Robert
8 years ago
62 changed files with 1688 additions and 1653 deletions
Split View
Diff Options
-
+0 -0Draft/Draft/Anonymity Opsec Privacy.md
-
+2 -1Draft/Draft/Attacking Defending Android -.md
-
+2 -0Draft/Draft/BIOS UEFI Attacks Defenses.md
-
+0 -0Draft/Draft/Basic Security Informd.md
-
+14 -11Draft/Draft/CTFs & Wargamd.md
-
+40 -33Draft/Draft/Cheat sheets reference pages Checklists -.md
-
+0 -0Draft/Draft/Conference Video Archives Stuff -.md
-
+8 -12Draft/Draft/Counter Surveillance.md
-
+4 -0Draft/Draft/Courses & Training -.md
-
+68 -61Draft/Draft/Cryptography & Encryption.md
-
+20 -14Draft/Draft/Darknets -.md
-
+2 -2Draft/Draft/Data AnalysisVisualization.md
-
+9 -2Draft/Draft/Disinformd.md
-
+11 -10Draft/Draft/Documd.md
-
+35 -40Draft/Draft/Emd.md
-
+22 -16Draft/Draft/Exfiltration.md
-
+115 -96Draft/Draft/Exploit Developmd.md
-
+1 -1Draft/Draft/Exploit Development/Lab for Practicing Exploit Writing.txt
-
+251 -54Draft/Draft/Forensics Incident Response.md
-
+0 -271Draft/Draft/Forensics Incident Response/add cull.txt
-
+5 -1Draft/Draft/Framd.md
-
+0 -0Draft/Draft/Frameworks Methodologies/Metasploit Reference.txt
-
+0 -0Draft/Draft/Frameworks Methodologies/Meterpreter Scripts and Description.txt
-
+0 -0Draft/Draft/Frameworks Methodologies/PTES - Penetration Testing Execution Standard/Discovery & Probing.txt
-
+0 -0Draft/Draft/Frameworks Methodologies/PTES - Penetration Testing Execution Standard/Enumeration.txt
-
+0 -0Draft/Draft/Frameworks Methodologies/PTES - Penetration Testing Execution Standard/Network Footprinting.txt
-
+0 -0Draft/Draft/Frameworks Methodologies/PTES - Penetration Testing Execution Standard/PTES - Penetration Testing Execution Standard.rtf
-
+0 -0Draft/Draft/Frameworks Methodologies/PTES - Penetration Testing Execution Standard/Password Cracking.txt
-
+0 -0Draft/Draft/Frameworks Methodologies/PTES - Penetration Testing Execution Standard/Penetration.txt
-
+0 -0Draft/Draft/Frameworks Methodologies/PTES - Penetration Testing Execution Standard/VoIP Security.txt
-
+0 -0Draft/Draft/Frameworks Methodologies/PTES - Penetration Testing Execution Standard/Vulnerability Assessment.txt
-
+0 -0Draft/Draft/Frameworks Methodologies/PTES - Penetration Testing Execution Standard/Wireless Penetration.txt
-
+0 -0Draft/Draft/Frameworks Methodologies/Post Exploitation with Metasploit.txt
-
+22 -34Draft/Draft/Fuzzing Bug Hunting.md
-
+0 -0Draft/Draft/Homd.md
-
+15 -7Draft/Draft/Honeypots -.md
-
+11 -1Draft/Draft/Interesting Things Useful stuff.md
-
+37 -43Draft/Draft/Malware.md
-
+186 -37Draft/Draft/Network Attacks & Defenses.md
-
+0 -0Draft/Draft/Network Attacks & Defenses/Getting Busy at the Command Line.txt
-
+0 -53Draft/Draft/Network Recon and Enumeration.md
-
+0 -169Draft/Draft/Network Recon and Enumeration/Tools.txt
-
+38 -21Draft/Draft/Network Security Monitoring & Logging.md
-
+27 -27Draft/Draft/Password Bruting and Hashcracking.md
-
+19 -7Draft/Draft/Phishing.md
-
+39 -39Draft/Draft/Privilege Escalation & Post-Exploitation.md
-
+44 -22Draft/Draft/Programmd.md
-
+41 -41Draft/Draft/Reverse Engineering.md
-
+17 -19Draft/Draft/Rootkits.md
-
+1 -1Draft/Draft/Sandboxes.md
-
+21 -33Draft/Draft/Securing Hardening.md
-
+5 -1Draft/Draft/Simd.md
-
+16 -8Draft/Draft/Social Engineering.md
-
+15 -0Draft/Draft/Sysadmd.md
-
+0 -6Draft/Draft/Sysadmin Stuff.md
-
+0 -171Draft/Draft/System Internals Windows and Linux Internals Reference.md
-
+306 -0Draft/Draft/Systemd.md
-
+16 -132Draft/Draft/To Do/add cull -1.txt
-
+0 -15Draft/Draft/Tor.md
-
+3 -0Draft/Draft/Various purpiose based OS's.md
-
+126 -38Draft/Draft/Web & Browsers.md
-
+74 -103Draft/Draft/Wireless Networks & RF.md
Draft/Draft/Anonymity Opsec Privacy -.md → Draft/Draft/Anonymity Opsec Privacy.md
View File
+ 2
- 1
Draft/Draft/Attacking Defending Android -.md
View File
+ 2
- 0
Draft/Draft/BIOS UEFI Attacks Defenses.md
View File
Draft/Draft/Basic Security Information.md → Draft/Draft/Basic Security Informd.md
View File
Draft/Draft/CTFs & Wargames -.md → Draft/Draft/CTFs & Wargamd.md
View File
+ 40
- 33
Draft/Draft/Cheat sheets reference pages Checklists -.md
View File
Draft/Draft/Conference Videos Stuff -.md → Draft/Draft/Conference Video Archives Stuff -.md
View File
+ 8
- 12
Draft/Draft/Counter Surveillance.md
View File
+ 4
- 0
Draft/Draft/Courses & Training -.md
View File
+ 68
- 61
Draft/Draft/Cryptography & Encryption.md
View File
| @ -1,142 +1,149 @@ | |||
| ##Cryptography | |||
| #####TOC | |||
| Learning/Courses | |||
| Books | |||
| Papers | |||
| Software | |||
| Writeups | |||
| * [General Information](#general) | |||
| * [Learning/Courses](#learn | |||
| * [Writeups](#write) | |||
| * [Blogposts/Misc](#blog) | |||
| * [Presentations](#presentation) | |||
| * [Papers](#papers) | |||
| * [Software](#soft) | |||
| * [Stenography](#steno) | |||
| * [Tools](#tools) | |||
| * [Books](#books) | |||
| ###Cull | |||
| ###Cull | |||
| [cr.yp.to blog](http://blog.cr.yp.to/index.html) | |||
| [Crypto: 48 Dirty Little Secrets Cryptographers Don’t Want You To Know - BlackHat2014](https://www.youtube.com/watch?v=mXdFHNJ6srY) | |||
| http://www.tau.ac.il/~tromer/acoustic/ | |||
| Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG's current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts. We experimentally demonstrate that such attacks can be carried out, using either a plain mobile phone placed next to the computer, or a more sensitive microphone placed 4 meters away. | |||
| [XOR Bitwise Operations Explained - Khan Academy](https://www.khanacademy.org/computing/computer-science/cryptography/ciphers/a/xor-bitwise-operation) | |||
| https://crypto.is/blog/ | |||
| [HiVE — Hidden Volume Encryption](http://hive.ccs.neu.edu/#four) | |||
| [Toward Robust Hidden Volumes Using Write-Only Oblivious RAM](https://eprint.iacr.org/2014/344.pdf) | |||
