Hacking Articles Tips Tricks Videos Tutorials
targets are explicitly marked as in scope. * Active*: Active* collections are actually passive collections. Nevertheless, as accessing some third-party sources is somehow limited (e.g., querying certain sources like Shodan.io cost credits), they are treated…
intel collection setup:
create a new workspace example
docker exec -it kaliintelsuite kismanage workspace -a example
add the second-level domain megacorpone.com to workspace example and set the scope to strict
docker exec -it kaliintelsuite kismanage domain -w example -a megacorpone.com -s strict
add new host names to workspace example. They are automatically in scope due to kismanage’s default value.
docker exec -it kaliintelsuite kismanage hostname -w example -a www.megacorpone.com ftp.megacorpone.com
verify the initial setup
docker exec -it kaliintelsuite bash
kis_shell> kisreport domain -w example –csv | csvcut -c “Second-Level Domain (SLD)”,”Scope (SLD)”,”Host Name (HN)”,”In Scope (HN)” | csvlook
Second-Level Domain (SLD) | Scope (SLD) | Host Name (HN) | In Scope (HN) |
| megacorpone.com | strict | megacorpone.com | False |
| megacorpone.com | strict | www.megacorpone.com | True |
| megacorpone.com | strict | ftp.megacorpone.com | True |
kis_shell> exit
Note that KIS treats the second-level domain also as a host name. As it has not been explicitly put in scope, it
is still out of scope.
*
create a new workspace example
docker exec -it kaliintelsuite kismanage workspace -a example
add the second-level domain google.com to workspace example and set the scope to all (default)
docker exec -it kaliintelsuite kismanage domain -w example -a google.com
In this case, KIS is able to, among other things, enumerate any sub-level domains as well as resolve their corresponding IP addresses. In addition, to ensure that KIS scans any host with an IP address within the IP network range 172.217.0.0/16, this network range must be added to KIS with scope type
add the network 172.217.0.0/16 to workspace example and set the scope to all (default)
docker exec -it kaliintelsuite kismanage network -w example -a 172.217.0.0/16
Example 2: Let’s assume the second-level domain google.com together with all sub-level domains that resolve to any network range are in scope. In this case, the top-level domain google.com is added to the KIS database with scope type
create a new workspace example
docker exec -it kaliintelsuite kismanage workspace -a example
add the second-level domain google.com to workspace example and set the scope to all (default)
docker exec -it kaliintelsuite kismanage domain -w example -a google.com
In this case, KIS is able to, among other things, enumerate any sub-level domains as well as resolve their corresponding IP addresses. In addition, to ensure that KIS scans any host, the network range 0.0.0.0/0 must be added to KIS with scope type
add network 0.0.0.0/0 to workspace example and set the scope to all (default)
docker exec -it kaliintelsuite kismanage network -w example -a 0.0.0.0/0
List of KIS Collectors
The following table shows the list of existing collectors that are supported by KIS. These collectors are executed by the script
The Priority column provides information about the order of execution; the lower the number, the earlier the respective OS commands are created and executed and subsequent collectors can profit from the already collected information. Collectors with a priority of
___________________________
@hacking_Attack
@Hacking_Video
create a new workspace example
docker exec -it kaliintelsuite kismanage workspace -a example
add the second-level domain megacorpone.com to workspace example and set the scope to strict
docker exec -it kaliintelsuite kismanage domain -w example -a megacorpone.com -s strict
add new host names to workspace example. They are automatically in scope due to kismanage’s default value.
docker exec -it kaliintelsuite kismanage hostname -w example -a www.megacorpone.com ftp.megacorpone.com
verify the initial setup
docker exec -it kaliintelsuite bash
kis_shell> kisreport domain -w example –csv | csvcut -c “Second-Level Domain (SLD)”,”Scope (SLD)”,”Host Name (HN)”,”In Scope (HN)” | csvlook
Second-Level Domain (SLD) | Scope (SLD) | Host Name (HN) | In Scope (HN) |
| megacorpone.com | strict | megacorpone.com | False |
| megacorpone.com | strict | www.megacorpone.com | True |
| megacorpone.com | strict | ftp.megacorpone.com | True |
kis_shell> exit
Note that KIS treats the second-level domain also as a host name. As it has not been explicitly put in scope, it
is still out of scope.
