Kali Linux Tutorials
PenguinTrace : Tool To Show How Code Runs At The Hardware Level

penguinTrace is intended to help build an understanding of how programs run at the hardware level. It provides a way to see what instructions compile to, and then step through those instructions and see how they affect machine state as well as how this maps back to variables in the original program. A bit more background is available on the website.

penguinTrace starts a web-server which provides a web interface to edit and run code. Code can be developed in C, C++ or Assembly. The resulting assembly is then displayed and can then be stepped through, with the values of hardware registers and variables in the current scope shown.

penguinTrace runs on Linux and supports the AMD64/X86-64 and AArch64 architectures. penguinTrace can run on other operating systems using Docker, a virtual machine or through the Windows Subsystem for Linux (WSL).
The primary goal of penguinTrace is to allow exploring how programs execute on a processor, however the development provided an opportunity to explore how debuggers work and some lower-level details of interaction with the kernel.

Note: penguinTrace allows running arbitrary code as part of its design. By default it will only listen for connections from the local machine. It should only be configured to listen for remote connections on a trusted network and not exposed to the interface. This can be mitigated by running penguinTrace in a container, and a limited degree of isolation of stepped code can be provided when libcapis available. Getting StartedPrerequisitespenguinTrace requires 64-bit Linux running on a X86-64 or AArch64 processor. It can also run on a Raspberry Pi running a 64-bit (AArch64) Linux distribution. For other operating systems, it can be run on Windows 10 using the Windows Subsystem for Linux (WSL) or in a Docker container. WSL does not support tracee process isolation.
python
clang
llvm
llvm-dev
libclang-dev
libcap-dev # For containment BuildingTo build penguinTrace outside of a container, clone the repository and run make. The binaries will be placed in build/binby default.

To build penguinTrace in Docker, run docker build -t penguintrace github.com/penguintrace/penguintrace. RunningOnce penguinTrace is built, running the penguintracebinary will start the server.

If built in a container it can then be run with docker run -it -p 127.0.0.1:8080:8080 --tmpfs /tmp:exec --cap-add=SYS_PTRACE --cap-add=SYS_ADMIN --rm --security-opt apparmor=unconfined penguintrace penguintrace. See Containers for details on better isolating the container.

Then navigate to 127.0.0.1:8080 or localhost:8080 to access the web interface.

Note: In order to run on port 80, you can modify the docker runcommand to map from port 8080 to port 80, e.g. -p 127.0.0.1:80:8080.
If built locally, you can modify the binary to allow it to bind to port 80 with sudo setcap CAP_NET_BIND_SERVICE=+ep penguintrace. It can then be run with penguintrace -c SERVER_PORT 80penguinTrace defaults to port 8080 as it is intended to be run as an unprivileged user. Temporary FilesThe penguinTrace server uses the system temporary directory as a location for compiled binaries and environments for running traced processes. If the PENGUINTRACE_TMPDIRenvironment variable is defined, this directory will be used. It will fall back to the TMPDIRenvironment variable and finally the directories specified in the C library.

This must correspond to a directory without noexecset, if running in a container it is likely the filesystem will have this set by default. NetworkingBy default penguinTrace only listens on the loopback device and IPv4. If the server is configured to listen on all addresses, then also s[...]

___________________________
@hacking_Attack
@Hacking_Video

etting the server to IPv6 will allow connections on both IPv4 and IPv6, this is the default mode when running in a Docker container.

This is because penguinTrace only creates a single thread to listen to connections and so can currently only bind to a single address or all addresses. Session HandlingBy default penguinTrace runs in multiple session mode, each time code is compiled a new session is created. The URL fragment (after the ‘#’) of the UI is updated with the session id, and this URL can be used to reconnect to the same session.

If running in single session mode each penguinTrace instance only supports a single debugging instance. The web UI will automatically reconnect to a previous session. To support multiple sessions, multiple instances should be launched which are listening on different ports. ContainersThe docker_build.shand docker_run.shscripts provide an example of how to run penguinTrace in a Docker container. Dockerfile_noisolateprovides an alterative way of running that does not require the SYS_ADMINcapability but provides less isolation between the server and the traced processes. The SYS_PTRACEcapability is always required for the server to trace processes. misc/apparmor-profileprovides an example AppArmor profile that is suitable for running penguinTrace but may need some customisation for the location of temporary directories and compilers. AArch64 / Raspberry PipenguinTrace will only run under a 64-bit operating system. The official operating systems provided for the Raspberry Pi are all 32-bit, to run penguinTrace something such as pi64 or Arch Linux Arm is required.

