Hacking Articles Tips Tricks Videos Tutorials

Hacking on Medium
5 Ways to Avoid Becoming a Victim of Online Identity Theft

It seems nearly everyone is online these days, and for many of us the internet is an endlessly fascinating place where the hours disappear…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

5 Ways to Avoid Becoming a Victim of Online Identity Theft

It seems nearly everyone is online these days, and for many of us the internet is an endlessly fascinating place where the hours disappear…

5 viewsedited 14:37

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
How can I get a hacker to hack my wife’s cellphone? I think she’s cheating on me.

https://cdn-images-1.medium.com/max/626/0*PXtiDFkNHgg4MGXo
Thehackerspro is a professional in hacking cellphones, they have lots of experience in this area. the American forensic firm can help you…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

How can I get a hacker to hack my wife’s cellphone? I think she’s cheating on me.

Thehackerspro is a professional in hacking cellphones, they have lots of experience in this area. the American forensic firm can help you…

6 viewsedited 14:37

Hacking Articles Tips Tricks Videos Tutorials

6 views14:56

Hacking Articles Tips Tricks Videos Tutorials

Photo

KitPloit - PenTest Tools!
Sentinel-Attack - Tools To Rapidly Deploy A Threat Hunting Capability On Azure Sentinel That Leverages Sysmon And MITRE ATT&CK

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjErDq3k0g5VYU6wIt_cot2_j9eEsaWyCFgBVhgnpg7b-6tv5CI8Au3BU-VhJer-v3xPewlJdy0aJdwRmI2M0ugp_UP0iZAA9cptkK-3IVz6I6weJGbkQBlnYHKUsQ8YTDM5_AakBiBkZLkEQCwxlMZJaQsFRCQhr3NC0bqgcnmC2ZKEXT_aGZlG9rE/s16000/sentinel-attack_1_logo.png Sentinel ATT&CK aims to simplify the rapid deployment of a threat hunting capability that leverages Sysmon and MITRE ATT&CK on Azure Sentinel.

DISCLAIMER: This tool requires tuning and investigative trialling to be truly effective in a production environment. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgcNKdHs6efdMp1_GkOPBeDjS_cBKsguCHqtRl5YqGN2qaHgJ9kablCagk9TN6pqDB4zQrMo_65oucXswwH9AU2Ns1Kl66RBa8qDAQOFA93k2e-Xmk33lpT2qdGzhaLWlOm7yggwsdtmtCi60wnUoSncTJSSFxFoLEmPScJJICXIkwpXMFPZj8ARYJ8/w640-h286/sentinel-attack_8_demo.gif OverviewSentinel ATT&CK provides the following tools:

* An ARM template to automatically deploy Sentinel ATT&CK to your Azure environment
* A Sysmon configuration file compatible with Azure Sentinel and mapped to specific ATT&CK techniques
* A Sysmon log parser mapped against the OSSEM data model
* 117 ready-to-use Kusto detection rules covering 156 ATT&CK techniques
* A Sysmon threat hunting workbook inspired by the Threat Hunting App for Splunk to help simplify threat hunts
* A Terraform script to provision a lab to test Sentinel ATT&CK
* Comprehensive guidance to help you use the materials in this repository UsageHead over to the WIKI to learn how to deploy and run Sentinel ATT&CK.

A copy of the DEF CON 27 cloud village presentation introducing Sentinel ATT&CK can be found here and here. ContributingAs this repository is constantly being updated and worked on, if you spot any problems we warmly welcome pull requests or submissions on the issue tracker. Authors and contributorsSentinel ATT&CK is built with <3

* Edoardo Gerosa

Special thanks go to the following contributors:

* Olaf Hartong
* Ashwin Patil
* Mor Shabi
* Adrian Corona Download Sentinel-Attack

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Sentinel-Attack - Tools To Rapidly Deploy A Threat Hunting Capability On Azure Sentinel That Leverages Sysmon And MITRE ATT&CK

7 viewsedited 14:56

Hacking Articles Tips Tricks Videos Tutorials

9 views15:06

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
Ecapture : Capture SSL/TLS Text Content Without CA Cert By eBPF

