Hacking on Medium
Do you know what Information Gathering is?
https://cdn-images-1.medium.com/max/1200/1*SXUKQvbeBpACY9v-9Jk0GQ.jpeg
Definition, Simply put, Information Gathering is a stage for a penetration tester in testing a system or application.
Continue reading on Medium »
Do you know what Information Gathering is?
https://cdn-images-1.medium.com/max/1200/1*SXUKQvbeBpACY9v-9Jk0GQ.jpeg
Definition, Simply put, Information Gathering is a stage for a penetration tester in testing a system or application.
Continue reading on Medium »
Medium
Do you know what Information Gathering is?
Definition, Simply put, Information Gathering is a stage for a penetration tester in testing a system or application. Information Gathering…
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
I have a friend who’s been saying some very fucked up things he plans to do to his family. How could I find a way to contact his mom and let her know? I know his full name, phone number, and address.
There’s somebody I know online who has been saying he plans to hurt his younger sister. I know this person’s full government name, phone number, and address (he lives with his mom). Is there any way for me to use those things to get contact information for his mom online?
submitted by /u/nfunncecnecub
[link] [comments]
I have a friend who’s been saying some very fucked up things he plans to do to his family. How could I find a way to contact his mom and let her know? I know his full name, phone number, and address.
There’s somebody I know online who has been saying he plans to hurt his younger sister. I know this person’s full government name, phone number, and address (he lives with his mom). Is there any way for me to use those things to get contact information for his mom online?
submitted by /u/nfunncecnecub
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Can someone use my IP adress to commit a cybercrime?
Can somebody use my IP adress to commit a crime on internet, to direct/lead the crime to me by my IP adress?
If so, does he/she have to be around my internet router? Or he can do it even if he is miles away from your internet router?
submitted by /u/WokeUpButCantGetUp
[link] [comments]
Can someone use my IP adress to commit a cybercrime?
Can somebody use my IP adress to commit a crime on internet, to direct/lead the crime to me by my IP adress?
If so, does he/she have to be around my internet router? Or he can do it even if he is miles away from your internet router?
submitted by /u/WokeUpButCantGetUp
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Rackspace says customers will start getting access to ransomware-hit data within days
https://external-preview.redd.it/Pe83NUwr3SPS6k5DEd9Qw2TXQlIxGey03kMrT-yOkpM.jpg?width=640&crop=smart&auto=webp&s=e3895b08456fb9af4b6c77dc58fa169e9bb9758d submitted by /u/AmokinKS
[link] [comments]
Rackspace says customers will start getting access to ransomware-hit data within days
https://external-preview.redd.it/Pe83NUwr3SPS6k5DEd9Qw2TXQlIxGey03kMrT-yOkpM.jpg?width=640&crop=smart&auto=webp&s=e3895b08456fb9af4b6c77dc58fa169e9bb9758d submitted by /u/AmokinKS
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
finding someone who won't return my money
To keep this short I paid for a service which I thought was legit. The person then had rescheduled and flaked more than 3 times within 2 weeks time. I gave the person the benefit of the doubt because they were polite but as it's now almost been a month and I had asked and was told I would receive a refund they have not yet returned my money. I'd like to scare this person by finding them. Don't even care for the money at this point I just want them to know I know. If anyone can help with this process of things send me a PM or Comment below thanks reddit.
submitted by /u/TheHeroicNoob
[link] [comments]
finding someone who won't return my money
To keep this short I paid for a service which I thought was legit. The person then had rescheduled and flaked more than 3 times within 2 weeks time. I gave the person the benefit of the doubt because they were polite but as it's now almost been a month and I had asked and was told I would receive a refund they have not yet returned my money. I'd like to scare this person by finding them. Don't even care for the money at this point I just want them to know I know. If anyone can help with this process of things send me a PM or Comment below thanks reddit.
