MakerDAO Launches $10m Bug Bounty On Immunefi
https://medium.com/immunefi/makerdao-launches-10m-bug-bounty-on-immunefi-56172b0ea508?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Immunefi has grown by leaps & bounds since we first launched in December 2020 and now protects over $100 billion (that’s Billion with a B)…Continue reading on Immunefi » (https://medium.com/immunefi/makerdao-launches-10m-bug-bounty-on-immunefi-56172b0ea508?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Php-Malware-Finder - Detect Potentially Malicious PHP Files
http://www.kitploit.com/2022/02/php-malware-finder-detect-potentially.html

___________________________
@hacking_Attack
@Hacking_Video

PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files using PHP functions often used in malwares/webshells. The following list of encoders/obfuscators/webshells are also detected: Bantam (https://github.com/gellin/bantam) Best PHP Obfuscator (http://www.pipsomania.com/best_php_obfuscator.do) Carbylamine (https://code.google.com/p/carbylamine/) Cipher Design (http://cipherdesign.co.uk/service/php-obfuscator) Cyklodev (http://sysadmin.cyklodev.com/online-php-obfuscator/) Joes Web Tools Obfuscator (http://www.joeswebtools.com/security/php-obfuscator/) P.A.S (http://profexer.name/pas/download.php) PHP Jiami (http://www.phpjiami.com/) Php (http://w3webtools.com/encode-php-online/)Obfuscator (https://www.kitploit.com/search/label/Obfuscator) Encode SpinObf (http://mohssen.org/SpinObf.php) Weevely3 (https://github.com/epinna/weevely3) atomiku (http://atomiku.com/online-php-code-obfuscator/) cobra obfuscator (http://obfuscator.uk/example/) nano (https://github.com/UltimateHackers/nano) novahot (https://github.com/chrisallenlane/novahot) phpencode (http://phpencode.org/) tennc (http://tennc.github.io/webshell/) web-malware-collection (https://github.com/nikicat/web-malware-collection) webtoolsvn (http://www.webtoolsvn.com/en-decode/) Of course it's trivial to bypass PMF, but its goal is to catch kiddies and idiots, not people with a working brain. If you report a stupid tailored bypass for PMF, you likely belong to one (or both) category, and should re-read the previous statement.
How does it work? Detection is performed by crawling (https://www.kitploit.com/search/label/Crawling) the filesystem (https://www.kitploit.com/search/label/Filesystem) and testing files against a set (https://github.com/jvoisin/php-malware-finder/blob/master/php-malware-finder/php.yar) of YARA (http://virustotal.github.io/yara/) rules. Yes, it's that simple! Instead of using an hash-based approach, PMF tries as much as possible to use semantic patterns, to detect things like "a $_GET variable is decoded two times, unzipped, and then passed to some dangerous function like system". Installation Install Yara (https://yara.readthedocs.io/en/stable/gettingstarted.html#compiling-and-installing-yara).
This is also possible via some Linux package managers: Debian: sudo apt-get install yara Red Hat: yum install yara (requires the EPEL repository (https://fedoraproject.org/wiki/EPEL)) You can also compile it from source: git clone git@github.com:VirusTotal/yara.git
cd yara/
YACC=bison ./configure
make
Download php-malware-finder git clone https://github.com/jvoisin/php-malware-finder.git How to use it? ... -c Optional path to a rule file -f Fast mode -h Show this help message -t Specify the number of threads to use (8 by default) -v Verbose mode">$ ./phpmalwarefinder -h
Usage phpmalwarefinder [-cfhtvl] ...
-c Optional path to a rule file
-f Fast mode
-h Show this help message
-t Specify the number of threads to use (8 by default)
-v Verbose mode
Or if you prefer to use yara: $ yara -r ./php.yar /var/www
Please keep in mind that you should use at least YARA 3.4 because we're using hashes (https://yara.readthedocs.org/en/latest/modules/hash.html) for the whitelist system, and greedy regexps. Please note that if you plan to build yara from sources, libssl-dev must be installed on your system in order to have support for hashes. Oh, and by the way, you can run the comprehensive testsuite with make tests. Whitelisting Check the whitelist.yar (https://github.com/jvoisin/php-malware-finder/blob/master/php-malware-finder/whitelist.yar) file. If you're lazy, you can generate whitelists (https://www.kitploit.com/search/label/Whitelists) for entire folders with the generate_whitelist.py (https://github.com/jvoisin/php-malware-finder/blob/master/php-malware-finder/utils/generate_whitelist.py) script. Why should

