Powered by Blogger.

Monday, August 31, 2020

Leo's Noob


I would like to send a salve to my friend noob at Rivendel in Brazilian company hahaha
Continue reading

Posted by Unknown at 1:28 PM 0 comments
Tags :

SQL Injection Attacks And Defense | By Justin Clarke | Pdf Free

More articles


Posted by Unknown at 5:00 AM 0 comments
Tags :

Sunday, August 30, 2020

Vulnerable-AD - Create A Vulnerable Active Directory That'S Allowing You To Test Most Of Active Directory Attacks In Local Lab


Create a vulnerable active directory that's allowing you to test most of active directory attacks in local lab.

Main Features
  • Randomize Attacks
  • Full Coverage of the mentioned attacks
  • you need run the script in DC with Active Directory installed
  • Some of attacks require client workstation

Supported Attacks
  • Abusing ACLs/ACEs
  • Kerberoasting
  • AS-REP Roasting
  • Abuse DnsAdmins
  • Password in AD User comment
  • Password Spraying
  • DCSync
  • Silver Ticket
  • Golden Ticket
  • Pass-the-Hash
  • Pass-the-Ticket
  • SMB Signing Disabled

Example
# if you didn't install Active Directory yet , you can try 
Install-ADDSForest -CreateDnsDelegation:$false -DatabasePath "C:\\Windows\\NTDS" -DomainMode "7" -DomainName "cs.org" -DomainNetbiosName "cs" -ForestMode "7" -InstallDns:$true -LogPath "C:\\Windows\\NTDS" -NoRebootOnCompletion:$false -SysvolPath "C:\\Windows\\SYSVOL" -Force:$true
# if you already installed Active Directory, just run the script !
IEX((new-object net.webclient).downloadstring("https://raw.githubusercontent.com/wazehell/vulnerable-AD/master/vulnad.ps1"));
Invoke-VulnAD -UsersLimit 100 -DomainName "cs.org"

TODO
  • Add More realistic scenarios
  • Click close issue button on github




via KitPloit
This article is the property of Tenochtitlan Offensive Security. Verlo Completo --> https://tenochtitlan-sec.blogspot.com

Related news


  1. Hacks And Tools
  2. Hacking Tools Windows
  3. Hackers Toolbox
  4. Bluetooth Hacking Tools Kali
  5. Hack Tools 2019
  6. Hacking Tools For Windows Free Download
  7. Blackhat Hacker Tools
  8. Easy Hack Tools
  9. Hacker Tools Github
  10. Pentest Tools List
  11. Game Hacking
  12. Pentest Tools Url Fuzzer
  13. Top Pentest Tools
  14. Best Pentesting Tools 2018
  15. Hacking Tools Hardware
  16. Hack Tools For Mac
  17. Usb Pentest Tools
  18. Tools For Hacker
  19. Hacker Security Tools
  20. Pentest Tools Url Fuzzer
  21. Hacker Tools
  22. Hack Tools
  23. Nsa Hacker Tools
  24. Blackhat Hacker Tools
  25. Hack Tools Mac
  26. Hacker Techniques Tools And Incident Handling
  27. Hacker Tools Apk
  28. Pentest Tools For Ubuntu
  29. Pentest Tools Port Scanner
  30. Hacking App
  31. Hacking Tools Windows 10
  32. Hack Tools
  33. Hacker Search Tools
  34. Hacking Tools Kit
  35. Pentest Tools Port Scanner
  36. Pentest Tools List
  37. Hacking Tools
  38. Easy Hack Tools
  39. Hack Tool Apk
  40. Pentest Tools
  41. Hack Tools For Pc
  42. Hack Website Online Tool
  43. Pentest Tools Website
  44. Tools Used For Hacking
  45. Pentest Recon Tools
  46. Pentest Tools Website
  47. Hack Tools
  48. Hacking Tools Github
  49. Pentest Tools Free
  50. Top Pentest Tools
  51. Hack Tool Apk
  52. Hak5 Tools
  53. Install Pentest Tools Ubuntu
  54. Pentest Tools Android
  55. Hacker Tools Mac
Posted by Unknown at 8:32 PM 0 comments
Tags :

Bypass Hardware Firewalls

This is just a collection of links about my DEF CON 22 presentation, and the two tools I released:

Slides:
http://www.slideshare.net/bz98/defcon-22-bypass-firewalls-application-white-lists-secure-remote-desktops-in-20-seconds

Tools:
https://github.com/MRGEffitas/Write-into-screen
https://github.com/MRGEffitas/hwfwbypass

Presentation video from Hacktivity:
https://www.youtube.com/watch?v=KPJBckmhtZ8

Technical blog post:
https://blog.mrg-effitas.com/bypass-hardware-firewalls-def-con-22/

Have fun!




