Hacking Articles Tips Tricks Videos Tutorials

4 views14:18

Kali Linux Tutorials RogueAssemblyHunter : Rogue Assembly Hunter Is A Utility For Discovering ‘Interesting’ .NET CLR Modules Rogue Assembly Hunter is a utility for discovering ‘interesting’ .NET CLR modules in running processes. Background.NET is a very powerful…

e fail accordingly for architecture mismatches.

* Tested on Windows 10 Pro 2H1H and Windows Server 2016 Standard 1607. It may run on other versions with the relevant .NET Framework.
* Visual Studio project source with NuGet packages, PowerShell script, and release binaries are included with this project.
* Notice.md includes project disclaimers and license information.
* Run at your own risk (and don’t mind my horrible code https://s.w.org/images/core/emoji/14.0.0/72x72/1f609.png )! Usage[*] Parameters:
–mode=<. : Required | Select analysis mode. Options include sweep, process, and watch.
–hunt=<. : Optional | Select the hunt scan type to find interesting CLR modules. Specify all (default), memory-only, unusual-dir,
sig-status, imposter-file, or list.
–export=<. : Optional, Experimental | Specify a file path to export loaded CLR modules for in-memory hunt scans and imposter-file hunt scans
(e.g. –hunt=memory-only/imposter-file/all).
–pid=<. : Optional | Specify a targeted process by PID. Must be used with –mode=process parameter/value.
–checks=<. : Optional | Specify a value for scan cycles. This may help reduce race condition misses during scans but could also repeat result output.
Default value is 1.
–sleep=<. : Optional | Specify a value for sleep seconds. This may help reduce race condition misses during scans by delaying the check cycle.
Default value is 0 seconds.
–debug : Optional | Display exception information (e.g. process connect errors).
–nobanner : Optional | Suppress the display banner. Useful for executing with the PowerShell script or for use cases that leverage automation.
–suppress : Optional | Do not scan the RogueAssemblyHunter process during –mode=sweep or –mode=watch.
–help : Optional | Show this help. This will override any other cmdline parameters and exit the application. *This is the default without parameters.
[] Modes (–mode=) – sweep : Scan/iterate through all processes (Note: Only processes of like architecture/’bitness’ will be successfully scanned. Compile to run for x86/x64/etc.). – process : Scan a single process. Use with –pid=. – watch : Scan new processes when created. Adjust scan attributes with –checks and –sleep. (Note: This is experimental. Race conditions are likely.) [] Hunts (–hunt=)
– all : Default value. Analyze with all hunt options (Except ‘list’).
– memory-only : Memory hunt. Analyze CLR modules that are not backed by disk.
– unusual-dir : Unusual directory hunt. Analyze CLR modules loaded outside of ‘normal’ directories.
Edit ‘_huntUnusualDirectoryFilter’ to customize.
– sig-status : File signature hunt. Analyze CLR modules with anomalous signature status (e.g. unsigned). Note: This is experimental. False positives are possible.
Edit ‘_huntSigExclusionsFilter’ to customize.
imposter-file : Unexpected CLR module hunt. Analyze CLR module with suspicious disk file backing. Experimental.
– list : Iterate through all CLR modules and list accordingly.
[*] Example Usage
– Example 1 : Scan processes and run through all hunts for accessible 64-bit processes (except ‘list’) –
RogueAssemblyHunter_x64.exe –mode=sweep
– Example 2 : Scan processes, list all CLR modules in accessible 32-bit managed processes, and show error information –
RogueAssemblyHunter_x86.exe –mode=sweep –hunt=list –debug
– Example 3 : Watch for new processes, scan all CLR modules (if managed and 64-bit), do not scan the RogueAssemblyHunter process, and do 2 checks with a 3 second delay between –
RogueAssemblyHunter_x64.exe –mode=watch –suppress –checks=2 –sleep=3
– Example 4 : Scan single process by PID, list in-memory only CLR module findings, and export CLR modules to specified path –
RogueAssemblyHunter_x86.exe –mode=process –pid=4650 –hunt=memory-only –export=c:\evilassemblies\
– Example 5 : Scan processes, list in-memory only CLR module findings for accessible 64-bit processes, do no scan RogueAssemblyHunter process, and do not show title banner –
RogueAssemblyHunter_x64.exe –mode=sweep –hunt=memory[...]

___________________________
@hacking_Attack
@Hacking_Video

4 viewsedited 14:18

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
Heyserial : Programmatically Create Hunting Rules For Deserialization Exploitation

Heyserial will Programmatically create hunting rules for deserialization exploitation with multiple

* keywords (e.g. cmd.exe)
* gadget chains (e.g. CommonsCollection)
* object types (e.g. ViewState, Java, Python Pickle, PHP)
* encodings (e.g. Base64, raw)
* rule types (e.g. Snort, Yara)

Usage

Help: python3 heyserial.py -h

Examples:

python3 heyserial.py -c ‘ExampleChain::condition1+condition2’ -t JavaObj
python3 heyserial.py -k cmd.exe whoami ‘This file cannot be run in DOS mode’
python3 heyserial.py -k Process.Start -t NETViewState -e base64 “base64+utf16le”

Utils

utils/checkyoself.py

This is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.

