Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Abaddon : Make red team operations faster, more repeatable, stealthier, while including value-added tools and bringing numerous reporting capabilities Abaddon is a Red team operations involve miscellaneous skills, last several months…
o the URL 127.0.0.1:8000 (connect with the Django superuser credentials created during the installation). Deployment Of A C&C Infrastructure Inside Abaddon
* If no EC2 instance has been deployed before from Abaddon (it is important that you deploy the EC2 from Abaddon, so that you have access to the SSH key, located in the aws folder), go to the Delivery/Let’s phish! page. Click on Deploy EC2!. Wait for the end of the deployment (you can check inside the terminal used to start Abaddon if the EC2 is ready to be used, all the deployment steps appear in the shell).
* Go to the misc/apache/default-ssl.conf file and UPDATE the domain name of the EC2 inside the second VirtualHost. To avoid the detection of your infrastructure, buy a new domain name and configure it to point to your EC2. Use this domain name in the Apache configuration file and UPDATE misc/apache/topsecret.key and misc/apache/topsecret.crt accordingly, which is with the private key and the certificate of your new domain.
* Go then to the Monitor current Scenarios page and click on Configure a RedELK infrastructure. Give this scenario a name. Abaddon supports actually only one scenario at the time. Choose an EC2 instance deployed from your Abaddon and choose Local Deployment (because you deploy your Apache docker locally). Then, choose the ports used by the deployed EC2 to receive the HTTP and SSL connections, and the port and the IP address the Apache reverse proxy will forward the traffic to (for instance, the IP and port your SILENTTRINITY server listens to). A common configuration would be the following:
*
___________________________
@hacking_Attack
@Hacking_Video
* If no EC2 instance has been deployed before from Abaddon (it is important that you deploy the EC2 from Abaddon, so that you have access to the SSH key, located in the aws folder), go to the Delivery/Let’s phish! page. Click on Deploy EC2!. Wait for the end of the deployment (you can check inside the terminal used to start Abaddon if the EC2 is ready to be used, all the deployment steps appear in the shell).
* Go to the misc/apache/default-ssl.conf file and UPDATE the domain name of the EC2 inside the second VirtualHost. To avoid the detection of your infrastructure, buy a new domain name and configure it to point to your EC2. Use this domain name in the Apache configuration file and UPDATE misc/apache/topsecret.key and misc/apache/topsecret.crt accordingly, which is with the private key and the certificate of your new domain.
* Go then to the Monitor current Scenarios page and click on Configure a RedELK infrastructure. Give this scenario a name. Abaddon supports actually only one scenario at the time. Choose an EC2 instance deployed from your Abaddon and choose Local Deployment (because you deploy your Apache docker locally). Then, choose the ports used by the deployed EC2 to receive the HTTP and SSL connections, and the port and the IP address the Apache reverse proxy will forward the traffic to (for instance, the IP and port your SILENTTRINITY server listens to). A common configuration would be the following:
*
http port = 80ssl port = 443Listening Port= 9999C2 IP adress = 172.16.0.1* Wait for the end of the deployment and go back to the Monitor current Scenarios page. Download___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
AzureHunter : A Cloud Forensics Powershell Module To Run Threat Hunting Playbooks On Data From Azure And O365
AzureHunter is a Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes
Getting Started
Check that you have the right O365 Permissions
The following roles are required in Exchange Online, in order to be able to have read only access to the UnifiedAuditLog:
These roles are assigned by default to the
NOTE: if you are a security analyst, incident responder or threat hunter and your organization is NOT giving you read-only access to these audit logs, you need to seriously question what their detection and response strategy is!
More information:
* How to search the Audit Log using the GUI
* Manage role groups in Exchange Online
* How to enable the UnifiedAuditLog
NOTE: your admin can verify these requirements by running
Ensure ExchangeOnlineManagement v2 PowerShell Module is installed
Please make sure you have ExchangeOnlineManagement (EXOv2) installed. You can find instructions on the web or go directly to my little KB on how to do it at the soc analyst scrolls
Either Clone the Repo or Install AzureHunter from the PSGallery
Cloning the Repo
1. Clone this repository
2. Import the module
All you need to do is:
Install-Module AzureHunter -Scope CurrentUser
Import-Module AzureHunter
What Is The UnifiedAuditLog?
