A Bottle Message to Bug Hunters!
https://infosecwriteups.com/a-bottle-message-to-bug-hunters-18e5835069e6?source=rss------bug_bounty-5
https://infosecwriteups.com/a-bottle-message-to-bug-hunters-18e5835069e6?source=rss------bug_bounty-5
Bug Bounty = PatienceContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/a-bottle-message-to-bug-hunters-18e5835069e6?source=rss------bug_bounty-5)
A Bottle Message to Bug Hunters!
Bug Bounty = PatienceContinue reading on InfoSec Write-ups »
Read more...
Bug Bounty = PatienceContinue reading on InfoSec Write-ups »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Browser-in-the-Browser Attack Makes Phishing Nearly Invisible
Browser-in-the-Browser Attack Makes Phishing Nearly InvisiblePost Views: 73
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 2 Minutes
The novel method takes advantage of third-party single sign-on (SSO) options embedded on websites that issue popup windows for authentication, such as “Sign in with Google,” Facebook, Apple or Microsoft.
Can we trust web browsers to protect us, even if they say “https?” Not with the novel BitB attack, which fakes popup SSO windows to phish away credentials for Google, Facebook and Microsoft, et al.
We’ve had it beaten into our brains: Before you go wily-nily clicking on a page, check the URL. First things first, the tried-and-usually-but-not-always-true advice goes, check that the site’s URL shows “https,” indicating that the site is secured with TLS/SSL encryption.
If only it were that easy to avoid phishing sites. In reality, URL reliability hasn’t been absolute for a long time, given things like homograph attacks that swap in similar-looking characters in order to create new, identical-looking but malicious URLs, as well as DNS hijacking, in which Domain Name System (DNS) queries are subverted.
Now, there’s one more way to trick targets into coughing up sensitive info, with a coding ruse that’s invisible to the naked eye. The novel phishing technique, described last week by a penetration tester and security researcher who goes by the handle mr.d0x, is called a browser-in-the-browser (BitB) attack.
See Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions.png The researcher used Canva as an example: In the log-in window for Canva shown below, the popup asks users to authenticate via their Google account. https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/21194343/Legit-login-to-Canva-e1647906237286.png Login to Canva using Google account credentials. Source: mr.d0x It’s Easy to Fabricate an Identical, Malicious PopupThese days, SSO popups are a routine way to authenticate when you sign in.
But according to mr.d0x’s post, completely fabricating a malicious version of a popup window is a snap: It’s “quite simple” using basic HTML/CSS, the researcher said. The concocted popups simulate a browser window within the browser, spoofing a legitimate domain and making it possible to stage convincing phishing attacks.
“Combine the window design with an iframe pointing to the malicious server hosting the phishing page, and [it’s] basically indistinguishable,” mr.d0x wrote. The report provided an image, included below, that shows a side-by-side of a fake window next to the real window. https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/21194525/real-v-fake-login-pages-e1647906342234.png Nearly identical real vs. fake login pages. Source: mr.d0x.
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH “Very few people would notice the slight differences between the two,” according to the report.
JavaScript can make the window appear on a link, button click or page loading screen, the report continued. As well, libraries – such as the popular JQuery JavaScript library – can make the window appear visually appealing … or, at least, visually bouncy, as depicted in the .gif provided in the researcher’s demo and shown below. https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/21154801/BitB-demo.gif BitB demo. Source: mr.d0x. Hovering Over Links: Another Easily Fooled Security SafeguardThe BitB attack can also flummox those who use the [...]
Browser-in-the-Browser Attack Makes Phishing Nearly Invisible
Browser-in-the-Browser Attack Makes Phishing Nearly InvisiblePost Views: 73
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 2 Minutes
The novel method takes advantage of third-party single sign-on (SSO) options embedded on websites that issue popup windows for authentication, such as “Sign in with Google,” Facebook, Apple or Microsoft.
Can we trust web browsers to protect us, even if they say “https?” Not with the novel BitB attack, which fakes popup SSO windows to phish away credentials for Google, Facebook and Microsoft, et al.
We’ve had it beaten into our brains: Before you go wily-nily clicking on a page, check the URL. First things first, the tried-and-usually-but-not-always-true advice goes, check that the site’s URL shows “https,” indicating that the site is secured with TLS/SSL encryption.
