Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools!
Sandbox_Scryer - Tool For Producing Threat Hunting And Intelligence Data From Public Sandbox Detonation Output

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEkO_7BLm2yIe2Fg8yqCr8240TtKpuXiqbBiPpcj2nEHt3TMqh5bx4C4zXmnbiAKy5Qyvx2PWJnKoJLjX5dfLD4mLRIvPZYq6pjCUiGFMd4WQZJGMQ_B1eagaeSPZ3AnsDpJVnmSJoTYvHZ5WwCRJbQeTpWFlGHqXjK5iSLfJ3rq5-er0iA7hyhbNQyg/w640-h472/h33.png The Sandbox Scryer is an open-source tool for producing threat hunting and intelligence data from public sandbox detonation output The tool leverages the MITRE ATT&CK Framework to organize and prioritize findings, assisting in the assembly of IOCs, understanding attack movement and in threat hunting By allowing researchers to send thousands of samples to a sandbox for building a profile that can be used with the ATT&CK technique, the Sandbox Scryer delivers an unprecedented ability to solve use cases at scale The tool is intended for cybersecurity professionals who are interested in threat hunting and attack analysis leveraging sandbox output data. The Sandbox Scryer tool currently consumes output from the free and public Hybrid Analysis malware analysis service helping analysts expedite and scale threat hunting Repository contents[root] version.txt - Current tool version LICENSE - Defines license for source and other contents README.md - This file

[root\bin] \Linux - Pre-build binaries for running tool in Linux. Currently supports: Ubuntu x64 \MacOS - Pre-build binaries for running tool in MacOS. Currently supports: OSX 10.15 x64 \Windows - Pre-build binaries for running tool in Windows. Currently supports: Win10 x64

[root\presentation_video] Sandbox_Scryer__BlackHat_Presentation_and_demo.mp4 - Video walking through slide deck and showing demo of tool

[root\screenshots_and_videos] Various backing screenshots

[root\scripts] Parse_report_set.* - Windows PowerShell and DOS Command Window batch file scripts that invoke tool to parse each HA Sandbox report summary in test set Collate_Results.* - Windows PowerShell and DOS Command Window batch file scripts that invoke tool to collate data from parsing report summaries and generate a MITRE Navigator layer file

[root\slides] BlackHat_Arsenal_2022__Sandbox_Scryer__BH_template.pdf - PDF export of slides used to present the Sandbox Scryer at Black Hat 2022

[root\src] Sandbox_Scryer - Folder with source for Sandbox Scryer tool (in c#) and Visual Studio 2019 solution file

[root\test_data] (SHA256 filenames).json - Report summaries from submissions to Hybrid Analysis enterprise-attack__062322.json - MITRE CTI data TopAttackTechniques__High__060922.json - Top MITRE ATT&CK techniques generated with the MITRE calculator. Used to rank techniques for generating heat map in MITRE Navigator

[root\test_output] (SHA256)_report__summary_Error_Log.txt - Errors (if any) encountered while parsing report summary for SHA256 included in name (SHA256)_report__summary_Hits__Complete_List.png - Graphic showing tecniques noted while parsing report summary for SHA256 included in name (SHA256)_report__summary_MITRE_Attck_Hits.csv - For collation step, techniques and tactics with select metadata from parsing report summary for SHA256 included in name (SHA256)_report__summary_MITRE_Attck_Hits.txt - More human-readable form of .csv file. Includes ranking data of noted techniques

\collated_data collated_080122_MITRE_Attck_Heatmap.json - Layer file for import into MITRE Navigator OperationThe Sandbox Scryer is intended to be invoked as a command-line tool, to facilitate scripting

Operation consists of two steps:

* Parsing, where a specified report summary is parsed to extract the output noted earlier
* Collation, where the data from the set of[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Sandbox_Scryer - Tool For Producing Threat Hunting And Intelligence Data From Public Sandbox Detonation Output

8 viewsedited 12:47

KitPloit - PenTest Tools! Sandbox_Scryer - Tool For Producing Threat Hunting And Intelligence Data From Public Sandbox Detonation Output https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEkO_7BLm2yIe2Fg8yqCr8240TtKpuXiqbBiPpcj2nEHt3TMqh5bx4C4zX…

parsing results from the parsing step is collated to produce a Navigator layer file

Invocation examples:

*
Parsing

*
Collation
If the parameter "-h" is specified, the built-in help is displayed as shown here Sandbox_Scryer.exe -h

