Cryptography a Foundation of Cyber Security. (Part-2)
https://medium.com/@cybertix/cryptography-a-foundation-of-cyber-security-part-2-c888eda26659?source=rss------bug_bounty-5
https://medium.com/@cybertix/cryptography-a-foundation-of-cyber-security-part-2-c888eda26659?source=rss------bug_bounty-5
Hello everyone, Welcome back to another Blog of Cyber Security that is Cryptography a Foundation of Cyber Security. (Part-2) !!Continue reading on Medium » (https://medium.com/@cybertix/cryptography-a-foundation-of-cyber-security-part-2-c888eda26659?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
IOSSecuritySuite : iOS Platform Security And Anti-Tampering Swift Library
iOS Security Suite is an advanced and easy-to-use platform security & anti-tampering library written in pure Swift! If you are developing for iOS and you want to protect your app according to the OWASP MASVS standard, chapter v8, then this library could save you a lot of time.
What ISS detects:
* Jailbreak (even the iOS 11+ with brand new indicators!
* Attached debugger
* If an app was run in an emulator
* Common reverse engineering tools running on the device SetupThere are 4 ways you can start using IOSSecuritySuite 1. Add sourceAdd
key>LSApplicationQueriesSchemes
array>
string>cydia
string>undecimus
string>sileo
string>zbra
string>filza
string>activator
/array> How to useJailbreak detector module* The simplest method returns True/False if you just want to know if the device is jailbroken or jailed
if IOSSecuritySuite.amIJailbroken() {
print(“This device is jailbroken”)
} else {
print(“This device is not jailbroken”)
}
Verbose, if you also want to know what indicators were identified
let jailbreakStatus = IOSSecuritySuite.amIJailbrokenWithFailMessage()
if jailbreakStatus.jailbroken {
print(“This device is jailbroken”)
print(“Because: (jailbreakStatus.failMessage)”)
} else {
print(“This device is not jailbroken”)
}
The failMessage is a String containing comma-separated indicators as shown on the example below:
let jailbreakStatus = IOSSecuritySuite.amIJailbrokenWithFailedChecks()
if jailbreakStatus.jailbroken {
if (jailbreakStatus.failedChecks.contains { $0.check == .existenceOfSuspiciousFiles }) && (jailbreakStatus.failedChecks.contains { $0.check == .suspiciousFilesCanBeOpened }) {
print(“This is real jailbroken device”)
}
} Debugger detector modulelet amIDebugged: Bool = IOSSecuritySuite.amIDebugged()
Deny debugger at all
IOSSecuritySuite.denyDebugger()
Emulator detector module
let runInEmulator: Bool = IOSSecuritySuite.amIRunInEmulator() Experimental featuresRuntime hook detector modulelet amIRuntimeHooked: Bool = amIRuntimeHook(dyldWhiteList: dylds, detectionClass: SomeClass.self, selector: #selector(SomeClass.someFunction), isClassMethod: false)
Symbol hook deny module
// If we want to deny symbol hook of Swift function, we have to pass mangled name of that function
denySymbolHook(“$s10Foundation5NSLogyySS_s7CVarArg_pdtF”) // denying hooking for the NSLog function
NSLog(“Hello Symbol Hook”)
denySymbolHook(“abort”)
abort()
MSHook detector module
// Function declaration
func someFunction(takes: Int) -> Bool {
return false
}
// Defining FunctionType : @convention(thin) indicates a “thin” function reference, which uses the Swift calling convention with no special “self” or “context” parameters.
typealias FunctionType = @convention(thin) (Int) -> (Bool)
// Getting pointer address of function we want to verify
func getSwiftFunctionAddr(_ function: @escaping FunctionType) -> UnsafeMutableRawPointer {
return unsafeBitCast(function, to: Unsafe[...]
IOSSecuritySuite : iOS Platform Security And Anti-Tampering Swift Library
iOS Security Suite is an advanced and easy-to-use platform security & anti-tampering library written in pure Swift! If you are developing for iOS and you want to protect your app according to the OWASP MASVS standard, chapter v8, then this library could save you a lot of time.
What ISS detects:
* Jailbreak (even the iOS 11+ with brand new indicators!
