/Security-Tool-Chest

A list of useful security and obvescation tools useful for red and blue teaming activities. A list made possible by the provided references.

MIT LicenseMIT

Security Tool Chest

Anticipating and mitigating security threats is critical during software development. This paper is going to detail and investigate security vulnerabilities and mitigation strategies to help software developers build secure applications and prevent operating system leaks. This paper examines common vulnerabilities, and provides relevant mitigation strategies, from several relevant perspectives. This paper hopes to encompasses the cyber Kill chain as part of the five stage compramision stages, displaying relevant tools, books and strategies at each stage.

Contents

Reconnaissance

Active Intelligence Gathering

Under this method, the targeted organization may become aware of the ongoing reconnaissance process since the pentester is actively engaging with the target. During this phase, he takes an active part in mapping network infrastructure, then he enumerates and/or scans the open services for vulnerabilities, and eventually searches for unpublished directories, files and servers. Other similar activities include OS Fingerprinting, Banner grabbing, and Web server application scan.

Passive Intelligence Gathering

This option is under discussion provided that there is an explicit demand for the gathering activities not to be detected by the target. In this regard, the pentester cannot use tools that send traffic to the targeted company neither from his host nor an “anonymous” one across the Internet. Not only will that be technically burdening but also the person who performs the pentest will have to substantiate his findings with whatever he can dig out from archived or stored information, which is at times not up to date and incorrect because it has been limited to inquiries collected from third parties.

  • Spyse Sybersecurity search engine that collects organization assets, web, technical & network data for cyber reconnaissance. https://spyse.com/
  • linkScrape A LinkedIn user/company enumeration tool. https://github.com/NickSanzotta/linkScrape
  • FOCA (Fingerprinting Organizations with Collected Archives) is a tool used mainly to find metadata and hidden information in the documents its scans. https://github.com/ElevenPaths/FOCA
  • theHarvester is a tool for gathering subdomain names, e-mail addresses, virtual hosts, open ports/ banners, and employee names from different public sources. https://github.com/laramies/theHarvester
  • Metagoofil is a tool for extracting metadata of public documents (pdf,doc,xls,ppt,etc) availables in the target websites. https://github.com/laramies/metagoofil
  • Social Mapper OSINT Social Media Mapping Tool, takes a list of names & images (or LinkedIn company name) and performs automated target searching on a huge scale across multiple social media sites. Not restricted by APIs as it instruments a browser using Selenium. Outputs reports to aid in correlating targets across sites. https://github.com/SpiderLabs/social_mapper
  • skiptracer OSINT scraping framework, utilizes some basic python webscraping (BeautifulSoup) of PII paywall sites to compile passive information on a target on a ramen noodle budget. https://github.com/xillwillx/skiptracer
  • typofinder a finder of domain typos showing country of IP address. https://github.com/nccgroup/typofinder
  • pwnedOrNot is a python script which checks if the email account has been compromised in a data breach, if the email account is compromised it proceeds to find passwords for the compromised account. https://github.com/thewhiteh4t/pwnedOrNot

Frameworks

In computer programming, a software framework is an abstraction in which software providing generic functionality can be selectively changed by additional user-written code, thus providing application-specific software. A software framework provides a standard way to build and deploy applications.

Social Engineering in the Context of Intelligence Gathering

Social engineering is deemed one of the most widespread avenues for gathering information on a particular individual or a firm. A lot of information is out there – just check the popular social media websites. Also, websites like Pipl, PeekYou, and Spokeo may come in handy as they will provide access to email addresses, locations, phone numbers, and even family tree information.

  • Eavesdropping
  • Shoulder Surfing

Honeypot

A Honeypot is a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of data (for example, in a network site) that appears to be a legitimate part of the site, but is actually isolated and monitored, and that seems to contain information or a resource of value to attackers, who are then blocked.