If only it were that easy to avoid phishing sites. In reality, URL reliability hasn’t been absolute for a long time, given things like homograph attacks that swap in similar-looking characters in order to create new, identical-looking but malicious URLs, as well as DNS hijacking, in which Domain Name System (DNS) queries are subverted.
Now, there’s one more way to trick targets into coughing up sensitive info, with a coding ruse that’s invisible to the naked eye. The novel phishing technique, described last week by a penetration tester and security researcher who goes by the handle mr.d0x, is called a browser-in-the-browser (BitB) attack.
See Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions.png The researcher used Canva as an example: In the log-in window for Canva shown below, the popup asks users to authenticate via their Google account. https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/21194343/Legit-login-to-Canva-e1647906237286.png Login to Canva using Google account credentials. Source: mr.d0x It’s Easy to Fabricate an Identical, Malicious PopupThese days, SSO popups are a routine way to authenticate when you sign in.
But according to mr.d0x’s post, completely fabricating a malicious version of a popup window is a snap: It’s “quite simple” using basic HTML/CSS, the researcher said. The concocted popups simulate a browser window within the browser, spoofing a legitimate domain and making it possible to stage convincing phishing attacks.
“Combine the window design with an iframe pointing to the malicious server hosting the phishing page, and [it’s] basically indistinguishable,” mr.d0x wrote. The report provided an image, included below, that shows a side-by-side of a fake window next to the real window. https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/21194525/real-v-fake-login-pages-e1647906342234.png Nearly identical real vs. fake login pages. Source: mr.d0x.
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH “Very few people would notice the slight differences between the two,” according to the report.
JavaScript can make the window appear on a link, button click or page loading screen, the report continued. As well, libraries – such as the popular JQuery JavaScript library – can make the window appear visually appealing … or, at least, visually bouncy, as depicted in the .gif provided in the researcher’s demo and shown below. https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/21154801/BitB-demo.gif BitB demo. Source: mr.d0x. Hovering Over Links: Another Easily Fooled Security SafeguardThe BitB attack can also flummox those who use the [...]
Black Hat Ethical Hacking
Browser-in-the-Browser Attack Makes Phishing Nearly Invisible
Browser-in-the-Browser Attack Makes Phishing Nearly Invisible
Black Hat Ethical Hacking
Browser-in-the-Browser Attack Makes Phishing Nearly Invisible | Black Hat Ethical Hacking
The novel method takes advantage of third-party single sign-on (SSO) options embedded on websites that issue popup windows for authentication, such as “Sign in with Google,” Facebook, Apple or Microsoft.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
AWS-Loot : Pull Secrets From An AWS Environment
AWS-Loot tool allows quick enumeration over large sets of AWS instances and services.
Install
pip install -r requirements.txt
An AWS credential file (.aws/credentials) is required for authentication to the target environment
* Access Key
* Access Key Secret
How it works
Awsloot works by going through EC2, Lambda, CodeBuilder instances and searching for high entropy strings. The EC2 Looter works by querying all available instance ID’s in all regions and requesting instance’s USERDATA where often developers leave secrets. The Lambda looter operates across regions as well. Lambada looter can search all available versions of a found function. It starts by searching the functions environment variables then downloads the source code and scans the source for secrets. The Codebuilder Looter works by searching for build instances and searching those builds for environment variables that might contain secrets.
Usage
Python3 awsloot.py
Next Features
* Allow users to specify an ARN to scan
* Looter for additional services
Download
AWS-Loot : Pull Secrets From An AWS Environment
AWS-Loot tool allows quick enumeration over large sets of AWS instances and services.
Install
pip install -r requirements.txt
An AWS credential file (.aws/credentials) is required for authentication to the target environment
* Access Key
* Access Key Secret
How it works
Awsloot works by going through EC2, Lambda, CodeBuilder instances and searching for high entropy strings. The EC2 Looter works by querying all available instance ID’s in all regions and requesting instance’s USERDATA where often developers leave secrets. The Lambda looter operates across regions as well. Lambada looter can search all available versions of a found function. It starts by searching the functions environment variables then downloads the source code and scans the source for secrets. The Codebuilder Looter works by searching for build instances and searching those builds for environment variables that might contain secrets.