| * With sensitive data being increasingly stored on mobile devices and laptops, hard disk encryption is more important than ever. In partic- ular, being able to plausibly deny that a hard disk contains certain information is a very useful and interesting research goal. However, it has been known for some time that existing “hidden volume” so- lutions, like TrueCrypt, fail in the face of an adversary who is able to observe the contents of a disk on multiple, separate occasions. In this work, we explore more robust constructions for hidden vol- umes and present HIVE, which is resistant to more powerful ad- versaries with multiple-snapshot capabilities. In pursuit of this, we propose the first security definitions for hidden volumes, and prove HIVE secure under these definitions. At the core of HIVE, we de- sign a new write-only Oblivious RAM. We show that, when only hiding writes, it is possible to achieve ORAM with optimal O (1) communication complexity and only poly-logarithmic user mem- ory. This is a significant improvement over existing work and an independently interesting result. We go on to show that our write- only ORAM is specially equipped to provide hidden volume func- tionality with low overhead and significantly increased security. Fi- nally, we implement HIVE as a Linux kernel block device to show both its practicality and usefulness on existing platforms. | |||
| ###<a name="general">General Information</a> | |||
| [HashID](https://github.com/psypanda/hashID) | |||
| * hashID is a tool written in Python 3 which supports the identification of over 220 unique hash types using regular expressions. It is able to identify a single hash, parse a file or read multiple files in a directory and identify the hashes within them. hashID is also capable of including the corresponding hashcat mode and/or JohnTheRipper format in its output. hashID works out of the box with Python 2 = 2.7.x or Python 3 = 3.3 on any platform. | |||
| [Website detailing various crypto laws around world](http://www.cryptolaw.org/) | |||
| [Primer on Zero-Knowledge Proofs](http://blog.cryptographyengineering.com/2014/11/zero-knowledge-proofs-illustrated-primer.html?m=1) | |||
| [Attack of the week: FREAK (or 'factoring the NSA for fun and profit')](http://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html) | |||
| [XOR Bitwise Operations Explained - Khan Academy](https://www.khanacademy.org/computing/computer-science/cryptography/ciphers/a/xor-bitwise-operation) | |||
| [Widespread Weak Keys in Network Devices](https://factorable.net/) | |||
| [quipqiup](http://quipqiup.com/) | |||
| * quipqiup is a fast and automated cryptogram solver by Edwin Olson. It can solve simple substitution ciphers often found in newspapers, including puzzles like cryptoquips (in which word boundaries are preserved) and patristocrats (inwhi chwor dboun darie saren t). | |||
| ###<a name="learn">Courses</a>: | |||
| Coursera Cryptography | |||
| [Matsano Crypto Challenges](Cryptopals.co) | |||
| * Go through a series of increasingly difficult challenges while learning all about cryptography. Expected knowledge level: You passed 9th grade math and you have 0 knowledge of crypto. | |||
| ###<a name="write">Writeups</a> | |||
| [Attack of the week: FREAK (or 'factoring the NSA for fun and profit')](http://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html) | |||
| [An Empirical Study of Cryptographic Misuse in Android Applications](https://www.cs.ucsb.edu/~chris/research/doc/ccs13_cryptolint.pdf) | |||
| [Indistinguishability Obfuscation from the Multilinear Subgroup Elimination Assumption](https://eprint.iacr.org/2014/309) | |||
| * Abstract: We revisit the question of constructing secure general-purpose indistinguishability obfuscation (iO), with a security reduction based on explicit computational assumptions over multi- linear maps. Previous to our work, such reductions were only known to exist based on meta- assumptions and/or ad-hoc assumptions: In the original constructive work of Garg et al. (FOCS 2013), the underlying explicit computational assumption encapsulated an exponential family of assumptions for each pair of circuits to be obfuscated. In the more recent work of Pass et al. (Crypto 2014), the underlying assumption is a meta-assumption that also encapsulates an exponential family of assumptions, and this meta-assumption is invoked in a manner that captures the specific pair of circuits to be obfuscated. The assumptions underlying both these works substantially capture (either explicitly or implicitly) the actual structure of the obfuscation mechanism itself. In our work, we provide the first construction of general-purpose indistinguishability obfuscation proven secure via a reduction to a natural computational assumption over multilinear maps, namely, the Multilinear Subgroup Elimination Assumption. This assumption does not depend on the circuits to be obfuscated (except for its size), and does not correspond to the underlying structure of our obfuscator. The technical heart of our paper is our reduction, which gives a new way to argue about the security of indistinguishability obfuscation. | |||
| ###<a name="blogs">Blogposts/Misc(doesnt explicitly fit in other sections)</a> | |||
| [Encrypting Strings in Android: Let's make better mistakes](http://tozny.com/blog/encrypting-strings-in-android-lets-make-better-mistakes/) | |||
| [Decrypto](http://sourceforge.net/projects/decrypto/) | |||
| * In DeCrypto you will find a collection of scripts for helping decrypt messages.\ | |||
| [Poor Man's Guide to Troubleshooting TLS Failures](http://blogs.technet.com/b/tspring/archive/2015/02/23/poor-man-s-guide-to-troubleshooting-tls-failures.aspx) | |||
| [A Messy State of the Union: Taming the Composite State Machines of TLS](https://www.smacktls.com/smack.pdf) | |||
| * Abstract —Implementations of the Transport Layer Security (TLS) protocol must handle a variety of protocol versions and extensions, authentication modes and key exchange methods, where each combination may prescribe a different message sequence between the client and the server. We address the problem of designing a robust composite state machine that can correctly multiplex between these different protocol modes. We systematically test popular open-source TLS implementations for state machine bugs and discover several critical security vulnerabilities that have lain hidden in these libraries for years (they are now in the process of being patched). We argue that these vulnerabilities stem from incorrect compositions of individually correct state machines. We present the first verified implementation of a composite TLS state machine in C that can be embedded into OpenSSL and accounts for all its supported ciphersuites. Our attacks expose the need for the formal verifica- tion of core components in cryptographic protocol libraries; our implementation demonstrates that such mechanized proofs are within reach, even for mainstream TLS implementations. | |||
