Hacking on Medium
“The Role of Artificial Intelligence in Cybersecurity”

Introduction:

Continue reading on Medium »

Hacking on Medium
DC-Series

https://cdn-images-1.medium.com/max/700/1*6dZJCgKwZOh0IwpE-YBGmQ.png
DC-1 is a purposely built vulnerable lab for the purpose of gaining experience in the world of penetration testing.

Continue reading on Medium »

Hacking on Medium
Creating and Winning a Capture the Flag Challenge: Our Experience Developing and Competing in an…

https://cdn-images-1.medium.com/max/2200/1*NIew9cDUfDkV7Tk4ANYL2Q.png
In December, my team and I took on a thrilling challenge as we participated in an Attack & Defense (A/D) Capture the Flag (CTF)…

Continue reading on Medium »

Hacking on Medium
Googling like a White hat

https://cdn-images-1.medium.com/max/2600/1*r9lzv0-dQGVHTfmJIidHSg.png
Last year, I had the chance to meet a White hat who works in the frensh cyberdefense. The first thing that struck me about him was his…

Continue reading on Medium »

Hacking on Medium
Active Directory enumeration and exploitation for beginners

https://cdn-images-1.medium.com/max/1293/1*z0fIgy-2zGIZLTRMwwtohQ.png
#beginners #activedirectory #AD #enumeration #exploitation

Continue reading on Medium »

Black Hat Ethical Hacking
Offensive Security Tool: XSSRocket

Offensive Security Tool: XSSRocketPost Views: 292 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes XSSRocketXSSRocket is written by Black Hat Ethical Hacking with the help of ChatGPT as experimentation, with a lot of hours spent modifying the code generated by ChatGPT, and is designed for Offensive Security and XSS (Cross-Site-Scripting) attacks. It is the result of showcasing how you can explore the process of utilizing ChatGPT’s advanced language capabilities to create a very powerful XSS injection tool for Offensive Security with tons of cool features and one-liners. By approaching this task with a hacker’s mindset, FAST XSS GPT demonstrates how ChatGPT can be trained to understand and analyze web application vulnerabilities, specifically those related to XSS injection that can be used by Pentesters, Red Teams, and Bug Bounty Hunters.
See Also: So you want to be a hacker? Offensive Security Courses DescriptionXSS Rocket, uses the Wayback Machine to fetch URLs and filters them based on parameters contained in the URLs. It then filters the URLs with httpx while using multiple Grep and SED patterns to filter only the ones that are alive and valid, removing the contents of the parameters and then uses a remote XSS payload list from Github to send GET requests with the payloads to the filtered URLs injecting them with the XSS Payloads, showcasing the status for 200 and 4XX errors in Red and Green, and creating a Summary for the findings, while saving all the results into a folder that has the same name as the domain name created with all the results, inside it.

It also includes a feature that generates a random Sun Tzu quote for Offensive Security and uses lolcat to display colorful outputs and ASCII art and a check system to ensure that the user is connected to the internet before running it.

What is special about this tool is that technically, is the methodology used and critical thinking behind it for each step that it is doing its action, but also by changing the payload wordlist, you could do more injection based attacks. This means you can modify it, so it can check for SQL Injections, OS Command Injection and so on! – If you do change it, send us a push notification so we can add it! You also get to perform stealth scans by changing the IP before each attack to evade various mechanisms. Features* Supports Stealth Mode using Proxychains, for more reliable attacks against defensive mechanisms
* Automatically fetches URLs from the Wayback Machine
* Filters URLs based on parameters contained in the URLs
* Used httpx to filter only alive URLs and clearing the values for each parameter
* Uses a remote XSS payload list from Github
* Installs all requirements needed depending on the architecture as it gets new updates (Compatible with MacOS, Ubuntu, Debian, Kali)
* Sends GET requests with payload list to URLs
* Detects and reports possible XSS vulnerabilities
* Creates a folder with the domain name to save results
* Prints final message with number of possible vulnerable URLs and a Summary
* Saves result URLs in a file
* Display a random Sun Tzu quote for offensive security
* Check if the user is connected to the internet before running the tool
* Provides a way to append payloads to the URLs
* Output the full URL with payload

This tool with also display a summary feature that displays the total number of possible XSS injections found, along with a list of affected URLs, the payload used, and the response code, at the end.
Trending: Offensive Security Tool: Villain
Trending: Offensive Security Tool: Freeze Requirements* waybackurls: This tool can be installed by running go get github.com/tomnomnom/waybackurls[...]