Usage
Python3 awsloot.py
Next Features
* Allow users to specify an ARN to scan
* Looter for additional services
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
LDAP-Password-Hunter : Password Hunter In The LDAP Infamous Database
LDAP Password Hunter is a tool which wraps features of getTGT.py (Impacket) and ldapsearch in order to look up for password stored in LDAP database. Impacket getTGT.py script is used in order to authenticate the domain account used for enumeration and save its TGT kerberos ticket. TGT ticket is then exported in KRB5CCNAME variable which is used by ldapsearch script to authenticate and obtain TGS kerberos tickets for each domain/DC LDAP-Password-Hunter is ran for. Basing on the CN=Schema,CN=Configuration export results a custom list of attributes is built and filtered in order to identify a big query which might contains interesting results. Results are shown and saved in a sqlite3 database. The DB is made of one table containing the following columns:
* DistinguishedName
* AttributeName
* Value
* Domain
Results are way more clean than the previous version and organized in the SQL DB. The output shows the entries found only if they are not in DB, so new entries pop up but the overall outcome of the analysis is still saved in a file with a timestamp.
Requirements
* Ldapsearch
* Impacket
* Sqlite
Usage
Be sure your krb5.conf file is clean and the domains.txt and conf.txt are filled properly.
From the project folder:
./run.sh
Download
LDAP-Password-Hunter : Password Hunter In The LDAP Infamous Database
LDAP Password Hunter is a tool which wraps features of getTGT.py (Impacket) and ldapsearch in order to look up for password stored in LDAP database. Impacket getTGT.py script is used in order to authenticate the domain account used for enumeration and save its TGT kerberos ticket. TGT ticket is then exported in KRB5CCNAME variable which is used by ldapsearch script to authenticate and obtain TGS kerberos tickets for each domain/DC LDAP-Password-Hunter is ran for. Basing on the CN=Schema,CN=Configuration export results a custom list of attributes is built and filtered in order to identify a big query which might contains interesting results. Results are shown and saved in a sqlite3 database. The DB is made of one table containing the following columns:
* DistinguishedName
* AttributeName
* Value
* Domain
Results are way more clean than the previous version and organized in the SQL DB. The output shows the entries found only if they are not in DB, so new entries pop up but the overall outcome of the analysis is still saved in a file with a timestamp.
Requirements
* Ldapsearch
* Impacket
* Sqlite
Usage
Be sure your krb5.conf file is clean and the domains.txt and conf.txt are filled properly.
From the project folder:
./run.sh
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
TerraGoat : Vulnerable Terraform Infrastructure
TerraGoat is Bridgecrew’s “Vulnerable by Design” Terraform repository. TerraGoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments. IntroductionTerraGoat was built to enable DevSecOps design and implement a sustainable misconfiguration prevention strategy. It can be used to test a policy-as-code framework like Bridgecrew & Checkov, inline-linters, pre-commit hooks or other code scanning methods.
