Hacking on Medium
Who’s in your Facebook and Instagram accounts?

https://cdn-images-1.medium.com/max/2600/0*PNSVxX7rJ4GB3_rP
What to do if you receive a notification about a suspicious login to your Facebook or Instagram account.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Windows PoC Exploit Released for Wormable RCE

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Windows PoC Exploit Released for Wormable RCEPost Views: 127
Reading Time: 1 Minute
A researcher has released a proof-of-concept (PoC) exploit for CVE-2021-31166, a use-after-free, highly critical vulnerability in the HTTP protocol stack (http.sys) that could lead to wormable remote code execution (RCE).
Microsoft discovered the flaw internally, releasing a patch in its May 11 Patch Tuesday update. This was the most severe bug in that batch: an http.sysissue that requires neither user authentication nor user interaction to exploit. An exploit would allow RCE with kernel privileges or a denial-of-service (DoS) attack.

According to a tweet from Microsoft’s Justin Campbell, the vulnerability was found by @_mxms and @fzzyhd1.
Fortunately this http.sys bug was an internal find by our team. This one thanks to @_mxms, @fzzyhd1 and everyone who contributes to our tooling and automation. https://t.co/0ru9BQMaJ9

— Justin Campbell (@metr0) May 13, 2021
See Also: Microsoft, Google Clouds Hijacked for Gobs of Phishing http.sysenables Windows and applications to communicate with other devices; it can be run standalone or in conjunction with Internet Information Services (IIS). Microsoft Advises Priority Patching“In most situations, an unauthenticated attacker could send a specially crafted packet to a targeted server utilizing the HTTP Protocol Stack (http.sys) to process packets,” Microsoft explained in its advisory. Given that the vulnerability is wormable, Microsoft recommends prioritizing the patching of affected servers.

“With a CVSS score of 9.8, the vulnerability announced has the potential to be both directly impactful and is also exceptionally simple to exploit, leading to a remote and unauthenticated denial-of-service (Blue Screen of Death) for affected products,” McAfee’s Steve Povolny said in an analysis of the flaw at the time.

Povolny explained that the problem lies in how Windows improperly tracks pointers while processing objects in network packets containing HTTP requests. The vulnerability only affects the latest versions of Windows 10 and Windows Server, meaning that the exposure for internet-facing enterprise servers is “fairly limited,” he said. That’s because many of these systems run Long Term Servicing Channel (LTSC) versions, such as Windows Server 2016 and 2019, which aren’t susceptible to this flaw. Public Exploit for Wormable Security BugResearcher Axel Souchet, who used to work for Microsoft, published the PoC to GitHub, noting that the bug happens in http!UlpParseContentCoding, where the function has a local LIST_ENTRYand appends an item to it. “When it’s done, it moves it into the Request structure; but it doesn’t NULLout the local list,” he explained. “The issue with that is that an attacker can trigger a code path that frees every [entry] of the local list, leaving them dangling in the Request object.”
See Also: Offensive Security Tool: EyeWitness This isn’t the first PoC exploit for CVE-2021-31166 that Souchet has released, but this is the first wormable one. Over the weekend, he released a PoC that only locked the impacted Windows system as long as it’s running an IIS server. That initial exploit shows how an attacker can leverage the flaw to cause DoS on a targeted system by sending it specially crafted packets.
I've built a PoC for CVE-2021-31166 the "HTTP Protocol Stack Remote Code Execution Vulnerability": https://t.co/8mqLCByvCp https://s.w.org/images/core/emoji/13.0.1/72x72/1[...]

___________________________
@hacking_Attack
@Hacking_Video

f525.png https://s.w.org/images/core/emoji/13.0.1/72x72/1f525.png pic.twitter.com/yzgUs2CQO5

— Axel Souchet (@0vercl0k) May 16, 2021 And Thus Does the Exploit Lifecycle Crank Up AgainThe publishing of a PoC code like this is typically the first step in the lifecycle of an exploit. As explained by Trend Micro’s Mayra Rosario Fuentes at the RSA Conference 2021 on Monday, the next step in that lifecycle is for crooks to sell it.

After it’s in the wild, a vulnerability moves into the stage of public disclosure. Next, the vendor patches the vulnerability. Finally, that vulnerability goes down two paths: If it’s patched, that’s it, end of life. If not, the exploit’s still there, waiting to be purchased on underground forums and set free on whichever unlucky victims haven’t yet patched.

