INTERCEPT - Policy As Code Static Analysis Auditing

Stupidly easy to use, small footprint Policy as Code subsecond command-line scanner that leverages the power of the fastest multi-line search tool to scan your codebase. It can be used as a linter, guard rail control or simple data collector and inspector. Consider it a weaponized ripgrep. Works on Mac, Linux and Windows.

How it works

• intercept binary
• policies yaml file
• (included) latest ripgrep binary
• (optional) exceptions yaml file

Intercept merges environment flags, policies yaml, exceptions yaml to generate a global config. Uses ripgrep to scan a target path for policy breaches recursively against your code and generates a human readable detailed output of the findings.

Use cases

• Simple and powerful free drop-in alternative for Hashicorp Sentinel if you are more comfortable writing and maintaining regular expressions than using a new custom policy language.
  
• Do you find Open Policy Agent rego files too much sugar for your pipeline?
  
• Captures the patterns from git-secrets and trufflehog and can prevent sensitive information to run through your pipeline. (trufflehog regex)
  
• Identifies policy breach (files and line numbers), reports solutions/suggestions to its findings making it a great tool to ease onboarding developer teams to your unified deployment pipeline.
  
• Can enforce style-guides, coding-standards, best practices and also report on suboptimal configurations.
  
• Can collect patterns or high entropy data and output it in multiple formats.
  
• Anything you can crunch on a regular expression can be actioned on.
  

Latest Release :

  # Standard package (intercept + ripgrep) for individual platforms
    -- intercept-rg-linux.zip
    -- intercept-rg-macos.zip
    -- intercept-rg-win.zip

  # Clean package (intercept only) for individual platforms
    -- core-intercept-linux.zip
    -- core-intercept-macos.zip
    -- core-intercept-win.zip

  # Full package (intercept + ripgrep) for all platforms
    -- x-intercept.zip

  # Package needed to fully use the Makefile
    -- setup-buildpack.zip

  # Package of the latest compatible release of ripgrep (doesn't include intercept)
    -- i-ripgrep-linux.zip
    -- i-ripgrep-macos.zip
    -- i-ripgrep-win.zip

Download the standard package for your platform to get started

Used in production
INTERCEPT was created to lint thousands of infra deployments a day with minor human intervention, the first MVP been running for a year already with no reported flaws. Keep in mind INTERCEPT is not and does not pretend to be a security tool. It's easy to circumvent a regex pattern once you know it, but the main objective of this tool is to pro-actively help the developers fix their code and assist with style suggestions to keep the codebase clean and avoid trivial support tickets for the uneducated crowd.

Inspired by

• ripgrep
• Hashicorp Sentinel
• Open Policy Agent

Standing on the shoulders of giants

Why ripgrep ? Why is it fast?

• It is built on top of Rust's regex engine. Rust's regex engine uses finite automata, SIMD and aggressive literal optimizations to make searching very fast. (PCRE2 support) Rust's regex library maintains performance with full Unicode support by building UTF-8 decoding directly into its deterministic finite automaton engine.
  
• It supports searching with either memory maps or by searching incrementally with an intermediate buffer. The former is better for single files and the latter is better for large directories. ripgrep chooses the best searching strategy for you automatically.
  
• Applies ignore patterns in .gitignore files using a RegexSet. That means a single file path can be matched against multiple glob patterns simultaneously.
  
• It uses a lock-free parallel recursive directory iterator, courtesy of crossbeam and ignore.
  

Benchmark ripgrep

Tool	Command	Line count	Time
ripgrep (Unicode)	rg -n -w '[A-Z]+_SUSPEND'	450	0.106s
git grep	LC_ALL=C git grep -E -n -w '[A-Z]+_SUSPEND'	450	0.553s
The Silver Searcher	ag -w '[A-Z]+_SUSPEND'	450	0.589s
git grep (Unicode)	LC_ALL=en_US.UTF-8 git grep -E -n -w '[A-Z]+_SUSPEND'	450	2.266s
sift	sift --git -n -w '[A-Z]+_SUSPEND'	450	3.505s
ack	ack -w '[A-Z]+_SUSPEND'	1878	6.823s
The Platinum Searcher	pt -w -e '[A-Z]+_SUSPEND'	450	14.208s

