Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools!
Geowifi - Search WiFi Geolocation Data By BSSID And SSID On Different Public Databases

https://blogger.googleusercontent.com/img/a/AVvXsEgQctqedwnCqwsLTpstL7YNEET5azHKUABoUEkyOIKUkmR1l7zCbHNS9ajEOahjr_5haGZH8pnFXV2qGXTwkNWG6Fdx-1W_kpbJAxNiwhdGF6He4TwmC_39sOpll1h6NghiedDo8RauUDVM6FDs4v_si_tXCjE_YglKiPpuizSm2hijHP0ydRXJGTxZ=w640-h348 Search WiFi geolocation data by BSSID and SSID on different public databases. Databases:* Wigle
* Apple
* OpenWifi
* Milnikov Prerequisites* Python3.
* In order to display emojis on Windows, it is recommended to install the new Windows terminal.
*
⚠️ In order to use the Wigle service it is necessary to obtain an API and configure the utils/API.yamlfile replacing the value of the "wigle_auth" parameter for the "Encoded for use" data provided by Wigle. This is necessary for searching by SSID. Installation Use the package manager pip to install requirements. python3 -m pip install -r requirements.txtUsage

usage: geowifi.py [-h] (-s SSID | -b BSSID) [-j] [-m]
optional arguments:
-h, --help               Show this help message and exit
-s SSID, --ssid SSID     Search by SSID
-b BSSID, --bssid BSSID  Search by BSSID
-j, --json               Json output
-m, --map                Map output

* Search by BSSID: python3 geowifi.py -b BSSID * Search by SSID: python3 geowifi.py -s SSID It is possible to export the results in json format using the -jparameter and show the locations on html map using -m. ️
Map output examplehttps://blogger.googleusercontent.com/img/a/AVvXsEjJWrVu6EK-KeaTsZubzZFJPiSnj60F9fj2IJmQ-nk8eh0LiQKn0LUqLRqckM9k1UQ5Cx-ZNLk0XHpitJpgC6shJGMp6oVBls8aLyp3qsQw3-oKWQYasjrlmtE0CAISo32hl5OPLCbt8-REePb5rotciZQQL3AZiLgM-L0FSAqrgCzGQRZd7Hm7wSKE=w640-h262 
Json output example

{
"data":{
"bssid":"A0:XX:XX:XX:6F:90",
"vendor":"TP-LINK TECHNOLOGIES CO.,LTD.",
"mac_type":"MA-L",
"wigle":{
"lat":00.000908922099,
"lon":00.000945220028
},
"apple":{
"lat":"not_found",
"lon":"not_found"
},
"openwifi":{
"lat":00.000808900099,
"lon":00.000845500028
},
"milnikov":{
"lat":"not_found",
"lon":"not_found"
}
}
}

Mentions * This project uses some of the research and code used at iSniff-GPS.
* Thanks to Micah Hoffman for his attention and answers to my questions.
* Thanks to kennbro for lending me his scrupulous eyes to give me feedback. Download Geowifi

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Kitploit – Maintenance in Progress

Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.

5 viewsedited 13:54

Hacking Articles Tips Tricks Videos Tutorials

Introduction to Simple Buffer Overflow
https://medium.com/@crazymart12_94950/introduction-to-simple-buffer-overflow-8a14e7a4196a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

Introduction to Simple Buffer Overflow

This article will provide an overview of exploit development, with a focus on creating Simple Buffer Overflow exploits. I’ll try to keep…

4 viewsedited 14:40

Hacking Articles Tips Tricks Videos Tutorials

4 views14:40

Hacking Articles Tips Tricks Videos Tutorials

This article will provide an overview of exploit development, with a focus on creating Simple Buffer Overflow exploits. I’ll try to keep…Continue reading on Medium » (https://medium.com/@crazymart12_94950/introduction-to-simple-buffer-overflow-8a14e7a4196a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

Introduction to Simple Buffer Overflow

This article will provide an overview of exploit development, with a focus on creating Simple Buffer Overflow exploits. I’ll try to keep…

6 viewsedited 14:40

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Zero Trust Can't Stop at the Federal Level

The federal government must step in to help local and state governments implement zero trust.

