Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Tehran and Abu Dhabi Seek Stronger Ties: Iran's Security Chief Holds Talks in the UAE

After years of animosity, UAE and Iran started re-engaging only in 2019. The recent visit of Iran's top security official to the UAE highlights Iran's efforts to strengthen ties with its neighbors amidst growing isolation from the West.

submitted by /u/defensive_reaction
[link] [comments]

6 views11:29

6 views11:52

Hacking Articles Tips Tricks Videos Tutorials

6 views11:52

Hacking Articles Tips Tricks Videos Tutorials

Photo

Black Hat Ethical Hacking
Samsung Users at Risk: 18 Zero-Day Vulnerabilities Found in Exynos Chipsets

Samsung Users at Risk: 18 Zero-Day Vulnerabilities Found in Exynos ChipsetsPost Views: 46 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Google’s Project Zero uncovers 18 zero-day vulnerabilities in Samsung Exynos chipsetsGoogle’s bug-hunting team, Project Zero, has identified 18 zero-day vulnerabilities in Samsung’s Exynos chipsets used in mobile devices, wearables, and cars. These vulnerabilities were discovered between late 2022 and early 2023, and four of them were deemed the most serious. The flaws allow remote code execution from the Internet to the baseband, enabling attackers to compromise vulnerable devices without any user interaction.

The security flaws, including CVE-2023-24033 and three others still awaiting a CVE-ID, were described as “Internet-to-baseband remote code execution (RCE) bugs.” Samsung acknowledged the vulnerability in a security advisory, stating that the baseband software does not properly check the format types of accept-type attribute specified by the SDP, which can lead to denial of service or code execution in Samsung Baseband Modem.
See Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Four of the identified Exynos modem security flaws enable remote code executionTim Willis, the Head of Project Zero, has warned that experienced attackers could easily create an exploit that remotely compromises vulnerable devices without triggering the target’s attention. Due to the high level of access these vulnerabilities provide, Project Zero has delayed disclosure for the four vulnerabilities that allow for Internet-to-baseband remote code execution.

The remaining 14 flaws, including CVE-2023-24072, CVE-2023-24073, CVE-2023-24074, CVE-2023-24075, CVE-2023-24076, and nine others awaiting CVE-IDs, are less critical but still pose a risk. Successful exploitation requires local access or a malicious mobile network operator.
End-users still don't have patches 90 days after report…. https://t.co/dkA9kuzTso

— Maddie Stone (@maddiestone) March 16, 2023
Samsung has already provided security updates addressing these vulnerabilities in impacted chipsets to other vendors. However, patches are not public and can’t be applied by all affected users. Each manufacturer’s patch timeline for their devices will differ. Google, for instance, has already addressed CVE-2023-24033 for impacted Pixel devices in its March 2023 security updates.
Trending: Major Cyber Attacks of 2022
Trending: Offensive Security Tool: CrackQL Google and Samsung urge users to update devices to mitigate Exynos chipset flawsUntil patches are available, users can disable Wi-Fi calling and Voice-over-LTE (VoLTE) to remove the attack vector and thwart baseband RCE exploitation attempts targeting Samsung’s Exynos chipsets in their device. Samsung has confirmed Project Zero’s workaround and encourages end-users to update their devices as soon as possible to ensure that they are running the latest builds that fix both disclosed and undisclosed security vulnerabilities.
Trending: Proof-of-concept for critical Microsoft Word vulnerability published
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/u[...]

6 views11:52

Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking Samsung Users at Risk: 18 Zero-Day Vulnerabilities Found in Exynos Chipsets Samsung Users at Risk: 18 Zero-Day Vulnerabilities Found in Exynos ChipsetsPost Views: 46 Premium Contenthttps://www.blackhatethicalhacking.com/wp-conte…

ploads/2023/03/M.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-7-300x150.png CISA Identifies Critical Vulnerability in Adobe ColdFusionMarch 16, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-6-300x150.png Russian hackers exploit Outlook zero-day vulnerability to target European organizationsMarch 15, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-5-1-300x150.png Kali Linux 2023.1 – Adds Kali Purple for defensive security, python updates, new toolsMarch 14, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-3-1-300x150.png GoBruteforcer: New Golang-based Botnet Malware Scans for and Infects Web ServersMarch 13, 2023 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now! https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Solutions.png Information Security SolutionsFind out how Pentesting Services can help you.
The post Samsung Users at Risk: 18 Zero-Day Vulnerabilities Found in Exynos Chipsets first appeared on Black Hat Ethical Hacking.

