Kali Linux Tutorials
Swurg : Parse OpenAPI Documents Into Burp Suite For Automating OpenAPI-based APIs Security Assessments

Swurg is a Burp Suite extension designed for OpenAPI testing.

The OpenAPI Specification (OAS) defines a standard, programming language-agnostic interface description for REST APIs, which allows both humans and computers to discover and understand the capabilities of a service without requiring access to source code, additional documentation, or inspection of network traffic. When properly defined via OpenAPI, a consumer can understand and interact with the remote service with a minimal amount of implementation logic. Similar to what interface descriptions have done for lower-level programming, the OpenAPI Specification removes guesswork in calling a service.

Use cases for machine-readable API definition documents include, but are not limited to: interactive documentation; code generation for documentation, clients, and servers; and automation of test cases. OpenAPI documents describe an API’s services and are represented in either YAML or JSON formats. These documents may either be produced and served statically or be generated dynamically from an application.

– OpenAPI Initiative

Performing security assessment of OpenAPI-based APIs can be a tedious task due to Burp Suite (industry standard) lacking native OpenAPI parsing capabilities. A solution to this situation, is to use third-party tools (e.g. SOAP-UI) or to implement custom scripts (often on a per engagement basis) to handle the parsing of OpenAPI documents and integrate/chain the results to Burp Suite to use its first class scanning capabilities.

Swurg is an OpenAPI parser that aims to streamline this entire process by allowing security professionals to use Burp Suite as a standalone tool for security assessment of OpenAPI-based APIs. Supported Features

* OpenAPI documents can be parsed either from a supplied file or URL. The extension can fetch OpenAPI documents directly from a URL using the Send to Swagger Parserfeature under the Target -> Site mapcontext menu.
* Parse OpenAPI documents, formerly known as the Swagger specification, fully compliant with OpenAPI 2.0/3.0 Specifications (OAS).
* Requests can be directly viewed/edited within the extension prior to sending them to other Burp tools.
* Requests can be sent to the Comparer, Intruder, Repeater, Scanner, Site map and ScopeBurp tools.
* Requests matching specific criterias (detailed in the ‘Parameters’ tab) can be intercepted to automatically match and replace the parsed parameters default values defined in the ‘Parameters’ tab. This feature allows for fine-tuning of the requests prior to sending them to other Burp tools (e.g., scanner). Edited requests can be viewed within the ‘Modified Request (OpenAPI Parser)’ tab of Burp’s message editor.
* Row highlighting allowing pentesters to highlight “interesting” API calls and/or colour code them for reporting purposes.
* Supports both JSON and YAML formats. Installation Compilation Windows & Unix

* Install and configure Gradle (https://gradle.org/) on your system.
* Download/clone this repository

$ git clone https://github.com/aress31/swurg
$ cd .\swurg\

Create the standalone jar:

$ gradle fatJar

Loading the extension into the Burp Suite

In Burp Suite, under the Extender/Optionstab, click on the Addbutton and load the swurg-alljar file located in the .\build\libsfolder.

Alternatively, you can now directly install/load this extension from the BApp Store.

Note: The version distributed on the BApp Storemight be behind the version available on this repository. Possible Improvements

* Beautify the graphical user interface.
* Deep parsing of OpenAPI schemas to collect all nested paramete[...]

rs along with their example/type.
* Code simplification/refactoring.
* Enable cells editing to change API calls directly from the GUI.
* Further optimise the source code.
* Implement support for authenticated testing (via user-supplied API-keys).
* Improve the Param column by adding the type of parameters (e.g. inquery, inbody, etc.).
* Implement the tables and context menus.
* Increase the extension verbosity (via the bottom panel). Download

Hacking on Medium
How Machine Learning Has Become Essential in Stopping Spam and Bots

https://cdn-images-1.medium.com/max/640/0*by3Laf361zc6-gy-.jpg
Spam filters are essential. Without them we couldn’t cut through the noise of phishing scams and malware links to read our messages.

Continue reading on Netacea »

Hacking on Medium
OPSEC LESSONS

https://cdn-images-1.medium.com/max/1500/1*rOtqGdxw879f63zAaYRz3w.png
This will guide you on the interwebs for better security (suckit)…like literally suck it all up.

Continue reading on Medium »

Hacking on Medium
Ethereum and Solana Bridge falls victim to a $320,000,000 hack

https://cdn-images-1.medium.com/max/2600/0*OJT4cBYqrS-uj7e2
It’s happened again. A hacker in the field of DeFi got rich off a bug in the code, and he did so correctly.

