Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Maui Ransomware has made several targets since March 2021
https://cdn-images-1.medium.com/max/640/0*skBtOW_fVpWFMC0P.jpg
There have been many cases linked to North Korea State-Sponsored threat actors. But who was the one to notice its attack and how many…
Continue reading on Medium »
Maui Ransomware has made several targets since March 2021
https://cdn-images-1.medium.com/max/640/0*skBtOW_fVpWFMC0P.jpg
There have been many cases linked to North Korea State-Sponsored threat actors. But who was the one to notice its attack and how many…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Ethical Hacking Training in Kerala
OCTOBER 17, 2021 BYONKAR
Continue reading on Medium »
Ethical Hacking Training in Kerala
OCTOBER 17, 2021 BYONKAR
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
Bpflock - eBPF Driven Security For Locking And Auditing Linux Machines
https://blogger.googleusercontent.com/img/a/AVvXsEg87_fg2zsjt2SOO-S02EVTzzIzNcHHACD_2bJFljEMQCyb3jN66NI5lINUpXtWdEC9aDY3PP4URkC8TlKRekqwM4eSKSdTEDzbbAQ9kElur2Eonb_wBEP4ErgqClkSqV8eT7HAKNPXE9OcYE8u46-U7m0HhcYYrQDTIEP46ywptZxBIp_MGbuzWv8A=w640-h180 bpflock - eBPF driven security for locking and auditing Linux machines.
Note: bpflock is currently in experimental stage, it may break, options and security semantics may change, some BPF programs will be updated to use Cilium ebpf library. 1. Introductionbpflock uses eBPF to strength Linux security. By restricting access to a various range of Linux features, bpflock is able to reduce the attack surface and block some well known attack techniques.
Only programs like container managers, systemd and other containers/programs that run in the host pid and network namespaces are allowed access to full Linux features, containers and applications that run on their own namespace will be restricted. If bpflock bpf programs run under the
bpflock protects Linux machines by taking advantage of multiple security features including Linux Security Modules + BPF.
Architecture and Security design notes:
* bpflock is not a mandatory access control labeling solution, and it does not intent to replace AppArmor, SELinux, and other MAC solutions. bpflock uses a simple declarative security profile.
* bpflock offers multiple small bpf programs that can be reused in multiple contexts from Cloud Native deployments to Linux IoT devices.
* bpflock is able to restrict root from accessing certain Linux features, however it does not protect against evil root. 2. Functionality Overview2.1 Security featuresbpflock offer multiple security protections that can be classified as:
* Memory Protections
* Kernel Image Lock-down
* Kernel Modules Protection
* BPF Protection
* Process Protections
* Fileless Memory Execution
* Namespaces protection
* Hardware Addition Attacks
* USB Additions Protection
* System and Application tracing
* Trace Application Execution
* Trace Privileged System Operations
*
Filesystem Protections
* Read-only root filesystem protection
* sysfs protection
*
Network protections
* bpflock may include in future a simple network protection that can be used in single machine workload or Linux-IoT, but will not include a Cloud Native protection. Cilium and other kubernetes CNI related solutions are by far better. 2.2 Semanticsbpflock keeps the security semantics simple. It support three global profiles to broadly cover the security sepctrum, and restrict access to specific Linux features.
*
*
*
*
*
Under the
*
Bpflock - eBPF Driven Security For Locking And Auditing Linux Machines
https://blogger.googleusercontent.com/img/a/AVvXsEg87_fg2zsjt2SOO-S02EVTzzIzNcHHACD_2bJFljEMQCyb3jN66NI5lINUpXtWdEC9aDY3PP4URkC8TlKRekqwM4eSKSdTEDzbbAQ9kElur2Eonb_wBEP4ErgqClkSqV8eT7HAKNPXE9OcYE8u46-U7m0HhcYYrQDTIEP46ywptZxBIp_MGbuzWv8A=w640-h180 bpflock - eBPF driven security for locking and auditing Linux machines.
Note: bpflock is currently in experimental stage, it may break, options and security semantics may change, some BPF programs will be updated to use Cilium ebpf library. 1. Introductionbpflock uses eBPF to strength Linux security. By restricting access to a various range of Linux features, bpflock is able to reduce the attack surface and block some well known attack techniques.
