Once authenticated, use header in all requests: Authorization: Token
Swagger

___________________________
@hacking_Attack
@Hacking_Video

ReDoc

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
MobileAudit - SAST and Malware Analysis for Android Mobile APKs

http://2.bp.blogspot.com/-RBfS_Dx9ME4/YR0N98YPEkI/AAAAAAAArKU/pAPHUea_vSMRtWiP--FRyrHjK7DjI5y9ACK4BGAYYCw/w640-h208/mobileAudit_1_mobile_audit-763706.png Django Web application for performing Static Analysis and detecting malware in Android APKs https://1.bp.blogspot.com/-Y_bruK5yGpQ/YSMnEJMq9JI/AAAAAAAAtak/fRIa-PSMIZwrWk1k9oE2NUGJXQ8WHA9TQCNcBGAsYHQ/w640-h370/mobileAudit_2_app.png In each of the scans, it would have the following information:

* Application Info
* Security Info
* Components
* SAST Findings
* Best Practices Implemented
* Virus Total Info
* Certificate Info
* Strings
* Databases
* Files https://1.bp.blogspot.com/-zoNBGxpOYU4/YSMnqA4ve1I/AAAAAAAAta4/xk_4PSbAB0cWc5zgxjb9ET2VSGr-CgvqACNcBGAsYHQ/w640-h510/mobileAudit_3_scan.png For easy access there is a sidebar on the left page of the scan: https://1.bp.blogspot.com/-VQsPcF0xUuY/YSMnz1WZ3BI/AAAAAAAAtbA/OtR7K60Iow8KIG9dQn1Eqvdpi-V6WgNtACNcBGAsYHQ/w640-h456/mobileAudit_4_menu.png Componentshttps://1.bp.blogspot.com/-I0_4uhy_0j8/YSMn4EALrzI/AAAAAAAAtbE/eZIM0hsBg4scmK1-wg-J78s0us1fas-XgCNcBGAsYHQ/w640-h292/mobileAudit_5_architecture.png * db: PostgreSQL 13.2
* nginx: Nginx 1.19.10
* rabbitmq: RabbitMQ 3.8.14
* worker: Celery 5.0.5
* web: Mobile Audit App Docker Base imagesImage is based on python buster. Link to Docker Hub image
ImageTagsBasempast/mobile_audit1.3.8python:3.9.4-bustermpast/mobile_audit1.3.6python:3.9.2-bustermpast/mobile_audit1.3.0python:3.9.1-bustermpast/mobile_audit1.0.0python:3.9.0-buster Main features* Uses Docker for easy deployment in multiplatform environment
* Extract all information of the APK
* Analyze all the source code searching for weaknesses
* All findings are categorized and follows CWE standards
* All findings are categorized and include Mobile Top 10 Risk
* Also highlight the Best Practices in Secure Android Implementation in the APK
* The findings can be edited and the false positives can be triaged and deleted
* All scan results can be exported to PDF
* User authentication and user management
* API v1 with Swagger and ReDoc
* TLS
* Dynamic page reload (WIP)
* LDAP integration
* Export to Markdown
* Export to CSV PatternsThe application has an engine with different rules and patterns that are used though the findings scanning phase to detect vulnerabilities and/or malicious code into the apk.

These can be activated and deactivated in /patternshttps://1.bp.blogspot.com/-y5aR71AMsAU/YSMn7h29iiI/AAAAAAAAtbI/JjUeXBrNEG0VC85iPkb4AWVBI99cH9iNwCNcBGAsYHQ/w640-h222/mobileAudit_6_patterns.png Note: some of the hardcoded patterns are from apkleaks ModelsThe application has an created models for each of the entities of the scans' information to be able to create relations an abtain the best conclusions for each of the apks. https://1.bp.blogspot.com/-BXyp4qBpzfg/YSMn-8HF2uI/AAAAAAAAtbM/NJsflosFMx01Uze4j6rJLzpW96fFNgBbQCNcBGAsYHQ/w640-h518/mobileAudit_7_models_snippet.png To see the whole model schema, go to models

