Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Boiler CTF TryHackMe Walkthrough
Today it is time to solve another challenge called “Boiler CTF”. It is available at TryHackMe for penetration testing practice. This challenge is of medium difficulty if you have the right basic knowledge and are attentive to little details that are required in the enumeration process. The credit for making
The post Boiler CTF TryHackMe Walkthrough appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
Boiler CTF TryHackMe Walkthrough
Today it is time to solve another challenge called “Boiler CTF”. It is available at TryHackMe for penetration testing practice. This challenge is of medium difficulty if you have the right basic knowledge and are attentive to little details that are required in the enumeration process. The credit for making
The post Boiler CTF TryHackMe Walkthrough appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles
Boiler CTF TryHackMe Walkthrough - Hacking Articles
Today it is time to solve another challenge called “Boiler CTF”. It is available at TryHackMe for penetration testing practice. This challenge is of medium
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Storm-Breaker : Tool Social Engineering (Access Webcam, Microphone, OS Password Grabber And Location Finder) With Ngrok
Features Get Device Information Without Any Permissions Access Location [SMARTPHONES] Os Password Grabber [WIN-10] Access Webcam Access Microphone Operating Systems Tested Kali Linux 2020 Installation On Kali Linux $ git clone https://github.com/ultrasecurity/Storm-Breaker$ cd Storm-Breaker$ sudo bash linux-installer.sh$ python3 -m pip install -r requirments.txt$ sudo python3 Storm-Breaker.py
The post Storm-Breaker : Tool Social Engineering (Access Webcam, Microphone, OS Password Grabber And Location Finder) With Ngrok appeared first on Kali Linux Tutorials.
___________________________
@hacking_Attack
@Hacking_Video
Storm-Breaker : Tool Social Engineering (Access Webcam, Microphone, OS Password Grabber And Location Finder) With Ngrok
Features Get Device Information Without Any Permissions Access Location [SMARTPHONES] Os Password Grabber [WIN-10] Access Webcam Access Microphone Operating Systems Tested Kali Linux 2020 Installation On Kali Linux $ git clone https://github.com/ultrasecurity/Storm-Breaker$ cd Storm-Breaker$ sudo bash linux-installer.sh$ python3 -m pip install -r requirments.txt$ sudo python3 Storm-Breaker.py
The post Storm-Breaker : Tool Social Engineering (Access Webcam, Microphone, OS Password Grabber And Location Finder) With Ngrok appeared first on Kali Linux Tutorials.
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
Storm-Breaker : Tool Social Engineering With Ngrok
Storm breaker is a tool for Social Engineering (Access Webcam, Microphone, OS Password Grabber And Location Finder) With Ngrok.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles|Raj Chandel's Blog
Boiler CTF TryHackMe Walkthrough
Today it is time to solve another challenge called “Boiler CTF”. It is available at TryHackMe for penetration testing practice. This challenge is of medium difficulty if you have the right basic knowledge and are attentive to little details that are required in the enumeration process. The credit for making this machine goes to MrSeth6797. The breakdown of the Machine with the redacted flags is as follow: Level: Medium<o:pPenetration Testing Methodology<o:p· Network Scanning<o:po Nmap Scan<o:p
· Enumeration<o:po Enumerating FTP<o:p
o Decoding ROT13<o:p
o Enumerating robots.txt<o:p
o Directory Bruteforce using dirb<o:p
o Enumerating Joomla CMS<o:p
o Enumerating Sar2HTML<o:p
· Exploitation<o:po Exploiting Remote Code Execution <o:p
o Enumerating SSH Credentials for basterd<o:p
o Enumerating Credentials for Stoner<o:p
o Reading User Flag<o:p
· Privilege Escalation<o:po Enumerating SUID Permissions<o:p
o Exploiting SUID permissions on find<o:p
o Getting Root Shell<o:p
o Reading Root Flag<o:p Walkthrough<o:pThere are two flags in this machine to discover. After Booting up the target machine from the TryHackMe: Boiler CTF Page, An IP will be assigned to the machine and will be visible on that page as well.<o:p IP Address: 10.10.140.202<o:pApart from the two flags, four questions are required as well to complete this machine. You can find the questions as the answers are discovered below.<o:p Network Scanning<o:pWe will start a nmap scan with the -sC for Default Scripts and -SV for Scanning Versions, We are also scanning for all ports.<o:p nmap -sC -sV -Pn -p- 10.10.140.202<o:phttps://1.bp.blogspot.com/-L7A9PZH0z8o/YJwN7Cm9qQI/AAAAAAAAv98/6hKpyTSwdV8hg61YX47AhT7ZIBDdfHnhgCLcBGAsYHQ/s16000/1.png Nmap was able to identify 4 services running on the target machine. It included the FTP (21), HTTP (80, 10000), and SSH on 65007. Q.2. What is on the highest port?<o:pssh<o:pQ.3. What's running on port 10000?<o:pWebmin<o:pWe don’t have the credentials for SSH so we cannot enumerate them. Since Anonymous Login is enabled on FTP, Let’s being the enumeration from FTP.