Security of Information, Threat Intelligence, Hacking, Offensive Security, Pentest, Open Source, Hackers Tools, Leaks, Pr1v8, Premium Courses Free, etc

  • Penetration Testing Distribution - BackBox

    BackBox is a penetration test and security assessment oriented Ubuntu-based Linux distribution providing a network and informatic systems analysis toolkit. It includes a complete set of tools required for ethical hacking and security testing...
  • Pentest Distro Linux - Weakerth4n

    Weakerth4n is a penetration testing distribution which is built from Debian Squeeze.For the desktop environment it uses Fluxbox...
  • The Amnesic Incognito Live System - Tails

    Tails is a live system that aims to preserve your privacy and anonymity. It helps you to use the Internet anonymously and circumvent censorship...
  • Penetration Testing Distribution - BlackArch

    BlackArch is a penetration testing distribution based on Arch Linux that provides a large amount of cyber security tools. It is an open-source distro created specially for penetration testers and security researchers...
  • The Best Penetration Testing Distribution - Kali Linux

    Kali Linux is a Debian-based distribution for digital forensics and penetration testing, developed and maintained by Offensive Security. Mati Aharoni and Devon Kearns rewrote BackTrack...
  • Friendly OS designed for Pentesting - ParrotOS

    Parrot Security OS is a cloud friendly operating system designed for Pentesting, Computer Forensic, Reverse engineering, Hacking, Cloud pentesting...
Showing posts with label Phones. Show all posts
Showing posts with label Phones. Show all posts

Tuesday, September 20, 2016

Build Your Own - PwnPhone

Build Your Own PwnPhone
We’ll attempt to show you how to build your own Pwn Phone running the Kali operating system and our AOPP (Android Open Pwn Project) image.
Let’s get cracking…

Flashing the Phone

  1. Download the Recovery image for your device:
    https://twrp.me/Devices
  2. Connect the device to the host machine via USB cable.
  3. Power off the device and boot into the Bootloader:
    Press and hold the Power & Volume-Down buttons
  4. Confirm the device is recognized by the host machine:
    (a device should be listed when the command returns)
    $ fastboot devices
  5. Unlock the device:$ fastboot oem unlock
  6. Once unlocked, flash the Recovery image:$ fastboot flash recovery <name-of-recovery-image>.img
  7. Once the Recovery image has been flashed, boot into Recovery from the Bootloader:
    Use the Volume-Down/Up buttons to cycle through the Bootloader options and then the Power button to select
  8. If prompted, swipe “Swipe to Allow Modifications”.
  9. Once in Recovery, wipe the device:
    Tap Wipe > Advanced Wipe > tap: Dalvik/ART cache, System, Cache, Data > swipe “Swipe to Wipe”
  10. Once wiped, do NOT boot into System (You don’t have one; you just wiped it). Tap the Home button to return to the Recovery home screen.
  11. Confirm again the device is recognized by the host machine:
    (a device should be listed when the command returns)$ adb devices
  12. From the host machine, push the downloaded AOPP ROM zip to the device sdcard:
    $ adb push <name-of-rom-zip>.zip /sdcard/
  13. On device, tap Install and then select the AOPP ROM zip from /sdcard.
  14. Swipe “Swipe to Confirm Flash”
  15. Once installed, tap “Reboot System”

OK Now Let’s Build the Phone

Downloading the Source

  1. Refer to “Downloading and Building Requirements” before proceeding:
    https://source.android.com/source/requirements.html
  2. Refer to “Downloading the Source” before proceeding:
    https://source.android.com/source/downloading.html
  3. Create a directory for the build system to live in and cd into that directory:$ mkdir <WORKING_DIR>$ cd <WORKING_DIR>
  4. Initialize a local repository using this source tree, use the command:
    $ repo init -u git@github.com:aopp/android_platform.git -b px-0.1
  5. Sync the repository, use:
    $ repo sync

Building

Devices are referred to by codename (e.g. hammerhead). Make sure to use this when substituting <device-codename> in the following instruction set.
  1. Refer to “Building the System” before proceeding:
    https://source.android.com/source/building.html
  2. To initialize the build environment, use the following command:$ . build/envsetup.sh
  3. Prepare the build environment (download device-tree and dependencies) for your specific device:$ breakfast <device-codename>
  4. Connect the device running a working AOPP/AOSP ROM to the host machine via USB.
  5. Make sure it is booted into system and confirm the device is recognized by the host machine:
    (a device should be listed when the command returns)$ adb devices
  6. Enter the device directory:$ cd <WORKING_DIR>/device/<vendor>/<device-codename>/
  7. Extract the proprietary binaries from your device:$ ./extract-files.sh
  8. Return to the root of the build system:$ croot
  9. Start a build run for your device:
    $ brunch <device-name>
  10. Once complete, the ROM zip can be found in the out/ directory:$ cd /out/target/product/<device-codename>
  11. The flashable ROM zip (product of the build run) will be located in the out/ directory as:
    aopp-0.1-<build-date>-UNOFFICIAL-<device-codename>.zip

