FastFinder is a lightweight tool made for threat hunting, live forensics (https://www.kitploit.com/search/label/Forensics) and triage on both Windows and Linux Platforms. It is focused on endpoint enumeration (https://www.kitploit.com/search/label/Enumeration) and suspicious file finding based on various criterias: file path / name md5 / sha1 / sha256 checksum simple string content match complex content condition(s) based on YARA
Ready for battle! fastfinder has been tested in real cases in multiple CERT, CSIRT and SOC use cases examples directory (https://www.kitploit.com/search/label/Directory) now include real malwares / suspect behaviors or vulnerability (https://www.kitploit.com/search/label/Vulnerability) scan examples Installation Compiled release of this software are available. If you want to compile from sources, it could be a little bit tricky because it strongly depends of go-yara and CGO compilation. Anyway, you'll find a detailed documentation for windows (https://github.com/codeyourweb/fastfinder/blob/master/README.windows-compilation.md) and for linux (https://github.com/codeyourweb/fastfinder/blob/master/README.linux-compilation.md) Usage "] [-b|--build ""] [-o|--output ""] [-n|--no-window] [-u|--no-userinterface] [-v|--verbosity ] [-t|--triage] Incident Response - Fast suspicious file finder Arguments: -h --help Print help information -c --configuration Fastfind configuration file. Default: -b --build Output a standalone package with configuration and rules in a single binary -o --output Save fastfinder logs in the specified file -n --no-window Hide fastfinder window -u --no-userinterface Hide advanced user interface -v --verbosity File log verbosity | 4: Only alert | 3: Alert and errors | 2: Alerts,errors and I/O operations | 1: Full verbosity) . Default: 3 -t --triage Triage mode (infinite run - scan every new file in the input path directories). Default: false'> ___ __ ___ ___ __ ___ __
|__ /\ /__` | |__ | |\ | | \ |__ |__)
| /~~\ .__/ | | | | \| |__/ |___ | \

2021-2022 | Jean-Pierre GARNIER | @codeyourweb
https://github.com/codeyourweb/fastfinder

usage: fastfinder [-h|--help] [-c|--configuration ""] [-b|--build
""] [-o|--output ""] [-n|--no-window]
[-u|--no-userinterface] [-v|--verbosity ]
[-t|--triage]

Incident Response - Fast suspicious file finder

Arguments:

-h --help Print help information
-c --configuration Fastfind configuration file. Default:
-b --build Output a standalone package with configuration and
rules in a single binary
-o --ou tput Save fastfinder logs in the specified file
-n --no-window Hide fastfinder window
-u --no-userinterface Hide advanced user interface
-v --verbosity File log verbosity
| 4: Only alert
| 3: Alert and errors
| 2: Alerts,errors and I/O operations
| 1: Full verbosity)
. Default: 3
-t --triage Triage mode (infinite run - scan every new file in
the input path directories). Default: false

___________________________
@hacking_Attack
@Hacking_Video

Depending on where you are looking for files, FastFinder could be used with admin OR simple user rights. Scan and export file match according to your needs configuration examples are available there (https://github.com/codeyourweb/fastfinder/blob/master/examples) input:
path: [] # match file path AND / OR file name based on simple string
content:
grep: [] # match literal string value inside file content
yara: [] # use yara rule and specify rules path(s) for more complex pattern search (wildcards / regex / conditions)
checksum: [] # parse for md5/sha1/sha256 in file content
options:
contentMatchDependsOnPathMatch: true # if true, paths are a pre-filter for content searchs. If false, paths and content both generate matchs
findInHardDrives: true # enumerate hard drive content
findInRemovableDrives: true # enumerate removable drive content
findInNetworkDrives: true # enumerate network drive content
findInCDRomDrives: true # enumerate physical CD-ROM and mounted iso / vhd...
output:
copyMatchingFiles: true # cr eate a copy of every matching file
base64Files: true # base64 matched content before copy
filesCopyPath: '' # empty value will copy matched files in the fastfinder.exe folder
advancedparameters:
yaraRC4Key: '' # yara rules can be (un)/ciphered using the specified RC4 key
maxScanFilesize: 2048 # ignore files up to maxScanFileSize Mb (default: 2048)
cleanMemoryIfFileGreaterThanSize: 512 # clean fastfinder internal memory after heavy file scan (default: 512Mb)
Search everywhere or in specified paths: use '?' in paths for simple char wildcard (eg. powershe??.exe) use '\*' in paths for multiple chars wildcard (eg. \*.exe) regular expressions are also available , just enclose paths with slashes (eg. /[0-9]{8}\.exe/) environment variables can also be used (eg. %TEMP%\myfile.exe) Important notes input path are always case INSENSITIVE content search on string (grep) are always case SENSITIVE backslashes SHOULD NOT be escaped (except with regular expressions) For more informations, take a look at the examples (https://github.com/codeyourweb/fastfinder/blob/master/examples) About this project I initially created this project to automate fast system oriented IOC detection on a wide computer network. It fulfills the needs I have today. Nevertheless if you have complementary ideas, do not hesitate to ask for, I will see to implement them if they can be useful for everyone. On the other hand, pull request will be studied carefully. Future releases I don't plan to add any additional features right now. The next release will be focused on: Unit testing / Code testing coverage / CI Build more examples based on live malwares tradecraft and threat actor campaigns