<o:p Enumeration<o:pStarting with the FTP service, we knew that we can log in as Anonymous from the Nmap scan we just performed. After logging in, we list the contents and find a hidden text file by the name of .info.txt. <o:p Q.1. File extension after anon login<o:ptxt<o:pTo take a closer look at it, it was transferred to the Local Kali Linux Machine using the get command. Reading the contents using the cat command, it was found that it contains some text that seems to be encoded. It read “Whfg jnagrq gb frr vs lbh svaq vg. Yby. Erzrzore: Rahzrengvba vf gur xrl!”. From the looks of it, it resembles the ROT13. <o:p ftp 10.10.140.202<o:pAnonymous<o:pls -la<o:pget .info.txt<o:pbye<o:phttps://1.bp.blogspot.com/-lSfVcF0ORAg/YJwOKOkkpII/AAAAAAAAv-A/88SlI0pGt5kJXvnAiqK4BTyPLSW6NMNCgCLcBGAsYHQ/s16000/2.png To confirm the suspicion, the text was copied into a ROT13 to Plain text converter. Upon conversion, the text read “Just wanted to see if you find it. Lol. Remember: Enumeration is the key!” This text is more like a rabbit hole. <o:p https://1.bp.blogspot.com/-dz_CsK8Q2rY/YJwOOYd89VI/AAAAAAAAv-I/aRPqCEEqZKwkUWi_5ChyMB34jgD8E2YrgCLcBGAsYHQ/s16000/3.png Moving back to the Nmap scan, it can be observed that the HTTP service on port 80 has a robots.txt file. Upon viewing the robots.txt file on Web Browser, it was observed that there are a lot of entries. All the entries lead to nowhere[...]
Boiler CTF TryHackMe Walkthrough
Today it is time to solve another challenge called “Boiler CTF”. It is available at TryHackMe for penetration testing practice. This challenge is of medium difficulty if you have the right basic knowledge and are attentive to little details that are required in the enumeration process. The credit for making this machine goes to MrSeth6797. The breakdown of the Machine with the redacted flags is as follow: Level: Medium<o:pPenetration Testing Methodology<o:p· Network Scanning<o:po Nmap Scan<o:p
· Enumeration<o:po Enumerating FTP<o:p
o Decoding ROT13<o:p
o Enumerating robots.txt<o:p
o Directory Bruteforce using dirb<o:p
o Enumerating Joomla CMS<o:p
o Enumerating Sar2HTML<o:p
· Exploitation<o:po Exploiting Remote Code Execution <o:p
o Enumerating SSH Credentials for basterd<o:p
o Enumerating Credentials for Stoner<o:p
o Reading User Flag<o:p
· Privilege Escalation<o:po Enumerating SUID Permissions<o:p
o Exploiting SUID permissions on find<o:p
o Getting Root Shell<o:p
o Reading Root Flag<o:p Walkthrough<o:pThere are two flags in this machine to discover. After Booting up the target machine from the TryHackMe: Boiler CTF Page, An IP will be assigned to the machine and will be visible on that page as well.<o:p IP Address: 10.10.140.202<o:pApart from the two flags, four questions are required as well to complete this machine. You can find the questions as the answers are discovered below.<o:p Network Scanning<o:pWe will start a nmap scan with the -sC for Default Scripts and -SV for Scanning Versions, We are also scanning for all ports.<o:p nmap -sC -sV -Pn -p- 10.10.140.202<o:phttps://1.bp.blogspot.com/-L7A9PZH0z8o/YJwN7Cm9qQI/AAAAAAAAv98/6hKpyTSwdV8hg61YX47AhT7ZIBDdfHnhgCLcBGAsYHQ/s16000/1.png Nmap was able to identify 4 services running on the target machine. It included the FTP (21), HTTP (80, 10000), and SSH on 65007. Q.2. What is on the highest port?<o:pssh<o:pQ.3. What's running on port 10000?<o:pWebmin<o:pWe don’t have the credentials for SSH so we cannot enumerate them. Since Anonymous Login is enabled on FTP, Let’s being the enumeration from FTP.<o:p Enumeration<o:pStarting with the FTP service, we knew that we can log in as Anonymous from the Nmap scan we just performed. After logging in, we list the contents and find a hidden text file by the name of .info.txt. <o:p Q.1. File extension after anon login<o:ptxt<o:pTo take a closer look at it, it was transferred to the Local Kali Linux Machine using the get command. Reading the contents using the cat command, it was found that it contains some text that seems to be encoded. It read “Whfg jnagrq gb frr vs lbh svaq vg. Yby. Erzrzore: Rahzrengvba vf gur xrl!”. From the looks of it, it resembles the ROT13. <o:p ftp 10.10.140.202<o:pAnonymous<o:pls -la<o:pget .info.txt<o:pbye<o:phttps://1.bp.blogspot.com/-lSfVcF0ORAg/YJwOKOkkpII/AAAAAAAAv-A/88SlI0pGt5kJXvnAiqK4BTyPLSW6NMNCgCLcBGAsYHQ/s16000/2.png To confirm the suspicion, the text was copied into a ROT13 to Plain text converter. Upon conversion, the text read “Just wanted to see if you find it. Lol. Remember: Enumeration is the key!” This text is more like a rabbit hole. <o:p https://1.bp.blogspot.com/-dz_CsK8Q2rY/YJwOOYd89VI/AAAAAAAAv-I/aRPqCEEqZKwkUWi_5ChyMB34jgD8E2YrgCLcBGAsYHQ/s16000/3.png Moving back to the Nmap scan, it can be observed that the HTTP service on port 80 has a robots.txt file. Upon viewing the robots.txt file on Web Browser, it was observed that there are a lot of entries. All the entries lead to nowhere[...]
