Leaderboard

Winpayloads is a tool to provide undetectable Windows payload generation with some extras running on Python 2.7. It provides persistence, privilege escalation, shellcode invocation and much more. The tool uses metasploits meterpreter shellcode, injects the users IP and port into the shellcode and writes a python file that executes the shellcode using ctypes. This is then AES encrypted and compiled to a Windows Executable using pyinstaller. Features UACBypass – PowerShellEmpire PowerUp – PowerShellEmpire Invoke-Shellcode Invoke-Mimikatz Invoke-EventVwrBypass Persistence – Adds payload persistence on reboot Psexec Spray – Spray hashes until successful connection and psexec payload on target Upload to local webserver – Easy deployment Powershell stager – allows invoking payloads in memory & more Winpayloads also comes with a few features such as UAC bypass and payload persistence. These are powershell files that execute on the system when the meterpreter gets a reverse shell. The UAC bypass is written by PowerShellEmpire and uses an exploit to bypass UAC on local administrator accounts and creates a reverse meterpreter running as local administrator back to the attackers machine. Winpayloads can also setup a SimpleHTTPServer to put the payload on the network to allow downloading on the target machine and also has a psexec feature that will execute the payload on the target machine if supplied with usernames,domain,passwords or hashes. Installation git clone https://github.com/nccgroup/winpayloads.git cd winpayloads ./setup.sh will setup everything needed for Winpayloads Start Winpayloads ./Winpayloads.py Type ‘help’ or ‘?’ to get a detailed help page Download Winpayloads-master.zip Source

Ukraine's government, National Bank and biggest power companies all warned of cyberattacks Tuesday. Airports and metro services in the country were also reportedly affected, though it appears they're victims of another massive ransomware outbreak that's spreading across the world fast and hitting a significant number of critical infrastructure providers. Whispers of WannaCry abound, though security experts said a different breed, named Petya, was to blame. "[We're seeing] several thousands of infection attempts at the moment, comparable in size to WannaCry's first hours," said Kaspersky Lab's Costin Raiu. "We are seeing infections from many different countries." One firm, BitDefender, said it believed a similar strain called GoldenEye was actually responsible. Later, security firms, including Kaspersky and Avast, said the malware responsible was actually an entirely new ransomware that had borrowed Petya code. Regardless of what malware was used, the attacks have gone global. This morning saw major Danish shipping and energy company Maersk report a cyber attack, noting on its website: "We can confirm that Maersk IT systems are down across multiple sites and business units due to a cyber attack." And Russian oil industry giant Rosnoft said it was facing a "powerful hacker attack." Major British advertiser WPP said on Facebook it was also hit by an attack, while law firm DLA Piper also confirmed it had been targeted by hackers. None offered specifics on the nature of those hacks. Sources told Forbes of one U.S. target: pharmaceuticals company Merck. One source said the problem extended to global offices, including those in Ireland, with both phones and PCs out of action, and employees going home. Merck Sharp & Dohme (MSD), the U.K. subsidiary of Merck, confirmed its network was compromised. "We're trying to understand the level of impact," a spokesperson said. "We're trying to operate as normally as possible." Articol complet: https://www.forbes.com/sites/thomasbrewster/2017/06/27/ransomware-spreads-rapidly-hitting-power-companies-banks-airlines-metro/#8ec1fc67abd6

@aelius esti pe dinafara, aici e vorba de 1337 haxx0rs!

