Kali Linux Tutorials
LeakedHandlesFinder : Leaked Windows Processes Handles Identification Tool

Leaked Windows processes handles identification tool. Useful for identify new LPE vulnerabilities during a pentest or simply as a new research process. Currently supports exploiting (autopwn) procesess leaked handles spawning a new arbitrary process (cmd.exe default).
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2fH19iljXudJSh2n7n_vYl5WOicw7QOWEh1K2gsgGwysV-AuPyleSOiS3l1v8rMUd4vkxsbt9O5umGhxtpEl7zTSNTqjh2_SfMJM7LHSnXZYkY8gV9jNNxQtSL6y8jVbraTRfzqKJOZy7zAOBSin5iM6RiqHLYoXkN-l3X_dwqTxTlauplIrFlzuj/s1135/1.png
LHF identifies in realtime inherited handles and gives the researcher explotability tips

Presented at rootedcon 2022 https://www.rootedcon.com/ponentes-rooted2022/.

Presentation -> Presentation/Exploiting Leaked Handles for LPE.pdf
Download

___________________________
@hacking_Attack
@Hacking_Video

abilities are provided by PANDA, while avatar2 is used as middleware to orchestrate the execution state of the emulator, including spin-up, breakpoint registration, and starting/stopping of the emulation. Additionally, we use avatar2’s Python Peripherals to implement peripherals which react on Memory-Mapped I/O accesses.

Under the hood, FirmWire implements vendor specific machines which use avatar2’s PyPanda target to embed PANDA as dynamic library in the same process space as the Python Interpreter keeping the required inter-process communication for FirmWire to a bare minimum. Emulator configurationPANDA and avatar2 use the so-called configurable machineto enable emulation of arbitrary embedded systems with custom memory mappings. In essence, the embedded systems’ memory map (including ROM, RAM, and peripherals) is described in a JSON file, which gets automatically generated by avatar2 based on individually registered memory ranges. This JSON file is then passed on to PANDA, which uses it to register and emulate the memory ranges accordingly.

Inside FirmWire, we use the configurable machine to create the emulation environments for the target baseband images on-the-fly. In more detail, our loader is responsible for parsing a binary firmware file and automatically extracting the required memory mappings, for instance by finding pre-defined MPU tables within the binary image. This ManualThe rest of this manual will guide you through FirmWire from a user’s perspective. In case you interested in developing or extending the core functionality of FirmWire, please stay tuned. Alternatively, you can dig through the source code, or reach out to us – we are happy to provide additional information wherever needed! Command Line Interface ReferenceThis part of our documentation works as quick-reference to all the firmwire.pyand firmwire_dev.pyCLI arguments, and provides links about where they are covered. For more information about the single command line flags, you can also run FirmWire with the --helpflag. firmwire.py argumentsArgumentCovered inDescriptionmodem_fileGetting StartedThe modem file FirmWire shall create an emulation environment for. Only mandatory argument(!)--consecutive-ports CONSECUTIVE_PORTSGetting StartedChoose consecutive ports for the any listening sockets (e.g. QEMU’s GDB & QMP), starting with the port provided.-h/--helpCLI referenceShow help for for different cli flags on commandline-w/--workspace WORKSPACEWorkspacesPath to the workspace to use--snapshot-at SNAPSHOT_ATWorkspacesAddress and name for taking a snapshot. (Syntax: address,name)--restore-snapshot SNAPSHOT_NAMEWorkspacesName of snapshot to be restored-t/--module INJECTED_TASKModkitModule / Task to be injected to the baseband modem-S/--stopInteractive explorationStop CPU after initializing the Machine. Useful for interactive exploration.-s/--gdb-serverInteractive explorationStart GDB server on TCP port. Default is 1234. NOTE: this is a minimal GDB stub.--consoleInteractive explorationSpawn an ipython remote kernel that can be connected to from another terminal using jupyter console --existing--fuzz FUZZFuzzingInject and invoke the passed AFL fuzz task module (headless).--fuzz-input FUZZ_INPUTFuzzingPath the AFL test case (@@ should be sufficient) or just the path to a single test file.--fuzz-triage FUZZ_TRIAGEFuzzingInvoke the fuzzer, but without an AFL front end. Enables debug hooks and saves code coverage.--fuzz-persistent FUZZ_PERSISTENTFuzzingEnable persistent fuzzing with a loop count as the argument.--fuzz-crashlog-dir FUZZ_CRASHLOG_DIRFuzzingFolder to which logs of all testcases (length testcase) for a crashing run in persistent mode--fuzz-crashlog-replay FUZZ_CRASHLOG_REPLAYFuzzingReplay a persis[...]

