Netmap.Js - Fast Browser-Based Network Discovery Module
http://www.kitploit.com/2021/03/netmapjs-fast-browser-based-network.html

Motivation
I needed a browser-based port scanner (https://www.kitploit.com/search/label/Port%20Scanner) for an idea I was working on. I thought it would be a simple matter of importing an existing module or copy-pasting from another project like BeEF (http://beefproject.com/). Turns out there wasn't a decent ready-to-use npm module and the port_scanner module in BeEF is (at the time of writing) inaccurate, slow and doesn't work on Chromium. netmap.js is therefor a somewhat optimized "ping" sweeper and TCP scanner that works on all modern browsers.
Quickstart

Install
npm install --save netmap.js
Find Live Hosts
Let's figure out the IP address of a website visitor's gateway, starting from a list of likely candidates in a home environment: import NetMap from 'netmap.js'

const netmap = new NetMap()
const hosts = ['192.168.0.1', '192.168.0.254', '192.168.1.1', '192.168.1.254']

netmap.pingSweep(hosts).then(results => {
console.log(results)
}) {
"hosts": [
{ "host": "192.168.0.1", "delta": 1003, "live": false },
{ "host": "192.168.0.254", "delta": 1001, "live": false },
{ "host": "192.168.1.1", "delta": 18, "live": true },
{ "host": "192.168.1.254", "delta": 1002, "live": false }
],
"meta": {}
} Host 192.168.1.1 appears to be live.
Scan TCP Ports
Let's try to find some open TCP ports on a few hosts: import NetMap from 'netmap.js'

const netmap = new NetMap()
const hosts = ['192.168.1.1', '192.168.99.100', 'google.co.uk']
const ports = [80, 443, 8000, 8080, 27017]

netmap.tcpScan(hosts, ports).then(results => {
console.log(results)
}) {
"hosts": [
{
"host": "192.168.1.1",
"control": "22",
"ports": [
{ "port": 443, "delta": 15, "open": false },
{ "port": 8000, "delta": 19, "open": false },
{ "port": 8080, "delta": 21, "open": false },
{ "port": 27017, "delta": 26, "open": false },
{ "port": 80, "delta": 95, "open": true }
]
},
{
"host": "192.168.99.100",
"control": "1001",
"ports": [
{ "port": 8080, "delta": 40, "open": true },
{ "port": 80, "delta": 1001, "open": false },
{ "port": 443, "delta": 1000, "open": false },
{ "port": 8000, "delta": 1004, "open": false },
{ "port": 27017, "delta": 1000, "open": false }
]
},
{
"host": "google.co.uk",
"control": "1001",
"ports": [
{ "port": 443, "delta": 67, "open": true },< br/> { "port": 80, "delta": 159, "open": true },
{ "port": 8000, "delta": 1001, "open": false },
{ "port": 8080, "delta": 1002, "open": false },
{ "port": 27017, "delta": 1000, "open": false }
]
}
],
"meta": {}
} At first the results may seem contradictory. 192.168.1.1 is an embedded Linux machine (a router) on the local network segment, and the only port open is 80. We can see that it took the browser about 5 times longer to error out on 80 compared to the other, closed, ports. 192.168.99.100 is a host-only VM with port 8080 open and google.co.uk is an external host with both 443 and 80 open. In these cases the browser threw an error relatively rapidly on the open ports (https://www.kitploit.com/search/label/Open%20Ports) while the closed ports simply timed out. The Theory (https://github.com/serain/netmap.js#theory) section further down explains when this happens. In order to determine if ports should be tagged as open or closed, netmap.js will scan a "control" port (by default 45000) that is assumed to be closed. The control time is then used to determine the status of other ports. If the ratio delta/control is greater than a set value (default 0.8), the port is assumed to be closed (tl;dr: a difference of more that 20% from the control time means the port is open).
Limitations

Port Blacklists

"Ping" Sweep
The "ping" sweep functionality provided by netmap.js does a pretty good job at quickly finding live *nix-based hosts on a local network segment (other computers, phones, routers, printers etc.) However, due to the implementation this won't work when TCP RST packets are not returned. Typically: Windows machines Some external hosts Some network setups like bridged/host-only VMs The reason behind this is explained in the Theory (https://github.com/serain/netmap.js#theory) section below. This limitation doesn't affect the TCP scanning capabilities and it's still possible to determine if the above hosts are live by trying to find an open port on them.
General Lack of Accuracy
Overall, I've found this module to be more accurate and faster than the other bits of code I found laying around the web. That being said, the whole idea of mapping networks from a browser is going to be fidgety by nature. Your mileage may vary.
Usage

