KitPloit - PenTest Tools!
Red-Kube - Red Team K8S Adversary Emulation Based On Kubectl

https://1.bp.blogspot.com/-tlThzaGqk70/YJhYhLfRkwI/AAAAAAAAWKQ/yY9iirGTQUYvt1PmgMk6-bCI4wrjCmwZQCNcBGAsYHQ/w400-h400/red-kube_1_redcube.png Red Kube is a collection of kubectl commands written to evaluate the security posture of Kubernetes clusters from the attacker's perspective.

The commands are either passive for data collection and information disclosure or active for performing real actions that affect the cluster.

The commands are mapped to MITRE ATT&CK Tactics to help get a sense of where we have most of our gaps and prioritize our findings.

The current version is wrapped with a python orchestration module to run several commands in one run based on different scenarios or tactics.

Please use with care as some commands are active and actively deploy new containers or change the role-based access control configuration.

Warning: You should NOT use red-kube commands on a Kubernetes cluster that you don't own! Prerequisites:python3 requirements pip3 install -r requirements.txtkubectl (Ubuntu / Debian) sudo apt-get update
sudo apt-get install -y apt-transport-https ca-certificates curl
sudo curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg
echo "deb [signed-by=/usr/share/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list
sudo apt-get update
sudo apt-get install -y kubectlkubectl (Red Hat based) cat <eof/etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
EOF
yum install -y kubectljq sudo apt-get update -y
sudo apt-get install -y jqUsageusage: python3 main.py [-h] [--mode active/passive/all] [--tactic TACTIC_NAME] [--show_tactics] [--cleanup]

required arguments:
--mode run kubectl commands which are active / passive / all modes
--tactic choose tactic

other arguments:
-h --help show this help message and exit
--show_tactics show all tactics Commands by MITRE ATT&CK TacticsTactic Count Reconnaissance 2 Initial Access 0 Execution 0 Persistence 2 Privilege Escalation 4 Defense Evasion 1 Credential Access 8 Discovery 15 Lateral Movement 0 Collection 1 Command and Control 2 Exfiltration 1 Impact 0 Webinars1 First Workshop with Lab01 and Lab02 Webinar Link

2 Second Workshop with Lab03 and Lab04 Webinar Link PresentationsBlackHat Asia 2021 Q&AWhy choosing kubectl and not using the kubernetes api in python?

When performing red team assessments and adversary emulations, the quick manipulations and tweaks for the tools used in the arsenal are critical.

The ability to run such assessments and combine the k8s attack techniques based on kubectl and powerful Linux commands reduces the time and effort significantly. Contact UsThis research was held by Lightspin's Security Research Team. For more information, contact us at support@lightspin.io. Download Red-Kube

hacking: security in practice
The World Famous Hacker Group Announced The Launch Of Its Own Virtual Currency

https://external-preview.redd.it/9bc6I8q4B0gtsf_8mO6V6Xz3e-gaht0NatGfqz_YI-c.jpg?width=216&crop=smart&auto=webp&s=46d78db61c8538b2f09d279ea3892fd6d563650e submitted by /u/om362
[link] [comments]

hacking: security in practice
Cyber Security Analyst Community

Hey all, hope you're having great weekend. Quick poll here, we've had a suggestion by one of our analysts to start up a discord server to discuss malware, conduct analysis, share iocs and anything else we can do to help other analysts or new joiners in the field.

Is this something you'd be interested in?

View Poll

submitted by /u/_Forever_Learning
[link] [comments]

Hacking on Medium
How to Hack Almost Any Laptop

https://cdn-images-1.medium.com/max/2600/1*qorUudPtQ3Ouky2CYtsDjw.jpeg
Instructions to regain access to a MacBook, Linux-based or Windows-based system

Continue reading on ILLUMINATION »

Hacking on Medium
How to prevent more than 200 million users from using Google services

Note: all bugs in this write-up still exist, and you can reproduce them in https://community.appsheet.com

Continue reading on Medium »

Hacking on Medium
Assembly Language x86_64 basics | 0x04 | Bin Exp#4

https://cdn-images-1.medium.com/max/2240/1*IWIkhkTcvgPOdNkLH77xPg.png
Hi friends, in the last blog I wrote about the compilation process of C. In this blog, we going to see the basics of x86_64 Assembly…

Continue reading on Medium »

Hacking on Medium
Open Source Low Code Development Platform (LCDP)

https://cdn-images-1.medium.com/max/1920/1*O5a_N2d6moxH6uqnYdpYsw.png
LCDP for rapid web application development and sharing of machine learning models.

