Kali Linux Tutorials
EDRSandblast : Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protection
___________________________
@hacking_Attack
@Hacking_Video
EDRSandblast : Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protection
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
EDRSandblast : Tool That Weaponize A Vulnerable Signed Driver
EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections and LSASS protections.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
365Inspect : A PowerShell Script That Automates The Security Assessment Of Microsoft Office 365 Environments
365Inspect requires the administrative PowerShell modules for Microsoft Online, Azure AD (We recommend installing the AzureADPreview module), Exchange administration, Microsoft Graph, Microsoft Intune, Microsoft Teams, and Sharepoint administration.
The 365Inspect.ps1 PowerShell script will validate the installed modules.
If you do not have these modules installed, you will be prompted to install them, and with your approval, the script will attempt installation. Otherwise, you should be able to install them with the following commands in an administrative PowerShell prompt, or by following the instructions at the references below:
Install-Module -Name MSOnline
Install-Module -Name AzureADPreview
Install-Module -Name ExchangeOnlineManagement
Install-Module -Name Microsoft.Online.SharePoint.PowerShell
Install-Module -Name Microsoft.Graph
Install-Module -Name MicrosoftTeams
Install-Module -Name Microsoft.Graph.Intune
Once the above are installed, download the 365Inspect source code folder from Github using your browser or by using git clone.
As you will run 365Inspect with administrative privileges, you should place it in a logical location and make sure the contents of the folder are readable and writable only by the administrative user. This is especially important if you intend to install 365Inspect in a location where it will be executed frequently or used as part of an automated process. UsageTo run 365Inspect, open a PowerShell console and navigate to the folder you downloaded 365Inspect into:
cd 365Inspect
You will interact with 365Inspect by executing the main script file, 365Inspect.ps1, from within the PowerShell command prompt.
All 365Inspect requires to inspect your O365 tenant is access via an O365 account with proper permissions, so most of the command line parameters relate to the organization being assessed and the method of authentication.
Execution of 365Inspect looks like this:
.\365Inspect.ps1 -OrgName -OutPath -Auth
For example, to log in by entering your credentials in a browser with MFA support:
.\365Inspect.ps1 -OrgName mycompany -OutPath ..\365_report -Auth MFA
365Inspect can be run with only specified Inspector modules, or conversely, by excluding specified modules.
For example, to log in by entering your credentials in a browser with MFA support:
.\365Inspect.ps1 -OrgName mycompany -OutPath ..\365_report -Auth MFA -SelectedInspectors inspector1, inspector2
or
.\365Inspect.ps1 -OrgName mycompany -OutPath ..\365_report -Auth MFA -ExcludedInspectors inspector1, inspector2, inspector3
To break down the parameters further:
* OrgName is the name of the core organization or “company” of your O365 instance, which will be inspected.
* If you do not know your organization name, you can navigate to the list of all Exchange domains in O365. The topmost domain should be named domain_name.onmicrosoft.com. In that example, domain_name is your organization name and should be used when executing 365Inspect.
* OutPath is the path to a folder where the report generated by 365Inspect will be placed.
* Auth is a selector that should be one of the literal values “MFA”, “CMDLINE”, or “ALREADY_AUTHED”.
* Auth controls how 365Inspect will authenticate to all of the Office 365 services.
* Auth MFA will produce a graphical popup in which you can type your credentials and even enter an MFA code for MFA-enabled accounts.
* Auth ALREADY_AUTHED instructs 365Inspect not to authenticate before scanning. This may be preferable if you are executing 365Inspect from a PowerShell prompt where you already have valid sessions for all of the described services, such as one where you have already executed 365Inspect.
* SelectedInspectors is the name or names of the inspector or inspectors you wish to run with 365Inspec[...]
___________________________
@hacking_Attack
@Hacking_Video
365Inspect : A PowerShell Script That Automates The Security Assessment Of Microsoft Office 365 Environments
365Inspect requires the administrative PowerShell modules for Microsoft Online, Azure AD (We recommend installing the AzureADPreview module), Exchange administration, Microsoft Graph, Microsoft Intune, Microsoft Teams, and Sharepoint administration.
The 365Inspect.ps1 PowerShell script will validate the installed modules.
If you do not have these modules installed, you will be prompted to install them, and with your approval, the script will attempt installation. Otherwise, you should be able to install them with the following commands in an administrative PowerShell prompt, or by following the instructions at the references below:
Install-Module -Name MSOnline
Install-Module -Name AzureADPreview
Install-Module -Name ExchangeOnlineManagement
Install-Module -Name Microsoft.Online.SharePoint.PowerShell
Install-Module -Name Microsoft.Graph
Install-Module -Name MicrosoftTeams
Install-Module -Name Microsoft.Graph.Intune
Once the above are installed, download the 365Inspect source code folder from Github using your browser or by using git clone.
As you will run 365Inspect with administrative privileges, you should place it in a logical location and make sure the contents of the folder are readable and writable only by the administrative user. This is especially important if you intend to install 365Inspect in a location where it will be executed frequently or used as part of an automated process. UsageTo run 365Inspect, open a PowerShell console and navigate to the folder you downloaded 365Inspect into:
cd 365Inspect
You will interact with 365Inspect by executing the main script file, 365Inspect.ps1, from within the PowerShell command prompt.
All 365Inspect requires to inspect your O365 tenant is access via an O365 account with proper permissions, so most of the command line parameters relate to the organization being assessed and the method of authentication.
Execution of 365Inspect looks like this:
.\365Inspect.ps1 -OrgName -OutPath -Auth
For example, to log in by entering your credentials in a browser with MFA support:
.\365Inspect.ps1 -OrgName mycompany -OutPath ..\365_report -Auth MFA
365Inspect can be run with only specified Inspector modules, or conversely, by excluding specified modules.
For example, to log in by entering your credentials in a browser with MFA support:
.\365Inspect.ps1 -OrgName mycompany -OutPath ..\365_report -Auth MFA -SelectedInspectors inspector1, inspector2
or
.\365Inspect.ps1 -OrgName mycompany -OutPath ..\365_report -Auth MFA -ExcludedInspectors inspector1, inspector2, inspector3
To break down the parameters further:
* OrgName is the name of the core organization or “company” of your O365 instance, which will be inspected.
* If you do not know your organization name, you can navigate to the list of all Exchange domains in O365. The topmost domain should be named domain_name.onmicrosoft.com. In that example, domain_name is your organization name and should be used when executing 365Inspect.
* OutPath is the path to a folder where the report generated by 365Inspect will be placed.
* Auth is a selector that should be one of the literal values “MFA”, “CMDLINE”, or “ALREADY_AUTHED”.
* Auth controls how 365Inspect will authenticate to all of the Office 365 services.
* Auth MFA will produce a graphical popup in which you can type your credentials and even enter an MFA code for MFA-enabled accounts.
* Auth ALREADY_AUTHED instructs 365Inspect not to authenticate before scanning. This may be preferable if you are executing 365Inspect from a PowerShell prompt where you already have valid sessions for all of the described services, such as one where you have already executed 365Inspect.
* SelectedInspectors is the name or names of the inspector or inspectors you wish to run with 365Inspec[...]
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
365Inspect : A PowerShell Script That Automates The Security Assessment
365Inspect requires the administrative PowerShell modules for Microsoft Online, Azure AD Exchange administration.
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials 365Inspect : A PowerShell Script That Automates The Security Assessment Of Microsoft Office 365 Environments 365Inspect requires the administrative PowerShell modules for Microsoft Online, Azure AD (We recommend installing the AzureADPreview…
t. If multiple inspectors are selected they must be comma separated. Only the named inspectors will be run.
* ExcludedInspectors is the name or names of the inspector or inspectors you wish to prevent from running with 365Inspect. If multiple inspectors are selected they must be comma separated. All modules other included modules will be run.
When you execute 365Inspect with -Auth MFA, it may produce several graphical login prompts that you must sequentially log into. This is normal behavior as Exchange, SharePoint etc. have separate administration modules and each requires a different login session. If you simply log in the requested number of times, 365Inspect should begin to execute. This is the opposite of fun and we’re seeking a workaround, but needless to say we feel the results are worth the minute spent looking at MFA codes.
As 365Inspect executes, it will steadily print status updates indicating which inspection task is running.
365Inspect may take some time to execute. This time scales with the size and complexity of the environment under test. For example, some inspection tasks involve scanning the account configuration of all users. This may occur near-instantly for an organization with 50 users, or could take entire minutes (!) for an organization with 10000. Output365Inspect creates the directory specified in the out_path parameter. This directory is the result of the entire 365Inspect inspection. It contains four items of note:
* Report.html: graphical report that describes the O365 security issues identified by 365Inspect, lists O365 objects that are misconfigured, and provides remediation advice.
* Various text files named [Inspector-Name]: these are raw output from inspector modules and contain a list (one item per line) of misconfigured O365 objects that contain the described security flaw. For example, if a module Inspect-FictionalMFASettings were to detect all users who do not have MFA set up, the file “Inspect-FictionalMFASettings” in the report ZIP would contain one user per line who does not have MFA set up. This information is only dumped to a file in cases where more than 15 affected objects are discovered. If less than 15 affected objects are discovered, the objects are listed directly in the main HTML report body.
* Report.zip: zipped version of this entire directory, for convenient distribution of the results in cases where some inspector modules generated a large amount of findings.
* Log directory: 365Inspect logs any errors encountered during the scripts execution to a timestamped log file found in the Log directory Necessary Privileges365Inspect can’t run properly unless the O365 account you authenticate with has appropriate privileges. 365Inspect requires, at minimum, the following:
* Global Administrator
* SharePoint Administrator
We realize that these are extremely permissive roles, unfortunately due to the use of Microsoft Graph, we are restricted from using lesser prileges by Microsoft. Application and Cloud Application Administrator roles (used to grant delegated and application permissions) are restricted from granting permissions for Microsoft Graph or Azure AD PowerShell modules. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#application-administrator Developing Inspector Modules365Inspect is designed to be easy to expand, with the hope that it enables individuals and organizations to either utilize their own 365Inspect modules internally, or publish those modules for the O365 community.
All of 365Inspect‘s inspector modules are stored in the .\inspectors folder.
It is simple to create an inspector module. Inspectors have two files:
* ModuleName.ps1: the PowerShell source code of the inspector module. Should return a list of all O365 objects affected by a specific issue, represented as strings.
* ModuleName.json: metadata about the inspector itself. For example, the finding name, description, remediation information, and references.
The Power[...]
___________________________
@hacking_Attack
@Hacking_Video
* ExcludedInspectors is the name or names of the inspector or inspectors you wish to prevent from running with 365Inspect. If multiple inspectors are selected they must be comma separated. All modules other included modules will be run.
When you execute 365Inspect with -Auth MFA, it may produce several graphical login prompts that you must sequentially log into. This is normal behavior as Exchange, SharePoint etc. have separate administration modules and each requires a different login session. If you simply log in the requested number of times, 365Inspect should begin to execute. This is the opposite of fun and we’re seeking a workaround, but needless to say we feel the results are worth the minute spent looking at MFA codes.
As 365Inspect executes, it will steadily print status updates indicating which inspection task is running.
365Inspect may take some time to execute. This time scales with the size and complexity of the environment under test. For example, some inspection tasks involve scanning the account configuration of all users. This may occur near-instantly for an organization with 50 users, or could take entire minutes (!) for an organization with 10000. Output365Inspect creates the directory specified in the out_path parameter. This directory is the result of the entire 365Inspect inspection. It contains four items of note:
* Report.html: graphical report that describes the O365 security issues identified by 365Inspect, lists O365 objects that are misconfigured, and provides remediation advice.
* Various text files named [Inspector-Name]: these are raw output from inspector modules and contain a list (one item per line) of misconfigured O365 objects that contain the described security flaw. For example, if a module Inspect-FictionalMFASettings were to detect all users who do not have MFA set up, the file “Inspect-FictionalMFASettings” in the report ZIP would contain one user per line who does not have MFA set up. This information is only dumped to a file in cases where more than 15 affected objects are discovered. If less than 15 affected objects are discovered, the objects are listed directly in the main HTML report body.
* Report.zip: zipped version of this entire directory, for convenient distribution of the results in cases where some inspector modules generated a large amount of findings.
* Log directory: 365Inspect logs any errors encountered during the scripts execution to a timestamped log file found in the Log directory Necessary Privileges365Inspect can’t run properly unless the O365 account you authenticate with has appropriate privileges. 365Inspect requires, at minimum, the following:
* Global Administrator
* SharePoint Administrator
We realize that these are extremely permissive roles, unfortunately due to the use of Microsoft Graph, we are restricted from using lesser prileges by Microsoft. Application and Cloud Application Administrator roles (used to grant delegated and application permissions) are restricted from granting permissions for Microsoft Graph or Azure AD PowerShell modules. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#application-administrator Developing Inspector Modules365Inspect is designed to be easy to expand, with the hope that it enables individuals and organizations to either utilize their own 365Inspect modules internally, or publish those modules for the O365 community.
All of 365Inspect‘s inspector modules are stored in the .\inspectors folder.
It is simple to create an inspector module. Inspectors have two files:
* ModuleName.ps1: the PowerShell source code of the inspector module. Should return a list of all O365 objects affected by a specific issue, represented as strings.
* ModuleName.json: metadata about the inspector itself. For example, the finding name, description, remediation information, and references.
The Power[...]
___________________________
@hacking_Attack
@Hacking_Video
Docs
Microsoft Entra Built-in Roles - Microsoft Entra ID
Learn what each Microsoft Entra built-in role can do, from Global Administrator to Reports Reader. Find role descriptions, permissions, and template IDs.
Hacking Articles Tips Tricks Videos Tutorials
t. If multiple inspectors are selected they must be comma separated. Only the named inspectors will be run. * ExcludedInspectors is the name or names of the inspector or inspectors you wish to prevent from running with 365Inspect. If multiple inspectors are…
Shell and JSON file names must be identical for 365Inspect to recognize that the two belong together. There are numerous examples in 365Inspect‘s built-in suite of modules, but we’ll put an example here too.
Example .ps1 file, BypassingSafeAttachments.ps1:
Define a function that we will later invoke.
365Inspect’s built-in modules all follow this pattern.
function Inspect-BypassingSafeAttachments {
Query some element of the O365 environment to inspect. Note that we did not have to authenticate to Exchange
to fetch these transport rules within this module; assume main 365Inspect harness has logged us in already.
$safe_attachment_bypass_rules = (Get-TransportRule | Where { $_.SetHeaderName -eq “X-MS-Exchange-Organization-SkipSafeAttachmentProcessing” }).Identity
If some of the parsed O365 objects were found to have the security flaw this module is inspecting for,
return a list of strings representing those objects. This is what will end up as the “Affected Objects”
field in the report.
If ($safe_attachment_bypass_rules.Count -ne 0) {
return $safe_attachment_bypass_rules
}
If none of the parsed O365 objects were found to have the security flaw this module is inspecting for,
returning $null indicates to 365Inspect that there were no findings for this module.
return $null
}
Return the results of invoking the inspector function.
return Inspect-BypassingSafeAttachments
Example .json file, BypassingSafeAttachments.json:
{
“FindingName”: “Do Not Bypass the Safe Attachments Filter”,
“Description”: “In Exchange, it is possible to create mail transport rules that bypass the Safe Attachments detection capability. The rules listed above bypass the Safe Attachments capability. Consider revie1wing these rules, as bypassing the Safe Attachments capability even for a subset of senders could be considered insecure depending on the context or may be an indicator of compromise.”,
“Remediation”: “Navigate to the Mail Flow -> Rules screen in the Exchange Admin Center. Look for the offending rules and begin the process of assessing who created them and whether they are necessary to the continued function of your organization. If they are not, remove the rules.”,
“AffectedObjects”: “”,
“References”: [
{
“Url”: “https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules”,
“Text”: “Manage Mail Flow Rules in Exchange Online”
},
{
“Url”: “https://www.undocumented-features.com/2018/05/10/atp-safe-attachments-safe-links-and-anti-phishing-policies-or-all-the-policies-you-can-shake-a-stick-at/#Bypass_Safe_Attachments_Processing”,
“Text”: “Undocumented Features: Safe Attachments, Safe Links, and Anti-Phishing Policies”
}
]
}
Once you drop these two files in the .\inspectors folder, they are considered part of 365Inspect‘s module inventory and will run the next time you execute 365Inspect.
You have just created the BypassingSafeAttachments Inspector module. That’s all!
365Inspect will throw a pretty loud and ugly error if something in your module doesn’t work or doesn’t follow 365Inspect conventions, so monitor the command line output. Download
___________________________
@hacking_Attack
@Hacking_Video
Example .ps1 file, BypassingSafeAttachments.ps1:
Define a function that we will later invoke.
365Inspect’s built-in modules all follow this pattern.
function Inspect-BypassingSafeAttachments {
Query some element of the O365 environment to inspect. Note that we did not have to authenticate to Exchange
to fetch these transport rules within this module; assume main 365Inspect harness has logged us in already.
$safe_attachment_bypass_rules = (Get-TransportRule | Where { $_.SetHeaderName -eq “X-MS-Exchange-Organization-SkipSafeAttachmentProcessing” }).Identity
If some of the parsed O365 objects were found to have the security flaw this module is inspecting for,
return a list of strings representing those objects. This is what will end up as the “Affected Objects”
field in the report.
If ($safe_attachment_bypass_rules.Count -ne 0) {
return $safe_attachment_bypass_rules
}
If none of the parsed O365 objects were found to have the security flaw this module is inspecting for,
returning $null indicates to 365Inspect that there were no findings for this module.
return $null
}
Return the results of invoking the inspector function.
return Inspect-BypassingSafeAttachments
Example .json file, BypassingSafeAttachments.json:
{
“FindingName”: “Do Not Bypass the Safe Attachments Filter”,
“Description”: “In Exchange, it is possible to create mail transport rules that bypass the Safe Attachments detection capability. The rules listed above bypass the Safe Attachments capability. Consider revie1wing these rules, as bypassing the Safe Attachments capability even for a subset of senders could be considered insecure depending on the context or may be an indicator of compromise.”,
“Remediation”: “Navigate to the Mail Flow -> Rules screen in the Exchange Admin Center. Look for the offending rules and begin the process of assessing who created them and whether they are necessary to the continued function of your organization. If they are not, remove the rules.”,
“AffectedObjects”: “”,
“References”: [
{
“Url”: “https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules”,
“Text”: “Manage Mail Flow Rules in Exchange Online”
},
{
“Url”: “https://www.undocumented-features.com/2018/05/10/atp-safe-attachments-safe-links-and-anti-phishing-policies-or-all-the-policies-you-can-shake-a-stick-at/#Bypass_Safe_Attachments_Processing”,
“Text”: “Undocumented Features: Safe Attachments, Safe Links, and Anti-Phishing Policies”
}
]
}
Once you drop these two files in the .\inspectors folder, they are considered part of 365Inspect‘s module inventory and will run the next time you execute 365Inspect.
You have just created the BypassingSafeAttachments Inspector module. That’s all!
365Inspect will throw a pretty loud and ugly error if something in your module doesn’t work or doesn’t follow 365Inspect conventions, so monitor the command line output. Download
___________________________
@hacking_Attack
@Hacking_Video
Docs
Manage mail flow rules in Exchange Online
Admins can learn how to view, create, modify, remove enable or disable, and import or export mail flow rules in Exchange Online.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
vAPI : Vulnerable Adversely Programmed Interface Which Is Self-Hostable API
vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios in the means of Exercises.
Requirements
* PHP
* MySQL
* PostMan
* MITM Proxy
Installation (Docker)
docker-compose up -d
Installation (Manual)
Copying the Code
cd Setting up the Database
Import
Configure the DB Credentials in the
Starting MySQL service
Run following command (Linux)
service mysqld start
Starting Laravel Server
Go to
php artisan serve
Setting Up Postman
* Import
* Import
OR
Use Public Workspace
Usage
Browse
After Sending requests, refer to the Postman Tests or Environment for Generated Tokens
Deployment
Helm can be used to deploy to a Kubernetes namespace. The chart is in the
DB_PASSWORD:
DB_USERNAME:
Sample Helm Install Command:
*** Important ***
The MYSQL_ROOT_PASSWORD on line 232 in the
Download
___________________________
@hacking_Attack
@Hacking_Video
vAPI : Vulnerable Adversely Programmed Interface Which Is Self-Hostable API
vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios in the means of Exercises.
Requirements
* PHP
* MySQL
* PostMan
* MITM Proxy
Installation (Docker)
docker-compose up -d
Installation (Manual)
Copying the Code
cd Setting up the Database
Import
vapi.sqlinto MySQL DatabaseConfigure the DB Credentials in the
vapi/.envStarting MySQL service
Run following command (Linux)
service mysqld start
Starting Laravel Server
Go to
vapidirectory and Runphp artisan serve
Setting Up Postman
* Import
vAPI.postman_collection.jsonin Postman* Import
vAPI_ENV.postman_environment.jsonin PostmanOR
Use Public Workspace
Usage
Browse
http://localhost/vapi/for DocumentationAfter Sending requests, refer to the Postman Tests or Environment for Generated Tokens
Deployment
Helm can be used to deploy to a Kubernetes namespace. The chart is in the
vapi-chartfolder. The chart requires one secret named vapiwith the following values:DB_PASSWORD:
DB_USERNAME:
Sample Helm Install Command:
helm upgrade --install vapi ./vapi-chart --values=./vapi-chart/values.yaml*** Important ***
The MYSQL_ROOT_PASSWORD on line 232 in the
values.yamlmust match that on line 184 in order to work.Download
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
vAPI : Vulnerable Adversely Programmed Interface
vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API. Top 10 scenarios.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Kraken : A Multi-Platform Distributed Brute-Force Password Cracking System
Kraken is an online distributed brute force password cracking tool. It allows you to parallelize dictionaries and crunch word generator based cracking across multiple machines both as a web app in a web browser and as a standalone electron based client. Kraken aims to be easy to use, fault tolerant and scalable.
I wrote Kraken because I wanted to learn more about offensive security and to write an easy solution to overcome the limitation of using a single device when attempting distribute brute force workloads.
Installation
Server and Browser Client
Kraken is a dockerized application using docker-compose which will launch the db (Postgres), s3 compliant file storage (Minio), the server and the browser client. You can find the docker-compose file at the root directory of the repository. You can deploy it using the following command:
docker-compose up
Kraken’s Browser Client should be accessible at:
* HTTP : localhost:8080 (use server url http://localhost:5000/api [default])
* HTTPS : https://localhost:8443 (use server url https://localhost:8443/api)
Note: To run the Browser Client from a remote machine, you MUST use HTTPS for both server url and browser url. Eg. If you are hosting the server on 192.168.1.2, then browser client will be available at https://192.168.1.2:8443 and the server url should be https://192.168.1.2:8443/api
To upload password lists or dictionaries, upload them to Minio Console at localhost:9001. View steps below for a detailed guide Otherwise, you can generate word lists dynamically using crunch. See crunch options and how to use them here: crunch man page
Kraken’s server runs on localhost:5000 and also hosts swagger documentation at localhost:5000/swagger.
Portable Desktop Client
The desktop client is an electron based portable application and can be run on Mac, Windows and Linux. Due to sensitive permissions required to function, it is highly recommended that you compile and it yourself by cloning the repo and using :
cd kraken-client
npm install
npm run electron-start
Windows
Note: Window EXE portable client needs to run in the folder with its hashcat dependencies. Hashcat files can be dowloaded from their home page or here. Ive included a compressed zip file with the portable executable and required hashcat files. They can be downloaded:
* Portable Exe
* Compressed Zip
Linux
Releases include a Linux AppImage which only requires hashcat to be installed.
* AppImage
Install hashcat:
sudo apt-get install hashcat
You will have to give AppImage permission via properties to execute.
Download
___________________________
@hacking_Attack
@Hacking_Video
Kraken : A Multi-Platform Distributed Brute-Force Password Cracking System
Kraken is an online distributed brute force password cracking tool. It allows you to parallelize dictionaries and crunch word generator based cracking across multiple machines both as a web app in a web browser and as a standalone electron based client. Kraken aims to be easy to use, fault tolerant and scalable.
I wrote Kraken because I wanted to learn more about offensive security and to write an easy solution to overcome the limitation of using a single device when attempting distribute brute force workloads.
Installation
Server and Browser Client
Kraken is a dockerized application using docker-compose which will launch the db (Postgres), s3 compliant file storage (Minio), the server and the browser client. You can find the docker-compose file at the root directory of the repository. You can deploy it using the following command:
docker-compose up
Kraken’s Browser Client should be accessible at:
* HTTP : localhost:8080 (use server url http://localhost:5000/api [default])
* HTTPS : https://localhost:8443 (use server url https://localhost:8443/api)
Note: To run the Browser Client from a remote machine, you MUST use HTTPS for both server url and browser url. Eg. If you are hosting the server on 192.168.1.2, then browser client will be available at https://192.168.1.2:8443 and the server url should be https://192.168.1.2:8443/api
To upload password lists or dictionaries, upload them to Minio Console at localhost:9001. View steps below for a detailed guide Otherwise, you can generate word lists dynamically using crunch. See crunch options and how to use them here: crunch man page
Kraken’s server runs on localhost:5000 and also hosts swagger documentation at localhost:5000/swagger.
Portable Desktop Client
The desktop client is an electron based portable application and can be run on Mac, Windows and Linux. Due to sensitive permissions required to function, it is highly recommended that you compile and it yourself by cloning the repo and using :
cd kraken-client
npm install
npm run electron-start
Windows
Note: Window EXE portable client needs to run in the folder with its hashcat dependencies. Hashcat files can be dowloaded from their home page or here. Ive included a compressed zip file with the portable executable and required hashcat files. They can be downloaded:
* Portable Exe
* Compressed Zip
Linux
Releases include a Linux AppImage which only requires hashcat to be installed.
* AppImage
Install hashcat:
sudo apt-get install hashcat
You will have to give AppImage permission via properties to execute.
Download
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
Kraken : A Multi-Platform Brute-Force Password Cracking System
Kraken is an online distributed brute force password cracking tool. It allows you to parallelize dictionaries and crunch word generator.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
OWASP Coraza WAF : A Golang Modsecurity Compatible Web Application Firewall Library
OWASP Coraza Web Application Firewall, OWASP Coraza is a golang enterprise-grade Web Application Firewall framework that supports Modsecurity’s seclang language and is 100% compatible with OWASP Core Ruleset.
Prerequisites
* Linux distribution (Debian and Centos are recommended, Windows is not supported yet)
* Golang compiler v1.16+
Migrate from v1
* Rollback SecAuditLog to the legacy syntax (serial/concurrent)
* Attach an error log handler using
* the function Transaction.Clean() must be used to clear transaction data, files and take them back to the sync pool.
* If you are using low level APIs check the complete changelog as most of them were removed.
* OWASP CRS does not require any external dependency anymore
Running the tests
Run the go tests:
go test ./…
go test -race ./…
Using pre-commit
pip install pre-commit
pre-commit run –all-files
ou can also install the pre-commit git hook by running
pre-commit install
Coraza v2 differences with v1
* Full internal API refactor, public API has not changed
* Full audit engine refactor with plugins support
* New enhanced plugins interface for transformations, actions, body processors, and operators
* We are fully compliant with Seclang from modsecurity v2
* Many features removed and transformed into plugins: XML (Mostly), GeoIP and PCRE regex
* Better debug logging
* New error logging (like modsecurity)
* Better performance
Your first Coraza WAF project
package main
import(
“fmt”
“github.com/corazawaf/coraza/v2”
“github.com/corazawaf/coraza/v2/seclang”
)
func main() {
// First we initialize our waf and our seclang parser
waf := coraza.NewWaf()
parser, _ := seclang.NewParser(waf)
// Now we parse our rules
if err := parser.FromString(
fmt.Println(err)
}
// Then we create a transaction and assign some variables
tx := waf.NewTransaction()
defer func(){
tx.ProcessLogging()
tx.Clean()
}()
tx.ProcessConnection(“127.0.0.1”, 8080, “127.0.0.1”, 12345)
// Finally we process the request headers phase, which may return an interruption
if it := tx.ProcessRequestHeaders(); it != nil {
fmt.Printf(“Transaction was interrupted with status %d\n”, it.Status)
}
}
Download
___________________________
@hacking_Attack
@Hacking_Video
OWASP Coraza WAF : A Golang Modsecurity Compatible Web Application Firewall Library
OWASP Coraza Web Application Firewall, OWASP Coraza is a golang enterprise-grade Web Application Firewall framework that supports Modsecurity’s seclang language and is 100% compatible with OWASP Core Ruleset.
Prerequisites
* Linux distribution (Debian and Centos are recommended, Windows is not supported yet)
* Golang compiler v1.16+
Migrate from v1
* Rollback SecAuditLog to the legacy syntax (serial/concurrent)
* Attach an error log handler using
waf.SetErrorLogCb(cb)(optional)* the function Transaction.Clean() must be used to clear transaction data, files and take them back to the sync pool.
* If you are using low level APIs check the complete changelog as most of them were removed.
* OWASP CRS does not require any external dependency anymore
Running the tests
Run the go tests:
go test ./…
go test -race ./…
Using pre-commit
pip install pre-commit
pre-commit run –all-files
ou can also install the pre-commit git hook by running
pre-commit install
Coraza v2 differences with v1
* Full internal API refactor, public API has not changed
* Full audit engine refactor with plugins support
* New enhanced plugins interface for transformations, actions, body processors, and operators
* We are fully compliant with Seclang from modsecurity v2
* Many features removed and transformed into plugins: XML (Mostly), GeoIP and PCRE regex
* Better debug logging
* New error logging (like modsecurity)
* Better performance
Your first Coraza WAF project
package main
import(
“fmt”
“github.com/corazawaf/coraza/v2”
“github.com/corazawaf/coraza/v2/seclang”
)
func main() {
// First we initialize our waf and our seclang parser
waf := coraza.NewWaf()
parser, _ := seclang.NewParser(waf)
// Now we parse our rules
if err := parser.FromString(
SecRule REMOTE_ADDR "@rx .*" "id:1,phase:1,deny,status:403"); err != nil {fmt.Println(err)
}
// Then we create a transaction and assign some variables
tx := waf.NewTransaction()
defer func(){
tx.ProcessLogging()
tx.Clean()
}()
tx.ProcessConnection(“127.0.0.1”, 8080, “127.0.0.1”, 12345)
// Finally we process the request headers phase, which may return an interruption
if it := tx.ProcessRequestHeaders(); it != nil {
fmt.Printf(“Transaction was interrupted with status %d\n”, it.Status)
}
}
Download
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
OWASP Coraza WAF : A Golang Modsecurity Compatible Web Application
OWASP Coraza Web Application Firewall, OWASP Coraza is a golang enterprise-grade Web Application Firewall framework
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
linWinPwn : A Bash Script That Automates A Number Of Active Directory Enumeration And Vulnerability Checks
linWinPwn is a bash script that automates a number of Active Directory Enumeration and Vulnerability checks. The script leverages and is dependent of a number of tools including: impacket, bloodhound, crackmapexec, ldapdomaindump, lsassy, smbmap, kerbrute, adidnsdump.
Setup
Git clone the repository and make the script executable
git clone https://github.com/lefayjey/linWinPwn
cd linWinPwn; chmod +x linWinPwn.sh
Install requirements on Kali machines using the
chmod +x install.sh
sudo ./install.sh
On non-Kali machines, run the
chmod +x install_nonkali.sh
sudo ./install_nonkali.sh
If you’re having DNS issues or time sync errors, run the
WARNING: The script will update /etc/resolv.conf
chmod +x configure.sh
sudo ./configure.sh -t -d -n
Usage
Modules
The linWinPwn script contains 4 modules that can be used either separately or simultaneously.
Default (fastest): ad_enum,kerberos (Optional: run OPSEC safe checks only by using
./linWinPwn.sh -d -u -p -t -o
User modules: ad_enum,kerberos,scan_shares,vuln_checks,mssql_enum
./linWinPwn.sh -M user -d -u -p -t -o
All modules: ad_enum,kerberos,scan_shares,vuln_checks,mssql_enum,pwd_dump
./linWinPwn.sh -M all -d -u -p -t -o
Module ad_enum: Active Directory Enumeration
./linWinPwn.sh -M ad_enum -d -u -p -t -o
Use cases
For each of the cases described, the linWinPwn script performs different checks as shown below.
Case 1: Unauthenticated
* Module ad_enum
* rid bruteforce
* user enumeration
* ldapdomaindump anonymous enumeration
* Check if ldap-signing is enforced, check for LDAP Relay
* Module kerberos
* kerbrute user spray
* ASREPRoast using collected list of users (and cracking hashes using john-the-ripper and the rockyou wordlist)
* Module scan_shares
* SMB shares anonymous enumeration on identified servers
* Module vuln_checks
* Enumeration for WebDav and Spooler services on identified servers
* Check for zerologon, petitpotam, nopac weaknesses
./linWinPwn.sh -M user -t
Case 2: Standard Account (using password, NTLM hash or Kerberos ticket)
* DNS extraction using adidnsdump
* Module ad_enum
* BloodHound data collection
* ldapdomaindump enumeration
* Delegation information extraction
* GPP Passwords extraction
* Extract ADCS information using certipy
* Check if ldap-signing is enforced, check for LDAP Relay
* Extraction of MachineAccountQuota of user, Password Policy and users’ descriptions containing “pass”
* LAPS and gMSA dump
* Module kerberos
* kerbrute user=pass enumeration
* ASREPRoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)
* Kerberoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)
* Module scan_shares
* SMB shares enumeration on all domain servers
* Module vuln_checks
* Enumeration for WebDav and Spooler services on all domain servers
* Check for zerologon, petitpotam, nopac weaknesses
* Module mssql_enum
* Check mssql privilege escalation paths
./linWinPwn.sh -M user -d -u -p -t
Case 3: Administrator Account (using password, NTLM hash or Kerberos ticket)
* All of the “Standard User” checks
* Module pwd_dump
* secretsdump on all domain servers or on provided list of servers with
* lsassy on on all domain servers or on provided list of servers with
./linWinPwn.sh -M all -d -u -p -t -S
Download
___________________________
@hacking_Attack
@Hacking_Video
linWinPwn : A Bash Script That Automates A Number Of Active Directory Enumeration And Vulnerability Checks
linWinPwn is a bash script that automates a number of Active Directory Enumeration and Vulnerability checks. The script leverages and is dependent of a number of tools including: impacket, bloodhound, crackmapexec, ldapdomaindump, lsassy, smbmap, kerbrute, adidnsdump.
Setup
Git clone the repository and make the script executable
git clone https://github.com/lefayjey/linWinPwn
cd linWinPwn; chmod +x linWinPwn.sh
Install requirements on Kali machines using the
install.shscriptchmod +x install.sh
sudo ./install.sh
On non-Kali machines, run the
install_nonkali.shscript insteadchmod +x install_nonkali.sh
sudo ./install_nonkali.sh
If you’re having DNS issues or time sync errors, run the
configure.shscript with -dfor DNS update and -nfor NTP syncWARNING: The script will update /etc/resolv.conf
chmod +x configure.sh
sudo ./configure.sh -t -d -n
Usage
Modules
The linWinPwn script contains 4 modules that can be used either separately or simultaneously.
Default (fastest): ad_enum,kerberos (Optional: run OPSEC safe checks only by using
-O)./linWinPwn.sh -d -u -p -t -o
User modules: ad_enum,kerberos,scan_shares,vuln_checks,mssql_enum
./linWinPwn.sh -M user -d -u -p -t -o
All modules: ad_enum,kerberos,scan_shares,vuln_checks,mssql_enum,pwd_dump
./linWinPwn.sh -M all -d -u -p -t -o
Module ad_enum: Active Directory Enumeration
./linWinPwn.sh -M ad_enum -d -u -p -t -o
Use cases
For each of the cases described, the linWinPwn script performs different checks as shown below.
Case 1: Unauthenticated
* Module ad_enum
* rid bruteforce
* user enumeration
* ldapdomaindump anonymous enumeration
* Check if ldap-signing is enforced, check for LDAP Relay
* Module kerberos
* kerbrute user spray
* ASREPRoast using collected list of users (and cracking hashes using john-the-ripper and the rockyou wordlist)
* Module scan_shares
* SMB shares anonymous enumeration on identified servers
* Module vuln_checks
* Enumeration for WebDav and Spooler services on identified servers
* Check for zerologon, petitpotam, nopac weaknesses
./linWinPwn.sh -M user -t
Case 2: Standard Account (using password, NTLM hash or Kerberos ticket)
* DNS extraction using adidnsdump
* Module ad_enum
* BloodHound data collection
* ldapdomaindump enumeration
* Delegation information extraction
* GPP Passwords extraction
* Extract ADCS information using certipy
* Check if ldap-signing is enforced, check for LDAP Relay
* Extraction of MachineAccountQuota of user, Password Policy and users’ descriptions containing “pass”
* LAPS and gMSA dump
* Module kerberos
* kerbrute user=pass enumeration
* ASREPRoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)
* Kerberoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)
* Module scan_shares
* SMB shares enumeration on all domain servers
* Module vuln_checks
* Enumeration for WebDav and Spooler services on all domain servers
* Check for zerologon, petitpotam, nopac weaknesses
* Module mssql_enum
* Check mssql privilege escalation paths
./linWinPwn.sh -M user -d -u -p -t
Case 3: Administrator Account (using password, NTLM hash or Kerberos ticket)
* All of the “Standard User” checks
* Module pwd_dump
* secretsdump on all domain servers or on provided list of servers with
-S* lsassy on on all domain servers or on provided list of servers with
-S./linWinPwn.sh -M all -d -u -p -t -S
Download
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
linWinPwn : Script Automates Number Of Active Directory Enumeration
linWinPwn is a bash script that automates a number of Active Directory Enumeration and Vulnerability checks.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Zircolite : A Standalone SIGMA-based Detection Tool For EVTX, Auditd And Sysmon For Linux Logs
Zircolite is a standalone tool written in Python 3. It allows to use SIGMA rules on MS Windows EVTX (EVTX and JSONL format), Auditd logs and Sysmon for Linux logs
* Zircolite can be used directly on the investigated endpoint (use releases) or in your forensic/detection lab
* Zircolite is fast and can parse large datasets in just seconds (check benchmarks)
Zircolite can be used directly in Python or you can use the binaries provided in releases (Microsoft Windows and Linux only). Documentation is here.
