Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools!
Autotimeliner - Automagically Extract Forensic Timeline From Volatile Memory Dump

http://2.bp.blogspot.com/-W2Z-SKv-dq4/Yd0eVCla67I/AAAAAAAA8jE/S77Wdb-UiW0Fb_NqRh5F6q-rgMTxAVwDQCK4BGAYYCw/w640-h376/autotimeliner_1-771906.gif
Automagically extract forensic timeline from volatile memory dumps.

Requirements

* Python 3
* Volatility
* mactime (from SleuthKit)

(Developed and tested on Debian 9.6 with Volatility 2.6-1 and sleuthkit 4.4.0-5)
How it works

AutoTimeline automates this workflow:

* Identify correct volatility profile for the memory image.
* Runs the timeliner plugin against volatile memory dump using volatility.
* Runs the mftparser volatility plugin, in order to extract $MFT from memory and generate a bodyfile.
* Runs the shellbags volatility plugin in order to generate a bodyfile of the user activity. (suggested by Matteo Cantoni).
* Merges the timeliner, mftparser and shellbags output files into a single bodyfile.
* Sorts and filters the bodyfile using mactime and exports data as CSV.

Installation

Simply clone the GitHub repository:

git clone https://github.com/andreafortuna/autotimeliner.git

Usage

Memory dump file -t TIMEFRAME, --timeframe TIMEFRAME Timeframe used to filter the timeline (YYYY-MM-DD ..YYYY-MM-DD) -p CUSTOMPROFILE, --customprofile CUSTOMPROFILE Jump image identification and use a custom memory profile">

autotimeline.py [-h] -f IMAGEFILE [-t TIMEFRAME] [-p CUSTOMPROFILE]

optional arguments:
-h, --help            show this help message and exit
-f IMAGEFILE, --imagefile IMAGEFILE
Memory dump file
-t TIMEFRAME, --timeframe TIMEFRAME
Timeframe used to filter the timeline (YYYY-MM-DD
..YYYY-MM-DD)
-p CUSTOMPROFILE, --customprofile CUSTOMPROFILE
Jump image identification and use a custom memory
profile

Examples

Extract timeline from TargetServerMemory.raw, limited to a timeframe from 2018-10-17 to 2018-10-21:

./autotimeline.py -f TargetServerMemory.raw -t 2018-10-17..2018-10-21

Extract timeline from all images in current directory, limited to a timeframe from 2018-10-17 to 2018-10-21:

./autotimeline.py -f ./*.raw -t 2018-10-17..2018-10-21

Extract timeline from TargetServerMemory.raw, using a custom memory profile:

./autotimeline.py -f TargetServerMemory.raw -p Win2008R2SP1x64

All timelines will be saved as $ORIGINALFILENAME-timeline.csv.

TODO

* Better image identification
* Better error trapping
Download Autotimeliner

6 views12:42

Continuing with Computer engineering degree VS online WGU degree ?
https://www.reddit.com/r/Pentesting/comments/ss9pk5/continuing_with_computer_engineering_degree_vs/

So i am studying computer engineering, i have like 1.5 years left to graduate and i hate everything about it. i can drop out easily and join an online cyber security school like WGU and prolly finish it in 6 months, but i need solid advice as this is a big step for me, is a cyber security degree from WGU valuable on the resume just like an engineering degree would ? i heard that employers wont be impressed by a degree you can get in 6 months, so is it worth the transition ?  submitted by /u/watermelonSoundsNice (https://www.reddit.com/user/watermelonSoundsNice)
[link] (https://www.reddit.com/r/Pentesting/comments/ss9pk5/continuing_with_computer_engineering_degree_vs/) [comments] (https://www.reddit.com/r/Pentesting/comments/ss9pk5/continuing_with_computer_engineering_degree_vs/)

8 views14:23

Hacking Articles Tips Tricks Videos Tutorials

Autotimeliner - Automagically Extract Forensic Timeline From Volatile Memory Dump

