Hacking on Medium
FUD UUID Shellcode

https://cdn-images-1.medium.com/max/626/1*R7dn3dHM01Ve9pvYGsPnvw.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TempleDAO hacked for $2.3M

https://cdn-images-1.medium.com/max/1200/0*wFrxkYTr-fLMn_eA.jpg
A legal bounty for the exploit is now being offered to the hacker.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top 5 VS Code Extensions for Smart-Contract Hacking |2022

https://cdn-images-1.medium.com/max/1920/1*uE9PRAeKAq_rMpvLhYTtvw.png
This blog contains popular vscode extensions used in smartcontract auditing. Using these extensions will save you a lot of time.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Don’t Do This, I Lose My 183k Followers & $2,150

https://cdn-images-1.medium.com/max/2600/0*__PyEGYXyjFYPi9x
Welcome, Dear Hustlers I’m back with Bad News, Yes you read right. The not Good news it's bad news.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

HTTP request smuggling Explained and Exploited Part 0x2
https://infosecwriteups.com/http-request-smuggling-explained-and-exploited-part-0x2-7768d04883fb?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi! My name is Hashar Mujahid, and today we will continue to discuss what HTTP request smuggling vulnerabilities are and how we can…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/http-request-smuggling-explained-and-exploited-part-0x2-7768d04883fb?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

HTTP request smuggling Explained and Exploited Part 0x2

Hi! My name is Hashar Mujahid, and today we will continue to discuss what HTTP request smuggling vulnerabilities are and how we can…Continue reading on InfoSec Write-ups »
Read more...

Black Hat Ethical Hacking
Offensive Security Tool: Monkey365

Offensive Security Tool: Monkey365Post Views: 80 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes Monkey365Monkey365 is an Open Source security tool that can be used to easily conduct not only Microsoft 365, but also Azure subscriptions and Azure Active Directory security configuration reviews without the significant overhead of learning tool APIs or complex admin panels from the start. To help with this effort, Monkey365 also provides several ways to identify security gaps in the desired tenant setup and configuration. It also provides valuable recommendations on how to best configure those settings to get the most out of your Microsoft 365 tenant or Azure subscription. IntroductionEssentially, it is a plugin-based PowerShell module that can be used to review the security posture of your cloud environment. You can scan for potential misconfigurations and security issues in public cloud accounts according to security best practices and compliance standards, across Azure, Azure AD, and Microsoft365 core applications.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course InstallationYou can either download the latest zip by clicking this link or download Monkey365 by cloning the repository:

Once downloaded, you must extract the file and extract the files to a suitable directory. Once you have unzipped the zip file, you can use the PowerShell V3 Unblock-File cmdlet to unblock files: Get-ChildItem -Recurse c:\monkey365 | Unblock-FileOnce you have installed the monkey365 module on your system, you will likely want to import the module with the Import-Module cmdlet. Assuming that Monkey365 is located in the PSModulePath, PowerShell would load monkey365 into active memory: Import-Module monkey365If Monkey365 is not located on a PSModulePath path, you can use an explicit path to import: Import-Module C:\temp\monkey365You can also use the Force parameter in case you want to reimport the Monkey365 module into the same session Import-Module C:\temp\monkey365 -ForceTrending: Offensive Security Tool: VLANPWN
Trending: Recon Tool: Collector Basic UsageGet-Help Invoke-Monkey365To get a list of examples use: Get-Help Invoke-Monkey365 -ExamplesTo get a list of all options and examples with detailed info use: Get-Help Invoke-Monkey365 -DetailedThe following example will retrieve data and metadata from Azure AD and SharePoint Online and then print results. If credentials are not supplied, Monkey365 will prompt for credentials. $param = @{Instance = 'Microsoft365';Analysis = 'SharePointOnline';PromptBehavior = 'SelectAccount';IncludeAzureActiveDirectory = $true;ExportTo = 'PRINT';}$assets = Invoke-Monkey365 @paramTrending: How to Exploit “improper error handling” in Web Applications Regulatory compliance checksMonkey365 helps streamline the process of performing not only Microsoft 365, but also Azure subscriptions and Azure Active Directory Security Reviews.

160+ checks covering industry defined security best practices for Microsoft 365, Azure and Azure Active Directory.

Monkey365 will help consultants to assess cloud environment and to analyze the risk factors according to controls and best practices. The report will contain structured data for quick checking and verification of the results. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/68747470733a2f2f73696c7665726861636b2e6769746875622e696f2f6d6f6e6b65793336352f6173736574732f696d616765732f68746d6c7265706f72[...]

