Black Hat Ethical Hacking
Recon Tool: msprobe

Recon Tool: msprobePost Views: 5 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes msprobeThis tool by puzzlepeaches, lets you find all things on-prem Microsoft for password spraying and enumeration. It will use a list of common subdomains associated with your target apex domain to attempt and discover valid instances of on-prem Microsoft solutions. You can find ADFS servers, RD Web servers, and more. Great for recon and getting ready before spraying attacks as part of your Red Team Assessment.

Screenshots of the tool in action are below:

https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/163191875-61040ed3-b318-4ad4-97c1-c06fb3f7eeba-1024x700.jpeg
See Also: So you want to be a hacker? Offensive Security Courses InstallingInstall the project using pipx pipx install git+https://github.com/puzzlepeaches/msprobe.gitTrending: Offensive Security Tool: Villain
Trending: Offensive Security Tool: Freeze UsageThe tool has four different modules that assist with the discovery of on-prem Microsoft products:

* Exchange
* RD Web
* ADFS
* Skype for Business

The help menu and supported modules are shown below:

https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/SS1-1.png
See Also: Write up: A primer on OS Command Injection Attacks ExamplesFind ADFS servers associated with apex domain: msprobe adfs acme.comFind RD Web servers associated with apex domain with verbose output: msprobe rdp acme.com -vFind all Microsoft products hostsed on-prem for a domain: msprobe full acme.comClone the repo from here: GitHub Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Shotlooter-300x150.png Recon Tool: ShotlooterJanuary 20, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Freeze-300x150.png Offensive Security Tool: FreezeJanuary 13, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Dangerzone-300x150.png Digital Forensics Tool: DangerzoneJanuary 6, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/psudohash-300x150.png Offensive Security Tool: PsudohashDecember 30, 2022 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Recon Tool: msprobe first appeared on Black Hat Ethical Hacking.

Black Hat Ethical Hacking
Windows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit Released

Windows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit ReleasedPost Views: 49 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Akamai researchers have released proof of concept exploit code for a critical Windows CryptoAPI vulnerability, which was discovered by the NSA and U.K.’s NCSC and allows for MD5-collision certificate spoofing. Tracked as CVE-2022-34689, this security flaw was addressed with security updates in August 2022, but was not made public by Microsoft until October.

The vulnerability allows unauthenticated attackers to manipulate existing public x.509 certificates to spoof their identity and perform actions such as authentication or code signing as the targeted certificate.
See Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Exploiting the vulnerabilityThe Akamai researchers have also shared an OSQuery to help defenders detect CryptoAPI library versions vulnerable to attacks.
They have found that older versions of Chrome (v48 and earlier) and Chromium-based applications can be exploited, but believe that there are more vulnerable targets in the wild.

The vulnerability can impact the validation of trust for HTTPS connections and signed executable code, files, or emails and can also provide attackers with the ability to perform man-in-the-middle attacks and decrypt confidential information.
Trending: A primer on OS Command Injection Attacks
Trending: Recon Tool: Shotlooter Update your Windows serversThe researchers advise to patch your Windows servers and endpoints with the latest security patch released by Microsoft.
Trending: PoC exploits released for critical bugs in popular WordPress plugins Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-6-3-300x150.png LearnPress: 75,000 WordPress Websites at Risk from Critical VulnerabilitiesJanuary 25, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-5-3-300x150.png Cisco VPN Routers: 19,000 Devices Left Exposed to Remote Command Execution Exploit ChainJanuary 24, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-4-3-300x150.png OneNote Attachments: The Next Frontier in Malware DistributionJanuary 23, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-7-1-300x150.png T-Mobile hacked to steal data of 37 million accounts in API data breachJanuary 20, 2023
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Windows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit Released first appeared on Black Hat Ethical Hacking.