___________________________
@hacking_Attack
@Hacking_Video

I use it instead of something else? Because: It doesn't use a single rule per sample (https://github.com/Neo23x0/signature-base/blob/e264d66a8ea3be93db8482ab3d639a2ed3e9c949/yara/thor-webshells.yar), since it only cares about finding malicious patterns, not specific webshells It has a complete testsuite (https://travis-ci.org/jvoisin/php-malware-finder), to avoid regressions Its whitelist (https://www.kitploit.com/search/label/Whitelist) system doesn't rely on filenames It doesn't rely on (slow) entropy computation (https://en.wikipedia.org/wiki/Entropy_(information_theory)) It uses a ghetto-style static analysis, instead of relying on file hashes Thanks to the aforementioned pseudo-static analysis, it works (especially) well on obfuscated files Licensing PHP-malware-finder is licensed (https://github.com/jvoisin/php-malware-finder/blob/master/php-malware-finder/LICENSE) under the GNU Lesser General Public License v3. The amazing YARA project is licensed under the Apache v2.0 license. Patches, whitelists or samples are of course more than welcome.

Download Php-Malware-Finder (https://github.com/jvoisin/php-malware-finder)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Php-Malware-Finder - Detect Potentially Malicious PHP Files

https://blogger.googleusercontent.com/img/a/AVvXsEh0XU0atowLaU2nYLZkL0QS0iy4y9FJuXue0grihUCQt7HH6jorFAZkgDTaLJP0kgnomkLl-tx58tmxU_1XtxUvyOZ9xDkPlo4bck7nCy834JFdpGCF2PyhiB3XAR0sSB2XuDIgzbisXx_xHpyllCnZbWA8Mn4fxI20ebmvlek2NTQaVe59hP_plsoy=w640-h390 PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files using PHP functions often used in malwares/webshells.

The following list of encoders/obfuscators/webshells are also detected:

* Bantam
* Best PHP Obfuscator
* Carbylamine
* Cipher Design
* Cyklodev
* Joes Web Tools Obfuscator
* P.A.S
* PHP Jiami
* Php Obfuscator Encode
* SpinObf
* Weevely3
* atomiku
* cobra obfuscator
* nano
* novahot
* phpencode
* tennc
* web-malware-collection
* webtoolsvn

Of course it's trivial to bypass PMF, but its goal is to catch kiddies and idiots, not people with a working brain. If you report a stupid tailored bypass for PMF, you likely belong to one (or both) category, and should re-read the previous statement. How does it work?Detection is performed by crawling the filesystem and testing files against a set of YARA rules. Yes, it's that simple!

Instead of using an hash-based approach, PMF tries as much as possible to use semantic patterns, to detect things like "a $_GETvariable is decoded two times, unzipped, and then passed to some dangerous function like system". Installation* Install Yara.
This is also possible via some Linux package managers:
* Debian: sudo apt-get install yara* Red Hat: yum install yara(requires the EPEL repository)
You can also compile it from source: git clone git@github.com:VirusTotal/yara.git
cd yara/
YACC=bison ./configure
make * Download php-malware-finder git clone https://github.com/jvoisin/php-malware-finder.gitHow to use it?$ ./phpmalwarefinder -h
Usage phpmalwarefinder [-cfhtvl] Or if you prefer to use yara: $ yara -r ./php.yar /var/www Please keep in mind that you should use at least YARA 3.4 because we're using hashes for the whitelist system, and greedy regexps. Please note that if you plan to build yara from sources, libssl-dev must be installed on your system in order to have support for hashes.

Oh, and by the way, you can run the comprehensive testsuite with make tests. WhitelistingCheck the whitelist.yar file. If you're lazy, you can generate whitelists for entire folders with the generate_whitelist.py script. Why should I use it instead of something else?Because:

* It doesn't use a single rule per sample, since it only cares about finding malicious patterns, not specific webshells
* It has a complete testsuite, to avoid regressions
* Its whitelist system doesn't rely on filenames
* It doesn't rely on (slow) entropy computation
* It uses a ghetto-style static analysis, instead of relying on file hashes
* Thanks to the aforementioned pseudo-static analysis, it works (especially) well on obfuscated files LicensingPHP-malware-finder is licensed under the GNU Lesser General Public License v3.

