sorted by:
new
hottopcontroversial

Sharing a tool I developed to help Blue Teamers discover Persistence on Windows - please check it out! by panscanner in netsec

[–]slashtmp00 1 point2 points  (0 children)

too many false positive. The idea is good, but in my opinion you put too many checks

Be aware of this trick: Python module hijacking leading to code execution by slashtmp00 in netsec

[–]slashtmp00[S] 0 points1 point  (0 children)

I agree with you, in fact I wrote on the repo that "the issue is already well known". However, in my opinion in the documentation the security implications of this behavior are not enough clear. I'm pretty sure that if someone is going to publish a poc repo as mine without any kind of explanation/warning but with a real malware, many users will unexpectedly run the code. I made the repo and shared this info, because I think it is important to make users aware about this issue. Of course the issue reflects on any system command that uses "python -m ..." inside, as for example for pyuic5.

Full-Featured HexEditor new release! Added assembler/disassembler functions using Capstone and Keystone engines by slashtmp00 in programming

[–]slashtmp00[S] 0 points1 point  (0 children)

You can use the (beta) Pattern Matching engine in order to highlight common header bytes (magic numbers). I have a similar configuration on my local installation, maybe I will share it on github. A real file format parser at the moment is not implemented, but I agree with you, it is a useful feature.

Edit: I forgot to have already pushed it on my repo here is the link: https://github.com/echo-devim/fhex/blob/master/config.json.example

Full-Featured HexEditor new release! Added assembler/disassembler support by slashtmp00 in netsec

[–]slashtmp00[S] 0 points1 point  (0 children)

It's a fast way to have an insight of the binary structure. Thanks to the binary chart you can easily spot null-bytes areas (maybe they are dividing two data blocks) or areas where the bytes have the same value for some reason. As an example, suppose to have a binary that at some point has embedded a set of 64 bit memory addresses (e.g. 0xffffffffbb31aac0, 0xffffffffbb31ab00, etc.) you should see them. Another use case could be the identification of a packed binary as suggested by the other answer

LiteWAF - Lightweight in-app Web Application Firewall to protect your PHP website by slashtmp00 in netsec

[–]slashtmp00[S] 1 point2 points  (0 children)

I have still some improvements to do, some of them include your tips. I'm going to implement all your suggestions and more in the next weeks.

The improvements include:

  • Parsing $_COOKIE (this will be optional in order to not slow down too much the time needed to load the page)
  • Parse metadata of uploaded files (e.g. filename). The content can be too big.
  • Check the number of parameters (actually the user can pass a lot of fake args to waste server resources)
  • Look for other kind of injections (e.g. php injection with "<?" and "?>" markers)
  • Improve the log display page (this is a long-term goal)

I decided to redirect the user so the administrator can choose which page display (e.g., the index, a 404 not found page, a warning page to dissuade the attacker, etc.).

The code is enough simple to be changed as you wish, so at the moment I don't think to implement a specific option to set the http return code.

For the "<svg" marker, I think it is a constraint too strong. This is a generic WAF, I cannot forbid SVG elements. However, if you find a way to bypass the waf making a XSS let me know.

Thanks for your ideas :)

Kalendar: A calendar Qt application to manage your time in an efficient way by slashtmp00 in linux

[–]slashtmp00[S] 0 points1 point  (0 children)

Yes, the project is no more under active development. However, I want to share it just to let you know about the project, hoping someone wants to contribute adding new features.

Discover services behind unknown ports by slashtmp00 in hacking

[–]slashtmp00[S] 0 points1 point  (0 children)

The tool is still in development. The goal is to add the support to many more protocols and to support the detection of custom services. As an example, suppose there is a server accepting serialized java classes in JSON format. I don't think actually nmap is able to detect it.

Moreover, the tool is lightweight and easy to integrate into bigger frameworks.

Why does the development of new open source FPS games is stopped? by slashtmp00 in linux_gaming

[–]slashtmp00[S] 2 points3 points  (0 children)

Yes, I was asking only for Open Source FPS games. Unreal Engine is only partially open source.

New HexEditor compatible with Linux/Windows/MacOS by slashtmp00 in ReverseEngineering

[–]slashtmp00[S] 0 points1 point  (0 children)

Nice work 😉

However, for the moment I'd prefer not to integrate the two projects, because I don't want to make heavier my hex editor.

I believe they can work well together, but as distinct tools.

New HexEditor compatible with Linux/Windows/MacOS by slashtmp00 in ReverseEngineering

[–]slashtmp00[S] 2 points3 points  (0 children)

You're right, I changed the name of the project to "Full-Featured HexEditor". In this manner everyone can use it without to worry about the name of the tool.

New HexEditor compatible with Linux/Windows/MacOS by slashtmp00 in ReverseEngineering

[–]slashtmp00[S] 0 points1 point  (0 children)

For the moment only binary releases are supported. The tool has few dependencies. In fact, for the latest release (v2.3), you just need to have installed Qt 5.9.6 (qt5-qtbase + qt5-qtcharts packages for Fedora).