* Attached debugger
* If an app was run in an emulator
* Common reverse engineering tools running on the device SetupThere are 4 ways you can start using IOSSecuritySuite 1. Add sourceAdd
IOSSecuritySuite/*.swiftfiles to your project 2. Setup with CocoaPodspod 'IOSSecuritySuite'3. Setup with Carthagegithub "securing/IOSSecuritySuite"4. Setup with Swift Package Manager.package(url: “https://github.com/securing/IOSSecuritySuite.git”, from: “1.5.0”) Update Info.plistAfter adding ISS to your project, you will also need to update your main Info.plist. There is a check in jailbreak detection module that uses canOpenURL(_:)method and requires specifying URLs that will be queried.key>LSApplicationQueriesSchemes
array>
string>cydia
string>undecimus
string>sileo
string>zbra
string>filza
string>activator
/array> How to useJailbreak detector module* The simplest method returns True/False if you just want to know if the device is jailbroken or jailed
if IOSSecuritySuite.amIJailbroken() {
print(“This device is jailbroken”)
} else {
print(“This device is not jailbroken”)
}
Verbose, if you also want to know what indicators were identified
let jailbreakStatus = IOSSecuritySuite.amIJailbrokenWithFailMessage()
if jailbreakStatus.jailbroken {
print(“This device is jailbroken”)
print(“Because: (jailbreakStatus.failMessage)”)
} else {
print(“This device is not jailbroken”)
}
The failMessage is a String containing comma-separated indicators as shown on the example below:
Cydia URL scheme detected, Suspicious file exists: /Library/MobileSubstrate/MobileSubstrate.dylib, Fork was able to create a new process* Verbose & filterable, if you also want to for example identify devices that were jailbroken in the past, but now are jailedlet jailbreakStatus = IOSSecuritySuite.amIJailbrokenWithFailedChecks()
if jailbreakStatus.jailbroken {
if (jailbreakStatus.failedChecks.contains { $0.check == .existenceOfSuspiciousFiles }) && (jailbreakStatus.failedChecks.contains { $0.check == .suspiciousFilesCanBeOpened }) {
print(“This is real jailbroken device”)
}
} Debugger detector modulelet amIDebugged: Bool = IOSSecuritySuite.amIDebugged()
Deny debugger at all
IOSSecuritySuite.denyDebugger()
Emulator detector module
let runInEmulator: Bool = IOSSecuritySuite.amIRunInEmulator() Experimental featuresRuntime hook detector modulelet amIRuntimeHooked: Bool = amIRuntimeHook(dyldWhiteList: dylds, detectionClass: SomeClass.self, selector: #selector(SomeClass.someFunction), isClassMethod: false)
Symbol hook deny module
// If we want to deny symbol hook of Swift function, we have to pass mangled name of that function
denySymbolHook(“$s10Foundation5NSLogyySS_s7CVarArg_pdtF”) // denying hooking for the NSLog function
NSLog(“Hello Symbol Hook”)
denySymbolHook(“abort”)
abort()
MSHook detector module
// Function declaration
func someFunction(takes: Int) -> Bool {
return false
}
// Defining FunctionType : @convention(thin) indicates a “thin” function reference, which uses the Swift calling convention with no special “self” or “context” parameters.
typealias FunctionType = @convention(thin) (Int) -> (Bool)
// Getting pointer address of function we want to verify
func getSwiftFunctionAddr(_ function: @escaping FunctionType) -> UnsafeMutableRawPointer {
return unsafeBitCast(function, to: Unsafe[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials IOSSecuritySuite : iOS Platform Security And Anti-Tampering Swift Library iOS Security Suite is an advanced and easy-to-use platform security & anti-tampering library written in pure Swift! If you are developing for iOS and you want to…
MutableRawPointer.self)
}
let funcAddr = getSwiftFunctionAddr(someFunction)
let amIMSHooked = IOSSecuritySuite.amIMSHooked(funcAddr)
File integrity verifier module
// Determine if application has been tampered with
if IOSSecuritySuite.amITampered([.bundleID(“biz.securing.FrameworkClientApp”),
.mobileProvision(“2976c70b56e9ae1e2c8e8b231bf6b0cff12bbbd0a593f21846d9a004dd181be3”),
.machO(“IOSSecuritySuite”, “6d8d460b9a4ee6c0f378e30f137cebaf2ce12bf31a2eef3729c36889158aa7fc”)]).result {
print(“I have been Tampered.”)
}
else {
print(“I have not been Tampered.”)
}
// Manually verify SHA256 hash value of a loaded dylib
if let hashValue = IOSSecuritySuite.getMachOFileHashValue(.custom(“IOSSecuritySuite”)), hashValue == “6d8d460b9a4ee6c0f378e30f137cebaf2ce12bf31a2eef3729c36889158aa7fc” {
print(“I have not been Tampered.”)
