OTP BYPASS WithOUT RESPONSE MANIPULATION

Hii, all! Scriptkiddie is back with a new hacking story. So a few days ago, I was hunting on one of the website where I am able to bypass…Continue reading on Medium »
Read more...

hacking: security in practice
GlacierCTF

Hey everyone!

We are the CTF-Team of the technical University of Graz (Austria). We are hosting our first CTF this weekend and would love for everyone cybersecurity interested to join.

There will be 1500€ in prizes for the best teams! Everyone is welcome, there will be beginner and advanced challenges in categories like PWN, Crypto, Web or Misc.

See you on Friday :)

https://ctf.glacierctf.com/

submitted by /u/king_yumanji
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
SSRF via DNS Rebinding (CVE-2022–4096)

https://cdn-images-1.medium.com/max/1000/0*zsc_3dnU9kq9sY99.png
Hello everyone myself Basavaraj , Today in this writeup I will explain about my 2nd CVE i.e CVE-2022–4096

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Dark Side of Permits (EIP2612)

https://cdn-images-1.medium.com/max/964/1*_RLKRHgqGQixgOS47Ryyvw.png
Last week Uniswap introduced Permit2 that is a game-changer and the new chapter for all future dapps.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
OTP BYPASS WithOUT RESPONSE MANIPULATION

https://cdn-images-1.medium.com/max/1000/1*oaDyMAFriILcMIgUHIatqA.png
Hii, all! Scriptkiddie is back with a new hacking story. So a few days ago, I was hunting on one of the website where I am able to bypass…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Stegowiper - A Powerful And Flexible Tool To Apply Active Attacks For Disrupting Stegomalware
http://www.kitploit.com/2022/11/stegowiper-powerful-and-flexible-tool.html

___________________________
@hacking_Attack
@Hacking_Video

Over the last 10 years, many threat groups have employed stegomalware or other steganography-based techniques (https://www.kitploit.com/search/label/Techniques) to attack organizations from all sectors and in all regions of the world. Some examples are: APT15/Vixen Panda, APT23/Tropic Trooper, APT29/Cozy Bear, APT32/OceanLotus, APT34/OilRig, APT37/ScarCruft, APT38/Lazarus Group, Duqu Group, Turla, Vawtrack, Powload, Lokibot, Ursnif, IceID, etc.
Our research (see APTs/ (https://github.com/mindcrypt/stegowiper/blob/main/APTs)) shows that most groups are employing very simple techniques (at least from an academic perspective) and known tools to circumvent perimeter defenses, although more advanced groups are also using steganography (https://www.kitploit.com/search/label/Steganography) to hide C&C communication and data exfiltration. We argue that this lack of sophistication is not due to the lack of knowledge in steganography (some APTs, like Turla, have already experimented with advanced algorithms), but simply because organizations are not able to defend themselves, even against the simplest steganography techniques.For this reason, we have created stegoWiper, a tool to blindly disrupt any image-based stegomalware, by attacking the weakest point of all steganography algorithms: their robustness. We have checked that it is capable of disrupting all steganography techniques and tools (Invoke-PSImage, F5, Steghide, openstego, ...) employed nowadays, as well as the most advanced algorithms available in the academic literature, based on matrix encryption, wet-papers, etc. (e.g. Hill, J-Uniward, Hugo). In fact, the more sophisticated a steganography technique is, the more disruption stegoWiper produces.Moreover, our active attack allows us to disrupt any steganography payload from all the images exchanged by an organization by means of a web proxy ICAP (Internet Content Adaptation Protocol) service (see c-icap/ (https://github.com/mindcrypt/stegowiper/blob/main/c-icap)), in real time (https://www.kitploit.com/search/label/Real%20Time) and without having to identify whether the images contain hidden data first.Usage & ParametersstegoWiper v0.1 - Cleans stego information from image files
(png, jpg, gif, bmp, svg)

Usage: ${myself} [-hvc ]