Only programs like container managers, systemd and other containers/programs that run in the host pid and network namespaces are allowed access to full Linux features, containers and applications that run on their own namespace will be restricted. If bpflock bpf programs run under the
restrictedprofile then all programs/containers including privileged ones will have their access denied.bpflock protects Linux machines by taking advantage of multiple security features including Linux Security Modules + BPF.
Architecture and Security design notes:
* bpflock is not a mandatory access control labeling solution, and it does not intent to replace AppArmor, SELinux, and other MAC solutions. bpflock uses a simple declarative security profile.
* bpflock offers multiple small bpf programs that can be reused in multiple contexts from Cloud Native deployments to Linux IoT devices.
* bpflock is able to restrict root from accessing certain Linux features, however it does not protect against evil root. 2. Functionality Overview2.1 Security featuresbpflock offer multiple security protections that can be classified as:
* Memory Protections
* Kernel Image Lock-down
* Kernel Modules Protection
* BPF Protection
* Process Protections
* Fileless Memory Execution
* Namespaces protection
* Hardware Addition Attacks
* USB Additions Protection
* System and Application tracing
* Trace Application Execution
* Trace Privileged System Operations
*
Filesystem Protections
* Read-only root filesystem protection
* sysfs protection
*
Network protections
* bpflock may include in future a simple network protection that can be used in single machine workload or Linux-IoT, but will not include a Cloud Native protection. Cilium and other kubernetes CNI related solutions are by far better. 2.2 Semanticsbpflock keeps the security semantics simple. It support three global profiles to broadly cover the security sepctrum, and restrict access to specific Linux features.
*
profile: this is the global profile that can be applied per bpf program, it takes one of the followings:*
allow|none|privileged: they are the same, they define the least secure profile. In this profile access is logged and allowed for all processes. Useful to log security events.*
baseline: restrictive profile where access is denied for all processes, except privileged applications and containers that run in the host namespaces, or per cgroup allowed profiles in the bpflock_cgroupmapbpf map.*
restricted: heavily restricted profile where access is denied for all processes.*
Allowedor blockedoperations/commands:Under the
allow|privilegedor baselineprofiles, a list of allowed or blocked commands can be specified and will be applied.*
--protection-allow: comma-separated list of allowed operations. Valid under baselineprofile, this is useful for applications that are too specific and perform privileged operations. It[...]“Damn Vulnerable DeFi Wargame” Challenge #7 — Compromised Contract Analysis ️
https://medium.com/@Zer0Luck/damn-vulnerable-defi-wargame-challenge-7-compromised-contract-analysis-%EF%B8%8F-cafc2dd11ed8?source=rss------bug_bounty-5
https://medium.com/@Zer0Luck/damn-vulnerable-defi-wargame-challenge-7-compromised-contract-analysis-%EF%B8%8F-cafc2dd11ed8?source=rss------bug_bounty-5
Damn Vulnerable DeFi WargameContinue reading on Medium » (https://medium.com/@Zer0Luck/damn-vulnerable-defi-wargame-challenge-7-compromised-contract-analysis-%EF%B8%8F-cafc2dd11ed8?source=rss------bug_bounty-5)
Open Redirect vulnerability in igp.com
https://medium.com/@vignesh3004/open-redirect-vulnerability-in-igp-com-c1d76efc59b3?source=rss------bug_bounty-5
Hello everyone, I am Vignesh, a 20-year-old Security Researcher from TamilNadu, India.Continue reading on Medium » (https://medium.com/@vignesh3004/open-redirect-vulnerability-in-igp-com-c1d76efc59b3?source=rss------bug_bounty-5)
https://medium.com/@vignesh3004/open-redirect-vulnerability-in-igp-com-c1d76efc59b3?source=rss------bug_bounty-5
Hello everyone, I am Vignesh, a 20-year-old Security Researcher from TamilNadu, India.Continue reading on Medium » (https://medium.com/@vignesh3004/open-redirect-vulnerability-in-igp-com-c1d76efc59b3?source=rss------bug_bounty-5)
Open Redirect vulnerability in igp.com
Hello everyone, I am Vignesh, a 20-year-old Security Researcher from TamilNadu, India.Continue reading on Medium »
Read more...
Hello everyone, I am Vignesh, a 20-year-old Security Researcher from TamilNadu, India.Continue reading on Medium »
Read more...
