KitPloit - PenTest Tools!
CAPEv2 - Malware Configuration And Payload Extraction

https://blogger.googleusercontent.com/img/a/AVvXsEiuPsGG3RilzO1Y6OB7knuT7uuSL9hRio3tesBwwdGouQK7HDfvexnkd2Q-T66QZh27UiU5i54jIJrvLyt1bpEII3znTG3Bu002yFqqFcoWmrwXJ3m5vTgskBHXF-HXjQV_YRUkxQo7LtiqOKzkDAvf5KRIoVLfW5wboJSklrp091GQmlIkv8uxhkGd=w640-h240 CAPE is a malware sandbox. It was derived from Cuckoo with the goal of adding automated malware unpacking and config extraction - hence its name is an acronym: 'Config And Payload Extraction'. Automated unpacking allows classification based on Yara signatures to complement network (Suricata) and behavior (API) signatures.

There is a free community instance online which anyone can use: https://capesandbox.com
Although config and payload extraction was the original stated goal, it was the development of the debugger in CAPE which first inspired the project: in order to extract configs or unpacked payloads from arbitrary malware families without relying on process dumps (which sooner or later the bad guys will thwart), instruction-level monitoring and control is necessary. The novel debugger in CAPE follows the principle of maximising use of processor hardware and minimising (almost completely) use of Windows debugging interfaces, allowing malware to be stealthily instrumented and manipulated from the entry point with hardware breakpoints programmatically set during detonation by Yara signatures or API calls. This allows instruction traces to be captured, or actions to be performed such as control flow manipulation or dumping of a memory region.

The debugger has allowed CAPE to continue to evolve beyond its original capabilities, which now include dynamic anti-evasion bypasses. Since modern malware commonly tries to evade analysis within sandboxes, for example by using timing traps for virtualisation or API hook detection, CAPE allows dynamic countermeasures to be developed combining debugger actions within Yara signatures to detect evasive malware as it detonates, and perform control-flow manipulation to force the sample to detonate fully or skip evasive actions. The list of dynamic bypasses in CAPE is growing but includes:

* Guloader
* Ursnif
* Dridex
* Zloader
* Formbook
* BuerLoader
* Pafish

CAPE takes advantage of many malware techniques or behaviours to allow for unpacked payload capture:

* Process injection
* Shellcode injection
* DLL injection
* Process Hollowing
* Process Doppelganging

* Decompression of executable modules in memory
* Extraction of executable modules or shellcode in memory

These behaviours will result in the capture of payloads being injected, extracted or decompressed for further analysis. In addition CAPE automatically creates a process dump for each process, or, in the case of a DLL, the DLL's module image in memory. This is useful for samples packed with simple packers, where often the module image dump is fully unpacked.

Quick access to the debugger is made possible with the breakpoint options 'bp0' through 'bp3' accepting RVA or VA values to set breakpoints, whereupon a short instruction trace will be output, governed by 'count' and 'depth' options (e.g. bp0=0x1234,depth=1,count=100). To set a breakpoint at the module entry point, 'ep' is used instead of an address (e.g. bp0=ep). Alternatively 'break-on-return' allows for a breakpoint on the return address of a hooked API (e.g. break-on-return=NtGetContextThread). An optional 'base-on-api' parameter allows the image base for RVA breakpoints to be set by API call (e.g. base-on-api=NtReadFile,bp0=0x2345).

Options 'action0' - 'action3' allow actions to be performed when breakpoints are hit, such as dumping memory regions (e.g. action0=dumpebx) or changing the execution control flow (e.g. action1=skip). CAPE's documentation contains further examples of such actions.

'dump-on-api'[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
CAPEv2 - Malware Configuration And Payload Extraction

___________________________
@hacking_Attack
@Hacking_Video

Do data practitioners are the new (security) weakest link?

Secrets in codeContinue reading on CodeX »
Read more...

Community Newsletter — March 2022
https://medium.com/pandoraprotocol/community-newsletter-march-2022-1d679c1a5823?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

As the Pandora community continues to grow stronger with each passing day, we would like to take this opportunity to thank everyone for…Continue reading on Pandora Protocol » (https://medium.com/pandoraprotocol/community-newsletter-march-2022-1d679c1a5823?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Community Newsletter — March 2022

As the Pandora community continues to grow stronger with each passing day, we would like to take this opportunity to thank everyone for…Continue reading on Pandora Protocol »
Read more...

Community Newsletter — March 2022

As the Pandora community continues to grow stronger with each passing day, we would like to take this opportunity to thank everyone for…Continue reading on Pandora Protocol »
Read more...

hacking: security in practice
Comprehensive, security-focused write up about communication tools?

Asking for a ukranian fried: I'm looking for a comprehensive, security-focused write up about communication tools and best practices to secure them, and the phone OS, in war time. The target audience would be civil citizens. If I can't find it, I'll try to write one. In any case, any pointers would be appreciated. Thanks a lot, and sorry if this is OT.

submitted by /u/ouiea
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Don't have time to read the entire Conti leak? Read the summary and stay up to date.

https://www.cyberark.com/?p=127656&post_type=threat_research_blog&preview=1&_ppp=a20e2b57fd

submitted by /u/jat0369
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Why won’t law enforcement answer questions about RaidForums? Or have they just winked?

https://external-preview.redd.it/ZnfyNyADCCwDRocb4EbDCtuN9qhb9VOdr-IycnpcMBA.jpg?width=320&crop=smart&auto=webp&s=c09b6158118145cdcf408a93a192f37dd539d8e1 submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
These guys are quite rude :(

https://external-preview.redd.it/uk0FIV7rrKZMIAypOvcwj0I-r6vxfzPjMyR4JX9rBD4.png?width=640&crop=smart&auto=webp&s=fe987f0b5d4409b6b2b2b19bf2a74ebf2359ec90 submitted by /u/grrwahrr
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

IDOR in support.mozilla.org through Code Review
https://noob3xploiter.medium.com/idor-in-support-mozilla-org-through-code-review-ff2aa8ea1201?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

I was trying to improve my static analysis code, specifically django apps, so i decided to hack a random project in github. And i found…Continue reading on Medium » (https://noob3xploiter.medium.com/idor-in-support-mozilla-org-through-code-review-ff2aa8ea1201?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty — How to approach Vulnerabilities ( PART 1 )
https://apexvicky.medium.com/bug-bounty-how-to-approach-vulnerabilities-part-1-47e211331386?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello people, it’s me again. In most cases, with automated tools, you can possibly find low level security bugs i.e most likely Blind XSS…Continue reading on Medium » (https://apexvicky.medium.com/bug-bounty-how-to-approach-vulnerabilities-part-1-47e211331386?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video