KitPloit - PenTest Tools!
Jektor - A Windows User-Mode Shellcode Execution Tool That Demonstrates Various Techniques That Malware Uses

https://blogger.googleusercontent.com/img/a/AVvXsEjPUZh2bM19bMCKno-1keHzqqPnKYezjowGFMC2ewBdWzsbBM4bs3dPRE1v1xDxcUU8UYUab_Smy9G3Y8i3a8MMxncLPM3kvnuLZfpOa3gBH2et1DJM8OEsjlnIkGomA2veDCXjR27kBLp_w7bflqmkHWRbatOalXMtELeXdHAMqtO5kqGxDlw8knt4cw=w640-h142 This utility focuses on shellcode injection techniques to demonstrate methods that malware may use to execute shellcode on a victim system

* Dynamically resolves API functions to evade IAT inclusion
* Includes usage of undocumented NT Windows API functions
* Supports local shellcode execution via CreateThread
* Supports remote shellcode execution via CreateRemoteThread
* Supports local shellcode injection via QueueUserAPC
* Supports local shellcode injection via EnumTimeFormatsEx
* Supports local shellcode injection via CreateFiber https://blogger.googleusercontent.com/img/a/AVvXsEjPUZh2bM19bMCKno-1keHzqqPnKYezjowGFMC2ewBdWzsbBM4bs3dPRE1v1xDxcUU8UYUab_Smy9G3Y8i3a8MMxncLPM3kvnuLZfpOa3gBH2et1DJM8OEsjlnIkGomA2veDCXjR27kBLp_w7bflqmkHWRbatOalXMtELeXdHAMqtO5kqGxDlw8knt4cw=w640-h142 Anti-virus detection?:

Pre-pending a set of NOPs to a Msfvenom XOR encrypted shellcode payload while using dynamic function address resolutions seems to bypass Windows Defender. IAT Import EvasionJektor makes use of dynamic function address resolutions using LoadLibrary and GetProcessAddress to make static analysis more difficult.

Important functions such as VirtualAlloc are not directly called which makes debugging and dumping the shellcode through breakpoints more difficult. Local shellcode execution via CreateThreadOn Windows when you want to create a new thread for the current process you can call the CreateThread function, this is the most basic technique for executing malicious code or shellcode within a process. You can simply allocate a region of memory for your shellcode, move your shellcode into the allocated region, and then call CreateThread with a pointer to the address of the allocated region. When you call CreateThread you pass the lpStartAddress parameter which is a pointer to the application-defined function that will be executed by the newly created thread. https://blogger.googleusercontent.com/img/a/AVvXsEi5aCFiSkNy6dbLXcFZUdzQJ7KnBA_1QTHD2-jUkDd-WYEw9M75sXelBgJ0qxAUsUasZyBQyt0q_DPEpQD5Rt2ETwhHj7lMkk65NE7a2-foooMZAPgLa1H6M6ChhT02dQD4CS8luCbiIZgiHC8Qf2jpGUuiaVIIzAO4WBRphdnqxFJemfOrO5g9ClnjPQ=w640-h120 1. Allocate a region of memory big enough for the shellcode using VirtualAlloc
2. Move the globally defined shellcode buffer into the newly allocated memory region with memcpy/RtlCopyMemory
3. Create a new thread that includes the base address of the allocated memory region with CreateThread
4. Wait for the new thread to be created/executed with WaitForSingleObject to ensure the payload detonates

After the memory region for the shellcode payload is allocated as RWX and the payload is moved into it, you can easily discover this region of memory by looking for any region of memory in the process that is marked as RWX, then if you inspect it you can seen the shellcode payload was moved into it, highlighted below are the first five bytes of the shellcode payload that executes a calculator on the victim system. https://blogger.googleusercontent.com/img/a/AVvXsEg-EdTGMKYV9pBxORo1L3MXsJw2H0liW0TgMqNRx1sVtkWTbrMtfG5L46vVfgyCI16-xm6gF9mmziuf5D5ZFIGsE0PIogCmRQnAeWhX0iSQRvayfzQlrBeGFGoVgToq7UObdUA7NtOw_Li-XMmUVEa0kVET6FHB4RLaysLZYvZHFpCWVg1OJeWyprZSSw=w640-h396 Hunting for RWX regions of memory is a quick way to identify potentially malicious activity on your system. https://blogger.googleusercontent.com/img/a/AVvXsEiIPWgZ2IELwpxKLe5Gdk-Nk8KLLC0sAEExG6aEEGwnI1Zr2yr-JNQJ6-ElfirO38UMtKr24JWY_mumidrDXr-_OV4t9fFu7KuS11HAycfL6Nkx9fBPv_8pzSm[...]