*
exclude: Sets the given second-level domains (e.g., megacorpone.com) together with all sub-level domains out of scope. As a result, KIS does not execute any active and active* collectors on these second-level domains. This scope type is the default type for all second-level domains and their sub-level domains that are automatically identified by KIS (e.g., via extraction from certificates, etc.). Thus, it is not necessary to explicitly set this scope type. Nevertheless, this scope type can be used to manually exclude second-level domains at a later time.create a new workspace example
docker exec -it kaliintelsuite kismanage workspace -a example
add the second-level domain google.com to workspace example and set the scope to all (default)
docker exec -it kaliintelsuite kismanage domain -w example -a google.com
In this case, KIS is able to, among other things, enumerate any sub-level domains as well as resolve their corresponding IP addresses. In addition, to ensure that KIS scans any host with an IP address within the IP network range 172.217.0.0/16, this network range must be added to KIS with scope type
allas well:add the network 172.217.0.0/16 to workspace example and set the scope to all (default)
docker exec -it kaliintelsuite kismanage network -w example -a 172.217.0.0/16
Example 2: Let’s assume the second-level domain google.com together with all sub-level domains that resolve to any network range are in scope. In this case, the top-level domain google.com is added to the KIS database with scope type
allas documented below:create a new workspace example
docker exec -it kaliintelsuite kismanage workspace -a example
add the second-level domain google.com to workspace example and set the scope to all (default)
docker exec -it kaliintelsuite kismanage domain -w example -a google.com
In this case, KIS is able to, among other things, enumerate any sub-level domains as well as resolve their corresponding IP addresses. In addition, to ensure that KIS scans any host, the network range 0.0.0.0/0 must be added to KIS with scope type
allas well:add network 0.0.0.0/0 to workspace example and set the scope to all (default)
docker exec -it kaliintelsuite kismanage network -w example -a 0.0.0.0/0
List of KIS Collectors
The following table shows the list of existing collectors that are supported by KIS. These collectors are executed by the script
kiscollectto create and execute actual OS commands.The Priority column provides information about the order of execution; the lower the number, the earlier the respective OS commands are created and executed and subsequent collectors can profit from the already collected information. Collectors with a priority of
-are not automatically executed as they ei[...]___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
intel collection setup: create a new workspace example docker exec -it kaliintelsuite kismanage workspace -a example add the second-level domain megacorpone.com to workspace example and set the scope to strict docker exec -it kaliintelsuite kismanage domain…
ther require user interaction or additional information (e.g., domain credentials) for execution.
The Name column contains the name of the collector. These names can be added as command line arguments to
Column Level specifies whether the collector is operating on:
* services: Scans services by using IPv4/IPv6 addresses and UDP/TCP port numbers
* vhosts: Scans web services by using host names (instead of IP addresses) and TCP port numbers
* hosts: Obtains information based on IPv4/IPv6 addresses
* domains: Obtains information based on second-level domains and optionally sub-level domains
* networks: Obtains information based on IPv4/IPv6 network ranges
* emails: Obtains information based on emails
* companies: Obtains information based on companies
Column Type specifies whether the collector actively approaches the target (
The IP Support column specifies the IP versions, which are supported by the underlying Kali tool (e.g., gobuster). Kali uses this information to decide which operating systems commands can be created and successfully executed. This column is only relevant for host, network, service, and vhost collectors (see column Level).
Column Timeout specifies the number of seconds after which the collector is automatically terminated.
The column User specifies the user with which the respective operating system commands are executed.
PriorityNameLevelTypeIP SupportTimeoutUser–ftpdotdotpwnserviceActiveIPv4, IPv6–nobody–httpdotdotpwnserviceActiveIPv4, IPv6–nobody–tftpdotdotpwnserviceActiveIPv4, IPv6–nobody–httphydraserviceActiveIPv4, IPv6–nobody–rdphydraserviceActiveIPv4, IPv6–nobody–smbhydraserviceActiveIPv4, IPv6–nobody–smbmedusaserviceActiveIPv4–nobody–smbmsfloginserviceActiveIPv4, IPv6–root–sshhydraserviceActiveIPv4, IPv6–nobody125builtwithdomainActive*––nobody127hostiodomainActive*––nobody130censysdomaindomainActive*––kali131securitytrailsdomainActive*––nobody132dnsdumpsterdomainActive*––nobody133certspotterdomainActive*––nobody134crtshdomaindomainActive*––nobody135virustotaldomainActive*––nobody140dnssublist3rdomainActive––nobody141dnsamasspassivedomainActive*––nobody142dnsamassactivedomainActive––nobody143dnscrobatdomaindomainActive*––nobody144dnscrobattlddomainActive*––nobody150theharvesterdomainPassive––kali155awsslurpdomainActive––nobody160dnsenumdomainActive––nobody170dnsgobusterdomainActive––nobody180dnsrecondomainActive––nobody210whoisdomaindomainActive–30nobody215dnsspfdomainActive––nobody220dnsdmarcdomainActive––nobody235dnsdkimdomainActive––nobody240dnstakeoverdomainActive––nobody310dnshostdomainActive––nobody312dnshostpublicdomainPassive––nobody320dnsreverselookuphostActiveIPv4, IPv6–nobody360dnscrobatreversehosthostActive*IPv4, IPv6–nobody410hunterdomainActive*––nobody420haveibeenbreachemailActive*––nobody430haveibeenpasteemailActive*––nobody510whoishosthostPassiveIPv4, IPv630nobody512whoisnetworknetworkPassiveIPv4, IPv630nobody515reversewhoiscompanyActive*––nobody520shodanhosthostActive*IPv4, IPv6–nobody521shodannetworknetworkActive*IPv4, IPv6–nobody530censyshosthostActive*IPv4–kali540crtshcompanycompanyActive*––nobody550dnscrobatreversenetworknetworkActive*IPv4, IPv6–nobody1100tcpnmapnetworknetworkActiveIPv4, IPv6–root1150tcpnmapdomaindomainActiveIPv4, IPv6–root1200udpnmapnetworknetworkActiveIPv4, IPv6–root1250udpnmapdomaindomainActiveIPv4, IPv6–root1270icmpnmapnetworknetworkActiveIPv4, IPv6–root1300tcpmasscannetworknetworkActiveIPv4–root1305dnsaxfrdomaindomainActive––nobody1306dnsaxfrserviceserviceActive*Ipv4, Ipv6–nobody1320vhostgobusterserviceActiveIPv4, IPv6–nobody1350anyservicenmapserviceActiveIPv4, IPv6–root1820tcptraceroutehostActiveIPv4, IPv6–nobody1900httpmsfrobotstxtservice, vhostActiveIPv4, IPv6–root2000dnsnmapserv[...]
