Last updated: February 27, 2018 | 5,595 views
Quickjack is an intuitive, point-and-click tool for performing advanced and covert clickjacking and frame slicing attacks. It also allows you to easily perform clickjacking, or steal “clicks” from users on many websites, forcing the user to unknowingly click buttons or links (for example the Facebook Like button) using their own cookies.
Quickjack By placing the auto-generated code on any site, you can obtain thousands of clicks quickly from different users, or perform targeted attacks by luring a victim to a specific URL. It also allows you to deceive a user into believing you have information on them that you don’t, as well as coerce a user into providing information to you without even knowing it.
Using Quickjack for Clickjacking & Frame Slicing
Quickjack supports not only easy point-and-click generation of code, but also the underlying iframe follows the user’s mouse movement around the page wherever they go, hides the clickjacking frame, and even performs a method of determining when you’ve obtained the user’s click in order to then remove clickjacking from the page so the user can actually perform the click they meant to execute.
The tool also includes a frame slicing tool which allows you to capture a small section of a page to display to them, coercing them to believe you have such information on them. An example would be to slice a section of a website which normally contains the user’s name, then place that frame slice on your own site, making it appear that you know their name.
You can even use frame slicing to obtain information from the user, such as slicing different characters of the user’s name on a site, rearranging them and adding other letters and numbers, turning it into a captcha, and when the user enters the captcha, they’re just entering an anagram of their name (and other characters which you remove) and can determine their name!
In this project, we’ll learn how Quickjack performs these methods and how clickjacking and frame slicing work, as well as some of the more advanced techniques presented in the Quickjack tool which allow more potent clickjacking to occur, as well as see real demonstrations on sites such as Facebook.
There is also this to check out:
Jack – Drag & Drop Clickjacking Tool For PoCs
You can download Quickjack here:
quickjack-master.zip
Or read more here and use the tool directly here.
Posted in: Hacking Tools
Latest Posts:
Fuzzilli – JavaScript Engine Fuzzing Library
Fuzzilii is a JavaScript engine fuzzing library, it's a coverage-guided fuzzer for dynamic language interpreters based on a custom intermediate language.
October 22, 2020 - 47 Shares
OWASP APICheck – HTTP API DevSecOps Toolset
APICheck is an HTTP API DevSecOps toolset, it integrates existing tools, creates execution chains easily and is designed for integration with 3rd parties. October 13, 2020 - 82 Shares
trident – Automated Password Spraying Tool
The Trident project is an automated password spraying tool developed to be deployed on multiple cloud providers and provides advanced options around scheduling October 7, 2020 - 69 Shares
tko-subs – Detect & Takeover Subdomains With Dead DNS Records
tko-subs is a tool that helps you to detect & takeover subdomains with dead DNS records, this could be dangling CNAMEs point to hosting services and more. September 24, 2020 - 116 Shares
Arcane – Tool To Backdoor iOS Packages (iPhone ARM)
Arcane is a simple script tool to backdoor iOS packages (iPhone ARM) and create the necessary resources for APT repositories. August 17, 2020 - 240 Shares
SharpHose – Asynchronous Password Spraying Tool
SharpHose is an asynchronous password spraying tool in C# for Windows environments that takes into consideration fine-grained password policies and can be run over Cobalt Strike's execute-assembly.
July 27, 2020 - 250 Shares
Last updated: February 12, 2018 | 7,380 views
BootStomp is a Python-based tool, with Docker support that helps you find two different classes of Android bootloader vulnerabilities and bugs. It looks for memory corruption and state storage vulnerabilities.
Note that BootStomp works with boot-loaders compiled for ARM architectures (32 and 64 bits both) and that results might slightly vary depending on angr and Z3’s versions. This is because of the time angr takes to analyze basic blocks and to Z3’s expression concretization results.
How does BootStomp find Android Bootloader Vulnerabilities?
BootStomp implements a multi-tag taint analysis resulting from a novel combination of static analyses and dynamic symbolic execution, designed to locate problematic areas where input from an attacker in control of the OS can compromise the bootloader’s execution or its security features.
Using the tool the team found six previously-unknown vulnerabilities (of which five have been confirmed by the respective vendors), as well as rediscovered one that had been previously reported. Some of these vulnerabilities would allow an attacker to execute arbitrary code as part of the bootloader (thus compromising the entire chain of trust), or to perform permanent denial-of-service attacks.
The vulnerabilities impact the Trusted Boot or Verified Boot mechanisms implemented by vendors to establish a Chain of Trust (CoT). The team using BootStomp discovered vulnerabilities in the bootloaders used by Huawei, Qualcomm, MediaTek, and NVIDIA.
