Features Dashboard Fixable vulnerabilities per severity Top 5 vulnerable elements (applications, resources, packages) New vulnerabilities trends Package count per license type Package count per programming language General counters Applications Automatic application detection in K8s runtime Create/edit/delete applications Per application, navigation to related: Resources (images/directories) Packages Vulnerabilities Licenses in use by the resources Application Resources (images/directories) Per resource, navigation to related: Applications Packages Vulnerabilities Packages Per package, navigation to related: Applications Linkable list of resources and the detecting SBOM analyzers Vulnerabilities Vulnerabilities Per vulnerability, navigation to related: Applications Resources List of detecting scanners K8s Runtime scan Automatic detection of target namespaces Scan progress and result navigation per affected element (applications, resources, packages, vulnerabilities) CLI (CI/CD) SBOM generation using multiple integrated content analyzers (Syft, cyclonedx-gomod) SBOM/image/directory vulnerability scanning using multiple integrated scanners (Grype, Dependency-track) Merging of SBOM and vulnerabilities across different CI/CD stages Export results to KubeClarity backend API The API for KubeClarity can be found here (https://github.com/openclarity/kubeclarity/blob/master/api/swagger.yaml) High level architecture

___________________________
@hacking_Attack
@Hacking_Video

Getting started Integration with SBOM generators and vulnerability scanners KubeClarity content analyzer integrates with the following SBOM generators: Syft (https://github.com/anchore/syft) Cyclonedx-gomod (https://github.com/CycloneDX/cyclonedx-gomod) KubeClarity vulnerability scanner (https://www.kitploit.com/search/label/Vulnerability%20Scanner) integrates with the following scanners: Grype (https://github.com/anchore/grype) Dependency-Track (https://github.com/DependencyTrack/dependency-track) The integrations with the SBOM generators can be found here (https://github.com/openclarity/kubeclarity/tree/master/shared/pkg/analyzer), and the integrations with the vulnerability scanners can be found here here (https://github.com/openclarity/kubeclarity/tree/master/shared/pkg/scanner). To enable and configure the supported SBOM generators and vulnerability scanners, please check the "analyzer" and "scanner" config under the "vulnerability-scanner" section in Helm values. Contributions of integrations with additional tools are more than welcome! Install KubeClarity in a K8s cluster using Helm: Add Helm repo helm repo add kubeclarity https://openclarity.github.io/kubeclarity Save KubeClarity default chart values helm show values kubeclarity/kubeclarity > values.yaml Check the configuration in values.yaml and update the required values if needed Deploy KubeClarity with Helm helm install --values values.yaml --create-namespace kubeclarity kubeclarity/kubeclarity -n kubeclarity or for OpenShift Restricted SCC compatible install: helm install --values values.yaml --create-namespace kubeclarity kubeclarity/kubeclarity -n kubeclarity --set global.openShiftRestricted=true \
--set kubeclarity-postgresql.securityContext.enabled=false --set kubeclarity-postgresql.containerSecurityContext.enabled=false \
--set kubeclarity-postgresql.volumePermissions.enabled=true --set kubeclarity-postgresql.volumePermissions.securityContext.runAsUser="auto" \
--set kubeclarity-postgresql.shmVolume.chmod.enabled=false Port forward to KubeClarity UI: kubectl port-forward -n kubeclarity svc/kubeclarity-kubeclarity 9999:8080 Open KubeClarity UI in the browser: http://localhost:9999/ Required K8s permissions Read secrets in cluster scope. This is required for getting image pull secrets for scanning private image repositories. Read config maps in cluster scope. This is required for getting the configured template of the scanner job. List pods in cluster scope. This is required for calculating the target pods that need to be scanned. List namespaces. This is required for fetching the target namespaces to scan in K8s runtime scan UI. Create & delete jobs in cluster scope. This is required for managing the jobs that will scan the target pods in their namespaces. Build and run locally with demo data Build UI & backend and start the backend locally (2 options): Using docker: Build UI and backend (the image tag is set using VERSION): VERSION=test make docker-backend Run the backend using demo data: docker run -p 8080:8080 -e FAKE_RUNTIME_SCANNER=true -e FAKE_DATA=true -e ENABLE_DB_INFO_LOGS=true -e DATABASE_DRIVER=LOCAL ghcr.io/openclarity/kubeclarity:test run Local build: Build UI and backend make ui && make backend Copy the built site: cp -r ./ui/build ./site Run the backend locally using demo data: FAKE_RUNTIME_SCANNER=true DATABASE_DRIVER=LOCAL FAKE_DATA=true ENABLE_DB_INFO_LOGS=true ./backend/bin/backend run Open KubeClarity UI in the browser: http://localhost:8080/ CLI KubeClarity includes a CLI that can be run locally and especially useful for CI/CD pipelines. It allows to analyze images and directories to generate SBOM, and scan it for vulnerabilities. The results can be exported to KubeClarity backend. Binary Distribution Download the release distribution for your OS from the releases page

