{
"undesirable": [
"generates new code at runtime",
"reads files and dirs: ['package/lib/cli-engine/load-rules.js:37', 'package/lib/cli-engine/file-enumerator.js:142']"
]
}
=> Complete report: /tmp/npm-eslint-8.16.0.json
How it works It first downloads the metadata from the registry using their APIs and analyze it for "risky" attributes. To perform API analysis, the package is downloaded from the registry using their APIs into a temp dir. Then, packj performs static code analysis (https://www.kitploit.com/search/label/Code%20Analysis) to detect API usage. API analysis is based on MalOSS (https://github.com/osssanitizer/maloss), a research project (https://www.kitploit.com/search/label/Research%20Project) from our group at Georgia Tech. Vulnerabilities (CVEs) are checked by pulling info from OSV database at OSV (https://osv.dev/) Python PyPI and NPM package downloads are fetched from pypistats (https://pypistats.org/) and npmjs (https://api.npmjs.org/downloads) All risks detected are aggregated and reported Risky attributes The design of Packj is guided by our study of 651 malware samples (https://www.kitploit.com/search/label/Malware%20Samples) of documented open-source software supply chain attacks. Specifically, we have empirically identified a number of risky code and metadata attributes that make a package vulnerable to supply chain attacks. For instance, we flag inactive or unmaintained packages that no longer receive security fixes. Inspired by Android app runtime permissions, Packj uses a permission-based security model to offer control and code transparency to developers. Packages that invoke sensitive operating system functionality such as file accesses and remote network communication are flagged as risky as this functionality could leak sensitive data. Some of the attributes we vet for, include Attribute Type Description Reason Release date Metadata Version release date to flag old or abandonded packages Old or unmaintained packages do not receive security fixes OS or lang APIs Code Use of sensitive APIs, such as exec and eval Malware uses APIs from the operating system or language runtime to perform sensitive operations (e.g., read SSH keys) Contributors' email Metadata Email addresses of the contributors Incorrect or invalid of email addresses suggest lack of 2FA Source repo Metadata Presence and validity of public source repo Absence of a public repo means no easy way to audit or review the source code publicly Full list of the attributes we track can be viewed at threats.csv (https://github.com/ossillate-inc/packj/blob/main/threats.csv) These attributes have been identified as risky by several other researchers [1 (https://arxiv.org/pdf/2112.10165.pdf), 2 (https://www.usenix.org/system/files/sec19-zimmermann.pdf), 3 (https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1B-1_23055_paper.pdf)] as well. How to customize Packj has been developed with a goal to assist developers in identifying and reviewing potential supply chain risks in packages. However, since the degree of perceived security risk from an untrusted package depends on the specific security requirements, Packj can be customized according to your threat model. For instance, a package with no 2FA may be perceived to pose greater security risks to some developers, compared to others who may be more willing to use such packages for the functionality offered. Given the volatile nature of the problem, providing customized and granular risk measurement is one of our goals. Packj can be customized to minimize noise and reduce alert fatigue by simply commenting out unwanted attributes in threats.csv (https://github.com/ossillate-inc/packj/blob/main/threats.csv) Malware found We found over 40 malicious packages on PyPI using this tool. A number of them been taken down. Refer to an example below: $ python3 main.py pypi krisqian
___________________________
@hacking_Attack
@Hacking_Video
"undesirable": [
"generates new code at runtime",
"reads files and dirs: ['package/lib/cli-engine/load-rules.js:37', 'package/lib/cli-engine/file-enumerator.js:142']"
]
}
=> Complete report: /tmp/npm-eslint-8.16.0.json