| ###<a name="presentation">Presentations/Talks</a> | |||
| [Crypto: 48 Dirty Little Secrets Cryptographers Don’t Want You To Know - BlackHat2014](https://www.youtube.com/watch?v=mXdFHNJ6srY) | |||
| [RELIC](https://github.com/relic-toolkit/relic) | |||
| * RELIC is a modern cryptographic meta-toolkit with emphasis on efficiency and flexibility. RELIC can be used to build efficient and usable cryptographic toolkits tailored for specific security levels and algorithmic choices. | |||
| [Website detailing various crypto laws around world](http://www.cryptolaw.org/) | |||
| ###<a name="papers">Papers</a> | |||
| [Get Your Hands Off My Laptop: Physical Side-Channel Key-Extraction Attacks On PCs](http://www.tau.ac.il/~tromer/handsoff/) | |||
| * We demonstrated physical side-channel attacks on a popular software implementation of RSA and ElGamal, running on laptop computers. Our attacks use novel side channels and are based on the observation that the "ground" electric potential in many computers fluctuates in a computation-dependent way. An attacker can measure this signal by touching exposed metal on the computer's chassis with a plain wire, or even with a bare hand. The signal can also be measured at the remote end of Ethernet, VGA or USB cables. Through suitable cryptanalysis and signal processing, we have extracted 4096-bit RSA keys and 3072-bit ElGamal keys from laptops, via each of these channels, as well as via power analysis and electromagnetic probing. Despite the GHz-scale clock rate of the laptops and numerous noise sources, the full attacks require a few seconds of measurements using Medium Frequency signals (around 2 MHz), or one hour using Low Frequency signals (up to 40 kHz). | |||
| [Poor Man's Guide to Troubleshooting TLS Failures](http://blogs.technet.com/b/tspring/archive/2015/02/23/poor-man-s-guide-to-troubleshooting-tls-failures.aspx) | |||
| [Website detailing various crypto laws around world](http://www.cryptolaw.org/) | |||
| [Encrypting Strings in Android: Let's make better mistakes](http://tozny.com/blog/encrypting-strings-in-android-lets-make-better-mistakes/) | |||
| [cr.yp.to blog](http://blog.cr.yp.to/index.html) | |||
| [java-aes-crypto (Android class)](https://github.com/tozny/java-aes-crypto) | |||
| * A simple Android class for encrypting & decrypting strings, aiming to avoid the classic mistakes that most such classes suffer from. | |||
| [Why does cryptographic software fail? A case study and open problems](http://pdos.csail.mit.edu/papers/cryptobugs:apsys14.pdf) | |||
| * Abstract: Mistakes in cryptographic software implementations often undermine the strong security guarantees offered by cryptography. This paper presents a systematic study of cryptographic vulnerabilities in practice, an examination of state-of-the-art techniques to prevent such vulnerabilities, and a discussion of open problems and possible future research directions. Our study covers 269 cryptographic vulnerabilities reported in the CVE database from January 2011 to May 2014. The results show that just 17% of the bugs are in cryptographic libraries (which often have devastating consequences), and the remaining 83% are misuses of cryptographic libraries by individual applications. We observe that preventing bugs in different parts of a system requires different techniques, and that no effective techniques exist to deal with certain classes of mistakes, such as weak key generation. | |||
| [RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis](http://www.tau.ac.il/~tromer/acoustic/) | |||
| * Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG's current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts. We experimentally demonstrate that such attacks can be carried out, using either a plain mobile phone placed next to the computer, or a more sensitive microphone placed 4 meters away. | |||
| [Toward Robust Hidden Volumes Using Write-Only Oblivious RAM](https://eprint.iacr.org/2014/344.pdf) | |||
| * With sensitive data being increasingly stored on mobile devices and laptops, hard disk encryption is more important than ever. In partic- ular, being able to plausibly deny that a hard disk contains certain information is a very useful and interesting research goal. However, it has been known for some time that existing “hidden volume” so- lutions, like TrueCrypt, fail in the face of an adversary who is able to observe the contents of a disk on multiple, separate occasions. In this work, we explore more robust constructions for hidden vol- umes and present HIVE, which is resistant to more powerful ad- versaries with multiple-snapshot capabilities. In pursuit of this, we propose the first security definitions for hidden volumes, and prove HIVE secure under these definitions. At the core of HIVE, we de- sign a new write-only Oblivious RAM. We show that, when only hiding writes, it is possible to achieve ORAM with optimal O (1) communication complexity and only poly-logarithmic user mem- ory. This is a significant improvement over existing work and an independently interesting result. We go on to show that our write- only ORAM is specially equipped to provide hidden volume func- tionality with low overhead and significantly increased security. Fi- nally, we implement HIVE as a Linux kernel block device to show both its practicality and usefulness on existing platforms. | |||
| [keyCzar](http://www.keyczar.org/) | |||
| * Keyczar is an open source cryptographic toolkit designed to make it easier and safer for developers to use cryptography in their applications. Keyczar supports authentication and encryption with both symmetric and asymmetric keys. | |||
| [A Messy State of the Union: Taming the Composite State Machines of TLS](https://www.smacktls.com/smack.pdf) | |||