Cele mai utile comenzi de rulare din Windows 7 și 10. Aceste comenzi permit să accesați rapid caracteristici și aplicații pentru a particulariza mediul sistemului de operare. Quick Access To C: drive \ Open the current user’s home folder . Open up the Users folder .. Open Documents Folder documents Open Videos folder videos Open Downloads Folder downloads Open Favorites Folder favorites Open Recent Folder recent Open Recent Folder logoff Open Pictures Folder pictures Windows Sideshow control.exe /name Microsoft.WindowsSideshow Windows CardSpace control.exe /name Microsoft.cardspace Windows Anytime Upgrade WindowsAnytimeUpgradeui Taskbar and Start Menu control.exe /name Microsoft.TaskbarandStartMenu Troubleshooting control.exe /name Microsoft.Troubleshooting User Accounts control.exe /name Microsoft.UserAccounts Adding a new Device devicepairingwizard Add Hardware Wizard hdwwiz Advanced User Accounts netplwiz Advanced User Accounts azman.msc Backup and Restore sdclt Bluetooth File Transfer fsquirt Calculator calc Certificates certmgr.msc Change Computer Performance Settings systempropertiesperformance Change Data Execution Prevention Settings systempropertiesdataexecutionprevention Change Data Execution Prevention Settings printui Character Map charmap ClearType Tuner cttune Color Management colorcpl Command Prompt cmd Component Services comexp.msc Component Services dcomcnfg Computer Management compmgmt.msc Computer Management compmgmtlauncher Connect to a Network Projector netproj Connect to a Projector displayswitch Control Panel control Create A Shared Folder Wizard shrpubw Create a System Repair Disc recdisc Credential Backup and Restore Wizard credwiz Data Execution Prevention systempropertiesdataexecutionprevention Date and Time timedate.cpl Default Location locationnotifications Device Manager devmgmt.msc Device Manager hdwwiz.cpl Device Pairing Wizard devicepairingwizard Diagnostics Troubleshooting Wizard msdt Digitizer Calibration Tool tabcal DirectX Diagnostic Tool dxdiag Disk Cleanup cleanmgr Disk Defragmenter dfrgui Disk Management diskmgmt.msc Display dpiscaling Display Color Calibration dccw Display Switch displayswitch DPAPI Key Migration Wizard dpapimig Driver Verifier Manager verifier Ease of Access Center utilman EFS Wizard rekeywiz Event Viewer eventvwr.msc Fax Cover Page Editor fxscover File Signature Verification sigverif Font Viewer fontview Game Controllers joy.cpl Getting Started gettingstarted IExpress Wizard iexpress Getting Started irprops.cpl Install or Uninstall Display Languages lusrmgr Internet Explorer iexplore Internet Options inetcpl.cpl iSCSI Initiator Configuration Tool iscsicpl Language Pack Installer lpksetup Local Group Policy Editor gpedit.msc Local Security Policy secpol.msc Local Users and Groups lusrmgr.msc Location Activity locationnotifications Magnifier magnify Malicious Software Removal Tool mrt Manage Your File Encryption Certificates rekeywiz Math Input Panel mip Microsoft Management Console mmc Microsoft Support Diagnostic Tool msdt Mouse main.cpl NAP Client Configuration napclcfg.msc Narrator narrator Network Connections ncpa.cpl New Scan Wizard wiaacmgr Notepad notepad ODBC Data Source Administrator odbcad32 ODBC Driver Configuration odbcconf On-Screen Keyboard osk Paint mspaint Pen and Touch tabletpc.cpl People Near Me collab.cpl Performance Monitor perfmon.msc Performance Options systempropertiesperformance Phone and Modem telephon.cpl Phone Dialer dialer Power Options powercfg.cpl Presentation Settings presentationsettings Print Management printmanagement.msc Printer Migration printbrmui Printer User Interface printui Private Character Editor eudcedit Problem Steps Recorder psr Programs and Features appwiz.cpl Protected Content Migration dpapimig Region and Language intl.cpl Registry Editor regedit Registry Editor 32 regedt32 Remote Access Phonebook rasphone Remote Desktop Connection mstsc Resource Monitor resmon Resultant Set of Policy rsop.msc SAM Lock Tool syskey Screen Resolution desk.cpl Securing the Windows Account Database syskey Services services.msc Set Program Access and Computer Defaults computerdefaults Share Creation Wizard shrpubw Shared Folders fsmgmt.msc Snipping Tool snippingtool Sound mmsys.cpl Sound recorder soundrecorder SQL Server Client Network Utility cliconfg Sticky Notes stikynot Stored User Names and Passwords credwiz Sync Center mobsync System Configuration msconfig System Configuration Editor sysedit System Information msinfo32 System Properties sysdm.cpl System Properties (Advanced Tab) systempropertiesadvanced System Properties (Computer Name Tab) systempropertiescomputername System Properties (Hardware Tab) systempropertieshardware System Properties (Remote Tab) systempropertiesremote System Properties (System Protection Tab) systempropertiesprotection System Restore rstrui Task Manager taskmgr Task Scheduler taskschd.msc Trusted Platform Module (TPM) Management tpm.msc User Account Control Settings useraccountcontrolsettings