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Type of phishing attacks with examples

https://cdn-images-1.medium.com/max/1200/1*wBa_HTQI9-n8QVPfpxXftA.jpeg
Hello buddies, I’m here with another handy tutorial and in this tutorial you will learn the most common phishing attacks which hackers use…

Continue reading on Block Magnates »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack Nedir? Hacker Türleri | Siber Suç

https://cdn-images-1.medium.com/max/1024/1*mnFH1K4c-5DZmTM26Jzytw.jpeg
Hack Nedir?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is a Riskware?

https://cdn-images-1.medium.com/max/2600/1*pRW8vDVeVurwIk-bT2sTOw.jpeg
Riskware is software that is both lawful and illegitimate and is vulnerable to cyber-attacks. Riskware is not always intended to be…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
OpenVAS docker container setup (Working 2022, all NVTs)

https://cdn-images-1.medium.com/max/886/1*4SRXO3sovj8oJX7HzlQtOg.png
I needed to scan a lot of IPs with OpenVAS for an assignment and it proved to be a very painful experience.

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
the real hardest part of hacking: getting a phishing link through the fucking gmail spam filters

i use link shorteners, html, carefully edit and dissect the email so it looks real, yet the google spam filters catch it every time

The mass mailer attack for SET is useless to me for this exact reason also. Am i supposed to use proxies with that thing or something?

Please teach me your ways, phishing masters.

submitted by /u/osint_god
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is there a specific website where script kiddies get their code from?

I am studying Cybersecurity and I know a big part of it is how to find things on the internet

submitted by /u/BasisPrimary4028
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Kubeclarity - Tool For Detection And Management Of Software Bill Of Materials (SBOM) And Vulnerabilities Of Container Images And Filesystems

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
SysWhispers3 : AV/EDR Evasion Via Direct System Calls

SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. Why on earth didn’t I create a PR to SysWhispers2?The reason for SysWhispers3 to be a standalone version are many, but the most important are:

* SysWhispers3 is the de-facto “fork” used by Inceptor, and implements some utils class which are not relevant to the original version of the tool.
* SysWhispers2 is moving towards supporting NASM compilation (for gcc/mingw), while this version is specifically designed and tested to support MSVC (because Inceptor will stay a Windows-only framework for the near future).
* SysWhispers3 contains partially implemented features (such as egg-hunting) which would not be sensible to include in the original version of the tool. Differences with SysWhispers2The usage is pretty similar to SysWhispers2, with the following exceptions:

* It also supports x86/WoW64
* It supports syscalls instruction replacement with an EGG (to be dynamically replaced)
* It supports direct jumps to syscalls in x86/x64 mode (in WOW64 it’s almost standard)
* It supports direct jumps to random syscalls (borrowing @ElephantSeal’s idea)

A better explanation of these features are better outlined i the blog post SysWhispers is dead, long live SysWhispers! IntroductionSecurity products, such as AVs and EDRs, usually place hooks in user-mode API functions to analyse a program execution flow, in order to detect potentially malicious activities.

