Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials
Caronte : A Tool To Analyze The Network Flow During Attack/Defence Capture The Flag Competitions

Caronte is a tool to analyze the network flow during capture the flag events of type attack/defence. It reassembles TCP packets captured in pcap files to rebuild TCP connections, and analyzes each connection to find user-defined patterns. The patterns can be defined as regex or using protocol specific rules. The connection flows are saved into […]

The post Caronte : A Tool To Analyze The Network Flow During Attack/Defence Capture The Flag Competitions appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Caronte : A Tool To Analyze The Network Flow During Defense Capture

Caronte is a tool to analyze the network flow during capture the flag events of type attack/defense. It reassembles TCP packets captured.

16 viewsedited 19:02

Hacking Articles Tips Tricks Videos Tutorials

15 views19:08

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
TryHackMe: Steel Mountain

https://cdn-images-1.medium.com/max/2600/1*NuP4l23THgs2Q2z04E1Skg.png
A walkthrough.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

TryHackMe: Steel Mountain

A walkthrough.

15 viewsedited 19:08

Hacking Articles Tips Tricks Videos Tutorials

Kconfig-Hardened-Check - A Tool For Checking The Hardening Options In The Linux Kernel Config
http://www.kitploit.com/2021/06/kconfig-hardened-check-tool-for.html

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Kconfig-Hardened-Check - A Tool For Checking The Hardening Options In The Linux Kernel Config

13 viewsedited 22:12

Hacking Articles Tips Tricks Videos Tutorials

13 views22:12

Hacking Articles Tips Tricks Videos Tutorials

Motivation
There are plenty of Linux kernel hardening config options. A lot of them are not enabled by the major distros. We have to enable these options ourselves to make our systems more secure. But nobody likes checking configs manually. So let the computers do their job! kconfig-hardened-check.py helps me to check the Linux kernel Kconfig option list against my hardening preferences, which are based on the KSPP recommended settings (http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings), CLIP OS kernel configuration (https://docs.clip-os.org/clipos/kernel.html#configuration), last public grsecurity (https://grsecurity.net/) patch (options which they disable), SECURITY_LOCKDOWN_LSM (https://lwn.net/Articles/791863/) patchset, direct feedback from Linux kernel maintainers (Daniel Vetter in issue #38 (https://github.com/a13xp0p0v/kconfig-hardened-check/issues/38)). I also created Linux Kernel Defence Map that is a graphical representation of the relationships between these hardening features and the corresponding vulnerability (https://www.kitploit.com/search/label/Vulnerability) classes or exploitation (https://www.kitploit.com/search/label/Exploitation) techniques.
Supported microarchitectures
X86_64 X86_32 ARM64 ARM
Installation
You can install the package: pip install git+https://github.com/a13xp0p0v/kconfig-hardened-check
or simply run ./bin/kconfig-hardened-check from the cloned repository.
Usage
usage: kconfig-hardened-check [-h] [--version] [-p {X86_64,X86_32,ARM64,ARM}]
[-c CONFIG]
[-m {verbose,json,show_ok,show_fail}]

Checks the hardening options in the Linux kernel config

optional arguments:
-h, --help show this help message and exit
--version show program's version number and exit
-p {X86_64,X86_32,ARM64,ARM}, --print {X86_64,X86_32,ARM64,ARM}
print hardening preferences for selected architecture
-c CONFIG, --config CONFIG
check the kernel config file against these preferences
-m {verbose,json,show_ok,show_fail}, --mode {verbose,json,show_ok,show_fail}
choose the report mode

