🦑Extracting information remotely from Microsoft Remote Desktop Web Access (RDWA) with RDWAtool

🔍 Microsoft Remote Desktop Web Access (RDWA) applications are often overlooked yet can be a treasure trove of information for attackers. RDWAtool is a Python-based all-in-one tool designed to analyze and test RDWA instances for vulnerabilities while extracting valuable insights.
🛠 What can RDWAtool do?

1️⃣ Extract useful Information in black box remotely:
- FQDN of the remote server to map the environment.
- Internal AD domain name derived from the FQDN.
- Remote Windows Server version for targeted exploitation.

In spray mode:

rdwatool spray -tu https://rds.podalirius.net/RDWeb/Pages/en-US/login.aspx

In brute mode:

rdwatool brute -tu https://rds.podalirius.net/RDWeb/Pages/en-US/login.aspx

> Free <
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑💰 Cost Savings: SSE vs. SASE Simplified!

🌐 Organizations leveraging Palo Alto Networks experience significant ROI through unified management and simplified operations—all within a single pane of glass.
Streamline your security strategy while accelerating growth!
What’s the Difference?

🟠 SSE (Security Service Edge):
Focuses on securing access to apps and data for remote and on-premises users.
Core features: SWG, CASB, and ZTNA for seamless, secure connectivity.

🟠 SASE (Secure Access Service Edge):
Combines networking (SD-WAN) and security services in a single cloud-delivered solution.

Perfect for securing distributed users and sites with optimal performance.
Why Choose Palo Alto Networks?

✔️ Unified platform for better visibility and control.
✔️ Simplified operations with scalable solutions for all use cases.
✔️ Future-ready security with proven innovation.

Let’s make security smarter, faster, and simpler—together!

Ref: Dhari A.Dhari A.
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Honeypot Integration with Elastic Stack - A Practical Guide 🛡

In this project , i have integrated Honeypot (trap for hackers) with the ELK Stack to monitor the real-time alerts and advanced threat hunting. 🕵️‍♂️
🔧 Key Steps:

1️⃣ Honeypot Setup: Deployed multiple honeypot services to capture malicious activity. (Requires a public IP 🌐)

2️⃣ ELK Stack Installation: The Elastic Stack plays a pivotal role in collecting, storing, and visualizing the data from the T-Pot honeypot. 📊

3️⃣ Data Filtration & Visualization: Filtered and visualized attack data in Kibana for actionable insights. 🔍📈

Note : This project can be extended to capture the IOC’s like users can add their own threat intelligence databases and can use python scripts to train the machine learning models for future use .🔒For instance , a MISP instance can be setup to store the IOC's from this honeypot.

Ref: HAMZA JAMEEL
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 ShellSweep: Detecting Web Shells Made Easy for Defenders 🚀

🐚 What is ShellSweep?
ShellSweep is a suite of open-source tools designed to detect web shells using entropy analysis, static code checks, and heuristic methods. From incident response to threat hunting, ShellSweep helps defenders identify suspicious files quickly and efficiently.

🛠Why Defenders Need ShellSweep
✅ Test Your Coverage: Validate analytic detection for file mods, process executions, and suspicious behavior from web shells.
✅ Tuning & Training: Scan web servers, analyze entropy baselines, and tune detection to YOUR environment.
✅ Lightweight & Customizable: Works locally, supports PowerShell, Python, and Lua. Full control with zero dependency on external services.

🐚 ShellSweep: The foundation.
- Detects web shells using entropy-based analysis.
- Scans key extensions (.asp, .aspx, .php, .jsp) for high-entropy anomalies.
- Outputs file paths, entropy values, and hashes.

🐚🐚 ShellSweepPlus: Enhanced detection.
- Dynamic entropy thresholds.
- Multi-layered detection: Entropy, StdDev, Mixed Mode, and Heuristics.
- Static code analysis to spot malicious patterns.
- JSON outputs for structured results & further analysis.