Utility Manager utilman Version Reporter Applet winver Volume Mixer sndvol Windows Action Center wscui.cpl Windows Activation Client slui Windows Anytime Upgrade Results windowsanytimeupgraderesults Windows CardSpace infocardcpl.cpl Windows Disc Image Burning Tool isoburn Windows DVD Maker dvdmaker Windows Easy Transfer migwiz Windows Explorer explorer Windows Fax and Scan wfs Windows Features optionalfeatures Windows Firewall firewall.cpl Windows Firewall with Advanced Security wf.msc Windows Journal journal Windows Media Player wmplayer Windows Memory Diagnostic Scheduler mdsched Windows Mobility Center mblctr Windows Picture Acquisition Wizard wiaacmgr Windows PowerShell powershell Windows PowerShell ISE powershell_ise Windows Remote Assistance msra Windows Repair Disc recdisc Windows Script Host wscript Windows Update wuapp Windows Update Standalone Installer wusa Version Windows winver WMI Management wmimgmt.msc WordPad write XPS Viewer xpsrchvw Import to Windows Contacts wabmig Tablet PC Input Panel tabtip Windows Contacts wab Windows Firewall with Advanced Security wf Windows Help and Support winhlp32 Windows Script Host wscript WMI Tester wbemtest Access Screen Resolution page desk.cpl Access Mouse properties main.cpl Access Windows Action Center wscui.cpl Access Network Adapters ncpa.cpl Access Power Option powercfg.cpl Access the Programs and Features Window appwiz.cpl Access the System Properties sysdm.cpl Access the Windows Firewall firewall.cpl

Ba tepare fii antena: 1. Nu vii cu un cacat de site pe care poate sa il faca si un copil de 10 ani 2. CIF 1234567 - nu serios ?! 3. Nu iti cauti clienti aici, doar in cazul in care esti disperat 4. De ce ai pus 3 adrese de mail ? crezi ca intereseaza pe cineva adresele tale ? pune dracu' 1 si atat. 5. In mediul online cartea se judeca dupa coperta, pt ca numai coperta o vezi antreprenorule care esti antreprenor 6. @nextseeker cu numele asta atragi clienti mai ceva ca magnetu' 7. Adresa "firmei" e pe camp, sau nu, intre timp ai construit tu acolo ca doar ai bani dar vii ca milogu' sa cauti clienti pe forum 8. "DUMNEAVOASTRA: se refera la client - expeditorul incarcaturii." termenii si conditiile se contrazic intre ei. Deci dupa ce ca esti prost, mai ai si gura mare. Daca nici asta nu zboara ... atunci chiar s-a dus dracu forumu asta.

sudo chmod ? :))))))))) Dati-va in pula mea ca va sterg posturile

Going Further with Responder's Basic Authentication There are a good number of situations when we find ourselves abusing the LLMNR and NBT-NS protocols on an infrastructure penetration test, more specifically on an Active Directory setup. These 2 protocols are enabled by default on most of the Windows operating systems. What are they doing is they facilitate the communication between network machines when searching for a DNS hostname regardless if it’s a share, a server or a web hostname. The overview picture of the attack vector: the victim is looking for a non-existing hostname the DNS server cannot resolve the request we reply and resolve the hostname resolution query we ask the victim for authentication

Hello everyone. I joined this community a while ago; I have/had been a lurker for even longer. A huge part of what made the hacker community what it was (and what it is here) involves a willingness to share knowledge (without spoonfeeding). I would feel remiss if I gained so much from so many of you and did not give something back on occasion. What follows are anecdotes, opinions and observations I can share after almost 7 years working professionally in the InfoSec/Netsec field. Most of my work in this sphere has been anchored in Penetration Testing. Even when my official designation was Network Security Analyst, I spent most of those 3 years in engagements against PCI environments utilized for subcontracting work from Comcast, Verizon, Time Warner, Sprint and AT&T (to name a few of my former employers clients). Currently, I manage the Cybersecurity Lab of an International company that employees over 200,000 employees. Most of my work in my current position involves Penetration Testing (every type imaginable, including focused blackbox testing against embedded devices and the network/control structures surrounding them). I am also a lead point of contact for our international teams during remediation and triage of major security threats, incidents and breaches. For example, I was the my company’s head analyst for the recent Shamoon 2.0 attacks (W32.DisttrackB/W97M.Downloader) last February, as well as the recent Wannacry outbreak. I also serve in a Security Engineer capacity, as I am regularly asked to evaluate facets of our products and provide feedback and opinions on the security ramifications involved. I am extremely busy and wanted to give back what I have taken thus far, so this is going to be long... Here goes nothing: 1) I am completely self taught (meaning I acquired no college/formal education to get where I am). That being said, a solid Computer Science degree is invaluable as a base (I would generally avoid Cybersecurity degrees and go for CS ), and even the degree itself will open doors into this business. Also, I work alongside high-level engineers (CS and Electrical Engineering PhDs); what they can do in a short period of time once they take an interest in InfoSec/NetSec is frightening. 2) That leads me to this: to be great in this industry ( or great for this industry), I believe that InfoSec/NetSec has to become a lifestyle,not just a job. I easily work 80+ hours a week (every week) between work, further study and skills building. And I love just about every minute of it. There is a huge need for InfoSec/NetSec professionals,which I feel is going to lead to a flood of low knowledge, low passion, low skill hiring. Anyone trying to get into this industry for the cash alone is going to have a rude awakening: there are probably lower pressure, lower work hour ways to earn the same money doing something that actually interests you.. Also, those of us really invested in these arts can pretty easily spot our own. 3) Learn to study, and learn to love the act of studying. Much of this job is continual study; eventually, when presented with an issue youare ignorant of, you will feel confident in knowing that you can find the answers you need. Break the issue into small, manageable pieces (goals really), and put the pieces together until you can view the whole answer. 4) Most of my success in this industry has been due to a willingness to work hard, persevere and never give up. Ever. Most of this job is the creative solving of problems that do not or may not have any easy answer (or any answer at all…yet). You have to build a no retreat, no surrender, obsessive need to conquer problems. 5) I specialize in network penetration, though I have become fairly well rounded. To me, network penetration is the art of acquiring advantages. During an engagement, I am always looking to acquire advantages. I study and train to better recognize and maximize the resources within an environment that allow me to gain those advantages. Gaining these advantages are more a product of knowledge and experience then an application of tools. 6) I am also looking to be efficient; the best penetration tests replicate real world attacks. In that vein, each action you take raises the probability that you will be detected. For hackers and freedom fighters engaged in illegal activity,you may want to consider the latter a bit. Once you make ingress and launch any manner of offensive action, you have escalated the legal ramifications of your trespass by multiple magnitudes. Also remember that the probability of you getting caught and prosecuted is never 0.00%: you have to be prepared, you have to be careful, you have to be patient and you have to prepare contingencies. 7) I use a measurement/assessment of risk vs. reward to make each action within the network as efficient as possible; by percentages,losing a queen to take a rook is generally a loser’s bet. The best way I’ve learned to temper a careful approach is with an old sales slogan (“ Always be closing the deal”, which I modified to “Always be advancing your position(s)”). 7) I try as much as possible to engage a target as a stalking, ambush predator: I move carefully and try to use the environment to hide myself as I seek to exploit the target/objectives lack of awareness. I work to remain patient and identify/quantify as many of the variables of the current environment/situation as possible. Sometimes the best decision you can make is to slow down or hold your current position for a bit; watching Tcpdump or Wireshark while thinking on a better move is still advancing your position. 8) To lower the probability of detection (whenever possible) I attempt to attack, enumerate or probe from an obfuscated position. Configuring your attack host/node for the highest probability of situational anonymity (using tunneling, proxies, encapsulation ,etc.) is infinitely useful in pentesting, hacking and/or general security/privacy. Mastering the manipulation of proxy, tunneling and encapsulation protocols (which involves a deep understanding of networking/TCP/UDP) almost lends you quasi-magical invisibility and teleportation powers when involved in network penetration. Obfuscation itself is one of 10,000 reasons why experience/knowledge in the disciplines of networking, OS and programming combined with security research are such huge advantages (and another reason why if you take up this path you may never stop learning). 9) Learn to use every tool you can, but more importantly, learn why the tool works. If you work in/at exploitation long enough, the principles governing the tools will help you exploit a box someday,regardless of whether you use that particular tool to get the wanted/needed result.. 