An open-source Go project to test different web application firewalls (https://www.kitploit.com/search/label/Firewalls) (WAF) for detection logic and bypasses.
How it works
It is a 3-steps requests generation process that multiply amount of payloads to encoders and placeholders. Let's say you defined 2 payloads, 3 encoders (Base64, JSON, and URLencode) and 1 placeholder (HTTP GET variable). In this case, the tool will send 2x3x1 = 6 requests in a testcase.
Payload
The payload string you wanna send. Like alert(111) or something more sophisticated. There is no macroses like so far, but it's in our TODO list. Since it's a YAML string, use binary encoding if you wanna to https://yaml.org/type/binary.html
Encoder
Data encoder the tool should apply to the payload. Base64, JSON unicode (\u0027 instead of '), etc.
Placeholder
A place inside HTTP request where encoded payload should be. Like URL parameter, URI, POST form parameter, or JSON POST body.
Quick start

Dockerhub
The latest gotestwaf always available via the dockerhub (https://www.kitploit.com/search/label/Dockerhub) repository: https://hub.docker.com/r/wallarm/gotestwaf
It can be easily pulled via the following command: docker pull wallarm/gotestwaf

Local Docker build
docker build . --force-rm -t gotestwaf
docker run -v ${PWD}/reports:/go/src/gotestwaf/reports gotestwaf --url=https://the-waf-you-wanna-test/
Find the report file waf-test-report-.pdf in the reports folder that you mapped to /go/src/gotestwaf/reports inside the container.
Build
Gotestwaf supports all the popular platforms (Linux, Windows, macOS), and can be built natively if Go is installed in the system. go build -mod vendor

Examples

Testing on OWASP ModSecurity (https://www.kitploit.com/search/label/OWASP%20ModSecurity) Core Rule Set

Build & run ModSecurity (https://www.kitploit.com/search/label/ModSecurity) CRS docker image
You can pull, build and run ModSecurity CRS docker image automatically: make modsec
Or manually with your configuration flags to test: docker pull owasp/modsecurity-crs
docker run -p 8080:80 -d -e PARANOIA=1 --rm owasp/modsecurity-crs
You may choose the PARANOIA level to increase the level of security.
Learn more https://coreruleset.org/faq/
Run gotestwaf
If you want to test the functionality on the running ModSecurity CRS docker container, you can use the following commands: make scan_local (to run natively)
make scan_local_from_docker (to run from docker)
Or manually from docker: docker run -v ${PWD}/reports:/go/src/gotestwaf/reports --network="host" gotestwaf --url=http://127.0.0.1:8080/ --verbose
And manually with go run (natively): go run ./cmd --url=http://127.0.0.1:8080/ --verbose

Run gotestwaf with WebSocket (https://www.kitploit.com/search/label/WebSocket) check
You can additionally set the WebSocket URL to check via the wsURL flag and verbose flag to include more information about the checking process: docker run -v ${PWD}/reports:/go/src/gotestwaf/reports gotestwaf --url=http://172.17.0.1:8080/ --wsURL=ws://172.17.0.1:8080/api/ws --verbose

Check results
GOTESTWAF : 2021/03/03 15:15:48.072331 main.go:61: Test cases loading started
GOTESTWAF : 2021/03/03 15:15:48.077093 main.go:68: Test cases loading finished
GOTESTWAF : 2021/03/03 15:15:48.077123 main.go:74: Scanned URL: http://127.0.0.1:8080/
GOTESTWAF : 2021/03/03 15:15:48.083134 main.go:85: WAF pre-check: OK. Blocking status code: 403
GOTESTWAF : 2021/03/03 15:15:48.083179 main.go:97: WebSocket pre-check. URL to check: ws://127.0.0.1:8080/
GOTESTWAF : 2021/03/03 15:15:48.251824 main.go:101: WebSocket pre-check: connection is not available, reason: websocket: bad handshake
GOTESTWAF : 2021/03/03 15:15:48.252047 main.go:129: Scanning http://127.0.0.1:8080/
GOTESTWAF : 2021/03/03 15:15:48.252076 scanner.go:124: Scanning started
GOTESTWAF : 2021/03/03 15:15:51.210216 scanner.go:129: Scanning Time: 2.958076338s

