Mosca – Manual Static Analysis Tool To Find Bugs

Mosca is a manual static analysis tool written in C designed to find bugs in the code before it is compiled, much like a grep unix command.

There are various ‘egg’ modules which contain patterns to scan for, it can scan through files recursively limited by file extension and logs results to an XML text file.
It’s also fairly easy to extend and add your own modules/eggs/languages.
Manual Static Analysis Tool Language Support
Languages it can scan for vulnerabilities are:

ASP
C
C#
Java
JavaScript
PHP
Ruby
Swift

You can download Mosca here:
Mosca-master.zip
Or read more here.
Read the rest of Mosca – Manual Static Analysis Tool To Find Bugs now! Only available at Darknet.

Link: https://www.darknet.org.uk/2019/07/mosca-manual-static-analysis-tool-to-find-bugs/

Malcom – Malware Communication Analyzer

Malcom is a Malware Communication Analyzer designed to analyze a system’s network communication using graphical representations of network traffic, and cross-reference them with known malware sources.

This comes handy when analyzing how certain malware species try to communicate with the outside world.
Malcom Malware Communication Analyzer Features
Malcom can help you:

Detect central command and control (C&C) servers
Understand peer-to-peer networks
Observe DNS fast-flux infrastructures
Quickly determine if a network artifact is ‘known-bad’

The aim of Malcom is to make malware analysis and intel gathering faster by providing a human-readable version of network traffic originating from a given host or network.
Read the rest of Malcom – Malware Communication Analyzer now! Only available at Darknet.

Link: https://www.darknet.org.uk/2018/11/malcom-malware-communication-analyzer/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed

Web Security Stats Show XSS & Outdated Software Are Major Problems

Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.

Data-based stats like these, which are not based on surveys, can be pretty useful – at least to get a broad overview of what is going on. These statistics also serve a solid purpose – they help all developers, security professionals and anyone who works with web applications better understand what might be going wrong.
Read the rest of Web Security Stats Show XSS & Outdated Software Are Major Problems now! Only available at Darknet.

Link: https://www.darknet.org.uk/2018/11/web-security-stats-show-xss-outdated-software-are-major-problems/

How To Recover When Your Website Got Hacked

The array of easily available Hacking Tools out there now is astounding, combined with self-propagating malware, people often come to me when their website got hacked and they don’t know what to do, or even where to start.

Acunetix has come out with a very useful post with a checklist of actions to take and items to prepare to help you triage and react in the event of a compromise on one of your servers or websites.
Read the rest of How To Recover When Your Website Got Hacked now! Only available at Darknet.

Link: https://www.darknet.org.uk/2018/10/how-to-recover-when-your-website-got-hacked/

HTTP Security Considerations – An Introduction To HTTP Basics

HTTP is ubiquitous now with pretty much everything being powered by an API, a web application or some kind of cloud-based HTTP driven infrastructure. With that HTTP Security becomes paramount and to secure HTTP you have to understand it.

HTTP is the protocol that powers the web and to penetrate via a web service it pays to have a good solid foundational understanding of HTTP, how it works and the common response codes – many of which can lead to some kind of vulnerability which is exploitable.
Read the rest of HTTP Security Considerations – An Introduction To HTTP Basics now! Only available at Darknet.

Link: https://www.darknet.org.uk/2018/08/http-security-considerations-an-introduction-to-http-basics/

Metta – Information Security Adversarial Simulation Tool

Metta is an information security preparedness tool in Python to help with adversarial simulation, this can help you check various detection and control capabilities within your organisation.

This project uses Redis/Celery, python, and vagrant with virtualbox to do adversarial simulation. This allows you to test (mostly) your host based instrumentation but may also allow you to test any network based detection and controls depending on how you set up your vagrants.
Read the rest of Metta – Information Security Adversarial Simulation Tool now! Only available at Darknet.

Link: https://www.darknet.org.uk/2018/06/metta-information-security-adversarial-simulation-tool/

Portspoof – Spoof All Ports Open & Emulate Valid Services

The primary goal of the Portspoof program is to enhance your system security through a set of new camouflage techniques which spoof all ports open and also emulate valid services on every port. As a result, any attackers port scan results will become fairly meaningless and will require hours of effort to accurately identify which ports have real services on and which do not.

The tool is meant to be a lightweight, fast, portable and secure addition to any firewall system or security system.
Read the rest of Portspoof – Spoof All Ports Open & Emulate Valid Services now! Only available at Darknet.

Link: https://www.darknet.org.uk/2018/04/portspoof-spoof-all-ports-open-emulate-valid-services/

Bitdefender Releases FREE GandCrab Ransomware Decryption Tool

The latest ransomware kicking everyone’s ass is Gandcrab which has infected an estimated 50,000 computers, fortunately for the victims, Bitdefender has released a free Gandcrab ransomware decryption tool as a part of the No More Ransom Project.

There’s nothing particularly notable about the ransomware itself other than it combines two existing exploit kits to compromise people and it takes payment in Dash, which is a privacy coin, rather than Bitcoin (which is a first as far as I know).
Read the rest of Bitdefender Releases FREE GandCrab Ransomware Decryption Tool now! Only available at Darknet.

Link: https://www.darknet.org.uk/2018/03/bitdefender-releases-free-gandcrab-ransomware-decryption-tool/

Google Chrome Marking ALL Non-HTTPS Sites Insecure July 2018

Google is ramping up its campaign against HTTP only sites and is going to mark ALL Non-HTTPS sites insecure in July 2018 with the release of Chrome 68. It’s a pretty strong move, but Google and the Internet, in general, has been moving in this direction for a while.

It started with suggestions, then forced SSL on all sites behind logins, then mixed-content warnings, then showing HTTP sites are not-secured and now it’s going to be outright marked as insecure.
Read the rest of Google Chrome Marking ALL Non-HTTPS Sites Insecure July 2018 now! Only available at Darknet.

Link: https://www.darknet.org.uk/2018/02/google-chrome-marking-non-https-sites-insecure-july-2018/