Hacking on Medium
Hacking, Hackers and Types!

https://cdn-images-1.medium.com/max/1024/1*tve4H8EdssNktR5h6Yuiyw.jpeg
Hello readers, long time it has been since by last blog on Cyber Security: A Brief Introduction.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Time-Based SQL Injection to Dumping the Database

https://cdn-images-1.medium.com/max/660/0*-JeWf25NioIFvrJL.png
Dumping the whole database

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

WAF Bypass Checklist
https://thexssrat.medium.com/waf-bypass-checklist-ad615dfa7cfc?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Generic techniques to try and bypass a WAF rulesetContinue reading on Medium » (https://thexssrat.medium.com/waf-bypass-checklist-ad615dfa7cfc?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Second Stage XSS (SSX)
https://dimazarno.medium.com/second-stage-xss-ssx-cd42d6e519c5?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Assalamualaikum Warohmatullahi Wabarokatuh :)Continue reading on Medium » (https://dimazarno.medium.com/second-stage-xss-ssx-cd42d6e519c5?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Time-Based SQL Injection to Dumping the Database
https://thevillagehacker.medium.com/time-based-sql-injection-to-dumping-the-database-da0e5bcaa9df?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Dumping the whole databaseContinue reading on Medium » (https://thevillagehacker.medium.com/time-based-sql-injection-to-dumping-the-database-da0e5bcaa9df?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Pystinger : Bypass Firewall For Traffic Forwarding Using Webshell

Pystinger implements SOCK4 proxy and port mapping through webshell. It can be directly used by metasploit-framework, viper, cobalt strike for session online. Pystinger is developed in python, and currently supports three proxy scripts: php, jsp(x) and aspx. Usage Suppose the domain name of the server is http://example.com :8080 The intranet IPAddress of the server intranet is 192.168.3.11 SOCK4 Proxy proxy.jsp Upload to […]

The post Pystinger : Bypass Firewall For Traffic Forwarding Using Webshell appeared first on Kali Linux Tutorials.

Time-Based SQL Injection to Dumping the Database

Dumping the whole databaseContinue reading on Medium »
Read more...

KitPloit - PenTest Tools!
Ghidra-Evm - Module For Reverse Engineering Smart Contracts

___________________________
@hacking_Attack
@Hacking_Video

Ghidra-Evm - Module For Reverse Engineering Smart Contracts
http://www.kitploit.com/2021/05/ghidra-evm-module-for-reverse.html

___________________________
@hacking_Attack
@Hacking_Video

In the last few years, attacks on deployed smart contracts (https://www.kitploit.com/search/label/Smart%20Contracts) in the Ethereum blockchain have ended up in a significant amount of stolen funds due to programming mistakes. Since smart contracts, once compiled and deployed, are complex to modify and update different practitioners have suggested the importance of reviewing their security in the blockchain where only Ethereum Virtual Machine (https://www.kitploit.com/search/label/Virtual%20Machine) (EVM) bytecode is available. In this respect, reverse engineering (https://www.kitploit.com/search/label/Reverse%20Engineering) through disassemble and decompilation can be effective.
ghidra-EVM is a Ghidra module for reverse engineering smart contracts. It can be used to download Ethereum Virtual Machine (EVM) bytecode from the Ethereum blockchain and disassemble and decompile the smart contract. Further, it can analyze creation code, find contract methods and locate insecure instructions. It comprises a processor module, custom loader and plugin(s) that disassembles Ethereum VM (EVM) bytecode and generates a control-flow graph (CFG) of a smart contract. The last version uses the Ghidra 9.1.2 API. It relies on the crytic evm_cfg_builder library (https://github.com/crytic/evm_cfg_builder) to assist Ghidra in the CFG generation process. Ghidra-evm consists of: A loader that reads byte and hex code from .evm and .evm_h files respectively (See examples (https://github.com/adelapie/ghidra-evm/blob/main/examples)). The SLEIGH definition of the EVM instruction set taking into account the Ghidra core limitations (See Notes). A helper script that uses evm_cfg_builder and ghidra_bridge in order to assist ghidra generating the CFG and exploring the function properties of a smart contract. A collection of scripts that help to reverse engineering different aspects of a smart contract: Script Description search_codecopy.py (https://github.com/adelapie/ghidra-evm/blob/main/scripts/search_codecopy.py) When analyzing creation code in a smart contract we can only see the _dispatcher function that uses CODECOPY in order to write the run time code into memory. This script looks for useful CODECOPY instructions and finds the smart contract methods hidden in the runtime part of the contract. search_dangerous_instructions.py (https://github.com/adelapie/ghidra-evm/blob/main/scripts/search_dangerous_instructions.py) Instructions such as CALL, CALLCODE, SELFDESTRUCT and DELEGATECALL can sometimed be abused to transfer funds to another contract. This script finds them and creates a label for each occurrence. load_external_contract.py (https://github.com/adelapie/ghidra-evm/blob/main/scripts/load_external_contract.py) Downloads smart contract byte code from the blockchain into a .evm_h file that can be loaded into ghidra-evm
Installation instructions
Install ghidra_bridge, following the instructions at https://github.com/justfoxing/ghidra_bridge Install the crytic evm_cfg_builder library, following the instructions at https://github.com/crytic/evm_cfg_builder Install the last ghidra-evm release file at ghidra_evm/dist/: Open ghidra File -> Install Extensions Click on '+' and select the zip file e.g. ghidra_9.1.2_PUBLIC_20201102_ghidra_evm.zip Click OK Restart Ghidra
Compilation instructions
The contents of the ghidra-evm directory can be used to create a Ghidra module in Eclipse with processor and loader in order to extend or debug ghidra_evm (https://github.com/adelapie/ghidra-evm/blob/main/ghidra_evm).
Tutorials

___________________________
@hacking_Attack
@Hacking_Video