}
else {
print(“I have been Tampered.”)
}
// Check SHA256 hash value of the main executable
// Tip: Your application may retrieve this value from the server
if let hashValue = IOSSecuritySuite.getMachOFileHashValue(.default), hashValue == “your-application-executable-hash-value” {
print(“I have not been Tampered.”)
}
else {
print(“I have been Tampered.”)
} Download
}
let funcAddr = getSwiftFunctionAddr(someFunction)
let amIMSHooked = IOSSecuritySuite.amIMSHooked(funcAddr)
File integrity verifier module
// Determine if application has been tampered with
if IOSSecuritySuite.amITampered([.bundleID(“biz.securing.FrameworkClientApp”),
.mobileProvision(“2976c70b56e9ae1e2c8e8b231bf6b0cff12bbbd0a593f21846d9a004dd181be3”),
.machO(“IOSSecuritySuite”, “6d8d460b9a4ee6c0f378e30f137cebaf2ce12bf31a2eef3729c36889158aa7fc”)]).result {
print(“I have been Tampered.”)
}
else {
print(“I have not been Tampered.”)
}
// Manually verify SHA256 hash value of a loaded dylib
if let hashValue = IOSSecuritySuite.getMachOFileHashValue(.custom(“IOSSecuritySuite”)), hashValue == “6d8d460b9a4ee6c0f378e30f137cebaf2ce12bf31a2eef3729c36889158aa7fc” {
print(“I have not been Tampered.”)
}
else {
print(“I have been Tampered.”)
}
// Check SHA256 hash value of the main executable
// Tip: Your application may retrieve this value from the server
if let hashValue = IOSSecuritySuite.getMachOFileHashValue(.default), hashValue == “your-application-executable-hash-value” {
print(“I have not been Tampered.”)
}
else {
print(“I have been Tampered.”)
} Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Rip Raw : Small Tool To Analyse The Memory Of Compromised Linux Systems
Rip Raw is a small tool to analyse the memory of compromised Linux systems. It is similar in purpose to Bulk Extractor, but particularly focused on extracting system Logs from memory dumps from Linux systems. This enables you to analyse systems without needing to generate a profile.
This is not a replacement for tools such as Rekall and Volatility which use a profile to perform a more structured analysis of memory.
Rip Raw works by taking a Raw Binary such as a Memory Dump and carves files and logs using:
* Text/binary boundaries
* File headers and file magic
* Log entries
Then puts them in a zip file for secondary processing by other tools such as Cado Response or a SIEM such as Splunk (examples below).
Example
For example, after capturing the memory of an Amazon EKS ( Elastic Kubernetes Service) system compromised with a crypto-mining worm we processed it with rip_raw:
python3 rip_raw.py -f eks-node-ncat-capture.mem
And then the large zip of logs that Rip Raw outputs can be viewed in a tool such as Cado Response (below). Approximately 36500 log events were extracted from this memory image, along with a number of binaries such as images and executables.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjemk1QpFpb8nkq1eet0U6zpI9YLF_8jxNJ8gwbmvjEkp4DVOekWN5cv54_b__wWiGGO5diuWPH9l2jVfBDSLZl2io5wtTXXgSX2eiuTMWl8wfnzkIOkGkgLnMPWQVTfPoej5lvmXRx8FX6g9anJbDWuReW0bM8PB2clP9HxFp4PYg69JUHeKSf-77G/s2495/1%20(2).png
Or Splunk:
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjEoiRuuGeGtw4w2UJHvSIBlUZinRpelsHL0S6u5XZsS1uAU3fhdzK7JDjbE73Wvq_lWLedLECmOGj3zPUTu_PklL_cy8jImZB5QjOC8p0VYl5Ng34APgPJVpmOPOcHZvZCal-2a9ue7K6YtkL37Y-TwcCU0nFG3BtA0oO4rf04nmayPzbeKvZSvdx/s2512/2%20(1).png
Download
Rip Raw : Small Tool To Analyse The Memory Of Compromised Linux Systems
Rip Raw is a small tool to analyse the memory of compromised Linux systems. It is similar in purpose to Bulk Extractor, but particularly focused on extracting system Logs from memory dumps from Linux systems. This enables you to analyse systems without needing to generate a profile.
This is not a replacement for tools such as Rekall and Volatility which use a profile to perform a more structured analysis of memory.
Rip Raw works by taking a Raw Binary such as a Memory Dump and carves files and logs using:
* Text/binary boundaries
* File headers and file magic
* Log entries
Then puts them in a zip file for secondary processing by other tools such as Cado Response or a SIEM such as Splunk (examples below).