NetMap Constructor
The NetMap constructor takes an options object that allows you to configure: The protocol used for scanning (default http, see Port Blacklists (https://github.com/serain/netmap.js#port-blacklists) for why you may want to set it to ftp) The port connection timeout (default 1000 milliseconds) import NetMap from 'netmap.js'

const netmap = new NetMap({
protocol: 'http',
timeout: 3000
})
pingSweep()
The pingSweep() method determines if a given array of hosts are live. It does this by checking if connection to a port times out, in which case a host is considered offline (see "Ping" Sweep (https://github.com/serain/netmap.js#ping-sweep) for limitations and Standard Case (https://github.com/serain/netmap.js#standard-case) for the theory). The method takes the following parameters: hosts array of hosts to scan (IP addresses or host names) options object with: maxConnections - the maximum number of concurrent connections (by default 10 on Chrome and 17 on other browsers - the maximum concurrent connections supported by the browsers) the port to scan (default 45000) It returns a promise. netmap.pingSweep(['192.168.1.1'], {
maxConnections: 5,
port: 80
}).then(results => {
console.log(results)
})
tcpScan()
The tcpScan() method will perform a port scan against a range of targets. Read the Standard Case (https://github.com/serain/netmap.js#standard-case) to understand how it does this. The method takes the following parameters: hosts array of hosts to scan (IP addresses or host names) ports list of ports to scan (integers between 1-65535, avoid ports in the blacklists (https://github.com/serain/netmap.js#port-blacklists)) options object with: maxConnections - the maximum number of concurrent connections (by default 6 - the maximum connections per domain browsers will allow) portCallback - a callback to execute when an individual host:port combination has finished scanning controlPort - the port to scan to determine a baseline closed-port delta (default 45000) controlRatio - the similarity, in percentage, from the control delta for a port to be considered closed (default 0.8, see example (https://github.com/serain/netmap.js#scan-tcp-ports)) It returns a promise. netmap.tcpScan(['192.168.1.1'], [80, 27017], {
maxConnections: 5,
portCallback: result => {
console.log(result)
},
controlPort: 45000,
controlRatio: 0.8
}).then(results => {
console.log(results)
}) Check the example (https://github.com/serain/netmap.js#tcp-port-scan) to interpret the output.
Theory
This section briefly covers the theory behind the module's discovery techniques.
General Idea
This module uses Image objects to try to request cross-origin resources (the series of http://{host}:{port} URLs under test). The time it takes for the browser to raise an error (the delta), or the lack of error after a certain timeout value, provides insights into the state of the host and port under review.
Standard Case

A live host will usually respond relatively rapidly with a TCP RST packet when attempting to connect to a closed port. If the port is open, and even if it's not running an HTTP server, the browser will take a bit longer to raise an error due to the overhead of establishing a full TCP connection and then realising it can't get an image from the provided URL. An offline host will naturally neither respond with a RST nor allow a full TCP connection to be established. Browsers will still try to establish the connection for a bit before timing out (~90 seconds). netmap.js will time out after waiting 1000 milliseconds by default. In summary: Closed ports on live hosts will have a very short delta Open ports on live hosts will have a slightly longer delta Offline hosts or unused IP addresses will time out The standard case is illustrated by the host 192.168.1.1 in the TCP Port Scan (https://github.com/serain/netmap.js#tcp-port-scan) example.
No TCP RST Case
Some hosts (like google.co.uk or Windows hosts) and some network setups (like VirtualBox host-only networks) will not return TCP RST packets when hitting a closed port. In these cases, closed ports will usually time out while open ports will quickly raise an error. The implementation of the pingSweep() method is therefor unreliable when RST packets are not returned. In summary, when TCP RST packets are not returned for whatever reason: Closed ports on live hosts will time out Open ports on live hosts will have a short delta pingSweep() can't distinguish between a closed port time out and a "dead" host time out The special case is illustrated by the hosts 192.168.99.100 and google.co.uk in the TCP Port Scan (https://github.com/serain/netmap.js#tcp-port-scan) example.
Disregarding WebSockets and AJAX
It's well-documented that you should also be able to map networks with WebSockets and AJAX. I gave it a try (and also tweaked BeEF to try its port_scanner module with WebSockets and AJAX only); I found both methods to produce completely unreliable results. Please let me know if I'm missing something in this regard.

