Hook Heaps and Live Free
https://www.reddit.com/r/redteamsec/comments/pkte0o/hook_heaps_and_live_free/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.arashparsa.com/hook-heaps-and-live-free/) [comments] (https://www.reddit.com/r/redteamsec/comments/pkte0o/hook_heaps_and_live_free/)

Shellcode Detection Using Real-Time Kernel Monitoring
https://www.reddit.com/r/redteamsec/comments/pkttjd/shellcode_detection_using_realtime_kernel/

submitted by /u/0xDangerous_bit (https://www.reddit.com/user/0xDangerous_bit)
[link] (https://www.countercraftsec.com/blog/post/shellcode-detection-using-realtime-kernel-monitoring/) [comments] (https://www.reddit.com/r/redteamsec/comments/pkttjd/shellcode_detection_using_realtime_kernel/)

Hacking on Medium
Fowsniff CTF — TryHackMe

https://cdn-images-1.medium.com/max/1200/1*Y1LqUXLKQDryVaOkv6BZqg.jpeg
CTF’s walkthrough will show you how to get the flag. This CTF is ideal for Beginners

Continue reading on Medium »

Hacking on Medium
One Way or The OTHER!

https://cdn-images-1.medium.com/max/1920/0*dCFzWAte0IRlGaeO
Cybercriminals Abusing Internet-Sharing Services to Monetize Malware/Ransomware Campaigns

Continue reading on rootissh »

Graphw00F - GraphQL fingerprinting tool for GQL endpoints

Credits to Nick Aleks for the logo!How does it work? graphw00f (inspired by wafw00f) is the GraphQL fingerprinting tool for GQL endpoints, it sends a mix of benign and malformed queries to determine the GraphQL engine running behind the scenes. graphw00f will provide insights into what security defences each technology provides out of the box, and whether they are on or off by default. Specially crafted queries cause different GraphQL server implementations to respond uniquely to queries, mutations and subscriptions, this makes it trivial to fingerprint the backend engine and distinguish between the various GraphQL implementations. (CWE: CWE-200)Detections graphw00f currently attempts to discover the following GraphQL engines: Graphene - Python Ariadne - Python Apollo - TypeScript graphql-go - Go gqlgen - Go WPGraphQL - PHP GraphQL API for Wordpress - PHP Ruby - GraphQL graphql-php - PHP Hasura - Haskell HyperGraphQL - Java graphql-java - Java Juniper - Rust Sangria - Scala Flutter - Dart Diana.jl - Julia Strawberry - Python Tartiflette - Python GraphQL Technologies Defence Matrices Each fingerprinted technology (e.g. Graphene, Ariadne, ...) has an associated document (example for graphene) which covers the security defence mechanisms the specific technology supports to give a better idea how the implementation may be attacked. | Field Suggestions | Query Depth Limit | Query Cost Analysis | Automatic Persisted Queries | Introspection | Debug Mode | Batch Requests ||-------------------|-------------------|---------------------|-----------------------------|--------------------|------------|-----------------|| On by Default | No Support | No Support | No Support | Enabled by Default | N/A | Off by Default | Prerequisites python3 requests Installation Clone Repository git clone git@github.com:dolevf/graphw00f.git Run graphw00f python3 main.py -h Usage: main.py -hOptions: -h, --help show this help message and exit -r, --noredirect Do not follow redirections given by 3xx responses -t URL, --target=URL target url with the path -o OUTPUT_FILE, --output-file=OUTPUT_FILE Output results to a file (CSV) -l, --list List all GraphQL technologies graphw00f is able to detect -v, --version Print out the current version and exit. Example python3 main.py -t http://127.0.0.1:5000/graphql +-------------------+ | graphw00f | +-------------------+ *** *** ** *** ** ** +--------------+ +--------------+ | Node X | | Node Y | +--------------+ +--------------+ *** *** ** ** ** ** +------------+ | Node Z | +------------+ graphw00f - v1.0.0 The fingerprinting tool for GraphQL \* Checking if GraphQL is available at https://demo.hypergraphql.org:8484/graphql...\* Found GraphQL...\* Attempting to fingerprint...\* Discovered GraphQL Engine: (HyperGraphQL)! Attack Surface Matrix: https://github.com/dolevf/graphw00f/blob/main/docs/hypergraphql.md! Technologies: Java! Homepage: https://www.hypergraphql.org\* Completed. Support and Issues Any issues with graphw00f such as false positives, inaccurate detections, bugs, etc. please create a GitHub issue with environment details. Resources Want to learn more about GraphQL? head over to my other project and hack GraphQL away: Damn Vulnerable GraphQL Application Download Graphw00F
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Graphw00F - GraphQL fingerprinting tool for GQL endpoints
http://www.kitploit.com/2021/09/graphw00f-graphql-fingerprinting-tool.html