Options:
-h  Display command-line options
-i  Input filepath
-ita  Input filepath - MITRE report for top techniques
-o  Output folder path
-ft Type of file to submit
-name Name to use with output
-sb_name Identifier of sandbox to use  (default:  ha)
-api_key API key to use with submission to sandbox
-env_id Environment ID to use with submission to sandbox
-inc_sub Include sub-techniques in graphical output  (default is to not include)
-mitre_data Filepath for mitre cti data to parse (to populate att&ck techniques)
-cmd  Command
Options:
parse  Process report file from prior sandbox submission
Uses -i, -ita, -   o, -name, -inc_sub, -sig_data   parameters
col    Collates report data from prior sandbox submissions
Uses -i (treated as folder path), -ita, -o, -name, -inc_sub, -mitre_data   parameters

Once the Navigator layer file is produced, it may be loaded into the Navigator for viewing via https://mitre-attack.github.io/attack-navigator/

Within the Navigator, techniques noted in the sandbox report summaries are highlighted and shown with increased heat based on a combined scoring of the technique ranking and the count of hits on the technique in the sandbox report summaries. Howevering of techniques will show select metadata. Download Sandbox_Scryer

___________________________
@hacking_Attack
@Hacking_Video

10 viewsedited 12:47

Hacking Articles Tips Tricks Videos Tutorials

Sandbox_Scryer - Tool For Producing Threat Hunting And Intelligence Data From Public Sandbox Detonation Output
http://www.kitploit.com/2022/11/sandboxscryer-tool-for-producing-threat.html

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Sandbox_Scryer - Tool For Producing Threat Hunting And Intelligence Data From Public Sandbox Detonation Output

9 viewsedited 13:44

Hacking Articles Tips Tricks Videos Tutorials

7 views13:44

Hacking Articles Tips Tricks Videos Tutorials

The Sandbox Scryer is an open-source tool for producing threat hunting (https://www.kitploit.com/search/label/Threat%20Hunting) and intelligence (https://www.kitploit.com/search/label/Intelligence) data from public sandbox detonation output The tool leverages the MITRE ATT&CK Framework to organize and prioritize findings, assisting in the assembly of IOCs, understanding attack movement and in threat hunting By allowing researchers to send thousands of samples to a sandbox for building a profile that can be used with the ATT&CK technique, the Sandbox Scryer delivers an unprecedented ability to solve use cases at scale The tool is intended for cybersecurity (https://www.kitploit.com/search/label/Cybersecurity) professionals who are interested in threat hunting and attack analysis leveraging sandbox output data. The Sandbox Scryer tool currently consumes output from the free and public Hybrid Analysis malware analysis (https://www.kitploit.com/search/label/Malware%20Analysis) service helping analysts expedite and scale threat hunting
Repository contents [root] version.txt - Current tool version LICENSE - Defines license for source and other contents README.md - This file [root\bin] \Linux - Pre-build binaries for running tool in Linux. Currently supports: Ubuntu x64 \MacOS - Pre-build binaries for running tool in MacOS. Currently supports: OSX 10.15 x64 \Windows - Pre-build binaries for running tool in Windows. Currently supports: Win10 x64 [root\presentation_video] Sandbox_Scryer__BlackHat_Presentation_and_demo.mp4 - Video walking through slide deck and showing demo of tool [root\screenshots_and_videos] Various backing screenshots [root\scripts] Parse_report_set.* - Windows PowerShell and DOS Command Window batch file scripts that invoke tool to parse each HA Sandbox report summary in test set Collate_Results.* - Windows PowerShell and DOS Command Window batch file scripts that invoke tool to collate data from parsing report summaries and generate a MITRE Navigator layer file [root\slides] BlackHat_Arsenal_2022__Sandbox_Scryer__BH_template.pdf - PDF export of slides used to present the Sandbox Scryer at Black Hat 2022 [root\src] Sandbox_Scryer - Folder with source for Sandbox Scryer tool (in c#) and Visual Studio 2019 solution file [root\test_data] (SHA256 filenames).json - Report summaries from submissions to Hybrid Analysis enterprise-attack__062322.json - MITRE CTI data TopAttackTechniques__High__060922.json - Top MITRE ATT&CK techniques generated with the MITRE calculator. Used to rank techniques for generating heat map in MITRE Navigator [root\test_output] (SHA256)_report__summary_Error_Log.txt - Errors (if any) encountered while parsing report summary for SHA256 included in name (SHA256)_report__summary_Hits__Complete_List.png - Graphic showing tecniques noted while parsing report summary for SHA256 included in name (SHA256)_report__summary_MITRE_Attck_Hits.csv - For collation step, techniques and tactics with select metadata from parsing report summary for SHA256 included in name (SHA256)_report__summary_MITRE_Attck_Hits.txt - More human-readable form of .csv file. Includes ranking data of noted techniques \collated_data collated_080122_MITRE_Attck_Heatmap.json - Layer file for import into MITRE Navigator Operation The Sandbox Scryer is intended to be invoked as a command-line tool, to facilitate scripting Operation consists of two steps: Parsing, where a specified report summary is parsed to extract the output noted earlier Collation, where the data from the set of parsing results from the parsing step is collated to produce a Navigator layer file Invocation examples: Parsing Collation If the parameter "-h" is specified, the built-in help is displayed as shown here Sandbox_Scryer.exe -h Options:

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.

