Hacking on Medium
Mass mailer attack using Social Engineering Toolkit

https://cdn-images-1.medium.com/max/1000/1*BtGWoh3IWulpP8-_C0mf8w.jpeg
A mass mailer is generally used to send a phishing page link to the email ID of the objective. The aggressor should know about the email…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Generate a QR code attack vector

https://cdn-images-1.medium.com/max/900/1*rm5_JxJKxbgynVJdCrPYmw.jpeg
QR is an organized code in a picture that can be perused by explicit readers that uncover their content or perform divert capacities for…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Follower and Following interchanges due to logical error

Reported on Saturday, 14 March 2020Continue reading on Medium »
Read more...

Page Admin Disclosure through edit history when Group is paused.

Reported: Wednesday, 24 March 2021Continue reading on Medium »
Read more...

Insecure Deserialization: It’s super hard! Or is it?

An often misunderstood vulnerability finally unravelledContinue reading on InfoSec Write-ups »
Read more...

Complex OPEN REDIRECT Exploitation

Hi readers,
Read more...

Pentesting ISP 101 | How I hacked & fixed My ISP

This blog is about the misconfiguration issue in the ISP I was using. While working on Shodan, I discovered that ISP has left WiFi…
Read more...

Follower and Following interchanges due to logical error
https://rajavikrant.medium.com/follower-and-following-interchanges-due-to-logical-error-80134ab42cca?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Reported on Saturday, 14 March 2020Continue reading on Medium » (https://rajavikrant.medium.com/follower-and-following-interchanges-due-to-logical-error-80134ab42cca?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Page Admin Disclosure through edit history when Group is paused.
https://rajavikrant.medium.com/page-admin-disclosure-through-edit-history-when-group-is-paused-9fc24e377e25?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Reported: Wednesday, 24 March 2021Continue reading on Medium » (https://rajavikrant.medium.com/page-admin-disclosure-through-edit-history-when-group-is-paused-9fc24e377e25?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
This subreddit has some interesting information that a lot of people would consider 'spooky deep web stuff'

submitted by /u/iKilledTupacAndX
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
what made you guys decided to go on the deep web?

submitted by /u/Many-Macaron-4486
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

DFIR-O365RC - PowerShell Module For Office 365 And Azure AD Log Collection
http://www.kitploit.com/2021/05/dfir-o365rc-powershell-module-for.html

___________________________
@hacking_Attack
@Hacking_Video

PowerShell module for Office 365 and Azure AD log collection
Module description
The DFIR-O365RC PowerShell (https://www.kitploit.com/search/label/PowerShell) module is a set of functions that allow the DFIR analyst to collect logs relevant for Office 365 Business Email Compromise investigations. The logs are generated in JSON format and retrieved from two main data sources: Office 365 Unified Audit Logs (https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide#search-the-audit-log). Azure AD sign-ins logs (https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-sign-ins) and audit logs (https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-audit-logs). The two data sources can be queried from different endpoints: Data source / Endpoint History Performance Scope Pre-requisites (OS or Azure) Unified Audit Logs / Exchange Online PowerShell (https://docs.microsoft.com/en-us/powershell/module/exchange/search-unifiedauditlog?view=exchange-ps) 90 days Poor All Office 365 logs (Azure AD included) None Unified Audit Logs / Office 365 (https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-apis-overview)Management (https://www.kitploit.com/search/label/Management) API 7 days Good All Office 365 logs (Azure AD included) Azure App registration Azure AD Logs / Azure AD PowerShell Preview (https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-powershell-reporting) 30 days Good Azure AD sign-ins and audit events only Windows OS only Azure AD Logs / MS Graph API (https://docs.microsoft.com/en-us/graph/api/overview?view=graph-rest-1.0) 30 days Good Azure AD sign-ins and audit events only None DFIR-O365RC is a forensic tool, its aim is not to monitor in real time your Office 365 infrastructure: Please use the Office 365 Management API if you want to analyze data in real time with a SIEM. DFIR-O365RC will fetch data from: Azure AD Logs using the MS Graph API because performance (https://www.kitploit.com/search/label/Performance) is good, history is 30 days and it works on PowerShell Core. Unified Audit Logs using Exchange online PowerShell despite poor performance, history is 90 days and it works on PowerShell Core. In case you are also investigating other Azure resources (IaaS, PaaS...) DFIR-O365RC can also fetch data from Azure Activity logs (https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log) using the Azure Monitor RESTAPI (https://docs.microsoft.com/en-us/rest/api/monitor/). History is 90 days and it works on PowerShell Core. As a result, DFIR-O365RC works also on Linux or Mac, as long as you have PowerShell Core and a browser in order to use device login.
Installation and pre-requisites
Clone the DFIR-O365RC repository. The tool works on PowerShell Desktop and PowerShell Core. DFIR-O365 uses Jason Thompson's MSAL.PS (https://github.com/AzureAD/MSAL.PS) and Boe Prox's PoshRSJob (https://github.com/proxb/PoshRSJob) modules. To install them run the following commands: Install-Module -Name MSAL.PS -RequiredVersion '4.21.0.1'
Install-Module -Name PoshRSJob -RequiredVersion '1.7.4.4'
If MSAL.PS (https://github.com/AzureAD/MSAL.PS) module installation fails with the following message: WARNING: The specified module ‘MSAL.PS’ with PowerShellGetFormatVersion ‘2.0’ is not supported by the current version of PowerShellGet. Get the latest version of the PowerShellGet module to install this module, ‘MSAL.PS’.
Update PowerShellGet with the following commands: Install-PackageProvider Nuget -Force
Install-Module -Name PowerShellGet -Force
Once both modules are installed, launch a PowerShell prompt and locate your Powershell modules path with the following command: PS> $env:PSModulePath