Example
For example, after capturing the memory of an Amazon EKS ( Elastic Kubernetes Service) system compromised with a crypto-mining worm we processed it with rip_raw:
python3 rip_raw.py -f eks-node-ncat-capture.mem
And then the large zip of logs that Rip Raw outputs can be viewed in a tool such as Cado Response (below). Approximately 36500 log events were extracted from this memory image, along with a number of binaries such as images and executables.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjemk1QpFpb8nkq1eet0U6zpI9YLF_8jxNJ8gwbmvjEkp4DVOekWN5cv54_b__wWiGGO5diuWPH9l2jVfBDSLZl2io5wtTXXgSX2eiuTMWl8wfnzkIOkGkgLnMPWQVTfPoej5lvmXRx8FX6g9anJbDWuReW0bM8PB2clP9HxFp4PYg69JUHeKSf-77G/s2495/1%20(2).png
Or Splunk:
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjEoiRuuGeGtw4w2UJHvSIBlUZinRpelsHL0S6u5XZsS1uAU3fhdzK7JDjbE73Wvq_lWLedLECmOGj3zPUTu_PklL_cy8jImZB5QjOC8p0VYl5Ng34APgPJVpmOPOcHZvZCal-2a9ue7K6YtkL37Y-TwcCU0nFG3BtA0oO4rf04nmayPzbeKvZSvdx/s2512/2%20(1).png
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Osinteye : Username Enumeration And Reconnaisance Suite
Osinteye is a tool used for Username enumeration & reconnaisance suite.
Supported sites
* PyPI
* Github
* TestPypi
* About.me
* Instagram
* DockerHub
Installation
Clone project:
$ git clone https://github.com/rly0nheart/osinteye.git
$ cd osinteye
$ pip install -r requirements.txt
Usage
$ python osinteye [–SITENAME] [USERNAME]
Or give osintEye execution permission:
$ chmod +x osinteye
$ ./osinteye [–SITENAME] [USERNAME]
Example 1.1;
$ python osinteye –instagram [USERNAME]
Example 1.2;
$ ./osinteye –instagram [USERNAME]
Optional Arguments
FlagUsage
Download
Osinteye : Username Enumeration And Reconnaisance Suite
Osinteye is a tool used for Username enumeration & reconnaisance suite.
Supported sites
* PyPI
* Github
* TestPypi
* About.me
* DockerHub
Installation
Clone project:
$ git clone https://github.com/rly0nheart/osinteye.git
$ cd osinteye
$ pip install -r requirements.txt
Usage
$ python osinteye [–SITENAME] [USERNAME]
Or give osintEye execution permission:
$ chmod +x osinteye
$ ./osinteye [–SITENAME] [USERNAME]
Example 1.1;
$ python osinteye –instagram [USERNAME]
Example 1.2;
$ ./osinteye –instagram [USERNAME]
Optional Arguments
FlagUsage
--pypiget target’s information from pypi--testpypiget target’s information from testpypi--aboutget target’s information from about.me--instagramget target’s information from instagram--githubget target’s information from github--dockerhubget target’s information from dockerhub-v/--verboseenable verbosity (returns network logs, errors and warnings)--versionshow program’s version number and exit Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Lupo : Malware IOC Extractor. Debugging Module For Malware Analysis Automation
Lupo is a Debugging module for Malware Analysis Automation.
Working on security incidents that involve malware, we come across situations on a regular basis where we feel the need to automate parts of the analysis process as complete manual analysis is, more often than not, not possible for every case due to many factors (time, skills, scale etc.).
I wrote Lupo mainly to automate and accelerate the process as much as possible. Lupo is a dynamic analysis tool that can be used as a module with the debugger. The first version works with the popular Windows Debugger — WinDbg. I’ll release versions for other debuggers in the future.
The way the tool works is pretty straight forward. You load Lupo into the debugger and then execute it. It runs through the malware and collects predefined IOC and writes them to a text file on the disk. You can then use this information to contain and neutralise malware campaigns or simply respond to the security incident that you are working on.
Lupo — the tool
I’ll give some more details on the tool itself but not too much to the inner workings of it, at least not here. We need to keep in mind that the malware authors are smart enough to quickly tweak the code to create problems for us!
The tool is written in C++ and uses the Windows Debugging framework to execute the code. It can be used with WinDbg as a ‘plugin’ in order to help automate the analysis process.
If you want to know more about the tool, feel free to contact me or comment below.