7 views15:43

Source

Hacking Articles Tips Tricks Videos Tutorials

6 views17:03

Hacking Articles Tips Tricks Videos Tutorials

6 views17:03

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
Http-Desync-Guardian – Analyze HTTP Requests To Minimize Risks Of HTTP Desync Attacks

Http-Desync-Guardian is to Analyze HTTP Requests To Minimize Risks Of HTTP Desync Attacks. HTTP/1.1went through a long evolution since 1991 to 2014:

* HTTP/0.9 – 1991
* HTTP/1.0 – 1996
* HTTP/1.1
* RFC 2068 – 1997
* RFC 2616 – 1999
* RFC 7230 – 2014
This means there is a variety of servers and clients, which might have different views on request boundaries, creating opportunities for desynchronization attacks (a.k.a. HTTP Desync).

It might seem simple to follow the latest RFC recommendations. However, for large scale systems that have been there for a while, it may come with unacceptable availability impact. http_desync_guardianlibrary is designed to analyze HTTP requests to prevent HTTP Desync attacks, balancing security and availability. It classifies requests into different categories and provides recommendations on how each tier should be handled.

It can be used either for raw HTTP request headers or already parsed by an HTTP engine. Consumers may configure logging and metrics collection. Logging is rate limited and all user data is obfuscated.

If you think you might have found a security impacting issue, please follow our Security Notification Process. Priorities

* Uniformity across services is key. This means request classification, logging, and metrics must happen under the hood and with minimally available settings (e.g., such as log file destination).
* Focus on reviewability. The test suite must require no knowledge about the library/programming languages but only about HTTP protocol. So it’s easy to review, contribute, and re-use.
* Security is efficient when it’s easy for users. Our goal is to make integration of the library as simple as possible.
* Ultralight. The overhead must be minimal and impose no tangible tax on request handling (see benchmarks). Supported HTTP versions

The main focus of this library is HTTP/1.1. See tests for all covered cases. Predecessors of HTTP/1.1don’t support connection re-use which limits opportunities for HTTP Desync, however some proxies may upgrade such requests to HTTP/1.1and re-use backend connections, which may allow to craft malicious HTTP/1.0requests. That’s why they are analyzed using the same criteria as HTTP/1.1. For other protocol versions have the following exceptions:

* HTTP/0.9requests are never considered Compliant, but are classified as Acceptable. If any of Content-Length/Transfer-Encoding is present then it’s Ambiguous.
* HTTP/1.0– the presence of Transfer-Encodingmakes a request Ambiguous.
* HTTP/2+is out of scope. But if your proxy downgrades HTTP/2to HTTP/1.1, make sure the outgoing request is analyzed.

See documentation to learn more.

Overview

This page contains request classification tiers and reasons as well as mitigations, with explanations for some non-trivial cases. Request classification http_desync_guardianis a library for analyzing and classifying HTTP/1.x requests to provide customers security balanced with necessity to serve traffic for legacy or proprietary systems (not always RFC compliant).

* Compliant– RFC compliant requests (*)
* Acceptable– non RFC compliant requests, but which do not represent security risks
* Ambiguous– requests that might be treated differently by different HTTP servers and therefore may lead to HTTP Desync issues (and request splitting/smuggling as a possible consequence)
* Severe– either malformed or highly likely crafted to trick HTTP parsers and cause HTTP de-synchr[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Http-Desync-Guardian : Analyze HTTP Requests To Minimize Risks

Http-Desync-Guardian is to Analyze HTTP Requests To Minimize Risks Of HTTP Desync Attacks. It went through a long evolution since 1991 to 2014

4 viewsedited 17:03

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
Dep-Scan : Fully Open-Source Security Audit For Project Dependencies

dep-scan is a fully open-source security audit tool for project dependencies based on known vulnerabilities, advisories and license limitations. Both local repositories and container images are supported as input. The tool is ideal for CI environments with built-in build breaker logic.