How it works It first downloads the metadata from the registry using their APIs and analyze it for "risky" attributes. To perform API analysis, the package is downloaded from the registry using their APIs into a temp dir. Then, packj performs static code analysis (https://www.kitploit.com/search/label/Code%20Analysis) to detect API usage. API analysis is based on MalOSS (https://github.com/osssanitizer/maloss), a research project (https://www.kitploit.com/search/label/Research%20Project) from our group at Georgia Tech. Vulnerabilities (CVEs) are checked by pulling info from OSV database at OSV (https://osv.dev/) Python PyPI and NPM package downloads are fetched from pypistats (https://pypistats.org/) and npmjs (https://api.npmjs.org/downloads) All risks detected are aggregated and reported Risky attributes The design of Packj is guided by our study of 651 malware samples (https://www.kitploit.com/search/label/Malware%20Samples) of documented open-source software supply chain attacks. Specifically, we have empirically identified a number of risky code and metadata attributes that make a package vulnerable to supply chain attacks. For instance, we flag inactive or unmaintained packages that no longer receive security fixes. Inspired by Android app runtime permissions, Packj uses a permission-based security model to offer control and code transparency to developers. Packages that invoke sensitive operating system functionality such as file accesses and remote network communication are flagged as risky as this functionality could leak sensitive data. Some of the attributes we vet for, include Attribute Type Description Reason Release date Metadata Version release date to flag old or abandonded packages Old or unmaintained packages do not receive security fixes OS or lang APIs Code Use of sensitive APIs, such as exec and eval Malware uses APIs from the operating system or language runtime to perform sensitive operations (e.g., read SSH keys) Contributors' email Metadata Email addresses of the contributors Incorrect or invalid of email addresses suggest lack of 2FA Source repo Metadata Presence and validity of public source repo Absence of a public repo means no easy way to audit or review the source code publicly Full list of the attributes we track can be viewed at threats.csv (https://github.com/ossillate-inc/packj/blob/main/threats.csv) These attributes have been identified as risky by several other researchers [1 (https://arxiv.org/pdf/2112.10165.pdf), 2 (https://www.usenix.org/system/files/sec19-zimmermann.pdf), 3 (https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1B-1_23055_paper.pdf)] as well. How to customize Packj has been developed with a goal to assist developers in identifying and reviewing potential supply chain risks in packages. However, since the degree of perceived security risk from an untrusted package depends on the specific security requirements, Packj can be customized according to your threat model. For instance, a package with no 2FA may be perceived to pose greater security risks to some developers, compared to others who may be more willing to use such packages for the functionality offered. Given the volatile nature of the problem, providing customized and granular risk measurement is one of our goals. Packj can be customized to minimize noise and reduce alert fatigue by simply commenting out unwanted attributes in threats.csv (https://github.com/ossillate-inc/packj/blob/main/threats.csv) Malware found We found over 40 malicious packages on PyPI using this tool. A number of them been taken down. Refer to an example below: $ python3 main.py pypi krisqian
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.
[+] Fetching 'krisqian' from pypi...OK [ver 0.0.7]
[+] Checking version...OK [256 days old]
[+] Checking release history...OK [7 version(s)]
[+] Checking release time gap...OK [1 days since last release]
[+] Checking author...OK [KrisWuQian@baidu.com]
[+] Checking email/domain validity...OK [KrisWuQian@baidu.com]
[+] Checking readme...ALERT [no readme]
[+] Checking homepage...OK [https://www.bilibili.com/bangumi/media/md140632]
[+] Checking downloads...OK [13 weekly]
[+] Checking repo_url URL...OK [None]
[+] Checking for CVEs...OK [none found]
[+] Checking dependencies...OK [none found]
[+] Downloading package 'KrisQian' (ver 0.0.7) from pypi...OK [1.94 KB]
[+] Analyzing code...ALERT [needs 3 perms: process,network,file]
[+] Checking files/funcs...OK [9 files (2 .py), 6 funcs, LoC: 184]
=============================================
[+] 6 risk(s) found, package is undes irable!