Automagically extract forensic timeline from volatile memory dumps. Requirements Python 3 Volatility mactime (from SleuthKit) (Developed and tested on Debian 9.6 with Volatility 2.6-1 and sleuthkit 4.4.0-5) How it works AutoTimeline automates this workflow: Identify correct volatility profile for the memory image. Runs the timeliner plugin against volatile memory dump using volatility. Runs the mftparser volatility plugin, in order to extract $MFT from memory and generate a bodyfile. Runs the shellbags volatility plugin in order to generate a bodyfile of the user activity. (suggested by Matteo Cantoni). Merges the timeliner, mftparser and shellbags output files into a single bodyfile. Sorts and filters the bodyfile using mactime and exports data as CSV. Installation Simply clone the GitHub repository: git clone https://github.com/andreafortuna/autotimeliner.git Usage Memory dump file -t TIMEFRAME, --timeframe TIMEFRAME Timeframe used to filter the timeline (YYYY-MM-DD ..YYYY-MM-DD) -p CUSTOMPROFILE, --customprofile CUSTOMPROFILE Jump image identification and use a custom memory profile">autotimeline.py -h -f IMAGEFILE -t TIMEFRAME -p CUSTOMPROFILEoptional arguments: -h, --help show this help message and exit -f IMAGEFILE, --imagefile IMAGEFILE Memory dump file -t TIMEFRAME, --timeframe TIMEFRAME Timeframe used to filter the timeline (YYYY-MM-DD ..YYYY-MM-DD) -p CUSTOMPROFILE, --customprofile CUSTOMPROFILE Jump image identification and use a custom memory profile Examples Extract timeline from TargetServerMemory.raw, limited to a timeframe from 2018-10-17 to 2018-10-21: ./autotimeline.py -f TargetServerMemory.raw -t 2018-10-17..2018-10-21 Extract timeline from all images in current directory, limited to a timeframe from 2018-10-17 to 2018-10-21: ./autotimeline.py -f ./*.raw -t 2018-10-17..2018-10-21 Extract timeline from TargetServerMemory.raw, using a custom memory profile: ./autotimeline.py -f TargetServerMemory.raw -p Win2008R2SP1x64 All timelines will be saved as $ORIGINALFILENAME-timeline.csv. TODO Better image identification Better error trapping Download Autotimeliner
Read more...

GitHub

GitHub - andreafortuna/autotimeliner: Automagically extract forensic timeline from volatile memory dump

Automagically extract forensic timeline from volatile memory dump - andreafortuna/autotimeliner

5 views14:23

Hacking Articles Tips Tricks Videos Tutorials

How to exploit 'gateway.php' for a CTF?
https://www.reddit.com/r/Pentesting/comments/ss9tls/how_to_exploit_gatewayphp_for_a_ctf/

I am trying to solve a CTF which is supposed to be basic. It has this login page called 'gateway.php'. I am not able to figure out how to exploit it. I understand that a "Authentication Bypass" attack is what I need to do, but I don't know how to. All help will be highly appreciated.  submitted by /u/elpasolol (https://www.reddit.com/user/elpasolol)
[link] (https://www.reddit.com/r/Pentesting/comments/ss9tls/how_to_exploit_gatewayphp_for_a_ctf/) [comments] (https://www.reddit.com/r/Pentesting/comments/ss9tls/how_to_exploit_gatewayphp_for_a_ctf/)

5 views14:24

Hacking Articles Tips Tricks Videos Tutorials

5 views14:52

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
BlackByte Ransomware Group Attacked San Francisco 49ers Ahead of Super Bowl

https://external-preview.redd.it/mMo9GNNPx3e8q99tHRDb9tTKNpuZThWbOqBp94Akt3w.jpg?width=640&crop=smart&auto=webp&s=f159bb24fc5ad0b3393f1a6482614d48c4802fbb submitted by /u/djuyera
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

BlackByte Ransomware Group Attacked San Francisco 49ers Ahead of...

Posted in r/hacking by u/djuyera • 1 point and 0 comments

5 viewsedited 14:52

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
How safe my MAC 2015 webcam is?

Hey guys,

I had a intimate situation last night, watching porn etc. I totally forgot to put a tape cover over my camera lenses and now I cant stop obsessing if someone caught me or not. My light on camera haven't lit up or anything. There was a Apple statement how only way your camera can be turned on is with it's light.

submitted by /u/racunarski
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How safe my MAC 2015 webcam is?

Hey guys, I had a intimate situation last night, watching porn etc. I totally forgot to put a tape cover over my camera lenses and now I cant...

6 viewsedited 14:52

Hacking Articles Tips Tricks Videos Tutorials

Research on Clickjacking & Network Sniffing- Cyber Sapiens Internship Task-14

Hello guys👋👋 ,Prajit here from the BUG XS Team and Cyber Sapiens United LLP Cybersecurity and Red Team Intern, in this I am regularly…Continue reading on Medium »
Read more...

