https://a.thumbs.redditmedia.com/R9H6rGDuvvli4CMXZKiTzn37QunIs30PDCMsTLzLd68.jpg submitted by /u/apocryphon--
[link] [comments]

AlphaGolang - IDApython Scripts For Analyzing Golang Binaries
http://www.kitploit.com/2022/01/alphagolang-idapython-scripts-for.html

___________________________
@hacking_Attack
@Hacking_Video

AlphaGolang is a collection of IDAPython scripts to help malware reverse engineers master Go binaries. The idea is to break the scripts into concrete steps, thus avoiding brittle monolithic scripts, and mimicking the methodology an analyst might follow when tackling a Go binary. Scripts are released under GPL license (honoring Tim Strazzere's original GolangLoaderAssist which we refactored and updated for python3, props to Tim :) ). Contributions are welcome and encouraged! Requirements: IDA Pro (ideally v7.6+) and Python3 (ew) The first two steps (recreate_pclntab and function_discovery_and_renaming) will work on IDA v7.5- but scripts beyond that require IDAv7.6+. Newer versions are the ideal target for newer scripts going forward. Original Reference: Mandiant Cyber Defense Summit 2021 talk (Video Pending)
AlphaGolang Analysis (https://www.kitploit.com/search/label/Analysis) Methodology Step 0: YARA rule to identify Go binaries (PE/ELF/MachO) identify_go_binaries.yara Simple header check + regex for Go build ID string. Could probably improve the build ID length range. Step 1: Recreate pcln table

___________________________
@hacking_Attack
@Hacking_Video

recreate_pclntab.py (IDA v7.5- compatible) Recreates the gopclntab section from heuristics Mostly useful for IDA v7.5- Step 2: Discover functions by walking pcln table and add names to all

___________________________
@hacking_Attack
@Hacking_Video

function_renaming.py (IDA v7.5- compatible) Split from golang loader assist Bruteforces discovery (https://www.kitploit.com/search/label/Discovery) of missing functions based on the pcln table Fixed some function name cleaning issues from the py3 transition Step 3: Surface user-generated functions

___________________________
@hacking_Attack
@Hacking_Video

categorize_go_folders.py (Requires IDA v7.6+) Automagically categorizes functions into folders Requires IDAv7.6 + 'show folders' to be enabled in functions view Step 4: Fix string references

___________________________
@hacking_Attack
@Hacking_Video

fix_string_cast.py Split from golang loader assist Added logic to undefine previously existing string blobs before defining new string New sanity checks make it far more effective Step 5: Extract type information (by Ivan Kwiatkowski)

___________________________
@hacking_Attack
@Hacking_Video

extract_types.py Comments the arguments of all calls to newobject, makechan, etc. Applies the correct C type to these objects and renames them Obtains the human-readable name and adds it as a comment Pending fixes and room for contributions: fix_string_cast.py - Still needs refactoring + better string load heuristics extract_types.py - Only works on PE files currently and looks for the hardcoded (https://www.kitploit.com/search/label/Hardcoded) .rdata section - A proper check / implementation for varint-encoded sizes is needed Next steps: Track strings references by user-generated functions Auto generate YARA signatures based on user-generated functions Generate hex-rays pseudocode output for user-generated functions Automatically set breakpoints for dynamic analysis (https://www.kitploit.com/search/label/Dynamic%20Analysis) of arguments ??? Credit to: Tim Strazzere for releasing the original golang_loader_assist (https://github.com/strazzere/golang_loader_assist) Milan Bohacek (Avast Software s.r.o.) for his invaluable help figuring out the idatree API. Joakim Kennedy (Intezer) Ivan Kwiatkowski (Kaspersky GReAT) for step 5. Igor Kuznetsov (Kaspersky GReAT)

Download AlphaGolang (https://github.com/SentineLabs/AlphaGolang)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
AlphaGolang - IDApython Scripts For Analyzing Golang Binaries

https://github.com/SentineLabs/AlphaGolang/raw/main/docs/logo/gopher_plays_go.png AlphaGolang is a collection of IDAPython scripts to help malware reverse engineers master Go binaries. The idea is to break the scripts into concrete steps, thus avoiding brittle monolithic scripts, and mimicking the methodology an analyst might follow when tackling a Go binary.

Scripts are released under GPL license (honoring Tim Strazzere's original GolangLoaderAssist which we refactored and updated for python3, props to Tim :) ). Contributions are welcome and encouraged!

