Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools!
HookDump - Security Product Hook Detection

https://1.bp.blogspot.com/-QK39bYgsM0w/YKr01qjQkBI/AAAAAAAAWR4/a26Fxld8i3Qb3slcqNxbfrG5u29xrgXzgCNcBGAsYHQ/w640-h342/HookDump.png
EDR function hook dumping

Please refer to the Zeroperil blog post for more information https://zeroperil.co.uk/hookdump/
Building source

* In order to build this you will need Visual Studio 2019 (community edition is fine) and CMake. The batch file Configure.bat will create two build directories with Visual Studio solutions.
* The project may build with MinGW with the correct CMake command line, this is untested YMMV.
* There is a dependency on zydis disassembler, so be sure to update the sub-modules in git before configuring the project.
* There is a 32bit and 64bit project, you may find that EDR's hook different functions in 32/64 bit so building and running both executables may provide more complete results

Notes

* Some EDRs replace the WOW stub in the TEB structure (specifically Wow32Reserved) in order to hook system calls for 32 bit binaries. In this case you may see zero hooks since no jump instructions are present in NTDLL. Most likley you will see hooks in the x64 version as the syscall instruction is used for system calls instead of a WOW stub
* We have noted that Windows Defender does not use any user mode hooks
* This tool is designed to be run as a standard user, elevation is not required

Hook Types Detected

JMP

A jump instruction has been patched into the function to redirect execution flow

WOW

Detection of the WOW64 syscall stub being hooked, which allows filtering of all system calls

EAT

The address in the export address table does not match the address in the export address table in the copy on disc

GPA

GetProcAddress hook, an experimental feature, this is only output in verbose mode, when the result of GetProcAddress does not match the manually resolved function address. YYMV with this and some care should be taken to verify the results.

Verification

The only way to truly verify the correct working of the program is to check in a debugger if hooks are present. If you are getting a zero hooks result and are expecting to see something different, then first verify this in a debugger and please get in touch.
Download HookDump

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

HookDump - Security Product Hook Detection

4 viewsedited 22:30

Deep Web
Do you have some good antivirus so I can go on the deep web safely?

submitted by /u/sophiabreton
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Do you have some good antivirus so I can go on the deep web safely?

Posted in r/deepweb by u/sophiabreton • 1 point and 0 comments

4 viewsedited 23:30

Hacking Articles Tips Tricks Videos Tutorials

The beauty of chaining client-side bugs

This is part of a report of a bug that I sent back in 2020, changing of course the program name for obvious reasons.Continue reading on Medium »
Read more...

6 views23:44

Hacking Articles Tips Tricks Videos Tutorials

The beauty of chaining client-side bugs
https://master-sec.medium.com/the-beauty-of-chaining-client-side-bugs-759e1091eabf?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

The beauty of chaining client-side bugs

This is part of a report of a bug that I sent back in 2020, changing of course the program name for obvious reasons.

6 viewsedited 23:56

Hacking Articles Tips Tricks Videos Tutorials

5 views23:56

Hacking Articles Tips Tricks Videos Tutorials

This is part of a report of a bug that I sent back in 2020, changing of course the program name for obvious reasons.Continue reading on Medium » (https://master-sec.medium.com/the-beauty-of-chaining-client-side-bugs-759e1091eabf?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium