KNX is a popular building automation (https://www.kitploit.com/search/label/Automation) protocol and is used to interconnect sensors, actuators and other components of a smart building together. Our KNX Bus Dump tool uses the Calimero java library, which we contributed to for the sake of this tool, to record the telegrams sent over a KNX bus. Particularly, our tool accesses the KNX bus through a TPUART connection but can be changed to use different connection mediums. The telegrams are dumped into a Wireshark-compatible hex dump file. Timestamps are provided and normalized to UTC time with nanosecond precision to perform data analysis and provide a timeline of the telegrams. The hex dump file can be imported into Wireshark, which can be configured to dissect the KNX telegrams with Wireshark’s cEMI dissector.
Our tool can be used for protocol analysis (https://www.kitploit.com/search/label/Protocol%20Analysis) of KNX sensors, actuators and other KNX devices. For example, we used the tool to understand our KNX devices and found irregular KNX telegrams. The tool is also ideal for security analysis of KNX devices given that it exposes all details of the involved protocol and data sent over the KNX bus. Tcpdump and Wireshark cannot be used to dump telegrams sent over a KNX bus since we are dealing with native KNX telegrams, not TCP/IP packets. Wireshark and tcpdump can dump KNXnet/IP packets, which are TCP/IP packets. KNXnet/IP is a protocol for sending commands and data to a KNX bus over a TCP/IP network. Prerequisites This tool is designed to work with the Calimero Java library and is compatible with a Raspberry Pi (https://www.kitploit.com/search/label/Raspberry%20Pi) 3 or 4 and a Raspberry Pi HAT for the TPUART connection. Here are some guides to getting the environment setup: KNX Raspberry PiHAT Usage Walkthrough (https://github.com/ChrisM09/KNX-Bus-Dump/blob/main/KNX-Raspberry-Pi-Hat-Usage/README.md) Raspberry Pi and Calimero Suite Setup (https://github.com/ChrisM09/KNX-Bus-Dump/blob/main/Raspberry-Pi-Calimero-Setup/README.md) Note: The next steps will assume that you setup your environment according to these guides. Usage Creating the Hex Dump Place the KNXBusDump.java file into the introduction/src/main/java/ folder of the Calimero Project suite. Change into the introduction folder. To run the program, you can simply run: ./gradlew run -Pcalimero.serial.tpuart.maxInterByteDelay=60000 -DmainClass=KNXBusDump
Refer to the troubleshooting guide below for some common error solutions. Now, you wait for some messages to be transmitted on the bus and the dumped telegrams will be in the KNXBusDump-Telegrams.txt file. Cancel the tool using Ctrl-C and the file is now ready to be imported into Wireshark to be analyzed. Analyzing the Hex Dump In Wireshark, you have the ability to import packets from a hex dump and specify a dissector to analyze the packet. Upon starting Wireshark, wait for the initial loading to finish. Then click File -> Import From Hex Dump...

___________________________
@hacking_Attack
@Hacking_Video

In order to properly parse this out, we need to give it a regular expression (https://www.kitploit.com/search/label/Regular%20Expression) (regex) with some tags. ^\s*(?\d{4}-\d\d\-\d\dT(\d\d\:){2}\d\d.(\d){6}[Z])\s(?\d{6})\s+(?[0-9a-fA-F]*)$
Choose the hex dump file as the source. Under the new dialog, change to the Regular Expression tab and paste the regex into the box. Ensure that the data encoding is Plain hex 200*16 In the Timestamp format textbox, we need to specify the pattern that is generated by the tool. %Y-%m-%dT%H:%M:%S.%fZ
NOTE: The timestamp format MUST be the EXACT SAME as this. Otherwise, there will not be a timestamp parsed out. Under the Encapsulation section, change Encapsulation Type to Wireshark Upper PDU Export. Check ExportPDU to specify the cemi dissector. Now you're able to import the file and analyze the telegram.

___________________________
@hacking_Attack
@Hacking_Video

Sample Output Wireshark Timestamp:

___________________________
@hacking_Attack
@Hacking_Video

Corresponding Hex Dump File

___________________________
@hacking_Attack
@Hacking_Video

Note: The time that is highlighted is the NORMALIZED UTC TIME. No matter what the timezone next to the time says, it will ALWAYS be the right time in UTC.

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Litefuzz : A Multi-Platform Fuzzer For Poking At Userland Binaries And Servers

Litefuzz is meant to serve a purpose: fuzz and triage on all the major platforms, support both CLI/GUI apps, network clients and servers in order to find security-related bugs. It simplifies the process and makes it easy to discover security bugs in many different targets, across platforms, while just making a few honest trade-offs.

It isn’t built for speed, scalability or meant to win any prizes in academia. It applies simple techniques at various angles to yield results. For console-based file fuzzing, you should probably just use AFL. It has superior performance, instrumention capabilities (and faster non-instrumented execs), scale and can make freakin’ jpegs out of thin air. For networking fuzzing, the mutiny fuzzer also works well if you have PCAPs to replay and frizzer looks promising as well. But if you want to give this one a try, it can fuzz those kinds of targets across platforms with just a single tool.

./ and give your target… a lite fuzz.

sudo apt install latex2rtf
./litefuzz.py -l -c “latex2rtf FUZZ” -i input/tex -o crashes/latex2rtf -n 1000 -z
–========================–
–======| litefuzz |======–
–========================–
[STATS]
run id: 3516
cmdline: latex2rtf FUZZ
crash dir: crashes/latex2rtf
input dir: input/tex
inputs: 1
iterations: 1000
mutator: random(mutators)
@ 1000/1000 (3 crashes, 127 duplicates, ~0:00:00 remaining)
[RESULTS]
completed (1000) iterations with (3) unique crashes and 127 dups
check crashes/latex2rtf for more details

This is a simple local target which AFL++ is perfectly capable of handling and just quickly given as an example. Litefuzz was designed to do much more in the way of network and GUI fuzzing which you’ll see once you dive in. whyYes, another fuzzer and one that doesn’t track all that well with the current trends and conventions. Trade-offs were made to address certain requirements. These requirements being a fuzzer that works by default on multiple platforms, fuzzes both local and network targets and is very easy to use. Not trying to convince anybody of anything, but let’s provide some context. Some targets require a lot of effort to integrate fuzzers such as AFL into the build chain. This is not a problem as this fuzzer does not require instrumentation, sacraficing the precise coverage gained by instrumentation for ease and portability. AFL also doesn’t support network fuzzing out of the box, and while there are projects based on it that do, they are far from straightforward to use and usually require more code modifications and harnesses to work (similar story with Libfuzzer). It doesn’t do parallel fuzzing, nor support anything like the blazing speed improvments that persistent mode can provide, so it cannot scale anywhere close to what fuzzers with such capabilities. Again, this is not a state-of-the-art fuzzer. But it doesn’t require source code, properly up a build or certain OS features. It can even fuzz some network client GUIs and interactive apps. It lives off the land in a lot of ways and many of the features such as mutators and minimization were just written from scratch.

It was designed to “just work” and effort has been put into automating the setup and installation for the few dependencies it needs. This fuzzer was written to serve a purpose, to provide value in a lot of different target scenarios and environments and most importantly and for what all fuzzers should ultimately be judged on: the ability to find bugs. And it does find bugs. It doesn’t presume there is target source code, so it can cover closed source software fairly well. It can run as part of automation with little modification, but is geared towards being fun to use for vulnerability researchers. It is however more helpful to think of it as a R&D project rather than a fully-fl[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Searpy : Search Engine Toolkit

Searpy, as its name implies, search engine optimization is the practice of optimizing websites and web pages for discovery in search engines.