___________________________
@hacking_Attack
@Hacking_Video

tent-mode crash trace written with fuzz-crashcase-dir.--fuzz-state-addr-file FUZZ_STATE_ADDR_FILEFuzzingTextfile containing the hex-addresses of state-variables--full-coverageFuzzingEnable full coverage collection (logs every executed basic block)--shannon-loader-nv_data NV_DATATBD(Shannon only) Specify the NV_DATA to be used--mtk-loader-nv_data NV_DATATBD(MediaTek only) Specify the NV_DATA to be used Developer optionsNote: These arguments are mostly useful for development and debugging. As of now, they are part of firmwire.py, but will be moved to a custom firmwire_dev.pyinterface to clearly distinguish developer and user features in a future iteration of FirmWire.
ArgumentCovered inDescription--debugTBDEnable FirmWire debugging--debug-peripheralTBDEnable debugging for specified peripheralas--avatar-debugTBDEnable debug logging for Avatar2--avatar-debug-memoryTBDEnable Avatar2 remote memory debugging (useful when Peripherals crash)--unassigned-access-logTBDPrint log messages when memory accesses to undefined memory occur--raw-asm-loggingTBDPrint assembly basic blocks as QEMU executes them. Useful for determining infinite loops.--trace-bb-translationTBDPrint the address of each new Basic Block, useful to eval BBs reached during fuzzing. WorkspacesFirmWire uses workspaces tied to the specific firmware file under analysis. These workspaces contain a variety of useful files, most notably logs emitted by the avatar2-orchestration, the configurable machine definition, and a qcow2-image used for FirmWire’s snapshotting mechanism, as well as vendor-specific files and directories.

By default, FirmWire creates a workspace at the very same directory where the modem file is located at, but this behavior can be overriden via the -w/--workspacecommand line flag. SnapshotsOne of FirmWire’s convenience features is snapshotting, which is implemented on top of QEMU. Besides storing the emulation machine state in QEMU’s qcow2image format, FirmWire also saves the state of used python peripherals in auxiliary .snapinfofiles.

To take a snapshot use the --snapshot-atcommandline argument or call the snapshot()method during interactive exploration. Presume you want to take a snapshot with the name my_first_snapshotat address 0x464d5752. For taking the snapshot from commandline, simply run ./firmwire.py --snapshot-at 0x464d5752,my_first_snapshot modem_file. When using interactive exploration, you will have directly access to the python machineobject via self. Make sure to stop execution at the desired address (for instance by setting a breakpoint), and then execute: self.snapshot("my_first_snapshot"). Alternatively, if you don’t want to manually steer execution, you can also use self.snapshot_state_at_address(0x464d5752, "my_first_snapshot").

For starting execution from this snapshot during the next start of FirmWire, all you will need to is ./firmwire.py --restore-snapshot my_first_snapshot modem_file. If you use interactive exploration, you can even restore snapshots on-the-fly, without the need to restart the emulator! In this case, you would need to execute self.restore_snapshot("my_first_snapshot")PatternDBPatternDB is a convienent way to define memory patterns which FirmWire uses to scan the binary baseband firmware during load-time. You you can think about FirmWire memory patterns as binary regexes tailored towards firmware analysis tasks. Once a pattern is found, FirmWire associates a symbol to the according pattern (in the simplest case), and, optionally executes lookup and post-lookup functions. The pattern itself are defined in the pattern.py-file present in the different vendor plugins.

Patt[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
FirmWire : b Full-System Baseband Firmware Emulation Platform

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is DHCP Snooping? What is Man in the Middle attack? How to configure DHCP Snooping security?

https://cdn-images-1.medium.com/max/600/1*7cHvxFfYMo_S5uJwsm_bPA.png
DHCP (Dynamic Host Configuration Protocol) servers are providing all the essential information that the client wants to operate on the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Dev Project Syphon

https://cdn-images-1.medium.com/max/1030/1*QkUP7K7b8jCOdHabEIvl5g.jpeg
Project Syphon allows dumping of saved browser infomation including decrypting password and credit card data.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Develop your Cyber Security skills and knowledge with these cool projects

https://cdn-images-1.medium.com/max/2600/0*UQXxJ25bPyuLIoRm
Cybersecurity is a vast and complex field, and it can be difficult to know where to start if you’re interested in getting into it. However…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Mount external directories into your Kubernetes container

https://cdn-images-1.medium.com/max/1125/0*0z14DYvmgLBfYNfs
I wondered how it is possible to get a volume mount into your Kubernetes cluster.

