Directory Traversal and LFI worth $400

A Directory Traversal and Local File Inclusion bug couldn’t be simpler than this, which eventually led to a bounty worth $400.Continue reading on Medium »
Read more...

KitPloit - PenTest Tools!
Wifi_Db - Script To Parse Aircrack-ng Captures To A SQLite Database

https://blogger.googleusercontent.com/img/a/AVvXsEhO52gZbQmL_OEzbU412aIPg_SeOmZWvXlqsbl-pDKOLdVB84rwbBJ4eh-P2m_hQBg0a_o8vk4Upb-hMQ_N06B4E3eA_c3uG1BdNCzWIVO3u8zvSBdoKFf7IaK5_6n4s-2EQ_7sfLQa3bBtuHoE8e_QNAYW9CosUxgbqtqAukbgqa3vbW-i_SwmvXOlmw=w640-h594 Script to parse Aircrack-ng captures into a SQLite database and extract useful information like handshakes (in 22000 hashcat format), MGT identities, interesting relations between APs, clients and it's Probes, WPS information and a global view of all the APs seen. _ __ _ _ _
__ __(_) / _|(_) __| || |__
\ \ /\ / /| || |_ | | / _` || '_ \
\ V V / | || _|| | | (_| || |_) |
\_/\_/ |_||_| |_| _____ \__,_||_.__/
|_____|
by r4ulcl Features* Displays if a network is cloaked (hidden) even if you have the ESSID.
* Shows a detailed table of connected clients and their respective APs.
* Identifies client probes connected to APs, providing insight into potential security risks usin Rogue APs.
* Extracts handshakes for use with hashcat, facilitating password cracking.
* Displays identity information from enterprise networks, including the EAP method used for authentication.
* Generates a summary of each AP group by ESSID and encryption, giving an overview of the security status of nearby networks.
* Provides a WPS info table for each AP, detailing information about the Wi-Fi Protected Setup configuration of the network.
* Logs all instances when a client or AP has been seen with the GPS data and timestamp, enabling location-based analysis.
* Upload files with capture folder or file. This option supports the use of wildcards (*) to select multiple files or folders.
* Docker version in Docker Hub to avoid dependencies.
* Obfuscated mode for demonstrations and conferences.
* Possibility to add static GPS data. InstallFrom DockerHub (RECOMMENDED)docker pull r4ulcl/wifi_dbManual installationDebian based systems (Ubuntu, Kali, Parrot, etc.)Dependencies:

* python3
* python3-pip
* tshark
* hcxtools sudo apt install tshark
sudo apt install python3 python3-pip

git clone https://github.com/ZerBea/hcxtools.git
cd hcxtools
make
sudo make install
cd ..Installation git clone https://github.com/r4ulcl/wifi_db
cd wifi_db
pip3 install -r requirements.txt ArchDependencies:

* python3
* python3-pip
* tshark
* hcxtools sudo pacman -S wireshark-qt
sudo pacman -S python-pip python

git clone https://github.com/ZerBea/hcxtools.git
cd hcxtools
make
sudo make install
cd ..Installation git clone https://github.com/r4ulcl/wifi_db
cd wifi_db
pip3 install -r requirements.txt UsageScan with airodump-ngRun airodump-ng saving the output with -w: sudo airodump-ng wlan0mon -w scan --manufacturer --wps --gpsdCreate the SQLite database using Docker#Folder with captures
CAPTURESFOLDER=/home/user/wifi

