Kali Linux Tutorials
Log4J-Detector : Detects Log4J versions on your file-system within any application that are vulnerable to CVE-2021-44228 and CVE-2021-45046

Log4J-Detector is a Scanner that detects vulnerable Log4J versions to help teams assess their exposure to CVE-2021-44228 (CRITICAL), CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. Can search for Log4J instances by carefully examining the complete file-system, including all installed applications. It is able to find Log4J instances that are hidden several layers deep. Works on Linux, Windows, and Mac, and everywhere else Java runs, too!

Introduction

Currently reports log4j-core versions 2.3.2, 2.12.4, and 2.17.1 as _SAFE_, 2.3.1, 2.12.2, 2.12.3, 2.15.0, 2.16.0, and 2.17.0 as _OKAY_ and all other versions as _VULNERABLE_ (although it does report pre-2.0-beta9 as _POTENTIALLY_SAFE_). It reports older log4j-1.x versions as _OLD_.

Can correctly detect log4j inside executable spring-boot jars/wars, dependencies blended into uber jars, shaded jars, and even exploded jar files just sitting uncompressed on the file-system (aka *.class).

We currently maintain a collection of log4j-samples we use for testing.

Example Usage

java -jar log4j-detector-2021.12.29.jar ./samples

— github.com/mergebase/log4j-detector v2021.12.29 (by mergebase.com) analyzing paths (could take a while).
— Note: specify the ‘–verbose’ flag to have every file examined printed to STDERR.
false-hits/log4j-core-2.12.2.jar contains Log4J-2.x == 2.12.2 OKAY
false-hits/log4j-core-2.12.3.jar contains Log4J-2.x == 2.12.3 OKAY
false-hits/log4j-core-2.12.4.jar contains Log4J-2.x == 2.12.4 SAFE
false-hits/log4j-core-2.15.0.jar contains Log4J-2.x == 2.15.0 OKAY
false-hits/log4j-core-2.16.0.jar contains Log4J-2.x == 2.16.0 OKAY
false-hits/log4j-core-2.17.0.jar contains Log4J-2.x == 2.17.0 OKAY
false-hits/log4j-core-2.17.1.jar contains Log4J-2.x >= 2.17.1 SAFE
false-hits/log4j-core-2.3.1.jar contains Log4J-2.x == 2.3.1 OKAY
false-hits/log4j-core-2.3.2.jar contains Log4J-2.x == 2.3.2 SAFE
true-hits/log4j-core-2.0-beta9.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.10.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE
true-hits/log4j-core-2.10.0.zip contains Log4J-2.x >= 2.10.0 VULNERABLE
true-hits/log4j-core-2.11.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE
true-hits/log4j-core-2.11.1.jar contains Log4J-2.x >= 2.10.0 VULNERABLE
true-hits/log4j-core-2.11.2.jar contains Log4J-2.x >= 2.10.0 VULNERABLE
true-hits/log4j-core-2.12.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE
true-hits/log4j-core-2.12.1.jar contains Log4J-2.x >= 2.10.0 VULNERABLE
true-hits/log4j-core-2.14.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE
true-hits/log4j-core-2.14.1.jar contains Log4J-2.x >= 2.10.0 VULNERABLE
true-hits/log4j-core-2.2.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.3.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.4.1.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.4.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.9.1.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE
old-hits/log4j-1.1.3.jar contains Log4J-1.x <=OLD
old-hits/log4j-1.2.17.jar contains Log4J-1.x <=OLD
old-hits/log4j-core-2.0-beta2.jar contains Log4J-2.x <=POTENTIALLY_SAFE (Did you remove JndiLookup.class?)

Understanding The Results

_VULNERABLE_ -> You need to upgrade or remove this file.

_OKAY_ -> We report this for Log4J versions 2.3.1, 2.12.2, 2.12.3, 2.15.0, 2.16.0, and 2.17.0. We recommend upgrading to 2.17.1.

_SAFE_ -> We currently only report this for Log4J versions 2.3.2, 2.12.4, and 2.17.1 (and greater).