Install

git clone https://github.com/j3ers3/Searpy
pip install -r requirement.txt
配置API及账号 ./config.py
python Searpy -h

Help

Searpy Engine Tookit
optional arguments:
-h, –help show this help message and exit
ENGINE:
–baidu Using baidu Engine
–google Using google Engine
–so Using 360so Engine
–bing Using bing Engine
–shodan Using shodan Engine
–fofa Using fofa Engine
–zoomeye Using zoomeye Engine
–goo Using goo Engine
–yahoo Using yahoo Engine
SCRIPT:
–shodan_icon SHODAN_ICON
Get ip list which using the same favicon.ico
–fofa_icon FOFA_ICON
Get ip list which using the same favicon.ico
MISC:
-s SEARCH Speciy Keyword
-o OUTPUT Specify output file default output.txt
-p PAGE Search page (default 1)
-l LIMIT Maximum searching results (default:10) Only Shodan

Example

python3 Searpy.py –fofa -s “app=jboss” -p 1
python3 Searpy.py –shodan -s “weblogic” -l 10
python3 Searpy.py –google -s “inurl:login.action” -p 1

Other functions

Use favicon.icon icon hash to find websites with the same icon, which can be used for real IP traceability and asset discovery

python3 Searpy.py –shodan_icon https://www.qq.com
python3 Searpy.py –fofa_icon https://www.qq.com

Module call

from Searpy import Bing
s = Bing(‘inurl:php?id=1’, 2)
s.search()
for i in s.result:
print(i)

Support search engine

* Shodan
* Cute
* Zoomeye
* censys
* Dnsdb
* Google
* Baidu
* Bing
* 360 so
* Goo
* Yahoo

Everything

* Add subdomain search

ChangeLog

v2.3

* fix some bugs
* add fofa_icon module

v2.2

* fix some bugs
Download

___________________________
@hacking_Attack
@Hacking_Video

edged product. Also, there’s no complicated setup where it’s slightly broken out of the box or needs more work to get it running on modern operating systems. It’s been tested working on Ubuntu Linux 20.04, Mac OS 11 and Windows 10 and comes with fully functional scripts that do just about everything for you in order to setup a ready-to-fuzz environment.

Once the setup script completes, it only takes a few minutes to get started fuzzing a ton of different targets. how it worksLitefuzz supports three different modes: local, client and server. Local means targeting local binaries, which on Linux/Mac are launched via sub process with automatic GDB and LLDB triage support respectively on crashes and via WinAppDbg on Windows. Crashes are written to a local crash directory and sorted by fault type, such as read/write AVs or SIGABRT/SIGSEGV along with the file hashes. All unique crashes are triaged as it fuzzes and this data along with target output (as available) is also captured and placed as artifacts in the same directory. It’s also possible to replay crashes with --replayand providing the crashing file. In localclient mode, the input directory should contain a server greeting, response or otherwise data that a client would expect when connecting to a server. As of now only one “shot” is implementated for network fuzzing with no complex session support. The client is launched via command line and debugged the same as when file fuzzing. A listener is setup to support this scenario, yes its a slow and borderline manual labor but it works. If a crash is detected, it is replayed in gdb to get the triage details. In remoteclient mode, this works the same expect for no local debugging / crash triage. In local server mode, it’s similar to local client mode and for remoteserver mode it just connects to a specified target and send mutated sample client data that the user specifies as inputs, but only a simple “can we still connect, if not then it probably crashed on the last one” triage is provided.

There are a few mutation functions written from scratch which mostly do random mutations with a random selection of inputs specified by the -iflag. For file fuzzing, just select local mode and pass it the target command line with FUZZ denoting where the app expects the filename to parse, eg. tcpdump -r FUZZalong with an input directory of “good files” to mutate. For network client fuzzing, it’s similar to local fuzzing, but also provide connection specifics via -a. And if you want to fuzz servers, do server mode and provide a protocol://address:portjust like for clients.

It fuzzes as fast as the target can consume the data and exit, such as the case for most CLI applications or for as long as you’ve determined it needs before the local execution or network connection times out, which can be much slower. No fancy exec or kernel tricks here. But of course if you write a harness that parses input and exits quickly, covering a specific part of the target, that helps too. But at that point, if you can get that close to the target, you’re probably better off using persistant mode or similar features that other fuzzers can offer.