# Output database
touch db.SQLITE

docker run -t -v $PWD/db.SQLITE:/db.SQLITE -v $CAPTURESFOLDER:/captures/ r4ulcl/wifi_db* -v $PWD/db.SQLITE:/db.SQLITE: To save de output in current folder db.SQLITE file
* -v $CAPTURESFOLDER:/captures/: To share the folder with the captures with the docker https://blogger.googleusercontent.com/img/a/AVvXsEhO52gZbQmL_OEzbU412aIPg_SeOmZWvXlqsbl-pDKOLdVB84rwbBJ4eh-P2m_hQBg0a_o8vk4Upb-hMQ_N06B4E3eA_c3uG1BdNCzWIVO3u8zvSBdoKFf7IaK5_6n4s-2EQ_7sfLQa3bBtuHoE8e_QNAYW9CosUxgbqtqAukbgqa3vbW-i_SwmvXOlmw=w640-h594 Create the SQLite database using manual installationOnce the capture is created, we can create the database by importing the capture. To do this, put the name of the capture without format. python3 wifi_db.py scan-01In the event that we have multiple ca[...]

ptures we can load the folder in which they are directly. And with -d we can rename the output database. python3 wifi_db.py -d database.sqlite scan-folderhttps://blogger.googleusercontent.com/img/a/AVvXsEhL-Vaq3y0psRaN7c_eyMvqHukYkNPKRfZPPWwljNybjzlT0zsbeKvXP2lM0fVTZ0dVQIukcYs-57pqIjat843tbV0yWdO1nAwO43J-hnbzsqcqKvo-JQQAPhqvSujFSrzB_BZc14hCY7nZ7QFF31Bo95pbRYY400wDbO1Oi_AgNXHI_D9U0g9aRqSODQ=w640-h478 Open databaseThe database can be open with:

* sqlitebrowser https://blogger.googleusercontent.com/img/a/AVvXsEjPwrhKSOK5BnQ2JmXfkWW4dyotmo1eWC7XUhozQSJgl_j-1xQ6TiH2PSYyY4dFArbcEvS3Sy1otlzgxvh0ZLGSTaE69kf0bH_eihHko90e0D8PSxuiHNZyN7wreG_zOzu4lbduORFc0zrq2uh3qYPpzPVHM2keY-2wS_IeH0pDh_rjF-FbBwlsZ4-K_A=w640-h420 Below is an example of a ProbeClientsConnected table. https://blogger.googleusercontent.com/img/a/AVvXsEgqPKxTR_l4MiEOdb6KlLy7AKeBmK5cYc3qPiLzGp3QsoShCax5pETY8-ESnCH2saQsmfsnJ4DY5dIyGTFvKHZPHY0W36xxYgpQVs6m1KSJ6wXRHc2x-P3IM1HnU2bKL_WCnhyb5N4008yQL9skZhaRGeVDb6uZRnfvPW_bxQbwsCN6n89uEJ9rSxBOOA=w640-h190 Argumentsusage: wifi_db.py [-h] [-v] [--debug] [-o] [-t LAT] [-n LON] [--source [{aircrack-ng,kismet,wigle}]] [-d DATABASE] capture [capture ...]

positional arguments:
capture capture folder or file with extensions .csv, .kismet.csv, .kismet.netxml, or .log.csv. If no extension is provided, all types will
be added. This option supports the use of wildcards (*) to select multiple files or folders.

options:
-h, --help show this help message and exit
-v, --verbose increase output verbosity
--debug increase output verbosity to debug
-o, --obfuscated Obfuscate MAC and BSSID with AA:BB:CC:XX:XX:XX-defghi (WARNING: replace all database)
-t LAT, --lat LAT insert a fake lat in the new elements
-n LON, --lon LON insert a fake lon i n the new elements
--source [{aircrack-ng,kismet,wigle}]
source from capture data (default: aircrack-ng)
-d DATABASE, --database DATABASE
output database, if exist append to the given database (default name: db.SQLITE)KismetTODO WigleTODO Databasewifi_db contains several tables to store information related to wireless network traffic captured by airodump-ng. The tables are as follows:

* AP: This table stores information about the access points (APs) detected during the captures, including their MAC address (bssid), network name (ssid), whether the network is cloaked (cloaked), manufacturer (manuf), channel (channel), frequency (frequency), carrier (carrier), encryption type (encryption), and total packets received from this AP (packetsTotal). The table uses the MAC address as a primary key.

