hacking: security in practice
assuming no faults, how can a router be attacked for it to lose its internet connection?

Would some form of DOS disconnect a router from the network requiring a restart or if not what would?

submitted by /u/tiddlywinks2661
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
PowerShell Empire StarKiller - Standard Account - KeePass Master Password Extraction (Version 2.52)

KeePass Password Managers are highly recommended and used in global companies, but also targeted by threat actors.

Therefore, attackers having a foothold with limited privileges (Standard User) to the machine can identify if KeePass is running by listing the processes and unauthorized download the .KDBX KeePass Database file.

While the KeePass Database file is opened, the password is stored in Plain Text in Memory which allows intruders to load scripts such as "KeeThief" to extract the Master Password and gain access to the compromised user credentials.

KeePass Version: 2.52 (Latest Version, dated 01/11/2022)

https://www.youtube.com/watch?v=I3-ixb9wnWg

submitted by /u/EpicOfAllEpics
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
You Must Know These Nmap Scans

https://cdn-images-1.medium.com/max/832/1*wfIIJzzYUDNAuggI34EgOA.png
Do you know them all? Test your knowledge.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Niural’s Hackathon: Aurora ’22

https://cdn-images-1.medium.com/max/1600/1*XZqib9Fd6Eg_CSL3jLtzpw.png
The hottest payments x financial identity hackathon in web3

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to brute force into old emails?

How would I go about accessing an old email I forgot the password to? I was quite young when I made it and I’ve used several passwords through the years. This password is connected to an older Xbox 360 Gamertag as well that I’m dying to have back. I haven’t had access to the email since about 2015 I suppose, those were the last times I received emails from that account to my current email regarding school projects

submitted by /u/biggestboy96
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Red Teaming TTPs
https://medium.com/@reconshell.com/red-teaming-ttps-1e89f4fee33e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Useful Techniques, Tactics, and Procedures for red teamers and defenders, alike!Continue reading on Medium » (https://medium.com/@reconshell.com/red-teaming-ttps-1e89f4fee33e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
SQLite patches 22-year-old code execution, a DoS vulnerability

SQLite patches 22-year-old code execution, a DoS vulnerabilityPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes The maintainers of the SQLite database engine have patched a high severity vulnerability (DoS) that attackers could exploit to crash or control programs that rely on the software.Developers of the software have offered The Daily Swig a convincing argument that the flaw would be difficult to exploit in practice. Even so, they have revised the software with a patch to defend against the flaw – rather than dismissing the issue as something that can be safely ignored. SQLite is a popular open source C-language library that underpins many enterprise apps and services. Notable users of SQLite include Apple, Adobe, Google, Facebook, and Microsoft. There are billions of copies of SQLite deployed worldwide.

The SQLite team is quick to fix emerging vulnerabilities in the software due to their potentially wide-reaching impact. However, a vulnerability disclosed this month by Trail of Bits was introduced 22 years ago and highlighted how initially secure functionality could have unintended consequences much further down the line.

In a blog post dated October 25, Trail of Bits researcher Andreas Kellas said the vulnerability was introduced in SQLite version 1.0.12, a 2000 release that landed when the software was primarily based on 32-bit architectures. According to Kellas, the bug “may not have seemed like an error” at the time.

The high severity vulnerability is tracked as CVE-2022-35737, scoring a CVSS severity score of 7.5.

Trail of Bits said the bug impacts any app that relies on the SQLite library API.

The vulnerability is exploitable on 64-bit systems when large string inputs contain %Q, %q, or %w format substitution types that – in this scenario – might cause programs to crash or worse.

In the most severe cases – when the ! special character exists in the format string – it may be “possible to achieve arbitrary code execution, in the worst case, or to cause the program to hang and loop (nearly) indefinitely,” according to the researchers.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Root cause analysisSpeaking to The Daily Swig, the creator of SQLite, D. Richard Hipp, said the root cause of the problem was the use of signed 32-bit integers as a byte index into the input string and to compute the size of the output string. When an input string was large enough, the integer would overflow, and “all kinds of problems” ensued.

