Let's configure LAUREL to turn the software_mgmt key into a process label that is propagated to child processes: Together with a ruleset that logs execve(2) and variants, this will cause every event directly caused by apt-get and its subprocesses to be labelled software_mgmt. For example, running sudo apt-get update on a Debian/bullseye system with a few sources configured, the following subprocesses labelled software_gmt can be observed in LAUREL's audit log: apt-get update /usr/bin/dpkg --print-foreign-architectures /usr/lib/apt/methods/http /usr/lib/apt/methods/https /usr/lib/apt/methods/https /usr/lib/apt/methods/http /usr/lib/apt/methods/gpgv /usr/lib/apt/methods/gpgv /usr/bin/dpkg --print-foreign-architectures /usr/bin/dpkg --print-foreign-architectures This sort of tracking (https://www.kitploit.com/search/label/Tracking) also works for package installation or removal. If some package's post-installation script is behaving suspiciously, a SIEM analyst will be able to make the connection to the software installation process by inspecting the single event. Installation See INSTALL.md (https://github.com/threathunters-io/laurel/blob/master/INSTALL.md). License GNU General Public License, version 3 Authors Hilko Bengen Sergej Schmidt The logo was created by Birgit Meyer .
Download Laurel (https://github.com/threathunters-io/laurel)
Download Laurel (https://github.com/threathunters-io/laurel)
Publicly Accessible Android Crash Reports Containing Sensitive Information
Hello Guys,Continue reading on Medium »
Read more...
Hello Guys,Continue reading on Medium »
Read more...
CVE-MAKER : An Hub for CVE and Exploits searching
https://www.reddit.com/r/Pentesting/comments/w8hmwa/cvemaker_an_hub_for_cve_and_exploits_searching/
https://www.reddit.com/r/Pentesting/comments/w8hmwa/cvemaker_an_hub_for_cve_and_exploits_searching/
submitted by /u/msd0pe (https://www.reddit.com/user/msd0pe)
[link] (https://github.com/msd0pe-1/cve-maker) [comments] (https://www.reddit.com/r/Pentesting/comments/w8hmwa/cvemaker_an_hub_for_cve_and_exploits_searching/)
[link] (https://github.com/msd0pe-1/cve-maker) [comments] (https://www.reddit.com/r/Pentesting/comments/w8hmwa/cvemaker_an_hub_for_cve_and_exploits_searching/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
The Difference between White-Box and Black-Box Pentesting
The Difference between White-Box and Black-Box PentestingPost Views: 16
Reading Time: 3 Minutes IntroductionEach Pentesting solution is different, with varying expertise and specialties. Before you decide who will perform it and which approach you will take, it’s important to have an idea of what you want out of a Pentesting.
For example, you’ll need to decide on the scope of work and what area of the infrastructure you want to assess, like your network, web applications, or different IoT devices. You also need to think about the project type, determining whether you’re looking for a more focused penetration test that will uncover and exploit weaknesses or a more comprehensive teaming exercise aimed at training a defense team by simulating an attack scenario.
Whether Internal or External, the approach certainly is important to study before proceeding in choosing the assessment. The way you discuss your scope in the initial stages and define the amount of info shared can be crucial. In the real world, an attacker will have zero knowledge and will still get access if he targets your company without any questions asked.
In this article, we will explain the difference between White-Box and Black-Box Penetration Testing.
When we speak of Black and White Boxes, we are speaking of the amount of access a pentester has been given before attempting to breach a system or network and the approach.
See Also: Solutions: Internal and External Pentesting So, what are the differences between the White-Box and Black-Box Pentesting?White-Box:Also known as Clear Box testing or Glass Box testing, is a penetration testing approach that involves sharing full access network and system information with the testers. White-Box testing aims to identify potential weaknesses in various areas such as logical vulnerabilities, potential security exposures, security misconfigurations, poorly written development code, and lack-of-defensive measures.
The goal of a White-Box penetration test is to provide as much information as possible to the penetration tester so that he/she can gain an insightful understanding of the system and elaborate the test based on it specifically giving us in scope only things to check.
Having and sharing this information helps to save time and reduce the overall cost of an engagement. White Box testing is considered low-level testing.
The Pros of this type of testing are:
* Deep and thorough testing
* Maximizes testing time
* Extends the testing area dealing with critical issues
The Cons of this type of testing are:
* It makes assessments more difficult and limited in exploitation where the live impact is involved in the current state of systems in scope.