{
"undesirable": [
"no readme",
"only 45 weekly downloads",
"no source repo found",
"generates new code at runtime",
"fetches data over the network: ['KrisQian-0.0.7/setup.py:40', 'KrisQian-0.0.7/setup.py:50']",
"reads files and dirs: ['KrisQian-0.0.7/setup.py:59', 'KrisQian-0.0.7/setup.py:70']"
]
}
=> Complete report: pypi-KrisQian-0.0.7.json
=> View pre-vetted package report at https://packj.dev/package/PyPi/KrisQian/0.0.7
Packj flagged KrisQian (v0.0.7) as suspicious due to absence of source repo and use of sensitive APIs (network, code generation) during package installation time (in setup.py). We decided to take a deeper look, and found the package malicious. Please find our detailed analysis at https://packj.dev/malware/krisqian. More examples of malware we found are listed at https://packj.dev/malware Please reach out to us at oss@ossillate.com (mailto:oss@ossillate.com) for full list. Resources To learn more about Packj tool or open-source software supply chain attacks, refer to our 🚀 behind our large-scale security analysis platform to detect malicious/risky open-source packages (34)">
___________________________
@hacking_Attack
@Hacking_Video
[+] Checking version...OK [256 days old]
[+] Checking release history...OK [7 version(s)]
[+] Checking release time gap...OK [1 days since last release]
[+] Checking author...OK [KrisWuQian@baidu.com]
[+] Checking email/domain validity...OK [KrisWuQian@baidu.com]
[+] Checking readme...ALERT [no readme]
[+] Checking homepage...OK [https://www.bilibili.com/bangumi/media/md140632]
[+] Checking downloads...OK [13 weekly]
[+] Checking repo_url URL...OK [None]
[+] Checking for CVEs...OK [none found]
[+] Checking dependencies...OK [none found]
[+] Downloading package 'KrisQian' (ver 0.0.7) from pypi...OK [1.94 KB]
[+] Analyzing code...ALERT [needs 3 perms: process,network,file]
[+] Checking files/funcs...OK [9 files (2 .py), 6 funcs, LoC: 184]
=============================================
[+] 6 risk(s) found, package is undes irable!
{
"undesirable": [
"no readme",
"only 45 weekly downloads",
"no source repo found",
"generates new code at runtime",
"fetches data over the network: ['KrisQian-0.0.7/setup.py:40', 'KrisQian-0.0.7/setup.py:50']",
"reads files and dirs: ['KrisQian-0.0.7/setup.py:59', 'KrisQian-0.0.7/setup.py:70']"
]
}
=> Complete report: pypi-KrisQian-0.0.7.json
=> View pre-vetted package report at https://packj.dev/package/PyPi/KrisQian/0.0.7
Packj flagged KrisQian (v0.0.7) as suspicious due to absence of source repo and use of sensitive APIs (network, code generation) during package installation time (in setup.py). We decided to take a deeper look, and found the package malicious. Please find our detailed analysis at https://packj.dev/malware/krisqian. More examples of malware we found are listed at https://packj.dev/malware Please reach out to us at oss@ossillate.com (mailto:oss@ossillate.com) for full list. Resources To learn more about Packj tool or open-source software supply chain attacks, refer to our 🚀 behind our large-scale security analysis platform to detect malicious/risky open-source packages (34)">
___________________________
@hacking_Attack
@Hacking_Video
Bilibili
天线宝宝
《天线宝宝》有两个元素：一个是“幻想园地”、一个是“真实纪录”。“幻想园地”是指《天线宝宝》的主要场景“神奇岛”(香港译名为天线得得园)，岛上有许多幻想奇观，让孩子有创造力、想像力；四个天线宝宝在神奇
PyConUS'22 talk (https://www.youtube.com/watch?v=Rcuqn56uCDk) and slides (https://speakerdeck.com/ashishbijlani/pyconus22-slides). BlackHAT Asia'22 Arsenal presentation (https://www.blackhat.com/asia-22/arsenal/schedule/#mitigating-open-source-software-supply-chain-attacks-26241) PackagingCon'21 talk (https://www.youtube.com/watch?v=PHfN-NrUCoo) and slides (https://speakerdeck.com/ashishbijlani/mitigating-open-source-software-supply-chain-attacks) Academic dissertation (https://cyfi.ece.gatech.edu/publications/DUAN-DISSERTATION-2019.pdf) on open-source software security and the paper (https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1B-1_23055_paper.pdf) from our group at Georgia Tech that started this research. Upcoming talks BlackHat USA'22 Arsenal talk Detecting typo-squatting, backdoored, abandoned, and other "risky" open-source packages using Packj (https://www.blackhat.com/us-22/arsenal/schedule/#detecting-typo-squatting-backdoored-abandoned-and-other-risky-open-source-packages-using-packj-28075) Open Source Summit, Europe'22 