SECURITY EDUCATION, PRIVACY GUIDANCE, THREAT AWARENESS, OPEN SOURCE TOOLS, RESEARCH NOTES, AND RESPONSIBLE TECHNOLOGY CONTENT

  • Penetration Testing Distribution - BackBox

    BackBox is a penetration test and security assessment oriented Ubuntu-based Linux distribution providing a network and informatic systems analysis toolkit. It includes a complete set of tools required for ethical hacking and security testing...
  • Pentest Distro Linux - Weakerth4n

    Weakerth4n is a penetration testing distribution which is built from Debian Squeeze.For the desktop environment it uses Fluxbox...
  • The Amnesic Incognito Live System - Tails

    Tails is a live system that aims to preserve your privacy and anonymity. It helps you to use the Internet anonymously and circumvent censorship...
  • Penetration Testing Distribution - BlackArch

    BlackArch is a penetration testing distribution based on Arch Linux that provides a large amount of cyber security tools. It is an open-source distro created specially for penetration testers and security researchers...
  • The Best Penetration Testing Distribution - Kali Linux

    Kali Linux is a Debian-based distribution for digital forensics and penetration testing, developed and maintained by Offensive Security. Mati Aharoni and Devon Kearns rewrote BackTrack...
  • Friendly OS designed for Pentesting - ParrotOS

    Parrot Security OS is a cloud friendly operating system designed for Pentesting, Computer Forensic, Reverse engineering, Hacking, Cloud pentesting...

Sunday, January 17, 2016

10 Estratégias de Manipulação da Mídia



10 Estratégias de Manipulação Midiática


Assista o Vídeo:






1- A ESTRATÉGIA DA DISTRAÇÃO

O elemento primordial do controle social é a estratégia da distração que consiste em desviar a atenção do público dos problemas importantes e das mudanças decididas pelas elites políticas e econômicas, mediante a técnica do dilúvio ou inundações de contínuas distrações e de informações insignificantes. A estratégia da distração é igualmente indispensável para impedir ao público de interessar-se pelos conhecimentos essenciais, na área da ciência, da economia, da psicologia, da neurobiologia e da cibernética. Manter a atenção do público distraída, longe dos verdadeiros problemas sociais, cativada por temas sem importância real. Manter o público ocupado, ocupado, ocupado, sem nenhum tempo para pensar; de volta à granja como os outros animais (citação do texto 'Armas silenciosas para guerras tranqüilas').

2- CRIAR PROBLEMAS, DEPOIS OFERECER SOLUÇÕES

Este método também é chamado problema-reação-solução. Cria-se um problema, uma situação prevista para causar certa reação no público, a fim de que este seja o mandante das medidas que se deseja fazer aceitar. Por exemplo: deixar que se desenvolva ou se intensifique a violência urbana, ou organizar atentados sangrentos, a fim de que o público seja o mandante de leis de segurança e políticas em prejuízo da liberdade. Ou também: criar uma crise econômica para fazer aceitar como um mal necessário o retrocesso dos direitos sociais e o desmantelamento dos serviços públicos.

3- A ESTRATÉGIA DA GRADAÇÃO

Para fazer com que se aceite uma medida inaceitável, basta aplicá-la gradativamente, a conta-gotas, por anos consecutivos. É dessa maneira que condições socioeconômicas radicalmente novas (neoliberalismo) foram impostas durante as décadas de 1980 e 1990: Estado mínimo, privatizações, precariedade, flexibilidade, desemprego em massa, salários que já não asseguram ingressos decentes, tantas mudanças que haveriam provocado uma revolução se tivessem sido aplicadas de uma só vez.

4- A ESTRATÉGIA DO DEFERIDO

Outra maneira de se fazer aceitar uma decisão impopular é a de apresentá-la como sendo dolorosa e necessária, obtendo a aceitação pública, no momento, para uma aplicação futura. É mais fácil aceitar um sacrifício futuro do que um sacrifício imediato. Primeiro, porque o esforço não é empregado imediatamente. Em seguida, porque o público, a massa, tem sempre a tendência a esperar ingenuamente que tudo irá melhorar amanhã e que o sacrifício exigido poderá ser evitado. Isto dá mais tempo ao público para acostumar-se com a idéia de mudança e de aceitá-la com resignação quando chegue o momento.