In short… what it does* runs on linux, windows and mac and supports py2/py3
* fuzzes CLI/GUI binaries that read from files/stdin
* fuzzes network clients and servers, open source or proprietary, available to debug locally or remote
* diffs, minimization, replay, sorting and auto-triaging of crashes
* misc stuff like TLS support, golang binary fuzzing and some extras for Mac
* mutates input with various built-in mutators + pyradamsa (Linux) what it doesn’t do* native instrumentation
* scale with concurrent jobs
* complex session fuzzing
* remote client and server monitoring (only basic checks eg. connect) supportPrimarily tested on Ubuntu Linux 20.04 (21.04 lightly tested), Windows 10 and Mac OS 11 (12 lightly tested). The fuz[...]

___________________________
@hacking_Attack
@Hacking_Video

zer and setup scripts may work on slightly older or newer versions of these operating systems as well, but the majority of research, testing and development occurred in these environments. Python3 is supported and an effort was made to make the code compatiable with Python2 as well as it’s necessary for fuzzing on Windows via WinAppDbg. Platform testing primarily occured on Intel-based hardware, but things seem to mostly work on Apple’s M1 platform too (notable exceptions being on Linux the exploitable plugin for GDB probably isn’t supported, nor is Pyradamsa). There are also setup scripts in setup/ to automate most or all of the tasks and depencency installation. It can generally fuzz native binaries on each platform, which are often compiled in C/C++, but it also catch crashes for Golang binaries as well (experimental). python versionsPython3 is supported for Linux and Mac while Python2 is required for Windows.

Why Py3 for Linux and Mac? Pyautogui, Pyradamsa (Linux only), better socket support on Mac.

Why Py2 for Windows? Winappdbg requires Py2. linuxGDB for debugging and exploitable for crash triage. If it’s OSS, you can build and instrument the target with sanitizers and such, otherwise there’s some memory debuggers we can just load at runtime.

This installation along with the python dependencies and other helpful stuff has been automated with setup/linux.sh. Recommended OS is Ubuntu 20.04 as that is where the majority of testing occurred. macInstead of gdb, we use lldb for debugging on OS X as it’s included with the XCode command line tools. Being an admin or in the developer group should let you use lldb, but this behavior may differ across environments and versions and you may need to run it with sudo privileges if all else fails.

The one thing you’ll manually need to do is turn off SIP (in recovery, via cmd+R or use vmware fusion hacks). Otherwise, auto-triage will fail when fuzzing on Tim Apple’s OS.

Almost all of the setup has been automated with the setup/mac.sh script, so you can just run it for a quick start. windowsWinAppDbg is used for debugging on Windows with the slight caveat that stdin fuzzing isn’t supported.

Like the automated setups for the other operating systems, chocolatey helps to automate package installation on windows. Run setup/windows.bat in the litefuzz root directory as Administrator to automate the installations. It will install debugging tools and other dependencies to make things run smoothly. targetsThis is a list of the types of targets that have been tested and are generally supported.

* Local CLI/GUI apps that parse file formats or stdin
* debug support

* Local CLI/GUI network client that parses server responses
* debug support for CLIs
* limited debug support for GUIs

* Local CLI network server that parses client requests
* debug support (caveat: must able to run as a standalone executable, otherwise can be treated as remote)

* Local GUI network server that parses client requests
* theoretically supported, untested

* Remote CLI/GUI network client that parses server responses
* no debug support

* Remote CLI/GUI network server that parses client requests
* no debug support
* exception being on Mac and using attachor reportcrashfeatures
Again, the fuzzer can run on and support local apps, clients and servers on Linux, Mac and Windows and of course can fuzz remote stuff independent of the target platform. triage* Local CLI/GUI apps that parse file formats or stdin
* run app, catch signals, repro by running it again inside a debugger with the crasher

* Local CLI/GUI network client that parses server responses
* run app, catch signals, repro by running it again inside a debugger with the crasher

* Local GUI/CLI network server that parses client requests
* run app in debugger, catch signals, repro by running it again inside a debugger with the crasher

* Remote CLI/GUI network client that parses server responses
* no vi[...]

