Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials WWWGrep : OWASP Foundation Web Respository WWWGrep is a rapid search “grepping” mechanism that examines HTML elements by type and permits focused (single), multiple (file based URLs) and recursive (with respect to root domain or not)…
cification
-st –text Search visible text on the page that matches the search specification
-sc –comments Search comments on the page that match the search specification
-sm –meta Search in page metadata for matches to the search specification
-sf –hidden Search in hidden fields for specific matches to the search specification
-sh –header-name Search response headers for specific matches to the search specification
-sv –header-value Search response header values for specific matches to the search specification
Examples of use
Find all input fields named login on a site recursively while not leaving the root domain without case sensitivity in the match
wwwgrep.py -t https://www.target.com -i -si “login” -rr
Find all comments containing the term “to do” on all pages in a site
wwwgrep.py -t https://www.target.com -i -sc “to do” -rr
Find all comments on a specific web page
wwwgrep.py -t https://www.target.com/some_page -i -sc “”
Find all hidden fields within a list of web applications contained in the file input.txt using site recursion
wwwgrep.py -f input.txt -sf “” -rr Download
-st –text Search visible text on the page that matches the search specification
-sc –comments Search comments on the page that match the search specification
-sm –meta Search in page metadata for matches to the search specification
-sf –hidden Search in hidden fields for specific matches to the search specification
-sh –header-name Search response headers for specific matches to the search specification
-sv –header-value Search response header values for specific matches to the search specification
Examples of use
Find all input fields named login on a site recursively while not leaving the root domain without case sensitivity in the match
wwwgrep.py -t https://www.target.com -i -si “login” -rr
Find all comments containing the term “to do” on all pages in a site
wwwgrep.py -t https://www.target.com -i -sc “to do” -rr
Find all comments on a specific web page
wwwgrep.py -t https://www.target.com/some_page -i -sc “”
Find all hidden fields within a list of web applications contained in the file input.txt using site recursion
wwwgrep.py -f input.txt -sf “” -rr Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Karta : Source Code Assisted Fast Binary Matching Plugin For IDA
“Karta” (Russian for “Map”) is an IDA Python plugin that identifies and matches open-sourced libraries in a given binary. The plugin uses a unique technique that enables it to support huge binaries (>200,000 functions), with almost no impact on the overall performance.
The matching algorithm is location-driven. This means that it’s main focus is to locate the different compiled files, and match each of the file’s functions based on their original order within the file. This way, the matching depends on K (number of functions in the open source) instead of N (size of the binary), gaining a significant performance boost as usually N >> K.
We believe that there are 3 main use cases for this IDA plugin:
* Identifying a list of used open sources (and their versions) when searching for a useful 1-Day
* Matching the symbols of supported open sources to help reverse engineer a malware
* Matching the symbols of supported open sources to help reverse engineer a binary / firmware when searching for 0-Days in proprietary code
Installation (Python 3 & IDA >= 7.4)
For the latest versions, using Python 3, simply git clone the repository and run the
Installation (Python 2 & IDA < 7.4)
As of the release of IDA 7.4, Karta is only actively developed for IDA 7.4 or newer, and Python 3. Python 2 and older IDA versions are still supported using the release version v1.2.0, which is most probably going to be the last supported version due to python 2.X end of life.
Identifier
Karta’s identifier is a smaller plugin that identifies the existence, and fingerprints the versions, of the existing (supported) open source libraries within the binary. No more need to reverse engineer the same open-source library again-and-again, simply run the identifier plugin and get a detailed list of the used open sources. Karta currently supports more than 10 open source libraries, including:
* OpenSSL
* Libpng
* Libjpeg
* NetSNMP
* zlib
* Etc.
Matcher
After identifying the used open sources, one can compile a .JSON configuration file for a specific library (libpng version 1.2.29 for instance). Once compiled, Karta will automatically attempt to match the functions (symbols) of the open source in the loaded binary. In addition, in case your open source used external functions (memcpy, fread, or zlib_inflate), Karta will also attempt to match those external functions as well.
Folder Structure
* src: source directory for the plugin
* configs: pre-supplied *.JSON configuration files (hoping the community will contribute more)
* compilations: compilation tips for generating the configuration files, and lessons from past open sources
* docs: sphinx documentation directory
Download
Karta : Source Code Assisted Fast Binary Matching Plugin For IDA
“Karta” (Russian for “Map”) is an IDA Python plugin that identifies and matches open-sourced libraries in a given binary. The plugin uses a unique technique that enables it to support huge binaries (>200,000 functions), with almost no impact on the overall performance.
