Scripts for Headless CWE Issue Detection
I want to use the Ghidra analyzeHeadless capability to automatically assess binaries and identify CWE issues. Does Ghidra fit such a scenario and is anyone aware of Ghidra scripts available to perform such analyses?
I have compiled binaries (ELF & amd64) from the Juliet 1.3 CWE test suite for C/C++ and run analyzeHeadless against them using the default out-of-the-box Ghidra scripts. I get no identification of any issues even though the original source has 100s of injected coding issues.
Perhaps I am thinking of Ghidra use and/or application incorrectly?
Btw, I am aware of BAP and cwe\_checker, but would like the broadest toolset for identifying as many vulnerabilities as possible in given binaries or firmware.
🗣dwardoh21
🎖@malwr
I want to use the Ghidra analyzeHeadless capability to automatically assess binaries and identify CWE issues. Does Ghidra fit such a scenario and is anyone aware of Ghidra scripts available to perform such analyses?
I have compiled binaries (ELF & amd64) from the Juliet 1.3 CWE test suite for C/C++ and run analyzeHeadless against them using the default out-of-the-box Ghidra scripts. I get no identification of any issues even though the original source has 100s of injected coding issues.
Perhaps I am thinking of Ghidra use and/or application incorrectly?
Btw, I am aware of BAP and cwe\_checker, but would like the broadest toolset for identifying as many vulnerabilities as possible in given binaries or firmware.
🗣dwardoh21
🎖@malwr
NIST Software Assurance Reference Dataset
Test suites - NIST Software Assurance Reference Dataset
The Software Assurance Reference Dataset (SARD) is a publicly accessible collection of over 450,000 test cases in different programming languages, covering dozens of different classes of weaknesses, such as those in the Common Weakness Enumeration (CWE)
The mechanics of LockDown Browser - Blogpost
🗣Ferib
Pretty neat, been a while since I looked at this. A few years back they did quite a few more things, but the big one was the fact that they ran a local proxy and mitm'd all your web traffic. I'd assume they would still be doing all that though.
Bunch of other fun things too where it'd disable a lot of windows shortcuts to things such as run, task manager and so on using the usual registry keys. Hilariously, you used to be able to run their restore application (reverts all its system changes) while LDB is running and you'd get most stuff back.
The lab version of LDB is much easier to get around because it doesn't need admin to run, so it's scope of being able to be annoying as fuck is severely limited.
👤NotActuallyAdam
🎖@malwr
🗣Ferib
Pretty neat, been a while since I looked at this. A few years back they did quite a few more things, but the big one was the fact that they ran a local proxy and mitm'd all your web traffic. I'd assume they would still be doing all that though.
Bunch of other fun things too where it'd disable a lot of windows shortcuts to things such as run, task manager and so on using the usual registry keys. Hilariously, you used to be able to run their restore application (reverts all its system changes) while LDB is running and you'd get most stuff back.
The lab version of LDB is much easier to get around because it doesn't need admin to run, so it's scope of being able to be annoying as fuck is severely limited.
👤NotActuallyAdam
🎖@malwr
ferib.dev
What does LockDownBrowser really do?
Just like any student, I'm too lazy to do anything school-related. Not that I'm dumb or unskilled, but just because I don't <i>feel</i> like doing anything for school. Now imagine you have been doing nothing all year long, and you just figured out you have…
MAC Forensics
Looking for ideas on performing remote forensics on our Macs. Are there any alternatives for Kape/Kansa for Macs?
🗣Avinbihari
osquery, volatility after you've acquired a memory image
👤CommercialWay1
Check out GRR, it use to be a beast to setup, but I heard it was easier now. Also OSquery may do enough for your needs. I have not used, but I’ve heard of MIG (Mozilla InvestiGator). Of course there are lots of pay EDR tools, but im not sure which have the best mac support.
👤APT0001
Depends on what you need. Do you have physical access to it? Do need just disk? Memory? Google Rapid Response(grr), Fresponse( for collection), Autopsy, Plaso.