However, the potential impact of the flaw appears to be limited.

Hipp told us that it is not possible to reach the vulnerability for malicious purposes via SQL inputs or by passing SQLite a malformed database file. Instead, an attacker would have to abuse the use the sqlite3_mprintf() function – or “similar C-level interfaces with a format string that includes one of the non-standard [;…] conversion symbols, and then pass in a string that is over 2GB in size”.

The software developer added:

“Lots of applications use SQLite, but only a small percentage of those use the sqlite3_mprintf() API, and an even smaller percentage make use of %Q, %q, or %w. Of those that do, most do not provide a way for an attacker to arrange for a 2GB+ string to be passed into the argument to %Q, %q, or %w.”
Trending: Exploit XSS Injections in a one-line powerful Technique
Trending: Recon Tool: Hakrawler Unearthing FossilIn addition, while the project uses the Fossil control system and this software uses printf, the team [...]

___________________________
@hacking_Attack
@Hacking_Video

couldn’t find a way to inject a 2GB string.

CVE-2022-35737 was reported to the Computer Emergency Response Team (CERT) Coordination Center by Trail of Bits on July 14. CERT confirmed the issue, reached out to SQLite maintainers, and the team fixed the bug in the software’s source code only three days later – a task accomplished by converting to the use of 64-bit integers.

The patched SQLite version, v3.39.2, was released on July 21.

“We are grateful for the responsible disclosure from the researchers who found it,” Hipp said. “It doesn’t hurt to upgrade to a newer release of SQLite. But very few if any real-world applications should be affected by this.”

​
Trending: Exploited Windows zero-day lets JavaScript files bypass security warnings Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-5-1-300x150.png OpenSSL Gives Heads Up to Critical Vulnerability DisclosureOctober 31, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-4-1-300x150.png GitHub patches bug called repojacking that could allow access to another user’s repoOctober 28, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-3-1-300x150.png Windows vulnerable driver blocklist sync issue patchedOctober 27, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-2-2-300x150.png Cisco warns admins to patch AnyConnect flaw exploited in attacksOctober 26, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post SQLite patches 22-year-old code execution, a DoS vulnerability first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Red Teaming TTPs

Useful Techniques, Tactics, and Procedures for red teamers and defenders, alike!Continue reading on Medium »
Read more...

Kali Linux Tutorials
Mangle : Tool That Manipulates Aspects Of Compiled Executables (.Exe Or DLL) To Avoid Detection From EDRs

Mangle is a tool that manipulates aspects of compiled executables (.exe or DLL). Mangle can remove known Indicators of Compromise (IoC) based strings and replace them with random characters, change the file by inflating the size to avoid EDRs, and can clone code-signing certs from legitimate files. In doing so, Mangle helps loaders evade on-disk and in-memory scanners. ContributingMangle was developed in Golang. InstallThe first step, as always, is to clone the repo. Before you compile Mangle, you’ll need to install the dependencies. To install them, run the following commands:
go get github.com/Binject/debug/pe
Then build it
go build Mangle.go ImportantWhile Mangle is written in Golang, a lot of the features are designed to work on executable files from other languages. At the time of release, the only feature that is Golang specific is the string manipulation part. Usage./mangle -h

_____ .__
/ \ _____ ____ ____ | | ____
/ \ / \\__ \ / \ / ___\| | _/ __ \
/ Y \/ __ \| | \/ /_/ > |_\ ___/
\____|__ (____ /___| /\___ /|____/\___ >
\/ \/ \//_____/ \/
(@Tyl0us)
Usage of ./Mangle:
-C string
Path to the file containing the certificate you want to clone
-I string
Path to the orginal file
-M Edit the PE file to strip out Go indicators
-O string
The new file name
-S int
How many MBs to increase the file by StringsMangle takes the input executable and looks for known strings that security products look for or alert on. These strings alone are not the sole point of detection. Often, these strings are in conjunction with other data points and pieces of telemetry for detection and prevention. Mangle finds these known strings and replaces the hex values with random ones to remove them. IMPORTANT: Mangle replaces the exact size of the strings it’s manipulating. It doesn’t add any more or any less, as this would create misalignments and instabilities in the file. Mangle does this using the -Mcommand-line option.

