Hacking on Medium
TryHackMe — TomGhost WriteUp

https://cdn-images-1.medium.com/max/1592/1*jXmn_plUhlT0YorXyDZ9Fw.png
Introduction:

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Recon Tool: Maigret

Recon Tool: MaigretPost Views: 23 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes MaigretRecon is the most powerful and most important step when it comes to Offensive Security and Digital Forensics. It is a lot of time consuming, however finding the right tools and techniques to conduct them faster, is being smart.

Maigret by soxoj collects a dossier on a person by username only, checking for accounts on a huge number of sites and gathering all the available information from web pages. No API keys are required.

Currently supported by more than 2500 sites (full list), the search is launched against 500 popular sites in descending order of popularity by default. Also supported checking of Tor sites, I2P sites, and domains via DNS resolving.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Main Features* Profile pages parsing, extraction of personal info, links to other profiles, etc.
* Recursive search by new usernames and other ids found
* Search by tags (site categories, countries)
* Censorship and captcha detection
* Requests retries

See full description of Maigret features in the documentation.
Trending: Offensive Security Tool: Mangle
Trending: Offensive Security Tool: WinPwnage InstallationMaigret can be installed using pip, Docker, or simply can be launched from the cloned repo.

Standalone EXE-binaries for Windows are located in Releases section of GitHub repository. Package installingNOTE: Python 3.7 or higher and pip is required, Python 3.8 is recommended. # install from pypipip3 install maigret# usagemaigret usernameCloning a repository# or clone and install manuallygit clone https://github.com/soxoj/maigret && cd maigretpip3 install -r requirements.txt# usage./maigret.py usernameDocker# official imagedocker pull soxoj/maigret# usagedocker run -v /mydir:/app/reports soxoj/maigret:latest username --html# manual builddocker build -t maigret .Usage Examples# make HTML and PDF reportsmaigret user --html --pdf# search on sites marked with tags photo & datingmaigret user --tags photo,dating# search for three usernames on all available sitesmaigret user1 user2 user3 -aUse maigret –help to get full options description. Also options are documented.
Trending: Exploit XSS Injections in a one-line powerful Technique Demo with page parsing and recursive username searchDemohttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/report_alexaimephotography_html_screenshot-1024x818.png

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/report_alexaimephotography_xmind_screenshot-1024x472.png
Clone the repo from here: GitHub Link
Trending: Article: Using VPS for Bug Bounty, comparing VPS providers https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/SecretScanner-300x150.png Recon Tool: SecretScannerNovember 17, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Mangle-300x150.png Offensive Security Tool: MangleNovember 11, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/WinPwnage-300x150.jpg Offensive Security Tool: WinPwnageNovember 4, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/lazypariah-300x150.png Offensive Security Tool: LAZYPARIAHOctober 28, 2022
Reading Time: 4 minutes https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Recon Tool: Maigret first appeared on Black Hat Ethical Hacking.

Black Hat Ethical Hacking
Google Roulette: Developer console trick can trigger XSS in Chromium browsers

Google Roulette: Developer console trick can trigger XSS in Chromium browsersPost Views: 15 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Malicious actors can stage cross-site scripting (XSS) attacks across the subdomains of a website if they can trick users of Chromium browsers into entering a simple JavaScript command in the developer console.This is according to the findings of security researcher Michał Bentkowski who presented his findings in a blog post published yesterday (November 16) titled Google Roulette.

While the bug is hard to exploit and Google has decided not to patch it, it is an interesting case study on the complexities of browser security.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Same-origin policy, site isolationChromium browsers have several safeguards to prevent XSS attacks. The Same-Origin policy feature prevents scripts in one browser tab from accessing cookies and data from another domain.

The Site Isolation feature, on the other hand, gives a separate process to each domain to prevent different websites from accessing each other’s memory space in the browser.

However, it is worth noting that Same-Origin and Site Isolation do not apply to subdomains.