| * Abstract —Implementations of the Transport Layer Security (TLS) protocol must handle a variety of protocol versions and extensions, authentication modes and key exchange methods, where each combination may prescribe a different message sequence between the client and the server. We address the problem of designing a robust composite state machine that can correctly multiplex between these different protocol modes. We systematically test popular open-source TLS implementations for state machine bugs and discover several critical security vulnerabilities that have lain hidden in these libraries for years (they are now in the process of being patched). We argue that these vulnerabilities stem from incorrect compositions of individually correct state machines. We present the first verified implementation of a composite TLS state machine in C that can be embedded into OpenSSL and accounts for all its supported ciphersuites. Our attacks expose the need for the formal verifica- tion of core components in cryptographic protocol libraries; our implementation demonstrates that such mechanized proofs are within reach, even for mainstream TLS implementations. | |||
| [RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis](http://www.tau.ac.il/~tromer/acoustic/) | |||
| * Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG's current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts. We experimentally demonstrate that such attacks can be carried out, using either a plain mobile phone placed next to the computer, or a more sensitive microphone placed 4 meters away. | |||
| [Indistinguishability Obfuscation from the Multilinear Subgroup Elimination Assumption](https://eprint.iacr.org/2014/309) | |||
| * Abstract: We revisit the question of constructing secure general-purpose indistinguishability obfuscation (iO), with a security reduction based on explicit computational assumptions over multi- linear maps. Previous to our work, such reductions were only known to exist based on meta- assumptions and/or ad-hoc assumptions: In the original constructive work of Garg et al. (FOCS 2013), the underlying explicit computational assumption encapsulated an exponential family of assumptions for each pair of circuits to be obfuscated. In the more recent work of Pass et al. (Crypto 2014), the underlying assumption is a meta-assumption that also encapsulates an exponential family of assumptions, and this meta-assumption is invoked in a manner that captures the specific pair of circuits to be obfuscated. The assumptions underlying both these works substantially capture (either explicitly or implicitly) the actual structure of the obfuscation mechanism itself. In our work, we provide the first construction of general-purpose indistinguishability obfuscation proven secure via a reduction to a natural computational assumption over multilinear maps, namely, the Multilinear Subgroup Elimination Assumption. This assumption does not depend on the circuits to be obfuscated (except for its size), and does not correspond to the underlying structure of our obfuscator. The technical heart of our paper is our reduction, which gives a new way to argue about the security of indistinguishability obfuscation. | |||
| [Primer on Zero-Knowledge Proofs](http://blog.cryptographyengineering.com/2014/11/zero-knowledge-proofs-illustrated-primer.html?m=1) | |||
| ###<a name="software">Software</a> | |||
| [Widespread Weak Keys in Network Devices](https://factorable.net/) | |||
| ###<a name="steno">Stenography</a> | |||
| http://www.tau.ac.il/~tromer/acoustic/ | |||
| Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG's current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts. We experimentally demonstrate that such attacks can be carried out, using either a plain mobile phone placed next to the computer, or a more sensitive microphone placed 4 meters away. | |||
| [imagejs](https://github.com/jklmnn/imagejs) | |||
| * imagejs is a small tool to hide javascript inside a valid image file. The image file is recognized as one by content checking software, e.g. the file command you might now from Linux or other Unix based operation systems. | |||
| [Real-time Steganography with RTP](http://uninformed.org/?v=all&a=36&t=sumry) | |||
| * Real-time Transfer Protocol (RTP) is used by nearly all Voice-over-IP systems to provide the audio channel for calls. As such, it provides ample opportunity for the creation of a covert communication channel due to its very nature. While use of steganographic techniques with various audio cover-medium has been extensively researched, most applications of such have been limited to audio cover-medium of a static nature such as WAV or MP3 file audio data. This paper details a common technique for the use of steganography with audio data cover-medium, outlines the problem issues that arise when attempting to use such techniques to establish a full-duplex communications channel within audio data transmitted via an unreliable streaming protocol, and documents solutions to these problems. An implementation of the ideas discussed entitled SteganRTP is included in the reference materials. | |||
| [Why does cryptographic software fail? A case study and open problems](http://pdos.csail.mit.edu/papers/cryptobugs:apsys14.pdf) | |||
| * Abstract: Mistakes in cryptographic software implementations often undermine the strong security guarantees offered by cryptography. This paper presents a systematic study of cryptographic vulnerabilities in practice, an examination of state-of-the-art techniques to prevent such vulnerabilities, and a discussion of open problems and possible future research directions. Our study covers 269 cryptographic vulnerabilities reported in the CVE database from January 2011 to May 2014. The results show that just 17% of the bugs are in cryptographic libraries (which often have devastating consequences), and the remaining 83% are misuses of cryptographic libraries by individual applications. We observe that preventing bugs in different parts of a system requires different techniques, and that no effective techniques exist to deal with certain classes of mistakes, such as weak key generation. | |||
| https://crypto.is/blog/ | |||
| ###<a name="tools">Tools</a> | |||
| [Matsano Crypto Challenges](Cryptopals.co) | |||
| [Cryptographic Implementations Analysis Toolkit (CIAT)](http://ciat.sourceforge.net/) | |||
| * The Cryptographic Implementations Analysis Toolkit (CIAT) is compendium of command line and graphical tools whose aim is to help in the detection and analysis of encrypted byte sequences within files (executable and non-executable). | |||
| [Simple crypto tools](http://rumkin.com/tools/) | |||
