BlueHound - Tool That Helps Blue Teams Pinpoint The Security Issues That Actually Matter
http://www.kitploit.com/2023/01/bluehound-tool-that-helps-blue-teams.html
http://www.kitploit.com/2023/01/bluehound-tool-that-helps-blue-teams.html
It is a fork of NeoDash, reimagined, to make it suitable for defensive security purposes. To get started with BlueHound, check out our introductory video (https://youtu.be/WVup5tnURoM), blog post (https://zeronetworks.com/blog/bluehound-community-driven-resilience/) and Nodes22 conference talk (https://www.youtube.com/watch?app=desktop&v=76MWt8uugAg).
BlueHound supports presenting your data as tables, graphs, bar charts, line charts, maps and more. It contains a Cypher editor to directly write the Cypher queries that populate the reports. You can save dashboards to your database, and share them with others. Main Features Full Automation: The entire cycle of collection, analysis and reporting is basically done with a click of a button. Community Driven: BlueHound configuration can be exported and imported by others. Sharing of knowledge, best practices, collection methodologies and more, built-into the tool itself. Easy Reporting: Creating customized report can be done intuitively, without the need to write any code. Easy Customization: Any custom collection method can be added into BlueHound. Users can even add their own custom parameters or even custom icons for their graphs. Getting Started ROST ISO BlueHound can be used as part of the ROST image (https://zeronetworks.com/ROST-iso.zip), which comes pre-configured with everything you need (BlueHound, Neo4j, BloodHound, and a sample dataset).
To load ROST, create a new virtual machine, and install it from the ISO like you would for a new Windows host. BlueHound Binary If you already have a Neo4j instance running, you can download a pre-compiled version of BlueHound from our release page (https://github.com/zeronetworks/BlueHound/releases). Just download the zip file suitable to your OS version, extract it, and run the binary. Using BlueHound Connect to your Neo4j server Download SharpHound (https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/SharpHound.exe), ShotHound (https://github.com/zeronetworks/BloodHound-Tools/tree/main/ShotHound) and the Vulnerability Scanner report parser (https://github.com/zeronetworks/BloodHound-Tools/tree/main/VulnerabilitiesDataImport) Use the Data Import section to collect & import data into your Neo4j database. Once you have data loaded, you can use the Configurations tab to set up the basic information that is used by the queries (e.g. Domain Admins group, crown jewels servers). Finally, the Queries section can be used to prepare the reports. BlueHound How-To Data Collection The Data Import Tools section can be used to collect data in a click of a button. By default, BlueHound comes preconfigured with SharpHound, ShotHound, and the Vulnerability Scanners (https://www.kitploit.com/search/label/Vulnerability%20Scanners) script. Additional tools can be added for more data collection. To get started: Download the relevant tools using the globe icon Configure the tool path & arguments for each tool Run the tools The built-in tools can be configured to automatically upload the results to your Neo4j instance. Running & Viewing Queries To get results for a chart, either use the Refresh icon to run a specific query, or use the Query Runner section to run queries in batches. The results will be cached even after closing BlueHound, and can be run again to get updated results.
Some charts have an Info icon which explain the query and/or provide links to additional information. Adding & Editing Queries You can edit the query for new and/or existing charts by using the Settings icon on the top right section of the chart. Here you can use any parameters configured with a Param Select chart, and any Edge Filtering string (see section below). Edge Filtering Using the Edge Filtering section, you can filter out specific relationship types for all queries that use the relevant string in their query. For example, ":FILTERED_EDGES" can be used to filter by all the selection filters.
BlueHound supports presenting your data as tables, graphs, bar charts, line charts, maps and more. It contains a Cypher editor to directly write the Cypher queries that populate the reports. You can save dashboards to your database, and share them with others. Main Features Full Automation: The entire cycle of collection, analysis and reporting is basically done with a click of a button. Community Driven: BlueHound configuration can be exported and imported by others. Sharing of knowledge, best practices, collection methodologies and more, built-into the tool itself. Easy Reporting: Creating customized report can be done intuitively, without the need to write any code. Easy Customization: Any custom collection method can be added into BlueHound. Users can even add their own custom parameters or even custom icons for their graphs. Getting Started ROST ISO BlueHound can be used as part of the ROST image (https://zeronetworks.com/ROST-iso.zip), which comes pre-configured with everything you need (BlueHound, Neo4j, BloodHound, and a sample dataset).