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles|Raj Chandel's Blog Boiler CTF TryHackMe Walkthrough Today it is time to solve another challenge called “Boiler CTF”. It is available at TryHackMe for penetration testing practice. This challenge is of medium difficulty if you have the right…
and The ASCII text at the bottom when converted reads “dCode ASCII”. So, this is another one of those rabbit holes.<o:p http://10.10.140.202/robots.txt<o:phttps://1.bp.blogspot.com/-uoEFwtygAf8/YJwOR9WqWsI/AAAAAAAAv-M/No_f1FHEPSIBfoVcnbDbmuf1Ae7BJLCvwCLcBGAsYHQ/s16000/4.png After traveling through the multiple rabbit holes, the enumeration took a turn when the directory brute force on HTTP service on port 80 detected some Joomla Files. <o:p dirb http://10.10.140.202<o:phttps://1.bp.blogspot.com/-HuIjYSUXo_A/YJwOc6urCSI/AAAAAAAAv-U/F3FVJSk-GX4E7S18mlqUkehi9ZaNbGneQCLcBGAsYHQ/s16000/5.png To check if the Joomla CMS is indeed running on the target server, it was opened in the web browser. A site was loaded as shown in the screenshot shown below.<o:p Q.5. What's CMS can you access?<o:pJoomla<o:pQ.6. Keep enumerating, you'll know when you find it.<o:pNo answer needed<o:phttp://10.10.140.202/joomla/<o:phttps://1.bp.blogspot.com/-ACJB3SA5OUM/YJwOimTgrGI/AAAAAAAAv-g/Yo8Abjuj15EJoY-o1sLAuY22MAE82fEcACLcBGAsYHQ/s16000/6.1.png In the directory bruteforce, among other directories, there was a page by the name of /_files/. Opening it in a Web Browser it was found to be some encoded text. It seemed to be Base64 on first look. It reads “VjJodmNITnBaU0JrWVdsemVRbz0K”.<o:p http://10.10.140.202/joomla/_files/<o:phttps://1.bp.blogspot.com/-hb6XVnqGrAw/YJwOmrbpuLI/AAAAAAAAv-k/0PU-VNwENcI9nLudda6Dn7BySak7lv04gCLcBGAsYHQ/s16000/6.png Copying the text and then using the echo command with the base64 -d command, it was found that it was possible to double encoded Base64. Decoding again gives the text “Whoopsie daisy”. It was another rabbit hole.<o:p echo "VjJodmNITnBaU0JrWVdsemVRbz0K" | base64 -d<o:pecho "V2hvcHNpZSBkYWlzeQo=" | base64 -d<o:phttps://1.bp.blogspot.com/-viF6MQY-sQk/YJwOq4hMv3I/AAAAAAAAv-o/INJSgnVVQr8VqIoNiPVi3Wej13ZvCLPNgCLcBGAsYHQ/s16000/7.png Another URL that was interesting from the Directory Brute force was /_test/. Opening it in a Web Browser, it seemed to be the deployment of Sar2HTML. It is a report generator. <o:p http://10.10.140.202/joomla/_test/<o:phttps://1.bp.blogspot.com/-MrxP7-ZrTNQ/YJwO4lHCbhI/AAAAAAAAv-w/r1vH82TtD4Idhc4F7JmOF1rEK0jnRV_9QCLcBGAsYHQ/s16000/8.png Searching for exploit on the Web, there seemed to be a Remote Code Execution vulnerabilityin the Sar2HTML. <o:p
<o:p https://1.bp.blogspot.com/-nTPVdm9XrU0/YJwPBwVm4aI/AAAAAAAAv-0/Gq3EaR5ULPEgwDlSyzljRs-3rKh7i6YZgCLcBGAsYHQ/s16000/9.png Reading the exploit, it seemed that the plot parameter is injectable and when the command is entered, the output of the command can be viewed in the Select Host Drop Down option. <o:p https://1.bp.blogspot.com/-BvbO2WsVUes/YJwPGq_khzI/AAAAAAAAv-4/n5l9RyNXEQcOjPTtUmS5h6HuM6R34UbhwCLcBGAsYHQ/s16000/10.png Exploitation<o:pAfter tinkering with the URL and plot parameter, it was possible to exploit the Remote Code Execution. The id command reverted the www-data user response in the Select Host drop-down menu as depicted in the image below.<o:p http://10.10.140.202/joomla/_test/index.php?plot=;id<o:phttps://1.bp.blogspot.com/-Vg1ag3AzvwU/YJwPR0bSm7I/AAAAAAAAv_A/wkfTrEBmyqk06zM3gk2NFq-mBXjOmuRLACLcBGAsYHQ/s16000/11.png The next command to run was the ls command to see the files that must be located in the directory that was accessible from this vulnerability. A log.txt file was found among other files in the directory listing output. <o:p Q.7. The interesting file name in the folder?<o:plog.txt<o:phttp://10.10.140.202/joomla/_test/index.php?plot=;ls<o:p<o:phttps://1.bp.blogspot.com/-hZtOvcYcAOI/YJwPgm0_flI/AAAAAAAAv_M/L_VrnhcZD3gLL9L-ll04xCEbx2kGaST8gCLcBGAsYHQ/s16000/12.png To read the contents of this file, the cat command must be used from the URL itself. The contents of the log file include credentials for the basterd use[...]
