A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the webroot…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/asp-net-core-path-traversal-e2bed792d171?source=rss------bug_bounty-5)
Launching Allbridge Bug Bounty Program In Collaboration With HackenProof
https://allbridge.medium.com/launching-allbridge-bug-bounty-program-in-collaboration-with-hackenproof-cc449b54a8bf?source=rss------bug_bounty-5
https://allbridge.medium.com/launching-allbridge-bug-bounty-program-in-collaboration-with-hackenproof-cc449b54a8bf?source=rss------bug_bounty-5
We are happy to announce our new partnership with an esteemed expert in the security department, a bug bounty platform HackenProof.Continue reading on Medium » (https://allbridge.medium.com/launching-allbridge-bug-bounty-program-in-collaboration-with-hackenproof-cc449b54a8bf?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Autoharness : A Tool That Automatically Creates Fuzzing Harnesses Based On A Library
AutoHarness is a tool that automatically generates fuzzing harnesses for you. This idea stems from a concurrent problem in fuzzing codebases today: large codebases have thousands of functions and pieces of code that can be embedded fairly deep into the library. It is very hard or sometimes even impossible for smart fuzzers to reach that codepath. Even for large fuzzing projects such as oss-fuzz, there are still parts of the codebase that are not covered in fuzzing. Hence, this program tries to alleviate this problem in some capacity as well as provide a tool that security researchers can use to initially test a code base. This program only supports code bases which are coded in C and C++. Setup/Demonstration
This program utilizes llvm and clang for libfuzzer, Codeql for finding functions, and python for the general program. This program was tested on Ubuntu 20.04 with llvm 12 and python 3. Here is the initial setup.
sudo apt-get update;
sudo apt-get install python3 python3-pip llvm-12* clang-12 git;
pip3 install pandas lief subprocess os argparse ast;
Follow the installation procedure for Codeql on https://github.com/github/codeql. Make sure to install the CLI tools and the libraries. For my testing, I have stored both the tools and libraries under one folder. Finally, clone this repository or download a release. Here is the program’s output after running on nginx with the multiple argument mode set. This is the command I used.
python3 harness.py -L /home/akshat/nginx-1.21.0/objs/ -C /home/akshat/codeql-h/ -M 1 -O /home/akshat/autoharness/ -D nginx -G 1 -Y 1 -F “-I /home/akshat/nginx-1.21.0/objs -I /home/akshat/nginx-1.21.0/src/core -I /home/akshat/nginx-1.21.0/src/event -I /home/akshat/nginx-1.21.0/src/http -I /home/akshat/nginx-1.21.0/src/mail -I /home/akshat/nginx-1.21.0/src/misc -I /home/akshat/nginx-1.21.0/src/os -I /home/akshat/nginx-1.21.0/src/stream -I /home/akshat/nginx-1.21.0/src/os/unix” -X ngx_config.h,ngx_core.h
Results
https://1.bp.blogspot.com/-x_tXFNctEXc/YT8SsdDkfmI/AAAAAAAAK0I/4kROTZIWgh4UkFywCWXDh4rI3pDXk58fQCLcBGAsYHQ/s1405/1.png
It is definitely possible to raise the success by further debugging the compilation and adding more header files and more. Note the nginx project does not have any shared objects after compiling. However, this program does have a feature that can convert PIE executables into shared libraries. Planned Features (in order of progress)
* Struct Fuzzing
The current way implemented in the program to fuzz functions with multiple arguments is by using fuzzing data provider. There are some improvements to make in this integration; however, I believe I can incorporate this feature with data structures. A problem which I come across when coding this is with codeql and nested structs. It becomes especially hard without writing multiple queries which vary for every function. In short, this feature needs more work. I was also thinking about a simple solution using protobufs.
* Implementation Based Harness Creation
Using codeql, it is possible to use to generate a control flow graph that maps how the parameters in a function are initialized. Using that information, we can create a better harness. Another way is to look for implementations for the function that exist in the library and use that information to make an educated guess on an implementation of the function as a harness. The problems I currently have with this are generating the control flow graphs with codeql.
* Parallelized fuzzing/False Positive Detection
I can create a simple program that runs all the harnesses and picks up on any of the common false positives using ASAN. Also, I can create a new interface that runs all the harnesses at once and displays their statistics. Contribution/Bugs
If you find any bugs [...]