upYchiWXvJ0t1oaGccH-j238wlJ9PIYarg1_v4_qBbp-YuTQ-RXV-2CW9A89JMGHAxg=w640-h38 Remote shellcode execution via CreateRemoteThreadAnother technique to create threads for shellcode execution is to call the CreateRemoteThread function, this will allow you to create threads remotely in another process. But the catch is that you will also want to allocate and write the shellcode payload into the remote process as well, since you’ll create a thread remotely that executes the payloads address that’s allocated within that process. In order to allocate the payload remotely, you’ll need to use the VirtualAllocEx function, this function is different from VirtualAlloc in that it can allocate memory regions in remote processes. To do this, Jektor creates a new process with the CREATE_NO_WINDOW flag set using CreateProcessW, this is used to spawn a new hidden notepad process. One the new process is spawned it remotely allocated memory in it and then uses WriteProcessMemory to write the shellcode payload into the allocated memory region. After this it calls CreateRemoteThread to execute the shellcode payload.

1. Spawn a new process using CreateProcessW with CREATE_NO_WINDOW set
2. Open a HANDLE to the newly spawed process by PID with OpenProcess and dwProcessId from PROCESS_INFORMATION
3. Allocate memory remotely in the spawned process for the shellcode with VirtualAllocEx
4. Write the shellcode payload into the allocated memory region with WriteProcessMemory
5. Detonate the remotely created shellcode payload with CreateRemoteThread and the HANDLE from OpenProcess https://blogger.googleusercontent.com/img/a/AVvXsEglQ1tph6U1TBVz8AB_wWiMp7unRmq2k8C7ebcnfwuc4W7Px1PUXtZzQZBohDGTDF4t96RGxkGVTb5uTQkj6t1cLm_jYthz_EB5xJq0q5pBDzOjUFs__gar3f0I1ao8mA5P7bGXMMq5QTK9HhJRl22TSEeHWpcJm3Y0tByYyrcJs8zxiNkSHsQZxfIxkQ=w640-h198 Local shellcode execution via EnumTimeFormatsEx1. Allocate memory locally for the shellcode payload with VirtualAlloc
2. Move the shellcode payload into the newly allocated region with memcpy/RtlCopyMemory
3. Detonate the shellcode by passing it as the lpTimeFmtEnumProcEx parameter for EnumTimeFormatsEx https://blogger.googleusercontent.com/img/a/AVvXsEhAzCc4M0dnH4fFo1wMr79EN4Ya5iesvjZBOs-5Ie0R0fT1N9sTqlDGZZ25E9Vv7vitrmTva6ehhzdobRAnngVwFDx8sl38OEjtdY-k9gwcSSPJjrVb9km3lR8V5SDnMIPzPT3No0NpkWhkCwrvE7_-BkZnoSccrhyt1C4AfDWFuErZT4IhO1L9v5Q8vQ=w640-h62 Local shellcode execution via CreateFiber1. Get a HANDLE to the current thread using GetCurrentThread
2. Convert the main thread to a Fiber using ConvertThreadToFiber
3. Allocate memory for the shellcode payload with VirtualAlloc
4. Copy the shellcode buffer into the newly allocated memory region with memcpy
5. Create a new fiber with the base address of the allocated memory region as the lpStartAddress parameter for CreateFiber
6. Detonate the shellcode by scheduling the fiber with SwitchToFiber
7. Perform cleanup by deleting the created fiber with DeleteFiber https://blogger.googleusercontent.com/img/a/AVvXsEjioWHCd4s51R1Od_gRiD9rOf2RvKViUG7AlJId2CiR8AarehigESaE59t4hglCsxSZ0aYFaYcPlwo-NNJrMLsGyM47aeWmR6RqMiJFkFYMER7D6QKddtan1KioZ_v73IxJyC7FqKLg-8tOqA_PtaFT6Do2Yyfskb6lprz2FmQuE7fwQ_CZuj3alXai7Q=w640-h112 Local shellcode execution via QueueUserAPC1. Allocate memory for the shellcode buffer with VirtualAlloc
2. Get a handle to the current process with GetCurrentProcess
3. Write the shellcode payload into the newly allocated memory region with WriteProcessMemory
4. Get a handle to the current thread with GetCurrentThread
5. Queue a new APC routine pass the address of the allocated memory region as the pfnAPC parameter to QueueUserAPC
6. Trigger the shellcode payload by calling the undocumented NtTestAlert function which clears the APC queue for the current thread
7. Perform cleanup by closing the handles to the current thread and current process https://blogger.googleusercontent.com/img/a/AVvXsEgmWrejjU2NkUTiJk5ZkkKLzUwvlLR41ouz5JlCV-QqALe2QS[...]

