Thursday, 23 April 2020

Adamantium-Thief - Decrypt Chromium Based Browsers Passwords, Cookies, Credit Cards, History, Bookmarks

Get chromium browsers: passwords, credit cards, history, cookies, bookmarks.
Chrome 80 > is supported!

Examples:

Get passwords from browsers:
Stealer.exe PASSWORDS


Get credit cards from browsers:
Stealer.exe CREDIT_CARDS


Get history from browsers:
Stealer.exe HISTORY


Get bookmarks from browsers:
Stealer.exe BOOKMARKS


Get cookies from browsers:
Stealer.exe COOKIES


Browsers list:
  • Google Chrome
  • Opera
  • Chromium
  • Brave-Browser
  • Epic Privacy Browser
  • Amigo
  • Vivaldi
  • Orbitum
  • Atom
  • Kometa
  • Comodo Dragon
  • Torch
  • Slimjet
  • 360Browser
  • Maxthon3
  • K-Melon
  • Sputnik
  • Nichrome
  • CocCoc Browser
  • Uran
  • Chromodo
  • Yandex (old)




via KitPloitRead more

Brutality: A Fuzzer For Any GET Entries

Brutalitys' Features
  • Multi-threading on demand.
  • Fuzzing, bruteforcing GET params.
  • Find admin panels.
  • Colored output.
  • Hide results by return code, word numbers.
  • Proxy support.
  • Big wordlist.
Screenshots:

Brutality's Installtion

How to use Brutality?

Examples:
   Use default wordlist with 5 threads (-t 5) and hide 404 messages (–e 404) to fuzz the given URL (http://192.168.1.1/FUZZ):
python brutality.py -u 'http://192.168.1.1/FUZZ' -t 5 -e 404

   Use common_pass.txt wordlist (-f ./wordlist/common_pass.txt), remove response with 6969 length (-r 6969) and proxy at 127.0.0.1:8080 (-p http://127.0.0.1:8080) to fuzz the given URL (http://192.168.1.1/brute.php?username=admin&password=FUZZ&submit=submit#):
python brutality.py -u 'http://192.168.1.1/brute.php?username=admin&password=FUZZ&submit=submit#' -f ./wordlist/common_pass.txt -r 6969 -p http://127.0.0.1:8080

ToDo List:
  • Smooth output.
  • Export file report.
  • Modularization.

Related word

Parrot Security OS 4.7 Released With New Linux Kernel, Menu Structure, Tools Improvements And Many Changes


In Sep 18 2019, Parrot Security OS 4.7 has released, with many new following changes below.

Latest Linux 5.2.x series
   The new ISO files of Parrot 4.7 are being released only now, but we were the first Debian derivative distribution to introduce Linux 5.1 and 5.2 to all our users, and now ParrotSec team is ready to offer it also with our ISO files rebild cycle to support more devices and integrate all the latest linux features from the beginning.

New sandbox behavior (opt-in rather than opt-out)
   Sandboxing is a great thing, and ParrotSec team was in the first line when they introduced our custom Firejail and AppArmor solution for the first time many years ago. We still want to improve such feature and ParrotSec team has a whole team dedicated to improve sandboxing and hardening of the Parrot Security OS system, but ParrotSec team had to face the many users with issues caused by the restrictions of our sandbox.

   In Parrot Security OS 4.7 the sandbox is disabled by default, and users can decide wether to start an application sandboxed or not. You can easily start the sandboxed version of an installed program from the /sandbox/ folder or from a dedicated menu that ParrotSec team plans to improve in the future (meanwhile the search feature of the bottom menu will fit all your needs), or you can re-enable it by default by using the firecfg tool.

New menu structure and tools improvements
   The pentesting menu structure was refactored and re-designed to make tools easier to access in a more logical hierarchical structure. New tools were also added to the project, and ParrotSec team plans to add even more in the future. Not all of them are going to be pre-installed, but a good set of tools in our repository enables pentesters to build up the perfect pentest system for their specific needs, regardless the default package selection picked by ParrotSec team.

Domain changes
   To reflect the neutrality of a distro that started as a pentest-only system and became more general purpose later with Parro Home, the community voted through a democratic process to switch to parrotlinux.org as the new default domain of the project.