* Test cases are difficult to design due to environment-specific metrics, and finding vulnerabilities may take longer than other tests.
However, it is a non-realistic attack, as the penetration tester is not in the same position as a non-informed potential attacker. Also in the real world, hackers are not told what is in scope or how and when to attack. This is where Black-Box comes in. Black-Box:A Black-Box penetration test requires little or no information from the tester about the target system (applications or network) and usually takes the approach of an uninformed attacker. The pentester in this instance follows the approach of an unprivileged attacker, from initial access and execution through to exploitation.
This type of testing can be seen as the most authentic and realistic of a Cyber Attack, demonstrating how an adversary with no inside knowledge would target and compromise an organization. Just like in the real w[...]
The Difference between White-Box and Black-Box Pentesting
The Difference between White-Box and Black-Box PentestingPost Views: 16
Reading Time: 3 Minutes IntroductionEach Pentesting solution is different, with varying expertise and specialties. Before you decide who will perform it and which approach you will take, it’s important to have an idea of what you want out of a Pentesting.
For example, you’ll need to decide on the scope of work and what area of the infrastructure you want to assess, like your network, web applications, or different IoT devices. You also need to think about the project type, determining whether you’re looking for a more focused penetration test that will uncover and exploit weaknesses or a more comprehensive teaming exercise aimed at training a defense team by simulating an attack scenario.
Whether Internal or External, the approach certainly is important to study before proceeding in choosing the assessment. The way you discuss your scope in the initial stages and define the amount of info shared can be crucial. In the real world, an attacker will have zero knowledge and will still get access if he targets your company without any questions asked.
In this article, we will explain the difference between White-Box and Black-Box Penetration Testing.
When we speak of Black and White Boxes, we are speaking of the amount of access a pentester has been given before attempting to breach a system or network and the approach.
See Also: Solutions: Internal and External Pentesting So, what are the differences between the White-Box and Black-Box Pentesting?White-Box:Also known as Clear Box testing or Glass Box testing, is a penetration testing approach that involves sharing full access network and system information with the testers. White-Box testing aims to identify potential weaknesses in various areas such as logical vulnerabilities, potential security exposures, security misconfigurations, poorly written development code, and lack-of-defensive measures.
The goal of a White-Box penetration test is to provide as much information as possible to the penetration tester so that he/she can gain an insightful understanding of the system and elaborate the test based on it specifically giving us in scope only things to check.
Having and sharing this information helps to save time and reduce the overall cost of an engagement. White Box testing is considered low-level testing.
The Pros of this type of testing are:
* Deep and thorough testing
* Maximizes testing time
* Extends the testing area dealing with critical issues
The Cons of this type of testing are:
* It makes assessments more difficult and limited in exploitation where the live impact is involved in the current state of systems in scope.
* Test cases are difficult to design due to environment-specific metrics, and finding vulnerabilities may take longer than other tests.
However, it is a non-realistic attack, as the penetration tester is not in the same position as a non-informed potential attacker. Also in the real world, hackers are not told what is in scope or how and when to attack. This is where Black-Box comes in. Black-Box:A Black-Box penetration test requires little or no information from the tester about the target system (applications or network) and usually takes the approach of an uninformed attacker. The pentester in this instance follows the approach of an unprivileged attacker, from initial access and execution through to exploitation.
This type of testing can be seen as the most authentic and realistic of a Cyber Attack, demonstrating how an adversary with no inside knowledge would target and compromise an organization. Just like in the real w[...]
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking The Difference between White-Box and Black-Box Pentesting The Difference between White-Box and Black-Box PentestingPost Views: 16 Reading Time: 3 Minutes IntroductionEach Pentesting solution is different, with varying expertise…
orld.
However, it also requires a great deal of time and has the greatest potential to overlook a vulnerability that exists within the internal part of a network or application.
Black-Box testing is a powerful testing technique because it exercises the behavior of a system end-to-end.
The Pros of this type of attack are:
* Ability to approach your company by all means necessary. Unorthodox techniques are used that combine Social Engineering, manually look for outdated versions, and exploit them using custom code and tools to gain and elevate access.
* Post exploitation then goes through spending time inside your network performing and looking for information that could damage your company, including planting ransomware and escalating to a more critical impact.
The Cons of this type of attack are:
* It does not cover in-depth assessment as compared to white-box tests.