Black Hat Ethical Hacking
Microsoft data breach exposes over 65K customers’ contact info, emails

Microsoft data breach exposes over 65K customers’ contact info, emailsPost Views: 94 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Microsoft said today that some of its customers’ sensitive information was exposed by a misconfigured Microsoft server accessible over the Internet.The company secured the server after being notified of the leak on September 24, 2022 by security researchers at threat intelligence firm SOCRadar.

“This misconfiguration resulted in the potential for unauthenticated access to some business transaction data corresponding to interactions between Microsoft and prospective customers, such as the planning or potential implementation and provisioning of Microsoft services,” the company revealed.

“Our investigation found no indication customer accounts or systems were compromised. We have directly notified the affected customers.”

According to Microsoft, the exposed information includes names, email addresses, email content, company name, and phone numbers, as well as files linked to business between affected customers and Microsoft or an authorized Microsoft partner.

Redmond added that the leak was caused by the “unintentional misconfiguration on an endpoint that is not in use across the Microsoft ecosystem” and not due to a security vulnerability.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Leaked data allegedly linked to 65,000 entities worldwideWhile Microsoft refrained from providing any additional details regarding this data leak, SOCRadar revealed in a blog post published today that the data was stored on misconfigured Azure Blob Storage.

In total, SOCRadar claims it was able to link this sensitive information to more than 65,000 entities from 111 countries stored in files dated from 2017 to August 2022.

“On September 24, 2022, SOCRadar’s built-in Cloud Security Module detected a misconfigured Azure Blob Storage maintained by Microsoft containing sensitive data from a high-profile cloud provider,” SOCRadar said.

The threat intel company added that, from its analysis, the leaked data “includes Proof-of-Execution (PoE) and Statement of Work (SoW) documents, user information, product orders/offers, project details, PII (Personally Identifiable Information) data, and documents that may reveal intellectual property.”

Microsoft added today that it believes SOCRadar “greatly exaggerated the scope of this issue” and “the numbers.”

Furthermore, Redmond said that SOCRadar’s decision to collect the data and make it searchable using a dedicated search portal “is not in the best interest of ensuring customer privacy or security and potentially exposing them to unnecessary risk.”
Trending: How to Exploit “improper error handling” in Web Applications Trending: Offensive Security Tool: VLANPWN Online tool to search the leaked dataSOCRadar’s data leak search portal is named BlueBleed and it allows companies to find if their sensitive info was also exposed with the leaked data.

Besides what was found inside Microsoft’s misconfigured server, BlueBleed also allows searching for data collected from five other public storage buckets.

In Microsoft’s server alone, SOCRadar claims to have found 2.4 TB of data containing sensitive information, with more than 335,000 emails, 133,000 projects, and 548,000 exposed users discovered while analyzing the leaked files until now.

Per SOCRadar’s analysis, these files contain customer emails, SOW documents, product offers, POC (Proof of Concept) works, partner ec[...]

___________________________
@hacking_Attack
@Hacking_Video

742e706e67-1024x479.png Supported standardsBy default, the HTML report shows you the CIS (Center for Internet Security) Benchmark. The CIS Benchmarks for Azure and Microsoft 365 are guidelines for security and compliance best practices.

The following standards are supported by Monkey365:

* CIS Microsoft Azure Foundations Benchmark v1.4.0
* CIS Microsoft 365 Foundations Benchmark v1.4.0

More standards will be added in next releases (NIST, HIPAA, GDPR, PCI-DSS, etc..) as they are available.

Additional information such as Installation or advanced usage can be found in the following link
Clone the repo from here: GitHub Link
Trending: Write up: A primer on OS Command Injection Attacks https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/collector-300x150.png Recon Tool: CollectorOctober 14, 2022
Reading Time: 2 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/VLANPWN-300x150.png Offensive Security Tool: VLANPWNOctober 7, 2022
Reading Time: 2 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/ProtOSINT-300x150.png OSINT Tool: ProtOSINTSeptember 30, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/BF_ActiveSub-300x150.png Recon Tool: BF ActiveSubSeptember 29, 2022
Reading Time: 4 minutes https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Offensive Security Tool: Monkey365 first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

osystem details, invoices, project details, customer product price list, POE documents, product orders, signed customer documents, internal comments for customers, sales strategies, and customer asset documents.

