Indholdsfortegnelse for May 2024 i Hackercool Magazine

All rights reserved. No part of this publication may be reproduced, distributed, or transmitted in any form or by any means, including photocopying, recording, or other electronic or mechanical methods, without the prior written permission of the publisher, except in the case of brief quotations embodied in critical reviews and certain other noncommercial uses permitted by copyright law. For permission requests, write to the publisher, addressed “Attention: Permissions Coordinator,” at the address below. Any references to historical events, real people, or real places are used fictitiously. Names, characters, and places are products of the author’s imagination. Hackercool Cybersecurity (OPC) Pvt Ltd. Banjara Hills, Hyderabad 500034 Telangana, India. Website: www.hackercoolmagazine.com Email Address: admin@hackercoolmagazine.com Information provided in this Magazine is strictly for educational purpose only. Please don't misuse this knowledge to hack…

What is the Pathfinder Attack? 1. Key Recovery: The Pathfinder attack aims to extract encryption keys and sensitive data from Intel CPUs. By leveraging specific vulnerabilities, attackers can compromise the security of encrypted information. 2. Group of Academics: A group of scholars from the University of California San Diego, Purdue University, UNC Chapel Hill, Georgia Institute of Technology, and Google collectively named these techniques “Pathfinder.” "If you’re not sure about the source, don’t use the link or open the attachment." Mitigation strategies To protect against the Pathfinder attack, consider the following strategies: 1. Microcode Updates: Keep your system’s microcode up to date. Manufacturers release patches to address vulnerabilities, so ensure you apply them promptly. 2. Software Updates: Regularly update your operating system and software. Security patches often include fixes for…

What is Microsoft Quick Assist? Have you ever heard about Microsoft Quick Assist? Windows comes bundled with so many features that it isn’t your fault if you don’t keep note of each and every tool it has. So, what is Microsoft Quick Assist? Quick Assist is a software inbuilt in Microsoft Windows that allows anyone to easily connect to another PC to be able to provide support. Here are the features of Quick Assist. 1) Quick Assist allows you to see another person’s screen in a Windows or MacOS.2) Control their PC remotely if they allow it.3) It has a feature to of a six-character security code to connect securely.4) It is inbuilt in Windows and doesn’t require any additional software. Let us see it practically. For this, we will…

To put it simply, the idea behind AiTM techniques employed by hackers is phishing. What Is AiTM Phishing? 1. Imagine you’re trying to visit a website, like your email or a social media platform.2. Hackers secretly place a “proxy server” between you and that website.3.This proxy server acts as a middleman, intercepting your communication.4. Sneaky, right? It’s like someone eavesdropping on your conversation. How Does It Work? 1. When you type your password on the website, the proxy server grabs it.2. It also steals a special “session cookie” that proves you’re logged in.3. Even if you use MFA (multifactor authentication), AiTM bypasses it.4. So, the hacker gets authenticated as you, without your knowledge. "Your online presence might still be vulnerable to threats even after implementing password vaults and managers. Picture…

Hello Hackercoolians. Till now in exploit writing feature, you learnt about some of the modules or libraries that help us in ethical hacking. In this Month’s feature, you will learn how to write an exploit in python to exploit the RFI or file upload vulnerability and upload a file to the target system. What is RFI vulnerability? RFI stands for Remote file inclusion. In this attack, hackers can upload remote files onto the web server. Normally, some files types are restricted to be uploaded. But if a website is vulnerable to RFI, we can upload any files we want into the web server. For this article, we will be using Mutillidae installed on XAMPP as our target. In Mutillidae, a page “upload-file.php” is vulnerable to RFI. Here’s the page vulnerable…

What is TunnelVision? TunnelVision (CVE-2024-3661) is a vulnerability that affects Virtual Private Network (VPN) connections. VPNs are commonly used to secure internet traffic by encrypting data between a user's device and a remote server. However, TunnelVision allows attackers to bypass this encryption and redirect traffic outside the VPN tunnel. How Does It Work? 1. DHCP Manipulation: The attack leverages Dynamic Host Configuration Protocol (DHCP) manipulation. When a device connects to a VPN, it receives an IP address from the VPN server via DHCP. TunnelVision tricks the VPN client into thinking it's still securely connected, while the unencrypted data is rerouted to the attacker's servers. 2. Data Exposure: As a result, sensitive information that should be encrypted within the VPN tunnel becomes vulnerable. This is especially concerning when using public WiFi…

MITRE corporation has recently revealed about a AV evasion tactic used in a cyber-attack performed by a Chinese threat actor being tracked as UNC5221 by Mandiant. In this attack, the hackers exploited two zero-day vulnerabilities to gain access to MTTRE’s Networked Experimentation (NERVE). After compromising an administrator account, they gained administrator access to VMware Exi infrastructure. Then they created rogue virtual machines in the VMware VCenter. In this rogue virtual machine that they created, they deployed their custom JSP web shell, Python based tunneling tools to facilitate SSH connection between rogue virtual machines they created and the ESXi hypervisor infrastructure. What is virtualization? Virtualization is a process that allows a computer to share its hardware resources with multiple separated environments. This virtualized environment (known as virtual machine) has its own…