KitPloit - PenTest Tools!
Heyserial - Programmatically Create Hunting Rules For Deserialization Exploitation With Multiple Keywords, Gadget Chains, Object Types, Encodings, And Rule Types

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh96iyLi-WJuKHxzsUe2ew0LLbVkwXkKoWXWpcZ0mRX6YUdBo7uzVq0lxIihLA9awRncMpRG3Pz54Becx4VdqrQLs5gSE0N0eXTFeY3SvASRKmLUj29WSoNXUB9oiczpcdLkgyqQmTBmYpjyy432kXPM87zwjhA7s0hfpa0u5aqBPpNFNzCyggYVI4E/w640-h370/deserialization1.png Programmatically create hunting rules for deserialization exploitation with multiple

* keywords (e.g. cmd.exe)
* gadget chains (e.g. CommonsCollection)
* object types (e.g. ViewState, Java, Python Pickle, PHP)
* encodings (e.g. Base64, raw)
* rule types (e.g. Snort, Yara) DisclaimerRules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.

Please test thoroughly before deploying to any production systems.

The Yara rules are primarily intended for scanning web server logs. Some of the "object prefixes" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.) UsageHelp: python3 heyserial.py -hExamples: python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode' python3 heyserial.py -k Process.Start -t NETViewState -e base64 "base64+utf16le" Utilsutils/checkyoself.pyThis is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.

Usage: python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcapExamples: python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_missesutils/generate_payloads.ps1YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.

* Source: https://github.com/pwntester/ysoserial.net
* License: ysoserial.net_LICENSE.txt utils/generate_payloads.shYSoSerial payload generation. Run on Linux from the ./utils directory.

* Source: https://github.com/frohoff/ysoserial
* License: ysoserial_LICENSE.txt utils/install_snort.shInstalling Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.

Use at your own risk in a VM that you have snapshotted recently. utils/server.pySimple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.

Handy for generating test PCAPs. LicenseCopyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at: [package root]/LICENSE.txt Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. ContributingCheck out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial! Prior Work/Related ResourcesTools

* Deserialization-Cheat-Sheet – @GrrrDog
* Ysoserial - @frohoff
* MarshalSec - @frohoff
* Ysoserial (forked) - @wh1t3p1g
* Ysoserial.NET and v2 branch - @pwntester
* ViewGen – 0xacb
* Rogue-JNDI - @veracode-research

Vulnerabilities

* Log4J (CVE-2021-44228)
* Exchange (CVE-2021-42321)
* Zoho ManageEngine (CVE-2020-10189)
* Jira (CVE-2020-36239)
* Telerik (CVE-2019-18935)
* C1 CMS (CVE-2019-18211)
* Jenkins (CVE-2016-9299)
* What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnera[...]

___________________________
@hacking_Attack
@Hacking_Video

bility. – @breenmachine, FoxGloveSecurity (2015)

Talks and Write-Ups

* PSA: Log4Shell and the current state of JNDI injection - Moritz Bechler (2021)
* This is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits – Chris Glyer, Dan Perez, Sarah Jones, Steve Miller (2020)
* Deep Dive into .NET ViewState deserialization and its exploitation – Swapneil Dash (2019)
* Exploiting Deserialization in ASP.NET via ViewState – Soroush Dalili (2019)
* Use of Deserialization in .NET Framework Methods and Classes – Soroush Dalili(2018)
* Friday the 13th, JSON Attacks – Alvaro Muños and Oleksandr Mirosh (2017)
* Exploiting .NET Managed DCOM – James Forshaw, Project Zero (2017)
* Java Unmarshaller Security – Moritz Bechler (2017)
* Deserialize My Shorts – Chris Frohoff (2016)
* Pwning Your Java Messaging with Deserialization Vulnerabilities – Matthias Kaiser (2016)
* Journey from JNDI/LDAP Manipulation to Remote Code Execution Dream Land – Alvaro Muños and Oleksandr Mirosh (2016)
* Marshalling Pickles – Chris Frohoff and Gabriel Lawrence (2015)
* Are you my Type? Breaking .NET Through Serialization – James Forshaw (2012)
* A Spirited Peek into ViewState – Mike Shema (2011)
Author: Alyssa Rahman @ramen0x3f

Created: 2021-10-27

Last Updated: 2021-12-02

Blog: https://www.mandiant.com/resources/hunting-deserialization-exploits

For more details on this tool and the research process behind it, check out our blog! Download Heyserial

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
3 Predictors of Cybersecurity Startup Success

Before investing, venture capitalists should consider a trio of business characteristics that seem to correlate with commercial success, based on meetings with over 2,000 cybersecurity startups.

