LDAP Nom Nom - anonymously bruteforce Active Directory usernames at high speed
https://www.reddit.com/r/redteamsec/comments/xi6spc/ldap_nom_nom_anonymously_bruteforce_active/

Here's my new tool "LDAP nom nom", which allows you to anonymously bruteforce Domain Controllers to find usernames in Active Directory at high speeds. As far as I know there are no logs generated for this, so detecting this requires custom network level monitoring. If you're pentesting a new environment, and don't know where to start, you can detect existence of about 10M usernames in less than 30 minutes (10K names/sec) From there on, it could be a question of looking for really dubious account names like "admintest" or "tempadmin" who might have the same password as the account name. This can be attempted by kerberoasting or direct logins (this is noisy and generates events). Reception of this small tool has been terrific, with more than 200 stars on Github in less than 24 hours, which is crazy compared to the other stuff I've released. https://github.com/lkarlslund/ldapnomnom submitted by /u/lkarlslund (https://www.reddit.com/user/lkarlslund)
[link] (https://www.reddit.com/r/redteamsec/comments/xi6spc/ldap_nom_nom_anonymously_bruteforce_active/) [comments] (https://www.reddit.com/r/redteamsec/comments/xi6spc/ldap_nom_nom_anonymously_bruteforce_active/)

___________________________
@hacking_Attack
@Hacking_Video

Crack Pre-Shared Key of WPA/WPA2 from Live Network
https://www.reddit.com/r/redteamsec/comments/xi7650/crack_preshared_key_of_wpawpa2_from_live_network/

submitted by /u/tbhaxor (https://www.reddit.com/user/tbhaxor)
[link] (https://tbhaxor.com/cracking-wpa-psk-using-aircrack/) [comments] (https://www.reddit.com/r/redteamsec/comments/xi7650/crack_preshared_key_of_wpawpa2_from_live_network/)

___________________________
@hacking_Attack
@Hacking_Video

Staying Under the Radar - PPID Spoofing and Blocking DLLs
https://www.reddit.com/r/redteamsec/comments/xi7opb/staying_under_the_radar_ppid_spoofing_and/

https://crypt0ace.github.io/posts/Staying-under-the-Radar/ submitted by /u/Potential_Waltz7400 (https://www.reddit.com/user/Potential_Waltz7400)
[link] (https://www.reddit.com/r/redteamsec/comments/xi7opb/staying_under_the_radar_ppid_spoofing_and/) [comments] (https://www.reddit.com/r/redteamsec/comments/xi7opb/staying_under_the_radar_ppid_spoofing_and/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe : Red Team Learning Path

https://cdn-images-1.medium.com/max/864/1*InAO4lsmYeEU3KC19eP65A.png
hey sup, it’s your techie Kalra here, so recently Tryhackme has created a new Learning Path called “Red Team Learning Path”, so today we…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hello Ethernaut (Level-0) CTF

https://cdn-images-1.medium.com/max/612/1*9XvfiaRh6u17knFl203x9A.jpeg
Introduction

Continue reading on CoinsBench »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Developing Pentest Skills

https://cdn-images-1.medium.com/max/728/0*7AlpQBiy8wX6MrrQ
Lots of people ask me how to get into the hacking field and almost always I tell them to start with pentesting. Pentesting is the gateway…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Google Dorking: How to hack the google search algorithm?

https://cdn-images-1.medium.com/max/1514/1*JH4EWYvR8BGX0zs-M2u_wg.jpeg
Most of us have faced those frustrating moments when we need that missing piece of information or a snippet of code to finish that college…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
DeFi: Over a million dollars stolen from Inverse Finance

https://cdn-images-1.medium.com/max/1600/1*HSOVnygmwAs0iQkora-FOg.png
Inverse Finance again fell victim to an instant credit exploit for $1.26 million in Tether (USDT) and Wrapped Bitcoin (WBTC).

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Découverte d’une faille IDOR et extraction de données téléphoniques
https://medium.com/@m4rkus.p1/d%C3%A9couverte-dune-faille-idor-et-extraction-de-donn%C3%A9es-t%C3%A9l%C3%A9phoniques-29657cfe65ff?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

J’ai un compte client fidélité chez une grande enseigne de prêt à porter… je tiens à flouter le nom de l’enseigne dans la suite de cet…Continue reading on Medium » (https://medium.com/@m4rkus.p1/d%C3%A9couverte-dune-faille-idor-et-extraction-de-donn%C3%A9es-t%C3%A9l%C3%A9phoniques-29657cfe65ff?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Parrot or kali for Pentesting
https://www.reddit.com/r/Pentesting/comments/xiahu1/parrot_or_kali_for_pentesting/

I have been struggling with installing Kali on HP omen. I'm now considering using Parrot for Pentesting and security stuff. What advice would you give to someone starting out and considering using Parrot? I know Kali is the recommended OS for security. submitted by /u/Groundbreaking_Owl24 (https://www.reddit.com/user/Groundbreaking_Owl24)
[link] (https://www.reddit.com/r/Pentesting/comments/xiahu1/parrot_or_kali_for_pentesting/) [comments] (https://www.reddit.com/r/Pentesting/comments/xiahu1/parrot_or_kali_for_pentesting/)