The unified audit log contains user, group, application, domain, and directory activities performed in the Microsoft 365 admin center or in the Azure management portal. For a complete list of Azure AD events, see the list of RecordTypes.
The UnifiedAuditLog is a great source of cloud forensic information since it contains a wealth of data on multiple types of cloud operations like ExchangeItems, SharePoint, Azure AD, OneDrive, Data Governance, Data Loss Prevention, Windows Defender Alerts and Quarantine events, Threat intelligence events in Microsoft Defender for Office 365 and the list goes on and on! AzureHunter Data Consistency Checks
AzureHunter implements some useful logic to ensure that the highest log density is mined and exported from Azure & O365 Audit Logs. In order to do this, we run two different operations for each cycle (batch):
1. Automatic Window Time Reduction: this check ensures that the time interval is reduced to the optimal interval based on the ResultSizeUpperThreshold parameter which by default is 20k. This means, if the amounts of logs returned within your designated TimeInterval is higher than ResultSizeUpperThreshold, then an automatic adjustment will take place.
2. Sequential Data Check: are returned Record Indexes sequentially valid?
https://blogger.googleusercontent.com/img/a/AVvXsEj-qFED47rqcQy9G5lyRJx3zw5dIQSYotrXkwf0vx7KajGWpcnPuG_q4wPHG4VLnVodFK0s7Pb4AwqPUbDY2HgkwtWevXLbj93utu1PACxFmFqL4Z48Ztf_G5eHC4a8AVQVb2irxZrJcYQ2Q9P5Bsp7utRs1hnSdggonC9aECVzFnYlaaq1jLO81fqL=s2640
Usage Ensure you connect to ExchangeOnline
It’s recommended that you run
AzureHunter has two main commands:
The purpose of
___________________________
@hacking_Attack
@Hacking_Video
AzureHunter : A Cloud Forensics Powershell Module To Run Threat Hunting Playbooks On Data From Azure And O365
AzureHunter is a Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes
Getting Started
Check that you have the right O365 Permissions
The following roles are required in Exchange Online, in order to be able to have read only access to the UnifiedAuditLog:
View-Only Audit Logsor Audit Logs.These roles are assigned by default to the
Compliance Managementrole group in Exchange Admin Center.NOTE: if you are a security analyst, incident responder or threat hunter and your organization is NOT giving you read-only access to these audit logs, you need to seriously question what their detection and response strategy is!
More information:
* How to search the Audit Log using the GUI
* Manage role groups in Exchange Online
* How to enable the UnifiedAuditLog
NOTE: your admin can verify these requirements by running
Get-ManagementRoleEntry "*\Search-UnifiedAuditLog"in your Azure tenancy cloud shell or local powershell instance connected to Azure.Ensure ExchangeOnlineManagement v2 PowerShell Module is installed
Please make sure you have ExchangeOnlineManagement (EXOv2) installed. You can find instructions on the web or go directly to my little KB on how to do it at the soc analyst scrolls
Either Clone the Repo or Install AzureHunter from the PSGallery
Cloning the Repo
1. Clone this repository
2. Import the module
Import-Module .\source\AzureHunter.psd1Install AzureHunter from the PSGalleryAll you need to do is:
Install-Module AzureHunter -Scope CurrentUser
Import-Module AzureHunter
What Is The UnifiedAuditLog?
The unified audit log contains user, group, application, domain, and directory activities performed in the Microsoft 365 admin center or in the Azure management portal. For a complete list of Azure AD events, see the list of RecordTypes.
The UnifiedAuditLog is a great source of cloud forensic information since it contains a wealth of data on multiple types of cloud operations like ExchangeItems, SharePoint, Azure AD, OneDrive, Data Governance, Data Loss Prevention, Windows Defender Alerts and Quarantine events, Threat intelligence events in Microsoft Defender for Office 365 and the list goes on and on! AzureHunter Data Consistency Checks
AzureHunter implements some useful logic to ensure that the highest log density is mined and exported from Azure & O365 Audit Logs. In order to do this, we run two different operations for each cycle (batch):
1. Automatic Window Time Reduction: this check ensures that the time interval is reduced to the optimal interval based on the ResultSizeUpperThreshold parameter which by default is 20k. This means, if the amounts of logs returned within your designated TimeInterval is higher than ResultSizeUpperThreshold, then an automatic adjustment will take place.
