mization, replay, sorting and auto-triaging of crashes
* misc stuff like TLS support, golang binary fuzzing and some extras for Mac
* mutates input with various built-in mutators + pyradamsa (Linux) what it doesn't do* native instrumentation
* scale with concurrent jobs
* complex session fuzzing
* remote client and server monitoring (only basic checks eg. connect) supportPrimarily tested on Ubuntu Linux 20.04 (lightly tested on 21.04), Windows 10 and Mac OS 11. The fuzzer and setup scripts may work on slightly older or newer versions of these operating systems as well, but the majority of research, testing and development occurred in these environments. Python3 is supported and an effort was made to make the code compatiable with Python2 as well as it's necessary for fuzzing on Windows via WinAppDbg. Platform testing primarily occured on Intel-based hardware, but things seem to mostly work on Apple's M1 platform too (notable exceptions being on Linux the exploitable plugin for GDB probably isn't supported, nor is Pyradamsa). There are also setup scripts in setup/ to automate most or all of the tasks and depencency installation. It can generally fuzz native binaries on each platform, wh ich are often compiled in C/C++, but it also catch crashes for Golang binaries as well (experimental). python versionsPython3 is supported for Linux and Mac while Python2 is required for Windows.

Why Py3 for Linux and Mac? Pyautogui, Pyradamsa (Linux only), better socket support on Mac.

Why Py2 for Windows? Winappdbg requires Py2. linuxGDB for debugging and exploitable for crash triage. If it's OSS, you can build and instrument the target with sanitizers and such, otherwise there's some memory debuggers we can just load at runtime.

This installation along with the python dependencies and other helpful stuff has been automated with setup/linux.sh. Recommended OS is Ubuntu 20.04 as that is where the majority of testing occurred. macInstead of gdb, we use lldb for debugging on OS X as it's included with the XCode command line tools. Being an admin or in the developer group should let you use lldb, but this behavior may differ across environments and versions and you may need to run it with sudo privileges if all else fails.

The one thing you'll manually need to do is turn off SIP (in recovery, via cmd+R or use vmware fusion hacks). Otherwise, auto-triage will fail when fuzzing on Tim Apple's OS.

Almost all of the setup has been automated with the setup/mac.sh script, so you can just run it for a quick start. windowsWinAppDbg is used for debugging on Windows with the slight caveat that stdin fuzzing isn't supported.

Like the automated setups for the other operating systems, chocolatey helps to automate package installation on windows. Run setup/windows.bat in the litefuzz root directory as Administrator to automate the installations. It will install debugging tools and other dependencies to make things run smoothly. targetsThis is a list of the types of targets that have been tested and are generally supported.

*
Local CLI/GUI apps that parse file formats or stdin

* debug support

*
Local CLI/GUI network client that parses server responses

* debug support for CLIs
* limited debug support for GUIs

*
Local CLI network server that parses client requests

* debug support (caveat: must able to run as a standalone executable, otherwise can be treated as remote)

*
Local GUI network server that parses client requests

* theoretically supported, untested

*
Remote CLI/GUI network client that parses server responses

* no debug support

*
Remote CLI/GUI network server that parses client requests

* no debug support
* exception being on Mac and using attachor reportcrashfeatures
Again, the fuzzer can run on and support local apps, clients and servers on Linux, Mac and Windows and of course can fuzz remote stu[...]

___________________________
@hacking_Attack
@Hacking_Video

ff independent of the target platform. triage*
Local CLI/GUI apps that parse file formats or stdin

* run app, catch signals, repro by running it again inside a debugger with the crasher

*
Local CLI/GUI network client that parses server responses

* run app, catch signals, repro by running it again inside a debugger with the crasher

*
Local GUI/CLI network server that parses client requests

* run app in debugger, catch signals, repro by running it again inside a debugger with the crasher

*
Remote CLI/GUI network client that parses server responses

* no visiblity, collect crashes from the remote side
* can manually write supporting scripts to aid in triage

*
Remote CLI/GUI network server that parses client requests

* no visiblity, collect crashes from the remote side
* can manually write supporting scripts to aid in triage
* exception on Mac are the attachand reportcrashoptions, which can be used to enable some triage capabilities getting startedMost of the setup across platforms has been automated with the scripts in the setup directory. Simply run those from the litefuzz root and it should save you a lot of time and help enable some of what's needed for automated deployments. It's useful to use a VM to setup a clean OS and fuzzing environment as among other things its snapshot capabilities come in handy.