To load ROST, create a new virtual machine, and install it from the ISO like you would for a new Windows host. BlueHound Binary If you already have a Neo4j instance running, you can download a pre-compiled version of BlueHound from our release page (https://github.com/zeronetworks/BlueHound/releases). Just download the zip file suitable to your OS version, extract it, and run the binary. Using BlueHound Connect to your Neo4j server Download SharpHound (https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/SharpHound.exe), ShotHound (https://github.com/zeronetworks/BloodHound-Tools/tree/main/ShotHound) and the Vulnerability Scanner report parser (https://github.com/zeronetworks/BloodHound-Tools/tree/main/VulnerabilitiesDataImport) Use the Data Import section to collect & import data into your Neo4j database. Once you have data loaded, you can use the Configurations tab to set up the basic information that is used by the queries (e.g. Domain Admins group, crown jewels servers). Finally, the Queries section can be used to prepare the reports. BlueHound How-To Data Collection The Data Import Tools section can be used to collect data in a click of a button. By default, BlueHound comes preconfigured with SharpHound, ShotHound, and the Vulnerability Scanners (https://www.kitploit.com/search/label/Vulnerability%20Scanners) script. Additional tools can be added for more data collection. To get started: Download the relevant tools using the globe icon Configure the tool path & arguments for each tool Run the tools The built-in tools can be configured to automatically upload the results to your Neo4j instance. Running & Viewing Queries To get results for a chart, either use the Refresh icon to run a specific query, or use the Query Runner section to run queries in batches. The results will be cached even after closing BlueHound, and can be run again to get updated results.
Some charts have an Info icon which explain the query and/or provide links to additional information. Adding & Editing Queries You can edit the query for new and/or existing charts by using the Settings icon on the top right section of the chart. Here you can use any parameters configured with a Param Select chart, and any Edge Filtering string (see section below). Edge Filtering Using the Edge Filtering section, you can filter out specific relationship types for all queries that use the relevant string in their query. For example, ":FILTERED_EDGES" can be used to filter by all the selection filters.
You can also filter by a specific category (see the Info icon) or even define your own custom edge filters. Import & Export Config The Export Config and Import Config sections can be used to save & load your dashboard (https://www.kitploit.com/search/label/Dashboard) and configurations as a backup, and even shared between users to collaborate and contribute insightful queries to the security community. Don’t worry, your credentials (https://www.kitploit.com/search/label/Credentials) and data won’t be exported.
Note: any arguments for data import tools are also exported, so make sure you remove any secrets before sharing your configuration. Settings The Settings section allows you to set some global limits on query execution – maximum query time and a limit for returned results. Technical Info BlueHound is a fork of NeoDash (https://github.com/neo4j-labs/neodash), built with React (https://reactjs.org/) and use-neo4j (https://github.com/adam-cowley/use-neo4j). It uses charts (https://github.com/neo4j-labs/charts) to power some of the visualizations. You can also extend NeoDash with your own visualizations. Check out the developer guide in the project repository (https://github.com/neo4j-labs/neodash). Developer Guide Run & Build using npm BlueHound is built with React. You'll need npm installed to run the web app. Use a recent version of npm and node to build BlueHound. The application has been tested with npm 8.3.1 & node v17.4.0. To run the application in development mode: clone this repository. open a terminal and navigate to the directory you just cloned. execute npm install to install the necessary dependencies. execute npm run dev to run the app in development mode. the application should be available at http://localhost:3000 (http://localhost:3000/). To build the app for production: follow the steps above to clone the repository and install dependencies. execute npm run build. This will create a build folder in your project directory. deploy the contents of the build folder to a web server. You should then be able to run the web app. Questions / Suggestions We are always open to ideas, comments, and suggestions regarding future versions of BlueHound, so if you have ideas, don’t hesitate to reach out to us at support@zeronetworks.com (mailto:support@zeronetworks.com) or open an issue/pull request on GitHub.
