Communication skills
https://www.reddit.com/r/Pentesting/comments/10gss1l/communication_skills/

<!-- SC_OFF -->I've been a pentester for 3 years now and the part that I struggle the most with is communication. I can put a good explanation on paper but presenting it to the client is where I suck. I've been lucky to have a supervisor who's been presenting the report since he's the contact person with the clients. However I want to be able to present my report myself, any advice on this. Just for context I end up stammering, sweating and making a fool of myself when I attempt to present the report. Fucking sucks man. <!-- SC_ON --> submitted by /u/Wooden-Weather688 (https://www.reddit.com/user/Wooden-Weather688)
[link] (https://www.reddit.com/r/Pentesting/comments/10gss1l/communication_skills/) [comments] (https://www.reddit.com/r/Pentesting/comments/10gss1l/communication_skills/)

Azure Attack Paths Management
https://www.reddit.com/r/redteamsec/comments/10gtq91/azure_attack_paths_management/

submitted by /u/sofblocks (https://www.reddit.com/user/sofblocks)
[link] (https://sofblocks.github.io/azure-attack-paths/) [comments] (https://www.reddit.com/r/redteamsec/comments/10gtq91/azure_attack_paths_management/)

Black Hat Ethical Hacking
Recon Tool: Shotlooter

Recon Tool: ShotlooterPost Views: 13 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes ShotlooterShotlooter by utkusen is a tool developed to find sensitive data inside the screenshots which are uploaded to https://prnt.sc/ (via the LightShot software) by applying OCR and image processing methods. It allows for performing image processing and web scraping tasks. It uses the libraries requests, BeautifulSoup, argparse, PIL, pytesseract, numpy, imutils, and cv2 to accomplish these tasks. This tool also uses these libraries to perform tasks such as template matching, image resizing, and web scraping. Additionally, it uses the libraries colorama and termcolor for color output and os and signal for handling system signals.

https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/SS1.png
See Also: So you want to be a hacker? Offensive Security Courses How it Works?1. Starting from the given image id, Shotlooter iterates through images (yes, image ids are not random) and downloads them locally.
2. Converts the text inside the image by using tesseract OCR library.
3. Searches for predefined keywords on the image (private_key,smtp_pass,access key,mongodb+srv etc.)
4. Searches strings with high entropy (API keys usually have high entropy)
5. Searches small images (e.g Lastpass logo) inside the downloaded image (Template Matching) with OpenCV.
6. Saves the results to a CSV file
7. Saves images that contain sensitive data to the output folder InstallationShotlooter requires Python3, pip3 to work and tested on macOS and Debian based Linux systems.

Installing Dependencies for macOS: brew install tesseractInstalling Dependencies for Debian Based Linux: sudo apt install libsm6 libxext6 libxrender-dev tesseract-ocr -yClone the repository: git clone https://github.com/utkusen/shotlooter.gitGo inside the folder cd shotlooterInstall required libraries pip3 install -r requirements.txtTrending: Digital Forensics Tool: Dangerzone
Trending: Offensive Security Tool: Freeze UsageBasic Usage: python3 shotlooter.py --code PRNT.SC_IDIt searches for matching keywords (located in keywords.txt), high entropy strings and credit card numbers. You can find an id by uploading an image to https://prnt.sc/ . For example python3 shotlooter.py –code sjgmm5

It will check the ids by incrementing them one by one:

sjgmm6
sjgmm7
sjgmm8
sjgmm9
sjgmma
sjgmmb
…

Image Search: python3 shotlooter.py --code sjgmm5 --imagedir IMAGE_FOLDER_PATHIt will search for the items covered in basic usage + will search for provided small images in the bigger screenshots. If you are planning to use this feature, put your small images inside the img folder.

Exclude Search: You can exclude any search type by providing related argument: –no-cc, –no-entropy, –no-keyword

For example: python3 shotlooter.py --code sjgmm5 --no-entropy.Shotlooter will skip high entropy string checking. A Note For The False PositivesShotlooter has high false-positive rates for high entropy string and credit card matching. Actually, they are not false positives but may not be the items that you are looking for. It detects high entropy strings to catch API keys, private keys etc. However, any non-sensitive random string will have a high entropy too and Shotlooter will detect them. The same goes for the credit card.

If you don’t want to deal with false positives, exclude entropy and credit card searches.
See Also: Hacking Stories: Operation OpRussia – Anonymous attacks on Russia What You Should Expect to Find?The creator ran Shotlooter for 2 weeks and identified 300+ images[...]