  • awesome-honeypots The canonical awesome honeypot list. https://github.com/paralax/awesome-honeypots
  • HoneyPy HoneyPy is a low to medium interaction honeypot. It is intended to be easy to: deploy, extend functionality with plugins, and apply custom configurations. https://github.com/foospidy/HoneyPy
  • Dionaea Dionaea is meant to be a nepenthes successor, embedding python as scripting language, using libemu to detect shellcodes, supporting ipv6 and tls. https://github.com/DinoTools/dionaea
  • Conpot ICS/SCADA Honeypot. Conpot is a low interactive server side Industrial Control Systems honeypot designed to be easy to deploy, modify and extend. By providing a range of common industrial control protocols we created the basics to build your own system, capable to emulate complex infrastructures to convince an adversary that he just found a huge industrial complex. To improve the deceptive capabilities, we also provided the possibility to server a custom human machine interface to increase the honeypots attack surface. The response times of the services can be artificially delayed to mimic the behaviour of a system under constant load. Because we are providing complete stacks of the protocols, Conpot can be accessed with productive HMI's or extended with real hardware. Conpot is developed under the umbrella of the Honeynet Project and on the shoulders of a couple of very big giants. https://github.com/mushorg/conpot
  • Amun Amun Python-based low-interaction Honeypot. https://github.com/zeroq/amun
  • Glastopf Glastopf is a Honeypot which emulates thousands of vulnerabilities to gather data from attacks targeting web applications. The principle behind it is very simple: Reply the correct response to the attacker exploiting the web application. https://github.com/mushorg/glastopf
  • Kippo Kippo is a medium interaction SSH honeypot designed to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker. https://github.com/desaster/kippo
  • Kojoney Kojoney is a low level interaction honeypot that emulates an SSH server. The daemon is written in Python using the Twisted Conch libraries. https://github.com/hydrogen18/kojoney/blob/master/kojoney.py
  • HonSSH HonSSH is a high-interaction Honey Pot solution. HonSSH will sit between an attacker and a honey pot, creating two separate SSH connections between them. https://github.com/tnich/honssh
  • Bifrozt Bifrozt is a NAT device with a DHCP server that is usually deployed with one NIC connected directly to the Internet and one NIC connected to the internal network. What differentiates Bifrozt from other standard NAT devices is its ability to work as a transparent SSHv2 proxy between an attacker and your honeypot. If you deployed an SSH server on Bifrozt’s internal network it would log all the interaction to a TTY file in plain text that could be viewed later and capture a copy of any files that were downloaded. You would not have to install any additional software, compile any kernel modules or use a specific version or type of operating system on the internal SSH server for this to work. It will limit outbound traffic to a set number of ports and will start to drop outbound packets on these ports when certain limits are exceeded. https://github.com/Bifrozt
  • Cuckoo Sandbox Cuckoo Sandbox is an Open Source software for automating analysis of suspicious files. To do so it makes use of custom components that monitor the behavior of the malicious processes while running in an isolated environment. https://cuckoosandbox.org/

Weaponization

The cyber attacker does not interact with the intended victim. Instead, they create their attack. For example, the attacker may create an infected Microsoft Office document paired with a customized phishing email, or perhaps they create a new strain of self-replicating malware to be distributed via USB drive. There are few security controls, including security awareness, that may impact or neutralize this stage, unless the cyber attacker does some limited testing on the intended target.

Delivery

Transmission of the attack to the intended victim(s). For example, this would be sending the actual phishing email or distributing the infected USB drives at a local coffee shop or cafe. While there is an entire technical industry dedicated to stopping this stage, people also play a critical role.

Phishing

Phishing is the fraudulent attempt to obtain sensitive information such as usernames, passwords and credit card details by disguising oneself as a trustworthy entity in an electronic communication.

Command and Control

Remote Access Tools

In computing, the term remote desktop refers to a software or operating system feature that allows a personal computer's desktop environment to be run remotely on one system, while being displayed on a separate client device. Remote desktop applications have varying features.

Staging

Lateral Movement

Lateral movement is a means to an end; a technique used to identify, gain access to and exfiltrate sensitive data.

Establish Foothold

Privilege Escalation

Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user.

Local Escalation

Data Exfiltration

Data exfiltration occurs when malware and/or a malicious actor carries out an unauthorized data transfer from a computer. It is also commonly called data extrusion or data exportation. Data exfiltration is also considered a form of data theft.