<o:p https://1.bp.blogspot.com/-nTPVdm9XrU0/YJwPBwVm4aI/AAAAAAAAv-0/Gq3EaR5ULPEgwDlSyzljRs-3rKh7i6YZgCLcBGAsYHQ/s16000/9.png Reading the exploit, it seemed that the plot parameter is injectable and when the command is entered, the output of the command can be viewed in the Select Host Drop Down option. <o:p https://1.bp.blogspot.com/-BvbO2WsVUes/YJwPGq_khzI/AAAAAAAAv-4/n5l9RyNXEQcOjPTtUmS5h6HuM6R34UbhwCLcBGAsYHQ/s16000/10.png Exploitation<o:pAfter tinkering with the URL and plot parameter, it was possible to exploit the Remote Code Execution. The id command reverted the www-data user response in the Select Host drop-down menu as depicted in the image below.<o:p http://10.10.140.202/joomla/_test/index.php?plot=;id<o:phttps://1.bp.blogspot.com/-Vg1ag3AzvwU/YJwPR0bSm7I/AAAAAAAAv_A/wkfTrEBmyqk06zM3gk2NFq-mBXjOmuRLACLcBGAsYHQ/s16000/11.png The next command to run was the ls command to see the files that must be located in the directory that was accessible from this vulnerability. A log.txt file was found among other files in the directory listing output. <o:p Q.7. The interesting file name in the folder?<o:plog.txt<o:phttp://10.10.140.202/joomla/_test/index.php?plot=;ls<o:p<o:phttps://1.bp.blogspot.com/-hZtOvcYcAOI/YJwPgm0_flI/AAAAAAAAv_M/L_VrnhcZD3gLL9L-ll04xCEbx2kGaST8gCLcBGAsYHQ/s16000/12.png To read the contents of this file, the cat command must be used from the URL itself. The contents of the log file include credentials for the basterd use[...]
Hacking Articles Tips Tricks Videos Tutorials
and The ASCII text at the bottom when converted reads “dCode ASCII”. So, this is another one of those rabbit holes.<o:p http://10.10.140.202/robots.txt<o:phttps://1.bp.blogspot.com/-uoEFwtygAf8/YJwOR9WqWsI/AAAAAAAAv-M/No_f1FHEPSIBfoVcnbDbmuf1Ae7BJLCvwCLcB…
r. <o:p http://10.10.140.202/joomla/_test/index.php?plot=;cat log.txt<o:pbasterd<o:psuperduperp@$$<o:phttps://1.bp.blogspot.com/-pq80FA24gQw/YJwPyEYwy9I/AAAAAAAAv_Y/ErD0RHU53MAv9D5loRaMR76xs5acIKCTwCLcBGAsYHQ/s16000/13.png Using the credentials that were located inside the log.txt file, it was possible to log in as basterd user via SSH. The SSH port was detected at 55007 by the nmap in the beginning. After connecting to the ssh, the contents of the directory were listed using the ls command. It located a shell file by the name of the backup.sh.<o:p ssh basterd@10.10.140.202 -p 55007<o:psuperduperp@$$<o:pls<o:phttps://1.bp.blogspot.com/-YmW1tZTn9Lw/YJwP5sf9ltI/AAAAAAAAv_c/bSi3RUfj0hI5DkPF6KBD43sL8yvUpkmqACLcBGAsYHQ/s16000/14.png Reading the shell file reveals another set of credentials that can be used. It was for the user stoner. <o:p Q.8. Where were the other users pass stored(no extension, just the name)?<o:pbackup<o:pcat backup.sh <o:phttps://1.bp.blogspot.com/-qoLHKQUV4R4/YJwP9YNSo4I/AAAAAAAAv_g/rxrj6Ea3uscU3bW_G_ehD0rcHPyhHv6-QCLcBGAsYHQ/s16000/15.png Using su to log in as a stoner user. After logging in as the stoner user, listing the contents of the home directory of the stoner user reveals the user flag by the name of .secret. <o:p Q.9. user.txt<o:p#################################<o:p
