Kali Linux Tutorials
Zircolite : A Standalone SIGMA-based Detection Tool For EVTX, Auditd And Sysmon For Linux Logs

Zircolite is a standalone tool written in Python 3. It allows to use SIGMA rules on MS Windows EVTX (EVTX and JSONL format), Auditd logs and Sysmon for Linux logs

* Zircolite can be used directly on the investigated endpoint (use releases) or in your forensic/detection lab
* Zircolite is fast and can parse large datasets in just seconds (check benchmarks)

Zircolite can be used directly in Python or you can use the binaries provided in releases (Microsoft Windows and Linux only). Documentation is here.

Requirements / Installation

You can install dependencies with : pip3 install -r requirements.txt

The use of evtx_dump is optional but required by default (because it is for now much faster), If you do not want to use it you have to use the --noexternaloption. The tool is provided if you clone the Zircolite repository (the official repository is here).

Quick start

EVTX files

Help is available with zircolite.py -h. If your EVTX files have the extension “.evtx”

python3 zircolite.py –evtx –ruleset
python3 zircolite.py –evtx sysmon.evtx –ruleset rules/rules_windows_sysmon.json

The SYSMON ruleset used here is a default one and it is for logs coming from endpoints where SYSMON installed. A generic ruleset is available too.

Auditd logs

python3 zircolite.py –evtx –ruleset –auditd
python3 zircolite.py –evtx auditd.log –ruleset rules/rules_linux.json –auditd

Sysmon for Linux logs

python3 zircolite.py –evtx –ruleset –sysmon4linux
python3 zircolite.py –evtx auditd.log –ruleset rules/rules_linux.json –sysmon4linux

JSONL/NDJSON files

python3 zircolite.py –evtx –ruleset rules/rules_windows_sysmon.json –jsononly
Download

___________________________
@hacking_Attack
@Hacking_Video

How I found my first ever XSS on a website.

So, I have been into web hacking lately. While into it, I have explored bug bounties but never found a bug in real website. I have tested…Continue reading on Medium »
Read more...

hacking: security in practice
Can someone get data from Eventbrite and upload into my database?

Hi, I am looking for some help if you could scrap events from Eventbrite with following filters

City, Free, Online

And then import that data into my SQL database.

Is there a tool available to do that? Or anyone has build any open-source tool? Or someone provides this service?

submitted by /u/harshalone
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Reverse engineering raspberrypi bootcode.bin in order to understand an OS problem? How to?

I was trying to boot RTEMS for raspberry pi but the case the is, the firmware after the git tag 1.20200601 does not work but prior to that, everything works. I'm new to reverse engineering, I tried binwalk, got nothing. Used ghidra, found somewhat relevent things but not everything. anyone like to share anything about that?

submitted by /u/elecanic
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How to find & access Admin Panel by digging into JS files…
https://medium.com/@ratnadip1998/how-to-find-access-admin-panel-by-digging-into-js-files-282d89391a2d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello All,🙂Continue reading on Medium » (https://medium.com/@ratnadip1998/how-to-find-access-admin-panel-by-digging-into-js-files-282d89391a2d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

PersistBOF - Tool To Help Automate Common Persistence Mechanisms
http://www.kitploit.com/2022/05/persistbof-tool-to-help-automate-common.html