Download BlueHound (https://github.com/zeronetworks/BlueHound)
Note: any arguments for data import tools are also exported, so make sure you remove any secrets before sharing your configuration. Settings The Settings section allows you to set some global limits on query execution – maximum query time and a limit for returned results. Technical Info BlueHound is a fork of NeoDash (https://github.com/neo4j-labs/neodash), built with React (https://reactjs.org/) and use-neo4j (https://github.com/adam-cowley/use-neo4j). It uses charts (https://github.com/neo4j-labs/charts) to power some of the visualizations. You can also extend NeoDash with your own visualizations. Check out the developer guide in the project repository (https://github.com/neo4j-labs/neodash). Developer Guide Run & Build using npm BlueHound is built with React. You'll need npm installed to run the web app. Use a recent version of npm and node to build BlueHound. The application has been tested with npm 8.3.1 & node v17.4.0. To run the application in development mode: clone this repository. open a terminal and navigate to the directory you just cloned. execute npm install to install the necessary dependencies. execute npm run dev to run the app in development mode. the application should be available at http://localhost:3000 (http://localhost:3000/). To build the app for production: follow the steps above to clone the repository and install dependencies. execute npm run build. This will create a build folder in your project directory. deploy the contents of the build folder to a web server. You should then be able to run the web app. Questions / Suggestions We are always open to ideas, comments, and suggestions regarding future versions of BlueHound, so if you have ideas, don’t hesitate to reach out to us at support@zeronetworks.com (mailto:support@zeronetworks.com) or open an issue/pull request on GitHub.
Download BlueHound (https://github.com/zeronetworks/BlueHound)
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
BlueHound - Tool That Helps Blue Teams Pinpoint The Security Issues That Actually Matter
https://blogger.googleusercontent.com/img/a/AVvXsEjkEjbErH9NJ-aLN53fiZeqzGzeYETt-jTqn9pUFBrG9zdRAOfwjctfGBdWWScdirUhKGIrUsDQm8sqgezx2O1cs8wMjez6D8duhTCg1-qNrRpj0JsC3B1rgLUtuH6Y-dqpFHxzNVjwg_5zbT0W0JH0bWEQanXODyNL3td21L1110cGYYfx_cgGuyqkVw=w640-h332 BlueHound is an open-source tool that helps blue teams pinpoint the security issues that actually matter. By combining information about user permissions, network access and unpatched vulnerabilities, BlueHound reveals the paths attackers would take if they were inside your network
It is a fork of NeoDash, reimagined, to make it suitable for defensive security purposes.
To get started with BlueHound, check out our introductory video, blog post and Nodes22 conference talk.
BlueHound supports presenting your data as tables, graphs, bar charts, line charts, maps and more. It contains a Cypher editor to directly write the Cypher queries that populate the reports. You can save dashboards to your database, and share them with others. Main Features1. Full Automation: The entire cycle of collection, analysis and reporting is basically done with a click of a button.
2. Community Driven: BlueHound configuration can be exported and imported by others. Sharing of knowledge, best practices, collection methodologies and more, built-into the tool itself.
3. Easy Reporting: Creating customized report can be done intuitively, without the need to write any code.
4. Easy Customization: Any custom collection method can be added into BlueHound. Users can even add their own custom parameters or even custom icons for their graphs. Getting StartedROST ISOBlueHound can be used as part of the ROST image, which comes pre-configured with everything you need (BlueHound, Neo4j, BloodHound, and a sample dataset).