Requirements / Installation
You can install dependencies with :
The use of evtx_dump is optional but required by default (because it is for now much faster), If you do not want to use it you have to use the
Quick start
EVTX files
Help is available with
python3 zircolite.py –evtx –ruleset
python3 zircolite.py –evtx sysmon.evtx –ruleset rules/rules_windows_sysmon.json
The SYSMON ruleset used here is a default one and it is for logs coming from endpoints where SYSMON installed. A generic ruleset is available too.
Auditd logs
python3 zircolite.py –evtx –ruleset –auditd
python3 zircolite.py –evtx auditd.log –ruleset rules/rules_linux.json –auditd
Sysmon for Linux logs
python3 zircolite.py –evtx –ruleset –sysmon4linux
python3 zircolite.py –evtx auditd.log –ruleset rules/rules_linux.json –sysmon4linux
JSONL/NDJSON files
python3 zircolite.py –evtx –ruleset rules/rules_windows_sysmon.json –jsononly
Download
___________________________
@hacking_Attack
@Hacking_Video
Zircolite : A Standalone SIGMA-based Detection Tool For EVTX, Auditd And Sysmon For Linux Logs
Zircolite is a standalone tool written in Python 3. It allows to use SIGMA rules on MS Windows EVTX (EVTX and JSONL format), Auditd logs and Sysmon for Linux logs
* Zircolite can be used directly on the investigated endpoint (use releases) or in your forensic/detection lab
* Zircolite is fast and can parse large datasets in just seconds (check benchmarks)
Zircolite can be used directly in Python or you can use the binaries provided in releases (Microsoft Windows and Linux only). Documentation is here.
Requirements / Installation
You can install dependencies with :
pip3 install -r requirements.txtThe use of evtx_dump is optional but required by default (because it is for now much faster), If you do not want to use it you have to use the
--noexternaloption. The tool is provided if you clone the Zircolite repository (the official repository is here).Quick start
EVTX files
Help is available with
zircolite.py -h. If your EVTX files have the extension “.evtx” python3 zircolite.py –evtx –ruleset
python3 zircolite.py –evtx sysmon.evtx –ruleset rules/rules_windows_sysmon.json
The SYSMON ruleset used here is a default one and it is for logs coming from endpoints where SYSMON installed. A generic ruleset is available too.
Auditd logs
python3 zircolite.py –evtx –ruleset –auditd
python3 zircolite.py –evtx auditd.log –ruleset rules/rules_linux.json –auditd
Sysmon for Linux logs
python3 zircolite.py –evtx –ruleset –sysmon4linux
python3 zircolite.py –evtx auditd.log –ruleset rules/rules_linux.json –sysmon4linux
JSONL/NDJSON files
python3 zircolite.py –evtx –ruleset rules/rules_windows_sysmon.json –jsononly
Download
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
Zircolite : A Standalone SIGMA-based Detection Tool For EVTX
Zircolite is a standalone tool written in Python 3. It allows to use SIGMA rules on MS Windows EVTX , Auditd logs and Sysmon for Linux logs
How I found my first ever XSS on a website.
So, I have been into web hacking lately. While into it, I have explored bug bounties but never found a bug in real website. I have tested…Continue reading on Medium »
Read more...
So, I have been into web hacking lately. While into it, I have explored bug bounties but never found a bug in real website. I have tested…Continue reading on Medium »
Read more...
hacking: security in practice
Can someone get data from Eventbrite and upload into my database?
Hi, I am looking for some help if you could scrap events from Eventbrite with following filters
City, Free, Online
And then import that data into my SQL database.
Is there a tool available to do that? Or anyone has build any open-source tool? Or someone provides this service?
submitted by /u/harshalone
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Can someone get data from Eventbrite and upload into my database?
Hi, I am looking for some help if you could scrap events from Eventbrite with following filters
City, Free, Online
And then import that data into my SQL database.
Is there a tool available to do that? Or anyone has build any open-source tool? Or someone provides this service?
submitted by /u/harshalone
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Can someone get data from Eventbrite and upload into my database?
Hi, I am looking for some help if you could scrap events from Eventbrite with following filters City, Free, Online And then import that data...
hacking: security in practice
Reverse engineering raspberrypi bootcode.bin in order to understand an OS problem? How to?
I was trying to boot RTEMS for raspberry pi but the case the is, the firmware after the git tag 1.20200601 does not work but prior to that, everything works. I'm new to reverse engineering, I tried binwalk, got nothing. Used ghidra, found somewhat relevent things but not everything. anyone like to share anything about that?
submitted by /u/elecanic
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Reverse engineering raspberrypi bootcode.bin in order to understand an OS problem? How to?
I was trying to boot RTEMS for raspberry pi but the case the is, the firmware after the git tag 1.20200601 does not work but prior to that, everything works. I'm new to reverse engineering, I tried binwalk, got nothing. Used ghidra, found somewhat relevent things but not everything. anyone like to share anything about that?
submitted by /u/elecanic
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Reverse engineering raspberrypi bootcode.bin in order to...
I was trying to boot RTEMS for raspberry pi but the case the is, the firmware after the git tag 1.20200601 does not work but prior to that,...
How to find & access Admin Panel by digging into JS files…
https://medium.com/@ratnadip1998/how-to-find-access-admin-panel-by-digging-into-js-files-282d89391a2d?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@ratnadip1998/how-to-find-access-admin-panel-by-digging-into-js-files-282d89391a2d?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
How to find & access Admin Panel by digging into JS files…🥰
Hello All,🙂
Hello All,🙂Continue reading on Medium » (https://medium.com/@ratnadip1998/how-to-find-access-admin-panel-by-digging-into-js-files-282d89391a2d?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
How to find & access Admin Panel by digging into JS files…🥰
Hello All,🙂