12 views11:52

Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking
Offensive Security Tool: Bypass Url Parser

Black Hat Ethical Hacking

Offensive Security Tool: Bypass Url Parser | Black Hat Ethical Hacking

Bypass-url-parser is a tool designed to simplify theprocess of testing URL parsing vulnerabilities in web applications. It tests MANY url bypasses to reach a 40X protected page.

12 views11:52

Hacking Articles Tips Tricks Videos Tutorials

iOS Mobile Application (i.e. .IPA) Vulnerability Assessment and Penetration Testing Walkthrough.

Hi Friends in this blog, I included step-by-step procedures from basics to the execution of test cases for iOS Application Security…Continue reading on Medium »
Read more...

13 views12:58

Hacking Articles Tips Tricks Videos Tutorials

Directory Traversal and LFI worth $400

A Directory Traversal and Local File Inclusion bug couldn’t be simpler than this, which eventually led to a bounty worth $400.Continue reading on Medium »
Read more...

10 views14:29

Hacking Articles Tips Tricks Videos Tutorials

9 views14:52

Hacking Articles Tips Tricks Videos Tutorials

Photo

KitPloit - PenTest Tools!
Wifi_Db - Script To Parse Aircrack-ng Captures To A SQLite Database

https://blogger.googleusercontent.com/img/a/AVvXsEhO52gZbQmL_OEzbU412aIPg_SeOmZWvXlqsbl-pDKOLdVB84rwbBJ4eh-P2m_hQBg0a_o8vk4Upb-hMQ_N06B4E3eA_c3uG1BdNCzWIVO3u8zvSBdoKFf7IaK5_6n4s-2EQ_7sfLQa3bBtuHoE8e_QNAYW9CosUxgbqtqAukbgqa3vbW-i_SwmvXOlmw=w640-h594 Script to parse Aircrack-ng captures into a SQLite database and extract useful information like handshakes (in 22000 hashcat format), MGT identities, interesting relations between APs, clients and it's Probes, WPS information and a global view of all the APs seen.

_   __  _             _  _ 
__      __(_) / _|(_)         __| || |__ 
\ \ /\ / /| || |_ | |        / _` || '_ \ 
\ V  V / | ||  _|| |       | (_| || |_) |
\_/\_/  |_||_|  |_| _____  \__,_||_.__/ 
|_____| 
by r4ulcl

Features* Displays if a network is cloaked (hidden) even if you have the ESSID.
* Shows a detailed table of connected clients and their respective APs.
* Identifies client probes connected to APs, providing insight into potential security risks usin Rogue APs.
* Extracts handshakes for use with hashcat, facilitating password cracking.
* Displays identity information from enterprise networks, including the EAP method used for authentication.
* Generates a summary of each AP group by ESSID and encryption, giving an overview of the security status of nearby networks.
* Provides a WPS info table for each AP, detailing information about the Wi-Fi Protected Setup configuration of the network.
* Logs all instances when a client or AP has been seen with the GPS data and timestamp, enabling location-based analysis.
* Upload files with capture folder or file. This option supports the use of wildcards (*) to select multiple files or folders.
* Docker version in Docker Hub to avoid dependencies.
* Obfuscated mode for demonstrations and conferences.
* Possibility to add static GPS data. InstallFrom DockerHub (RECOMMENDED)docker pull r4ulcl/wifi_dbManual installationDebian based systems (Ubuntu, Kali, Parrot, etc.)Dependencies:

* python3
* python3-pip
* tshark
* hcxtools

sudo apt install tshark
sudo apt install python3 python3-pip

git clone https://github.com/ZerBea/hcxtools.git
cd hcxtools
make 
sudo make install
cd ..

Installation

git clone https://github.com/r4ulcl/wifi_db
cd wifi_db
pip3 install -r requirements.txt

ArchDependencies:

* python3
* python3-pip
* tshark
* hcxtools

sudo pacman -S wireshark-qt
sudo pacman -S python-pip python

git clone https://github.com/ZerBea/hcxtools.git
cd hcxtools
make 
sudo make install
cd ..

