Hacking on Medium
To defeat cyberattackers you need to get to know them better

https://cdn-images-1.medium.com/max/1200/1*o9Dbp8GiKb4ZKa4GoOuwZg.jpeg
While it may not involve bombs and bullets, you’re at war with cyberattackers. The best way to defeat them is to know how they’ll attack.

Continue reading on Nerd For Tech »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe writeup: BadByte

https://cdn-images-1.medium.com/max/966/0*U3rvar97WQdWSQaD.png
That lassie with the dragon tattoo took a bad byte — but nothing more than she can chew ;-)

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Home Grown Red Team: From Workstation To Domain Controller With Havoc C2 and Microsoft EDR

https://cdn-images-1.medium.com/max/1796/1*MvUlJbYwJ-lN2ss0z7O2LQ.png
Welcome back! In this blog entry we’ll be facing off with Microsoft’s Defender For Endpoint EDR once again to see if we can go from a low…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to get the password of a registered WIFI

https://cdn-images-1.medium.com/max/1118/1*-TwSMiY1g4iI3aiz2nRsXw.png
Sometimes is useful to get the password of a wifi when you have already enter on your device. Is you put the password once, this data is…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

EvilTree - A Remake Of The Classic "Tree" Command With The Additional Feature Of Searching For User Provided Keywords/Regex In Files, Highlighting Those That Contain Matche
http://www.kitploit.com/2022/11/eviltree-remake-of-classic-tree-command.html

___________________________
@hacking_Attack
@Hacking_Video

A standalone python3 remake of the classic "tree" command with the additional feature of searching for user provided keywords/regex in files, highlighting those that contain matches. Created for two main reasons: While searching for secrets (https://www.kitploit.com/search/label/Secrets) in files of nested directory (https://www.kitploit.com/search/label/Directory) structures, being able to visualize which files contain user provided keywords/regex patterns and where those files are located in the hierarchy of folders, provides a significant advantage. "tree" is an amazing tool for analyzing directory structures. It's really handy to have a standalone alternative of the command for post-exploitation (https://www.kitploit.com/search/label/Post-Exploitation) enumeration (https://www.kitploit.com/search/label/Enumeration) as it is not pre-installed on every linux distro and is kind of limited on Windows (compared to the UNIX version).
Usage Examples Example #1: Running a regex that essentially matches strings similar to: password = something against /var/www

___________________________
@hacking_Attack
@Hacking_Video

Example #2: Using comma separated keywords instead of regex:

___________________________
@hacking_Attack
@Hacking_Video

Disclaimer: Only tested on Windows 10 (https://www.kitploit.com/search/label/Windows%2010) Pro. Further Options & Usage Tips Notable features: Regex -x search actually returns a unique list of all matched patterns in a file. Be careful when combining it with -v (--verbose), try to be specific and limit the length of chars to match. You can search keywords/regex in binary files as well by providing option -b. You can use this tool as the classic "tree" command if you do not provide keywords -k and regex -x values. This is useful in case you have gained a limited shell on a machine and want to have "tree" with colored output to look around. There's a list variable filetype_blacklist in eviltree.py which can be used to exclude certain file extensions from content search. By default, it excludes the following: gz, zip, tar, rar, 7z, bz2, xz, deb, img, iso, vmdk, dll, ovf, ova. A quite useful feature is the -i (--interesting-only) option. It instructs eviltree to list only files with matching keywords/regex content, significantly reducing the output length:

___________________________
@hacking_Attack
@Hacking_Video

Useful keywords/regex patterns Regex to look for passwords: -x ".{0,3}passw.{0,3}[=]{1}.{0,18}" Keywords to look for sensitive info: -k passw,db_,admin,account,user,token

Download Eviltree (https://github.com/t3l3machus/eviltree)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Where can I learn how to execute Powershell when a PDF is opened?

I am trying to learn (for my degree thesis) some techniques hackers use. I want to learn how attackers put Powershell bash code in PDFs so it runs when the PDF file opens (on open action launch). I Googled it but I can't find any tutorial or examples on how to do it. Does anyone here know any tutorial by chance?

submitted by /u/Sarciteu
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Email hack

A friend uses a MBP for work. She does admin work from home for a small business whose website is hosted by GoDaddy. Last week it was found that the email had been hacked and 3 rules put in place — one of which was to forward emails and replies addressed to her from her boss. Doing this, the hacker tried to have her checks changed to direct deposit. I don’t know if that was opportunistic or the purpose of the hack. GoDaddy said it was a direct hack. Her boss’ email address now shows up in red with the “not a verified email” warning when she uses it. Would that mean his account was the one hacked and not hers? Is it a GoDaddy issue rather than on the MBP itself? Would her home network be at risk now?

submitted by /u/SandiR2
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
KnowBe4 Launches New Mobile Learner App for Cybersecurity Learning

KnowBe4 empowers end users by introducing security awareness and compliance training on the go at no additional cost.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
NanoLock Brings Built-In Meter-Level Cybersecurity to Renesas Customers

The DLMS-compatible, zero-trust meter-level security is built into the Renesas smart meter solutions, enabling smart meter manufacturers to get to market faster with built-in advanced security solutions.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Bring Your Own Key — A Placebo?

BYOK was envisioned to reduce the risk of using a cloud service provider processing sensitive data, yet there are several deficiencies.