Hacking Articles Tips Tricks Videos Tutorials

9 views10:50

hacking: security in practice
IATelligence

IATelligence is a Python script that will extract the IAT of a PE file and request GPT to get more information about the API and the ATT&CK matrix related

https://github.com/fr0gger/IATelligence

submitted by /u/boutnaru
[link] [comments]

25 views10:50

Hacking Articles Tips Tricks Videos Tutorials

8 views11:56

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
Klyda : Highly Configurable Script For Dictionary/Spray Attacks Against Online Web Applications

The Klyda project has been created to aid in quick credential based attacks against online web applications. Klyda supports the use from simple password sprays, to large multithreaded dictionary attacks.

Klyda is a new project, and I am looking for any contributions. Any help is very appreciated.
Klyda offers simple, easy to remember usage; however, still offers configurability for your needs:

* Mulithreaded tasks
* Combine wordlists for larger scale attacks
* Blacklisting data to narrow down results
* Limit thread speed for sneaky purposes
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgx4w3LfNaHoBXbTKxGd4ZvqnGmqUoA-N4NpI3IXJMkOoP1Vc5Y0bjMO7ih2acgW4nUgH-1ljQKpJs3uj2rkQ48jvOKhfdpJ9eoblCjMuu3MuwuJkrE_2uipmly5GQRljPiyVw6sR_unSlhlQ9uddiXaPf3caGt20MeYPyEQu4yVKTu5g1-ceBc4XAe/s391/Klyda_2_example-705902(1).png Installation & Usage1) Clone the Git repo to your machine, git clone https://github.com/Xeonrx/Klyda2) Cd into the Klyda directory, cd Klyda3) Install the neccessary modules via Pip, pip install requests beautifulsoup4 colorama numpy4) Display the Klyda help prompt for usage, python3 klyda.py -hKlyda has been mainly designed for Linux, but should work on any machine capable of running Python.

What Klyda needs to work are only four simple dependencies: URL to attack, username(s), password(s), and formdata. The URLYou can parse the URL via the --urltag. It should look something like this, --url http://127.0.0.1Remember to never launch an attack on a webpage, that you don’t have proper permission to do so. UsernamesUsernames are the main target to these dictionary attacks. It could be a whole range of usernames, a few in specific, or perhaps just one. That’s all your decision when using the script. You can specify usernames in a few ways…

1) Specify them manually, -u Admin User123 Guest2) Give a file to use, or a few to combine, -U users.txt extra.txt3) Give both a file & manual entry, -U users.txt -u Johnson924PasswordsPasswords are the hard part to these attacks. You don’t know them, hence why dictionary & brute force attacks exists. Like the usernames, you can give from just one password, up to however many you want. You can specify passwords in a few ways…

1) Specify them manually, -p password 1234 letmein2) Give a file to use, or a few to combine, -P passwords.txt extra.txt3) Give both a file & manual entry, -P passwords.txt -p redklyda24FormDataFormData is how you form the request, so the target website can take it in, and process the given information. Usually you would need to specify a: username value, a password value, and sometimes an extra value. You can see the FormData your target uses by reviewing the network tab, of your browsers inspect element. For Klyda, you use the -dtag.

You need to use placeholders to Klyda knows where to inject in the username & password, when fowarding out its requests. It may look something like this… -d username:xuser password:xpass Login:Loginxuseris the placeholder to inject the usernames, & xpassis the placeholder to inject the passwords. Make sure you know these, or Klyda won’t be able to work.

Format the FormData as (key):(value)BlacklistsIn order to Klyda to know if it hit a successful strike or not, you need to give it data to dig through. Klyda takes use of given blacklists from failed login attempts, so it can tell the difference between a failed or complete request. You can blacklist three different types of data…

1) Strings, --bstr "Login failed"2) Status Codes, --bcde 4043) Content Length, --blen 11You can speci[...]

8 views11:56

Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials Klyda : Highly Configurable Script For Dictionary/Spray Attacks Against Online Web Applications The Klyda project has been created to aid in quick credential based attacks against online web applications. Klyda supports the use from simple…

fy as much data for each blacklist as needed. If any of the given data is not found from the response, Klyda gives it a “strike”, saying it was a successful login attempt. Otherwise if data in the blacklists is found, Klyda marks it as an unsuccessful login attempt. Since you give the data for Klyda to evaluate, false positives are non-apparent.

If you don’t give any data to blacklist, then every request will be marked as a strike from Klyda! Rate limiting & ThreadsBy default, Klyda only uses a single thread to run; but, you can specify more, using the -ttag. This can be helpful for speeding up your work.

However, credential attacks can be very loud on a network; hence, are detected easily. A targeted account could simply just receieve a simple lock due to too many login attempts. This creates a DoS attack, but prevents you from gaining the users’s credentials, which is the goal of Klyda.