___________________________
@hacking_Attack
@Hacking_Video

Credits to Nick Aleks (https://github.com/nicholasaleks)for the logo!
How does it work?
graphw00f (inspired by wafw00f (https://github.com/EnableSecurity/wafw00f)) is the GraphQL fingerprinting (https://www.kitploit.com/search/label/Fingerprinting) tool for GQL endpoints, it sends a mix of benign and malformed (https://www.kitploit.com/search/label/Malformed) queries to determine the GraphQL engine running behind the scenes. graphw00f will provide insights into what security defences each technology provides out of the box, and whether they are on or off by default. Specially crafted queries cause different GraphQL server implementations to respond uniquely to queries, mutations and subscriptions, this makes it trivial to fingerprint (https://www.kitploit.com/search/label/Fingerprint) the backend engine and distinguish between the various GraphQL implementations. (CWE: CWE-200 (https://github.com/dolevf/graphw00f#CWE-Reference))
Detections
graphw00f currently attempts to discover the following GraphQL engines: Graphene - Python Ariadne - Python Apollo - TypeScript graphql-go - Go gqlgen - Go WPGraphQL - PHP GraphQL API for Wordpress - PHP Ruby - GraphQL graphql-php - PHP Hasura - Haskell HyperGraphQL - Java graphql-java - Java Juniper - Rust Sangria - Scala Flutter - Dart Diana.jl - Julia Strawberry - Python Tartiflette - Python
GraphQL Technologies Defence Matrices
Each fingerprinted technology (e.g. Graphene, Ariadne, ...) has an associated document (example for graphene (https://github.com/dolevf/graphw00f/blob/main/docs/graphene.md)) which covers the security defence mechanisms the specific technology supports to give a better idea how the implementation may be attacked. | Field Suggestions | Query Depth Limit | Query Cost Analysis | Automatic Persisted Queries | Introspection | Debug Mode | Batch Requests |
|-------------------|-------------------|---------------------|-----------------------------|--------------------|------------|-----------------|
| On by Default | No Support | No Support | No Support | Enabled by Default | N/A | Off by Default |

Prerequisites
python3 requests
Installation

Clone Repository
git clone git@github.com:dolevf/graphw00f.git
Run graphw00f
python3 main.py -h Usage: main.py -h

Options:
-h, --help show this help message and exit
-r, --noredirect Do not follow redirections given by 3xx responses
-t URL, --target=URL target url with the path
-o OUTPUT_FILE, --output-file=OUTPUT_FILE
Output results to a file (CSV)
-l, --list List all GraphQL technologies graphw00f is able to
detect
-v, --version Print out the current version and exit.

Example
python3 main.py -t http://127.0.0.1:5000/graphql

+-------------------+
| graphw00f |
+-------------------+
*** ***
** ***
** **
+--------------+ +--------------+
| Node X | | Node Y |
+--------------+ +--------------+
*** ***
** **
** **
+------------+
| Node Z |
+------------+

graphw00f - v1.0.0
The fingerprinting tool for GraphQL

[*] Checking if GraphQL is available at https://demo.hypergraphql.org:8484/graphql...
[*] Found GraphQL...
[*] Attempting to fingerprint...
[*] Discovered GraphQL Engine: (HyperGraphQL)

___________________________
@hacking_Attack
@Hacking_Video

[!] Attack Surface Matrix: https://github.com/dolevf/graphw00f/blob/main/docs/hypergraphql.md
[!] Technologies: Java
[!] Homepage: https://www.hypergraphql.org
[*] Completed.

Support and Issues
Any issues with graphw00f such as false positives, inaccurate detections, bugs, etc. please create a GitHub issue with environment details.
Resources
Want to learn more about GraphQL? head over to my other project and hack GraphQL away: Damn (https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/)Vulnerable (https://www.kitploit.com/search/label/Vulnerable) GraphQL Application

Download Graphw00F (https://github.com/dolevf/graphw00f)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
NIST Cybersecurity Framework Profile for Ransomware Risk Management - draft for feedback

https://external-preview.redd.it/glL_lZdyT_LkQsaU7WzuY5FGUzbwWKJCfkrjA1eWxH8.jpg?width=640&crop=smart&auto=webp&s=beedefe4566ee737bc698299aa4f3549dc54f796 submitted by /u/inlay883
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
“Defend the Web” write-up (Crypt3 / Crypt — decoding morse code)

https://cdn-images-1.medium.com/max/1024/1*uDBACgKbg8VFoHb2warn4w.jpeg
This challenge is a little bit interesting. The developers gave us a clue, which is an encrypted text message that incorporates the…

Continue reading on Purple TEAM »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hub Weekly Digest: Quantum-Resistant Encryption, FirstEnergy, Accellion Data Hack and North Korean…

https://cdn-images-1.medium.com/max/2600/1*pGPDIXCumwp5JgVIU0aX5g.jpeg
HUB Security’s weekly digest covers top stories happening around the world related to cyber attacks, threats and global cybersecurity news.

Continue reading on HUB Security »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
website designer vs website developer — Knowledge World

https://cdn-images-1.medium.com/max/600/0*5YK6YRi0Z9gL_Bx-
Welcome to the discussion of Front and Development vs. Back and Development, we will try to understand it with a real-life example…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Ontology’s EVM TestNet Officially Deployed, Now Opening EVM-Compatible Public Beta to Developers
https://medium.com/ontologynetwork/ontologys-evm-testnet-officially-deployed-now-opening-evm-compatible-public-beta-to-developers-6dddc2bdd764?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video