KitPloit - PenTest Tools!
Doldrums - A Flutter/Dart Reverse Engineering Tool

http://3.bp.blogspot.com/-tTUkIW-TdlE/YP8f9froezI/AAAAAAAAops/NJuPvbe9mJwkOax5FX5yTMCcUaQlsPF4ACK4BGAYYCw/w640-h176/Doldrums_1_logo-783659.png
To flutter: to move in quick, irregular motions, to beat rapidly, to be agitated.
Doldrums: a period of stagnation.

Doldrums is a reverse engineering tool for Flutter apps targetting Android. Concretely, it is a parser and information extractor for the Flutter/Dart Android binary, conventionally named libapp.so, for all Dart version 2.10 releases. When run, it outputs a full dump of all classes present in the isolate snapshot.

The tool is currently in beta, and missing some deserialization routines and class information. If it does not work out-of-the-box, please let me know.
Dependencies

Doldrums requires pyelftools to parse the ELF format. You can install it with

pip3 install pyelftools


Usage

To use, simply run the following command, substituting libapp.sofor the appropriate binary, and outputfor the desired output file. Note that the verbose option only works for Dart snapshot v2.12.

python3 src/main.py [-v] libapp.so output


The expected output is a dump of all classes, in the following format:

class MyApp extends StatelessWidget {
Widget build(DynamicType, DynamicType) {
Code at absolute offset: 0xec85c
}

String myPrint(DynamicType, DynamicType) {
Code at absolute offset: 0xeca80
}
}


The absolute code offset indicates the offset into the libapp.sofile where the native function may be found.

Reading material

For a detailed write-up on the format, please check my blog post.

Related works

darter is a fully implemented and fully tested parser for Dart version 2.5 releases.

Contribute

If you'd like to help the project, consider making a pull request, or donating to

* ADA: DdzFFzCqrhsgHAVMtnep9Uq9iF61oxZ31LWVG3izmT8BH54Jz7C2gUBFcy6VnCkrbVNqrkevQ4wSwK7dfh7YrUfvSd5toKdE9tzZrcaB
* BTC: 33piC5kfTdqFyQ5ionmuJkTDJXsFYdzGdS
* ETH: 0x2bF670503C28B551C80191aeE9F7ACC96e101D9B

Logo by Luis Fonseca.
Download Doldrums

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cyber Security Interview Questions Part-2

https://cdn-images-1.medium.com/max/1400/0*gBbKtZQAI2iyYLGG.png
Precontext: This is the part 2 of the series of cyber security interview questions. If you haven’t read the first part go here…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
POPCORN — HackTheBox WriteUp

https://cdn-images-1.medium.com/max/771/1*lLX-zSeXBeaGSsCKlIKYNA.png
This box is a part of TJnull’s list of boxes. I am doing these boxes as a part of my preparation for OSCP. I will be sharing the writeups…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HYBRID HACKER SUMMER CAMP 2021 GUIDE — Part Six: DEFCON 29

https://cdn-images-1.medium.com/max/1058/1*I7gZn2LKvXTzyi7W-pMTCw.jpeg
HYBRID HACKER SUMMER CAMP 2021 GUIDE — Part Six: DEFCON 29

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Iphone

My friends father has passed away recently they want us to go to court to be able to get into his iphone 11 pro max. we’re able to get the phone wiped but still has the password for the apple id password, would it be possible for anyone to get into it we’re open to paying we just really need into the phone so get it all erased so we don’t just have a dead iphone.

submitted by /u/_Percaholic_
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Build a Ventilated Cat Litter Box with Pi Zero

https://cdn-images-1.medium.com/max/2600/1*CdVOyIJnpcE-jt3vLoZpaw.jpeg
It’s hard for one to tie cats, those cute fluffy creatures, with the pungent smell from the waste they produce everyday. These two are my…

Continue reading on Medium »

Hacking on Medium
Installing Kali Linux

https://cdn-images-1.medium.com/max/1600/0*Tv--4Asq3c8mQ3Vl
Getting Started

Continue reading on Medium »

Deep Web
What are some good or popular dark websites for political discussions?