9 viewsedited 13:44

Hacking Articles Tips Tricks Videos Tutorials

-h Display command-line options
-i Input filepath
-ita Input filepath - MITRE report for top techniques
-o Output folder path
-ft Type of file to submit
-name Name to use with output
-sb_name Identifier (https://www.kitploit.com/search/label/Identifier) of sandbox to use (default: ha)
-api_key API key to use with submission to sandbox
-env_id Environment ID to use with submission to sandbox
-inc_sub Include sub-techniques in graphical output (default is to not include)
-mitre_data Filepath for mitre cti data to parse (to populate att&ck techniques)
-cmd Command
Options:
parse Process report file from prior sandbox submission
Uses -i, -ita, - o, -name, -inc_sub, -sig_data parameters
col Collates report data from prior sandbox submissions
Uses -i (treated as folder path), -ita, -o, -name, -inc_sub, -mitre_data parameters
Once the Navigator layer file is produced, it may be loaded into the Navigator for viewing via https://mitre-attack.github.io/attack-navigator/ Within the Navigator, techniques noted in the sandbox report summaries are highlighted and shown with increased heat based on a combined scoring of the technique ranking and the count of hits on the technique in the sandbox report summaries. Howevering of techniques will show select metadata.

Download Sandbox_Scryer (https://github.com/PayloadSecurity/Sandbox_Scryer)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.

8 viewsedited 13:44

Hacking Articles Tips Tricks Videos Tutorials

7 views14:17

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
Nuvola : Tool To Dump & Perform Automatic And Manual Security Analysis On AWS

nuvola (with the lowercase n) is a tool to dump and perform automatic and manual security analysis on AWS environments configurations and services using predefined, extensible and custom rules created using a simple Yaml syntax.

The general idea behind this project is to create an abstracted digital twin of a cloud platform. For a more concrete example: nuvola reflects the BloodHound traits used for Active Directory analysis but on cloud environments (at the moment only AWS).

The usage of a graph database also increases the possibility of finding different and innovative attack paths and can be used as an offline, centralised and lightweight digital twin.

Quick Start

Requirements

* docker-composeinstalled
* an AWS account configured to be used with awscliwith full access to the cloud resources, better if in ReadOnly mode (the policy arn:aws:iam::aws:policy/ReadOnlyAccessis fine)

Setup

1. Clone the repository
git clone --depth=1 https://github.com/primait/nuvola.git; cd nuvola
1. Create and edit, if required, the .envfile to set your DB username/password/URL
cp .env_example .env;
Start the Neo4j docker instance
make start
Build the tool
make build
Usage

1. Firstly you need to dump all the supported AWS services configurations and load the data into the Neo4j database:
./nuvola dump -profile default_RO -outputdir ~/DumpDumpFolder -format zip
1. To import a previously executed dump operation into the Neo4j database:
./nuvola assess -import ~/DumpDumpFolder/nuvola-default_RO_20220901.zip
1. To only perform static assessments on the data loaded into the Neo4j database using the predefined ruleset:
./nuvola assess
1. Or use Neo4j Browser to manually explore the digital twin.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhulCufeI3v3wnfw2b4kZYQiZtm21Efl2pPHYnfKdf4q_c4xAMDNeu6MGGDSqNniqL674ivedZGEIfHYLGezbbccGGUb8Wo8QL2nJK0shkVotbn3s1HfjgUj4MHt2yCOQpd9QBK2-y3Vi4KVcAROfoJm8FWbbOYUL-fiNIu9JqDSQZ_PM7ooGq_olAQ/s1580/188325663-d713d2bc-d522-4e9c-bc02-fc766f010374.png

Click Here To Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Nuvola : Tool To Dump & Perform Automatic And Manual Security Analysis On AWS

nuvola (with the lowercase n) is a tool to dump and perform automatic and manual security analysis on AWS environments configurations

6 viewsedited 14:17

Hacking Articles Tips Tricks Videos Tutorials

P1 Bug Hunting: A Step by Step Guide to SQL Injection
https://medium.com/the-gray-area/p1-bug-hunting-a-step-by-step-guide-to-sql-injection-76f95c8986b0?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

P1 Bug Hunting: A Step by Step Guide to SQL Injection

TL;DR- A beginners guide to SQL Injection in bug hunting, and obtaining access to the inner databases of targets.

6 viewsedited 14:45

About

Blog

Apps

Platform