X% or more of the image, mark as failed.
# Note: the base image layer is NOT included in the total image size.
# Expressed as a ratio between 0-1; fails if the threshold is met or crossed.
highestUserWastedPercent: 0.20 KeyBindingsKey BindingDescriptionCtrl + CExitTabSwitch between the layer and filetree viewsCtrl + FFilter filesPageUpScroll up a pagePageDownScroll down a pageCtrl + ALayer view: see aggregated image modificationsCtrl + LLayer view: see current layer modificationsSpaceFiletree view: collapse/uncollapse a directoryCtrl + SpaceFiletree view: collapse/uncollapse all directoriesCtrl + AFiletree view: show/hide added filesCtrl + RFiletree view: show/hide removed filesCtrl + MFiletree view: show/hide modified filesCtrl + UFiletree view: show/hide unmodified filesCtrl + BFiletree view: show/hide file attributesPageUpFiletree view: scroll up a pagePageDownFiletree view: scroll down a page UI ConfigurationNo configuration is necessary, however, you can create a config file and override values: supported options are “docker” and “podman”container-engine: docker continue with analysis even if there are errors parsing the image archiveignore-errors: false
log:
enabled: true
path: ./dive.log
level: info Note: you can specify multiple bindings by separating values with a comma.Note: UI hinting is derived from the first bindingkeybinding:
# Global bindings
quit: ctrl+c
toggle-view: tab
filter-files: ctrl+f, ctrl+slash
# Layer view specific bindings
compare-all: ctrl+a
compare-layer: ctrl+l
# File view specific bindings
toggle-collapse-dir: space
toggle-collapse-all-dir: ctrl+space
toggle-added-files: ctrl+a
toggle-removed-files: ctrl+r
toggle-modified-files: ctrl+m
toggle-unmodified-files: ctrl+u
toggle-filetree-attributes: ctrl+b
page-up: pgup
page-down: pgdn
diff:
# You can change the default files shown in the filetree (right pane). All diff types are shown by default.
hide:
– added
– removed
– modified
– unmodified
filetree:
# The default directory-collapse state
collapse-dir: false
# The percentage of screen width the filetree should take on the screen (must be >0 and
pane-width: 0.5
# Show the file attributes next to the filetree
show-attributes: true
layer:
# Enable showing all changes from this layer and every previous layer
show-aggregated-changes: false

dive will search for configs in the following locations:

* $XDG_CONFIG_HOME/dive/*.yaml* $XDG_CONFIG_DIRS/dive/*.yaml* ~/.config/dive/*.yaml* ~/.dive.yamlDownload

Kali Linux Tutorials
Get-RBCD-Threaded : Tool To Discover Resource-Based Constrained Delegation Attack Paths

Get-RBCD-Threaded is a tool to discover Resource-Based Constrained Delegation attack paths in Active Directory Environments

Based almost entirely on wonderful blog posts “Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory” by Elad Shamir and “A Case Study in Wagging the Dog: Computer Takeover” by harmj0y. Read these two blog posts if you actually want to understand what is going on here. I honestly only half understand it all myself (and that’s being generous).

I don’t know how to C# well so I figured out how to communicate with a domain in C# by reading through the source code of SharpSploit and SharpView. How it works

Get-RBCD-Thread will query all Active Directory users, groups (minus privileged groups like “Domain Admins” and “BUILTIN\Administrators”), and computer objects in your current domain and compile a list of their SIDs. Get-RBCD-Threaded will then query AD for all DACLs on the computer objects in the domain. Each ACE in the DACLs will be checked to see if one of the user/group/computer SIDS has either “GenericAll”, “GenericWrite”, “WriteOwner”, or “WriteDacl” privileges on the computer object, or if the SIDS have “WriteProp” permissions on the ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity attribute (GUID:3f78c3e5-f79a-46bd-a0b8-9d18116ddc79). If it does, then, well, you my friend are on your way to a Resource-Based Constrained Delegation attack! UsageCompile in Visual Studio. This uses Parallel.ForEach to spead up searching through the DACL object, so .NET v4 is minimum required. Options-u|-username=, Username to authenticate as

-p|-password=, Password for the user

-d|-domain=, Fully qualified domain name to authenticate to

-s|-searchforest, Discover domains and forests through trust relationships. Enumerate all domains and forests

-pwdlastset=, Filter computers based on pwdLastSet to remove stale computer objects. If you set this to 90, it will filter out computer objects whose pwdLastSet date is more than 90 days ago

-i|-insecure, Force insecure LDAP connect if LDAPS is causing connection issues.

