Hacking on Medium
Secure Software Summit: The State of OSS Supply Chain Security

https://cdn-images-1.medium.com/max/2600/0*0JpaIJxznXkL7ZIF
By Dan Lorenc, Chainguard

Continue reading on ShiftLeft Blog »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Moving executable to startup folder triggers windows defender on Windows 10. Is there a way to stay undetected?

Just coding a program for myself and when I copy my executable to the startup folder windows defender automatically blocks it. 6 years ago this was undetected but times have changed

submitted by /u/Letsgoandexplore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
beginning

hey guys lI'm trying to get into hacking, i downloaded an app called Ethical Hacking and it's asking me to download virtual box with Kali Linux but i don't know which one it is. any suggestions?

submitted by /u/RoyaleKnightGaming
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/T-tavwUrYdLDj8nhaUXgBptZMqaocP8PBOcv7qUY_Ws.jpg submitted by /u/quesoboi21
[link] [comments]

hacking: security in practice
Clickjacking method that bypassed CORS for multi-step

https://external-preview.redd.it/KsrlIWF5nHc865UWAdaB5kAv62i-nUH8p4u2QVYYsMc.jpg?width=320&crop=smart&auto=webp&s=39fc846348814f6f4871b92c4f1fb9c073830be3 submitted by /u/AntoinetMartin
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
PurplePanda - Identify Privilege Escalation Paths Within And Across Different Clouds

https://blogger.googleusercontent.com/img/a/AVvXsEidFt5ibzldwSMn7USOdo2gx3oMcsxByF3lgUJoDBOC4Z2ptdk7eIPaXW2X6QRdSTtetxUYTJwyHDW3ACkPHjuUI6UpAlExnhjmilPS4P4RqWW5a8Diy5wyN_2auA2qrkrJsS9v-buM25PYe77IiapDqWL_Xamjgr8LNGGSRcsFBaGdJKgiYlZ9Z5f1=w640-h400 This tool fetches resources from different cloud/saas applications focusing on permissions in order to identify privilege escalation paths and dangerous permissions in the cloud/saas configurations. Note that PurplePanda searches both privileges escalation paths within a platform and across platforms.

The name comes from the animal Red Panda. This panda eats peas, just like Purple Panda, which can ingest API keys/tokens found by these PEASS. The color was changed to purple because this tool is meant mainly for Purple Teams (because it can be highly useful for both Blue and Red Teams). How to useEach folder inside /inteldefines one platform that can be enumerated and contains a README.md file explaining how to use that specific module.

Download Neo4jDesktop and create a database. Then export the env variables PURPLEPANDA_NEO4J_URLand PURPLEPANDA_PWDwith the URL to the neo4j database and the password.

If you want shodan to be used with public IPs discovered during the enumeration export a env variable called SHODAN_KEY with a valid api key of shodan.

Then just install and launch the program indicating the platforms you want to enumerate comma separated like: git clone https://github.com/carlospolop/PurplePanda
cd PurplePanda
python3 -m venv .
source bin/activate
python3 -m pip install -r requirements.txt
export PURPLEPANDA_NEO4J_URL="bolt://neo4j@localhost:7687"
export PURPLEPANDA_PWD="neo4j_pwd_4_purplepanda"
python3 main.py -h # Get help
python3 main.py -e --enumerate google,github,k8s --github-only-org --k8s-get-secret-values --gcp-get-secret-values # Enumerate google, github and k8sPurplePanda has 2 analysis modes:

* -e(enumerate): This is the main one, it will try to gather data and analyze it.
* -a(analyze): This will perform a quick analysis of the provided credentials. Video tutorialCheck how to use and inspect the data gathered by PurplePanda: For Blue/Purple TeamsUse credentials for each platform with at least admin read access to all the resources of the platform. This will help you to see exactly the privesc paths that can be abused within your configurations in each platform and across For Red TeamsPurplePanda is also designed to be used by Red Teams. In general, cloud/saas platforms won't give everyone access to read the configuration of the platform, that's why PurplePanda supports the use of several keys for the same platform, in order to try to enumerate everything with all the keys you compromised and have the most accurate view of the configuration of the platform. Supported platforms* Google Cloud Platform (GCP): To understand how GCP security works and how to abuse roles and permissions read https://book.hacktricks.xyz/cloud-security/gcp-security
* Github: To understand how Github security works and how to bypass branch protections, steal secrets, privesc... read https://book.hacktricks.xyz/cloud-security/github-security
* Kubernetes (K8s): To understand how Kubernetes RBAC security works and how to abuse roles, privesc to other clouds... read https://book.hacktricks.xyz/cloud-security/pentesting-kubernetes How to use the dataUse the -dparameter indicating a directory. Then, PurplePanda will write in this directory several interesting analysis in csvformat of the information obtained from all the platforms. The recommendation is to find interesting and unexpected things in those files an[...]