To load ROST, create a new virtual machine, and install it from the ISO like you would for a new Windows host. BlueHound BinaryIf you already have a Neo4j instance running, you can download a pre-compiled version of BlueHound from our release page. Just download the zip file suitable to your OS version, extract it, and run the binary. Using BlueHound1. Connect to your Neo4j server
2. Download SharpHound, ShotHound and the Vulnerability Scanner report parser
3. Use the Data Import section to collect & import data into your Neo4j database.
4. Once you have data loaded, you can use the Configurations tab to set up the basic information that is used by the queries (e.g. Domain Admins group, crown jewels servers).
5. Finally, the Queries section can be used to prepare the reports. BlueHound How-ToData CollectionThe Data Import Tools section can be used to collect data in a click of a button. By default, BlueHound comes preconfigured with SharpHound, ShotHound, and the Vulnerability Scanners script. Additional tools can be added for more data collection. To get started:
1. Download the relevant tools using the globe icon
2. Configure the tool path & arguments for each tool
3. Run the tools
The built-in tools can be configured to automatically upload the results to your Neo4j instance. Running & Viewing QueriesTo get results for a chart, either use the Refresh icon to run a specific query, or use the Query Runner section to run queries in batches. The results will be cached even after closing BlueHound, and can be run again to get updated results.
Some charts have an Info icon which explain the query and/or provide links to additional information. Adding & Editing QueriesYou can edit the query for new and/or existing charts by using the Settings icon on the top right section of the chart. Here you can use any parameters configured with a Param Select chart, and any Edge Filtering string (see section below). Edge FilteringUsing the Edge Filtering section, you [...]
BlueHound - Tool That Helps Blue Teams Pinpoint The Security Issues That Actually Matter
https://blogger.googleusercontent.com/img/a/AVvXsEjkEjbErH9NJ-aLN53fiZeqzGzeYETt-jTqn9pUFBrG9zdRAOfwjctfGBdWWScdirUhKGIrUsDQm8sqgezx2O1cs8wMjez6D8duhTCg1-qNrRpj0JsC3B1rgLUtuH6Y-dqpFHxzNVjwg_5zbT0W0JH0bWEQanXODyNL3td21L1110cGYYfx_cgGuyqkVw=w640-h332 BlueHound is an open-source tool that helps blue teams pinpoint the security issues that actually matter. By combining information about user permissions, network access and unpatched vulnerabilities, BlueHound reveals the paths attackers would take if they were inside your network
It is a fork of NeoDash, reimagined, to make it suitable for defensive security purposes.
To get started with BlueHound, check out our introductory video, blog post and Nodes22 conference talk.
BlueHound supports presenting your data as tables, graphs, bar charts, line charts, maps and more. It contains a Cypher editor to directly write the Cypher queries that populate the reports. You can save dashboards to your database, and share them with others. Main Features1. Full Automation: The entire cycle of collection, analysis and reporting is basically done with a click of a button.
2. Community Driven: BlueHound configuration can be exported and imported by others. Sharing of knowledge, best practices, collection methodologies and more, built-into the tool itself.
3. Easy Reporting: Creating customized report can be done intuitively, without the need to write any code.
4. Easy Customization: Any custom collection method can be added into BlueHound. Users can even add their own custom parameters or even custom icons for their graphs. Getting StartedROST ISOBlueHound can be used as part of the ROST image, which comes pre-configured with everything you need (BlueHound, Neo4j, BloodHound, and a sample dataset).
To load ROST, create a new virtual machine, and install it from the ISO like you would for a new Windows host. BlueHound BinaryIf you already have a Neo4j instance running, you can download a pre-compiled version of BlueHound from our release page. Just download the zip file suitable to your OS version, extract it, and run the binary. Using BlueHound1. Connect to your Neo4j server
2. Download SharpHound, ShotHound and the Vulnerability Scanner report parser
3. Use the Data Import section to collect & import data into your Neo4j database.
4. Once you have data loaded, you can use the Configurations tab to set up the basic information that is used by the queries (e.g. Domain Admins group, crown jewels servers).