GOTESTWAF : 2021/03/03 15:15:51.210235 scanner.go:160: Scanning finished

Negative Tests:
+-----------------------+-- ---------------------+-----------------------+-----------------------+-----------------------+-----------------------+
| TEST SET | TEST CASE | PERCENTAGE, % | BLOCKED | BYPASSED | UNRESOLVED |
+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+
| community | community-lfi | 66.67 | 4 | 2 | 0 |
| community | community-rce | 14.29 | 6 | 36 | 0 |
| community | community-sqli | 70.83 | 34 | 14 | 0 |
| community | community-xss | 91.78 | 279 | 25 | 0 |
| community | community-xxe | 100.00 | 4 | 0 | 0 |
| owasp | ldap-injection | 0.00 | 0 | 8 | 0 |
| owasp | mail-injection | 0.00 | 0 | 6 | 6 |
| owasp | nosql-injection | 0.00 | 0 | 12 | 6 |
| owasp | path-traversal | 38.89 | 7 | 11 | 6 |
| owasp | shell-injection | 37.50 | 3 | 5 | 0 |
| owasp | sql-injection | 33.33 | 8 | 16 | 8 |
| owasp | ss-include | 50.00 | 5 | 5 | 10 |
| owasp | sst-injection | 45.45 | 5 | 6 | 9 |
| owasp | xml-injection | 100.00 | 12 | 0 | 0 |
| owasp | xss-scripting | 56.25 | 9 | 7 | 12 |
| owasp-api | graphql | 100.00 | 1 | 0 | 0 |
| owasp-api | rest | 100.00 | 2 | 0 | 0 |
| owasp-api | soap | 100.00 | 2 | 0 | 0 |
+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+
| DATE: | WAF NAME: | WAF AVERAGE SCORE: | BLOCKED (RESOLVED): | BYPASSED (RESOLVED): | UNRESOLVED: |
| 2021-03-03 | GENERIC | 55.83% | 381/534 (71.35%) | 153/534 (28.65%) | 57/591 (9.64%) |
+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+

Positive Tests:
+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+

| TEST SET | TEST CASE | PERCENTAGE, % | BLOCKED | BYPASSED | UNRESOLVED |
+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+
| false-pos | texts | 50.00 | 1 | 1 | 6 |
+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+
| DATE: | WAF NAME: | WAF POSITIVE SCORE: | FALSE POSITIVE (RES): | TRUE POSITIVE (RES): | UNRESOLVED: |
| 2021-03-03 | GENERIC | 50.00% | 1/2 (50.00%) | 1/2 (50.00%) | 6/8 (75.00%) |
+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+-----------------------+

PDF report is ready: reports/waf -evaluation-report-generic-2021-March-03-15-15-51.pdf

Configuration options
Usage of /go/src/gotestwaf/gotestwaf:
--blockRegex string Regex to detect a blocking page with the same HTTP response status code as a not blocked request
--blockStatusCode int HTTP status code that WAF uses while blocking requests (default 403)
--configPath string Path to the config file (default "config.yaml")
--followCookies If true, use cookies sent by the server. May work only with --maxIdleConns=1
--idleConnTimeout int The maximum amount of time a keep-alive connection will live (default 2)
--maxIdleConns int The maximum number of keep-alive connections (default 2)
--maxRedirects int The maximum number of handling redirects (default 50)
--nonBlockedAsPassed If true, count requests that weren't blocked as passed. If false, requests that don't satisfy to PassStatuscode/PassRegExp as blocked
--passRegex string Regex to a detect normal (not blocked) web page with the same HTTP status code as a blocked request
--passStatusCode int HTTP response status code that WAF uses while passing requests (default 200)
--proxy string Proxy URL to use
--randomDelay int Random delay in ms in addition to the delay between requests (default 400)
--reportPath string A directory to store reports (default "reports")
--sendDelay int Delay in ms between requests (default 400)
--testCase string If set then only this test case will be run
--testCasesPath string Path to a folder with test cases (default "testcases")
--testSet string If set then only this test set's cases will be run
--tlsVerify If true, the received TLS certificate will be verified
--url string URL to check (default "http://localhost/")
--verbose If true, enable verbose logg ing (default true)
--wafName string Name of the WAF product (default "generic")
--workers int The number of workers to scan (default 200)
--wsURL string WebSocket URL to check