ptw4_NJBwL2NN-ZtDA55q793gBD2rjseMjaUy2K5SjJuVcCcXBRF1C7BZqvcW3xsP3lvplYIP1ts443P2jIF4Ck63A3lb6l-vJoryK8REQ0ThGsEUS9Rc60StNaiB0JjmRBzI098QnjQ=w640-h122 Download Jektor➖ Sent by @TheFeedReaderBot ➖

Kali Linux Tutorials
The Ultimate Guide to Web Testing: Types and Key Areas

This guide is a web security testing bible that will help you with web safety. It includes a number of different web security testing strategies and types of web security testing. You’ll learn how to test for vulnerabilities in your website, what the web looks like from an attacker’s perspective, and what you can do to make sure your site is secure. Web TestingWeb testing is a web security analysis process that will help you identify vulnerabilities and fix them. It’s all about keeping your website and web applications safe from attacks and hacks so they can’t be used against you or the people who visit them. Web testing not only identifies issues but also provides fixes for those issues to ensure 100% protection. What are the types of web tests?There are three different types of web tests:

1. Black box – This type of web security test starts with zero knowledge of anything on the target website(s) or its infrastructure. The tester has no idea how it works, what technologies/frameworks were used in building the application, etc… All they have access to be an endpoint (URL) where they are able to enter web application security testing inputs.
2. White box – This type of web security test has full access to the code, database, and infrastructure of the target website(s). The tester is given complete knowledge of how everything works which allows them to easily spot issues with web application logic or design. However, this does not always mean that it will be easier for them to exploit those vulnerabilities as most web applications have added protection against these types of attacks (e.g.: session management).
3. Gray Box – A gray box penetration test uses some level of knowledge about the system being tested but doesn’t provide detailed information on exactly what’s going on behind the scenes. For example, a pen tester may be given web server version information to use during the web security testing but not login credentials. What is the difference between API and Web Services Testing?API security and web services testing are not mutually exclusive, contrary to popular belief. In actuality, each is a subset of the other: every web service is an API since it exposes the data and/or functionality of an application, but not every API is a web service. This is due to the fact that the definition of a web service is fairly limited in terms of implementation:

1. Web services necessitate the use of a network. Web services, unlike APIs, must be connected to the internet.
2. APIs are protocol-independent. Web services often utilize SOAP, although APIs can use any protocol or design style (but sometimes REST, UDDI, and XML-RPC). What should you look for?Web security tests can be performed on any web application (both web services and interactive websites) regardless of its underlying technology stack or platform. The following are some key areas that need special attention when performing a web app penetration testing:

1. Authentication – Ensure all user input is validated before submitting it; make sure your sessions aren’t left open after authentication has taken place, check what happens to the password while entering it in the form, etc…(e.g.: SHA hashes). Also, ensure that passwords are stored properly so they cannot be accessed by malicious users if their database gets compromised. storage mechanisms have been well documented over the web.
2. Cross-Site Request Forgery – This web vulnerability is a result of poorly implemented user input validation where the application doesn’t verify whether or not it’s actually being requested from within its own domain/endpoint. An attacker can use this to trick users into clicking links that perform certain actions on their behalf while they are logged in (e.[...]

Kali Linux Tutorials
The Definitive Guide to Web Security Testing: Vulnerabilities and Password Management

Many web developers often neglect web security testing. However, it is a crucial part of the web development process because web security testing can identify vulnerabilities that may be missed during other stages. Once these web security holes are identified, they can be patched up and avoided from being exploited by hackers. In this guide, we will cover what web security testing is and its vulnerabilities as well as password management strategies to help keep your website secure. What are the types of web security testing?Web security testing includes different types of approaches such as:

* Vulnerability Scanning
* Security Scanning
* Penetration Testing
* Security Audit/ Review
* Ethical Hacking
* Risk Assessment
* Authentication. What is the difference between Web Security and SaaS security testing?Web Security Testing is a subset of software testing that focuses on finding risks, threats, and vulnerabilities in web applications. Security testing analyses all the dangers a web application confronts by testing on many tiers spanning the database, network, infrastructure, and access points such as mobile. The platform, network, apps, operating system, and physical infrastructure are all under the control of the SaaS provider. Several sorts of security solutions can assist businesses in enhancing SaaS security. Individually or as part of a CASB, the solutions can be deployed. How to find vulnerabilities in your website?Think like a web hacker and treat your web application as if it were someone else’s. Try to find vulnerabilities by crawling through your website with an automated tool or manually checking for web security flaws (i.e., input validation errors, session management issues, XSS holes). Once you’ve identified these web security weaknesses in your code, fix them before they get exploited! Best practices for password management and how to protect against phishing attacks and malware:The best web security password management strategy is to use a random, long alphanumeric string for each website you have an account with. It’s critical that you use the same password on every website. This will make it more difficult for hackers to figure out your online passwords if they’ve been hacked!

