Twitter doesn’t allow making tweets of same content in relatively near time frame.Continue reading on Medium » (https://jayateerthag.medium.com/bypass-duplicate-tweet-protection-using-negative-tweet-id-71e6802955b4?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

10 Awesome Tools For Bung Bounty

Hey, guys!Continue reading on Medium »
Read more...

Kali Linux Tutorials
Cicd-Goat : A Deliberately Vulnerable CI/CD Environment

The CI/CD-Goat project allows engineers and security practitioners to learn and practice CI/CD security through a set of 10 challenges, enacted against a real, full blown CI/CD environment. The scenarios are of varying difficulty levels, with each scenario focusing on one primary attack vector.

The challenges cover the Top 10 CI/CD Security Risks, including Insufficient Flow Control Mechanisms, PPE (Poisoned Pipeline Execution), Dependency Chain Abuse, PBAC (Pipeline-Based Access Controls), and more.
The different challenges are inspired by Alice in Wonderland, each one is themed as a different character.

The project’s environment is based on Docker images and can be run locally. These images are:

1. Gitea (minimal git server)
2. Jenkins
3. Jenkins agent
4. LocalStack (cloud service emulator that runs in a single container)
5. Lighttpd
6. CTFd (Capture The Flag framework).

The images are configured to interconnect in a way that creates fully functional pipelines.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCrm3duUda7pnb68HM9stO6a-5twOFYiYvf9h9W_J0LG9ZFaov7460SgGIu9t6D0pLt7wLSeYbhBHtc4xMNaAht40GFzYVu3eqINTI5oBb6bVlTCSc_k4Fa56w13t-qLHbFfPzHmjrOvEp1kIhhRb73Eo_Us4wnvJlrYH1eCcZDE9NW-eWW0K9-OM7/s823/cicd-goat1.png Download & RunThere’s no need to clone the repository. Linux & Maccurl -o cicd-goat/docker-compose.yaml --create-dirs https://raw.githubusercontent.com/cider-security-research/cicd-goat/main/docker-compose.yaml
cd cicd-goat && docker-compose up -d Windows (Powershell)mkdir cicd-goat; cd cicd-goat
curl -o docker-compose.yaml https://raw.githubusercontent.com/cider-security-research/cicd-goat/main/docker-compose.yaml
get-content docker-compose.yaml | %{$_ -replace "bridge","nat"}
docker-compose up -d UsageInstructions* Spoiler alert! Avoid browsing the repository files as they contain spoilers.
* To configure your git client for accessing private repositories we suggest cloning using the http url.
* In each challenge, find the flag – in the format of flag# (e.g flag2), or another format if mentioned specifically.
* Each challenge stands on its own. Do not use access gained in one challenge to solve another challenge.
* If needed, use the hints on CTFd.
* There is no need to exploit CVEs.
* No need to hijack admin accounts of Gitea or Jenkins (named “admin” or “red-queen”). Take the challenge1. After starting the containers, it might take up to 5 minutes until the containers configuration process is complete.
2. Login to CTFd at http://localhost:8000 to view the challenges:
* Username: alice* Password: alice3. Hack:
* Jenkins http://localhost:8080
* Username: alice* Password: alice* Gitea http://localhost:3000
* Username: thealice* Password: thealice4. Insert the flags on CTFd and find out if you got it right. Troubleshooting* If Gitea shows a blank page, refresh the page.
* When forking a repository, don’t change the name of the forked repository. ContributingDevelopment1. Clone the repository.
2. Rename .git folders to make them usable:
python3 rename.py git
3. Install testing dependencies: pip3 install pipenv==2022.8.30 pipenv install –deploy
4. Run the development environment to experiment with new changes: rm -rf tmp tmp-ctfd/ cp -R ctfd/data/ tmp-ctfd/ docker-compose -f docker-compose-dev.yaml up -d
5. Make the desired changes:
* All services except CTFd are completely configured as code so desired changes should be made to the files in the appropriate folders.
* To make changes in CTFd, use the admin credentials.

6. Shutdown the environment, move changes made in CTFd and rebuild it: docker-compose -f docker-compose-dev.yaml down ./apply.sh # save CTFd changes docker-compose -f docker-compose-dev.yaml up -d –build
7. Run tests:[...]