Full instructions for setting up a 64-bit OS on Raspberry Pi TBD. Click Here To Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
~~ my life with hackers ~~

zoom bomers

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Everything You Need to Know About Hacks, Malware, and Cyberattacks

https://cdn-images-1.medium.com/max/640/1*lhN-ejHJWAcuf4YtP2mL7w.jpeg
The digital world is now the real world. Businesses are digitizing their services everywhere you look to keep up with changing market…

Continue reading on Axiom »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
When security issues are considered as features (GITHUB)

https://cdn-images-1.medium.com/max/1516/1*vQaTK9kOSAeXMYJxE_oLmQ.jpeg
After 3 times in a row reporting issues that they do considerate as ‘abuse’ and not a vulnerability, I am publishing a PoC for their…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Burp Suite? No Thanks! Blind SQLi in DVWA With Python (Part 2) — StackZero

https://cdn-images-1.medium.com/max/1280/1*iSxJgJubrnOwSZZxUsFiBg.jpeg
Let’s build Blind SQLi attack together, without tools but just with Python

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How To Attacking The Domain Controller

https://cdn-images-1.medium.com/max/2600/0*BJmjOs7IYllkdh3E
If you were lucky enough to get a local administrative account or a domain admin account, the next target is usually the Domain Controller…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
OSCP — The Official Guide

https://cdn-images-1.medium.com/max/2600/0*Dltct82pIZnkQEwa
So you are looking to become an Offensive Security Certified Professional (OSCP) ?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
topmostp: A simple CLI tool to retrieve the N top most used ports

topmostp(Topmost Ports) is a tool that allows you to quickly retrieve the most used ports. The source of the ranking is the nmap-servicesin the nmap repo.

I know that the top ports can be retrieved with a single bash oneliner, but this tool gives you also different features such as stats about a specific port and also allows you to find the port by service. It is particularly useful when chained with other tools like naabu:

naabu -p $(topmostp all 15 --silent) -host example.com In this snippet the output of topmostpis used to retrieve the list of the top 10 ports and it is chained with the naabuport scanning tool.

Finally there is also a little demo made with asciinemaeven though in this demo some features (like statsand search) are missing.

This is the link of the GitHub repo: https://github.com/cybersecsi/topmostp

submitted by /u/deleee
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Cisco warns admins to patch AnyConnect flaw exploited in attacks

Cisco warns admins to patch AnyConnect flaw exploited in attacksPost Views: 62 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Cisco warned customers today that two security vulnerabilities in the Cisco AnyConnect Secure Mobility Client for Windows are being exploited in the wild.The AnyConnect Secure Mobility Client simplifies secure enterprise endpoint access and enables employees to work from anywhere while connected to a secure Virtual Private Network (VPN) through Secure Sockets Layer (SSL) and IPsec IKEv2.

The two security flaws (tracked as CVE-2020-3433 and CVE-2020-3153) enable local attackers to perform DLL hijacking attacks and copy files to system directories with system-level privileges.

Following successful exploitation, the attackers could execute arbitrary code on the targeted Windows devices with SYSTEM privileges.

Luckily, both vulnerabilities require authentication, with the attackers being required to have valid credentials on the system. However, they could be chained with Windows privilege escalation flaws, especially since proof-of-concept exploits are already available online for both CVEs [1, 2].

Today, two years after patching them in 2020, Cisco updated the security advisories to ask admins to update the vulnerable software and block ongoing attacks.

“In October 2022, the Cisco PSIRT became aware of additional attempted exploitation of this vulnerability in the wild,” the company warned.

“Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.”
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Added to CISA’s list of bugs exploited in attacksThis warning confirms an announcement from Cybersecurity and Infrastructure Security Agency (CISA) on Monday that both security flaws have been added to its Known Exploited Vulnerabilities catalog.

Once added to CISA’s list of bugs exploited in attacks, all Federal Civilian Executive Branch Agencies (FCEB) agencies are required by a binding operational directive (BOD 22-01) from November 2021 to apply patches or mitigation measures.

The federal agencies were given three weeks, until November 11th, to ensure that any ongoing exploitation attempts would be blocked.
Trending: Common and Uncommon types of SQL Injection Trending: Offensive Security Tool: Monkey365 As CISA added yesterday, “these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.”

The U.S. cybersecurity agency also strongly urged all organizations worldwide to prioritize patching these security bugs, even though BOD 22-01 only applies to U.S. FCEB agencies. ​Trending: Microsoft data breach exposes over 65K customers’ contact info, emails
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-12-300x150.png Apple fixes new zero-day used in attacks against iPhones, iPadsOctober 25, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp[...]

___________________________
@hacking_Attack
@Hacking_Video

-content/uploads/2022/10/Images-for-the-News-posts-11-300x150.png Exploited Windows zero-day lets JavaScript files bypass security warningsOctober 24, 2022
Reading Time: 6 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-1-2-300x150.png Microsoft Office Online Server open to SSRF-to-RCE exploitOctober 21, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-10-300x150.png Microsoft data breach exposes over 65K customers’ contact info, emailsOctober 20, 2022
Reading Time: 4 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Cisco warns admins to patch AnyConnect flaw exploited in attacks first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Report a Security Vulnerability Like a pro in less than 15 min!
https://joshuaarulsamy.medium.com/report-a-security-vulnerability-like-a-pro-in-less-than-15-min-881ae4f00455?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Bug bounty programs have become a major part of the security industry. They offer corporations, government agencies, and even individuals…Continue reading on Medium » (https://joshuaarulsamy.medium.com/report-a-security-vulnerability-like-a-pro-in-less-than-15-min-881ae4f00455?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Awesome CTF Resources

Hello guys Caleb (Dateneard) here welcome back today lets talk about ctfs (capture the flags)

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video