Hello hunters,Continue reading on Medium » (https://janmuhammadzaidi.medium.com/how-i-was-able-to-bypass-waf-and-find-the-origin-ip-and-a-few-sensitive-files-fc445180adb7?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How To Hack Any Website [ Part — 1]
https://cdn-images-1.medium.com/max/1200/1*1VZVZIMCmTw0QUVA0Y_uYA.jpeg
As a hacker, your role when reviewing a website or web application is to discover features that could potentially be vulnerable and…
Continue reading on Medium »
How To Hack Any Website [ Part — 1]
https://cdn-images-1.medium.com/max/1200/1*1VZVZIMCmTw0QUVA0Y_uYA.jpeg
As a hacker, your role when reviewing a website or web application is to discover features that could potentially be vulnerable and…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
TryHackMe: Mustacchio -Writeup
https://cdn-images-1.medium.com/max/677/1*Tl6KUMWAryefU5wjC_maIw.jpeg
Today, Here I come bring another Challenge Walkthrough of “Mustacchio” created by zyeinn. It’s a boot2root Machine.
Level: Easy
Continue reading on Medium »
TryHackMe: Mustacchio -Writeup
https://cdn-images-1.medium.com/max/677/1*Tl6KUMWAryefU5wjC_maIw.jpeg
Today, Here I come bring another Challenge Walkthrough of “Mustacchio” created by zyeinn. It’s a boot2root Machine.
Level: Easy
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Implementing Application Security on your project
https://cdn-images-1.medium.com/max/600/1*xUZ09zQTcuIV01upg6Pl9A.png
The main purpose: Security should help businesses succeed.
Continue reading on Medium »
Implementing Application Security on your project
https://cdn-images-1.medium.com/max/600/1*xUZ09zQTcuIV01upg6Pl9A.png
The main purpose: Security should help businesses succeed.
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How “assertions” can get you Hacked !!
https://cdn-images-1.medium.com/max/2600/1*CKt7fp9beN0DiVghBVrlfw.jpeg
A deep dive into the assert() function and ways to exploit it!
Continue reading on InfoSec Write-ups »
How “assertions” can get you Hacked !!
https://cdn-images-1.medium.com/max/2600/1*CKt7fp9beN0DiVghBVrlfw.jpeg
A deep dive into the assert() function and ways to exploit it!
Continue reading on InfoSec Write-ups »
Pentest a payments gateway
https://www.reddit.com/r/Pentesting/comments/rm3vek/pentest_a_payments_gateway/
<!-- SC_OFF -->Hi all, I work in a fairly new startup so we do not have much employees, hence being the only Devops/Cloud guy, my boss has asked me to pentest our payment gateway page and give him a report. I am interested in pentesting and have done some ctfs before and played around with Burpsuit and wireshark and Nmap but that's it. Any help as to how I can start with it, i.e pentesting that payment page? Thanks! <!-- SC_ON --> submitted by /u/blank1993 (https://www.reddit.com/user/blank1993)
[link] (https://www.reddit.com/r/Pentesting/comments/rm3vek/pentest_a_payments_gateway/) [comments] (https://www.reddit.com/r/Pentesting/comments/rm3vek/pentest_a_payments_gateway/)
https://www.reddit.com/r/Pentesting/comments/rm3vek/pentest_a_payments_gateway/
<!-- SC_OFF -->Hi all, I work in a fairly new startup so we do not have much employees, hence being the only Devops/Cloud guy, my boss has asked me to pentest our payment gateway page and give him a report. I am interested in pentesting and have done some ctfs before and played around with Burpsuit and wireshark and Nmap but that's it. Any help as to how I can start with it, i.e pentesting that payment page? Thanks! <!-- SC_ON --> submitted by /u/blank1993 (https://www.reddit.com/user/blank1993)
[link] (https://www.reddit.com/r/Pentesting/comments/rm3vek/pentest_a_payments_gateway/) [comments] (https://www.reddit.com/r/Pentesting/comments/rm3vek/pentest_a_payments_gateway/)
MUI - A GUI Plugin For Binary Ninja To Easily Interact With And View The Progress Of Manticore
http://www.kitploit.com/2021/12/mui-gui-plugin-for-binary-ninja-to.html
http://www.kitploit.com/2021/12/mui-gui-plugin-for-binary-ninja-to.html
With the Manticore (https://www.kitploit.com/search/label/Manticore) User Interface (MUI) project, we provide a graphical user interface plugin for Binary Ninja (https://binary.ninja/) to allow users to easily interact with and view progress of the Manticore (https://github.com/trailofbits/manticore)symbolic execution (https://www.kitploit.com/search/label/Symbolic%20Execution) engine for analysis (https://www.kitploit.com/search/label/Analysis) of smart contracts (https://www.kitploit.com/search/label/Smart%20Contracts) and native binaries.
