Quickstart Quickstart details. (https://bonjourmalware.github.io/melody/installation) TL;DR Release Get the latest release at https://github.com/bonjourmalware/melody/releases. make install # Set default outfacing interface
make cap # Set network capabilities to start Melody without elevated privileges
make certs # Make self signed certs for the HTTPS fileserver
make enable_all_rules # Enable the default rules
make service # Create a systemd service to restart the program automatically and launch it at startup

sudo systemctl stop melody # Stop the service while we're configuring it Update the filter.bpf file to filter out unwanted packets. sudo systemctl start melody # Start Melody
sudo systemctl status melody # Check that Melody is running The logs should start to pile up in /opt/melody/logs/melody.ndjson. tail -f /opt/melody/logs/melody.ndjson # | jq From source git clone https://github.com/bonjourmalware/melody /opt/melody
cd /opt/melody
make build Then continue with the steps from the release (https://github.com/bonjourmalware/melody#release) TL;DR. Docker make certs # Make self signed certs for the HTTPS fileserver
make enable_all_rules # Enable the default rules
mkdir -p /opt/melody/logs
cd /opt/melody/

docker pull bonjourmalware/melody:latest

MELODY_CLI="" # Put your CLI options here. Example : export MELODY_CLI="-s -i 'lo' -F 'dst port 5555' -o 'server.http.port: 5555'"

docker run \
--net=host \
-e "MELODY_CLI=$MELODY_CLI" \
--mount type=bind,source="$(pwd)/filter.bpf",target=/app/filter.bpf,readonly \
--mount type=bind,source="$(pwd)/config.yml",target=/app/config.yml,readonly \
--mount type=bind,source="$(pwd)/var",target=/app/var,readonly \
--mount type=bind,source="$(pwd)/rules",target=/app/rules,readonly \
--mount type=bind,source="$(pwd)/logs",target=/app/logs/ \
bonjourmalware/melody The logs should start to pile up in /opt/melody/logs/melody.ndjson. Rules Rule syntax details. (https://bonjourmalware.github.io/melody/installation) Example CVE-2020-14882 Oracle Weblogic Server RCE:
layer: http
meta:
id: 3e1d86d8-fba6-4e15-8c74-941c3375fd3e
version: 1.0
author: BonjourMalware
status: stable
created: 2020/11/07
modified: 2020/20/07
description: "Checking or trying to exploit CVE-2020-14882"
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2020-14882"
match:
http.uri:
startswith|any|nocase:
- "/console/css/"
- "/console/images"
contains|any|nocase:
- "console.portal"
- "consolejndi.portal?test_handle="
tags:
cve: "cve-2020-14882"
vendor: "oracle"
product: "weblogic"
impact: "rce" Logs Logs content details. (https://bonjourmalware.github.io/melody/layers) Example Netcat TCP packet over IPv4 : {
"tcp": {
"window": 512,
"seq": 1906765553,
"ack": 2514263732,
"data_offset": 8,
"flags": "PA",
"urgent": 0,
"payload": {
"content": "I made a discovery today. I found a computer.\n",
"base64": "SSBtYWRlIGEgZGlzY292ZXJ5IHRvZGF5LiAgSSBmb3VuZCBhIGNvbXB1dGVyLgo=",
"truncated": false
}
},
"ip": {
"version": 4,
"ihl": 5,
"tos": 0,
"length": 99,
"id": 39114,
"fragbits": "DF",
"frag_offset": 0,
"ttl": 64,
"protocol": 6
},
"timestamp": "2020-11-16T15:50:01.277828+01:00",
"session": "bup9368o4skolf20rt8g",
"type": "tcp",
"src_ip": "127.0.0.1",
"dst_port": 1234,
"matches": {},
"inline_matches": [],
"embedded": {}
}

Download Melody (https://github.com/bonjourmalware/melody)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Where to find "true/real" domains of hacking forums or anything else?

For example, I want to search a leaked database right now and looked up to forums containing leaks section. In this subreddit's wiki I found "leakforums" and on www this one seems like a popular one but how am I supposed to find the real "leakforums"? Is it .su, .co, .fr, .net (.com, .org forwards to .net) or anything else? Would appreciate the help. Thx.

submitted by /u/IHateFacelessPorn
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do i transfer a malicious file from my laptop to my vm

So I made a script that once deployed or downloaded it will immediately make random txt files in a very fast manner and spams it on the desktop and just overwhelms the pc. Now im just hella curious how i can transfer it from my desktop to my VM

submitted by /u/Barlie2
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Codecat v0.56 : An Open-Source Tool To Help You Find/Track User Input Sinks And Security Bugs

CodeCat is an open-source tool to help you find/track user input sinks and security bugs using static code analysis. These points follow regex rules. Current rules for C,C++,GO, Python, javascript, Swift, PHP, Ruby, ASP, Kotlin, Dart and Java.(you can create your rules).

How too install, step by step

Go to CodeCat directory, install backend and frontend libs:

$ apt install python3-venv python3-dev libffi-dev rustc libssl-dev
$ python3 -m venv .venv
$ . .venv/bin/activate
$ pip install wheel
$ pip install -r Frontend/requirements.txt
$ pip install -r Backend/requirements.txt

Run backend and frontend

$ cd Codecat
$ cd Frontend; python3 wsgi.py &
$ cd ..
$ cd Backend; python3 wsgi.py &

Next step you need save your user to login:

$ curl -i -X POST -H “Content-Type: application/json” -d ‘{“email”:”admin2@test.com”,”username”:”admin”,”password”:”rubrik123″}’ https://127.0.0.1:50001/api/users -k

These endpoint /API/users run only once in the first deployment. If you try to send a request again to insert a user, the endpoint return 404 is security to block resources of possible attacks.