The team analyzed bootloader implementations in many platforms, including Huawei P8 ALE-L23 (Huawei / HiSilicon chipset), Sony Xperia XA (MediaTek chipset), Nexus 9 (NVIDIA Tegra chipset), and two versions of the LK-based bootloader (Qualcomm).
How to use BootStomp
The easiest way to use BootStomp is to run it in a docker container. The folder docker contains an appropriate Dockerfile, these are the commands to use it:
|
|
cd docker # build the docker image docker build -t bootstomp . # run the docker image (if you need, use proper options to have persistent changes or shared files) docker run -it bootstomp # now you are inside a docker container cd BootStomp # run BootStomp's taint analysis on one of the examples # this will take about 30 minutes python taint_analysis/bootloadertaint.py config/config.huawei # the last line of the output will be something like: # INFO | 2017-10-14 01:54:10,617 | _CoreTaint | Results in /tmp/BootloaderTaint_fastboot.img_.out # you can then "pretty print" the results using: python taint_analysis/result_pretty_print.py /tmp/BootloaderTaint_fastboot.img_.out |
For Android related security you can also check out:
– Androguard – Reverse Engineering & Malware Analysis For Android
You can download BootStomp here:
BootStomp-master.zip
Or read more here.
Posted in: Hacking Tools
Latest Posts:
Fuzzilli – JavaScript Engine Fuzzing Library
Fuzzilii is a JavaScript engine fuzzing library, it's a coverage-guided fuzzer for dynamic language interpreters based on a custom intermediate language.
October 22, 2020 - 47 Shares
OWASP APICheck – HTTP API DevSecOps Toolset
APICheck is an HTTP API DevSecOps toolset, it integrates existing tools, creates execution chains easily and is designed for integration with 3rd parties. October 13, 2020 - 82 Shares
trident – Automated Password Spraying Tool
The Trident project is an automated password spraying tool developed to be deployed on multiple cloud providers and provides advanced options around scheduling October 7, 2020 - 69 Shares
tko-subs – Detect & Takeover Subdomains With Dead DNS Records
tko-subs is a tool that helps you to detect & takeover subdomains with dead DNS records, this could be dangling CNAMEs point to hosting services and more. September 24, 2020 - 116 Shares
Arcane – Tool To Backdoor iOS Packages (iPhone ARM)
Arcane is a simple script tool to backdoor iOS packages (iPhone ARM) and create the necessary resources for APT repositories. August 17, 2020 - 240 Shares
SharpHose – Asynchronous Password Spraying Tool
SharpHose is an asynchronous password spraying tool in C# for Windows environments that takes into consideration fine-grained password policies and can be run over Cobalt Strike's execute-assembly.
July 27, 2020 - 250 Shares
Last updated: February 10, 2018 | 3,416 views
Google is ramping up its campaign against HTTP only sites and is going to mark ALL Non-HTTPS sites insecure in July 2018 with the release of Chrome 68. It’s a pretty strong move, but Google and the Internet, in general, has been moving in this direction for a while.
It started with suggestions, then forced SSL on all sites behind logins, then mixed-content warnings, then showing HTTP sites are not-secured and now it’s going to be outright marked as insecure.
Three years ago, Google’s search engine began favouring in its results websites that use encrypted HTTPS connections.
Sites that secure their content get a boost over websites that used plain-old boring insecure HTTP. In a “carrot and stick” model, that’s the carrot: rewarding security with greater search visibility.
Later this year comes the stick. This summer, Google will mark non-HTTPS websites as insecure in its Chrome browser, fulfilling a plan rolled out in September 2016.
Starting with Chrome 68, due to hit the stable distribution channel on July 2018, visiting a website using an HTTP connection will prompt the message “Not secure” in the browser’s omnibox – the display and input field that accepts both URLs and search queries.
“Chrome’s new interface will help users understand that all HTTP sites are not secure, and continue to move the web toward a secure HTTPS web by default,”
I’m glad I updated this site to SSL before it became absolutely critical, and to be honest with Google Cloud, Amazon AWS and Lets Encrypt offering SSL termination for free, there’s no real excuse not to be on SSL anymore.
– Introducing managed SSL for Google App Engine
– New – AWS Certificate Manager – Deploy SSL/TLS-Based Apps on AWS
– Getting Started – Let’s Encrypt – Free SSL/TLS Certificates
Because Chrome holds something like 56 percent of the global browser market share across mobile and desktop platforms, Google’s name-and-shame label is likely to be noticed by a great many Chrome users and by any websites those fans no longer visit due to security concerns.