Another thing of interest in the home directory was the .nano directory. Traversing in the directory it was found to be empty. <o:p su stoner<o:psuperduperp@$$no1knows<o:pls -la<o:pcat .secret<o:pcd .nano<o:pls -la<o:phttps://1.bp.blogspot.com/-XWOF3U4mPbk/YJwQFIWgQiI/AAAAAAAAv_o/kyywL0ExPlwYgDKjJ4Lg1K_f7hzggsKxgCLcBGAsYHQ/s16000/16.png Privilege Escalation<o:pNow that the user-level access is gained, it was time to enumerate ways to elevate this privilege to root. One of the enumeration tasks is to check for the SUID permissions. It was revealed that the find command has the SUID permissions.<o:p Q.10. What did you exploit to get the privileged user?<o:pfind<o:p find / -perm -u=s 2>/dev/null<o:phttps://1.bp.blogspot.com/-x3u4UGc90f4/YJwQIvabkYI/AAAAAAAAv_s/18jL7PQa5SgwTV_5flseMxRiwPxLuBBIQCLcBGAsYHQ/s16000/17.png A brief search onGTFOBINreveals the exact command that should be run on the terminal with the proper location of the find to get the root level access on the target machine. The command was copied from the website.<o:p https://1.bp.blogspot.com/-snDYszpJTto/YJwQNtC0tdI/AAAAAAAAv_0/DwoQeDypG-gfkMd_txHtuKl64_wt2KBJwCLcBGAsYHQ/s16000/18.png From the enumeration for SUID permission, it was confirmed that the find was located in /usr/bin/ so using it with the command copied from GTFOBIN when executed on the stoner user shell gave the root level access on the target machine. At last, the root flag was read to conclude the machine.<o:p Q.11. root.txt<o:pIt wasn't that hard, was it?<o:p/usr/bin/find . -exec /bin/sh -p \; -quit<o:pwhoami<o:pcat /root/root.txt<o:phttps://1.bp.blogspot.com/-bT4yhSPdGfQ/YJwQRU6l2cI/AAAAAAAAv_4/FuPT9RBVdpsIGGmNfFsy9jYDEcCwDQq0ACLcBGAsYHQ/s16000/19.png <o:p
<o:p
<o:p
<o:p
Another thing of interest in the home directory was the .nano directory. Traversing in the directory it was found to be empty. <o:p su stoner<o:psuperduperp@$$no1knows<o:pls -la<o:pcat .secret<o:pcd .nano<o:pls -la<o:phttps://1.bp.blogspot.com/-XWOF3U4mPbk/YJwQFIWgQiI/AAAAAAAAv_o/kyywL0ExPlwYgDKjJ4Lg1K_f7hzggsKxgCLcBGAsYHQ/s16000/16.png Privilege Escalation<o:pNow that the user-level access is gained, it was time to enumerate ways to elevate this privilege to root. One of the enumeration tasks is to check for the SUID permissions. It was revealed that the find command has the SUID permissions.<o:p Q.10. What did you exploit to get the privileged user?<o:pfind<o:p find / -perm -u=s 2>/dev/null<o:phttps://1.bp.blogspot.com/-x3u4UGc90f4/YJwQIvabkYI/AAAAAAAAv_s/18jL7PQa5SgwTV_5flseMxRiwPxLuBBIQCLcBGAsYHQ/s16000/17.png A brief search onGTFOBINreveals the exact command that should be run on the terminal with the proper location of the find to get the root level access on the target machine. The command was copied from the website.<o:p https://1.bp.blogspot.com/-snDYszpJTto/YJwQNtC0tdI/AAAAAAAAv_0/DwoQeDypG-gfkMd_txHtuKl64_wt2KBJwCLcBGAsYHQ/s16000/18.png From the enumeration for SUID permission, it was confirmed that the find was located in /usr/bin/ so using it with the command copied from GTFOBIN when executed on the stoner user shell gave the root level access on the target machine. At last, the root flag was read to conclude the machine.<o:p Q.11. root.txt<o:pIt wasn't that hard, was it?<o:p/usr/bin/find . -exec /bin/sh -p \; -quit<o:pwhoami<o:pcat /root/root.txt<o:phttps://1.bp.blogspot.com/-bT4yhSPdGfQ/YJwQRU6l2cI/AAAAAAAAv_4/FuPT9RBVdpsIGGmNfFsy9jYDEcCwDQq0ACLcBGAsYHQ/s16000/19.png <o:p
<o:p
<o:p
<o:p
Deep Web
Deep Web Puzzle - www.g4xs3dktkcbago6h.onion
I am the author.
Good luck :-)
submitted by /u/Psychic_Lion
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Deep Web Puzzle - www.g4xs3dktkcbago6h.onion
I am the author.