-o|-outputfile=, Output to a CSV file. Provided full path to file and file name.

-h|-?|-help, Show the help options

You can now specify the username, password, and domain to authenticate to. If u/p/d options are blank, Get-RBCD-Threaded will atempt to authenticate to the domain in your current user context.

-o will output to a CSV file. Provide the full file path and file name to save the output to.

The default search specifies that port 636 be used to force LDAPS. This may cause issues. If you get an error saying something about the server not being available or similar, try the “-i” flag to remove the 636 port from the connect string.

“pwdLastSet” has been added as a filtering option. In larger environments you can get a lot of stale computer objects that no longer exist as the “destination” object int he ACL, and can’t really be used for the RBCD attack (at least not that I am aware of). Set pwdLastSet to a number of days. Example: “-pwdlastset=90” will filter out any computer objects from your results where the pwdLastSet date is greater or equal to 90 days ago from the current date and time.

Tested in an environment with 20k+ uses, groups, and computers (over 60k total objects). Get-RBCD-Thread took ~60 seconds to complete. By comparison, my hacked together PowerView commands in this gist to perform a similar search ran for several hours and never completed.

This tool will not perform the delegation attack for you. You’ll need to read Elad Shamir’s and harmj0y’s blogs to figure out how to do that. This will only help you find possible targets for the RBCD attack.

Example usage from my AD lab:
https://blogger.googleuser[...]

content.com/img/a/AVvXsEiaULH3JrJZVATe0m9FgbwMPWJovTNr9ByX9UgoH1V7xD2pO4fJJ_2jh3DdO0XzNTdD0of2C5GAKidopqwRiX8Hb-yNsjfpevuVXz5rPoi_Xd_ZzusKlbl39dIv-oLA734zL6SWz6el7dN0NF6bFyvhmktbTNgK_XgKCfSz9NdmBX69m8UDsAjywuhv=s829 DetectionsThis tool does nothing more than query Active Directory using LDAP queries, which may not be easy to detect. Netflow could possibly be used to detect large numbers of LDAP queries / traffic to one system.

The other possible way to detect this is through honeypot accounts. The idea would be to create a computer object that some user / group has write privileges to. The RBCD attack relies on modifying a computer object and then delegating kerberos tickets to it. The possible points of detection for the honeypot computer object could be:

1. Monitor modifications to the honeypot computer object, specifically to the “msds-allowedtoactonbehalfofotheridentity” property
2. Monitor for kerberos tickets requested for services on the honeypot computer object, specifically any kerberos tickets for administrator users

I made this tool to help me on penetration tests. However, defenders / blue teams / sysadmins can easily use this to help find weaknesses in their environments and (hopefully) move to remediate them. Download

Hacking on Medium
TCS Hackquest Season 6 -Forensics Writeup

https://cdn-images-1.medium.com/max/1349/1*dez6yPL8-gIcvt91BaX_kA.png
Let’s Take a look at some forensic and steganography #5 challenges from TCS Hackquest season 6 ( 26/02/2022)

Continue reading on Medium »

Hacking on Medium
Information Disclosure Bug

https://cdn-images-1.medium.com/max/2600/0*gy7a09dXIv0YsqBK
Web security

Continue reading on Medium »

Information Disclosure Bug
https://mukibas37.medium.com/information-disclosure-bug-78907c5d49fc?source=rss------bug_bounty-5

Web securityContinue reading on Medium » (https://mukibas37.medium.com/information-disclosure-bug-78907c5d49fc?source=rss------bug_bounty-5)

KitPloit - PenTest Tools!
ShellcodeTemplate - An Easily Modifiable Shellcode Template For Windows X64/X86

https://blogger.googleusercontent.com/img/a/AVvXsEiB83DaBRx0yg_1k9jG2M9ydsNbd941k5dLfwFqtn0F4Dx49rRVFIyL6VA57VrjPekqVGKT_CyeP_n6eCm5cmf44OOaSgcOKFxIAtnBPbSNAhfb2bx1W17vzhhHaI7bR7bzsmcXMDukOaTEMG1Q0eMZvvMGRkI7PVNRVouq5juuTvJQud6r22rxep8X=w640-h540

An easily modifiable shellcode template for Windows x64/x86

How does it work?