* Client: This table stores information about the wireless clients detected during the captures, including their MAC address (mac), network name (ssid), manufacturer (manuf), device type (type), and total packets received from this client (packetsTotal). The table uses the MAC address as a primary key.

* SeenClient: This table stores information about the clients seen during the captures, including their MAC address (mac), time of detection (time), tool used to capture the data (tool), signal strength (signal_rssi), latitude (lat), longitude (lon), altitude (alt). The table uses the combination of MAC address and detection time as a primary key, and has a foreign key relationship with the Clienttable.

* Connected: This table stores information about the wireless clients that are connected to an access point, including the MAC address of the access point (bssid) and the client (mac). The table uses a combination of access point and client MAC addresses as a primary ke[...]

y, and has foreign key relationships with both the APand Clienttables.

* WPS: This table stores information about access points that have Wi-Fi Protected Setup (WPS) enabled, including their MAC address (bssid), network name (wlan_ssid), WPS version (wps_version), device name (wps_device_name), model name (wps_model_name), model number (wps_model_number), configuration methods (wps_config_methods), and keypad configuration methods (wps_config_methods_keypad). The table uses the MAC address as a primary key, and has a foreign key relationship with the APtable.

* SeenAp: This table stores information about the access points seen during the captures, including their MAC address (bssid), time of detection (time), tool used to capture the data (tool), signal strength (signal_rssi), latitude (lat), longitude (lon), altitude (alt), and timestamp (bsstimestamp). The table uses the combination of access point MAC address and detection time as a primary key, and has a foreign key relationship with the APtable.

* Probe: This table stores information about the probes sent by clients, including the client MAC address (mac), network name (ssid), and time of probe (time). The table uses a combination of client MAC address and network name as a primary key, and has a foreign key relationship with the Clienttable.

* Handshake: This table stores information about the handshakes captured during the captures, including the MAC address of the access point (bssid), the client (mac), the file name (file), and the hashcat format (hashcat). The table uses a combination of access point and client MAC addresses, and file name as a primary key, and has foreign key relationships with both the APand Clienttables.

* Identity: This table represents EAP (Extensible Authentication Protocol) identities and methods used in wireless authentication. The bssidand macfields are foreign keys that reference the APand Clienttables, respectively. Other fields include the identity and method used in the authentication process. Views* ProbeClients: This view selects the MAC address of the probe, the manufacturer and type of the client device, the total number of packets transmitted by the client, and the SSID of the probe. It joins the Probeand Clienttables on the MAC address and orders the results by SSID.

* ConnectedAP: This view selects the BSSID of the connected access point, the SSID of the access point, the MAC address of the connected client device, and the manufacturer of the client device. It joins the Connected, AP, and Clienttables on the BSSID and MAC address, respectively, and orders the results by BSSID.

* ProbeClientsConnected: This view selects the BSSID and SSID of the connected access point, the MAC address of the probe, the manufacturer and type of the client device, the total number of packets transmitted by the client, and the SSID of the probe. It joins the Probe, Client, and ConnectedAPtables on the MAC address of the probe, and filters the results to exclude probes that are connected to the same SSID that they are probing. The results are ordered by the SSID of the probe.

* HandshakeAP: This view selects the BSSID of the access point, the SSID of the access point, the MAC address of the client device that performed the handshake, the manufacturer of the client device, the file containing the handshake, and the hashca[...]

t output. It joins the Handshake, AP, and Clienttables on the BSSID and MAC address, respectively, and orders the results by BSSID.

* HandshakeAPUnique: This view selects the BSSID of the access point, the SSID of the access point, the MAC address of the client device that performed the handshake, the manufacturer of the client device, the file containing the handshake, and the hashcat output. It joins the Handshake, AP, and Clienttables on the BSSID and MAC address, respectively, and filters the results to exclude handshakes that were not cracked by hashcat. The results are grouped by SSID and ordered by BSSID.

