Hacking Articles Tips Tricks Videos Tutorials

HTTP request smuggling Explained and Exploited Part 0x2

Hi! My name is Hashar Mujahid, and today we will continue to discuss what HTTP request smuggling vulnerabilities are and how we can…Continue reading on InfoSec Write-ups »
Read more...

6 views10:57

6 views11:26

Hacking Articles Tips Tricks Videos Tutorials

7 views11:26

Hacking Articles Tips Tricks Videos Tutorials

Photo

Black Hat Ethical Hacking
Offensive Security Tool: Monkey365

Offensive Security Tool: Monkey365Post Views: 80 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes Monkey365Monkey365 is an Open Source security tool that can be used to easily conduct not only Microsoft 365, but also Azure subscriptions and Azure Active Directory security configuration reviews without the significant overhead of learning tool APIs or complex admin panels from the start. To help with this effort, Monkey365 also provides several ways to identify security gaps in the desired tenant setup and configuration. It also provides valuable recommendations on how to best configure those settings to get the most out of your Microsoft 365 tenant or Azure subscription. IntroductionEssentially, it is a plugin-based PowerShell module that can be used to review the security posture of your cloud environment. You can scan for potential misconfigurations and security issues in public cloud accounts according to security best practices and compliance standards, across Azure, Azure AD, and Microsoft365 core applications.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course InstallationYou can either download the latest zip by clicking this link or download Monkey365 by cloning the repository:

Once downloaded, you must extract the file and extract the files to a suitable directory. Once you have unzipped the zip file, you can use the PowerShell V3 Unblock-File cmdlet to unblock files: Get-ChildItem -Recurse c:\monkey365 | Unblock-FileOnce you have installed the monkey365 module on your system, you will likely want to import the module with the Import-Module cmdlet. Assuming that Monkey365 is located in the PSModulePath, PowerShell would load monkey365 into active memory: Import-Module monkey365If Monkey365 is not located on a PSModulePath path, you can use an explicit path to import: Import-Module C:\temp\monkey365You can also use the Force parameter in case you want to reimport the Monkey365 module into the same session Import-Module C:\temp\monkey365 -ForceTrending: Offensive Security Tool: VLANPWN
Trending: Recon Tool: Collector Basic UsageGet-Help Invoke-Monkey365To get a list of examples use: Get-Help Invoke-Monkey365 -ExamplesTo get a list of all options and examples with detailed info use: Get-Help Invoke-Monkey365 -DetailedThe following example will retrieve data and metadata from Azure AD and SharePoint Online and then print results. If credentials are not supplied, Monkey365 will prompt for credentials. $param = @{Instance = 'Microsoft365';Analysis = 'SharePointOnline';PromptBehavior = 'SelectAccount';IncludeAzureActiveDirectory = $true;ExportTo = 'PRINT';}$assets = Invoke-Monkey365 @paramTrending: How to Exploit “improper error handling” in Web Applications Regulatory compliance checksMonkey365 helps streamline the process of performing not only Microsoft 365, but also Azure subscriptions and Azure Active Directory Security Reviews.

160+ checks covering industry defined security best practices for Microsoft 365, Azure and Azure Active Directory.

Monkey365 will help consultants to assess cloud environment and to analyze the risk factors according to controls and best practices. The report will contain structured data for quick checking and verification of the results. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/68747470733a2f2f73696c7665726861636b2e6769746875622e696f2f6d6f6e6b65793336352f6173736574732f696d616765732f68746d6c7265706f72[...]

10 views11:26

Hacking Articles Tips Tricks Videos Tutorials

Photo

Black Hat Ethical Hacking
Microsoft data breach exposes over 65K customers’ contact info, emails

Microsoft data breach exposes over 65K customers’ contact info, emailsPost Views: 94 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Microsoft said today that some of its customers’ sensitive information was exposed by a misconfigured Microsoft server accessible over the Internet.The company secured the server after being notified of the leak on September 24, 2022 by security researchers at threat intelligence firm SOCRadar.

“This misconfiguration resulted in the potential for unauthenticated access to some business transaction data corresponding to interactions between Microsoft and prospective customers, such as the planning or potential implementation and provisioning of Microsoft services,” the company revealed.

“Our investigation found no indication customer accounts or systems were compromised. We have directly notified the affected customers.”

According to Microsoft, the exposed information includes names, email addresses, email content, company name, and phone numbers, as well as files linked to business between affected customers and Microsoft or an authorized Microsoft partner.

Redmond added that the leak was caused by the “unintentional misconfiguration on an endpoint that is not in use across the Microsoft ecosystem” and not due to a security vulnerability.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Leaked data allegedly linked to 65,000 entities worldwideWhile Microsoft refrained from providing any additional details regarding this data leak, SOCRadar revealed in a blog post published today that the data was stored on misconfigured Azure Blob Storage.

In total, SOCRadar claims it was able to link this sensitive information to more than 65,000 entities from 111 countries stored in files dated from 2017 to August 2022.

“On September 24, 2022, SOCRadar’s built-in Cloud Security Module detected a misconfigured Azure Blob Storage maintained by Microsoft containing sensitive data from a high-profile cloud provider,” SOCRadar said.

The threat intel company added that, from its analysis, the leaked data “includes Proof-of-Execution (PoE) and Statement of Work (SoW) documents, user information, product orders/offers, project details, PII (Personally Identifiable Information) data, and documents that may reveal intellectual property.”

Microsoft added today that it believes SOCRadar “greatly exaggerated the scope of this issue” and “the numbers.”

Furthermore, Redmond said that SOCRadar’s decision to collect the data and make it searchable using a dedicated search portal “is not in the best interest of ensuring customer privacy or security and potentially exposing them to unnecessary risk.”
Trending: How to Exploit “improper error handling” in Web Applications Trending: Offensive Security Tool: VLANPWN Online tool to search the leaked dataSOCRadar’s data leak search portal is named BlueBleed and it allows companies to find if their sensitive info was also exposed with the leaked data.

Besides what was found inside Microsoft’s misconfigured server, BlueBleed also allows searching for data collected from five other public storage buckets.

In Microsoft’s server alone, SOCRadar claims to have found 2.4 TB of data containing sensitive information, with more than 335,000 emails, 133,000 projects, and 548,000 exposed users discovered while analyzing the leaked files until now.

Per SOCRadar’s analysis, these files contain customer emails, SOW documents, product offers, POC (Proof of Concept) works, partner ec[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking

Microsoft data breach exposes over 65K customers’ contact info, emails | Black Hat Ethical Hacking

Microsoft said today that some of its customers' sensitive information was exposed by a misconfigured Microsoft server accessible over the Internet.

10 viewsedited 11:26

About

Blog

Apps

Platform