aLt's Security Blog

If you facing problem with virtualbox installation on kali rolling edition because of its outdated kernel 4.3.0-kali1-amd64 then this post is for you only. Step1: Install latest kernel. First search the cache for list of available ones apt-cache search linux-headers Depending upon the list choose one from the set and install install it. you can download kernel file using wget from ubuntu source also. example: wget kernel.ubuntu.com/~kernel-ppa/mainline/v4.4.3-wily/linux-image-4.4.3-040403-generic_4.4.3-040403.201602251634_amd64.deb for more refer to this post: link Step2: Edit the boot entry /boot/vmlinuz-(New Linux kernel Version) & /boot/initrd.img-(New Linux kernel version) in grub menu. Before making boot entry changes be sure these files exist in the /boot directory after running install command. In my case following new file got created in /boot folder: 1)vmlinuz-4.6.0-kali1-amd64 2)initrd.img-4.6.0-kali1-amd64 Thats all you need to do to install any vir...

I recently started working on  widows 10 Apps( Apps not Applications) security. Before diving deep in hacking terms lets try to understand what's new in Windows 10 UWP( Universal Platform) as compared to old Apps. Lets begin with how apps actually work on windows 10(desktop/tablet). Now windows 10 comes with a container only for running apps inside the isolated environment. By default, /APPCONTAINER(Linker Flag) is off. This option modifies an executable to indicate whether the app must be run in the appcontainer process-isolation environment. Specify /APPCONTAINER for an app that must run in the appcontainer environment—for example, a Windows Store app. (The option is set automatically in Visual Studio when you create a Windows Store app from a template.) For a desktop app, specify /APPCONTAINER:NO or just omit the option. The /APPCONTAINER option was introduced in Windows 8. Now there is no registry entry concept for these app in the System HIVE rather they install they own hiv...

1. Declare the module in  AndroidManifest.xml < manifest xmlns:android = "http://schemas.android.com/apk/res/android"     package = "com.example.xpomodfc"     android:versionCode = "1"     android:versionName = "1.0" >     < uses-sdk         android:minSdkVersion = "8"         android:targetSdkVersion = "15" />     < application         android:allowBackup = "true"         android:icon = "@drawable/ic_launcher"         android:label = "@string/app_name"         android:theme = "@style/AppTheme" >           < meta-data             android:name =...

Application Security Risks Type Of Risks Reference: Link

The installation through the AWS EC2 interface is dead simple. Point, click. Cutting keys and firing up ssh is also easy. But before you get too comfortable, there’s a few things you should know. First, unlike every preceding version of BackTrack and Kali, you do not just log in as root and leave it there. In order to meet the Amazon terms of service, you must log in as a lower-level user (in this case, user “kali”) and then su to root:     $ sudo su     # <-- and you are root! Note no password is required. You should consider running ‘passwd’ to ensure your instance requires one. No one will ever, ever guess ‘toor’. You’re welcome. Second, you should also know this is a “barebones” install. I couldn’t find what the “barebones” term meant anywhere on the kali.org website or support forums. Well it actually means “The Kali Amazon image is what we call a ‘minimal image’, meaning, no tools pre-installed. You can install any tools you need individually, or...

DarunGrim is a binary diffing tool. DarunGrim is a free diffing tool which provides binary diffing functionality.Binary diffing is a powerful technique to reverse-engineer patches released by software vendors like Microsoft. Especially by analyzing security patches you can dig into the details of the vulnerabilities it's fixing. You can use that information to learn what causes software break. Also that information can help you write some protection codes for those specific vulnerabilities. It's also used to write 1-day exploits by malware writers or security researchers.This binary diffing technique is especially useful for Microsoft binaries. Not like other vendors they are releasing patch regularly and the patched vulnerabilities are relatively concentrated in small areas in the code. That makes the patched part more visible and apparent to the patch analyzers. Lets now try to reverse a latest microsoft security patch{well in my next post I'll show how to use DarunG...

Running daily scans manually is a very cumbersome and boring task. So I thought of automating them for ease and fast processing. So Zaproxy is very well known OWASP vulnerability scanner that can be very helpful for webapps pentesting and lot more. So here are few steps to get started with OWASP Zaproxy: Step1: Download ZAProxy from here Step2: You can run Zaproxy in GUI mode to get feel and things that are available on this beautiful scanner. But in order to automated I prefer it running in daemon mode. So I use follwoing command: ./zap.sh -daemon -config api.disablekey=true & So this command will start ZAP in daemon mode with ZAP APIs listening  on 8080  by default. Oh I forget to tell you that this scanner comes with REST API which you can access using python, java or ruby also. Everything that you can do from gui is also supported by these APIs. I generally use python so I installed owasp-zapv2 using pip. pip install python-owasp-zap-v2.4 If you want to rea...

The emulator file system is ext4. You can re-size the userdata.img using standard Linux tools. Try this only when you are facing problem increasing AVD size using Android-SDK GUI. # Navigate to AVD cd ~ /.android/ avd /{name-of-avd} # Delete old image rm userdata - qemu .* # Re-size the image resize2fs userdata . img 1 512M # Start the emulator and enjoy#BePatient it may take some time to create new partition emulator {name-of-avd} OR e2fsck - f userdata - qemu . img resize2fs userdata - qemu . img 512M

curl http://pastie.org/pastes/9934018/download -o /tmp/vmnet-3.19.patch cd /usr/lib/vmware/modules/source tar -xf vmnet.tar patch -p0 -i /tmp/vmnet-3.19.patch tar -cf vmnet.tar vmnet-only rm -r *-only vmware-modconfig --console --install-all References: http://askubuntu.com/questions/605530/vmware-player-7-1-0-on-ubuntu-15-04-kernel-3-19-0-10-generic-app-loading http://askubuntu.com/questions/617704/failed-to-build-vmnet-for-kernel-3-19

I bet if you are an active facebook user then you might have already seen such post. They lurk user into opening the link and then a background script will automatically tag all the victim friends to that same video or it can also prompt you to install malicious software in order to view the same. If you are not logged in then it will prompt you to login like  shown below: So better next time before opening any link or installing any unknown  software be sure whether you trust the content originator fully or not. As an advice always open external links in incognito mode of same browser or different browser in which you are not logged in.

As discussed in previous post now we will employ traditional malware analysis technique in order to dissect this new virus. Figure 2 show LOL zip virus message. Initially we have following information about this malware: ·          This message is sent from victim’s computer without his knowledge to all his Facebook friends and ·          Victims also reported sluggish performance of system after the infection. Fig. 2. Facebook Message containing Malware We will safely download this file on our virtual controlled environment to carry the further analysis. After unzipping it we found a JAR (Java Archived File) in it. Fig. 3. JAR file inside Zipped folder  Using online available java decompiler we have converted the byte code (JAR file) to source code file. Fig. 4. Decompiled Jar File   Decompilation and comprehension of JAR File Source of JAR file ...