2,898 reputation
1715
bio website
location
age
visits member for 2 years, 4 months
seen 2 mins ago

5h
comment Metasploit new exploits failed
The msfconsole output already displays the version. You can manually run version command as well. Run msfupdate to pull down the latest version.
2d
awarded  Revival
Jul
1
answered How does process migration work in Meterpreter
Jun
27
comment How do cryptographic algorithms help hackers to bypass Antivirus software?
There is no difference between an exe and an ASCII file as far as encryption algorithms are concerned. If you have studied AES, you will know the input is 16 bytes of data. This data could be anything: ASCII text, binary blobs from an exe file, anything. So encrypting an exe is the same as encryption any other type of data. For decryption, the decryption routine is executed first in memory and that is why AVs fail to detect it. The signature engine check the file BEFORE execution and not during execution.
Jun
27
reviewed Approve Client misunderstanding nmap
Jun
27
comment How do cryptographic algorithms help hackers to bypass Antivirus software?
For a computer system everything is a binary blob. If you have seen cryptography applied to a text file and all its contents have changed (encrypted), apply the same crypto to an executable binary blob and surely everything will change. AV signatures won't work. The only difference is you will attack the decryption stub to the start of the exe (the initial entry point) so that the encrypted payload is encrypted at runtime for execution.
Jun
25
comment Nil events in IPS reports today
A lot of times FUD (fear, uncertainty, doubt) reports get a lot of attention. It is good someone is giving advice based upon common sense. One thing I am curios about: OP is getting just 1-2 IPS events per day. We get like ~100 per hour.
Jun
23
comment Metasploit reverse_http(s) PAYLOAD for linux target
I think the reason of not choosing reverse_http(s) is due to the large size of the payload. If reverse_http(s) can be selected with the exploit (outside BAP), OP should be able to select those payloads within BAP as well. If not, then BAP won't show those payloads since it selects from compatible payloads.
Jun
21
reviewed Approve Is it Safe to Send an Invalid Password Back to the Client?
Jun
20
comment Is there a way to use VirusTotal.com offline?
VirusTotal is nothing more than a collection of all the AV engines that tests a submitted file. If you want to setup offline scans, you can configure VMs or docker images for the AVs you want to test against. The point and advantage of VT is all due to it being online since updates are pushed in real time. If there was presumably an offline version (there isn't any), it would be off little use anyway.
Jun
15
answered What is “Gateway Host Probe”?
Jun
10
revised Does Server Mistrust improve security?
deleted 8 characters in body; edited title
Jun
3
comment How do you deal with personal security issues?
Considering that the OP don't have any idea what is going on, wiping or changing the OS might be a short term solution but he can get infected once again. Also, someone with big capital have other means to track personal movements.
Jun
1
comment Metasploit SSH Error: could not settle on kex algorithm
@dylan7 The supported Kex (Key Exchange algorithms) are defined at github.com/rapid7/metasploit-framework/blob/master/lib/net/ssh/…. If you could manually look at what kex algorithms are needed for the SSH server, we could add it to the supported algorithms list. A standard SSH server should be able to negotiate with these algorithms; however in your case I think the SSH server is either too outdated or configured only with specific algorithms. The list of supported kex should be in the ssh_config file.
May
31
comment Metasploit SSH Error: could not settle on kex algorithm
Could you use the Metasploit modules directly (outside Cobalt Strike) so that it is confirmed that the error is related to the Metasploit framework and not some default config in CS?
May
28
comment Linux Kernel module signing
If you don't have battery then all certificate validation will fail and not just kernel modules. Every HTTPS site you visit will display the non-validation warning. I suppose at this stage your problem is not that of kernel module warning but fixing the motherboard.
May
27
comment What causes a powershell payload to run the first time but not the second?
Much has changed in the world of Metasploit payloads. Can you generate the payload through msfvenom and then run it on the target machine through powersploit or any other means?
May
22
reviewed Approve When using LUKS, which parts of the hard disk are not encrypted?
May
22
reviewed Approve If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
May
18
comment How does an attacker know when he has the password?
if hash(pAssword) == obtained_hash, then pAssword is the password. Else if hash(passwoRd) == obtained_hash, then passwoRd is the password and so on unless you get hash(x) == obtained_hash or you run out of choices.