Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Rip Raw : Small Tool To Analyse The Memory Of Compromised Linux Systems
Rip Raw is a small tool to analyse the memory of compromised Linux systems. It is similar in purpose to Bulk Extractor, but particularly focused on extracting system Logs from memory dumps from Linux systems. This enables you to analyse systems without needing to generate a profile.
This is not a replacement for tools such as Rekall and Volatility which use a profile to perform a more structured analysis of memory.
Rip Raw works by taking a Raw Binary such as a Memory Dump and carves files and logs using:
* Text/binary boundaries
* File headers and file magic
* Log entries
Then puts them in a zip file for secondary processing by other tools such as Cado Response or a SIEM such as Splunk (examples below).
Example
For example, after capturing the memory of an Amazon EKS ( Elastic Kubernetes Service) system compromised with a crypto-mining worm we processed it with rip_raw:
python3 rip_raw.py -f eks-node-ncat-capture.mem
And then the large zip of logs that Rip Raw outputs can be viewed in a tool such as Cado Response (below). Approximately 36500 log events were extracted from this memory image, along with a number of binaries such as images and executables.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjemk1QpFpb8nkq1eet0U6zpI9YLF_8jxNJ8gwbmvjEkp4DVOekWN5cv54_b__wWiGGO5diuWPH9l2jVfBDSLZl2io5wtTXXgSX2eiuTMWl8wfnzkIOkGkgLnMPWQVTfPoej5lvmXRx8FX6g9anJbDWuReW0bM8PB2clP9HxFp4PYg69JUHeKSf-77G/s2495/1%20(2).png
Or Splunk:
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjEoiRuuGeGtw4w2UJHvSIBlUZinRpelsHL0S6u5XZsS1uAU3fhdzK7JDjbE73Wvq_lWLedLECmOGj3zPUTu_PklL_cy8jImZB5QjOC8p0VYl5Ng34APgPJVpmOPOcHZvZCal-2a9ue7K6YtkL37Y-TwcCU0nFG3BtA0oO4rf04nmayPzbeKvZSvdx/s2512/2%20(1).png
Download
Rip Raw : Small Tool To Analyse The Memory Of Compromised Linux Systems
Rip Raw is a small tool to analyse the memory of compromised Linux systems. It is similar in purpose to Bulk Extractor, but particularly focused on extracting system Logs from memory dumps from Linux systems. This enables you to analyse systems without needing to generate a profile.
This is not a replacement for tools such as Rekall and Volatility which use a profile to perform a more structured analysis of memory.
Rip Raw works by taking a Raw Binary such as a Memory Dump and carves files and logs using:
* Text/binary boundaries
* File headers and file magic
* Log entries
Then puts them in a zip file for secondary processing by other tools such as Cado Response or a SIEM such as Splunk (examples below).
Example
For example, after capturing the memory of an Amazon EKS ( Elastic Kubernetes Service) system compromised with a crypto-mining worm we processed it with rip_raw:
python3 rip_raw.py -f eks-node-ncat-capture.mem
And then the large zip of logs that Rip Raw outputs can be viewed in a tool such as Cado Response (below). Approximately 36500 log events were extracted from this memory image, along with a number of binaries such as images and executables.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjemk1QpFpb8nkq1eet0U6zpI9YLF_8jxNJ8gwbmvjEkp4DVOekWN5cv54_b__wWiGGO5diuWPH9l2jVfBDSLZl2io5wtTXXgSX2eiuTMWl8wfnzkIOkGkgLnMPWQVTfPoej5lvmXRx8FX6g9anJbDWuReW0bM8PB2clP9HxFp4PYg69JUHeKSf-77G/s2495/1%20(2).png
Or Splunk:
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjEoiRuuGeGtw4w2UJHvSIBlUZinRpelsHL0S6u5XZsS1uAU3fhdzK7JDjbE73Wvq_lWLedLECmOGj3zPUTu_PklL_cy8jImZB5QjOC8p0VYl5Ng34APgPJVpmOPOcHZvZCal-2a9ue7K6YtkL37Y-TwcCU0nFG3BtA0oO4rf04nmayPzbeKvZSvdx/s2512/2%20(1).png
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Osinteye : Username Enumeration And Reconnaisance Suite
Osinteye is a tool used for Username enumeration & reconnaisance suite.