2. Sequential Data Check: are returned Record Indexes sequentially valid?
https://blogger.googleusercontent.com/img/a/AVvXsEj-qFED47rqcQy9G5lyRJx3zw5dIQSYotrXkwf0vx7KajGWpcnPuG_q4wPHG4VLnVodFK0s7Pb4AwqPUbDY2HgkwtWevXLbj93utu1PACxFmFqL4Z48Ztf_G5eHC4a8AVQVb2irxZrJcYQ2Q9P5Bsp7utRs1hnSdggonC9aECVzFnYlaaq1jLO81fqL=s2640
Usage Ensure you connect to ExchangeOnline
It’s recommended that you run
Connect-ExchangeOnlinebefore running any AzureHuntercommands. The program checks for an active remote session and attempts to connect but some versions of Powershell don’t allow this and you need to do it yourself regardless. Run AzureHunterAzureHunter has two main commands:
Search-AzureCloudUnifiedLogand Invoke-AzHunterPlaybook.The purpose of
Search-AzureCloudUnifiedLogis to implement a complex logic[...]___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
AzureHunter : A Cloud Forensics Powershell Module To Run Threat
AzureHunter is a Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes.
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Canadian Furious Beaver : A Tool For Monitoring IRP Handler In Windows Drivers, And Facilitating The Process Of Analyzing, Replaying And Fuzzing Windows Drivers For Vulnerabilities Canadian Furious Beaver is a distributed tool for capturing…
this data in user-land waiting for a event to ask for them. Build GUI
Clone the repository, and build the
Clone the repository and in a VS prompt run
C:\cfb> msbuild CFB.sln /p:Configuration=$Conf
Where
A Windows 7+ machine (Windows 10 SDK VM is recommended)
On this target machine, simply enable BCD test signing flag (in
C:> bcdedit.exe /set {whatever-profile} testsigning on
If using in Debug mode,
C:> bcdedit.exe /set {whatever-profile} debug on
It is also recommended to edit the KD verbosity level, via:
* the registry for a permanent effect (
* directly from WinDbg for only the current session (
If you plan on (re-)compiling any of the tools, you must install VS (2019 preferred). If using the Release binaries, you only need VS C++ Redist installed (x86 or x64 depending on your VM architecture).
Follow the indications in the
___________________________
@hacking_Attack
@Hacking_Video
Clone the repository, and build the
Brokerin the solution CFB.slnat the project root with Visual Studio (Debug – very verbose – or Release). Additionally, you can build the App GUI by building the GUI (Universal Windows)project. Command lineClone the repository and in a VS prompt run
C:\cfb> msbuild CFB.sln /p:Configuration=$Conf
Where
$Confcan be set to Releaseto Debug. SetupA Windows 7+ machine (Windows 10 SDK VM is recommended)
On this target machine, simply enable BCD test signing flag (in
cmd.exeas Admin):C:> bcdedit.exe /set {whatever-profile} testsigning on
If using in Debug mode,
IrpDumper.syswill provide a lot more valuable information as to what’s being hooked (the price of performance). All those info can be visible via tools like DebugView.exeor a kernel debugger like WinDbg. In either case, you must enable kernel debug BCD flag (in cmd.exeas Admin):C:> bcdedit.exe /set {whatever-profile} debug on
It is also recommended to edit the KD verbosity level, via:
* the registry for a permanent effect (
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter" /v DEFAULT /t REG_DWORD /d 0xf)* directly from WinDbg for only the current session (
ed nt!Kd_Default_Mask 0xf)If you plan on (re-)compiling any of the tools, you must install VS (2019 preferred). If using the Release binaries, you only need VS C++ Redist installed (x86 or x64 depending on your VM architecture).
Follow the indications in the
Docs/folder to improve your setup. Download___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
EXOCET : AV-evading, Undetectable, Payload Delivery Tool
EXOCET is superior to Metasploit’s “Evasive Payloads” modules as EXOCET uses AES-256 in GCM Mode (Galois/Counter Mode). Metasploit’s Evasion Payloads uses a easy to detect RC4 encryption. While RC4 can decrypt faster, AES-256 is much more difficult to ascertain the intent of the malware.
https://blogger.googleusercontent.com/img/a/AVvXsEjr3X_IDfq6Ji0_r-BUagPu9k7MGRfvmAVrTeTKzWF5wWnXtNJLLDFuy9UiOs4pAvlPxW-oNEvvFNc8iXAZq595T7zg4vp-fQE0HE-g0HG2ugesD8GMUopqEoMW8aBqx94QNk92v-uofO4747iRs-HxdUkI82bUmOyrTNwTDA3cMuEcZ4xk7vbmEpSG=s1920
However, it is possible to use Metasploit to build a Evasive Payload, and then chain that with EXOCET. So EXOCET will decrypt via AES-256, and then the Metasploit Evasive Payload then decrypts itself from RC4.