___________________________
@hacking_Attack
@Hacking_Video

siblity, collect crashes from the remote side
* can manually write supporting scripts to aid in triage

* Remote CLI/GUI network server that parses client requests
* no visiblity, collect crashes from the remote side
* can manually write supporting scripts to aid in triage
* exception on Mac are the attachand reportcrashoptions, which can be used to enable some triage capabilities getting startedMost of the setup across platforms has been automated with the scripts in the setup directory. Simply run those from the litefuzz root and it should save you a lot of time and help enable some of what’s needed for automated deployments. It’s useful to use a VM to setup a clean OS and fuzzing environment as among other things its snapshot capabilities come in handy.

See INSTALL.md for details. testsunit testsThere are a few simple unit and functional tests to get some coverage for Litefuzz, but it is not meant to be complete.

py2> pytest
py3> python3 -m pytest

This will run pytest for test_litefuzz.pyin the main directory and provide PASS/FAIL results once the test run is finished. crashing app testsA few examples of buggy apps for testing crash and triage capabilities on the different platforms can be found in the testfolder.

* (a) null pointer dereference
* (b) divide-by-zero
* (c) heap overflow
* (d-gui) format string bug in a GUI
* (e) buffer overflow in client
* (f) buffer overflow in server

They are automatically built during setup and you can run them on the command line, in a debugger or use them to test as fuzzing targets. If running on Windows command line, check Event Viewer -> Windows Logs -> Applicationto see crashes. optionsThere are a ton of different options and features to take advantage of various target scenarios. The following is a brief explanation and some examples to help understand how to use them. crash directory-olets you specify a crash directory other than the default, which is the crashes/ in the local path. One can use this to manage crash folders for several concurrent fuzzing runs for different apps at the same time. insulate mode-uinsulates the target application from the normal fuzzing process, eg. execs or sending packets over and over and checking for crashes. Instead, this mode was made for interactive client applications, eg. Postman where you can script inside the application to repeat connections for client fuzzing. The target is ran inside of a debugger, the fuzzer is paused to get the user time to click a few buttons or sets the target’s config to make it run automatically, user resumes and now you are fuzzing interactive network clients. litefuzz -lk -c "/snap/postman/140/usr/share/Postman/_Postman" -i input/http_responses -a tcp://localhost:8080 -u -n 100000 -zInsulate mode + refresh can be used for interactive clients, eg. run FileZilla in a debugger, but keep hitting F5 to make it reconnect to the server for each new iteration. Also, fuzzing local CLI/GUI servers are only started and ran once inside a debugger to make the process a little more efficient. --keyalso allows you to send keys while fuzzing interactive targets, such as fuzzing FileZilla’s parsing of FTP server responses by sending “refresh connection” with F5. litefuzz -lk -c "filezilla" -a tcp://localhost:2121 -i input/ftp/filezilla -u -pp --key "F5" -n 100 -z glibcnote: insulate mode has only been tested working on Linux and is not supported on Windows. timeout-x secsallows you to specify a timeout. In practice, this is more like “approx how long between iterations” for CLI targets and an actual timeout for GUIs. mutators--mutator Nspecifies which mutator to use for fuzzing. If the option is not provided, a random choice from the list of available mutators is chosen for each fuzzing iteration. These mutators were written from scratch (w[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Litefuzz : A Multi-Platform Fuzzer For Poking At Userland Binaries And Servers

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Wavlink Command Injection (CVE-2022–23900)

https://cdn-images-1.medium.com/max/899/1*r2YxDLi4t-Db4XZQ8z3Pyg.png
Your Router Is My Router

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Module-2 | OWASP ModSecurity Core Rule Set -Pentesting & Bypassing Cloud Web Application Firewall…

https://cdn-images-1.medium.com/max/600/1*GDkNNwPsI7tL1p0ZV9dnyw.png
Q. What is Core Rule Set & why it is utilized by all the cloud WAFs?
A. We will try to understand more about the core rule set along with…

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
KNX-Bus-Dump - A Tool To Listen On A KNX Bus Via TPUART And The Calimero Project Suite And To Dump The Data From The Packets Into A Wireshark-Compatible File Hex Dump