Dark Reading: Attacks/Breaches
Black Hat Asia: Firmware Supply-Chain Woes Plague Device Security

The supply chain for firmware development is vast, convoluted, and growing out of control: patching security vulnerabilities can take up to two years. For cybercriminals, it's a veritable playground.

Dark Reading: Attacks/Breaches
Transforming SQL Queries Bypasses WAF Security

A team of university researchers finds a machine learning-based approach to generating HTTP requests that slip past Web application firewalls.

Hacking on Medium
Proving Grounds — DC-1

https://cdn-images-1.medium.com/max/600/1*MbbAxfr88Xl0gsBizvePdg.png
DC-1 (VulnHub: https://www.vulnhub.com/entry/dc-1,292/) is an easy box in Proving Grounds: Play. Bottom line up front — this box should be…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to set ip address to a specific location in my own city?

I want to set my device's ip address location to a specific neighborhood. So whenever I log in on social media it shows activity being done from that location. I have the GPS location for the area I want to show my IP address of if that helps.

anyone get any idea how to do it?

submitted by /u/Physical-Mushroom-76
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

[Bug Bounty] Sql Injection and Bypass Sql Login
https://medium.com/@ryuukhagetsu/bug-bounty-sql-injection-and-bypass-sql-login-8759b222e70c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi Semuanya bagaimana kabarnya ?, semoga dalam keadaan baik baik saja. Kali ini saya ingin membagikan tulisan saya mengenai bug bounty dan…Continue reading on Medium » (https://medium.com/@ryuukhagetsu/bug-bounty-sql-injection-and-bypass-sql-login-8759b222e70c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

[Bug Bounty] Sql Injection and Bypass Sql Login

Hi Semuanya bagaimana kabarnya ?, semoga dalam keadaan baik baik saja. Kali ini saya ingin membagikan tulisan saya mengenai bug bounty dan…Continue reading on Medium »
Read more...

Hacking on Medium
Best Hackers Online — Hire a Crypto Hacker

https://cdn-images-1.medium.com/max/880/1*RbEJcLgHib3G-fVMSHegGw.jpeg
Best Hackers Online — Hire A Crypto Hacker To Recover Stolen Funds

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
CVE-2022-30525, Zyxel critical RCE vulnerability : Zyxel fixed Firewall Unauthenticated Remote Command Injection.

https://external-preview.redd.it/08j3lnTCIqlRcyrKj_HOp6N-XegG1xIuurXwNaF7v7U.jpg?width=640&crop=smart&auto=webp&s=a93b8a0dae40ce2c8b7fefeda7584ed149da1865 submitted by /u/Late_Ice_9288
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Getting started

What’s a good way to get into hacking? Just curious

submitted by /u/Minimum-Sir-2747
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
BPFdoor: Stealthy Linux malware bypasses firewalls for remote access

BPFdoor: Stealthy Linux malware bypasses firewalls for remote accessPost Views: 6
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.
Reading Time: 4 Minutes
A recently discovered backdoor malware called BPFdoor has been stealthily targeting Linux and Solaris systems without being noticed for more than five years.
BPFdoor is a Linux/Unix backdoor that allows threat actors to remotely connect to a Linux shell to gain complete access to a compromised device.

The malware does not need to open ports, it can’t be stopped by firewalls, and can respond to commands from any IP address on the web, making it the ideal tool for corporate espionage and persistent attacks. Parsing ‘magic’ packetsBPFdoor is a passive backdoor, meaning that it can listen on one or more ports for incoming packets from one or more hosts, that attackers can use to send commands remotely to the compromised network.

The malware uses a Berkeley Packet Filter (the BPF in the backdoor’s name) sniffer, that works at the network layer interface being able to see all network traffic and send send packets to any destination.

Because of its positioning at such a low level, BPF does not abide by any firewall rules.

It has versions for Linux and Solaris SPARC systems but it could be ported to BSD as well, BleepingComputer learned from Craig Rowland, the founder of Sandfly Security, a company that offers an agentless solution to protect Linux systems.

