Forwarded from UNDERCODE NEWS
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦HOW TO FIX A HACKED DRUPAL WEBSITE ??
Step 1: Make a forensic copy of the site
Once you are sure that you've been hacked you should stop everything and make a forensic copy of it. Some people prefer to literally yank the network cable and power cable from the server, though that obviously isn't always appropriate and doesn't work for all environments (cloud, anyone?). If you can, this forensic copy could be an operating system level snapshot of the server(s) involved. Otherwise, go for a copy of the database and files. Store one copy to media that can't be modified like a CD or DVD.
Step 2: Decide to keep, rollback, rebuild, or throw the site away.
"Keeping" a site requires you to spend a lot of time and effort reviewing it. You may decide, depending on the nature of the site, that it is perfectly acceptable to throw it away or rebuild it. Perhaps the needs of the site have shifted and you were planning to rebuild it already. Perhaps it was for an event that has come and gone and you can make a static copy or just delete it all. Even if you've decided to rebuild or delete a site you aren't done with this process, but at least you've cut out a lot of the work in remediation. You may not be able to make this decision or may change your mind based on investigation you do as part of remediation. Start the process by considering this question and it may help ease your life. If you know the specific date that your site was hacked, you may be able to rebuild the site easily simply by using an older database and file backup (you make those and keep them around, right?).
Sidebar: Documentation and learning
One of the first things you should do is open two scratch pads. One for documenting everything you've discovered and that you're doing NOW. If you notice an important detail proving how the attackers got in, add the source of the information and as much of that information as you can. The second document is for things you want to do to harden your site that you think of as you go through the process. You may realize a lot of things you can do to make it harder for attackers, but their not easy or critical enough to do right now. Save those valuable ideas for later.
Step 3: Who should you notify?
You should start deciding who you need to notify about the issue. If your site had users and you believe your site was completely taken over then private content like their email address, IP address and anything else private on the site is compromised. In some locations you are legally bound to inform people of this exposure (e.g. in the case of sites requiring HIPAA or PCI Compliance), if not also morally bound.
If you are not the owner of the site, you should consider which stakeholders to inform. Visitors of the site might have been exposed to malware. The owner should be involved in decision making.
Depending on the nature of the site and who you suspect attacked it, you may wish to notify one or more law enforcement groups. Many local law enforcement groups are poorly equipped for dealing with these kinds of issues. But perhaps they will be able to help or refer your case to another law enforcement group.
Step 4: Should you take the site offline?
Again, depending on the nature of the site you may wish to take it offline. If you suspect that it is actively being used to distribute malware, send spam, or as a pivot point for further attacks then taking it offline and installing a placeholder will at least prevent further damage.
Note that taking the site offline likely does tip the attackers that you are aware of their presence.
If you don't take the site offline at the webserver level:
Make sure you've got your forensic copy and then delete out all sessions.
If you suspect passwords have been changed, you can update them to new values using a query like this:
update users set pass = concat('ZZZ', sha(concat(pass, md5(rand()))));
Users will be able to use the password reset tool to change their password.
π¦HOW TO FIX A HACKED DRUPAL WEBSITE ??
Step 1: Make a forensic copy of the site
Once you are sure that you've been hacked you should stop everything and make a forensic copy of it. Some people prefer to literally yank the network cable and power cable from the server, though that obviously isn't always appropriate and doesn't work for all environments (cloud, anyone?). If you can, this forensic copy could be an operating system level snapshot of the server(s) involved. Otherwise, go for a copy of the database and files. Store one copy to media that can't be modified like a CD or DVD.
Step 2: Decide to keep, rollback, rebuild, or throw the site away.
