Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
What are some tools or methods people use to completely wipe memory.

I’m curious on what programs or methods you guys use or are the best for completely formatting sd cards, usb sticks, hard drives, and operating systems so that no data can be recovered. This includes cookies, any metadata, files, etc. say if law enforcement seized these devices they would not find anything.

submitted by /u/shinygoldcollector
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

What are some tools or methods people use to completely wipe memory.

A subreddit dedicated to hacking and hackers. Constructive collaboration and learning about exploits, industry standards, grey and white hat...

9 viewsedited 19:34

10 views20:07

Hacking Articles Tips Tricks Videos Tutorials

Photo

Black Hat Ethical Hacking
Offensive Security Tool: DeepSleep

Offensive Security Tool: DeepSleepPost Views: 104
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes

Offensive Security Tool: DeepSleep GitHub Link
DeepSleep by thefLink, is a variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC. Evasive techniques take time to produce, find and create. They are the most important steps for any attack scenario. Without evasion, you cannot perform attacks. DescriptionThis tool was created to better understand how to evade memory artifacts using a Gargoyle-like technique on x64. The idea is to set up a ROPChain calling VirtualProtect() ➡ Sleep() ➡ VirtualProtect() to mark my own page as N/A while Sleeping.

Unlike Gargoyle and other Gargoyle-like implementations, this tool relied on ROP and do not queue any APC. DeepSleep itself is implemented as fully PIC, which makes it easier to enumerate which memory pages have to be hidden from scanners.

While the thread is active, a MessageBox pops up and DeepSleep’s page is marked as executable. While Sleeping, the page is marked as N/A.

This effectively bypasses Moneta at the time of writing if DeepSleep is injected and the executing thread’s base address does not point to private commited memory.

It has been verified using the Earlybird injection technique to inject DeepSleep.bin into notepad.exe
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/MonetaFound.png

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/MonetaNotFound.png
See Also: Recon Tool: qsreplace UsageUsing Mingw:
Type make and a wild DeepSleep.bin appears.
Alternatively use the precompiled DeepSleep.bin LimitationsThis was tested on 10.0.19044 N/A Build 19044

The ROPgadgets that the tool relies on might not exist in ntdll.dll in other versions of Windows. It is probably a good idea to make use of smaller and more generic ROPgadgets and to enumerate the gadgets in more dlls than ntdll.dll. DetectionThe callstack to a thread in the DelayExecution state includes unknown/tampered memory regions and additionally includes addresses to VirtualProtect(). Hunt-Sleeping-Beacons detects this.
It may be possible to apply that metric to other C2 using a different technique to wait between callbacks.

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/WeirdTrace.png
See Also: The Difference between Vulnerability Assessment and Pentesting https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/qsreplace-90x90.png Recon Tool: qsreplace1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Arjun-90x90.png Offensive Security Tool: Arjun1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Dorks-collections-list-90x90.png Recon Tool: Dorks collections list1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/malicious-pdf-90x90.png Offensive Security Tool: malicious-pdf2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/scanmycode-90x90.png Static Code Analysis Tool: scanmycode-ce3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/MOSINT-1-90x90.png OSINT Tool: MOSINT4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/findomain-90x90.png Recon Tool: Findomain4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/keethief-90x90.png Offensive Security Tool: KeeThief1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/reconftw-90x90.png Recon Tool: ReconFTW1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/smap-demo-90x90.png Recon Tool: Smap1 month ago
The post Offensive Security Tool: DeepSleep first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking

Offensive Security Tool: DeepSleep | Black Hat Ethical Hacking

DeepSleep is a variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC. Evasive techniques take time to produce. They are the most important steps for any attack scenario.

10 viewsedited 20:07

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Exposed Kubernetes Clusters, Kubelet Ports Can Be Abused in Cyberattacks

Organizations must ensure their kubelets and related APIs aren’t inadvertently exposed or lack proper access control, offering an easy access point for malicious actors.

14 views21:42

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Space Force Expands Cyber Defense Operations

Space Force's Delta 6 cyber-defense group adds squadrons, updates legacy Satellite Control Network.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Space Force Expands Cyber Defense Operations

Space Force's Delta 6 cyber-defense group adds squadrons, updates legacy Satellite Control Network.

13 viewsedited 21:43

Hacking Articles Tips Tricks Videos Tutorials

LEAF - Linux Evidence Acquisition Framework
http://www.kitploit.com/2022/05/leaf-linux-evidence-acquisition.html

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

LEAF - Linux Evidence Acquisition Framework

11 viewsedited 22:48

Hacking Articles Tips Tricks Videos Tutorials

11 views22:48

Hacking Articles Tips Tricks Videos Tutorials

Linux Evidence Acquisition Framework (LEAF) acquires artifacts and evidence from Linux EXT4 systems, accepting user input to customize the functionality of the tool for easier scalability. Offering several modules and parameters as input, LEAF is able to use smart analysis (https://www.kitploit.com/search/label/Analysis) to extract Linux artifacts and output to an ISO image file.
Usage LEAF_master.py [-h] [-i INPUT [INPUT ...]] [-o OUTPUT] [-u USERS [USERS ...]] [-c CATEGORIES [CATEGORIES ...]] [-v]
[-s] [-g [GET_FILE_BY_OWNER [GET_FILE_BY_OWNER ...]]] [-y [YARA [YARA ...]]]
[-yr [YARA_RECURSIVE [YARA_RECURSIVE ...]]] [-yd [YARA_DESTINATIONS [YARA_DESTINATIONS...]]]

