Hacking Articles Tips Tricks Videos Tutorials

Hacking on Medium
Powershell POC for CVE-2022–26923

Since you are here I assume that you already know what CVE-2022–26923 is all about.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Powershell POC for CVE-2022–26923

Since you are here I assume that you already know what CVE-2022–26923 is all about. If not I have a blog and a video about it, you can find…

11 viewsedited 13:26

Hacking Articles Tips Tricks Videos Tutorials

6 views13:38

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
Packj : Large-Scale Security Analysis Platform To Detect Malicious/Risky Open-Source Packages

Packj (pronounced package) is a command line (CLI) tool to vet open-source software packages for “risky” attributes that make them vulnerable to supply chain attacks. This is the tool behind our large-scale security analysis platform Packj.dev that continuously vets packages and provides free reports. How To UsePackj accepts two input args:

* name of the registry or package manager, pypi, npm, or rubygems.
* name of the package to be vetted

Packj supports vetting of PyPI, NPM, and RubyGems packages. It performs static code analysis and checks for several metadata attributes such as release timestamps, author email, downloads, dependencies. Packages with expired email domains, large release time gap, sensitive APIs, etc. are flagged as risky for security reasons.

Packj also analyzes public repo code as well as metadata (e.g., stars, forks). By comparing the repo description and package title, you can be sure if the package indeed has been created from the repo to mitigate any starjackingattacks. ContainerizedThe best way to use Packj is to run it inside Docker (or Podman) container. You can pull our latest image from DockerHub to get started. docker pull ossillate/packj:latest$ docker run –mount type=bind,source=/tmp,target=/tmp ossillate/packj:latest npm browserify
[+] Fetching ‘browserify’ from npm…OK [ver 17.0.0]
[+] Checking version…ALERT [598 days old]
[+] Checking release history…OK [484 version(s)]
[+] Checking release time gap…OK [68 days since last release]
[+] Checking author…OK [mail@substack.net]
[+] Checking email/domain validity…ALERT [expired author email domain]
[+] Checking readme…OK [26838 bytes]
[+] Checking homepage…OK [https://github.com/browserify/browserify#readme]
[+] Checking downloads…OK [2.2M weekly]
[+] Checking repo_url URL…OK [https://github.com/browserify/browserify]
[+] Checking repo data…OK [stars: 14077, forks: 1236]
[+] Checking repo activity…OK [commits: 2290, contributors: 207, tags: 413]
[+] Checking for CVEs…OK [none found]
[+] Checking dependencies…ALERT [48 found]
[+] Downloading package ‘browserify’ (ver 17.0.0) from npm…OK [163.83 KB]
[+] Analyzing code…ALERT [needs 3 perms: process,file,codegen]
[+] Checking files/funcs…OK [429 files (383 .js), 744 funcs, LoC: 9.7K]
[+] 5 risk(s) found, package is undesirable!
=> Complete report: /tmp/npm-browserify-17.0.0.json
{
“undesirable”: [
“old package: 598 days old”,
“invalid or no author email: expired author email domain”,
“generates new code at runtime”,
“reads files and dirs”,
“forks or exits OS processes”,
]
}

Specific package versions to be vetted could be specified using ==. Please refer to the example below

$ docker run –mount type=bind,source=/tmp,target=/tmp ossillate/packj:latest pypi requests==2.18.4
[+] Fetching ‘requests’ from pypi…OK [ver 2.18.4]
[+] Checking version…ALERT [1750 days old]
[+] Checking release history…OK [142 version(s)]
[+] Checking release time gap…OK [14 days since last release]
[+] Checking author…OK [me@kennethreitz.org]
[+] Checking email/domain validity…OK [me@kennethreitz.org]
[+] Checking readme…OK [49006 bytes]
[+] Checking homepage…OK [http://python-requests.org]
[+] Checking downloads…OK [50M weekly]
[+] Checking repo_url URL…OK [https://github.com/psf/requests]
[+] Checking repo data…OK [stars: 47547, forks: 8758]
[+] Checking repo activity…OK [commits: 6112, contributors: 725, tags: 144]
[+] Checking for CVEs…ALERT [2 found]
[+] Checking dependencies…OK [9 direct]
[+] Downloading package ‘requests’ (ver 2.18.4) from pypi…OK [123.27 KB]
[+] Analyzing code…ALERT [needs 4 perms: codegen,process,file,network]
[+] Checking files/funcs…OK [47 files (33 .py), 578 funcs, LoC: 13.9K]
[+] 6 risk(s) found, package is undesirable, vulnerable!
{
“undesirable”: [
“old pac[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Packj : Large-Scale Security Analysis Platform To Detect Malicious

Packj is a command line tool to vet open-source software packages for "risky" attributes that make them vulnerable to supply chain attacks.