Bpflock - eBPF Driven Security For Locking And Auditing Linux Machines
http://www.kitploit.com/2022/07/bpflock-ebpf-driven-security-for.html
http://www.kitploit.com/2022/07/bpflock-ebpf-driven-security-for.html
or GRUB_CMDLINE_LINUX="lsm=lockdown,capability,yama,apparmor,bpf"
Update grub config with: sudo update-grub2 Reboot into your kernel. 3.2 Docker deployment To run using the default allow or privileged profile (the least secure profile): docker run --name bpflock -it --rm --cgroupns=host \
--pid=host --privileged \
-v /sys/kernel/:/sys/kernel/ \
-v /sys/fs/bpf:/sys/fs/bpf linuxlock/bpflock Fileless Binary Execution To log and restict fileless binary execution (https://github.com/linux-lock/bpflock/tree/main/docs/process-protections.md#fileless-memory-execution) run with: docker run --name bpflock -it --rm --cgroupns=host --pid=host --privileged \
-e "BPFLOCK_FILELESSLOCK_PROFILE=restricted" \
-v /sys/kernel/:/sys/kernel/ \
-v /sys/fs/bpf:/sys/fs/bpf linuxlock/bpflock When running under restricted profile, the container logs will display: Running under the restricted profile may break things, this is why the default profile is allow. Kernel Modules Protection To apply Kernel Modules Protection (https://github.com/linux-lock/bpflock/tree/main/docs/memory-protections.md#2-kernel-modules-protection) run with environment variable BPFLOCK_KMODLOCK_PROFILE=baseline or BPFLOCK_KMODLOCK_PROFILE=restricted: docker run --name bpflock -it --rm --cgroupns=host --pid=host --privileged \
-e "BPFLOCK_KMODLOCK_PROFILE=restricted" \
-v /sys/kernel/:/sys/kernel/ \
-v /sys/fs/bpf:/sys/fs/bpf linuxlock/bpflock Example: $ sudo unshare -p -n -f
# modprobe xfs
modprobe: ERROR: could not insert 'xfs': Operation not permitted Kernel Image Lock-down To apply Kernel Image Lock-down (https://github.com/linux-lock/bpflock/tree/main/docs/memory-protections.md#1-kernel-image-lock-down) run with environment variable BPFLOCK_KIMGLOCK_PROFILE=baseline: docker run --name bpflock -it --rm --cgroupns=host --pid=host --privileged \
-e "BPFLOCK_KIMGLOCK_PROFILE=baseline" \
-v /sys/kernel/:/sys/kernel/ \
-v /sys/fs/bpf:/sys/fs/bpf linuxlock/bpflock $ sudo unshare -f -p -n bash
# head -c 1 /dev/mem
head: cannot open '/dev/mem' for reading: Operation not permitted BPF Protection To apply bpf restriction (https://github.com/linux-lock/bpflock/tree/main/docs/memory-protections.md#3-bpf-protection) run with environment variable BPFLOCK_BPFRESTRICT_PROFILE=baseline or BPFLOCK_BPFRESTRICT_PROFILE=restricted: docker run --name bpflock -it --rm --cgroupns=host --pid=host --privileged \
-e "BPFLOCK_BPFRESTRICT_PROFILE=baseline" \
-v /sys/kernel/:/sys/kernel/ \
-v /sys/fs/bpf:/sys/fs/bpf linuxlock/bpflock Example running in a different pid and network namespaces (https://www.kitploit.com/search/label/Namespaces) and using bpftool (https://github.com/libbpf/bpftool): $ sudo unshare -f -p -n bash
# bpftool prog
Error: can't get next program: Operation not permitted Running with the -e "BPFLOCK_BPFRESTRICT_PROFILE=restricted" profile will deny bpf for all: 3.3 Configuration and Environment file Passing configuration as bind mounts can be achieved using the following command. Assuming bpflock.yaml (https://github.com/linux-lock/bpflock/blob/main/deploy/configs/bpflock/bpflock.yaml) and bpf.d profiles (https://github.com/linux-lock/bpflock/blob/main/deploy/configs/bpflock/bpf.d/) configs are in current directory inside bpflock directory, then we can just use: ls bpflock/
bpf.d bpflock.d bpflock.yaml docker run --name bpflock -it --rm --cgroupns=host --pid=host --privileged \
-v $(pwd)/bpflock/:/etc/bpflock \
-v /sys/kernel/:/sys/kernel/ \
-v /sys/fs/bpf:/sys/fs/bpf linuxlock/bpflock Passing environment variables can also be done with files using --env-file. All parameters can be passed as environment variables using the BPFLOCK_$VARIABLE_NAME=VALUE format. Example run with environment variables in a file: docker run --name bpflock -it --rm --cgroupns=host --pid=host --privileged \