___________________________
@hacking_Attack
@Hacking_Video

pytest tests/
8. Rename .git folders to allow push: python3 rename.py notgit
9. Commit and push! ChecklistFollow the checklist below to add a challenge:

1. CTFd:
1. Write challenge description.
2. Choose category according to difficulty level.
3. Make sure the challenge is visible and has value according to difficulty.
4. Write hints in order of usage.
5. Add a flag. Make sure to select if it’s case-insensitive.

2. Gitea:
1. Configure a new repository in gitea.yaml.
2. Create the repository under gitea/repositories. Use an open-source repository that use the MIT license as a template for the challenge repository.

3. Jenkins:
1. Configure Jenkins and add new jobdsl files in the casc.yaml file.
2. Make sure jobs don’t run periodically. Jobs should be triggered by events / polling.
3. Validate that the new challenge doesn’t interfere with other challenges.

4. Make sure the flag is not accessible when solving other challenges.
5. Write tests.
6. Write the solution.
7. Update README.md if needed.
8. In order to run the CI, make sure you have a CircleCI account and that you’ve clicked “Set Up Project” on your fork of the project. Click Here To Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Making a proxy for a game.

I'm trying to make a proxy for a game. I was looking at some games and found one called Growtopia.

redirected the game to localhost trough the hosts file I don't see any incoming packets, from the game, but when I curl the ports trough terminal I see the incoming traffic. Why is my proxy not working do I need to fake an SSH certificate?

Heres link to the repo: https://github.com/paspielka/grow-proxy

submitted by /u/paspielka
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

10 Awesome Tools For Bung Bounty
https://medium.com/@nimmughal799/10-awesome-tools-for-bung-bounty-fd47db3452e2?source=rss------bug_bounty-5

Hey, guys!Continue reading on Medium » (https://medium.com/@nimmughal799/10-awesome-tools-for-bung-bounty-fd47db3452e2?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Australian law for penetration testing
https://www.reddit.com/r/Pentesting/comments/ys7d3m/australian_law_for_penetration_testing/

Hi, I am a small-time freelance penetration tester based in the US. I have a client who has introduced me to a potential client in Australia for web application testing. When I issue scoping documents to my clients, they are created in line with US law. I’ve researched and I believe I need to make my scoping document align with the law set out in the Criminal Code Act 1995 - Part 10.7. Is this the correct legislation I need to reference, and is there any others? Thank you submitted by /u/Responsible-Self7193 (https://www.reddit.com/user/Responsible-Self7193)
[link] (https://www.reddit.com/r/Pentesting/comments/ys7d3m/australian_law_for_penetration_testing/) [comments] (https://www.reddit.com/r/Pentesting/comments/ys7d3m/australian_law_for_penetration_testing/)

___________________________
@hacking_Attack
@Hacking_Video

TeamFiltration - Cross-Platform Framework For Enumerating, Spraying, Exfiltrating, And Backdooring O365 AAD Accounts
http://www.kitploit.com/2022/11/teamfiltration-cross-platform-framework.html

