Consider tuning with the --checks and --sleep switches to help (especially in 'watch' mode). In some cases, it may be difficult to 'catch' a particular assembly load due to speed of execution (such as execute-assembly and sacrificial processes). Architecture ('bitness') and .NET versions matter (e.g. 4+) for interacting with remote processes with the .NET CLRMD libraries. For maximum inspection/coverage, build and run this program for x86 and x64 use cases. Process sweep mode will attempt to connect to all running processes regardless of 'bitness'. It will otherwise fail accordingly for architecture mismatches. Tested on Windows 10 (https://www.kitploit.com/search/label/Windows%2010) Pro 2H1H and Windows Server 2016 Standard 1607. It may run on other versions with the relevant .NET Framework. Visual Studio project source with NuGet packages, PowerShell script, and release binaries are included with this project. Notice.md includes project disclaimers and license information. Run at your own risk (and don't mind my horrible code ;) )! Usage : Required | Select analysis mode. Options include sweep, process, and watch. --hunt=<.> : Optional | Select the hunt scan type to find interesting CLR modules. Specify all (default), memory-only, unusual-dir, sig-status, imposter-file, or list. --export=<.> : Optional, Experimental | Specify a file path to export loaded CLR modules for in-memory hunt scans and imposter-file hunt scans (e.g. --hunt=memory-only/imposter-file/all). --pid=<.> : Optional | Specify a targeted process by PID. Must be used with --mode=process parameter/value. --checks=<.> : Optional | Specify a value for scan cycles. This may help reduce race condition misses during scans but could also repeat result output. Default value is 1. --sleep=<.> : Optional | Specify a value for sleep seconds. This may help reduce race condition misses during scans by delaying the check cycle. Default value is 0 seconds. --debug : Optional | Display exception information (e.g. process connect errors). --nobanner : Optional | Suppress the display banner. Useful for executing with the PowerShell script or for use cases that leverage automation. --suppress : Optional | Do not scan the RogueAssemblyHunter process during --mode=sweep or --mode=watch. --help : Optional | Show this help. This will override any other cmdline parameters and exit the application. *This is the default without parameters. [*] Modes (--mode=) - sweep : Scan/iterate through all processes (Note: Only processes of like architecture/'bitness' will be successfully scanned. Compile to run for x86/x64/etc.). - process : Scan a single process. Use with --pid=. - watch : Scan new processes when created. Adjust scan attributes with --checks and --sleep. (Note: This is experimental. Race conditions are likely.) [*] Hunts (--hunt=) - all : Default value. Analyze with all hunt options (Except 'list'). - memory-only : Memory hunt. Analyze CLR modules that are not backed by disk. - unusual-dir : Unusual directory hunt. Analyze CLR modules loaded outside of 'normal' directories. Edit '_huntUnusualDirectoryFilter' to customize. - sig-status : File signature hunt. Analyze CLR modules with anomalous signature status (e.g. unsigned). Note: This is experimental. False positives are possible. Edit '_huntSigExclusionsFilter' to customize. - imposter-file : Unexpected CLR module hunt. Analyze CLR module with suspicious disk file backing. Experimental. - list : Iterate through all CLR modules and list accordingly. [*] Example Usage - Example 1 : Scan processes and run through all hunts for accessible 64-bit processes (except 'list') -

