MemTracer - Memory Scaner
http://www.kitploit.com/2023/11/memtracer-memory-scaner.html

MemTracer is a tool that offers live memory analysis (https://www.kitploit.com/search/label/Analysis) capabilities, allowing digital forensic (https://www.kitploit.com/search/label/Forensic) practitioners to discover (https://www.kitploit.com/search/label/Discover) and investigate stealthy attack traces hidden in memory. The MemTracer is implemented in Python language, aiming to detect reflectively loaded native .NET framework Dynamic-Link Library (DLL). This is achieved by looking for the following abnormal memory region’s characteristics: The state of memory pages flags in each memory region. Specifically, the MEM_COMMIT flag which is used to reserve memory pages for virtual memory use. The type of pages in the region. The MEM_MAPPED page type indicates that the memory pages within the region are mapped into the view of a section. The memory protection (https://www.kitploit.com/search/label/Protection) for the region. The PAGE_READWRITE protection to indicate that the memory region is readable and writable, which happens if Assembly.Load(byte[]) method is used to load a module into memory. The memory region contains a PE header.
The tool starts by scanning the running processes, and by analyzing the allocated memory regions characteristics to detect reflective DLL loading symptoms. Suspicious memory regions which are identified as DLL modules are dumped for further analysis and investigation.
Furthermore, the tool features the following options: Dump the compromised process. Export a JSON file that provides information about the compromised process, such as the process name, ID, path, size, and base address. Search for specific loaded module by name. Example python.exe memScanner.py [-h] [-r] [-m MODULE]
-h, --help show this help message and exit
-r, --reflectiveScan Looking for reflective DLL loading
-m MODULE, --module MODULE Looking for spcefic loaded DLL The script needs administrator privileges in order incepect all processes.

Download MemTracer (https://github.com/mayHamad/MemTracer)

Writeups of All Apprentice Labs in Portswigger — All Lab’s Solution| Karthikeyan Nagaraj
https://cyberw1ng.medium.com/writeups-of-all-apprentice-labs-in-portswigger-all-labs-solution-karthikeyan-nagaraj-a5f23fd0c87b?source=rss------bug_bounty-5

The Blog Contains a series of all writeups of Apprentice labs in Portswigger with an Explanation of Each Vulnerability. Labs are solved…Continue reading on Medium » (https://cyberw1ng.medium.com/writeups-of-all-apprentice-labs-in-portswigger-all-labs-solution-karthikeyan-nagaraj-a5f23fd0c87b?source=rss------bug_bounty-5)

Writeups of All Apprentice Labs in Portswigger — All Lab’s Solution| Karthikeyan Nagaraj

The Blog Contains a series of all writeups of Apprentice labs in Portswigger with an Explanation of Each Vulnerability. Labs are solved…Continue reading on Medium »
Read more...

Persistence - Scheduled Task Tampering
https://www.reddit.com/r/redteamsec/comments/17zo5lw/persistence_scheduled_task_tampering/

submitted by /u/netbiosX (https://www.reddit.com/user/netbiosX)
[link] (https://pentestlab.blog/2023/11/20/persistence-scheduled-task-tampering/) [comments] (https://www.reddit.com/r/redteamsec/comments/17zo5lw/persistence_scheduled_task_tampering/)

ESSENTIAL HTML FOR HACKERS

IN THIS BLOG, I WILL SHARE MY KNOWLEDGE OF HTML STUFFS THAT ARE REQUIRED FOR BECOMING A HACKERContinue reading on Medium »
Read more...

ESSENTIAL HTML FOR HACKERS
https://medium.com/@agapehearts/essential-html-for-hackers-12d329927c9b?source=rss------bug_bounty-5

IN THIS BLOG, I WILL SHARE MY KNOWLEDGE OF HTML STUFFS THAT ARE REQUIRED FOR BECOMING A HACKERContinue reading on Medium » (https://medium.com/@agapehearts/essential-html-for-hackers-12d329927c9b?source=rss------bug_bounty-5)

The Story of How I Hacked one of the online payment system website twice

Back in 2018 when I was in high school, the site owner asked me to check the security of their website. They were curious because I had…Continue reading on Medium »
Read more...

The Story of How I Hacked one of the online payment system website twice
https://christmex.medium.com/the-story-of-how-i-hacked-one-of-the-online-payment-system-website-twice-b0ba48ed13db?source=rss------bug_bounty-5

Back in 2018 when I was in high school, the site owner asked me to check the security of their website. They were curious because I had…Continue reading on Medium » (https://christmex.medium.com/the-story-of-how-i-hacked-one-of-the-online-payment-system-website-twice-b0ba48ed13db?source=rss------bug_bounty-5)

Go Beyond with Gretire

As you may know, some hackers like using the command line interface and running tools to gather information for later monitoring. I happen…Continue reading on System Weakness »
Read more...

r-tec Blog | Process Injection - Avoiding Kernel Triggered Memory Scans.
https://www.reddit.com/r/redteamsec/comments/17zufwy/rtec_blog_process_injection_avoiding_kernel/

submitted by /u/S3cur3Th1sSh1t (https://www.reddit.com/user/S3cur3Th1sSh1t)
[link] (https://www.r-tec.net/r-tec-blog-process-injection-avoiding-kernel-triggered-memory-scans.html) [comments] (https://www.reddit.com/r/redteamsec/comments/17zufwy/rtec_blog_process_injection_avoiding_kernel/)

Go Beyond with Gretire
https://systemweakness.com/go-beyond-with-gretire-313b7fbe3f47?source=rss------bug_bounty-5

As you may know, some hackers like using the command line interface and running tools to gather information for later monitoring. I happen…Continue reading on System Weakness » (https://systemweakness.com/go-beyond-with-gretire-313b7fbe3f47?source=rss------bug_bounty-5)