___________________________
@hacking_Attack
@Hacking_Video

CATS - REST API Fuzzer And Negative Testing Tool For OpenAPI Endpoints
http://www.kitploit.com/2022/09/cats-rest-api-fuzzer-and-negative.html

___________________________
@hacking_Attack
@Hacking_Video

REST API fuzzer and negative testing tool. Run thousands of self-healing API tests within minutes with no coding effort!Comprehensive: tests are generated automatically based on a large number scenarios and cover every field and headerIntelligent: tests are generated based on data types and constraints; each Fuzzer have specific expectations depending on the scenario under testHighly Configurable: high amount of customization: you can exclude specific Fuzzers, HTTP response codes, provide business context and a lot moreSelf-Healing: as tests are generated, any OpenAPI spec change is picked up automaticallySimple to Learn: flat learning curve, with intuitive configuration and syntaxFast: automatic process for write, run and report tests which covers thousands of scenarios within minutes
OverviewBy using a simple and minimal syntax, with a flat learning curve, CATS (Contract Auto-generated Tests for Swagger) enables you to generate thousands of API tests within minutes with no coding effort. All tests are generated, run and reported automatically based on a pre-defined set of 89 Fuzzers. The Fuzzers cover a wide range of input data from fully random large Unicode values to well crafted, context dependant values based on the request data types and constraints. Even more, you can leverage the fact that CATS generates request payloads dynamically and write simple end-to-end functional tests.

___________________________
@hacking_Attack
@Hacking_Video

Please check the Slicing Strategies (https://github.com/Endava/cats#slicing-strategies-for-running-cats) section for making CATS run fast and comprehensive in the same time. Tutorials on how to use CATSThis is a list of articles with step-by-step guides on how to use CATS:Testing the GitHub API with CATS (https://ludovicianul.github.io/2020/10/05/github-api-testing/)How to write self-healing functional tests with no coding effort (https://ludovicianul.github.io/2020/09/09/cats/)Some bugs found by CATShashicorp/vault#13274 (https://github.com/hashicorp/vault/issues/13274) | hashicorp/vault#13273 (https://github.com/hashicorp/vault/issues/13273)hashicorp/vault#13225 (https://github.com/hashicorp/vault/issues/13225) | hashicorp/vault#13232 (https://github.com/hashicorp/vault/issues/13232)go-gitea/gitea#19397 (https://github.com/go-gitea/gitea/issues/19397) | go-gitea/gitea#19398 (https://github.com/go-gitea/gitea/issues/19398)go-gitea/gitea#19399 (https://github.com/go-gitea/gitea/issues/19399)InstallationHomebrew brew tap endava/tap > brew install cats">> brew tap endava/tap
> brew install catsManualCATS is bundled both as an executable JAR or a native binary. The native binaries do not need Java installed.After downloading your OS native binary, you can add it in classpath so that you can execute it as any other command line (https://www.kitploit.com/search/label/Command%20Line) tool:sudo cp cats /usr/local/bin/catsYou can also get autocomplete by downloading the cats_autocomplete (https://github.com/Endava/cats/blob/master/cats_autocomplete) script and do:source cats_autocompleteTo get persistent autocomplete, add the above line in ~/.zshrc or ./bashrc, but make sure you put the fully qualified path for the cats_autocomplete script.You can also check the cats_autocomplete source for alternative setup.There is no native binary for Windows, but you can use the uberjar version. This requires Java 11+ to be installed.You can run it as java -jar cats.jar.Head to the releases page to download the latest versions: https://github.com/Endava/cats/releases.BuildYou can build CATS from sources on you local box. You need Java 11+. Maven is already bundled.Before running the first build, please make sure you do a ./mvnw clean. CATS uses a fork ok OKHttpClient which will install locally under the 4.9.1-CATS version, so don't worry about overriding the official versions.You can use the following Maven command to build the project:./mvnw package -Dquarkus.package.type=uber-jarcp target/You will end up with a cats.jar in the target folder. You can run it wih java -jar cats.jar ....You can also build native images using a GraalVM Java version../mvnw package -PnativeNote: You will need to configure Maven with a Github PAT (https://docs.github.com/en/free-pro-team@latest/packages/guides/configuring-apache-maven-for-use-with-github-packages) with read-packages scope to get some dependencies for the build.Notes on Unit TestsYou may see some ERROR log messages while running the Unit Tests. Those are expected behaviour for testing the negative scenarios of the Fuzzers.Running CATSBlackbox modeBlackbox mode means that CATS doesn't need any specific context. You just need to provide the service URL, the OpenAPI spec and most probably authentication headers (https://github.com/Endava/cats#headers-file).> cats --contract=openapy.yaml --server=http://localhost:8080 --headers=headers.yml --blackboxIn blackbox mode CATS will only report ERRORs if the received HTTP response code is a 5XX. Any other mismatch between what the Fuzzer expects vs what the service returns (for example service returns 400 and service returns 200) will be ignored.The blackbox mode is similar to a smoke test. It will quickly tell you if the application has major bugs that must be addressed immediately.Context modeThe real power of CATS relies on running it in a non-blackbox mode also called context mode. Each Fuzzer has an expected HTTP response code based on the scenario under

___________________________
@hacking_Attack
@Hacking_Video