Hacking on Medium
Top Cyber Attacks Used by Hackers in 2022

https://cdn-images-1.medium.com/max/2600/1*PY9nByRuVnhXsCvYeiZ9LQ.jpeg
Originally published on Learnhub Blog by Cyril Osagie

Continue reading on Medium »

Hacking on Medium
5 Must-Hit Sleep Tactics for Zombie Pharmacists

https://cdn-images-1.medium.com/max/2600/0*1sGN14dDUhheAs4F
Here’s what a zombie looks like: a decade ago, my wife and I brought home our first baby. Not the baby, us. Two zombies. In the lack of…

Continue reading on In Fitness And In Health »

KitPloit - PenTest Tools!
Mangle - Tool That Manipulates Aspects Of Compiled Executables (.Exe Or DLL) To Avoid Detection From EDRs

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5c46_nTyHbdBAxoWUtPRPC1IT69t42mlHIB-tnP3FT4cpHi7AgoKcl00n89_vMQLXC75z1RLT5D9LL2GIUTonGxIfhFJF5lY2wPZ2Y_GC-yeqxM_xpSPSjhWPdNJ_9r7yAQT9z7tilpTi6-oI0eGkJm4e4cl8rn96ISpGlItgipttYDkBozoCaiwvyw/w494-h640/Mangle_1_logo.png Authored By Tyl0usFeatured at Source Zero Con 2022Mangle is a tool that manipulates aspects of compiled executables (.exe or DLL). Mangle can remove known Indicators of Compromise (IoC) based strings and replace them with random characters, change the file by inflating the size to avoid EDRs, and can clone code-signing certs from legitimate files. In doing so, Mangle helps loaders evade on-disk and in-memory scanners. ContributingMangle was developed in Golang. InstallThe first step, as always, is to clone the repo. Before you compile Mangle, you'll need to install the dependencies. To install them, run the following commands: go get github.com/Binject/debug/pe Then build it go build Mangle.go ImportantWhile Mangle is written in Golang, a lot of the features are designed to work on executable files from other languages. At the time of release, the only feature that is Golang specific is the string manipulation part. Usage./mangle -h

_____ .__
/ \ _____ ____ ____ | | ____
/ \ / \\__ \ / \ / ___\| | _/ __ \
/ Y \/ __ \| | \/ /_/ > |_\ ___/
\____|__ (____ /___| /\___ /|____/\___ >
\/ \/ \//_____/ \/
(@Tyl0us)
Usage of ./Mangle:
-C string
Path to the file containing the certificate you want to clone
-I string
Path to the orginal file
-M Edit the PE file to strip out Go indicators
-O string
The new file name
-S int
How many MBs to increase the file by StringsMangle takes the input executable and looks for known strings that security products look for or alert on. These strings alone are not the sole point of detection. Often, these strings are in conjunction with other data points and pieces of telemetry for detection and prevention. Mangle finds these known strings and replaces the hex values with random ones to remove them. IMPORTANT: Mangle replaces the exact size of the strings it’s manipulating. It doesn’t add any more or any less, as this would create misalignments and instabilities in the file. Mangle does this using the -Mcommand-line option.

Currently, Mangle only does Golang files but as time goes on other languages will be added. If you know of any for other languages, please open an issue ticket and submit them. Beforehttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnttttUBg4eFz8NqeI10YjWJZmTGB2i_E9zBDd17CdrNo7gXoNCT-w7yD7-tvsw1nltX8CEal56oTj_dNvfAMh5Lji5TR6Rm8_ztxRavGcjEbtnoRF0XBaZ1qyB1ekg3XtzbRAe6KGyA3VD5GhnM9FlY7Z2-2UUF-tIpE_2m34W-fsJ7mIYmqpOFywkQ/w640-h142/Mangle_2_Strings_Before.png Afterhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTcD29a1Cy_1eSqo5LrOTc1hBi5jroiNVIHW-8QI6SmyzdBvrzXHAdOGO3uE88AfItr0SlUgxXoKEY_zaLBrY9acBkS5opTh_qBU8bKHuDGYz135AzmN-Cu3FRZT8nI5tivonS-CSzzPIcXJSXVO752CQ-RravgrPS4IQAzRcJ3bo2lpCJvOkL_CqAgw/w640-h100/Mangle_3_Strings_After.png InflatePretty much all EDRs can’t scan both on disk or in memory files beyond a certain size. This simply stems from the fact that large files take longer to review, scan, or monitor. EDRs do not want to impact performance by slowing down the user's productivity. Mangle inflates files by creating a padding of Null bytes (Zeros) at the end of the file. This ensures that nothing inside the file is impacted. To inflate an executable, use the -Scommand-line option along with the number of bytes you want to add to the file. Large payloads are really not an issue an[...]

ymore with how fast Internet speeds are, that being said, it's not recommended to make a 2 gig file.

Based on test cases across numerous userland and kernel EDRs, it is recommended to increase the size by either 95-100 megabytes. Because vendors do not check large files, the activity goes unnoticed, resulting in the successful execution of shellcode. Example:https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhsmMexlN01H-wwtSaHLrAUgECYruYthXiyM4O4Sy_DsihusplovCkK1fVSNfXOAG14jhBnQG_fbj0D6EeX89SVvCdTXCXflOiPeFjepf4PnjvPT5KsAaAOJGxtuhMRQOKgOFs5k-wXiHSdLggK6vdERlWRtGMPsTs_9Nmd6TWJVH_3XgejbigrLJbr2Q/w640-h268/Mangle_4_Demo.gif CertificateMangle also contains the ability to take the full chain and all attributes from a legitimate code-signing certificate from a file and copy it onto another file. This includes the signing date, counter signatures, and other measurable attributes.