Flashing

  1. Download and install the command line tools for your OS: https://developer.android.com/studio/index.html#downloads
  2. Download the AOPP ROM for your device:
    https://wiki.pwnieexpress.com/index.php/Official_devices
  3. Download the Recovery image for your device:
    https://twrp.me/Devices
  4. Connect the device to the host machine via USB cable.
  5. Power off the device and boot into the Bootloader:
    Press and hold the Power & Volume-Down buttons
  6. Confirm the device is recognized by the host machine:
    (a device should be listed when the command returns)
    $ fastboot devices
  7. Unlock the device:
    $ fastboot oem unlock
  8. Once unlocked, flash the Recovery image:$ fastboot flash recovery <name-of-recovery-image>.img
  9. Once the Recovery image has been flashed, boot into Recovery from the Bootloader:
    Use the Volume-Down/Up buttons to cycle through the Bootloader options and then the Power button to select
  10. If prompted, swipe “Swipe to Allow Modifications”.
  11. Once in Recovery, wipe the device:
    Tap Wipe > Advanced Wipe > tap: Dalvik/ART cache, System, Cache, Data > swipe “Swipe to Wipe”
  12. Once wiped, do NOT boot into System (You don’t have one; you just wiped it). Tap the Home button to return to the Recovery home screen.
  13. Confirm again the device is recognized by the host machine:
    (a device should be listed when the command returns)$ adb devices
  14. From the host machine, push the downloaded AOPP ROM zip to the device sdcard:$ adb push <name-of-rom-zip>.zip /sdcard/
  15. On device, tap Install and then select the AOPP ROM zip from /sdcard.
  16. Swipe “Swipe to Confirm Flash”
  17. Download SuperSU from Chainfire here:
    https://download.chainfire.eu/969/SuperSU/UPDATE-SuperSU-v2.76-20160630161323.zip
  18. Push the SuperSU zip to /sdcard/:
    $ adb push <SuperSU-zip-name>.zip /sdcard/
  19. Once installed, tap “Reboot System”
  20. Hack the Gibson…and remember…hugs are worth more than handshakes

Source: pwnieexpress


Share:

Wednesday, January 27, 2016

Android Security Evaluation Framework - ASEF



Have you ever looked at your Android applications and wondered if they are watching you as well? Whether it’s a bandwidth-hogging app, aggressive adware or even malware, it would be interesting to know if they are doing more than what they are supposed to and if your personal information is exposed. Is there really a way to automatically evaluate all your apps – even hundreds of them – to harvest their behavioral data, analyze their run pattern, and at the same time provide an interface to facilitate a vast majority of evolving security tests with most practical solutions?




Android Security Evaluation Framework (ASEF) performs this analysis while alerting you about other possible issues. It will make you aware of unusual activities of your apps, will expose vulnerable components and help narrow down suspicious apps for further manual research. The framework will take a set of apps (either pre-installed on a device or as individual APK files) and migrate them to the test suite where it will run it through test cycles on a pre-configured Android Virtual Device (AVD).

Android Security Evaluation Framework

During the test cycles the apps will be installed and launched on the AVD. ASEF will trigger certain behaviors by sending random or custom gestures and later uninstall the app automatically. It will capture log events, network traffic, kernel logs, memory dump, running processes and other parameters at every stage which will later be utilized by the ASEF analyzer. The analyzer will try to determine the aggressive bandwidth usage, interaction with any command and control (C&C) servers using Google’s safe browsing API, permission mappings and known security flaws. ASEF can easily be integrated with other open source tools to capture sensitive information, such as SIM cards, phone numbers and others.



ASEF is an Open Source tool for scanning Android Devices for security evaluation. Users will gain access to security aspects of android apps by using this tool with its default settings. An advanced user can fine-tune this, expand upon this idea by easily integrating more test scenarios, or even find patterns out of the data it already collects. ASEF will provide automated application testing and facilitate a plug and play kind of environment to keep up with the dynamic field of Android Security.




Share:

Saturday, January 23, 2016

Mobile Terminal Application for Intermittent Connectivity - Mosh


Remote terminal application that allows roaming, supports intermittent connectivity, and provides intelligent local echo and line editing of user keystrokes. This is a replacement for SSH. It’s more robust and responsive, especially over Wi-Fi, cellular, and long-distance inks. Mosh is free software, available for GNU/Linux, FreeBSD, and Mac OS X.





Mosh is a remote terminal application that supports intermittent connectivity, allows roaming, and provides speculative local echo and line editing of user keystrokes.

