Black Hat Ethical Hacking
Google Chrome extensions can be fingerprinted to track you online

Google Chrome extensions can be fingerprinted to track you onlinePost Views: 16
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
A researcher has created a website that uses your installed Google Chrome extensions to generate a fingerprint of your device that can be used to track you online.
To track users on the web, it is possible to create fingerprints, or tracking hashes, based on various characteristics of a device connecting to a website. These characteristics include GPU performance, installed Windows applications, a device’s screen resolution, hardware configuration, and even the installed fonts.

It is then possible to track a device across sites using the same fingerprinting method. Fingerprint from installed Chrome extensionsYesterday, web developer ‘z0ccc’ shared a new fingerprinting site called ‘Extension Fingerprints’ that can generate a tracking hash based on a browser’s installed Google Chrome extensions.

When creating a Chrome browser extension, it is possible to declare certain assets as ‘web accessible resources‘ that web pages or other extensions can access.

These resources are typically image files, which are declared using the ‘web_accessible_resources‘ property in a browser extension’s manifest file.

An example declaration of web-accessible resources is shown below: "web_accessible_resources": [
{
"resources": [ "logo.png" ],
"matches": [ "https://www.bleepingcomputer.com/*" ]
}
],As previously disclosed in 2019, it is possible to use web-accessible resources to check for installed extensions and generate a fingerprint of a visitor’s browser based on the combination of found extensions.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png To prevent detection, z0ccc says that some extensions use a secret token that is required to access a web resource. However, the researcher discovered a ‘Resource timing comparison’ method that can still be be used to detect if the extension is installed.

“Resources of protected extensions will take longer to fetch than resources of extensions that are not installed. By comparing the timing differences you can accurately determine if the protected extensions are installed,” explained z0ccc on the project’s GitHub page.

To illustrate this fingerprinting method, z0ccc created an Extension Fingerprints website that will check a visitor’s browser for the existence of web-accessible resources in 1,170 popular extensions available on the Google Chrome Web Store.

Some of the extensions that the website will identify are uBlock, LastPass, Adobe Acrobat, Honey, Grammarly, Rakuten, and ColorZilla.

Based on the combination of installed extensions, the website will generate a tracking hash that can be used to track that particular browser, as shown below.
https://www.bleepstatic.com/images/news/security/f/fingerprint/extension-fingerprints/extension-fingerprints.jpg
___________________________
@hacking_Attack
@Hacking_Video

the fingerprinting model can further refine the fingerprint, making the hashes unique per user.

“This is definitely a viable option for fingerprinting users,” z0ccc explained in an email to BleepingComputer.

“Especially using the ‘fetching web accessible resources’ method. If this is combined with other user data (like user agents, timezones etc) users could be very easily identified.”
Trending: New Linux rootkit, Syslogk uses magic packets to trigger backdoor
The Extensions Fingerprints site only works with Chromium browsers installing extensions from the Chrome Web Store. While this method will work with Microsoft Edge, it would need to be modified to use extension IDs from Microsoft’s extension store.

This method does not work with Mozilla Firefox add-ons as Firefox extension IDs are unique for every browser instance. uBlock is the most commonly installedWhile z0ccc is not collecting any data regarding installed extensions, his own tests showed that uBlock installed is the most common extension fingerprint.

“By far the most popular is having no extensions installed. As previously said I do not collect specific extension data but in my own testing it seems that having only ublock installed is a common extension fingerprint,” shared z0ccc.

“Having 3+ detectable extensions installed seems to always make your fingerprint very unique.”

Below are the percentages of users with various popular extensions installed from tests conducted by BleepingComputer.

* 58.248% – No extensions installed or enabled.
* 2.065% – Only Google Docs Offline, which is the only extension installed by default.
* 0.528% – uBlock Origin + Google Docs Offline
* 0.238% – AdBlock + Google Docs Offline
* 0.141% – Adobe Acrobat + Google Docs Offline
* 0.122% – Google Translate + Google Docs Offline
* 0.019% – Malwarebytes Browser Guard
* 0.058% – Grammarly + Google Docs Offline
* 0.058% – LastPass + Google Docs Offline
* 0.051% – Honey + Google Docs Offline
* 0.013% – ColorZilla + Google Docs Offline
Trending: Offensive Security Tool: Mobile Security Framework (MobSF) Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
In our tests, installing three to four extensions brought the percentage of users using the same extension to as low as 0.006%. Obviously, the more installed extensions, the fewer people will have the same combination installed.

z0ccc says the 0.006% percentage indicates that you are the only user with that combination of extensions, but this will change as more people visit the site.