### Integrations Virus Total (API v3)It checks if there has been an scan of the APK and extract all its information. Also, there is the possibility of uploading the APK is selected a property in the environment (Disabled by default). Defect Dojo (API v2)It is possible to upload the findings to the defect manager. MalwareDB & MaltrailIt checks in the database if there are URLs in the APK that are related with Malware. InstallationUsing Docker-compose:

The provided docker-compose.ymlfile allows you to run the app locally in development.

To build the local image and if there are changes to the local Application Dockerfile, you can build the image with: docker-compose buildThen, to start the container[...]

, run: docker-compose upOptional: run in detached mode (not see the logs) docker-compose up -dOnce the application has launched, you can test the application by navigating to: http://localhost:8888/ to access the dashboard. https://1.bp.blogspot.com/-K3y0Bjg6rTM/YSMoCR4q4FI/AAAAAAAAtbc/wWYHGU6qDnkj-mHU35BkzXPkI8wpM4i4QCNcBGAsYHQ/w596-h640/mobileAudit_9_auth_token.png Also, there is a TLS version using docker-compose.prod.yamlrunning in port 443

To use it, execute docker-compose -f docker-compose.prod.yaml upThen, you can test the application by navigating to: https://localhost/ to access the dashboard.

For more information, see TLS

To stop and remove the containers, run docker-compose downAPI v1REST API integration with Swagger and ReDoc. Usage* Endpoint to authenticate and get token: /api/v1/auth-token/https://1.bp.blogspot.com/-AqN0MMTdMCw/YSMoFxtNQGI/AAAAAAAAtbs/8ala5l12ro01jKHvTDSwZEGzFdxyy3V-ACNcBGAsYHQ/w596-h640/mobileAudit_9_auth_token.png * Once authenticated, use header in all requests: Authorization: Token <apikeySwaggerhttps://1.bp.blogspot.com/-wG0AdMTUsFU/YSMoJ6Oj6kI/AAAAAAAAtbw/SwDg8BC_aPERNEWBu6827S78ccU7ueqxACNcBGAsYHQ/w640-h338/mobileAudit_10_swagger.png ReDochttps://1.bp.blogspot.com/-20LEjCTt-48/YSMoOb7GhHI/AAAAAAAAtb4/vWVmJW0LFMoa2Eak0SwGYoM_5OOizYIoACNcBGAsYHQ/w640-h326/mobileAudit_11_redoc.png Endpoints* A JSON view of the API specification at /swagger.json* A YAML view of the API specification at /swagger.yaml* A swagger-ui view of the API specification at /swagger/* A ReDoc view of the API specification at /redoc/TLSPre-requirements* Add the certificates into nginx/ssl* To generate a self-signed certificate: openssl req -x509 -nodes -days 1 -newkey rsa:4096 -subj "/C=ES/ST=Madrid/L=Madrid/O=Example/OU=IT/CN=localhost" -keyout nginx/ssl/nginx.key -out nginx/ssl/nginx.crtNginx configuration* TLS - port 443: nginx/app_tls.conf* Standard - port 8888: nginx/app.confDocker configurationBy default, there is a volume in docker-compose.ymlwith the configuration with 8888 available - ./nginx/app.conf:/etc/nginx/conf.d/app.conf** In production environment** use docker-compose.prod.yamlwith port 443 - ./nginx/app_tls.conf:/etc/nginx/conf.d/app_tls.confEnvironment variablesAll the environment variables are in a .envfile, there is an .env.examplewith all the variables needed. Also there are collected in app/config/settings.py: CWE_URL = env('CWE_URL', 'https://cwe.mitre.org/data/definitions/')