* It is performed against production environments in the case of an active directory, and internal LAN/networks.
See Also: Solutions: Web Application Pentesting Which one is best for your Company?A penetration test aims to identify potential vulnerabilities in your systems before criminal hackers do. When commissioning a penetration test, by Defining the concerns, you would like to resolve is essential to designing a customized approach that will effectively meet the necessary security requirements and result in the most value from your penetration testing investment. There is no right/wrong decision about White-Box or Black-Box. It depends on the scenario that needs to be tested and your requirements.
Our team of highly skilled and innovative ethical hackers at BHEH customizes every engagement to ensure the most thorough penetration test possible tailored to your needs. We understand that not every architecture or application fits into a predefined box and will require an adaptive testing methodology to develop a solution that works best for your organization.
There is no minimum threat in Cyber Security. An old saying about achieving high quality in manufacturing is “You can’t manage what you can’t measure.” From an Information Security standpoint, a better expression would be “You can’t protect what you can’t see.” Most importantly, you need visibility to where sensitive information is at all times.
After all, how would you know how you withstand a targeted attack if you do not test your equipment setups?
To find out more about how Black Hat Ethical Hacking can help you, check out our Solutions https://www.blackhatethicalhacking.com/solutions Recent Articles* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Hacking-Linux-300x150.png How Misconfigurations in Linux can leave you vulnerable to AttackersJuly 12, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/QR-Codes-for-hacking-300x150.png How do QR Codes work and how criminal hackers use them to generate phishing attacks – DemoJune 30, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Articles_Gallery1-300x150.png Kevin Poulsen, aka Dark Dante, and his hacking activities on ARPANET’s networksMay 30, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/The-Difference-between-Vulnerability-Assessment-and-Pentesting.-300x150.png The Difference between Vulnerability Assessment and PentestingMay 27, 2022 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post The Difference between White-Box and Black-Box Pentesting first appeared on Black Hat Ethical Hacking.
However, it also requires a great deal of time and has the greatest potential to overlook a vulnerability that exists within the internal part of a network or application.
Black-Box testing is a powerful testing technique because it exercises the behavior of a system end-to-end.
The Pros of this type of attack are:
* Ability to approach your company by all means necessary. Unorthodox techniques are used that combine Social Engineering, manually look for outdated versions, and exploit them using custom code and tools to gain and elevate access.
* Post exploitation then goes through spending time inside your network performing and looking for information that could damage your company, including planting ransomware and escalating to a more critical impact.
The Cons of this type of attack are:
* It does not cover in-depth assessment as compared to white-box tests.
* It is performed against production environments in the case of an active directory, and internal LAN/networks.
See Also: Solutions: Web Application Pentesting Which one is best for your Company?A penetration test aims to identify potential vulnerabilities in your systems before criminal hackers do. When commissioning a penetration test, by Defining the concerns, you would like to resolve is essential to designing a customized approach that will effectively meet the necessary security requirements and result in the most value from your penetration testing investment. There is no right/wrong decision about White-Box or Black-Box. It depends on the scenario that needs to be tested and your requirements.
Our team of highly skilled and innovative ethical hackers at BHEH customizes every engagement to ensure the most thorough penetration test possible tailored to your needs. We understand that not every architecture or application fits into a predefined box and will require an adaptive testing methodology to develop a solution that works best for your organization.
There is no minimum threat in Cyber Security. An old saying about achieving high quality in manufacturing is “You can’t manage what you can’t measure.” From an Information Security standpoint, a better expression would be “You can’t protect what you can’t see.” Most importantly, you need visibility to where sensitive information is at all times.
After all, how would you know how you withstand a targeted attack if you do not test your equipment setups?
To find out more about how Black Hat Ethical Hacking can help you, check out our Solutions https://www.blackhatethicalhacking.com/solutions Recent Articles* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Hacking-Linux-300x150.png How Misconfigurations in Linux can leave you vulnerable to AttackersJuly 12, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/QR-Codes-for-hacking-300x150.png How do QR Codes work and how criminal hackers use them to generate phishing attacks – DemoJune 30, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Articles_Gallery1-300x150.png Kevin Poulsen, aka Dark Dante, and his hacking activities on ARPANET’s networksMay 30, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/The-Difference-between-Vulnerability-Assessment-and-Pentesting.-300x150.png The Difference between Vulnerability Assessment and PentestingMay 27, 2022 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post The Difference between White-Box and Black-Box Pentesting first appeared on Black Hat Ethical Hacking.