See INSTALL.md for details. testsunit testsThere are a few simple unit and functional tests to get some coverage for Litefuzz, but it is not meant to be complete. py2> pytest
py3> python3 -m pytest This will run pytest for test_litefuzz.pyin the main directory and provide PASS/FAIL results once the test run is finished. crashing app testsA few examples of buggy apps for testing crash and triage capabilities on the different platforms can be found in the testfolder.

* (a) null pointer dereference
* (b) divide-by-zero
* (c) heap overflow
* (d-gui) format string bug in a GUI
* (e) buffer overflow in client
* (f) buffer overflow in server

They are automatically built during setup and you can run them on the command line, in a debugger or use them to test as fuzzing targets. If running on Windows command line, check Event Viewer -> Windows Logs -> Applicationto see crashes. optionsThere are a ton of different options and features to take advantage of various target scenarios. The following is a brief explanation and some examples to help understand how to use them. crash directory-olets you specify a crash directory other than the default, which is the crashes/ in the local path. One can use this to manage crash folders for several concurrent fuzzing runs for different apps at the same time. insulate mode-uinsulates the target application from the normal fuzzing process, eg. execs or sending packets over and over and checking for crashes. Instead, this mode was made for interactive client applications, eg. Postman where you can script inside the application to repeat connections for client fuzzing. The target is ran inside of a debugger, the fuzzer is paused to get the user time to click a few buttons or sets the target's config to make it run automatically, user resumes and now you are fuzzing interactive network clients. litefuzz -lk -c "/snap/postman/140/usr/share/Postman/_Postman" -i input/http_responses -a tcp://localhost:8080 -u -n 100000 -zInsulate mode + refresh can be used for interactive clients, eg. run FileZilla in a debugger, but keep hitting F5 to make it reconnect to the server for each new iteration. Also, fuzzing local CLI/GUI servers are only started and ran once inside a debugger to make the process a little more efficient. --keyalso allows you to send keys while fuzzing interactive targets, such as fuzzing FileZilla's parsing of FTP server responses by sending "refre[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Litefuzz - A Multi-Platform Fuzzer For Poking At Userland Binaries And Servers

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
How Retailers Can Address 'Buy Now, Pay Later' Fraud

As BNPL platforms grow in popularity, experts warn that cybercriminals could target them using synthetic identity fraud and first-party fraud.

hacking: security in practice
How does UDP Flood on webservers work?

I am very likely to have misunderstood something here, since I don't know much about web in general. But shouldn't a UDP flood only work if the victim ports, which receive the UDP traffic aren't blocking all udp data. Doesn't that mean UDP flood only works, when there's a port/service on that webservers, which allows UDP data like a videochat or sth. In conclusion: when there's a webserver that doesn't use UDP at all, isn't it immune to UDP flood attacks?

Probably a lot wrong here, so please go soft on me >~

submitted by /u/LarryTheSnobster
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Wifi-Framework : For Creating Proof-Of-Concepts, Automated Experiments, Test Suites, Fuzzers, And More…

Wifi-Framework is a framework to more easily perform Wi-Fi experiments. It can be used to create fuzzers, implement new attacks, create proof-of-concepts to test for vulnerabilities, automate experiments, implement test suites, and so on.

The main advantage of the framework is that it allows you to reuse Wi-Fi functionality of Linux to more easily implement attacks and/or tests. For instance, the framework can connect to (protected) Wi-Fi networks for you and can broadcast beacons for you when testing clients. In general, any Wi-Fi functionality of Linux can be reused to more quickly implement attacks/tests. The framework accomplishes this by executing test cases on top of the hostap user space daemon.
https://blogger.googleusercontent.com/img/a/AVvXsEi27NzKEWwoQn_Wm7MQ2kEms5PkICD7q5ajoQtftXY4WudUUBqbIvkToXH9TUSLTEJDVa2ZNemv6bZYm6_OEzqw45lCfIZ3Bpt1qpyQDzzAvzRL-j0O9RSJlJTUuaUFuran8f5TQptPNUI5E2lyM_x3MV4dJTP73PYKkeRopUeYVQmMkPsJCPI-uLpF=s1000
If you are new to performing Wi-Fi experiments on Linux it is highly recommended to first read the libwifi Linux Tutorial. When you are implementing basic Wi-Fi attacks without the need to reuse Linux functionality, then the framework provides limited advantages and you can instead consider directly implementing attacks in Scapy and optionally use the libwifi library. Usage