SysWhispers2 is a tool designed to generate header/ASM pairs for any system call in the core kernel image (ntoskrnl.exe), which can then be integrated and called directly from C/C++ code, evading user-lands hooks.

The tool, however, generates some patters which can be included in signatures, or behaviour which can be detected at runtime.

SysWhispers3 is built on top of SysWhispers2, and integrates some helpful features to bypass these forms of detection. InstallationC:> git clone https://github.com/klezVirus/SysWhispers3.git
C:> cd SysWhispers3
C:> python .\syswhispers.py –help Usage and ExamplesThe help shows all the available commands and features of the tool:

C:>python syswhispers.py -h
usage: syswhispers.py [-h] [-p PRESET] [-a {x86,x64}] [-m {embedded,egg_hunter,jumper,jumper_randomized}] [-f FUNCTIONS] -o OUT_FILE [–int2eh] [–wow64] [-v] [-d]
SysWhispers3 – SysWhispers on steroids
optional arguments:
-h, –help show this help message and exit
-p PRESET, –preset PRESET
Preset (“all”, “common”)
-a {x86,x64}, –arch {x86,x64}
Architecture
-c {msvc,mingw,all}, –compiler {msvc,mingw,all}
Compiler
-m {embedded,egg_hunter,jumper,jumper_randomized}, –method {embedded,egg_hunter,jumper,jumper_randomized}
Syscall recovery method
-f FUNCTIONS, –functions FUNCTIONS
Comma-separated functions
-o OUT_FILE, –out-file OUT_FILE
Output basename (w/o extension)
–int2eh Use the old int 2ehinstruction in place of syscall–wow64 Use Wow64 to run x86 on x64 (only usable with x86 architecture)
-v, –verbose Enable debug output
-d, –debug Enable syscall debug (insert software breakpoint) Command LinesStandard SysWhispers, embedded system calls (x64)Export all functions with compatibility for all supported Windows versions (see example-output/).
py .\syswhispers.py –preset all -o syscalls_all
Export just the common functions (see below for list).
py .\syswhispers.py –preset common -o syscalls_common
Export NtProtectVirtualMemory and NtWriteVirtualMemory with compatibility for all versions.
py .\syswhispers.py –functions NtProtectVirtualMemory,NtWriteVirtualMemory -o syscalls_mem SysWhispers3-only samplesNormal SysWhispers, 32-bits mode
py .\syswhispers.py –preset all -o syscalls_all -m jumper –arch x86
Normal SysWhispers, using WOW64 in 32-bits mode (only specific fun[...]

___________________________
@hacking_Attack
@Hacking_Video

ctions)
py .\syswhispers.py –functions NtProtectVirtualMemory,NtWriteVirtualMemory -o syscalls_mem –arch x86 –wow64
Egg-Hunting SysWhispers, to bypass the “mark of the sycall” (common function)
py .\syswhispers.py –preset common -o syscalls_common -m jumper
Jumping/Jumping Randomized SysWhispers, to bypass dynamic RIP validation (all functions) using MinGW as the compiler
py .\syswhispers.py –preset all -o syscalls_all -m jumper -c mingw Script OutputPS C:\Projects\SysWhispers2> py .\syswhispers.py –preset common –out-file temp\syscalls_common -v . ,–.
,-. . . ,-. . , , |-. o ,-. ,-. ,-. ,-. ,-. _/ -. | |-. |/|/ | | | -. | | |-' |-. . \ -'-| -' ' ' ' ' '-‘ |-‘ -' '-‘ ”’ /| | @Jackson_T `-‘ ‘ @modexpblog, 2021 Edits by @klezVirus, 2022 SysWhispers3: Why call the kernel when you can whisper? Common functions selected. Complete! Files written to: temp\syscalls_common.h temp\syscalls_common.c temp\syscalls_common.asm
Press a key to continue… Importing into Visual Studio* Copy the generated H/C/ASM files into the project folder.
* In Visual Studio, go to Project → Build Customizations… and enable MASM.
* In the Solution Explorer, add the .h and .c/.asm files to the project as header and source files, respectively.
* Go to the properties of the ASM file, and set the Item Type to Microsoft Macro Assembler. Compiling outside of Visual StudioWindowsMakefile for 64 bits: Makefile.msvcOPTIONS = -Zp8 -c -nologo -Gy -Os -O1 -GR- -EHa -Oi -GS-
LIBS = libvcruntime.lib libcmt.lib ucrt.lib kernel32.lib program:
ML64 /c syscalls-asm.x64.asm /link /NODEFAULTLIB /RELEASE /MACHINE:X64
cl.exe $(OPTIONS) syscalls.c program.c
link.exe /OUT:program.x64.exe -nologo $(LIBS) /MACHINE:X64 -subsystem:console -nodefaultlib syscalls-asm.x64.obj syscalls.obj program.obj