Supported sites
* PyPI
* Github
* TestPypi
* About.me
* Instagram
* DockerHub
Installation
Clone project:
$ git clone https://github.com/rly0nheart/osinteye.git
$ cd osinteye
$ pip install -r requirements.txt
Usage
$ python osinteye [–SITENAME] [USERNAME]
Or give osintEye execution permission:
$ chmod +x osinteye
$ ./osinteye [–SITENAME] [USERNAME]
Example 1.1;
$ python osinteye –instagram [USERNAME]
Example 1.2;
$ ./osinteye –instagram [USERNAME]
Optional Arguments
FlagUsage
Download
Osinteye : Username Enumeration And Reconnaisance Suite
Osinteye is a tool used for Username enumeration & reconnaisance suite.
Supported sites
* PyPI
* Github
* TestPypi
* About.me
* DockerHub
Installation
Clone project:
$ git clone https://github.com/rly0nheart/osinteye.git
$ cd osinteye
$ pip install -r requirements.txt
Usage
$ python osinteye [–SITENAME] [USERNAME]
Or give osintEye execution permission:
$ chmod +x osinteye
$ ./osinteye [–SITENAME] [USERNAME]
Example 1.1;
$ python osinteye –instagram [USERNAME]
Example 1.2;
$ ./osinteye –instagram [USERNAME]
Optional Arguments
FlagUsage
--pypiget target’s information from pypi--testpypiget target’s information from testpypi--aboutget target’s information from about.me--instagramget target’s information from instagram--githubget target’s information from github--dockerhubget target’s information from dockerhub-v/--verboseenable verbosity (returns network logs, errors and warnings)--versionshow program’s version number and exit Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Lupo : Malware IOC Extractor. Debugging Module For Malware Analysis Automation
Lupo is a Debugging module for Malware Analysis Automation.
Working on security incidents that involve malware, we come across situations on a regular basis where we feel the need to automate parts of the analysis process as complete manual analysis is, more often than not, not possible for every case due to many factors (time, skills, scale etc.).
I wrote Lupo mainly to automate and accelerate the process as much as possible. Lupo is a dynamic analysis tool that can be used as a module with the debugger. The first version works with the popular Windows Debugger — WinDbg. I’ll release versions for other debuggers in the future.
The way the tool works is pretty straight forward. You load Lupo into the debugger and then execute it. It runs through the malware and collects predefined IOC and writes them to a text file on the disk. You can then use this information to contain and neutralise malware campaigns or simply respond to the security incident that you are working on.
Lupo — the tool
I’ll give some more details on the tool itself but not too much to the inner workings of it, at least not here. We need to keep in mind that the malware authors are smart enough to quickly tweak the code to create problems for us!
The tool is written in C++ and uses the Windows Debugging framework to execute the code. It can be used with WinDbg as a ‘plugin’ in order to help automate the analysis process.
If you want to know more about the tool, feel free to contact me or comment below.
Download
Download all the DLLs from this repo. You also need all the VC++ dependencies, the easiest way to do that is to install Visual Studio (Community version works) and select all the C++ components.
Usage
Using the tool is very easy. It works in this way:
Save the Lupo extension in your extensions dir (default: sdk\samples\exts subdirectory of the installation directory). You can also define the extensions path by using the command ‘.extpath[+] [Directory[;…]]’.
Start the debugger
Attach the process to be debugged (malware in this case)
Load Lupo using the ‘.load’ command.
Execute Lupo by using this command: ‘lupo.go’
All results will be displayed in the console and also written to a new textfile on the disk. Path and name of this textfile will be displayed in console as well. All done!
You can optionally use the results from Lupo with this other tool that I wrote — Ragno, to advance your research and response by aggregating OSINT for the wider footprint of the campaign you are possibly dealing with. You can read about Ragno in another post here: https://medium.com/@vishal_thakur/introducing-ragno-ioc-multiplier-9b75834353bb
Download
Lupo : Malware IOC Extractor. Debugging Module For Malware Analysis Automation
Lupo is a Debugging module for Malware Analysis Automation.
Working on security incidents that involve malware, we come across situations on a regular basis where we feel the need to automate parts of the analysis process as complete manual analysis is, more often than not, not possible for every case due to many factors (time, skills, scale etc.).
I wrote Lupo mainly to automate and accelerate the process as much as possible. Lupo is a dynamic analysis tool that can be used as a module with the debugger. The first version works with the popular Windows Debugger — WinDbg. I’ll release versions for other debuggers in the future.
The way the tool works is pretty straight forward. You load Lupo into the debugger and then execute it. It runs through the malware and collects predefined IOC and writes them to a text file on the disk. You can then use this information to contain and neutralise malware campaigns or simply respond to the security incident that you are working on.
Lupo — the tool
I’ll give some more details on the tool itself but not too much to the inner workings of it, at least not here. We need to keep in mind that the malware authors are smart enough to quickly tweak the code to create problems for us!