talk Scoring dependencies to detect “weak links” in your open-source software supply chain (https://osseu2022.sched.com/overview/type/SupplyChainSecurityCon) Feature roadmap Add support for other language ecosystems. Rust is a work in progress, and will be available in July '22 (last week). Add functionality to detect several other "risky" code as well as metadata attributes. Packj currently only performs static code analysis, we are working on adding support for dynamic analysis (https://www.kitploit.com/search/label/Dynamic%20Analysis) (WIP, ETA: end of summer) Team Packj has been developed by Cybersecurity researchers at Ossillate Inc. (https://ossillate.com/team) and external collaborators to help developers mitigate risks of supply chain attacks when sourcing untrusted third-party open-source software dependencies. We thank our developers and collaborators. We welcome code contributions. Join our discord community (https://discord.gg/8hx3yEtF) for discussion and feature requests. FAQ What Package Managers (Registries) are supported? Packj can currently vet NPM, PyPI, and RubyGems packages for "risky" attributes. We are adding support for Rust. Does it work on obfuscated calls? For example, a base 64 encrypted string that gets decrypted and then passed to a shell? This is a very common malicious behavior. Packj detects code obfuscation as well as spawning of shell commands (exec system call). For example, Packj can flag use of getattr() and eval() API as they indicate "runtime code generation"; a developer can go and take a deeper look then. See main.py (https://github.com/ossillate-inc/packj/blob/main/main.py#L486) for details. Does this work at the system call level, where it would detect e.g. any attempt to open ~/.aws/credentials, or does it rely on heuristic analysis of the code itself, which will always be able to be "coded around" by the malware authors? Packj currently uses static code analysis to derive permissions (e.g., file/network accesses). Therefore, it can detect open() calls if used by the malware directly (e.g., not obfuscated in a base64 encoded string). But, Packj can also point out such base64 decode calls. Fortunately, malware has to use these APIs (read, open, decode, eval, etc.) for their functionality -- there's no getting around. Having said that, a sophisticated malware can hide itself better, so dynamic analysis must be performed for completeness. We are incorporating strace-based dynamic analysis (containerized) to collect system calls. See roadmap (https://github.com/ossillate-inc/packj#feature-roadmap) for details.
Download Packj (https://github.com/ossillate-inc/packj)
___________________________
@hacking_Attack
@Hacking_Video
Download Packj (https://github.com/ossillate-inc/packj)
___________________________
@hacking_Attack
@Hacking_Video
YouTube
Talk - Ajinkya Rajput/Ashish Bijlani:Bad actors vs our community: detecting software supply chain...
Rapid prototyping or development is one of the most favourite features of the Python software ecosystem. This is possible due to efficient reuse of software libraries enabled by package managers such as PyPi. While PyPI maintainers have streamlined the process…
How do attackers leverage routers ?
https://www.reddit.com/r/redteamsec/comments/wkxgen/how_do_attackers_leverage_routers/
If an attacker compromises your router with lots of devices connected and has ssh access to your router. How can he benefit from this ? submitted by /u/Due-Mycologist1279 (https://www.reddit.com/user/Due-Mycologist1279)
[link] (https://www.reddit.com/r/redteamsec/comments/wkxgen/how_do_attackers_leverage_routers/) [comments] (https://www.reddit.com/r/redteamsec/comments/wkxgen/how_do_attackers_leverage_routers/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/redteamsec/comments/wkxgen/how_do_attackers_leverage_routers/
If an attacker compromises your router with lots of devices connected and has ssh access to your router. How can he benefit from this ? submitted by /u/Due-Mycologist1279 (https://www.reddit.com/user/Due-Mycologist1279)
[link] (https://www.reddit.com/r/redteamsec/comments/wkxgen/how_do_attackers_leverage_routers/) [comments] (https://www.reddit.com/r/redteamsec/comments/wkxgen/how_do_attackers_leverage_routers/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
How do attackers leverage routers ?