Autoharness : A Tool That Automatically Creates Fuzzing Harnesses Based On A Library
AutoHarness is a tool that automatically generates fuzzing harnesses for you. This idea stems from a concurrent problem in fuzzing codebases today: large codebases have thousands of functions and pieces of code that can be embedded fairly deep into the library. It is very hard or sometimes even impossible for smart fuzzers to reach that codepath. Even for large fuzzing projects such as oss-fuzz, there are still parts of the codebase that are not covered in fuzzing. Hence, this program tries to alleviate this problem in some capacity as well as provide a tool that security researchers can use to initially test a code base. This program only supports code bases which are coded in C and C++. Setup/Demonstration
This program utilizes llvm and clang for libfuzzer, Codeql for finding functions, and python for the general program. This program was tested on Ubuntu 20.04 with llvm 12 and python 3. Here is the initial setup.
sudo apt-get update;
sudo apt-get install python3 python3-pip llvm-12* clang-12 git;
pip3 install pandas lief subprocess os argparse ast;
Follow the installation procedure for Codeql on https://github.com/github/codeql. Make sure to install the CLI tools and the libraries. For my testing, I have stored both the tools and libraries under one folder. Finally, clone this repository or download a release. Here is the program’s output after running on nginx with the multiple argument mode set. This is the command I used.
python3 harness.py -L /home/akshat/nginx-1.21.0/objs/ -C /home/akshat/codeql-h/ -M 1 -O /home/akshat/autoharness/ -D nginx -G 1 -Y 1 -F “-I /home/akshat/nginx-1.21.0/objs -I /home/akshat/nginx-1.21.0/src/core -I /home/akshat/nginx-1.21.0/src/event -I /home/akshat/nginx-1.21.0/src/http -I /home/akshat/nginx-1.21.0/src/mail -I /home/akshat/nginx-1.21.0/src/misc -I /home/akshat/nginx-1.21.0/src/os -I /home/akshat/nginx-1.21.0/src/stream -I /home/akshat/nginx-1.21.0/src/os/unix” -X ngx_config.h,ngx_core.h
Results
https://1.bp.blogspot.com/-x_tXFNctEXc/YT8SsdDkfmI/AAAAAAAAK0I/4kROTZIWgh4UkFywCWXDh4rI3pDXk58fQCLcBGAsYHQ/s1405/1.png
It is definitely possible to raise the success by further debugging the compilation and adding more header files and more. Note the nginx project does not have any shared objects after compiling. However, this program does have a feature that can convert PIE executables into shared libraries. Planned Features (in order of progress)
* Struct Fuzzing
The current way implemented in the program to fuzz functions with multiple arguments is by using fuzzing data provider. There are some improvements to make in this integration; however, I believe I can incorporate this feature with data structures. A problem which I come across when coding this is with codeql and nested structs. It becomes especially hard without writing multiple queries which vary for every function. In short, this feature needs more work. I was also thinking about a simple solution using protobufs.
* Implementation Based Harness Creation
Using codeql, it is possible to use to generate a control flow graph that maps how the parameters in a function are initialized. Using that information, we can create a better harness. Another way is to look for implementations for the function that exist in the library and use that information to make an educated guess on an implementation of the function as a harness. The problems I currently have with this are generating the control flow graphs with codeql.
* Parallelized fuzzing/False Positive Detection
I can create a simple program that runs all the harnesses and picks up on any of the common false positives using ASAN. Also, I can create a new interface that runs all the harnesses at once and displays their statistics. Contribution/Bugs
If you find any bugs [...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Autoharness : A Tool That Automatically Creates Fuzzing Harnesses Based On A Library AutoHarness is a tool that automatically generates fuzzing harnesses for you. This idea stems from a concurrent problem in fuzzing codebases today: large…
with this program, please create an issue. I will try to come up with a fix. Also, if you have any ideas on any new features or how to implement performance upgrades or the current planned features, please create a pull request or an issue with the tag (contribution). PSA
This tool generates some false positives. Please first analyze the crashes and see if it is valid bug or if it is just an implementation bug. Also, you can enable the debug mode if some functions are not compiling. This will help you understand if there are some header files that you are missing or any linkage issues. If the project you are working on does not have shared libraries but an executable, make sure to compile the executable in PIE form so that this program can convert it into a shared library. Download
This tool generates some false positives. Please first analyze the crashes and see if it is valid bug or if it is just an implementation bug. Also, you can enable the debug mode if some functions are not compiling. This will help you understand if there are some header files that you are missing or any linkage issues. If the project you are working on does not have shared libraries but an executable, make sure to compile the executable in PIE form so that this program can convert it into a shared library. Download
Reconky - A Great Content Discovery Bash Script For Bug Bounty Hunters Which Automate Lot Of Task And Organized It
http://www.kitploit.com/2021/09/reconky-great-content-discovery-bash.html
http://www.kitploit.com/2021/09/reconky-great-content-discovery-bash.html
Reconky is a script written in bash to automate the task of recon and information gathering.This Bash Script allows you to collect some information that will help you identify what to do next and where to look for the required target.