"Keeping" a site requires you to spend a lot of time and effort reviewing it. You may decide, depending on the nature of the site, that it is perfectly acceptable to throw it away or rebuild it. Perhaps the needs of the site have shifted and you were planning to rebuild it already. Perhaps it was for an event that has come and gone and you can make a static copy or just delete it all. Even if you've decided to rebuild or delete a site you aren't done with this process, but at least you've cut out a lot of the work in remediation. You may not be able to make this decision or may change your mind based on investigation you do as part of remediation. Start the process by considering this question and it may help ease your life. If you know the specific date that your site was hacked, you may be able to rebuild the site easily simply by using an older database and file backup (you make those and keep them around, right?).
Sidebar: Documentation and learning
One of the first things you should do is open two scratch pads. One for documenting everything you've discovered and that you're doing NOW. If you notice an important detail proving how the attackers got in, add the source of the information and as much of that information as you can. The second document is for things you want to do to harden your site that you think of as you go through the process. You may realize a lot of things you can do to make it harder for attackers, but their not easy or critical enough to do right now. Save those valuable ideas for later.
Step 3: Who should you notify?
You should start deciding who you need to notify about the issue. If your site had users and you believe your site was completely taken over then private content like their email address, IP address and anything else private on the site is compromised. In some locations you are legally bound to inform people of this exposure (e.g. in the case of sites requiring HIPAA or PCI Compliance), if not also morally bound.
If you are not the owner of the site, you should consider which stakeholders to inform. Visitors of the site might have been exposed to malware. The owner should be involved in decision making.
Depending on the nature of the site and who you suspect attacked it, you may wish to notify one or more law enforcement groups. Many local law enforcement groups are poorly equipped for dealing with these kinds of issues. But perhaps they will be able to help or refer your case to another law enforcement group.
Step 4: Should you take the site offline?
Again, depending on the nature of the site you may wish to take it offline. If you suspect that it is actively being used to distribute malware, send spam, or as a pivot point for further attacks then taking it offline and installing a placeholder will at least prevent further damage.
Note that taking the site offline likely does tip the attackers that you are aware of their presence.
If you don't take the site offline at the webserver level:
Make sure you've got your forensic copy and then delete out all sessions.
If you suspect passwords have been changed, you can update them to new values using a query like this:
update users set pass = concat('ZZZ', sha(concat(pass, md5(rand()))));
Users will be able to use the password reset tool to change their password.
HOW TO FIX A HACKED DRUPAL WEBSITE 2
Step 5: Begin investigating the attack
Whatever tipped you off to the fact that you were compromised is the first step in investigating the attack. If your page content was changed, spam emails were sent, information stolen and used for some purpose, malware uploaded to the site, whatever the compromise is - consider how the attacker could have achieved that. List out every way you can think of that someone could make that change. There are two goals to this exercise: first, you'll help pin down how you got attacked so you can close that hole. Second, you'll identify other things the attacker could have done based on the means they used to attack your site. Try to be creative and don't throw out any possibilities as "too hard" or "technically impossible" - your attacker was probably creative and your site may not work exactly as you think it does.
Once you have a list of ways, start trying to pin down which is most likely. Which requires the least effort? What evidence would there be for each one? Do you see examples of that evidence? For each method, is the attack a reasonable thing for someone to do if they had that kind of access? Does one require so much effort that it's not worth it?
When in doubt, ask for help from a colleague that may have more experience with IT and web application security. Sometimes the simple excercise of talking it through with another person will surface additional ideas. Additionally, you should review the OWASP Top 10 list to make sure you're aware of all the various types of attacks. Finally, you find it helpful to search the internet to see if there are others experiencing a similar breach. Often times these attacks are performed by bots that scan a large quantity of websites, so there may be some known signatures to look for as well as solutions to correct and/or mitigate the vulnerability.
If you're lucky, one or two of the potential ways to break in will be the obvious choice. So, block that weakness!
Sidebar: Attackers Have Workflows Too
Just like you have a workflow for building a site, attackers have workflows for attacking a site. Loosely speaking, the first step that matters to you is when they have broken into the site. There is often a software bot and/or group of people who are working on this piece and they are not necessarily the people who will exploit the site. Once they have established a foothold, the next step may not come for days or months.