Much like my previous project, DarkLordObama, this toolkit is designed to be a delivery/launch vehicle, much like Veil-Evasion does.
Dark Lord Obama Project
However, EXOCET is not limited to a single codebase or platforms that are running Python. EXOCET works on ALL supported platforms and architectures that Go supports. Exocet Overview
EXOCET, is effectively a crypter-type malware dropper that can recycle easily detectable payloads like WannaCry, encrypt them using AES-GCM (Galois/Counter Mode), which is more secure than AES-CBC, and then create a dropper file for a majority of architectures and platforms out there.
Basically…
1. It ingests dangerous malware that are now detectable by antivirus engines
2. It then encrypts them and produces it’s own Go file
3. Then that Go file can be cross-compiled to 99% of known architectures
4. Upon execution, the encrypted payload is written to the disk and immediately executed on the command line
5. Alternatively, instead of a file-drop, it will execute the reconstitute shellcode in memory using amenzhinsky’s go-memexec module github.com/amenzhinsky/go-memexec
6. A custom shellcode executor is in the works, it takes ordinary C shellcode and after num-transform, it will run it by creating a new process after allocating the correct virtual address space and granting it RWX permissions on Windows
That means 32-bit, and 64-bit architectures, and it works on Linux, Windows, Macs, Unix, Android, iPhone, etc. You take, anything, and I mean ANYTHING, like the 1988 Morris Worm that nearly brought down the internet (which exploited a flaw in the fingerd listener daemon on UNIX), and make it a viable cyberweapon again.
EXOCET is designed to be used with the DSX Program, or the “Cyber Metal Gear” as I envisioned it. Being able to launch and proliferate dangerous malware without a traceable launch trail.
EXOCET is written entirely in Go. How to use
EXOCET, regardless of which binary you use to run it, requires Golang to work. By default, it generates a crypter .go file.
1. Windows users: Install Go Here
2. Linux users: run
5. For Windows and Mac x64 Users, pre-compiled binaries are in the /bin folder To run it
go run EXOCET.go detectablemalware.exe outputmalware.go
A key is automatically generated for you. The key is 64-characters long and is entirely composed of bash and cmd.exe shell pipe redirectors to confuse and disrupt brute-forcing attempts against the key by causing unpredictable, destructive behavior on the forensic analyst’s device.
For 64-bit Windows Targets…
env GOOS=windows GOARCH=amd64 go build -ldflags “-s -w” -o outputMalware.exe outputmalware.go
And out comes a
For 64-bit MacOS Targets
env GOOS=darwin GOARCH=amd64 go build -ldflags “-s -w” -o outputMalware.macho outputmalware.go
[...]
___________________________
@hacking_Attack
@Hacking_Video
EXOCET : AV-evading, Undetectable, Payload Delivery Tool
EXOCET is superior to Metasploit’s “Evasive Payloads” modules as EXOCET uses AES-256 in GCM Mode (Galois/Counter Mode). Metasploit’s Evasion Payloads uses a easy to detect RC4 encryption. While RC4 can decrypt faster, AES-256 is much more difficult to ascertain the intent of the malware.
https://blogger.googleusercontent.com/img/a/AVvXsEjr3X_IDfq6Ji0_r-BUagPu9k7MGRfvmAVrTeTKzWF5wWnXtNJLLDFuy9UiOs4pAvlPxW-oNEvvFNc8iXAZq595T7zg4vp-fQE0HE-g0HG2ugesD8GMUopqEoMW8aBqx94QNk92v-uofO4747iRs-HxdUkI82bUmOyrTNwTDA3cMuEcZ4xk7vbmEpSG=s1920
However, it is possible to use Metasploit to build a Evasive Payload, and then chain that with EXOCET. So EXOCET will decrypt via AES-256, and then the Metasploit Evasive Payload then decrypts itself from RC4.