5- DIRIGIR-SE AO PÚBLICO COMO CRIANÇAS DE BAIXA IDADE

A maioria da publicidade dirigida ao grande público utiliza discurso, argumentos, personagens e entonação particularmente infantis, muitas vezes próximos à debilidade, como se o espectador fosse um menino de baixa idade ou um deficiente mental. Quanto mais se intente buscar enganar ao espectador, mais se tende a adotar um tom infantilizante. Por quê? Se você se dirige a uma pessoa como se ela tivesse a idade de 12 anos ou menos, então, em razão da sugestionabilidade, ela tenderá, com certa probabilidade, a uma resposta ou reação também desprovida de um sentido crítico como a de uma pessoa de 12 anos ou menos de idade.

6- UTILIZAR O ASPECTO EMOCIONAL MUITO MAIS DO QUE A REFLEXÃO

Fazer uso do aspecto emocional é uma técnica clássica para causar um curto circuito na análise racional, e por fim ao sentido critico dos indivíduos. Além do mais, a utilização do registro emocional permite abrir a porta de acesso ao inconsciente para implantar ou enxertar idéias, desejos, medos e temores, compulsões, ou induzir comportamentos...

7- MANTER O PÚBLICO NA IGNORÂNCIA E NA MEDIOCRIDADE

Fazer com que o público seja incapaz de compreender as tecnologias e os métodos utilizados para seu controle e sua escravidão. A qualidade da educação dada às classes sociais inferiores deve ser a mais pobre e medíocre possível, de forma que a distância da ignorância que paira entre as classes inferiores às classes sociais superiores seja e permaneça impossíveis para o alcance das classes inferiores.

8- ESTIMULAR O PÚBLICO A SER COMPLACENTE NA MEDIOCRIDADE

Promover ao público a achar que é moda o fato de ser estúpido, vulgar e inculto...

9- REFORÇAR A REVOLTA PELA AUTOCULPABILIDADE

Fazer o indivíduo acreditar que é somente ele o culpado pela sua própria desgraça, por causa da insuficiência de sua inteligência, de suas capacidades, ou de seus esforços. Assim, ao invés de rebelar-se contra o sistema econômico, o individuo se auto-desvalida e culpa-se, o que gera um estado depressivo do qual um dos seus efeitos é a inibição da sua ação. E, sem ação, não há revolução!

10- CONHECER MELHOR OS INDIVÍDUOS DO QUE ELES MESMOS SE CONHECEM

No transcorrer dos últimos 50 anos, os avanços acelerados da ciência têm gerado crescente brecha entre os conhecimentos do público e aquelas possuídas e utilizadas pelas elites dominantes. Graças à biologia, à neurobiologia e à psicologia aplicada, o sistema tem desfrutado de um conhecimento avançado do ser humano, tanto de forma física como psicologicamente. O sistema tem conseguido conhecer melhor o indivíduo comum do que ele mesmo conhece a si mesmo. Isto significa que, na maioria dos casos, o sistema exerce um controle maior e um grande poder sobre os indivíduos do que os indivíduos a si mesmos.

Source: Noam Chomsky


By OffensiveSec
Share:

Project Arsenal X - As HackTheGame But Real



Project Arsenal X

New version of my Arsenal X written in Delphi with the following options:


[+] Gmail Inbox
[+] Whois Client
[+] Table
[+] Downloader
[+] Get IP
[+] Locate IP
[+] K0bra SQLI Scanner
[+] Crack multiple hashes
[+] Search admin panel
[+] Port Scanner
[+] Multi Cracker with support for FTP, TELNET, POP3
[+] Execution of commands in the console

An video :





Share:

Saturday, January 16, 2016

RAT - Dendroid



Obs. I am not responsible for his actions, all links found on the internet.


A botnet is a collection of Internet-connected programs communicating with other similar programs in order to perform tasks which can be controlled from anywhere by remotely accessing the panel of the server system. This can be as mundane as keeping control of an Internet Relay Chat (IRC) channel, or it could be used to send spam email or participate in distributed denial-of-service attacks and do other things like cypto currency mining and stealing informations. The term is usually used with a negative or malicious connotation.


This one “Dendroid” which is a botnet especially developed for attacking android user’s which has the functionalities like

Media volume up/down
Ringer volume up/down
Screen On
Which can turn on screen remotely
Record Calls
Block SMS
Record Audio
Take Video
Take Photo
Send Text
Send Contacts
Get user accounts

Which can get the user accounts that are being used in that mobile

Call Number
Delete Call Logs
Open Webpage
Update the app
Delete Files ( audio, video, pictures, calls )
Get Browser History
Get Browser Bookmarks
Get Call History
Open Dialog Box
Get Inbox SMS
HTTP flood



Share:

Friday, January 15, 2016

We Are Legion - The Story of the Hacktivists Documentary



A documentary on the workings and beliefs of the self-described "hacktivist" collective, Anonymous.