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
New IP Osint Tool!
Hello World!
I just finished my tool and publish it in github.
It's a python tool that extract Ip addresses from captured network traffic file (pcap/pcapng) and generate csv report containing details about the geolocation of each ip in the packets.
I hope you check it out
https://github.com/z-alami/IpGeo
submitted by /u/doloren59
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
New IP Osint Tool!
Hello World!
I just finished my tool and publish it in github.
It's a python tool that extract Ip addresses from captured network traffic file (pcap/pcapng) and generate csv report containing details about the geolocation of each ip in the packets.
I hope you check it out
https://github.com/z-alami/IpGeo
submitted by /u/doloren59
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
hacking: security in practice
Explaining hacking to a newbie issues
How can I explain that it is not easy to hack an instagram or discord account, and I cannot hack a whole ass billion-dollar company???
submitted by /u/Bulky-Technology-398
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
Explaining hacking to a newbie issues
How can I explain that it is not easy to hack an instagram or discord account, and I cannot hack a whole ass billion-dollar company???
submitted by /u/Bulky-Technology-398
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
reddit
Explaining hacking to a newbie issues
How can I explain that it is not easy to hack an instagram or discord account, and I cannot hack a whole ass billion-dollar company???
hacking: security in practice
Tech for exposing live heart beat and respiration data to a websocket
I'm posting here since I'm sure there are people here who have done some fun hacky setups around this topic. Obviously I'm doing this with permission from the person involved.
Am doing a visual art project (with some budget) and am going to be respresenting people heartbeats with some visuals in real time.
I've done all the live visual bits before, but I'm unsure how to go from someones data to a websocket, local server or similar. Can anyone suggest some tech that might help me achieve this?
submitted by /u/TechnicalyAnIdiot
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
Tech for exposing live heart beat and respiration data to a websocket
I'm posting here since I'm sure there are people here who have done some fun hacky setups around this topic. Obviously I'm doing this with permission from the person involved.
Am doing a visual art project (with some budget) and am going to be respresenting people heartbeats with some visuals in real time.
I've done all the live visual bits before, but I'm unsure how to go from someones data to a websocket, local server or similar. Can anyone suggest some tech that might help me achieve this?
submitted by /u/TechnicalyAnIdiot
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
reddit
Tech for exposing live heart beat and respiration data to a websocket
I'm posting here since I'm sure there are people here who have done some fun hacky setups around this topic. Obviously I'm doing this with...
Publicly Accessible Android Crash Reports Containing Sensitive Information
https://medium.com/@xpertwhitehat/publicly-accessible-android-crash-reports-containing-sensitive-information-ec1220079f31?source=rss------bug_bounty-5
https://medium.com/@xpertwhitehat/publicly-accessible-android-crash-reports-containing-sensitive-information-ec1220079f31?source=rss------bug_bounty-5
Hello Guys,Continue reading on Medium » (https://medium.com/@xpertwhitehat/publicly-accessible-android-crash-reports-containing-sensitive-information-ec1220079f31?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
SharpEventPersist : Persistence By Writing/Reading Shellcode From Event Log
SharpEventPersist is a Persistence by writing/reading shellcode from Event Log.
Usage
The SharpEventPersist tool takes 4 case-sensitive parameters:
* -file “C:\path\to\shellcode.bin”
* -instanceid 1337
* -source Persistence
* -eventlog “Key Management Service”.
The shellcode is converted to hex and written to the “Key Management Service”, event level is set to “Information” and source is “Persistence”.
Run the SharpEventLoader tool to fetch shellcode from event log and execute it. Ideally this should be converted to a DLL and sideloaded on program start/boot.
Remember to change the Event Log name and instanceId in the loader, if not running with default values.
Default values will leave the following artifact:
* A new key will be written to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service named “Persistance”.
* This new “Persistance” key will not have a provider GUID or TypesSupported which the default key “KmsRequests” have. This can be used to build detections.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCmUxfE5mcqSjmxfX6K6gGIYPrk7BMa7CPmHTTjCuYm6mObLwJ5M3M4TK9r1HKC-8UpJxiotzFgicSC_nqCJaiyrkW5GvTnPztJWaocEdviaqIc405_DawBEnu0LviXtN6H3vAg2PWeK2XQ2VTSfZ4GPaC4YlCnfd3XFMDAnH2-9UtnoF1vxqvLWyQ/s1127/1.png
Download
SharpEventPersist : Persistence By Writing/Reading Shellcode From Event Log
SharpEventPersist is a Persistence by writing/reading shellcode from Event Log.