Is pentesting that well paid
https://www.reddit.com/r/Pentesting/comments/10lpsuf/is_pentesting_that_well_paid/

<!-- SC_OFF -->I’m I love computers and have wanted to become a penetration for a while now. I am currently having a look at local colleges and 6th forms. I have also looked a lot on indeed to see what skills companies require. I have noticed many junior pentesting jobs are about 30k a year. Where would I go from this position if I were to get it? some senior jobs earn about 70k a year but I would likely not achieve this for years in the field I assume? Thanks in advance Anthony <!-- SC_ON --> submitted by /u/THESEASANIC (https://www.reddit.com/user/THESEASANIC)
[link] (https://www.reddit.com/r/Pentesting/comments/10lpsuf/is_pentesting_that_well_paid/) [comments] (https://www.reddit.com/r/Pentesting/comments/10lpsuf/is_pentesting_that_well_paid/)

XSS vulnerability

Hii amigos today we are going to discuss about XSS vulnerability listed also known as Cross-site-Scripting vulnerability which is regarded…Continue reading on Medium »
Read more...

GUAC - Aggregates Software Security Metadata Into A High Fidelity Graph Database
http://www.kitploit.com/2023/01/guac-aggregates-software-security.html

Note: GUAC is under active (https://www.kitploit.com/search/label/Active) development - if you are interested in contributing, please look at contributor guide (https://github.com/guacsec/guac/blob/main/CONTRIBUTING.md) and the "express interest" issue (https://github.com/guacsec/guac/issues/1) Graph for Understanding Artifact Composition (GUAC) aggregates software security metadata (https://www.kitploit.com/search/label/Metadata) into a high fidelity graph database—normalizing entity identities and mapping standard relationships between them. Querying this graph can drive higher-level organizational outcomes such as audit, policy, risk management, and even developer assistance.
Conceptually, GUAC occupies the “aggregation and synthesis” layer of the software supply chain (https://www.kitploit.com/search/label/Supply%20Chain) transparency (https://www.kitploit.com/search/label/Transparency) logical model:

A few examples of questions answered by GUAC include:

Quickstart Refer to the Setup + Demo (https://github.com/guacsec/guac/blob/main/SETUP.md) document to learn how to prepare your environment and try GUAC out! Architecture Here is an overview of the architecture of GUAC:

Supported input formats CycloneDX (https://github.com/CycloneDX/specification) Dead Simple Signing Envelope (https://github.com/secure-systems-lab/dsse) In-toto ITE6 (https://github.com/in-toto/attestation) OpenSSF Scorecard (https://github.com/ossf/scorecard) SLSA (https://github.com/slsa-framework/slsa) SPDX (https://spdx.dev/specifications/) Additional References GUAC Intro Slides (https://docs.google.com/presentation/d/1WF4dsJiwR6URWPgn1aiHAE3iLVl-oGP4SJRWFpcOlao/edit#slide=id.p) GUAC Design Doc (https://docs.google.com/document/d/1N5x0HErb-kmCPgG9M8TwBEOGIVU54clqp_X4KhtNJI8/edit) Communication We encourage discussions to be done on github issues. We also have a public slack channel (https://openssf.slack.com/archives/C03U677QD46) on the OpenSSF slack. For security issues or code of conduct concerns, an e-mail should be sent to guac-maintainers@googlegroups.com (mailto:guac-maintainers@googlegroups.com). Governance Information about governance can be found here (https://github.com/guacsec/guac/blob/main/GOVERNANCE.md).

Download Guac (https://github.com/guacsec/guac)

KitPloit - PenTest Tools!
GUAC - Aggregates Software Security Metadata Into A High Fidelity Graph Database

https://blogger.googleusercontent.com/img/a/AVvXsEgEtOzw7jZvX6v0V6NjRX0XDPlWLyEvEHCLiQ5pR6V3WSoZHaec8CDnDQFqUA7YcHWHxPFaEmRBI_qIEyg417P5P2u5Br4e3rVTlj8SzoVZV5cju1uCi1UecMMmRMgv0f9O2NOXYhnt-PmfFStnSt9XeEFS6yslL8fCBUBPGgkf9PCKjBL4yMUemG6d5w=w258-h400 Note: GUAC is under active development - if you are interested in contributing, please look at contributor guide and the "express interest" issue