Related articles

Posted by Unknown at 12:05 PM 0 comments
Tags :

Mythbusters: Is An Open (Unencrypted) WiFi More Dangerous Than A WPA2-PSK? Actually, It Is Not.

Introduction


Whenever security professionals recommend the 5 most important IT security practices to average users, one of the items is usually something like: "Avoid using open Wifi" or "Always use VPN while using open WiFi" or "Avoid sensitive websites (e.g. online banking) while using open WiFI", etc.

What I think about this? It is bullshit. But let's not jump to the conclusions. Let's analyze all risks and factors here.


During the following analysis, I made two assumptions. The first one is that we are comparing public WiFi hotspots with no encryption at all (referred to as Open), and we compare this to public WiFi hotspots with WPA2-PSK (and just hope WEP died years before). The other assumption is there are people who are security-aware, and those who just don't care. They just want to browse the web, access Facebook, write e-mails, etc.

The risks


Let's discuss the different threats people face using public hotspots, compared to home/work internet usage:
1. Where the website session data is not protected with SSL/TLS (and the cookie is not protected with secure flag), attackers on the same hotspot can obtain the session data and use it in session/login credentials stealing. Typical protocols affected:

  • HTTP sites
  • HTTPS sites but unsecured cookie
  • FTP without encryption
  • IMAP/SMTP/POP3 without SSL/TLS or STARTTLS

2. Attackers can inject extra data into the HTTP traffic, which can be used for exploits, or social engineer attacks (e.g. update Flash player with our malware) – see the Dark Hotel campaign

3. Attackers can use tools like SSLStrip to keep the user's traffic on clear text HTTP and steal password/session data/personal information

4. Attackers can monitor and track user activity

5. Attackers can directly attack the user's machine (e.g. SMB service)

WPA2-PSK security


So, why is a public WPA2-PSK WiFi safer than an open WiFi? Spoiler alert: it is not!

In a generic public WPA2-PSK scenario, all users share the same password. And guess what, the whole traffic can be decrypted with the following information: SSID + shared password + information from the 4-way handshake. https://wiki.wireshark.org/HowToDecrypt802.11
If you want to see it in action, here is a nice tutorial for you
Decrypted WPA2-PSK traffic

Any user having access to the same WPA2-PSK network knows this information. So they can instantly decrypt your traffic. Or the attackers can just set up an access point with the same SSID, same password, and stronger signal. And now, the attacker can instantly launch active man-in-the-middle attacks. It is a common belief (even among ITSEC experts) that WPA2-PSK is not vulnerable to this attack. I am not sure why this vulnerability was left in the protocol, if you have the answer, let me know. Edit (2015-08-03): I think the key message here is that without server authentication (e.g. via PKI), it is not possible to solve this.
Let me link here one of my previous posts here with a great skiddie tool:

To sum up, attackers on a WPA2-PSK network can:

  • Decrypt all HTTP/FTP/IMAP/SMTP/POP3 passwords or other sensitive information
  • Can launch active attacks like SSLStrip, or modify HTTP traffic to include exploit/social engineer attacks
  • Can monitor/track user activity

The only difference between open and WPA2-PSK networks is that an open network can be hacked with an attacker of the skill level of 1 from 10, while the WPA2-PSK network needs and an attacker with a skill level of 1.5. That is the difference.

The real solutions



1. Website owners, service providers should deploy proper (trusted) SSL/TLS infrastructure, protect session cookies, etc. Whenever a user (or security professional) notices a problem with the quality of the service (e.g. missing SSL/TLS), the service provider has to be notified. If no change is made, it is recommended to drop the service provider and choose a more secure one. Users have to use HTTPS Everywhere plugin.

2. Protect the device against exploits by patching the software on it, use a secure browser (Chrome, IE11 + enhanced protection), disable unnecessary plugins (Java, Flash, Silverlight), or at least use it via click-to-play. Also, the use of exploit mitigations tools (EMET, HitmanPro Alert, Malwarebytes AntiExploit) and a good internet security suite is a good idea.

3. Website owners have to deploy HSTS, and optionally include their site in an HSTS preload list

4. Don't click blindly on fake downloads (like fake Flash Player updates)


5. The benefits of a VPN is usually overestimated. A VPN provider is just another provider, like the hotspot provider, or the ISP. They can do the same malicious stuff (traffic injecting, traffic monitoring, user tracking). Especially when people use free VPNs. And "Average Joe" will choose a free VPN. Also, VPN connections tend to be disconnected, and almost none of the VPN providers provide fail secure VPNs. Also, for the price of a good VPN service you can buy a good data plan and use 4G/3G instead of low-quality public hotspots. But besides this, on mobile OSes (Android, iOS, etc.) I strongly recommend the use of VPN, because it is not practically feasible to know for users which app is using SSL/TLS and which is not.

