Memhunter – Automated Memory Resident Malware Detection
Memhunter is an Automated Memory Resident Malware Detection tool for the hunting of memory resident malware at scale, improving the threat hunter analysis process and remediation times.
It’s a self contained binary that can be deployed and managed at scale, does not use memory dumps and relies purely on memory inspection to do its work. It also does not require any complex infrastructure to deploy.
The tool was designed as a replacement of memory forensic volatility plugins such as malfind and hollowfind. The idea of not requiring memory dumps helps on performing the memory resident malware threat hunting at scale, without manual analysis, and without the complex infrastructure needed to move dumps to forensic environments.
Memhunter in a nutshell:
- It is an standalone binary that gets itself deployed as a windows service
- It uses a set of memory inspection heuristics and ETW data collection to find footprints left by common injection techniques.
- Forensic information on findings gets reported through console or event logs for forwarding
Memhunter Automated Memory Resident Malware Detection Features
The detection process is performed through a combination of endpoint data collection and memory inspection scanners. The tool is a standalone binary that, upon execution, deploys itself as a windows service. Once running as a service, memhunter starts the collection of ETW events that might indicate code injection attacks. The live stream of collected data events is feed into memory inspection scanners that use detection heuristics to down select the potential attacks. The entire detection process does not require human intervention, neither memory dumps, and it can be performed by the tool itself at scale.
- 9 hunter heuristics included (see next slide)
- 15 code injection techniques implemented on minjector test tool
- ETW data collection of suspicious events used for heuristic triggering
- Windows Event Log generation
- Exclusion of baseline detection
- Basic forensic information
- Sqlite storage integration
Memhunter Automated Memory Resident Malware Detection minjector.exe
Besides the data collection and hunting heuristics, the project has also led to the creation of a companion tool called “minjector” that contains +15 code injection techniques. The minjector tool cannot only be used to exercise memhunter detections, but also as a one-stop location to learn on well-known code injection techniques out there.
You can download Memhunter here:
Or read more here.
Topic: Forensics
Sandcastle – AWS S3 Bucket Enumeration Tool
Sandcastle is a Python-based Amazon AWS S3 Bucket Enumeration Tool, formerly known as bucketCrawler. The script takes a target’s name as the stem argument (e.g. shopify) and iterates through a file of bucket name permutations.
Amazon S3 [Simple Storage Service] is cloud storage for the Internet. To upload your data (photos, videos, documents etc.), you first create a bucket in one of the AWS Regions. You can then upload any number of objects to the bucket.
In terms of implementation, buckets and objects are resources, and Amazon S3 provides APIs for you to manage them.
Examples of the kinds of bucket names it would look for:
- -training
- -bucket
- -dev
- -attachments
- -photos
- -elasticsearch
- […]
You can find the example bucket names file here.
Using Sandcastle – AWS S3 Bucket Enumeration Tool
Here’s how to get started:
- Clone this repo (PyPi distribution temporarily disabled).
- Run
sandcastle.pywith a target name and input file (grab an example from this repo) - Matching bucket permutations will be identified, and read permissions tested.
|
1 2 3 4 5 6 7 8 9 |
usage: sandcastle.py [-h] -t targetStem [-f inputFile] arguments: -h, --help show this help message and exit -t targetStem, --target targetStem Select a target stem name (e.g. 'shopify') -f inputFile, --file inputFile Select a bucket permutation file (default: bucket- names.txt) |
Status codes and testing for Sandcastle – AWS S3 Bucket Enumeration Tool
- 404 – Bucket Not Found – Not a target for analysis (hidden by default)
- 403 – Access Denied – Potential target for analysis via the CLI
- 200 – Publicly Accessible – Potential target for analysis via the CLI
You can download Sandcastle here:
Or read more here.
Topic: Hacking Tools
Astra – API Automated Security Testing For REST
Astra is a Python-based tool for API Automated Security Testing, REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs.
Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can automatically detect and test login & logout (Authentication API), so it’s easy for anyone to integrate this into CI/CD pipeline.