If you have just come across this repo, probably the best place to start is to checkout the parent project slscan which include depscan along with a number of other tools. Features

* Local repos and container image based scanning with CVE insights [1]
* Package vulnerability scanning is performed locally and is quite fast. No server is used!
* Suggest optimal fix version by package group (See suggest mode)
* Perform deep packages risk audit for dependency confusion attacks and maintenance risks (See risk audit)

NOTE

* [1] Only application related packages in container images are included in scanning. OS packages are not included yet. https://github.com/AppThreat/dep-scan/raw/master/docs/depscan-latest.png Vulnerability Data sources

* OSV
* NVD
* GitHub
* NPM Usage

dep-scan is ideal for use during continuous integration (CI) and also as a tool for local development. Use with ShiftLeft Scan

dep-scan is integrated with scan, a free and open-source SAST tool. To enable this feature simply pass depscanto the --typeargument. Refer to the scan documentation for more information.

–type python,depscan,credscan

This approach should work for all CI environments supported by scan. Scanning projects locally (Python version)

sudo npm install -g @appthreat/cdxgen
pip install appthreat-depscan

This would install two commands called cdxgenand scan.

You can invoke the scan command directly with the various options.

cd
depscan –src $PWD –report_file $PWD/reports/depscan.json

Full list of options are below:

usage: depscan [-h] [–no-banner] [–cache] [–sync] [–suggest] [–risk-audit] [–private-ns PRIVATE_NS] [-t PROJECT_TYPE] [–bom BOM] -i SRC_DIR [-o REPORT_FILE]
[–no-error]
-h, –help show this help message and exit
–no-banner Do not display banner
–cache Cache vulnerability information in platform specific user_data_dir
–sync Sync to receive the latest vulnerability data. Should have invoked cache first.
–suggest Suggest appropriate fix version for each identified vulnerability.
–risk-audit Perform package risk audit (slow operation). Npm only.
–private-ns PRIVATE_NS
Private namespace to use while performing oss risk audit. Private packages should not be available in public registries by default. Comma
separated values accepted.
-t PROJECT_TYPE, –type PROJECT_TYPE
Override project type if auto-detection is incorrect
–bom BOM Examine using the given Software Bill-of-Materials (SBoM) file in CycloneDX format. Use cdxgen command to produce one.
-i SRC_DIR, –src SRC_DIR
Source directory
-o REPORT_FILE, –report_file REPORT_FILE
Report filename with directory
–no-error Continue on error to prevent build from breaking

Scanning containers locally (Python version)

Scan latesttag of the container shiftleft/scan-slimdepscan –no-error –cache –src shiftleft/scan-slim -o containertests/depscan-scan.json -t docker

Include licenseto the type to perform license audit.

depscan –no-error –-cache –src shiftleft/scan-slim -o containertests/depscan-scan.json -t docker,license

You can also save container images using docker or podman save command and pass the archive to depscan for scanning.

docker save -o /tmp/scanslim.tar shiftleft/scan-slim:latest
podman save –format oci-archive -o /tmp/scanslim.tar shiftleft/scan-slim:latest
depscan –no-error –src /tmp/scanslim.tar -o reports/depscan-scan.json -t docker

Supported languages and package forma[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Dep-Scan : Fully Open-Source Security Audit For Project Dependencies

dep-scan is a fully open-source security audit tool for project dependencies based on known vulnerabilities, advisories.