Compile with nmake:

nmake -f Makefile.msvc LinuxMakefile for both 64 and 32 bits: Makefile.mingwCC_x64 := x86_64-w64-mingw32-gcc
CC_x86 := i686-w64-mingw32-gcc
OPTIONS := -masm=intel -Wall
program:
$(CC_x64) syscalls.c program.c -o program.x64.exe $(OPTIONS)
$(CC_x86) syscalls.c program.c -o program.x86.exe $(OPTIONS) Caveats and Limitations* The Egg-Hunter functionality is not implemented within this tool, it is in Inceptor.
* System calls from the graphical subsystem (win32k.sys) are not supported.
* Tested on Visual Studio 2019/2022 with Windows 10 SDK.
* Support for NASM is not guaranteed.
* Support for GCC and MinGW is not guaranteed. Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Factual-Rules-Generator : An Open Source Project Which Aims To Generate YARA Rules

Factual-rules-generator is an open source project which aims to generate YARA rules about installed software from a running operating system.

The goal of the software is to be able to use a set of rules against collected or acquired digital forensic evidences and find installed software in a timely fashion.

The software can be used to baseline known software from Windows system and create a set of rules for finding similar installation on other systems.

Dependencies

* pefile
* psutil
* ndjson
* python-tlsh
* PyInstaller (to change client.py to client.exe)
* ssdeep
* On Ubuntu:
* sudo apt-get install build-essential libffi-dev python3 python3-dev python3-pip libfuzzy-dev
* pip install ssdeep
Tools requirement

Some tools are required on the host operating system some are Unix standard tools and some additional ones:

* xxd
* curl

For the Windows virtual machine, the following software is required to be installed:

* SDelete
* AsA (AttackSurfaceAnalyzer)

Install

* Install all Python dependencies defined requirements.txt
* Create a shared folder to communicate with VM
* Install a Windows VM
* Install chocolatey on Windows VM
* Complete bin/OnWindows/Varclient.py
* Change bin/OnWindows/client.pyin an executable file with PyInstaller and put in startup folder

* Update etc/allVariables.pyto match your desired configuraiton

In test/some examples of software to install is given, the following specific format is required:

* First, select the name of the packages to install using chocolatey before :, or the name of the file in case of msi or exe file.
* Second, after :there’s the name of the exe to extract and run it (without extension).
* The second part after ,follow the same system with the word installerfirst and after :the type of installer :
* choco
* msiexec
* exe

* Finally, the third part, uninstallerfollow by :and the uninstaller like choco, msiexec or exe

Run and generate the rules

* bin/Generator.pyis the only script to run, don’t forget to update etc/allVariables.py(critical step).

Public YARA rules repository

* factual-rules – Sample rules generated from some very common software.

Overview of factual rules generator
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpVRAHpwS4FpUF5eSom2brvTlya1SWQZZ3yuG5Ru0IcjZvOwZK41QvMbKFH__rUEkFsyMjAUj6dap9AJ2XHlLl4F77Qzd4DSK4Wy1hd4g-idnwq0_b8bWalxKIxCY63vGX6a--EY4fUwbjOwrs7w7n86IAKBnJ4TYDsx7wQ_6Z3fi-oSwd7xzJqTxY/s814/1g.png

Download

___________________________
@hacking_Attack
@Hacking_Video