Continue reading on The Capital »

Does VPN need to be set up on host or just the kali vm installed on the host?
https://www.reddit.com/r/Pentesting/comments/sjgj8y/does_vpn_need_to_be_set_up_on_host_or_just_the/

<!-- SC_OFF -->It might be a silly question but for a pen test exam they sent me an openvpn file to connect to their network. I have Windows as my main machine and Kali -Virtual box installed on that. Do I need to setup the vpn on my windows machine or just connect directly from kali? <!-- SC_ON --> submitted by /u/brucue (https://www.reddit.com/user/brucue)
[link] (https://www.reddit.com/r/Pentesting/comments/sjgj8y/does_vpn_need_to_be_set_up_on_host_or_just_the/) [comments] (https://www.reddit.com/r/Pentesting/comments/sjgj8y/does_vpn_need_to_be_set_up_on_host_or_just_the/)

Heaptrace - Helps Visualize Heap Operations For Pwn And Debugging
http://www.kitploit.com/2022/02/heaptrace-helps-visualize-heap.html

replaces addresses with easy-to-understand symbols detects heap corruption and memory leakage issues can debug in gdb at any point (--break) supports all ELF64 (x86_64) binaries regardless of ASLR or compiler (https://www.kitploit.com/search/label/Compiler) settings (including stripped binaries (https://github.com/Arinerron/heaptrace/wiki/Dealing-with-a-Stripped-Binary)) How are heaptrace and valgrind different? (https://github.com/Arinerron/heaptrace/wiki/Difference-between-heaptrace-and-valgrind)
Installation Official Releases See the .deb and .rpm release files, and a pre-compiled binary at the Releases page (https://github.com/Arinerron/heaptrace/releases/). Ubuntu PPA $ sudo add-apt-repository ppa:arinerron/heaptrace
$ sudo apt-get update
$ sudo apt-get install heaptrace
Arch User Repository (PKGBUILD) Use your preferred AUR helper to install one of the two following packages: heaptrace-git — source package (PKGBUILD (https://aur.archlinux.org/cgit/aur.git/plain/PKGBUILD?h=heaptrace-git)) heaptrace — binary package (PKGBUILD (https://aur.archlinux.org/cgit/aur.git/plain/PKGBUILD?h=heaptrace)) $ trizen -S heaptrace-git
... OR ...
$ trizen -S heaptrace
Compile from Source $ git clone https://github.com/Arinerron/heaptrace.git && cd heaptrace
$ make
$ sudo make install
...
$ heaptrace ./target Usage You can specify arguments to heaptrace before specifying the binary name: [args...] heaptrace [options...] --attach Options: -p , --attach , --pid Tells heaptrace to attach to the specified pid instead of running the binary from the `target` argument. Note that if you specify this argument you do not have to specify `target`. -b , --break=, --break-at= Send SIGSTOP to the process when the specified `expression` is satisfied and attach the GNU debugger (gdb) to the process. This argument supports complex expressions. Please See the documentation for more information: https://github.com/Arinerron/heaptrace/wiki/How-to-Create-Breakpoints -B , --break-after= Similar to `--break`. Replaces the tracer process with gdb, but only after the heap function returns. See the documentation for more information: https://github.com/Arinerron/heaptrace/wiki/How-to-Create-Breakpoints -e , --environ=, --environment= Sets a single environmental variable. Useful for setting runtime settings for the target such as LD_PRELOAD=./libc.so.6 without having them affect heaptrace's runtime configuration. This option can be used multiple times. -s , --symbols= Override the values heaptrace detects for the malloc/calloc/free/realloc/reallocarray symbols. Useful if heaptrace fails to automatically identify heap functions in a stripped binary. See the wiki for more info. -F, --follow-fork, --follow Tells heaptrace to detach the parent and follow the child if the target calls fork(), vfork(), or clone(). The default behavior is to detach the child and only trace the parent. -G , --gdb-path Tells heaptrace to use the path to gdb specified in `path` instead of /usr/bin/gdb (default). -w , --width=, --term-width= Force a certain terminal width. -o , --output= Write the heaptrace output to `file` instead of /dev/stderr (which is the default output path). -v, --verbose Prints verbose information such as line numbers in source code given the required debugging info is stored in the ELF. -V, --version Displays the current heaptrace version. -h, --help Shows this help menu. ">Usage:
heaptrace [options...] [args...]
heaptrace [options...] --attach

Options:
-p , --attach , --pid
Tells heaptrace to attach to the specified pid
instead of running the binary from the `target`
argument. Note that if you specify this argument
you do not have to specify `target`.