Extension Fingerprints has been released as an open-source React project on GitHub, allowing anyone to see how to query for the presence of installed extensions.
Trending: Write up: Find hidden and encrypted secrets from any website Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/android_malware-700x394-1-90x90.jpg New MaliBot Android banking malware spreads as a crypto miner3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Cisco_Systems_Bug-90x90.jpg Cisco Secure Email bug can let attackers bypass authentication4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/android-malware-90x90.jpg Android malware on the Google Play Store gets 2 million downloads5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Linux-90x90.jpg New Linux rootkit, Syslogk uses magic packets to trigger backdoor6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Header-Python-Packages-Blog-Final-Image-90x[...]

___________________________
@hacking_Attack
@Hacking_Video

90.jpg PyPI package ‘keep’ mistakenly included a password stealer7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/venom_superhero_movie_tom11_hardy-wallpaper-1920x1080-980x551-1-90x90.jpg This new Linux malware is ‘almost impossible’ to detect1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/ran-download-33-1-e1639685560151-90x90.jpeg Black Basta Ransomware Teams Up with Malware Stalwart Qbot2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/InstallerFileTakeOver-Zero-Day-Security-Vulnerability-All-Windows-OS-Versions-90x90.jpg New ‘DogWalk’ Windows zero-day bug gets free unofficial patches2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/ipad_update_1200x675-90x90.jpg Security Fixes Won’t Require Full iOS Update in iOS 16, Will Be Installed Automatically2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Confluence-90x90.jpg Exploit released for Atlassian Confluence RCE bug, update now2 weeks ago
The post Google Chrome extensions can be fingerprinted to track you online first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

How I found 5 CVEs in few days

Hi all,Continue reading on Medium »
Read more...

How I found 5 CVEs in few days
https://medium.com/@agrawalsmart7/how-i-found-5-cves-in-few-days-88ad1c55372?source=rss------bug_bounty-5

Hi all,Continue reading on Medium » (https://medium.com/@agrawalsmart7/how-i-found-5-cves-in-few-days-88ad1c55372?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
FirmWire : b Full-System Baseband Firmware Emulation Platform

FirmWire is a full-system baseband firmware analysis platform that supports Samsung and MediaTek. It enables fuzzing, root-cause analysis, and debugging of baseband firmware images. See the FirmWire documentation to get started! InstallationThe recommended way of using FirmWire is by using the supplied Dockerfile. To build the docker file, execute the following commands:

git clone https://github.com/FirmWire/FirmWire.git
cd FirmWire
git clone https://github.com/FirmWire/panda.git
This will take some time
docker build -t firmwire .

Afterwards, you can obtain an interactive shell to a docker environment with FirmWire installed by executing:

docker run –rm -it -v $(pwd):/firmwire firmwire

From here, you can directly go to check out our quick start documentation to emulate your first modem! Visual Studio CodeAlternatively to using docker from your commandline, you can also create a FirmWire environment using VScode, by using the devcontainerand dockerextensions. After cloning FirmWire and FirmWire’s version of Panda, just open the corresponding directory in code and execute: > Remote-Containers: Add Development Container Configuration FilesThen, select From Dockerfile, which should automatically create a .devcontainerfile. Afterwards, follow code’s prompt to Reopen in container.

This will build the docker container and provide you an interactive shell inside the docker environment, with files transparently forwarded to the host directories. This is the favorite development setup for some of the FirmWire developers! Manual InstallationThe manual installation of FirmWire is a bit more tedious. Besides installing FirmWire and its requirement, you also need to:

* Manually build Panda
* Install PyPanda
* Manually build the FirmWire mods

For information on how to carry out these individual steps, please refer to the Dockerfile. Quick StartHave you installed FirmWire and are all eager to emulate your modem FirmWire? Very good! All you have to run after installation is:

$ ./firmwire.py modem.bin

This will automatically recognize the firmware, unpack it, and select a loader and machine to run it. You can also load firmware from a URL to get started:

$ ./firmwire.py https://github.com/grant-h/ShannonFirmware/raw/master/modem_files/CP_G973FXXU3ASG8_CP13372649_CL16487963_QB24948473_REV01_user_low_ship.tar.md5.lz4

Currently, FirmWire supports a subset of MediaTek MTK and Samsung Shannon firmware images.