___________________________
@hacking_Attack
@Hacking_Video
The Name column contains the name of the collector. These names can be added as command line arguments to
kiscollect(e.g. --httpnikto). The name also indicates, which underlying OS command is executed.Column Level specifies whether the collector is operating on:
* services: Scans services by using IPv4/IPv6 addresses and UDP/TCP port numbers
* vhosts: Scans web services by using host names (instead of IP addresses) and TCP port numbers
* hosts: Obtains information based on IPv4/IPv6 addresses
* domains: Obtains information based on second-level domains and optionally sub-level domains
* networks: Obtains information based on IPv4/IPv6 network ranges
* emails: Obtains information based on emails
* companies: Obtains information based on companies
Column Type specifies whether the collector actively approaches the target (
active) or obtains the information from third-party sources (passive and active*).The IP Support column specifies the IP versions, which are supported by the underlying Kali tool (e.g., gobuster). Kali uses this information to decide which operating systems commands can be created and successfully executed. This column is only relevant for host, network, service, and vhost collectors (see column Level).
Column Timeout specifies the number of seconds after which the collector is automatically terminated.
The column User specifies the user with which the respective operating system commands are executed.
PriorityNameLevelTypeIP SupportTimeoutUser–ftpdotdotpwnserviceActiveIPv4, IPv6–nobody–httpdotdotpwnserviceActiveIPv4, IPv6–nobody–tftpdotdotpwnserviceActiveIPv4, IPv6–nobody–httphydraserviceActiveIPv4, IPv6–nobody–rdphydraserviceActiveIPv4, IPv6–nobody–smbhydraserviceActiveIPv4, IPv6–nobody–smbmedusaserviceActiveIPv4–nobody–smbmsfloginserviceActiveIPv4, IPv6–root–sshhydraserviceActiveIPv4, IPv6–nobody125builtwithdomainActive*––nobody127hostiodomainActive*––nobody130censysdomaindomainActive*––kali131securitytrailsdomainActive*––nobody132dnsdumpsterdomainActive*––nobody133certspotterdomainActive*––nobody134crtshdomaindomainActive*––nobody135virustotaldomainActive*––nobody140dnssublist3rdomainActive––nobody141dnsamasspassivedomainActive*––nobody142dnsamassactivedomainActive––nobody143dnscrobatdomaindomainActive*––nobody144dnscrobattlddomainActive*––nobody150theharvesterdomainPassive––kali155awsslurpdomainActive––nobody160dnsenumdomainActive––nobody170dnsgobusterdomainActive––nobody180dnsrecondomainActive––nobody210whoisdomaindomainActive–30nobody215dnsspfdomainActive––nobody220dnsdmarcdomainActive––nobody235dnsdkimdomainActive––nobody240dnstakeoverdomainActive––nobody310dnshostdomainActive––nobody312dnshostpublicdomainPassive––nobody320dnsreverselookuphostActiveIPv4, IPv6–nobody360dnscrobatreversehosthostActive*IPv4, IPv6–nobody410hunterdomainActive*––nobody420haveibeenbreachemailActive*––nobody430haveibeenpasteemailActive*––nobody510whoishosthostPassiveIPv4, IPv630nobody512whoisnetworknetworkPassiveIPv4, IPv630nobody515reversewhoiscompanyActive*––nobody520shodanhosthostActive*IPv4, IPv6–nobody521shodannetworknetworkActive*IPv4, IPv6–nobody530censyshosthostActive*IPv4–kali540crtshcompanycompanyActive*––nobody550dnscrobatreversenetworknetworkActive*IPv4, IPv6–nobody1100tcpnmapnetworknetworkActiveIPv4, IPv6–root1150tcpnmapdomaindomainActiveIPv4, IPv6–root1200udpnmapnetworknetworkActiveIPv4, IPv6–root1250udpnmapdomaindomainActiveIPv4, IPv6–root1270icmpnmapnetworknetworkActiveIPv4, IPv6–root1300tcpmasscannetworknetworkActiveIPv4–root1305dnsaxfrdomaindomainActive––nobody1306dnsaxfrserviceserviceActive*Ipv4, Ipv6–nobody1320vhostgobusterserviceActiveIPv4, IPv6–nobody1350anyservicenmapserviceActiveIPv4, IPv6–root1820tcptraceroutehostActiveIPv4, IPv6–nobody1900httpmsfrobotstxtservice, vhostActiveIPv4, IPv6–root2000dnsnmapserv[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
ther require user interaction or additional information (e.g., domain credentials) for execution. The Name column contains the name of the collector. These names can be added as command line arguments to kiscollect(e.g. --httpnikto). The name also indicates…