Mobile Terminal Application: Mosh

It aims to support the typical interactive uses of SSH, plus: Mobile Terminal Application for 

ºMosh keeps the session alive if the client goes to sleep and wakes up later, or temporarily loses its Internet connection.
ºMosh allows the client and server to “roam” and change IP addresses, while keeping the connection alive. Unlike SSH, Mosh can be used while switching between Wi-Fi networks or from Wi-Fi to cellular data to wired Ethernet.
ºThe Mosh client runs a predictive model of the server’s behavior in the background and tries to guess intelligently how each keystroke will affect the screen state. When it is confident in its predictions, it will show them to the user while waiting for confirmation from the server. Most typing and uses of the left- and right-arrow keys can be echoed immediately.As a result, Mosh is usable on high-latency links, e.g. on a cellular data connection or spotty Wi-Fi. In distinction from previous attempts at local echo modes in other protocols, Mosh works properly with full-screen applications such as emacs, vi, alpine, and irssi, and automatically recovers from occasional prediction errors within an RTT. On high-latency links, Mosh underlines its predictions while they are outstanding and removes the underline when they are confirmed by the server.


Mosh does not support X forwarding or the non-interactive uses of SSH, including port forwarding.


Other features

ºadjusts its frame rate so as not to fill up network queues on slow links, so “Control-C” always works within an RTT to halt a runaway process.
ºwarns the user when it has not heard from the server in a while.
ºsupports lossy links that lose a significant fraction of their packets.
ºhandles some Unicode edge cases better than SSH and existing terminal emulators by themselves, but requires a UTF-8 environment to run.
ºleverages SSH to set up the connection and authenticate users. Mosh does not contain any privileged (root) code.

Usage

The mosh-client binary must exist on the user’s machine, and the mosh-server binary on the remote host.

The user runs:

$ mosh [user@]host

If the mosh-client or mosh-server binaries live outside the user’s $PATH, mosh accepts the arguments --client=PATH and --server=PATH to select alternate locations. More options are documented in the mosh(1) manual page.

There are more examples and a FAQ on the Mosh web site.

How it works

The mosh program will SSH to user@host to establish the connection. SSH may prompt the user for a password or use public-key authentication to log in.

From this point, mosh runs the mosh-server process (as the user) on the server machine. The server process listens on a high UDP port and sends its port number and an AES-128 secret key back to the client over SSH. The SSH connection is then shut down and the terminal session begins over UDP.

If the client changes IP addresses, the server will begin sending to the client on the new IP address within a few seconds.


To function, Mosh requires UDP datagrams to be passed between client and server. By default, moshuses a port number between 60000 and 61000, but the user can select a particular port with the -p option.




Share:

Tuesday, January 19, 2016

SIP Witch



SIP Witch


GNU SIP Witch is a secure peer-to-peer VoIP server that uses the SIP protocol. Calls can be made peer-to-peer behind NAT firewalls, and without needing a service provider. GNU SIP Witch supports using secure telephone extensions, for placing and receiving calls directly over the Internet, and intercept-free peer-to-peer audio and video extensions. GNU SIP Witch also is being introduced as a desktop VoIP mediation service to enable the construction of participatory bottom-up secure calling networks and to enable replacement of Skype with free software and published protocols. As a desktop mediation service, GNU SIP Witch can solve issues like NAT in one place for all user agents, and offer new ways to route and redirect VoIP much like gstreamer does for desktop media.

GNU Bayonne is the telephony server of GNU Telephony and the GNU Project. The production release of GNU Bayonne 1 is 1.2.15 and has a long history in production telecommunication environments. GNU Bayonne supports IVR scripting using hardware from Voicetronix, Dialogic, Aculab, CAPI drivers, and Quicklink drivers under GNU/Linux. GNU Bayonne 1 can integrate perl and python applications, and has been commercially deployed in production use for several years. Future releases of GNU Bayonne will be based on ucommon and will further explore it’s role as a Telephony integration server.

GNU SIP Witch is a call and registration server for the SIP protocol. As a call server it services call registration for SIP devices and destination routing through SIP gateways. GNU SIP Witch does not perform codec operations or media proxying and thereby enables SIP endpoints to directly peer negotiate call setting and process peer to peer media streaming even when when multiple SIP Witch call nodes at multiple locations are involved. This means GNU SIP Witch operates without introducing additional media latency or offering a central point for media capture.

GNU SIP Witch is designed to support network scaling of telephony services, rather than the heavily compute-bound solutions we find in use today. This means a call node has a local authentication/registration database, and this will be mirrored, so that any active call node in a cluster will be able to accept and service a call. This allows for the possibility of live failover support in the future as well.

GNU SIP Witch is not a SIP “router”, and does not try to address the same things as a project like iptel “Ser”. GNU SIP Witch is being designed to create on-premise SIP telephone systems, telecenter servers, and Internet hosted SIP telephone systems. One important feature will include use of URI routing to support direct peer to peer calls between service domains over the public internet without needing mediation of an intermediary “service provider” so that people can publish and call sip: uri’s unconstrained. GNU SIP Witch is about freedom to communicate and the removal of artifical barriers and constraints whether imposed by monopoly service providers or by governments.



Share:
Copyright © Offensive Sec Blog | Powered by OffensiveSec
Design by OffSec | Theme by Nasa Records | Distributed By Pirate Edition