3 viewsedited 17:03

Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials Http-Desync-Guardian – Analyze HTTP Requests To Minimize Risks Of HTTP Desync Attacks Http-Desync-Guardian is to Analyze HTTP Requests To Minimize Risks Of HTTP Desync Attacks. HTTP/1.1went through a long evolution since 1991 to 2014:…

onization. Recommended http_desync_guardianModes
ClassificationDefensive modeStrictest modeCompliantAllowedAllowedAcceptableAllowedBlockedAmbiguousAllowed¹BlockedSevereBlockedBlocked
¹ Route the requests but closes the client and target connections.

For Blockedrequests the client connection must be closed.

If you are concerned about potential impact, Monitoring mode offers a metrics-only approach to assess prior to switching. Classification Reasons* Compliant* Compliant– a compliant request

* Acceptable* NonCompliantHeader– non-essential header containing a non-ASCII or control characters (CTL) – i.e. special invisible characters.
* SpaceInUri– unescaped space in the URI
* NonCompliantVersion– version which contains extra spaces, missing (i.e. HTTP/0.9) or matches HTTP/1.[2-9]
* GetHeadZeroContentLength– GET/HEAD request with a “Content-Length: 0” header

* Ambiguous* EmptyHeader– if there is an empty header or a line with whitespaces only in the request
* AmbiguousUri– an URI containing CTL characters
* UndefinedContentLengthSemantics– Content-Length for GET/HEAD requests
* UndefinedTransferEncodingSemantics– Transfer-Encoding for GET/HEAD requests
* DuplicateContentLength– duplicated Content-Length header (same value)
* BothTeClPresent– both Transfer-Encoding and Content-Length are present in the request
* SuspiciousHeader– a header that can be normalized to Transfer-Encodingor Content-Lengthusing common text normalization techniques (sanitation, case normalization, delimiters normalization).

* Severe* BadHeader– header containing null-character or CR
* BadUri– URI containing null-character or CR
* BadVersion– malformed version
* MultipleContentLength– different Content-Length headers
* BadContentLength– a non-parseable value or an invalid number
* MultipleTransferEncodingChunked– multiple Transfer-Encoding: chunked headers
* BadTransferEncoding– unknown Transfer-Encoding value
* BadMethod– malformed method

* Parsingraw-requests
* NonCrLfLineTermination(Acceptable) – allowing “\n” line termination (similar to Nginx).
* MultilineHeader(Ambiguous) – multi-line headers are non RFC compliant (except Content-Type)
* PartialHeaderLine(Ambiguous) – if a header line was not terminated
* MissingLastEmptyLine(Ambiguous) – there is no empty line at the end of request
* MissingHeaderColon(Ambiguous) – header line doesn’t have colon separator
* MissingUri(Ambiguous) – there is no URI in the request line Details on certain classifications Undefined Content-Length/Transfer-Encoding Semantics (UndefinedTransferEncodingSemantics, UndefinedContentLengthSemantics)A payload within a GET/HEAD request message has no defined semantics. https://tools.ietf.org/html/rfc7231#section-4.3

https://medium.com/@knownsec404team/protocol-layer-attack-http-request-smuggling-cc654535b6f 3.1 GET Request with CL != 0

https://portswigger.net/web-security/request-smuggling/exploiting See “Capturing other users’ requests” https://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf see “EXAMPLE #3” Both Content-Length and Transfer-Encoding are present (BothTeClPresent)

If a request containing both Content-Length and Transfer-Encoding was received, it means that the sender didn’t follow RFC, and thus there is a chance that request boundaries might be out of sync with the sender.

If a message is received with both a Transfer-Encoding and a Content-Length header field, the Transfer-Encoding overrides the Content-Length. Such a message might indica[...]

___________________________
@hacking_Attack
@Hacking_Video

IETF Datatracker

RFC 7231: Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content

The Hypertext Transfer Protocol (HTTP) is a stateless \%application- level protocol for distributed, collaborative, hypertext information systems. This document defines the semantics of HTTP/1.1 messages, as expressed by request methods, request header fields…

1 viewedited 17:03

Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials Dep-Scan : Fully Open-Source Security Audit For Project Dependencies dep-scan is a fully open-source security audit tool for project dependencies based on known vulnerabilities, advisories and license limitations. Both local repositories…

t

dep-scan uses cdxgen command internally to create Software Bill-of-Materials (SBoM) file for the project. This is then used for performing the scans.