To use the framework:

* Install it by running ./setup.sh. See setup to know what this script does.
* Read the usage tutorial. Example

Say you want to test whether a client ever encrypts frames using an all-zero key. This can happen during a key reinstallation attack. By using the framework you do not need to reimplement all functionality of an access point, but only need to write the following test case:

class ExampleKrackZerokey(Test):
name = “example-krack-zero-key”
kind = Test.Authenticator
def init(self):
super().init([
# Replay 4-Way Handshake Message 3/4.
Action( trigger=Trigger.Connected, action=Action.Function ),
# Receive all frames and search for one encrypted with an all-zero key.
Action( trigger=Trigger.NoTrigger, action=Action.Receive ),
# When we receive such a frame, we can terminate the test.
Action( trigger=Trigger.Received, action=Action.Terminate )
])
def resend(self, station):
# Resend 4-Way Handshake Message 3/4.
station.wpaspy_command(“RESEND_M3 ” + station.clientmac )
def receive(self, station, frame):
if frame[Dot11].addr2 != station.clientmac or not frame.haslayer(Dot11CCMP):
return False
# Check if CCMP-encrypted frame can be decrypted using an all-zero key
plaintext = decrypt_ccmp(frame.getlayer(Dot11), tk=b”\x00″*16)
if plaintext is None: return False
# We received a valid plaintext frame!
log(STATUS,’Client encrypted a frame with an all-zero key!’, color=”green”)
return True

The above test case will create an access point that clients can connect to. After the client connects, a new 3rd message in the 4-way handshake will be sent to the client. A vulnerable client will then start using an all-zero encryption key, which the test case automatically detects.

You can run the above test case using simulated Wi-Fi radios as follows:

./setup/setup-hwsim.sh 4
source setup/venv/bin/activate
./run.py wlan1 example-krack-zero-key

You can connect to the created access point to test it (network testnetworkwith password passphrase):

./hostap.py wlan2

By changing the network configuration this AP can easily be configured to use WPA2 or WPA3 and/or can be configured to use enterprise authentication, without making any changes to the test case that we wrote! Additional benefits of using the framework in this example are:

* No need to manually broadcast beacons
* The authentication and association stage [...]

___________________________
@hacking_Attack
@Hacking_Video

is handled by the framework
* The WPA2 and/or WPA3 handshake is handled by the framework
* Injected packets will be automatically retransmitted by the Linux kernel
* Packets sent towards the AP will be acknowledged
* Sleep mode of the client is automatically handled by the kernel
* … Download

___________________________
@hacking_Attack
@Hacking_Video

Weakly Typed SQL Injection

Programming languages come in two categories: Hard/Strong Typed Soft/Weak TypedContinue reading on Medium »
Read more...

Weakly Typed SQL Injection
https://hogarth45.medium.com/weakly-typed-sql-injection-f43a158a7daa?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Programming languages come in two categories:
Hard/Strong Typed
Soft/Weak TypedContinue reading on Medium » (https://hogarth45.medium.com/weakly-typed-sql-injection-f43a158a7daa?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Weakly Typed SQL Injection

Programming languages come in two categories: Hard/Strong Typed Soft/Weak TypedContinue reading on Medium »
Read more...

Exploit Collector
Polkit pkexec Local Privilege Escalation

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Hundreds of Open Source Components Could Undermine Security, Census Finds

The Linux Foundation and Harvard University create lists of the top 500 most popular open source projects, highlighting critical software that needs to be secured.

Dark Reading: Attacks/Breaches
How to Get One Step Ahead of Mobile Attacks

The advent of so-called "dropper" apps, which deliver and install malware that can also be later updated, is an emerging threat vector for mobile users.

Dark Reading: Attacks/Breaches
Attivo Expands Active Directory Protection from Unmanaged Devices, Including Mac, Linux, IoT/OT

Attivo Networks ADSecure-DC solution joins the company’s existing suite of Active Directory protection products.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Palo Alto Networks Introduces PAN-OS 10.2 Nebula

Software collects, analyzes, and interprets potential zero-day threats in real time using inline deep learning.

___________________________
@hacking_Attack
@Hacking_Video