--env-file bpflock.env.list \
-v /sys/kernel/:/sys/kernel/ \
Update grub config with: sudo update-grub2 Reboot into your kernel. 3.2 Docker deployment To run using the default allow or privileged profile (the least secure profile): docker run --name bpflock -it --rm --cgroupns=host \
--pid=host --privileged \
-v /sys/kernel/:/sys/kernel/ \
-v /sys/fs/bpf:/sys/fs/bpf linuxlock/bpflock Fileless Binary Execution To log and restict fileless binary execution (https://github.com/linux-lock/bpflock/tree/main/docs/process-protections.md#fileless-memory-execution) run with: docker run --name bpflock -it --rm --cgroupns=host --pid=host --privileged \
-e "BPFLOCK_FILELESSLOCK_PROFILE=restricted" \
-v /sys/kernel/:/sys/kernel/ \
-v /sys/fs/bpf:/sys/fs/bpf linuxlock/bpflock When running under restricted profile, the container logs will display: Running under the restricted profile may break things, this is why the default profile is allow. Kernel Modules Protection To apply Kernel Modules Protection (https://github.com/linux-lock/bpflock/tree/main/docs/memory-protections.md#2-kernel-modules-protection) run with environment variable BPFLOCK_KMODLOCK_PROFILE=baseline or BPFLOCK_KMODLOCK_PROFILE=restricted: docker run --name bpflock -it --rm --cgroupns=host --pid=host --privileged \
-e "BPFLOCK_KMODLOCK_PROFILE=restricted" \
-v /sys/kernel/:/sys/kernel/ \
-v /sys/fs/bpf:/sys/fs/bpf linuxlock/bpflock Example: $ sudo unshare -p -n -f
# modprobe xfs
modprobe: ERROR: could not insert 'xfs': Operation not permitted Kernel Image Lock-down To apply Kernel Image Lock-down (https://github.com/linux-lock/bpflock/tree/main/docs/memory-protections.md#1-kernel-image-lock-down) run with environment variable BPFLOCK_KIMGLOCK_PROFILE=baseline: docker run --name bpflock -it --rm --cgroupns=host --pid=host --privileged \
-e "BPFLOCK_KIMGLOCK_PROFILE=baseline" \
-v /sys/kernel/:/sys/kernel/ \
-v /sys/fs/bpf:/sys/fs/bpf linuxlock/bpflock $ sudo unshare -f -p -n bash
# head -c 1 /dev/mem
head: cannot open '/dev/mem' for reading: Operation not permitted BPF Protection To apply bpf restriction (https://github.com/linux-lock/bpflock/tree/main/docs/memory-protections.md#3-bpf-protection) run with environment variable BPFLOCK_BPFRESTRICT_PROFILE=baseline or BPFLOCK_BPFRESTRICT_PROFILE=restricted: docker run --name bpflock -it --rm --cgroupns=host --pid=host --privileged \
-e "BPFLOCK_BPFRESTRICT_PROFILE=baseline" \
-v /sys/kernel/:/sys/kernel/ \
-v /sys/fs/bpf:/sys/fs/bpf linuxlock/bpflock Example running in a different pid and network namespaces (https://www.kitploit.com/search/label/Namespaces) and using bpftool (https://github.com/libbpf/bpftool): $ sudo unshare -f -p -n bash
# bpftool prog
Error: can't get next program: Operation not permitted Running with the -e "BPFLOCK_BPFRESTRICT_PROFILE=restricted" profile will deny bpf for all: 3.3 Configuration and Environment file Passing configuration as bind mounts can be achieved using the following command. Assuming bpflock.yaml (https://github.com/linux-lock/bpflock/blob/main/deploy/configs/bpflock/bpflock.yaml) and bpf.d profiles (https://github.com/linux-lock/bpflock/blob/main/deploy/configs/bpflock/bpf.d/) configs are in current directory inside bpflock directory, then we can just use: ls bpflock/
bpf.d bpflock.d bpflock.yaml docker run --name bpflock -it --rm --cgroupns=host --pid=host --privileged \
-v $(pwd)/bpflock/:/etc/bpflock \
-v /sys/kernel/:/sys/kernel/ \
-v /sys/fs/bpf:/sys/fs/bpf linuxlock/bpflock Passing environment variables can also be done with files using --env-file. All parameters can be passed as environment variables using the BPFLOCK_$VARIABLE_NAME=VALUE format. Example run with environment variables in a file: docker run --name bpflock -it --rm --cgroupns=host --pid=host --privileged \