___________________________
@hacking_Attack
@Hacking_Video

d then move to analyze those interesting cases with the graphs.

Each folder inside /inteldefines one platform that can be enumerated and contains a README.md file explaining how to use that specific module. Moreover, each folder also contains a HOW_TO_USE.mdfile and a QUERIES.mdfile.

In the HOW_TO_USE.mdfile you can find the best queries to perform an investigation on how to escalate privileges (for Purple, Blue, and Red Teams).

In the QUERIES.mdfile you will find all proposed queries to investigate the data easier. How to visualize the data in graphsFollow the instructions indicated in VISUALIZE_GRAPHS.md How to ContributeIn the root folder and in each folder inside intel/you will find a TODO.mdfile. You can find in those files how you can help. Just send a PR with the addition.

PRs with fixes are also welcome :)

Moreover, if you have other ideas that aren't in those TODO files feel free to send a PR.

By Polop(TM) Download PurplePanda

___________________________
@hacking_Attack
@Hacking_Video

PurplePanda - Identify Privilege Escalation Paths Within And Across Different Clouds
http://www.kitploit.com/2022/03/purplepanda-identify-privilege.html

___________________________
@hacking_Attack
@Hacking_Video

This tool fetches resources from different cloud/saas applications focusing on permissions in order to identify privilege escalation (https://www.kitploit.com/search/label/Privilege%20Escalation) paths and dangerous permissions in the cloud/saas configurations. Note that PurplePanda searches both privileges escalation (https://www.kitploit.com/search/label/Escalation) paths within a platform and across platforms. The name comes from the animal Red Panda. This panda eats peas, just like Purple Panda, which can ingest API keys/tokens found by these PEASS (https://github.com/carlospolop/PEASS-ng). The color was changed to purple because this tool is meant mainly for Purple Teams (because it can be highly useful for both Blue and Red Teams).
How to use Each folder inside /intel defines one platform that can be enumerated and contains a README.md file explaining how to use that specific module. Download Neo4jDesktop (https://neo4j.com/download-center/#desktop) and create a database. Then export the env variables PURPLEPANDA_NEO4J_URL and PURPLEPANDA_PWD with the URL to the neo4j database and the password. If you want shodan to be used with public IPs discovered during the enumeration (https://www.kitploit.com/search/label/Enumeration) export a env variable called SHODAN_KEY with a valid api key of shodan. Then just install and launch the program indicating the platforms you want to enumerate comma separated like: git clone https://github.com/carlospolop/PurplePanda
cd PurplePanda
python3 -m venv .
source bin/activate
python3 -m pip install -r requirements.txt
export PURPLEPANDA_NEO4J_URL="bolt://neo4j@localhost:7687"
export PURPLEPANDA_PWD="neo4j_pwd_4_purplepanda"
python3 main.py -h # Get help
python3 main.py -e --enumerate google,github,k8s --github-only-org --k8s-get-secret-values --gcp-get-secret-values # Enumerate google, github and k8s PurplePanda has 2 analysis modes: -e (enumerate): This is the main one, it will try to gather data and analyze it. -a (analyze): This will perform a quick analysis of the provided credentials. Video tutorial Check how to use and inspect the data gathered by PurplePanda:
For Blue/Purple Teams Use credentials (https://www.kitploit.com/search/label/Credentials) for each platform with at least admin read access to all the resources of the platform. This will help you to see exactly the privesc paths that can be abused within your configurations in each platform and across For Red Teams PurplePanda is also designed to be used by Red Teams. In general, cloud/saas platforms won't give everyone access to read the configuration of the platform, that's why PurplePanda supports the use of several keys for the same platform, in order to try to enumerate everything with all the keys you compromised and have the most accurate view of the configuration of the platform. Supported platforms Google Cloud Platform (GCP): To understand how GCP security works and how to abuse roles and permissions read https://book.hacktricks.xyz/cloud-security/gcp-security Github: To understand how Github security works and how to bypass branch protections, steal secrets, privesc... read https://book.hacktricks.xyz/cloud-security/github-security Kubernetes (K8s): To understand how Kubernetes (https://www.kitploit.com/search/label/Kubernetes) RBAC security works and how to abuse roles, privesc to other clouds... read https://book.hacktricks.xyz/cloud-security/pentesting-kubernetes How to use the data Use the -d parameter indicating a directory. Then, PurplePanda will write in this directory several interesting analysis in csv format of the information obtained from all the platforms. The recommendation is to find interesting and unexpected things in those files and then move to analyze those interesting cases with the graphs. Each folder inside /intel defines one platform that can be enumerated and contains a README.md file explaining how to use that specific module. Moreover, each folder also