🐚🐚🐚 ShellSweepX: Next-level, centralized detection.
- Combines entropy analysis, machine learning, and YARA rule matching.
- Cross-platform (PowerShell, Python, Bash).
- API integration for automated scans and result management.
- Web interface for visualizing and managing detections.

✨ Perfect for Incident Responders & Threat Hunters
🛡 Deploy ShellSweep tools in test or production environments.
🔍 Load up your preferred web shells, simulate uploads, and refine detection rules.
📈 Detect new or obfuscated threats. Identify gaps. Tune your defenses.

🧰 ShellSweep: ShellSweeping the Evil!

Ref: Michael H.Michael H.
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Encryption vs Hashing - What's the difference?

Imagine you have a secret recipe for a cake, and you want to share it with a friend.

🤵Encryption:

You lock the recipe in a box with a key and give the box to your friend.

Your friend can unlock the box (with the key you gave them) and read the recipe.

If someone else finds the box without the key, they can't read it.
Key Point: It can be reversed if you have the key (decrypt it).

🧛Hashing:

You put the recipe in a blender and blend it into a unique smoothie.

Now it’s impossible to get the original recipe back from the smoothie.

But if someone else blends the exact same recipe, they’ll get the exact same smoothie.

Key Point: One-way process. You can’t go back to the recipe, but you can check if two smoothies match.

In short:

Encryption is like locking something up—can be unlocked.

Hashing is like turning it into mush—you can’t un-mush it!

As both methods involve turning data into a scrambled form, one might consider these two the same. However, there is a distinction you must know about:

Data is encrypted twice while it’s only hashed once.

One can encrypt/decrypt a piece of data, meaning that the original text can be retrieved back. However, retrieval of plain text isn’t possible if data is hashed once.

Ref: Santosh Nandakumar
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Cloud Pentesting Cheatsheet🛡

Cloud penetration testing is a crucial skill to identify vulnerabilities in cloud environments like AWS, Azure, and Google Cloud Platform (GCP). This cheatsheet simplifies complex concepts and helps you take your cloud security game to the next level!

📘What’s Inside?
1️⃣ Key Testing Steps:
• Reconnaissance: Identify misconfigured assets, open ports, and exposed services in the cloud.
• Enumeration: Gather details about cloud accounts, storage buckets, APIs, and permissions.
• Exploitation: Simulate attacks by exploiting misconfigurations, weak access controls, or privilege escalation opportunities.
• Post-Exploitation: Assess the impact by reviewing data leakage and persistence mechanisms.

2️⃣ Cloud-specific Vulnerabilities:
• Misconfigured IAM roles and policies leading to unauthorized access.
• Publicly accessible storage buckets exposing sensitive data.
• Weak or absent encryption protocols for data in transit or at rest.
• Exploitable serverless functions (e.g., AWS Lambda) due to insecure coding practices.
• Over-permissive security groups allowing unrestricted traffic.

3️⃣ Essential Tools for Cloud Pentesting:
• ScoutSuite: Multi-cloud security auditing.
• Pacu: AWS exploitation framework for testing security.
• Cloudsploit: Scan configurations for security issues.
• Burp Suite: Analyze APIs in cloud applications.
• Nmap: Detect open ports and vulnerable services in the cloud.
• AWS CLI and GCP CLI: Enumerate configurations directly from the command line.

4️⃣ Best Practices:
• Use least privilege policies for all IAM roles and accounts.
• Enable logging and monitoring through services like AWS CloudTrail or Azure Monitor.
• Apply encryption standards (TLS, AES-256) to protect sensitive data.
• Regularly perform compliance checks using CIS Benchmarks and OWASP Cloud Top 10.

✨ Key Areas to Focus On:

🔑 Authentication and Authorization Flaws:
• Check for mismanaged credentials (e.g., leaked keys or weak passwords).
• Review SSO configurations for potential bypass scenarios.

