Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Azur3Alph4 : A PowerShell Module That Automates Red-Team Tasks For Ops On Objective
Azur3Alph4 is a PowerShell module that automates red-team tasks for ops on objective. This module situates in a post-breach (RCE achieved) position. Token extraction and many other tools will not execute successfully without starting in this position. This module should be used for further enumeration and movement in a compromised app that is part of a managed identity.
Azur3Alph4 is currently in development. Modules are being worked on and updated. Most of this is still untested.
Scripts are in repo for individual use and easy identification, but the .psm1 file is what will be consistently updated.
Installation & Usage
Point the $envendpoint to cmd execution passing “env” to the Azure backend.
Updates – 8/10/2021
* Added Get-ResourceActions.ps1 and updated Azur3Alph4.psm1
Updates – 8/5/2021
* Made Azur3Alph4 modular
* Added Get-SubscriptionId function
Why This Was Built
* I built this because I wanted to learn more about both PowerShell and Azure, two things I’d definitely like to get better at.
* To help automate and eliminate a lot of repetitive PS commands.
* To build off my current knowledge of Azure red teaming
Function List
Get-Endpoint
Enumerates an Azure endpoint to verify whether or not it belongs to a managed identity
Get-ManagedIdentityToken
Grabs the Managed Identity Token from the endpoint using the extracted secret. Stores the value in a given variable
Connect-AzAccount
Takes a username and password variable and automates SecureString conversion and connects to an Azure account
Get-SubscriptionId
Gets the subscription ID using the REST API for Azure
Get-ManagedIdentityResources
Uses the subscription ID to enumerate all resources that are accessible
Get-ResourceActions.ps1
Enumerates all resources available using Azure token and lists permissions of each resource directly below it
Download
Azur3Alph4 : A PowerShell Module That Automates Red-Team Tasks For Ops On Objective
Azur3Alph4 is a PowerShell module that automates red-team tasks for ops on objective. This module situates in a post-breach (RCE achieved) position. Token extraction and many other tools will not execute successfully without starting in this position. This module should be used for further enumeration and movement in a compromised app that is part of a managed identity.
Azur3Alph4 is currently in development. Modules are being worked on and updated. Most of this is still untested.
Scripts are in repo for individual use and easy identification, but the .psm1 file is what will be consistently updated.
Installation & Usage
Import-Module Azur3Alph4Point the $envendpoint to cmd execution passing “env” to the Azure backend.
Updates – 8/10/2021
* Added Get-ResourceActions.ps1 and updated Azur3Alph4.psm1
Updates – 8/5/2021
* Made Azur3Alph4 modular
* Added Get-SubscriptionId function
Why This Was Built
* I built this because I wanted to learn more about both PowerShell and Azure, two things I’d definitely like to get better at.
* To help automate and eliminate a lot of repetitive PS commands.
* To build off my current knowledge of Azure red teaming
Function List
Get-Endpoint
Enumerates an Azure endpoint to verify whether or not it belongs to a managed identity
Get-ManagedIdentityToken
Grabs the Managed Identity Token from the endpoint using the extracted secret. Stores the value in a given variable
Connect-AzAccount
Takes a username and password variable and automates SecureString conversion and connects to an Azure account
Get-SubscriptionId
Gets the subscription ID using the REST API for Azure
Get-ManagedIdentityResources
Uses the subscription ID to enumerate all resources that are accessible
Get-ResourceActions.ps1
Enumerates all resources available using Azure token and lists permissions of each resource directly below it
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
LinuxCatScale : Incident Response Collection And Processing Scripts With Automated Reporting Scripts
Linux CatScale is a bash script that uses live of the land tools to collect extensive data from Linux based hosts. The data aims to help DFIR professionals triage and scope incidents. An Elk Stack instance also is configured to consume the output and assist the analysis process.
Usage
This scripts were built to automate as much as possible. We recommend running it from an external device/usb to avoid overwriting evidence. Just in case you need a full image in future.