Continue reading on Medium »

Red-Kube - Red Team K8S Adversary Emulation Based On Kubectl
http://www.kitploit.com/2021/05/red-kube-red-team-k8s-adversary.html

___________________________
@hacking_Attack
@Hacking_Video

Red Kube is a collection of kubectl commands written to evaluate the security posture of Kubernetes (https://www.kitploit.com/search/label/Kubernetes) clusters from the attacker's perspective. The commands are either passive for data collection and information disclosure (https://www.kitploit.com/search/label/Information%20Disclosure) or active for performing real actions that affect the cluster. The commands are mapped to MITRE ATT&CK Tactics to help get a sense of where we have most of our gaps and prioritize our findings. The current version is wrapped with a python orchestration module to run several commands in one run based on different scenarios or tactics. Please use with care as some commands are active and actively deploy new containers (https://www.kitploit.com/search/label/Containers) or change the role-based access control configuration. Warning: You should NOT use red-kube commands on a Kubernetes cluster that you don't own!
Prerequisites:
python3 requirements pip3 install -r requirements.txt kubectl (Ubuntu / Debian) sudo apt-get update
sudo apt-get install -y apt-transport-https ca-certificates curl
sudo curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg
echo "deb [signed-by=/usr/share/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list
sudo apt-get update
sudo apt-get install -y kubectl kubectl (Red Hat based) cat < /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
EOF
yum install -y kubectl jq sudo apt-get update -y
sudo apt-get install -y jq
Usage
usage: python3 main.py [-h] [--mode active/passive/all] [--tactic TACTIC_NAME] [--show_tactics] [--cleanup]

required arguments:
--mode run kubectl commands which are active / passive / all modes
--tactic choose tactic

other arguments:
-h --help show this help message and exit
--show_tactics show all tactics

Commands by MITRE ATT&CK Tactics
Tactic Count Reconnaissance 2 Initial Access 0 Execution 0 Persistence 2 Privilege Escalation 4 Defense Evasion 1 Credential Access 8 Discovery 15 Lateral Movement 0 Collection 1 Command and Control 2 Exfiltration 1 Impact 0
Webinars
1 First Workshop with Lab01 and Lab02 Webinar Link (https://www.lightspin.io/kubernetes-security-concepts-workshop) 2 Second Workshop with Lab03 and Lab04 Webinar Link (https://www.lightspin.io/webishop-specific-container-security-in-kubernetes)
Presentations
BlackHat Asia 2021 (https://www.blackhat.com/asia-21/arsenal/schedule/#red-kube-22401)
Q&A
Why choosing kubectl and not using the kubernetes api in python? When performing red team assessments and adversary emulations, the quick manipulations and tweaks for the tools used in the arsenal are critical. The ability to run such assessments and combine the k8s attack techniques based on kubectl and powerful Linux commands reduces the time and effort significantly.
Contact Us
This research was held by Lightspin's Security Research Team. For more information, contact us at support@lightspin.io (mailto:support@lightspin.io).

Download Red-Kube (https://github.com/lightspin-tech/red-kube)

___________________________
@hacking_Attack
@Hacking_Video

Building your own evil HID injector USB cable
https://www.reddit.com/r/redteamsec/comments/ndqlza/building_your_own_evil_hid_injector_usb_cable/

submitted by /u/The-Luemmel (https://www.reddit.com/user/The-Luemmel)
[link] (https://luemmelsec.github.io/Building-An-Evil-USB-Cable/) [comments] (https://www.reddit.com/r/redteamsec/comments/ndqlza/building_your_own_evil_hid_injector_usb_cable/)

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Can't find something on Tor which is important to me

Several days ago, a massive DC Washington MPD database was leaked, now it's public info, the hackers posted it on Tor. The thing is that there is one of my family member case in it.

Somebody has the link to it (actually more than 4k ppl have a link to it) and try to sell me that for 500 dollars, but i can't afford the money rn.

I was questioning myself, how can i find it on Tor ? I just have the beggining of the link which goes like this : flhnknbdg7yddsu3gj5lyn2wjkb3mmuoatmi5z5qe2o then i don't know the rest of it

submitted by /u/ShuttingOP
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How to Bruteforce Android Pin?????
https://www.reddit.com/r/Pentesting/comments/ndtbn0/how_to_bruteforce_android_pin/

submitted by /u/Green-Ad274 (https://www.reddit.com/user/Green-Ad274)
[link] (https://www.reddit.com/r/Pentesting/comments/ndtbn0/how_to_bruteforce_android_pin/) [comments] (https://www.reddit.com/r/Pentesting/comments/ndtbn0/how_to_bruteforce_android_pin/)

___________________________
@hacking_Attack
@Hacking_Video