_OLD_ -> You are safe from CVE-2021-44228, but should plan to upgrade because Log4J 1.2.x has been EOL for 7 years and has [...]

several known-vulnerabilities.

_POTENTIALLY_SAFE_ -> The “JndiLookup.class” file is not present, either because your version of Log4J is very old (pre 2.0-beta9), or because someone already removed this file. Make sure it was someone in your team or company that removed “JndiLookup.class” if that’s the case, because attackers have been known to remove this file themselves to prevent additional competing attackers from gaining access to compromised systems. Usage

java -jar log4j-detector-2021.12.29.jar
Usage: java -jar log4j-detector-2021.12.29.jar [–verbose] [–json] [–stdin] [–exclude=X] [paths to scan…]
–json – Output STDOUT results in JSON. (Errors/warning still emitted to STDERR)
–stdin – Read STDIN for paths to explore (one path per line)
–exclude=X – Where X is a JSON list containing full paths to exclude. Must be valid JSON.
Example: –exclude='[“/dev”, “/media”, “Z:\TEMP”]’
Exit codes: 0 = No vulnerable Log4J versions found.
1 = At least one legacy Log4J 1.x version found.
2 = At least one vulnerable Log4J version found.
About – MergeBase log4j detector (version 2021.12.29)
Docs – https://github.com/mergebase/log4j-detector
(C) Copyright 2021 Mergebase Software Inc. Licensed to you via GPLv3.

Build From Source

git clone https://github.com/mergebase/log4j-detector.git
cd log4j-detector/
mvn install
java -jar target/log4j-detector-latest.jar Download

Flare-Qdb - Command-line And Python Debugger For Instrumenting And Modifying Native Software Behavior On Windows And Linux

flare-qdb is a command-line and scriptable Python-based tool for evaluating and manipulating native program state. It uses Vivisect to set a breakpoint on each queried instruction and executes Python code when hit. flare-qdb frees the analyst to take a nonlinear approach to dynamic analysis that accommodates the questions that arise in the course of normal debugging and static analysis. flare-qdb answers these questions without requiring the analyst to manually set up an interactive debugger session and navigate the program counter to that code location. Here are some examples of spot questions flare-qdb can answer: Does eax always equal this value at this point? What was eax equal to before this branch? What values will this string assume throughout this loop? At the first iteration of the inner loop, what base address is used? Is the program even going to hit this logic? Which code executes first? Does the number of loop iterations depend on the value of argv1? Can I alter the command-line arguments to avoid this condition? flare-qdb can also be used to facilitate automated, repeatable manipulation of program execution. Here are some examples of useful applications: Executing a string decoder with different arguments to quickly extract all the strings used by a malware sample. Overriding the arguments to Sleep() to permit rapid iterative testing of a custom command and control (C2) server. Telling a privilege escalation tool that its integrity level is 0x1000 (MANDATORYLOWRID) in order to induce it to execute its exploit code. Repeatably automating the unpacking of a packer that jumps into one or more non-deterministic heap locations. flare-qdb accepts multiple queries that take the form of a program counter or Vivisect expression paired with some Python text to evaluate in the flare-qdb scripting environment. Vivisect expressions can be used to specify simple constant program counter values like "0x401000", symbolic expressions like "kernel32.Sleep", and more. Vivisect expressions can also incorporate register and memory state to articulate sophisticated conditions, such as "not eax or (( edx > 3) and (poi(ebp-8) < 5))". The command line argument format for this is: -at <vexpr-pc> <pythontext> flare-qdb also supports conditional evaluation based on the truth value of a Vivisect expression: -at-if <vexpr-pc> <vexpr-conds> <pythontext> flare-qdb provides several builtins for convenient debugging, which are available both from the command line and as methods of its Qdb class. flare-qdb has been tested primarily on Windows, but works on Linux. Unfortunately, the Darwin port of Vivisect's vtrace.Trace class is incomplete, so flare-qdb does not support OSX. Example Scripts flare-qdb comes with De-DOSfuscator, which is a tool for decoding obfuscated batch files by running them. Details can be found in the De-DOSfuscator Guide or by reading the blog Cmd and Conquer: De-DOSfuscation with flare-qdb. Detailed Information Information about installing flare-qdb is available in the Installation Guide. Information about using flare-qdb on the command line is available in the Command Line Usage Guide. Information about scripting with flare-qdb is available in the Scripting Guide. Qdb class methods specific to scripting flare-qdb can be found in the Methods Reference. A full reference of flare-qdb's builtins (available both from the CLI and as instance methods) is available in the Builtins Reference or by typing flareqdb --help-builtins after installing flare-qdb. De-DOSfuscator documentation can be found in the De-DOSfuscator Guide. Troubleshooting information can be found in the Troubleshooting Guide. Acknowledgements and thoughts about future functionality that may be useful can be found in the Notes. Download Flare-Qdb
Read more...

