Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools!
VuCSA - Vulnerable Client-Server Application - Made For Learning/Presenting How To Perform Penetration Tests Of Non-Http Thick Clients

https://blogger.googleusercontent.com/img/a/AVvXsEhXcmK17m6wCBaHR39GGFs4rVs1weuGCekhTBe08jKuPqdoI9FwF73Zab_WrU8EIvkyMQEd4jjOjXtLpKpCEVLLodefbjSs92ScFS8-Fs6Qe25JuLQe71k0_l-jucZ7iG3DM1Gh3PgwpWhsksNn1xTIknLQc6uIjspvI8RMpemtzIGPyDbgJd2KlqDlfw=w200-h200
Vulnerable Client-Server Application

Vulnerable client-server application (VuCSA) is made for learning/presenting how to perform penetration tests of non-http thick clients. It is written in Java (with JavaFX graphical user interface).

Currently the vulnerable application contains the following challenges:

1. Buffer Over-read (simulated)
2. Command Execution
3. SQL Injection
4. Enumeration
5. XML
6. Horizontal Access Control
7. Vertical Access Control

If you want to know how to solve these challenges, take a look at the PETEP website, which describes how to use the open-source tool PETEP to exploit them.

Tip: Before you start hacking, do not forget to check the data structure of messages bellow.
How to Run

In order to run the vulnerable server and client, you can use one of releases on GitHub or run gradle assemble, which creates distribution packages (for both Windows and Unix). These packages contain sh/bat scripts that will run the server and client using JVM.

Project Structure

Project is divided into three modules:

* vucsa-common - common functionality for both client and server (including protocol processing utilities)
* vucsa-client - vulnerable client with JavaFX GUI
* vucsa-server - vulnerable server for terminal use

Data Structure

Messages transmitted between server and client have the following simple format:

[type][target][length][payload]
32b    32b     32b     ???

These four parts have the following meaning:

* type - type of the message (used for serialization/deserialization)
* target - target handler that will receive the message
* length - length of the payload
* payload - data serialized into bytes
Download Vucsa

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

VuCSA - Vulnerable Client-Server Application - Made For Learning/Presenting How To Perform Penetration Tests Of Non-Http Thick…

9 viewsedited 15:13

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Looking for somewhere to sell various bits of hacking related hardware

Any suggestions? Kind if a niche thing so looking for a place I could list these and not have to go through the whole "so what does it do?" sort of stuff.

Examples:

* CC1011 USB radio dongle from Im-Me messaging device (the little pink thing Travis Goodspeed hacked) - basically the same chip as on the Flipper zero to do subghz tx/rx
* TI eZ430 Chronos Smart watch with USB Dongle hacked to run rfcat - do replay attacks from your wrist
* Nexx Travel Router running OnionWRT - basically a TOR VPN
* TPLink travel router running OpenWRT
* GLinet Router hacked to run Wifi Pineapple
* GLinet Router hacked to run Minipwner
* Couple of ESP8266 devices probably running some captive portal spoofer or deauth/packet analysis firmware - one has a battery slot for an 18650 (think it's an ESP32 too actually)
* Lilygo T-Watch 2020 ESP32 based smartwatch
* Tiny little ZSUN USB dongle that is basically a tiny wifi router - unhacked, but hacks exist
* Some random USB dongle that identifies as a Sparkfun lilypad HID device... which it definitely is not, so I'm assuming it has a micro-controller that I put some HID emulator s/w on it to do some BadUSB thing with
* A USB ESP8266 with SD card so you can do remote-controlled BadUSB stuff - it identifies as a HID and provides a web UI that you can type into to send keystrokes.
* Few other little USB micro-controller type things

Nothing particularly valuable, but gathering dust and I don't want to just chuck the stuff out.

submitted by /u/nowonmai
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Looking for somewhere to sell various bits of hacking related hardware

Edit: someone reached out to me on Reddit and has taken the lot. Thanks for all the input & suggestions. Any suggestions? Kind if a...

9 viewsedited 16:07

Hacking Articles Tips Tricks Videos Tutorials

Invitation Hijacking

Hi Guys! Long time no see!Continue reading on Medium »
Read more...

7 views16:44

Hacking Articles Tips Tricks Videos Tutorials

Invitation Hijacking
https://medium.com/@vflexo/invitation-hijacking-4d6467f418cc?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

Invitation Hijacking

Hi Guys! Long time no see!

7 viewsedited 16:45

Hacking Articles Tips Tricks Videos Tutorials

6 views16:45

Hacking Articles Tips Tricks Videos Tutorials

Hi Guys! Long time no see!Continue reading on Medium » (https://medium.com/@vflexo/invitation-hijacking-4d6467f418cc?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

Invitation Hijacking

Hi Guys! Long time no see!

8 viewsedited 16:45

Hacking Articles Tips Tricks Videos Tutorials

Stopping C2 communications in human-operated ransomware through network protection
https://www.reddit.com/r/redteamsec/comments/yl7yf9/stopping_c2_communications_in_humanoperated/

submitted by /u/SCI_Rusher (https://www.reddit.com/user/SCI_Rusher)
[link] (https://aka.ms/C2Ransomware) [comments] (https://www.reddit.com/r/redteamsec/comments/yl7yf9/stopping_c2_communications_in_humanoperated/)

___________________________
@hacking_Attack
@Hacking_Video

Stopping C2 communications in human-operated ransomware through...

Posted in r/redteamsec by u/SCI_Rusher • 1 point and 0 comments

8 viewsedited 17:28

Hacking Articles Tips Tricks Videos Tutorials

OS Banner Grabbing & Identifying Target System OS.

Banner grabbing is a technique used by hackers and security teams to gain information about computer systems on networks and services…Continue reading on Medium »
Read more...

9 views18:14

Hacking Articles Tips Tricks Videos Tutorials

If there is an XSS vulnerability, does that mean that the attacker can maniuplate/inject whatever he'd like into the source code?
https://www.reddit.com/r/Pentesting/comments/yl9zwv/if_there_is_an_xss_vulnerability_does_that_mean/

Just wondering if there is an XSS vulnerability does that mean that an attacker freely can change whatever code he'd like? submitted by /u/Mjweki (https://www.reddit.com/user/Mjweki)
[link] (https://www.reddit.com/r/Pentesting/comments/yl9zwv/if_there_is_an_xss_vulnerability_does_that_mean/) [comments] (https://www.reddit.com/r/Pentesting/comments/yl9zwv/if_there_is_an_xss_vulnerability_does_that_mean/)

___________________________
@hacking_Attack
@Hacking_Video

If there is an XSS vulnerability, does that mean that the attacker...

Just wondering if there is an XSS vulnerability does that mean that an attacker freely can change whatever code he'd like?

8 viewsedited 18:53

Hacking Articles Tips Tricks Videos Tutorials

7 views19:04

Hacking Articles Tips Tricks Videos Tutorials

7 views19:04

Hacking Articles Tips Tricks Videos Tutorials

Photo