-b , --break=, --break-at=

Send SIGSTOP to the process when the specified
`expression` is satisfied and attach the GNU debugger
(gdb) to the process.

This argument supports complex expressions. Please
See the documentation for more information:
https://github.com/Arinerron/heaptrace/wiki/How-to-Create-Breakpoints


-B , --break-after=
Similar to `--break`. Replaces the tracer
process with gdb, but only af ter the heap function
returns. See the documentation for more information:
https://github.com/Arinerron/heaptrace/wiki/How-to-Create-Breakpoints


-e , --environ=, --environment=
Sets a single environmental variable. Useful for
setting runtime settings for the target such as
LD_PRELOAD=./libc.so.6 without having them affect
heaptrace's runtime configuration. This option can
be used multiple times.

-s , --symbols=
Override the values heaptrace detects for the
malloc/calloc/free/realloc/reallocarray symbols.
Useful if heaptrace fails to automatically
identify heap functions in a stripped binary. See
the wiki for more info.


-F, --follow-fork, --follow
Tells heaptrace to detach the parent and follow
the child if the target calls fork(), vfork(), or
clone().

The default behavior is to detach the child and
only trace the parent.


-G , --gdb-path
Tells heaptrace to use the path to gdb specified
in `path` instead of /usr/bin/gdb (default).


-w , --width=, --term-width=
Force a certain terminal width.


-o , --output=
Write the heaptrace output to `file` instead of
/dev/stderr (which is the default output path).


-v, --verbose
Prints verbose information such as line numbers in
source code given the required debugging info is
stored in the ELF.


-V, --version
Displays the current heaptrace version.


-h, --help
Shows this help menu.

For example, if you wanted to automatically attach gdb at operation #3, you would execute heaptrace --break=3 ./my-binary. Please see the wiki documentation (https://github.com/Arinerron/heaptrace/wiki/How-to-Create-Breakpoints) for more information on how to use this argument. See the wiki documentation (https://github.com/Arinerron/heaptrace/wiki/Dealing-with-a-Stripped-Binary) for more information on how to use the -s/--symbol argument to debug stripped binaries that heaptrace failed to automatically identify functions in. Set the $NO_COLOR argument to remove ANSI color codes from output. This option is still in development and will be converted into an argument soon. Support I'm happy to help if you experience a bug or have any feedback. Please see the GitHub Issues (https://github.com/Arinerron/heaptrace/issues) page.

Download Heaptrace (https://github.com/Arinerron/heaptrace)

Deep Web
Hacking

are deepweb socmed hackers legit?

submitted by /u/usernam30_0
[link] [comments]

UnderRated Tool For Pass-The-Hash[Evil-WinRM]
https://genesis1109.medium.com/underrated-tool-for-pass-the-hash-evil-winrm-50032872b79b?source=rss------bug_bounty-5

First Of all I’ll Describe What is Pass-The-Hash AttackContinue reading on Medium » (https://genesis1109.medium.com/underrated-tool-for-pass-the-hash-evil-winrm-50032872b79b?source=rss------bug_bounty-5)

hacking: security in practice
Was hacking a Trezor One hardware wallet really this simple?

Joe Grand shows in this video https://www.youtube.com/watch?v=dT9y-KQbqi4 how he managed to hack a Trezor One hardware wallet running firmware version 1.6.0.

Objective of the video was to obtain from the device RAM a 5 digit PIN in plaintext. At 28:40 this was accomplished alongside mnemonic pass phrase.

Given the level of security Trezor devices promise, this is laughably insecure.

Are Trezor devices still vulnerable to such attacks with todays firmware?

submitted by /u/PeteMarcus
[link] [comments]

hacking: security in practice
Here's How A Hacker Recovered $2 Million In Cryptocurrency From A Crypto Wallet For An Owner Who Forgot The Password

https://external-preview.redd.it/pVjXxOPFcE8EkEMslEAQuXkgitlmM-atr44Nnn2ZowU.jpg?width=640&crop=smart&auto=webp&s=ef2b0668aebbd4c41b035d3a49995a0d74d333da submitted by /u/noahthearc333
[link] [comments]