👤APT0001
🎖@malwr
Looking for ideas on performing remote forensics on our Macs. Are there any alternatives for Kape/Kansa for Macs?
🗣Avinbihari
osquery, volatility after you've acquired a memory image
👤CommercialWay1
Check out GRR, it use to be a beast to setup, but I heard it was easier now. Also OSquery may do enough for your needs. I have not used, but I’ve heard of MIG (Mozilla InvestiGator). Of course there are lots of pay EDR tools, but im not sure which have the best mac support.
👤APT0001
Depends on what you need. Do you have physical access to it? Do need just disk? Memory? Google Rapid Response(grr), Fresponse( for collection), Autopsy, Plaso.
👤APT0001
🎖@malwr
reddit
MAC Forensics
Looking for ideas on performing remote forensics on our Macs. Are there any alternatives for Kape/Kansa for Macs?
Tesla Autopilot hacked to go 85mph in a 35mph zone
🗣kpness
Kids with tape: I'm gonna do what Is called a pro-gamer move
👤Daemon1530
That’s a pretty funny exploit. Just a silly piece of tape.
Put up another sign “run from cops”.
👤TsunamiTreats
This is from 2014 according to the YouTube comments e:(the auto pilot 1.0)
👤1337turbo
🎖@malwr
🗣kpness
Kids with tape: I'm gonna do what Is called a pro-gamer move
👤Daemon1530
That’s a pretty funny exploit. Just a silly piece of tape.
Put up another sign “run from cops”.
👤TsunamiTreats
This is from 2014 according to the YouTube comments e:(the auto pilot 1.0)
👤1337turbo
🎖@malwr
YouTube
McAfee Demonstrates Model Hacking in the Real World
McAfee ATR successfully creates a black-box targeted attack on the MobilEye EyeQ3 camera system in a Tesla Model S utilizing Hardware pack 1, causing the camera to misclassify a 35 mile-per-hour (mph) speed limit sign as 85 mph, autonomously increase speed.…
Finding Python ReDoS bugs at scale using Dlint and r2c (CVE-2020-8492)
🗣Schwag
This reminds me of a similar project done for Javascript a while back, looking for ReDoS vulns at scale live on websites: https://www.usenix.org/conference/usenixsecurity18/presentation/staicu
👤wargame-mods
🎖@malwr
🗣Schwag
This reminds me of a similar project done for Javascript a while back, looking for ReDoS vulns at scale live on websites: https://www.usenix.org/conference/usenixsecurity18/presentation/staicu
👤wargame-mods
🎖@malwr
How to proxy and tamper with Mobile Applications
If you've ever wondered how to intercept and tamper with Mobile Applications, here's two videos explaining how to setup a proxy on your device and do just that.
Android: https://youtu.be/cRN0WEzadsE
iOS: https://youtu.be/AWsvdiVN4PA
🗣mrturvey
🎖@malwr
If you've ever wondered how to intercept and tamper with Mobile Applications, here's two videos explaining how to setup a proxy on your device and do just that.
Android: https://youtu.be/cRN0WEzadsE
iOS: https://youtu.be/AWsvdiVN4PA
🗣mrturvey
🎖@malwr
YouTube
How to proxy Android applications
Don't forget to subscribe and like the video for continued Cyber Security viewing!
In this video you will learn how to proxy Android applications with Burp Suite and intercept web and mobile applications. This will then allow you to tamper with the HTTPS…
In this video you will learn how to proxy Android applications with Burp Suite and intercept web and mobile applications. This will then allow you to tamper with the HTTPS…
FIDO2 security key company publishes results of internal security audit
🗣qznc_bot2
There is a discussion on Hacker News
👤qznc_bot2
🎖@malwr
🗣qznc_bot2
There is a discussion on Hacker News
👤qznc_bot2
🎖@malwr
Doyensec
Security Analysis of the Solo Firmware
We engaged Doyensec to perform a security assessment of our firmware, v3.0.1 at the time of testing. During a 10 person/days project, Doyensec discovered and reported 3 vulnerabilities in our firmware. While two of the issues are considered informational…