   ParrotSec team will still use ParrotSec.org for other things (included the old email addresses), and they introduced other project domains to handle specific parts of the infrastructure.

Repository changes
   ParrotSec team is preparing to integrate a future LTS branch, so they decided to rename the current repository from stable to rolling. Nothing changes for the end user, and the current Parrot Security OS branch will continue to behave the same as before, but now with a different name to better reflect the rolling release nature of the system, waiting for the LTS edition to join the Parrot Security OS family along side the rolling branch in a similar way OpenSUSE does.

New MATE 1.22 release: Parrot Security OS 4.7 ships with the latest MATE 1.22 desktop environment.

Miscellaneous: New Firefox Browser 69, the latest Radare2 and cutter versions and many other important upgrades are all aboard as expected in a properly developed rolling release distro.

How to upgrade to the lastest Parrot Security OS version
   You can update your existing Parrot Security OS system with this command:
sudo parrot-upgrade

   Or use the raw apt command
sudo apt update
sudo apt full-upgrade


   Don't forget to use this command regularly (at least once a week) to receive the latest security updates and bugfixes from the Parrot Security OS repository.

   Or you can download the latest release from official download page.

Related news

OWASP May Connector 2019

OWASP
Connector
May 2019

COMMUNICATIONS


Letter from the Vice Chairman:

Dear OWASP Community,

Since last month the foundation has been busy working towards enabling our project leaders and community members to utilize funds to work on nurturing and developing projects. So far there has been huge uptake on this initiative. It's great to see so many people passionate about collaborating at project summits. 
 
Our Global AppSec Tel-Aviv is nearly upon us, for members, there is an extra incentive for attending this conference, in the form of a significant discount. This and the sandy beaches and beautiful scenery, not to mention the great speakers and trainers we have lined up, is a great reason to attend. If you have not done so we would encourage you to attend this great conference - https://telaviv.appsecglobal.org.
 
One of the key things I've noticed in my Board of Director tenure is the passion our community emits, sometimes this passion aids in growing the foundation, but sometimes it also forces us to take a step back and look at how we do things within the foundation. With Mike, our ED and staff we have seen a lot of good change from an operations perspective, with more in the pipeline. Mike's appointment has allowed the Board of Directors to take a step back from operations and enable us to work on more strategic goals. To this end at a recent Board meeting we discussed each Board member taking up one of the following strategic goals, as set out at the start of the year:
 
1.Marketing the OWASP brand 
2.Membership benefits
3.Developer outreach

  • Improve benefits 
  • Decrease the possibility of OWASP losing relevance
  • Reaching out to management and Risk levels
  • Increase involvement in new tech/ ways of doing things – dev ops
 
4.Project focus 
  • Get Universities involved
  • Practicum sponsored ideas
  • Internships 

 
5.Improve finances
6.Improve OWAP/ Board of Directors Perception
7.Process improvement
8. Get consistent ED
9.Community empowerment
 
I would encourage the community to come forward if you have any ideas on the above and are happy to work with one of the 7 Board of Directors and community members on one of these initiatives. 
 
Thanks and best wishes, 
Owen Pendlebury
Vice Chair

OWASP FOUNDATION UPDATE FROM INTERIM EXECUTIVE DIRECTOR:

OWASP Foundation welcomes aboard Emily Berman as Events Director. Emily was most recently with the Scrum Alliance where she planned high-profile functions for upwards of 2,000 guests. Emily brings a fresh approach to events planning and her 12 years of experience planning and organizing large-scale events worldwide well in advance will greatly benefit our Global AppSecs.
Did you Register yet? 
Global AppSec DC September 9-13, 2019
submit to the Call for Papers and Call for Training
Check out Sponsorship Opportunities while they are still available.
Save the Date for Global AppSec Amsterdam Sept 23-27, 2019 
Sponsorship Opportunities are available

EVENTS 

You may also be interested in one of our other affiliated events:

REGIONAL AND LOCAL EVENTS

Event DateLocation
Latam Tour 2019 Starting April 4, 2019 Latin America
OWASP Portland Training Day September 25, 2019 Portland, OR
OWASP Italy Day Udine 2019 September 27,2019 Udine, Italy
OWASP Portland Day October 16,2019 Wroclaw, Poland
LASCON X October 24-25,2019 Austin, TX
OWASP AppSec Day 2019 Oct 30 - Nov 1, 2019 Melbourne, Australia

