wafme0w: A new fast Web Firewall fingerprinting tool.
🗣Due_Criticism_2326

I am not Golang developer, but code is ugly.
It has a lot of nested loops. Is it normal?
👤Hot-Vegetable-3507

Can you provide data to back your claims that this is more performant than wafw00f?
👤wntrmut

Hello, I made this fast and concurrent Web Application Firewall fingerprinting tool. Written in Go, it's based on wafw00f. Performance gains are huge.
Any advice is welcome.
Thank you!
👤Due_Criticism_2326


🎖@malwr

FLARE VM update!
🗣Diesl

Nice! I remember when the installer would break due to outdated or unsupported applications. Chocolatey would fail and I would be so bummed.
👤rotten_sec


🎖@malwr

NIST Retires SHA-1 Cryptographic Algorithm
🗣OfftheTopRope

It's really hard for industries to change after they adopt a specific technology. In the USA, legal and accounting industries still use FAX machines, even though the rest of us have long ago replaced FAX with emailed attachments, SMS/MMS attachments, cloud sharing services, etc. Why do they use FAX? Because FAX is literally written into law as an approved method. It's hard enough to get a technology approved, it's even harder to get it obsoleted.

By today's standards, MD5 is horribly weak and broken. Creating two files with the same arbitrary hash can be done on a typical desktop in under 1 second. (Forced hash match.) Generatting a file with a specific hash (not arbitrary) might take hours or days. And natural hash collisions (not intentionally forced) have been encountered in the real world. MD5 hasn't been recommended for use in over a decade. And yet, MD5 is still widely used for tracking evidence. It is widely used by the legal system because long ago it was approved.

SHA1 has been considered relatively weak for years. However, forced collisions for specific hashes are very difficult and time consuming to generate. And I'm not aware of any natural (not forced) collisions. Even though SHA1 is officially retired, I suspect that SHA1 will be widely used long after anyone reading this posting is dead. from old age.
👤hackerfactor

SHA-1 has been broken for over a decade. We forensicators haven't used it in over 10 years.
👤gibson_mel

Not sure how this is relevant to digital forensics.
👤baggins422


🎖@malwr

Azure PenTesting Tools
I need to curate the most extensive list of Azure PenTesting tools I can. Most are already covered in this (as far as I can tell) fantastic list: https://github.com/Kyuu-Ji/Awesome-Azure-Pentest. I'd just add:

- Stratus: https://stratus-red-team.cloud/
- Basic Blob Finder (though there is a Blob finder in Kyuu-Ji's github already): https://github.com/joswr1ght/basicblobfinder

Is there any thing else anybody would add? Any favorites? Anything that's missing here?

Thanks!
🗣Round-Campaign-1692

I didn’t see Bloodhound on there.
👤DH_Prelude


🎖@malwr