Dark Reading: Attacks/Breaches
Cloud Firm Appian Awarded $2B in Trade Secret Cyber-Theft Lawsuit

Cloud competitor found liable for breaking into Appian back-end systems to steal company secrets.

Dark Reading: Attacks/Breaches
Egnyte Enhances Program for Managed Service Providers

Enhancements to the program include unique packages, faster response time for invoicing, and dedicated training for new solutions.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
StackHawk Raises $20.7 Million in Series B Funding for Developer-First Application and API Security Testing

Round co-led by Sapphire Ventures and Costanoa Ventures to accelerate product leadership and market growth.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
La UE propone nuevas reglas para que las empresas tecnológicas combatan el abuso sexual infantil…

https://cdn-images-1.medium.com/max/1588/0*ryfxpC5eLngKrun0
PUBLICADO EN 12 MAYO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Is The Cost Of Predictive Cyber Security Worth The Investment?

https://cdn-images-1.medium.com/max/753/0*EEMMmGYZyAZ5X8wM
Cybersecurity Events Becoming More Predictable ?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Heyserial - Programmatically Create Hunting Rules For Deserialization Exploitation With Multiple Keywords, Gadget Chains, Object Types, Encodings, And Rule Types
http://www.kitploit.com/2022/05/heyserial-programmatically-create.html

___________________________
@hacking_Attack
@Hacking_Video

Programmatically create hunting rules for deserialization exploitation (https://www.kitploit.com/search/label/Exploitation) with multiple keywords (e.g. cmd.exe) gadget chains (e.g. CommonsCollection) object types (e.g. ViewState, Java, Python Pickle, PHP) encodings (e.g. Base64, raw) rule types (e.g. Snort, Yara)
Disclaimer Rules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes. Please test thoroughly before deploying to any production systems. The Yara rules are primarily intended for scanning web server logs. Some of the "object prefixes" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.) Usage Help: python3 heyserial.py -h Examples: python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode' python3 heyserial.py -k Process.Start -t NETViewState -e base64 "base64+utf16le" Utils utils/checkyoself.py This is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files. Usage: python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcap Examples: python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_misses utils/generate_payloads.ps1 YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory. Source: https://github.com/pwntester/ysoserial.net License: ysoserial.net_LICENSE.txt utils/generate_payloads.sh YSoSerial payload generation. Run on Linux from the ./utils directory. Source: https://github.com/frohoff/ysoserial License: ysoserial_LICENSE.txt utils/install_snort.sh Installing Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here. Use at your own risk in a VM that you have snapshotted recently. utils/server.py Simple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests. Handy for generating test PCAPs. License Copyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at: [package root]/LICENSE.txt Unless required by applicable law or agreed to in writing, software distributed (https://www.kitploit.com/search/label/Distributed) under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. Contributing Check out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial! Prior Work/Related Resources Tools Deserialization-Cheat-Sheet (https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet) – @GrrrDog Ysoserial (https://github.com/frohoff/ysoserial) - @frohoff MarshalSec (https://github.com/frohoff/marshalsec) - @frohoff Ysoserial (forked) (https://github.com/wh1t3p1g/ysoserial) - @wh1t3p1g Ysoserial.NET (https://github.com/pwntester/ysoserial.net) and v2 branch (https://github.com/pwntester/ysoserial.net/tree/v2) - @pwntester ViewGen (https://github.com/0xacb/viewgen) – 0xacb Rogue-JNDI (https://github.com/veracode-research/rogue-jndi) - @veracode-research Vulnerabilities Log4J (CVE-2021-44228 (https://www.lunasec.io/docs/blog/log4j-zero-day/)) Exchange (CVE-2021-42321 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42321)) Zoho ManageEngine (CVE-2020-10189 (https://nvd.nist.gov/vuln/detail/CVE-2020-10189)) Jira (CVE-2020-36239 (https://oxalis.io/atlassian-jira-data-centers-critical-vulnerability-what-you-need-to-know/)) Telerik (CVE-2019-18935