TerraGoat follows the tradition of existing *Goat projects that provide a baseline training ground to practice implementing secure development best practices for cloud infrastructure. Important notes* Where to get help: the Bridge crew Community Slack
Before you proceed please take a not of these warning:
Terra Goat creates intentionally vulnerable AWS resources into your account. DO NOT deploy TerraGoat in a production environment or alongside any sensitive AWS resources. Requirements* Terraform 0.12
* aws cli
* azure cli
To prevent vulnerable infrastructure from arriving to production see: Bridgecrew & checkov, the open source static analysis tool for infrastructure as code. Getting startedAWS SetupInstallation (AWS)You can deploy multiple TerraGoat stacks in a single AWS account using the parameter
export TF_VAR_company_name=acme
export TF_VAR_environment=mydevsecops
export TF_VAR_region=”us-west-2″
aws s3api create-bucket –bucket $TERRAGOAT_STATE_BUCKET \
–region $TF_VAR_region –create-bucket-configuration LocationConstraint=$TF_VAR_region
Enable versioning
aws s3api put-bucket-versioning –bucket $TERRAGOAT_STATE_BUCKET –versioning-configuration Status=Enabled
Enable encryption
aws s3api put-bucket-encryption –bucket $TERRAGOAT_STATE_BUCKET –server-side-encryption-configuration ‘{
“Rules”: [
{
“ApplyServerSideEncryptionByDefault”: {
“SSEAlgorithm”: “aws:kms”
}
}
]
}’
Apply TerraGoat (AWS)
cd terraform/aws/
terraform init \
-backend-config=”bucket=$TERRAGOAT_STATE_BUCKET” \
-backend-config=”key=$TF_VAR_company_name-$TF_VAR_environment.tfstate” \
-backend-config=”region=$TF_VAR_region”
terraform apply
Remove TerraGoat (AWS)
terraform destroy Azure SetupInstallation (Azure)You can deploy multiple TerraGoat stacks in a single Azure subscription using the parameter
export TERRAGOAT_STATE_STORAGE_ACCOUNT=”mydevsecopssa”
export TERRAGOAT_STATE_CONTAINER=”mydevsecops”
export TF_VAR_environment=”dev”
export TF_VAR_region=”westus”
Create resource group
az group create –location $TF_VAR_region –name $TERRAGOAT_RESOURCE_GROUP
Create storage account
az storage account create –name $TERRAGOAT_STATE_STORAGE_ACCOUNT –resource-group $TERRAGOAT_RESOURCE_GROUP –location $TF_VAR_region –sku Standard_LRS –kind StorageV2 –https-only true –encryption-services blob
Get storage account key
ACCOUNT_KEY=$(az storage account keys list –resource-group $TERRAGOAT_RESOURCE_GROUP –account-name $TERRAGOAT_STATE_STORAGE_ACCOUNT –query [0].value -o tsv)
Create blob container
az storage container create –name $TERRAGOAT_STATE_CONTAINER –account-name $TERRAGOAT_STATE_STORAGE_ACCOUNT –account-key $ACCOUNT_KEY GCP SetupInstallation (GCP)You can deploy multiple TerraGoat stacks in a single GCP project using the parameter
TerraGoat : Vulnerable Terraform Infrastructure
TerraGoat is Bridgecrew’s “Vulnerable by Design” Terraform repository. TerraGoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments. IntroductionTerraGoat was built to enable DevSecOps design and implement a sustainable misconfiguration prevention strategy. It can be used to test a policy-as-code framework like Bridgecrew & Checkov, inline-linters, pre-commit hooks or other code scanning methods.
TerraGoat follows the tradition of existing *Goat projects that provide a baseline training ground to practice implementing secure development best practices for cloud infrastructure. Important notes* Where to get help: the Bridge crew Community Slack
Before you proceed please take a not of these warning:
Terra Goat creates intentionally vulnerable AWS resources into your account. DO NOT deploy TerraGoat in a production environment or alongside any sensitive AWS resources. Requirements* Terraform 0.12
* aws cli
* azure cli
To prevent vulnerable infrastructure from arriving to production see: Bridgecrew & checkov, the open source static analysis tool for infrastructure as code. Getting startedAWS SetupInstallation (AWS)You can deploy multiple TerraGoat stacks in a single AWS account using the parameter
TF_VAR_environment. Create an S3 Bucket backend to keep Terraform stateexport TERRAGOAT_STATE_BUCKET=”mydevsecops-bucket”export TF_VAR_company_name=acme