RogueAssemblyHunter_x64.exe --mode=sweep - Example 2 : Scan processes, list all CLR modules in accessible 32-bit managed processes, and show error information - RogueAssemblyHunter_x86.exe --mode=sweep --hunt=list --debug - Example 3 : Watch for new processes, scan all CLR modules (if managed and 64-bit), do not scan the RogueAssemblyHunter process, and do 2 checks with a 3 second delay between - RogueAssemblyHunter_x64.exe --mode=watch --suppress --checks=2 --sleep=3 - Example 4 : Scan single process by PID, list in-memory only CLR module findings, and export CLR modules to specified path - RogueAssemblyHunter_x86.exe --mode=process --pid=4650 --hunt=memory-only --export=c:\evilassemblies\ - Example 5 : Scan processes, list in-memory only CLR module findings for accessible 64-bit processes, do no scan RogueAssemblyHunter process, and do not show title banner - RogueAssemblyHunter_x64.exe --mode=sweep --hunt=memory-only --suppress --nobanner ">[*] Parameters: --mode=<.> : Required | Select analysis mode. Options include sweep, process, and watch. --hunt=<.> : Optional | Select the hunt scan type to find interesting CLR modules. Specify all (default), memory-only, unusual-dir, sig-status, imposter-file, or list. --export=<.> : Optional, Experimental | Specify a file path to export loaded CLR modules for in-memory hunt scans and imposter-file hunt scans (e.g. --hunt=memory-only/imposter-file/all). --pid=<.> : Optional | Specify a targeted process by PID. Must be used with --mode=process parameter/value. --checks=<.> : Optional | Specify a value for scan cycles. This may help reduce race condition misses during scans but could also repeat result output. Default value is 1. --sleep=<.> : Optional | Specify a value for sleep seconds. This may help reduce race condition misses during scans by delaying the check cycle. Default value is 0 seconds. --debug : Optional | Display exception information (e.g. process connect errors). --nobanner : Optional | Suppress the display banner. Useful for executing with the PowerShell script or for use cases that leverage automation. --suppress : Optional | Do not scan the RogueAssemblyHunter process during --mode=sweep or --mode=watch. --help : Optional | Show this help. This will override any other cmdline parameters and exit the application. *This is the default without parameters. [*] Modes (--mode=) - sweep : Scan/iterate through all processes (Note: Only processes of like architecture/'bitness' will be successfully scanned. Compile to run for x86/x64/etc.). - process : Scan a single process. Use with --pid=. - watch : Scan new processes when created. Adjust scan attributes with --checks and --sleep. (Note: This is experimental. Race conditions are likely.) [*] Hunts (--hunt=) - all : Default value. Analyze with all hunt options (Except 'list'). - memory-only : Memory hunt. Analyze CLR modules that are not backed by disk. - unusual-dir : Unusual directory hunt. Analyze CLR modules loaded outside of 'normal' directories. Edit '_huntUnusualDirectoryFilter' to customize. - sig-status : File signature hunt. Analyze CLR modules with anomalous signature status (e.g. unsigned). Note: This is experimental. False positives are possible. Edit '_huntSigExclusionsFilter' to customize. - imposter-file : Unexpected CLR module hunt. Analyze CLR module with suspicious disk file backing. Experimental. - list : Iterate through all CLR modules and list accordingly. [*] Example Usage - Example 1 : Scan processes and run through all hunts