5. Finally, the Queries section can be used to prepare the reports. BlueHound How-ToData CollectionThe Data Import Tools section can be used to collect data in a click of a button. By default, BlueHound comes preconfigured with SharpHound, ShotHound, and the Vulnerability Scanners script. Additional tools can be added for more data collection. To get started:
1. Download the relevant tools using the globe icon
2. Configure the tool path & arguments for each tool
3. Run the tools
The built-in tools can be configured to automatically upload the results to your Neo4j instance. Running & Viewing QueriesTo get results for a chart, either use the Refresh icon to run a specific query, or use the Query Runner section to run queries in batches. The results will be cached even after closing BlueHound, and can be run again to get updated results.
Some charts have an Info icon which explain the query and/or provide links to additional information. Adding & Editing QueriesYou can edit the query for new and/or existing charts by using the Settings icon on the top right section of the chart. Here you can use any parameters configured with a Param Select chart, and any Edge Filtering string (see section below). Edge FilteringUsing the Edge Filtering section, you [...]
Hacking Articles Tips Tricks Videos Tutorials
KitPloit - PenTest Tools! BlueHound - Tool That Helps Blue Teams Pinpoint The Security Issues That Actually Matter https://blogger.googleusercontent.com/img/a/AVvXsEjkEjbErH9NJ-aLN53fiZeqzGzeYETt-jTqn9pUFBrG9zdRAOfwjctfGBdWWScdirUhKGIrUsDQm8sqgezx2O1cs8wMjez6D8duhTCg1…
can filter out specific relationship types for all queries that use the relevant string in their query. For example, ":FILTERED_EDGES" can be used to filter by all the selection filters.
You can also filter by a specific category (see the Info icon) or even define your own custom edge filters. Import & Export ConfigThe Export Config and Import Config sections can be used to save & load your dashboard and configurations as a backup, and even shared between users to collaborate and contribute insightful queries to the security community. Don’t worry, your credentials and data won’t be exported.
Note: any arguments for data import tools are also exported, so make sure you remove any secrets before sharing your configuration. SettingsThe Settings section allows you to set some global limits on query execution – maximum query time and a limit for returned results. Technical InfoBlueHound is a fork of NeoDash, built with React and use-neo4j. It uses charts to power some of the visualizations. You can also extend NeoDash with your own visualizations. Check out the developer guide in the project repository. Developer GuideRun & Build using npmBlueHound is built with React. You'll need
Use a recent version of
To run the application in development mode:
* clone this repository.
* open a terminal and navigate to the directory you just cloned.
* execute
* execute
* the application should be available at http://localhost:3000.
To build the app for production:
* follow the steps above to clone the repository and install dependencies.
* execute
* deploy the contents of the build folder to a web server. You should then be able to run the web app. Questions / SuggestionsWe are always open to ideas, comments, and suggestions regarding future versions of BlueHound, so if you have ideas, don’t hesitate to reach out to us at support@zeronetworks.com or open an issue/pull request on GitHub. Download BlueHound
You can also filter by a specific category (see the Info icon) or even define your own custom edge filters. Import & Export ConfigThe Export Config and Import Config sections can be used to save & load your dashboard and configurations as a backup, and even shared between users to collaborate and contribute insightful queries to the security community. Don’t worry, your credentials and data won’t be exported.
Note: any arguments for data import tools are also exported, so make sure you remove any secrets before sharing your configuration. SettingsThe Settings section allows you to set some global limits on query execution – maximum query time and a limit for returned results. Technical InfoBlueHound is a fork of NeoDash, built with React and use-neo4j. It uses charts to power some of the visualizations. You can also extend NeoDash with your own visualizations. Check out the developer guide in the project repository. Developer GuideRun & Build using npmBlueHound is built with React. You'll need
npminstalled to run the web app.Use a recent version of
npmand nodeto build BlueHound. The application has been tested with npm 8.3.1 & node v17.4.0.To run the application in development mode:
* clone this repository.
* open a terminal and navigate to the directory you just cloned.
* execute
npm installto install the necessary dependencies.* execute
npm run devto run the app in development mode.* the application should be available at http://localhost:3000.
To build the app for production:
* follow the steps above to clone the repository and install dependencies.