7 views15:25

Hacking Articles Tips Tricks Videos Tutorials

9 views15:35

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
Haptyc : Test Generation Framework

Haptyc is a python library which was built to add payload position support and Sniper/Clusterbomb/Batteringram/Pitchfork attack types into Turbo Intruder. While Haptyc accomplishes these goals fairly well it also introduces a simpler way to express test sequences in general. While this library was meant to target Turbo Intruder it has no hard dependencies on Turbo Intruder and can be used anywhere one requires test generation in a Python context. Unfortunately at this time since Haptyc was built for a jython interpreter it only supports Python 2.7 (however future changes will fix this). What are Haptyc tags?

Haptyc tags are tags which a tester can use to annotate an original input payload. A tester can use multiple tags to surround key pieces of data in an HTTP request to wrap it as a positional payload. When tests are being generated Haptyc will parse all the tags in the original payload and generate tests in accordance to the functions associated with the tag names. When Haptyc evaluates a Haptyc tag it will execute the associated tag function (this is called a Haptyc Transform) for a test payload to place in position of the associated tag in the request. Every tag function will receive a data argument and a state argument. The data argument may contain the inner data of the tag or may contain some other test payload sequence. The state argument is a state object associated with the tag where state can be stored between test iterations. Let’s review an example. Example 1: Simple list iteration

Original Payload

GET /animal/[+GuessAnimal]dog[+end] HTTP/1.1

Haptyc Class & Haptyc Transform

from haptyc import *
original = “GET /animal/[+GuessAnimal]dog[+end] HTTP/1.1”
class TestLogic(Transform):
@ApplyList([“snake”,”cat”,”owl”,”lion”])
def test_GuessAnimal(self, data, state):
return data + “?original=” + self.inner() + “&attempt=” + str(state.iter)
TestFactory = TestLogic(original)
for test in TestFactory:
print(test)

Tests Generated

GET /animal/snake?original=dog&attempt=0 HTTP/1.1
GET /animal/cat?original=dog&attempt=1 HTTP/1.1
GET /animal/owl?original=dog&attempt=2 HTTP/1.1
GET /animal/lion?original=dog&attempt=3 HTTP/1.1

In the example above we how one can express tests in a simple way using Haptyc. First the Haptyc library is imported. Second we have defined the original data with our Haptyc tag annotations (GuessAnimal). Next the TestLogic class is defined and extended as a Transform class. Inside this class every method that starts with test_will get registered as a Haptyc tag for evaluation in the original payload. We use a logic decorator to apply the state logic for this Haptyc transform. In this case we use the @ApplyList(list)decorator to tell Haptyc to generate a test for every item in the specified list and place that item into the Haptyc transform as the data argument. Inside the transform we return a mutated version of the data to insert back into the position of the tag. In this case the mutation is the list item as data concatenated with the data surrounded by the tag (dog) and then concatentated with the iter value in the state object. Lastly the remaining python shows the TestFactory object being created and all tests being generated in a for loop iterator. This is an example of a standard sniper-style attack which targets a single payload position. Next lets look at other style of attacks. Example 2: Clusterbomb

Original Payload

GET /animal?type=[%type]dog[%end]&name=[%name]fido[%end] HTTP/1.1

Haptyc Class & Haptyc Transform

from haptyc import *
original = “GET /animal?type=[%type]dog[%end]&name=[%name]fido[%end] HTTP/1.1”
class TestLogic(Transform):
@ApplyList(“snake”,”cat”,”owl”,”lion”)
def test_type(self, data, state):
return data
@ApplyList(“Frank”, “Lisa”, “Jin”, “Tooth”)
def test_name(self, data, [...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Haptyc : Test Generation Framework !!! Kali Linux Tutorials

Haptyc is a python library which was built to add payload position support and Sniper/Clusterbomb/Batteringram/Pitchfork attack.