for accessible 64-bit processes (except 'list') - RogueAssemblyHunter_x64.exe --mode=sweep - Example 2 : Scan processes, list all CLR modules in accessible 32-bit managed processes, and show error information - RogueAssemblyHunter_x86.exe --mode=sweep --hunt=list --debug - Example 3 : Watch for new processes, scan all CLR modules (if managed and 64-bit), do not scan the RogueAssemblyHunter process, and do 2 checks with a 3 second delay between - RogueAssemblyHunter_x64.exe --mode=watch --suppress --checks=2 --sleep=3 - Example 4 : Scan single process by PID, list in-memory only CLR module findings, and export CLR modules to specified path - RogueAssemblyHunter_x86.exe --mode=process --pid=4650 --hunt=memory-only --export=c:\evilassemblies\ - Example 5 : Scan processes, list in-memory only CLR module findings for accessible 64-bit processes, do no scan RogueAssemblyHunter process, and do not show title banner - RogueAssemblyHunter_x64.exe --mode=sweep --hunt=memory-only --suppress --nobanner Release Files: Invoke-RogueAssemblyHunter & Compiled Binaries For convinience, a PowerShell script along with two compiled binaries (RogueAssemblyHunter_x64.exe and RogueAssemblyHunter_x86.exe) have been included in the \Release folder. Feel free to modify to fit your use cases (e.g. deployment, embedding, checks, sleep, etc.). Example Usage: Run Invoke-RogueAssemblyHunter in sweep mode and check for all hunt options cd c:\path\to\RogueAssemblyHunter import-module .\Invoke-RogueAssemblyHunter.ps1 Invoke-RogueAssemblyHunter Run Invoke-RogueAssemblyHunter in watch mode and check for all hunt options cd c:\path\to\RogueAssemblyHunter import-module .\Invoke-RogueAssemblyHunter.ps1 Invoke-RogueAssemblyHunter -ScanMode watch SHA256 Hashes: e804711a8b6469f1b13b388de47dfa6dde1c85279d365db7b6e19e1644990fa6 Invoke-RogueAssemblyHunter.ps1 cc985d918e566671aa209142abc55bd798ca6c1a18730b785ac8c18d489736c3 RogueAssemblyHunter_x64.exe ae3aead43871e263cd8465d5356c4daaae0635714321f872c931ec825008287a RogueAssemblyHunter_x86.exe Roadmap Managed dump (.dmp) file analysis Improve sig-status check(s) Output improvements (e.g. json) Stability and bug fixes Credits, Inspiration, & Resources Hunting For In-Memory .NET Attacks (https://www.elastic.co/blog/hunting-memory-net-attacks) | by Joe Desimone (@dez_ (https://mobile.twitter.com/dez_)) Get-ClrReflection (https://gist.github.com/dezhub/2875fa6dc78083cedeab10abc551cb58) | by Joe Desimone (@dez_ (https://mobile.twitter.com/dez_)) Get-InjectedThread (https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2) | by Jared Atkinson (@jaredcatkinson (https://mobile.twitter.com/jaredcatkinson)) pe-sieve (https://github.com/hasherezade/pe-sieve) | by hasherezade (@hasherezade (https://mobile.twitter.com/hasherezade)) CLR MD — Analyzing Live Process (https://harshaprojects.wordpress.com/2015/12/29/clr-md-analyzing-live-process/) | by Harsha How to enumerate Modules in each App Domain using ClrMD (https://sukesh.me/2020/06/12/how-to-enumerate-modules-in-each-app-domain-using-clrmd/) | by Sukesh Ashok Kumar WMIProcessWatcher (https://github.com/malcomvetter/WMIProcessWatcher/) | by Tim MalcomVetter (@malcomvetter (https://twitter.com/malcomvetter))

Download RogueAssemblyHunter (https://github.com/bohops/RogueAssemblyHunter)

hacking: security in practice
Is someone hacking my internet?

If this is the wrong place to post this please point me where I should post this.

Tl;dr what kind of problems can I expect from someone using my mailing address for their internet carrier? One thing I could think of is, if they missed a payment on their internet, it might affect my credit score.

A stranger is using my mailing address. I know because I kept getting their mail from my internet provider. I live in an apartment complex. The address is correct except it has their name and no apartment number.

At first I figured it was a new neighbor, new to renting, who didn’t know how to fill-in their apartment number after the street address. I started getting their other mail and frankly it was a bit annoying. So I called my internet provider, X, and explained the situation. X took the blame and corrected it and I figured it was settled.

Recently I received a package with the same name as before, right address, again no apartment number. This time it was from a competitor of the first internet provider. I put it back near the mailboxes but where I could see it.

Just now, someone picked it up and they drove off. So now I don’t think it is a neighbor. Maybe someone is trying to hide their address?

submitted by /u/MoltingGold
[link] [comments]

hacking: security in practice
Should I worry if someone gets my IP through Omegle?

First of all, sorry for the dumb question, I am terrible with software stuff.

So I rarely go on Omegle just to have some laughs with my friends and sometimes certain annoying people say my location but they don’t seem to be very intimidating like they know what they’re doing. I am aware that Omegle is not the safest place, which is why I rarely go there, but my main concern here is if someone can do anything dangerous with my IP.

Thank you in advance and sorry if this is the wrong sub, if so, suggest me where to post plz

submitted by /u/cabron555
[link] [comments]

hacking: security in practice
Difficulty running Turbo Intruder from command line. Could anyone lend insight on its arguments?

I'm trying to run Turbo Intruder in headless mode and I am having difficulties with what it exactly wants.

From his Blog post:

Command line usage

From time to time, you might find you want to run Turbo Intruder from a server. To support headless use it can be launched directly from the jar, without Burp.

