Kali Linux Tutorials
Androidqf : (Android Quick Forensics) Helps Quickly Gathering Forensic Evidence From Android Devices, In Order To Identify Potential Traces Of Compromise

Androidqf (Android Quick Forensics) is a portable tool to simplify the acquisition of relevant forensic data from Android devices. It is the successor of Snoopdroid, re-written in Go and leveraging official adb binaries.

androidqf is intended to provide a simple and portable cross-platform utility to quickly acquire data from Android devices. It is similar in functionality to mvt-android. However, contrary to MVT, androidqf is designed to be easily run by non-tech savvy users as well.

Build

Executable binaries for Linux, Windows and Mac should be available in the latest release. In case you have issues running the binary you might want to build it by yourself.

In order to build androidqf you will need Go 1.15+ installed. You will also need to install make. When ready you can clone the repository and run any of the following commands, for your platform of choice:

make linux
make darwin
make windows

These commands will generate binaries in a build/ folder. How To Use

Before launching androidqf you need to have the target Android device connected to your computer via USB, and you will need to have enabled USB debugging. Please refer to the official documentation on how to do this, but also be mindful that Android phones from different manufacturers might require different navigation steps than the defaults.

Once USB debugging is enabled, you can proceed launching androidqf. It will first attempt to connect to the device over the USB bridge, which should result in the Android phone to prompt you to manually authorize the host keys. Make sure to authorize them, ideally permanently so that the prompt wouldn’t appear again.

Now androidqf should be executing and creating an acquisition folder at the same path you have placed your androidqf binary. At some point in the execution, androidqf will prompt you some choices: these prompts will pause the acquisition until you provide a selection, so pay attention.

The following data can be extracted:

1. A list of all packages installed and related distribution files.
2. (Optional) Copy of all installed APKs or of only those not marked as system apps.
3. The output of the dumpsysshell command, providing diagnostic information about the device.
4. The output of the getpropshell command, providing build information and configuration parameters.
5. The output of the psshell command, providing a list of all running processes.
6. (Optional) A backup of SMS and MMS messages. Encryption & Potential Threats

Carrying the androidqf acquisitions on an unencrypted drive might expose yourself, and even more so those you acquired data from, to significant risk. For example, you might be stopped at a problematic border and your androidqf drive could be seized. The raw data might not only expose the purpose of your trip, but it will also likely contain very sensitive data (for example list of applications installed, or even SMS messages).

Ideally you should have the drive fully encrypted, but that might not always be possible. You could also consider placing androidqf inside a VeraCrypt container and carry with it a copy of VeraCrypt to mount it. However, VeraCrypt containers are typically protected only by a password, which you might be forced to provide.

Alternatively, androidqf allows to encrypt each acquisition with a provided age public key. Preferably, this public key belongs to a keypair for which the end-user does not possess, or at least carry, the private key. In this way, the end-user would not be able to decrypt the acquired data even under duress.

If you place a file called key.txtin the same folder as the androidqf executable, androi[...]

dqf will automatically attempt to compress and encrypt each acquisition and delete the original unencrypted copies.

Once you have retrieved an encrypted acquisition file, you can decrypt it with age like so:

$ age –decrypt -i ~/path/to/privatekey.txt -o .zip .zip.age

Bear in mind, it is always possible that at least some portion of the unencrypted data could be recovered through advanced forensics techniques – although we’re working to mitigate that. Download

Hacking on Medium
“Cybersecurity” Science-Research, November 2021 — summary from Arxiv, DOAJ and Astrophysics Data…

https://cdn-images-1.medium.com/max/2600/1*XqSjl-6sm59szbE16KoXNg.jpeg
Arxiv — summary generated by Brevi Assistant

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Try Hack Me Gaming Server

https://cdn-images-1.medium.com/max/1134/1*1YOEU3tPd_YSsEiI0p7Qaw.png
This is another simple Boot2Root box on Try hack me. This box requires enumeration techniques to find hidden directories. Once found we…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Seeking opinions on Bug Bounties and whether they are 'good' for society/'bad' for society/inbetween/why?

Bug Bounty looks like a good way to earn money.

I'm more interested in wondering about the 'societal goals' of bug bounty work. And where the 'industry' ends up in 10-20 yrs.

For example: you could say bugs have, in the past, been a way to either 'fuck the system', or at least to say 'the system can be fucked' or 'look how fucked the system can be'. And most of bug bounties is helping out already rich-and-powerful corporations, which some could argue already have too much wealth, too much power. Maybe even so much power that the largest companies help maintain power over everyday citizens. The idea that: corporations are just as, or more powerful than governments, or work in tandem with governments to maintain the power i'm talking about.

On the other side, I imagine, people could say "well if you find bugs in software through a bug bounty system: you are protecting the everyday computer user from being exploited by data-breach etc."

Can bug bounty be generalised into one of these two camps? Are you more on one side of the fence than the other? I ask because I do not know all that much about this and am not sure what side of the fence I am on. I am mostly wondering about bug bounty as a phenomenon, and where it goes in 20 yrs time? do all corporations in 20 years time essentially 'own' all the top bounty hunters? do they put them up in big mansions and employ the bounty hunters just for their own company? might be a bad question but i wonder where the bug bounty system goes. It is helping massive corporations out isnt it. do they need the help? or is it helping everyday users? can such a generalization be made?

So I am wondering if anyone has a strong opinion about Bug Bounty? In terms of value to society or whatever your value system may be.

submitted by /u/Adept_Ad_8458
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

OTP Bypass {step to step}
https://technicalsurendra.medium.com/otp-bypass-step-to-step-c81f1a6a40f5?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Learn how OTP can bypass and report it to company's to get bounty |Continue reading on Medium » (https://technicalsurendra.medium.com/otp-bypass-step-to-step-c81f1a6a40f5?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Google Dork Series !!
https://infosec-helper.medium.com/google-dork-series-1acd2b09a37b?source=rss------bug_bounty-5

I am Parshwa Bhavsar and I am starting new series of Google Dorks in which , I’ll mention some useful dorks.Continue reading on Medium » (https://infosec-helper.medium.com/google-dork-series-1acd2b09a37b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

OTP Bypass {step to step}

Learn how OTP can bypass and report it to company's to get bounty |Continue reading on InfoSec Write-ups »
Read more...

Google Dork Series !!

I am Parshwa Bhavsar and I am starting new series of Google Dorks in which , I’ll mention some useful dorks.Continue reading on Medium »
Read more...

Hacking on Medium
OTP Bypass {step to step}

https://cdn-images-1.medium.com/max/900/1*-D0eLo1NNn4-Sx44N-qo1Q.jpeg
Learn how OTP can bypass and report it to company's to get bounty |

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Google Dork Series !!

I am Parshwa Bhavsar and I am starting new series of Google Dorks in which , I’ll mention some useful dorks.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Roadmap to become an Ethical hacker

https://cdn-images-1.medium.com/max/1815/1*1fbaXSDe9h4Dtmy_ufQSWA.png
INTRODUCTION

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The curse of the p-value

https://cdn-images-1.medium.com/max/2500/0*M44NayJzFmq8pqB1
For decades, the quality of statistical results has been measured using the p-value.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video