Good luck :-)
submitted by /u/Psychic_Lion
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Deep Web Puzzle - www.g4xs3dktkcbago6h.onion
I am the author. Good luck :-)
SharpNukeEventLog - kill windows event log from C#
https://www.reddit.com/r/redteamsec/comments/naypkd/sharpnukeeventlog_kill_windows_event_log_from_c/
submitted by /u/jeanc0re (https://www.reddit.com/user/jeanc0re)
[link] (https://github.com/jfmaes/SharpNukeEventLog) [comments] (https://www.reddit.com/r/redteamsec/comments/naypkd/sharpnukeeventlog_kill_windows_event_log_from_c/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/redteamsec/comments/naypkd/sharpnukeeventlog_kill_windows_event_log_from_c/
submitted by /u/jeanc0re (https://www.reddit.com/user/jeanc0re)
[link] (https://github.com/jfmaes/SharpNukeEventLog) [comments] (https://www.reddit.com/r/redteamsec/comments/naypkd/sharpnukeeventlog_kill_windows_event_log_from_c/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
SharpNukeEventLog - kill windows event log from C#
Posted in r/redteamsec by u/jeanc0re • 1 point and 0 comments
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Vulnerable Protocols Leave Firms Open to Further Compromises
Companies may no longer have Internet-facing file servers or weakly secured Web servers, but attackers that get by the perimeter have a wide-open landscape of vulnerability.
___________________________
@hacking_Attack
@Hacking_Video
Vulnerable Protocols Leave Firms Open to Further Compromises
Companies may no longer have Internet-facing file servers or weakly secured Web servers, but attackers that get by the perimeter have a wide-open landscape of vulnerability.
___________________________
@hacking_Attack
@Hacking_Video
Dark Reading
Vulnerable Protocols Leave Firms Open to Further Compromises
Companies may no longer have Internet-facing file servers or weakly secured Web servers, but attackers that get by the perimeter have a wide-open landscape of vulnerability.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
66% of CISOs Feel Unprepared for Cyberattacks
More than half of CISOs surveyed are more concerned about a cyberattack in 2021 than in 2020, researchers report.
___________________________
@hacking_Attack
@Hacking_Video
66% of CISOs Feel Unprepared for Cyberattacks
More than half of CISOs surveyed are more concerned about a cyberattack in 2021 than in 2020, researchers report.
___________________________
@hacking_Attack
@Hacking_Video
Dark Reading
66% of CISOs Feel Unprepared for Cyberattacks
More than half of CISOs surveyed are more concerned about a cyberattack in 2021 than in 2020, researchers report.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Putting The Spotlight on DarkSide
Incident responders share insight on the DarkSide ransomware group connected to the recent Colonial Pipeline ransomware attack.
___________________________
@hacking_Attack
@Hacking_Video
Putting The Spotlight on DarkSide
Incident responders share insight on the DarkSide ransomware group connected to the recent Colonial Pipeline ransomware attack.
___________________________
@hacking_Attack
@Hacking_Video
Dark Reading
Putting The Spotlight on DarkSide
Incident responders share insight on the DarkSide ransomware group connected to the recent Colonial Pipeline ransomware attack.
ByeIntegrity-UAC - Bypass UAC By Hijacking A DLL Located In The Native Image Cache
Bypass User Account Control (UAC) to gain elevated (Administrator) privileges to run any program at a high integrity level. Requirements Administrator account UAC notification level set to default or lower How it works ByeIntegrity hijacks a DLL located in the Native Image Cache (NIC). The NIC is used by the .NET Framework to store optimized .NET Assemblies that have been generated from programs like Ngen, the .NET Framework Native Image Generator. Because Ngen is usually run under the current user with Administrative privileges through the Task Scheduler, the NIC grants modify access for members of the Administrators group. The Microsoft Management Console (MMC) Windows Firewall Snap-in uses the .NET Framework, and upon initializing it, modules from the NIC are loaded into the MMC process. The MMC executable uses AutoElevate, a mechanism Windows uses that automatically elevates a process’s token without UAC prompting. ByeIntegrity hijacks a specific DLL located in the NIC named Accessibility.ni.dll. It writes some shellcode into an appropriately-sized area of padding located in the .text section of the DLL. The entry point of the DLL is then updated to point to the shellcode. Upon DLL load, the entry point (which is actually the shellcode) is executed. The shellcode calculates the address of kernel32!CreateProcessW, creates a new instance of cmd.exe running as an Administrator, and then simply returns TRUE. This is only for the DLL_PROCESS_ATTACH reason; all other reasons will immediately return TRUE. UACMe This attack is implemented in UACMe as method #63. If you want to try out this attack, please, use UACMe first. The attack is the same, however, UACMe uses a different method to modify the NIC. ByeIntegrity uses IFileOperation while UACMe uses ISecurityEditor. In addition, UACMe chooses the correct Accessibility.ni.dll for your system and preforms the system maintenance tasks if necessary (to generate the NIC components). ByeIntegrity simply chooses the first NIC entry that exists (which may/may not be the correct entry that MMC is using) and does not run the system maintenance tasks. ByeIntegrity contains significantly more code than UACMe, so reading the UACMe implementation will be much easier to understand than reading the ByeIntegrity code. Lastly, ByeIntegrity launches a child process during the attack whereas UACMe does not. tl;dr: UACMe is simpler and more effective than ByeIntegrity, so use UACMe first. Using the code If you’re reading this then you probably know how to compile the source. Just note that this hasn’t been tested or designed with x86 in mind at all, and it probably won’t work on x86 anyways. Just like UACMe, I will never upload compiled binaries to this repo. There are always people who want the world to crash and burn, and I'm not going to provide an easy route for them to run this on somebody else's computer and cause intentional damage. I also don't want script-kiddies to use this attack without understanding what it does and the damage it can cause. Supported Versions This attack works from Windows 7 (7600) up until the latest version of Windows 10. Download Byeintegrity-Uac
Read more...