Usage:

python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcap

Examples: python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_misses

utils/generate_payloads.ps1

YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.

* Source: https://github.com/pwntester/ysoserial.net
* License: ysoserial.net_LICENSE.txt

utils/generate_payloads.sh

YSoSerial payload generation. Run on Linux from the ./utils directory.

* Source: https://github.com/frohoff/ysoserial
* License: ysoserial_LICENSE.txt

utils/install_snort.sh

Installing Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.

Use at your own risk in a VM that you have snapshotted recently.

utils/server.py

Simple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.

Handy for generating test PCAPs.
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Heyserial : Programmatically Create Hunting Rules

Heyserial will Programmatically create hunting rules for deserialization exploitation with multiple keywords (e.g. cmd.exe).

5 viewsedited 14:18

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
BWASP : BoB Web Application Security Project

BWASP is BoB Web Application Security Project (BWASP) is an open-source, analysis tool to support for Web Vulnerability Manual Analysis hackers.

The BWASP tool basically provides predicted information through vulnerability analysis without proceeding with an attack.

BWASP supports performing automated analysis and manual analysis.

The BWASP Project supports:

* Find Attack vector automatically. (e.g. SQL Injection, Cross-site Scripting)
* Detect website technology.
* Log4J vulnerability scan (Partially supports java language)
* HTTP REST API
* GuideLine Result
* Test payload option(attack test)

Getting started

pip3 install -r requirements.txt
python3 start.py
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

BWASP : BoB Web Application Security Project !!! Kali Linux

BWASP is BoB Web Application Security Project is an open-source, analysis tool to support for Web Vulnerability Manual Analysis hackers.

4 viewsedited 14:18

Hacking Articles Tips Tricks Videos Tutorials

-only –suppress –nobanner Release Files: Invoke-RogueAssemblyHunter & Compiled BinariesFor convinience, a PowerShell script along with two compiled binaries (RogueAssemblyHunter_x64.exe and RogueAssemblyHunter_x86.exe) have been included in the \Release folder. Feel free to modify to fit your use cases (e.g. deployment, embedding, checks, sleep, etc.).

Example Usage

Run Invoke-RogueAssemblyHunter in sweep mode and check for all hunt options

cd c:\path\to\RogueAssemblyHunter
import-module .\Invoke-RogueAssemblyHunter.ps1
Invoke-RogueAssemblyHunter

Run Invoke-RogueAssemblyHunter in watch mode and check for all hunt options

cd c:\path\to\RogueAssemblyHunter
import-module .\Invoke-RogueAssemblyHunter.ps1
Invoke-RogueAssemblyHunter -ScanMode watch

SHA256 Hashes

e804711a8b6469f1b13b388de47dfa6dde1c85279d365db7b6e19e1644990fa6 Invoke-RogueAssemblyHunter.ps1
cc985d918e566671aa209142abc55bd798ca6c1a18730b785ac8c18d489736c3 RogueAssemblyHunter_x64.exe
ae3aead43871e263cd8465d5356c4daaae0635714321f872c931ec825008287a RogueAssemblyHunter_x86.exe Download

___________________________
@hacking_Attack
@Hacking_Video

5 viewsedited 14:18

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Without Conti On The Scene, LockBit 2.0 Leads Ransomware Attacks

Analysts say an 18% drop in ransomware attacks seen in May is likely fleeting, as Conti actors regroup.

5 views14:34

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
The Cybersecurity Talent Shortage Is a Myth

We have a tech innovation problem, not a staff retention (or recruitment) problem.

4 views14:34

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
7 Steps to Stronger SaaS Security

Continuous monitoring is key to keeping up with software-as-a-service changes, but that's not all you'll need to get better visibility into your SaaS security.

3 views14:34

Source

Hacking Articles Tips Tricks Videos Tutorials

Writing your own Burpsuite Extensions: Complete Guide
https://cirius.medium.com/writing-your-own-burpsuite-extensions-complete-guide-cb7aba4dbceb?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

Writing your own Burpsuite Extensions: Complete Guide

Recently I had to create some extensions for Burpsuite. I tried finding resources that could help me but couldn’t find much. Most of them…

4 viewsedited 14:45

Hacking Articles Tips Tricks Videos Tutorials

3 views14:45

Hacking Articles Tips Tricks Videos Tutorials

Recently I had to create some extensions for Burpsuite. I tried finding resources that could help me but couldn’t find much. Most of them…Continue reading on Medium » (https://cirius.medium.com/writing-your-own-burpsuite-extensions-complete-guide-cb7aba4dbceb?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video