The following projects and package-dependency format is supported by cdxgen.
LanguagePackage formatnode.jspackage-lock.json, pnpm-lock.yaml, yarn.lock, rush.jsjavamaven (pom.xml [1]), gradle (build.gradle, .kts), scala (sbt)phpcomposer.lockpythonsetup.py, requirements.txt [2], Pipfile.lock, poetry.lock, bdist_wheel, .whlgobinary, go.mod, go.sum, Gopkg.lockrubyGemfile.lock, gemspecrustCargo.toml, Cargo.lock.Net.csproj, packages.config, project.assets.json, packages.lock.jsondocker / oci imageAll supported languages excluding OS packages
NOTE

The docker image for dep-scan currently doesn’t bundle suitable java and maven commands required for bom generation. To workaround this limitation, you can –

* Use python-based execution from a VM containing the correct versions for java, maven and gradle.
* Generate the bom file by invoking cdxgencommand locally and subsequently passing this to dep-scanvia the --bomargument. Integration with CI environments Integration with Azure DevOps

Refer to this example yaml configuration for integrating dep-scan with Azure Pipelines. The build step would perform the scan and display the report inline as shown below:
https://blogger.googleusercontent.com/img/a/AVvXsEh-pjxjO4AFRU5NvapTl_mcVXj_I6Q51VvE8R0OXsZpe0k9msVD1sIPfujKeS_xT-X7HHc_nsertaq93ujnlmJq250kYjzNN4mUPBLcNw6L2f_ZXTQqLG7ml7wUbc6uHwDFYlFJlDrQfPs_JAF-DfFUol4nJCZAZxkYyhR5jQ9N4P6HzqFsttHnqHtO=s2826
Integration with GitHub Actions

This tool can be used with GitHub Actions using this action.

This repo self-tests itself with both sast-scan and dep-scan! Check the GitHub workflow file of this repo.

* name: Self dep-scan
uses: AppThreat/dep-scan-action@master
env:
VDB_HOME: ${{ github.workspace }}/db
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
* Customisation through environment variablesThe following environment variables can be used to customise the behaviour.

* VDB_HOME – Directory to use for caching database. For docker based execution, this directory should get mounted as a volume from the host
* NVD_START_YEAR – Default: 2018. Supports upto 2002
* GITHUB_PAGE_COUNT – Default: 2. Supports upto 20 GitHub Security Advisory

To download security advisories from GitHub, a personal access token with the following scope is necessary.

* read:packages

export GITHUB_TOKEN=””

Package Risk Audit --risk-auditargument enables package risk audit. Currently, only npm and pypi packages are supported in this mode. A number of risk factors are identified and assigned weights to compute a final risk score. Packages that then exceed a maximum risk score (config.pkg_max_risk_score) are presented in a table.

Use --private-nsto specify the private package namespace that should be checked for dependency confusion type issues where a private package is available on public npm/pypi registry.

Example to check if private packages with namespaces @appthreat and @shiftleft are not accidentally made public use the below argument. --private-ns appthreat,shiftleft Risk categoryDefault WeightReasonpkg_private_on_public_registry4Private package is available on a public registrypkg_min_versions2Packages with less than 3 versions represent an extreme where they could be either super stable or quite recent. Special heuristics are applied to ignore older stable packagesmod_create_min_seconds1Less than 12 hours difference between modified and creation time. This indicates that the upload had a defect that had to be rectified immediately. Sometimes, such a rapid update could also be maliciouslatest_now_min_seconds0.5Less than 12 hours difference between the latest version and the current time. Depending on the package such a latest version may or may not be desirablelatest_n[...]