--env-file bpflock.env.list \
-v /sys/kernel/:/sys/kernel/ \
-v /sys/fs/bpf:/sys/fs/bpf linuxlock/bpflock 4. Documentation Documentation files can be found here (https://github.com/linux-lock/bpflock/tree/main/docs/). 5. Build bpflock uses docker BuildKit (https://docs.docker.com/develop/develop-images/build_enhancements/) to build and Golang (https://go.dev/doc/install) to make some checks and run tests. bpflock is built inside Ubuntu container that downloads the standard golang package. Run the following to build the bpflock docker container: git submodule update --init --recursive
make Bpf programs are built using libbpf. The docker image used is Ubuntu. If you want to only build the bpf programs directly without using docker, then on Ubuntu: sudo apt install -y pkg-config bison binutils-dev build-essential \
flex libc6-dev clang-12 libllvm12 llvm-12-dev libclang-12-dev \
zlib1g-dev libelf-dev libfl-dev gcc-multilib zlib1g-dev \
libcap-dev libiberty-dev libbfd-dev Then run: make bpf-programs In this case the generated programs will be inside the ./bpf/build/... directory. Credits bpflock uses lot of resources including source code from the Cilium (https://github.com/cilium/cilium) and bcc (https://github.com/iovisor/bcc) projects. License The bpflock user space components are licensed under the Apache License, Version 2.0 (https://github.com/linux-lock/bpflock/blob/main/LICENSE). The BPF code where it is noted is licensed under the General Public License, Version 2.0 (https://github.com/linux-lock/bpflock/blob/main/src/COPYING).
Download Bpflock (https://github.com/linux-lock/bpflock)
make Bpf programs are built using libbpf. The docker image used is Ubuntu. If you want to only build the bpf programs directly without using docker, then on Ubuntu: sudo apt install -y pkg-config bison binutils-dev build-essential \
flex libc6-dev clang-12 libllvm12 llvm-12-dev libclang-12-dev \
zlib1g-dev libelf-dev libfl-dev gcc-multilib zlib1g-dev \
libcap-dev libiberty-dev libbfd-dev Then run: make bpf-programs In this case the generated programs will be inside the ./bpf/build/... directory. Credits bpflock uses lot of resources including source code from the Cilium (https://github.com/cilium/cilium) and bcc (https://github.com/iovisor/bcc) projects. License The bpflock user space components are licensed under the Apache License, Version 2.0 (https://github.com/linux-lock/bpflock/blob/main/LICENSE). The BPF code where it is noted is licensed under the General Public License, Version 2.0 (https://github.com/linux-lock/bpflock/blob/main/src/COPYING).
Download Bpflock (https://github.com/linux-lock/bpflock)
$1.333 For Account Takeover Via Reset Password
https://medium.com/@ibnu1337/1-333-for-account-takeover-via-reset-password-349f0c455555?source=rss------bug_bounty-5
https://medium.com/@ibnu1337/1-333-for-account-takeover-via-reset-password-349f0c455555?source=rss------bug_bounty-5
Assalamualaikum, Halo Bug Hunter!
Kali ini gw nemu celah keamanan yang Sangat Critical pada salah satu Aplikasi. Tanpa basa basi, langsung…Continue reading on Medium » (https://medium.com/@ibnu1337/1-333-for-account-takeover-via-reset-password-349f0c455555?source=rss------bug_bounty-5)
Kali ini gw nemu celah keamanan yang Sangat Critical pada salah satu Aplikasi. Tanpa basa basi, langsung…Continue reading on Medium » (https://medium.com/@ibnu1337/1-333-for-account-takeover-via-reset-password-349f0c455555?source=rss------bug_bounty-5)
MSA Weekly 5 - “How to Get Sensitive Data Exposure on Web Application”
https://medium.com/@ajisnt1907/msa-weekly-5-how-to-get-sensitive-data-exposure-on-web-application-b2ff7483f056?source=rss------bug_bounty-5
https://medium.com/@ajisnt1907/msa-weekly-5-how-to-get-sensitive-data-exposure-on-web-application-b2ff7483f056?source=rss------bug_bounty-5