Usage
./reconky.sh
Main-Features
It will Gathers Subdomains (https://www.kitploit.com/search/label/Subdomains) with assetfinder and Sublist3r Duplex check for subdomains using amass Enumerates subdomains on a target domain through dictionary (https://www.kitploit.com/search/label/Dictionary) attack using knockpy searchs for alive domains using Httprobe Investigates for feasible subdomain takeover Scans for open ports (https://www.kitploit.com/search/label/Open%20Ports) using nmap Pulls and Assembls all possible parameters found in wayback_url data Pulls and compilis json/js/php/aspx/ files from wayback output Runs eyewitness (https://www.kitploit.com/search/label/EyeWitness) against all the compiled(alive) domains
Installation & Requirements
Download the install script from https://github.com/ShivamRai2003/Reconky-Automated_Bash_Script/blob/main/reconky.sh
DEMO
Usage
./reconky.sh
Main-Features
It will Gathers Subdomains (https://www.kitploit.com/search/label/Subdomains) with assetfinder and Sublist3r Duplex check for subdomains using amass Enumerates subdomains on a target domain through dictionary (https://www.kitploit.com/search/label/Dictionary) attack using knockpy searchs for alive domains using Httprobe Investigates for feasible subdomain takeover Scans for open ports (https://www.kitploit.com/search/label/Open%20Ports) using nmap Pulls and Assembls all possible parameters found in wayback_url data Pulls and compilis json/js/php/aspx/ files from wayback output Runs eyewitness (https://www.kitploit.com/search/label/EyeWitness) against all the compiled(alive) domains
Installation & Requirements
Download the install script from https://github.com/ShivamRai2003/Reconky-Automated_Bash_Script/blob/main/reconky.sh
DEMO
Authors and Thanks
This script makes use of tools developped by the following people Cyber Mentor Tom Hudson - Tomonomnom OWASP Ahmed Aboul-Ela - Aboul3la Gianni Amato FortyNorth Security Gordon Lyon Note : this tool tested on the kali linux (https://www.kitploit.com/search/label/Kali%20Linux) 2021.2 live image. If install.sh does not run kindly install all the tools manually described in that.So that directory problem will not occur and make sure all the tools can be run globally from any directory for that use symbolic link.
Happy Hunting
Note : Run with Caution. Pull Request and New Ideas Is Welcome.
Download Reconky-Automated_Bash_Script (https://github.com/ShivamRai2003/Reconky-Automated_Bash_Script)
This script makes use of tools developped by the following people Cyber Mentor Tom Hudson - Tomonomnom OWASP Ahmed Aboul-Ela - Aboul3la Gianni Amato FortyNorth Security Gordon Lyon Note : this tool tested on the kali linux (https://www.kitploit.com/search/label/Kali%20Linux) 2021.2 live image. If install.sh does not run kindly install all the tools manually described in that.So that directory problem will not occur and make sure all the tools can be run globally from any directory for that use symbolic link.
Happy Hunting
Note : Run with Caution. Pull Request and New Ideas Is Welcome.