11 viewsedited 13:38

Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials Packj : Large-Scale Security Analysis Platform To Detect Malicious/Risky Open-Source Packages Packj (pronounced package) is a command line (CLI) tool to vet open-source software packages for “risky” attributes that make them vulnerable…

kage: 1744 days old”,
“invalid or no homepage: insecure webpage”,
“generates new code at runtime”,
“fetches data over the network”,
“reads files and dirs”,
],
“vulnerable”: [
“contains CVE-2018-18074,CVE-2018-18074”
]
}
=> Complete report: /tmp/pypi-requests-2.18.4.json
=> View pre-vetted package report at https://packj.dev/package/PyPi/requests/2.18.4 Non-containerizedAlternatively, you can install Python/Ruby dependencies locally and test it.

NOTE

* Packj has only been tested on Linux.
* Requires Python3 and Ruby. API analysis will fail if used with Python2.
* You will have to install Python and Ruby dependencies before using the tool:
* pip install -r requirements.txt* gem install google-protobuf:3.21.2 rubocop:1.31.1$ python3 main.py npm eslint
[+] Fetching ‘eslint’ from npm…OK [ver 8.16.0]
[+] Checking version…OK [10 days old]
[+] Checking release history…OK [305 version(s)]
[+] Checking release time gap…OK [15 days since last release]
[+] Checking author…OK [nicholas+npm@nczconsulting.com]
[+] Checking email/domain validity…OK [nicholas+npm@nczconsulting.com]
[+] Checking readme…OK [18234 bytes]
[+] Checking homepage…OK [https://eslint.org]
[+] Checking downloads…OK [23.8M weekly]
[+] Checking repo_url URL…OK [https://github.com/eslint/eslint]
[+] Checking repo data…OK [stars: 20669, forks: 3689]
[+] Checking repo activity…OK [commits: 8447, contributors: 1013, tags: 302]
[+] Checking for CVEs…OK [none found]
[+] Checking dependencies…ALERT [35 found]
[+] Downloading package ‘eslint’ (ver 8.16.0) from npm…OK [490.14 KB]
[+] Analyzing code…ALERT [needs 2 perms: codegen,file]
[+] Checking files/funcs…OK [395 files (390 .js), 1022 funcs, LoC: 76.3K]
[+] 2 risk(s) found, package is undesirable!
{
“undesirable”: [
“generates new code at runtime”,
“reads files and dirs: [‘package/lib/cli-engine/load-rules.js:37’, ‘package/lib/cli-engine/file-enumerator.js:142’]”
]
}
=> Complete report: /tmp/npm-eslint-8.16.0.json How It Works* It first downloads the metadata from the registry using their APIs and analyze it for “risky” attributes.
* To perform API analysis, the package is downloaded from the registry using their APIs into a temp dir. Then, packj performs static code analysis to detect API usage. API analysis is based on MalOSS, a research project from our group at Georgia Tech.
* Vulnerabilities (CVEs) are checked by pulling info from OSV database at OSV
* Python PyPI and NPM package downloads are fetched from pypistats and npmjs
* All risks detected are aggregated and reported Risky AttributesThe design of Packj is guided by our study of 651 malware samples of documented open-source software supply chain attacks. Specifically, we have empirically identified a number of risky code and metadata attributes that make a package vulnerable to supply chain attacks.

For instance, we flag inactive or unmaintained packages that no longer receive security fixes. Inspired by Android app runtime permissions, Packj uses a permission-based security model to offer control and code transparency to developers. Packages that invoke sensitive operating system functionality such as file accesses and remote network communication are flagged as risky as this functionality could leak sensitive data.

Some of the attributes we vet for, include
AttributeTypeDescriptionReasonRelease dateMetadataVersion release date to flag old or abandonded packagesOld or unmaintained packages do not receive security fixesOS or lang APIsCodeUse of sensitive APIs, such as execand evalMalware uses APIs from the operating system or language runtime to perform sensitive operations (e.g., read SSH keys)Contributors’ emailMetadataEmail addresses of the contributorsIncorrect or invalid of email addresses suggest lack of 2FASource repoMetadataPresence and validity of public source repoAbsence of a public repo means no easy way to audit or review the source code publicly
Full list of the attributes [...]