Black Hat Ethical Hacking
T-Mobile hacked to steal data of 37 million accounts in API data breach

T-Mobile hacked to steal data of 37 million accounts in API data breachPost Views: 36 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes T-Mobile data breachT-Mobile recently announced a data breach in which a hacker stole the personal information of 37 million current postpaid and prepaid customer accounts through one of the company’s Application Programming Interfaces (APIs)

The mobile carrier detected the malicious activity on January 5, 2023 and cut off the hacker’s access to the API the following day.
See Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Customer account data exposedThe company stated that the API that was exploited did not provide access to sensitive information such as social security numbers, driver’s licenses, or financial account information.
Instead, the hacker was able to access a limited set of customer account data, including name, billing address, email, phone number, date of birth, T-Mobile account number and information such as the number of lines on the account and plan features.

T-Mobile is working with law enforcement to investigate the breach and has reported the incident to U.S federal agencies.
Trending: Common and Uncommon types of SQL Injection Trending: Offensive Security Tool: Freeze 8th data breach since 2018This is the eighth data breach T-Mobile has suffered since 2018.

The mobile carrier has suffered seven other data breaches since 2018, including one where attackers gained access to the data of roughly 3% of all T-Mobile customers.

In 2019, T-Mobile exposed prepaid customers’ data. Unknown threat actors also accessed T-Mobile employees’ email accounts in March 2020.

In December 2020, unknown threat actors also gained access to customer proprietary network information (phone numbers, call records), and in February 2021, attackers accessed an internal T-Mobile application without authorization. In August 2021, hackers brute-forced their way through T-Mobile’s network after a breach of the carrier’s testing environments.

The company also confirmed in April 2022 that the Lapsus$ extortion gang had breached its network using stolen credentials.
Trending: Microsoft: Cuba ransomware hacking Exchange servers via OWASSRF flaw
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-6-2-300x150.png Mailchimp says it was hacked, againJanuary 19, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-5-2-300x150.png Git patches two critical remote code execution security flawsJanuary 18, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-4-2-300x150.png MSI accidentally breaks Secure Boot for hundreds of motherboardsJanuary 17, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-10-300x150.png PoC exploits released for critical bugs in popular WordPress pluginsJanuary 16, 2023
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post T-Mobile hacked to steal data of 37 million accounts in API data breach first appeared on Black Hat Ethical Hacking.

that contain various of sensitive data. You can check the findings that the creator encountered more than others below: Postman RequestsContains useful session IDs, access tokens etc. https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/postman-1024x667.png Cloud API Keys (Google, AWS)Screenshots are taken from the cloud’s console or from a desktop client https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/google-1024x555.png https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/aws.png Session ID on the URLWe all know that it’s not good to pass the session ID with a GET request for different reasons. This is one of them.

https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/url-1024x593.png Credentials on Excel SheetsSome people love to use the Excel as a password manager.

https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/excel.png Bitcoin Private Keys (This is Terrible)Bitcoin wallets allow you to export your private key so that you can import it into somewhere else. But if you publish the screenshot of your private key, your whole wallet can be compromised.

https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/btc1.png

https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/btc2.png
Clone the repo from here: GitHub Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Freeze-300x150.png Offensive Security Tool: FreezeJanuary 13, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Dangerzone-300x150.png Digital Forensics Tool: DangerzoneJanuary 6, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/psudohash-300x150.png Offensive Security Tool: PsudohashDecember 30, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/OrbitalDump-300x150.png Offensive Security Tool: OrbitalDumpDecember 29, 2022 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Recon Tool: Shotlooter first appeared on Black Hat Ethical Hacking.

Azure Attack Paths Management
https://www.reddit.com/r/Pentesting/comments/10gtjh9/azure_attack_paths_management/

submitted by /u/sofblocks (https://www.reddit.com/user/sofblocks)
[link] (https://sofblocks.github.io/azure-attack-paths/) [comments] (https://www.reddit.com/r/Pentesting/comments/10gtjh9/azure_attack_paths_management/)

Ghauri - An Advanced Cross-Platform Tool That Automates The Process Of Detecting And Exploiting SQL Injection Security Flaws
http://www.kitploit.com/2023/01/ghauri-advanced-cross-platform-tool.html