Software For Team Communication

  • RocketChat is free, unlimited and open source. Replace email & Slack with the ultimate team chat software solution. https://rocket.chat
  • Etherpad is an open source, web-based collaborative real-time editor, allowing authors to simultaneously edit a text document https://etherpad.net

Log Aggregation

Log aggregation is a valuable tool, but it isn't normally a good tool for time-series data. A log aggregation system is a great place for collecting event data. These are irregular activities that are significant. An example might be access logs for a web service.

Forensics

  • Autopsy A digital forensics platform and graphical interface to The Sleuth Kit and other digital forensics tools · sleuthkit - A library and collection of command-line digital forensics tools · EnCase - The shared technology within a suite of digital investigations products by Guidance Software https://www.sleuthkit.org/autopsy/

Cryptography

  • xortool A tool to analyze multi-byte XOR cipher · John the Ripper - A fast password cracker · Aircrack - Aircrack is 802.11 WEP and WPA-PSK keys cracking program. https://github.com/hellman/xortool

Wargame

  • OverTheWire - Semtex · OverTheWire - Vortex · OverTheWire - Drifter · pwnable.kr - Provide various pwn challenges regarding system security · Exploit Exercises - Nebula · SmashTheStack

Reverse Engineering

  • Reversing.kr This site tests your ability to Cracking & Reverse Code Engineering· http://reversing.kr/
  • Crackmes.de The world first and largest community website for crackmes and reversemes. http://crackmes.de/
  • Hack This Site A free, safe and legal training ground for hackers to test and expand their hacking skills. https://www.hackthissite.org/

DLL Architecture

Dynamic linking is a mechanism that links applications to libraries at run time. The libraries remain in their own files and are not copied into the executable files of the applications. DLLs link to an application when the application is run, rather than when it is created.

Kernel32.dll

This is a very common DLL that contains core functionality, such as access and manipulation of memory, files, and hardware.

Advapi32.dll

This DLL provides access to advanced core Windows components such as the Service Manager and Registry.

User32.dll

This DLL contains all the user-interface components, such as buttons, scroll bars, and components for controlling and responding to user actions.

Gdi32.dll

This DLL contains functions for displaying and manipulating graphics.

Ntdll.dll

This DLL is the interface to the Windows kernel.

WSock32.dll and Ws2_32.dll

These are networking DLLs. A program that accesses either of these most likely connects to a network or performs network-related tasks.

Wininet.dll

This DLL contains higher-level networking functions.

Malware Corpora

Malware samples collected for analysis.

  • Clean MX - Realtime database of malware and malicious domains.
  • Contagio - A collection of recent malware samples and analyses.
  • Exploit Database - Exploit and shellcode samples.
  • Infosec - CERT-PA - Malware samples collection and analysis.
  • InQuest Labs - Evergrowing searchable corpus of malicious Microsoft documents.
  • Javascript Mallware Collection - Collection of almost 40.000 javascript malware samples
  • Malpedia - A resource providing rapid identification and actionable context for malware investigations.
  • Malshare - Large repository of malware actively scrapped from malicious sites.
  • Open Malware Project - Sample information and downloads. Formerly Offensive Computing.
  • Ragpicker - Plugin based malware crawler with pre-analysis and reporting functionalities
  • theZoo - Live malware samples for analysts.
  • Tracker h3x - Agregator for malware corpus tracker and malicious download sites.
  • vduddu malware repo - Collection of various malware files and source code.
  • VirusBay - Community-Based malware repository and social network.
  • ViruSign - Malware database that detected by many anti malware programs except ClamAV.
  • VirusShare - Malware repository, registration required.
  • VX Vault - Active collection of malware samples.
  • Zeltser's Sources - A list of malware sample sources put together by Lenny Zeltser.
  • Zeus Source Code - Source for the Zeus trojan leaked in 2011.