So to make these attacks a little less loud, you can take use of the --ratetag. This allows you to limit your threads to a certain number of requests per minute.
It will be formatted like this, --rate (# of requests) (minutes)For example, --rate 5 1will only send out 5 requests for each minute. Remember, this is for each thread. If you had 2 threads, this would send 10 requests per minute. ExampleTest Klyda out on the Damn Vulnerable Web App (DVWA), or Mutillidae.

python3 klyda.py –url http://127.0.0.1/dvwa/login.php -u user guest admin -p 1234 password admin -d username:xuser password:xpass Login:Login –bstr “Login failed”

python3 klyda.py –url http://127.0.0.1/mutillidae/index.php?page=login.php -u root -P passwords.txt -d username:xuser password:xpass login-php-submit-button:Login –bstr “Authentication Error” Click Here To Download

10 views11:56

Hacking Articles Tips Tricks Videos Tutorials

FarsightAD - PowerShell Script That Aim To Help Uncovering (Eventual) Persistence Mechanisms Deployed By A Threat Actor Following An Active Directory Domain Compromise
http://www.kitploit.com/2022/12/farsightad-powershell-script-that-aim.html

8 views12:55

Hacking Articles Tips Tricks Videos Tutorials

8 views12:55

Hacking Articles Tips Tricks Videos Tutorials

Non-default (as defined in the Microsoft documentation) ACLs are identified and potentially dangerous ACEs are highlighted. Export-ADHuntingACLPrivilegedObjects Export the ACL configured on the privileged objects in the domain and highlight potentially dangerous access rights. Export-ADHuntingADCSCertificateTemplates Export information and access rights (https://www.kitploit.com/search/label/Access%20Rights) on certificate templates.

The following notable parameters are retrieved: certificate template publish status, certificate usage, if the subject is constructed from user-supplied data, and access control (enrollment / modification). Export-ADHuntingADCSPKSObjects Export information and access rights on sensitive PKS objects (NTAuthCertificates, certificationAuthority, and pKIEnrollmentService). Export-ADHuntingGPOObjectsAndFilesACL Export ACL access rights information on GPO objects and files, highlighting GPOs are applied on privileged users or computers. Export-ADHuntingGPOSettings Export information on various settings configured by GPOs that could be leveraged for persistence (privileges and logon rights, restricted groups membership, scheduled and immediate tasks V1 / V2, machine and user logon / logoff scripts). Export-ADHuntingHiddenObjectsWithDRSRepData Export the objects' attributes that are accessible through replication (with the Directory Replication Service (DRS) protocol) but not by direct query.

Access control are not taken into account for replication operations, which allows to identify access control blocking access to specific objects attribute(s).

Only a limited set of sensitive attributes are assessed. Export-ADHuntingKerberosDelegations Export the Kerberos delegations that are considered dangerous (unconstrained, constrained to a privileged service, or resources-based constrained on a privileged service). Export-ADHuntingPrincipalsAddedViaMachineAccountQuota Export the computers that were added to the domain by non-privileged principals (using the ms-DS-MachineAccountQuota mechanism). Export-ADHuntingPrincipalsCertificates Export parsed accounts' certificate(s) (for accounts having a non empty userCertificate attribute).

The certificates (https://www.kitploit.com/search/label/Certificates) are parsed to retrieve a number of parameters: certificate validity timestamps, certificate purpose, certificate subject and eventual SubjectAltName(s), ... Export-ADHuntingPrincipalsDontRequirePreAuth Export the accounts that do not require Kerberos pre-authentication. Export-ADHuntingPrincipalsOncePrivileged Export the accounts that were once member of privileged groups. Export-ADHuntingPrincipalsPrimaryGroupID Export the accounts that have a non default primaryGroupID attribute, highlighting RID linked to privileged groups. Export-ADHuntingPrincipalsPrivilegedAccounts Export detailed information about members of privileged groups. Export-ADHuntingPrincipalsPrivilegedGroupsMembership Export privileged groups' current and past members, retrieved using replication metadata. Export-ADHuntingPrincipalsSIDHistory Export the accounts that have a non-empty SID History attribute, with resolution of the associated domain and highlighting of privileged SIDs. Export-ADHuntingPrincipalsShadowCredentials Export parsed Key Credentials (https://www.kitploit.com/search/label/Credentials) information (of accounts having a non-empty msDS-KeyCredentialLink attribute). Export-ADHuntingPrincipalsTechnicalPrivileged Export the technical privileged accounts (SERVER_TRUST_ACCOUNT and INTERDOMAIN_TRUST_ACCOUNT). Export-ADHuntingPrincipalsUPNandAltSecID Export the accounts that define a UserPrincipalName or AltSecurityIdentities attribute, highlighting potential anomalies. Export-ADHuntingTrusts Export the trusts of all the domains in the forest.

10 views12:55

Hacking Articles Tips Tricks Videos Tutorials

A number of parameters are retrieved for each trust: transivity, SID filtering, TGT delegation. More information on each cmdlet usage can be retrieved using Get-Help -Full . Demo Fully / partially hidden objects detection

9 views12:55

Hacking Articles Tips Tricks Videos Tutorials

8 views12:55

Hacking Articles Tips Tricks Videos Tutorials

Adding a fully hidden user

8 views12:55

Hacking Articles Tips Tricks Videos Tutorials

8 views13:20

Hacking Articles Tips Tricks Videos Tutorials

6 views13:20

Hacking Articles Tips Tricks Videos Tutorials

Photo