Security researcher Kevin Beaumont, who published a blog post on BPFdoor, told BleepingComputer that the operators use a “magic” password to control the implant’s actions.

BPFdoor parses only ICMP, UDP, and TCP packets, checking them for a specific data value, and also a password for the latter two types of packets.

What makes BPFDoor stand out is that it can can monitor any port for the magic packet, even if those ports are used by other legitimate services, such as webservers, FTP, or SSH.
See Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png If the TCP and UDP packets have the right “magic” data and a correct password, the backdoor springs into action executing a supported command, such as setting up a bind or reverse shell.
https://www.bleepstatic.com/images/news/u/1100723/Malware/BPFdoor/BPFdoor_firewall-redirect-diagram.jpg
Bypassing the local firewallRowland notes in a comprehensive technical report on BPFdoor that the malware employs some clever anti-evasion tactics:

* Resides in system memory and deploys anti-forensics action (wipes the process environment, albeit unsuccessfully as it leaves it empty)
* Loads a Berkeley Packet Filter (BPF) sniffer allowing it to work in fro[...]

___________________________
@hacking_Attack
@Hacking_Video

nt of any locally running firewalls to see packets
* Modifies ‘iptables’ rules when receiving a relevant packet to allow attacker communication through the local firewall
* Masquerades the binary under a name similar to a common Linux system daemon
* Renames and runs itself as /dev/shm/kdmtmpflush
* Changes the date of the binary (timestomping) to October 30, 2008, before deleting it

Rowland believes an explanation for timestomping, as an anti-forensics technique in this case, could be that the attacker may try to protect the binary in case its deletion fails.

The researcher says that the purpose of the fake date could be to hide the malware from a search looking for new files on the system.

Changing firewall rules is of particular importance because it allows attackers to communicate with the backdoor via traffic that firewalls can’t flag as suspicious.

Rowland explains that when the infected host receives a special BPFdoor packet, the malware “will spawn a new instance and change the local iptables rules to do a redirect from the requesting host to the shell port.”
“For instance, the implant can redirect all traffic from the attacker using TCP port 443 (encrypted web) to the shell. Externally, the traffic will look like TLS/SSL traffic but in fact the attacker is interacting with a remote root shell on the system” – Craig Rowland, Sandfly Security
To clarify even more, Rowland says that for a local shell, the malware modifies the ‘iptables’ configuration to redirect all traffic coming from the attacker through a legitimate port to a port range defined in the malware.

This way, the attacker can choose a connection over any port because it would be routed to the shell behind the firewall.
https://www.bleepstatic.com/images/news/u/1100723/Malware/BPFdoor/BPFdoor_redirect_CraigRowland.jpg
Commands and detectionAnother technical analysis on BPFdoor from Tristan Pourcelot of threat intelligence and incident response company ExaTrack, notes that the malware comes with several hardcoded names that match command strings inside relevant packets:

* justtryit, justrobot, and justforfun to establish a bind shell on ports 42391 through 42491
* socket or sockettcp to set up a reverse shell to an IP address present in the packet

Part of BPFdoor’s techniques to evade detection is to rename the binary to appear as a normal Linux daemon using the choices below: /sbin/udevd -d/sbin/mingetty /dev/tty7/usr/sbin/console-kit-daemon --no-daemonhald-addon-acpi: listening on acpi kernel interface /proc/acpi/event
dbus-daemon --system
hald-runner
pickup -l -t fifo -u avahi-daemon: chroot helper/sbin/auditd -n
/usr/lib/systemd/systemd-journald Pourcelot says that the threat actor updated BPFdoor regularly, improving each release with different names for commands, processes, or files.

For instance, newer variants of the implant switched from using command keywords to MD5 hashes, likely in an attempt to avoid trivial detection.

There are at least 21 versions of BPFdoor currently detected on the Virus Total scanning platform, the earliest ones submitted in August 2018.

While the detection rate for this implant improved, especially after Beaumont, Rowland, and Pourcelot published their findings, the malware went virtually invisible for a long time.

One BPFdoor variant for Solaris from 2019 went undetected until at least this May 7. Today, 28 antivirus engines flag it as malicious.
https://www.bleepstatic.com/images/news/u/1100723/Malware/BPFdoor/BPFdoorSolarisDetection.jpg
___________________________
@hacking_Attack
@Hacking_Video