Indholdsfortegnelse for September 2022 i Hackercool Magazine

All rights reserved. No part of this publication may be reproduced, distributed, or transmitted in any form or by any means, including photocopying, recording, or other electronic or mechanical methods, without the prior written permission of the publishe -r, except in the case of brief quotations embodied in critical reviews and certain other noncommercial uses permitted by copyright law. For permission requests, write to the publisher, addressed “Attention: Permissions Coordinator,” at the address below. Any references to historical events, real people, or real places are used fictitiously. Names, characters, and places are products of the author’s imagination. Hackercool Cybersecurity (OPC) Pvt Ltd. Banjara Hills, Hyderabad 500034 Telangana, India. Website: www.hackercoolmagazine.com Email Address: admin@hackercoolmagazine.com Information provided in this Magazine is strictly for educational purpose only. Please don't misuse this knowledge to…

In August of this year 2022, 1 0 Python libraries have been removed from the PyPI as they were found to be harvesting critical data points like passwords and API tokens. The Python packages that are offending include Ascii2text, Pyg_utils and PyProto2. In June of this year, researchers have discovered multiple Python packages with backdoors and code to steal AWS keys and secrets. Further in May 2022, two popular PyPI packages "ctx" and PHP library "Phpass" were hijacked to steal AWS keys. In yet another case, a PyPI package was found to be dropping fileless crypto miner to Linux systems. Recently, cases of open source libraries being used as part of a supply chain attack have increased. This article explains our readers about Python packages and Libraries and how they…

Gitlab GraphQL API UnAuth User Enumeration Module TARGET: Gitlab 13.0 to 14.8.2,14.7.4 and 14.6.5 TYPE: Remote MODULE: Auxiliary ANTI-MALWARE: NA Gitlab is a web-based Git repository built on DEVOPs platform. Just like Github, enables professional ability to free open and private repositories. Above mentioned versions of Gitlab have a vulnerability exploiting which this module acquires the list of Gitlab users without needing any authentication. This module queries the GraphQL API to acquire this list. We have tested this on Gitlab version 1 3.1 0.2. The setup and installation instruction are given in our Installation section. After the target is set, load the gitlab_graphql_user_enum module as shown below. Researchers detected a new hacking attack against Middle Eastern Counries that hides malware in Windows Logo. Set all the required options as shown…

Hi Readers, In this month we will learn about another tool that can be useful in AV Evasion. i.e Condor. Condor is a tool developed in Python to help pen testers bypass protections like AV/EDR/XDR in Windows operating systems. Condor has many features that can help penetration testers but the most important feature is its simplicity of usage. Its other features include the small size of the generated file and adding fake signature to the executable. The makers of Condor recommend to use this tool in a WSL (Windows Subsystem for Linux) as the tool requires both msfvenom (that is available only in Linux) to generate shellcode and PyInstaller on Windows to be able to compile the shellcode. But hackers we are, we are going to run this tool on…

How To Install and Configure Gitlab Download Gitlab with wget using the following command. Next, Install SSH server. Next, use dpkg to install the Debian Installer. Next, Open the/etc/gitlab.rb fie using any text editor and change option of " external_url" to " http://localhost" as shown below. Next, reconfigure Gitlab. How To Install Webmin in Linux Install “libio_pty_perl” and “libauthem_ pam_perl". Neither space nor quote here Download the vulnerable version of Webmin (Information given in our Downloads section). Install the Debian package using Debian package using Debian package manager. Once installed, open browser and visit the url "https://localhost: 100000" as shown below. A threat actor has been using a trojanized installer for the Co mm1 00 Live Chat application to distribute a JavaScript backdoor. Login using default credentials. Let’s create a…