Output for Ubuntu 20.04 LTS (Focal Fossa) kernel config
$ ./bin/kconfig-hardened-check -c kconfig_hardened_check/config_files/distros/ubuntu-focal.config
[+] Config file to check: kconfig_hardened_check/config_files/distros/ubuntu-focal.config
[+] Detected architecture: X86_64
[+] Detected kernel version: 5.4
=========================================================================================================================
option name | desired val | decision | reason | check result
=========================================================================================================================
CONFIG_BUG | y |defconfig | self_protection | OK
CONFIG_SLUB_DEBUG | y |defconfig | self_protection | OK
CONFIG_GCC_PLUGINS | y |defconfig | self_protection | FAIL: not found
CONFIG_STACKPROTECTOR_STRONG | y |defconfig | self_protection | OK
CONFIG_STRICT_KERNEL_RWX | y |defconfig | self_protection | OK
CONFIG_STRICT_MODULE_RWX | y |defconfig | self_protection | OK
CONFIG_REFCOUNT_FULL | y |defconfig | self_protection | FAIL: "is not set"
CONFIG_IOMMU_SUPPORT | y |defconfig | self_protection | OK
CONFIG_MICROCODE | y |defconfig | self_protection | OK
CONFIG_RETPOLINE | y |defconfig | self_protection | OK

___________________________
@hacking_Attack
@Hacking_Video

13 viewsedited 22:12

Hacking Articles Tips Tricks Videos Tutorials

13 viewsedited 22:12

Hacking Articles Tips Tricks Videos Tutorials

10 viewsedited 22:12

Hacking Articles Tips Tricks Videos Tutorials

8 viewsedited 22:12

Hacking Articles Tips Tricks Videos Tutorials

CONFIG_X86_IOPL_IOPERM | is not set | clipos | cut_attack_surface | OK: not found
CONFIG_ACPI_TABLE_UPGRADE | is not set | clipos | cut_attack_surface | FAIL: "y"
CONFIG_EFI_CUSTOM_SSDT_OVERLAYS | is not set | clipos | cut_attack_surface | OK: not found
CONFIG_LDISC_AUTOLOAD | is not set | clipos | cut_attack_surface | FAIL: "y"
CONFIG_X86_INTEL_TSX_MODE_OFF | y | clipos | cut_attack_surface | OK
CONFIG_EFI_TEST | is not set | lockdown | cut_attack_surface | FAIL: "m"
CONFIG_BPF_SYSCALL | is not set | lockdown | cut_attack_surface | FAIL: "y"
CONFIG_MMIOTRACE_TEST | is not set | lockdown | cut_attack_surface | OK
CONFIG_TRIM_UNUSED_KSYMS | y | my | cut_attack_surface | FAIL: not found
CONFIG_MMIOTRACE | is not set | my | cut_attack_surface | FAIL: "y"
CONFIG_LIVEPATCH | is not set | my | cut_attack_surface | FAIL: "y"
CONFIG_IP_DCCP | is not set | my | cut_attack_surface | FAIL: "m"
CONFIG_IP_SCTP | is not set | my | cut_attack_surface | FAIL: "m"
CONFIG_FTRACE | is not set | my | cut_attack_surface | FAIL: "y"
CONFIG_VIDEO_VIVID | is not set | my | cut_attack_surface | FAIL: "m"
CONFIG_INPUT_EVBUG | is not set | my | cut_attack_surface | FAIL: "m"
CONFIG_INTEGRITY | y |defconfig |userspace_hardening | OK
CONFIG_ARCH_MMAP_RND_BITS | 32 | clipos |userspace_hardening | FAIL: "28"
[+] Config check is finished: 'OK' - 58 / 'FAIL' - 82