Installation

git clone https://github.com/r4ulcl/wifi_db
cd wifi_db
pip3 install -r requirements.txt

UsageScan with airodump-ngRun airodump-ng saving the output with -w: sudo airodump-ng wlan0mon -w scan --manufacturer --wps --gpsdCreate the SQLite database using Docker

#Folder with captures
CAPTURESFOLDER=/home/user/wifi

# Output database
touch db.SQLITE

docker run -t -v $PWD/db.SQLITE:/db.SQLITE -v $CAPTURESFOLDER:/captures/ r4ulcl/wifi_db

* -v $PWD/db.SQLITE:/db.SQLITE: To save de output in current folder db.SQLITE file
* -v $CAPTURESFOLDER:/captures/: To share the folder with the captures with the docker https://blogger.googleusercontent.com/img/a/AVvXsEhO52gZbQmL_OEzbU412aIPg_SeOmZWvXlqsbl-pDKOLdVB84rwbBJ4eh-P2m_hQBg0a_o8vk4Upb-hMQ_N06B4E3eA_c3uG1BdNCzWIVO3u8zvSBdoKFf7IaK5_6n4s-2EQ_7sfLQa3bBtuHoE8e_QNAYW9CosUxgbqtqAukbgqa3vbW-i_SwmvXOlmw=w640-h594 Create the SQLite database using manual installationOnce the capture is created, we can create the database by importing the capture. To do this, put the name of the capture without format. python3 wifi_db.py scan-01In the event that we have multiple ca[...]

8 views14:52

Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools! Wifi_Db - Script To Parse Aircrack-ng Captures To A SQLite Database https://blogger.googleusercontent.com/img/a/AVvXsEhO52gZbQmL_OEzbU412aIPg_SeOmZWvXlqsbl-pDKOLdVB84rwbBJ4eh-P2m_hQBg0a_o8vk4Upb-hMQ_N06B4E3eA_c3uG1BdNCzWIVO3u8zv…

ptures we can load the folder in which they are directly. And with -d we can rename the output database. python3 wifi_db.py -d database.sqlite scan-folderhttps://blogger.googleusercontent.com/img/a/AVvXsEhL-Vaq3y0psRaN7c_eyMvqHukYkNPKRfZPPWwljNybjzlT0zsbeKvXP2lM0fVTZ0dVQIukcYs-57pqIjat843tbV0yWdO1nAwO43J-hnbzsqcqKvo-JQQAPhqvSujFSrzB_BZc14hCY7nZ7QFF31Bo95pbRYY400wDbO1Oi_AgNXHI_D9U0g9aRqSODQ=w640-h478 Open databaseThe database can be open with:

* sqlitebrowser https://blogger.googleusercontent.com/img/a/AVvXsEjPwrhKSOK5BnQ2JmXfkWW4dyotmo1eWC7XUhozQSJgl_j-1xQ6TiH2PSYyY4dFArbcEvS3Sy1otlzgxvh0ZLGSTaE69kf0bH_eihHko90e0D8PSxuiHNZyN7wreG_zOzu4lbduORFc0zrq2uh3qYPpzPVHM2keY-2wS_IeH0pDh_rjF-FbBwlsZ4-K_A=w640-h420 Below is an example of a ProbeClientsConnected table. https://blogger.googleusercontent.com/img/a/AVvXsEgqPKxTR_l4MiEOdb6KlLy7AKeBmK5cYc3qPiLzGp3QsoShCax5pETY8-ESnCH2saQsmfsnJ4DY5dIyGTFvKHZPHY0W36xxYgpQVs6m1KSJ6wXRHc2x-P3IM1HnU2bKL_WCnhyb5N4008yQL9skZhaRGeVDb6uZRnfvPW_bxQbwsCN6n89uEJ9rSxBOOA=w640-h190 Arguments

usage: wifi_db.py [-h] [-v] [--debug] [-o] [-t LAT] [-n LON] [--source [{aircrack-ng,kismet,wigle}]] [-d DATABASE] capture [capture ...]

positional arguments:
capture               capture folder or file with extensions .csv, .kismet.csv, .kismet.netxml, or .log.csv. If no extension is provided, all types will
be added. This option supports the use of wildcards (*) to select multiple files or folders.

options:
-h, --help            show this help message and exit
-v, --verbose         increase output verbosity
--debug               increase output verbosity to debug
-o, --obfuscated      Obfuscate MAC and BSSID with AA:BB:CC:XX:XX:XX-defghi (WARNING: replace all database)
-t LAT, --lat LAT     insert a fake lat in the new elements
-n LON, --lon LON     insert a fake lon i   n the new elements
--source [{aircrack-ng,kismet,wigle}]
source from capture data (default: aircrack-ng)
-d DATABASE, --database DATABASE
output database, if exist append to the given database (default name: db.SQLITE)

KismetTODO WigleTODO Databasewifi_db contains several tables to store information related to wireless network traffic captured by airodump-ng. The tables are as follows:

* AP: This table stores information about the access points (APs) detected during the captures, including their MAC address (bssid), network name (ssid), whether the network is cloaked (cloaked), manufacturer (manuf), channel (channel), frequency (frequency), carrier (carrier), encryption type (encryption), and total packets received from this AP (packetsTotal). The table uses the MAC address as a primary key.