iceActiveIPv4, IPv6–root2020telnetnmapserviceActiveIPv4, IPv6–root2040vncnmapserviceActiveIPv4, IPv6–root2100mssqlnmapserviceActiveIPv4, IPv6–root2150mysqlnmapserviceActiveIPv4, IPv6–root2200smbnmapserviceActiveIPv4, IPv6–root2250ftpnmapserviceActiveIPv4, IPv6–root2300smtpnmapserviceActiveIPv4, IPv6–root2400rpcnmapserviceActiveIPv4, IPv6–root2500rdpnmapserviceActiveIPv4, IPv6–root2700pop3nmapserviceActiveIPv4, IPv6–root2750msrpcenumserviceActiveIPv4, IPv6–root2800imapnmapserviceActiveIPv4, IPv6–root2850x11nmapserviceActiveIPv4, IPv6–root2900tftpnmapserviceActiveIPv4, IPv6–root2950nfsnmapserviceActiveIPv4, IPv6–root3100fingerserviceActiveIPv4–nobody3200ntpdateserviceActiveIPv4, IPv6–nobody3300ntpqserviceActiveIPv4, IPv6–nobody4000h323versionserviceActiveIPv4, IPv6–root4100sipnmapserviceActiveIPv4, IPv6–root4120sipmsfserviceActiveIPv4, IPv6–root4200stunnmapserviceActiveIPv4, IPv6–root11000vncmsfnoneauthserviceActiveIPv4, IPv6–root11010vncmsfloginserviceActiveIPv4, IPv6–root11100ftphydraserviceActiveIPv4, IPv6–nobody11200mssqlhydraserviceActiveIPv4, IPv6–nobody11400pgsqlhydraserviceActiveIPv4, IPv6–nobody11500snmphydraserviceActiveIPv4, IPv6–nobody11600sshchangemeserviceActiveIPv4, IPv6–kali11610httpchangemeservice, vhostActiveIPv4, IPv6–kali11700ipmiserviceActiveIPv4, IPv6–root11750rmiregistrymsfgatherserviceActiveIPv4, IPv6–root11760rmiregistrynmapserviceActiveIPv4, IPv6–root12100ftpfilelistserviceActiveIPv4, IPv6–nobody13000showmountserviceActiveIPv4, IPv6300nobody13090smbcmeserviceActiveIpv4, Ipv6–kali13100smbclientserviceActiveIPv4, IPv6–nobody13200smbfilelistserviceActiveIPv4, IPv6–nobody13210smbmapserviceActiveIPv4–nobody21500nbtscanserviceActiveIPv4–nobody21600ldapsearchserviceActiveIPv4, IPv6–nobody21610ldapnmapserviceActiveIPv4, IPv6–root31100snmpcheckserviceActiveIPv4300nobody31110snmpnmapserviceActiveIPv4, IPv6–root31200onesixtyoneserviceActiveIPv460nobody31300snmpwalkserviceActiveIPv4–nobody31400oraclesidguessserviceActiveIPv4–nobody41200sshnmapserviceActiveIPv4, IPv6–root41300certnmapservice, vhostActiveIPv4, IPv6–root41310tlsnmapservice, vhostActiveIPv4, IPv6–root41315sslyzeservice, vhostActiveIPv4–nobody41320sslscanservice, vhostActiveIPv4, IPv6–nobody41330certopensslservice, vhostActiveIPv4, IPv6120nobody51100httpgobusterservice, vhostActiveIPv4, IPv6–nobody51110httpgobustersmartservice, vhostActiveIPv4, IPv6–nobody51150httpkiterunnerservice, vhostActiveIpv4–kali51200httpnmapservice, vhostActiveIPv4, IPv6–root51205httpntlmnmapservice, vhostActiveIPv4, IPv6–root61400rpcclientserviceActiveIPv4, IPv6–nobody61500rpcinfoserviceActiveIPv4, IPv6–nobody71100ikescanserviceActiveIPv4–root91050httpwpscanserviceActiveIPv4, IPv6–kali91100enum4linuxserviceActiveIPv4–nobody91200httpniktoservice, vhostActiveIPv4–nobody91225httpburpsuiteprodomain, hostActiveIPv4, IPv6–nobody91250httpdavtestservice, vhostActiveIPv4, IPv6–nobody91260httpwhatwebserviceActiveIPv4, IPv6–nobody91300httpsqlmapservice, vhostActiveIPv4, IPv6–nobody91400smtpuserenumserviceActiveIPv4–nobody91600mysqlhydraserviceActiveIPv4, IPv6–nobody92200httpwapitiservice, vhostActiveIPv4, IPv6–nobody100000vncviewerserviceActiveIPv4–nobody100100httpeyewitnessservice, vhostActiveIPv4, IPv63600kali Usage
After the setup, the following KIS commands are available. kismanage
This script allows:
* setting up and testing KIS
* managing the database (re-creation, creating backups, restoring backups, etc.)
* creating workspaces, networks, host names, emails, companies, etc.
* importing Nmap, Nessus, and Masscan scan results
* defining the scope
Run the following command to obtain more information and examples:
docker exec -it kaliintelsuite kismanage -h
kiscollect
This script implements a commandline interface to collect the intelligence.
Run the following command to obtain more information and examples:
docker exec -it kaliintelsuite kiscollect -h
kisreport
This script allows the analysis of the collected data via various filtering op[...]