https://www.bleepstatic.com/images/news/u/1109292/2022/BlueBleed_search_portal.png
​Trending: Critical RCE Vulnerability Found in vm2 Sandbox Library Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-9-300x150.png Researchers find 633% increase in cyber-attacks aimed at open source repositoriesOctober 19, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-8-300x150.png MyDeal data breach impacts 2.2M users, stolen data for sale onlineOctober 18, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-7-1-300x150.png Microsoft 365 Message Encryption Can Leak Sensitive InfoOctober 17, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-6-300x150.png GitLab patches RCE bug in GitHub import functionOctober 14, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Microsoft data breach exposes over 65K customers’ contact info, emails first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

PartyLoud - A Simple Tool To Generate Fake Web Browsing And Mitigate Tracking
http://www.kitploit.com/2022/10/partyloud-simple-tool-to-generate-fake.html

___________________________
@hacking_Attack
@Hacking_Video

PartyLoud is a highly configurable and straightforward free tool that helps you prevent tracking directly from your linux terminal, no special skills required. Once started, you can forget it is running. It provides several flags; each flag lets you customize your experience and change PartyLoud behaviour according to your needs.

Simple. 3 files only, no installation required, just clone this repo an you're ready to go. Powerful. Thread-based navigation. Stealthy. Optimized to emulate user navigation. Portable. You can use this script on every unix-based OS. This project was inspired by noisy.py (https://github.com/1tayH/noisy)
How It Works URLs and keywords are loaded (either from partyloud.conf and badwords or from user-defined files) If proxy flag has been used, proxy config will be tested For each URL in ULR-list a thread is started, each thread as an user agent (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/User-Agent) associated Each thread will start by sending an HTTP (https://www.scaler.com/topics/hypertext-transfer-protocol/) request to the given URL The response if filtered using the keywords in order to prevent 404s and malformed (https://www.kitploit.com/search/label/Malformed) URLs A new URL is choosen from the list generated after filering Current thread sleeps for a random time Actions from 4 to 7 are repeated using the new URL until user send kill signal (CTRL-C or enter key) Features Configurable urls list and blocklist Random DNS Mode : each request is done on a different DNS Server Multi-threaded request engine (# of thread are equal to # of urls in partyloud.conf) Error recovery (https://www.kitploit.com/search/label/Recovery) mechanism to protect Engines from failures Spoofed User Agent prevent from fingerprinting (https://www.kitploit.com/search/label/Fingerprinting) (each engine has a different user agent) Dynamic UI Setup Clone the repository: git clone https://github.com/realtho/PartyLoud.git Navigate to the directory (https://www.kitploit.com/search/label/Directory) and make the script executable: cd PartyLoud
chmod +x partyloud.sh Run 'partyloud': ./partyloud.sh Usage DNS Servers are sourced from specified FILE, each request will use a different DNS Server in the list !!WARNING THIS FEATURE IS EXPERIMENTAL!! !!PLEASE LET ME KNOW ISSUES ON GITHUB !! -l --url-list read URL list from specified FILE -b --blocklist read blocklist from specified FILE -p --http-proxy set a HTTP proxy -s --https-proxy set a HTTPS proxy -n --no-wait disable wait between one request and an other -h --help dispaly this help" dir="auto">Usage: ./partyloud.sh [options...]

-d --dns DNS Servers are sourced from specified FILE,
each request will use a different DNS Server
in the list
!!WARNING THIS FEATURE IS EXPERIMENTAL!!
!!PLEASE LET ME KNOW ISSUES ON GITHUB !!
-l --url-list read URL list from specified FILE
-b --blocklist read blocklist from specified FILE
-p --http-proxy set a HTTP proxy
-s --https-proxy set a HTTPS proxy
-n --no-wait disable wait between one request and an other
-h --help dispaly this help To stop the script press either enter or CRTL-C  File Specifications In current release there is no input-validation on files.
If you find bugs or have suggestions on how to improve this features please help me by opening issues on GitHub