* cURL: This tool is commonly pre-installed on Kali Linux and Ubuntu, but can be installed by running apt-get install curl on Ubuntu or brew install curl on MacOS
* figlet: This tool can be installed by running apt-get install figlet on Kali Linux or Ubuntu or brew install figlet on MacOS
* lolcat: This tool can be installed by running gem install lolcat
* wget: This tool is commonly pre-installed on Kali Linux and Ubuntu, but can be installed by running apt-get install wget on Ubuntu or brew install wget on MacOS Installationgit clone https://github.com/blackhatethicalhacking/XSSRocket.gitcd XSSRocketchmod +x XSSRocket.sh./XSSRocket.shScreenshotMain Menu

https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Main-Menu-1024x499.png
See Also: Write up: A primer on OS Command Injection Attacks CompatibilityThis tool has been tested on Kali Linux, Ubuntu and MacOS. Payload WordlistTo change the list of payloads, you can edit the tool and set another URL. TO DOAsk the user towards the end, to email the results of the summary.

This is something that we will be using: # Check if there were any affected URLs
if [ -s affected_urls.txt ]; then
echo "A total of $counter possible XSS injections found."
echo "Possible vulnerable URLs:"
cat affected_urls.txt

# Ask user if they want to email the results
read -p "Do you want to email the results? (y/n): " email_results
if [ "$email_results" == "y" ]; then
# Set variables for the email
recipient="example@email.com"
subject="Vulnerability Results from BHEH_FAST_XSS_GPT for $domain"
body="A total of $counter possible XSS injections found.\nPossible vulnerable URLs:\n$(cat affected_urls.txt)"
summary="$(echo -e "$body")"
smtp_url="smtp.mailtrap.io"
smtp_port="2525"
api_key="YOUR_API_KEY"

# Send the email with curl
curl --request POST \
--url "smtp://$smtp_url:$smtp_port" \
--data-urlencode "from=BHEH_FAST_XSS_GPT <from@email.com" \
--data-urlencode "to=$recipient" \
--data-urlencode "subject=$subject" \
--data-urlencode "text=$summary" \
--user "$api_key:"
echo -e "\nEmail sent!"
fi
else
echo "No vulnerabilities found."
fiDisclaimerThis tool is provided for educational and research purpose only. The author of this project are no way responsible for any misuse of this tool. We use it to test under NDA agreements with clients and their consents for pentesting purposes and we never encourage to misuse or take responsibility for any damage caused!
Clone the repo from here: GitHub Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/msprobe-300x150.png Recon Tool: msprobeJanuary 26, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Shotlooter-300x150.png Recon Tool: ShotlooterJanuary 20, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Freeze-300x150.png Offensive Security Tool: FreezeJanuary 13, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Dangerzone-300x150.png Digital Forensics Tool: DangerzoneJanuary 6, 2023 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Offensive Security Tool: XSSRocket first appeared on Black Hat Ethical Hacking.

Dark Reading: Attacks/Breaches
3 Ways ChatGPT Will Change Infosec in 2023

OpenAI's chatbot has the promise to revolutionize how security practitioners work.

Exploit Collector
PHPJabbers Car Rental Script 3.0 SQL Injection

https://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png PHPJabbers Car Rental Script version 3.0 suffers from a remote SQL injection vulnerability.