___________________________
@hacking_Attack
@Hacking_Video
After the setup, the following KIS commands are available. kismanage
This script allows:
* setting up and testing KIS
* managing the database (re-creation, creating backups, restoring backups, etc.)
* creating workspaces, networks, host names, emails, companies, etc.
* importing Nmap, Nessus, and Masscan scan results
* defining the scope
Run the following command to obtain more information and examples:
docker exec -it kaliintelsuite kismanage -h
kiscollect
This script implements a commandline interface to collect the intelligence.
Run the following command to obtain more information and examples:
docker exec -it kaliintelsuite kiscollect -h
kisreport
This script allows the analysis of the collected data via various filtering op[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
iceActiveIPv4, IPv6–root2020telnetnmapserviceActiveIPv4, IPv6–root2040vncnmapserviceActiveIPv4, IPv6–root2100mssqlnmapserviceActiveIPv4, IPv6–root2150mysqlnmapserviceActiveIPv4, IPv6–root2200smbnmapserviceActiveIPv4, IPv6–root2250ftpnmapserviceActiveIPv4,…
tions. Supported report formats are:
* Character-separated values (CSV): Export of the collected intelligence in the structured CSV format. This allows further processing via tools like grep, csvcut, or Aquatone
* Microsoft Excel: Export of all collected intelligence into a Microsoft Excel file.
* Text: Export of the collected raw text intelligence (e.g., text output of tool Nikto).
* Raw: Export of additionally collected files like JSON objects from APIs like Shodan.io, or certificate files.
Run the following command to obtain more information and examples:
docker exec -it kaliintelsuite kisreport -h Download
___________________________
@hacking_Attack
@Hacking_Video
* Character-separated values (CSV): Export of the collected intelligence in the structured CSV format. This allows further processing via tools like grep, csvcut, or Aquatone
* Microsoft Excel: Export of all collected intelligence into a Microsoft Excel file.
* Text: Export of the collected raw text intelligence (e.g., text output of tool Nikto).
* Raw: Export of additionally collected files like JSON objects from APIs like Shodan.io, or certificate files.
Run the following command to obtain more information and examples:
docker exec -it kaliintelsuite kisreport -h Download
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How OpenBullet is Used And Abused By Cybercriminals
https://cdn-images-1.medium.com/max/940/0*_TDcdPdYFII-CSl-.png
Although designed to aid security professionals, in the wrong hands OpenBullet can be abused for the opposite purpose.
Continue reading on Netacea »
___________________________
@hacking_Attack
@Hacking_Video
How OpenBullet is Used And Abused By Cybercriminals
https://cdn-images-1.medium.com/max/940/0*_TDcdPdYFII-CSl-.png
Although designed to aid security professionals, in the wrong hands OpenBullet can be abused for the opposite purpose.
Continue reading on Netacea »
___________________________
@hacking_Attack
@Hacking_Video
Medium
How OpenBullet is used and abused by cybercriminals
Although designed to aid security professionals, in the wrong hands OpenBullet can be abused for the opposite purpose.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Anatomy Of An Email Scam
https://cdn-images-1.medium.com/max/640/1*8uEgDQ3CHSPWabhq0BNk-w.jpeg
Tell-tale signs an email is a scam and what to do if you’ve responded to one
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Anatomy Of An Email Scam
https://cdn-images-1.medium.com/max/640/1*8uEgDQ3CHSPWabhq0BNk-w.jpeg
Tell-tale signs an email is a scam and what to do if you’ve responded to one
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Anatomy Of An Email Scam
Tell-tale signs an email is a scam and what to do if you’ve responded to one
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How to not be a script kiddie in 2022
https://cdn-images-1.medium.com/max/600/0*h7PVAWMXNmbu0o0e
If you are interested in InfoSec/Cyber security you have probably heard the term “script kiddie/skiddie”. You might’ve wondered what that…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
How to not be a script kiddie in 2022
https://cdn-images-1.medium.com/max/600/0*h7PVAWMXNmbu0o0e
If you are interested in InfoSec/Cyber security you have probably heard the term “script kiddie/skiddie”. You might’ve wondered what that…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
How to not be a script kiddie in 2022
If you are interested in InfoSec/Cyber security you have probably heard the term “script kiddie/skiddie”. You might’ve wondered what that…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Lessons We Can Learn From The Wormhole Bridge Hack
https://cdn-images-1.medium.com/max/2600/0*RvmGtnWh55w_5lH5
This week one of the largest DeFi bridge between Solana and Ethereum has been hacked in what deemed to be the second largest hack ever:
Continue reading on Godly Dev »
___________________________
@hacking_Attack
@Hacking_Video
Lessons We Can Learn From The Wormhole Bridge Hack
https://cdn-images-1.medium.com/max/2600/0*RvmGtnWh55w_5lH5
This week one of the largest DeFi bridge between Solana and Ethereum has been hacked in what deemed to be the second largest hack ever:
Continue reading on Godly Dev »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Lessons We Can Learn From The Wormhole Bridge Hack
This week one of the largest DeFi bridge between Solana and Ethereum has been hacked in what deemed to be the second largest hack ever:
KitPloit - PenTest Tools!