This template is heavily based on Austin Hudson's (aka SecIdiot) TitanLdr It compiles the project into a PE Executable and extracts the .text section
Example

The entrypoint of the shellcode looks like this. Of course, this can be changed for your need. First we need to initialize needed libraries and functions by using our custom written GetModuleHandle and GetProcAddress.

SEC( text, B ) VOID Entry( VOID )
{
INSTANCE Instance = { };

Instance.Modules.Kernel32 = TGetModuleHandle( HASH_KERNEL32 );
Instance.Modules.Ntdll = TGetModuleHandle( HASH_NTDLL );

if ( Instance.Modules.Kernel32 != NULL )
{
// Load needed functions
Instance.Win32.LoadLibraryA = TGetProcAddr( Instance.Modules.Kernel32, 0xb7072fdb );

// Load needed Libraries
Instance.Modules.User32 = Instance.Win32.LoadLibraryA( GET_SYMBOL( "User32" ) );

if ( Instance.Modules.User32 != NULL )
{
Instance.Win32.MessageBoxA = TGetProcAddr( Instance.Modules.User32, 0xb303ebb4 );
}
}

// ------ Code ------
Instance.Win32.MessageBoxA( NULL, GET_SYMBOL( "Hello World" ), GET_SYMBOL( "MessageBox Title" ), MB_OK );
}

Btw as you can see we can use normal strings in our shellcode. This is because we include the .rdata section into our shellcode at linking time. And GET_SYMBOL gets the pointer to the function or string via its relative offset to GetRIP()

https://blogger.googleusercontent.com/img/a/AVvXsEiB83DaBRx0yg_1k9jG2M9ydsNbd941k5dLfwFqtn0F4Dx49rRVFIyL6VA57VrjPekqVGKT_CyeP_n6eCm5cmf44OOaSgcOKFxIAtnBPbSNAhfb2bx1W17vzhhHaI7bR7bzsmcXMDukOaTEMG1Q0eMZvvMGRkI7PVNRVouq5juuTvJQud6r22rxep8X=w640-h540

Get Started

Clone this project and you are ready to start

git clone https://www.github.com/Cracked5pider/ShellcodeTemplate


Next you would need to change the project name in the makefile from ShellcodeTemplateto whatever you want Then you can compile the project by using make

make // to compile x64 and x86
make x64 // to compile only x64
make x86 // to compile only x86


Credit

Huge credit goes to Austin Hudson (aka SecIdiot)!!!
Download ShellcodeTemplate

hacking: security in practice
Finding an address with a car registration number

Is it possible to find someone’s address with just a car registration number (without transport company or police involved)

submitted by /u/BusSilver
[link] [comments]

Operation Dragon Castling: APT group targeting betting companies - Avast Threat Labs
https://www.reddit.com/r/redteamsec/comments/tkvjib/operation_dragon_castling_apt_group_targeting/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://decoded.avast.io/luigicamastra/operation-dragon-castling-apt-group-targeting-betting-companies/) [comments] (https://www.reddit.com/r/redteamsec/comments/tkvjib/operation_dragon_castling_apt_group_targeting/)

Dark Reading: Attacks/Breaches
Building a Red Team: How to Get Started

These groups of authorized hackers work to infiltrate their customer's data, development environment, or any other business area to locate and identify vulnerabilities.

Dark Reading: Attacks/Breaches
F-Secure Rebrands as WithSecure, Spins Off Consumer Products

Attempting to catch up with CrowdStrike, Microsoft, and Trend Micro, the Helsinki-based endpoint-protection firm "de-merges" its consumer-security business to focus on businesses.

Multiple ways to find sql and cheatsheet

Comments out rest of the query.  Line comments are generally useful for ignoring rest of the query so you don’t have to deal with fixing…Continue reading on Medium »
Read more...