hacking: security in practice
we have made a dc for people to learn that's actually managed

join if you want, itll be pretty cool https://discord.gg/DV55VvT3 this is an educational server where we can all learn, beginner or experienced!

submitted by /u/Alkely-on-twitter
[link] [comments]

hacking: security in practice
Retrieving My Old iPhone Messages

I used some software to extract messages I deleted when I accidentally restored my entire iPhone years ago, lost some sentimental pictures unfortunately but was still able to retrieve some.

It was some free download that thankfully didn't give me a virus, but I'm wondering if there is slightly better quality software for purchase? My current phone hasn't been restored. The messages were regularly deleted.

Any suggestions would be appreciated.

submitted by /u/BrandyPit
[link] [comments]

Hacking on Medium
TryHackMe | VulnNet:Roasted

A room on TryHackMe created by TheCyb3rW0lf featuring a Windows machine.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Where can I find a trusted hacker?

I understand that the definition of “a reliable hacker” is one that has been tested and one who has delivered both excellently and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Email Spoofing: How it happens and its Remediation

https://cdn-images-1.medium.com/max/797/1*GNWQ0DYQdrhtWJQLy4ug0g.png
What is email Spoofing:

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Juice Jacking Nedir?

https://cdn-images-1.medium.com/max/2600/0*WWgq9uVrBsUJswud
Juice Jacking Nedir? — Juice jacking, virüslü bir USB şarj istasyonunu kullanan kişileri ve bağlı cihazları tehlikeye atmak için…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
NTLM Downgrade Attack: Internal Monologue

In this article, it’s time to explore the scenario where the attacker wants to extract the hash or credentials of the target user but cannot use Mimikatz or any other noisy tool. This attack is called a Downgrade Attack because the attacker downgrades the version of NTLM to extract the

The post NTLM Downgrade Attack: Internal Monologue appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
NTLM Downgrade Attack: Internal Monologue

In this article, it’s time to explore the scenario where the attacker wants to extract the hash or credentials of the target user but cannot use Mimikatz or any other noisy tool. This attack is called a Downgrade Attack because the attacker downgrades the version of NTLM to extract the hash. Table of Content· Introduction· Exploitation· PowerShell Empire Exploitation· Decryption of Hash· ConclusionWhile performing Red Team Operations, it is possible to come across a scenario where the attacker cannot use Mimikatz. This can be because almost all the Antivirus or Malware software are going to detect the presence of Mimikatz as soon as it lands on the Target Machine. This is the scenario where an attacker can perform Internal Monologue Attack. To perform this, attack a tool is required that was developed by Elad Shamirfrom Missing Link Security. GitHub: Internal MonologueYou have the option to compile the executable by yourself by getting the binaries from GitHub. However, for this demonstration, we will be downloading the executable itself. Download InternalMonologue.exeAfter downloading the executable, assuming the attacker holds the initial foothold of the target machine. It is required to transfer the executable to the target machine and run it with certain parameters. The Downgrade parameter should have the value true to downgrade the version. Then the Threads parameter should also hold the true value and finally to perform the Impersonation, the Impersonate parameter value should also be true. Upon successfully running the executable, the attacker is successfully able to extract the downgraded v1 hash of the target user as demonstrated. https://1.bp.blogspot.com/-2PlSKbAcd_k/YKAKfhpcWSI/AAAAAAAAwAM/I23Y[...]

___________________________
@hacking_Attack
@Hacking_Video

HZ71jZgyQ5J22wzK1xgsS2kNrlhpgCLcBGAsYHQ/s16000/1.png PowerShell Empire ExploitationIn case, the attacker decided to compromise the target machine through the PowerShell Empire and has an agent active, then they can perform a downgrade attack directly from PowerShell Empire. Inside the Credentials, the PowerShell Empire has a module by the name of invoke_internal_monologue that essentially performs the same attacker as the executable that was discussed earlier. This method doesn’t involve transferring an executable and running it on the target machine is much stealthier. usemodule credentials/invoke_internal_monologuehttps://1.bp.blogspot.com/-4Be0a4BcK8Y/YKAKkqRtEII/AAAAAAAAwAQ/bXBkNOUPm_8B0ENXuipzYXCPgCbGiU-XACLcBGAsYHQ/s16000/2.png Decryption of HashIn both variants of attacks that were performed earlier. The hash for the raj user was found to be the same and now there are two ways in which this has can be used. Firstly, the attacker can directly use the hash to log in by performing a Pass the Hash. But if the attacker wants, they can crack the hash using John the Ripper. Store the extracted hash of the raj user in a file on the Desktop of our Kali Linux and named its hash. Then using John the Ripper with describing the format to be NetNTLM as demonstrated below. It can be observed that the hash can be cracked. The hash was found to be the password “123”. john –format=netntlm hash --showhttps://1.bp.blogspot.com/-irWV32LPS1Y/YKAKoq542oI/AAAAAAAAwAU/6m6pYKnjFNQUzm8CesS7eYjeqEgzcPUcACLcBGAsYHQ/s16000/3.png ConclusionSometimes, ideas as simple as downgrading the version of the authentication mechanism can serve to be dangerous. As this attack doesn’t require any tools that are on the target of various Defensive Mechanisms it can fly under the radar and get those credentials. This is a testament that Security is ever-evolving and the only way to get ahead of an attacker is to think like one. ___________________________
@hacking_Attack
@Hacking_Video