Download Fastfinder (https://github.com/codeyourweb/fastfinder)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Pequenas anotações sobre o cabeçalho TCP/IP e sua conexão através do Three-way Handshake

https://cdn-images-1.medium.com/max/856/1*oqx14hnvll8OIaQzAmauVA.jpeg
Em palavras simples, o TCP (Transmission Control Protocol) é um protocolo orientado a conexão responsável pela transmissão de dados na…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HTB: Chatterbox Writeup w/o Metasploit

https://cdn-images-1.medium.com/max/600/0*_hyp1gfsAOazuP02.png
Introduction

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking Human Connection: the Story of Awedience

https://cdn-images-1.medium.com/max/2600/1*wYiW3cB5YfO_oLC9CVHW3A.jpeg
How a home-grown product helps Airbnb employees feel more connected during solitary times

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Microsoft investiga un supuesto robo de código fuente por parte de Lapsus$

https://cdn-images-1.medium.com/max/1644/0*kZMGqA5i-5fleZlQ
PUBLICADO EN 22 MARZO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
FastFinder - Incident Response - Fast Suspicious File Finder

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Accessing bitlocker Windows 7

Not sure if this is the right sub to be asking this one. Just found my old laptop still running and one of my partitioned drives has bitlocker activated. I don’t have the recovery key anymore and tried as much as possible the passwords that I have used.

Any tips or guide how to access this one or do I just have to accept it as it is and probably reformat the whole drive.

submitted by /u/GreenBar88
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Account TakeOver Via Reset Password (APPLE CORP)
https://medium.com/@elqayserelqayser/account-takeover-via-reset-password-apple-corp-784699fb1392?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

In The First This is my first writeup so forgive for anything or any mistake or you can send to me to share your knowledge or increase…Continue reading on Medium » (https://medium.com/@elqayserelqayser/account-takeover-via-reset-password-apple-corp-784699fb1392?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Account TakeOver Via Reset Password (APPLE CORP)

In The First This is my first writeup so forgive for anything or any mistake or you can send to me to share your knowledge or increase…Continue reading on Medium »
Read more...

Hacking on Medium
Post-mortem Analysis of OneRing Incident

https://cdn-images-1.medium.com/max/820/1*WLs5WjLh-FtzqCjIFErHPA.png
The SlowMist security team recommends projects to not use instant price calculation in the future to avoid price manipulation.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Brethren, I want to get into simple cryptography. I see a lot of math is involved.

I took algebra 2 in high school. What would be the best route to get up to speed with these mathematics used? What would you recommend?

submitted by /u/BravesWin02
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Microsoft confirms they were hacked by Lapsus$ extortion group. Lapsus$ has recently conducted numerous attacks against the enterprise, including those against NVIDIA, Samsung, Vodafone, Ubisoft, Mercado Libre, and now Microsoft.

https://external-preview.redd.it/7OthBc-rN-ReESaV1AQRTm01b9nEqgXQlrLjvt1DWa8.jpg?width=640&crop=smart&auto=webp&s=ceaea574e49b46b988a761e614359c81cb6c0098 submitted by /u/Late_Ice_9288
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Would a Crypto Mining GPU like the NVIDIA CMP HX be a good choice for HashCracking.

Given the limited availability of GPU's in this current state and the influx of LHR restricted GPU's?

submitted by /u/SoeMyzlack
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Supply Chain Attacks: A ripe area for research

Let’s discuss about Supply Chain Attacks and why it’s a great research area in the recent times.Continue reading on Pentester Academy Blog »
Read more...

Supply Chain Attacks: A ripe area for research
https://blog.pentesteracademy.com/supply-chain-attacks-a-ripe-area-for-research-fa42fe11e1c5?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video