| [keyCzar](http://www.keyczar.org/) | |||
| * Keyczar is an open source cryptographic toolkit designed to make it easier and safer for developers to use cryptography in their applications. Keyczar supports authentication and encryption with both symmetric and asymmetric keys. | |||
| [Decrypto](http://sourceforge.net/projects/decrypto/) | |||
| * In DeCrypto you will find a collection of scripts for helping decrypt messages.\ | |||
| [Cryptographic Implementations Analysis Toolkit (CIAT)](http://ciat.sourceforge.net/) | |||
| * The Cryptographic Implementations Analysis Toolkit (CIAT) is compendium of command line and graphical tools whose aim is to help in the detection and analysis of encrypted byte sequences within files (executable and non-executable). | |||
| [RELIC](https://github.com/relic-toolkit/relic) | |||
| * RELIC is a modern cryptographic meta-toolkit with emphasis on efficiency and flexibility. RELIC can be used to build efficient and usable cryptographic toolkits tailored for specific security levels and algorithmic choices. | |||
| [quipqiup](http://quipqiup.com/) | |||
| * quipqiup is a fast and automated cryptogram solver by Edwin Olson. It can solve simple substitution ciphers often found in newspapers, including puzzles like cryptoquips (in which word boundaries are preserved) and patristocrats (in which word boundaries aren't). | |||
| [HashID](https://github.com/psypanda/hashID) | |||
| * hashID is a tool written in Python 3 which supports the identification of over 220 unique hash types using regular expressions. It is able to identify a single hash, parse a file or read multiple files in a directory and identify the hashes within them. hashID is also capable of including the corresponding hashcat mode and/or JohnTheRipper format in its output. hashID works out of the box with Python 2 = 2.7.x or Python 3 = 3.3 on any platform. | |||
| [An Empirical Study of Cryptographic Misuse in Android Applications](https://www.cs.ucsb.edu/~chris/research/doc/ccs13_cryptolint.pdf) | |||
| [HiVE — Hidden Volume Encryption](http://hive.ccs.neu.edu/#four) | |||
| ###Books: | |||
| ###<a name="">Books</a>: | |||
| Cryptography Engineering | |||
| Applied Cryptography | |||
| ###Courses: | |||
| Coursera Cryptography | |||
| Matsano Crypto Challenges | |||
| Go through a series of increasingly difficult challenges while learning all about cryptography. | |||
| Expected knowledge level: You passed 9th grade math and you have 0 knowledge of crypto. | |||
| http://cryptopals.com/ | |||
| ###Stenograhpy | |||
| [imagejs](https://github.com/jklmnn/imagejs) | |||
| * imagejs is a small tool to hide javascript inside a valid image file. The image file is recognized as one by content checking software, e.g. the file command you might now from Linux or other Unix based operation systems. | |||
+ 20
- 14
Draft/Draft/Darknets -.md
View File
+ 2
- 2
Draft/Draft/Data AnalysisVisualization.md
View File
Draft/Draft/Disinformation -.md → Draft/Draft/Disinformd.md
View File
Draft/Draft/Documentation & Reports -.md → Draft/Draft/Documd.md
View File
Draft/Draft/Embedded Device & Hardware Hacking -.md → Draft/Draft/Emd.md
View File
+ 22
- 16
Draft/Draft/Exfiltration.md
View File
| @ -1,45 +1,51 @@ | |||
| ###Exfiltration | |||
| #####TOC | |||
| * [General](#general) | |||
| * [Methodologies](#methods) | |||
| * [Tools](#tools) | |||
| * [Papers](#papers) | |||
| Cull | |||
| Stunnel | |||
| iodine | |||
| http://windowsir.blogspot.com/2013/07/howto-data-exfiltration.html | |||
| [PyExfil](https://ytisf.github.io/PyExfil/) | |||
| * Exfiltration tools inspired by Regin. Alpha Status. | |||
| [Exfil - Modular tool to test exfiltration techniques](https://github.com/averagesecurityguy/exfil) | |||
| * Exfil is a tool designed to exfiltrate data using various techniques, which allows a security team to test whether its monitoring system can effectively catch the exfiltration. The idea for Exfil came from a Twitter conversation between @averagesecguy, @ChrisJohnRiley, and @Ben0xA and was sparked by the TrustWave POS malware whitepaper available at https://gsr.trustwave.com/topics/placeholder-topic/point-of-sale-malware/. | |||
| ###<a name="general">General</a> | |||
| [fraud-bridge](https://github.com/stealth/fraud-bridge) | |||
| * fraud-bridge allows to tunnel TCP connections through ICMP, ICMPv6, DNS | |||
| via UDP or DNS via UDP6. Project, not stable | |||
| ###<a name="methods">Methodologies</a> | |||
| [Multitun](https://github.com/covertcodes/multitun) | |||
| * Efficiently and securely tunnel everything over a harmless looking WebSocket! | |||
| Gmail/other email services Draft emails | |||
| Draft emails | |||
| Stunnel | |||
| ###<a name="tools">Tools</a> | |||
| [fraud-bridge](https://github.com/stealth/fraud-bridge) | |||
| * fraud-bridge allows to tunnel TCP connections through ICMP, ICMPv6, DNS via UDP or DNS via UDP6. Project, not stable | |||
| [PyExfil](https://ytisf.github.io/PyExfil/) | |||
| * Exfiltration tools inspired by Regin. Alpha Status. | |||
| [Exfil - Modular tool to test exfiltration techniques](https://github.com/averagesecurityguy/exfil) | |||
| * Exfil is a tool designed to exfiltrate data using various techniques, which allows a security team to test whether its monitoring system can effectively catch the exfiltration. The idea for Exfil came from a Twitter conversation between @averagesecguy, @ChrisJohnRiley, and @Ben0xA and was sparked by the TrustWave POS malware whitepaper available at https://gsr.trustwave.com/topics/placeholder-topic/point-of-sale-malware/. | |||
| [Multitun](https://github.com/covertcodes/multitun) | |||
| * Efficiently and securely tunnel everything over a harmless looking WebSocket! | |||
| ###Papers | |||
| [Self-Exfiltration: The Dangers of Browser-Enforced Information Flow Control](http://ericchen.me/self_exfiltration.pdf) | |||