export TF_VAR_environment=mydevsecops
export TF_VAR_region=”us-west-2″
aws s3api create-bucket –bucket $TERRAGOAT_STATE_BUCKET \
–region $TF_VAR_region –create-bucket-configuration LocationConstraint=$TF_VAR_region
Enable versioning
aws s3api put-bucket-versioning –bucket $TERRAGOAT_STATE_BUCKET –versioning-configuration Status=Enabled
Enable encryption
aws s3api put-bucket-encryption –bucket $TERRAGOAT_STATE_BUCKET –server-side-encryption-configuration ‘{
“Rules”: [
{
“ApplyServerSideEncryptionByDefault”: {
“SSEAlgorithm”: “aws:kms”
}
}
]
}’
Apply TerraGoat (AWS)
cd terraform/aws/
terraform init \
-backend-config=”bucket=$TERRAGOAT_STATE_BUCKET” \
-backend-config=”key=$TF_VAR_company_name-$TF_VAR_environment.tfstate” \
-backend-config=”region=$TF_VAR_region”
terraform apply
Remove TerraGoat (AWS)
terraform destroy Azure SetupInstallation (Azure)You can deploy multiple TerraGoat stacks in a single Azure subscription using the parameter
TF_VAR_environment. Create an Azure Storage Account backend to keep Terraform stateexport TERRAGOAT_RESOURCE_GROUP=”TerraGoatRG”export TERRAGOAT_STATE_STORAGE_ACCOUNT=”mydevsecopssa”
export TERRAGOAT_STATE_CONTAINER=”mydevsecops”
export TF_VAR_environment=”dev”
export TF_VAR_region=”westus”
Create resource group
az group create –location $TF_VAR_region –name $TERRAGOAT_RESOURCE_GROUP
Create storage account
az storage account create –name $TERRAGOAT_STATE_STORAGE_ACCOUNT –resource-group $TERRAGOAT_RESOURCE_GROUP –location $TF_VAR_region –sku Standard_LRS –kind StorageV2 –https-only true –encryption-services blob
Get storage account key
ACCOUNT_KEY=$(az storage account keys list –resource-group $TERRAGOAT_RESOURCE_GROUP –account-name $TERRAGOAT_STATE_STORAGE_ACCOUNT –query [0].value -o tsv)
Create blob container
az storage container create –name $TERRAGOAT_STATE_CONTAINER –account-name $TERRAGOAT_STATE_STORAGE_ACCOUNT –account-key $ACCOUNT_KEY GCP SetupInstallation (GCP)You can deploy multiple TerraGoat stacks in a single GCP project using the parameter
TF_VAR_environment. Create a GCS backend to keep Terraform stateTo use terraform, a Service Account and matching set of credentials are required. If they do not exist, they must be manually [...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials TerraGoat : Vulnerable Terraform Infrastructure TerraGoat is Bridgecrew’s “Vulnerable by Design” Terraform repository. TerraGoat is a learning and training project that demonstrates how common configuration errors can find their way into…
created for the relevant project. To create the Service Account:
* Sign into your GCP project, go to
* Click the
* Give a name to your service account (for example –
* Grant the Service Account the
* Click
To create the credentials:
* Sign into your GCP project, go to
* Click
We recommend saving the key with a nicer name than the auto-generated one (i.e.
export TF_VAR_environment=”dev”
export TF_TERRAGOAT_STATE_BUCKET=remote-state-bucket-terragoat
export TF_VAR_credentials_path= # example: export TF_VAR_credentials_path=terragoat_credentials.json
export TF_VAR_project=
Create storage bucket
gsutil mb gs://${TF_TERRAGOAT_STATE_BUCKET}
Apply TerraGoat (GCP)
cd terraform/gcp/
terraform init -reconfigure -backend-config=”bucket=$TF_TERRAGOAT_STATE_BUCKET” \
-backend-config “credentials=$TF_VAR_credentials_path” \
-backend-config “prefix=terragoat/${TF_VAR_environment}”
terraform apply
Remove TerraGoat (GCP)
terraform destroy Download
* Sign into your GCP project, go to
IAM> Service Accounts.* Click the
CREATE SERVICE ACCOUNT.* Give a name to your service account (for example –
terragoat) and click CREATE.* Grant the Service Account the
Project> Editorrole and click CONTINUE.* Click
DONE.To create the credentials:
* Sign into your GCP project, go to
IAM> Service Accountsand click on the relevant Service Account.* Click
ADD KEY> Create new key> JSONand click CREATE. This will create a .jsonfile and download it to your computer.We recommend saving the key with a nicer name than the auto-generated one (i.e.