While many websites will be affected, plenty are already in compliance. According to Google, 81 of the top 100 websites use HTTPS by default, over 68 percent of Chrome traffic on Android and Windows occurs over HTTPS, and over 78 percent of Chrome traffic on Chrome OS and macOS and iOS travels securely.
Google offers a free security auditing tool called Lighthouse that can help developers identify which website resources still load using insecure HTTP.
The Chocolate Factory’s shunning scheme follows a similar tack the company has taken to issue warnings to websites that rely on dodgy Symantec digital certificates.
I would imagine similar standards are going to be pushed out across the other browsers given the time and the fact Google is still the biggest search engine, they define how the web reacts.
Make sure your SSL install is secure using these:
– TLSSLed v1.2 – Evaluate The Security Of A Target SSL Or TLS (HTTPS) Web Server Implementation
– sslscan Download – Detect SSL Versions & Cipher Suites (Including TLS)
The official blog by Google on this is here:
A secure web is here to stay
I personally think this is a step in the right direction and wonder why only 81 of the top 100 sites are on SSL.
Source: The Register
Posted in: Countermeasures
Latest Posts:
Fuzzilli – JavaScript Engine Fuzzing Library
Fuzzilii is a JavaScript engine fuzzing library, it's a coverage-guided fuzzer for dynamic language interpreters based on a custom intermediate language.
October 22, 2020 - 47 Shares
OWASP APICheck – HTTP API DevSecOps Toolset
APICheck is an HTTP API DevSecOps toolset, it integrates existing tools, creates execution chains easily and is designed for integration with 3rd parties. October 13, 2020 - 82 Shares
trident – Automated Password Spraying Tool
The Trident project is an automated password spraying tool developed to be deployed on multiple cloud providers and provides advanced options around scheduling October 7, 2020 - 69 Shares
tko-subs – Detect & Takeover Subdomains With Dead DNS Records
tko-subs is a tool that helps you to detect & takeover subdomains with dead DNS records, this could be dangling CNAMEs point to hosting services and more. September 24, 2020 - 116 Shares
Arcane – Tool To Backdoor iOS Packages (iPhone ARM)
Arcane is a simple script tool to backdoor iOS packages (iPhone ARM) and create the necessary resources for APT repositories. August 17, 2020 - 240 Shares
SharpHose – Asynchronous Password Spraying Tool
SharpHose is an asynchronous password spraying tool in C# for Windows environments that takes into consideration fine-grained password policies and can be run over Cobalt Strike's execute-assembly.
July 27, 2020 - 250 Shares
Last updated: February 7, 2018 | 4,435 views
Altdns is a Subdomain Recon Tool in Python that allows for the discovery of subdomains that conform to patterns. The tool takes in words that could be present in subdomains under a domain (such as test, dev, staging) as well as takes in a list of subdomains that you know of.
From these two lists that are provided as input to altdns, the tool then generates a massive output of “altered” or “mutated” potential subdomains that could be present. It saves this output so that it can then be used by your favourite DNS brute-forcing tool such as:
– SubBrute – Subdomain Brute-forcing Tool
– Bluto – DNS Recon, Zone Transfer & Brute Forcer
Features of altdns Subdomain Enumeration Tool
Alternatively, the -r flag can be passed to altdns so that once this output is generated, the tool can then resolve these subdomains (multi-threaded) and save the results to a file.
Altdns works best with large datasets. Having an initial dataset of 200 or more subdomains should churn out some valid subdomains via the alterations generated.
altdns Subdomain Recon Tool Usage
|
|
./altdns.py -i subdomains.txt -o data_output -w words.txt -r -s results_output.txt subdomains.txt contains the known subdomains for an organization data_output is a file that will contain the massive list of altered and permuted subdomains words.txt is your list of words that you'd like to permute your current subdomains with (i.e. admin, staging, dev, qa) - one word per line the -r command resolves each generated, permuted subdomain the -s command tells altdns where to save the results of the resolved permuted subdomains. results_output.txt will contain the final list of permuted subdomains found that are valid and have a DNS record. the -t command limits how many threads the resolver will use simultaneously -d 1.2.3.4 overrides the system default DNS resolver and will use the specified IP address as the resolving server. Setting this to the authoritative DNS server of the target domain may increase resolution performance |
You can download altdns here:
altdns-master.zip
Or read more here.
Posted in: Hacking Tools
Latest Posts:
Fuzzilli – JavaScript Engine Fuzzing Library
Fuzzilii is a JavaScript engine fuzzing library, it's a coverage-guided fuzzer for dynamic language interpreters based on a custom intermediate language.