Please run the collection script on suspected hosts with sudo rights. fsecure_incident-response_linux_collector_0.7.sh the only file you need to run the collection.
user@suspecthost:$ chmod +x ./Cat-Scale.sh
user@suspecthost:$ sudo ./Cat-Scale.sh
The script will create a directory called “FSecure-out” in the working directory and should remove all artefacts after being compressed. This will leave a filename in the format of
Once these are all aggregated and you have the
user@analysishost:$ chmod +x ./Extract-Cat-Scale.sh
user@analysishost:$ sudo ./Extract-Cat-Scale.sh
Parsing
This project has predefined grok filters to ingest data into elastic, feel free to modify them as you need.
What does it collect?
This script will produce output and archive. Currently most up to date what it collects is covered in the blog post here: https://labs.f-secure.com/tools/cat-scale-linux-incident-response-collection/
Download
LinuxCatScale : Incident Response Collection And Processing Scripts With Automated Reporting Scripts
Linux CatScale is a bash script that uses live of the land tools to collect extensive data from Linux based hosts. The data aims to help DFIR professionals triage and scope incidents. An Elk Stack instance also is configured to consume the output and assist the analysis process.
Usage
This scripts were built to automate as much as possible. We recommend running it from an external device/usb to avoid overwriting evidence. Just in case you need a full image in future.
Please run the collection script on suspected hosts with sudo rights. fsecure_incident-response_linux_collector_0.7.sh the only file you need to run the collection.
user@suspecthost:$ chmod +x ./Cat-Scale.sh
user@suspecthost:$ sudo ./Cat-Scale.sh
The script will create a directory called “FSecure-out” in the working directory and should remove all artefacts after being compressed. This will leave a filename in the format of
FSecure_Hostname-YYMMDD-HHMM.tar.gzOnce these are all aggregated and you have the
FSecure_Hostname-YYMMDD-HHMM.tar.gzon the analysis machine. You can run Extract-Cat-Scale.sh which will extract all the files and place them in a folder called “extracted”.user@analysishost:$ chmod +x ./Extract-Cat-Scale.sh
user@analysishost:$ sudo ./Extract-Cat-Scale.sh
Parsing
This project has predefined grok filters to ingest data into elastic, feel free to modify them as you need.
What does it collect?
This script will produce output and archive. Currently most up to date what it collects is covered in the blog post here: https://labs.f-secure.com/tools/cat-scale-linux-incident-response-collection/
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
FUSE : A Penetration Testing Tool For Finding File Upload Bugs
FUSE is a penetration testing system designed to identify Unrestricted Executable File Upload (UEFU) vulnerabilities. The details of the testing strategy is in our paper, “FUSE: Finding File Upload Bugs via Penetration Testing”, which appeared in NDSS 2020. To see how to configure and execute FUSE, see the followings.
Setup
Install
FUSE currently works on Ubuntu 18.04 and Python 2.7.15.
* Install dependencies
#apt-get install rabbitmq-server
#apt-get install python-pip
#apt-get install git
* Clone and build FUSE
$ git clone https://github.com/WSP-LAB/FUSE
$ cd FUSE && pip install -r requirements.txt
If you plan to leverage headless browser verification using selenium, please install Chrome and Firefox web driver by refering selenium document.
Usage
Configuration
* FUSE uses a user-provided configuration file that specifies parameters for a target PHP application. The script must be filled out before testing a target Web application. You can check out README file and example configuration files.
* Configuration for File Monitor (Optional)
$ vim filemonitor.py
…
10 MONITOR_PATH=’/var/www/html/’ <-
11 MONITOR_PORT=20174 <-
12 EVENT_LIST_LIMITATION=8000 <-
…
Execution
* FUSE
$ python framework.py [Path of configuration file]
File Monitor
$ python filemonitor.py
* Result
* When FUSE completes the penetration testing, a [HOST] directory and a [HOST_report.txt] file are created.