LEAF (Linux Evidence Acquisition Framework) - Cartware
____ _________ ___________ __________
/ / / _____/ / ____ / / ______/
/ / / /____ / /___/ / / /____
/ / / _____/ / ____ / / _____/
/ /_____ / /_____ / / / / / /
/_________/ /_________/ /___/ /___/ /___/ v2.0
Process Ubuntu 20.04/Debian file systems for forensic (https://www.kitploit.com/search/label/Forensic) artifacts, extract important data, and export information to an ISO9660 file. Compatible with EXT4 file system and common locations on Ubuntu 20.04 operating system. See help page for more information. Suggested usage: Do not run from LEAF/ directory Parameters optional arguments:

-h, --help show this help message and exit

-i INPUT [INPUT ...], --input INPUT [INPUT ...]
Additional Input locations. Separate multiple input files with spaces
Default: /home/user1/Desktop/LEAF-3/target_locations

-o OUTPUT, --output OUTPUT

Output directory (https://www.kitploit.com/search/label/Directory) location

Default: ./LEAF_output

-u USERS [USERS ...], --users USERS [USERS ...]

Users to include in output, separated by spaces (i.e. -u alice bob root).
Users not present in /etc/passwd will be removed
Default: All non-service users in /etc/passwd
-c CATEGORIES [CATEGORIES ...], --categories CATEGORIES [CATEGORIES ...]< br/> Explicit artifact categories to include during acquisition.
Categories must be separated by space, (i.e. -c network users apache).
Full List of built-in categories includes:
APPLICATIONS, EXECUTIONS, LOGS, MISC, NETWORK, SHELL, STARTUP, SERVICES, SYSTEM, TRASH, USERS
Categories are compatible with user-inputted files as long as they follow the notation:
# CATEGORY
/location1
/location2
.../location[n]
# END CATEGORY
Default: "all"
-v, --verbose Output in verbose mode, (may conflict with progress bar)
Default: False
-s, --save Save the raw evidence directory
Default: False
-g [GET_ OWNERSHIP [GET_OWNERSHIP ...]], --get_ownership [GET_OWNERSHIP [GET_OWNERSHIP ...]]
Get files and directories owned by included users.
Enabling this will increase parsing (https://www.kitploit.com/search/label/Parsing) time.
Use -g alone to parse from / root directory.
Include paths after -g to specify target locations (i.e. "-g /etc /home/user/Downloads/
Default: Disabled
-y [YARA [YARA ...]], --yara [YARA [YARA ...]]
Configure Yara IOC scanning. Select -y alone to enable Yara scanning.

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Kitploit – Maintenance in Progress

Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.

13 viewsedited 22:48

Hacking Articles Tips Tricks Videos Tutorials

Specify '-y /path/to/yara/' to specify custom input location.
For multiple inputs, use spaces between items,
i.e. '-y rulefile1.yar rulefile2.yara rule_dir/'
All yara files m ust have ".yar" or ".yara" extension.
Default: None
-yr [YARA_RECURSIVE [YARA_RECURSIVE ...]], --yara_recursive [YARA_RECURSIVE [YARA_RECURSIVE ...]]
Configure Recursive Yara IOC scanning.
For multiple inputs, use spaces between items,
i.e. '-yr rulefile1.yar rulefile2.yara rule_dir/'.
Directories in this list will be scanned recursively.
Can be used in conjunction with the normal -y flag,
but intersecting directories will take recursive priority.
Default: None
-yd [YARA_DESTINATIONS [YARA_DESTINATIONS...]], --yara_destinations [YARA_DESTINATIONS [YARA_DESTINATIONS...]]
Destination to run yara files against.
Separate multiple targets with a space.(i.e. /home/alice/ /bin/star/)
Default: All user directories
Example Usages: To use default arguments [this will use default input file (./target_locations), users (all users), categories (all categories), and output location (./LEAF_output/). Cloned data will not be stored in a local directory, verbose mode is off, and yara scanning (https://www.kitploit.com/search/label/Scanning) is disabled]:
LEAF_main.py

All arguments:
LEAF_main.py -i /home/alice/Desktop/customfile1.txt -o /home/alice/Desktop/ExampleOutput/ -c logs startup services apache -u alice bob charlie -s -v -y /path/to/yara_rule1.yar -yr /path2/to/yara_rules/ -yd /home/frank -g /etc/

To specify usernames, categories, and yara files:
LEAF_main.py -u alice bob charlie -c applications executions users -y /home/alice/Desktop/yara1.yar /home/alice/Desktop/yara2.yar

To include custom input file(s) and categories:
LEAF_main.py -i /home/alice/Desktop/customfile1.txt /home/alice/Desktop/customfile2.t xt -c apache xampp
How to Use Install Python requirements: Python 3 (preferably 3.8 or higher) (apt install python3) pip 3 (apt install pip3) Download required modules Install modules from requirements.txt (pip3 install -r requirements.txt) If you get an installation error, try sudo -H pip3 install -r requirements.txt Run the script sudo python3 LEAF_master.py with optional arguments

Download LEAF (https://github.com/alex-cart/LEAF)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.

12 viewsedited 22:48

Hacking Articles Tips Tricks Videos Tutorials

9 views22:52

Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools!
LEAF - Linux Evidence Acquisition Framework

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

LEAF - Linux Evidence Acquisition Framework

10 viewsedited 22:52

Hacking Articles Tips Tricks Videos Tutorials

Razer Blade 17 (Intel i7 12 gen) vs Macbook Pro 16 (M1 pro)
https://www.reddit.com/r/Pentesting/comments/uz9v6x/razer_blade_17_intel_i7_12_gen_vs_macbook_pro_16/

___________________________
@hacking_Attack
@Hacking_Video