Kali Linux Tutorials
Klyda : Highly Configurable Script For Dictionary/Spray Attacks Against Online Web Applications

The Klyda project has been created to aid in quick credential based attacks against online web applications. Klyda supports the use from simple password sprays, to large multithreaded dictionary attacks.

Klyda is a new project, and I am looking for any contributions. Any help is very appreciated.
Klyda offers simple, easy to remember usage; however, still offers configurability for your needs:

* Mulithreaded tasks
* Combine wordlists for larger scale attacks
* Blacklisting data to narrow down results
* Limit thread speed for sneaky purposes
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgx4w3LfNaHoBXbTKxGd4ZvqnGmqUoA-N4NpI3IXJMkOoP1Vc5Y0bjMO7ih2acgW4nUgH-1ljQKpJs3uj2rkQ48jvOKhfdpJ9eoblCjMuu3MuwuJkrE_2uipmly5GQRljPiyVw6sR_unSlhlQ9uddiXaPf3caGt20MeYPyEQu4yVKTu5g1-ceBc4XAe/s391/Klyda_2_example-705902(1).png Installation & Usage1) Clone the Git repo to your machine, git clone https://github.com/Xeonrx/Klyda2) Cd into the Klyda directory, cd Klyda3) Install the neccessary modules via Pip, pip install requests beautifulsoup4 colorama numpy4) Display the Klyda help prompt for usage, python3 klyda.py -hKlyda has been mainly designed for Linux, but should work on any machine capable of running Python.

What Klyda needs to work are only four simple dependencies: URL to attack, username(s), password(s), and formdata. The URLYou can parse the URL via the --urltag. It should look something like this, --url http://127.0.0.1Remember to never launch an attack on a webpage, that you don’t have proper permission to do so. UsernamesUsernames are the main target to these dictionary attacks. It could be a whole range of usernames, a few in specific, or perhaps just one. That’s all your decision when using the script. You can specify usernames in a few ways…

1) Specify them manually, -u Admin User123 Guest2) Give a file to use, or a few to combine, -U users.txt extra.txt3) Give both a file & manual entry, -U users.txt -u Johnson924PasswordsPasswords are the hard part to these attacks. You don’t know them, hence why dictionary & brute force attacks exists. Like the usernames, you can give from just one password, up to however many you want. You can specify passwords in a few ways…

1) Specify them manually, -p password 1234 letmein2) Give a file to use, or a few to combine, -P passwords.txt extra.txt3) Give both a file & manual entry, -P passwords.txt -p redklyda24FormDataFormData is how you form the request, so the target website can take it in, and process the given information. Usually you would need to specify a: username value, a password value, and sometimes an extra value. You can see the FormData your target uses by reviewing the network tab, of your browsers inspect element. For Klyda, you use the -dtag.

You need to use placeholders to Klyda knows where to inject in the username & password, when fowarding out its requests. It may look something like this… -d username:xuser password:xpass Login:Loginxuseris the placeholder to inject the usernames, & xpassis the placeholder to inject the passwords. Make sure you know these, or Klyda won’t be able to work.

Format the FormData as (key):(value)BlacklistsIn order to Klyda to know if it hit a successful strike or not, you need to give it data to dig through. Klyda takes use of given blacklists from failed login attempts, so it can tell the difference between a failed or complete request. You can blacklist three different types of data…

1) Strings, --bstr "Login failed"2) Status Codes, --bcde 4043) Content Length, --blen 11You can speci[...]

fy as much data for each blacklist as needed. If any of the given data is not found from the response, Klyda gives it a “strike”, saying it was a successful login attempt. Otherwise if data in the blacklists is found, Klyda marks it as an unsuccessful login attempt. Since you give the data for Klyda to evaluate, false positives are non-apparent.

If you don’t give any data to blacklist, then every request will be marked as a strike from Klyda! Rate limiting & ThreadsBy default, Klyda only uses a single thread to run; but, you can specify more, using the -ttag. This can be helpful for speeding up your work.

However, credential attacks can be very loud on a network; hence, are detected easily. A targeted account could simply just receieve a simple lock due to too many login attempts. This creates a DoS attack, but prevents you from gaining the users’s credentials, which is the goal of Klyda.

So to make these attacks a little less loud, you can take use of the --ratetag. This allows you to limit your threads to a certain number of requests per minute.
It will be formatted like this, --rate (# of requests) (minutes)For example, --rate 5 1will only send out 5 requests for each minute. Remember, this is for each thread. If you had 2 threads, this would send 10 requests per minute. ExampleTest Klyda out on the Damn Vulnerable Web App (DVWA), or Mutillidae.

python3 klyda.py –url http://127.0.0.1/dvwa/login.php -u user guest admin -p 1234 password admin -d username:xuser password:xpass Login:Login –bstr “Login failed”

python3 klyda.py –url http://127.0.0.1/mutillidae/index.php?page=login.php -u root -P passwords.txt -d username:xuser password:xpass login-php-submit-button:Login –bstr “Authentication Error” Click Here To Download

FarsightAD - PowerShell Script That Aim To Help Uncovering (Eventual) Persistence Mechanisms Deployed By A Threat Actor Following An Active Directory Domain Compromise
http://www.kitploit.com/2022/12/farsightad-powershell-script-that-aim.html

Non-default (as defined in the Microsoft documentation) ACLs are identified and potentially dangerous ACEs are highlighted. Export-ADHuntingACLPrivilegedObjects Export the ACL configured on the privileged objects in the domain and highlight potentially dangerous access rights. Export-ADHuntingADCSCertificateTemplates Export information and access rights (https://www.kitploit.com/search/label/Access%20Rights) on certificate templates.

The following notable parameters are retrieved: certificate template publish status, certificate usage, if the subject is constructed from user-supplied data, and access control (enrollment / modification). Export-ADHuntingADCSPKSObjects Export information and access rights on sensitive PKS objects (NTAuthCertificates, certificationAuthority, and pKIEnrollmentService). Export-ADHuntingGPOObjectsAndFilesACL Export ACL access rights information on GPO objects and files, highlighting GPOs are applied on privileged users or computers. Export-ADHuntingGPOSettings Export information on various settings configured by GPOs that could be leveraged for persistence (privileges and logon rights, restricted groups membership, scheduled and immediate tasks V1 / V2, machine and user logon / logoff scripts). Export-ADHuntingHiddenObjectsWithDRSRepData Export the objects' attributes that are accessible through replication (with the Directory Replication Service (DRS) protocol) but not by direct query.

Access control are not taken into account for replication operations, which allows to identify access control blocking access to specific objects attribute(s).

Only a limited set of sensitive attributes are assessed. Export-ADHuntingKerberosDelegations Export the Kerberos delegations that are considered dangerous (unconstrained, constrained to a privileged service, or resources-based constrained on a privileged service). Export-ADHuntingPrincipalsAddedViaMachineAccountQuota Export the computers that were added to the domain by non-privileged principals (using the ms-DS-MachineAccountQuota mechanism). Export-ADHuntingPrincipalsCertificates Export parsed accounts' certificate(s) (for accounts having a non empty userCertificate attribute).

The certificates (https://www.kitploit.com/search/label/Certificates) are parsed to retrieve a number of parameters: certificate validity timestamps, certificate purpose, certificate subject and eventual SubjectAltName(s), ... Export-ADHuntingPrincipalsDontRequirePreAuth Export the accounts that do not require Kerberos pre-authentication. Export-ADHuntingPrincipalsOncePrivileged Export the accounts that were once member of privileged groups. Export-ADHuntingPrincipalsPrimaryGroupID Export the accounts that have a non default primaryGroupID attribute, highlighting RID linked to privileged groups. Export-ADHuntingPrincipalsPrivilegedAccounts Export detailed information about members of privileged groups. Export-ADHuntingPrincipalsPrivilegedGroupsMembership Export privileged groups' current and past members, retrieved using replication metadata. Export-ADHuntingPrincipalsSIDHistory Export the accounts that have a non-empty SID History attribute, with resolution of the associated domain and highlighting of privileged SIDs. Export-ADHuntingPrincipalsShadowCredentials Export parsed Key Credentials (https://www.kitploit.com/search/label/Credentials) information (of accounts having a non-empty msDS-KeyCredentialLink attribute). Export-ADHuntingPrincipalsTechnicalPrivileged Export the technical privileged accounts (SERVER_TRUST_ACCOUNT and INTERDOMAIN_TRUST_ACCOUNT). Export-ADHuntingPrincipalsUPNandAltSecID Export the accounts that define a UserPrincipalName or AltSecurityIdentities attribute, highlighting potential anomalies. Export-ADHuntingTrusts Export the trusts of all the domains in the forest.

A number of parameters are retrieved for each trust: transivity, SID filtering, TGT delegation. More information on each cmdlet usage can be retrieved using Get-Help -Full . Demo Fully / partially hidden objects detection

Adding a fully hidden user

Hacking on Medium
FreeBSD: The Ultimate Solution for Frustrated Users

https://cdn-images-1.medium.com/max/728/1*4yvjqnmA4i9WKI6PK8r82w.jpeg
Tired of feeling like your system is out of control? Switch to FreeBSD for stability, security, and performance!

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

Hacking on Medium
TGA Weekly Newsletter [12/14/22]

https://cdn-images-1.medium.com/max/842/1*B0Evnj_FH8GfslhT5984dA.png
The Gray Area’s newsletter from 12/07/22 → 12/14/22, with this week’s must-reads.

Continue reading on The Gray Area »
➖ Sent by @TheFeedReaderBot ➖

Hacking on Medium
Bluebugging Explained and How can we safeguard our devices from it?

https://cdn-images-1.medium.com/max/1181/0*Mkk0I5kC14pw3ciQ.jpg
Bluetooth is an incredibly convenient technology that allows us to connect our devices wirelessly. But, while it’s a great tool, there are…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

Hacking on Medium
Setting up the Arduino RP2040 Connect to use with MicroPython

https://cdn-images-1.medium.com/max/1920/1*3uaFX3X-YXMl0TmImt5qBQ.png
After my initial excitement and subsequent purchase following the release of the RP2040 Connect with support for micropython, that…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

Hacking on Medium
HACK THE BOX — MetaTwo WALKTHROUGH

https://cdn-images-1.medium.com/max/700/1*W9KKMdPvgTt7E6x7tVYGKQ.png
In this write up we’re going to solve a box on hack the box called “MetaTwo”

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

Dark Reading: Attacks/Breaches
Cybersecurity Drives Improvements in Business Goals

Deloitte's Future of Cyber study highlights the fact that cybersecurity is an essential part of business success and should not be limited to just mitigating IT risks.