MALWARE_ENABLED = env('MALWARE_ENABLED', True)
MALWAREDB_URL = env('MALWAREDB_URL', 'https://www.malwaredomainlist.com/mdlcsv.php')
MALTRAILDB_URL = env('MALTRAILDB_URL', 'https://raw.githubusercontent.com/stamparm/aux/master/maltrail-malware-domains.txt')

VIRUSTOTAL_ENABLED = env('VIRUSTOTAL_ENABLED', False)
VIRUSTOTAL_URL = env('VIRUSTOTAL_URL', 'https://www.virustotal.com/')
VIRUSTOTAL_FILE_URL = env('VIRUSTOTAL_FILE_URL', 'https://www.virustotal.com/gui/file/')
VIRUSTOTAL_API_URL_V3 = env('VIRUSTOTAL_API_URL_V3', 'https://www.virustotal.com/api/v3/')
VIRUSTOTAL_URL_V2 = env('VIRUSTOTAL_API_URL_V2', 'https://www.virustotal.com/vtapi/v2/file/')
VIRUSTOTAL_API_KEY = env('VIRUSTOTAL_API_KEY', '')
VIRUSTOTAL_UPLOAD = env('VIRUSTOTAL_UPLOAD', False)

DEFECTDOJO_ENABLED = env('DEFECTDOJO_ENABLED', False)
DEFECTDOJO_URL = env('DEFECTDOJO_URL', 'http://defectdojo:8080/finding/')
DEFECTDOJO_API_URL = env('DEFECTDOJO_API_URL', 'http://defectdojo:8080/api/v2/')
DEFECTDOJO_API_KEY = env('DEFECTDOJO_API_KEY', '')If you like to contribute, see Contributing Download mobileAudit

Kali Linux Tutorials
Raider : Web Authentication Testing Framework

Raiders is a framework designed to test authentication for web applications. While web proxies like ZAProxy and Burpsuite allow authenticated tests, they don’t provide features to test the authentication process itself, i.e. manipulating the relevant input fields to identify broken authentication.

Most authentication bugs in the wild have been found by manually testing it or writing custom scripts that replicate the behavior. Raider aims to make testing easier, by providing the interface to interact with all important elements found in modern authentication systems.

Features

Raider has the goal to support most of the modern authentication systems, and here are some features that other tools don’t offer:

* Unlimited authentication steps
* Unlimited inputs/outputs for each step
* Ability to conditionally decide the next step
* Running arbitrary operations when receiving the response
* Easy to write custom operations and plugins How does it work

Raider treats the authentication as a finite state machine. Each authentication step is a different state, with its own inputs and outputs. Those can be cookies, headers, CSRF tokens, or other pieces of information.

Each application needs its own configuration file for Raider to work. The configuration is written in Hylang. The language choice was done for multiple reasons, mainly because it’s a Lisp dialect embedded in Python.

Using Lisp was necessarily since sometimes the authentication can get quite complex, and using a static configuration file would’ve not been enough to cover all the details. Lisp makes it easy to combine code and data, which is exactly what was needed here.

By using a real programming language as a configuration file gives Raider a lot of power, and with great power comes great responsibility. Theoretically one can write entire malware inside the application configuration file, which means you should be careful what’s being executed, and not to use configuration files from sources you don’t trust. Raider will evaluate everything inside the .hy files, which means if you’re not careful you could shoot yourself in the foot and break something on your system. Installation

The package is available in the Python Package Index, so to install the latest stable release of Raider just use the command pip3 install --user raiderWarning

Raider was developed on Python 3.9 and it wasn’t tested yet on older versions, so it might have incompatibility issues.

If you feel adventurous and want to build Raider from source, you can do so. You will need to do that anyways if you want to contribute to the development.

First start by clonning the repository with git clone https://github.com/DigeeX/raider.

Using a python virtual environment is recommended to avoid weird issues with python incompatibilities when working on the code. However you can still use pip3 install .in the project’s directory to install the package locally.