Graph for Understanding Artifact Composition (GUAC) aggregates software security metadata into a high fidelity graph database—normalizing entity identities and mapping standard relationships between them. Querying this graph can drive higher-level organizational outcomes such as audit, policy, risk management, and even developer assistance.
Conceptually, GUAC occupies the “aggregation and synthesis” layer of the software supply chain transparency logical model: https://blogger.googleusercontent.com/img/a/AVvXsEjCOXt8ov6H6LlHg1Im-TtNFlplAFlpYR88jEg4XfgjrsbBEvtvjQDly-fb-6cJi-h9IMIdMqpy42MF-b2VWTkLj6bYjT6vK1dXJUvu91u3pLSdKh4n4R-fI4_qb1gmexfzz1lNUUpxIRCe--C-GO5WCaNJTwJogdXYa9sILVz1k-JOQ__qT_jk0ZmHaw=w640-h500 A few examples of questions answered by GUAC include: https://blogger.googleusercontent.com/img/a/AVvXsEiJJotPbN2MSCa1bnXRrEWVJm_tPJ9TruIYiTK6yvhmotDWdfkXsVfOVmsbG8PpOXB93OLJDJrtSH0WhhSPs0pfOTBOzSNMNLgXfvCmEbFnzm8bFy0x-4C33IYH4MUq5NCVKv0hIuB8vKvBsIToHtbj36Z3F258SMn6MtDsBUB1y6eowcKoOb4cZxXBcw=w640-h290 QuickstartRefer to the Setup + Demo document to learn how to prepare your environment and try GUAC out! ArchitectureHere is an overview of the architecture of GUAC: https://blogger.googleusercontent.com/img/a/AVvXsEi5DEW3s8Fs02PYifWaxCs5NZ4morOKYKY96VPr985dzhAEj7hrGkVFKMJFA7ipFjAthiyP5FH1-NRGyF2mIj2roQBe0xLXArZKq4_j1oegbW25a2g4LCsrCsCBE_BLEWzf0ceU8DSXqDQKpJcEIPH7xSmqFqJn0DQNiKX6LF-Ud7jpHTM0n-WeVRQ_Zw=w640-h338 Supported input formats* CycloneDX
* Dead Simple Signing Envelope
* In-toto ITE6
* OpenSSF Scorecard
* SLSA
* SPDX Additional References* GUAC Intro Slides
* GUAC Design Doc CommunicationWe encourage discussions to be done on github issues. We also have a public slack channel on the OpenSSF slack.

For security issues or code of conduct concerns, an e-mail should be sent to guac-maintainers@googlegroups.com. GovernanceInformation about governance can be found here. Download Guac

hacking: security in practice
Just started learning what is the better OS?

So I’ve been learning python and I’ve been experimenting with different types of Linux os I’ve used Ubuntu and kali but I’ve used both on different types of machine like for example I used the Ubuntu on a vm but I put kali on a usb but it seems to me like little differences between all the os are frustrating to filter out

submitted by /u/amon619
[link] [comments]

hacking: security in practice
How to clone a website?

I need to clone my school website, long story short a proffesor got mad at us and wants to shut down a website that is very usefull to us students, it has YEARS of lectures and work on it and i want to clone it and save all that work with PDF,PFT files photoes etc... So i hope if someone here can show me how to do it?

submitted by /u/Bujadin
[link] [comments]

hacking: security in practice
How to run an Apache server from a Docker container using EC-2?

I'm taking an online course about AWS as it relates to cybersecurity, and it's a bit unclear to me. For a certain task, the instructor told us to run an Apache server from a Docker container using EC-2, and then create a “Hello World” webpage accessible via port 11111 and provide its URL, and to then provide a screenshot of the "docker ps" command output.

Can anyone here help me out a bit by pointing me in the way of some good resources? I'm fairly lost.

submitted by /u/dvnci1452
[link] [comments]