Hacking Articles Tips Tricks Videos Tutorials
468 subscribers
65.8K photos
15 videos
157 files
132K links
Exploit
Pentesting
Hacking
Red Team
Blue Team
Kali Linux
Bug Bounty
Black Hat
Cyber security etc

@Hacking_Video
@Hacking_attack
Download Telegram
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials VTI-Dorks – Mastering Threat Hunting With VirusTotal Queries Awesome VirusTotal Enterprise Search Queries (formerly Virustotal Intelligence or VTI). In today’s evolving cyber landscape, effective threat hunting is paramount. ‘VTI-Dorks:…
rds used by this sandbox) "c2ae:STEALER and tag:peexe" Content Searches (New Feature)

Content searches cannot be combined with other conditions.

Search for well-known mimikatz keyword in any type of sample. "content:"sekurlsa::logonpasswords""
Detects phishing documents that ask the user to activate macros "content:"click enable editing"
content:"click enable content""
Detects exploit codes "content:"] Shellcode"" Sample Similarities And Pivoting

Content searches for malware similarities.

VT Feature Hash is an internal hash used by Virustotal. "similar-to:<hashofthefile"
Code Blocks is used to look for samples that contain the same pieces of code. "code-similar-to:<hashofthefile"
ImpHash is a well-known hash calculated with the Import Address Table to identify samples using the same imported functions. "imphash:<iathash"
PE Rich Hash is a hash calculated from Rich Header. "rich_pe_header_hash:<richhash"
TLSH is used to generate hash values which can then be analyzed for similarities. "tlsh:<tlshash"
SSDEEP is a fuzzing algorithm that can be used for the same purpose. "ssdeep:<ssdeep_hash"
The other functions are used to identify similarity based on behavior identified with sandbox analysis. "behash:<hashofthefile"
Files with a visually similar icon or thumbnail. "main_icon_dhash:<icon_hash"
.NET files that were built in one project have the same GUID value "netguid:<guid"
Permhash is used to hash the declared permissions applied to Chromium-based browser extensions and APKs "permhash:<permhash"
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
CloudGrep – Efficient Direct Search For Logs In Cloud Storage

The innovative solution designed to streamline your search processes in cloud storage. By bypassing traditional log indexing in SIEMs, CloudGrep offers a faster, cost-effective method to delve directly into your AWS S3 logs.

Whether you’re debugging applications or conducting a security investigation, discover how CloudGrep enhances your cloud-based search capabilities. Why?

* Directly searching cloud storage, without indexing logs into a SIEM or Log Analysis tool, can be faster and cheaper.
* There is no need to wait for logs to be ingested, indexed, and made available for searching.
* It searches files in parallel for speed.
* If you run this in the same region as the S3 bucket using a VPC endpoint for S3 you can avoid data transfer costs. Do check first!
* This may be of use when debugging applications, or investigating a security incident. Example

Simple example: python3 cloudgrep.py --bucket test-s3-access-logs --query 9RXXKPREHHTFQD77
python3 cloudgrep.py -b test-s3-access-logs -q 9RXXKPREHHTFQD77

More complicated example: python3 cloudgrep.py -b test-s3-access-logs --prefix "logs/" --filename ".log" -q 9RXXKPREHHTFQD77 -s "2023-01-09 20:30:00" -e "2023-01-09 20:45:00" --file_size 10000 --debug
Saving the output to a file: python3 cloudgrep.py -b test-s3-access-logs -q 9RXXKPREHHTFQD77 --hide_filenames > output.txt
Example output: Bucket is in region: us-east-2 : Search from the same region to avoid egress charges.
Searching 11 files in test-s3-access-logs for 9RXXKPREHHTFQD77...
access2023-01-09-20-34-20-EAC533CB93B4ACBE: abbd82b5ad5dc5d024cd1841d19c0cf2fd7472c47a1501ececde37fe91adc510 bucket-72561-s3bucketalt-1my9piwesfim7 [09/Jan/2023:19:20:00 +0000] 1.125.222.333 arn:aws:sts::000011110470:assumed-role/bucket-72561-myResponseRole-1WP2IOKDV7B4Y/1673265251.340187 9RXXKPREHHTFQD77 REST.GET.BUCKET - "GET /?list-type=2&prefix=-collector%2Fproject-&start-after=&encoding-type=url HTTP/1.1" 200 - 946 - 33 32 "-" "Boto3/1.21.24 Python/3.9.2 Linux/5.10.0-10-cloud-amd64 Botocore/1.24.46" - aNPuHKw== SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader bucket-72561-s3bucketalt-1my9piwesfim7.s3.us-east-2.amazonaws.com TLSv1.2 - -
Arguments python3 cloudgrep.py --help
usage: cloudgrep.py [-h] -b BUCKET -q QUERY [-p PREFIX] [-f FILENAME] [-s START_DATE] [-e END_DATE] [-fs FILE_SIZE] [-d] [-hf]