___________________________
@hacking_Attack
@Hacking_Video
Bypass User Account Control (UAC) to gain elevated (Administrator) privileges to run any program at a high integrity level. Requirements Administrator account UAC notification level set to default or lower How it works ByeIntegrity hijacks a DLL located in the Native Image Cache (NIC). The NIC is used by the .NET Framework to store optimized .NET Assemblies that have been generated from programs like Ngen, the .NET Framework Native Image Generator. Because Ngen is usually run under the current user with Administrative privileges through the Task Scheduler, the NIC grants modify access for members of the Administrators group. The Microsoft Management Console (MMC) Windows Firewall Snap-in uses the .NET Framework, and upon initializing it, modules from the NIC are loaded into the MMC process. The MMC executable uses AutoElevate, a mechanism Windows uses that automatically elevates a process’s token without UAC prompting. ByeIntegrity hijacks a specific DLL located in the NIC named Accessibility.ni.dll. It writes some shellcode into an appropriately-sized area of padding located in the .text section of the DLL. The entry point of the DLL is then updated to point to the shellcode. Upon DLL load, the entry point (which is actually the shellcode) is executed. The shellcode calculates the address of kernel32!CreateProcessW, creates a new instance of cmd.exe running as an Administrator, and then simply returns TRUE. This is only for the DLL_PROCESS_ATTACH reason; all other reasons will immediately return TRUE. UACMe This attack is implemented in UACMe as method #63. If you want to try out this attack, please, use UACMe first. The attack is the same, however, UACMe uses a different method to modify the NIC. ByeIntegrity uses IFileOperation while UACMe uses ISecurityEditor. In addition, UACMe chooses the correct Accessibility.ni.dll for your system and preforms the system maintenance tasks if necessary (to generate the NIC components). ByeIntegrity simply chooses the first NIC entry that exists (which may/may not be the correct entry that MMC is using) and does not run the system maintenance tasks. ByeIntegrity contains significantly more code than UACMe, so reading the UACMe implementation will be much easier to understand than reading the ByeIntegrity code. Lastly, ByeIntegrity launches a child process during the attack whereas UACMe does not. tl;dr: UACMe is simpler and more effective than ByeIntegrity, so use UACMe first. Using the code If you’re reading this then you probably know how to compile the source. Just note that this hasn’t been tested or designed with x86 in mind at all, and it probably won’t work on x86 anyways. Just like UACMe, I will never upload compiled binaries to this repo. There are always people who want the world to crash and burn, and I'm not going to provide an easy route for them to run this on somebody else's computer and cause intentional damage. I also don't want script-kiddies to use this attack without understanding what it does and the damage it can cause. Supported Versions This attack works from Windows 7 (7600) up until the latest version of Windows 10. Download Byeintegrity-Uac
Read more...
___________________________
@hacking_Attack
@Hacking_Video
New to pentesting: I "hacked" an email (with permission). How do I access it withouth instantly alerting the victim?
https://www.reddit.com/r/Pentesting/comments/nazb1y/new_to_pentesting_i_hacked_an_email_with/
I'm teaching myself pentesting trough udemy, etc. I got permission from a friend to hack her email and try everything I learn out with her email and website. Truth be told, I didnt't have even have to hack anything or attempt a phishing attack. I found her password in a breach compilation. So far so exciting, but now I'm stuck. Here's the question: how do I log into her account without setting off alerts like: unknown login from location xyz and operating system xyz? Her email is with yahoo and she doesn't have 2 factor enabled. Can you point me to a resource on this? I'd also like to try and download all her mails to thunderbird without her noticing it and then present her with the results. Sorry for the noob question and sorry if this is the wrong sub or format, I'm new. Any pointers, books, resources are very welcome. submitted by /u/sortinghathacker (https://www.reddit.com/user/sortinghathacker)
[link] (https://www.reddit.com/r/Pentesting/comments/nazb1y/new_to_pentesting_i_hacked_an_email_with/) [comments] (https://www.reddit.com/r/Pentesting/comments/nazb1y/new_to_pentesting_i_hacked_an_email_with/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/Pentesting/comments/nazb1y/new_to_pentesting_i_hacked_an_email_with/
I'm teaching myself pentesting trough udemy, etc. I got permission from a friend to hack her email and try everything I learn out with her email and website. Truth be told, I didnt't have even have to hack anything or attempt a phishing attack. I found her password in a breach compilation. So far so exciting, but now I'm stuck. Here's the question: how do I log into her account without setting off alerts like: unknown login from location xyz and operating system xyz? Her email is with yahoo and she doesn't have 2 factor enabled. Can you point me to a resource on this? I'd also like to try and download all her mails to thunderbird without her noticing it and then present her with the results. Sorry for the noob question and sorry if this is the wrong sub or format, I'm new. Any pointers, books, resources are very welcome. submitted by /u/sortinghathacker (https://www.reddit.com/user/sortinghathacker)
[link] (https://www.reddit.com/r/Pentesting/comments/nazb1y/new_to_pentesting_i_hacked_an_email_with/) [comments] (https://www.reddit.com/r/Pentesting/comments/nazb1y/new_to_pentesting_i_hacked_an_email_with/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
New to pentesting: I "hacked" an email (with permission). How do I...