The matching algorithm is location-driven. This means that it’s main focus is to locate the different compiled files, and match each of the file’s functions based on their original order within the file. This way, the matching depends on K (number of functions in the open source) instead of N (size of the binary), gaining a significant performance boost as usually N >> K.
We believe that there are 3 main use cases for this IDA plugin:
* Identifying a list of used open sources (and their versions) when searching for a useful 1-Day
* Matching the symbols of supported open sources to help reverse engineer a malware
* Matching the symbols of supported open sources to help reverse engineer a binary / firmware when searching for 0-Days in proprietary code
Installation (Python 3 & IDA >= 7.4)
For the latest versions, using Python 3, simply git clone the repository and run the
setup.py installscript. Python 3 is supported since versions v2.0.0 and above.Installation (Python 2 & IDA < 7.4)
As of the release of IDA 7.4, Karta is only actively developed for IDA 7.4 or newer, and Python 3. Python 2 and older IDA versions are still supported using the release version v1.2.0, which is most probably going to be the last supported version due to python 2.X end of life.
Identifier
Karta’s identifier is a smaller plugin that identifies the existence, and fingerprints the versions, of the existing (supported) open source libraries within the binary. No more need to reverse engineer the same open-source library again-and-again, simply run the identifier plugin and get a detailed list of the used open sources. Karta currently supports more than 10 open source libraries, including:
* OpenSSL
* Libpng
* Libjpeg
* NetSNMP
* zlib
* Etc.
Matcher
After identifying the used open sources, one can compile a .JSON configuration file for a specific library (libpng version 1.2.29 for instance). Once compiled, Karta will automatically attempt to match the functions (symbols) of the open source in the loaded binary. In addition, in case your open source used external functions (memcpy, fread, or zlib_inflate), Karta will also attempt to match those external functions as well.
Folder Structure
* src: source directory for the plugin
* configs: pre-supplied *.JSON configuration files (hoping the community will contribute more)
* compilations: compilation tips for generating the configuration files, and lessons from past open sources
* docs: sphinx documentation directory
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Setting Amass config file?
I posted this question on the amass discord and haven't gotten a reply so I thought I would throw it up here.
I'm trying to get the config file setup. I added a file to /etc/amass/ using nano and named it config.ini and copy/pasted the example config.ini from github ( Amass/config.ini at master · OWASP/Amass (github.com ). Tried running it, permission denied, did chmod+x config.ini, ran with sudo and still permission denied.
I've tried running the command as amass enum -d example.com -config /etc/amass/config.ini.
Halp
submitted by /u/DoubleAgent10
[link] [comments]
Setting Amass config file?
I posted this question on the amass discord and haven't gotten a reply so I thought I would throw it up here.
I'm trying to get the config file setup. I added a file to /etc/amass/ using nano and named it config.ini and copy/pasted the example config.ini from github ( Amass/config.ini at master · OWASP/Amass (github.com ). Tried running it, permission denied, did chmod+x config.ini, ran with sudo and still permission denied.
I've tried running the command as amass enum -d example.com -config /etc/amass/config.ini.
Halp
submitted by /u/DoubleAgent10
[link] [comments]
hacking: security in practice
I want to catch a scammer who had been ripping off my brother until he died last month. He's been dead less than 4 weeks and this person is now already hitting me up for money. Any ideas on how to get info on them to turn over to LE without scaring them away?
My older brother was 53 and lonely. He died of a heart attack at the end of August, and since then I have found out that he was being scammed by at least two people. The first person had conned him into sending over $5K to "invest in cryptocurrency". Soon after he passed away, I found this person on Facebook and I quickly scared them off by saying my brother's probate attorney needed to get in touch with them to discuss liquefying his investments. Within minutes, I got blocked on FB and that's the only connection I had.
Now I am being texted by someone who claims they were my brother's fiancee. He never told me he was engaged or even seeing anyone, but that's not out of his character; he was very introverted and private.
I got his "fiancee"'s phone number when she called his phone shortly after he died. At that point, all she would say was that they were engaged. But now, less than a month after he died, she has begun asking me for money. Her story is: she is starting an online business and my brother had helped her finance it, and now that he's gone she needs help keeping her business afloat. She had the gall to include the line, "it would make your brother sad if our business failed."
