Category Archives: Security News

Sorry for the extended break , got super busy with work etc.. so here’s part 3 installing the solar after we got the roof back together. The OG house batteries were worthless for what I wanted to do , additionally the bay they were in wouldn’t fit newer LIPO4 batteries.

Ended up going with Renogy products because they have decent enough equipment and they had a good sale going on at the time, I think roughly cost about $4500 for all the equipment, wiring, tools etc…

4x200watts of solar for 800watts total
2x200AH batteries for 400 AH total
3000 watt inverter/charger
60 amp solar charger
The RV also has a built in 1000w generator that runs off the gas tank and a propane tank to do heating, hot water, and runs the fridge. Coupled with a 30 gallon water tank and Starlink & T-Mobile MiFi for internet I can stay off grid for a bit without needing to use hookups. So far in the few years I’ve had this, I made it to Florida/Florida Keys and back to Connecticut 3 times, Tennessee and back, CT to Mt. Detroit/Rushmore/Yellowstone/Vegas/Area51/Grand Canyon and back on Rt 66 for 3 weeks. No major issues so far for less than $10k for the whole project from start to finish.

Looking back to last year’s post https://www.kali.org/blog/10-years/ going over the history of the Kali pentesting distro I noticed that they still had the screenshots from the desktop background image (check the bottom right) I made when I was part of the original IRC group on irc.unixgods.net that started from muts’ (Mati Aharoni) old website, whitehat.co.il site. I originally found muts from an article he wrote My meanest hack in early 2004. It started out with Whoppix based off the Knoppix live CD then Whax based off the live Slax CD. Though I didn’t take the OSCP test until 2015, it’s crazy to think that 20+yrs later I’m still playing around on the distro for work and for fun (hackthebox), and finally making money fulltime from a hobby that I love.

Working on a personal project collecting breach DBs, I had come across the Zynga dump. On September 12th, 2019, Zynga publicly acknowledged the data breach had happened. The company developed games including Farmville, Zynga Poker, Words With Friends, Mafia Wars, Café World, and Empires & Allies etc… The breach contains 206,267,210 records including duplicates and 150,363,954 records without duplicates.
The following information was leaked:

I used to see alot of networks setup and either the tech or the end user choosing the person/business’s phone number as the password. So I usually try to test these first when trying to crack a WiFi password.

I was looking into more efficient ways to crack the password if you were working in a virtual machine and didn’t have access to a GPU cracking rig to utilize hashcat.

Kon-Boot is an awesome tool that I’ve used extensively with tech jobs that I’ve had in the past (it’s been around since 2009), for clients that couldn’t remember their password :/ or a employee that was fired etc… Most recently Red-Team pentest engagements when I’ve had physical access to a box and needed quick and stealth access. It allows accessing a target computer (Windows/Mac OSX) without knowing the user’s password.

Kon-Boot does not need to remove or modify the user’s password and all changes are reverted back to previous state after system restart unlike other tools that just remove/modify the password and is currently the only solution that I know of that can bypass Windows 10 online passwords.

Recently I had done some training where we setup ESXI 6.7 on a Intel NUC. It’s been over a month since I’ve touched it. Apparently during the training my coworker had set a root password for the install, which was supposedly written down, but was either typed wrong in the notes or fat-fingered while setting it. Unfortunately, you can no longer boot into single user mode or Service Console to reset the password and VMware suggest you reinstall ESXI to reset the password. I didn’t want to risk trying that method because I wasnt sure if it would affect the currently installed VMs and I didn’t have a copy of ESXI with me to do so. Instead I used a bootable Kali USB to mount the ESXI drive and reset the root password to a blank password by editing the shadow file.

My new open source python OSINT framework, skiptracer was released @ HushCon East on June 1st. Initial attack vectors for recon usually involve utilizing pay-for-data/API (Recon-NG), or paying to utilize transforms (Maltego) to get data mining results. Using some basic python webscraping of PII paywall sites to compile passive information on a target. The modules will allow queries for phone/email/screen names/real names/addresses/IP/Hostname/breach credentials etc.. It will help you collect relevant information about a target to help expand your attack surface.`Everyone should be encourage to submit new ideas/modules. You can get the code here: https://github.com/xillwillx/skiptracer feel free to submit new modules or code fixes.