* execute
npm run build. This will create a buildfolder in your project directory.* deploy the contents of the build folder to a web server. You should then be able to run the web app. Questions / SuggestionsWe are always open to ideas, comments, and suggestions regarding future versions of BlueHound, so if you have ideas, don’t hesitate to reach out to us at support@zeronetworks.com or open an issue/pull request on GitHub. Download BlueHound
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
hey guys which would be easier to make, a malicious docx or pdf?
Hey guys,
I know this is a bit strange but I am wondering which one would be easier to make. Here's a bit of a back story.
I am currently making a malware analysis sandbox and to test it out I want to make a malicious document (controlled test). This will be something I will want to look into in the future after my current studies but I want to try to make a malicious document that is easy to detect, and hopefully a malicious document that is hard to detect.
Any help, resources or advice is welcome. This is purely for educational purposes. If you have a better idea than docx or pdf please let me know , it has to be a document of some form (like excel or powerpoint).
submitted by /u/manooko
[link] [comments]
hey guys which would be easier to make, a malicious docx or pdf?
Hey guys,
I know this is a bit strange but I am wondering which one would be easier to make. Here's a bit of a back story.
I am currently making a malware analysis sandbox and to test it out I want to make a malicious document (controlled test). This will be something I will want to look into in the future after my current studies but I want to try to make a malicious document that is easy to detect, and hopefully a malicious document that is hard to detect.
Any help, resources or advice is welcome. This is purely for educational purposes. If you have a better idea than docx or pdf please let me know , it has to be a document of some form (like excel or powerpoint).
submitted by /u/manooko
[link] [comments]
Discovered Reflected Cross-Site Scripting Vulnerable into Shaadi.com
https://amit-lt.medium.com/discovered-reflected-cross-site-scripting-into-shaadi-com-508a855c8f81?source=rss------bug_bounty-5
https://amit-lt.medium.com/discovered-reflected-cross-site-scripting-into-shaadi-com-508a855c8f81?source=rss------bug_bounty-5
I have discovered a Reflected XSS vulnerability in shaadi.com, it means that an attacker can inject malicious code into the website, which…Continue reading on Medium » (https://amit-lt.medium.com/discovered-reflected-cross-site-scripting-into-shaadi-com-508a855c8f81?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
DC-Series
https://cdn-images-1.medium.com/max/700/1*6dZJCgKwZOh0IwpE-YBGmQ.png
DC-1 is a purposely built vulnerable lab for the purpose of gaining experience in the world of penetration testing.
Continue reading on Medium »
DC-Series
https://cdn-images-1.medium.com/max/700/1*6dZJCgKwZOh0IwpE-YBGmQ.png
DC-1 is a purposely built vulnerable lab for the purpose of gaining experience in the world of penetration testing.
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Creating and Winning a Capture the Flag Challenge: Our Experience Developing and Competing in an…
https://cdn-images-1.medium.com/max/2200/1*NIew9cDUfDkV7Tk4ANYL2Q.png
In December, my team and I took on a thrilling challenge as we participated in an Attack & Defense (A/D) Capture the Flag (CTF)…
Continue reading on Medium »
Creating and Winning a Capture the Flag Challenge: Our Experience Developing and Competing in an…
https://cdn-images-1.medium.com/max/2200/1*NIew9cDUfDkV7Tk4ANYL2Q.png
In December, my team and I took on a thrilling challenge as we participated in an Attack & Defense (A/D) Capture the Flag (CTF)…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Googling like a White hat
https://cdn-images-1.medium.com/max/2600/1*r9lzv0-dQGVHTfmJIidHSg.png
Last year, I had the chance to meet a White hat who works in the frensh cyberdefense. The first thing that struck me about him was his…
Continue reading on Medium »
Googling like a White hat
https://cdn-images-1.medium.com/max/2600/1*r9lzv0-dQGVHTfmJIidHSg.png
Last year, I had the chance to meet a White hat who works in the frensh cyberdefense. The first thing that struck me about him was his…
Continue reading on Medium »