Options:
-h Show this message and exit
-v Verbose mode
-c Add to output image file
Examples - Breaking steganographystegowiper.sh -c "stegoWiped" ursnif.png ursnif_clean.png
The examples/ (https://github.com/mindcrypt/stegowiper/blob/main/examples) directory (https://www.kitploit.com/search/label/Directory) includes several base images that have been employed to hide secret information using different steganography algorithms, as well as the result of cleanign them with stegoWiper.How it works?stegoWiper removes all metadata comments from the input file, and also adds some imperceptible noise to the image (it doesn't matter if it really includes a hidden payload or not). If the image does contain a steganographic payload, this random noise alters it, so if you try to extract it, it will either fail or be corrupted, so steganomalware fails to execute.We have tested several kinds (Uniform, Poisson, Laplacian, Impulsive, Multiplicative) and levels of noise, and the best one in terms of payload disruption and reducing the impact on the input image is the Gaussian one (see tests/ (https://github.com/mindcrypt/stegowiper/blob/main/tests) for a summary of our experiments). It is also worth noting that, since the noise is random and distributed (https://www.kitploit.com/search/label/Distributed) all over the image, attackers cannot know how to avoid it. This is important because other authors have proposed deterministic alterations (such as clearing the least significant bit of all pixels), so the attackers can easily bypass them (e.g. just by using the second least significaby bit).Author & licenseThis project has been developed by Dr. Alfonso

___________________________
@hacking_Attack
@Hacking_Video

Muñoz and Dr. Manuel Urueña The code is released under the GNU General Public License v3.

Download Stegowiper (https://github.com/mindcrypt/stegowiper)

___________________________
@hacking_Attack
@Hacking_Video

SSRF via DNS Rebinding (CVE-2022–4096)

Hello everyone myself Basavaraj , Today in this writeup I will explain about my 2nd CVE i.e CVE-2022–4096Continue reading on Medium »
Read more...

SSRF via DNS Rebinding (CVE-2022–4096)
https://basu-banakar.medium.com/ssrf-via-dns-rebinding-cve-2022-4096-b7bf75928bb2?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello everyone myself Basavaraj , Today in this writeup I will explain about my 2nd CVE i.e CVE-2022–4096Continue reading on Medium » (https://basu-banakar.medium.com/ssrf-via-dns-rebinding-cve-2022-4096-b7bf75928bb2?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Stegowiper - A Powerful And Flexible Tool To Apply Active Attacks For Disrupting Stegomalware

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoK5VhpzP8ET8fV-VvacHmqId9yzrmPVt4BM7T9HluCy8LuUgEzPM8beUyhNEKOzedRf9ifX0ut38gAS_SUtSAn8UsyEqIYcwLwLrI4MKRtiT3NMQnzpE9Ug-lDyhb93p3CSf02CWgfAU-9XAlFs9K4c4O2MrcL8P_3qIxZO0dnU10dFiRObgNGbQ3gg/w640-h336/stegomalware.png Over the last 10 years, many threat groups have employed stegomalware or other steganography-based techniques to attack organizations from all sectors and in all regions of the world. Some examples are: APT15/Vixen Panda, APT23/Tropic Trooper, APT29/Cozy Bear, APT32/OceanLotus, APT34/OilRig, APT37/ScarCruft, APT38/Lazarus Group, Duqu Group, Turla, Vawtrack, Powload, Lokibot, Ursnif, IceID, etc.
Our research (see APTs/) shows that most groups are employing very simple techniques (at least from an academic perspective) and known tools to circumvent perimeter defenses, although more advanced groups are also using steganography to hide C&C communication and data exfiltration. We argue that this lack of sophistication is not due to the lack of knowledge in steganography (some APTs, like Turla, have already experimented with advanced algorithms), but simply because organizations are not able to defend themselves, even against the simplest steganography techniques.

For this reason, we have created stegoWiper, a tool to blindly disrupt any image-based stegomalware, by attacking the weakest point of all steganography algorithms: their robustness. We have checked that it is capable of disrupting all steganography techniques and tools (Invoke-PSImage, F5, Steghide, openstego, ...) employed nowadays, as well as the most advanced algorithms available in the academic literature, based on matrix encryption, wet-papers, etc. (e.g. Hill, J-Uniward, Hugo). In fact, the more sophisticated a steganography technique is, the more disruption stegoWiper produces.