To avoid malware phishing attacks on any device, always be careful of what websites or web apps you download onto your computer or mobile phone. Phishers often send out emails that appear as though they were sent from someone trustworthy asking the recipient to login into their bank account (for example) but are actually sending them to a fake replica site where all their web data will likely get stolen by malicious actors! Even worse, some web browsers can infect devices with malware when users visit certain websites so it’s very important to be cautious! How do I protect myself from phishing attacks on any device?The best web security password management strategy is to use a random, long alphanumeric string for each website you have an account with. This will make it difficult for hackers to guess your web passwords if they are compromised! To avoid phishing attacks and malware infection on any device, always be careful of what websites or web apps you download onto your computer or mobile phone. Phishers often send out emails that appear as though they were sent from someone trustworthy asking the recipient to login into their bank account (for example) but are actually sending them to a fake replica site where all their web data will likely get stolen by malicious actors! Even worse, some web browsers can infect devices with malware when users visit certain websites so it’s very important to be cautious! Conclusion:Web securi[...]

g.: transfer money, change profile settings, etc…). Some examples of OWASP TOP web vulnerabilities include: CSRF and XSS Attacks
3. Injection Flaws – These types of web security tests happen when an application sends unfiltered user input straight into another system without validating what’s going on which could lead to code execution, escalation and more depending on how the web application was designed. For example, SQL injection happens when an attacker sends unfiltered user input to a web application’s database layer, which allows them to retrieve the information they should not have access to or even change existing records.
4. Logic Flaws – These web security tests are usually the result of poor programming practices that allow attackers to bypass authentication systems, escalate privileges within the website itself, etc… Some examples include hidden fields in forms (e.g.: session IDs) and exposed back-end data/code via public-facing error messages containing critical details about how certain parts of the web page work. Conclusion:In order to be a successful business today, your website must not only function properly and look good but also protect you from online threats. Web security testing is the process of identifying vulnerabilities in websites that attackers might exploit for their own purposes – such as stealing data or installing malicious software on your site without detection. Hiring experts who can identify and fix these issues will save you time and money down the line by keeping hackers out of your system.

ty testing is the process of identifying vulnerabilities in your website, including phishing attacks and malware. To protect against these threats, you should consider password policies that are more stringent than default settings. You can also use two-step verification or multi-factor authentication to further secure access to your site.

The best way to find vulnerabilities before they happen is with a web vulnerability scan. This will help identify any potential weaknesses so you can take steps ahead of time to mitigate them from causing major damage later on down the line. These services are essential for businesses targeting customers online who may be using outdated browsers or operating systems which could put their data at risk if not protected properly by up-to-date software patches and antivirus programs installed on.

Hacking on Medium
TryHackMe: Tutorial de BurpSuite

Review de los ejercicios que aparecen en la room de BurpSuite de TryHackMe.

Continue reading on Medium »

Hacking on Medium
CloudCover’s “Solution Differentiators” Part Two:  The Importance of Risk Awareness

https://cdn-images-1.medium.com/max/2422/1*CY3zGLSy9mATxuALowZ4Nw.png
Blog Summary: Now that we’ve introduced you to our tenets and technology, we’re going to take a deep dive into another one of our…

Continue reading on Medium »

Hacking on Medium
Anatolia CTF Machine

https://cdn-images-1.medium.com/max/1440/1*HVYx_AHgS03VvtgyXT8FSA.png
This box is designed to get players hacking the machine of a malazgirt chat program reverse engineer.It aimed to break the server and…

Continue reading on Medium »

Hacking on Medium
Kubernetes Network Policy or Blocking External Traffic will Slightly Reduce log4j Attack, not…

https://cdn-images-1.medium.com/max/2600/1*I9JhYb4nvzLJPzZHW7OFMA.jpeg
blocking external egress from your applications is not only unrealistic for many but also doesn’t mitigate (avoid) the issue… only slightly

Continue reading on Martino Jones »

Hacking on Medium
Gaining access to a network with Office macros — Pentesting and red teaming

https://cdn-images-1.medium.com/max/600/1*Lr5-lwsVOBC1On3qgYyw-Q.gif
Explaining the usage of malicious Office macros to gain access to a target’s network as a red teamer.

Continue reading on Medium »

Hacking on Medium
Chrome should be updated to patch a new zero-day vulnerability that has been discovered recently

https://cdn-images-1.medium.com/max/900/1*qLSc9XzbvHLmyej9_8hfPw.jpeg
Google has released patches for five security flaws in its Chrome web browser, including one that it claims is being exploited in the…

Continue reading on Medium »