CloudGrep searches is grep for cloud storage like S3.

options:
-h, --help show this help message and exit
-b BUCKET, --bucket BUCKET
Bucket to search. E.g. my-bucket
-q QUERY, --query QUERY
Text to search for. Will be parsed as a Regex. E.g. example.com
-p PREFIX, --prefix PREFIX
Optionally filter on the start of the Object name. E.g. logs/
-f FILENAME, --filename FILENAME
Optionally filter on Objects that match a keyword. E.g. .log.gz
-s START_DATE, --start_date START_DATE
Optionally filter on Objects modified after a Date or Time. E.g. 2022-01-01
-e END_DATE, --end_date END_DATE
Optionally filter on Objects modified before a Date or Time. E.g. 2022-01-01
-fs FILE_SIZE, --file_size FILE_SIZE
Optionally filter on Objects smaller than a file size, in bytes. Defaults to 100 Mb.
-d, --debug Enable Debug logging.
-hf, --hide_filenames
Dont show matching filesnames.
Deployment

Install with: pip3 install -r requirements.txt

You can run this from your local laptop, or from an EC2 instance in the same region as the S3 bucket with a VPC endpoint for S3 to avoid egress charges.

You can authenticate in a number of ways. If you are running on an EC2, an Instance Profile is likely the best choice.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
ChopChop – Web Security Testing Tool

ChopChop is a command-line tool for dynamic application security testing on web applications, initially written by the Michelin CERT.

Its goal is to scan several endpoints and identify exposition of services/files/folders through the webroot. Checks/Signatures are declared in a config file (by default: "chopchop.yml"), fully configurable, and especially by developers.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEyzzOEGsBX1vAw-CJaP8N6JIYGZ4D0MS3N-gb6y_VL-LEHNfsDpdfRE5J6UZK73KDOe3OaOYE9iNSwIMe520553SqK7naPIZanbWX1d9oMsSMIlhZasJimpDfnqBWvii0YoSAiB8csRoE49x8IfSxQqR2jV9rm7qrVc-SBF6lKbR_9kuzH8Fumz3pjvEN/s16000/demo%20(1).gif
“Chop chop” is a phrase rooted in Cantonese. “Chop chop” means “hurry” and suggests that something should be done now and without delay. Table Of Contents

* Building
* Usage
* Available flags
* Advanced usage

* Creating a new check/signature
* External Libraries
* Talks
* Licence
* Authors Building

We tried to make the build process painless and hopefully, it should be as easy as: "$ go mod download
$ go build ."
There should be a resulting "gochopchop" binary in the folder. Using Docker

Thanks to Github Container Registry, we are able to provide you some freshly-build Docker images! "docker run ghcr.io/michelin/gochopchop scan https://foobar.com -v debug" "docker run ghcr.io/michelin/gochopchop scan https://foobar.com -v debug "But if you prefer, you can also build it locally, see below: Build Locally "docker build -t gochopchop ." Usage

We are continuously trying to make "goChopChop" as easy as possible. Scanning a host with this utility is as simple as : "$ ./gochopchop scan https://foobar.com" Using Docker "docker run gochopchop scan https://foobar.com" Custom Configuration File "docker run -v ./:/app chopchop scan -c /app/chopchop.yml https://foobar.com" What’s Next

The Golang rewrite took place a couple of months ago but there’s so much to do, still. Here are some features we are planning to integrate : [x] Threading for better performance [x] Ability to specify the number of concurrent threads [x] Colors and better formatting [x] Ability to filter checks/signatures to search for [x] Mock and unit tests [x] Github CI And much more! Testing

To quickly end-to-end test chopchop, we provided a web-server in "tests/server.go". To try it, please run "go run tests/server.go" then run chopchop with the following command "./gochopchop scan http://localhost:8000 --verbosity Debug". ChopChop should print “no vulnerabilities found”.

There are also unit test that you can launch with "go test -v ./...". These tests are integrated in the github CI workflow. Available Flags

You can find the available flags available for the "scan" command :
FlagFull flagDescription"-h""--help"Help wizard"-v""--verbosity"Verbose level of logging"-c""--signature"Path of custom signature file"-k""--insecure"Disable SSL Verification"-u""--url-file"Path to a specified file containing urls to test"-b""--max-severity"Block the CI pipeline if severity is over or equal specified flag"-e""--export"Export type of the output (csv and/or json)"--export-filename"Specify the filename for the export file(s)"-t""--timeout"Timeout for the HTTP requests"--severity-filter"Filter Plugins by severity"--plugin-filter"Filter Plugins by name of plugin"--threads"Number of concurrent threads Advanced Usage

Here is a list of advanced usage that you might be interested in. Note: Redirectors like ">" for post processing can be used.