Requirements: IDA Pro (ideally v7.6+) and Python3 (ew) The first two steps (recreate_pclntab and function_discovery_and_renaming) will work on IDA v7.5- but scripts beyond that require IDAv7.6+. Newer versions are the ideal target for newer scripts going forward.

Original Reference: Mandiant Cyber Defense Summit 2021 talk (Video Pending) AlphaGolang Analysis Methodology* Step 0: YARA rule to identify Go binaries (PE/ELF/MachO)* identify_go_binaries.yara
* Simple header check + regex for Go build ID string.
* Could probably improve the build ID length range.
* Step 1: Recreate pcln tablehttps://github.com/SentineLabs/AlphaGolang/raw/main/docs/images/recreate_pcln.gif * recreate_pclntab.py (IDA v7.5- compatible)
* Recreates the gopclntab section from heuristics
* Mostly useful for IDA v7.5-
* Step 2: Discover functions by walking pcln table and add names to allhttps://github.com/SentineLabs/AlphaGolang/raw/main/docs/images/function_discover_and_rename.gif * function_renaming.py (IDA v7.5- compatible)
* Split from golang loader assist
* Bruteforces discovery of missing functions based on the pcln table
* Fixed some function name cleaning issues from the py3 transition
* Step 3: Surface user-generated functionshttps://github.com/SentineLabs/AlphaGolang/raw/main/docs/images/categorize.gif * categorize_go_folders.py (Requires IDA v7.6+)
* Automagically categorizes functions into folders
* Requires IDAv7.6 + 'show folders' to be enabled in functions view
* Step 4: Fix string referenceshttps://github.com/SentineLabs/AlphaGolang/raw/main/docs/images/stringcast.gif * fix_string_cast.py
* Split from golang loader assist
* Added logic to undefine previously existing string blobs before defining new string
* New sanity checks make it far more effective
* Step 5: Extract type information (by Ivan Kwiatkowski)https://github.com/SentineLabs/AlphaGolang/raw/main/docs/images/recover_type.gif * extract_types.py
* Comments the arguments of all calls to newobject, makechan, etc.
* Applies the correct C type to these objects and renames them
* Obtains the human-readable name and adds it as a comment Pending fixes and room for contributions:* fix_string_cast.py - Still needs refactoring + better string load heuristics
* extract_types.py - Only works on PE files currently and looks for the hardcoded .rdatasection - A proper check / implementation for varint-encoded sizes is needed Next steps:* Track strings references by user-generated functions
* Auto generate YARA signatures based on user-generated functions
* Generate hex-rays pseudocode output for user-generated functions
* Automatically set breakpoints for dynamic analysis of arguments
* ??? Credit to:* Tim Strazzere for releasing the original golang_loader_assist
* Milan Bohacek (Avast Software s.r.o.) for his invaluable help figuring out the idatree API.
* Joakim Kennedy (Intezer)
* Ivan Kwiatkowski (Kaspersky GReAT) for step 5.
* Igor Kuznetsov (Kaspersky GReAT) Download AlphaGolang

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Game Title

My teacher recently recommended a game which he called a sort of hacking simulator. It entailed JavaScript to “mine” bits. I can’t remember the name of the game, except it’s something along the lines of bit ____. Any ideas?

submitted by /u/Samuel-Pye
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
A website to forward all web browsing content in the browser

I have access to Amazon Web Services, but I'm on a network that whitelists traffic. That means I cannot connect to any remote desktop, vpn, proxy server. I want to access something like SlashDot. I can do something like go to http://mysite.aws.com/url?=slashdot.com, and I can put something on on AWS to do a wget to grab the html, and then display onto the webpage. It wont grab everything else like the css, pictures, etc, but I can get the text of the site. Is there something out of the box that can do this? I want the server to load all the content, and then maybe write everything onto the aws server, and then display it to me on the webpage.

EDIT - protocalls on the network are blocked. Even though I have access to AWS, SSH connections to the EC2 server is blocked.

submitted by /u/meteoraln
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
[Cross-post] "Demons in the database" - My guide to hiding backdoors/malware within popular DBMS softwares.

submitted by /u/0x0MLT
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Largest darknet stolen credit card site closes

https://cdn-images-1.medium.com/max/976/0*tzM3Dj0XXrcumfRh.jpg
The administrators of the largest illegal marketplace on the darknet for stolen credit cards are retiring after making an estimated $358m…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video