___________________________
@hacking_Attack
@Hacking_Video

9 viewsedited 13:39

Hacking Articles Tips Tricks Videos Tutorials

we track can be viewed at threats.csv

These attributes have been identified as risky by several other researchers [1, 2, 3] as well. How To CustomizePackj has been developed with a goal to assist developers in identifying and reviewing potential supply chain risks in packages.

However, since the degree of perceived security risk from an untrusted package depends on the specific security requirements, Packj can be customized according to your threat model. For instance, a package with no 2FA may be perceived to pose greater security risks to some developers, compared to others who may be more willing to use such packages for the functionality offered. Given the volatile nature of the problem, providing customized and granular risk measurement is one of our goals.

Packj can be customized to minimize noise and reduce alert fatigue by simply commenting out unwanted attributes in threats.csv Malware FoundWe found over 40 malicious packages on PyPI using this tool. A number of them been taken down. Refer to an example below:

$ python3 main.py pypi krisqian
[+] Fetching ‘krisqian’ from pypi…OK [ver 0.0.7]
[+] Checking version…OK [256 days old]
[+] Checking release history…OK [7 version(s)]
[+] Checking release time gap…OK [1 days since last release]
[+] Checking author…OK [KrisWuQian@baidu.com]
[+] Checking email/domain validity…OK [KrisWuQian@baidu.com]
[+] Checking readme…ALERT [no readme]
[+] Checking homepage…OK [https://www.bilibili.com/bangumi/media/md140632]
[+] Checking downloads…OK [13 weekly]
[+] Checking repo_url URL…OK [None]
[+] Checking for CVEs…OK [none found]
[+] Checking dependencies…OK [none found]
[+] Downloading package ‘KrisQian’ (ver 0.0.7) from pypi…OK [1.94 KB]
[+] Analyzing code…ALERT [needs 3 perms: process,network,file]
[+] Checking files/funcs…OK [9 files (2 .py), 6 funcs, LoC: 184]
[+] 6 risk(s) found, package is undesirable!
{
“undesirable”: [
“no readme”,
“only 45 weekly downloads”,
“no source repo found”,
“generates new code at runtime”,
“fetches data over the network: [‘KrisQian-0.0.7/setup.py:40’, ‘KrisQian-0.0.7/setup.py:50’]”,
“reads files and dirs: [‘KrisQian-0.0.7/setup.py:59’, ‘KrisQian-0.0.7/setup.py:70’]”
]
}
=> Complete report: pypi-KrisQian-0.0.7.json
=> View pre-vetted package report at https://packj.dev/package/PyPi/KrisQian/0.0.7

Packj flagged KrisQian (v0.0.7) as suspicious due to absence of source repo and use of sensitive APIs (network, code generation) during package installation time (in setup.py). We decided to take a deeper look, and found the package malicious. Please find our detailed analysis at https://packj.dev/malware/krisqian.

More examples of malware we found are listed at https://packj.dev/malware Please reach out to us at oss@ossillate.com for full list. ResourcesTo learn more about Packj tool or open-source software supply chain attacks, refer to our

* PyConUS’22 talk and slides.
* BlackHAT Asia’22 Arsenal presentation
* PackagingCon’21 talk and slides
* Academic dissertation on open-source software security and the paper from our group at Georgia Tech that started this research. Upcoming talks* BlackHat USA’22 Arsenal talk Detecting typo-squatting, backdoored, abandoned, and other “risky” open-source packages using Packj
* Open Source Summit, Europe’22 talk Scoring dependencies to detect “weak links” in your open-source software supply chain Feature Roadmap* Add support for other language ecosystems. Rust is a work in progress, and will be available in July ’22 (last week).
* Add functionality to detect several other “risky” code as well as metadata attributes.
* Packj currently only performs static code analysis, we are working on adding support for dynamic analysis (WIP, ETA: end of summer) Download

___________________________
@hacking_Attack
@Hacking_Video

Bilibili

天线宝宝

《天线宝宝》有两个元素：一个是“幻想园地”、一个是“真实纪录”。“幻想园地”是指《天线宝宝》的主要场景“神奇岛”(香港译名为天线得得园)，岛上有许多幻想奇观，让孩子有创造力、想像力；四个天线宝宝在神奇

8 viewsedited 13:39

Hacking Articles Tips Tricks Videos Tutorials

6 views13:39

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
MrKaplan : Tool Aimed To Help Red Teamers To Stay Hidden By Clearing Evidence Of Execution

MrKaplan is a tool aimed to help red teamers to stay hidden by clearing evidence of execution. It works by saving information such as the time it ran, snapshot of files and associate each evidence to the related user.

