUserThe role/clusterrole can impersonate other userwarninghttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png CanModifyResourcesThe role/clusterrole can delete kubernetes resourceswarninghttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png CanModifyWorkloadsThe role/clusterrole can modify kubernetes workloadswarninghttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png NoCPULimitsThe resource does not set limits of CPU in containers.resourcesdangerhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png NoCPURequestsThe resource does not set requests of CPU in containers.resourcesdangerhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png HighRiskCapabilitiesHave high-Risk options in capabilities such as ALL/SYS_ADMIN/NET_ADMINdangerhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png HostIPCAllowedHostIPC Set to truedangerhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png HostNetworkAllowedHostNetwork Set to truedangerhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png HostPIDAllowedHostPID Set to truedangerhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png HostPortAllowedHostPort Set to truedangerhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png ImagePullPolicyNotAlwaysImage pull policy not alwayswarninghttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png ImageTagIsLatestThe image tag is latestwarninghttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png ImageTagMissThe image tag do not declaredangerhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png InsecureCapabilitiesHave insecure options in capabilities such as KILL/SYS_CHROOT/CHOWNdangerhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png NoLivenessProbeThe resource does not set livenessProbewarninghttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png NoMemoryLimitsThe resource does not set limits of memory in containers.resourcesdangerhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png NoMemoryRequestsThe resource does not set requests of memory in containers.resourcesdangerhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png NoPriorityClassNameThe resource does not set priorityClassNameignorehttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png PrivilegedAllowedRunning a pod in a privileged mode means that the pod can access the host’s resources and kernel capabilitiesdangerhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png NoReadinessProbeThe resource does not set readinessProbewarninghttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png NotReadOnlyRootFilesystemThe resource does not set readOnlyRootFilesystem to truewarninghttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png NotRunAsNonRootThe resource does not set runAsNonRoot to true, maybe executed run as a root accountwarninghttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png CertificateExpiredPeriodCertificate expiration date less than 30 daysdangerhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png EventAuditEvent auditwarninghttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png NodeStatusnode status auditwarninghttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png DockerStatusdocker status auditwarninghttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png KubeletStatuskubelet status auditwarning Add your own inspection rulesAdd custom OPA rules* create a directory for OPA rules

mkdir opa

* Add custom OPA rules files

Note: the OPA rule for workloads, package name must be kubeeye_workloads_rego for RBAC, package name must be kubeeye_RBAC_rego for nodes, package name must be kubeeye_nodes_rego

* Save the following rules to rule file such as imageRegistryRule.rego to check the image registry address complies with rules.

package kubeeye_workloads[...]

___________________________
@hacking_Attack
@Hacking_Video

_rego
deny[msg] {
resource := input
type := resource.Object.kind
resourcename := resource.Object.metadata.name
resourcenamespace := resource.Object.metadata.namespace
workloadsType := {“Deployment”,”ReplicaSet”,”DaemonSet”,”StatefulSet”,”Job”}
workloadsType[type]
not workloadsImageRegistryRule(resource)
msg := {
“Name”: sprintf(“%v”, [resourcename]),
“Namespace”: sprintf(“%v”, [resourcenamespace]),
“Type”: sprintf(“%v”, [type]),
“Message”: “ImageRegistryNotmyregistry”
}
}
workloadsImageRegistryRule(resource) {
regex.match(“^myregistry.public.kubesphere/basic/.+”, resource.Object.spec.template.spec.containers[_].image)
}

* Run KubeEye with custom rules

Note: Specify the path then Kubeeye will read all files in the directory that end with .rego.

root:# kubeeye audit -p ./opa
NAMESPACE NAME KIND MESSAGE
default nginx1 Deployment [ImageRegistryNotmyregistry NotReadOnlyRootFilesystem NotRunAsNonRoot]
default nginx11 Deployment [ImageRegistryNotmyregistry PrivilegeEscalationAllowed HighRiskCapabilities HostIPCAllowed HostPortAllowed ImagePullPolicyNotAlways ImageTagIsLatest InsecureCapabilities NoPriorityClassName PrivilegedAllowed NotReadOnlyRootFilesystem NotRunAsNonRoot]
default nginx111 Deployment [ImageRegistryNotmyregistry NoCPULimits NoCPURequests ImageTagMiss NoLivenessProbe NoMemoryLimits NoMemoryRequests NoPriorityClassName NotReadOnlyRootFilesystem NoReadinessProbe NotRunAsNonRoot] KubeEye OperatorWhat is KubeEye OperatorKubeEye Operator is an inspection platform for Kubernetes, manage KubeEye by operator and generate inspection result. What KubeEye Operator can do* KubeEye Operator provides management functions through web page.
* KubeEye Operator recode inspection results by CR, can view and compare cluster inspection results by web page.
* KubeEye Operator provides more plugins.
* KubeEye Operator provides more detailed modification suggestions. deploy Kubeeyekubectl apply -f https://raw.githubusercontent.com/kubesphere/kubeeye/main/deploy/kubeeye.yaml
kubectl apply -f https://raw.githubusercontent.com/kubesphere/kubeeye/main/deploy/kubeeye_insights.yaml get the inspection resultsapiVersion: v1
items:
apiVersion: kubeeye.kubesphere.io/v1alpha1
kind: ClusterInsight
metadata:
name: clusterinsight-sample
namespace: default
spec:
auditPeriod: 24h
status:
auditResults:
auditResults:
resourcesType: Node
resultInfos:
namespace: “”
resourceInfos:
items:
level: warning
message: KubeletHasNoSufficientMemory
reason: kubelet has no sufficient memory available
level: warning
message: KubeletHasNoSufficientPID
reason: kubelet has no sufficient PID available
level: warning
message: KubeletHasDiskPressure
reason: kubelet has disk pressure
name: kubeeyeNode Download

___________________________
@hacking_Attack
@Hacking_Video

DeathSleep - A PoC Implementation For An Evasion Technique To Terminate The Current Thread And Restore It Before Resuming Execution, While Implementing Page Protection Changes During No Execution
http://www.kitploit.com/2022/09/deathsleep-poc-implementation-for.html

___________________________
@hacking_Attack
@Hacking_Video

A PoC implementation for an evasion technique to terminate the current thread and restore it before resuming execution, while implementing page protection (https://www.kitploit.com/search/label/Protection) changes during no execution.
IntroSleep and obfuscation (https://www.kitploit.com/search/label/Obfuscation) methods are well known in the maldev community, with different implementations, they have the objective of hiding from memory scanners while sleeping, usually changing page protections and even adding cool features like encrypting the shellcode, but there is another important point to hide our shellcode, and is hiding the current execution thread. Spoofing the stack is cool, but after thinking a little about it I thought that there is no need to spoof the stack… if there is no stack :)The usability of this technique is left to the reader to assess, but in any case, I think it is a cool way to review some topics, and learn some maldev for those who, like me, are starting in this world.The main implementation showed here holds everything that we need to take out of the stack in the data section, as global variables, but an impletementation moving everything to the heap will be published soon. It aims to show some key modifications that needs to be done to make this code pic and injectable.This repository is mirrored between GitHub (https://github.com/janoglezcampos/DeathSleep) and GitLab (https://gitlab.gi7w0rm.de/infosec_family/DeathSleep).

Download DeathSleep (https://github.com/janoglezcampos/DeathSleep)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Analyzing NFT’s Discord Server Hacks | QuillAudits

https://cdn-images-1.medium.com/max/1920/1*UUSyuIhoirhVFXYWUqgblA.png
Discord is a social media platform that is commonly used by NFT Projects. In recent times, there has been an increase in Discord hacks on…

Continue reading on QuillHash »

___________________________
@hacking_Attack
@Hacking_Video