Next is learning about the site and deciding what to do with it. If the site houses a large number of accounts or sensitive data then that is a resource. If it's on a big private network then that becomes something new to explore and exploit. Maybe it's just a clean IP to use to send spam. Maybe it gets a lot of traffic and is a good point to use to distribute malware. If it's got a high search engine rank it can be a place from which to link to other sites and earn search-engine reputation.
Once the potential value of your site is understood it's time to start exploiting it. Attackers may do multiple things at the same time: start by exfiltrating the email/password list and then leave some malware and search-engine links. If your content is particularly sensitive they may copy it and then clean up their tracks so you don't suspect any data was stolen.
If you see signs of a break-in but not of any damage, perhaps you stopped the process early, or perhaps they abused the site in ways that don't leave traces and then haven't done anything else.
Reference-git2020
β β β Uππ»βΊπ«Δπ¬πβ β β β
Step 5: Begin investigating the attack
Whatever tipped you off to the fact that you were compromised is the first step in investigating the attack. If your page content was changed, spam emails were sent, information stolen and used for some purpose, malware uploaded to the site, whatever the compromise is - consider how the attacker could have achieved that. List out every way you can think of that someone could make that change. There are two goals to this exercise: first, you'll help pin down how you got attacked so you can close that hole. Second, you'll identify other things the attacker could have done based on the means they used to attack your site. Try to be creative and don't throw out any possibilities as "too hard" or "technically impossible" - your attacker was probably creative and your site may not work exactly as you think it does.
Once you have a list of ways, start trying to pin down which is most likely. Which requires the least effort? What evidence would there be for each one? Do you see examples of that evidence? For each method, is the attack a reasonable thing for someone to do if they had that kind of access? Does one require so much effort that it's not worth it?
When in doubt, ask for help from a colleague that may have more experience with IT and web application security. Sometimes the simple excercise of talking it through with another person will surface additional ideas. Additionally, you should review the OWASP Top 10 list to make sure you're aware of all the various types of attacks. Finally, you find it helpful to search the internet to see if there are others experiencing a similar breach. Often times these attacks are performed by bots that scan a large quantity of websites, so there may be some known signatures to look for as well as solutions to correct and/or mitigate the vulnerability.
If you're lucky, one or two of the potential ways to break in will be the obvious choice. So, block that weakness!
Sidebar: Attackers Have Workflows Too
Just like you have a workflow for building a site, attackers have workflows for attacking a site. Loosely speaking, the first step that matters to you is when they have broken into the site. There is often a software bot and/or group of people who are working on this piece and they are not necessarily the people who will exploit the site. Once they have established a foothold, the next step may not come for days or months.
Next is learning about the site and deciding what to do with it. If the site houses a large number of accounts or sensitive data then that is a resource. If it's on a big private network then that becomes something new to explore and exploit. Maybe it's just a clean IP to use to send spam. Maybe it gets a lot of traffic and is a good point to use to distribute malware. If it's got a high search engine rank it can be a place from which to link to other sites and earn search-engine reputation.
Once the potential value of your site is understood it's time to start exploiting it. Attackers may do multiple things at the same time: start by exfiltrating the email/password list and then leave some malware and search-engine links. If your content is particularly sensitive they may copy it and then clean up their tracks so you don't suspect any data was stolen.
If you see signs of a break-in but not of any damage, perhaps you stopped the process early, or perhaps they abused the site in ways that don't leave traces and then haven't done anything else.