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyLi0gQ8NmQWP3syFUwkaNTPMeOm1fesd2vUsEmVDB4lEIesCXXiEw3ioXLRFiEeUZgddKbCJWDdxfkbEJ0ZorXqV3UUcCg0OOS0jJGip96c29kBSaRFObdaROcAkn4umMmQYIvCMVLMWhaHvfwK-wGjibNnllxilZKDm8yGdt1NTfpn6B_68dgAKy/w640-h524/KNX-Bus-Dump_6_Local-KNX-Setup.jpeg KNX is a popular building automation protocol and is used to interconnect sensors, actuators and other components of a smart building together. Our KNX Bus Dump tool uses the Calimero java library, which we contributed to for the sake of this tool, to record the telegrams sent over a KNX bus. Particularly, our tool accesses the KNX bus through a TPUART connection but can be changed to use different connection mediums. The telegrams are dumped into a Wireshark-compatible hex dump file. Timestamps are provided and normalized to UTC time with nanosecond precision to perform data analysis and provide a timeline of the telegrams. The hex dump file can be imported into Wireshark, which can be configured to dissect the KNX telegrams with Wireshark’s cEMI dissector.
Our tool can be used for protocol analysis of KNX sensors, actuators and other KNX devices. For example, we used the tool to understand our KNX devices and found irregular KNX telegrams. The tool is also ideal for security analysis of KNX devices given that it exposes all details of the involved protocol and data sent over the KNX bus.

Tcpdump and Wireshark cannot be used to dump telegrams sent over a KNX bus since we are dealing with native KNX telegrams, not TCP/IP packets. Wireshark and tcpdump can dump KNXnet/IP packets, which are TCP/IP packets. KNXnet/IP is a protocol for sending commands and data to a KNX bus over a TCP/IP network. PrerequisitesThis tool is designed to work with the Calimero Java library and is compatible with a Raspberry Pi 3 or 4 and a Raspberry Pi HAT for the TPUART connection.

Here are some guides to getting the environment setup:

1. KNX Raspberry PiHAT Usage Walkthrough
2. Raspberry Pi and Calimero Suite Setup

Note: The next steps will assume that you setup your environment according to these guides. UsageCreating the Hex Dump1.
Place the KNXBusDump.java file into the introduction/src/main/java/ folder of the Calimero Project suite.

2.
Change into the introduction folder.

3.
To run the program, you can simply run: ./gradlew run -Pcalimero.serial.tpuart.maxInterByteDelay=60000 -DmainClass=KNXBusDump Refer to the troubleshooting guide below for some common error solutions.

4.
Now, you wait for some messages to be transmitted on the bus and the dumped telegrams will be in the KNXBusDump-Telegrams.txt file.

5.
Cancel the tool using Ctrl-C and the file is now ready to be imported into Wireshark to be analyzed. Analyzing the Hex DumpIn Wireshark, you have the ability to import packets from a hex dump and specify a dissector to analyze the packet.

1.
Upon starting Wireshark, wait for the initial loading to finish. Then click File -> Import From Hex Dump... https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZGvbjM7z-WNksG9rEytzNhhrV13MphJzCJwZSgnjUDriEH0jNOUn2-plo-6XaovMj8OyQPI7AMaC3wN7xZS-Au0AwpAmwR3ZULTjCfHz-rMVa-502A4pUu_e6vo1ZdfUiuH0ilEEqx-G_fxXWCDSCaN2uKDOrLxjAO0p8WtSxPZVRl6nylWCX5n3Y/s16000/KNX-Bus-Dump_1.png 2.
In order to properly parse this out, we need to give it a regular expression (regex) with some tags. ^\s*(?\d{4}-\d\d\-\d\dT(\d\d\:){2}\d\d.(\d){6}[Z])\s(?3.
Choose the hex dump file as the source.

4.
Under the new dialog, change to the Regular Expression tab and paste the regex into the box.

5.
Ensure that the data encoding is Plain hex 200*16

6.
[...]

___________________________
@hacking_Attack
@Hacking_Video