submitted by /u/TheHeroicNoob
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles|Raj Chandel's Blog
Pandora HackTheBox Walkthrough
SummaryPandora is Linux machine and considered as easy box by the hack the box but indeed it is not. With this box we will need to perform other port scan instead of being relied on only TCP ports results. Then we will dig about SNMP protocol and find out a very interesting information for us which will lead us to initial foothold to the target machine. Then we will need to perform Horizontal privilege escalation and local port forward to enumerate service running on target’s internal port. Then we will exploit the admin console which is vulnerable to the SQL injection and upload malicious file to get a reverse shell as a different user. In the post exploitation phase, we will abuse SUID binary using path hijacking technique. <o:pTable of content<o:pInitial Access<o:p
* TCP Port Scan<o:p
* Enumeration<o:p
* UDP Port Scan <o:p
* SNMP Enumeration<o:p
* User Shell as Daniel<o:p Horizontal Privilege Escalation<o:p
* Enumeration<o:p
* Port Forwarding<o:p
* CVE-2021-32099 SQL injection Exploitation<o:p
* File Upload <o:p
* User Flag<o:p Privilege Escalation<o:p
* SSH Key Generate<o:p
* SUID Path hijack<o:p
* Root Flag<o:p
Let’s exploit it step by step.<o:p Initial Access<o:pWe are going to start assessment with the TCP/IP port scanning.<o:p TCP Port Scan<o:pLet’s start with the port scan. We are using nmap to find out which ports are open so we can begin our port and service analyse. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sCand -sVflags. <o:p
Flags features:<o:p -sC: Scans with default NSE scripts<o:p -sV: Attempts to determine the service version<o:p Command used:<o:pnmap -sC -sV 10.129.26.243<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggzEIOKKimE5TO1DEb1dOq1Ced9FfQ8yxFD_3qWtKitCIJhWX73NUNykwZV7qG1H-x_YZDGqQUagpjMCzorKJ21k4vkmh0BpM-cE_7qwPmeJqdTSS6qnmxwZZS_G7u7H8Yo9JH29XA5s1FfDUDZ1OYwTDsn7XrGgKuTEqOMd_S_PcwtYX0p40Yx7uoPg/s16000/1.png From the nmap scan, we have found there were only two ports open, which is port 80and port 22. As usual HTTP serviceis running on port 80 and the SSH service is running on port 22. Http service is used for the webhosting and the SSH service is used for remote connection. SSH version is latest and does not look like vulnerable and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let’s start enumerating port 80. <o:p Enumeration<o:pWe begin enumeration by accessing port 80 over browser. Webpage does not have much interesting things, but we can see domain name is available there which is Panda.htb. Next thing we can analyse what this website made for, and it does. Remember every website is created for some purpose with this mindset we assumed this website is serving games and the network monitoring solutions. <o:p URL: htttp://10.129.26.243https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqOXWdV-BU1atzeRt_jEHloQrnFNDjLuJdrer05e-OY-zJLwxnjpbd6eh5rRxVbDgjc4X2nY6E8cORDvyAy9Byn5GXrVPpmSRCvWYfWsEQjrWdLHx7zE2YZ7jg8Nb4uth35ULKEDAESt0ykZNiU1JxQKNh0ZdhBmJTZtsR5R84ZAL31y40rjRBwcMVug/s16000/2.png UDP Port Scan <o:pGot stuck for some time as we did not get any lead to get foothold into the target system, we decided to perform an UDP port scan. When we do normal nmap scan, it only scans TCP ports but not UDP so many time UDP port may lead us to interesting findings. After the completion of the UDP port scan we found that SNMPport is open on its default port which is port 161. Now we can go for the[...]