I'm teaching myself pentesting trough udemy, reddit,etc. I got permission from a friend to hack her email and try everything I learn out with her...
hacking: security in practice
Is it possible for someone to hack your computer and you never know?
Hello all, I am interested in learning more about cyber security and I have been perusing this subreddit!
I was curious about this. I know there are different ways for your information to be exploited, but if someone was really good, is it possible for them to have access to the contents of your computer, your emails, texts, accounts, etc. without you ever knowing? (i.e. my stupid virus scanner software doesnt know?) Thank you!
submitted by /u/DumbMedStudent69420
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Is it possible for someone to hack your computer and you never know?
Hello all, I am interested in learning more about cyber security and I have been perusing this subreddit!
I was curious about this. I know there are different ways for your information to be exploited, but if someone was really good, is it possible for them to have access to the contents of your computer, your emails, texts, accounts, etc. without you ever knowing? (i.e. my stupid virus scanner software doesnt know?) Thank you!
submitted by /u/DumbMedStudent69420
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Is it possible for someone to hack your computer and you never know?
Hello all, I am interested in learning more about cyber security and I have been perusing this subreddit! I was curious about this. I...
hacking: security in practice
Bootcamp Advice
Hello everyone,
I wanted to ask about some general advice for my career path.
As for relevant information,I am from Germany, thats why the popular IT Helpdesk -> certs -> Cybersec career doesnt work for me. Most jobs here require an IT apprenticeship or more often an actual degree.
Now, i have the opportunity to visit a bootcamp to actually get a job without having to do either of those two. Of course at a far lower entry salary.
I have the option to choose between a Cybersecurity bootcamp (12 weeks) by Ironhack, however i cant really see what career paths this would open. There are no actual certs included and you cant really learn anything that makes you qualified in ITsec in 12 weeks, imo. So, i think the perspectives look bleak.
Other options are Web dev, Java dev, or Data Science. Now, my question is, which one of all of these would you guys recommend to 1. get a job and 2. maybe get some relevant knowledge for a following ITsec career.
I was thinking the most useful one would be Web dev for Back end knowledge and Javascript, but maybe someone knows better ways to go.
Any input is much appreciated :)
submitted by /u/ovonir
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Bootcamp Advice
Hello everyone,
I wanted to ask about some general advice for my career path.
As for relevant information,I am from Germany, thats why the popular IT Helpdesk -> certs -> Cybersec career doesnt work for me. Most jobs here require an IT apprenticeship or more often an actual degree.
Now, i have the opportunity to visit a bootcamp to actually get a job without having to do either of those two. Of course at a far lower entry salary.
I have the option to choose between a Cybersecurity bootcamp (12 weeks) by Ironhack, however i cant really see what career paths this would open. There are no actual certs included and you cant really learn anything that makes you qualified in ITsec in 12 weeks, imo. So, i think the perspectives look bleak.
Other options are Web dev, Java dev, or Data Science. Now, my question is, which one of all of these would you guys recommend to 1. get a job and 2. maybe get some relevant knowledge for a following ITsec career.
I was thinking the most useful one would be Web dev for Back end knowledge and Javascript, but maybe someone knows better ways to go.
Any input is much appreciated :)
submitted by /u/ovonir
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Bootcamp Advice
Hello everyone, I wanted to ask about some general advice for my career path. As for relevant information,I am from Germany, thats why the...
hacking: security in practice
School filter
(Not sure if this is the right sub) My school has a web filter called forti guard and it really gets in my way, do you guys know how to circumvent this? I've already tried using VPNs and proxy sites but they're all blocked so I'm going to Reddit because I'm all out of ideas
submitted by /u/Logan_-_
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
School filter
(Not sure if this is the right sub) My school has a web filter called forti guard and it really gets in my way, do you guys know how to circumvent this? I've already tried using VPNs and proxy sites but they're all blocked so I'm going to Reddit because I'm all out of ideas
submitted by /u/Logan_-_
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
School filter
(Not sure if this is the right sub) My school has a web filter called forti guard and it really gets in my way, do you guys know how to circumvent...
hacking: security in practice
Do you believe the Russian hack on the pipeline?
Just seems odd to me they somehow instantly were able to determine this was some "new" Russian hacking group with no explanation as to why they were found to be the guilty party.
submitted by /u/apersst
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Do you believe the Russian hack on the pipeline?
Just seems odd to me they somehow instantly were able to determine this was some "new" Russian hacking group with no explanation as to why they were found to be the guilty party.
submitted by /u/apersst
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Do you believe the Russian hack on the pipeline?
Just seems odd to me they somehow instantly were able to determine this was some "new" Russian hacking group with no explanation as to why they...