___________________________
@hacking_Attack
@Hacking_Video

Intro If you don’t have special needs , default config files are just fine to get you started. Default files are located in: badwords (https://github.com/davideolgiati/PartyLoud/blob/master/badwords) partyloud.conf (https://github.com/davideolgiati/PartyLoud/blob/master/partyloud.conf) DNSList (https://github.com/davideolgiati/PartyLoud/blob/master/DNSList) Please note that file name and extension are not important, just content of files matter badwords (https://github.com/davideolgiati/PartyLoud/blob/master/badwords) - Keywords-based blocklist badwords (https://github.com/davideolgiati/PartyLoud/blob/master/badwords) is a keywords-based blocklist used to filter non-HTML content, images, document and so on.
The default config as been created after several weeks of testing. If you really think you need a custom blocklist, my suggestion is to start by copy and modifying default config according to your needs.
Here are some hints on how to create a great blocklist file: DO ✅ DONT  Use only ASCII chars Define one-site-only rules Try to keep the rules as general as possible Define case-sensitive rules Prefer relative path Place more than one rule per line partyloud.conf (https://github.com/davideolgiati/PartyLoud/blob/master/partyloud.conf) - ULR List partyloud.conf (https://github.com/davideolgiati/PartyLoud/blob/master/partyloud.conf) is a ULR List used as starting point for fake navigation generators.
The goal here is to create a good list of sites containing a lot of URLs.
Aside suggesting you not to use google, youtube and social networks related links, I've really no hints for you. Note #1 - To work properly the URLs must be well-formed (https://earthsci.stanford.edu/computing/hosting/urlsyntax/index.php) Note #2 - Even if the file contains 1000 lines only 10 are used (first 10, working on randomness) Note #3 - Only one URL per line is allowed DNSList (https://github.com/davideolgiati/PartyLoud/blob/master/DNSList) - DNS List DNSList (https://github.com/davideolgiati/PartyLoud/blob/master/DNSList) is a List of DNS used as argument for random DNS feature. Random DNS is not enable by default, so the “default file” is really just a guide line and a test used while developing the function to se if everything was working as expected.
The only suggestion here is to add as much address as possible to increase randomness. Note #1 - Only one address per line is allowed
Download PartyLoud (https://github.com/davideolgiati/PartyLoud)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
God Genesis : Payload Capable Bypass All The Known Antiviruses And Endpoints

God Genesis is a C2 server purely coded in Python3 created to help Red Teamers and Penetration Testers. Currently It only supports TCP reverse shell but wait a min, its a FUD and can give u admin shell from any targeted WINDOWS Machine.

The List Of Commands It Supports :-
===================================================================================================
BASIC COMMANDS:
===================================================================================================
help --> Show This Options
terminate --> Exit The Shell Completely
exit --> Shell Works In Background And Prompted To C2 Server
clear --> Clear The Previous Outputs

===================================================================================================
SYSTEM COMMANDS:
===================================================================================================
cd --> Change Directory
pwd --> Prints Current Working Directory
mkdir *dir_name* --> Creates A Directory Mentioned
rm *dir_name* --> Deletes A Directoty Mentioned
powershell [command] --> Run Powershell Command
start *exe_name* --> Start Any Executable By Giving The Executable Name

===================================================================================================
INFORMATION GATHERING COMMANDS:
===================================================================================================
env --> Checks Enviornment Variables
sc --> Lists All Services Running
user --> Current User
info --> Gives Us All Information About Compromised System
av --> Lists All antivirus In Compromised System

===================================================================================================
DATA EXFILTRATION COMMANDS:
===================================================================================================
download *file_name* --> Download Files From Compromised System
upload *file_name* --> Uploads Files To Victim Pc


===================================================================================================
EXPLOITATION COMMANDS:
===================================================================================================
persistence1 --> Persistance Via Method 1
persistence2 --> Persistance Via Method 2
get --> Download Files From Any URL
chrome_pass_dump --> Dump All Stored Passwords From Chrome Bowser
wifi_password --> Dump Passwords Of All Saved Wifi Networks
keylogger --> Starts Key Logging Via Keylogger
dump_keylogger --> Dump All Logs Done By Keylogger
python_install --> Installs Python In Victim Pc Without UI Features Of Our FrameworkCheck The Video To Get A Detail Knowledge
1. The Payload.py is [...]

___________________________
@hacking_Attack
@Hacking_Video

a FULLY UNDETECTABLE(FUD) use your own techniques for making an exe file. (Best Result When Backdoored With Some Other Legitimate Applictions)
2. Able to perform privilege escalation on any windows systems.
3. Fud keylogger
4. 2 ways of achieving persistance
5. Recon automation to save your time. How To Use Our Tool?git clone https://github.com/SaumyajeetDas/GodGenesis.git
pip3 install -r requirements.txt
python3 c2c.py
It is worth mentioning that Suman Chakraborty have contributed in the framework by coding the the the Fud Keyloger, Wifi Password Extraction and Chrome Password Dumper modules. Click Here To Download

___________________________
@hacking_Attack
@Hacking_Video