___________________________
@hacking_Attack
@Hacking_Video

(https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui)) C1 CMS (CVE-2019-18211 (https://medium.com/@frycos/yet-another-net-deserialization-35f6ce048df7)) Jenkins (CVE-2016-9299 (https://nvd.nist.gov/vuln/detail/CVE-2016-9299)) What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability. (https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/) – @breenmachine, FoxGloveSecurity (2015) Talks and Write-Ups PSA: Log4Shell and the current state of JNDI injection (https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/) - Moritz Bechler (2021) This is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits (https://www.mandiant.com/resources/apt41-initiates-global-intrusion-campaign-using-multiple-exploits) – Chris Glyer, Dan Perez, Sarah Jones, Steve Miller (2020) Deep Dive into .NET ViewState deserialization and its exploitation (https://swapneildash.medium.com/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817) – Swapneil Dash (2019) Exploiting (https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)Deserialization (https://www.kitploit.com/search/label/Deserialization) in ASP.NET via ViewState – Soroush Dalili (2019) Use of Deserialization in .NET Framework Methods and Classes (https://research.nccgroup.com/wp-content/uploads/2020/07/whitepaper-new.pdf) – Soroush Dalili(2018) Friday the 13th, JSON Attacks (https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf) – Alvaro Muños and Oleksandr Mirosh (2017) Exploiting .NET Managed DCOM (https://googleprojectzero.blogspot.com/2017/04/exploiting-net-managed-dcom.html) – James Forshaw, Project Zero (2017) Java Unmarshaller Security (https://github.com/frohoff/marshalsec/blob/master/marshalsec.pdf) – Moritz Bechler (2017) Deserialize My Shorts (https://www.slideshare.net/frohoff1/deserialize-my-shorts-or-how-i-learned-to-start-worrying-and-hate-java-object-deserialization) – Chris Frohoff (2016) Pwning Your Java Messaging with Deserialization Vulnerabilities (https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf) – Matthias Kaiser (2016) Journey from JNDI/LDAP (https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf)Manipulation (https://www.kitploit.com/search/label/Manipulation) to Remote Code Execution (https://www.kitploit.com/search/label/Remote%20Code%20Execution) Dream Land – Alvaro Muños and Oleksandr Mirosh (2016) Marshalling Pickles (https://www.youtube.com/watch?v=KSA7vUkXGSg) – Chris Frohoff and Gabriel Lawrence (2015) Are you my Type? Breaking .NET Through Serialization (https://github.com/VulnerableGhost/.Net-Sterilized--Deserialization-Exploitation/blob/master/BH_US_12_Forshaw_Are_You_My_Type_WP.pdf) – James Forshaw (2012) A Spirited Peek into ViewState (https://deadliestwebattacks.com/2011/05/13/a-spirited-peek-into-viewstate-part-i/) – Mike Shema (2011)
Author: Alyssa Rahman @ramen0x3fCreated: 2021-10-27Last Updated: 2021-12-02Blog: https://www.mandiant.com/resources/hunting-deserialization-exploitsFor more details on this tool and the research process behind it, check out our blog (https://www.mandiant.com/resources/hunting-deserialization-exploits)!

Download Heyserial (https://github.com/mandiant/heyserial)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Any software that will do a deep analysis of redacted PDF to see if there is any recoverable information?

I received a redacted document but would like to check if the redaction program used (unknown) still left behind any metadata or any other data buried somewhere in the PDF file. What software will help me accomplish this?

submitted by /u/aamfs94
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Inbuilt Wifi for Hacking

I am total beginner in computer world.. But, Ihave tried fern-cracker once. I bought a 722n V2 adapter for enabling me monitor mode. But, I recenly found out that my brothers laptop (Legion 5 5600h) has an intel built in wifi card which, as i checked, has support for monitor mode. Will it be as capable as 722n for hacking purpose? What are its limitations and what is it poor/ strong at in comparison to 722n?

​

Not of concern to question: I bought a L5p too.. It will arrive to me in 25 days or so. I dont know now, if it has intel or mediatek wifi.. I hope I get lucky with an intel card too.. Wish me Luck.

submitted by /u/glitchystar_717
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Looking for memory forensics tutorials.

I am looking learn how analyze malware that’s running in memory and was wondering if there are any recommendations for good tutorials before I just hit YouTube/google

submitted by /u/sgtwtf22
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Heyserial - Programmatically Create Hunting Rules For Deserialization Exploitation With Multiple Keywords, Gadget Chains, Object Types, Encodings, And Rule Types

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh96iyLi-WJuKHxzsUe2ew0LLbVkwXkKoWXWpcZ0mRX6YUdBo7uzVq0lxIihLA9awRncMpRG3Pz54Becx4VdqrQLs5gSE0N0eXTFeY3SvASRKmLUj29WSoNXUB9oiczpcdLkgyqQmTBmYpjyy432kXPM87zwjhA7s0hfpa0u5aqBPpNFNzCyggYVI4E/w640-h370/deserialization1.png Programmatically create hunting rules for deserialization exploitation with multiple

* keywords (e.g. cmd.exe)
* gadget chains (e.g. CommonsCollection)
* object types (e.g. ViewState, Java, Python Pickle, PHP)
* encodings (e.g. Base64, raw)
* rule types (e.g. Snort, Yara) DisclaimerRules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.