terragoat_credentials.json), and storing the resulting JSON file inside terraform/gcpdirectory of terragoat. Once the credentials are set up, create the BE configuration as follows:export TF_VAR_environment=”dev”
export TF_TERRAGOAT_STATE_BUCKET=remote-state-bucket-terragoat
export TF_VAR_credentials_path= # example: export TF_VAR_credentials_path=terragoat_credentials.json
export TF_VAR_project=
Create storage bucket
gsutil mb gs://${TF_TERRAGOAT_STATE_BUCKET}
Apply TerraGoat (GCP)
cd terraform/gcp/
terraform init -reconfigure -backend-config=”bucket=$TF_TERRAGOAT_STATE_BUCKET” \
-backend-config “credentials=$TF_VAR_credentials_path” \
-backend-config “prefix=terragoat/${TF_VAR_environment}”
terraform apply
Remove TerraGoat (GCP)
terraform destroy Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Php-Malware-Finder : Detect Potentially Malicious PHP Files
PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files using PHP functions often used in malwares/webshells.
The following list of encoders/obfuscators/webshells are also detected:
* Bantam
* Best PHP Obfuscator
* Carbylamine
* Cipher Design
* Cyklodev
* Joes Web Tools Obfuscator
* P.A.S
* PHP Jiami
* Php Obfuscator Encode
* SpinObf
* Weevely3
* atomiku
* cobra obfuscator
* nano
* novahot
* phpencode
* tennc
* web-malware-collection
* webtoolsvn
Of course it’s trivial to bypass PMF, but its goal is to catch kiddies and idiots, not people with a working brain. If you report a stupid tailored bypass for PMF, you likely belong to one (or both) category, and should re-read the previous statement.
How does it work?
Detection is performed by crawling the filesystem and testing files against a set of YARA rules. Yes, it’s that simple!
Instead of using an hash-based approach, PMF tries as much as possible to use semantic patterns, to detect things like “a
Installation
* Install Yara.
This is also possible via some Linux package managers:
* Debian:
* Red Hat:
You can also compile it from source:
git clone git@github.com:VirusTotal/yara.git
cd yara/
YACC=bison ./configure
make
* Download php-malware-finder
How to use it?
$ ./phpmalwarefinder -h
Usage phpmalwarefinder [-cfhtvl] …
-c Optional path to a rule file
-f Fast mode
-h Show this help message
-t Specify the number of threads to use (8 by default)
-v Verbose mode
Or if you prefer to use
$ yara -r ./php.yar /var/www
Please keep in mind that you should use at least YARA 3.4 because we’re using hashes for the whitelist system, and greedy regexps. Please note that if you plan to build yara from sources, libssl-dev must be installed on your system in order to have support for hashes.
Oh, and by the way, you can run the comprehensive testsuite with
Whitelisting
Check the whitelist.yar file. If you’re lazy, you can generate whitelists for entire folders with the generate_whitelist.py script.
Why should I use it instead of something else?
Because:
* It doesn’t use a single rule per sample, since it only cares about finding malicious patterns, not specific webshells
* It has a complete testsuite, to avoid regressions
* Its whitelist system doesn’t rely on filenames
* It doesn’t rely on (slow) entropy computation
* It uses a ghetto-style static analysis, instead of relying on file hashes
* Thanks to the aforementioned pseudo-static analysis, it works (especially) well on obfuscated files
Download
Php-Malware-Finder : Detect Potentially Malicious PHP Files
PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files using PHP functions often used in malwares/webshells.
The following list of encoders/obfuscators/webshells are also detected:
* Bantam
* Best PHP Obfuscator
* Carbylamine
* Cipher Design
* Cyklodev
* Joes Web Tools Obfuscator
* P.A.S
* PHP Jiami
* Php Obfuscator Encode
* SpinObf
* Weevely3
* atomiku
* cobra obfuscator
* nano
* novahot
* phpencode
* tennc
* web-malware-collection
* webtoolsvn
Of course it’s trivial to bypass PMF, but its goal is to catch kiddies and idiots, not people with a working brain. If you report a stupid tailored bypass for PMF, you likely belong to one (or both) category, and should re-read the previous statement.
How does it work?
Detection is performed by crawling the filesystem and testing files against a set of YARA rules. Yes, it’s that simple!
Instead of using an hash-based approach, PMF tries as much as possible to use semantic patterns, to detect things like “a
$_GETvariable is decoded two times, unzipped, and then passed to some dangerous function like system“.Installation
* Install Yara.