___________________________
@hacking_Attack
@Hacking_Video

TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring (https://www.kitploit.com/search/label/Backdooring) O365 AAD accounts. See the TeamFiltration (https://github.com/Flangvik/TeamFiltration/wiki/TeamFiltration) wiki page for an introduction into how TeamFiltration works and the Quick Start Guide (https://github.com/Flangvik/TeamFiltration/wiki/TeamFiltration#quick-start-guide) for how to get up and running! This tool has been used internally since January 2021 and was publicly released in my talk "Taking a Dumb In The Cloud" during DefCON30.
Download You can download the latest precompiled release for Linux, Windows and MacOSX X64 (https://github.com/Flangvik/TeamFiltration/releases/latest) The releases are precompiled into a single application-dependent binary. The size go up, but you do not need DotNetCore or any other dependencies to run them. Usage
╓╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╖
╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬
╬╬╬╬┤ ╟╬╬╜╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬
╬╬╬╬╡ │ ╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬
╬╬╬╬╡ ││ ╙╬╬╜╘ └╙╜╬╬╬╬╬╬
╬╬╬╬╡ ╓╥╥╬╬╬╬╬╬╥╥╖ ││ │ ╬╬╬╬╬
╬╬╬╬╡ ╓╬╫╬╜╜┘ ╙╜╜╬╫╬┐ ││ ││ └╬╬╬╬
╬╬╬╬┤ ╬╬╜╙╩╬╖╓ ╙╬╬╬ ││ ││ ╬╬╬╬
╬╬╬╬┤ ╬╜ ╙╬╫╖╖ ╓ ╙╬╖ ││ ├││ ╬╬╬╬
╬╬╬╬┤ ╬╬ ╓╖ ╙╬╬╬╬╬╬╦ ╬╬ │┌ ╓╬┤││ ╓╬╬╬╬
╬╬╬╬┤ ╓╬┤ ╬╬╬ ╬╬╬╬╬╬╬╬╜╜╜╬╬╖ ╟╬╬╬╬╬╬╬╬╬╕ ┌╬╬╬╬╬
╬╬╬╬┤ ╬╬┤ ╙╩┘ ╙╬╬╬╬╬╩ ╟╬╬ ╙╜╜╜╜╜╜╜╜╜╬╬╖╖╖╦╬╬╬╬╬╬╬
╬╬╬╬┤ ╬╬┤ ╟╬╬ ││ ╬╬╬╬╬╬╬╬╬╬╬╬
╬╬╬╬┤ ╬╬ ╦╖ ╗╖ ╬╬ ││ │ ╬╬╬╬
╬╬╬╬┤ └╬┐ ╙╬╖╖ ╓╬╬╜ ╓╬┘ ││ │ ╬╬╬╬
╬╬╬╬┤ └╬╖ ╙╩╨╬╬╬╩╨╜╜ ╒╬╬ ││ │ ╬╬╬╬
╬╬╬╬┤ ╙╬╬╬╖ ┌╖╫╬╜┘ ││ │ ╬╬╬╬
╬╬╬╬┤ ╙╩╬╬╬╥╥╥╥╥╥╫╬╬╜╜ ││ │ ╬╬╬╬
╬╬╬╬┤ ╙╙╜╜╜╛ ││ │ ╬╬╬╬
╬╬╬╬┤ ││ │ ╓╖╬╬╬╬╬
╬╬╬╬┤ ││ ╬╦╦╬╬╬╬╬╬╬╬╬
╬╬╬╬┤ ││ ╓╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬
╬╬╬╬┤ ╬╬╬╖╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬
╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬
└╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╜
╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜╜

[�] TeamFiltration V0.3.3.7 PUBLIC, created by @Flangvik @TrustedSec
Usage:

--outpath Output path to store database and exfiltrated information (Needed for all modules)

--config Local path to your TeamFiltration.json configuration file, if not provided will load from the current path

--exfil Load the exfiltration (https://www.kitploit.com/searc%20%20%20h/label/Exfiltration) module

--username Override to target a given username that does not exist in the database
--password Override to target a given password that does not exist in the database
--cookie-dump Override to target a given account using it's refresk-cookie-collection

--all Exfiltrate information from ALL SSO resources (Graph, OWA, SharePoint, OneDrive, Teams)
--aad Exfiltrate information from Graph API (domain users and groups)
--teams Exfiltrate information from Teams API (files, chatlogs, attachments, contactlist)
--onedrive Exfiltrate information from OneDrive/SharePoint API (accessible SharePoint files and the users entire OneDrive directory)
--owa Exfiltrate information from the Outlook REST API ( The last 2k emails, both sent and received)
--owa-limit Set the max amount of emails to exfiltrate, default is 2k.