Tests

Test Suite runs with venom

venom run tests/suite.yml

Vulnerabilities

Scanned with Sonatype Nancy

Audited dependencies:41,Vulnerable:0

from Sonatype OSS Index

Download Intercept

via KitPloit

This article is the property of Tenochtitlan Offensive Security. Verlo Completo --> https://tenochtitlan-sec.blogspot.com

More articles

1. Blackhat Hacking
2. Penetration Testing A Hands-On Introduction To Hacking
3. Programa Hacker
4. Hacking Wifi
5. Hacking Ethical
6. Ethical Hacking Course
7. Hacking Meaning

Falcons, Spears And Revenants, Oh My

I finished the first of the six Falcon turrets last Friday right before NEAT. The next six are going to be magnetised so I can swap them out for Fire Prism turrets (haven't started on those yet though).

I also did some conversion work earlier this week on my Revenants. I did some leg swaps to add some pose variety and magnetized the weapons. I have some Vibrocannon arm conversions to work on and a bit of puttying to do before these see paint.

Finally, I finished up the lances and gems on the Shining Spears last night, and put on their decals as well. They'll need a bit of touch up and bases edges before they get top coated.

A Note On "Standard" Player Powers

In a few recent TMG games I've worked on (Harvest, Pioneer Days, and Old West Empresario) I thought a lot about how to do player powers in the game.

In Harvest, the "standard" side of each player board (recommended for first time players) is Wil Plantsomdil, who starts with a basic spread of resources, and gets a big VP bonus at game end. The intent was to allow a new player to play in a game with experienced players, not have to wrestle with a player power while also learning the game, and still get a competitive score. In that game, I wouldn't blame "experienced games" for skipping Wil Plantsomdil and going straight for the "real" player powers. However, I thought we could do better...

In Pioneer Days and Old West Empresario, the Standard Pioneer / Standard Empresario abilities are not just a dumbed down power meant for newbie players. Rather we took one of the more well-rounded or straightforward of the powers we were developing, one which we thought would make for a good first experience, and made that the "standard" power.

The rules for both of those games say to deal 2 characters to each player and let them choose between one unique ability, the other, or the standard ability on the back side. While we recommend that first time players choose the standard ability, we worked hard to balance them all so that the standard power is on par with the unique ones, giving each player 3 solid options.

I fear that players will assume that "standard" implies "boring," automatically skip the "standard" ability as if it didn't exist, and therefore miss out on one of the fun player powers.

Hopefully we can break them of this habit. I played a game of Old West Empresario the other day and intentionally chose the Standard Empresario ability, and I did better than I've done in a long time!

TL;DR: In Pioneer Days, Old West Empresario, and any future TMG title I work on, don't look at the standard player power as "lesser" -- it's designed to be on par with the rest of the player powers!

BurpSuite Introduction & Installation

What is BurpSuite?
Burp Suite is a Java based Web Penetration Testing framework. It has become an industry standard suite of tools used by information security professionals. Burp Suite helps you identify vulnerabilities and verify attack vectors that are affecting web applications. Because of its popularity and breadth as well as depth of features, we have created this useful page as a collection of Burp Suite knowledge and information.

In its simplest form, Burp Suite can be classified as an Interception Proxy. While browsing their target application, a penetration tester can configure their internet browser to route traffic through the Burp Suite proxy server. Burp Suite then acts as a (sort of) Man In The Middle by capturing and analyzing each request to and from the target web application so that they can be analyzed.

Everyone has their favorite security tools, but when it comes to mobile and web applications I've always found myself looking BurpSuite . It always seems to have everything I need and for folks just getting started with web application testing it can be a challenge putting all of the pieces together. I'm just going to go through the installation to paint a good picture of how to get it up quickly.

BurpSuite is freely available with everything you need to get started and when you're ready to cut the leash, the professional version has some handy tools that can make the whole process a little bit easier. I'll also go through how to install FoxyProxy which makes it much easier to change your proxy setup, but we'll get into that a little later.

