Dumpscan is a command-line tool designed to extract and dump secrets from kernel and Windows Minidump formats. Kernel-dump parsing is provided by volatility3 (https://github.com/volatilityfoundation/volatility3).
Features x509 Public and Private key (PKCS #8/PKCS #1) parsing SymCrypt (https://github.com/microsoft/SymCrypt) parsing Supported structures SYMCRYPT_RSAKEY - Determines if the key structure also has a private key Matching to public certificates (https://www.kitploit.com/search/label/Certificates) found in the same process More SymCrypt structures to come Environment variables Command line arguments Note: Testing has only been performed on Windows 10 and 11 64-bit hosts and processes. Feel free to file an issue for additional versions. Linux testing TBD. Installation As a command-line tool, installation is recommended using pipx (https://github.com/pypa/pipx). This allows for easy updates and well and ensuring it is installed in its own virtual environment. pipx install dumpscan
pipx inject dumpscan git+https://github.com/volatilityfoundation/volatility3#39e812a
Usage Usage: dumpscan [OPTIONS] COMMAND [ARGS]...

Scan memory dumps for secrets and keys

╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ --help Show this message and exit. &#9474 ;
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ kernel Scan kernel dump using volatility │
│ minidump Scan a user-mode minidump │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
In the case for subcommands that extract certificates, you can provide --output/-o to output any discovered certificates to disk. Kernel Mode As mentioned, kernel analysis is performed by Volatility3. cmdline, envar, and pslist are direct calls to the Volatility3 plugins, while symcrypt and x509 are custom plugins. Usage: dumpscan kernel [OPTIONS] COMMAND [ARGS]...

Scan kernel dump using volatility

╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ --help Show this message and exit. ╰
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ cmdline List command line (https://www.kitploit.com/search/label/Command%20Line) for processes (Only for Windows) │
│ envar List process environment variables (Only for Windows) │
│ pslist List all the processes and their command lin e arguments │
│ symcrypt Scan a kernel-mode dump for symcrypt objects │

│ x509 Scan a kernel-mode dump for x509 certificates │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
Minidump Mode Supports Windows Minidump format. Note: This has only been tested on 64-bit processes on Windows 10+. 32-bit processes requires additional work but isn't a priority. Usage: dumpscan minidump [OPTIONS] COMMAND [ARGS]...

Scan a user-mode minidump

╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ --help Show this message and exit. │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ cmdline Dump the command line string │
│ envar Dump the environment variables in a minidump │
│ symcrypt Scan a minidump for symcrypt objects │
│ x509 Scan a minidump for x509 objects │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
Built With volatility3 (https://github.com/volatilityfoundation/volatility3) construct (https://github.com/construct/construct) yara-python (https://github.com/VirusTotal/yara-python) typer (https://github.com/tiangolo/typer) rich (https://github.com/Textualize/rich) rich_click (https://github.com/ewels/rich-click) Acknowledgements Thanks to F-Secure (https://github.com/FSecureLABS) and the physmem2profit (https://github.com/FSecureLABS/physmem2profit) project for providing the idea to use construct for parsing minidumps. Thanks to Skelsec (https://github.com/skelsec) and his minidump (https://github.com/skelsec/minidump) project which helped me figure out to parse minidumps. To-Do Verify use against 32-bit minidumps Create a coredump parser for Linux process dumps Verify volatility plugins (https://www.kitploit.com/search/label/Volatility%20Plugins) work against Linux kernel dumps Add an HTML report that shows all plugins Code refactoring to make more extensible MORE SECRETS

Download Dumpscan (https://github.com/daddycocoaman/dumpscan)

hacking: security in practice
My account was pwned

What can I do if my account has been pwned for three times? Im not sure if this is the right place to ask questions, but I hope some of you can help.

submitted by /u/nocapdaddyugh
[link] [comments]

hacking: security in practice
PDF Malware and protection

Hi, I heard about the hack of the Ronin network, which was accomplished via a malicious PDF file. So I asked myself if there are ways of protection to prevent an infiltration like this. Besides the obvious ways of deactivating JavaScript and making the staff more aware, is there more that could be done? Like opening a PDF in a sandbox like environment? I don't mean virtual machines, since that would be overkill to open a PDF, but something more lightweight like docker.

submitted by /u/Cano_7_7
[link] [comments]

hacking: security in practice
Are there unethical hackers for hire out there?

