KitPloit - PenTest Tools!
Caronte - A Tool To Analyze The Network Flow During Attack/Defence Capture The Flag Competitions

https://1.bp.blogspot.com/-a0CIO8ee_pg/YL1fRvEJQyI/AAAAAAAAZ7s/ugyTkBAdoQgxpBGFkQWxGFMcR_94lBU3ACNcBGAsYHQ/w640-h360/caronte_8_main.png Caronte is a tool to analyze the network flow during capture the flag events of type attack/defence. It reassembles TCP packets captured in pcap files to rebuild TCP connections, and analyzes each connection to find user-defined patterns. The patterns can be defined as regex or using protocol specific rules. The connection flows are saved into a database and can be visualized with the web application. REST API are also provided. Features* immediate installation with docker-compose
* no configuration file, settings can be changed via GUI or API
* pcaps to be analyzed can be loaded via curl, either locally or remotely, or via the GUI
* it is also possible to download the pcaps from the GUI and see all the analysis statistics for each pcap

* rules can be created to identify connections that contain certain strings
* pattern matching is done through regular expressions (regex)
* regex in UTF-8 and Unicode format are also supported

* connections can be labeled by type of service, identified by the port number
* each service can be assigned a different color

* ability to filter connections by addresses, ports, dimensions, time, duration, matched rules
* a timeline shows statistics with different metrics sampled per minute
* some of these metrics are connections_per_service, client_bytes_per_service, server_bytes_per_service, duration_per service, matched_rules
* with matched_rules metric it can be possible to see the relationship between flag_in and flag_out

* the timeline contains a sliding window which can be used to search for connections in a certain time interval

* advanced search by term, negated term, exact phrase, regex, negated regex
* the performed searches are saved to be instantly repeated the following times

* the detected HTTP connections are automatically reconstructed
* HTTP requests can be replicated through curl, fetchand python requests* compressed HTTP responses (gzip/deflate) are automatically decompressed

* ability to export and view the content of connections in various formats, including hex and base64
* JSON content is displayed in a JSON tree viewer, HTML code can be rendered in a separate window
* occurrences of matched rules are highlighted in the connection content view
* supports both IPv4 and IPv6 addresses
* if more addresses are assigned to the vulnerable machine to be defended, a CIDR address can be used InstallationThere are two ways to install Caronte:

* with Docker and docker-compose, the fastest and easiest way
* manually installing dependencies and compiling the project Run with DockerThe only things to do are:

* clone the repo, with git clone https://github.com/eciavatta/caronte.git* inside the carontefolder, run docker-compose up -d* wait for the image to be compiled and open browser at http://localhost:3333Manually installationThe first thing to do is to install the dependencies:

* go >= 1.14 https://golang.org/doc/install
* node >= v12 https://nodejs.org/it/download/
* yarnpkg https://classic.yarnpkg.com/en/docs/install/
* hyperscan >= v5 https://www.hyperscan.io/downloads/

Next you need to compile the project, which is composed of two parts:

* the backend, which can be compiled with go mod download && go build* the frontend, which can be compiled with cd frontend && yarn install && yarn buildBefore running Caronte starts an instance of MongoDB https://docs.mongodb.com/manual/administration/install-community/ [...]

___________________________
@hacking_Attack
@Hacking_Video

that has no authentication. Be careful not to expose the MongoDB port on the public interface.

Run the binary with ./caronte. The available configuration options are: -bind-address address where server is bind (default "0.0.0.0") -bind-port port where server is bind (default 3333) -db-name name of database to use (default "caronte") -mongo-host address of MongoDB (default "localhost") -mongo-port port of MongoDB (default 27017) ConfigurationThe configuration takes place at runtime on the first start via the graphical interface or via API. It is necessary to setup:

* the server_address: the ip address of the vulnerable machine. Must be the destination address of all the connections in the pcaps. If each vulnerable service has an own ip, this param accept also a CIDR address. The address can be either IPv4 both IPv6
* the flag_regex: the regular expression that matches a flag. Usually provided on the competition rules page
* auth_required: if true a basic authentication is enabled to protect the analyzer
* an optional accountsarray, which contains the credentials of authorized users DocumentationThe backend, written in Go language, it is designed as a service. It exposes REST API that are used by the frontend written using React. The list of available APIs with their explanation is available here: https://app.swaggerhub.com/apis-docs/eciavatta/caronte/WIP ScreenshotsBelow there are some screenshots showing the main features of the tool. Main window, with connections list and stream contenthttps://1.bp.blogspot.com/-dwP1XL8FFXY/YL1gThx0T5I/AAAAAAAAZ70/dz_otlVpCb0-zS0ba-kWoIY0b2s8-2WFQCNcBGAsYHQ/w640-h360/caronte_8_main.png Main window, with the timeline expandedhttps://1.bp.blogspot.com/-wgojUn6Oocc/YL1gX2QOKEI/AAAAAAAAZ74/GQEh0ThXj0Yhan5kKVqeAvAZhYHLqGfiwCNcBGAsYHQ/w640-h360/caronte_9_main2.png Rules and services viewhttps://1.bp.blogspot.com/-GDevNMvHC1Y/YL1gbqWWyKI/AAAAAAAAZ78/fucXa9bOKvon59S0Xsse7yvNwiu1015RgCNcBGAsYHQ/w640-h360/caronte_10_rules_services.png Searches and pcaps viewhttps://1.bp.blogspot.com/-dfSeEgkz0dw/YL1gh47LzTI/AAAAAAAAZ8A/WA387T3QDIo56USSN1maasHYfBcwuHz2gCNcBGAsYHQ/w640-h360/caronte_11_searches_pcaps.png Download Caronte