___________________________
@hacking_Attack
@Hacking_Video

A tool to help automate common persistence mechanisms. Currently supports Print Monitor (SYSTEM), Time Provider (Network Service), Start folder shortcut hijacking (https://www.kitploit.com/search/label/Hijacking) (User), and Junction Folder (User)
Usage Clone, run make, add .cna to Cobalt Strike (https://www.kitploit.com/search/label/Cobalt%20Strike) client. run: help persist-ice in CS console Syntax: persist-ice [PrintMon, TimeProv, Shortcut, Junction] [persist or clean] [key/folder name] [dll / lnk exe name]; Technique Overview All of these techniques rely on a Dll file to be seperately placed on disk. It is intentially not part of the BOF. Print Monitor The Dll MUST be on disk and in a location in PATH (Dll search order) BEFORE you run the BOF. It will fail otherwise. The Dll will immediately be loaded by spoolsv.exe as SYSTEM. This can be used to elevate from admin to SYSTEM as well as for persistence. Will execute on system startup. Must be elevated to run. Demo Print Monitor Dll in project Example: upload NotMalware.dll to C:\Windows\NotMalware.dll persist-ice PrintMon persist TotesLegitMonitor NotMalware.dll Immediately executes as SYSTEM Will execute on startup until removed persist-ice PrintMon clean TotesLegitMonitor C:\Windows\NotMalware.dll > Will delete the registery keys and unload the Dll, then attempt to delete the dll if provided the correct path. Should succeed. Time Provider Loaded by svchost.exe as NETWORK SERVICE (get your potatoes ready!) on startup after running the BOF. Must be elevated to run. Demo Time Provider Dll in project Example: persist-ice TimeProv persist TotesLegitTimeProvider C:\anywhere\NotMalware.dll persist-ice TimeProv cleanup TotesLegitTimeProvider C:\anywhere\NotMalware.dll > Will delete the registry (https://www.kitploit.com/search/label/Registry) keys and attempt to delete the dll if provided the correct path. Will probably fail because the dll is not unloaded by the process. Junction Folder Same technique as demonstrated in Vault 7 leaks. Executed on user login. Non-elevated. Dll will be loaded into explorer.exe Example: persist-ice Juction persist TotesLegitFolder C:\user-writable-folder\NotMalware.dll Save CLSID persist-ice Juction clean TotesLegitFolder C:\user-writable-folder\NotMalware.dll 6be5e092-90cc-452d-be83-208029e259e0 > Will delete the registry keys, junction folder, and attempt to delete the dll. Start Folder Hijack Create a new, user writeable folder, copy a hijackable windows (https://www.kitploit.com/search/label/Windows) binary (https://www.kitploit.com/search/label/Binary) to the folder, then create a shortcut in the startup folder. Executed on user login. Non-elevated. Example: persist-ice Shortcut persist C:\TotesLegitFolder C:\Windows\System32\Dism.exe > upload your Dll as a proxy dll to dismcore.dll into C:\TotesLegitFolder persist-ice Shortcut persist C:\TotesLegitFolder C:\Windows\System32\Dism.exe > Will attempt delete all files in new folder then delete the folder itself. If the Dll is still loaded in the process then this will fail. References https://stmxcsr.com/persistence/print-monitor.html https://stmxcsr.com/persistence/time-provider.html https://pentestlab.blog/2019/10/28/persistence-port-monitors/ https://blog.f-secure.com/hunting-for-junction-folder-persistence/ https://attack.mitre.org/techniques/T1547/010/ https://attack.mitre.org/techniques/T1547/003/ https://attack.mitre.org/techniques/T1547/009/

Download PersistBOF (https://github.com/IcebreakerSecurity/PersistBOF)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to find & access Admin Panel by digging into JS files…

https://cdn-images-1.medium.com/max/1206/0*gWmf1S7O7TT5Ctt3.jpeg
Hello All,🙂

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Indian Hackers are being hired by the Israeli Private Detective Service for Russian Oligarchs!

https://cdn-images-1.medium.com/max/640/0*LSo_3bDCLpCMSv2q.jpg
The Israeli Private Detective used Indian hackers!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top 5 Hacking Book , Must Read !!

https://cdn-images-1.medium.com/max/800/1*BNbCYjofq0JDtmslfaMkkg.jpeg
A Hacking and cybersecurity books guide which tells you about top 10 Hacking books .

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Uma dádiva dos espiões

https://cdn-images-1.medium.com/max/2600/1*Z_Jq9G9xYAqAwLYff4Ztbw.jpeg
Quantas pessoas já pensaram sobre estarem sendo espionadas sem o seu consentimento?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack Hydra co-owner’s crypto wallet

https://cdn-images-1.medium.com/max/2000/0*JlRgk-mMgani_P0J.jpg
A Moscow court can confiscate a record amount for Russia from a drug dealer’s crypto wallet, but he does not give the password. We are…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video