Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials
Hakoriginfinder : Tool For Discovering The Origin Host Behind A Reverse Proxy. Useful For Bypassing Cloud WAFs

Hakoriginfinder is a tool for discovering the origin host behind a reverse proxy. Useful for bypassing WAFs and other reverse proxies.

How Does It Work?

This tool will first make a HTTP request to the hostname that you provide and store the response, then it will make a request to every IP address that you provide via HTTP (80) and HTTPS (443), with the Hostheader set to the original host. Each HTTP response is then compared to the original using the Levenshtein algorithm to determine similarity. If the response is similar, it will be deemed a match.

Usage

Provide the list of IP addresses via stdin, and the original hostname via the -h option. For example:

prips 93.184.216.0/24 | hakoriginfinder -h example.com

You may set the Levenshtein distance threshold with -l. The lower the number, the more similar the matches need to be for it to be considered a match, the default is 5.

The number of threads may be set with -t, default is 32.

The hostname is set with -h, there is no default.

Output

The output is 3 columns, separated by spaces. The first column is either “MATCH” or “NOMATCH” depending on whether the Levenshtein threshold was reached or not. The second column is the URL being teseted, and the third column is the Levenshtein score.

Output example

hakluke$ prips 1.1.1.0/24 | hakoriginfinder -h one.one.one.one
NOMATCH http://1.1.1.0 54366
NOMATCH http://1.1.1.30 54366
NOMATCH http://1.1.1.20 54366
NOMATCH http://1.1.1.4 54366
NOMATCH http://1.1.1.11 54366
NOMATCH http://1.1.1.5 54366
NOMATCH http://1.1.1.22 54366
NOMATCH http://1.1.1.13 54366
NOMATCH http://1.1.1.10 54366
NOMATCH http://1.1.1.25 54366
NOMATCH http://1.1.1.19 54366
… snipped for brevity …
NOMATCH http://1.1.1.251 54366
NOMATCH http://1.1.1.248 54366
MATCH http://1.1.1.1 0
NOMATCH http://1.1.1.3 19567
NOMATCH http://1.1.1.2 19517
MATCH https://1.1.1.1 0
NOMATCH https://1.1.1.3 19534
NOMATCH https://1.1.1.2 19532

Installation

Install golang, then run:

go install github.com/hakluke/hakoriginfinder@latest
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Hakoriginfinder : Discovering The Origin Host Behind A Reverse Proxy

Hakoriginfinder is a tool for discovering the origin host behind a reverse proxy. Useful for bypassing WAFs and other reverse proxies.

7 viewsedited 11:46

Hacking Articles Tips Tricks Videos Tutorials

5 views11:48

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
BinAbsInspector : Vulnerability Scanner For Binaries

BinAbsInspector (Binary Abstract Inspector) is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at Keenlab. It is based on abstract interpretation with the support from Ghidra. It works on Ghidra’s Pcode instead of assembly. Currently it supports binaries on x86,x64, armv7 and aarch64. Installation* Install Ghidra according to Ghidra’s documentation
* Install Z3 (tested version: 4.8.15)
* Note that generally there are two parts for Z3 library: one is Java package, the other one is native library. The Java package is already included in “/lib” directory, but we suggest that you replace it with your own Java package for version compatibility.
* For Windows, download a pre-built package from here, extract the zip file and add a PATH environment variable pointing to z3-${version}-win/bin* For Linux, install with package manager is NOT recommended, there are two options:
* You can download suitable pre-build package from here, extract the zip file and copy z3-${version}-win/bin/*.soto /usr/local/lib/* or you can build and install z3 according to Building Z3 using make and GCC/Clang

* For MacOS, it is similar to Linux.

* Download the extension zip file from release page
* Install the extension according to Ghidra Extension Notes BuildingBuild the extension by yourself, if you want to develop a new feature, please refer to development guide.

* Install Ghidra and Z3
* Install Gradle 7.x (tested version: 7.4)
* Pull the repository
* Run gradle buildExtensionunder repository root
* The extension will be generated at dist/${GhidraVersion}_${date}_BinAbsInspector.zipUsageYou can run BinAbsInspector in headless mode, GUI mode, or with docker.

* With Ghidra headless mode.

$GHIDRA_INSTALL_DIR/support/analyzeHeadless -import -postScript BinAbsInspector “@@” — Ghidra project path. — Ghidra project name. — The argument for our analyzer, provides following options:
ParameterDescription[-K KSet size limit K[-callStringK Call string maximum length K[-Z3Timeout Z3 timeout[-timeout Analysis timeout

[-entry 
]

Entry address[-externalMap External function model config[-json]Output in json format[-disableZ3]Disable Z3[-all]Enable all checkers[-debug]Enable debugging log output[-check "Enable specific checkers
* With Ghidra GUI
* Run Ghidra and import the target binary into a project
* Analyze the binary with default settings
* When the analysis is done, open Window -> Script Managerand find BinAbsInspector.java* Double-click on BinAbsInspector.javaentry, set the parameters in configuration window and click OK
* When the analysis is done, you can see the CWE reports in console window, double-click the addresses from the report can jump to corresponding address

* With Docker

git clone git@github.com:KeenSecurityLab/BinAbsInspector.git
cd BinAbsInspector
docker build . -t bai
docker run -v $(pwd):/data/workspace bai “@@ Implemented CheckersSo far BinAbsInspector supports following checkers:

* CWE78 (OS Command Injection)
* CWE119 (Buffer Overflow (generic case))
* CWE125 (Buffer Overflow (Out-of-bounds Read))
* CWE134 (Use of Externally-Controlled Format string)
* CWE190 (Integer overflow or wraparound)
* CWE367 (Time-of-check Time-of-use (TOCTOU))
* CWE415 (Double free)
* CWE416 (Use After Free)
* CWE426 (Untrusted Search Path)
* CWE467 (Use of sizeof() on a pointer type[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

BinAbsInspector : Vulnerability Scanner For Binaries

BinAbsInspector (Binary Abstract Inspector) is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries.

5 viewsedited 11:48

About

Blog

Apps

Platform