One example is the eight-month lifecycle of CVE-2020-9054: an exploit sold on the XSS cybercriminal forum for $20,000 in February 2020 that got written up by cybersecurity journalist Brian Krebs, was publicly disclosed and patched by Microsoft in March 2020, and wound up being exploited by a botnet a month later. That botnet, a variant of the Mirai botnet named Mukashi that targeted Zyxel network-attached storage (NAS) devices, allowed threat actors to remotely compromise and control devices. See Also: Hacking Stories: Xbox UndergroundFive months after it was patched, in August 2020, another forum post requested an exploit, offering a bargain basement payment of $2,000. It’s a tenth of the original exploit, but a solid indication that some vulnerabilities have a long shelf life – most particularly if they’re used to crack open Microsoft products. Microsoft exploits, after all, are by far the most-requested and the most-sold exploit flavors on the underground market: All the more reason to heed Microsoft’s advice to prioritize patching for this one.
Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-3-1-90x90.png Microsoft, Google Clouds Hijacked for Gobs of Phishing1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-2-2-90x90.png Microsoft, Adobe Exploits Top List of Crooks’ Wish List2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-3-90x90.png Bizarro Banking Trojan Sports Sophisticated Backdoor3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Safari_Browser-90x90.jpg ‘Scheme Flooding’ Allows Websites to Track Users Across Browsers4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Mac-Malware-90x90.jpg Apple’s ‘Find My’ Network Exploited via Bluetooth7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-2-1-90x90.png GitHub Prepares to Move Beyond Passwords1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-2-90x90.png Wormable Windows Bug Opens Door to DoS, RCE1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Yellow-Duck-Malware-90x90.jpg Lemon Duck Cryptojacking Botnet Changes Up Tactics1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/iPhone-Jailbreak-90x90.jpg iPhone Hack Allegedly Used to Spy on China’s Uyghurs2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/cisco-jabber-90x90.jpg Critical Cisco SD-WAN, HyperFlex Bugs Threaten Corporate Networks2 weeks ago
The post Windows PoC Exploit Released for Wormable RCE first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

403 Forbidden Bypass

Hey hunters! This writeup is related with my previous writeup. I’ll share with you how I was able to bypass 403 Forbidden. So, Let’s get…Continue reading on Medium »
Read more...

403 Forbidden Bypass
https://dewangpanchal98.medium.com/403-forbidden-bypass-fc8b5df109b7?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hey hunters! This writeup is related with my previous writeup. I’ll share with you how I was able to bypass 403 Forbidden. So, Let’s get…Continue reading on Medium » (https://dewangpanchal98.medium.com/403-forbidden-bypass-fc8b5df109b7?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Any input?

I want to learn about how horrible the deep web is. Every nitty gritty detail of how it’s set up, how people use it, it fascinates me. I could never use it myself but I love learning about current tech. I’d never order drugs off the deep web. Couldn’t be me

submitted by /u/terpfiend227
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
AutoPentest-DRL - Automated Penetration Testing Using Deep Reinforcement Learning

https://1.bp.blogspot.com/-vvmrBKCQpaY/YKSzC6PiNPI/AAAAAAAAWNw/tlg1QN6C_GAuttpuM2zrqtfe0Q244RwsQCNcBGAsYHQ/w640-h204/AutoPentest-DRL_1_framework_overview.png AutoPentest-DRL is an automated penetration testing framework based on Deep Reinforcement Learning (DRL) techniques. The framework determines the most appropriate attack path for a given network, and can be used to execute a simulated attack on that network via penetration testing tools, such as Metasploit. AutoPentest-DRL is being developed by the Cyber Range Organization and Design (CROND) NEC-endowed chair at the Japan Advanced Institute of Science and Technology (JAIST) in Ishikawa, Japan.

An overview of AutoPentest-DRL is shown below. The framework can use network scanning tools, such as Nmap, to find vulnerabilities in the target network; otherwise, user input is employed instead. The MulVAL attack-graph generator is used to determine potential attack trees, which are then fed in a simplified form into the DQN Decision Engine. The attack path that is produced as output can be fed into penetration testing tools, such as Metasploit, to conduct an attack on a real target network, or used with a logical network instead, for example for educational purposes. In addition, a topology generation algorithm is used to produce multiple network topologies that are used to train the DQN.
Next we provide brief information on how to setup and use AutoPentest-DRL. For details, please refer to the User Guide that we also make available. PrerequisitesSeveral external tools are needed in order to use AutoPentest-DRL, as follows:

*
MulVAL: Attack-graph generator used by AutoPentest-DRL to produce possible attack paths for a given network. See the MulVAL page for installation instructions. MulVAL should be installed in the directory repos/mulvalin the AutoPentest-DRL folder. You also need to configure the /etc/profilefile as discussed here.