___________________________
@hacking_Attack
@Hacking_Video

contains a HOW_TO_USE.md file and a QUERIES.md file. In the HOW_TO_USE.md file you can find the best queries to perform an investigation on how to escalate privileges (for Purple, Blue, and Red Teams). In the QUERIES.md file you will find all proposed queries to investigate the data easier. How to visualize the data in graphs Follow the instructions indicated in VISUALIZE_GRAPHS.md (https://github.com/carlospolop/PurplePanda/blob/master/VISUALIZE_GRAPHS.md) How to Contribute In the root folder and in each folder inside intel/ you will find a TODO.md file. You can find in those files how you can help. Just send a PR with the addition. PRs with fixes are also welcome :) Moreover, if you have other ideas that aren't in those TODO files feel free to send a PR. By Polop(TM)

Download PurplePanda (https://github.com/carlospolop/PurplePanda)

___________________________
@hacking_Attack
@Hacking_Video

Looking for a certain utility key
https://www.reddit.com/r/Pentesting/comments/tgbe6f/looking_for_a_certain_utility_key/

From the front it looks like a circle with a line through one side, kinda like a Q or a Ø. From the side it looks like a regular key blank, but the shaft is a hollow cylinder only about an inch long, with a small groove from the line. All help is appreciated, thanks submitted by /u/Maninblue69 (https://www.reddit.com/user/Maninblue69)
[link] (https://www.reddit.com/r/Pentesting/comments/tgbe6f/looking_for_a_certain_utility_key/) [comments] (https://www.reddit.com/r/Pentesting/comments/tgbe6f/looking_for_a_certain_utility_key/)

___________________________
@hacking_Attack
@Hacking_Video

Unraveling Assets from Android Apps at Scale - An OSINT API allows you to scan over half a million Android apps for subdomains, S3 buckets, URL Params and more
https://www.reddit.com/r/redteamsec/comments/tgc9od/unraveling_assets_from_android_apps_at_scale_an/

submitted by /u/alt-glitch (https://www.reddit.com/user/alt-glitch)
[link] (https://bevigil.com/blog/unraveling-assets-from-android-apps-at-scale/) [comments] (https://www.reddit.com/r/redteamsec/comments/tgc9od/unraveling_assets_from_android_apps_at_scale_an/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Enhancing DLP With Natural Language Understanding for Better Email Security

Natural language understanding is well-suited for scanning enterprise email to detect and filter out spam and other malicious content. Armorblox introduces a data loss prevention service to its email security platform using NLU.

Dark Reading: Attacks/Breaches
Cut Down on Alert Overload and Leverage Layered Security Measures

Feeling overwhelmed by the number of alerts? It doesn't have to be that way.

Cansina — Open Source Hidden Content Discovery Tool on Linux

Reconnaissance is one of the first steps to conduct within a pen test engagement. During this stage, information is gathered using…Continue reading on Medium »
Read more...

Kali Linux Tutorials
Elfloader : An Architecture-Agnostic ELF File Flattener For Shellcode

Elfloaderis a super simple loader for ELF files that generates a flat in-memory representation of the ELF.

Pair this with Rust and now you can write your shellcode in a proper, safe, high-level language. Any target that LLVM can target can be used, including custom target specifications for really exotic platforms and ABIs. Enjoy using things like u64s on 32-bit systems, bounds checked arrays, drop handling of allocations, etc https://s.w.org/images/core/emoji/13.1.0/72x72/1f642.png

It simply concatenates all LOADsections together, using zero-padding if there are gaps, into one big flat file.

This file includes zero-initialization of .bsssections, and thus can be used directly as a shellcode payload.

If you don’t want to waste time with fail-open linker scripts, this is probably a great way to go.

This doesn’t handle any relocations, it’s on you to make sure the original ELF is based at the address you want it to be at. UsageTo use this tool, simply:

Usage: elfloader [–perms] [–binary] [–base=]
–binary – Don’t output a FELF, output the raw loaded image with no
metadata
–perms – Create a FELF0002 which includes permission data, overrides
–binary
–base= – Force the output to start at , zero padding from
the base to the start of the first LOAD segment if needed. is default hex, can be overrided with 0d, 0b, 0x, or 0oprefixes.
Warning: This does not relocate to base, it simply starts
the output at (adding zero bytes such that the
output image can be loaded at instead of the
original ELF base)
– Path to input ELF
– Path to output file

To install this tool run: cargo install --path .Now you can use elfloaderfrom anywhere in your shell! DevThis project was developed live here: ExampleThere’s an example in example_small_program, simply run makeor nmakeand this should generate an example.binwhich is 8 bytes.

