BinAbsInspector - Vulnerability Scanner For Binaries
http://www.kitploit.com/2022/05/binabsinspector-vulnerability-scanner.html

___________________________
@hacking_Attack
@Hacking_Video

BinAbsInspector (Binary Abstract Inspector) is a static analyzer (https://www.kitploit.com/search/label/Static%20Analyzer) for automated reverse engineering (https://www.kitploit.com/search/label/Reverse%20Engineering) and scanning vulnerabilities in binaries, which is a long-term research project (https://www.kitploit.com/search/label/Research%20Project) incubated at Keenlab (https://keenlab.tencent.com/). It is based on abstract interpretation (https://www.kitploit.com/search/label/Abstract%20Interpretation) with the support from Ghidra. It works on Ghidra's Pcode instead of assembly. Currently it supports binaries on x86,x64, armv7 and aarch64.
Installation Install Ghidra according to Ghidra's documentation (https://github.com/NationalSecurityAgency/ghidra#install) Install Z3 (https://github.com/Z3Prover/z3) (tested version: 4.8.15) Note that generally there are two parts for Z3 library: one is Java package, the other one is native library. The Java package is already included in "/lib" directory, but we suggest that you replace it with your own Java package for version compatibility. For Windows, download a pre-built package from here (https://github.com/Z3Prover/z3/releases), extract the zip file and add a PATH environment variable pointing to z3-${version}-win/bin For Linux, install with package manager is NOT recommended, there are two options: You can download suitable pre-build package from here (https://github.com/Z3Prover/z3/releases), extract the zip file and copy z3-${version}-win/bin/*.so to /usr/local/lib/ or you can build and install z3 according to Building Z3 using make and GCC/Clang (https://github.com/Z3Prover/z3#building-z3-using-make-and-gccclang) For MacOS, it is similar to Linux. Download the extension zip file from release page (https://github.com/KeenSecurityLab/BinAbsInspector/releases) Install the extension according to Ghidra Extension Notes (https://ghidra-sre.org/InstallationGuide.html#GhidraExtensionNotes) Building Build the extension by yourself, if you want to develop a new feature, please refer to development guide (https://github.com/KeenSecurityLab/BinAbsInspector/wiki/Developer-Guide). Install Ghidra and Z3 Install Gradle 7.x (https://gradle.org/releases/) (tested version: 7.4) Pull the repository Run gradle buildExtension under repository root The extension will be generated at dist/${GhidraVersion}_${date}_BinAbsInspector.zip Usage You can run BinAbsInspector in headless mode, GUI mode, or with docker. With Ghidra headless mode. $GHIDRA_INSTALL_DIR/support/analyzeHeadless -import -postScript BinAbsInspector "@@"
-- Ghidra project path.
-- Ghidra project name.
-- The argument for our analyzer, provides following options: Parameter Description [-K ] KSet size limit K (https://github.com/KeenSecurityLab/BinAbsInspector/wiki/Technical-Details#kset) [-callStringK ] Call string maximum length K (https://github.com/KeenSecurityLab/BinAbsInspector/wiki/Technical-Details#context) [-Z3Timeout ] Z3 timeout [-timeout ] Analysis timeout [-entry ] Entry address [-externalMap ] External function model config [-json] Output in json format [-disableZ3] Disable Z3 [-all] Enable all checkers [-debug] Enable debugging log output [-check "[;...]"] Enable specific checkers With Ghidra GUI Run Ghidra and import the target binary into a project Analyze the binary with default settings When the analysis is done, open Window -> Script Manager and find BinAbsInspector.java Double-click on BinAbsInspector.java entry, set the parameters in configuration window and click OK When the analysis is done, you can see the CWE reports in console window, double-click the addresses from the report can jump to corresponding address With Docker " -import '>git clone git@github.com:KeenSecurityLab/BinAbsInspector.git
cd BinAbsInspector
docker build . -t bai