Much like my previous project, DarkLordObama, this toolkit is designed to be a delivery/launch vehicle, much like Veil-Evasion does.
Dark Lord Obama Project
However, EXOCET is not limited to a single codebase or platforms that are running Python. EXOCET works on ALL supported platforms and architectures that Go supports. Exocet Overview
EXOCET, is effectively a crypter-type malware dropper that can recycle easily detectable payloads like WannaCry, encrypt them using AES-GCM (Galois/Counter Mode), which is more secure than AES-CBC, and then create a dropper file for a majority of architectures and platforms out there.
Basically…
1. It ingests dangerous malware that are now detectable by antivirus engines
2. It then encrypts them and produces it’s own Go file
3. Then that Go file can be cross-compiled to 99% of known architectures
4. Upon execution, the encrypted payload is written to the disk and immediately executed on the command line
5. Alternatively, instead of a file-drop, it will execute the reconstitute shellcode in memory using amenzhinsky’s go-memexec module github.com/amenzhinsky/go-memexec
6. A custom shellcode executor is in the works, it takes ordinary C shellcode and after num-transform, it will run it by creating a new process after allocating the correct virtual address space and granting it RWX permissions on Windows
That means 32-bit, and 64-bit architectures, and it works on Linux, Windows, Macs, Unix, Android, iPhone, etc. You take, anything, and I mean ANYTHING, like the 1988 Morris Worm that nearly brought down the internet (which exploited a flaw in the fingerd listener daemon on UNIX), and make it a viable cyberweapon again.
EXOCET is designed to be used with the DSX Program, or the “Cyber Metal Gear” as I envisioned it. Being able to launch and proliferate dangerous malware without a traceable launch trail.
EXOCET is written entirely in Go. How to use
EXOCET, regardless of which binary you use to run it, requires Golang to work. By default, it generates a crypter .go file.
1. Windows users: Install Go Here
2. Linux users: run
sudo apt-get update && sudo apt-get install -y golang3. You must install the EXOCET source files in golang go get github.com/tanc7/EXOCET-AV-Evasion4. Sub-requirements will also be downloaded and installed5. For Windows and Mac x64 Users, pre-compiled binaries are in the /bin folder To run it
go run EXOCET.go detectablemalware.exe outputmalware.go
A key is automatically generated for you. The key is 64-characters long and is entirely composed of bash and cmd.exe shell pipe redirectors to confuse and disrupt brute-forcing attempts against the key by causing unpredictable, destructive behavior on the forensic analyst’s device.
For 64-bit Windows Targets…
env GOOS=windows GOARCH=amd64 go build -ldflags “-s -w” -o outputMalware.exe outputmalware.go
And out comes a
outputmalware.exefileFor 64-bit MacOS Targets
env GOOS=darwin GOARCH=amd64 go build -ldflags “-s -w” -o outputMalware.macho outputmalware.go
[...]
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
EXOCET : AV-evading, Undetectable, Payload Delivery Tool
EXOCET is superior to Metasploit's "Evasive Payloads" modules as EXOCET uses AES-256 in GCM Mode (Galois/Counter Mode).
Kali Linux Tutorials
Clash : A Rule-Based Tunnel In Go
___________________________
@hacking_Attack
@Hacking_Video
Clash : A Rule-Based Tunnel In Go
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
Clash : A Rule-Based Tunnel In Go !!! Kali Linux Tutorials
Clash is a tool like a rule-based Tunnel In Go. Local HTTP/HTTPS/SOCKS server with authentication supportVMess, Shadowsocks, Trojan.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Cumulus : Web Application Weakness Monitoring, It Would Be Working By Add Just 3 Codelines
Cumulus is a service that helps you monitor and fix security weakness in realtime. The issues will be reported on web dashboard. It’s very simple and powerful.
