Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- Snort
  - Data Aquisition Modules
  - Usage
    - Sniffing
    - Packet Logger
    - IDS and IPS
    - PCAPs
  - Rules
    - Detection Rules

# Snort

Comprised of packet decoder, pre processor, detection engine, logging and alerting, output and plugins

## Data Aquisition Modules

- Pcap, default
- Afpacket, inline mode, IPS
- Ipq, uses netfilter on linux
- Nfq, inline mode on linux
- Ipfw, inline mode on BSD
- Dump, test mode

## Usage

- Check config, and run tests via

    snort -c <config> -T

### Sniffing

| Parameter | Description | +-----------+-------------+ | -v | Verbose. Display the TCP/IP output in the console.| | -d | Display the packet data (payload).| | -e | Display the link-layer (TCP/IP/UDP/ICMP) headers. | | -X | Display the full packet details in HEX.| | -i | Liste on interface |

### Packet Logger

- Logged by IP as directory, ports as files inside these dirs
- BPF filter can be used like `tcp port 80`
- Log files can be opened by wireshark or `tcpdump -r <logfile>`

| Parameter | Description | |-----------|-------------| | -l | Logger mode, target log and alert output directory. Default output folder is tcpdump to /var/log/snort.| | -K ASCII | Log packets in ASCII format | | -r | Filter dumped logs in Snort | | -n | Specify the number of packets that will be read |

### IDS and IPS

- Output is an alert file along an optional log file

| Parameter | Description | |-----------|-------------| | -c | Defining the configuration file | | -T | Testing the configuration file | | -N | Disable logging | | -D | Background mode | | -A | Alert modes; full: all possible info about alerts, default mode; fast : alert message, timestamp, source and destination IP, port numbers. console: Provides fast style alerts on the console screen. cmg: CMG style, basic header details with payload in hex and text format. none: Disabling alerting |

- Rules found in `/etc/snort/rules/local.rules`

    alert icmp any any <> any any  (msg: "ICMP Packet Found"; sid: 100001; rev:1;)

### PCAPs

- `snort -c <configfile> -r file.pcap -A console -n <number of packets>`
- `snort -c <configfile> --pcap-list="file1.pcap file2.pcap" -A console -l .`

## Rules

    snort -c /etc/snort/rules/local.rules -A console
    snort -c /etc/snort/rules/local.rules -A full

- Every rule has an IP source and destination, as well as a port for every endpoint

- General, payload and non payload rules

- Direction of the packet

  - `->` to destination
  - `<>` bidirectional

- IDS -> `alert`

- IPS -> `reject`

`<action> <protocol> <ip.src> <src.port> <> <ip.dst> <dst.port>(msg: "<msg>; <reference>; <ruleID>;<revision info>`

- Actions

  - `alert`
  - `log`
  - `drop`
  - `reject`

- SID rule IDs

  - < 100 reserved rules
  - 100 - 999,999 rules of the build

  - > = 1,000,000 user rules

- Reference may be a CVE

- Revisions are versionings of the rule

- Filter address range via CIDR

    alert icmp 192.168.1.0/24 any <> any any  (msg: "ICMP Packet Found"; sid: 100001; rev:1;)

- Filter multiple address ranges

    alert icmp [192.168.1.0/24, 10.1.1.0/24] any <> any any  (msg: "ICMP Packet Found"; sid: 100001; rev:1;)

- Exlude via `!10.10.0.1`
- Filter via any and ports between 4712 and 8080

    alert icmp any 4711,8080: <> any any (msg: "TCP Packet Found"; sid: 100001; rev:1;)

### Detection Rules

- `/etc/snort/rules/local.rules`
- ASCII or gex mode

    ASCII mode - alert tcp any any -> any 8080  (msg: "GET Request Found"; content:"GET";content: "/foo"; sid: 100001; rev:1;)
    alert tcp any any -> any 8080  (msg: "GET Request Found"; content:"|47 45 54|"; sid: 100001; rev:1;)

- Case insensitiv

    alert tcp any any -> any 8080  (msg: "GET Request Found"; content:"GET"; nocase; sid: 100001; rev:1;)

- Fast pattern

    alert tcp any any <> any 80  (msg: "GET Request Found"; content:"GET"; fast_pattern; content:"www";  sid:100001; rev:1;)

- Non payload detection rules
  - TCP flags, `flags: F,S,A,R,P,U`
  - Payload size, `dsize:min<>max`
  - SameIP, `alert ip any any <> any any (msg: "SAME-IP TEST"; sameip; sid: 100001; rev:1;)`
  - Packet IDs, `id: 4711`