An advanced cross-platform tool that automates the process of detecting and exploiting (https://www.kitploit.com/search/label/Exploiting) SQL injection security flaws
Requirements Python 3 Python pip3 Installation cd to ghauri directory. install requirements: python3 -m pip install --upgrade -r requirements.txt run: python3 setup.py install or python3 -m pip install -e . you will be able to access and run the ghauri with simple ghauri --help command. Download Ghauri You can download the latest version of Ghauri by cloning the GitHub repository. git clone https://github.com/r0oth3x49/ghauri.git
Features Supports following types of injection payloads: Boolean based. Error Based Time Based Stacked Queries Support SQL injection for following DBMS. MySQL Microsoft SQL Server Postgre Oracle Supports following injection types. GET/POST Based injections Headers Based injections Cookies Based injections Mulitipart Form data injections JSON based injections support proxy option --proxy. supports parsing request from txt file: switch for that -r file.txt supports limiting data extraction for dbs/tables/columns/dump: swicth --start 1 --stop 2 added support for resuming of all phases. added support for skip urlencoding switch: --skip-urlencode added support to verify extracted characters in case of boolean/time based injections. Advanced Usage
Author: Nasir khan (r0ot h3x49)

usage: ghauri -u URL [OPTIONS]

A cross-platform python based advanced sql injections detection & exploitation (https://www.kitploit.com/search/label/Exploitation) tool.

General:
-h, --help Shows the help.
--version Shows the version.
-v VERBOSE Verbosity level: 1-5 (default 1).
--batch Never ask for user input, use the default behavior
--flush-session Flush session files for current target

Target:
At least one of these options has to be provided to define the
target(s)

-u URL, --url URL Target URL (e.g. 'http://www.site.com/vuln.php?id=1).
-r REQUESTFILE Load HTTP request from a file

Request:
These options can be used to specify how to connect to the target URL

-A , --user-agent HTTP User-Agent header value -H , --header Extra header (e.g. "X-Forwarded-For: 127.0.0.1")
--host HTTP Host header value
--data Data string to be sent through POST (e.g. "id=1")
--cookie HTTP Cookie header value (e.g. "PHPSESSID=a8d127e..")
--referer HTTP Referer header value
--headers Extra headers (e.g. "Accept-Language: fr\nETag: 123")
--proxy Use a proxy to connect to the target URL
--delay Delay in seconds between each HTTP request
--timeout Seconds to wait before timeout connection (default 30)
--retries Retries when the connection related error occurs (default 3)
--skip-urlencode Skip URL encoding (https://www.kitploit.com/search/label/Encoding) of payload data
--force-ssl Force usage of SSL/HTTPS

Injection:
These options can be used to specify which paramete rs to test for,
provide custom injection payloads and optional tampering scripts

-p TESTPARAMETER Testable parameter(s)
--dbms DBMS Force back-end DBMS to provided value
--prefix Injection (https://www.kitploit.com/search/label/Injection) payload prefix string
--suffix Injection payload suffix string

Detection:
These options can be used to customize the detection phase

--level LEVEL Level of tests to perform (1-3, default 1)
--code CODE HTTP code to match when query is evaluated to True
--string String to match when query is evaluated to True
--not-string String to match when query is evaluated to False
--text-only Compare pages based only on the textual content

Techniques:

These options can be used to tweak testing of specific SQL injection
techniques

--technique TECH SQL injection techniques (https://www.kitploit.com/search/label/Techniques) to use (default "BEST")
--time-sec TIMESEC Seconds to delay the DBMS response (default 5)

Enumeration:
These options can be used to enumerate the back-end database
managment system information, structure and data contained in the
tables.

-b, --banner Retrieve DBMS banner
--current-user Retrieve DBMS current user
--current-db Retrieve DBMS current database
--hostname Retrieve DBMS server hostname
--dbs Enumerate DBMS databases
--tables Enumerate DBMS database tables
--columns Enumerate DBMS database table columns
--dump Dump DBMS database table entries
-D DB DBMS database to enumerate
-T TBL DBMS database tables(s) to enumerate
-C COLS DBMS database table column(s) to enumerate
--start Retrive entries from offset for dbs/tables/columns/dump
--stop Retrive entries till offset for dbs/tables/columns/dump

Example:
ghauri http://www.site.com/vuln.php?id=1 --dbs
Legal disclaimer Usage of Ghauri for attacking targets without prior mutual consent is illegal.
It is the end user's responsibility to obey all applicable local,state and federal laws.
Developer assume no liability and is not responsible for any misuse or damage caused by this program.
TODO Add support for inline queries. Add support for Union based queries

Download Ghauri (https://github.com/r0oth3x49/ghauri)

hacking: security in practice
Hacking paid antivirus apps on phones

Not asking if it’s possible. Asking how it would be done. How could someone bypass any and every paid full antivirus app on a phone repeatedly despite the app being used? Would they have to already have something like remote access, child monitoring software, man in the middle, etc setup?

submitted by /u/Never_B_Ur_Saint_377
[link] [comments]

Two Factor Authentication Bypass On Facebook

Summary: I discovered the lack of rate-limiting issue in instagram which could have allowed an attacker to bypass two factor…Continue reading on Medium »
Read more...