You'll probably find it easiest to develop your script inside Burp as usual, then save and launch it on the server:

java -jar turbo.jar <scriptfile<baserequestfile<endpoint<baseinput

Example: java -jar turbo.jar resources/examples/basic.py resources/examples/request.txt https://example.net:443 foo

The command line support is pretty basic - if you try to use this exclusively you'll probably have a bad time. Also, it doesn't support automatic interesting response detection as this relies on various Burp methods.

Here is where I am throwing the exception in the source code.

My script is perfectly sound within Burp Suite, his example is just networkly advanced, too lazy, or I'm too lazy.

I'm assuming my endpoint is not the entire url: https://example.net/worker.php?varOne=1&varTwo=%s

but rather:

/worker.php?varOne=1&varTwo=%s

So my command would look somewhat like this:

java -jar turbo-intruder-all.jar myScript.py substitutes.txt https://example.net/worker.php?varOne=1&varTwo=%s unusedBaseInputVariable

I'm not using the baseInputvariable in the script, but it's not throwing an error regardless. Probably should pass it Nonebut whatever.

The error I'm getting:

User Python error, check extender for full details: The request has payloads specified, but no %s injection markers

Also.. How does this even function without the rest of the POST request (header, with no body). How would I even implement a cookie without the header?

submitted by /u/MintChocolateEnema
[link] [comments]

0 != 0 a misconfiguration, leading to missing funds

TLDR; I discovered a misconfiguration for a collateral with weak oracle on lending & borrowing platform, combine with a nuance in…Continue reading on Medium »
Read more...

0 != 0 a misconfiguration, leading to missing funds
https://medium.com/@nnez/0-0-a-misconfiguration-leading-to-missing-funds-51d4b9e5f96a?source=rss------bug_bounty-5

TLDR; I discovered a misconfiguration for a collateral with weak oracle on lending & borrowing platform, combine with a nuance in…Continue reading on Medium » (https://medium.com/@nnez/0-0-a-misconfiguration-leading-to-missing-funds-51d4b9e5f96a?source=rss------bug_bounty-5)

Hacking on Medium
How to protect yourself from phishing attacks

https://cdn-images-1.medium.com/max/1024/1*Sbs2Mn4rRX7bBMVKWqCxiQ.png
In this tutorial you will learn how to protect your self against phishing attacks as a hacker. That means first, you have to know how…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
“駭客盜幣”-WSJ Reading

https://cdn-images-1.medium.com/max/1174/1*zpIES4_SENff1NzyyVwL3A.png
2022.05.14 一團旁聽

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Learning how to hack non-independently

Okay, I’ve seen plenty of resources on hackerone, tryhackme, hackthebox, and I’ve bought a book on web application hacking and I’ve watched “bug bounty hunter’s methodology” and I’ve even found two account takeover vulnerabilities in different websites, one of which was owned by a fairly large company!

I certainly haven’t used all of the listed resources to their full extent, but what I’ve established from the time I’ve spent is that learning to hack, or more specifically bug bounty hunting, is incredibly difficult to do independently. I understand that’s how it is for nearly everyone in this field, but I’m still wondering if there’s somewhere I can go that’s got at least slightly more support than just sitting at my laptop alone?

submitted by /u/The-Lozenger
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Malicious Websites

Hello, I just had someone message me via Facebook Messenger and it looked something like this:

Look who just died, I think you know him? https://************.com?m6

Piqing my suspicion and curiosity, how can I check if a website is malicious or what are some telltale signs? Any website that has that kind of capability?

Any suggestions will help thank you.

submitted by /u/traumatix
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
You know what would be polite? A malware coded in Rust

I mean seriously, the time and effort and passion he put into creating such a beautiful piece of software, it is almost like a cute teddy bear holding a gun to rob you.

submitted by /u/IsoSpandy
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How does a Ransomware actually work?

Ransomware identifies the drives on an infected system and begins to encrypt the files.Continue reading on Medium »
Read more...

How does a Ransomware actually work?
https://0xshakhawat.medium.com/how-does-a-ransomware-actually-work-5db49035b473?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video