Currently, Mangle only does Golang files but as time goes on other languages will be added. If you know of any for other languages, please open an issue ticket and submit them.

Before
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiuFxSXFOtznK1Z_JXfNBV7nWmPodQk1lQS-OipEZlHCLfv8S4DW8EblSU-o1qiqAkyR-dyi2jIOPvreuu7oCv-Hz4pNZcTkMoiJgS0fLdTf9gOMPOmdx7tFbc28xlMcaBld60R1CPPtkJCqcSyztDimen4VuWGHu30hOH3A64fCqUJDu6WBIDDI1Ep/s630/Mangle1.png
After
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgsC_BpQZfOl3qvFTjDUmHhS1WmCoefKpmScZ0dG5wgMoTFac5Bf6741XhwKi8IPYNnBfh4RHLl5WajLz5ZxNVLwSpGfaMswVis0hkwobkp3eQR36-J7oB8i-TJSvxPAe25SDvcu1ap3qQUCFaP0ybiPamegFjSC7jhGK5Z2SOUngz7Clx7ZI8b6uHE/s633/Mangle4.png InflatePretty much all EDRs can’t scan both on disk or in memory files beyond a certain size. This simply stems from the fact that large files take longer to review, scan, or monitor. EDRs do not want to impact performance by slowing down the user’s productivity. Mangle inflates files by creating a padding of Null bytes (Zeros) at the end of the file. This ensures that nothing inside the file is impacted. To inflate an executable, use the -Scommand-line option along with the number of bytes you want to add to the file. Large payloads are really not an issue anymore with how fast Internet speeds are, that being said, it’s not recommended to make a 2 gig file.

Based on test cases across numerous userland and kernel EDRs, it is recommended to increase the size by either 95-100 megabytes. Because vendors do not check large files, the activity goes unnoticed, resulting in the successful execution of shellcode. Example:https://blogger.googleusercontent.com/img/[...]

___________________________
@hacking_Attack
@Hacking_Video

b/R29vZ2xl/AVvXsEhf8jnEV7Fuk1b45vJ1sFJJ0PIzfya1LitN-cR8M_ohhv6pJKw4BqZAbq5b-YKq0m7QxFJyuSqsF9_Tdud8UihYJwz1q0TP8cl3cEjrUBMAlatDIGBgGAJpwNlIu4uE7P_1O_U8x4oKQBt0jMVyZe6dztOtlz8aNiofFigsUspFlIOO7S7rGa91tgDq/s3440/Mangle2.gif CertificateMangle also contains the ability to take the full chain and all attributes from a legitimate code-signing certificate from a file and copy it onto another file. This includes the signing date, counter signatures, and other measurable attributes.

While this feature may sound similar to another tool I developed, Limelighter, the major difference between the two is that Limelighter makes a fake certificate based off a domain and signs it with the current date and time, versus using valid attributes where the timestamp is taken from when the original file. This option can use DLL or .exe files to copy using the -Ccommand-line option, along with the path to the file you want to copy the certificate from.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8CI8EJ1JWnpbrO1X-CZwwChR0D6E8g3wOwaNE9YwagfChxZULLItmBcVOOPI961-bEHgIWlzhlh_Sl_ZBgHTNwzLaSXf-yDEaKoVCRoDVNDaKMYGYPm0UKNZu0XPRgyMcdrvSWyrsDfw13LNggqKsxwUgEl21LUdAvUSPm4xG0vq7vgJmhoIhaBEX/s724/Mangle3.png Click Here To Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Red Teaming TTPs

https://cdn-images-1.medium.com/max/1700/1*6pKrfSAWgx8kEucOPVb_iw.jpeg
Useful Techniques, Tactics, and Procedures for red teamers and defenders, alike!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Be-aware against ‘Human Hacking’

https://cdn-images-1.medium.com/max/2600/1*UCQIYFch4MTs8Z55eLCKfA.jpeg
When the same results can be attained with much less effort by means of social engineering, why bother with complex malware/tools/exploits?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video