📂 Storage Misconfigurations:
• Detect open storage buckets or public file access.
• Ensure data is encrypted and access is controlled through proper permissions.

📡 Network Security Risks:
• Audit firewall rules and security groups to detect overly permissive settings.
• Identify exposed management ports (SSH, RDP, etc.).

🔄 Serverless Security Issues:
• Look for weak input validation and insecure API integrations in serverless applications.
• Check timeout and resource limits to mitigate DoS risks.

Ref: Santosh Nandakumar
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 100 Free Security Tools – Protect Your Digital World for Free! 🚀

Looking to enhance your cybersecurity skills or secure your systems without breaking the bank? Explore this comprehensive list of 100 FREE Security Tools that cover every aspect of cybersecurity, from penetration testing to network security and data protection! 🌍

🔑 What’s Included?

✅ Network Security Tools

Wireshark: Analyze network packets in real-time.

Nmap: Scan networks for vulnerabilities.


✅ Web Security Tools

Burp Suite Community Edition: Test web application security.

ZAP (OWASP): Identify vulnerabilities in web applications.


✅ Endpoint Protection

Malwarebytes Free: Detect and remove malware effectively.

ClamAV: Open-source antivirus for Linux systems.


✅ Penetration Testing Tools

Metasploit Framework: Comprehensive pen-testing platform.

SQLmap: Automate SQL injection testing.


✅ Password Security

KeePass: Securely manage your passwords.

Hashcat: Advanced password recovery tool.


✅ Cloud Security Tools

ScoutSuite: Assess the security of your cloud infrastructure.

CloudSploit: Detect misconfigurations in cloud environments.


✅ Forensic Tools

Autopsy: Analyze digital media for forensic purposes.

FTK Imager: Quickly collect and analyze forensic data.


... and 85 more tools to strengthen your cybersecurity skills!

Ref: In pdf
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑💡𝐌𝐚𝐥𝐰𝐚𝐫𝐞 𝐀𝐧𝐚𝐥𝐲𝐬𝐢𝐬 𝐓𝐢𝐩: 𝐒𝐩𝐨𝐭𝐭𝐢𝐧𝐠 𝐀𝐧𝐭𝐢-𝐃𝐢𝐬𝐚𝐬𝐬𝐞𝐦𝐛𝐥𝐲 𝐓𝐫𝐢𝐜𝐤𝐬 💡

While analyzing malware, a common anti-disassembly technique to watch for is the use of a 𝐜𝐨𝐧𝐝𝐢𝐭𝐢𝐨𝐧𝐚𝐥 𝐣𝐮𝐦𝐩 𝐰𝐢𝐭𝐡 𝐚 𝐜𝐨𝐧𝐬𝐭𝐚𝐧𝐭 𝐜𝐨𝐧𝐝𝐢𝐭𝐢𝐨𝐧.

Take the snippet below as an example:

The code starts with 𝒙𝒐𝒓 𝒆𝒂𝒙, 𝒆𝒂𝒙, which clears the 𝑬𝑨𝑿 register and, as a result, sets the zero flag (𝒁𝑭).

Immediately after, a conditional jump (𝒋𝒛) checks the state of the zero flag.

Since 𝒙𝒐𝒓 𝒆𝒂𝒙, 𝒆𝒂𝒙 guarantees ZF will 𝒂𝒍𝒘𝒂𝒚𝒔 be set, the jump is effectively unconditional. However, to automated tools or disassemblers, it may appear as conditional, complicating static analysis.

🔐 𝑾𝒉𝒚 𝒅𝒐𝒆𝒔 𝒕𝒉𝒊𝒔 𝒎𝒂𝒕𝒕𝒆𝒓?

Malware authors use this technique to:

● Obfuscate control flow.
● Confuse disassembly tools.
● Make reverse engineering more time-consuming.

Ref: AIT ICHOU Mustapha
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