Download Reconky-Automated_Bash_Script (https://github.com/ShivamRai2003/Reconky-Automated_Bash_Script)
Reconky - A Great Content Discovery Bash Script For Bug Bounty Hunters Which Automate Lot Of Task And Organized It
Reconky is a script written in bash to automate the task of recon and information gathering.This Bash Script allows you to collect some information that will help you identify what to do next and where to look for the required target.Usage./reconky.sh <domain.com>Main-Features It will Gathers Subdomains with assetfinder and Sublist3r Duplex check for subdomains using amass Enumerates subdomains on a target domain through dictionary attack using knockpy searchs for alive domains using Httprobe Investigates for feasible subdomain takeover Scans for open ports using nmap Pulls and Assembls all possible parameters found in wayback_url data Pulls and compilis json/js/php/aspx/ files from wayback output Runs eyewitness against all the compiled(alive) domains Installation & Requirements Download the install script from https://github.com/ShivamRai2003/Reconky-Automated_Bash_Script/blob/main/reconky.sh DEMO Authors and Thanks This script makes use of tools developped by the following people Cyber Mentor Tom Hudson - Tomonomnom OWASP Ahmed Aboul-Ela - Aboul3la Gianni Amato FortyNorth Security Gordon Lyon Note : this tool tested on the kali linux 2021.2 live image. If install.sh does not run kindly install all the tools manually described in that.So that directory problem will not occur and make sure all the tools can be run globally from any directory for that use symbolic link. Happy Hunting Note : Run with Caution. Pull Request and New Ideas Is Welcome. Download Reconky-Automated_Bash_Script
Read more...
Reconky is a script written in bash to automate the task of recon and information gathering.This Bash Script allows you to collect some information that will help you identify what to do next and where to look for the required target.Usage./reconky.sh <domain.com>Main-Features It will Gathers Subdomains with assetfinder and Sublist3r Duplex check for subdomains using amass Enumerates subdomains on a target domain through dictionary attack using knockpy searchs for alive domains using Httprobe Investigates for feasible subdomain takeover Scans for open ports using nmap Pulls and Assembls all possible parameters found in wayback_url data Pulls and compilis json/js/php/aspx/ files from wayback output Runs eyewitness against all the compiled(alive) domains Installation & Requirements Download the install script from https://github.com/ShivamRai2003/Reconky-Automated_Bash_Script/blob/main/reconky.sh DEMO Authors and Thanks This script makes use of tools developped by the following people Cyber Mentor Tom Hudson - Tomonomnom OWASP Ahmed Aboul-Ela - Aboul3la Gianni Amato FortyNorth Security Gordon Lyon Note : this tool tested on the kali linux 2021.2 live image. If install.sh does not run kindly install all the tools manually described in that.So that directory problem will not occur and make sure all the tools can be run globally from any directory for that use symbolic link. Happy Hunting Note : Run with Caution. Pull Request and New Ideas Is Welcome. Download Reconky-Automated_Bash_Script
Read more...
GitHub
Reconky-Automated_Bash_Script/reconky.sh at main · ShivamRai2003/Reconky-Automated_Bash_Script
Reconky is an great Content Discovery bash script for bug bounty hunters which automate lot of task and organized in the well mannered form which help them to look forward. - ShivamRai2003/Reconky...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Hack This Site: Basic Web Challenges — Level 8
https://cdn-images-1.medium.com/max/1237/1*zOEqL_Tm6Lv0DnQ2LGIONA.png
Hello and welcome to HaXeZ, today we are looking at Hack This Site Basic Web Challenge level 8. This challenge requires you to perform a…
Continue reading on Medium »
Hack This Site: Basic Web Challenges — Level 8
https://cdn-images-1.medium.com/max/1237/1*zOEqL_Tm6Lv0DnQ2LGIONA.png
Hello and welcome to HaXeZ, today we are looking at Hack This Site Basic Web Challenge level 8. This challenge requires you to perform a…
Continue reading on Medium »
Dark Reading: Attacks/Breaches
How to Bust Through Barriers for a More Diverse Cybersecurity Workforce
Diversity is the topic du jour, but cybersecurity professionals of color still face a lot of hurdles to enter and grow within the industry. Organizations such as Blacks in Cybersecurity are providing some of these under-represented groups with a voice.
How to Bust Through Barriers for a More Diverse Cybersecurity Workforce
Diversity is the topic du jour, but cybersecurity professionals of color still face a lot of hurdles to enter and grow within the industry. Organizations such as Blacks in Cybersecurity are providing some of these under-represented groups with a voice.
Dark Reading: Attacks/Breaches
33% of Reported Phishing Emails Prove Malicious or Suspect
A new analysis from F-Secure details commonly used phishing phrases and methods seen in attacks.
33% of Reported Phishing Emails Prove Malicious or Suspect
A new analysis from F-Secure details commonly used phishing phrases and methods seen in attacks.
Dark Reading
33% of Reported Phishing Emails Prove Malicious or Suspect
A new analysis from F-Secure details commonly used phishing phrases and methods seen in attacks.