October 22, 2020 - 47 Shares
OWASP APICheck – HTTP API DevSecOps Toolset
APICheck is an HTTP API DevSecOps toolset, it integrates existing tools, creates execution chains easily and is designed for integration with 3rd parties. October 13, 2020 - 82 Shares
trident – Automated Password Spraying Tool
The Trident project is an automated password spraying tool developed to be deployed on multiple cloud providers and provides advanced options around scheduling October 7, 2020 - 69 Shares
tko-subs – Detect & Takeover Subdomains With Dead DNS Records
tko-subs is a tool that helps you to detect & takeover subdomains with dead DNS records, this could be dangling CNAMEs point to hosting services and more. September 24, 2020 - 116 Shares
Arcane – Tool To Backdoor iOS Packages (iPhone ARM)
Arcane is a simple script tool to backdoor iOS packages (iPhone ARM) and create the necessary resources for APT repositories. August 17, 2020 - 240 Shares
SharpHose – Asynchronous Password Spraying Tool
SharpHose is an asynchronous password spraying tool in C# for Windows environments that takes into consideration fine-grained password policies and can be run over Cobalt Strike's execute-assembly.
July 27, 2020 - 250 Shares
Last updated: February 3, 2018 | 4,034 views
So another 0-Day Flash Vulnerability is being exploited in the Wild, a previously unknown flaw which has been labelled CVE-2018-4878 and it affects 28.0.0.137 and earlier versions for both Windows and Mac (the desktop runtime) and for basically everything in the Chrome Flash Player (Windows, Mac, Linux and Chrome OS).
The full Adobe Security Advisory can be found here:
– Security Advisory for Flash Player | APSA18-01
Adobe warned on Thursday that attackers are exploiting a previously unknown security hole in its Flash Player software to break into Microsoft Windows computers. Adobe said it plans to issue a fix for the flaw in the next few days, but now might be a good time to check your exposure to this still-ubiquitous program and harden your defenses.
Adobe said a critical vulnerability (CVE-2018-4878) exists in Adobe Flash Player 28.0.0.137 and earlier versions. Successful exploitation could allow an attacker to take control of the affected system.
The software company warns that an exploit for the flaw is being used in the wild, and that so far the attacks leverage Microsoft Office documents with embedded malicious Flash content. Adobe said it plans to address this vulnerability in a release planned for the week of February 5.
According to Adobe’s advisory, beginning with Flash Player 27, administrators have the ability to change Flash Player’s behavior when running on Internet Explorer on Windows 7 and below by prompting the user before playing Flash content. A guide on how to do that is here (PDF). Administrators may also consider implementing Protected View for Office. Protected View opens a file marked as potentially unsafe in Read-only mode.
The wild usage of the exploit seems to be in the Korean context with North Korean hackers using it against South Korean targets and apparently they have been using it since November 2017.
It’s a fairly complex attack chain so I’m surprised if it’s a very reliable exploit as it targets Flash content embedded in Microsoft Office documents.
Hopefully, most readers here have taken my longstanding advice to disable or at least hobble Flash, a buggy and insecure component that nonetheless ships by default with Google Chrome and Internet Explorer. More on that approach (as well as slightly less radical solutions) can be found in A Month Without Adobe Flash Player. The short version is that you can probably get by without Flash installed and not miss it at all.
For readers still unwilling to cut the Flash cord, there are half-measures that work almost as well. Fortunately, disabling Flash in Chrome is simple enough. Paste “chrome://settings/content” into a Chrome browser bar and then select “Flash” from the list of items. By default it should be set to “Ask first” before running Flash, although users also can disable Flash entirely here or whitelist and blacklist specific sites.
By default, Mozilla Firefox on Windows computers with Flash installed runs Flash in a “protected mode,” which prompts the user to decide if they want to enable the plugin before Flash content runs on a Web site.
Another, perhaps less elegant, alternative to wholesale kicking Flash to the curb is to keeping it installed in a browser that you don’t normally use, and then only using that browser on sites that require Flash.
Most browsers of the current generation have either no Flash support at all, or make it “ask-first” when Flash content attempts to display. I would hazard a guess that this is why the attackers chose to target Flash embedded in Microsoft Office documents as it’s such ubiquitous software and not so regularly updated or patched by individuals or organsations.
It’s not the first Flash zero-day and it won’t be the last, we’ve reported on a few before, I think the impact should get less and less as more sites phase out Flash and move to native HTML5.
Source: Krebs
Posted in: Hacking News
Latest Posts:
Fuzzilli – JavaScript Engine Fuzzing Library
Fuzzilii is a JavaScript engine fuzzing library, it's a coverage-guided fuzzer for dynamic language interpreters based on a custom intermediate language.