If you choose to use the virtual environment, install poetry since that’s how Raider was developed.

Once poetry is installed, you can prepare the virtual environment and switch to it to work with Raider:

cd raider
poetry install
poetry shell

And now you’re working inside the virtual environment, and Raider should be available here.

Architecture

Abstracting the authentication process

First let’s start by taking a closer look at how web authentication works. Every authentication process can be abstracted as a Finite State Machine.

On a high level, we start in the unauthenticated state, the user sends the application their credentials, optionally the multi-factor authentication (MFA) code, and if both checks pass, we reach the authenticated state. A typical modern web application will looks like the following in a diagram:[...]

https://1.bp.blogspot.com/-caN5HixiFww/YRp3RfwgnzI/AAAAAAAAKeo/zd4BOOsk7Kwc4g2fvCubIjiuDiJwQu4ZQCLcBGAsYHQ/s1108/plantuml-ad2aa1b5a57b181aa2ee3a4afd27dccd79ce2e37.png
Basic concepts in Raider

Now let’s zoom in and look at the details. Instead of dealing with the states (Unauthenticated, Login failed, MFA required, and Authenticated), we define the concept of stages, which describes the information exchange between the client and the server containing one request and the respective response.

The example below shows a closer look of the authentication process for an imaginary web application:
https://1.bp.blogspot.com/-YYN0TaYUs6o/YRp3rAaW0PI/AAAAAAAAKew/-W2sDXDghZ4uhihqhFZ0Xi68S-3bnyj8wCLcBGAsYHQ/s2436/plantuml-c6d5182524e1145aa56790c6c885b14f7cfd00f2.png
To describe the authentication process from the example defined above, we need three stages. The first one, Initialization, doesn’t have any inputs, but creates the Session cookie and the CSRF token as outputs.

Those outputs are passed to the next stage, Login, together with user credentials. A request is built with those pieces of information, and the new outputs are generated. In this case we have the new CSRF token, an updated session cookie, and a new cookie identifying the user: user cookie.

Depending on whether MFA is enabled or not, the third stage Multi-factor authentication might be skipped or executed. If it’s enabled, the outputs from the previous stage get passed as inputs to this one, the user is asked to input the next Factor, and a new cookie is set proving the user has passed the checks and is properly authenticated.

In Raider, stages are implemented using Flow objects. The authentication process consists of a series of Flows connected to each other. Each one accepts inputs and generates outputs. In addition to that, Flow objects implement Operations which can be used to run various actions upon receiving the response, but most importantly they’re used to control the authentication process by conditionally or unconditionally defining the next stage. So for example one can jump to stage X if the HTTP response code is 200 or to stage Y if it’s 403.
https://1.bp.blogspot.com/-OL0Ew3hOs_A/YRp4CHHvVnI/AAAAAAAAKe4/nBunqhp38-wYRiolhYBpZCyIPjAAibYbQCLcBGAsYHQ/s892/plantuml-def0c509dccb720ebcda2e219a43afb701799a0b.png
Inputs and outputs are often the same object, and you may want to update its value from one Flow to the next (for example the CSRF token changes for every stage). This was implemented in Raider using Plugins.

Plugins are pieces of code that can act as inputs for the HTTP requests to be sent, and/or as outputs from the HTTP responses. They are used to facilitate the information exchange between Flows. Raider provides the user the option to write new plugins with a small piece of hylang code.

Once the response is received, the Operations will be executed. The primary function of operations is to define which Flow comes next. But they can do anything, and Raider makes it easy to write new operations.

Tutorial

Preparation

Before you can use Raider, you have to set up the authentication inside hyfiles. To do that, you’ll probably need to use a web proxy (BurpSuite, ZAProxy, mitmproxy, etc…) to see the requests the application is generating, and identify all the important inputs and outputs for each request.