By OffensiveSec
Share:

TPB AFK - The Pirate Bay Away From Keyboard




An intellectual freedoms documentary based around the interpersonal triumphs, and defeats of the three main characters against the largest industry in the known universe. The media industry.






By OffensiveSec
Share:

DEFCON - The Full Documentary



A film about the world's largest hacking convention and its 20th year running. Filmed over the summer of 2012 and containing hundreds of hours of interviews, parties, presentations and spectacle.
Over 280 hours of footage was recorded in support of the documentary, and five separate camera crews were in action.

Directed by Jason Scott with camerawork by Eddie Codel, Alex Buie, Drew Wallner, Rick Dakan, Steve Fish, Kyle Way and Rachel Lovinger. 
Produced by Jeff Moss and Russ Rogers.




By OffensiveSec
Share:

Hacker Documentary - Hackers Are People Too




Hackers do laundry. Hackers like movies. Hackers are people and could be your neighbors, your brother, your friends. Presenting a portrait of the hacking community, created by the community themselves, this film breaks down negative stereotypes by letting hackers show you that they are really no different from anyone else. Delving into areas such as the way hackers think, what is hacking, hackers in the media, and women in the security/hacking field, this film will have you questioning your ideas about what a 'hacker' really is.





By OffensiveSec
Share:

Revolution OS - Documentary about the Linux System (legended in portuguese)



Synopsis

The film begins with glimpses of Raymond, a Linux IPO, Torvalds, the idea of Open Source, Perens, Stallman, then sets the historical stage in the early days of hackers and computer hobbyists when code was shared freely. It discusses how change came in 1978 as Bill Gates, in his Open Letter to Hobbyists, pointedly prodded hobbyists to pay up. Stallman relates his struggles with proprietary software vendors at the MIT Artificial Intelligence Lab, leading to his departure to focus on the development of free software, and the GNU project.

Torvalds describes the development of the Linux kernel, the GNU/Linux naming controversy, Linux's further evolution, and its commercialization.

Raymond and Stallman clarify the philosophy of free software versus communism and capitalism, as well as the development stages of Linux.

Michael Tiemann discusses meeting Stallman in 1987, getting an early version of Stallman's GCC, and founding Cygnus Solutions.

Larry Augustin describes combining GNU software with a normal PC to create a Unix-like workstation at one third the price and twice the power of a Sun workstation. He relates his early dealings with venture capitalists, the eventual capitalization and commodification of Linux for his own company, VA Linux, and its IPO.

Brian Behlendorf, one of the original developers of the Apache HTTP Server, explains that he started to exchange patches for the NCSA web server daemon with other developers, which led to the release of "a patchy" webserver, dubbed Apache.

Frank Hecker of Netscape discusses the events leading up to Netscape's executives releasing the source code for Netscape's browser, one of the signal events which made open source a force to be reckoned with by business executives, the mainstream media, and the public at large.[1] This point was validated further after the film's release as the Netscape source code eventually became the Firefox web browser, reclaiming a large percentage of market share from Microsoft's Internet Explorer.

The film also documents the scope of the first full-scale LinuxWorld Summit conference, with appearances by Linus Torvalds and Larry Augustin on the keynote stage.


Much of the footage for the film was shot in Silicon Valley.





By OffensiveSec
Share:

SimplyEmail - Email Recon Made Fast And Easy, With A Framework To Build On



What is the simple email recon tool? This tool was based off the work of theHarvester and kind of a port of the functionality. This was just an expansion of what was used to build theHarvester and will incorporate his work but allow users to easily build Modules for the Framework. Which I felt was desperately needed after building my first module for theHarvester.

Scrape EVERYTHING - Simply

Current Platforms Supported:
  • Kali Linux 2.0
  • Kali Linux 1.0
A few small benefits:
  • Easy for you to write modules (All you need is 1 required Class option and you're up and running)
  • Use the built in Parsers for most raw results
  • Multiprocessing Queue for modules and Result Queue for easy handling of Email data
  • Simple intergration of theHarvester Modules and new ones to come
  • Also the ability to change major settings fast without diving into the code
API Based Searches:
  • When API based searches become avaliable, no need to add them to the Command line
  • API keys will be auto pulled from the SimpleEmail.ini, this will activate the module for use

Get Started

Please RUN the simple Setup Bash script!!!


root@kali:~/Desktop/SimplyEmail# sh Setup.sh
or
root@kali:~/Desktop/SimplyEmail# ./Setup.sh