October 22, 2020 - 47 Shares
OWASP APICheck – HTTP API DevSecOps Toolset
APICheck is an HTTP API DevSecOps toolset, it integrates existing tools, creates execution chains easily and is designed for integration with 3rd parties. October 13, 2020 - 82 Shares
trident – Automated Password Spraying Tool
The Trident project is an automated password spraying tool developed to be deployed on multiple cloud providers and provides advanced options around scheduling October 7, 2020 - 69 Shares
tko-subs – Detect & Takeover Subdomains With Dead DNS Records
tko-subs is a tool that helps you to detect & takeover subdomains with dead DNS records, this could be dangling CNAMEs point to hosting services and more. September 24, 2020 - 116 Shares
Arcane – Tool To Backdoor iOS Packages (iPhone ARM)
Arcane is a simple script tool to backdoor iOS packages (iPhone ARM) and create the necessary resources for APT repositories. August 17, 2020 - 240 Shares
SharpHose – Asynchronous Password Spraying Tool
SharpHose is an asynchronous password spraying tool in C# for Windows environments that takes into consideration fine-grained password policies and can be run over Cobalt Strike's execute-assembly.
July 27, 2020 - 250 Shares
Last updated: February 1, 2018 | 8,276 views
dorkbot is a modular command-line tool for Google dorking, which is performing vulnerability scans against a set of web pages returned by Google search queries in a given Google Custom Search Engine.
How dorkbot works
It is broken up into two sets of modules:
- Indexers – modules that issue a search query and return the results as targets
- Scanners – modules that perform a vulnerability scan against each target
Targets are stored in a local database file upon being indexed. Once scanned, any vulnerabilities found by the chosen scanner are written to a standard JSON report file. Indexing and scanning processes can be run separately or combined in a single command.
dorkbot Google Vulnerability Scanner Usage
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
usage: dorkbot.py [-h] [-c CONFIG] [-b BLACKLIST] [-d DATABASE] [-i INDEXER] [-l] [-o INDEXER_OPTIONS] [-p SCANNER_OPTIONS] [-s SCANNER] [-v VULNDIR] optional arguments: -h, --help show this help message and exit -c CONFIG, --config CONFIG Configuration file -b BLACKLIST, --blacklist BLACKLIST File containing (regex) patterns to blacklist from scans -d DATABASE, --database DATABASE SQLite3 database file -i INDEXER, --indexer INDEXER Indexer module to use -l, --list List targets in database -o INDEXER_OPTIONS, --indexer-options INDEXER_OPTIONS Indexer-specific options (opt1=val1,opt2=val2,..) -p SCANNER_OPTIONS, --scanner-options SCANNER_OPTIONS Scanner-specific options (opt1=val1,opt2=val2,..) -s SCANNER, --scanner SCANNER Scanner module to use -v VULNDIR, --vulndir VULNDIR Directory to store vulnerability output reports |
Example:
|
|
./dorkbot.py -i google -o engine=012345678901234567891:abc12defg3h,query="filetype:php inurl:id" |
The scanner module also needs:
– Arachni – Web Application Security Scanner Framework
– Wapiti – Web Application Scanner / Black-box testing
You can download dorkbot here:
dorkbot-master.zip
Or read more here.
Posted in: Hacking Tools
Latest Posts:
Fuzzilli – JavaScript Engine Fuzzing Library
Fuzzilii is a JavaScript engine fuzzing library, it's a coverage-guided fuzzer for dynamic language interpreters based on a custom intermediate language.
October 22, 2020 - 47 Shares
OWASP APICheck – HTTP API DevSecOps Toolset
APICheck is an HTTP API DevSecOps toolset, it integrates existing tools, creates execution chains easily and is designed for integration with 3rd parties. October 13, 2020 - 82 Shares
trident – Automated Password Spraying Tool
The Trident project is an automated password spraying tool developed to be deployed on multiple cloud providers and provides advanced options around scheduling October 7, 2020 - 69 Shares
tko-subs – Detect & Takeover Subdomains With Dead DNS Records
tko-subs is a tool that helps you to detect & takeover subdomains with dead DNS records, this could be dangling CNAMEs point to hosting services and more. September 24, 2020 - 116 Shares
Arcane – Tool To Backdoor iOS Packages (iPhone ARM)
Arcane is a simple script tool to backdoor iOS packages (iPhone ARM) and create the necessary resources for APT repositories. August 17, 2020 - 240 Shares
SharpHose – Asynchronous Password Spraying Tool
SharpHose is an asynchronous password spraying tool in C# for Windows environments that takes into consideration fine-grained password policies and can be run over Cobalt Strike's execute-assembly.
July 27, 2020 - 250 Shares