Elfloader - An Architecture-Agnostic ELF File Flattener For Shellcode
___________________________
@hacking_Attack
@Hacking_Video
Elfloader - An Architecture-Agnostic ELF File Flattener For Shellcode
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Elfloader - An Architecture-Agnostic ELF File Flattener For Shellcode
Elfloader - An Architecture-Agnostic ELF File Flattener For Shellcode
http://www.kitploit.com/2022/02/elfloader-architecture-agnostic-elf.html
___________________________
@hacking_Attack
@Hacking_Video
http://www.kitploit.com/2022/02/elfloader-architecture-agnostic-elf.html
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Elfloader - An Architecture-Agnostic ELF File Flattener For Shellcode
--binary - Don't output a FELF, output the raw loaded image with no
metadata
--base= - Force the output to start at ``, zero padding from
the base to the start of the first LOAD segment if needed.
`` is default hex, can be overrided with `0d`, `0b`,
`0x`, or `0o` prefixes.
Warning: This does not _relocate_ to base, it simply starts
the output at `` (adding zero bytes such that the
output image can be loaded at `` instead of the
original ELF base)
- Path to input ELF
- Path to output file
To install this tool run: cargo install --path . Now you can use elfloader from anywhere in your shell! Dev This project was developed live here: https://www.youtube.com/watch?v=x0V-CEmXQCQ Example There's an example in example_small_program, simply run make or nmake and this should generate an example.bin which is 8 bytes. : 133700b0: 8b000020 add x0, x1, x0 133700b4: d65f03c0 ret">pleb@gamey ~/elfloader/example_small_program $ make
cargo build --release
Finished release [optimized] target(s) in 0.03s
elfloader --binary target/aarch64-unknown-none/release/example_small_program example.bin
pleb@gamey ~/elfloader/example_small_program $ ls -l ./example.bin
-rw-r--r-- 1 pleb pleb 8 Nov 8 12:27 ./example.bin
pleb@gamey ~/elfloader/example_small_program $ objdump -d target/aarch64-unknown-none/release/example_small_program
target/aarch64-unknown-none/release/example_small_program: file format elf64-littleaarch64
Disassembly of section .text:
00000000133700b0 :
133700b0: 8b000020 add x0, x1, x0
133700b4: d65f03c0 ret
Now you can write your shellcode in Rust, and you don't have to worry about whether you emit .data, .rodata, .bss, etc. This will handle it all for you! There's also an example with .bss and .rodata : 13370124: 90000000 adrp x0, 13370000 13370128: 90000008 adrp x8, 13370000 1337012c: 52800029 mov w9, #0x1 // #1 13370130: 91048000 add x0, x0, #0x120 13370134: 3904f109 strb w9, [x8, #316] 13370138: d65f03c0 ret pleb@gamey ~/elfloader/example_program_with_data $ readelf -l target/aarch64-unknown-none/release/example_program_with_data Elf file type is EXEC (Executable file) Entry point 0x13370124 There are 4 program headers, starting at offset 64 Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align LOAD 0x0000000000000120 0x0000000013370120 0x0000000013370120 0x0000000000000004 0x0000000000000004 R 0x1 LOAD 0x0000000000000124 0x0000000013370124 0x0000000013370124 0x0000000000000018 0x0000000000000018 R E 0x4 LOAD 0x000000000000013c 0x000000001337013c 0x000000001337013c 0x0000000000000000 0x0000000000000001 RW 0x4 GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 RW 0x0 Section to Segment mapping: Segment Sections... 00 .rodata 01 .text 02 .bss 03 ">pleb@gamey ~/elfloader/example_program_with_data $ make
cargo build --release
Finished release [optimized] target(s) in 0.04s
elfloader --binary target/aarch64-unknown-none/release/example_program_with_data example.bin
pleb@gamey ~/elfloader/example_program_with_data $ ls -l ./example.bin
-rw-r--r-- 1 pleb pleb 29 Nov 8 12:39 ./example.bin
pleb@gamey ~/elfloader/example_program_with_data $ objdump -d target/aarch64-unknown-none/release/example_program_with_data
___________________________
@hacking_Attack
@Hacking_Video
metadata
--base= - Force the output to start at ``, zero padding from
the base to the start of the first LOAD segment if needed.
`` is default hex, can be overrided with `0d`, `0b`,
`0x`, or `0o` prefixes.