Go to the following “https://127.0.0.1:50093/front/auth/”. Now you can enter this system-auth, use login “admin”, pass “rubrik123”.

Note About TLS: You can configure and load your TLS cert in “wsgi.py”.

Production

Suppose you need to run in production. So I recommend another way.

$ gunicorn -b 127.0.0.1:50001 wsgi:app

If you want, you can use TLS with CERT resources:

$ gunicorn –certfile=server.crt –keyfile=server.key -b 127.0.0.1:50001 wsgi:app

The same command to frontend, but you need to use port 50093.
Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How can I prevent Hackers from intruding into my Windows computer?

https://cdn-images-1.medium.com/max/1280/1*XorzWsJQmZ2pf0JbnJFRtg.png
Have you ever thought about frustrating hackers from intruding into your computer? This article lays down an analysis, and fingerprints a…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is the dark web, and what will you find there?

https://cdn-images-1.medium.com/max/1366/1*DwvB_jlcXImbItX4tBfjWg.png
The dark web is the sort of back alley of the internet world. You can find all sorts of illicit activities being conducted there

Continue reading on Mindaro »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Weekly NFT Update #32

https://cdn-images-1.medium.com/max/1500/0*BIdiGBAOOasKPyLw.png
GM NFT enthusiasts! Welcome back to your one-stop shop for all NFT-highlights! Don’t forget to read through today’s weekly update to the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is “Openbullet” and how do cybercriminals abuse it to steal millions of accounts daily?

https://cdn-images-1.medium.com/max/600/1*n8XnYpKJIr2XhvEU095FRQ.png
Credential Stuffing and Openbullet. What are they?

Continue reading on HackerHub »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Melody - A Transparent Internet Sensor Built For Threat Intelligence

___________________________
@hacking_Attack
@Hacking_Video

Coercing NTLM Authentication from SCCM
https://www.reddit.com/r/redteamsec/comments/u2tgub/coercing_ntlm_authentication_from_sccm/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://posts.specterops.io/coercing-ntlm-authentication-from-sccm-e6e23ea8260a) [comments] (https://www.reddit.com/r/redteamsec/comments/u2tgub/coercing_ntlm_authentication_from_sccm/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Wifi password algorithm - PBKDF location

I'm writing a security analysis article and I'm trying to reproduce the results given here in https://www.usenix.org/system/files/conference/woot15/woot15-paper-lorente.pdf with candidate firmware https://www.mediafire.com/file/sda5rzxqmfs5gh9/upfr.zip/file . Till now, I'm unable to locate the PBKDF algorithm location in the firmware. Can anybody help me with this? Pm me for further information. The firmware is an outdated version and not in use now at all.

submitted by /u/ProcedureDelicious95
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Old Hack The Planet Website

Trying to find out what happened to a website/forum I used to frequent in the early 2010s called 'Hack the Planet'. It was basically a set of puzzles and challenges related to 'hacking' aka basic html stuff, that would get progressivley harder and were a way to get people to get more involved.

I used to fuck around there when I was younger and I thought I'd look it up, but I can't find anything about it. Maybe y'all know something about it.

Apologies if it's too off topic.

submitted by /u/AntonioG-S
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Couldn't Find how two cookies are being set on twitter

So keeping it real I'm trying to create a twitter account creater script using python

First I thought of making it with requests lib but wasn't successful as I couldn't figure out how x-csrf-token is being set On twitter x-csrf-token can be found in cookies stored as ct0

There's this preflight request being made with activate.json on first time there isn't any token in but it's actually setting up "Access-Response-Headers" On second time when it's being called you can find csrf token in it and it's also saved in cookies.

And similar issues popped up when I tried doing it with requests

So i opted to selenium. At first I was able to create an account or 2 by automating it... But it's really time consuming and not worth it. And doesn't satisfy my initial goal which is to make it using requests not selenium.

Anyone willing to help?

submitted by /u/h4ck3r_x
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Spring4Shell Code Execution

https://4.bp.blogspot.com/-slZrAXCcTc4/WWlvSkUdx-I/AAAAAAAAINc/GD9pE2wpupUfP-XcYlxrz5jw2m91dZTOgCLcBGAs/s1600/h39.png
Python exploit for CVE-2022-22965 that provides a prompt to the user in the style of an ssh session. The script is designed to be easy to understand and execute, with both readability and accessibility - depending on the user's choice. Designed for exploiting the vulnerability on tomcat servers. The fileDateFormat field on the server will be set and unset as part of the script which allows the exploit to be run multiple times. Cleanup may be required. It leverages a vulnerability found in the java spring framework before version 5.2, as well as in versions 5.3.0-17 an d 5.2.0-19 and running on a version of the Java Development Kit greater than or equal to 9.

MD5 | e7a290b05afa996043b9cfc38a121fcb

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Social Hunter
https://medium.com/@reconshell.com/social-hunter-f9748e360859?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Crawls the given URL and finds broken social media links that can be hijacked. Broken social links may allow an attacker to conduct…Continue reading on Medium » (https://medium.com/@reconshell.com/social-hunter-f9748e360859?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video