Standard Help
 ============================================================
Curent Version: 0.5 | Website: CyberSyndicates.com
============================================================
Twitter: @real_slacker007 | Twitter: @Killswitch_gui
============================================================
------------------------------------------------------------
______ ________ __ __
/ \/ | / / |
/$$$$$$ $$$$$$$$/ _____ ____ ______ $$/$$ |
$$ \__$$/$$ |__ / \/ \ / \/ $$ |
$$ \$$ | $$$$$$ $$$$ |$$$$$$ $$ $$ |
$$$$$$ $$$$$/ $$ | $$ | $$ |/ $$ $$ $$ |
/ \__$$ $$ |_____$$ | $$ | $$ /$$$$$$$ $$ $$ |
$$ $$/$$ $$ | $$ | $$ $$ $$ $$ $$ |
$$$$$$/ $$$$$$$$/$$/ $$/ $$/ $$$$$$$/$$/$$/

------------------------------------------------------------
usage: SimplyEmail.py [-all] [-e company.com] [-l] [-t html / flickr / google]
[-v]

Email enumeration is a important phase of so many operation that a pen-tester
or Red Teamer goes through. There are tons of applications that do this but I
wanted a simple yet effective way to get what Recon-Ng gets and theHarvester
gets. (You may want to run -h)

optional arguments:
-all Use all non API methods to obtain Emails
-e company.com Set required email addr user, ex ale@email.com
-l List the current Modules Loaded
-t html / flickr / google
Test individual module (For Linting)
-v Set this switch for verbose output of modules

Run SimplyEmail

Let's say your target is cybersyndicates.com


./SimplyEmail.py -all -e cybersyndicates.com  or in verbose  ./SimplyEmail.py -all -v -e cybersyndicates.com

This will run ALL modules that are have API Key placed in the SimpleEmail.ini file and will run all non-API based modules.

List Modules SimpleEmail


root@vapt-kali:~/Desktop/SimplyEmail# ./SimplyEmail.py -l

============================================================
Curent Version: 0.5 | Website: CyberSyndicates.com
============================================================
Twitter: @real_slacker007 | Twitter: @Killswitch_gui
============================================================
------------------------------------------------------------
______ ________ __ __
/ \/ | / / |
/$$$$$$ $$$$$$$$/ _____ ____ ______ $$/$$ |
$$ \__$$/$$ |__ / \/ \ / \/ $$ |
$$ \$$ | $$$$$$ $$$$ |$$$$$$ $$ $$ |
$$$$$$ $$$$$/ $$ | $$ | $$ |/ $$ $$ $$ |
/ \__$$ $$ |_____$$ | $$ | $$ /$$$$$$$ $$ $$ |
$$ $$/$$ $$ | $$ | $$ $$ $$ $$ $$ |
$$$$$$/ $$$$$$$$/$$/ $$/ $$/ $$$$$$$/$$/$$/

------------------------------------------------------------
[*] Available Modules are:

1) Modules/GooglePDFSearch.py
2) Modules/HtmlScrape.py
3) Modules/GitHubUserSearch.py
4) Modules/Whoisolgy.py
5) Modules/CanaryBinSearch.py
6) Modules/YahooSearch.py
7) Modules/GitHubCodeSearch.py
8) Modules/OnionStagram.py
9) Modules/AskSearch.py
10) Modules/EmailHunter.py
11) Modules/WhoisAPISearch.py
12) Modules/SearchPGP.py
13) Modules/GoogleSearch.py
14) Modules/GitHubGistSearch.py
15) Modules/RedditPostSearch.py
16) Modules/FlickrSearch.py


Understanding Reporting Options:

One of the most frustrating aspects of Pen-testing is the tools' ability to report the findings and make those easily readable. This may be for the data provided to a customer or just the ability to report on source of the data.
So I'm making it my goal for my tools to take that work off your back and make it as simple as possible! Let's cover the two different reports generated.

Text Output:

With this option results are generated and appended to a running text file called Email_List.txt. this makes it easy to find past searches or export to tool of choice. 

Example:
    ----------------------------------
    Email Recon: 11/11/2015 05:13:32
----------------------------------
bo@mandiant.com
in@mandiant.com
sc@mandiant.com
je@mandiant.com
su@mandiant.com
----------------------------------
Email Recon: 11/11/2015 05:15:42
----------------------------------
bo@mandiant.com
in@mandiant.com
sc@mandiant.com
je@mandiant.com
su@mandiant.com

HTML Output:

As I mentioned before a powerful function that I wanted to integrate was the ability to produce a visually appealing and rich report for the user and potentially something that could be part of data provided to a client. Please let me know with suggestions!

