Kali Linux Tutorials
JSubFinder : Searches Webpages For Javascript To Find Hidden Subdomains & Secrets

JSubFinder is a tool writtin in golang to search webpages & javascript for hidden subdomains and secrets in the given URL. Developed with BugBounty hunters in mind JSubFinder takes advantage of Go’s amazing performance allowing it to utilize large data sets & be easily chained with other tools.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDpoT0WH6rB8qi1sAurqAeA1_WOlhRC71G25D1wucr9qHurov6MpjUXKN028VMPf-sep-UTbBCTQKPbN1BYqW7Iui8fWLrg-i6XgwTfNsDRAv-qPMPsB7PK0vahe9iIdKjg97duQ8536JjQS5aGY0P364jOcX-P3Tv3N4pvM6K3w_lubLoq0MBfCSb/s1600/JSubFinder1.gif InstallInstall the application and download the signatures needed to find secrets Using GO:go get github.com/ThreatUnkown/jsubfinder
wget https://raw.githubusercontent.com/ThreatUnkown/jsubfinder/master/.jsf_signatures.yaml && mv .jsf_signatu
Or Downloads Page Basic UsageSearchSearch the given url’s for subdomains and secrets
$ jsubfinder search -h

Execute the command specified

Usage:
JSubFinder search [flags]

Flags:
-c, --crawl Enable crawling
-g, --greedy Check all files for URL's not just Javascript
-h, --help help for search
-f, --inputFile string File containing domains
-t, --threads int Ammount of threads to be used (default 5)
-u, --url strings Url to check

Global Flags:
-d, --debug Enable debug mode. Logs are stored in log.info
-K, --nossl Skip SSL cert verification (default true)
-o, --outputFile string name/location to store the file
-s, --secrets Check results for secrets e.g api keys
--sig string Location of signatures for finding secrets
-S, --silent Disable printing to the console
Examples (results are the same in this case):
$ jsubfinder search -u www.google.com
$ jsubfinder search -f file.txt
$ echo www.google.com | jsubfinder search
$ echo www.google.com | httpx --silent | jsubfinder search$

apis.google.com
ogs.google.com
store.google.com
mail.google.com
accounts.google.com
www.google.com
policies.google.com
support.google.com
adservice.google.com
play.google.com With Secrets Enablednote --secrets=""will save the secret results in a secrets.txt file
$ echo www.youtube.com | jsubfinder search --secrets=""
www.youtube.com
youtubei.youtube.com
payments.youtube.com
2Fwww.youtube.com
252Fwww.youtube.com
m.youtube.com
tv.youtube.com
music.youtube.com
creatoracademy.youtube.com
artists.youtube.com

Google Cloud API Key Advanced examples$ echo www.google.com | jsubfinder search -crawl -s "google_secrets.txt" -S -o jsf_google.txt -t 10 -g
* -crawluse the default crawler to crawl pages for other URL’s to analyze
* -senables JSubFinder to search for secrets
* -SSilence output to console
* -o save output to specified file
* -t 10use 10 threads
* -gsearch every URL for JS, even ones we don’t think have any ProxyEnables the upstream HTTP proxy with TLS MITM sypport. This allows you to:

1. Browse sites in realtime and have JSubFinder search for subdomains and secrets real time.
2. If needed run jsubfinder on another server to offload the workload
$ JSubFinder proxy -h

Execute the command specified

Usage:
JSubFinder proxy [flags]

Flags:
-h, --help help for proxy
-p, --port int [...]

___________________________
@hacking_Attack
@Hacking_Video

Port for the proxy to listen on (default 8444)
--scope strings Url's in scope seperated by commas. e.g www.google.com,www.netflix.com
-u, --upstream-proxy string Adress of upsteam proxy e.g http://127.0.0.1:8888 (default "http://127.0.0.1:8888")

Global Flags:
-d, --debug Enable debug mode. Logs are stored in log.info
-K, --nossl Skip SSL cert verification (default true)
-o, --outputFile string name/location to store the file
-s, --secrets Check results for secrets e.g api keys
--sig string Location of signatures for finding secrets
-S, --silent Disable printing to the console $ jsubfinder proxy
Proxy started on :8444
Subdomain: out.reddit.com
Subdomain: www.reddit.com
Subdomain: 2Fwww.reddit.com
Subdomain: alb.reddit.com
Subdomain: about.reddit.com With Burp Suite1. Configure Burp Suite to forward traffic to an upstream proxy/ (User Options > Connections > Upsteam Proxy Servers > Add)
2. Run JSubFinder in proxy mode

Burp Suite will now forward all traffic proxied through it to JSubFinder. JSubFinder will retrieve the response, return it to burp and in another thread search for subdomains and secrets. With Proxify1. Launch Proxify & dump traffic to a folder proxify -output logs2. Configure Burp Suite, a Browser or other tool to forward traffic to Proxify (see instructions on their github page)
3. Launch JSubFinder in proxy mode & set the upstream proxy as Proxify jsubfinder proxy -u http://127.0.0.1:84434. Use Proxify’s replay utility to replay the dumped traffic to jsubfinder replay -output logs -burp-addr http://127.0.0.1:8444Run on another serverSimple, run JSubFinder in proxy mode on another server e.g 192.168.1.2. Follow the proxy steps above but set your applications upstream proxy as 192.168.1.2:8443 Advanced Examples$ jsubfinder proxy --scope www.reddit.com -p 8081 -S -o jsf_reddit.txt
* --scopelimits JSubFinder to only analyze responses from www.reddit.com
* -pport JSubFinders proxy server is running on
* -Ssilence output to the console/stdout
* -o output examples to this file Click Here To Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
WHAT IF YOU FORGOT YOUR BITCOIN PASSWORD?

