Saturday, January 27, 2024

How To Start | How To Become An Ethical Hacker

Are you tired of reading endless news stories about ethical hacking and not really knowing what that means? Let's change that!
This Post is for the people that:

  • Have No Experience With Cybersecurity (Ethical Hacking)
  • Have Limited Experience.
  • Those That Just Can't Get A Break


OK, let's dive into the post and suggest some ways that you can get ahead in Cybersecurity.
I receive many messages on how to become a hacker. "I'm a beginner in hacking, how should I start?" or "I want to be able to hack my friend's Facebook account" are some of the more frequent queries. Hacking is a skill. And you must remember that if you want to learn hacking solely for the fun of hacking into your friend's Facebook account or email, things will not work out for you. You should decide to learn hacking because of your fascination for technology and your desire to be an expert in computer systems. Its time to change the color of your hat 😀

 I've had my good share of Hats. Black, white or sometimes a blackish shade of grey. The darker it gets, the more fun you have.

If you have no experience don't worry. We ALL had to start somewhere, and we ALL needed help to get where we are today. No one is an island and no one is born with all the necessary skills. Period.OK, so you have zero experience and limited skills…my advice in this instance is that you teach yourself some absolute fundamentals.
Let's get this party started.
  •  What is hacking?
Hacking is identifying weakness and vulnerabilities of some system and gaining access with it.
Hacker gets unauthorized access by targeting system while ethical hacker have an official permission in a lawful and legitimate manner to assess the security posture of a target system(s)

 There's some types of hackers, a bit of "terminology".
White hat — ethical hacker.
Black hat — classical hacker, get unauthorized access.
Grey hat — person who gets unauthorized access but reveals the weaknesses to the company.
Script kiddie — person with no technical skills just used pre-made tools.
Hacktivist — person who hacks for some idea and leaves some messages. For example strike against copyright.
  •  Skills required to become ethical hacker.
  1. Curosity anf exploration
  2. Operating System
  3. Fundamentals of Networking
*Note this sites





Related links


Posted by at No comments:

Friday, January 26, 2024

Exploiting Golang Unsafe Pointers


There are situations when c interacts with golang for example in a library, and its possible to exploit a golang function writing raw memory using an unsafe.Pointer() parameter.

When golang receive a null terminated string on a *C.Char parameter, can be converted to golang s tring with  s2 := C.GoString(s1) we can do string operations with s2 safelly if the null byte is there.

When golang receives a pointer to a buffer on an unsafe.Pointer() and the length of the buffer on a C.int, if the length is not cheated can be converted to a []byte safelly with b := C.GoBytes(buf,sz)

Buuut what happens if golang receives a pointer to a buffer on an unsafe.Pointer() and is an OUT variable? the golang routine has to write on this pointer unsafelly for example we can create a golangs memcpy in the following way:



We convert to uintptr for indexing the pointer and then convert again to pointer casted to a byte pointer dereferenced and every byte is writed in this way.

If b is controlled, the memory can be written and the return pointer of main.main or whatever function can be modified.

https://play.golang.org/p/HppcVpLfuMf


The return addres can be pinpointed, for example 0x41 buffer 0x42 address:



We can reproduce it simulating the buffer from golang in this way:


we can dump the address of a function and redirect the execution to it:


https://play.golang.org/p/7htJHJp8gUJ

In this way it's possible to build a rop chain using golang runtime to unprotect a shellcode.

Related articles


Posted by at No comments:

TLS V1.2 Sigalgs Remote Crash (CVE-2015-0291)


OpenSSL 1.0.2a fix several security issues, one of them let crash TLSv1.2 based services remotelly from internet.


Regarding to the TLSv1.2 RFC,  this version of TLS provides a "signature_algorithms" extension for the client_hello. 

Data Structures
If a bad signature is sent after the renegotiation, the structure will be corrupted, becouse structure pointer:
s->c->shared_sigalgs will be NULL, and the number of algorithms:
s->c->shared_sigalgslen will not be zeroed.
Which will be interpreted as one algorithm to process, but the pointer points to 0x00 address. 


Then tls1_process_sigalgs() will try to process one signature algorithm (becouse of shared_sigalgslen=1) then sigptr will be pointer to c->shared_sigalgs (NULL) and then will try to derreference sigptr->rhash. 


This mean a Segmentation Fault in  tls1_process_sigalgs() function, and called by tls1_set_server_sigalgs() with is called from ssl3_client_hello() as the stack trace shows.