Reference-git2020
β β β Uππ»βΊπ«Δπ¬πβ β β β
Forwarded from UNDERCODE NEWS
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦SCRIPTING UTILITIES :
* [IDC Functions Doc](https://www.hex-rays.com/products/ida/support/idadoc/162.shtml)
* [Using IDAPython to Make your Life Easier](http://researchcenter.paloaltonetworks.com/tag/idapython/)
* [Introduction to IDA Python](https://tuts4you.com/download.php?view.3229)
* [The Beginner's Guide to IDA Python](https://leanpub.com/IDAPython-Book)
* [IDA Plugin Contest](https://www.hex-rays.com/contests/)
* [onehawt IDA Plugin List](https://github.com/onethawt/idaplugins-list)
* [pefile Python Library](https://github.com/erocarrera/pefile)
git resources
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦SCRIPTING UTILITIES :
* [IDC Functions Doc](https://www.hex-rays.com/products/ida/support/idadoc/162.shtml)
* [Using IDAPython to Make your Life Easier](http://researchcenter.paloaltonetworks.com/tag/idapython/)
* [Introduction to IDA Python](https://tuts4you.com/download.php?view.3229)
* [The Beginner's Guide to IDA Python](https://leanpub.com/IDAPython-Book)
* [IDA Plugin Contest](https://www.hex-rays.com/contests/)
* [onehawt IDA Plugin List](https://github.com/onethawt/idaplugins-list)
* [pefile Python Library](https://github.com/erocarrera/pefile)
git resources
β β β Uππ»βΊπ«Δπ¬πβ β β β
Leanpub
The Beginner's Guide to IDAPython
Forwarded from UNDERCODE NEWS
Forwarded from UNDERCODE NEWS
You're finally dying, Flash! You, software serial killer!
#Vulnerabilities
#Vulnerabilities
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦STILL LOOKING FOR THE FASTEST INTERNET DOWNLOAD MANAGER FOR WINDOWS ?
https://jdownloader.org/home/index
http://www.internetdownloadmanager.com/
https://beebom.com/best-windows-10-apps/
https://www.freedownloadmanager.org/
http://www.eagleget.com/
https://ugetdm.com/
http://xdman.sourceforge.net/
https://wordrider.net/freerapid/index.html
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦STILL LOOKING FOR THE FASTEST INTERNET DOWNLOAD MANAGER FOR WINDOWS ?
https://jdownloader.org/home/index
http://www.internetdownloadmanager.com/
https://beebom.com/best-windows-10-apps/
https://www.freedownloadmanager.org/
http://www.eagleget.com/
https://ugetdm.com/
http://xdman.sourceforge.net/
https://wordrider.net/freerapid/index.html
β β β Uππ»βΊπ«Δπ¬πβ β β β
Internetdownloadmanager
Internet Download Manager is a powerful download accelerator
Internet Download Manager (IDM) is a tool to increase download speeds by up to 10 times, resume or schedule downloads and download streaming videos
Forwarded from UNDERCODE NEWS
Forwarded from UNDERCODE NEWS
Amazon is transferring $ 30 million to AllCloud to transfer Israeli companies to its cloud.
#international
#international
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦a simple paid apk with great features:
Tracking a set of texts, SMS-messages, online correspondence in chats, history of visiting pages on the Internet, calls, contacts, emails, photos and videos in invisible mode;
Access to the online control panel via a computer for remote viewing of recorded and tracked information;
Support for working with almost any device;
Ability to work with gadgets from "Apple" without breaking the system;
Simple registration of an account on the official website;
The program works in a hidden mode, which prevents its deactivation by your children or inexperienced users;
Mobistealth helps protect your children from various cyber threats associated with fraud and extortion;
The software installation takes a few minutes;
Leaders of organizations get the opportunity to better optimize their workflow by tracking employees using Mobistealth software tools;
The cost of maintaining a single device tracking app starts at just $ 0.50 per day.
A) Contact Tracking:
You will always be aware of who your child is communicating with, and if he tries to make an appointment and enter this event in the electronic calendar on your phone, then you will know about it.
B) Voice call tracking tools:
In addition to the fact that with the help of "Mobistealth" you can view the list of outgoing and incoming calls, it is also possible to listen to the voice communication of the interlocutors during regular calls, as well as when talking through various instant messengers.
C) Recording messages:
If your child is actively communicating on social networks, then you can find out every word that he writes to the interlocutor on various popular services, including Skype, Viber, WhatsApp and KiK.
D) Tracking emails:
The Mobistealth program has a built-in keylogger that reads all keystrokes on a smartphone, which can be very useful for obtaining passwords from accounts on various Internet resources.
E) Viewing the history of visits to web pages:
Allows you to find out which sites your child visits frequently in order to further block unwanted web addresses.
F) Taking screenshots of the desktop:
Allows you to see applications that were recently installed, after which the corresponding icons appear on the smartphone. In addition, installed unwanted software can be easily removed using the Mobistealth tools through the control panel.
G) Sound recording via built-in microphone:
With this option, you can use your smartphone as an ordinary "bug", listening to all conversations around the device.
H) Tracking SMS messages:
You can read all text messages received through your mobile operator.
https://www.mobistealth.com/
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦a simple paid apk with great features:
Tracking a set of texts, SMS-messages, online correspondence in chats, history of visiting pages on the Internet, calls, contacts, emails, photos and videos in invisible mode;
Access to the online control panel via a computer for remote viewing of recorded and tracked information;
Support for working with almost any device;
Ability to work with gadgets from "Apple" without breaking the system;
Simple registration of an account on the official website;
The program works in a hidden mode, which prevents its deactivation by your children or inexperienced users;
Mobistealth helps protect your children from various cyber threats associated with fraud and extortion;
The software installation takes a few minutes;
Leaders of organizations get the opportunity to better optimize their workflow by tracking employees using Mobistealth software tools;
The cost of maintaining a single device tracking app starts at just $ 0.50 per day.
A) Contact Tracking:
You will always be aware of who your child is communicating with, and if he tries to make an appointment and enter this event in the electronic calendar on your phone, then you will know about it.
B) Voice call tracking tools:
In addition to the fact that with the help of "Mobistealth" you can view the list of outgoing and incoming calls, it is also possible to listen to the voice communication of the interlocutors during regular calls, as well as when talking through various instant messengers.
C) Recording messages:
If your child is actively communicating on social networks, then you can find out every word that he writes to the interlocutor on various popular services, including Skype, Viber, WhatsApp and KiK.
D) Tracking emails:
The Mobistealth program has a built-in keylogger that reads all keystrokes on a smartphone, which can be very useful for obtaining passwords from accounts on various Internet resources.
E) Viewing the history of visits to web pages:
Allows you to find out which sites your child visits frequently in order to further block unwanted web addresses.
F) Taking screenshots of the desktop:
Allows you to see applications that were recently installed, after which the corresponding icons appear on the smartphone. In addition, installed unwanted software can be easily removed using the Mobistealth tools through the control panel.
G) Sound recording via built-in microphone:
With this option, you can use your smartphone as an ordinary "bug", listening to all conversations around the device.
H) Tracking SMS messages:
You can read all text messages received through your mobile operator.
https://www.mobistealth.com/
β β β Uππ»βΊπ«Δπ¬πβ β β β
Mobistealth
Best Parental Control And Monitoring App | Mobistealth
Best Cell Phone and Computer Monitoring software to monitor all activities. View Text Messages, Track Location, Log Keystrokes and much more!
Forwarded from UNDERCODE NEWS
UNDERCODE COMMUNITY
Lateral Movement β RDP.pdf
some pdfs from git
βWinRM stands for Windows Remote Management and is a service that allows administrators to perform management tasks on systems remotely. Communication is performed via HTTP (5985) or HTTPS SOAP (5986) and support Kerberos and NTLM authentication by default and Basic authentication. Usage of this service requires administrator level credentials
βWinRM stands for Windows Remote Management and is a service that allows administrators to perform management tasks on systems remotely. Communication is performed via HTTP (5985) or HTTPS SOAP (5986) and support Kerberos and NTLM authentication by default and Basic authentication. Usage of this service requires administrator level credentials