Warning: This does not _relocate_ to base, it simply starts
the output at `` (adding zero bytes such that the
output image can be loaded at `` instead of the
original ELF base)
- Path to input ELF
- Path to output file
To install this tool run: cargo install --path . Now you can use elfloader from anywhere in your shell! Dev This project was developed live here: https://www.youtube.com/watch?v=x0V-CEmXQCQ Example There's an example in example_small_program, simply run make or nmake and this should generate an example.bin which is 8 bytes. : 133700b0: 8b000020 add x0, x1, x0 133700b4: d65f03c0 ret">pleb@gamey ~/elfloader/example_small_program $ make
cargo build --release
Finished release [optimized] target(s) in 0.03s
elfloader --binary target/aarch64-unknown-none/release/example_small_program example.bin
pleb@gamey ~/elfloader/example_small_program $ ls -l ./example.bin
-rw-r--r-- 1 pleb pleb 8 Nov 8 12:27 ./example.bin
pleb@gamey ~/elfloader/example_small_program $ objdump -d target/aarch64-unknown-none/release/example_small_program
target/aarch64-unknown-none/release/example_small_program: file format elf64-littleaarch64
Disassembly of section .text:
00000000133700b0 :
133700b0: 8b000020 add x0, x1, x0
133700b4: d65f03c0 ret
Now you can write your shellcode in Rust, and you don't have to worry about whether you emit .data, .rodata, .bss, etc. This will handle it all for you! There's also an example with .bss and .rodata : 13370124: 90000000 adrp x0, 13370000 13370128: 90000008 adrp x8, 13370000 1337012c: 52800029 mov w9, #0x1 // #1 13370130: 91048000 add x0, x0, #0x120 13370134: 3904f109 strb w9, [x8, #316] 13370138: d65f03c0 ret pleb@gamey ~/elfloader/example_program_with_data $ readelf -l target/aarch64-unknown-none/release/example_program_with_data Elf file type is EXEC (Executable file) Entry point 0x13370124 There are 4 program headers, starting at offset 64 Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align LOAD 0x0000000000000120 0x0000000013370120 0x0000000013370120 0x0000000000000004 0x0000000000000004 R 0x1 LOAD 0x0000000000000124 0x0000000013370124 0x0000000013370124 0x0000000000000018 0x0000000000000018 R E 0x4 LOAD 0x000000000000013c 0x000000001337013c 0x000000001337013c 0x0000000000000000 0x0000000000000001 RW 0x4 GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 RW 0x0 Section to Segment mapping: Segment Sections... 00 .rodata 01 .text 02 .bss 03 ">pleb@gamey ~/elfloader/example_program_with_data $ make
cargo build --release
Finished release [optimized] target(s) in 0.04s
elfloader --binary target/aarch64-unknown-none/release/example_program_with_data example.bin
pleb@gamey ~/elfloader/example_program_with_data $ ls -l ./example.bin
-rw-r--r-- 1 pleb pleb 29 Nov 8 12:39 ./example.bin
pleb@gamey ~/elfloader/example_program_with_data $ objdump -d target/aarch64-unknown-none/release/example_program_with_data
___________________________
@hacking_Attack
@Hacking_Video
YouTube
Getting Rust running on Windows NT 4.0 MIPS64
In this stream we get Rust running on Windows NT 4.0 running on MIPS64. How cool is that!? We write an ELF to shellcode converter (https://github.com/gamozolabs/elfloader) and then a small network loader for downloading and executing these payloads inside…
target/aarch64-unknown-none/release/example_program_with_data: file format elf64-littleaarch64
Disassembly of section .text:
0000000013370124 :
13370124: 90000000 adrp x0, 13370000
13370128: 90000008 adrp x8, 13370000
1337012c: 52800029 mov w9, #0x1 // #1
13370130: 91048000 add x0, x0, #0x120
13370134: 3904f109 strb w9, [x8, #316]
13370138: d65f03c0 ret
pleb@gamey ~/elfloader/example_program_with_data $ readelf -l target/aarch64-unknown-none/release/example_program_with_data
Elf file type is EXEC (Executable file)
Entry point 0x13370124
There are 4 program headers, starting at offset 64
Program Headers:
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
LOAD 0x0000000000000120 0x0000000013370120 0x0000000013370120
0x0000000000000004 0x0000000000000004 R 0x1
LOAD 0x0000000000000124 0x0000000013370124 0x0000000013370124
0x0000000000000018 0x0000000000000018 R E 0x4
LOAD 0x000000000000013c 0x000000001337013c 0x000000001337013c
0x0000000000000000 0x0000000000000001 RW 0x4
GNU_STAC K 0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 RW 0x0
Section to Segment mapping:
Segment Sections...
00 .rodata
01 .text
02 .bss
03
Internals This tool doesn't care about anything except for LOAD sections. It determines the endianness (little vs big) and bitness (32 vs 64) from the ELF header, and from there it creates a flat image based on program header virtual addresses (where it's loaded), file size (number of initialized bytes) and mem size (size of actual memory (https://www.kitploit.com/search/label/Memory) region). The bytes are initialized from the file based on the offset and file size, and this is then extended with zeros until mem size (or truncated if mem size is smaller than file size). These LOAD sections are then concatenated together with zero-byte padding for gaps. This is designed to be incredibly simple, and agnostic to the ELF input. It could be an executable, object file, shared object, core dump, etc, doesn't really care. It'll simply give you the flat representation of the memory, nothing more. This allows you to turn any ELF into shellcode, or a simpler file format that is easier to load in hard-to-reach areas, like embedded (https://www.kitploit.com/search/label/Embedded) devices. Personally, I developed this for my MIPS (https://www.kitploit.com/search/label/MIPS) NT 4.0 loader which allows me to run Rust code. FELF0001 format This tool by default generates a FELF file format. This is a Falk ELF. This is a simple file format: - Rest of the file is the raw image, to be loaded at `base` and jumped into at `entry`">FELF0001 - Magic header
entry - 64-bit little endian integer of the entry point address
base - 64-bit little endian integer of the base address to load the image
- Rest of the file is the raw image, to be loaded at `base` and jumped
into at `entry`
Download Elfloader (https://github.com/gamozolabs/elfloader)
___________________________
@hacking_Attack
@Hacking_Video
Disassembly of section .text:
0000000013370124 :
13370124: 90000000 adrp x0, 13370000
13370128: 90000008 adrp x8, 13370000
1337012c: 52800029 mov w9, #0x1 // #1
13370130: 91048000 add x0, x0, #0x120
13370134: 3904f109 strb w9, [x8, #316]
13370138: d65f03c0 ret
pleb@gamey ~/elfloader/example_program_with_data $ readelf -l target/aarch64-unknown-none/release/example_program_with_data
Elf file type is EXEC (Executable file)
Entry point 0x13370124
There are 4 program headers, starting at offset 64
Program Headers:
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
LOAD 0x0000000000000120 0x0000000013370120 0x0000000013370120
0x0000000000000004 0x0000000000000004 R 0x1
LOAD 0x0000000000000124 0x0000000013370124 0x0000000013370124
0x0000000000000018 0x0000000000000018 R E 0x4
LOAD 0x000000000000013c 0x000000001337013c 0x000000001337013c
0x0000000000000000 0x0000000000000001 RW 0x4
GNU_STAC K 0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 RW 0x0
Section to Segment mapping:
Segment Sections...