Email Source:


Email Section:
  • Html report now shows Alerts for Canary Search Results! 


Current Email Evasion Techniques
  • The following will be built into the Parser Soon:
  • shinichiro.hamaji at gmail.com
  • shinichiro.hamaji AT gmail.com
  • simohayha.bobo at gmail.com
  • "jeffreytgilbert" => "gmail.com"
  • felix021 # gmail.com
  • hirokidaichi[at]gmail.com
  • hirokidaichi[@]gmail.com
  • hirokidaichi[#]gmail.com
  • xaicron{ at }gmail.com
  • xaicron{at}gmail.com
  • xaicron{@}gmail.com
  • xaicron(@)gmail.com
  • xaicron + gmail.com
  • xaicron ++ gmail.com
  • xaicron ## gmail.com
  • bekt17[@]gmail.com
  • billy3321 -AT- gmail.com
  • billy3321[AT]gmail.com
  • ybenjo.repose [[[at]]] gmail.com
  • sudhindra.r.rao (at) gmail.com
  • sudhindra.r.rao nospam gmail.com
  • shinichiro.hamaji (.) gmail.com
  • shinichiro.hamaji--at--gmail.com

Build Log:

Changelog (Current v0.6):

===================================
Framework Improvements v0.7:
-----------------------------
(x) Add unicode / UT8 Decoding to the parser options
(x) Added Version Check

Modules Added in v0.7
-----------------------------
(x) Google Docx Search

Issues Fixed in v0.7:
-----------------------------
(x) Fixed issues with Except statement in a few modules
(x) Fixed Case Mathcing Issues with target Domain

===================================
Modules Added in v0.6
-----------------------------
(x) Google Doc Search
(x) Google Xlsx Search

===================================
Modules Added in v0.5
-----------------------------
(x) Reddit Post Search added
(x) Google PDF search

===================================
Modules Added in v0.4
-----------------------------
(x) GitHubUser added

Issues Fixed in v0.4:
-----------------------------
(x) Setup File Fix
(x) issues with strip in Html

Framework Improvements v0.4:
-----------------------------
(x) Added Source of email collection
to final report in bootstrap.
(x) Added Verbose options for Modules
to handle Vebose printing.
(x) Added Alerts to HTML report
when emails are gathered from canary.

===================================
Modules Added in v0.3:
-----------------------------
(x) OnionStagram (Instagram User Search)
(x) AskSearch - Port from theHarvester

Issues Fixed in v0.3:
----------------------------
(x) Added Parser to GitHubCode Search
(x) Moved wget to 2 sec timeout

===================================
Modules Added in v0.2:
-----------------------------
(x) EmailHunter Trial API

Issues Fixed in v0.2:
-----------------------------
(x) Fixed Issues with SetupScript
(x) Changes Output Text file name

===================================
Modules Added in v0.1:
-----------------------------
(x) HtmlScrape Added to Modules
(x) SearchPGP Added to Modules - Port form theHarvester
(x) Google Search - Port form theHarvester
(x) Flickr Page Search
(x) GitHub Code Search
(x) GitHubGist Code Search
(x) Whois Non-Auth API Search
(x) Whoisology Search
(x) Yahoo Search - Port from theHarvester
(x) Canary (Non-API) PasteBin Search for Past Data Dumps!

Issues Fixed in v0.1:
-----------------------------
(x) Wget fails to follow redirects in some cases
(x) Fixed Issues with google search
(x) Major change with how the Framework Handles Consumer and Producred Model
(x) Fix Issues with Join() and Conducter

Imprrovements in v0.1:
-----------------------------
(x) Added in valid UserAgents and headers
(x) HTML Scrape now has opption to save or remove is mirror
(x) HTML Scrape UTF-8 issues fixed

Build out Path:

Modules Under Dev:
-----------------------------
( ) StartPage Search (can help with captcha issues)
( ) Searching SEC Data
( ) Exalead Search - Port from theHarvester
( ) PwnBin Search
( ) PasteBin Searches
( ) Past Data Dumps
( ) psbdmp API Based and non Alert

Framework Under Dev:
-----------------------------
( ) New Parsers to clean results
( ) Fix import errors with Glob
( ) Add in "[@]something.com" to search Regex and engines
( ) Add errors for Captcha limit's
( ) Add Threading/Multi to GitHub Search
( ) Add Source of collection to HTML Output



Share:
Established in 2015. Offensive Sec Blog has been sharing security research, hacking tools, threat intelligence, and offensive security content since 2015.
Copyright © OffSec Blog | Powered by OffensiveSec
Design by OffSec | Built for the security community