___________________________
@hacking_Attack
@Hacking_Video

--jwt-tokens Exfiltrate JSON formated JTW-tokens for SSO resources (MsGraph,AdGraph, Outlook, SharePoint, OneDrive, Teams)

--spray Load the spraying module

--aad-sso Use SecureWorks recent Azure Active Directory (https://www.kitploit.com/search/label/Azure%20Active%20Directory) password brute-forcing vuln for spraying
--us-cloud When spraying companies attached to US Tenants (https://login.microsoftonline.us/)
--time-window Defines a time windows where spraying should accour, in the military time format
--passwords Path to a list of passwords, common weak-passwords will be generated if not supplied
--seasons-only Password generated for spraying will only be based on seasons
--months-only Password generated for spraying will only be based on months
--common-only Spray with the top 20 most common passwords
--combo Path to a combolist of username:password
--exclude Path to a list of emails to exclude from spraying

--sleep-min Minimum minutes to sleep between each full rotation of spraying default=60
--sleep-max Maximum minutes to sleep between each full rotation of spraying default=100
--delay Delay in seconds between each individual authentication (https://www.kitploit.com/search/label/Authentication) attempt. default=0
--push Get Pushover notifications when valid credentials are found (requires pushover keys in config)
--push-lo cked Get Pushover notifications when an sprayed account gets locked (requires pushover keys in config)
--force Force the spraying to proceed even if there is less the time since the last attempt

--enum Load the enumeration module

--domain Domain to perfom enumeration against, names pulled from statistically-likely-usernames if not provided with --usernames
--usernames Path to a list of usernames to enumerate (emails)
--dehashed Use the dehashed submodule in order to enumerate emails from a basedomain
--validate-msol Validate that the given o365 accounts exists using the public GetCredentialType method (Very RateLimited - Slow 20 e/s)
--validate-teams Validate that the given o365 accounts exists using the Teams API method (Recommended - Super Fast 300 e/s)
--validate-login Validate that the given o365 accounts by attemping to login (Noisy - triggers logins - Fast 100 e/s)

--backdoor Loads the interactive backdoor module

--database Loads the interactive database browser module

--debug Add burp as a proxy on 127.0.0.1:8080

Examples:

--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --spray --sleep-min 120 --sleep-max 200 --push
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --spray --push-locked --months-only --exclude C:\Clients\2021\FooBar\Exclude_Emails.txt
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --spray --passwords C:\Clients\2021\FooBar\Generic\Passwords.txt --time-window 13:00-22:00
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --exfil --all
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --exfil --aad
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --exfil --teams --owa --owa-limit 5000
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --debug --exfil --onedrive
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --enum --validate-teams

___________________________
@hacking_Attack
@Hacking_Video

--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --enum --validate-msol --usernames C:\Clients\2021\FooBar\OSINT\Usernames.txt
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --backdoor
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --database
Credits GitHub - KoenZomers/OneDriveAPI: API in .NET to communicate with OneDrive Personal and OneDrive for Business (https://github.com/KoenZomers/OneDriveAPI) Research into Undocumented Behavior of Azure AD Refresh Tokens (https://github.com/secureworks/family-of-client-ids-research) WS API Gateway management tool for creating on the fly HTTP pass-through proxies for unique IP rotation (https://github.com/ustayready/fireprox) Credits to [Ryan] (https://twitter.com/detectdotdev) for validating and discussing my observations / questions! The entire TrustedSec (https://trustedsec.com/) team for helping me polish this tool!

Download TeamFiltration (https://github.com/Flangvik/TeamFiltration)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Is Your World About to Change?

It may go without saying.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Secured Clone Credit Card, Dump & pins, bank Cashapp Zelle paypal transfers , Western Union…

HOT DEALS!!!!! WhatsApp:+1(202) 503–9187? HOT DEALS!!ICQ:740 976 941
 Email: albertgonzalez0001@gmail.com
 CASH TEAM
 WELCOME TO MY WORLD…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Kerberoasting

https://cdn-images-1.medium.com/max/1153/1*8QlMdQFtC-FmKixECG7zQg.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is Threat Hunting?

https://cdn-images-1.medium.com/max/2600/1*GP-V3CY_Zej6FNdgYHnTNg.jpeg
Identification of Threats

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Over $3B Digital Assets Stolen in 2022

https://cdn-images-1.medium.com/max/2048/1*65_TRFXFvTn7gP9qWKfBcQ.jpeg
If 2022 is a hard year for crypto, it’s paradoxically the best one for hacks, according to Chainalysis. While the market slows and the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video