6 viewsedited 15:35

Hacking Articles Tips Tricks Videos Tutorials

6 views15:35

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
Jektor : A Windows User-Mode Shellcode Execution Tool That Demonstrates Various Techniques That Malware Uses

Jektor utility focuses on shellcode injection techniques to demonstrate methods that malware may use to execute shellcode on a victim system

* Dynamically resolves API functions to evade IAT inclusion
* Includes usage of undocumented NT Windows API functions
* Supports local shellcode execution via CreateThread
* Supports remote shellcode execution via CreateRemoteThread
* Supports local shellcode injection via QueueUserAPC
* Supports local shellcode injection via EnumTimeFormatsEx
* Supports local shellcode injection via CreateFiber
https://blogger.googleusercontent.com/img/a/AVvXsEia5oKTx6SrjIrFmXdZuxHlpbqKsCPQHCqxmsxt-5CbBbcrdOJbjG-tQCGYQTgvaTUhN4CZwSCsr-nTfFk3XVT2ASMiiL-Aa2rSmrKT2ADCcLxUcqeGA3g99dAqZSKC5LA4WIM0SjCg7VFAUMZs0mvnel7Xu7eJmqCVe_omAbMKV2iZCPuj202rd3UG=s815
Anti-virus detection?

Pre-pending a set of NOPs to a Msfvenom XOR encrypted shellcode payload while using dynamic function address resolutions seems to bypass Windows Defender. IAT Import Evasion

Jektor makes use of dynamic function address resolutions using LoadLibrary and GetProcessAddress to make static analysis more difficult.

Important functions such as VirtualAlloc are not directly called which makes debugging and dumping the shellcode through breakpoints more difficult. Local shellcode execution via CreateThread

On Windows when you want to create a new thread for the current process you can call the CreateThread function, this is the most basic technique for executing malicious code or shellcode within a process. You can simply allocate a region of memory for your shellcode, move your shellcode into the allocated region, and then call CreateThread with a pointer to the address of the allocated region. When you call CreateThread you pass the lpStartAddress parameter which is a pointer to the application-defined function that will be executed by the newly created thread.
https://blogger.googleusercontent.com/img/a/AVvXsEhgOktF__J48nylqqgL9PJvDpYASLUejbxSQUDfBzZvFD2kxLyOEeX8yxBbeOi9Dldjd9vgQFskcJtGfgCpa3K55heAgebg73wfaBPGOHREPWnaIiSxcYljeiUAbJZGuerR-961JWZ8sF_Z-bKvh57vmbw7g4F8Fm9gOHwpL71HT0-O3pRXwkyTFkcx=s812
* Allocate a region of memory big enough for the shellcode using VirtualAlloc
* Move the globally defined shellcode buffer into the newly allocated memory region with memcpy/RtlCopyMemory
* Create a new thread that includes the base address of the allocated memory region with CreateThread
* Wait for the new thread to be created/executed with WaitForSingleObject to ensure the payload detonates

After the memory region for the shellcode payload is allocated as RWX and the payload is moved into it, you can easily discover this region of memory by looking for any region of memory in the process that is marked as RWX, then if you inspect it you can seen the shellcode payload was moved into it, highlighted below are the first five bytes of the shellcode payload that executes a calculator on the victim system.
https://blogger.googleusercontent.com/img/a/AVvXsEjv4uwQgaqsnvZw74jq7DXTR5QpIq4KUZTsF28KBeClaihR24VwaXzYUDXRTxE96xyz2LL50Wgu4ys68OkS3CFWmCeS2kJrS4n_XdLNQfhPI7ydbo5ILKsocT__4mY5gm-HWTGKPGz0zb3uzoJZ0YMUYEzhQwmEKreN72EtcL54ny0UKOwePkvvqbi7=s576
Hunting for RWX regions of memory is a quick way to identify potentially malicious activity on your system. Keep in mind, actors can also allocate a memory region as PAGE_READWRITE, write their shellcode into it, and then switch it to exectuable via VirtualProtect later on, this can help evade detection of a PAGE_EXECUTE_READWRITE memory region.
https://blogger.googleusercontent.com/img/a/AVvXsEhu_YUrhQ8kxDPtUTI3vAlnbOtKTANx6YSDNxCxjH7wUaLRAI4GVZuAuNgwTfpma0L1xvn7ANjVpF3wCdnfxaNvopm-Way4msuPsArgdsqOqh29C8w1IDgbbUVn7XC1W9oKl_BH0m4PtQ26QLt7cvjAr7s20NpoLyRvU5qACKGoJa8NYk-tv9ooKEYz=s[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Jektor : A Windows User-Mode Shellcode Execution Tool

Jektor utility focuses on shellcode injection techniques to demonstrate methods that malware may use to execute shellcode on a victim system.