eCapture is a tool to capture SSL/TLS text content without CA cert Using eBPF.How eCapture workshttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyqHl3BxOoNkTlX0Bdgt5F7ceNM_kEZ5vU52rwVaXetgdvZq9FU4R467ZhGsy2OkTOArTVeRWnl1nwhjKk6otyC5Eg8XCnCpMKW0yV5OBsMlzcXfpIfBlMpT6LB78bZSCcOH45h_JO-AsZDha7a7glA8iYbDMNFgHM0Lo_k6vddKmdTss6CMTjnHgo/s1333/16.png
* SSL/TLS text context capture, support openssl\libressl\boringssl\gnutls\nspr(nss) libraries.
* bash audit, capture bash command for Host Security Audit.
* mysql query SQL audit, support mysqld 5.6\5.7\8.0, and mariadDB. eCapture Architecurehttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdiqmWAKH3urE_DuRs_TcPpjh3IyA3uGxurega8lMJ_LHoOy5KZAdy72_KN2AsBECT-gbTkEqALzd0QQRE8VDEkxC3RhN1t5vZJ7dJVjGGrK9JMJmVskV0G2xpEO0C-ZicdVhwObkgt7sQbdwg-7s3D7okFnjk7caoZszp44h9eJrXujD_fpr8G9ek/s1200/ecapture-architecture.png Getting starteduse ELF binary fileDownload ELF zip file release , unzip and use by command ./ecapture --help.

* Linux kernel version >= 4.18
* Enable BTF BPF Type Format (BTF) (Optional, 2022-04-17) check your server BTF configcfc4n@vm-server:~$# uname -r
4.18.0-305.3.1.el8.x86_64
cfc4n@vm-server:~$# cat /boot/config-uname -r | grep CONFIG_DEBUG_INFO_BTF
CONFIG_DEBUG_INFO_BTF=y tls commandcapture tls text context. Step 1:

./ecapture tls –hex

Step 2:

curl https://github.com libressl&boringsslfor installed libressl, libssl.so.52 is the dynamic ssl lib
vm@vm-server:~$ ldd /usr/local/bin/openssl
linux-vdso.so.1 (0x00007ffc82985000)
libssl.so.52 => /usr/local/lib/libssl.so.52 (0x00007f1730f9f000)
libcrypto.so.49 => /usr/local/lib/libcrypto.so.49 (0x00007f1730d8a000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f1730b62000)
/lib64/ld-linux-x86-64.so.2 (0x00007f17310b2000)
use the libssl to config the libssl.so path
vm@vm-server:~$ sudo ./ecapture tls –libssl=”/usr/local/lib/libssl.so.52″ –hex
in another terminal, use the command, then type some string, watch the output of ecapture
vm@vm-server:~$ /usr/local/bin/openssl s_client -connect github.com:443
for installed boringssl, usage is the same
/path/to/bin/bssl s_client -connect github.com:443 bash commandcapture bash command.

ps -ef | grep foo uprobe HOOKopenssl\libressl\boringssl hookeCapture hookSSL_write \ SSL_readfunction of shared library /lib/x86_64-linux-gnu/libssl.so.1.1. get text context, and send message to user space by eBPF maps.

Probes: []manager.Probe{ { Section: “uprobe/SSL_write”, EbpfFuncName: “probe_entry_SSL_write”, AttachToFuncName: “SSL_write”, //UprobeOffset: 0x386B0, BinaryPath: “/lib/x86_64-linux-gnu/libssl.so.1.1”, }, { Section: “uretprobe/SSL_write”, EbpfFuncName: “probe_ret_SSL_write”, AttachToFuncName: “SSL_write”, //UprobeOffset: 0x386B0, BinaryPath: “/lib/x86_64-linux-gnu/libssl.so.1.1”, }, { Section: “uprobe/SSL_read”, EbpfFuncName: “probe_entry_SSL_read”, AttachToFuncName: “SSL_read”, //UprobeOffset: 0x38380, BinaryPath: “/lib/x86_64-linux-gnu/libssl.so.1.1”, }, { Section: “uretprobe/SSL_read”, EbpfFuncName: “probe_ret_SSL_read”, AttachToFuncName: “SSL_read”, //UprobeOffset: 0x38380, BinaryPath: “/lib/x86_64-linux-gnu/libssl.so.1.1”, }, /*/
}, bash readline.so hookhook /bin/bashsymbol name readline. How to compileLinux Kernel: >= 4.18. Tools* golang 1.16
* clang 9.0.0
* cmake 3.18.4
* clang backend: llvm 9.0.0
* kernel config:CONFIG_DEBUG_INFO_BTF=y (Optional, 2022-04-17) commandgit clone git@github.com:ehids/ecapture.git
cd ecapture
make
bin/ecapture –help compile without BTFeCapture support NO BTF with command make nocoreto compile on 2022/04/17.

make nocore
bin/ecapture –help Download
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Ecapture : Capture SSL/TLS Text Content Without CA Cert By eBPF

eCapture is a tool to capture SSL/TLS text content without CA cert Using eBPF. SSL/TLS text context capture, support openssllibressl.

8 viewsedited 15:06

Hacking Articles Tips Tricks Videos Tutorials

Aurora Inflation Spend Bugfix Review: $6m Payout

SummaryContinue reading on Immunefi »
Read more...

8 views15:28

About

Blog

Apps

Platform