Specifically ones with a strong social democrat or left leaning communities. Any suggestions?

submitted by /u/Jaded195
[link] [comments]

hacking: security in practice
Anydesk

What types of hacking is possible when I connect with other persons PC? I am noob. Could you please show me guidance?

submitted by /u/sazid311
[link] [comments]

Hacking on Medium
OPTIMUM — HackTheBox WriteUp

https://cdn-images-1.medium.com/max/847/1*rY-CQQEu5SB7sAv3zwiGKw.png
This box is a part of TJnull’s list of boxes. I am doing these boxes as a part of my preparation for OSCP. I will be sharing the writeups…

Continue reading on Medium »

Black Hat Ethical Hacking
Bugs in Chrome’s JavaScript engine can lead to powerful exploits. This project aims to stop them

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Bugs in Chrome’s JavaScript engine can lead to powerful exploits. This project aims to stop themPost Views: 45
Reading Time: 1 Minute
A new project hopes to beef up the security of V8, a part of the Chrome browser that most users aren’t aware of but that hackers increasingly see as a juicy target.
JavaScript makes the web go around and Google has had to patch multiple zero-day or previously unknown flaws in Chrome’s V8 JavaScript engine this year. In April, Google admitted a high severity bug in V8 tracked as CVE-2021-21224 was being exploited in the wild.

Chrome has over two billion users, so when zero-day exploits strike Chrome, it’s a big deal. V8, an open source Google project, is a powerful JavaScript engine for Chrome that’s helped advance the web and web applications. V8 also powers the server-side runtime Node.js.

Now Samuel Groß, a member of the Google Project Zero security researchers team, has detailed a V8 sandbox proposal to help protect its memory from nastier bugs in the engine using virtual machine and sandboxing technologies.

“V8 bugs typically allow for the construction of unusually powerful exploits. Furthermore, these bugs are unlikely to be mitigated by memory safe languages or upcoming hardware-assisted security features such as MTE or CFI,” explains Groß, referring to security technologies like Microsoft’s Control-flow integrity (CFI) and Intel’s control-flow enforcement technologies (CET).

” As a result, V8 is especially attractive for real-world attackers.”
See Also: Hackers used never-before-seen wiper in recent attack on Iranian train system Groß’s comments suggest that even adopting a memory-safe language like Rust — which Google has adopted for new Android code — wouldn’t immediately solve the security problems faced by V8, which is written in C++.
He also outlines the broad design objectives but, signaling the size of the project, stresses that this sandbox project is in its infancy and that there are some big hurdles to overcome. But V8 is a Google-led open source project and given that V8 has been the source of security vulnerabilities in Chrome, there is a chance that member of GPZ’s proposal could make it across the line.

The issues affect how browser software interacts with hardware beyond the operating system and aims to prevent future flaws in V8 from corrupting a computer’s memory outside of the V8 heap. This would allow an attacker to execute malicious code.
See Also: Offensive Security Tool: Ruler One consideration for the additional security protections for V8 is the impact on hardware performance. Groß estimates his proposal would cause an overhead of about “1% overall on real-world workloads”.

Groß explains the problem with V8 that stems from JIT compilers that can be used trick a machine into emitting machine code that corrupts memory at runtime.

“Many V8 vulnerabilities exploited by real-world attackers are effectively 2nd order vulnerabilities: the root-cause is often a logic issue in one of the JIT compilers, which can then be exploited to generate vulnerable machine code (e.g. code that is missing a runtime safety check). The generated code can then in turn be exploited to cause memory corruption at runtime.” See Also: Hacking Stories: Andrian Lamo – The ‘homeless’ Hacker He also highlights the shortcomings of the latest security technologies, including hardware-based mitigations, that will make [...]

V8 an attractive target for years to come and hence is why V8 may need a sandbox approach. These include:

* The attacker has a great amount of control over the memory corruption primitive and can often turn these bugs into highly reliable and fast exploits
* Memory safe languages will not protect from these issues as they are fundamentally logic bugs
* Due to CPU side-channels and the potency of V8 vulnerabilities, upcoming hardware security features such as memory tagging will likely be bypassable most of the time

Despite downplaying the likelihood of the new V8 sandbox actually being adopted, the researcher seems upbeat about its prospects for doing its intended job by requiring an attacker chain together two separate vulnerabilities in order to execute code of their choice.