PARTNER AND PROMOTIONAL EVENTS
Event Date Location
Open Security Summit June 3-7,2019 Woburn Forest Center Parcs, Bedfordshire
Hack in Paris 2019 June 16-20, 2019 Paris
Cyber Security and Cloud Expo Europe June 19-20, 2019 Amsterdam
IoT Tech Expo Europe June 19-20, 2019 Amsterdam
BlackHat USA 2019 August 3-8,2019 Las Vegas, Nevada
DefCon 27 August 8-11,2019 Las Vegas, Nevada
it-sa-IT Security Expo and Congress October 8-10, 2019 Germany

PROJECTS

We have had the following projects added to the OWASP inventory.  Please congratulate these leaders and check out the work they have done:

Project Type Leader(s)
Risk Assessment Framework Documentation Ade Yoseman Putra, Rejah Rehim
QRLJacker Tool Mohammed Baset
Container Security Verification Standard Documentation Sven Vetsch
Find Security Bugs Code Philippe Arteau
Vulnerable Web Application Code Fatih Çelik
D4N155 Tool Julio Pedro de Lira Neto
Jupiter Tool Matt Stanchek
Top 10 Card Game Documentation Dennis Johnson
Samurai WTF Code Kevin Johnson
DevSecOps Maturity Model Documentation Timo Pagel

 


Also, we will have the following projects presenting at the Project Showcase Global AppSec Tel Aviv:

Final Schedule
Wednesday, May 29th Thursday, May 30th
Time Project Presenter(s) Confirmed Time Project Presenter(s) Confirmed
10:​4​5 a.m. Glue Tool Omer Levi Hevroni Yes 10:​30 ​ a.m. API Security Erez Yalon, Inon Shkedy Yes
  ​7    
               
11:5​5​ a.m. IoT & Embedded AppSec Aaron Guzman Yes 11:​50​ a.m. Mod Security Core Rule Set Tin Zaw Yes
        12:​25 ​p.m. Automated Threats Tin Zaw Yes
12:​30 ​p.m. Lunch Break   12:​55​ p.m. Lunch Break  
2:​35​ p.m. SAMM John DiLeo Yes        
​3:10​ p.m. Application Security Curriculum John DiLeo Yes ​3:10 p.m. ​Damned Vulnerable Serveless Application​ ​Tal Melamed​ ​Yes​
 

Finally, if you are able to help participate in the Project Reviews at the Conference, please send me an email at harold.blankenship@owasp.com.  We have a large line-up of projects to review this time around:

Project To Level Leader(s)
Snakes and Ladders Flagship Katy Anton, Colin Watson
Cheat Sheet Series Flagship Dominique Righetto, Jim Manico
Mobile Security Testing Guide Flagship Jeroen Willemsen, Sven Schleier
Amass Lab Jeff Foley
Attack Surface Detector Lab Ken Prole
SecureTea Lab Ade Yoseman Putra, Bambang Rahmadi K.P, Rejah Rehim.A.A
Serverless Goat Lab Ory Segal

Google Summer of Code Update:
We were allocated 13 students this year!  The current timeline is as follows:
Google Season of Docs:
We were accepted into the Google Season of Docs.  There will be a single technical writer resource.  The current timeline is as follows:

COMMUNITY

New OWASP Chapters
Riyadh, Saudi Arabia
Guayaquil, Equador
Lome, Togo
Natal, Brazil
Nashua, New Hampshire
Gwalior, India
Louisville, Kentucky
Nainital, India
Liverpool, United Kingdom
Syracuse, New York

MEMBERSHIP

 
We would like to welcome the following Premier and Contributor Corporate Members.

Premier Corporate Members

Contributor Corporate Members
Join us
Donate
Our mailing address is:
OWASP Foundation 
1200-C Agora Drive, # 232
Bel Air, MD 21014  
Contact Us
Unsubscribe






This email was sent to *|EMAIL|*
why did I get this?    unsubscribe from this list    update subscription preferences
*|LIST:ADDRESSLINE|*