___________________________
@hacking_Attack
@Hacking_Video

1 viewedited 17:04

Hacking Articles Tips Tricks Videos Tutorials

onization. Recommended http_desync_guardianModes ClassificationDefensive modeStrictest modeCompliantAllowedAllowedAcceptableAllowedBlockedAmbiguousAllowed¹BlockedSevereBlockedBlocked ¹ Route the requests but closes the client and target connections. For…

te an attempt to perform request smuggling (Section 9.5) or response splitting (Section 9.4) and ought to be handled as an error. A sender MUST remove the received Content-Length field prior to forwarding such a message downstream.

https://tools.ietf.org/html/rfc7230#section-3.3.2 Multi-line headers (MultilineHeader)

Multi-line headers have been deprecated in RFC 7230, and different engines may either support it or not, which provides malicious actors a toolkit to trick parser to “see” headers that are not there or vice versa. That’s why we mark requests containing multi-line headers as Ambiguous (except the Content-Type header).

Historically, HTTP header field values could be extended over multiple lines by preceding each extra line with at least one space or horizontal tab (obs-fold). This specification deprecates such line folding except within the message/http media type (Section 8.3.1). A sender MUST NOT generate a message that includes line folding (i.e., that has any field-value that contains a match to the obs-fold rule) unless the message is intended for packaging within the message/http media type.

https://tools.ietf.org/html/rfc7230#section-3.2.4 Multiple Transfer-Encoding Chunked (MultipleTransferEncodingChunked)

A sender MUST NOT apply chunked more than once to a message body

https://tools.ietf.org/html/rfc7230#section-3.3.1 Multiple Content-Length Headers (MultipleContentLength, DuplicateContentLength)

If there are multiple different Content-Length headers (different values) the request is marked as Severe. In the case of multiple but same values, it falls into DuplicateContentLength category (marked as Ambiguous).

If a message is received that has multiple Content-Length header fields with field-values consisting of the same decimal value, or a single Content-Length header field with a field value containing a list of identical decimal values (e.g., “Content-Length: 42, 42”), indicating that duplicate Content-Length header fields have been generated or combined by an upstream message processor, then the recipient MUST either reject the message as invalid or replace the duplicated field-values with a single valid Content-Length field containing that decimal value prior to determining the message body length or forwarding the message.

https://tools.ietf.org/html/rfc7230#section-3.3.2 Suspicious headers (SuspiciousHeader)

There is a range of attacks to masquerade Transfer-Encoding and Content-Length headers, so some engines in the chain will see them while others won’t. For example:

Transfer-Encoding : chunked
Content-Length: 100

In this case, some engines may reject this request, as it’s not RFC compliant. Some may sanitize the space before the colon and treat as it has “Transfer-Encoding: chunked” while some may see “Transfer-Encoding[space]” and ignore it. It is the simplest case to illustrate this idea, but there are many others. For instance:

Transfer-Encodıng: chunked

Small Dotless I becomes ASCII “I” on upper-case transformation which may trick some engines. Or have a CTL character:

Transfer_Encoding: chunked
\x01Transfer-Encoding: chunked
Transfer-Encoding\b: chunked

Some engines may normalize delimiters or non-letters, e.g., using regular expressions, etc. (especially using standard string trimming routines that may have different behaviors in different platforms).

To mitigate these risks, we determine the similarity of headers to Transfer-Encodingand Content-Length and mark requests as Ambiguous if any of these deviations are detected. Mitigations

There are two types of mitigations:

* Reject request with 400 and close the connection
* Serve the request but disable connection re-use on both front-end and back-end.

Why connection is closed after a Severerequest

In this case, we cannot establish request boundaries and tell when the next request starts.

Why connections are both FE/BE connections closed af[...]

___________________________
@hacking_Attack
@Hacking_Video

1 viewedited 17:04

About

Blog

Apps

Platform