Download Netmap.Js (https://github.com/serain/netmap.js)

Black Hat Ethical Hacking
Bogus Android Clubhouse App Drops Credential-Swiping Malware

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Bogus Android Clubhouse App Drops Credential-Swiping MalwarePost Views: 72
style="display:block"
data-ad-client="ca-pub-6620833063853657"
data-ad-slot="8337846400"
data-ad-format="auto"
data-full-width-responsive="true">
Reading Time: 1 Minute
Researchers are warning of a fake version of the popular audio chat app Clubhouse, which delivers malware — BlackRock that steals login credentials for more than 450 apps.
The malicious app spreads the BlackRock malware, which steals credentials from 458 services – including Twitter, WhatsApp, Facebook and Amazon.

Clubhouse has burst on the social media scene over the past few months, gaining hype through its audio-chat rooms where participants can discuss anything from politics to relationships. Despite being invite-only, and only being around for a year, the app is closing in on 13 million downloads. However, as of now the app is only available on Apple’s App Store mobile application marketplace – there’s no Android version yet (though plans are in the works to develop one).

Cybercriminals are swooping in on Android users looking to download Clubhouse by creating their own fake Android version of the app. To add a legitimacy to the scam, the fake app is delivered from a website purporting to be the real Clubhouse website – which “looks like the real deal,” said Lukas Stefanko, researcher with ESET.

“To be frank, it is a well-executed copy of the legitimate Clubhouse website,” said Stefanko on Friday. “However, once the user clicks on ‘Get it on Google Play’, the app will be automatically downloaded onto the user’s device. By contrast, legitimate websites would always redirect the user to Google Play, rather than directly download an Android Package Kit, or APK for short.”
See Also: Trojanized Xcode Project Slips MacOS Malware to Apple Developers
It’s not known how this website is discovered by potential victims, but Stefanko told Threatpost the website is most likely spread via social media or third-party websites like forums. The fraudulent website (joinclubhouse[.]mobi) looks identical to the real Clubhouse website (joinclubhouse.com) – both tell users that they can join with an invite from an existing user, with a call to action: “Sign up to see if you have friends on Clubhouse who can let you in.” While the real website points to users to download the app on the store, the fake site tells users to get the app on Google Play.

However, upon closer inspection the fake website has red flags tipping off potential victims that something is off – such as the connection being HTTP rather than HTTPS, and the fact that the site uses the .mobi top-level domain (rather than the .com used by the legitimate domain). The Android Malware: BlackRockIf the victim should click on the button that purports to download the app, a trojan called BlackRock is installed on their system. This malware, discovered in July, is a variant of the LokiBot trojan that attacks not just financial and banking apps, but also a massive list of well-known and commonly used brand-name apps on Android devices.
See Also: Offensive Security Tool: Skipfish https://media.threatpost.com/wp-content/uploads/sites/103/2021/03/19101419/figure-1a-463x1024-1-136x300.jpg The fake Clubhouse website. Credit: ESET
“The trojan – nicknamed “BlackRock” by ThreatFabric and detected by ESET products as Android/TrojanDropper.Agent.HLR – can steal victims’ login data for no fewer than 458 online services,” said researchers.

The targeted list of app credentials includes well-kno[...]

wn financial and shopping apps, cryptocurrency exchanges and social media and messaging apps – including Twitter, WhatsApp, Facebook, Amazon, Netflix, Outlook, eBay, Coinbase, Plus500, Cash App, BBVA and Lloyds Bank.

The trojan swipes credentials using an overlay attack – which is a common type of attack for malicious Android apps. In this type of attack, the malware will create a data-stealing overlay of the application that the victim is navigating to, and request the user to log in. However, while the victim believes he is logging in, he is unwittingly handing over his credentials to the cybercriminals. See Also: Hacking Stories: Albert Gonzalez & the ‘Get Rich or Die Trying’ Crew who stole 130 million credit-card numbersIn a commonly-used tactic by Android malware, the malicious app also asks the victim to enable accessibility services on the phone in order to grant itself permissions on the phone without the victim’s knowledge (Android says that accessibility services are typically used to assist users with disabilities in using Android devices and apps). These permissions give the malware to access contacts, camera, SMS messages and more. This ability to intercept SMS messages is also handy for threat actors looking to get around SMS-based two-factor authentication (2FA) protections set up by the apps on the victims’ phone (if an app sends a 2FA code, for instance, attackers can pick it up via viewing the text messages). https://media.threatpost.com/wp-content/uploads/sites/103/2021/03/19101452/figure-2b-170x300.png The malware’s installation prompt. Credit: ESET
The biggest clue that this app is malicious is that its name is “Install” rather than “Clubhouse,” Stefanko said.