pleb@gamey ~/elfloader/example_small_program $ make
cargo build –release
Finished release [optimized] target(s) in 0.03s
elfloader –binary target/aarch64-unknown-none/release/example_small_program example.bin
pleb@gamey ~/elfloader/example_small_program $ ls -l ./example.bin
-rw-r–r– 1 pleb pleb 8 Nov 8 12:27 ./example.bin
pleb@gamey ~/elfloader/example_small_program $ objdump -d target/aarch64-unknown-none/release/example_small_program
target/aarch64-unknown-none/release/example_small_program: file format elf64-littleaarch64
Disassembly of section .text:
00000000133700b0 <_start:
133700b0: 8b000020 add x0, x1, x0
133700b4: d65f03c0 ret

Now you can write your shellcode in Rust, and you don’t have to worry about whether you emit .data, .rodata, .bss, etc. This will handle it all for you!

There’s also an example with .bssand .rodatapleb@gamey ~/elfloader/example_program_with_data $ make
cargo build –release
Finished release [optimized] target(s) in 0.04s
elfloader –binary target/aarch64-unknown-none/release/example_program_with_data example.bin
pleb@gamey ~/elfloader/example_program_with_data $ ls -l ./example.bin
-rw-r–r– 1 pleb pleb 29 Nov 8 12:39 ./example.bin
pleb@gamey ~/elfloader/example_program_with_data $ objdump -d target/aarch64-unknown-none/release/example_program_with_data
target/aarch64-unknown-none/release/example_program_with_data: file format elf64-littleaarch64
Disassembly of section .text:
0000000013370124 <_start:
13370124: 90000000 adrp x0, 13370000 <_start-0x124
13370128: 90000008 adrp x8, 13370000 <_start-0x124
1337012c: 5280[...]

___________________________
@hacking_Attack
@Hacking_Video

0029 mov w9, #0x1 // #1
13370130: 91048000 add x0, x0, #0x120
13370134: 3904f109 strb w9, [x8, #316]
13370138: d65f03c0 ret
pleb@gamey ~/elfloader/example_program_with_data $ readelf -l target/aarch64-unknown-none/release/example_program_with_data
Elf file type is EXEC (Executable file)
Entry point 0x13370124
There are 4 program headers, starting at offset 64
Program Headers:
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
LOAD 0x0000000000000120 0x0000000013370120 0x0000000013370120
0x0000000000000004 0x0000000000000004 R 0x1
LOAD 0x0000000000000124 0x0000000013370124 0x0000000013370124
0x0000000000000018 0x0000000000000018 R E 0x4
LOAD 0x000000000000013c 0x000000001337013c 0x000000001337013c
0x0000000000000000 0x0000000000000001 RW 0x4
GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 RW 0x0
Section to Segment mapping:
Segment Sections…
00 .rodata
01 .text
02 .bss
03 InternalsThis tool doesn’t care about anything except for LOADsections. It determines the endianness (little vs big) and bitness (32 vs 64) from the ELF header, and from there it creates a flat image based on program header virtual addresses (where it’s loaded), file size (number of initialized bytes) and mem size (size of actual memory region). The bytes are initialized from the file based on the offset and file size, and this is then extended with zeros until mem size (or truncated if mem size is smaller than file size).

These LOADsections are then concatenated together with zero-byte padding for gaps.

This is designed to be incredibly simple, and agnostic to the ELF input. It could be an executable, object file, shared object, core dump, etc, doesn’t really care. It’ll simply give you the flat representation of the memory, nothing more.

This allows you to turn any ELF into shellcode, or a simpler file format that is easier to load in hard-to-reach areas, like embedded devices. Personally, I developed this for my MIPS NT 4.0 loader which allows me to run Rust code. FELF0001 formatThis tool by default generates a FELF file format. This is a Falk ELF. This is a simple file format:

FELF0001 – Magic header
entry – 64-bit little endian integer of the entry point address
base – 64-bit little endian integer of the base address to load the image
– Rest of the file is the raw image, to be loaded at baseand jumped
into at entryFELF0002 format (when –perms flag is used)This tool by default generates a FELF file format. This is a Falk ELF. This is a simple file format with permissions:

FELF0002 – Magic header
entry – 64-bit little endian integer of the entry point address
base – 64-bit little endian integer of the base address to load the image
– Rest of the file is the raw image, to be loaded at baseand jumped
into at entry– Permissions, matching the bytes of where the byte contains
the following flags bitwise or-ed together:
0x01 – Executable, 0x02 – Writable, 0x04 – Readable
Padding bytes will be 0x00, and thus have no permissions for any
access Download

___________________________
@hacking_Attack
@Hacking_Video