Moreover, our active attack allows us to disrupt any steganography payload from all the images exchanged by an organization by means of a web proxy ICAP (Internet Content Adaptation Protocol) service (see c-icap/), in real time and without having to identify whether the images contain hidden data first. Usage & ParametersstegoWiper v0.1 - Cleans stego information from image files
(png, jpg, gif, bmp, svg)

Usage: ${myself} [-hvc Examples - Breaking steganographystegowiper.sh -c "stegoWiped" ursnif.png ursnif_clean.png The examples/ directory includes several base images that have been employed to hide secret information using different steganography algorithms, as well as the result of cleanign them with stegoWiper. How it works?stegoWiper removes all metadata comments from the input file, and also adds some imperceptible noise to the image (it doesn't matter if it really includes a hidden payload or not). If the image does contain a steganographic payload, this random noise alters it, so if you try to extract it, it will either fail or be corrupted, so steganomalware fails to execute.

We have tested several kinds (Uniform, Poisson, Laplacian, Impulsive, Multiplicative) and levels of noise, and the best one in terms of payload disruption and reducing the impact on the input image is the Gaussian one (see tests/ for a summary of our experiments). It is also worth noting that, since the noise is random and distributed all over the image, attackers cannot know how to avoid it. This is important because other authors have proposed deterministic alterations (such as clearing the least significant bit of all pixels), so the attackers can easily bypass them (e.g. just by using the second least significaby bit). Author & licenseThis project has been developed by Dr. Alfonso Muñoz and Dr. Manuel Urueña The code is released under the GNU General Public License v3. Download Stegowiper

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Slicer : Tool To Automate The Boring Process Of APK Recon

Slicer is a tool to automate the recon process on an APK file. Slicer accepts a path to an extracted APK file and then returns all the activities, receivers, and services which are exported and have nullpermissions and can be externally provoked.

Note: The APK has to be extracted via jadxor apktool. SummaryWhy?I started bug bounty like 3 weeks ago(in June 2020) and I have been trying my best on android apps. But I noticed one thing that in all the apps there were certain things which I have to do before diving in deep. So I just thought it would be nice to automate that process with a simple tool.

Why not drozer?

Well, drozer is a different beast. Even though it does finds out all the accessible components but I was tired of running those commands again and again.

Why not automate using drozer?

I actually wrote a bash script for running certain drozer commands so I won’t have to run them manually but there was still some boring stuff that had to be done. Like Checking the strings.xmlfor various API keys, testing if firebase DB was publically accessible or if those google API keys have setup any cap or anything on their usage and lot of other stuff.

Why not search all the files?

I think that a tool like grep or ripgrep would be much faster to search through all the files. So if there is something specific that you want to search it would be better to use those tools. But if you think that there is something which should be checked in all the android files then feel free to open an issue. Features* Check if the APK has set the android:allowbackupto true* Check if the APK has set the android:debuggableto true.
* Return all the activities, services and broadcast receivers which are exported and have null permission set. This is decided on the basis of two things:
* android:exporte=trueis present in any of the component and have no permission set.
* If exported is not mention then slicer check if any Intent-filtersare defined for that component, if yes that means that component is exported by default(This is the rule given in android documentation.)

* Check the Firebase URL of the APK by testing it for .jsontrick.
* If the firebase URL is myapp.firebaseio.comthen it will check if https://myapp.firebaseio.com/.jsonreturns something or gives permission denied.
* If this thing is open then that can be reported as high severity.

* Check if the google API keys are publically accessible or not.
* This can be reported on some bounty programs but have a low severity.
* But most of the time reporting this kind of thing will bring out the pain of Duplicate.
* Also sometimes the company can just close it as not applicableand will claim that the KEY has a usage cap– r/suspiciouslyspecific https://s.w.org/images/core/emoji/14.0.0/72x72/1f609.png

* Return other API keys that are present in strings.xmland in AndroidManifest.xml* List all the file names present in /res/rawand res/xmldirectory.
* Extracts all the URLs and paths.
* These can be used with tool like dirsearch or ffuf. Installation* Clone this repository
git clone https://github.com/mzfr/slicer
cd slicer
Now you can run it: python3 slicer.py -hUsageIt’s very simple to use. Following options are available:
Extract information from Manifest and strings of an APK

Usage:
slicer [OPTION] [Extracted APK directory]

Options:

-d, --dir path to jadx output directory
-o, --output Name of the output file(not implemented)
I have not implemented the outputflag yet because I think if you can redirect slicer output to a yaml file it will a proper format. Usage Example* Extract information from the APK and display it on the screen.
python3 slicer.py -d path/to/extact/apk -c config.json Click Here To Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
ODAT : Oracle Database Attacking Tool

ODAT (Oracle Database Attacking Tool) is an open source penetration testing tool that tests the security of Oracle Databases remotely.