The tool is written in C++ and uses the Windows Debugging framework to execute the code. It can be used with WinDbg as a ‘plugin’ in order to help automate the analysis process.
If you want to know more about the tool, feel free to contact me or comment below.
Download
Download all the DLLs from this repo. You also need all the VC++ dependencies, the easiest way to do that is to install Visual Studio (Community version works) and select all the C++ components.
Usage
Using the tool is very easy. It works in this way:
Save the Lupo extension in your extensions dir (default: sdk\samples\exts subdirectory of the installation directory). You can also define the extensions path by using the command ‘.extpath[+] [Directory[;…]]’.
Start the debugger
Attach the process to be debugged (malware in this case)
Load Lupo using the ‘.load’ command.
Execute Lupo by using this command: ‘lupo.go’
All results will be displayed in the console and also written to a new textfile on the disk. Path and name of this textfile will be displayed in console as well. All done!
You can optionally use the results from Lupo with this other tool that I wrote — Ragno, to advance your research and response by aggregating OSINT for the wider footprint of the campaign you are possibly dealing with. You can read about Ragno in another post here: https://medium.com/@vishal_thakur/introducing-ragno-ioc-multiplier-9b75834353bb
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
NO RATE LIMIT IN JUST 5 MIN
https://cdn-images-1.medium.com/max/611/1*CXJWEecINhvjKZM8kYA2dg.jpeg
Hii all my name is Milan jain and i am a bug bounty hunter !! recently i got 250$ bounty .but before 1 month ago i got my first Hall of…
Continue reading on Medium »
NO RATE LIMIT IN JUST 5 MIN
https://cdn-images-1.medium.com/max/611/1*CXJWEecINhvjKZM8kYA2dg.jpeg
Hii all my name is Milan jain and i am a bug bounty hunter !! recently i got 250$ bounty .but before 1 month ago i got my first Hall of…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Command Challenge (bash)
https://cdn-images-1.medium.com/max/1141/1*7FtlsXOEWQ3t-yE5g1-hYQ.png
The CMD CHALLENGE Directed Project is a cool game that challenges you in Bash skills. Everything is done through the command line, and the…
Continue reading on Medium »
Command Challenge (bash)
https://cdn-images-1.medium.com/max/1141/1*7FtlsXOEWQ3t-yE5g1-hYQ.png
The CMD CHALLENGE Directed Project is a cool game that challenges you in Bash skills. Everything is done through the command line, and the…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
myTermux : Best Termux Theme till 2022
https://cdn-images-1.medium.com/max/1080/1*sFp7pbHwktrpBmOxd4GUpg.png
Hey Guys 🙋♂️, So nowadays I am more into terminal styling and there are a lot of tools available that can change the theme of our termux…
Continue reading on Medium »
myTermux : Best Termux Theme till 2022
https://cdn-images-1.medium.com/max/1080/1*sFp7pbHwktrpBmOxd4GUpg.png
Hey Guys 🙋♂️, So nowadays I am more into terminal styling and there are a lot of tools available that can change the theme of our termux…
Continue reading on Medium »
LambdaGuard - AWS Serverless Security
http://www.kitploit.com/2022/06/lambdaguard-aws-serverless-security.html
http://www.kitploit.com/2022/06/lambdaguard-aws-serverless-security.html
AWS Lambda is an event-driven, serverless (https://www.kitploit.com/search/label/Serverless) computing platform provided by Amazon (https://www.kitploit.com/search/label/Amazon) Web Services. It is a computing service that runs code in response to events and automatically manages the computing resources required by that code. LambdaGuard is an AWS Lambda auditing (https://www.kitploit.com/search/label/Auditing) tool designed to create asset visibility (https://www.kitploit.com/search/label/Visibility) and provide actionable results. It provides a meaningful overview in terms of statistical analysis, AWS service dependencies and configuration checks from the security perspective.
Requirements Python 3.6+ Java 11 (optional for SonarQube) Install From PyPI pip3 install lambdaguard
From Github git clone https://github.com/Skyscanner/lambdaguard
cd lambdaguard
sudo make install
AWS Access You will need a set of AWS access (https://www.kitploit.com/search/label/Access) keys and permissions to run LambdaGuard. make aws
Create a profile in ~/.aws/credentials with the newly created keys. [LambdaGuardProfile]
aws_access_key_id = ...
aws_secret_access_key = ...