00 .rodata
01 .text
02 .bss
03
Internals This tool doesn't care about anything except for LOAD sections. It determines the endianness (little vs big) and bitness (32 vs 64) from the ELF header, and from there it creates a flat image based on program header virtual addresses (where it's loaded), file size (number of initialized bytes) and mem size (size of actual memory (https://www.kitploit.com/search/label/Memory) region). The bytes are initialized from the file based on the offset and file size, and this is then extended with zeros until mem size (or truncated if mem size is smaller than file size). These LOAD sections are then concatenated together with zero-byte padding for gaps. This is designed to be incredibly simple, and agnostic to the ELF input. It could be an executable, object file, shared object, core dump, etc, doesn't really care. It'll simply give you the flat representation of the memory, nothing more. This allows you to turn any ELF into shellcode, or a simpler file format that is easier to load in hard-to-reach areas, like embedded (https://www.kitploit.com/search/label/Embedded) devices. Personally, I developed this for my MIPS (https://www.kitploit.com/search/label/MIPS) NT 4.0 loader which allows me to run Rust code. FELF0001 format This tool by default generates a FELF file format. This is a Falk ELF. This is a simple file format: - Rest of the file is the raw image, to be loaded at `base` and jumped into at `entry`">FELF0001 - Magic header
entry - 64-bit little endian integer of the entry point address
base - 64-bit little endian integer of the base address to load the image
- Rest of the file is the raw image, to be loaded at `base` and jumped
into at `entry`
Download Elfloader (https://github.com/gamozolabs/elfloader)
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.
Pen Testing vs Sec Manager Role
https://www.reddit.com/r/Pentesting/comments/skc69q/pen_testing_vs_sec_manager_role/
I am 31 and I have been working in cyber sec for few years now and have the opportunity to move away from my analyst role to a managerial role in security. At the same time I always loved pen testing and finally got qualified for it. There is a possibility that I can get a pen testing role but it will an starting point again and salary would be the same as my current. I like to know your opinion about if it worth it to move into pen testing world or just continue my broad security role and go into a managerial role with higher salary. Of course interest is the key in this but I think maybe if I move to pen testing then again I go back to square one and I will need few years to get to were I am now in my field.. would it still worth it? There is not right or wrong just general idea and comments plz submitted by /u/brucue (https://www.reddit.com/user/brucue)
[link] (https://www.reddit.com/r/Pentesting/comments/skc69q/pen_testing_vs_sec_manager_role/) [comments] (https://www.reddit.com/r/Pentesting/comments/skc69q/pen_testing_vs_sec_manager_role/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/Pentesting/comments/skc69q/pen_testing_vs_sec_manager_role/
I am 31 and I have been working in cyber sec for few years now and have the opportunity to move away from my analyst role to a managerial role in security. At the same time I always loved pen testing and finally got qualified for it. There is a possibility that I can get a pen testing role but it will an starting point again and salary would be the same as my current. I like to know your opinion about if it worth it to move into pen testing world or just continue my broad security role and go into a managerial role with higher salary. Of course interest is the key in this but I think maybe if I move to pen testing then again I go back to square one and I will need few years to get to were I am now in my field.. would it still worth it? There is not right or wrong just general idea and comments plz submitted by /u/brucue (https://www.reddit.com/user/brucue)
[link] (https://www.reddit.com/r/Pentesting/comments/skc69q/pen_testing_vs_sec_manager_role/) [comments] (https://www.reddit.com/r/Pentesting/comments/skc69q/pen_testing_vs_sec_manager_role/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
Pen Testing vs Sec Manager Role
I am 31 and I have been working in cyber sec for few years now and have the opportunity to move away from my analyst role to a managerial role in...
Black Hat Ethical Hacking
Offensive Security Tool: Stratus Red Team
Offensive Security Tool: Stratus Red Team
Black Hat Ethical Hacking
Offensive Security Tool: Stratus Red Team | Black Hat Ethical Hacking
Stratus Red Team is "Atomic Red Team" for the cloud, allowing to emulate offensive attack techniques in a granular and self-contained manner.