* A [HOST] folder stores files that have been attempted to upload.
* A [HOST_report.txt] file contains test results and information related to files that trigger U(E)FU.
CVEs
If you find UFU and UEFU bugs and get CVEs by running FUSE, please send a PR for README.md
ApplicationCVEsElggCVE-2018-19172ECCube3CVE-2018-18637CMSMadeSimpleCVE-2018-19419, CVE-2018-18574CMSimpleCVE-2018-19062Concrete5CVE-2018-19146GetSimpleCMSCVE-2018-19420, CVE-2018-19421SubrionCVE-2018-19422OsCommerce2CVE-2018-18572, CVE-2018-18964, CVE-2018-18965, CVE-2018-18966MonstraCVE-2018-6383, CVE-2018-18694XEXEVE-2019-001
Download
FUSE : A Penetration Testing Tool For Finding File Upload Bugs
FUSE is a penetration testing system designed to identify Unrestricted Executable File Upload (UEFU) vulnerabilities. The details of the testing strategy is in our paper, “FUSE: Finding File Upload Bugs via Penetration Testing”, which appeared in NDSS 2020. To see how to configure and execute FUSE, see the followings.
Setup
Install
FUSE currently works on Ubuntu 18.04 and Python 2.7.15.
* Install dependencies
#apt-get install rabbitmq-server
#apt-get install python-pip
#apt-get install git
* Clone and build FUSE
$ git clone https://github.com/WSP-LAB/FUSE
$ cd FUSE && pip install -r requirements.txt
If you plan to leverage headless browser verification using selenium, please install Chrome and Firefox web driver by refering selenium document.
Usage
Configuration
* FUSE uses a user-provided configuration file that specifies parameters for a target PHP application. The script must be filled out before testing a target Web application. You can check out README file and example configuration files.
* Configuration for File Monitor (Optional)
$ vim filemonitor.py
…
10 MONITOR_PATH=’/var/www/html/’ <-
11 MONITOR_PORT=20174 <-
12 EVENT_LIST_LIMITATION=8000 <-
…
Execution
* FUSE
$ python framework.py [Path of configuration file]
File Monitor
$ python filemonitor.py
* Result
* When FUSE completes the penetration testing, a [HOST] directory and a [HOST_report.txt] file are created.
* A [HOST] folder stores files that have been attempted to upload.
* A [HOST_report.txt] file contains test results and information related to files that trigger U(E)FU.
CVEs
If you find UFU and UEFU bugs and get CVEs by running FUSE, please send a PR for README.md
ApplicationCVEsElggCVE-2018-19172ECCube3CVE-2018-18637CMSMadeSimpleCVE-2018-19419, CVE-2018-18574CMSimpleCVE-2018-19062Concrete5CVE-2018-19146GetSimpleCMSCVE-2018-19420, CVE-2018-19421SubrionCVE-2018-19422OsCommerce2CVE-2018-18572, CVE-2018-18964, CVE-2018-18965, CVE-2018-18966MonstraCVE-2018-6383, CVE-2018-18694XEXEVE-2019-001
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
BruteLoops : Protocol Agnostic Online Password Guessing API
BruteLoops is a dead simple library providing the foundational logic for efficient password brute force attacks against authentication interfaces.
See various Wiki sections for more information.
A “modular” example is included with the library that demonstrates how to use this package. It’s fully functional and provides multiple brute force modules. Below is a sample of its capabilities:
http.accellion_ftp Accellion FTP HTTP interface login module
http.basic_digest Generic HTTP basic digest auth
http.basic_ntlm Generic HTTP basic NTLM authentication
http.global_protect
Global Protect web interface
http.mattermost Mattermost login web interface
http.netwrix Netwrix web login
http.okta Okta JSON API
http.owa2010 OWA 2010 web interface
http.owa2016 OWA 2016 web interface
smb.smb Target a single SMB server
testing.fake Fake authentication module for training/testing
Key Features
* Protocol agnostic – If a callback can be written in Python, BruteLoops can be used to attack it
* SQLite support – All usernames, passwords, and credentials are maintained in an SQLite database.