Please test thoroughly before deploying to any production systems.

The Yara rules are primarily intended for scanning web server logs. Some of the "object prefixes" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.) UsageHelp: python3 heyserial.py -hExamples: python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode' python3 heyserial.py -k Process.Start -t NETViewState -e base64 "base64+utf16le" Utilsutils/checkyoself.pyThis is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.

Usage: python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcapExamples: python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_missesutils/generate_payloads.ps1YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.

* Source: https://github.com/pwntester/ysoserial.net
* License: ysoserial.net_LICENSE.txt utils/generate_payloads.shYSoSerial payload generation. Run on Linux from the ./utils directory.

* Source: https://github.com/frohoff/ysoserial
* License: ysoserial_LICENSE.txt utils/install_snort.shInstalling Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.

Use at your own risk in a VM that you have snapshotted recently. utils/server.pySimple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.

Handy for generating test PCAPs. LicenseCopyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at: [package root]/LICENSE.txt Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. ContributingCheck out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial! Prior Work/Related ResourcesTools

* Deserialization-Cheat-Sheet – @GrrrDog
* Ysoserial - @frohoff
* MarshalSec - @frohoff
* Ysoserial (forked) - @wh1t3p1g
* Ysoserial.NET and v2 branch - @pwntester
* ViewGen – 0xacb
* Rogue-JNDI - @veracode-research

Vulnerabilities

* Log4J (CVE-2021-44228)
* Exchange (CVE-2021-42321)
* Zoho ManageEngine (CVE-2020-10189)
* Jira (CVE-2020-36239)
* Telerik (CVE-2019-18935)
* C1 CMS (CVE-2019-18211)
* Jenkins (CVE-2016-9299)
* What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnera[...]

___________________________
@hacking_Attack
@Hacking_Video

bility. – @breenmachine, FoxGloveSecurity (2015)

Talks and Write-Ups

* PSA: Log4Shell and the current state of JNDI injection - Moritz Bechler (2021)
* This is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits – Chris Glyer, Dan Perez, Sarah Jones, Steve Miller (2020)
* Deep Dive into .NET ViewState deserialization and its exploitation – Swapneil Dash (2019)
* Exploiting Deserialization in ASP.NET via ViewState – Soroush Dalili (2019)
* Use of Deserialization in .NET Framework Methods and Classes – Soroush Dalili(2018)
* Friday the 13th, JSON Attacks – Alvaro Muños and Oleksandr Mirosh (2017)
* Exploiting .NET Managed DCOM – James Forshaw, Project Zero (2017)
* Java Unmarshaller Security – Moritz Bechler (2017)
* Deserialize My Shorts – Chris Frohoff (2016)
* Pwning Your Java Messaging with Deserialization Vulnerabilities – Matthias Kaiser (2016)
* Journey from JNDI/LDAP Manipulation to Remote Code Execution Dream Land – Alvaro Muños and Oleksandr Mirosh (2016)
* Marshalling Pickles – Chris Frohoff and Gabriel Lawrence (2015)
* Are you my Type? Breaking .NET Through Serialization – James Forshaw (2012)
* A Spirited Peek into ViewState – Mike Shema (2011)
Author: Alyssa Rahman @ramen0x3f

Created: 2021-10-27

Last Updated: 2021-12-02

Blog: https://www.mandiant.com/resources/hunting-deserialization-exploits

For more details on this tool and the research process behind it, check out our blog! Download Heyserial

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
3 Predictors of Cybersecurity Startup Success

Before investing, venture capitalists should consider a trio of business characteristics that seem to correlate with commercial success, based on meetings with over 2,000 cybersecurity startups.

Dark Reading: Attacks/Breaches
Black Hat Asia: Firmware Supply-Chain Woes Plague Device Security

The supply chain for firmware development is vast, convoluted, and growing out of control: patching security vulnerabilities can take up to two years. For cybercriminals, it's a veritable playground.