Requirements and assumptions:

Mozilla Firefox 3.1 or Later Knowledge of Firefox Add-ons and installation The Java Runtime Environment installed

Download BurpSuite from http://portswigger.net/burp/download.htmland make a note of where you save it.

on for Firefox from   https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/


If this is your first time running the JAR file, it may take a minute or two to load, so be patient and wait.


Video for setup and installation.

You need to install compatible version of java , So that you can run BurpSuite.

Read more

1. Herramientas Hacking Etico
2. Hacking Windows: Ataques A Sistemas Y Redes Microsoft
3. Hackers Informaticos Contactar
4. Programa De Hacking
5. Significado Hacker
6. Defcon Hacking
7. Hacking School
8. Blog Hacking

Pwned - Simple CLI Script To Check If You Have A Password That Has Been Compromised In A Data Breach

This article is the property of Tenochtitlan Offensive Security. Verlo Completo --> https://tenochtitlan-sec.blogspot.com

Related articles

• Elhacker Ip
• Elladodelmal
• Curso De Hacking Etico Gratis
• Black Hacker
• Web Hacking 101
• Wifi Hacking
• Hacking Curso
• Hacking Web Technologies Pdf
• Hacking Smart Tv
• Web Hacking 101

Diggy - Extract Enpoints From APK Files

Diggy can extract endpoints/URLs from apk files. It saves the result into a txt file for further processing.


Dependencies

• apktool

Usage

./diggy.sh /path/to/apk/file.apk

You can also install it for easier access by running install.sh
After that, you will be able to run Diggy as follows:

diggy /path/to/apk/file.apk

Download Diggy

Related articles

1. Mindset Hacking Español
2. Hacking School
3. Hacking Live
4. Aprender Hacking Etico
5. Hacking Apps
6. Hacking 2019

Practical Dictionary Attack On IPsec IKE

We found out that in contrast to public knowledge, the Pre-Shared Key (PSK) authentication method in main mode of IKEv1 is susceptible to offline dictionary attacks. This requires only a single active Man-in-the-Middle attack. Thus, if low entropy passwords are used as PSKs, this can easily be broken.

This week at the USENIX Security conference, Dennis Felsch will present our research paper on IPsec attacks: The Dangers of Key Reuse: Practical Attacks on IPsec IKE. [alternative link to the paper]

In his blog post, Dennis showed how to attack the public key encryption based authentication methods of IKEv1 (PKE & RPKE) and how to use this attack against IKEv2 signature based authentication method. In this blog post, I will focus on another interesting finding regarding IKEv1 and the Pre-Shared Key authentication.

IPsec and Internet Key Exchange (IKE)

IPsec enables cryptographic protection of IP packets. It is commonly used to build VPNs (Virtual Private Networks). For key establishment, the IKE protocol is used. IKE exists in two versions, each with different modes, different phases, several authentication methods, and configuration options. Therefore, IKE is one of the most complex cryptographic protocols in use.

In version 1 of IKE (IKEv1), four authentication methods are available for Phase 1, in which initial authenticated keying material is established: Two public key encryption based methods, one signature based method, and a PSK (Pre-Shared Key) based method.

The relationship between IKEv1 Phase 1, Phase 2, and IPsec ESP. Multiple simultaneous Phase 2 connections can be established from a single Phase 1 connection. Grey parts are encrypted, either with IKE derived keys (light grey) or with IPsec keys (dark grey). The numbers at the curly brackets denote the number of messages to be exchanged in the protocol.

Pre-Shared Key authentication

As shown above, Pre-Shared Key authentication is one of three authentication methods in IKEv1. The authentication is based on the knowledge of a shared secret string. In reality, this is probably some sort of password.

The IKEv1 handshake for PSK authentication looks like the following (simplified version):

In the first two messages, the session identifier (inside HDR) and the cryptographic algorithms (proposals) are selected by initiator and responder. 