* Ability to scan and disable SSL verification "$ ./gochopchop scan https://foobar.com --insecure"
* Ability to scan with a custom configuration file (including custom plugins) "$ ./gochopchop scan https://foobar.com --insecure --signature test_config.yml"
* Ability to list all the plugins or by severity : "plugins" or[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials ChopChop – Web Security Testing Tool ChopChop is a command-line tool for dynamic application security testing on web applications, initially written by the Michelin CERT. Its goal is to scan several endpoints and identify exposition…
"plugins --severity High" "$ ./gochopchop plugins --severity High"
* Ability to specify number of concurrent threads : "--threads 4" for 4 workers "$ ./gochopchop plugins --threads 4"
* Ability to block the CI pipeline by severity level (equal or over specified severity) : "--max-severity Medium" "$ ./gochopchop scan https://foobar.com --max-severity Medium"
* Ability to specify specific signatures to be checked "./gochopchop scan https://foobar.com --timeout 1 --verbosity --export=csv,json --export-filename boo --plugin-filters=Git,Zimbra,Jenkins"
* Ability to list all the plugins "$ ./gochopchop plugins"
* List High severity plugins "$ ./gochopchop plugins --severity High"
* Set a list or URLs located in a file "$ ./gochopchop scan --url-file url_file.txt"
* Export GoChopChop results in CSV and JSON format "$ ./gochopchop scan https://foobar.com --export=csv,json --export-filename results" Creating A New Check

Writing a new check is as simple as : "- endpoint: "/.git/config"
checks:
- name: Git exposed
match:
- "[branch"
remediation: Do not deploy .git folder on production servers
description: Verifies that the GIT repository is accessible from the site
severity: "High""
An endpoint (eg. "/.git/config") is mapped to multiple checks which avoids sending X requests for X checks. Multiple checks can be done through a single HTTP request. Each check needs those fields:
AttributeTypeDescriptionOptional ?ExamplenamestringName of the checkNoGit exposeddescriptionstringA small description for the checkNoEnsure .git repository is not accessible from the webrootremediationstringGive a remediation for this specific “issue”NoDo not deploy .git folder on production serversseverityEnum(“High”, “Medium”, “Low”, “Informational”)Rate the criticity if it triggers in your environmentNoHighstatus_codeintegerThe HTTP status code that should be returnedYes200headersList of stringList of headers there should be in the HTTP responseYesN/Ano_headersList of stringList of headers there should NOT be in the HTTP responseYesN/AmatchList of stringList the strings there should be in the HTTP responseYes“[branch”no_matchList of stringList the strings there should NOT be in the HTTP responseYesN/Aquery_stringGET parameters that have to be passed to the endpointStringYes"query_string: "id=FOO-chopchoptest""
Dark Reading: Attacks/Breaches
Badbox Operation Targets Android Devices in Fraud Schemes

Researchers believe that more than 70,000 Android devices may have been affected.
Dark Reading: Attacks/Breaches
New One-Click Exploit Is a Supply Chain Risk for Linux OSes

An overlooked library contains a vulnerability that could enable full remote takeover simply by clicking a link.
Dark Reading: Attacks/Breaches
Internet-Wide Zero-Day Bug Fuels Largest-Ever DDoS Event

Ongoing Rapid Reset DDoS flood attacks exposed organizations need to patch CVE-2023-44487 immediately to head off crippling outages and business disruption.
hacking: security in practice
How to FALL IN LOVE with Networking?

I started my journey after new year 2023,went through Network+ basics so i could tackle easier Security +. Right now im finishing CCD and my next goal are pen.testing certs. So far i have basic knowledge of networking,but i would like to be better at it,only problem is it bores me so much..so how could i force myself to start liking it? Its kinda important thing if you want ro be good at hacking ,right.

submitted by /u/RevMarC2
[link] [comments]
hacking: security in practice
It is possible!

Hard means possible. You can become a self-taught hacker like I did. without paying for courses or certificates or whatever.
you just got to believe in yourself and not give up when things starts to get complicated and scary.

There is no real path you should go through but it is always best to start by learning a programming language

submitted by /u/daddy_ubi
[link] [comments]
hacking: security in practice
Hashcat with locked iPad-- cannot locate hash file

Hi,

I'm pretty new and don't know a whole lot but I'm trying to crack a locked iPad for practice (yes, I have permission. Long story). I've searched the reddit and google but can't find info pertaining to my specific question.

I'm using Hashcat for this and have gained a rudimentary understanding of how this all works, but my problem is I can't figure out how to extract the Manifest.plist file from the iPad. I've not backed it up on this laptop before. Is this possible even? I know what to do once I get the hash I just cannot figure out how to get it. I tried using the github repo itunes_backup2hashcat but my Terminal keeps saying it can't read the Manifest.plist, which makes me think I'm going in the wrong direction entirely with this.

submitted by /u/_blue-bird_
[link] [comments]