9) Knowledge/experience over tool use is especially important today: regardless of what many sites say, you will not find many enterprise/corporate networks today (as a professional penetration tester at least) where there are gross configurations/deployments leading to an easy, out of the box (deploy tool== Meterpreter) exploitation. 10) When training for a fight, professional mixed martial artists put themselves in the worst possible positions so they react properly when the fight is underway. Eventually, training/practicing your exploitation/research techniques the same way will be a huge boon in engagements, POCs (or in the wild). I especially like to round difficulty up during research; it is difficult for someone else to minimize your findings if you have added (and circumvented) greater security measures than the norm (rather than having reduced them). 11) Most of my exploitation of networks in the last couple years have been a process of discovering network misconfigurations and weaknesses (especially in Windows firewall, Programs and Features, LGPO/GPO policies and/or IE/Internet Options within Window Domains/Networks) or information leaks that I locate online or through DNS enumeration that ultimately leads to my gaining access to a host. From there, remote exploitation (toward post exploitation/privilege escalation/pivoting) will often occur This is largely when knowledge of things such as Powershell (leveraged by itself or tools like Powersploit/CrackMapExec/PsExec/Empire) become invaluable (in Windows networks). I have actually been finding easier remote exploits when attacking Linux/Unix boxes in enterprise networks (finding Solaris with Apache Tomcat during enumeration still springs hope eternal in my human breast). Many (actually, maybe all) of these companies are/were new at deploying Unix/Linux boxes in their networks and were making some serious mistakes with deployment. 12) Enumeration is the most important part of an engagement to me. You should get used to enumeration without automated tools; I love Nmap, but many times it is not feasible to usewithin the customer’s network (network overhead issues, the chance of detection by IIDS, the chance of breaking PLCs or other embedded devices, etc.). In cases where you are on the customer’s network, tools like Wireshark, Tcpdump, knowledge of networking protocols/ports and banner grabbing are your friends. 13) For those engagements where you first need to gain access to the network, you definitely have more room for running some louder tools: I love Fierce (and DNS enumeration in general) as it often presents my way in. Google dorking is still also an incredible tool, as is Firefox with the right set of extensions (Hackbar, Tamperdata, Wappalyzer, BuiltWIth, Uppity, IP Address and DOmain Information, etc,.). Who loves Dirbuster in these cirumstances? This carbon/caffeine based lifeform right here. Whether you are pentesting, bughunting or hacking/freedom fighting, a paid Shodan subscription will($50) is worth every cent. The capacity to make exacting, accurate searches for greater than five pages has helped me in more engagements/bughunts than I can remember. 14) When I am explaining why a config/setting/LGPO /GPO (etc.) is a security risk to a client or my fellow employees, I like to explain that many of the advantages I look for in my environment are most often advantages that are needlessly provided to me. If it does not break key functionality or seriously impede efficiency/development time, than it is in their best interest to deny me as many advantages as possible, even when the advantages appear as if they are minutia. When dealing with a client or non-security fellow employees,you should work to create a relationship of mutual help and teamwork. I am not there to rub their noses in there crap; I am there to help improve their security so the company can prosper. This is partially a customer service gig where solutions (remediation/counter measures) are more beneficial to the customer than the exploitation itself. Whenever possible, I like to end the post-exploitation/penetration test conversation/meeting/presentation with the attitude that I am here to help fix these issues , how can WE best close these gaps? How can I help make your (or our) company safer, so that we can become more prosperous? 15) I personally despise Microsoft (and many proprietary products/companies) on many levels, but when it comes to work, I am platform agnostic. Whatever tool is needed to complete the mission is the tool I am going to employ. However, whenever possible without jeopardizing the mission, I am going to employ an Open Source/Unix/Linux-centric solution. I work hard to show my company the value in Open Source. The way to show that value isn’t to be the super Unix/Linux/GPL neckbeard who constantly bemoans proprietary software./platforms. The best way (for me), is to show how effective the strategy involving the Open Source tool is. Then, in my report, I explain the business hook of using Open Source (if the tool is free for commercial use). I am sensitive to companies taking Open Source tools and turning them into something proprietary. However, if I can make my company (which is both huge and almost universally recognized as ethical, which is rare) see the value in Open Source, I know they will eventually incorporate Open Source into the support packages for their products (which they have while keeping the tools ad the license in tact). This than spreads the value of Open Source to smallercompanies who see it being trusted by a much larger company. 