Are there any unethical hackers that actually provide proof of their work before they ask for money? Or is true that it's a service that you can't really hire?

submitted by /u/Klxpp
[link] [comments]

hacking: security in practice
Can my parents see internet traffic of specific apps on my Windows 10 pc?

I have a question, I have fairly strict parents that like to monitor what I do with my computer. So I’m wondering if they could also see the certain requests that some apps are making to the internet if they wanted to. For example, if I want to update Photoshop to its newest version, can they see that I downloaded that update? And if so, how do they see this and can intervene somehow?

Thank you in advance

submitted by /u/Vaizyyy
[link] [comments]

Black Hat Ethical Hacking
Recon Tool: WayMore

Recon Tool: WayMorePost Views: 70 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png
Subscribe to Patreon to watch this episode.
Reading Time: 4 Minutes
Anyone who does Bug Bounty will have likely used the amazing waybackurls by TomNomNom. The idea behind waymore by xnlh4ck3r is to find even more links from the Wayback Machine than other existing tools.

The biggest difference between waymore and other tools is that it can also download the archived responses for URLs on wayback machine so that you can then search these for even more links, developer comments, extra parameters, and so on.

This tool gets URLs from:

* Wayback Machine (web.archive.org)
* Common Crawl (index.commoncrawl.org)
* Alien Vault OTX (otx.alienvault.com)
* URLScan (urlscan.io) Installationwaymore supports Python 3.

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/installation-1-1024x427.png

if you’re having a problem running the setup.py for whatever reason you can run the following to install the dependencies:

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/dependencies.png
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course UsageArg Long Arg Description -i –input The target domain to find links for. This can be a domain only, or a domain with a specific path. If it is a domain only to get everything for that domain, don;t prefix with www. -mode The mode to run: U (retrieve URLs only), R (download Responses only) or B (Both). If -i is a domain only, then -mode will default to B. If -i is a domain with path then -mode will default to R. -n –no-subs Don’t include subdomains of the target domain (only used if input is not a domain with a specific path). -f –filter-responses-only The initial links from Wayback Machine will not be filtered, only the responses that are downloaded, , e.g. it maybe useful to still see all available paths from the links even if you don’t want to check the content. -l –limit How many responses will be saved (if -b is not passed). A positive value will get the first N results, a negative value will will get the last N results. A value of 0 will get ALL responses (default: 5000) -from –from-date What date to get responses from. If not specified it will get from the earliest possible results. A partial value can be passed, e.g. 2016, 201805, etc. -to –to-date What date to get responses to. If not specified it will get to the latest possible results. A partial value can be passed, e.g. 2021, 202112, etc. -ci –capture-interval Filters the search on archive.org to only get at most 1 capture per hour (h), day (d) or month (m). This filter is used for responses only. The default is ‘d’ but can also be set to ‘none’ to not filter anything and get all responses. -ra –regex-after RegEx for filtering purposes against links found from archive.org/commoncrawl.org AND responses downloaded. Only positive matches will be output. -url-filename Set the file name of downloaded responses to the URL that generated the response, otherwise it will be set to the hash value of the response. Using the hash value means multiple URLs that generated the same response will only result in one file being saved for that response. -xcc Exclude checks to commoncrawl.org. Searching all their index collections can take a while, and often it may not return any extra URLs that weren’t already found on archive.org -xav Exclude checks to alienvault.com. Searching all their pages can take a while, and often it may not return any extra URLs that weren’t already found on archive.org -lcc Limit the number of Common Crawl index collections searched, e.g. -lcc 10 will just search the latest 10 collections.. As of June 2022 there are currently 88 collections. Setting to 0 (def[...]

ault) will search ALL collections. If you don’t want to search Common Crawl at all, use the -xcc option. -t –timeout This is for archived responses only! How many seconds to wait for the server to send data before giving up (default: 30) -p –processes Basic multithreading is done when getting requests for a file of URLs. This argument determines the number of processes (threads) used (default: 3) -r –retries The number of retries for requests that get connection error or rate limited (default: 1). -v –verbose Verbose output -h –help show the help message and exit Input and ModeThe input -i can either be a domain only, e.g. redbull.com or a specific domain and path, e.g. redbull.com/robots.txt.