“With this sandbox, attackers are assumed to be able to corrupt memory inside the virtual memory cage arbitrarily and from multiple threads, and will now require an additional vulnerability to corrupt memory outside of it, and thus to execute arbitrary code,” he wrote.
Source: www.zdnet.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/chinese-flag-keyboard-internet-istock-90x90.jpg DeadRinger: Chinese APTs strike major telecommunications companies1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/public-wifi-90x90.jpg NSA Warns Public Networks are Hacker Hotbeds2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/iran-thumb-90x90.jpg Hackers used never-before-seen wiper in recent attack on Iranian train system5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/PunkSpider-90x90.png Reboot of PunkSpider Tool at DEF CON Stirs Debate6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/apple-mac-security-90x90.jpg Apple Patches Actively Exploited Zero-Day in iOS, MacOS1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Windows-Abstract-90x90.jpg Microsoft Rushes Fix for ‘PetitPotam’ Attack PoC1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Ransomware-Key-90x90.jpg Kaseya Obtains Universal Decryptor for REvil Ransomware1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Atlassian-Jira-90x90.png Critical Jira Flaw in Atlassian Could Lead to RCE2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Copy-of-Untitled-90x90.png MacOS Being Picked Apart by $49 XLoader Data Stealer2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/printer-1-90x90.jpg 16-Year-Old HP Printer-Driver Bug Impacts Millions of Windows Machines2 weeks ago
style="display:block; text-align:center;"
data-ad-layout="in-article"
data-ad-format="fluid"
data-ad-client="ca-pub-6620833063853657"
data-ad-slot="4517761481">
The post Bugs in Chrome’s JavaScript engine can lead to powerful exploits. This project aims to stop them first appeared on Black Hat Ethical Hacking.

Hacking Articles|Raj Chandel's Blog
Windows Privilege Escalation: SeImpersontate

In this article, we will be showcasing the process of creating a lab environment on an IIS Server running a Windows Server 2019 machine. After setting the IIS server, we will be focusing on the usage of the SeImpersontatePrivilege or Impersonate a Client After Authentication" User Right Privileges to elevate the access on the machine using different methods. Table of Contents <o:p· Introduction <o:p· Lab Setup<o:po IIS Installation<o:p

o Adding the Upload Functionality<o:p

o Changing Permissions<o:p

· Exploitation of IIS Server<o:p· Elevating Privileges using PrintSpoofer <o:p· Conclusion <o:pIntroduction <o:pTalking about the SeImpersontatePrivilege (Impersonate a Client after Authentication), It was introduced in Windows 2000 SP4. The users which are assigned this Privilege are the Members of the Device's Local Administrators Group and the Device's Local Service Account. Apart from these users and groups following components also have this user right: Services initiated by the Service Control Manager Component Object Model (COM) servers initiated by the COM infrastructure and are configured to run under a particular account Now that we know which types of users have this privilege, it’s time to understand what do the users get with these privileges. Whenever a user is assigned the SeImpersontatePrivilege, the user is permitted to run programs on behalf of that user to impersonate a client. This particular privilege was designed to prevent unauthorized servers from impersonating clients that connect to it through methods such as RPC or Named Pipes.<o:p

Now that we have a certain understanding of the SeImpersontatePrivilege. Let’s dive into the Lab setup for now. We will discuss this as we proceed.<o:p Lab Setup<o:pAs we learned from the Introduction that this kind of privilege is set on the users that are local administrators or have similar roles. So, to replicate the vulnerability, we will be using Window Server 2019 with AD.  As Microsoft patched the vulnerabilities, we will be using Build 17763 as shown in the image below.<o:p systeminfo<o:phttps://1.bp.blogspot.com/-hEyVtVp8jxc/YQpG1n5fu_I/AAAAAAAAyFk/hY-RGt8D05kPQ6Rl8SiLenf0UBGo2r5ngCLcBGAsYHQ/s16000/1.png <v:shapetype<v:stroke<v:formulas<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:path<o:lock<v:shape<v:imagedata<o:p IIS Installation<o:pWe will be getting the particular privilege by installing the IIS server on our machine. To configure the IIS server, we will need to open the Server Manager and Choose the Add roles and features from the QuickStart Menu as shown in the image below.<o:p https://1.bp.blogspot.com/-1g7WKf3nl1g/YQpLXTVqLZI/AAAAAAAAyFs/niMgNN8ybf0SiEuWjeWRPcnXOIoX42V8gCLcBGAsYHQ/s16000/2.png <v:shape<v:imagedata<o:p

This will open an Installation Wizard. We move through the Before You Begin section without making any changes. Now we are presented with the Installation Type section, we will proceed to choose the Role-based or feature-based installation option. <o:p https://1.bp.blogspot.com/-nwScmdBuMgk/YQpLplS1O6I/AAAAAAAAyF0/VesdttgTupYObJgS--vs-YifHHKNxmyhQCLcBGAsYHQ/s16000/3.png <v:shape<v:imagedata<o:p

Again, we are breezing through the Server Selection as this would be different for each user as it is based on the name you gave to your server and its subsequent Forest. We get to the Server Roles section. Here, we have the option to choose the Web Server (IIS) as demonstrated below.<o:p https://1.bp.blogspot.com/-fSf04I2mZYA/YQpLwUvT4rI/AAAAAAAAyF4/BRq0YZJ-tzwukN_QjDHpJovT4dTCXvN5QCLcBGAsYHQ/s16000/4.png <v:shape[...]