16) I have tens of thousands of dollars worth of licenses atmy disposal. However, I will never use tools like Nexpose, Nessus, Canvas orMetasploit Pro unless the project, client, or a governing body specificallyrequire them. I believe these tools develop poor habits. Obviously, if a project such as evaluating an entire domain of IP/hosts for vulnerabilities is my task, I am going to use Nessus. However, (whenever a time/project permits, which they most often do) I am going to evaluate the findings (and search for other vulnerabilities) manually. 17) The ultimate goal should be reliance on nothing more than a Linux/Unix Terminal, some manner of network access and a programming language. One of my favorite exploitation tools is my Nexus 7 2013 flo tablet (running a modified version of Nethunter) and a Bluetooth folio keyboard ( I got the idea from n-o-d-e, https://www.youtube.com/watch?v=hqG8ivP0RkQ44) as the final product is a netbook that fits in a jacket pocket). I have exploited some seriously huge clients with thislittle rig (for ingress and a quick root shell, WPS on network/enterpriseprinters and knowledge PCL/PJL/Postscript are often your friend). I have also exploited other customers with a cheap UMX smartphone with 5 gigs of storage, 1 gb of memory and GNUroot Debian (Guest Wifi access from the parking lot or an onsite public restroom, human nature, and Responder.py analyze mode, followed by WPAD, LLMNR and NetBios poisoning with NTLMv1 and LM authorization downgradefor the win). 18) During (red team, onsite, etc.) engagements, even when the ultimate target of the engagement is located on a hardwired network with heavy segmentation/compartmentalization (such as the conduit/zone based layouts that are general best practice in Industrial sectors), it is always worthgaining a host/node with corporate WIFI access. One thing WIFI access provides is reach: an Administrator’s (or other privileged user’s) dedicated workstation may be out of reach, but his other devices (if in scope) may be connected to Corp. WIFI for reasons such as saving data on a plan. Also, WIFI allows me attacks of opportunity even when I am doing other things. Running Responder.py on a misconfigured network’s WIFI while I am elsewise engaged is gaining me advantages (maybe clear text creds, maybe hashes, maybe NTLMv1 and LM hashes) at little cost to my time or attention. When I employ this, I like to spoof the poisoning machines hostname/mac address to something familiar on the network. If you see a bunch of hosts named “Apple” during your recon, and all of those hosts are not online, spoof the hostname/MAC to match one of the Apple machines (this will not withstand close scrutiny, but will often suffice with a little work). It always helps to watch and take note on the norms of the network traffic and protocols. Try to match this as much as possible (this will likely help you avoid IDS/IPS, firewall rules, etc.) and whatever traffic would seriously stand out, try to tunnel or encapsulate with normal network traffic/protocols. 19) This leads to two other points: A) Be prepared for the majority of people within a company who do not care about, or will minimize security issues. Do not get frustrated; I find that showing the parties involved what they stand to lose as a company from a vuln to be more effective than focusing on the vuln itself. This is where the Nexus and cheap smartphone come into play: taking the client’s domain with a laptop may scare up some results, but showing s customer that an attacker could cost them tens of millions with a $20 dollar smartphone or a $100 dollar tablet (from the parking lot) works wonders. C) I have an interest in learning to exploit everything and anything. This has served me well during network penetration tests, as many targets will defend their DCs, file servers and hosts, but not pay much attention to the printers and IoT devices within the network. D) To this end, learn to work with uncommon protocols. UPnP. NTLDNA and SSDP have been serving me well for the last couple years. Many file servers (and company smartphones/tablets when they are in scope) keep the UPnP door (and associated protocols) wide open. I once grabbed SNMP and other default network appliance creds from a fileserver through UPnP. 20) If you are going to pay for certs with your own cash, I recommend the OSCP. Yes, some of the machines/exploits are outdated. You won’t find many of the SMB remote exploits used for the course in the wild very often anymore (unless an Admin leaves a test server up, which happens occasionally). However, the overall experience, breakdown on enumeration methodology, self reliance and mindset the entire experience teaches you are invaluable. I have seen some sites peddling garbage certs with no industry recognition. Save your money for the OSCP; its profile in the industry is high and growing. Certs are no replacement for experience, but starting out with a IT/CS related degree or some general IT experience (even Helpdesk work) along with the OSCP will get you hired somewhere. 