*
Nmap: Network scanner used by AutoPentest-DRL to determine vulnerabilities in a given real network. The command needed to install nmapon Ubuntu is given below: sudo apt-get install nmap *
Metasploit: Penetration testing tools used by AutoPentest-DRL to actually conduct the attack proposed by the DQN engine on the real target network. To install Metasploit, you can use the installers made available on the Metasploit website. In addition, we use pymetasploit3as RPC API to communicate with Metasploit, and this tool needs to be installed in the directory Penetration_tools/pymetasploit3by following its author's instructions. SetupAutoPentest-DRL has been developed mainly on the Ubuntu 18.04 LTS operating system; other OSes may work, but have not been tested. In order to set up AutoPentest-DRL, use the releases page to download the latest version, and extract the source code archive into a directory of your choice (for instance, your home directory) on the host on which you intend to use it.

AutoPentest-DRL is implemented in Python, and it requires several packages to run. The file requirements.txtincluded with the distribution can be used to install the necessary packages via the following command that should be run from the AutoPentest-DRL/directory: $ sudo -H pip install -r requirements.txt The last step is to install the database, which contains information about real hosts and vulnerabilities. For this purpose, download the asset file named database.tgzfrom the release page, and extract it into the Database/directory. Quick StartThe simplest way to use AutoPentest-DRL is to start it in the logical attack mode tha[...]

___________________________
@hacking_Attack
@Hacking_Video

t will determine the optimal attack path for a given logical network. For more information about this and the other operation modes, real attack mode and training mode, see our User Guide.

In order to use the logical attack mode on a sample network topology, run the following command from a terminal window: $ python3 ./AutoPentest-DRL.py logical_attack The logical network topology used in this attack mode is described in the file MulVal_P/logical_attack.P, which includes details about the servers, their connections, and their vulnerabilities. This file can modified following the syntax described in the MulVAL documentation.

In the logical attack mode no actual attack is conducted, and only the optimal attack path is provided as output. By referring to the visualization of the attack graph that is generated by MulVAL in the file mulval_results/AttackGraph.pdfyou can study in detail the attack steps. The figures below provide examples of such output. ReferencesFor a research background regarding AutoPentest-DRL, please refer to the following paper:

* Z. Hu, R. Beuran, Y. Tan, "Automated Penetration Testing Using Deep Reinforcement Learning", IEEE European Symposium on Security and Privacy Workshops (EuroS&PW 2020), Workshop on Cyber Range Applications and Technologies (CACOE'20), Genova, Italy, September 7, 2020, pp. 2-10.

For a list of contributors to this project, see the file CONTRIBUTORS included in the distribution. Download AutoPentest-DRL

___________________________
@hacking_Attack
@Hacking_Video

AutoPentest-DRL - Automated Penetration Testing Using Deep Reinforcement Learning
http://www.kitploit.com/2021/05/autopentest-drl-automated-penetration.html