Download Gotestwaf (https://github.com/wallarm/gotestwaf)

Phishing Trends With PDF Files in 2020: 5 Approaches Attackers Use
https://www.reddit.com/r/redteamsec/comments/moes0b/phishing_trends_with_pdf_files_in_2020_5/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://unit42.paloaltonetworks.com/phishing-trends-with-pdf-files/) [comments] (https://www.reddit.com/r/redteamsec/comments/moes0b/phishing_trends_with_pdf_files_in_2020_5/)

Deep Web
What is a “Red Room” and what happens in them?

submitted by /u/Monkeyhank420
[link] [comments]

hacking: security in practice
What is the best way to detect the static addresses used to store certain value? Obv in a reverse engineering context

Yeah I am a Newbie. I know that usually, using a memory scanner you can see multiple addresses with the value wich you are looking for. This is because of multi-level pointers, but what is the smartest way to discover static addresses?

submitted by /u/Electronic_Sort_2918
[link] [comments]

hacking: security in practice
Just complaining

That moment in a bug bounty program you find a fishy site and logged in as admin with the default crenditials but then the account gets disabled and locked the soonest you logged in

PAIN :(

submitted by /u/GrEeKxFiVeR
[link] [comments]

hacking: security in practice
don't try and beat me in my own game, lil sh*t

I was on omegle and some guy said 'hey i recognise you, i saw you yesterday i think. You live in manchester?' (He pulled my ip) so i pulled his and said 'interesting because i saw you this morning in farmington..' he looked shocked so i said 'don't use my own spell against me potter and continued to read out his ip

submitted by /u/grumpyloza123
[link] [comments]

hacking: security in practice
How does hacking a website actually work

I looked in the sub for other posts like this but couldn’t find any. Like I get the idea conceptually, but what exactly is happening, is the websites code being manipulated? Are you using your own code to simply get through or into the websites code. Is code involved at all? If the answer to any of these is yes could you go into more detail and maybe provide an example of code you would use/code that would be vulnerable/how you actually manipulate the code. Sorry if this sounds stupid but I genuinely have no idea how it works. If none of that is how it works could you explain how, and provide relevant examples. Also if there are any other posts addressing this that I missed I’d be fine with a link to that instead of a response

submitted by /u/Traditional_Dinner16
[link] [comments]

Hacking on Medium
Hacking wireless sockets like a NOOB

https://cdn-images-1.medium.com/max/600/1*mhawEcVT9Gl3RVdrPHiviw.png
Learn how to use the Universal Radio Hacker, software, in order to analyze the signals used to control a wireless socket device.

Continue reading on Medium »

㊙️ Carding OS v1.0 ㊙️

Size: ~15GB

Tools:
- Acrobat Reader (PDFs)
- Activator.bat ( Activates Windows Again)
- AntiOS (Anti-Fingerprint Tools Written In Python)
- CCleaner (If no connection you are able to crack it with loader)
- Comodo Firewall
- Destroy Windows 10 Spying
- Firefox (Customized)
- GPA (For PGP messages)
- Genesis Browser (Fingerprint Browser For Genesis Fingerprints)
- Hard Disk Changer
- HWID Changer (Change Hardware ID)
- ICQ
- Kleopatra
- MagicSim (Sim Tools)
- Malwarebytes (Should be cracked)
- Notepad++
- Pidgin (OTR)
- Proxifier
- Python
- Sublime Editor (Editor)
- SimExplorer (Sim Tools)
- Sphere Browser (Anti-Detect Browser)
- Telegram
- TMAC (Mac Changer)
- Tor
- Windows Defender Disable (Disables Windows Defender)
- Windows Security (For Windows Security)
- 911 VPN

DM Me If You Have Tools Which I Should Add — @f4c3r100