Alternatively, you can use the keys directly as CLI arguments (not recommended). Run lambdaguard --help lambdaguard --function arn:aws:lambda:function lambdaguard --input function-arns.txt lambdaguard --output /tmp/lambdaguard lambdaguard --profile LambdaGuardProfile lambdaguard --keys ACCESS_KEY_ID SECRET_ACCESS_KEY lambdaguard --region eu-west-1 lambdaguard --verbose SonarQube: Static Code Analysis Download sonar-scanner-cli https://github.com/SonarSource/sonar-scanner-cli Build SonarQube make sonarqube Use SonarQube lambdaguard --sonarqube config.json Config should have the following format: {
"command": "sonar-scanner -X",
"url": "http://localhost:9000",
"login": "admin",
"password": "admin"
} Development make -B clean
make dev
. dev/bin/activate
make install-dev
make test
Download LambdaGuard (https://github.com/Skyscanner/LambdaGuard)
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
LambdaGuard - AWS Serverless Security
https://blogger.googleusercontent.com/img/a/AVvXsEivJEVrS2dhDjNMnyp8j9yqwQ_Lzat1288-6PctnOURF_xsSjDxpWy10FqVo8Fmo0u3SNMXrVT1gvRT4hs8ceG6cnqFTSHlf_cD4qwOwWuYrAqKQE7WX76lj1VR11KhSlzVhsswt0sh2aGHlg-f2eOaQCvPsfoR64y2f6iSzqjNbnhnMNOLIMWIzpO2=s16000
AWS Lambda is an event-driven, serverless computing platform provided by Amazon Web Services. It is a computing service that runs code in response to events and automatically manages the computing resources required by that code.
LambdaGuard is an AWS Lambda auditing tool designed to create asset visibility and provide actionable results. It provides a meaningful overview in terms of statistical analysis, AWS service dependencies and configuration checks from the security perspective.
Requirements
* Python 3.6+
* Java 11 (optional for SonarQube)
Install
From PyPI
From Github
AWS Access
You will need a set of AWS access keys and permissions to run LambdaGuard.
Create a profile in
Alternatively, you can use the keys directly as CLI arguments (not recommended).
Run
*
*
*
*
*
*
*
*
SonarQube: Static Code Analysis
Download sonar-scanner-cli
* https://github.com/SonarSource/sonar-scanner-cli
Build SonarQube
*
Use SonarQube
*
Config should have the following format:
Development
Download LambdaGuard
LambdaGuard - AWS Serverless Security
https://blogger.googleusercontent.com/img/a/AVvXsEivJEVrS2dhDjNMnyp8j9yqwQ_Lzat1288-6PctnOURF_xsSjDxpWy10FqVo8Fmo0u3SNMXrVT1gvRT4hs8ceG6cnqFTSHlf_cD4qwOwWuYrAqKQE7WX76lj1VR11KhSlzVhsswt0sh2aGHlg-f2eOaQCvPsfoR64y2f6iSzqjNbnhnMNOLIMWIzpO2=s16000
AWS Lambda is an event-driven, serverless computing platform provided by Amazon Web Services. It is a computing service that runs code in response to events and automatically manages the computing resources required by that code.
LambdaGuard is an AWS Lambda auditing tool designed to create asset visibility and provide actionable results. It provides a meaningful overview in terms of statistical analysis, AWS service dependencies and configuration checks from the security perspective.
Requirements
* Python 3.6+
* Java 11 (optional for SonarQube)
Install
From PyPI
pip3 install lambdaguard
From Github
git clone https://github.com/Skyscanner/lambdaguard
cd lambdaguard
sudo make install
AWS Access
You will need a set of AWS access keys and permissions to run LambdaGuard.
make aws
Create a profile in
~/.aws/credentialswith the newly created keys.[LambdaGuardProfile]
aws_access_key_id = ...
aws_secret_access_key = ...
Alternatively, you can use the keys directly as CLI arguments (not recommended).
Run
*
lambdaguard --help*
lambdaguard --function arn:aws:lambda:function*
lambdaguard --input function-arns.txt*
lambdaguard --output /tmp/lambdaguard*
lambdaguard --profile LambdaGuardProfile*
lambdaguard --keys ACCESS_KEY_ID SECRET_ACCESS_KEY*
lambdaguard --region eu-west-1*
lambdaguard --verboseSonarQube: Static Code Analysis
Download sonar-scanner-cli
* https://github.com/SonarSource/sonar-scanner-cli
Build SonarQube
*
make sonarqubeUse SonarQube
*
lambdaguard --sonarqube config.jsonConfig should have the following format:
{
"command": "sonar-scanner -X",
"url": "http://localhost:9000",
"login": "admin",
"password": "admin"
}Development
make -B clean
make dev
. dev/bin/activate
make install-dev
make test
Download LambdaGuard