Download
Download all the DLLs from this repo. You also need all the VC++ dependencies, the easiest way to do that is to install Visual Studio (Community version works) and select all the C++ components.
Usage
Using the tool is very easy. It works in this way:
Save the Lupo extension in your extensions dir (default: sdk\samples\exts subdirectory of the installation directory). You can also define the extensions path by using the command ‘.extpath[+] [Directory[;…]]’.
Start the debugger
Attach the process to be debugged (malware in this case)
Load Lupo using the ‘.load’ command.
Execute Lupo by using this command: ‘lupo.go’
All results will be displayed in the console and also written to a new textfile on the disk. Path and name of this textfile will be displayed in console as well. All done!
You can optionally use the results from Lupo with this other tool that I wrote — Ragno, to advance your research and response by aggregating OSINT for the wider footprint of the campaign you are possibly dealing with. You can read about Ragno in another post here: https://medium.com/@vishal_thakur/introducing-ragno-ioc-multiplier-9b75834353bb
Download
Lupo : Malware IOC Extractor. Debugging Module For Malware Analysis Automation
Lupo is a Debugging module for Malware Analysis Automation.
Working on security incidents that involve malware, we come across situations on a regular basis where we feel the need to automate parts of the analysis process as complete manual analysis is, more often than not, not possible for every case due to many factors (time, skills, scale etc.).
I wrote Lupo mainly to automate and accelerate the process as much as possible. Lupo is a dynamic analysis tool that can be used as a module with the debugger. The first version works with the popular Windows Debugger — WinDbg. I’ll release versions for other debuggers in the future.
The way the tool works is pretty straight forward. You load Lupo into the debugger and then execute it. It runs through the malware and collects predefined IOC and writes them to a text file on the disk. You can then use this information to contain and neutralise malware campaigns or simply respond to the security incident that you are working on.
Lupo — the tool
I’ll give some more details on the tool itself but not too much to the inner workings of it, at least not here. We need to keep in mind that the malware authors are smart enough to quickly tweak the code to create problems for us!
The tool is written in C++ and uses the Windows Debugging framework to execute the code. It can be used with WinDbg as a ‘plugin’ in order to help automate the analysis process.
If you want to know more about the tool, feel free to contact me or comment below.
Download
Download all the DLLs from this repo. You also need all the VC++ dependencies, the easiest way to do that is to install Visual Studio (Community version works) and select all the C++ components.
Usage
Using the tool is very easy. It works in this way:
Save the Lupo extension in your extensions dir (default: sdk\samples\exts subdirectory of the installation directory). You can also define the extensions path by using the command ‘.extpath[+] [Directory[;…]]’.
Start the debugger
Attach the process to be debugged (malware in this case)
Load Lupo using the ‘.load’ command.
Execute Lupo by using this command: ‘lupo.go’
All results will be displayed in the console and also written to a new textfile on the disk. Path and name of this textfile will be displayed in console as well. All done!
You can optionally use the results from Lupo with this other tool that I wrote — Ragno, to advance your research and response by aggregating OSINT for the wider footprint of the campaign you are possibly dealing with. You can read about Ragno in another post here: https://medium.com/@vishal_thakur/introducing-ragno-ioc-multiplier-9b75834353bb
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
NO RATE LIMIT IN JUST 5 MIN
https://cdn-images-1.medium.com/max/611/1*CXJWEecINhvjKZM8kYA2dg.jpeg
Hii all my name is Milan jain and i am a bug bounty hunter !! recently i got 250$ bounty .but before 1 month ago i got my first Hall of…
Continue reading on Medium »
NO RATE LIMIT IN JUST 5 MIN
https://cdn-images-1.medium.com/max/611/1*CXJWEecINhvjKZM8kYA2dg.jpeg
Hii all my name is Milan jain and i am a bug bounty hunter !! recently i got 250$ bounty .but before 1 month ago i got my first Hall of…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Command Challenge (bash)
https://cdn-images-1.medium.com/max/1141/1*7FtlsXOEWQ3t-yE5g1-hYQ.png
The CMD CHALLENGE Directed Project is a cool game that challenges you in Bash skills. Everything is done through the command line, and the…
Continue reading on Medium »
Command Challenge (bash)
https://cdn-images-1.medium.com/max/1141/1*7FtlsXOEWQ3t-yE5g1-hYQ.png
The CMD CHALLENGE Directed Project is a cool game that challenges you in Bash skills. Everything is done through the command line, and the…
Continue reading on Medium »