While this feature may sound similar to another tool I developed, Limelighter, the major difference between the two is that Limelighter makes a fake certificate based off a domain and signs it with the current date and time, versus using valid attributes where the timestamp is taken from when the original file. This option can use DLL or .exe files to copy using the -Ccommand-line option, along with the path to the file you want to copy the certificate from. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjYTfA6m3i7I3Fvq4SL2prtwRzPSCeHB5_5apT3e2lnP72p0vFMvsivo_vbRES2gFlhvmvFpDpxURTL051smEu1s9NBTfmuPjpBYyz2q4UPG5xp0-ygFQUWNEXzYCjJ3zxfUb2TD7xtUVvC5BSmzznaVHFKgIorbhl3xdpy-2ZmhkAHHeC0fRnWZn4RJQ/w640-h474/Mangle_5_Cert_Copy.png Credit* Special thanks to Jessica of SuperNovasStore for creating the logo.
* Special thanks to Binject for his repo Download Mangle

hacking: security in practice
Which language is the best for scripting?

Knowing how to script is actually quite important for a hacker. As a newbie to hacking, I wonder which programming language is the best for scripting. There are currently two choices in my list, C++ and Python. Can anyone share their views or experiences on them? I just don’t know which one should I master with. My C++ skills are slightly better than Python.

submitted by /u/PhysicalLiterature19
[link] [comments]

Would an associates degree prevent me from getting a pen testing job?
https://www.reddit.com/r/Pentesting/comments/yd6bx0/would_an_associates_degree_prevent_me_from/

<!-- SC_OFF -->I’m going to graduate with my associates in computer science in a year and a half from now, and I was thinking about teaching myself the programs that pen testers use. Then I’ll study for my OSCP, and other offensive security certifications and my GPEN along with my GXPN when I’m ready for it. Along with practicing hack the box, and try hack me to learn more about pen testing. Do you guys think that I should stick with this plan? Or should I transfer to another college after I graduate that offers computer science and cybersecurity all in one and then I study for my certificates. <!-- SC_ON --> submitted by /u/ELIDAL99 (https://www.reddit.com/user/ELIDAL99)
[link] (https://www.reddit.com/r/Pentesting/comments/yd6bx0/would_an_associates_degree_prevent_me_from/) [comments] (https://www.reddit.com/r/Pentesting/comments/yd6bx0/would_an_associates_degree_prevent_me_from/)

DEV-0832 (Vice Society) opportunistic ransomware campaigns impacting US education sector
https://www.reddit.com/r/redteamsec/comments/yd9b6d/dev0832_vice_society_opportunistic_ransomware/

submitted by /u/SCI_Rusher (https://www.reddit.com/user/SCI_Rusher)
[link] (https://aka.ms/ViceSociety) [comments] (https://www.reddit.com/r/redteamsec/comments/yd9b6d/dev0832_vice_society_opportunistic_ransomware/)

Exploiting SSRF Using Export PDF
https://roadtooscp.medium.com/exploiting-ssrf-using-export-pdf-623adbf1c9b2?source=rss------bug_bounty-5

Server Side Request Forgery (SSRF) is an attack where the server will act like a proxy for the attacker for accessing a local or to a…Continue reading on Medium » (https://roadtooscp.medium.com/exploiting-ssrf-using-export-pdf-623adbf1c9b2?source=rss------bug_bounty-5)

Dark Reading: Attacks/Breaches
LinkedIn Phishing Spoof Bypasses Google Workspace Security

A credential-stealing attack that spoofed LinkedIn and targeted a national travel organization skates past DMARC and other email protections.

Dark Reading: Attacks/Breaches
Threat Groups Repurpose Banking Trojans into Backdoors

Ursnif, a one-time banking Trojan also known as Gozi, becomes the latest codebase to be repurposed as a more general backdoor, as malware developers trend toward modularity.

Dark Reading: Attacks/Breaches
HR Departments Play a Key Role in Cybersecurity

A more secure organization starts with stronger alignment between HR and the IT operation.

Dark Reading: Attacks/Breaches
Spyderbat Raises Series A to Deliver Runtime Security Throughout Cloud Native Software Development Environments

Led by NTTVC, the funding enables further development of Cloud Native Intrusion Prevention from the team that invented Network Intrusion Prevention Systems.

Dark Reading: Attacks/Breaches
PayPal Introduces More Secure Payments with Passkeys

Passkeys are designed to replace passwords and allow seamless logins for consumers across devices and platforms.

Hacking on Medium
Mnemonic TryHackMe Writeup

https://cdn-images-1.medium.com/max/933/1*Uk28mEJNV-ZuMfPf8E_a7A.png
Mnemonic TryHackMe Walkthrough

Continue reading on Medium »

Hacking on Medium
how easily your phone can be hacked in 2022

https://cdn-images-1.medium.com/max/640/0*qn9db6_UgEnAv-YI.jpg
how easily your phone can be hacked

Continue reading on Medium »