Please note that FirmWire requires a couple different TCP ports for its operation. If you have any restrictions on which ports can be used, please use the --consecutive-portsflag to specify which ports can be used. For instance, if ports 10000-10005 are free to use on your system, invoke FirmWire as follows:

$ ./firmwire.py –consecutive-ports 10000 modem.bin Supported ImagesMediaTek* Samsung A10s (MT6762)
* Samsung A41 (MT6768) Shannon* Most images for Galaxy S7, S7e (S335)
* Moto One Vision (S337)
* Galaxy S8, S8+ (S355)
* Galaxy S9 (S360)
* Galaxy S10, S10e (S5000) Using GhidraWe have custom patches to Ghidra which are required if you are analyzing MediaTek firmware. See https://github.com/FirmWire/ghidra for setup instructions. For Shannon firmware see https://github.com/grant-h/ShannonBaseband#getting-started-with-shannon-firmware. You will need the ShannonLoader, which can be installed on to the custom Ghidra for MediaTek (or just use the upstream Ghidra). Technical BackgroundFirmWire is a baseband analysis platform. As input, it takes a baseband firmware image and tries to create an emulation environment for this image on-the-fly. Emulation CoreThe Emulation Core of FirmWire is built on top of avatar2 and PANDA. The core emulation cap[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
LeakedHandlesFinder : Leaked Windows Processes Handles Identification Tool

Leaked Windows processes handles identification tool. Useful for identify new LPE vulnerabilities during a pentest or simply as a new research process. Currently supports exploiting (autopwn) procesess leaked handles spawning a new arbitrary process (cmd.exe default).
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2fH19iljXudJSh2n7n_vYl5WOicw7QOWEh1K2gsgGwysV-AuPyleSOiS3l1v8rMUd4vkxsbt9O5umGhxtpEl7zTSNTqjh2_SfMJM7LHSnXZYkY8gV9jNNxQtSL6y8jVbraTRfzqKJOZy7zAOBSin5iM6RiqHLYoXkN-l3X_dwqTxTlauplIrFlzuj/s1135/1.png
LHF identifies in realtime inherited handles and gives the researcher explotability tips

Presented at rootedcon 2022 https://www.rootedcon.com/ponentes-rooted2022/.

Presentation -> Presentation/Exploiting Leaked Handles for LPE.pdf
Download

___________________________
@hacking_Attack
@Hacking_Video

abilities are provided by PANDA, while avatar2 is used as middleware to orchestrate the execution state of the emulator, including spin-up, breakpoint registration, and starting/stopping of the emulation. Additionally, we use avatar2’s Python Peripherals to implement peripherals which react on Memory-Mapped I/O accesses.

Under the hood, FirmWire implements vendor specific machines which use avatar2’s PyPanda target to embed PANDA as dynamic library in the same process space as the Python Interpreter keeping the required inter-process communication for FirmWire to a bare minimum. Emulator configurationPANDA and avatar2 use the so-called configurable machineto enable emulation of arbitrary embedded systems with custom memory mappings. In essence, the embedded systems’ memory map (including ROM, RAM, and peripherals) is described in a JSON file, which gets automatically generated by avatar2 based on individually registered memory ranges. This JSON file is then passed on to PANDA, which uses it to register and emulate the memory ranges accordingly.

Inside FirmWire, we use the configurable machine to create the emulation environments for the target baseband images on-the-fly. In more detail, our loader is responsible for parsing a binary firmware file and automatically extracting the required memory mappings, for instance by finding pre-defined MPU tables within the binary image. This ManualThe rest of this manual will guide you through FirmWire from a user’s perspective. In case you interested in developing or extending the core functionality of FirmWire, please stay tuned. Alternatively, you can dig through the source code, or reach out to us – we are happy to provide additional information wherever needed! Command Line Interface ReferenceThis part of our documentation works as quick-reference to all the firmwire.pyand firmwire_dev.pyCLI arguments, and provides links about where they are covered. For more information about the single command line flags, you can also run FirmWire with the --helpflag. firmwire.py argumentsArgumentCovered inDescriptionmodem_fileGetting StartedThe modem file FirmWire shall create an emulation environment for. Only mandatory argument(!)--consecutive-ports CONSECUTIVE_PORTSGetting StartedChoose consecutive ports for the any listening sockets (e.g. QEMU’s GDB & QMP), starting with the port provided.-h/--helpCLI referenceShow help for for different cli flags on commandline-w/--workspace WORKSPACEWorkspacesPath to the workspace to use--snapshot-at SNAPSHOT_ATWorkspacesAddress and name for taking a snapshot. (Syntax: address,name)--restore-snapshot SNAPSHOT_NAMEWorkspacesName of snapshot to be restored-t/--module INJECTED_TASKModkitModule / Task to be injected to the baseband modem-S/--stopInteractive explorationStop CPU after initializing the Machine. Useful for interactive exploration.-s/--gdb-serverInteractive explorationStart GDB server on TCP port. Default is 1234. NOTE: this is a minimal GDB stub.--consoleInteractive explorationSpawn an ipython remote kernel that can be connected to from another terminal using jupyter console --existing--fuzz FUZZFuzzingInject and invoke the passed AFL fuzz task module (headless).--fuzz-input FUZZ_INPUTFuzzingPath the AFL test case (@@ should be sufficient) or just the path to a single test file.--fuzz-triage FUZZ_TRIAGEFuzzingInvoke the fuzzer, but without an AFL front end. Enables debug hooks and saves code coverage.--fuzz-persistent FUZZ_PERSISTENTFuzzingEnable persistent fuzzing with a loop count as the argument.--fuzz-crashlog-dir FUZZ_CRASHLOG_DIRFuzzingFolder to which logs of all testcases (length testcase) for a crashing run in persistent mode--fuzz-crashlog-replay FUZZ_CRASHLOG_REPLAYFuzzingReplay a persis[...]