___________________________
@hacking_Attack
@Hacking_Video

AutoPentest-DRL is an automated penetration testing framework (https://www.kitploit.com/search/label/Penetration%20Testing%20Framework) based on Deep Reinforcement Learning (DRL) techniques. The framework determines the most appropriate attack path for a given network, and can be used to execute a simulated attack on that network via penetration testing tools, such as Metasploit. AutoPentest-DRL is being developed by the Cyber Range Organization and Design (CROND (https://www.jaist.ac.jp/misc/crond/index-en.html)) NEC-endowed chair at the Japan Advanced Institute of Science and Technology (JAIST (https://www.jaist.ac.jp/english/)) in Ishikawa, Japan. An overview of AutoPentest-DRL is shown below. The framework can use network scanning tools, such as Nmap, to find vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) in the target network; otherwise, user input is employed instead. The MulVAL attack-graph generator is used to determine potential attack trees, which are then fed in a simplified form into the DQN Decision Engine. The attack path that is produced as output can be fed into penetration testing tools, such as Metasploit, to conduct an attack on a real target network, or used with a logical network instead, for example for educational purposes. In addition, a topology generation algorithm is used to produce multiple network topologies that are used to train the DQN.
Next we provide brief information on how to setup and use AutoPentest-DRL. For details, please refer to the User Guide (https://github.com/crond-jaist/AutoPentest-DRL/blob/master/user_guide.md) that we also make available.
Prerequisites
Several external tools are needed in order to use AutoPentest-DRL, as follows: MulVAL: Attack-graph generator used by AutoPentest-DRL to produce possible attack paths for a given network. See the MulVAL page (https://github.com/risksense/mulval) for installation instructions. MulVAL should be installed in the directory repos/mulval in the AutoPentest-DRL folder. You also need to configure the /etc/profile file as discussed here (https://www.programmersought.com/article/37794643490/). Nmap: Network scanner used by AutoPentest-DRL to determine vulnerabilities in a given real network. The command needed to install nmap on Ubuntu is given below: sudo apt-get install nmap
Metasploit: Penetration testing tools used by AutoPentest-DRL to actually conduct the attack proposed by the DQN engine on the real target network. To install Metasploit, you can use the installers made available on the Metasploit website (https://www.metasploit.com/). In addition, we use pymetasploit3 as RPC API to communicate with Metasploit, and this tool needs to be installed in the directory Penetration_tools/pymetasploit3 by following its author's instructions (https://github.com/DanMcInerney/pymetasploit3).
Setup
AutoPentest-DRL has been developed mainly on the Ubuntu 18.04 LTS operating system; other OSes may work, but have not been tested. In order to set up AutoPentest-DRL, use the releases (https://github.com/crond-jaist/AutoPentest-DRL/releases) page to download the latest version, and extract the source code archive into a directory of your choice (for instance, your home directory) on the host on which you intend to use it. AutoPentest-DRL is implemented in Python, and it requires several packages to run. The file requirements.txt included with the distribution can be used to install the necessary packages via the following command that should be run from the AutoPentest-DRL/ directory: $ sudo -H pip install -r requirements.txt
The last step is to install the database, which contains information about real hosts and vulnerabilities. For this purpose, download the asset file named database.tgz from the release page, and extract it into the Database/ directory.
Quick Start

___________________________
@hacking_Attack
@Hacking_Video

The simplest way to use AutoPentest-DRL is to start it in the logical attack mode that will determine the optimal attack path for a given logical network. For more information about this and the other operation modes, real attack mode and training mode, see our User Guide (https://github.com/crond-jaist/AutoPentest-DRL/blob/master/user_guide.md). In order to use the logical attack mode on a sample network topology, run the following command from a terminal window: $ python3 ./AutoPentest-DRL.py logical_attack
The logical network topology used in this attack mode is described in the file MulVal_P/logical_attack.P, which includes details about the servers, their connections, and their vulnerabilities. This file can modified following the syntax described in the MulVAL documentation (https://github.com/risksense/mulval). In the logical attack mode no actual attack is conducted, and only the optimal attack path is provided as output. By referring to the visualization of the attack graph that is generated by MulVAL in the file mulval_results/AttackGraph.pdf you can study in detail the attack steps. The figures below provide examples of such output.
References
For a research background regarding AutoPentest-DRL, please refer to the following paper: Z. Hu, R. Beuran, Y. Tan, "Automated Penetration Testing Using Deep Reinforcement Learning", IEEE European Symposium on Security and Privacy Workshops (EuroS&PW 2020), Workshop on Cyber Range Applications and Technologies (CACOE'20), Genova, Italy, September 7, 2020, pp. 2-10. For a list of contributors to this project, see the file CONTRIBUTORS included in the distribution.

Download AutoPentest-DRL (https://github.com/crond-jaist/AutoPentest-DRL)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Maltego OSINT CTF

https://external-preview.redd.it/pKJZj4-e0oB3qaYtq5fWIBl1HSTBzdIJN_2WIPus0mw.jpg?width=640&crop=smart&auto=webp&s=b2f9629f5bf747c2e0bb77756793baf41c83affd submitted by /u/GifLurker
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Researchers reporting a call center-based method of distributing BazarLoader

https://external-preview.redd.it/--srMyH1qb36iD7gt-jESC1XvHLoHTUFfDa36NKwqvI.jpg?width=320&crop=smart&auto=webp&s=217645d6dd5f58fd82aeeadc458b4335a78e0386 submitted by /u/cenotaphx
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video