21) For persistence, I prefer adding innocuous user accounts/Remote Desktop accounts. If I am going to add some manner of privileged user account early to mid engagement, I usually try to add a more low profile account (if I have the option) such as Server Operator; these type of accounts allow privileged access you can build from, but generally are not watched with the scrutiny of an Administrator account. When I do create Administrator accounts (I try to wait until I begin my endgame), I will try to match the naming convention to similar accounts in within the network. if a For example, if the Administrator accounts within the network are named USsupervisor, I will name the added account something like USupervisor. If I know the clear text password of the account I have mimicked, I will use the same password. 22) Keep good notes during the engagement; too much information is better than to little information. Captured PCAPS of network traffic are great for examination during down time between engagements. 23) If you are a hacker, freedom fighter, or someone generally concerned about max privacy, this series of articles and configurations are for you: https://www.ivpn.net/blog/privacy-guides/advanced-privacy-and-anonymity-part-146 24) My favorite distro is Backbox; it starts out with a solid set of tools ninus the obscure bloat (and so far I have been able to add anything Kali has to Backbox). You can use Backbox's "Anonymous" option for a full transparent Tor proxy, Macchanger and host name changer and set RAM to overwrite on exit. I also keep Portable Virtualbox on a USB drive with a Kali Linux image... You could follow some of the advice here: http://www.torforum.org/viewtopic.php?f=2&t=1832020 And here: http://www.torforum.org/viewtopic.php?f=2&t=1832020 The articles above could help you create an encrypted USB with a Whonix gateway and Kali Linux workstation (you could probably exchange Kali OS in the Whonix Workstation for any Debian/Debian like OS). This configuration is disposable and concealable, and will run all of the Kali Workstation's (or other Debian/Debian like OS) through Tor. You could also create multiple other Vanilla Whonix Workstations/Gateways on the USB to create a type of local jumpbox sequencea to tunnel between/through SSH and/or VPN them before final Kali workstation. (Note: This is just a gut feeling, but for your own OpSec/security/anonymity, you are probably best replacing the Kali workstation with another Debian/Debian like distro. I have tried Katoolin in the Whonix Workstation, but I find that Katoolin often breaks i). 25) A VPS with your pentest tools installed is a valuable commodity; I call mine DeathStar, and I can call down some thunder from my Nexus 7 2013 flo (and a prepaid Wireless hotspot) from pretty much anywhere. There are some providers who do not give a damn about the traffic leaving your VM as long as you are using a VPN and a DMCA does not come their way. For hackers and freedom fighters, get your VPS from a country outside 14 Eyes countries (providers in Eastern European/former Soviet Block countries can be both dirt cheap and extremely honorable; just do your research and have tolerance for the occasional technical issue). You could pay with laundered/tumbled Bitcoin; even better are those providers who except gift cards (much like some VPN providers do)as payment. Have another party buy the gift cards a good distance away from you; you can find some of these providers who take gift cards on Low End Box. The VPS can be a valuable addition to the encrypted USB above (as you now have a host/node to catch your reverse shells without sacrificing Tor) when combined with SSH or IPsec (such as Strongswan, which is in the Debian repos). 26) Again, this post was long because I am busy, and Iwanted to make the contribution I felt I owed this site since shortly after it began. If you have technical questions concerning (or any questions in general), please post them as comments and I will definitely get you back an answer. https://0x00sec.org/t/shared-thoughts-after-6-years-in-pentesting/2492

Fuck off din topic dacă nu aveți nimic bun de spus. Nu e momentul sa arătați cat sunteți de copii. A murit un programator, fost membru al comunității RST. Condoleanțe familie și prietenilor.

Cei mai buni hackeri ..hmm..nu veti auzi niciodata numele lor ..Esti cunoscut cand esti prins ,baietii destepti nu sunt prinsi

.