* Client: This table stores information about the wireless clients detected during the captures, including their MAC address (mac), network name (ssid), manufacturer (manuf), device type (type), and total packets received from this client (packetsTotal). The table uses the MAC address as a primary key.

* SeenClient: This table stores information about the clients seen during the captures, including their MAC address (mac), time of detection (time), tool used to capture the data (tool), signal strength (signal_rssi), latitude (lat), longitude (lon), altitude (alt). The table uses the combination of MAC address and detection time as a primary key, and has a foreign key relationship with the Clienttable.

* Connected: This table stores information about the wireless clients that are connected to an access point, including the MAC address of the access point (bssid) and the client (mac). The table uses a combination of access point and client MAC addresses as a primary ke[...]

5 views14:52

Hacking Articles Tips Tricks Videos Tutorials

ptures we can load the folder in which they are directly. And with -d we can rename the output database. python3 wifi_db.py -d database.sqlite scan-folderhttps://blogger.googleusercontent.com/img/a/AVvXsEhL-Vaq3y0psRaN7c_eyMvqHukYkNPKRfZPPWwljNybjzlT0zsbe…

y, and has foreign key relationships with both the APand Clienttables.

* WPS: This table stores information about access points that have Wi-Fi Protected Setup (WPS) enabled, including their MAC address (bssid), network name (wlan_ssid), WPS version (wps_version), device name (wps_device_name), model name (wps_model_name), model number (wps_model_number), configuration methods (wps_config_methods), and keypad configuration methods (wps_config_methods_keypad). The table uses the MAC address as a primary key, and has a foreign key relationship with the APtable.

* SeenAp: This table stores information about the access points seen during the captures, including their MAC address (bssid), time of detection (time), tool used to capture the data (tool), signal strength (signal_rssi), latitude (lat), longitude (lon), altitude (alt), and timestamp (bsstimestamp). The table uses the combination of access point MAC address and detection time as a primary key, and has a foreign key relationship with the APtable.

* Probe: This table stores information about the probes sent by clients, including the client MAC address (mac), network name (ssid), and time of probe (time). The table uses a combination of client MAC address and network name as a primary key, and has a foreign key relationship with the Clienttable.

* Handshake: This table stores information about the handshakes captured during the captures, including the MAC address of the access point (bssid), the client (mac), the file name (file), and the hashcat format (hashcat). The table uses a combination of access point and client MAC addresses, and file name as a primary key, and has foreign key relationships with both the APand Clienttables.

* Identity: This table represents EAP (Extensible Authentication Protocol) identities and methods used in wireless authentication. The bssidand macfields are foreign keys that reference the APand Clienttables, respectively. Other fields include the identity and method used in the authentication process. Views* ProbeClients: This view selects the MAC address of the probe, the manufacturer and type of the client device, the total number of packets transmitted by the client, and the SSID of the probe. It joins the Probeand Clienttables on the MAC address and orders the results by SSID.

* ConnectedAP: This view selects the BSSID of the connected access point, the SSID of the access point, the MAC address of the connected client device, and the manufacturer of the client device. It joins the Connected, AP, and Clienttables on the BSSID and MAC address, respectively, and orders the results by BSSID.

* ProbeClientsConnected: This view selects the BSSID and SSID of the connected access point, the MAC address of the probe, the manufacturer and type of the client device, the total number of packets transmitted by the client, and the SSID of the probe. It joins the Probe, Client, and ConnectedAPtables on the MAC address of the probe, and filters the results to exclude probes that are connected to the same SSID that they are probing. The results are ordered by the SSID of the probe.

* HandshakeAP: This view selects the BSSID of the access point, the SSID of the access point, the MAC address of the client device that performed the handshake, the manufacturer of the client device, the file containing the handshake, and the hashca[...]

4 views14:52

About

Blog

Apps

Platform