Faking a JARM signature by replaying TLS Server Hello's
🗣Robbedoes_

This was actually a pretty slick writeup. I enjoyed the use cases mentioned in the article:

>They could be used by malicious actors to hide their applications when tools like JARM scanners are deployed to identify services in a network or on the internet. It can also be used for good. A honeypot replaying the fingerprint of a specific service can be used to setup a digital smokescreen for attackers.
👤-SnowBl1nd-


🎖@malwr

Microsoft Defender for Identity: ADFSDump
Microsoft updated Microsoft Defender for Identity to detect the ADFSDump tool’s use, which was the initial tool used in the Solorigate campaign. This blog post will describe what the attack does and bypass Microsoft Defender for Identity detection using a tool I have written, including mitigation to the attack.

https://thalpius.com/2020/12/28/microsoft-defender-for-identity-adfsdump/

​

P.s. Don't forget to join the Discord server.
🗣thalpius


🎖@malwr

Reverse Engineering Source Code of the Biontech Pfizer Vaccine: Part 2
🗣ASIC_SP

I don't understand shit, but it's an interesting read
👤the_dancing_squirel

Wouldn't have this problem if people weren't neurotic to germs. That's why we have an immune system and it needs practice.


Now, it seems like the only practice our immune system gets is from VSCode, JavaScript, and Electron. No wonder why covid turned our vital organs into liquid shit.
👤IamRudeAndDelusional


🎖@malwr

(anti-forensics) What's the best way to physically destroy data on a device
So, I have some drives that I want to physically destroy. I've read up on it a bit but the links mentioned like this one are no longer valid and I'm worried that with advancements in forensics or hard drive construction, that the methods are no longer viable.

What is the best way to 100% ensure the destruction of a hard drive (desktop and laptop)? What would be the quickest way? and would this change based on if it were a HDD or USB? (if I wanted to do like an average sandisk USB or phone, would that change anything in the process?
🗣Early-Winner9849

Throw it in a volcano.
Or lunch it to the sun.
Or use DBAN with 7 passes.
Most fire and explosion are not good. Many HDD could be, theoretically, partially recovered by LEA and military, although I read those cases are from '80s or '90s. Many says that physical recovery with broken disks is pretty much impossible since 2000 because HDD are much more dense.
There ie no point in physical destruction if you encrypt.
Encrypt + DBAN
the only fail I can imagine is firmware trojan.
👤Redfruitz

Destroying the drive assuming it was not uploaded to the cloud or anything is the only real method. It really depends on your situation.

Theoretically if you were under investigation and wanted to destroy the data, you're fucked. Every method is pretty obvious to the investigators to be expunging of evidence and it will be assumed it says whatever your investigators claimed it did by the court and submitted as evidence (and an extra charge or 3) generally.

If it's just embarrassing data or passwords or even card numbers encrypting and formatting the driver or downloading one of the programs meant specifically for that come to mind.

If it's enterprise stuff where you potentially actually have trade secrets at stake, just destroy the drive as best you can then see to it that the garbage trucks picks it up.
👤ruskyon

A plastic bucket and 18 molar H2SO4.
👤pogidaga


🎖@malwr

Bypass Windows protection mechanisms & Playing with OffensiveNim
🗣S3cur3Th1sSh1t

Good writeup! There are things in here I know a lot of companies would want to take a look at for their own security.
👤PwnistryCR

Java strikes again lol
👤cluberti

This is a great explanation. Really great work so thank you!
👤flani00


🎖@malwr

Monitoring with PowerShell: Monitoring Storage Sense
Hi all,

First off; I wish you all the best for the coming year. May it be filled with a 100% increase in MRR, no security incidents and lot's of easy clients.

As the year is ending I figured to release some blogs I still had waiting, this one is about StorageSense. Storage Sense is a sort of automated disk cleanup that works a lot more efficient than the standard disk cleanup. The blog can be found here https://www.cyberdrain.com/monitoring-with-powershell-monitoring-storage-sense-settings/.

Best wishes to you all! :)
🗣Lime-TeGek

I currently deploy storage sense settings via GPO but I’ve been working on ways to monitor this and other things that probably require impersonation. Maybe even something older like like folder redirection status.

I’m a little concerned about deploying something like this via RMM and being dependent package repo. (Both having the module and taking supply chain into account)
Is there anyway repackage a module like this into a single script?
👤mspit

2 two many doors. Nice ride.
👤Gatorvw

This is great. Thanks!
👤pinncomp


🎖@malwr

Ways to practice Windows PrivEsc
Hello community,

I am not really good (awful to be honest) with windows privilege escalation, and i am looking for resources to practice it. Are there any VMs that can be downloaded for that purpose?

Thanks in advance.

Happy hacking :)
🗣sakas4

Consider looking into the CRTP cert from Pen tester academy. I am currently working on this cert. there are many ways to escalate privileges locally on a windows machine but this cert focuses on NOT using exploits in order to escalate privileges in an enterprise network.
👤Redteamer1995

I am huge fan and admirer of Vulnhub myself but HTB is a bit more challenging and it makes your mind think like in a different way.
Vulnhub in general is easier than HTB. So, giving HTB a shot is not a bad idea.
👤skinny3l3phant

VMs that can be downloaded for that purpose?

HTB VIP or OFF SEC Playground is must for practicing Windows boxes.
👤skinny3l3phant


🎖@malwr

PCAP Forensics
🗣johnhammond010

Neat. I love capture the flag challenges.
👤maledependa


🎖@malwr

diodb: Open-source vulnerability disclosure and bug bounty program database by disclose.io
🗣yesnet0

Met the diodb database while doing "contact tracing" for a CVE recently.

Now I use it to find random companies to look for bugs in, rather than the other way around.

Extremely fast to Ctrl+F through the json, rather than load up 50+ vendor websites.
👤docker-osx


🎖@malwr

I just published my first step-by-step reverse engineering/game patching tutorial using Ghidra, x64dbg, and Python. I tried to make it fun & balance the technical aspects for newcomers to RE. I really hope it helps someone here. Feedback is appreciated.
🗣0xFF0F

I nearly stopped watching instantly when you said "everybody in Cyber", but I stuck with it and really enjoyed it :) You're a natural teacher, I'm sure this will be a go-to video for many people getting into RE. Good job!
👤mrverybored

This is really good, already shared it with my ctf teams
👤cents02


🎖@malwr

Reversing Go - Part 2
🗣digicat

This can and should be great content, but it is written poorly imo. Almost like a manual. No engagement for the reader, not even an introduction (not even for the first part), mostly spewed assembly with assumptions and explanations. Some people might be into this though, so thanks!
👤saudi_hacker1337


🎖@malwr

Beginners: Here is an Easy-To-Use Packet Sniffing Tool
Espionage: A Network Packet and Traffic Interceptor For Linux. Spoof ARP & Wiretap A Network.

https://github.com/DoubleThreatSecurity/Espionage

Espionage is a network packet sniffer that intercepts large amounts of data being passed through an interface. The tool allows users to to run normal and verbose traffic analysis that shows a live feed of traffic, revealing packet direction, protocols, flags, etc. Espionage can also spoof ARP so, all data sent by the target gets redirected through the attacker (MiTM). Espionage supports IPv4, TCP/UDP, ICMP, and HTTP. Espionage was written in Python 3.8 but it also supports version 3.6.
🗣overflow1n


🎖@malwr