If an attacker compromises your router with lots of devices connected and has ssh access to your router. How can he benefit from this ?
Enhancing Subdomain Enumeration — ENTs and NOERROR
https://medium.com/sse-blog/enhancing-subdomain-enumeration-ents-and-noerror-69a0479b7a3d?source=rss------bug_bounty-5
https://medium.com/sse-blog/enhancing-subdomain-enumeration-ents-and-noerror-69a0479b7a3d?source=rss------bug_bounty-5
Identifying subdomains more reliably by checking DNS status codes and empty nodesContinue reading on SSE Blog » (https://medium.com/sse-blog/enhancing-subdomain-enumeration-ents-and-noerror-69a0479b7a3d?source=rss------bug_bounty-5)
sql injection
https://www.reddit.com/r/Pentesting/comments/wkx6ad/sql_injection/
<!-- SC_OFF -->Hello, someone can explain to me how a prepared statement prevent on sql injection i dont really understand well <!-- SC_ON --> submitted by /u/Objective_Fruit_5995 (https://www.reddit.com/user/Objective_Fruit_5995)
[link] (https://www.reddit.com/r/Pentesting/comments/wkx6ad/sql_injection/) [comments] (https://www.reddit.com/r/Pentesting/comments/wkx6ad/sql_injection/)
https://www.reddit.com/r/Pentesting/comments/wkx6ad/sql_injection/
<!-- SC_OFF -->Hello, someone can explain to me how a prepared statement prevent on sql injection i dont really understand well <!-- SC_ON --> submitted by /u/Objective_Fruit_5995 (https://www.reddit.com/user/Objective_Fruit_5995)
[link] (https://www.reddit.com/r/Pentesting/comments/wkx6ad/sql_injection/) [comments] (https://www.reddit.com/r/Pentesting/comments/wkx6ad/sql_injection/)
403 Forbidden Bypass Leading to Admin Endpoint Access.
https://medium.com/@engrdrayc/403-forbidden-bypass-leading-to-admin-endpoint-access-b696a36665ed?source=rss------bug_bounty-5
https://medium.com/@engrdrayc/403-forbidden-bypass-leading-to-admin-endpoint-access-b696a36665ed?source=rss------bug_bounty-5
Hi everyone! This is my first write-up, pardon me for any mistakes. I’ll share my tip with everyone how I was able to bypass a 403…Continue reading on Medium » (https://medium.com/@engrdrayc/403-forbidden-bypass-leading-to-admin-endpoint-access-b696a36665ed?source=rss------bug_bounty-5)
403 Forbidden Bypass Leading to Admin Endpoint Access.
Hi everyone! This is my first write-up, pardon me for any mistakes. I’ll share my tip with everyone how I was able to bypass a 403…Continue reading on Medium »
Read more...
Hi everyone! This is my first write-up, pardon me for any mistakes. I’ll share my tip with everyone how I was able to bypass a 403…Continue reading on Medium »
Read more...
Exchange/Azure AD pen testing resources. Any tips or good articles about this?
https://www.reddit.com/r/redteamsec/comments/wl656c/exchangeazure_ad_pen_testing_resources_any_tips/
submitted by /u/One_Appeal_4080 (https://www.reddit.com/user/One_Appeal_4080)
[link] (https://www.reddit.com/r/redteamsec/comments/wl656c/exchangeazure_ad_pen_testing_resources_any_tips/) [comments] (https://www.reddit.com/r/redteamsec/comments/wl656c/exchangeazure_ad_pen_testing_resources_any_tips/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/redteamsec/comments/wl656c/exchangeazure_ad_pen_testing_resources_any_tips/
submitted by /u/One_Appeal_4080 (https://www.reddit.com/user/One_Appeal_4080)
[link] (https://www.reddit.com/r/redteamsec/comments/wl656c/exchangeazure_ad_pen_testing_resources_any_tips/) [comments] (https://www.reddit.com/r/redteamsec/comments/wl656c/exchangeazure_ad_pen_testing_resources_any_tips/)
___________________________
@hacking_Attack
@Hacking_Video
Reddit
r/redteamsec on Reddit: Exchange/Azure AD pen testing resources. Any tips or good articles about this?
Posted by u/[Deleted Account] - 14 votes and 5 comments
Email Confirmation bypass at Instagram
This story is all about a logical vulnerability which helped me in Bypassing the email confirmation process and adding any arbitrary…Continue reading on Medium »
Read more...
This story is all about a logical vulnerability which helped me in Bypassing the email confirmation process and adding any arbitrary…Continue reading on Medium »
Read more...
Email Confirmation bypass at Instagram
https://medium.com/@avinash_/email-confirmation-bypass-at-instagram-cc968f9a126?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@avinash_/email-confirmation-bypass-at-instagram-cc968f9a126?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Email Confirmation bypass at Instagram
This story is all about a logical vulnerability which helped me in Bypassing the email confirmation process and adding any arbitrary…
This story is all about a logical vulnerability which helped me in Bypassing the email confirmation process and adding any arbitrary…Continue reading on Medium » (https://medium.com/@avinash_/email-confirmation-bypass-at-instagram-cc968f9a126?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Email Confirmation bypass at Instagram
This story is all about a logical vulnerability which helped me in Bypassing the email confirmation process and adding any arbitrary…
Pentesting Course recommendation
https://www.reddit.com/r/Pentesting/comments/wl5k9s/pentesting_course_recommendation/
Looking for recommendations on formal Pentesting courses, either instructor led in person or online. I am completing my development plan for the next 12 months and looking at the best courses for beginners. I have done the EC-Council Ethical Hacker course which I enjoyed and see they do a Pentesting one also. submitted by /u/cb24nz (https://www.reddit.com/user/cb24nz)
[link] (https://www.reddit.com/r/Pentesting/comments/wl5k9s/pentesting_course_recommendation/) [comments] (https://www.reddit.com/r/Pentesting/comments/wl5k9s/pentesting_course_recommendation/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/Pentesting/comments/wl5k9s/pentesting_course_recommendation/
Looking for recommendations on formal Pentesting courses, either instructor led in person or online. I am completing my development plan for the next 12 months and looking at the best courses for beginners. I have done the EC-Council Ethical Hacker course which I enjoyed and see they do a Pentesting one also. submitted by /u/cb24nz (https://www.reddit.com/user/cb24nz)
[link] (https://www.reddit.com/r/Pentesting/comments/wl5k9s/pentesting_course_recommendation/) [comments] (https://www.reddit.com/r/Pentesting/comments/wl5k9s/pentesting_course_recommendation/)
___________________________
@hacking_Attack
@Hacking_Video
Reddit
reddit.com: over 18?
Reddit gives you the best of the internet in one place. Get a constantly updating feed of breaking news, fun stories, pics, memes, and videos just for you. Passionate about something niche? Reddit has thousands of vibrant communities with people that share…
Defeat the HttpOnly flag to achieve Account Takeover | RXSS
Hello folks, I’m Mohamed Tarek aka Timooon at Bugcrowd and HackerOne, In this write up I will explain how I get the victim’s session when…Continue reading on Medium »
Read more...
Hello folks, I’m Mohamed Tarek aka Timooon at Bugcrowd and HackerOne, In this write up I will explain how I get the victim’s session when…Continue reading on Medium »
Read more...
Defeat the HttpOnly flag to achieve Account Takeover | RXSS
https://medium.com/@mohamedtarekq/defeat-the-httponly-flag-to-achieve-account-takeover-rxss-c16849d3d192?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@mohamedtarekq/defeat-the-httponly-flag-to-achieve-account-takeover-rxss-c16849d3d192?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Defeat the HttpOnly flag to achieve Account Takeover | RXSS
Hello folks, I’m Mohamed Tarek aka Timooon at Bugcrowd and HackerOne, In this write up I will explain how I get the victim’s session when…