https://blogger.googleusercontent.com/img/a/AVvXsEigWUCWSjHr8uaxdNbRTa6SltIWHhTYa0MDsgeL1PDhp9SN_iZlpkuwVtoMbYyd-p9ihQ_llWrF0Fw3LVSCZHXzQCdV_IlBL69ENWBQUFO-iiqy3ayhCL7eOLbqGEGID90X8Bpc-2qmmfQMd9yH6gfNAHvJ0TVkwRUfqDDB4P8dmfCWar9r1zFl0mOZ=s1893
Key features
Just install SDK to web front, can be found security weakness on service
* SDK detect weakness from Inner Layer, dynamically (ex_ DOM Event, XHR Request)
* Scanner detect weakness from Out Layer, statically (ex_ Web crawling based analysis)
NameOriginDescriptionXSSSDKWhen user input a xss pattern string, trigger detection of XSSSQLInjectionSDKWhen user input a sqlinjection pattern, trigger detection of SQLInjectionSensitive PayloadSDKWhen requesting with sensitive payload. for example, unencoded raw passwordFile UploadSDKWhen user embed any file worried for system. for example, web shellUnnecessary CommentScannerCode comments are on the served HTML or JSDirectory TraversalScannerDetect directory listing vulnerabilityGuessingScannerDetect sensitive page like adminUnobfuscated CodeScannerDetect unobfuscated vulnerable codes
If you think about able to detect additional weakness, please contribute on SDK or Scanner
Cumulus SDK for JavaScript
The official Cumulus SDK for JavaScript, providing as npm
Note: current version is unsupported version on typescript project but we considering now and gonna make it, quickly! (#2)
Installation
To install a SDK, simply add package like belows:
npm install –save https://github.com/tophat-cloud/cumulus
yarn add https://github.com/tophat-cloud/cumulus
Setup and usage of SDK always follow the same principle.
import { protect, captureMessage } from ‘cumulus’;
protect({
key: ‘key’,
});
captureMessage(‘Hello, world!’);
If you haven’t
Download
___________________________
@hacking_Attack
@Hacking_Video
Cumulus : Web Application Weakness Monitoring, It Would Be Working By Add Just 3 Codelines
Cumulus is a service that helps you monitor and fix security weakness in realtime. The issues will be reported on web dashboard. It’s very simple and powerful.
https://blogger.googleusercontent.com/img/a/AVvXsEigWUCWSjHr8uaxdNbRTa6SltIWHhTYa0MDsgeL1PDhp9SN_iZlpkuwVtoMbYyd-p9ihQ_llWrF0Fw3LVSCZHXzQCdV_IlBL69ENWBQUFO-iiqy3ayhCL7eOLbqGEGID90X8Bpc-2qmmfQMd9yH6gfNAHvJ0TVkwRUfqDDB4P8dmfCWar9r1zFl0mOZ=s1893
Key features
Just install SDK to web front, can be found security weakness on service
* SDK detect weakness from Inner Layer, dynamically (ex_ DOM Event, XHR Request)
* Scanner detect weakness from Out Layer, statically (ex_ Web crawling based analysis)
NameOriginDescriptionXSSSDKWhen user input a xss pattern string, trigger detection of XSSSQLInjectionSDKWhen user input a sqlinjection pattern, trigger detection of SQLInjectionSensitive PayloadSDKWhen requesting with sensitive payload. for example, unencoded raw passwordFile UploadSDKWhen user embed any file worried for system. for example, web shellUnnecessary CommentScannerCode comments are on the served HTML or JSDirectory TraversalScannerDetect directory listing vulnerabilityGuessingScannerDetect sensitive page like adminUnobfuscated CodeScannerDetect unobfuscated vulnerable codes
If you think about able to detect additional weakness, please contribute on SDK or Scanner
Cumulus SDK for JavaScript
The official Cumulus SDK for JavaScript, providing as npm
Note: current version is unsupported version on typescript project but we considering now and gonna make it, quickly! (#2)
Installation
To install a SDK, simply add package like belows:
npm install –save https://github.com/tophat-cloud/cumulus
yarn add https://github.com/tophat-cloud/cumulus
Setup and usage of SDK always follow the same principle.
import { protect, captureMessage } from ‘cumulus’;
protect({
key: ‘key’,
});
captureMessage(‘Hello, world!’);
If you haven’t
__key__, please sign-up and create project to get to keyDownload
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
Cumulus : Web Application Weakness Monitoring, It Would Be Working
Cumulus is a service that helps you monitor and fix security weakness in realtime. The issues will be reported on web dashboard.
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials AzureHunter : A Cloud Forensics Powershell Module To Run Threat Hunting Playbooks On Data From Azure And O365 AzureHunter is a Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes…
to ensure that the highest percentage of UnifiedAuditLog records are mined from Azure. By default, it will export extracted and deduplicated records to a CSV file.