___________________________
@hacking_Attack
@Hacking_Video

tent-mode crash trace written with fuzz-crashcase-dir.--fuzz-state-addr-file FUZZ_STATE_ADDR_FILEFuzzingTextfile containing the hex-addresses of state-variables--full-coverageFuzzingEnable full coverage collection (logs every executed basic block)--shannon-loader-nv_data NV_DATATBD(Shannon only) Specify the NV_DATA to be used--mtk-loader-nv_data NV_DATATBD(MediaTek only) Specify the NV_DATA to be used Developer optionsNote: These arguments are mostly useful for development and debugging. As of now, they are part of firmwire.py, but will be moved to a custom firmwire_dev.pyinterface to clearly distinguish developer and user features in a future iteration of FirmWire.
ArgumentCovered inDescription--debugTBDEnable FirmWire debugging--debug-peripheralTBDEnable debugging for specified peripheralas--avatar-debugTBDEnable debug logging for Avatar2--avatar-debug-memoryTBDEnable Avatar2 remote memory debugging (useful when Peripherals crash)--unassigned-access-logTBDPrint log messages when memory accesses to undefined memory occur--raw-asm-loggingTBDPrint assembly basic blocks as QEMU executes them. Useful for determining infinite loops.--trace-bb-translationTBDPrint the address of each new Basic Block, useful to eval BBs reached during fuzzing. WorkspacesFirmWire uses workspaces tied to the specific firmware file under analysis. These workspaces contain a variety of useful files, most notably logs emitted by the avatar2-orchestration, the configurable machine definition, and a qcow2-image used for FirmWire’s snapshotting mechanism, as well as vendor-specific files and directories.

By default, FirmWire creates a workspace at the very same directory where the modem file is located at, but this behavior can be overriden via the -w/--workspacecommand line flag. SnapshotsOne of FirmWire’s convenience features is snapshotting, which is implemented on top of QEMU. Besides storing the emulation machine state in QEMU’s qcow2image format, FirmWire also saves the state of used python peripherals in auxiliary .snapinfofiles.

To take a snapshot use the --snapshot-atcommandline argument or call the snapshot()method during interactive exploration. Presume you want to take a snapshot with the name my_first_snapshotat address 0x464d5752. For taking the snapshot from commandline, simply run ./firmwire.py --snapshot-at 0x464d5752,my_first_snapshot modem_file. When using interactive exploration, you will have directly access to the python machineobject via self. Make sure to stop execution at the desired address (for instance by setting a breakpoint), and then execute: self.snapshot("my_first_snapshot"). Alternatively, if you don’t want to manually steer execution, you can also use self.snapshot_state_at_address(0x464d5752, "my_first_snapshot").

For starting execution from this snapshot during the next start of FirmWire, all you will need to is ./firmwire.py --restore-snapshot my_first_snapshot modem_file. If you use interactive exploration, you can even restore snapshots on-the-fly, without the need to restart the emulator! In this case, you would need to execute self.restore_snapshot("my_first_snapshot")PatternDBPatternDB is a convienent way to define memory patterns which FirmWire uses to scan the binary baseband firmware during load-time. You you can think about FirmWire memory patterns as binary regexes tailored towards firmware analysis tasks. Once a pattern is found, FirmWire associates a symbol to the according pattern (in the simplest case), and, optionally executes lookup and post-lookup functions. The pattern itself are defined in the pattern.py-file present in the different vendor plugins.

Patt[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
FirmWire : b Full-System Baseband Firmware Emulation Platform

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is DHCP Snooping? What is Man in the Middle attack? How to configure DHCP Snooping security?

https://cdn-images-1.medium.com/max/600/1*7cHvxFfYMo_S5uJwsm_bPA.png
DHCP (Dynamic Host Configuration Protocol) servers are providing all the essential information that the client wants to operate on the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Dev Project Syphon

https://cdn-images-1.medium.com/max/1030/1*QkUP7K7b8jCOdHabEIvl5g.jpeg
Project Syphon allows dumping of saved browser infomation including decrypting password and credit card data.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Develop your Cyber Security skills and knowledge with these cool projects

https://cdn-images-1.medium.com/max/2600/0*UQXxJ25bPyuLIoRm
Cybersecurity is a vast and complex field, and it can be difficult to know where to start if you’re interested in getting into it. However…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video