6. Use a location-aware firewall, and whenever the network is not trusted, set it to a Public.

7. In a small-business/home environment, buy a WiFi router with guest WiFi access possibility, where the different passwords can be set to guest networks than used for the other.

Asking the question "Are you using open WiFi?", or "Do you do online banking on open WiFi?" are the wrong questions. The good questions are:
  • Do you trust the operator(s) of the network you are using?
  • Are the clients separated?
  • If clients are not separated, is it possible that there are people with malicious intent on the network?
  • Are you security-aware, and are you following the rules previously mentioned? If you do follow these rules, those will protect you on whatever network you are.

And call me an idiot, but I do online banking, e-shopping, and all the other sensitive stuff while I'm using open WiFi. And whenever I order pizza from an HTTP website, attackers can learn my address. Which is already in the phone book, on Facebook, and in every photo metadata I took with my smartphone about my cat and uploaded to the Internet (http://iknowwhereyourcatlives.com/).


Most articles and research publications are full of FUD about what people can learn from others. Maybe they are just outdated, maybe they are not. But it is totally safe to use Gmail on an open WiFi, no one will be able to read my e-mails.

PS: I know "Average Joe" won't find my blog post, won't start to read it, won't understand half I wrote. But even if they do, they won't patch their browser plugins, pay for a VPN, or check the session cookie. So they are doomed to fail. That's life. Deal with it.

Related posts


  1. Pentest Tools Open Source
  2. Computer Hacker
  3. Hacking Tools Kit
  4. Pentest Tools Free
  5. Hacker Techniques Tools And Incident Handling
  6. Pentest Tools Download
  7. Hacking Tools Download
  8. Kik Hack Tools
  9. Pentest Tools Android
  10. Hack Tools 2019
  11. Hack Tools For Mac
  12. Hacking Tools For Beginners
  13. Hackrf Tools
  14. Hacking Tools Pc
  15. Hacking Apps
  16. Hacking Tools Pc
  17. New Hacker Tools
  18. Hacker Tools For Pc
  19. World No 1 Hacker Software
  20. Hacking Tools
  21. Hacking Tools For Beginners
  22. Hacks And Tools
  23. Hacking Tools For Games
  24. Hacking Tools 2020
  25. Pentest Tools Website Vulnerability
  26. Pentest Tools Bluekeep
  27. Computer Hacker
  28. New Hack Tools
  29. Hacking Tools For Windows Free Download
  30. Hacker Tools 2019
  31. Hacker Tools For Mac
  32. World No 1 Hacker Software
  33. Hacker Tool Kit
  34. Hacking Tools Name
  35. Hack Tools For Mac
  36. Hack Tools Online
  37. Hacker Tools 2020
  38. Bluetooth Hacking Tools Kali
  39. Android Hack Tools Github
  40. What Is Hacking Tools
  41. Hacking Tools For Mac
  42. Hacking Tools Software
  43. Easy Hack Tools
  44. Game Hacking
  45. Pentest Tools Framework
  46. Hack Rom Tools
  47. Hacker Techniques Tools And Incident Handling
  48. Hacking Tools Name
  49. Pentest Recon Tools
  50. Hack Tools Github
  51. Pentest Tools Nmap
  52. Hack Tools 2019
  53. Hacking Tools For Mac
  54. Hacker Security Tools
  55. Github Hacking Tools
  56. Hacking Tools For Windows Free Download
  57. New Hacker Tools
  58. Pentest Tools Download
  59. Hacking Tools Mac
  60. Bluetooth Hacking Tools Kali
  61. Hacker Tools For Pc
  62. Best Pentesting Tools 2018
  63. Pentest Tools For Ubuntu
  64. Tools For Hacker
  65. Hacking Tools 2019
  66. Hack Tools Mac
  67. Hacking Tools 2020
  68. Hacking Tools For Games
  69. Hack Tools For Pc
  70. Pentest Tools For Ubuntu
  71. Hacking Tools Free Download
  72. Pentest Tools Subdomain
  73. Hack Tool Apk
  74. Hack Tools Pc
  75. Hacking Tools Kit
  76. Hacking Tools 2019
  77. Pentest Tools Alternative
  78. Nsa Hack Tools
  79. Hacking Tools For Games
  80. Pentest Tools Android
  81. What Is Hacking Tools
  82. Hacking Tools Mac
Posted by Unknown at 3:37 AM 0 comments
Tags :
Job Services © Powered by Blogger Maintained by Job Services