SHA-256 | da611ec0ad9f60f8789a0b37c087ba77ab18171db28eb201e5d8c4312ef65403Download ┌┌───────────────────────────────────────────────────────────────────────────────────────┐
││ C r a C k E r ┌┘
┌┘ T H E C R A C K O F E T E R N A L M I G H T ││
└───────────────────────────────────────────────────────────────────────────────────────┘┘

┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ [ Vulnerability ] ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
: Author : CraCkEr :
│ Website : PHPJabbers.com │
│ Vendor : PHPJabbers │
│ Software : PHPJabbers Car Rental Script 3.0 │
│ Vuln Type: SQL Injection │
│ Impact : Database Access │
│ │
│────────────────────────────────────────────────────────────────────────────────────────│
│ ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
: :
│ Release Notes: │
│ ═════════════ │
│ │
│ SQL injection attacks can allow unauthorized access to sensitive data, modification of │
│ data and crash the application or make it unavailable, leading to lost revenue and │
│ damage to a company's reputation. │
│ │
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Greets:

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL

CryptoJob (Twitter) twitter.com/CryptozJob

┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ © CraCkEr 2023 ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Path: /index.php

POST parameter 'hour_from' is vulnerable to SQLI

POST parameter 'minutes_to' is vulnerable to SQLI

date_from=27.01.2023&hour_from=[INJECT-HERE]&minutes_from=00&date_to=28.01.2023&hour_to=09&minutes_to=[INJECT-HERE]&pickup_id=4&same_location=1
POST parameter 'col_name' is vulnerable to SQLI

index.php?controller=pjFront&action=pjActionLoadCars&session_id=9j5lonhuljjtcpff7l1qjq5a85&type_id=all&transmission=&col_name=total_price&direction=asc
[-] Done Source:packetstormsecurity.com

Exploit Collector
Micro Focus GroupWise Session ID Disclosure

https://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png
Micro Focus GroupWise is a messaging software for email and personal information management. Trovent Security GmbH discovered that the GroupWise web application transmits the session ID in HTTP GET requests in the URL when email content is accessed. The exposed session ID can be recorded in the browser history of the client and in log files of the web server or reverse proxy server. A possible attacker with access to the browser history or the server log files is able to take control of the user session with the help of the session ID. Versions prior to 18.4.2 are affected.

SHA-256 | 45d877f2bc8d1d68f308fad7fe918c90f982d284964eee41b93805a3c6fb1ad2

Download
# Trovent Security Advisory 2203-01 #
#####################################
Micro Focus GroupWise transmits session ID in URL
#################################################
Overview
########

Advisory ID: TRSA-2203-01
Advisory version: 1.0
Advisory status: Public
Advisory URL: https://trovent.io/security-advisory-2203-01
Affected product: Micro Focus GroupWise
Affected version: prior to 18.4.2
Vendor: Micro Focus, https://www.microfocus.com
Credits: Trovent Security GmbH, Stefan Pietsch
Detailed description
####################

Micro Focus GroupWise is a messaging software for email and personal information
management.
Trovent Security GmbH discovered that the GroupWise web application transmits
the session ID in HTTP GET requests in the URL when email content is accessed.
The exposed session ID can be recorded in the browser history of the client and
in log files of the web server or reverse proxy server.
A possible attacker with access to the browser history or the server log files
is able to take control of the user session with the help of the session ID.

Severity: Medium
CVSS Score: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
CVE ID: CVE-2022-38756
CWE ID: CWE-598
Proof of concept
################

Simplified HTTP request:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
GET /attachment?session=<sessionid&id=... HTTP/1.1
Host: <hostname
...
X-User-Agent: GroupWise Web (18.4.0-139604)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Solution / Workaround
#####################

The vendor released a fixed version of GroupWise.

Fixed in version 18.4.2.
History
#######

2022-03-30: Vulnerability found
2022-08-05: Vendor contacted
2022-10-31: Contacted vendor again
2022-11-01: Vendor replied that the vulnerability will be investigated
2022-11-14: Vendor contacted, asking for status
2022-11-16: Vendor replied that a security bulletin is being prepared
2022-12-06: Vendor published security bulletin
2023-01-27: Advisory published

Source:packetstormsecurity.com

Sensitive Data Exposure: Take Over All Environment

Halo semuanya, kali ini saya mau menceritakan bagaimana saya bisa menemukan sebuah celah pada sebuah website salah satu website restoran…Continue reading on Medium »
Read more...