Therefore, two browser tabs that are on, say, https://workspace.google.com and https://developer.google.com will run on the same process and are considered to be of the same origin (google.com). Developer console scriptsThe browser’s protection mechanisms apply not only to on-page scripts but also to scripts running in the browser’s developer console. However, the developer console has access to certain extra functions that are not available to on-page scripts.

One of these functions is debug(), which sets breakpoints on specific events, such as when a function is called.

Two things are interesting about debug(). First, it has an optional argument that allows you to replace the breakpoint functionality with a custom JavaScript code. And second, when you use the developer console to define a debug() event on a webpage, it persists across page refreshes and even carries to other subdomains of the same origin in the same tab.

How does lead to XSS? First, Bentkowski set up a page that contained two malicious functions.

The first one is the XSS payload, which iterates across the subdomains of the current origin and runs a proof-of-concept script (in this case an alert() popup).

The second one is a getter function called magic() that defines a debug() event for the appendChild function (which happens many times during a page load) and reloads the page.

Since debug() needs to be explicitly called from the developer console, the page displays a message that prompts the user to call magic() from the developer console. After that, the XSS cycle is triggered and goes through any number of subdomains defined in the payload function.

A video containing a proof-of-concept can be found here.
Trending: A primer on OS Command Injection Attacks
Trending: Offensive Security Tool: Mangle Impact and fix“I see it more as an interesting technical bug than something exploitable in the real world,” Bentkowski told The Daily Swig. “In my opinion, the user interaction required by this attack makes it not really feasible for attackers.”

There are, however, two scenarios where this bug can become concerning, according to Bentkowski.

First are websites where users can create their own subdomains. In this case, a user can c[...]

___________________________
@hacking_Attack
@Hacking_Video

reate a malicious page and trick visitors into triggering the XSS function on their own subdomain.

A second scenario is when there is an XSS vulnerability on one subdomain and the attacker wants to escalate it to others through the developer console.

Bentkowski reported the bug in 2020 and Google has apparently decided not to fix it. “The issue isn’t currently assigned to anyone so it doesn’t look like we can expect the patch soon,” Bentkowski said.

However, Google agreed to allow Bentkowski to make his findings public, telling him that since the bug is no longer exploitable via Chrome Extensions, it is no longer a security issue.

“I still think that there might be some ways to escalate it that I failed to discover, and maybe you, my dear readers, will have some better ideas,” Bentkowski wrote on his blog.
Trending: Azov Ransomware is a wiper, destroying data 666 bytes at a time Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-8-1-300x150.png Updated RapperBot malware targets game servers in DDoS attacksNovember 17, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-6-1-300x150.png Mastodon users vulnerable to password-stealing attacksNovember 16, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-5-300x150.png Windows Kerberos authentication breaks after November updatesNovember 15, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-4-300x150.png Russian hacktivists use new Somnia ransomwareNovember 14, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Google Roulette: Developer console trick can trigger XSS in Chromium browsers first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

$250 for Email account enumeration using “NameToMail” tool
https://medium.com/@snoopy101/250-for-email-account-enumeration-using-nametomail-tool-cce02a17ade8?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi amazing hackers.Continue reading on Medium » (https://medium.com/@snoopy101/250-for-email-account-enumeration-using-nametomail-tool-cce02a17ade8?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Slicer - Tool To Automate The Boring Process Of APK Recon
http://www.kitploit.com/2022/11/slicer-tool-to-automate-boring-process.html