* A companion utility (
* Spray and Stuffing Attacks in One Tool – BruteLoops supports both spray and stuffing attacks in the same attack logic and database, meaning that you can configure a single database and run the attack without heavy reconfiguration and confusion.
* Guess scheduling – Each username in the SQLite database is configured with a timestamp that is updated after each authentication event. This means we can significantly reduce likelihood of locking accounts by scheduling each authentication event with precision.
* Fine-grained configurability to avoid lockout events – Microsoft’s lockout policies can be matched 1-to-1 using BruteLoop’s parameters:
*
*
* Timestampes associated with each authentication event are tracked in BruteLoops’ SQLite database. Each username receives a distinct timestamp to assure that authentication events are highly controlled.
* Attack resumption – Stopping and resuming an attack is possible without worrying about losing your place in the attack or locking accounts.
* Multiprocessing – Speed up attacks using multiprocessing! By configuring the`parallel guess count, you’re effectively telling BruteLoops how many usernames to guess in parallel.
* Logging – Each authentication event can optionally logged to disk. This information can be useful during red teams by providing customers with a detailed attack timeline that can be mapped back to logged events.
Dependencies
BruteLoops requires Python3.7 or newer and SQLAlchemy 1.3.0, the latter of which can be obtained via pip and the requirements.txt file in this repository:
Installation
git clone https://github.com/arch4ngel/bruteloops
cd bruteloops
python3 -m pip install -r requirements.txt
How do I use this Damn Thing?
Jeez, alright already…we can break an attack down into a few steps:
* Find an attackable service
* If one isn’t already available in the
* Find some usernames, passwords, and credentials
* Construct a database by passing the authentication data to
* If relevant, Enumerate or request the AD lockout policy to intelligently configure the attack
* Execute the attack in alignment with the target lockout policy[1][3][4]
Download
BruteLoops : Protocol Agnostic Online Password Guessing API
BruteLoops is a dead simple library providing the foundational logic for efficient password brute force attacks against authentication interfaces.
See various Wiki sections for more information.
A “modular” example is included with the library that demonstrates how to use this package. It’s fully functional and provides multiple brute force modules. Below is a sample of its capabilities:
http.accellion_ftp Accellion FTP HTTP interface login module
http.basic_digest Generic HTTP basic digest auth
http.basic_ntlm Generic HTTP basic NTLM authentication
http.global_protect
Global Protect web interface
http.mattermost Mattermost login web interface
http.netwrix Netwrix web login
http.okta Okta JSON API
http.owa2010 OWA 2010 web interface
http.owa2016 OWA 2016 web interface
smb.smb Target a single SMB server
testing.fake Fake authentication module for training/testing
Key Features
* Protocol agnostic – If a callback can be written in Python, BruteLoops can be used to attack it
* SQLite support – All usernames, passwords, and credentials are maintained in an SQLite database.
* A companion utility (
dbmanager.py) that creates and manages input databases accompanies BruteLoops* Spray and Stuffing Attacks in One Tool – BruteLoops supports both spray and stuffing attacks in the same attack logic and database, meaning that you can configure a single database and run the attack without heavy reconfiguration and confusion.
* Guess scheduling – Each username in the SQLite database is configured with a timestamp that is updated after each authentication event. This means we can significantly reduce likelihood of locking accounts by scheduling each authentication event with precision.
* Fine-grained configurability to avoid lockout events – Microsoft’s lockout policies can be matched 1-to-1 using BruteLoop’s parameters:
*
auth_threshold= Lockout Threshold*
max_auth_jitter= Lockout Observation Window* Timestampes associated with each authentication event are tracked in BruteLoops’ SQLite database. Each username receives a distinct timestamp to assure that authentication events are highly controlled.