Hacking on Medium
Common Hacking Techniques Used by Hackers

https://cdn-images-1.medium.com/max/1500/1*Qy4GqEQIyapA_1o5wYnv1w.jpeg
The advent of the internet in the past few decades has also led to cyber-attacks and caused Billion-dollar worth of damage. Any…

Continue reading on Medium »

Hacking on Medium
Do Online Games Pose Greater Cyber Risks?

https://cdn-images-1.medium.com/max/1110/0*5LXHrmOjgVb4UinU.jpg
Generally speaking, all games are hackable in theory and there isn’t really a hierarchy for one type or genre being more or less hackable.

Continue reading on Medium »

KitPloit - PenTest Tools!
Flare-Qdb - Command-line And Python Debugger For Instrumenting And Modifying Native Software Behavior On Windows And Linux

https://blogger.googleusercontent.com/img/a/AVvXsEhXEBPvZVniJMV2UX-JBx_fVGiiycsfH8MQTdDaC2lQ2JMvHdQqd_DpZAnDYupSrBsYUuaYAi7By3lSziRjxYDUw1B9piisn7PxiidW74f-Rw26x3XxEkqu1dW2wuOI-J5pV9pPeOy0bb1-2vmOomsv-PFyD-egcppmRsr-GugjK81AE9h7gKBioOxi=w640-h236 flare-qdb is a command-line and scriptable Python-based tool for evaluating and manipulating native program state. It uses Vivisect to set a breakpoint on each queried instruction and executes Python code when hit.

flare-qdb frees the analyst to take a nonlinear approach to dynamic analysis that accommodates the questions that arise in the course of normal debugging and static analysis. flare-qdb answers these questions without requiring the analyst to manually set up an interactive debugger session and navigate the program counter to that code location.
Here are some examples of spot questions flare-qdb can answer:

* Does eax always equal this value at this point?
* What was eax equal to before this branch?
* What values will this string assume throughout this loop?
* At the first iteration of the inner loop, what base address is used?
* Is the program even going to hit this logic?
* Which code executes first?
* Does the number of loop iterations depend on the value of argv[1]?
* Can I alter the command-line arguments to avoid this condition?

flare-qdb can also be used to facilitate automated, repeatable manipulation of program execution. Here are some examples of useful applications:

* Executing a string decoder with different arguments to quickly extract all the strings used by a malware sample.
* Overriding the arguments to Sleep()to permit rapid iterative testing of a custom command and control (C2) server.
* Telling a privilege escalation tool that its integrity level is 0x1000 (MANDATORY_LOW_RID) in order to induce it to execute its exploit code.
* Repeatably automating the unpacking of a packer that jumps into one or more non-deterministic heap locations.

flare-qdb accepts multiple queries that take the form of a program counter or Vivisect expression paired with some Python text to evaluate in the flare-qdb scripting environment. Vivisect expressions can be used to specify simple constant program counter values like "0x401000", symbolic expressions like "kernel32.Sleep", and more. Vivisect expressions can also incorporate register and memory state to articulate sophisticated conditions, such as "not eax or (( edx > 3) and (poi(ebp-8) < 5))".