CIMplant - C# Port Of WMImplant Which Uses Either CIM Or WMI To Query Remote Systems
http://www.kitploit.com/2021/05/cimplant-c-port-of-wmimplant-which-uses.html

___________________________
@hacking_Attack
@Hacking_Video

C# port of WMImplant which uses either CIM or WMI to query remote systems. It can use provided credentials (https://www.kitploit.com/search/label/Credentials) or the current user's session. Note: Some commands will use PowerShell (https://www.kitploit.com/search/label/PowerShell) in combination with WMI, denoted with ** in the --show-commands command.
Introduction
CIMplant is a C# rewrite and expansion on @christruncer (https://twitter.com/christruncer)'s WMImplant (https://github.com/FortyNorthSecurity/WMImplant). It allows you to gather data about a remote system, execute commands, exfil data, and more. The tool allows connections using Windows (https://www.kitploit.com/search/label/Windows) Management (https://www.kitploit.com/search/label/Management) Instrumentation, WMI (https://docs.microsoft.com/en-us/windows/win32/wmisdk/about-wmi), or Common Interface Model, CIM (https://www.dmtf.org/standards/cim) ; well more accurately Windows Management Infrastructure, MI (https://docs.microsoft.com/en-us/previous-versi%20%20%20ons/windows/desktop/wmi_v2/windows-management-infrastructure). CIMplant requires local administrator permissions on the target system.
Setup:
It's probably easiest to use the built version under Releases, just note that it is compiled in Debug mode. If you want to build the solution yourself, follow the steps below. Load CIMplant.sln into Visual Studio Go to Build at the top and then Build Solution if no modifications are wanted
Usage
CIMplant.exe --help
CIMplant.exe --show-commands
CIMplant.exe --show-examples
CIMplant.exe -s [remote IP address] -c cat -f c:\users\user\desktop\file.txt
CIMplant.exe -s [remote IP address] -u [username] -d [domain] -p [password] -c cat -f c:\users\test\desktop\file.txt
CIMplant.exe -s [remote IP address] -u [username] -d [domain] -p [password] -c command_exec --execute "dir c:\\"

Some Helpful Commands

___________________________
@hacking_Attack
@Hacking_Video

Important Files Program.cs This is the brains of the operation, the driver for the program. Connector.cs This is where the initial CIM/WMI connections are made and passed to the rest of the application ExecuteWMI.cs All function code for the WMI commands ExecuteCIM.cs All function code for the CIM (MI) commands
Detection
Of course, the first thing we'll want to be aware of is the initial WMI or CIM connection. In general, WMI uses DCOM as a communication protocol whereas CIM uses WSMan (or, WinRM). This can be modified for CIM, and is in CIMplant, but let's just go over the default values for now. For DCOM, the first thing we can do is look for initial TCP connections over port 135. The connecting and receiving systems will then decide on a new, very high port to use so that will vary drastically. For WSMan, the initial TCP connection is over port 5985. Next, you'll want to look at the Microsoft-Windows-WMI-Activity/Trace event log in the Event Viewer. Search for Event ID 11 and filter on the IsLocal property if possible. You can also look for Event ID 1295 within the Microsoft-Windows-WinRM/Analytic log. Finally, you'll want to look for any modifications to the DebugFilePath property with the Win32_OSRecoveryConfiguration class. More detailed information about detection can be found at Part 1 of our blog series here: CIMplant Part 1: Detection of a C# Implementation of WMImplant (https://fortynorthsecurity.com/blog/cimplant-part-1-detections/)

Download CIMplant (https://github.com/FortyNorthSecurity/CIMplant)

___________________________
@hacking_Attack
@Hacking_Video