___________________________
@hacking_Attack
@Hacking_Video

Copy the DFIR-O365RC directory in one of your modules path, for example on Windows: %USERPROFILE%\Documents\WindowsPowerShell\Modules %ProgramFiles%\WindowsPowerShell\Modules %SYSTEMROOT%\system32\WindowsPowerShell\v1.0\Modules Modules path examples on Linux: /home/%USERNAME%/.local/share/powershell/Modules /usr/local/share/powershell/Modules /opt/microsoft/powershell/7/Modules The DFIR-O365RC module is installed, restart the PowerShell prompt and load the module: PS> Import-module DFIR-O365RC

Roles and license requirements (https://www.kitploit.com/search/label/Requirements)
The user launching the tool should have the following roles: Microsoft 365 role (portal.microsoft.com): Global reader Exchange Online role (outlook.office365.com/ecp): View-Only Audit Logs In order to retrieve Azure AD sign-ins logs (https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-sign-ins) with the MS Graph API you need at least one user with an Azure AD Premium P1 (https://azure.microsoft.com/en-us/pricing/details/active-directory/) license. This license can be purchased at additional cost for a single user and is sometimes included in some license plans such as the Microsoft 365 Business Premium for small and medium-sized businesses. If you need to retrieve also the Azure Activity logs you need the Log Analytics Reader role for the Azure subscription you are dumping the logs from.
Functions included in the module
The module has 6 functions: Function name Data Source/History Performance Completeness Details Get-O365Full Unified audit logs/90 days Poor All unified audit logs A subset of logs per record type can be retrieved. Use only on a small tenant or a short period of time Get-O365Light Unified audit logs/90 days Good A subset of unified audit logs only Only a subset of operations considered of interest is retrieved. Get-DefenderforO365 Unified audit logs/90 days Good A subset of unified audit logs only Retrieves Defender for Office 365 related logs. Requires at least an E5 license (https://www.microsoft.com/en-us/microsoft-365/enterprise/office-365-e5?activetab=pivot:overviewtab) or a license plan such as Microsoft Defender for Office 365 Plan (https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/office-365-atp?view=o365-worldwide#microsoft-defender-for-office-365-plan-1-and-plan-2) or cloud app security (https://www.microsoft.com/en-us/microsoft-365/enterprise-mobility-security/cloud-app-security) Get-AADLogs Azure AD Logs/30 days Good All Azure AD logs Get tenant general information, all Azure sign-ins and audit logs. Azure AD sign-ins logs have more information than Azure AD logs retrieved via Unified audit logs. Get-AADApps Azure AD Logs/30 days Good A subset of Azure AD logs only Get Azure audit logs related to Azure applications and service principals only. The logs are enriched with application or service principal object information. Get-AADDevices Azure AD Logs/30 days Good A subset of Azure AD logs only Get Azure audit logs related to Azure AD joined or registered devices only. The logs are enriched with device object information. Search-O365 Unified audit logs/90 days Depends on the query A subset of unified audit logs only Search for activity related to a particular user, IP address or use the freetext query. Get-AzRMActivityLogs Azure Activity logs/90 days Good All Azure Activity logs Get all Azure activity logs for a given subscription or on every subscription the account running the function has access to When querying Unified audit logs you are limited to 3 concurrent Exchange Online Powershell sessions. DFIR-O365RC will try to use all available sessions, please close any existing session before launching the log collection. Each function as a comment based help which you can invoke with the get-help cmdlet. #Display comment based help

___________________________
@hacking_Attack
@Hacking_Video