The purpose of
When running
Finally
Search-AzureCloudUnifiedLog -StartDate “2020-03-06T10:00:00” -EndDate “2020-06-09T12:40:00” -TimeInterval 12 -AggregatedResultsFlushSize 5000 -Verbose
This command will:
* Search data between the dates in StartDate and EndDate
* Implement a window of 12 hours between these dates, which will be used to sweep the entire length of the time interval (StartDate –> EndDate). This window will be automatically reduced and adjusted to provide the maximum amount of records within the window, thus ensuring higher quality of output. The time window slides sequentially until reaching the EndDate.
* The
We assume that you have exported UnifiedAuditLog records to a CSV file, if so you can then do:
$RecordArray = Import-Csv .\my-exported-records.csv
Invoke-AzHunterPlaybook -Records $RecordArray -Playbooks ‘AzHunter.Playbook.UAL.LogonAnalyser’
You can run more than one playbook by separating them via commas, they will run sequentially:
$RecordArray = Import-Csv .\my-exported-records.csv
Invoke-AzHunterPlaybook -Records $RecordArray -Playbooks ‘AzHunter.Playbook.UAL.Exporter’, ‘AzHunter.Playbook.UAL.LogonAnalyser’
Example 3 | Run Hunting Playbook to produce a clean eDiscovery Summary Report
We assume that you have exported an eDiscovery Summary Report to a CSV file, if so you can then do:
$eDiscoReportFile = .\eDisco-Summary-Report-PersonOfInterest.csv
Invoke-AzHunterPlaybook -Records $eDiscoReportFile -Playbooks ‘AzHunter.Playbook.eDisco.SummaryReportCleaner’
Optionally we can pass some parameters to the playbook like so:
$eDiscoReportFile = .\eDisco-Summary-Report-PersonOfInterest.csv
Invoke-AzHunterPlaybook -Records $eDiscoReportFile -Playbooks ‘AzHunter.Playbook.eDisco.SummaryReportCleaner’ -PlayBookParameters @{“CsvRecordsBatchSize” = 700}
The paramenter “CsvRecordsBatchSize” will tell the playbook to flush records to disk in batches of 700 records. Why?
Since the aftermath of the SolarWinds Supply Chain Compromise many tools have emerged out of deep forges of cyberforensicators, carefully developed by cyber blacksmith ninj[...]
___________________________
@hacking_Attack
@Hacking_Video
The purpose of
Invoke-AzHunterPlaybookis to provide a flexible interface into hunting playbooks stored in the playbooksfolder. These playbooks are designed so that anyone can contribute with their own analytics and ideas. So far, only two very simple playbooks have been developed: AzHunter.Playbook.Exporterand AzHunter.Playbook.LogonAnalyser. The Exportertakes care of exporting records after applying de-duplication and sorting operations to the data. The LogonAnalyseris in beta mode and extracts events where the Operationsproperty is UserLoggedIn. It is an example of what can be done with the playbooks and how easy it is to construct one.When running
Search-AzureCloudUnifiedLog, you can pass in a list of playbooks to run per log batch. Search-AzureCloudUnifiedLogwill pass on the batch to the playbooks via Invoke-AzHunterPlaybook.Finally
Invoke-AzHunterPlaybookcan, be used standalone. If you have an export of UnifiedAuditLog records, you can load them into a Powershell Array and pass them on to this command and specify the relevant playbooks. Example 1 | Run search on Azure UnifiedAuditLog and extract records to CSV file (default behaviour)Search-AzureCloudUnifiedLog -StartDate “2020-03-06T10:00:00” -EndDate “2020-06-09T12:40:00” -TimeInterval 12 -AggregatedResultsFlushSize 5000 -Verbose
This command will:
* Search data between the dates in StartDate and EndDate
* Implement a window of 12 hours between these dates, which will be used to sweep the entire length of the time interval (StartDate –> EndDate). This window will be automatically reduced and adjusted to provide the maximum amount of records within the window, thus ensuring higher quality of output. The time window slides sequentially until reaching the EndDate.
