Rascals are always sociable, and the chief sign that a man has any nobility in his character is the little pleasure he takes in others company. Arthur Schopenhauer
I love corporations having total control over my life.
I love asking the corporation for permission to do something with my device that 10 years ago I could just do myself.
I love talking to Indian call-center employees.
And I absolutely love paying for the privilege of all this.
Rhonda Fleming and Robert Mitchum in Out of the Past (1947).
The pessimistic foot fetishist sees a woman putting her shoe back on.
The optimistic foot fetishist sees a woman just having taken her shoe off.
The shoe fetishist sees the shoe.
Wordcloud generated via Python from ~250k words on this website (with some common stopwords).
MS is offering a signed binary (code.exe), which will establish a Command&Control channel via an official Microsoft domain https://vscode.dev. The C2 communication itself is going to https://global.rel.tunnels.api.visualstudio.com over WebSockets. An attacker only needs an Github account. Let’s Go (VS) Code - Red Team style or the Microsoft signed and hosted Reverse Shell
CrackMapExec (CME) is a popular post-exploitation framework and penetration testing tool, and it’s frequently used in the field. Although CME is versatile and modular, it has become a target for threat actors exploiting its features for malicious purposes. For that reason, it’s important for blue teams to keep up with updates of such frameworks. With the introduction of new modules and capabilities, defenders should make sure they have detections and hunting strategies in place. Understanding Red to Be Better at Blue: Navigating New CrackMapExec Updates
Maybe you have heard about this year’s Defcon unwanted persistent pop-up pairing messages that were received by many attendees to pair their iPhone with nearby Apple TV or other gadget via Bluetooth. In this blog we will demonstrate how to send these pop-ups to nearby iPhone devices from Android smartphone. This is possible thanks to AppleJuice tool that is intended for Linux devices and was successfully tested on laptop and Raspberry Pi 3B+. Because of that, we can install and use it on Android as well. The spoofing can be performed even using built-in Bluetooth chip. Spoof iOS devices with Bluetooth pairing messages using Android
Doctor Web has identified a family of Android.Pandora trojans that compromise Android devices, either during firmware updates or when applications for viewing pirated video content are installed. This backdoor inherited its advanced DDoS-attack capabilities from its ancestor, the well-known Linux.Mirai trojan. Well-known Mirai trojan arrives in a new disguise to Android-based TV sets and TV boxes
Group Policy Objects represent high value targets for an attacker in any Active Directory environment. Indeed, compromising such objects would allow taking over any computer or user linked to it, thus opening up a high number of privilege escalation or lateral movement opportunities. What’s more, if the GPO is linked to an administrative user on the domain or to a domain controller, its compromise would directly lead to the domain takeover.
Attacking a Group Policy Object traditionally requires full control of a user with write permissions on the target GPO (meaning, the attacker knows such a user’s password or NT hash). This requirement limits the exploitability of GPOs and restricts the implementation of such attack paths to specific, authenticated edge cases. GPOddity: exploiting Active Directory GPOs through NTLM relaying, and more
Welcome to the world of Home security, where protecting your digital assets is a top priority. In today’s interconnected landscape, it’s crucial to have a strong defense system in place to detect and respond to potential threats.
That’s why we’re here to guide you through an exciting tutorial on building a secure network using Wazuh — an incredible open-source security monitoring platform — on a Raspberry Pi. But wait, there’s more! We’ll take it up a notch by harnessing the power of Telegram to create a handy notification center for instant alerts and updates. Get your Home Network Secured with Raspberry Pi & Wazuh
Embrace eccentricity. Magnify your strengths, weaknesses and passions, become a caricature of yourself.
In this blogpost I’m going to blow your mind with some easy to understand NetNTLMv1 downgrade and relaying stuff. I will keep this blogpost simple, so that everyone can follow these steps, but I will link further resources for those who want to get the bigger picture at the end of this post.
First I am going to show you my lab environment for the different attacks I’m about to go through and the tools I used for each attack. What comes next is the real deal. I will in detail go through the attack path of downgrading to NetNTLMv1 authentication and the further exploitation steps needed to elevate privileges in an effected environment. This blog includes two common attack scenarios, which occurred to us frequently during our internal penetration tests. NetNTLMv1 Downgrade to compromise
VisionFive 2 Debian Image 202308 has been released. here is the simple release notes. Please check the wiki page for more detail: VisionFive 2 Debian Wiki - 202308 Release | RVspace
Tips:
- Although 4K resolution is supported, there is still performance drop issue where frame rate is dropped during desktop usage. Thus, it is recommended to switch to 1080p60 resolution for a smooth desktop user experience.
- Please avoid running apt upgrade as it will override the existing customized mesa and linux-libc-dev versions provided.
- This debian image contains FFmpeg, Firefox and VLC by default.
- Please update the SPI flash to the latest SPL/U-Boot binaries if you would like to try nvme booting (set boot mode as QSPI boot).
Nmap cheatsheet, click on the image for a bigger version.
Lately I was trying to port kali nethunter to my old phone with supported external wifi card and things to be worked without much issues that I have found while using custom pre-built kali nethunter roms and custom kernel and it appears non of them worked in a stable way and not much support for the external wifi cards (Like the well-known TP-LINK W722N v2) and some other tools. So I have decided to create my own custom build for kali nethunter and this blog post will be about my walkthrough on how I have created my custom build for my unsupported phone. Port Custom Build of Kali Nethunter to an Unsupported Phone
Imagine a scrawny, averagely intelligent white guy that could only become farther from being a man by being born with two X chromosomes. Now, place that specimen into a soulless technology corporation that sells shit that the world would be better off without.
That’s your average Hacker News poster.
When life gets too hard I close my eyes and pretend the world has fast-forwarded 100 years. Everyone I know is gone, and their memories of me are gone with them. I close my eyes again, and I find myself sitting on top of a mountain, a hundred thousand years from now. Everyone is dead. Here, I am the only human left alive. I look at the beach below and the waters are pristine and teeming with microscopic fluorescent life. Earth has recovered. I sigh as I remember how hard I was on myself when I was alive.
Recently, we performed a penetration test on an Android application available on the Play Store. The app had good security in place to protect it from being opened and executed on a rooted app. In this blog post, Sanjay from NotSoSecure describes how he got around every necessary check to conduct API/dynamic testing on an Android application.
This is a tale of circumventing all checks to record the activity of an Android application on a rooted smartphone. It took us 16 hours to crack and in this blog we’ll tell you the story of how we did it. Bypassing Hardened Android Applications
Nickname: 