| * Abstract —Since the early days of Netscape, browser vendors and web security researchers have restricted out-going data based on its destination. The security argument accompanying these mechanisms is that they prevent sensitive user data from being sent to the attacker’s domain. However, in this paper, we show that regulating web information flow based on its destination server is an inherently flawed security practice. It is vulnerable to self-exfiltration attacks, where an adversary stashes stolen information in the database of a whitelisted site, then later independently connects to the whitelisted site to retrieve the information. We describe eight existing browser security mechanisms that are vulnerable to these “self-exfiltration” attacks. Furthermore, we discovered at least one exfiltration channel for each of the Alexa top 100 websites. None of the existing information flow control mechanisms we surveyed are sufficient to protect data from being leaked to the attacker. Our goal is to prevent browser vendors and researchers from falling into this trap by designing more systems that are vulnerable to self-exfiltration. | |||
Draft/Draft/Exploit Development.md → Draft/Draft/Exploit Developmd.md
View File
+ 1
- 1
Draft/Draft/Exploit Development/Lab for Practicing Exploit Writing.txt
View File
+ 251
- 54
Draft/Draft/Forensics Incident Response.md
View File
+ 0
- 271
Draft/Draft/Forensics Incident Response/add cull.txt
View File
| @ -1,271 +0,0 @@ | |||
| [File Signature Table](http://www.garykessler.net/library/file_sigs.html) | |||
| [Firefox private browsing forensics](http://www.magnetforensics.com/forensic-implications-of-a-person-using-firefoxs-private-browsing/) | |||
| [Spotting the Adversary with Windows Event Log Monitoring - NSA](http://cryptome.org/2014/01/nsa-windows-event.pdf) | |||
| * NSA 70-page writeup on windows event log monitoring | |||
| [Forensics on Amazon’s EC2](https://sysforensics.org/2014/10/forensics-in-the-amazon-cloud-ec2.html) | |||
| [Analysis of a Romanian Botnet](http://www.politoinc.com/2015/04/analysis-of-a-romanian-botnet/) | |||
| * Going from first sighting in logs to tracing attackers to their C2 IRC room | |||
| [How to Pull passwords from a memory dump](https://cyberarms.wordpress.com/2011/11/04/memory-forensics-how-to-pull-passwords-from-a-memory-dump/) | |||
| [Investigating PowerShell Attacks - Ryan Kazanciyan and Matt Hastings - DEFCON22](https://www.youtube.com/watch?v=qF06PFcezLs) | |||
| * This presentation will focus on common attack patterns performed through PowerShell - such as lateral movement, remote command execution, reconnaissance, file transfer, etc. - and the sources of evidence they leave behind. We'll demonstrate how to collect and interpret these forensic artifacts, both on individual hosts and at scale across the enterprise. Throughout the presentation, we'll include examples from real-world incidents and recommendations on how to limit exposure to these attacks. | |||
| [Extensible Metadata Platform](https://en.wikipedia.org/wiki/Extensible_Metadata_Platform) | |||
| * The Extensible Metadata Platform (XMP) is an ISO standard, originally created by Adobe Systems Inc., for the creation, processing and interchange of standardized and custom metadata for digital documents and data sets. | |||
| [Firmware Forensics: Diffs, Timelines, ELFs and Backdoors](http://w00tsec.blogspot.com/2015/02/firmware-forensics-diffs-timelines-elfs.html) | |||
| [Real-time Steganography with RTP](http://uninformed.org/?v=all&a=36&t=sumry) | |||
| * Real-time Transfer Protocol (RTP) is used by nearly all Voice-over-IP systems to provide the audio channel for calls. As such, it provides ample opportunity for the creation of a covert communication channel due to its very nature. While use of steganographic techniques with various audio cover-medium has been extensively researched, most applications of such have been limited to audio cover-medium of a static nature such as WAV or MP3 file audio data. This paper details a common technique for the use of steganography with audio data cover-medium, outlines the problem issues that arise when attempting to use such techniques to establish a full-duplex communications channel within audio data transmitted via an unreliable streaming protocol, and documents solutions to these problems. An implementation of the ideas discussed entitled SteganRTP is included in the reference materials. | |||
| [Bootkit Disk Forensics | |||
| [Part 1](http://www.malwaretech.com/2015/02/bootkit-disk-forensics-part-1.html) | |||
| [Part 2](http://www.malwaretech.com/2015/03/bootkit-disk-forensics-part-2.html) | |||
| [Kansa -A Powershell incident response framework ](https://github.com/davehull/Kansa) | |||
| * A modular incident response framework in Powershell. Note there's a bug that's currently cropping up in PowerShell version 2 systems, but version 3 and later should be fine | |||
| [Windows Memory Analysis Checklist](http://www.dumpanalysis.org/windows-memory-analysis-checklist) | |||
| [MozillaRecovery](https://github.com/gtfy/MozillaRecovery) | |||
| * Recovers the master password of key3.db files, i.e. Thunderbird, Firefox | |||
| [Exfil Framework](https://github.com/reservoirlabs/bro-scripts/tree/master/exfil-detection-framework) | |||
| * The Exfil Framework is a suite of Bro scripts that detect file uploads in TCP connections. The Exfil Framework can detect file uploads in most TCP sessions including sessions that have encrypted payloads (SCP,SFTP,HTTPS). | |||
| [Event Tracing for Windows and Network Monitor](http://blogs.technet.com/b/netmon/archive/2009/05/13/event-tracing-for-windows-and-network-monitor.aspx) | |||
| * "Event Tracing for Windows, (ETW), has been around for quite a while now as it was introduced in Windows 2000. It's basically instrumented logging that describes what a component is doing. Conceptually, it’s something like the proverbial printf("here1") concept used by programmers, but it is present in retail builds. When you enable logging in a component the result is an ETL (Event Trace Log) file. What’s new is that that Network Monitor can read any ETL file. And with the supplied parsers many network oriented ETW providers can be decoded." | |||
| [File Signature Table](http://www.garykessler.net/library/file_sigs.html) | |||
| * This table of file signatures (aka "magic numbers") is a continuing work-in-progress. I have found little information on this in a single place, with the exception of the table in Forensic Computing: A Practitioner's Guide by T. Sammes & B. Jenkinson (Springer, 2000); that was my inspiration to start this list in 2002. See also Wikipedia's List of file signatures. Comments, additions, and queries can be sent to Gary Kessler at gck@garykessler.net. | |||