* The
AggregatedResultsFlushSizeparameter speficies the batches of records that will be processed by downstream playbooks. We are telling AzureHunter here to process the batch of records once the total amount reaches 5000. This way, you can get results on the fly, without having to wait for hours until a huge span of records is exported to CSV files. Example 2 | Run Hunting Playbooks on CSV FileWe assume that you have exported UnifiedAuditLog records to a CSV file, if so you can then do:
$RecordArray = Import-Csv .\my-exported-records.csv
Invoke-AzHunterPlaybook -Records $RecordArray -Playbooks ‘AzHunter.Playbook.UAL.LogonAnalyser’
You can run more than one playbook by separating them via commas, they will run sequentially:
$RecordArray = Import-Csv .\my-exported-records.csv
Invoke-AzHunterPlaybook -Records $RecordArray -Playbooks ‘AzHunter.Playbook.UAL.Exporter’, ‘AzHunter.Playbook.UAL.LogonAnalyser’
Example 3 | Run Hunting Playbook to produce a clean eDiscovery Summary Report
We assume that you have exported an eDiscovery Summary Report to a CSV file, if so you can then do:
$eDiscoReportFile = .\eDisco-Summary-Report-PersonOfInterest.csv
Invoke-AzHunterPlaybook -Records $eDiscoReportFile -Playbooks ‘AzHunter.Playbook.eDisco.SummaryReportCleaner’
Optionally we can pass some parameters to the playbook like so:
$eDiscoReportFile = .\eDisco-Summary-Report-PersonOfInterest.csv
Invoke-AzHunterPlaybook -Records $eDiscoReportFile -Playbooks ‘AzHunter.Playbook.eDisco.SummaryReportCleaner’ -PlayBookParameters @{“CsvRecordsBatchSize” = 700}
The paramenter “CsvRecordsBatchSize” will tell the playbook to flush records to disk in batches of 700 records. Why?
Since the aftermath of the SolarWinds Supply Chain Compromise many tools have emerged out of deep forges of cyberforensicators, carefully developed by cyber blacksmith ninj[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Discord Tweak for Invisible Typing
https://cdn-images-1.medium.com/max/1200/1*rPeGWZtaDnE0qR-EbhZc5w.png
New Invisible Typing Discord Tweak for Jailbreaks
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Discord Tweak for Invisible Typing
https://cdn-images-1.medium.com/max/1200/1*rPeGWZtaDnE0qR-EbhZc5w.png
New Invisible Typing Discord Tweak for Jailbreaks
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Discord Tweak for Invisible Typing
New Invisible Typing Discord Tweak for Jailbreaks
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Common Nginx Misconfiguration leads to Path Traversal
https://cdn-images-1.medium.com/max/2600/0*eA1ZnHCtDmUPuMMA
Recently, I have been invited by my friend to participate into a private pentest project. The target has been using Nginx as its Reverse…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Common Nginx Misconfiguration leads to Path Traversal
https://cdn-images-1.medium.com/max/2600/0*eA1ZnHCtDmUPuMMA
Recently, I have been invited by my friend to participate into a private pentest project. The target has been using Nginx as its Reverse…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Common Nginx Misconfiguration leads to Path Traversal
Recently, I have been invited by my friend to participate into a private pentest project. The target has been using Nginx as its Reverse…
hacking: security in practice
Crossposted from r/HowtoHack, any advice here?
submitted by /u/N1tingale
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Crossposted from r/HowtoHack, any advice here?
submitted by /u/N1tingale
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Crossposted from r/HowtoHack, any advice here?
Posted in r/hacking by u/N1tingale • 1 point and 0 comments
snovvcrash/NimHollow: Nim implementation of Process Hollowing using syscalls (PoC)
https://www.reddit.com/r/redteamsec/comments/rpj4fn/snovvcrashnimhollow_nim_implementation_of_process/
submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://github.com/snovvcrash/NimHollow) [comments] (https://www.reddit.com/r/redteamsec/comments/rpj4fn/snovvcrashnimhollow_nim_implementation_of_process/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/redteamsec/comments/rpj4fn/snovvcrashnimhollow_nim_implementation_of_process/
submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://github.com/snovvcrash/NimHollow) [comments] (https://www.reddit.com/r/redteamsec/comments/rpj4fn/snovvcrashnimhollow_nim_implementation_of_process/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
snovvcrash/NimHollow: Nim implementation of Process Hollowing...
Posted in r/redteamsec by u/dmchell • 5 points and 0 comments