Looking for thoughts, advice, or known prior art of building an alternative to hooking: behavior baseline by predicting a limited subset of machine code's probable control flow in memory at runtime.
https://www.reddit.com/r/redteamsec/comments/xfeocn/looking_for_thoughts_advice_or_known_prior_art_of/

Hooking is pretty easy to beat. It's efficient, low overhead, but unreliable. It also results in very low resolution scrutiny of program behavior. I think I have an idea, not to replace hooking, but maybe add a more resilient redundant behavior analysis mechanism. Computational overhead is my primary concern, and also I'm unsure how often you can halt a process's normal execution flow to do this without noticeable performance impact. To be honest, I'm actually not even sure how, without implementing this in the kernel, you would, at some interval, redirect the instruction pointer to your analysis code (by force, not by hooking) and also protect it from attacker modification. But I think the idea itself is interesting enough to be discussion-worthy. I think the defender's best option to deal with higher end EDR evasion and obfuscation techniques is to analyze the control flow of the x86 machine code at run-time to build a baseline and detect when there's significant deviation. We know the control flow is unpredictable (https://www.reddit.com/r/cybersecurity/comments/qopemf/i_attempted_to_diagram_everything_ive_learned/), but it should be fairly predictable outside of malicious activity and a few edge-cases (JIT compilation, like in a browser). So I propose this idea of, at a set interval, decode a limited number of instructions ahead of the current IP, disassemble them, and map that disassembly to a behavior baseline. Make sure the control flow matches the baseline - a baseline generated and extrapolated on and broadened by comparing analysis of the same process on hundreds or thousands of hosts in a network.. The next interval, test your last prediction; make sure the IP is within the predicted control flow range. If not, log an alert to a SIEM. Maybe it's a false positive, but the SIEM's logic or some SOAR solution can at least more carefully scrutinize the process / host, maybe treat any other alerts from that host with higher sensitivity. These baselines could also be used as signatures. An attacker might re-write the implementation of a PowerShell command to evade improving PS auditing apparatuses, for example. Or Python, or any other LOLBIN vector. Or they might just do some unhooking on the mechanisms that perform that auditing. This measure would potentially be resistant to those evasion vectors along with control flow obfuscation. You would either identify a baseline that matches some other known baseline (like a PowerShell command, or a Python interpreter) or worse, one that doesn't match any baseline. submitted by /u/Jonathan-Todd (https://www.reddit.com/user/Jonathan-Todd)
[link] (https://www.reddit.com/r/redteamsec/comments/xfeocn/looking_for_thoughts_advice_or_known_prior_art_of/) [comments] (https://www.reddit.com/r/redteamsec/comments/xfeocn/looking_for_thoughts_advice_or_known_prior_art_of/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Anonymous IP logger?

New to hacking here

I want to make an title. I was using iplogger .org, but if you just hold the link then the preview exposes what youre doing. I tried using TinyURL but URL shorteners don’t hide the preview. How can I make this, with the average user having no idea that I got their IP address (preferrable with some sort of software thing like iplogger .org where it shows the location and such)?

submitted by /u/Legend5V
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
AndroRAT

I have an old android phone I’m t trying to mess around androRAT with, but when I get to systemctl status apache2.service it says “disabled” & “inactive.” Is there something else to use

submitted by /u/Dchemist909
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
The Uber hack is quite severe and wide ranging. Wishing their blue teams the best of luck and love during this understandably difficult period.

https://external-preview.redd.it/lw02mVmhV3Z_uCaxo6WTlqXUhdBfCGd22AqlF9DEvGU.jpg?width=108&crop=smart&auto=webp&s=be64f7d22a443d50f8dfe0c36df0890b5cb80b66 submitted by /u/GeniusDodo
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Proxy POC

So me and a friend of mine are working on a AITM proxy POC with python. They are stating that we should use flask but I’m not really sure that would work. Does anyone know of any example proxies we may be able to study from?

submitted by /u/KingA1mighty
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
REQUEST Mentorship RESPONSE $$ :)

Good day everyone,

Al lot of the time, you hear a successful people talk about how lucky they were having a mentor in some shape. I'm just going to pretty much throw out there I have decent understanding of service security so a decent time in fundamentals, however with all the information that are there I am unable to find a ride methodology without constantly getting stuck somewhere to become a full webApp and mobile hacker. This is the only work I can do as I'm suffering from a disability which also left me in a wheelchair. So i have time.

I guess what I'm saying is I'm looking more for an experienced coach, that gets paid. I know this is a long shot and im sure the responses will range from take the xyz path to you need to figure it out youself etc. The thing is like I said I have a lot of time since my accident so I have an account at HTB Codecademy THM havent started many of the Udemy courses by zSecurity cause i dont know which ones will waste time and which will get me closer to the goal im trying to reach.

for example. I learned JS on codecademy, just to realize i should have done HTML CSS websites interactive with JS instead as i can just console.log('disappointment') now after another thing completed that didn't get me a step closer but mentally 2 steps back because of frustration.

Well, its 6 am and Ill take a go at OWASP 10 on THM even tho i was thinking if i became a full stack dev. id know the ins and outs of what to look for so ya... there goes my dilemma.

If anyone is interested to make some money on the side let me know.

Thanks

submitted by /u/Gammasntax
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Coding in movies vs real life 😂

https://external-preview.redd.it/gnUxv1bCadAUCMAM3lGfQEbae3joMSZQ8w947_78ikc.jpg?width=320&crop=smart&auto=webp&s=b77e27b30f522da441ca1a1624ff7c288441414d submitted by /u/PoeticHerald
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Cross-site request forgery (CSRF) Explained and Exploited I
https://infosecwriteups.com/cross-site-request-forgery-csrf-explained-and-exploited-i-db464a61a582?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi! This blog will teach you how CSRF attacks happen and how we can prevent them.Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/cross-site-request-forgery-csrf-explained-and-exploited-i-db464a61a582?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Cross-site request forgery (CSRF) Explained and Exploited I

Hi! This blog will teach you how CSRF attacks happen and how we can prevent them.Continue reading on InfoSec Write-ups »
Read more...

No rate limit to SmS bombing..
https://itsrvsinghh.medium.com/no-rate-limit-to-sms-bombing-7e96a9d57efc?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello everyone,Continue reading on Medium » (https://itsrvsinghh.medium.com/no-rate-limit-to-sms-bombing-7e96a9d57efc?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Abusing Broken Link In Fitbit (Google Acquisition)To Collect BugBounty Reports On Behalf Of Google !
https://jayateerthag.medium.com/abusing-broken-link-in-fitbit-google-acquisition-to-collect-bugbounty-reports-on-behalf-of-google-5885a556eb7c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

I usually track acquisitions of websites for which I am hunting bugs regularly…Continue reading on Medium » (https://jayateerthag.medium.com/abusing-broken-link-in-fitbit-google-acquisition-to-collect-bugbounty-reports-on-behalf-of-google-5885a556eb7c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Information Gathering:
https://medium.com/@rajeevranjancom/information-gathering-43af1a221b8?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video