___________________________
@hacking_Attack
@Hacking_Video

All about unrestricted file upload
https://infosecwriteups.com/all-about-unrestricted-file-upload-a4ecf243b86b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
searching ...

Hi

Any known search engine in TOR that can only link to working .onion sites ? Not just the ordinary sites i mean the darkweb onion sites , those we see in documentaries and movies , and no not necessary porn ! porn can be found on google ...

submitted by /u/markitingrush
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Ransomware attacks are closing schools, delaying chemotherapy and derailing everyday life

https://external-preview.redd.it/hooOovaywuyHuY7crDLgxvTlCYotK6wptrZI8SnxWZM.jpg?width=640&crop=smart&auto=webp&s=623a58ff4ce9ce9a7b8b28d1f61a04ec8d7e4aa7 submitted by /u/LisaMck041
[link] [comments]

hacking: security in practice
Why is hacking so hard?

I have been trying out OverTheWire: behemoth CTFs and they have been really hard for me. I got through 1 and 2 but after that it feels like it is impossible do them by myself; they are too advanced. Programming for me is way easier than this because it is just remembering programming languages' details and expressing logic and algorithms but for hacking, you have to know all the system details: system calls and OS and try to break them. This alone feels like an impossible task without years of experience in programming Linux and assembly.

submitted by /u/lockpick123159
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Free Course Site
Flutter & Dart – The Complete Guide [2021 Edition]

https://freecoursesite.com/wp-content/uploads/2018/08/1708340_7108_2.jpg
A Complete Guide to the Flutter SDK & Flutter Framework for building native iOS and Android apps. What you’ll learn Learn Flutter and Dart from the ground up, step-by-step Build engaging native mobile apps for both Android and iOS Use features like Google Maps, the device camera, authentication and much more! Learn how to upload […]

The post Flutter & Dart – The Complete Guide [2021 Edition] appeared first on Free Course Site.

___________________________
@hacking_Attack
@Hacking_Video

Free Course Site
Data Structures & Algorithms – JavaScript

https://freecoursesite.com/wp-content/uploads/2021/06/555488777.jpg
The ultimate JavaScript coding interview bootcamp What you’ll learn Confidently answer technical interview questions Mastery of Data Structures and Algorithms Land your dream job Strengthen your skills as a developer Requirements Basic programming No experience with data structures or algorithms required Description This course is different… After each line of code, an animation of the […]

The post Data Structures & Algorithms – JavaScript appeared first on Free Course Site.

___________________________
@hacking_Attack
@Hacking_Video

An easy HTML Injection
https://anishkashukla.medium.com/an-easy-html-injection-c1c6ab6ff05?source=rss------bug_bounty-5

Hello everyone. I hope everyone is doing great :)Continue reading on Medium » (https://anishkashukla.medium.com/an-easy-html-injection-c1c6ab6ff05?source=rss------bug_bounty-5)

All about unrestricted file upload

File upload attacks
Read more...

An easy HTML Injection

Hello everyone. I hope everyone is doing great :)Continue reading on Medium »
Read more...

How do you get your first internship in cyber security?

Hello there, everyone. I hope you’re all doing well. If you are a college student looking for an internship, this blog can assist you in…Continue reading on Medium »
Read more...

Hacking on Medium
Robo de contraseñas 101 — Windows

https://cdn-images-1.medium.com/max/600/1*vkI2c02M1i8DmoAGtlc2Ag.jpeg
La contraseña de Windows es un buen punto de partida para empezar con el crackeado de contraseñas

Continue reading on Medium »

Hacking on Medium
Certificaciones enfocadas en la seguridad web

eWPT: https://elearnsecurity.com/product/ewpt-certification/

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking

https://cdn-images-1.medium.com/max/600/1*SyLLnP8fFUh0Ot-S6pm88Q.jpeg
Growth Hacking 101

Continue reading on Medium »