Pandora HackTheBox Walkthrough
SummaryPandora is Linux machine and considered as easy box by the hack the box but indeed it is not. With this box we will need to perform other port scan instead of being relied on only TCP ports results. Then we will dig about SNMP protocol and find out a very interesting information for us which will lead us to initial foothold to the target machine. Then we will need to perform Horizontal privilege escalation and local port forward to enumerate service running on target’s internal port. Then we will exploit the admin console which is vulnerable to the SQL injection and upload malicious file to get a reverse shell as a different user. In the post exploitation phase, we will abuse SUID binary using path hijacking technique. <o:pTable of content<o:pInitial Access<o:p
* TCP Port Scan<o:p
* Enumeration<o:p
* UDP Port Scan <o:p
* SNMP Enumeration<o:p
* User Shell as Daniel<o:p Horizontal Privilege Escalation<o:p
* Enumeration<o:p
* Port Forwarding<o:p
* CVE-2021-32099 SQL injection Exploitation<o:p
* File Upload <o:p
* User Flag<o:p Privilege Escalation<o:p
* SSH Key Generate<o:p
* SUID Path hijack<o:p
* Root Flag<o:p
Let’s exploit it step by step.<o:p Initial Access<o:pWe are going to start assessment with the TCP/IP port scanning.<o:p TCP Port Scan<o:pLet’s start with the port scan. We are using nmap to find out which ports are open so we can begin our port and service analyse. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sCand -sVflags. <o:p
Flags features:<o:p -sC: Scans with default NSE scripts<o:p -sV: Attempts to determine the service version<o:p Command used:<o:pnmap -sC -sV 10.129.26.243<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggzEIOKKimE5TO1DEb1dOq1Ced9FfQ8yxFD_3qWtKitCIJhWX73NUNykwZV7qG1H-x_YZDGqQUagpjMCzorKJ21k4vkmh0BpM-cE_7qwPmeJqdTSS6qnmxwZZS_G7u7H8Yo9JH29XA5s1FfDUDZ1OYwTDsn7XrGgKuTEqOMd_S_PcwtYX0p40Yx7uoPg/s16000/1.png From the nmap scan, we have found there were only two ports open, which is port 80and port 22. As usual HTTP serviceis running on port 80 and the SSH service is running on port 22. Http service is used for the webhosting and the SSH service is used for remote connection. SSH version is latest and does not look like vulnerable and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let’s start enumerating port 80. <o:p Enumeration<o:pWe begin enumeration by accessing port 80 over browser. Webpage does not have much interesting things, but we can see domain name is available there which is Panda.htb. Next thing we can analyse what this website made for, and it does. Remember every website is created for some purpose with this mindset we assumed this website is serving games and the network monitoring solutions. <o:p URL: htttp://10.129.26.243https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqOXWdV-BU1atzeRt_jEHloQrnFNDjLuJdrer05e-OY-zJLwxnjpbd6eh5rRxVbDgjc4X2nY6E8cORDvyAy9Byn5GXrVPpmSRCvWYfWsEQjrWdLHx7zE2YZ7jg8Nb4uth35ULKEDAESt0ykZNiU1JxQKNh0ZdhBmJTZtsR5R84ZAL31y40rjRBwcMVug/s16000/2.png UDP Port Scan <o:pGot stuck for some time as we did not get any lead to get foothold into the target system, we decided to perform an UDP port scan. When we do normal nmap scan, it only scans TCP ports but not UDP so many time UDP port may lead us to interesting findings. After the completion of the UDP port scan we found that SNMPport is open on its default port which is port 161. Now we can go for the[...]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Overview eJPT - Matheus Gutierre
https://cdn-images-1.medium.com/max/1209/1*PF5YNZHpY_F_NWd-U6F6LA.png
17th of December 2022 — O dia em que fui aprovado na eLean Junior Prenetration Tester. Essa prova consiste em 20 questões, onde a taxa…
Continue reading on Medium »
Overview eJPT - Matheus Gutierre
https://cdn-images-1.medium.com/max/1209/1*PF5YNZHpY_F_NWd-U6F6LA.png
17th of December 2022 — O dia em que fui aprovado na eLean Junior Prenetration Tester. Essa prova consiste em 20 questões, onde a taxa…
Continue reading on Medium »