This tool is inspired by MoonWalk, a similar tool for Unix machines.

You can read more about it in the wiki page.

Features

* Stopping event logging.
* Clearing files artifacts.
* Clearing registry artifacts.
* Can run for multiple users.
* Can run as user and as admin (Highly recommended to run as admin).
* Can save timestamps of files.
* Can exclude certian operations and leave artifacts to blue teams.

Usage

* Before you start your operations on the computer, run MrKaplan with begin flag and whenever your finish run it again with end flag.
* DO NOT REMOVE MrKaplan registry key, otherwise MrKaplan will not be able to use the information.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiplcELr2vVdHJccVN5FkxbTtVne4pDmIGQeH1PQoPv010uhYbHLNh0gS1_OmEgRlKBq7cuUFbTGt78EKxc4Gl_PCFH7y5TYH_c3CWrynqq17EsrTYj5Io2fZor2F2cptNIdecklD1eZmBQ8YnB3vGztcFOZxTtQb9SxlgwJMqzfupEEGUv6Fb4Zkd_/s1063/usage.png
IOCs

* Powershell process that access to the artifacts mentioned in the wiki page.
* Powershell importing weird base64 blob.
* Powershell process that performs Token Manipulation.
* MrKaplan’s registry key: HKCU:\Software\MrKaplan.
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

MrKaplan : Tool Aimed To Help Red Teamers To Stay Hidden

MrKaplan is a tool aimed to help red teamers to stay hidden by clearing evidence of execution. It works by saving information.

7 viewsedited 13:39

Hacking Articles Tips Tricks Videos Tutorials

System Informer - A Free, Powerful, Multi-Purpose Tool That Helps You Monitor System Resources, Debug Software And Detect Malware
http://www.kitploit.com/2022/08/system-informer-free-powerful-multi.html

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

System Informer - A Free, Powerful, Multi-Purpose Tool That Helps You Monitor System Resources, Debug Software And Detect Malware

10 viewsedited 14:10

Hacking Articles Tips Tricks Videos Tutorials

6 views14:10

Hacking Articles Tips Tricks Videos Tutorials

System Informer A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. Project Website (https://systeminformer.sourceforge.io/) - Project Downloads (https://systeminformer.sourceforge.io/downloads.php)
System requirements Windows 7 or higher, 32-bit or 64-bit. Features A detailed overview of system activity with highlighting. Graphs and statistics allow you quickly to track down resource hogs and runaway processes. Can't edit or delete a file? Discover (https://www.kitploit.com/search/label/Discover) which processes are using that file. See what programs have active network connections, and close them if necessary. Get real-time (https://www.kitploit.com/search/label/Real-Time) information on disk access. View detailed stack traces with kernel-mode, WOW64 and .NET support. Go beyond services.msc: create, edit and control services. Small, portable and no installation required. 100% Free Software (https://www.gnu.org/philosophy/free-sw.en.html) (MIT (https://opensource.org/licenses/MIT)) Building the project Requires Visual Studio (2022 or later). Execute build_release.cmd located in the build directory (https://www.kitploit.com/search/label/Directory) to compile the project or load the SystemInformer.sln and Plugins.sln solutions if you prefer building the project using Visual Studio. You can download the free Visual Studio Community Edition (https://www.visualstudio.com/vs/community/) to build the System Informer source code. See the build readme (https://github.com/winsiderss/systeminformer/blob/master/build/README.md) for more information or if you're having trouble building. Enhancements/Bugs Please use the GitHub issue tracker (https://github.com/winsiderss/systeminformer/issues) for reporting (https://www.kitploit.com/search/label/Reporting) problems or suggesting new features. Settings If you are running System Informer from a USB drive, you may want to save System Informer's settings there as well. To do this, create a blank file named "SystemInformer.exe.settings.xml" in the same directory as SystemInformer.exe. You can do this using Windows Explorer: Make sure "Hide extensions for known file types" is unticked in Tools > Folder options > View. Right-click in the folder and choose New > Text Document. Rename the file to SystemInformer.exe.settings.xml (delete the ".txt" extension). Plugins Plugins can be configured from Options > Plugins. If you experience any crashes (https://www.kitploit.com/search/label/Crashes) involving plugins, make sure they are up to date. Disk and Network information provided by the ExtendedTools plugin is only available when running System Informer with administrative rights.