4 viewsedited 15:35

Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials Haptyc : Test Generation Framework Haptyc is a python library which was built to add payload position support and Sniper/Clusterbomb/Batteringram/Pitchfork attack types into Turbo Intruder. While Haptyc accomplishes these goals fairly…

state):
return data
TestFactory = TestLogic(original)
for test in TestFactory:
print(test)

Tests Generated

GET /animal?type=snake&name=Frank HTTP/1.1
GET /animal?type=snake&name=Lisa HTTP/1.1
GET /animal?type=snake&name=Jin HTTP/1.1
GET /animal?type=snake&name=Tooth HTTP/1.1
GET /animal?type=cat&name=Frank HTTP/1.1
GET /animal?type=cat&name=Lisa HTTP/1.1
GET /animal?type=cat&name=Jin HTTP/1.1
GET /animal?type=cat&name=Tooth HTTP/1.1
GET /animal?type=owl&name=Frank HTTP/1.1
GET /animal?type=owl&name=Lisa HTTP/1.1
GET /animal?type=owl&name=Jin HTTP/1.1
GET /animal?type=owl&name=Tooth HTTP/1.1
GET /animal?type=lion&name=Frank HTTP/1.1
GET /animal?type=lion&name=Lisa HTTP/1.1
GET /animal?type=lion&name=Jin HTTP/1.1
GET /animal?type=lion&name=Tooth HTTP/1.1

Example 1 showed how to evaluate transforms sniper style by using the ‘+’ sign annotation in the tag [+tag][+end]. Example 2 shows how we can use 2 transforms/positions to conduct a clusterbomb-style of attack. As you can see we use 2 separate transform tags called [%type][%end]and [%name][%end]. The ‘%’ sign tells Haptyc to evaluate these transforms clusterbomb-style, for every payload in the first transform create a test with the payload from the second transform. The test count is the number of tests of every transform involved multiplied by each other. Example 3: Pitchfork/BatteringRam

Using the same exact python code we can switch the attack style from clusterbomb to pitchfork by changing the ‘%’ to a ‘#’. Pitchfork style attacks will place the position payload all in parallel. The test count is the lowest number of tests given of all involved transforms.

Original Payload

GET /animal?type=[#type]dog[#end]&name=[#name]fido[#end] HTTP/1.1

Tests Generated

GET /animal?type=snake&name=Frank HTTP/1.1
GET /animal?type=cat&name=Lisa HTTP/1.1
GET /animal?type=owl&name=Jin HTTP/1.1
GET /animal?type=lion&name=Tooth HTTP/1.1

Example 4: Persistent Transforms

Original Payload

GET /animal?type=dog&id=[+idor]0[+end]&process=[@randbool]False[@end] HTTP/1.1

Haptyc Class & Haptyc Transform

from haptyc import *
import random
original = “GET /animal?type=dog&id=[+idor]0[+end]&process=[@randbool]False[@end] HTTP/1.1”
class TestLogic(Transform):
@ApplyIteration(10)
def test_idor(self, data, state):
return str(state.iter)
def per_randbool(self, data):
return random.choice([“True”, “False”])
TestFactory = TestLogic(original)
for test in TestFactory:
print(test)

Tests Generated

GET /animal?type=dog&id=0&process=False HTTP/1.1
GET /animal?type=dog&id=1&process=True HTTP/1.1
GET /animal?type=dog&id=2&process=False HTTP/1.1
GET /animal?type=dog&id=3&process=True HTTP/1.1
GET /animal?type=dog&id=4&process=False HTTP/1.1
GET /animal?type=dog&id=5&process=True HTTP/1.1
GET /animal?type=dog&id=6&process=False HTTP/1.1
GET /animal?type=dog&id=7&process=True HTTP/1.1
GET /animal?type=dog&id=8&process=False HTTP/1.1
GET /animal?type=dog&id=9&process=False HTTP/1.1

Persistent transforms are denoted by the ‘@’ sign and the transform functions always start with per_this is because these transforms are not iterative, they don’t create tests or keep state. These transforms are just naive transformation which you can apply anywhere in the payload for a state-less transformation without affecting the stateful transforms. Since they don’t prescribe any tests you cannot generate tests with persistent transforms alone, they are meant to be mixed with iterative transforms. In the example above we have a 10-test snipe style transform placing an incrementing id. Also we have a persistent transform which places a random boolean into its position. Example 5: Using state and state.init

There may be cases where prior to the start of a test sequence the tester may want to perform some processing/initialization. To support this Haptyc executes all involved transforms for an i[...]

___________________________
@hacking_Attack
@Hacking_Video

4 viewsedited 15:35

About

Blog

Apps

Platform