ATTENTION
This project is under active development and may be unstable or unusable. Please open an issue if you have any difficulties using the existing features. New feature development will be considered on a case by case basis. RequirementsAside from the Python requirements, we require the following:Binary Ninja (latest development version) with GUIgit submodule update --init --recursive for Manticore submoduleInstallationMUI requires a copy of Binary Ninja with a GUI. Currently we are testing against the latest dev release(s) (2.4.2901-dev at time of writing).Manticore only operates on native binaries within a Linux environment. EVM support has only been tested on Mac and Linux, and it requires the installation of ethersplay (https://github.com/crytic/ethersplay).Python dependencies are currently managed using requirements.txt and requirements-dev.txt. You can run make init to set up a development environment.Make the project available to Binary Ninja by creating a symbolic link to the plugins directory. From within the root of this repo, run the following:# For Mac
$ ln -s "$(pwd)/mui" "${HOME}/Library/Application Support/Binary Ninja/plugins/mui"
# For Linux
$ ln -s "$(pwd)/mui" "${HOME}/.binaryninja/plugins/mui"
Make sure Binary Ninja knows about our Python virtual environment.Open Binary Ninja's "Preferences" -> "Settings" -> "Python" and ensure the "Python Interpreter" is correctly set to the Python path associated with the current virtual environment. Reference venv/pyvenv.cfg to find the base path.Copy and paste the absolute path of the MUI project into Binary Ninja's "Python Virtual Environment Site-Packages" and add the required /venv/lib/python3./site-packages suffix for the site-packages path.Restart Binary Ninja if necessary.DevelopmentInstalling currently listed dependencies:$ make init
# For Mac (will be similar for Linux)
$ export PYTHONPATH="/Applications/Binary Ninja.app/Contents/Resources/python:/Applications/Binary Ninja.app/Contents/Resources/python3"
Activating the python virtual environment (do this before running other make commands):$ . venv/bin/activate
Code style and linting can be followed by running the following:$ make format
$ make lint
Tests for code without Binary Ninja interaction can be run if you have a headless version of binary ninja available, otherwise only non-Binary Ninja tests will be run:$ make test
Adding a new dependency can be done by editing requirements.txt or requirements-dev.txt and then running the following in the virtual environment:$ pip install -r requirements-dev.txt -r requirements.txt
Usage (Native)All MUI features can be accessed through either the right-click context menu or the command palette. Common features include:Find Path to This Instruction / Remove Instruction from Find ListAvoid This Instruction / Remove Instruction from Avoid ListAdd/Edit Custom HookSolve With Manticore / Stop ManticoreAnd the following widgets are available:State List WidgetShows all the Active/Waiting/Complete/Errored states during manticore execution. Double-clicking a certain state navigates you to the current instruction of that state and renders its provenance tree in the graph widget.
ATTENTION
This project is under active development and may be unstable or unusable. Please open an issue if you have any difficulties using the existing features. New feature development will be considered on a case by case basis. RequirementsAside from the Python requirements, we require the following:Binary Ninja (latest development version) with GUIgit submodule update --init --recursive for Manticore submoduleInstallationMUI requires a copy of Binary Ninja with a GUI. Currently we are testing against the latest dev release(s) (2.4.2901-dev at time of writing).Manticore only operates on native binaries within a Linux environment. EVM support has only been tested on Mac and Linux, and it requires the installation of ethersplay (https://github.com/crytic/ethersplay).Python dependencies are currently managed using requirements.txt and requirements-dev.txt. You can run make init to set up a development environment.Make the project available to Binary Ninja by creating a symbolic link to the plugins directory. From within the root of this repo, run the following:# For Mac
$ ln -s "$(pwd)/mui" "${HOME}/Library/Application Support/Binary Ninja/plugins/mui"
# For Linux
$ ln -s "$(pwd)/mui" "${HOME}/.binaryninja/plugins/mui"
Make sure Binary Ninja knows about our Python virtual environment.Open Binary Ninja's "Preferences" -> "Settings" -> "Python" and ensure the "Python Interpreter" is correctly set to the Python path associated with the current virtual environment. Reference venv/pyvenv.cfg to find the base path.Copy and paste the absolute path of the MUI project into Binary Ninja's "Python Virtual Environment Site-Packages" and add the required /venv/lib/python3./site-packages suffix for the site-packages path.Restart Binary Ninja if necessary.DevelopmentInstalling currently listed dependencies:$ make init
# For Mac (will be similar for Linux)
$ export PYTHONPATH="/Applications/Binary Ninja.app/Contents/Resources/python:/Applications/Binary Ninja.app/Contents/Resources/python3"
Activating the python virtual environment (do this before running other make commands):$ . venv/bin/activate
Code style and linting can be followed by running the following:$ make format
$ make lint
Tests for code without Binary Ninja interaction can be run if you have a headless version of binary ninja available, otherwise only non-Binary Ninja tests will be run:$ make test
Adding a new dependency can be done by editing requirements.txt or requirements-dev.txt and then running the following in the virtual environment:$ pip install -r requirements-dev.txt -r requirements.txt
Usage (Native)All MUI features can be accessed through either the right-click context menu or the command palette. Common features include:Find Path to This Instruction / Remove Instruction from Find ListAvoid This Instruction / Remove Instruction from Avoid ListAdd/Edit Custom HookSolve With Manticore / Stop ManticoreAnd the following widgets are available:State List WidgetShows all the Active/Waiting/Complete/Errored states during manticore execution. Double-clicking a certain state navigates you to the current instruction of that state and renders its provenance tree in the graph widget.
State Graph WidgetShows the provenance tree for a certain state selected in the list widget. Tab can be used to expand/collapse the graph and double-clicking any of the state nodes navigates you to the current instruction of that state.
Run DialogThe run dialog is shown when you invoke the Solve with Manticore command. It allows you to configure the various manticore options, and the changes will be saved to the bndb file. Some example configs include using a combination of LD_PRELOAD and LD_LIBRARY_PATH environment variables to run the binary with custom glibc.
Custom Hook DialogThe custom hook dialog can be accessed using the Add/Edit Custom Hook command. It allows you to define a custom manticore hook at the selected address. You also have full access to the Binary Ninja API which allows you to add highlighting, comments, and more. A defined hook can be removed by setting the code input field to blank.