Download Systeminformer (https://github.com/winsiderss/systeminformer)

___________________________
@hacking_Attack
@Hacking_Video

systeminformer.io

System Informer

System Informer, A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware.

6 viewsedited 14:10

Hacking Articles Tips Tricks Videos Tutorials

First Writeup — Broken Authentication and IDOR

Hello everyone, I hope you all are doing good. This is my first writeup and in this will be covering a finding of a simple IDOR.Continue reading on Medium »
Read more...

5 views14:10

Hacking Articles Tips Tricks Videos Tutorials

5 views14:13

Hacking Articles Tips Tricks Videos Tutorials

Photo

KitPloit - PenTest Tools!
System Informer - A Free, Powerful, Multi-Purpose Tool That Helps You Monitor System Resources, Debug Software And Detect Malware

https://blogger.googleusercontent.com/img/a/AVvXsEja7auFyDQuQXRIdVTWZGpfLuBVV3wWV8gi4NGf6nPMRFgXgH_r7bwZnvT17n7Ow32JI0hMVDR6EvASK7TVegYoUmRQYysiWRq0Y3JAn9vmxscaTmWncKD5BOGg5nmcsnz3Q1FOkNF_QR9v8AWgcr9XvjINNPilg4UYOvlZnmu_pfkbSuZGAClqH9QQ=w400-h400
System Informer

A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc.

Project Website - Project Downloads
System requirements

Windows 7 or higher, 32-bit or 64-bit.

Features

* A detailed overview of system activity with highlighting.
* Graphs and statistics allow you quickly to track down resource hogs and runaway processes.
* Can't edit or delete a file? Discover which processes are using that file.
* See what programs have active network connections, and close them if necessary.
* Get real-time information on disk access.
* View detailed stack traces with kernel-mode, WOW64 and .NET support.
* Go beyond services.msc: create, edit and control services.
* Small, portable and no installation required.
* 100% Free Software (MIT)

Building the project

Requires Visual Studio (2022 or later).

Execute build_release.cmdlocated in the builddirectory to compile the project or load the SystemInformer.slnand Plugins.slnsolutions if you prefer building the project using Visual Studio.

You can download the free Visual Studio Community Edition to build the System Informer source code.

See the build readme for more information or if you're having trouble building.

Enhancements/Bugs

Please use the GitHub issue tracker for reporting problems or suggesting new features.

Settings

If you are running System Informer from a USB drive, you may want to save System Informer's settings there as well. To do this, create a blank file named "SystemInformer.exe.settings.xml" in the same directory as SystemInformer.exe. You can do this using Windows Explorer:

1. Make sure "Hide extensions for known file types" is unticked in Tools > Folder options > View.
2. Right-click in the folder and choose New > Text Document.
3. Rename the file to SystemInformer.exe.settings.xml (delete the ".txt" extension).

Plugins

Plugins can be configured from Options > Plugins.

If you experience any crashes involving plugins, make sure they are up to date.

Disk and Network information provided by the ExtendedTools plugin is only available when running System Informer with administrative rights.
Download Systeminformer

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

System Informer - A Free, Powerful, Multi-Purpose Tool That Helps You Monitor System Resources, Debug Software And Detect Malware

8 viewsedited 14:13

Hacking Articles Tips Tricks Videos Tutorials

First Writeup — Broken Authentication and IDOR
https://ma7moodbakr.medium.com/first-writeup-broken-authentication-and-idor-23b5a03eef89?source=rss------bug_bounty-5

Hello everyone, I hope you all are doing good. This is my first writeup and in this will be covering a finding of a simple IDOR.Continue reading on Medium » (https://ma7moodbakr.medium.com/first-writeup-broken-authentication-and-idor-23b5a03eef89?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

First Writeup — Broken Authentication and IDOR

Hello everyone, I hope you all are doing good. This is my first writeup and in this will be covering a finding of a simple IDOR.

6 viewsedited 15:21

Hacking Articles Tips Tricks Videos Tutorials

Hello All Hackers !! Here is a guide to get started with Bug Bounty
https://secrooq.medium.com/hello-all-hackers-here-is-a-guide-to-get-started-with-bug-bounty-204dde43c92?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium