DemmSec

DemmSec

Sign in Subscribe

Creating and onboarding a Syslog Forwarder into Sentinel (Azure VM) (Easy)

Creating and onboarding a Syslog Forwarder into Sentinel (Azure VM) (Easy)

Introduction The reason I decided to put this post up is simply because I've just lost the past 4 hours of my life to trying to forward syslog from an Azure VM into Microsoft Sentinel. From what I've seen there's at least 4 different

YouTube Censoring Hacking Content

YouTube Censoring Hacking Content

Policy Woes For a long time I've decided against talking much about this topic over fear of having my own account nuked. Over the weekend @TurvSec had his YouTube account deleted by YouTube over an apparent breach of the "Harmful or dangerous content" policy. Well, thats

Exploiting fully patched Office 2016 using CVE-2018-0802

Exploiting fully patched Office 2016 using CVE-2018-0802

What’s up guys? Microsoft recently released a security advisory which included a vulnerability in Microsoft Office 2016 which can allow a potential attacker to run code on a target’s computer. My first question.. HOW!?! So this is how you do it: First off we need to clone a

Hack Outlook with ZERO user interaction

Hack Outlook with ZERO user interaction

There’s definitely something more appealing about a hack that doesn’t require user interaction.. It just makes everything feel a bit more like its going to work. I was shown and stumbled across a tool called Ruler, which allows you to interact with the Exchange/Outlook Web Access API

What's that Fing on my network?

What's that Fing on my network?

Fing web shop and grab one for £125 (-$10 with code DEMMSEC10) Fingbox? So this little device can do so much and if you haven’t heard about it well let me introduce you to the Fingbox! So Fingbox was a huge success with the company Fing achieving 1744%

Best VPN 2017?

What is a VPN, what is its purpose and why would you need one? With the everyday threat of having your information stolen from you, there are many ways in which we can protect ourselves and ensure that we don’t leak too much information. One way we can achieve

Track any smartphone using a simple web page

Track any smartphone using a simple web page

What you will need * A server somewhere – I recommend a Digital Ocean VPS * A domain name Setting everything up I’m assuming you’re already logged into your VPS using SSH so I’ll start from there. The first thing you’re going to need to do is point your

Fundamentals of TOR

So we have all heard of TOR in some way or another, whether it being the wrong doings on the dark web, and is usually associated with bad people that want to stay hidden. Although, we all have our own personal reasons for using TOR. In this video both me

Automate Phishing Emails with GoPhish

Automate Phishing Emails with GoPhish

A simple phishing toolkit created by Jordan Wright. That is a framework that allows the easy management of phishing campaigns. It even handles the malicious web pages that you create. This is available for all OS types and you can grab this tool from github.com. For this tutorial, we

HOW TO MAKE MALWARE UNDETECTABLE! (SHELLTER)

HOW TO MAKE MALWARE UNDETECTABLE! (SHELLTER)

This one is pretty simple if you’re using Windows. You can simply head over to the Shellter Website and download the binary and away you go… If you want to run Shellter on Linux, specifically Kali Linux, there’s a few things you need to set up first. If

Password Managers

Password Managers

So if you are anything like me then you would have had countless password resets due to forgetting them or the re-use of passwords, which not only is not safe but is also not cool! However, I went through many years of using the same password with different variations. It

How to install Metasploitable 3

beginner hacking

How to install Metasploitable 3

Metasploitable is a range of intentionally vulnerable virtual machines that you can use to learn about exploits and how to use Metasploit. Metasploitable 3 is quite a lot different from Metasploitable 2. In 2 you could simply unzip a file and launch the virtual machine. In Metasploitable 3 you need

PoshC2 - A fully powershell command and control server

PoshC2 - A fully powershell command and control server

Installation PoshC2 is very easy to install. If you are using Windows 10 it may be worth disabling Windows Defender during the installation due to the PowerShell payloads bundled with PoshC2, or set C:\Temp\ as an exclusion from your Anti-Virus. To install it, on the PoshC2 Github Page there

War Driving with Android (HOW DO PEOPLE STILL USE WEP!?!?!)

War Driving with Android (HOW DO PEOPLE STILL USE WEP!?!?!)

I’ve gone back to my home city of Leeds over the holidays and I decided to try out an app I’ve had on my phone for a while and see if I could find anything interesting. The app is called WiFi Tracker and it simply plots WiFi access

Lan Turtle Review

Lan Turtle Review

I was lucky enough to get my hands on a LAN Turtle, the tiny Linux based computer disguised as a USB ethernet adapter. Specs * Atheros AR9331 SoC at 400 MHz MIPS * 16 MB Onboard Flash * 64 MB DDR2 RAM * 10/100 Ethernet Port * USB Ethernet Port – Realtek RTL8152 * Indicator LED

Steal Hashes with Bettercap

To steal hashes with Bettercap there’s a few things we need to do first. In Kali we will need Bettercap and Responder. Responder is installed by default, but it might be worth gettting the version from Git, but it’s not neccesary though. As for Bettercap, luckily, there is

How to make a Poison Tap (Hack locked Computers)

How to make a Poison Tap (Hack locked Computers)

Samy Kamkar released a tool which allows for a Raspberry Pi Zero to emulate a USB Ethernet device and steal cookies from a locked machine. We decided to make one and see how it worked. Below is a quick tutorial on how to set this up for yourself! Requirements * Raspberry