Astra can take API collection as an input so this can also be used for testing apis in standalone mode, it looks for the following issues:
- SQL injection
- Cross site scripting
- Information Leakage
- Broken Authentication and session management
- CSRF (including Blind CSRF)
- Rate limit
- CORS misconfiguration (including CORS bypass techniques)
- JWT attack
- CRLF detection
- Blind XXE injection
Using Astra for API Automated Security Testing
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 |
$ python astra.py --help _ /\ | | / \ ___| |_ _ __ __ _ / /\ \ / __| __| '__/ _` | / ____ \__ \ |_| | | (_| | /_/ \_\___/\__|_| \__,_| usage: astra.py [-h] [-c {Postman,Swagger}] [-n COLLECTION_NAME] [-u URL] [-headers HEADERS] [-method {GET,POST}] [-b BODY] [-l LOGINURL] [-H LOGINHEADERS] [-d LOGINDATA] REST API Security testing Framework optional arguments: -h, --help show this help message and exit -c {Postman,Swagger}, --collection_type {Postman,Swagger} Type of API collection -n COLLECTION_NAME, --collection_name COLLECTION_NAME Type of API collection -u URL, --url URL URL of target API -headers HEADERS, --headers HEADERS Custom headers.Example: {"token" : "123"} -method {GET,POST}, --method {GET,POST} HTTP request method -b BODY, --body BODY Request body of API -l LOGINURL, --loginurl LOGINURL URL of login API -H LOGINHEADERS, --loginheaders LOGINHEADERS Headers should be in a dictionary format. Example: {"accesstoken" : "axzvbqdadf"} -d LOGINDATA, --logindata LOGINDATA login data of API |
You can download Astra here:
Or read more here.
Topic: Security Software
Judas DNS – Nameserver DNS Poisoning Attack Tool
Judas DNS is a Nameserver DNS Poisoning Attack Tool which functions as a DNS proxy server built to be deployed in place of a taken over nameserver to perform targeted exploitation. Judas works by proxying all DNS queries to the legitimate nameservers for a domain.
The magic comes with Judas’s rule configurations which allow you to change DNS responses depending on source IP or DNS query type. This allows an attacker to configure a malicious nameserver to do things like selectively re-route inbound email coming from specified source IP ranges (via modified MX records), set extremely long TTLs to keep poisoned records cached, and more.
How to use Judas DNS Nameserver DNS Poisoning Attack Tool
The following is an example configuration for Judas for an example scenario where an attacker has compromised/taken over one of Apple’s authoritative nameservers (for apple.com):
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 |
{ "version": "1.0.0", "port": 2248, "dns_query_timeout": 10000, "target_nameservers": [ "17.254.0.59", "17.254.0.50", "17.112.144.50", "17.112.144.59", "17.171.63.30", "17.171.63.40", "17.151.0.151", "17.151.0.152" ], "rules": [ { "name": "Secretly redirect all emails coming from 127.0.0.1!", "query_type_matches": [ "MX" ], "ip_range_matches": [ "127.0.0.1/32" ], "modifications": [ { "answer": [ { "name": "apple.com", "type": 15, "class": 1, "ttl": 10, "priority": 10, "exchange": "hacktheplace.localhost" } ] } ] }, { "name": "Make all responses NOERROR even if they've failed.", "query_type_matches": [ "*" ], "modifications": [ { "header": { "rcode": 0 } } ] } ] } |
The above configuration value purposes are the following:
- version: The configuration file format version (for now is always 1.0.0).
- port: The port Judas should run on.
- dns_query_timeout: How long to wait in milliseconds before giving up on a reply from the upstream target nameserver.
- target_nameservers: The legit nameservers for your target domain, all DNS queries will be sent here from Judas on behalf of all requesting clients.
- rules: A list of rules with modifications to the DNS response to apply if matched.
- name: Name of a given rule.
- query_type_matches: List of query types to match on such as CNAME, A, etc. A wildcard (*) can also be specified to match any query type.
- ip_range_matches: List of IP ranges to match on. For selectively spoofing responses to a specific range of IPs.
- modifications: See the “Modifications” section of this README.
You can download Judas DNS here:
Or read more here.
Topic: Hacking Tools
dsniff Download – Tools for Network Auditing & Password Sniffing
Dsniff download is a collection of tools for network auditing & penetration testing. Dsniff, filesnarf, mailsnarf, msgsnarf, URLsnarf, and WebSpy passively monitor a network for interesting data (passwords, e-mail, files, etc.). ARPspoof, DNSspoof, and macof facilitate the interception of network traffic normally unavailable to an attacker (e.g, due to layer-2 switching). sshmitm and webmitm implement […]
Topic: Networking Hacking
OWASP Amass – DNS Enumeration, Attack Surface Mapping & External Asset Discovery
The OWASP Amass Project is a DNS Enumeration, Attack Surface Mapping & External Asset Discovery tool to help information security professionals perform network mapping of attack surfaces and perform external asset discovery using open source information gathering and active reconnaissance techniques. Information Gathering Techniques Used by OWASP Amass for DNS Enumeration and More The main […]
Topic: Hacking Tools