| [Did it Execute? - Mandiant](https://www.mandiant.com/blog/execute/) | |||
| * You found a malicious executable! Now you’ve got a crucial question to answer: did the file execute? We’ll discuss a few sources of evidence you can use to answer this question. In this post, we will focus on static or “dead drive” forensics on Windows systems. We will cover four main sources of evidence: Windows Prefetch, Registry, Log Files, and File Information. | |||
| [Handler Diaries - Another Hunting Post(DFIR)](http://blog.handlerdiaries.com/?p=775) | |||
| * Good post on not only knowing the layout, but knowing expected behaviours. | |||
| [DPAPIck](http://dpapick.com/) | |||
| * This is a forensic tool to deal, in an offline way, with Microsoft Windows® protected data, using the DPAPI (Data Protection API). | |||
| [Ways to Identify Malware on a System Ryan Irving](http://www.irongeek.com/i.php?page=videos/bsidestampa2015/201-ways-to-identify-malware-on-a-system-ryan-irving) | |||
| [HowTo: Determine Program Execution](http://windowsir.blogspot.com/2013/07/howto-determine-program-execution.html) | |||
| [Less is More, Exploring Code/Process-less Techniques and Other Weird Machine Methods to Hide Code (and How to Detect Them)](https://cansecwest.com/slides/2014/less%20is%20more3.pptx) | |||
| [PEview](http://wjradburn.com/software/) | |||
| * PEview provides a quick and easy way to view the structure and content of 32-bit Portable Executable (PE) and Component Object File Format (COFF) files. This PE/COFF file viewer displays header, section, directory, import table, export table, and resource information within EXE, DLL, OBJ, LIB, DBG, and other file types. | |||
| [BTA - AD Security Audit Framework](https://bitbucket.org/iwseclabs/bta) | |||
| BTA is an open-source Active Directory security audit framework. Its goal is to help auditors harvest the information they need to answer such questions as: | |||
| Who has rights over a given object (computer, user account, etc.) ? | |||
| Who can read a given mailbox ? | |||
| Which are the accounts with domain admin rights ? | |||
| Who has extended rights (userForceChangePassword, SendAs, etc.) ? | |||
| What are the changes done on an AD between two points in time ? | |||
| The framework is made of | |||
| an importer able to translate a ntds.dit file, containing all the AD data, into a database | |||
| tools to query the database | |||
| AD miner framework | |||
| AD diff utility | |||
| small utilities (list of databases, etc.) | |||
| The comprehensive set of attributes are imported and can be querried including all schema extensions (Exchange, Sharepoint, etc.). | |||
| ####Hacking Exposed - Automating DFIR Series | |||
| [Automating DFIR - How to series on programming libtsk with python Part 1 - ](http://hackingexposedcomputerforensicsblog.blogspot.com/2015/02/automating-dfir-how-to-series-on.html) | |||
| [Automating DFIR - How to series on programming libtsk with python Part 2](http://hackingexposedcomputerforensicsblog.blogspot.com/2015/02/automating-dfir-how-to-series-on_19.html) | |||
| [Automating DFIR - How to series on programming libtsk with python Part 3](http://hackingexposedcomputerforensicsblog.blogspot.com/2015/02/automating-dfir-how-to-series-on_21.html) | |||
| [Know your Windows Processes or Die Trying](https://sysforensics.org/2014/01/know-your-windows-processes.html) | |||
| * Excellent quick reference on Windows proccesses with a focus on Win7. Good resource. | |||
| [IOC Bucket](https://www.iocbucket.com/) | |||
| * IOC sharing platform | |||
| [Rapier](https://code.google.com/p/rapier/) | |||
| * RAPIER is a security tool built to facilitate first response procedures for incident handling. It is designed to acquire commonly requested information and samples during an information security event, incident, or investigation. RAPIER automates the entire process of data collection and delivers the results directly to the hands of a skilled security analyst | |||
| [ENISA CERT Exercises and Training](http://www.enisa.europa.eu/activities/cert/support/exercise) | |||
| * ENISA CERT Exercises and training material was introduced in 2008, in 2012 and 2013 it was complemented with new exercise scenarios containing essential material for success in the CERT community and in the field of information security. In this page you will find the ENISA CERT Exercise material, containing Handbook for teachers, Toolset for students and Virtual Image to support hands on training sessions. | |||
| [WinPrefetchView v1.25](http://www.nirsoft.net/utils/win_prefetch_view.html) | |||
| * Each time that you run an application in your system, a Prefetch file which contains information about the files loaded by the application is created by Windows operating system. The information in the Prefetch file is used for optimizing the loading time of the application in the next time that you run it. | |||
| WinPrefetchView is a small utility that reads the Prefetch files stored in your system and display the information stored in them. By looking in these files, you can learn which files every application is using, and which files are loaded on Windows boot. | |||
| [PostgreSQL Pass The Hash protocol design weakness](https://hashcat.net/misc/postgres-pth/postgres-pth.pdf) | |||
| [License to Kill: Malware Hunting with the Sysinternals Tools](http://channel9.msdn.com/Events/TechEd/NorthAmerica/2013/ATC-B308) | |||
| [triage-ir](https://code.google.com/p/triage-ir/) | |||
| * Triage: Incident Response automatically collect information from a system that needs basic triage functions performed upon it. The script allows for easy modification for customization to your needs, in an easy to comprehend and implement language. This tool uses a lot others to get its information. Eventually I hope to eliminate the need for them, but use them as verification. This tool requires you to download the Sysinternals Suite if you want full functionality to it. | |||
| [Computer Security Incident Handling Guide - NIST](http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf) | |||
| [An Incident Handling Process for Small and Medium Businesses - SANS 2007](https://www.sans.org/reading-room/whitepapers/incident/incident-handling-process-small-medium-businesses-1791) | |||