Detection and Classification

Antivirus and other malware identification tools

  • AnalyzePE - Wrapper for a variety of tools for reporting on Windows PE files.
  • Assemblyline - A scalable distributed file analysis framework.
  • BinaryAlert - An open source, serverless AWS pipeline that scans and alerts on uploaded files based on a set of YARA rules.
  • chkrootkit - Local Linux rootkit detection.
  • ClamAV - Open source antivirus engine.
  • Detect It Easy(DiE) - A program for determining types of files.
  • Exeinfo PE - Packer, compressor detector, unpack info, internal exe tools.
  • ExifTool - Read, write and edit file metadata.
  • File Scanning Framework - Modular, recursive file scanning solution.
  • Generic File Parser - A Single Library Parser to extract meta information,static analysis and detect macros within the files.
  • hashdeep - Compute digest hashes with a variety of algorithms.
  • HashCheck - Windows shell extension to compute hashes with a variety of algorithms.
  • Loki - Host based scanner for IOCs.
  • Malfunction - Catalog and compare malware at a function level.
  • Manalyze - Static analyzer for PE executables.
  • MASTIFF - Static analysis framework.
  • MultiScanner - Modular file scanning/analysis framework
  • Nauz File Detector(NFD) - Linker/Compiler/Tool detector for Windows, Linux and MacOS.
  • nsrllookup - A tool for looking up hashes in NIST's National Software Reference Library database.
  • packerid - A cross-platform Python alternative to PEiD.
  • PE-bear - Reversing tool for PE files.
  • PEframe - PEframe is an open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.
  • PEV - A multiplatform toolkit to work with PE files, providing feature-rich tools for proper analysis of suspicious binaries.
  • PortEx - Java library to analyse PE files with a special focus on malware analysis and PE malformation robustness.
  • Quark-Engine - An Obfuscation-Neglect Android Malware Scoring System
  • Rootkit Hunter - Detect Linux rootkits.
  • ssdeep - Compute fuzzy hashes.
  • totalhash.py - Python script for easy searching of the TotalHash.cymru.com database.
  • TrID - File identifier.
  • YARA - Pattern matching tool for analysts.
  • Yara rules generator - Generate yara rules based on a set of malware samples. Also contains a good strings DB to avoid false positives.
  • Yara Finder - A simple tool to yara match the file against various yara rules to find the indicators of suspicion.

Memory Forensics

Tools for dissecting malware in memory images or running systems.

  • BlackLight - Windows/MacOS forensics client supporting hiberfil, pagefile, raw memory analysis.
  • DAMM - Differential Analysis of Malware in Memory, built on Volatility.
  • evolve - Web interface for the Volatility Memory Forensics Framework.
  • FindAES - Find AES encryption keys in memory.
  • inVtero.net - High speed memory analysis framework developed in .NET supports all Windows x64, includes code integrity and write support.
  • Muninn - A script to automate portions of analysis using Volatility, and create a readable report.
  • Rekall - Memory analysis framework, forked from Volatility in 2013.
  • TotalRecall - Script based on Volatility for automating various malware analysis tasks.
  • VolDiff - Run Volatility on memory images before and after malware execution, and report changes.
  • Volatility - Advanced memory forensics framework.
  • VolUtility - Web Interface for Volatility Memory Analysis framework.
  • WDBGARK - WinDBG Anti-RootKit Extension.
  • WinDbg - Live memory inspection and kernel debugging for Windows systems.

X86 Architecture

The x86 architecture is an instruction set architecture. It is a set of computer processors that were developed by the Intel Corporation. x86 architecture defines how a processor handles and executes different instructions on a computer by setting standards on application execution.

  • EAX: Extended Accumulator Register
  • EBX: Extended Base Register
  • ECD: Extended Counter Register
  • EDX: Extended Data Register
  • ESI: Extended Source Index
  • EDI: Extended Destination Index
  • EBP: Extended Base Pointer
  • ESP: Extended Stack Pointer

The POP instruction pops a value or memory address which is the name in the stack. Additionally it also increments the stack pointer to point to the new top of the stack. The PUSH instruction pushes a value to the stack and decrements the stack pointer to point to the new top.

References

License

License: GPL v3