Usage
The SharpEventPersist tool takes 4 case-sensitive parameters:
* -file “C:\path\to\shellcode.bin”
* -instanceid 1337
* -source Persistence
* -eventlog “Key Management Service”.
The shellcode is converted to hex and written to the “Key Management Service”, event level is set to “Information” and source is “Persistence”.
Run the SharpEventLoader tool to fetch shellcode from event log and execute it. Ideally this should be converted to a DLL and sideloaded on program start/boot.
Remember to change the Event Log name and instanceId in the loader, if not running with default values.
Default values will leave the following artifact:
* A new key will be written to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service named “Persistance”.
* This new “Persistance” key will not have a provider GUID or TypesSupported which the default key “KmsRequests” have. This can be used to build detections.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCmUxfE5mcqSjmxfX6K6gGIYPrk7BMa7CPmHTTjCuYm6mObLwJ5M3M4TK9r1HKC-8UpJxiotzFgicSC_nqCJaiyrkW5GvTnPztJWaocEdviaqIc405_DawBEnu0LviXtN6H3vAg2PWeK2XQ2VTSfZ4GPaC4YlCnfd3XFMDAnH2-9UtnoF1vxqvLWyQ/s1127/1.png
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
ConfluencePot : Simple Honeypot For Atlassian Confluence (CVE-2022-26134)
ConfluencePot is a simple honeypot for the Atlassian Confluence unauthenticated and remote OGNL injection vulnerability (CVE-2022-26134).
About the vulnerability
You can find the official advisory by Atlassian to this vulerability here. For details about the inner workings and exploits in the wild you should refer to the reports by Rapid7 and Cloudflare. Affected but not yet patched systems should be deemed compromised until further investigation.
About the tool
ConfluencePot is written in Golang and implements its own HTTPS server to minimize the overall attack surface. To make it appear like a legit Confluence instance it returns a bare-bones version of a Confluence landing page. Log output is written to stdout and a log file on disk. ConfluencePot DOES NOT allow attackers to execute commands/code on your machine, it only logs requests and returns a bogus response.
Building & Running it
You need a recent version of Golang to run/build confluencePot and the appropriate privileges to bind to port 443. We recommend to execute it in a tmux session for easier handling. To run ConfluencePot you either need to create a self-signed TLS certificate with openssl or request one from e.g. Let’s Encrypt.
go build confluencePot.go
./confluencePot
Download
ConfluencePot : Simple Honeypot For Atlassian Confluence (CVE-2022-26134)
ConfluencePot is a simple honeypot for the Atlassian Confluence unauthenticated and remote OGNL injection vulnerability (CVE-2022-26134).
About the vulnerability
You can find the official advisory by Atlassian to this vulerability here. For details about the inner workings and exploits in the wild you should refer to the reports by Rapid7 and Cloudflare. Affected but not yet patched systems should be deemed compromised until further investigation.
About the tool
ConfluencePot is written in Golang and implements its own HTTPS server to minimize the overall attack surface. To make it appear like a legit Confluence instance it returns a bare-bones version of a Confluence landing page. Log output is written to stdout and a log file on disk. ConfluencePot DOES NOT allow attackers to execute commands/code on your machine, it only logs requests and returns a bogus response.
Building & Running it
You need a recent version of Golang to run/build confluencePot and the appropriate privileges to bind to port 443. We recommend to execute it in a tmux session for easier handling. To run ConfluencePot you either need to create a self-signed TLS certificate with openssl or request one from e.g. Let’s Encrypt.
go build confluencePot.go
./confluencePot
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Exploiting EternalBlue (Blue)
https://cdn-images-1.medium.com/max/1280/1*zMQsgPNZOL3MuEM6B0VEWQ.png
Gain access to a Windows Machine through EternalBlue
Continue reading on Medium »
Exploiting EternalBlue (Blue)
https://cdn-images-1.medium.com/max/1280/1*zMQsgPNZOL3MuEM6B0VEWQ.png
Gain access to a Windows Machine through EternalBlue
Continue reading on Medium »