___________________________
@hacking_Attack
@Hacking_Video

A tool to automate the recon process on an APK file. Slicer accepts a path to an extracted APK file and then returns all the activities, receivers, and services which are exported and have null permissions and can be externally provoked. Note: The APK has to be extracted via jadx or apktool.
Summary Why? I started bug bounty like 3 weeks ago(in June 2020) and I have been trying my best on android apps. But I noticed one thing that in all the apps there were certain things which I have to do before diving in deep. So I just thought it would be nice to automate that process with a simple tool. Why not drozer? Well, drozer is a different beast. Even though it does finds out all the accessible components but I was tired of running those commands again and again. Why not automate using drozer? I actually wrote a bash script for running certain drozer commands so I won't have to run them manually but there was still some boring stuff that had to be done. Like Checking the strings.xml for various API keys, testing if firebase DB was publically accessible or if those google API keys have setup any cap or anything on their usage and lot of other stuff. Why not search all the files? I think that a tool like grep or ripgrep would be much faster to search through all the files. So if there is something specific that you want to search it would be better to use those tools. But if you think that there is something which should be checked in all the android files then feel free to open an issue. Features Check if the APK has set the android:allowbackup to true Check if the APK has set the android:debuggable to true. Return all the activities, services and broadcast receivers which are exported and have null permission set. This is decided on the basis of two things: android:exporte=true is present in any of the component and have no permission set. If exported is not mention then slicer check if any Intent-filters are defined for that component, if yes that means that component is exported by default(This is the rule given in android documentation.) Check the Firebase (https://www.kitploit.com/search/label/Firebase) URL of the APK by testing it for .json trick. If the firebase URL is myapp.firebaseio.com then it will check if https://myapp.firebaseio.com/.json returns something or gives permission denied. If this thing is open then that can be reported as high severity. Check if the google API keys are publically accessible or not. This can be reported on some bounty programs but have a low severity. But most of the time reporting (https://www.kitploit.com/search/label/Reporting) this kind of thing will bring out the pain of Duplicate. Also sometimes the company can just close it as not applicable and will claim that the KEY has a usage cap - r/suspiciouslyspecific  Return other API keys that are present in strings.xml and in AndroidManifest.xml List all the file names present in /res/raw and res/xml directory. Extracts all the URLs and paths. These can be used with tool like dirsearch (https://www.kitploit.com/search/label/dirsearch) or ffuf. Installation Clone this repository git clone https://github.com/mzfr/slicer
cd slicer Now you can run it: python3 slicer.py -h Usage It's very simple to use. Following options are available: Extract information from Manifest and strings of an APK

Usage:
slicer [OPTION] [Extracted APK directory]

Options:

-d, --dir path to jadx output directory
-o, --output Name of the output file(not implemented)
I have not implemented the output flag yet because I think if you can redirect slicer output to a yaml file it will a proper format. Usage Example Extract information from the APK and display it on the screen. python3 slicer.py -d path/to/extact/apk -c config.json Acknowledgements and Credits The extractor (https://www.kitploit.com/search/label/Extractor) module

___________________________
@hacking_Attack
@Hacking_Video

used to extract URLs and paths is taken from apkurlgrep (https://github.com/ndelphit) by @ndelphit Contribution All the features implemented in this are things that I've learned in past few weeks, so if you think that there are various other things which should be checked in an APK then please open an issue for that feature and I'd be happy to implement that :) Support If you'd like you can buy me some coffee:

___________________________
@hacking_Attack
@Hacking_Video

Download Slicer (https://github.com/mzfr/slicer)

___________________________
@hacking_Attack
@Hacking_Video

$250 for Email account enumeration using “NameToMail” tool

Hi amazing hackers.Continue reading on Medium »
Read more...

hacking: security in practice
OMG cable on OpenSuse

Has anyone used a omg cable on opensuse with success or any of their products?

submitted by /u/CollarFullz
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is there a tool/lib/cmd to find accounts created by given email?

Something similar to nexfil where you can browse the Internet by nickname. Nexfil doesn't seem to like emails, it gets timed out randomly.

submitted by /u/emosGambler
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Warning: New RapperBot Campaign Aims to Launch DDoS Attacks at Game Servers

https://cdn-images-1.medium.com/max/602/0*pVZuwfS14_9syDfn.jpg
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video