Usage examples of ODAT:

* You have an Oracle database listening remotely and want to find valid SIDs and credentials in order to connect to the database
* You have a valid Oracle account on a database and want to escalate your privileges to become DBA or SYSDBA
* You have a Oracle account and you want to execute system commands (e.g. reverse shell) in order to move forward on the operating system hosting the database

Tested on Oracle Database 10g, 11g, 12c, 18c and 19c. FeaturesThanks to ODAT, you can:

* search valid SID on a remote Oracle Database listener via:
* a dictionary attack
* a brute force attack
* ALIAS of the listener

* search Oracle accounts using:
* a dictionary attack
* each Oracle user like the password (need an account before to use this attack)

* execute system commands on the database server using:
* DBMS_SCHEDULER
* JAVA
* external tables
* oradbg

* download files stored on the database server using:
* UTL_FILE
* DBMS_XSLPROCESSOR
* external tables
* CTXSYS
* DBMS_LOB

* upload files on the database server using:
* UTL_FILE
* DBMS_XSLPROCESSOR
* DBMS_ADVISOR

* delete files using:
* UTL_FILE

* gain privileged access using these following system privileges combinations (see help for privesc module commands):
* CREATE ANY PROCEDURE
* CREATE PROCEDURE and EXECUTE ANY PROCEDURE
* CREATE ANY TRIGER (and CREATE PROCEDURE)
* ANALYZE ANY (and CREATE PROCEDURE)
* CREATE ANY INDEX (and CREATE PROCEDURE)

* send/reveive HTTP requests from the database server using:
* UTL_HTTP
* HttpUriType

* scan ports of the local server or a remote server using:
* UTL_HTTP
* HttpUriType
* UTL_TCP

* capture a SMB authentication through:
* an index in order trigger a SMB connection

* exploit some CVE:
* the CVE-2012-3137
* pickup the session key and salt for arbitrary users
* attack by dictionary on sessions

* the CVE-2012-????: A user authenticated can modify all tables who can select even if he can’t modify them normally (no ALTER privilege).
* the CVE-2012-1675 (aka TNS poisoning attack)

* search in column names thanks to the search module:
* search a pattern (ex: password) in column names

* unwrap PL/SQL source code (10g/11g and 12c)
* get system privileges and roles granted. It is possible to get privileges and roles of roles granted also
* execute arbitrary SELECT requests (aka minimal sql shell)

This list is not exhaustive. Supported Platforms and dependenciesODAT is compatible with Linux only.

Standalone version exists in order to don’t have need to install dependencies (see https://github.com/quentinhardy/odat/releases/). The ODAT standalone has been generated thanks to pyinstaller.

If you want to have the development version installed on your computer, these following tools and dependencies are needed:

* Langage: Python 3
* Oracle dependancies:
* Instant Oracle basic
* Instant Oracle sdk

* Python libraries:
* cx_Oracle
* passlib
* pycrypto
* python-scapy
* python-libnmap (new from python 5.1)
* colorlog (recommended)
* termcolor (recommended)
* argcomplete (recommended)
* pyinstaller (recommended) Installation (optional, for development version)This part describes how to install instantclient, CX_Oracle and some others python libraries on Ubuntu in order to have the ODAT development version. Don’t forget that an ODAT standalone version exists at https://github.com/quentinhardy/odat/releases/: It is not required to install something for use the standalone version

* Clone the repository to get the ODAT source code:
git clone https://github.com/quentinhardy/odat.git
* Update wiki pages in this repository for getting the ODAT documentation loca[...]

___________________________
@hacking_Attack
@Hacking_Video