The amazing YARA project is licensed under the Apache v2.0 license.

Patches, whitelists or samples are of course more than welcome. Download Php-Malware-Finder

___________________________
@hacking_Attack
@Hacking_Video

MakerDAO Launches $10m Bug Bounty On Immunefi

Immunefi has grown by leaps & bounds since we first launched in December 2020 and now protects over $100 billion (that’s Billion with a B)…Continue reading on Immunefi »
Read more...

Php-Malware-Finder - Detect Potentially Malicious PHP Files

PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files using PHP functions often used in malwares/webshells. The following list of encoders/obfuscators/webshells are also detected: Bantam Best PHP Obfuscator Carbylamine Cipher Design Cyklodev Joes Web Tools Obfuscator P.A.S PHP Jiami Php Obfuscator Encode SpinObf Weevely3 atomiku cobra obfuscator nano novahot phpencode tennc web-malware-collection webtoolsvn Of course it's trivial to bypass PMF, but its goal is to catch kiddies and idiots, not people with a working brain. If you report a stupid tailored bypass for PMF, you likely belong to one (or both) category, and should re-read the previous statement. How does it work? Detection is performed by crawling the filesystem and testing files against a set of YARA rules. Yes, it's that simple! Instead of using an hash-based approach, PMF tries as much as possible to use semantic patterns, to detect things like "a $_GET variable is decoded two times, unzipped, and then passed to some dangerous function like system". Installation Install Yara. This is also possible via some Linux package managers: Debian: sudo apt-get install yara Red Hat: yum install yara (requires the EPEL repository) You can also compile it from source: git clone git@github.com:VirusTotal/yara.gitcd yara/YACC=bison ./configuremake Download php-malware-finder git clone https://github.com/jvoisin/php-malware-finder.git How to use it? $ ./phpmalwarefinder -hUsage phpmalwarefinder -cfhtvl ... -c Optional path to a rule file -f Fast mode -h Show this help message -t Specify the number of threads to use (8 by default) -v Verbose mode Or if you prefer to use yara: $ yara -r ./php.yar /var/www Please keep in mind that you should use at least YARA 3.4 because we're using hashes for the whitelist system, and greedy regexps. Please note that if you plan to build yara from sources, libssl-dev must be installed on your system in order to have support for hashes. Oh, and by the way, you can run the comprehensive testsuite with make tests. Whitelisting Check the whitelist.yar file. If you're lazy, you can generate whitelists for entire folders with the generate_whitelist.py script. Why should I use it instead of something else? Because: It doesn't use a single rule per sample, since it only cares about finding malicious patterns, not specific webshells It has a complete testsuite, to avoid regressions Its whitelist system doesn't rely on filenames It doesn't rely on (slow) entropy computation It uses a ghetto-style static analysis, instead of relying on file hashes Thanks to the aforementioned pseudo-static analysis, it works (especially) well on obfuscated files Licensing PHP-malware-finder is licensed under the GNU Lesser General Public License v3. The amazing YARA project is licensed under the Apache v2.0 license. Patches, whitelists or samples are of course more than welcome. Download Php-Malware-Finder
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Titaniam Secures $6 Million in Seed Funding

Funding round led by Refinery Ventures, with participation from Fusion Fund and Shasta Ventures.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Allure Security Raises $6.8 Million Seed Funding Round

Funding led by Gutbrain Ventures.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Orca Security Adds Expanded CIEM Capabilities and Multi-Cloud Security Score to Cloud Platform

Expands cloud infrastructure entitlement management capabilities, adds cloud security benchmarking, and support for Kubernetes compliance frameworks.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Defense Contractors Need to Check Their Six

Companies overall met government standards, but poor credential management left vulnerabilities.

Dark Reading: Attacks/Breaches
Dynatrace Launches DevSecOps Automation Alliance Partner Program

Program enables alliance and solution partners to extend the capabilities of their DevSecOps offerings through seamless integrations with the Dynatrace platform.

___________________________
@hacking_Attack
@Hacking_Video