I haven't scared this one away yet. All I have is a phone number. Any ideas on ways I could get closer to finding out this scumbag's identity? I would like to report them to the authorities for online fraud.
submitted by /u/izimand
[link] [comments]
I want to catch a scammer who had been ripping off my brother until he died last month. He's been dead less than 4 weeks and this person is now already hitting me up for money. Any ideas on how to get info on them to turn over to LE without scaring them away?
My older brother was 53 and lonely. He died of a heart attack at the end of August, and since then I have found out that he was being scammed by at least two people. The first person had conned him into sending over $5K to "invest in cryptocurrency". Soon after he passed away, I found this person on Facebook and I quickly scared them off by saying my brother's probate attorney needed to get in touch with them to discuss liquefying his investments. Within minutes, I got blocked on FB and that's the only connection I had.
Now I am being texted by someone who claims they were my brother's fiancee. He never told me he was engaged or even seeing anyone, but that's not out of his character; he was very introverted and private.
I got his "fiancee"'s phone number when she called his phone shortly after he died. At that point, all she would say was that they were engaged. But now, less than a month after he died, she has begun asking me for money. Her story is: she is starting an online business and my brother had helped her finance it, and now that he's gone she needs help keeping her business afloat. She had the gall to include the line, "it would make your brother sad if our business failed."
I haven't scared this one away yet. All I have is a phone number. Any ideas on ways I could get closer to finding out this scumbag's identity? I would like to report them to the authorities for online fraud.
submitted by /u/izimand
[link] [comments]
reddit
I want to catch a scammer who had been ripping off my brother...
My older brother was 53 and lonely. He died of a heart attack at the end of August, and since then I have found out that he was being scammed by...
hacking: security in practice
How wpscan works?
Hello guys,
I already know and use WPScan (I'm a beginner). But I would like to know how this tool works (WPScan). I would like to know what she does so that it is possible to scan a WordPress site in this way.
Could someone explain?
submitted by /u/essencedata
[link] [comments]
How wpscan works?
Hello guys,
I already know and use WPScan (I'm a beginner). But I would like to know how this tool works (WPScan). I would like to know what she does so that it is possible to scan a WordPress site in this way.
Could someone explain?
submitted by /u/essencedata
[link] [comments]
reddit
How wpscan works?
Hello guys, I already know and use WPScan (I'm a beginner). But I would like to know how this tool works (WPScan). I would like to...
hacking: security in practice
Can't get PCUnlocker to boot
I'm trying to unlock a forgotten password Windows 10 machine. I tried using Ubuntu live, but ran into road blocks and caved and bought PCUnlocker. Thing is, the PC is resisting to boot to the USB drive with the iso on it. I've screwed around with the various BIOS settings related to secure boot, UEFI vs legacy, etc, but nothing seems to work. Any suggestions?
submitted by /u/Mastiff37
[link] [comments]
Can't get PCUnlocker to boot
I'm trying to unlock a forgotten password Windows 10 machine. I tried using Ubuntu live, but ran into road blocks and caved and bought PCUnlocker. Thing is, the PC is resisting to boot to the USB drive with the iso on it. I've screwed around with the various BIOS settings related to secure boot, UEFI vs legacy, etc, but nothing seems to work. Any suggestions?
submitted by /u/Mastiff37
[link] [comments]
reddit
Can't get PCUnlocker to boot
I'm trying to unlock a forgotten password Windows 10 machine. I tried using Ubuntu live, but ran into road blocks and caved and bought...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Common Cyber Security Threats, And How To Protect Yourself
https://cdn-images-1.medium.com/max/600/0*DfkEqx7_ck2G6CAh.jpg
Naturally devices which are constantly connected to the internet and sending information to one-another and to you wherever you are in the…
Continue reading on Medium »
Common Cyber Security Threats, And How To Protect Yourself
https://cdn-images-1.medium.com/max/600/0*DfkEqx7_ck2G6CAh.jpg
Naturally devices which are constantly connected to the internet and sending information to one-another and to you wherever you are in the…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Hack This Site: Basic Web Challenges — Level 7
https://cdn-images-1.medium.com/max/1237/1*pnP2DHhY5fv1ZIZoJQ-RZw.png
Today we’re looking at Hack This Site Basic Web Challenge 7. This challenge requires performing command injection to complete it. If you…
Continue reading on Medium »
Hack This Site: Basic Web Challenges — Level 7
https://cdn-images-1.medium.com/max/1237/1*pnP2DHhY5fv1ZIZoJQ-RZw.png
Today we’re looking at Hack This Site Basic Web Challenge 7. This challenge requires performing command injection to complete it. If you…
Continue reading on Medium »