* IdentityAP: This view selects the BSSID of the access point, the SSID of the access point, the MAC address of the client device that performed the identity request, the manufacturer of the client device, the identity string, and the method used for the identity request. It joins the Identity, AP, and Clienttables on the BSSID and MAC address, respectively, and orders the results by BSSID.

* SummaryAP: This view selects the SSID, the count of access points broadcasting the SSID, the encryption type, the manufacturer of the access point, and whether the SSID is cloaked. It groups the results by SSID and orders them by the count of access points in descending order. TODO*
Aircrack-ng

*
All in 1 file (and separately)

*
Kismet

*
Wigle

*
install

*
parse all files in folder -f --folder

*
Fix Extended errors, tildes, etc (fixed in aircrack-ng 1.6)

*
Support bash multi files: "capture*-1*"

*
Script to delete client or AP from DB (mac). - (Whitelist)

*
Whitelist to don't add mac to DB (file whitelist.txt, add macs, create DB)

*
Overwrite if there is new info (old ESSID='', New ESSID='WIFI')

*
Table Handhsakes and PMKID

*
Hashcat hash format 22000

*
Table files, if file exists skip (full path)

*
Get HTTP POST passwords

*
DNS querys
This program is a continuation of a part of: https://github.com/T1GR3S/airo-heat Author* Raúl Calvo Laorden (@r4ulcl) LicenseGNU General Public License v3.0 Download Wifi_Db

Hacking on Medium
Cybersecurity and the need for advanced security measures.

https://cdn-images-1.medium.com/max/2600/1*12O86p4WcSAdI1CDHonBvg.jpeg
Introduction to Cybersecurity

Continue reading on Medium »

Hacking on Medium
GM

Gm to the security community and the world we secure.

Continue reading on Medium »

Hacking on Medium
An antivirus is a software program designed to detect, prevent, and remove malicious software…

https://cdn-images-1.medium.com/max/600/1*EUUVB419hy651yKpIYXCIg.jpeg
Antivirus software works by scanning your device and identifying any suspicious files or activities. It compares these files to a database…

Continue reading on Medium »

Hacking on Medium
MQTT (Mosquitto)

https://cdn-images-1.medium.com/max/810/1*D1v2wySfIvUQoMrGwZEZRA.png
Today we are going to take look at port 1883 mosquitto. We started off on a box and from outside the network, so I ran an NMAP scan on the…

Continue reading on System Weakness »

hacking: security in practice
Why there is no "Enter password" in BitLocker configuration? Is BitLocker's PIN option secure enough?

I intended to encrypt my SSD with BitLocker using my own strong password, but I only have the option to:

* enter a PIN
* insert a USB
* let BitLocker automatically unlock my drive

I'm wondering why I can't use a strong password to encrypt my drive, and instead, I have to use a PIN number. I am able to do this with my pendrive or other fixed data drives, but not with the one that has my operating system installed. Is this due to the TPM module?

I want to enter BitLocker password every time when PC starts to prevent it from thieves and secure my files. Is using an 8-digits PIN enough and safe option? Can't someone brute-force it?

submitted by /u/EliteSkylu
[link] [comments]

Dark Reading: Attacks/Breaches
The Ethics of Network and Security Monitoring

The chances of getting hacked are no longer low. Companies need to rethink their data collection and monitoring strategies to protect employee privacy and corporate integrity.

Dark Reading: Attacks/Breaches
Low-Budget 'Winter Vivern' APT Awakens After 2-Year Hibernation

The "underreported" APT has returned to focus after attacks promoting Russian and Belarusian government interests and going after targets with humor, zest, and scrappiness.

Dark Reading: Attacks/Breaches
Meta Proposes Revamped Approach to Online Kill Chain Frameworks

A more holistic model beyond MITRE et al is needed to help defenders better identify and understand commonalities in different online threat campaigns, the Facebook parent company says.

Blockchain Technology: The Importance of an Upgrade — By CyBirb

Blockchain technology has revolutionized the way we think about data storage and security. It has enabled the creation of a decentralized…Continue reading on Medium »
Read more...