Experts discuss the hacking capability needed to compromise digital wallets and how cryptocurrency holders can safeguard the security of…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Support supports a Hacker

https://cdn-images-1.medium.com/max/900/0*wYSRIqm_kxeBaho9.png
Manipulating user accounts via Helpdesk

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

The Logging Dead: Two Event Log Vulnerabilities Haunting Windows
https://www.reddit.com/r/redteamsec/comments/yd1ryb/the_logging_dead_two_event_log_vulnerabilities/

submitted by /u/lohacker0 (https://www.reddit.com/user/lohacker0)
[link] (https://www.varonis.com/blog/the-logging-dead-two-windows-event-log-vulnerabilities) [comments] (https://www.reddit.com/r/redteamsec/comments/yd1ryb/the_logging_dead_two_event_log_vulnerabilities/)

___________________________
@hacking_Attack
@Hacking_Video

Mangle - Tool That Manipulates Aspects Of Compiled Executables (.Exe Or DLL) To Avoid Detection From EDRs
http://www.kitploit.com/2022/10/mangle-tool-that-manipulates-aspects-of.html

___________________________
@hacking_Attack
@Hacking_Video

Authored By Tyl0us Featured at Source Zero Con 2022 Mangle is a tool that manipulates aspects of compiled executables (.exe or DLL). Mangle can remove known Indicators of Compromise (https://www.kitploit.com/search/label/Indicators%20of%20Compromise) (IoC) based strings and replace them with random characters, change the file by inflating the size to avoid EDRs, and can clone code-signing certs from legitimate files. In doing so, Mangle helps loaders evade on-disk and in-memory scanners.
Contributing Mangle was developed in Golang. Install The first step, as always, is to clone the repo. Before you compile Mangle, you'll need to install the dependencies. To install them, run the following commands: go get github.com/Binject/debug/pe
Then build it go build Mangle.go
Important While Mangle is written in Golang, a lot of the features are designed to work on executable files from other languages. At the time of release, the only feature that is Golang specific is the string manipulation (https://www.kitploit.com/search/label/Manipulation) part. Usage ./mangle -h

_____ .__
/ \ _____ ____ ____ | | ____
/ \ / \\__ \ / \ / ___\| | _/ __ \
/ Y \/ __ \| | \/ /_/ > |_\ ___/
\____|__ (____ /___| /\___ /|____/\___ >
\/ \/ \//_____/ \/
(@Tyl0us)
Usage of ./Mangle:
-C string
Path to the file containing the certificate you want to clone
-I string
Path to the orginal file
-M Edit the PE file to strip out Go indicators
-O string
The new file name
-S int
How many MBs to increase the file by

Strings Mangle takes the input executable and looks for known strings that security products look for or alert on. These strings alone are not the sole point of detection. Often, these strings are in conjunction with other data points and pieces of telemetry (https://www.kitploit.com/search/label/Telemetry) for detection and prevention. Mangle finds these known strings and replaces the hex values with random ones to remove them. IMPORTANT: Mangle replaces the exact size of the strings it’s manipulating. It doesn’t add any more or any less, as this would create misalignments and instabilities in the file. Mangle does this using the -M command-line option. Currently, Mangle only does Golang files but as time goes on other languages will be added. If you know of any for other languages, please open an issue ticket and submit them. Before

___________________________
@hacking_Attack
@Hacking_Video

After

___________________________
@hacking_Attack
@Hacking_Video

Inflate Pretty much all EDRs can’t scan both on disk or in memory files beyond a certain size. This simply stems from the fact that large files take longer to review, scan, or monitor. EDRs do not want to impact performance (https://www.kitploit.com/search/label/Performance) by slowing down the user's productivity. Mangle inflates files by creating a padding of Null bytes (Zeros) at the end of the file. This ensures that nothing inside the file is impacted. To inflate an executable, use the -S command-line option along with the number of bytes you want to add to the file. Large payloads are really not an issue anymore with how fast Internet speeds are, that being said, it's not recommended to make a 2 gig file. Based on test cases across numerous userland and kernel EDRs, it is recommended to increase the size by either 95-100 megabytes. Because vendors do not check large files, the activity goes unnoticed, resulting in the successful execution of shellcode. Example:

___________________________
@hacking_Attack
@Hacking_Video

Certificate Mangle also contains the ability to take the full chain and all attributes from a legitimate code-signing certificate from a file and copy it onto another file. This includes the signing date, counter signatures, and other measurable attributes. While this feature may sound similar to another tool I developed, Limelighter (https://github.com/Tylous/Limelighter), the major difference between the two is that Limelighter (https://www.kitploit.com/search/label/Limelighter) makes a fake certificate based off a domain and signs it with the current date and time, versus using valid attributes where the timestamp is taken from when the original file. This option can use DLL or .exe files to copy using the -C command-line option, along with the path to the file you want to copy the certificate from.

___________________________
@hacking_Attack
@Hacking_Video

Credit Special thanks to Jessica of SuperNovasStore for creating the logo. Special thanks to Binject for his repo (https://github.com/Binject/debug)

Download Mangle (https://github.com/optiv/Mangle)

___________________________
@hacking_Attack
@Hacking_Video

Support supports a Hacker
https://mechboy.medium.com/support-supports-a-hacker-be9931104923?source=rss------bug_bounty-5

Manipulating user accounts via HelpdeskContinue reading on Medium » (https://mechboy.medium.com/support-supports-a-hacker-be9931104923?source=rss------bug_bounty-5)

HTTP request smuggling Explained and Exploited Part 0x3
https://infosecwriteups.com/http-request-smuggling-explained-and-exploited-part-0x3-b61623287603?source=rss------bug_bounty-5