* Attack resumption – Stopping and resuming an attack is possible without worrying about losing your place in the attack or locking accounts.
* Multiprocessing – Speed up attacks using multiprocessing! By configuring the`parallel guess count, you’re effectively telling BruteLoops how many usernames to guess in parallel.
* Logging – Each authentication event can optionally logged to disk. This information can be useful during red teams by providing customers with a detailed attack timeline that can be mapped back to logged events.
Dependencies
BruteLoops requires Python3.7 or newer and SQLAlchemy 1.3.0, the latter of which can be obtained via pip and the requirements.txt file in this repository:
python3.7 -m pip install -r requirements.txtInstallation
git clone https://github.com/arch4ngel/bruteloops
cd bruteloops
python3 -m pip install -r requirements.txt
How do I use this Damn Thing?
Jeez, alright already…we can break an attack down into a few steps:
* Find an attackable service
* If one isn’t already available in the
example.py[1] directory, build a callback* Find some usernames, passwords, and credentials
* Construct a database by passing the authentication data to
dbmanager.py[2]* If relevant, Enumerate or request the AD lockout policy to intelligently configure the attack
* Execute the attack in alignment with the target lockout policy[1][3][4]
Download
hacking: security in practice
Kali, Kismet, and a GPS dongle that doesn't want to update (but only with gpsd)
I've tried this on both KaliPi and Kali running in RHEL VMM.
I'm attempting to do a "wireless assesment survery" (ahem wardrive) using Kismet, but I'm having a weird GPS issue.
The dongle I'm using is this one, which has a U-Blox 7 under the hood.
Everything is detected correctly, gpsmon gives me wonderfully good data, with the lat/long dancing around in the bottom few digits as the accuracy comes down. Then I fired up gpsd with nothing more complex than a -n option and cgps shows a good 3d fix and tons of satellites while the NMEA data flies past underneath.
Cool. Went for a drive.
Came home and looked at the data, and wouldn't you know it - it was all geolocated at my house. The place I started Kismet.
I went back and looked at the cgps output and the lat/long wasn't changing. At all. Not even eight digits past the decimal. Rock steady. I did it again on a drive, looking at the location in cgps the whole time. Never changed.
I discovered that the location will update if you restart gpsd and then re-run cgps, but it gets "stuck" on the first fix after gpsd starts.
I've been pulling my hair out trying all manner of different settings in /etc/default/gpsd and searching through forums but nobody seems to be having this precise problem.
Any ideas? I would just assume the dongle is bad were it not for the super clean data coming through the tty into gpsmon.
submitted by /u/Do_Hard_Things
[link] [comments]
Kali, Kismet, and a GPS dongle that doesn't want to update (but only with gpsd)
I've tried this on both KaliPi and Kali running in RHEL VMM.
I'm attempting to do a "wireless assesment survery" (ahem wardrive) using Kismet, but I'm having a weird GPS issue.
The dongle I'm using is this one, which has a U-Blox 7 under the hood.
Everything is detected correctly, gpsmon gives me wonderfully good data, with the lat/long dancing around in the bottom few digits as the accuracy comes down. Then I fired up gpsd with nothing more complex than a -n option and cgps shows a good 3d fix and tons of satellites while the NMEA data flies past underneath.
Cool. Went for a drive.
Came home and looked at the data, and wouldn't you know it - it was all geolocated at my house. The place I started Kismet.
I went back and looked at the cgps output and the lat/long wasn't changing. At all. Not even eight digits past the decimal. Rock steady. I did it again on a drive, looking at the location in cgps the whole time. Never changed.
I discovered that the location will update if you restart gpsd and then re-run cgps, but it gets "stuck" on the first fix after gpsd starts.
I've been pulling my hair out trying all manner of different settings in /etc/default/gpsd and searching through forums but nobody seems to be having this precise problem.