There are different modes that can be run for waymore. The -mode argument can be 3 different value:

* U – URLs will be retrieved from archive.org, commoncrawl.org (if -xcc is not passed) and otx.alienvault.com (if -xvv is not passed)
* R – Responses will be downloaded from archive.org
* B – Both URLs and Responses will be retrieved
If the input was a specific URL, e.g. redbull.com/robots.txt then the -mode defaults to R. Only responses will be downloaded. You cannot change the mode to U or B for a domain with path because it isn’t necessary to retrieve URLs for a specific URL.

If the input is just a domain, e.g. redbull.com then the -mode defaults to B. It can be changed to U or R if required. When a domain only is passed then all URLs/responses are retrieved for that domain (and sub domains unless -n is passed). If the no sub domain option -n is passed then the www sub domain is still included by default.
See Also: OSINT Tool: Pagodo config.ymlThe config.yml file have filter values that can be updated to suit your needs. These are all provided as comma separated lists:

* FILTER_CODE – Exclusions used to exclude responses we will try to get from web.archive.org, and also for file names when -i is a directory, e.g. 301,302
* FILTER_MIME – MIME Content-Type exclusions used to filter links and responses from web.archive.org through their API, e.g. ‘text/css,image/jpeg
* FILTER_URL – Response code exclusions we will use to filter links and responses from web.archive.org through their API, e.g. .css,.jpg
NOTE: The MIME types cannot be filtered for Alien Vault results because they do not return that in the API response. OutputIn the path of the waymore.py file, a results directory will be created. Within that, a directory will be created with target domain (or domain with path) passed with -i. When run, the following files are created in the target directory:
* waymore.txt – If -mode is U or B, this file will contain links from archive.org. Also any additional links from commoncrawl.org (if -xcc wasn’t passed) and otx.alienvault.com (if -xav wasn’t passed).
* index.txt – If -mode is R or B, and -url-filname was not passed then archived responses will be downloaded and hash values will be used for the saved file names. This file contains a comma separated list of <hash,<archive,<timestamp in case you need to know which URLs produced which response.
* *.xnl – These archived response files will be created if -mode was R or B. If -url-filename was passed the the file names will be the archive URL that generated the response, e.g. https–example.com-robots.txt.xnl, otherwise the file name will be a hash value, e.g. 7960113391501.xnl. Using hash values mean that less files will be written as there will only be one file per unique response. These archived responses are edited, before being saved, to remove any reference to web.archive.org. Info and SuggestionsThe number of links found, and then potentially the number of files archived responses you will download could potentially be HUGE for many domains. This tool isn’t about speed, it’s about finding more, so be patient.

There is a -p option to increase the number of processes (used when retrieving links from all sources, and downloading archived responses from archive.org). Howev[...]

GOOD RECON LEADS TO SENSSITIVE ACCOUNTS
https://medium.com/@milanjain7906/good-recon-leads-to-senssitive-accounts-a8abb6c21333?source=rss------bug_bounty-5

Hello people i have back with new hacking story !! . so yesterday i was hunting on one of the vdp program let’s consider it xyz.com . so…Continue reading on Medium » (https://medium.com/@milanjain7906/good-recon-leads-to-senssitive-accounts-a8abb6c21333?source=rss------bug_bounty-5)

Bypass Firewall and get the Real IP Address of a Website
https://www.reddit.com/r/Pentesting/comments/vzrdct/bypass_firewall_and_get_the_real_ip_address_of_a/

submitted by /u/Simple_Sand_7 (https://www.reddit.com/user/Simple_Sand_7)
[link] (https://youtube.com/watch?v=LVWEVynYjsY&feature=share) [comments] (https://www.reddit.com/r/Pentesting/comments/vzrdct/bypass_firewall_and_get_the_real_ip_address_of_a/)

How I Got My First CVE
https://medium.com/@tobydavenn/how-i-got-my-first-cve-a157606cc86e?source=rss------bug_bounty-5

Hello readers,Continue reading on Medium » (https://medium.com/@tobydavenn/how-i-got-my-first-cve-a157606cc86e?source=rss------bug_bounty-5)