kconfig-hardened-check versioning
I usually update the kernel hardening recommendations after each Linux kernel release. So the version of kconfig-hardened-check is associated with the corresponding version of the kernel. The version format is: [major_number].[kernel_version].[kernel_patchlevel]
Questions and answers
Q: How disabling CONFIG_USER_NS cuts the attack surface? It's needed for containers! A: Yes, the CONFIG_USER_NS option provides some isolation between the userspace programs, but the tool recommends disabling it to cut the attack surface of the kernel. The rationale: A nice LWN article about the corresponding LKML discussion: https://lwn.net/Articles/673597/ A twitter thread about CONFIG_USER_NS and security: https://twitter.com/robertswiecki/status/1095447678949953541 A good overview of the trade-off between having user namespaces enabled, disabled and available only for root: https://github.com/NixOS/nixpkgs/pull/84522#issuecomment-614640601
Q: Why CONFIG_GCC_PLUGINS is automatically disabled during the kernel compilation? A: It means that your gcc doesn't support plugins. For example, if you have gcc-7 on Ubuntu, try to install gcc-7-plugin-dev package, it should help.
Q: KSPP and CLIP OS recommend CONFIG_PANIC_ON_OOPS=y. Why doesn't this tool do the same? A: I personally don't support this recommendation because it provides easy denial-of-service attacks for the whole system (kernel oops is not a rare situation). I think having CONFIG_BUG is enough here -- if we have a kernel oops in the process context, the offending/attacking process is killed.
Q: What about performance impact of these kernel hardening options? A: Ike Devolder @BlackIkeEagle (https://github.com/BlackIkeEagle) made some performance tests and described the results in this article (https://blog.herecura.eu/blog/2020-05-30-kconfig-hardening-tests/).

___________________________
@hacking_Attack
@Hacking_Video

LWN.net

Controlling access to user namespaces

The user namespaces feature holds an interesting promise for system security: users can be conf [...]

9 viewsedited 22:12

Hacking Articles Tips Tricks Videos Tutorials

Q: Why enabling CONFIG_STATIC_USERMODEHELPER breaks various things in my GNU/Linux system? Do I really need that feature? A: Linux kernel usermode helpers can be used for privilege escalation (https://www.kitploit.com/search/label/Privilege%20Escalation) in kernel exploits (example 1 (https://googleprojectzero.blogspot.com/2018/09/a-cache-invalidation-bug-in-linux.html), example 2 (https://a13xp0p0v.github.io/2020/02/15/CVE-2019-18683.html)). CONFIG_STATIC_USERMODEHELPER prevents that method. But it requires the corresponding support in the userspace: see the example implementation (https://github.com/tych0/huldufolk) by Tycho Andersen @tych0 (https://github.com/tych0).
Q: Does my kernel have all those mitigations of Transient Execution Vulnerabilities in my hardware? A: Checking the kernel config is not enough to answer this question. I highly recommend using spectre-meltdown-checker (https://github.com/speed47/spectre-meltdown-checker) tool maintained by Stéphane Lesimple @speed47 (https://github.com/speed47).

Download Kconfig-Hardened-Check (https://github.com/a13xp0p0v/kconfig-hardened-check)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.

9 viewsedited 22:12

Hacking Articles Tips Tricks Videos Tutorials

CSRF on Password Reset

My name is Filipe Azevedo and in this post, I’m going to talk about a CSRF that I recently found on a private program on HackerOne.Continue reading on Medium »
Read more...

9 views22:14

Hacking Articles Tips Tricks Videos Tutorials

CSRF on Password Reset
https://filipaze.medium.com/csrf-on-password-reset-c79d30615b77?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

CSRF on Password Reset

My name is Filipe Azevedo and in this post, I’m going to talk about a CSRF that I recently found on a private program on HackerOne.

10 viewsedited 22:54

Hacking Articles Tips Tricks Videos Tutorials

10 views22:54

Hacking Articles Tips Tricks Videos Tutorials

My name is Filipe Azevedo and in this post, I’m going to talk about a CSRF that I recently found on a private program on HackerOne.Continue reading on Medium » (https://filipaze.medium.com/csrf-on-password-reset-c79d30615b77?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

CSRF on Password Reset

My name is Filipe Azevedo and in this post, I’m going to talk about a CSRF that I recently found on a private program on HackerOne.

13 viewsedited 22:54

Hacking Articles Tips Tricks Videos Tutorials

10 views23:01

Hacking Articles Tips Tricks Videos Tutorials

Photo

Dark Reading: Attacks/Breaches
Accidental Insider Leaks Prove Major Source of Risk

Research reports highlight growing concerns around insider negligence that leads to data breaches.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Accidental Insider Leaks Prove Major Source of Risk

Research reports highlight growing concerns around insider negligence that leads to data breaches.

9 viewsedited 23:01

About

Blog

Apps

Platform