The command line argument format for this is: -at <vexpr-pc<pythontext flare-qdb also supports conditional evaluation based on the truth value of a Vivisect expression: -at-if <vexpr-pc<vexpr-conds<pythontext flare-qdb provides several builtins for convenient debugging, which are available both from the command line and as methods of its Qdbclass.

flare-qdb has been tested primarily on Windows, but works on Linux. Unfortunately, the Darwin port of Vivisect's vtrace.Traceclass is incomplete, so flare-qdb does not support OSX. Example Scriptsflare-qdb comes with De-DOSfuscator, which is a tool for decoding obfuscated batch files by running them. Details can be found in the De-DOSfuscator Guide or by reading the blog Cmd and Conquer: De-DOSfuscation with flare-qdb. Detailed InformationInformation about installing flare-qdb is available in the Installation Guide.

Information about using flare-qdb on the command line is available in the Command Line Usage Guide.

Information about scripting with flare-qdb is available in the Scripting Guide. Qdbclass methods spec[...]

ific to scripting flare-qdb can be found in the Methods Reference.

A full reference of flare-qdb's builtins (available both from the CLI and as instance methods) is available in the Builtins Reference or by typing flareqdb --help-builtinsafter installing flare-qdb.

De-DOSfuscator documentation can be found in the De-DOSfuscator Guide.

Troubleshooting information can be found in the Troubleshooting Guide.

Acknowledgements and thoughts about future functionality that may be useful can be found in the Notes. Download Flare-Qdb

Неочевидное об XSS и HTML-энкодинге

Многие знают о том, что перед тем, как получить значение атрибута тега, браузер декодирует HTML-сущности внутри. Скажем, если попытаться…Continue reading on Medium »
Read more...

Flare-Qdb - Command-line And Python Debugger For Instrumenting And Modifying Native Software Behavior On Windows And Linux
http://www.kitploit.com/2022/02/flare-qdb-command-line-and-python.html

flare-qdb is a command-line and scriptable Python-based tool for evaluating and manipulating native program state. It uses Vivisect (https://github.com/vivisect/vivisect) to set a breakpoint on each queried instruction and executes Python code when hit. flare-qdb frees the analyst to take a nonlinear approach to dynamic analysis that accommodates the questions that arise in the course of normal debugging and static analysis. flare-qdb answers these questions without requiring the analyst to manually set up an interactive debugger session and navigate the program counter to that code location.
Here are some examples of spot questions flare-qdb can answer: Does eax always equal this value at this point? What was eax equal to before this branch? What values will this string assume throughout this loop? At the first iteration of the inner loop, what base address is used? Is the program even going to hit this logic? Which code executes first? Does the number of loop iterations depend on the value of argv[1]? Can I alter the command-line arguments to avoid this condition? flare-qdb can also be used to facilitate automated, repeatable manipulation (https://www.kitploit.com/search/label/Manipulation) of program execution. Here are some examples of useful applications: Executing a string decoder with different arguments to quickly extract all the strings used by a malware sample. Overriding the arguments to Sleep() to permit rapid iterative testing of a custom command and control (C2) server. Telling a privilege escalation (https://www.kitploit.com/search/label/Privilege%20Escalation) tool that its integrity level is 0x1000 (MANDATORY_LOW_RID) in order to induce it to execute its exploit code. Repeatably automating the unpacking of a packer that jumps into one or more non-deterministic heap locations. flare-qdb accepts multiple queries that take the form of a program counter or Vivisect expression paired with some Python text to evaluate in the flare-qdb scripting environment. Vivisect expressions can be used to specify simple constant program counter values like "0x401000", symbolic expressions like "kernel32.Sleep", and more. Vivisect expressions can also incorporate register and memory state to articulate sophisticated conditions, such as "not eax or (( edx > 3) and (poi(ebp-8) < 5))". The command line (https://www.kitploit.com/search/label/Command%20Line) argument format for this is: -at
flare-qdb also supports conditional evaluation (https://www.kitploit.com/search/label/Evaluation) based on the truth value of a Vivisect expression: -at-if
flare-qdb provides several builtins for convenient debugging, which are available both from the command line and as methods of its Qdb class. flare-qdb has been tested primarily on Windows, but works on Linux. Unfortunately, the Darwin port of Vivisect's vtrace.Trace class is incomplete, so flare-qdb does not support OSX. Example Scripts flare-qdb comes with De-DOSfuscator, which is a tool for decoding obfuscated batch files by running them. Details can be found in the De-DOSfuscator Guide (https://github.com/mandiant/flare-qdb/blob/master/doc/dedosfuscator.md) or by reading the blog Cmd and Conquer: De-DOSfuscation with flare-qdb (https://www.fireeye.com/blog/threat-research/2018/11/cmd-and-conquer-de-dosfuscation-with-flare-qdb.html). Detailed Information Information about installing flare-qdb is available in the Installation Guide (https://github.com/mandiant/flare-qdb/blob/master/doc/installation.md). Information about using flare-qdb on the command line is available in the Command Line Usage Guide (https://github.com/mandiant/flare-qdb/blob/master/doc/usage.md). Information about scripting with flare-qdb is available in the Scripting Guide (https://github.com/mandiant/flare-qdb/blob/master/doc/scripting.md). Qdb class methods specific to scripting flare-qdb can be found in the Methods Reference

