HackMag – Page 8 – Security, malware, coding, devops

First contact. Attacks against contactless cards

Contactless payment cards are very convenient: you just tap the terminal with your card, and a few seconds later, your phone rings indicating that the transaction is completed. But this convenience has a downside: malefactors can steal money from such cards. This article provides an overview of methods used to hack NFC (near-field communication) payment cards.

Read full article →

Pentest in your own way. How to create a new testing methodology using OSCP and Hack The Box machines

Written by Evgeniy Gryaznov

Each aspiring pentester or information security enthusiast wants to advance at some point from reading exciting write-ups to practical tasks. How to do this in the best way and what should you pay attention to in the first place? In this article, I will describe my own pentesting journey and share some of my findings.

Read full article →

Persistence cheatsheet. How to establish persistence on the target host and detect a compromise of your own system

Written by s0i37

Once you have got a shell on the target host, the first thing you have to do is make your presence in the system ‘persistent’. In many real-life situations, you have only one RCE attempt and cannot afford losing access due to some unexpected event.

Read full article →

It’s a trap! How to create honeypots for stupid bots

Written by Hackat and Mikhail Artyukhin

If you had ever administered a server, you definitely know that the password-based authentication must be disabled or restricted: either by a whitelist, or a VPN gateway, or in some other way. We decided to conduct an experiment and check what happens if this simple step isn’t taken.

Read full article →

Digging to the bottom. Escalating privileges to root with kernel exploitation techniques on a Hack The Box virtual machine

Written by artex

This article discusses one of the most sophisticated PWN topics: kernel exploitation in Linux. You are about to learn what tools are required for kernel debugging, what are LKM, KGDB, IOCTL, and TTY, and many other exciting things!

Read full article →

The big heap adventure. Mastering heap exploitation techniques on a Hack The Box virtual machine

Written by artex

This article covers the following topics: memory management algorithms in Linux, heap exploitation techniques, and exploitation of the Use-After-Free (UAF) vulnerability on a host where all protection mechanisms are enabled. The target machine is RopeTwo, one of the most hardcore VMs on Hack The Box.

Read full article →

Secrets of V8 Engine. Dissecting Chrome on a Hack The Box virtual machine

Written by artex

No, this article isn’t about motor cylinders and valves – it’s about Google V8 Engine used in Chromium and Android. Today, I will show how to hack it on RopeTwo, the most hardcore VM on Hack The Box. Concurrently, you will learn what types of data are used in this engine, how to manipulate them in order to drop an exploit, how to use V8 debugging tools, what it WebAssembly, and how can it be used to penetrate into the RopeTwo shell.

Read full article →