After the traffic was captured, there will probably be lots of HTTP requests that are irrelevant to the authentication. Start by removing all static files (.png, .js, .pdf, etc…). When you’re left with a fewer requests to deal with, it’s time to dive deeper and understand how the authentication works.

At this point we assume you already know the basics of Python and Hylang so this documentation will not cover information that can be found somewhere else.

This tutorial will show the authentication in use by Reddit at the time of writing this. It could be different in the future when you’re reading thi[...]

s, if they update the way authentication works or change the HTML structure, so you will have to do this all by yourself anyways.

The easiest way to start this is by going backwards starting with one authenticated request. This should be some kind of request that only works when the user is already authenticated. I choose the “unread_message_count” one for reddit, and the request looks like this:

GET https://s.reddit.com/api/v1/sendbird/unread_message_count HTTP/1.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Content-Type: application/json
Origin: https://www.reddit.com
DNT: 1
Authorization: Bearer [REDACTED TOKEN]
Referer: https://www.reddit.com/
Connection: keep-alive
Host: s.reddit.com

As you can see from this, the only information we sent to this URL from our authentication is the Bearer token.

We define a new Flow that will check for the unread messages in hy:

(setv get_unread_messages
(Flow
:name “get_unread_messages”
:request (Request
:method “GET”
:headers [(Header.bearerauth access_token)]
:url “https://s.reddit.com/api/v1/sendbird/unread_message_count”)))

In Hy, setvis used to set up new variables. Here we created the variable get_unread_messagesthat will hold the information about this Flow. This will be hold in the _functions special variable which stores the Flows which aren’t affecting the authentication.

The only required parameters for Flowobjects are the name and the request. The name is a string that is used for reference purposes, and the request contains the actual HTTP request definition as a Requestobject.

The Request object requires only the method and url. Other parameters are optional. We translate the original request into Raider config format, and to use the access token we need to define it in the request header. Since this is a bearer header, we use Header.bearerauthwith the access_tokenwhich we will create later on.

Getting the access token
The next step would be to find out where is this token generated and how we can extract it. Searching for this token in previous responses, we can see it was first seen in a request to the main reddit page. It’s located inside the

NCIIPC — Responsible Vulnerability Disclosure Program
https://spoofing.medium.com/nciipc-responsible-vulnerability-disclosure-program-c94d69267517?source=rss------bug_bounty-5

NCIIPC stands for National Critical Information Infrastructure Protection Center.Continue reading on Medium » (https://spoofing.medium.com/nciipc-responsible-vulnerability-disclosure-program-c94d69267517?source=rss------bug_bounty-5)

hacking: security in practice
SWIM wants to work from a different country w/o my company finding out

A consultant has both a company laptop and a client laptop, both of which require MFA. The client laptop requires VPN as well.

Is there a way to go undetected while working from outside the US?

submitted by /u/TRO_WHEY
[link] [comments]

Hacking on Medium
HOW TO HIRE A HACKER TO CHANGE GRADES

https://cdn-images-1.medium.com/max/620/1*nwvEsegMTGhYVsjD0AABEA.jpeg
CONTACT US ON MAGICFINGERHACKERS@GMAIL.COM on any hacking relating issues.

Continue reading on Medium »

Hacking on Medium
HOW TO HACK UNIVERSITY PORTAL AND DATABASE

https://cdn-images-1.medium.com/max/660/1*RAaiZezDRj0NT6viJNverA.jpeg
REDEMPTIONHACKERSCREW@GMAIL.COM — — PROFESSIONALLY KNOWN FOR UNIVERSITY PORTAL HACK.

Continue reading on Medium »

Hacking on Medium
My Facebook recently got hacked and how I got it back

https://cdn-images-1.medium.com/max/720/1*bxehhxBfHycu1bFR6aFyGQ.png
I’ve been using Facebook since past 8 or 10 years as long as I can remember. And during such a long period, I’ve had various security…

Continue reading on Medium »