| [Instruments - OS X system analysis](https://developer.apple.com/library/mac/documentation/DeveloperTools/Conceptual/InstrumentsUserGuide/Introduction/Introduction.html) | |||
| * Instruments is a performance-analysis and testing tool for dynamically tracing and profiling OS X and iOS code. It is a flexible and powerful tool that lets you track a process, collect data, and examine the collected data. In this way, Instruments helps you understand the behavior of both user apps and the operating system. | |||
| [Windows Program Automatic Startup Locations](http://www.bleepingcomputer.com/tutorials/windows-program-automatic-startup-locations/) | |||
| [Passive DNS](https://github.com/gamelinux/passivedns) | |||
| * A tool to collect DNS records passively to aid Incident handling, Network | |||
| Security Monitoring (NSM) and general digital forensics. | |||
| * PassiveDNS sniffs traffic from an interface or reads a pcap-file and outputs | |||
| the DNS-server answers to a log file. PassiveDNS can cache/aggregate duplicate | |||
| DNS answers in-memory, limiting the amount of data in the logfile without | |||
| losing the essense in the DNS answer. | |||
| [MozillaRecovery](https://github.com/gtfy/MozillaRecovery) | |||
| * Recovers the master password of key3.db files, i.e. Thunderbird, Firefox | |||
| [Windows Attribute changer](http://www.petges.lu/home/) | |||
| [NVbit : Accessing Bitlocker volumes from linux](http://www.nvlabs.in/index.php?/archives/1-NVbit-Accessing-Bitlocker-volumes-from-linux.html) | |||
| [PDF Forensics](http://countuponsecurity.com/2014/09/22/malicious-documents-pdf-analysis-in-5-steps/) | |||
| [Malware Management Framework - Sniper Forensics Toolkit](http://sniperforensicstoolkit.squarespace.com/malwaremanagementframework/) | |||
| [Dshell](https://github.com/USArmyResearchLab/Dshell) | |||
| * An extensible network forensic analysis framework. Enables rapid development of plugins to support the dissection of network packet captures. | |||
| [Mem forenics cheat sheet](http://forensicmethods.com/wp-content/uploads/2012/04/Memory-Forensics-Cheat-Sheet-v1.pdf) | |||
| [Captipper](http://www.omriher.com/2015/01/captipper-malicious-http-traffic.html) | |||
| * CapTipper is a python tool to analyze, explore and revive HTTP malicious traffic. | |||
| CapTipper sets up a web server that acts exactly as the server in the PCAP file, | |||
| and contains internal tools, with a powerful interactive console, for analysis and inspection of the hosts, objects and conversations found. | |||
| [Xmount](https://www.pinguin.lu/xmount) | |||
| * What is xmount? xmount allows you to convert on-the-fly between multiple input and output harddisk image types. xmount creates a virtual file system using FUSE (Filesystem in Userspace) that contains a virtual representation of the input image. The virtual representation can be in raw DD, DMG, VHD, VirtualBox's virtual disk file format or in VmWare's VMDK file format. Input images can be raw DD, EWF (Expert Witness Compression Format) or AFF (Advanced Forensic Format) files. In addition, xmount also supports virtual write access to the output files that is redirected to a cache file. This makes it possible to boot acquired harddisk images using QEMU, KVM, VirtualBox, VmWare or alike. | |||
| [Sniper Forensics](https://digital-forensics.sans.org/summit-archives/2010/2-newell-spiderlabs-sniper-forensics.pdf) | |||
| * Pg10 and onward | |||
| https://sniperforensicstoolkit.squarespace.com/storage/logging/Windows%20Logging%20Cheat%20Sheet%20v1.1.pdf | |||
| [Detekt](https://github.com/botherder/detekt) | |||
| * Detekt is a Python tool that relies on Yara, Volatility and Winpmem to scan the memory of a running Windows system (currently supporting Windows XP to Windows 8 both 32 and 64 bit and Windows 8.1 32bit). | |||
| Detekt tries to detect the presence of pre-defined patterns that have been identified through the course of our research to be unique identifiers that indicate the presence of a given malware running on the computer. Currently it is provided with patterns for: | |||
| DarkComet RAT | |||
| XtremeRAT | |||
| BlackShades RAT | |||
| njRAT | |||
| FinFisher FinSpy | |||
| HackingTeam RCS | |||
| ShadowTech RAT | |||
| Gh0st RAT | |||
| [NTDSXtract - Active Directory Forensics Framework](http://www.ntdsxtract.com/) | |||
| * Description from the page: This framework was developed by the author in order to provide the community | |||
| with a solution to extract forensically important information from the main | |||
| database of Microsoft Active Directory (NTDS.DIT). | |||
| [SSDeep](http://ssdeep.sourceforge.net/) | |||
| * ssdeep is a program for computing context triggered piecewise hashes (CTPH). Also called fuzzy hashes, CTPH can match inputs that have homologies. Such inputs have sequences of identical bytes in the same order, although bytes in between these sequences may be different in both content and length. | |||
| [binwally](https://github.com/bmaia/binwally) | |||
| * Binary and Directory tree comparison tool using the Fuzzy Hashing concept (ssdeep) | |||
| [Unmasking Careto through Memory Analysis - Andrew Case](http://2014.video.sector.ca/video/110388398) | |||
| http://blog.didierstevens.com/programs/pdf-tools/ | |||
| http://windowsir.blogspot.com/2013/07/howto-data-exfiltration.html | |||
| https://sysforensics.org/2014/01/know-your-windows-processes.html | |||
| [Attrition Forensics](http://2014.video.sector.ca/video/110334184) | |||
| https://santoku-linux.com/howtos | |||
| http://blog.didierstevens.com/programs/pdf-tools/ | |||
| http://windowsir.blogspot.com/2013/11/sniper-forensics-memory-analysis-and.html | |||
| http://blog.spiderlabs.com/2011/11/sniper-forensics-context-context-context.html | |||
| http://blog.spiderlabs.com/2011/03/sniper-forensics-part-4.html | |||
| https://digital-forensics.sans.org/summit-archives/2010/2-newell-spiderlabs-sniper-forensics.pdf | |||
| http://blog.spiderlabs.com/2011/07/sniper-forensics-part-v-finding-evil-part-ii.html http://blog.spiderlabs.com/2011/01/sniper-forensics-part-two-target-acquisition-in-part-one-of-the-sniper-forensics-post-we-discussed-the-history-of-forensic.html | |||
| Forensics wiki | |||
| Add Enterprise Forensics section? | |||
| Yelp/Github - OSX Collector - Mass style forensics/management | |||