This is also possible via some Linux package managers:
* Debian:
sudo apt-get install yara* Red Hat:
yum install yara(requires the EPEL repository)You can also compile it from source:
git clone git@github.com:VirusTotal/yara.git
cd yara/
YACC=bison ./configure
make
* Download php-malware-finder
git clone https://github.com/jvoisin/php-malware-finder.gitHow to use it?
$ ./phpmalwarefinder -h
Usage phpmalwarefinder [-cfhtvl] …
-c Optional path to a rule file
-f Fast mode
-h Show this help message
-t Specify the number of threads to use (8 by default)
-v Verbose mode
Or if you prefer to use
yara:$ yara -r ./php.yar /var/www
Please keep in mind that you should use at least YARA 3.4 because we’re using hashes for the whitelist system, and greedy regexps. Please note that if you plan to build yara from sources, libssl-dev must be installed on your system in order to have support for hashes.
Oh, and by the way, you can run the comprehensive testsuite with
make tests.Whitelisting
Check the whitelist.yar file. If you’re lazy, you can generate whitelists for entire folders with the generate_whitelist.py script.
Why should I use it instead of something else?
Because:
* It doesn’t use a single rule per sample, since it only cares about finding malicious patterns, not specific webshells
* It has a complete testsuite, to avoid regressions
* Its whitelist system doesn’t rely on filenames
* It doesn’t rely on (slow) entropy computation
* It uses a ghetto-style static analysis, instead of relying on file hashes
* Thanks to the aforementioned pseudo-static analysis, it works (especially) well on obfuscated files
Download
Stumbling into the bug of another
The work of another bug hunter is staring back at you. Is your job half done?Continue reading on Medium »
Read more...
The work of another bug hunter is staring back at you. Is your job half done?Continue reading on Medium »
Read more...
Stumbling into the bug of another
https://adamwize.medium.com/stumbling-into-the-bug-of-another-c11f1848ba75?source=rss------bug_bounty-5
https://adamwize.medium.com/stumbling-into-the-bug-of-another-c11f1848ba75?source=rss------bug_bounty-5
The work of another bug hunter is staring back at you. Is your job half done?Continue reading on Medium » (https://adamwize.medium.com/stumbling-into-the-bug-of-another-c11f1848ba75?source=rss------bug_bounty-5)
Recently started with pen-testing
https://www.reddit.com/r/Pentesting/comments/tk1xfx/recently_started_with_pentesting/
<!-- SC_OFF -->Hi, so I went to a website from BugCrowd and Wappalyzer showed me that the website is using "gatsby@2.24.62 (mailto:gatsby@2.24.62)" JavaScript Framework which is vulnerable to several attacks as shown here - https://snyk.io/test/npm/gatsby/2.24.62 so is that website really vulnerable to RCE and DDOS as shown in this link and am I just supposed to tell them to upgrade or actually attack them with them, I am just confused as to how I should move forward. Thanks! <!-- SC_ON --> submitted by /u/blank1993 (https://www.reddit.com/user/blank1993)
[link] (https://www.reddit.com/r/Pentesting/comments/tk1xfx/recently_started_with_pentesting/) [comments] (https://www.reddit.com/r/Pentesting/comments/tk1xfx/recently_started_with_pentesting/)
https://www.reddit.com/r/Pentesting/comments/tk1xfx/recently_started_with_pentesting/
<!-- SC_OFF -->Hi, so I went to a website from BugCrowd and Wappalyzer showed me that the website is using "gatsby@2.24.62 (mailto:gatsby@2.24.62)" JavaScript Framework which is vulnerable to several attacks as shown here - https://snyk.io/test/npm/gatsby/2.24.62 so is that website really vulnerable to RCE and DDOS as shown in this link and am I just supposed to tell them to upgrade or actually attack them with them, I am just confused as to how I should move forward. Thanks! <!-- SC_ON --> submitted by /u/blank1993 (https://www.reddit.com/user/blank1993)
[link] (https://www.reddit.com/r/Pentesting/comments/tk1xfx/recently_started_with_pentesting/) [comments] (https://www.reddit.com/r/Pentesting/comments/tk1xfx/recently_started_with_pentesting/)