Continue reading on Geek Culture »

___________________________
@hacking_Attack
@Hacking_Video

Xss_Vulnerability_Challenges - This Repository Is A Docker Containing Some "XSS Vulnerability" Challenges And Bypass Examples
http://www.kitploit.com/2022/06/xssvulnerabilitychallenges-this.html

___________________________
@hacking_Attack
@Hacking_Video

This repository is a Dockerized php application containing some XSS vulnerability challenges.
The ideas behind challenges are:
Javascript validation bypass html entities bypass WAF bypass Black-list validation bypass Basic XSS validation bypass Double encode bypass of WAF to exploit XSS Exploiting XSS by bypassing (https://www.kitploit.com/search/label/Bypassing) escape characters
Quick Start Using Docker Using docker hub (Quickest): To access (https://www.kitploit.com/search/label/Access) the challenges, you need docker (https://docs.docker.com/install) installed.
Run this command to pull and run the image from docker hub:
sudo docker run -d -p 9003:80 moeinfatehi/xss_vulnerability_challenges Access the challenges with this URL: http://localhost:9003 (http://localhost:9003/)

Help: -d: detached mode (You can use terminal after running command
-p: specifies port (you can change 8008 to whatever you want. If you don't have a web server on your host, set it to 80)
Using docker-compose: To access the challenges, you need docker (https://docs.docker.com/install) and docker-compose (https://docs.docker.com/compose/install/) installed.
Clone the repository
git clone https://github.com/moeinfatehi/xss_vulnerability_challenges.git Open the main directory (https://www.kitploit.com/search/label/Directory) of the project (where docker-compose.yml file exists) and run: docker-compose up Access the challenges with this URL: http://localhost:9003 (http://localhost:9003/)

___________________________
@hacking_Attack
@Hacking_Video

Disclaimer This project is for Educational purpose ONLY. The usual disclaimer applies, especially the fact that I'm not liable for any damages caused by direct or indirect use of the information or functionality provided by these programs. The author or any Internet provider bears NO responsibility for content or misuse of these programs or any derivatives thereof. By using these project you accept the fact that any damage (dataloss, system crash, system compromise, etc.) caused by the use of this program is not my responsibility. Hack and have fun ! If you have any further questions, please don't hesitate to contact me via my twitter (https://twitter.com/MoeinFatehi) account.

Download Xss_Vulnerability_Challenges (https://github.com/moeinfatehi/xss_vulnerability_challenges)

___________________________
@hacking_Attack
@Hacking_Video

A tool I made for Active Directory
https://www.reddit.com/r/Pentesting/comments/vgjzo1/a_tool_i_made_for_active_directory/

I have been lately working on a few security projects. I recently created the tool ActiveDirectoryAttackTool (ADAT). This tool is designed to take some basic input and print out commands which can be easily run against a Domain Controller. Some of the protocols ADAT prints out commands for: DNS Kerberos LDAP MSSQL NTP RDP SMB WinRM Some of the tools ADAT prints out commands for: BloodHound Crackmapexec (Including modules and PowerShell commands) Impacket toolset Metasploit Nmap ldapdomaindump ldapsearch pywerview xfreerdp ADAT also provides commands for post exploitation. ADAT: https://github.com/The-Viper-One/ActiveDirectoryAttackTool I also have plenty of notes and documentation on penetration testing Active directory as linked below in my Gitbook. Gitbook: https://viperone.gitbook.io/pentest-everything/ ​ Hope this is helpful for some of you. submitted by /u/AkimboViper (https://www.reddit.com/user/AkimboViper)
[link] (https://www.reddit.com/r/Pentesting/comments/vgjzo1/a_tool_i_made_for_active_directory/) [comments] (https://www.reddit.com/r/Pentesting/comments/vgjzo1/a_tool_i_made_for_active_directory/)

___________________________
@hacking_Attack
@Hacking_Video

Attempting to branch out from IAM into Pen Testing. New to this field and looking for advice
https://www.reddit.com/r/Pentesting/comments/vgkrjz/attempting_to_branch_out_from_iam_into_pen/

What would you recommend for a complete newbie to this field? I have IT Audit and IAM experience and passed my CISSP and CISA. However, I know that holds 0 value in the world of pen testing. Where would you recommend me to start before I actually attempt to tackle a subset of “labs” my company has setup to vet people looking to join the team? I’m think TryHackMe, and maybe eJPT as well. submitted by /u/anonymous_mx5 (https://www.reddit.com/user/anonymous_mx5)
[link] (https://www.reddit.com/r/Pentesting/comments/vgkrjz/attempting_to_branch_out_from_iam_into_pen/) [comments] (https://www.reddit.com/r/Pentesting/comments/vgkrjz/attempting_to_branch_out_from_iam_into_pen/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Pool on the roof - {{%B %d, %Y}}

Have a no0b question? New to hacking? Looking for a script? Need help with your github project? Something wrong with your payload? Stuck on a CTF or bug bounty?

This is a weekly recurring post to make friends with other hackers, ask questions, and get any type of help you may need.

Make sure to read our wiki as it's full of resources for you.

Keep all beginner questions in this weekly stickied post.

submitted by /u/AutoModerator
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video