StackTrace

The following code, points sigptr to null and try to read sigptr->rsign, which is assembled as movzbl eax,  byte ptr [0x0+R12] note in register window that R12 is 0x00

Debugger in the crash point.


radare2 static decompiled


The patch fix the vulnerability zeroing the sigalgslen.
Get  David A. Ramos' proof of concept exploit here





Read more


  1. Beginner Hacker Tools
  2. Hacking Tools And Software
  3. Hacker Hardware Tools
  4. Hack Tools
  5. Pentest Tools Framework
  6. Hacker Tools Apk Download
  7. Hack Tools Online
  8. Hacking App
  9. Hacking Tools
  10. Hack Tools For Pc
  11. Blackhat Hacker Tools
  12. How To Hack
  13. Install Pentest Tools Ubuntu
  14. Hack App
  15. Hack Tools For Pc
  16. Pentest Box Tools Download
  17. Hacking Tools For Mac
  18. Hack Tools For Games
  19. Hack Tools For Mac
  20. Hack Tools Pc
  21. Pentest Tools Subdomain
  22. Hacker Tools Mac
  23. Hacker Tools Free Download
  24. Hacker Tools List
  25. Hacker Tools For Windows
  26. Hacking Tools Download
  27. Pentest Tools Windows
  28. Hack Tools Mac
  29. Hack Tools Download
  30. What Is Hacking Tools
  31. Hacking Tools For Windows 7
  32. Pentest Box Tools Download
  33. Pentest Automation Tools
  34. Hacking Tools For Windows
  35. Hacking Apps
  36. Pentest Tools Kali Linux
  37. Pentest Tools Online
  38. Install Pentest Tools Ubuntu
  39. Underground Hacker Sites
  40. Hacker Tools 2020
  41. Hacks And Tools
  42. What Are Hacking Tools
  43. Hacker Tools 2019
  44. Hacker Tools Apk
  45. Hacker Tools Free Download
  46. Hacker Tools Apk
  47. Hack Apps
  48. Pentest Tools Subdomain
  49. Hack Tools For Windows
  50. Hacking Tools Hardware
  51. Pentest Reporting Tools
  52. Pentest Tools Review
  53. Hack Tool Apk No Root
  54. Pentest Tools Website Vulnerability
  55. Pentest Tools Alternative
  56. Termux Hacking Tools 2019
  57. Hack Tools Online
  58. Pentest Recon Tools
  59. Hacker Tools Github
  60. Pentest Tools Linux
  61. Hacker Tools Free Download
  62. Hacker Tools 2019
  63. Hacking Tools Windows
  64. World No 1 Hacker Software
  65. Pentest Tools Bluekeep
  66. Hacker Tools Free
  67. Hacking Tools Pc
  68. Pentest Tools Alternative
  69. Kik Hack Tools
  70. Hack Tools
  71. Pentest Tools Review
  72. Hacking Tools Windows 10
  73. Pentest Tools Find Subdomains
  74. Pentest Tools Tcp Port Scanner
  75. Hacking Tools For Pc
  76. Pentest Recon Tools
  77. Hacker Tools Github
  78. Pentest Box Tools Download
  79. Pentest Reporting Tools
  80. Hacker Tools For Mac
  81. Pentest Tools Apk
  82. Game Hacking
  83. Tools 4 Hack
  84. World No 1 Hacker Software
  85. Hacking Tools Windows 10
  86. Hacking Tools Download
  87. Hacker Tools
  88. Hacking Apps
  89. Hacking Tools Windows
  90. Termux Hacking Tools 2019
  91. Hack Tool Apk
  92. Pentest Automation Tools
  93. Hack Tools Online
  94. Pentest Tools Subdomain
  95. Pentest Tools Url Fuzzer
  96. Hack Website Online Tool
  97. Pentest Tools Subdomain
  98. What Is Hacking Tools
  99. How To Install Pentest Tools In Ubuntu
  100. Hacking Tools For Kali Linux
  101. Top Pentest Tools
  102. What Are Hacking Tools
  103. Pentest Tools Free
  104. Hacking Tools Mac
  105. Termux Hacking Tools 2019
  106. Physical Pentest Tools
  107. Kik Hack Tools
  108. Hacking Tools Software
  109. Pentest Tools Review
  110. Hacker Tools Apk Download
  111. Hacking Tools
  112. Hack App
  113. Game Hacking
  114. Hacking Tools Software
  115. Hacking Tools For Mac
  116. Hacker Search Tools
  117. Pentest Automation Tools
  118. Hack Tools Online
  119. How To Hack
  120. Best Hacking Tools 2019
  121. Ethical Hacker Tools
  122. Pentest Tools Windows
  123. What Is Hacking Tools
  124. Hacker Tool Kit
  125. Hack Tools For Windows
  126. Hacking Tools For Games
  127. Hacking Tools For Pc
  128. Wifi Hacker Tools For Windows
  129. Hacking Tools And Software
  130. Tools For Hacker
  131. Pentest Tools Download
  132. Pentest Tools Kali Linux
  133. Pentest Recon Tools
  134. Hacker Tools Github
  135. Hacker Hardware Tools
  136. Hack Tools
  137. Hacking Tools And Software
  138. Hacker
  139. Termux Hacking Tools 2019
  140. Hack Tools For Windows
  141. Install Pentest Tools Ubuntu
  142. Hacker Security Tools
  143. Hacking Tools Hardware
  144. Hacking Tools For Games
  145. Hack Tools Download
  146. Hacks And Tools
  147. Hacking Tools Free Download
Posted by at No comments:

Thursday, January 25, 2024

How To Start | How To Become An Ethical Hacker

Are you tired of reading endless news stories about ethical hacking and not really knowing what that means? Let's change that!
This Post is for the people that:

  • Have No Experience With Cybersecurity (Ethical Hacking)
  • Have Limited Experience.
  • Those That Just Can't Get A Break


OK, let's dive into the post and suggest some ways that you can get ahead in Cybersecurity.
I receive many messages on how to become a hacker. "I'm a beginner in hacking, how should I start?" or "I want to be able to hack my friend's Facebook account" are some of the more frequent queries. Hacking is a skill. And you must remember that if you want to learn hacking solely for the fun of hacking into your friend's Facebook account or email, things will not work out for you. You should decide to learn hacking because of your fascination for technology and your desire to be an expert in computer systems. Its time to change the color of your hat 😀

 I've had my good share of Hats. Black, white or sometimes a blackish shade of grey. The darker it gets, the more fun you have.

If you have no experience don't worry. We ALL had to start somewhere, and we ALL needed help to get where we are today. No one is an island and no one is born with all the necessary skills. Period.OK, so you have zero experience and limited skills…my advice in this instance is that you teach yourself some absolute fundamentals.
Let's get this party started.
  •  What is hacking?
Hacking is identifying weakness and vulnerabilities of some system and gaining access with it.
Hacker gets unauthorized access by targeting system while ethical hacker have an official permission in a lawful and legitimate manner to assess the security posture of a target system(s)

 There's some types of hackers, a bit of "terminology".
White hat — ethical hacker.
Black hat — classical hacker, get unauthorized access.
Grey hat — person who gets unauthorized access but reveals the weaknesses to the company.
Script kiddie — person with no technical skills just used pre-made tools.
Hacktivist — person who hacks for some idea and leaves some messages. For example strike against copyright.
  •  Skills required to become ethical hacker.
  1. Curosity anf exploration
  2. Operating System
  3. Fundamentals of Networking
*Note this sites





Related news
  1. Hak5 Tools
  2. Pentest Tools Framework
  3. Pentest Tools Kali Linux
  4. Pentest Tools For Ubuntu
  5. Hack Tools Download
  6. Hacker Tools Apk Download
  7. Hack Tools Github
  8. Hack Tools For Pc
  9. Hacking Tools For Windows Free Download
  10. Pentest Tools Open Source
  11. Hacking Tools Download
  12. Pentest Tools Port Scanner
  13. Hacker Tools Linux
  14. Hacking Tools Name
  15. Hacker Tools 2019
  16. Android Hack Tools Github
  17. Pentest Tools Port Scanner
  18. Hacking Tools Windows 10
  19. Hak5 Tools
  20. Pentest Reporting Tools
  21. Hacker Tools Linux
  22. Hacker Tools Free Download
  23. Hacker Tools Apk Download
  24. Pentest Tools Website
  25. Hacking Apps
  26. Pentest Tools For Windows
  27. Pentest Box Tools Download
  28. Hack Tool Apk No Root
  29. Best Hacking Tools 2020
  30. Hacking Tools Online
  31. Pentest Tools For Android
  32. Hacker Tools 2020
  33. Hacking Apps
  34. Hack Tools For Mac
  35. Hack Tools Download
  36. Pentest Box Tools Download
  37. Hacking Tools Name
  38. Hacker Tools 2019
  39. Pentest Tools Download
  40. Install Pentest Tools Ubuntu
  41. Blackhat Hacker Tools
  42. Hacking Tools Pc
  43. Hacker Tools Software
  44. Hacking Tools For Kali Linux
  45. Hack Tools For Mac
  46. Hacker Tools Hardware
  47. Hacking Tools For Kali Linux
  48. Hacking Tools
  49. Android Hack Tools Github
  50. Hacking Tools For Kali Linux
  51. Pentest Tools Online
  52. Hackrf Tools
  53. Best Hacking Tools 2020
  54. Pentest Tools For Windows
  55. Hacking Tools And Software
  56. Android Hack Tools Github
  57. Hacking Tools For Windows 7
  58. Hacking Tools Hardware
  59. Ethical Hacker Tools
  60. Underground Hacker Sites
  61. Pentest Tools Kali Linux
  62. Hacker Tools For Ios
  63. Hacker Tools Software
  64. Hacker Tools Mac
  65. Hacking Apps
  66. Hack Tools
  67. How To Hack
  68. Hacking Tools Usb
  69. Usb Pentest Tools
  70. How To Make Hacking Tools
  71. Hack Tools 2019
  72. Hack App
  73. Pentest Tools Alternative
  74. Game Hacking
  75. Hack Tool Apk No Root
  76. Hack Tools For Ubuntu
  77. Hacker Search Tools
Posted by at No comments:
Subscribe to: Posts (Atom)