Any ideas? I would just assume the dongle is bad were it not for the super clean data coming through the tty into gpsmon.
submitted by /u/Do_Hard_Things
[link] [comments]
reddit
Kali, Kismet, and a GPS dongle that doesn't want to update (but...
I've tried this on both KaliPi and Kali running in RHEL VMM. I'm attempting to do a "wireless assesment survery" (**ahem** wardrive) using...
Analysis for CVE-2021–21233 (Google Chrome Heap Buffer Overflow)
https://medium.com/@abrar.slr722/analysis-for-cve-2021-21233-google-chrome-heap-buffer-overflow-d8778bf212b9?source=rss------bug_bounty-5
Out Of Bounds Write vulnerability existed in BlitFramebuffer method of WebGL API in Chromium based browsers.Continue reading on Medium » (https://medium.com/@abrar.slr722/analysis-for-cve-2021-21233-google-chrome-heap-buffer-overflow-d8778bf212b9?source=rss------bug_bounty-5)
https://medium.com/@abrar.slr722/analysis-for-cve-2021-21233-google-chrome-heap-buffer-overflow-d8778bf212b9?source=rss------bug_bounty-5
Out Of Bounds Write vulnerability existed in BlitFramebuffer method of WebGL API in Chromium based browsers.Continue reading on Medium » (https://medium.com/@abrar.slr722/analysis-for-cve-2021-21233-google-chrome-heap-buffer-overflow-d8778bf212b9?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How to Hack a Simple JavaScript-driven Web Application
https://cdn-images-1.medium.com/max/655/1*T4OJi5689OVnDHouqTtT8g.png
The FLARE-ON capture the flag is, in my opinion, one of the most difficult online reverse engineering contests out there. I usually enter…
Continue reading on JavaScript in Plain English »
How to Hack a Simple JavaScript-driven Web Application
https://cdn-images-1.medium.com/max/655/1*T4OJi5689OVnDHouqTtT8g.png
The FLARE-ON capture the flag is, in my opinion, one of the most difficult online reverse engineering contests out there. I usually enter…
Continue reading on JavaScript in Plain English »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Malware Analysis
https://cdn-images-1.medium.com/max/2542/1*MJqcRnXCtZ9h78YiL84f9w.png
For a project I was asked to set up a honey pot to see what malware I would get on the system. I used the AWS T-POT for this project and…
Continue reading on Medium »
Malware Analysis
https://cdn-images-1.medium.com/max/2542/1*MJqcRnXCtZ9h78YiL84f9w.png
For a project I was asked to set up a honey pot to see what malware I would get on the system. I used the AWS T-POT for this project and…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Visit Websites Without Opening The Browser
https://cdn-images-1.medium.com/max/2600/0*B0SswuDMCh7ObeV-
Learn how to interact with a website using headless Chrome, simple JavaScript, and Docker containers.
Continue reading on JavaScript in Plain English »
Visit Websites Without Opening The Browser
https://cdn-images-1.medium.com/max/2600/0*B0SswuDMCh7ObeV-
Learn how to interact with a website using headless Chrome, simple JavaScript, and Docker containers.
Continue reading on JavaScript in Plain English »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Ensure that you treat all systems, devices, data sources, etc. as protected resources
Today over 30% of data attacks and compromises come from inside the organization. And, most external attacks come from compromised user…
Continue reading on Medium »
Ensure that you treat all systems, devices, data sources, etc. as protected resources
Today over 30% of data attacks and compromises come from inside the organization. And, most external attacks come from compromised user…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
¡Winamp Media Player regresó con la versión 5.8!
https://cdn-images-1.medium.com/max/1438/0*5njKGltUCyt3VVts
PUBLICADO EN 25 OCTUBRE, 2021 POR EHACKING
Continue reading on Medium »
¡Winamp Media Player regresó con la versión 5.8!
https://cdn-images-1.medium.com/max/1438/0*5njKGltUCyt3VVts
PUBLICADO EN 25 OCTUBRE, 2021 POR EHACKING
Continue reading on Medium »