In messages 3 and 4, they exchange ephemeral Diffie-Hellman shares and nonces. After that, they compute a key k by using their shared secret (PSK) in a PRF function (e.g. HMAC-SHA1) and the previously exchanged nonces. This key is used to derive additional keys (k_a, k_d, k_e). The key k_d is used to compute MAC_I over the session identifier and the shared diffie-hellman secret g^xy. Finally, the key k_e is used to encrypt ID_I (e.g. IPv4 address of the peer) and MAC_I. 

Weaknesses of PSK authentication

It is well known that the aggressive mode of authentication in combination with PSK is insecure and vulnerable against off-line dictionary attacks, by simply eavesedropping the packets. For example, in strongSwan it is necessary to set the following configuration flag in order to use it:

charon.i_dont_care_about_security_and_use_aggressive_mode_psk=yes

For the main mode, we found a similar attack when doing some minor additional work. For that, the attacker needs to waits until a peer A (initiator) tries to connect to another peer B (responder). Then, the attacker acts as a man-in-the middle and behaves like the peer B would, but does not forward the packets to B.

From the picture above it should be clear that an attacker who acts as B can compute (g^xy) and receives the necessary public values session ID, n_I, n_R. However, the attacker does not know the PSK. In order to mount a dictionary attack against this value, he uses the nonces, and computes a candidate for k for every entry in the dictionary. It is necessary to make a key derivation for every k with the values of the session identifiers and shared Diffie-Hellmann secret the possible keys k_a, k_d and k_e. Then, the attacker uses k_e in order to decrypt the encrypted part of message 5. Due to ID_I often being an IP address plus some additional data of the initiator, the attacker can easily determine if the correct PSK has been found.

Who is affected?

This weakness exists in the IKEv1 standard (RFC 2409). Every software or hardware that is compliant to this standard is affected. Therefore, we encourage all vendors, companies, and developers to at least ensure that high-entropy Pre-Shared Keys are used in IKEv1 configurations.

In order to verify the attack, we tested the attack against strongSWAN 5.5.1.

Proof-of-Concept

We have implemented a PoC that runs a dictionary attack against a network capture (pcapng) of a IKEv1 main mode session. As input, it also requires the Diffie-Hellmann secret as described above. You can find the source code at github. We only tested the attack against strongSWAN 5.5.1. If you want to use the PoC against another implementation or session, you have to adjust the idHex value in main.py.

Responsible Disclosure

We reported our findings to the international CERT at July 6th, 2018. We were informed that they contacted over 250 parties about the weakness. The CVE ID for it is CVE-2018-5389 [cert entry].

Credits

On August 10th, 2018, we learned that this attack against IKEv1 main mode with PSKs was previously described by David McGrew in his blog post Great Cipher, But Where Did You Get That Key?. We would like to point out that neither we nor the USENIX reviewers nor the CERT were obviously aware of this.
On August 14th 2018, Graham Bartlett (Cisco) email us that he presented the weakness of PSK in IKEv2 in several public presentations and in his book.
On August 15th 2018, we were informed by Tamir Zegman that John Pliam described the attack on his web page in 1999.

FAQs

• Do you have a name, logo, any merchandising for the attack?
  No.
• Have I been attacked?
  We mentioned above that such an attack would require an active man-in-the-middle attack. In the logs this could look like a failed connection attempt or a session timed out. But this is a rather weak indication and no evidence for an attack. 
• What should I do?
  If you do not have the option to switch to authentication with digital signatures, choose a Pre-Shared Key that resists dictionary attacks. If you want to achieve e.g. 128 bits of security, configure a PSK with at least 19 random ASCII characters. And do not use something that can be found in public databases.
• Am I safe if I use PSKs with IKEv2?
  No, interestingly the standard also mentions that IKEv2 does not prevent against off-line dictionary attacks.
• Where can I learn more?
  You can read the paper. [alternative link to the paper]
• What else does the paper contain?
  The paper contains a lot more details than this blogpost. It explains all authentication methods of IKEv1 and it gives message flow diagrams of the protocol. There, we describe a variant of the attack that uses the Bleichenbacher oracles to forge signatures to target IKEv2. 

More information

• Herramientas De Seguridad Informatica
• Retos Hacking
• Hacking Apps
• Software Hacking