(https://github.com/mandiant/flare-qdb/blob/master/doc/qdb_methods.txt). A full reference of flare-qdb's builtins (available both from the CLI and as instance methods) is available in the Builtins Reference (https://github.com/mandiant/flare-qdb/blob/master/doc/qdb_builtins.txt) or by typing flareqdb --help-builtins after installing flare-qdb. De-DOSfuscator documentation can be found in the De-DOSfuscator Guide (https://github.com/mandiant/flare-qdb/blob/master/doc/dedosfuscator.md). Troubleshooting information can be found in the Troubleshooting Guide (https://github.com/mandiant/flare-qdb/blob/master/doc/troubleshooting.md). Acknowledgements and thoughts about future functionality that may be useful can be found in the Notes (https://github.com/mandiant/flare-qdb/blob/master/doc/notes.md).

Download Flare-Qdb (https://github.com/mandiant/flare-qdb)

Неочевидное об XSS и HTML-энкодинге
https://medium.com/@skavans_/%D0%BD%D0%B5%D0%BE%D1%87%D0%B5%D0%B2%D0%B8%D0%B4%D0%BD%D0%BE%D0%B5-%D0%BE%D0%B1-xss-%D0%B8-html-%D1%8D%D0%BD%D0%BA%D0%BE%D0%B4%D0%B8%D0%BD%D0%B3%D0%B5-46fa75212496?source=rss------bug_bounty-5

Многие знают о том, что перед тем, как получить значение атрибута тега, браузер декодирует HTML-сущности внутри. Скажем, если попытаться…Continue reading on Medium » (https://medium.com/@skavans_/%D0%BD%D0%B5%D0%BE%D1%87%D0%B5%D0%B2%D0%B8%D0%B4%D0%BD%D0%BE%D0%B5-%D0%BE%D0%B1-xss-%D0%B8-html-%D1%8D%D0%BD%D0%BA%D0%BE%D0%B4%D0%B8%D0%BD%D0%B3%D0%B5-46fa75212496?source=rss------bug_bounty-5)

​​How Did I Start Doing Bug Bounty?
https://medium.com/@skavans_/how-did-i-start-doing-bug-bounty-c4374b2d98af?source=rss------bug_bounty-5

Since school, I have been reading Hacker (the Russian offensive security magazine) when I had the opportunity to buy it (then it was still…Continue reading on Medium » (https://medium.com/@skavans_/how-did-i-start-doing-bug-bounty-c4374b2d98af?source=rss------bug_bounty-5)

Bug Bounty: Low Hanging Fruit
https://medium.com/@skavans_/bug-bounty-low-hanging-fruit-4ba92ec46f02?source=rss------bug_bounty-5