___________________________
@hacking_Attack
@Hacking_Video

docker run -v $(pwd):/data/workspace bai "@@" -import Implemented Checkers So far BinAbsInspector supports following checkers: CWE78 (https://cwe.mitre.org/data/definitions/78.html) (OS Command Injection) CWE119 (https://cwe.mitre.org/data/definitions/119.html) (Buffer Overflow (generic case)) CWE125 (https://cwe.mitre.org/data/definitions/125.html) (Buffer Overflow (Out-of-bounds Read)) CWE134 (https://cwe.mitre.org/data/definitions/134.html) (Use of Externally-Controlled Format string) CWE190 (https://cwe.mitre.org/data/definitions/190.html) (Integer overflow or wraparound) CWE367 (https://cwe.mitre.org/data/definitions/367.html) (Time-of-check Time-of-use (TOCTOU)) CWE415 (https://cwe.mitre.org/data/definitions/415.html) (Double free) CWE416 (https://cwe.mitre.org/data/definitions/416.html) (Use After Free) CWE426 (https://cwe.mitre.org/data/definitions/426.html) (Untrusted Search Path) CWE467 (https://cwe.mitre.org/data/definitions/467.html) (Use of sizeof() on a pointer type) CWE476 (https://cwe.mitre.org/data/definitions/476.htmll) (NULL Pointer Dereference) CWE676 (https://cwe.mitre.org/data/definitions/676.html) (Use of Potentially Dangerous Function) CWE787 (https://cwe.mitre.org/data/definitions/787.html) (Buffer Overflow (Out-of-bounds Write)) Project Structure The structure of this project is as follows, please refer to technical details (https://github.com/KeenSecurityLab/BinAbsInspector/wiki/Technical-Details) for more details. ├── main
│ ├── java
│ │ └── com
│ │ └── bai
│ │ ├── checkers checker implementatiom
│ │ ├── env
│ │ │ ├── funcs function modeling
│ │ │ │ ├── externalfuncs external function modeling
│ │ │ │ └── stdfuncs cpp std modeling
│ │ │ └── region memory modeling
│ │ ├── solver analyze core and grpah module
│ │ └── util utilities
│ └── resources
└── test
You can also build the javadoc with gradle javadoc, the API documentation will be generated in ./build/docs/javadoc. Acknowledgement We employ Ghidra (https://ghidra-sre.org/) as our foundation and frequently leverage JImmutable Collections (http://brianburton.github.io/java-immutable-collections/) for better performance.
Here we would like to thank them for their great help!

Download BinAbsInspector (https://github.com/KeenSecurityLab/BinAbsInspector)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What’s DDOS Attack?

https://cdn-images-1.medium.com/max/750/1*LjmRuOLY7skPyYoQvNFuKQ.png
If you want the clear understanding of distributed denial-of-service (DDoS) attack, let’s start with this short story, Essam is a very…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
BinAbsInspector - Vulnerability Scanner For Binaries

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_Vf77SEegN9hd3L-1LH__qKHmso-Umr6OXBz1Nb9B5MkgKlSLbxOrUGBdoSyZ0DxJnhNC0ObMqASuMmr2Lb0qxzOLfgOyvcwU5YxB7r1VQ5DEYyU6vDgxZbP2o-15P5cWcD5wsKYWn997GoL9V9xfeFp8Bku8UVgxlk7Z9YryxtLu66XQKeCDV-S0/w640-h358/binary.png BinAbsInspector (Binary Abstract Inspector) is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at Keenlab. It is based on abstract interpretation with the support from Ghidra. It works on Ghidra's Pcode instead of assembly. Currently it supports binaries on x86,x64, armv7 and aarch64. Installation* Install Ghidra according to Ghidra's documentation
* Install Z3 (tested version: 4.8.15)
* Note that generally there are two parts for Z3 library: one is Java package, the other one is native library. The Java package is already included in "/lib" directory, but we suggest that you replace it with your own Java package for version compatibility.
* For Windows, download a pre-built package from here, extract the zip file and add a PATH environment variable pointing to z3-${version}-win/bin* For Linux, install with package manager is NOT recommended, there are two options:
1. You can download suitable pre-build package from here, extract the zip file and copy z3-${version}-win/bin/*.soto /usr/local/lib/2. or you can build and install z3 according to Building Z3 using make and GCC/Clang

* For MacOS, it is similar to Linux.

* Download the extension zip file from release page
* Install the extension according to Ghidra Extension Notes BuildingBuild the extension by yourself, if you want to develop a new feature, please refer to development guide.

* Install Ghidra and Z3
* Install Gradle 7.x (tested version: 7.4)
* Pull the repository
* Run gradle buildExtensionunder repository root
* The extension will be generated at dist/${GhidraVersion}_${date}_BinAbsInspector.zipUsageYou can run BinAbsInspector in headless mode, GUI mode, or with docker.

* With Ghidra headless mode. $GHIDRA_INSTALL_DIR/support/analyzeHeadless -- Ghidra project path. -- Ghidra project name. -- The argument for our analyzer, provides following options:
Parameter Description [-K KSet size limit K [-callStringK Call string maximum length K [-Z3Timeout Z3 timeout [-timeout Analysis timeout [-entry
] Entry address [-externalMap External function model config [-json]Output in json format [-disableZ3]Disable Z3 [-all]Enable all checkers [-debug]Enable debugging log output [-check "Enable specific checkers
*
With Ghidra GUI

1. Run Ghidra and import the target binary into a project
2. Analyze the binary with default settings
3. When the analysis is done, open Window -> Script Managerand find BinAbsInspector.java4. Double-click on BinAbsInspector.javaentry, set the parameters in configuration window and click OK
5. When the analysis is done, you can see the CWE reports in console window, double-click the addresses from the report can jump to corresponding address

*
With Docker

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Domain Escalation: Unconstrained Delegation

IntroductionPost Windows 2000, Microsoft introduced an option where users could authenticate to one system via Kerberos and work with another system. This was made possible via delegation option. Unconstrained delegation is achieved via TGT forwarding technique which is what we’ll talk about in this article.Kerberos DelegationKerberos Delegation enables a service to impersonate a computer or user in order to engage with a second service using the user's privileges and permissions.Service Principal NameA unique name (identifier) of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account. This allows a client application to request that the service authenticate an account even if the client does not have account name.Unconstrained DelegationThe feature debut initially in Windows Server 2000 but it is still there for backwards compatibility. Basically, if a user requests a service ticket for a service on a server set with unconstrained delegation, that server will extract user’s TGT and cache it in its memory for later use. Which means, server can pretend to be that user to any resource on the domain. Computers -> Trust this computer for delegation to any service.TGT extraction via Unconstrained DelegationIt is obvious that we need to run our attack on the machine that has delegation enabled. So we are assuming the attacker has compromised one such machine. Assumption 1: At[...]

___________________________
@hacking_Attack
@Hacking_Video

tacker compromised DC1$ system running IIS on Kerberos authentication.Get-ADComputer -Filter {TrustedForDelegation -eq $true} -Properties trustedfordelegation,serviceprincipalname,descriptionhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVnK7rS34mzNVUEiA9a8iFu-AWGIa1769BQ5rhHzo4SP7EbvihjQp8w8dUSECl3vxQYp3YZxsWhPRRj9yQnycufs-Oz0puzoYimptCyRR-tvb4yd2v2vdA4vyK4GEZOTf5BNPMidKow9FWbIIoVooMsbXuYDHAr_psusYrohNuoHGHfzlimbxJvJXKBQ/s16000/1.png The same can also be achieved by using the powerview script which is part of the PowerSploit framework created for offensive security using PowerShell. You can find it here.Import-Module .\powerview.ps1https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj6OQ9WL5m9pj7MTD6OV-I3k1JRSPYRi_oNLBHHBTbDLlKs20gkF7ucGDcc2e_P6FlLq1wOxv15MgqpAhkFV5xxV-N0G749iWdV3Tr1Bj77-xfFSUqrb8MKnvOOgO5-4SaLmdAOqmRIHkfeVue6F4_0WKwn1qBFAOaCd-30xxHDJO13r3VepawQDneUAA/s16000/2.png Now, on the target system we need to run Rubeus in monitor mode on the dc1 system. After that, whenever a user connects/authenticates to dc1$ Rubeus will dump TGT of the user.rubeus.exe monitor /monitorinterval:10 /targetuser:dc1$ /nowraphttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiI9fqrYrtznEJtRXkIbdKMbwUatKKh_PeDTxcSpTgotlMeT4oj6ytWQOXV8nxKW9oJLHKNiEEnJML5en_gSdXMREzbULMa19Tz48ZUsq-dalm7uBdDWTX3tGG3iK7OL33qWxnKhcij6u9kUfFtZP6kPRQkrpY5bT6IPk-1UsnY6RtlE-O0C9f62i2AXg/s16000/3.png Now, let’s wait for genuine users to connect to dc1$ running IIS service. For simplicity, let’s do that manually using the IWR module.Invoke-WebRequest http://dc1.offense.local -UseDefaultCredentials -UseBasicParsinghttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgp_YUQfI-8qvUbBWr9ife7GS2VzpcXEi97j6Xci64URJ1-nugreRG3ljY8DRP8kwxlCIYfdGz_CEuETmTQL6zqRHRH1LmvI8LpOz-o5gIADMM3VbC3DRD0Pzu6K0tTpgxApaPS_ZV2dsdnI0QoHgB7Oxesv9eMwLdttMpvhLqThgdY072ubnIcITj0Mg/s16000/4.png As you can see, Rubeus has now captured a new ticket granting ticket (TGT) from the user IGNITE\Administrator.ConclusionThe article demonstrated a delegation technique called Unconstrained Delegation because as the name suggests, there are no restrictions upon how the system that has delegation rights use a user’s authentication information. The security loopholes made Microsoft introduce Constrained Delegation. You’ll read more about that in the next article. Hope you liked the article. Thanks for reading.___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
$ where backdoor -[heroctf 2022] by sudo_von

https://cdn-images-1.medium.com/max/1117/1*rcr80p5kkEzWXSr8erMiVg.png
Hello, in this challenge we need to find a backdoor so let’s inspect the website.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to stop an IP accessing your website

Hi all,

I wasn't sure where to post this, so if someone could direct me to a more appropriate sub that would be awesome.

Long story short I run a business and have a malicious stalker who is trying to ruin me. Is there a way I can block her IP address from accessing my website? I believe I have her mobile and home IP.

I know it will not stop her using someone else device but it's a start.

submitted by /u/youngmanmyra
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Why Hackers Use Kali Linux?

https://cdn-images-1.medium.com/max/1000/0*JuVWtBWtutySi0wX.png
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Creating custom wordlists for cracking passwords

https://cdn-images-1.medium.com/max/660/1*RmSGehPf02LHSJmlULW2ng.jpeg
There are multiple tools that are readily available in Kali Linux to create custom a wordlist for cracking passwords offline. We will now…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Basic Ways To Improve SaaS Security

https://cdn-images-1.medium.com/max/600/1*HAXPA1e3NVNrNZ5r6-8lYA.png
1. Use strong passwords and enable two-factor authentication.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video