“While this demonstrates that the malware creator was probably too lazy to disguise the downloaded app properly, it could also mean that we may discover even more sophisticated copycats in the future,” he said.

Even as its popularity grows, Clubhouse has come under fire for various privacy issues, such as the fact that conversations via the app are recorded. France’s privacy watchdog also recently opened an investigation into the app over how it protects the privacy of European users’ data.

While this malicious app is in no way affiliated with the legitimate Clubhouse app itself, researchers warn that more sham Clubhouse apps will appear in the future – particularly while the demand for a yet-to-be rolled out Android version continues.
Android users can protect themselves by always sticking to official mobile app marketplaces to download apps to their devices, staying wary of the permissions they grant to applications and keeping their devices up to date (via patching and otherwise).
Source: https://threatpost.com (Click Link)style="display:block"
data-ad-client="ca-pub-6620833063853657"
data-ad-slot="8337846400"
data-ad-format="auto"
data-full-width-responsive="true"> Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/apple-security-90x90.jpg Trojanized Xcode Project Slips MacOS Malware to Apple Developers3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/Cisco_Systems_Sign-90x90.jpg Cisco Plugs Security Hole in Small Business Routers4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/JPG-Malicious-Two-90x90.jpg Magecart Attackers Save Stolen Credit-Card Data in JPG Files5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/Google-Chrome-Browser-1-90x90.jpg Google Warns Mac, Windows Users of Chrome Zero-Day Flaw6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/internet-of-things-90x90.jpg Critical Security Hole Can Knock Smart Meters Offline1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/Linux-kernel-vulnerability-90x90.png Linux Systems Under Attack By New RedXOR Malware1 week ago[...]

* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/security-camera-90x90.jpg Breach Exposes Verkada Security Camera Footage at Tesla, Cloudflare2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/ezgif.com-gif-maker-1-90x90.jpg Apple’s Device Location-Tracking System Could Expose User Identities2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/recaptcha-90x90.jpg Fake Google reCAPTCHA Phishing Attack Swipes Office 365 Passwords2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/botnet-90x90.jpg D-Link, IoT Devices Under Attack By Tor-Based Gafgyt Variant2 weeks ago
The post Bogus Android Clubhouse App Drops Credential-Swiping Malware first appeared on Black Hat Ethical Hacking.

Hacking on Medium
I NEED A HACKER TO CHANGE MY TRANSCRIPT CONTACT: QULIOUSHACKER@GMAIL.COM

CONTACT: QULIOUSHACKER@GMAIL.COM — -IF YOU HAVE HACKING RELATED ISSUES CONCERNING HOW TO HACK AND CHANGE YOUR UNIVERSITY GRADES AND…

Continue reading on Medium »

Hacking on Medium
I NEED A HACKER TO CHANGE MY UNIVERSITY T CONTACT: QULIOUSHACKER@GMAIL.COM

CONTACT: QULIOUSHACKER@GMAIL.COM — -IF YOU HAVE HACKING RELATED ISSUES CONCERNING HOW TO HACK AND CHANGE YOUR UNIVERSITY GRADES AND…

Continue reading on Medium »

Hacking on Medium
HOW TO HACK PORTAL CONTACT: QULIOUSHACKER@GMAIL.COM

https://cdn-images-1.medium.com/max/600/0*kEcvgWIhRk61nVDA.jpeg
CONTACT: QULIOUSHACKER@GMAIL.COM — -IF YOU HAVE HACKING RELATED ISSUES CONCERNING HOW TO HACK AND CHANGE YOUR UNIVERSITY GRADES AND…

Continue reading on Medium »

Hacking on Medium
Network Discovery and Security Auditing with Nmap

https://cdn-images-1.medium.com/max/1920/1*cw6Gql7-97AnSCll0z9cMw.jpeg
Nmap “Network Mapper” is a free and open-source tool used for network discovery and security auditing. Many systems and network…

Continue reading on Dev Genius »

Hacking on Medium
HOW TO HACK WEBSITE ADMIN PASSWORD CONTACT: QULIOUSHACKER@GMAIL.COM

CONTACT: QULIOUSHACKER@GMAIL.COM — -IF YOU HAVE HACKING RELATED ISSUES CONCERNING HOW TO HACK AND CHANGE YOUR UNIVERSITY GRADES AND…

Continue reading on Medium »