Single Sign-On Security: Security Analysis Of Real-Life OpenID Connect Implementations

<p>This is a guest blogpost by <a href="https://twitter.com/_lauritz_" target="_blank">Lauritz Holtmann</a>. He wrote his master thesis:</p><p></p><blockquote>"Single Sign-On Security: Security Analysis of real-life OpenID Connect Implementations"</blockquote><p></p><p>Lauritz summarizes his exciting results in the following. The thesis was supervised by <a href="https://twitter.com/v_mladenov" target="_blank">Vladislav Mladenov</a>, <span><a href="https://twitter.com/CheariX" target="_blank">Christian Mainka</a></span>, and <a href="https://twitter.com/JoergSchwenk" target="_blank">Jörg Schwenk</a>. You can read find his full thesis <a href="https://www.nds.ruhr-uni-bochum.de/media/nds/arbeiten/2020/11/30/Masterarbeit_Lauritz_Holtmann_Single_Sign-On_Security.pdf" target="_blank"><span>here</span></a>.</p><p>OpenID Connect 1.0 and OAuth 2.0 are <i>the</i> Single Sign-On Protocols that are implemented in modern web applications. In this post, we outline common issue patterns that were discovered in popular OpenID Connect implementations, give concrete examples of vulnerabilities, and give recommendations for adjustments to the OpenID Connect specification.</p><p><span></span></p><a name="more"></a><p></p><h2 style="text-align: left;">Table of Contents </h2><ol data-sourcepos="7:1-14:0" dir="auto"> <li data-sourcepos="7:1-7:47"><a href="#user-content-introduction">Introduction</a></li> <li data-sourcepos="8:1-8:50"><a href="#user-content-attacker-models">Attacker Models</a></li> <li data-sourcepos="9:1-9:84"><a href="#user-content-high-level-setup-and-selection-of-implementations">High-Level Setup and Selection of Implementations</a></li> <li data-sourcepos="10:1-10:82"><a href="#user-content-derived-issue-patterns">Derived Issue Patterns</a></li> <li data-sourcepos="11:1-11:101"><a href="#user-content-derived-modifications-to-the-openid-connect-security-considerations">Derived modifications to the OpenID Connect Security Considerations</a></li> <li data-sourcepos="12:1-12:44"><a href="#user-content-references">References</a></li></ol> <h2 data-sourcepos="17:1-17:15" dir="auto"> <a aria-hidden="true" class="anchor" href="#introduction" id="user-content-introduction"></a>Introduction</h2> <p data-sourcepos="18:1-18:256" dir="auto">This post outlines the lessons learned during the research on the security of real-life OpenID Connect implementations that were roughly performed between April and October 2020. We presume basic knowledge of OpenID Connect 1.0 and OAuth 2.0 for this post.</p> <p data-sourcepos="20:1-20:468" dir="auto">First, we describe the attacker models that will be applied in this post. Afterward, we outline a high-level overview of the selection criteria for real-life OpenID Connect implementations. Furthermore, we describe patterns that were regularly observed during the analysis of real-life OpenID Connect Service Provider and Identity Provider implementations. Finally, proposals for adjusted security considerations regarding the OpenID Connect specification are derived.</p> <h2 data-sourcepos="23:1-23:18" dir="auto"> <a aria-hidden="true" class="anchor" href="#attacker-models" id="user-content-attacker-models"></a>Attacker Models</h2> <p data-sourcepos="24:1-24:168" dir="auto">In the following, multiple different attacker models are considered. Each individual observation will be categorized into an attacker model that is described hereinafter.</p> <h3 data-sourcepos="26:1-26:16" dir="auto"> <a aria-hidden="true" class="anchor" href="#web-attacker" id="user-content-web-attacker"></a>Web Attacker</h3> <p data-sourcepos="27:1-27:68" dir="auto">The web attacker model was introduced by Barth et al. in 2008 [<a href="https://www.adambarth.com/papers/2008/barth-jackson-mitchell.pdf" target="_blank">13</a>].</p> <h4 data-sourcepos="29:1-29:11" dir="auto"> <a aria-hidden="true" class="anchor" href="#victim" id="user-content-victim"></a>Victim</h4> <p data-sourcepos="30:1-30:112" dir="auto">The victim in this attacker model is either an End-User, a benign Service Provider or a benign OpenID Provider.</p> <h4 data-sourcepos="32:1-32:31" dir="auto"> <a aria-hidden="true" class="anchor" href="#objectives-of-the-attacker" id="user-content-objectives-of-the-attacker"></a>Objectives of the Attacker</h4> <p data-sourcepos="33:1-33:697" dir="auto">Depending on the victim, the attacker's objectives may be different. If a web attacker targets an End-User, the ultimate goal is to break the authentication and access restricted resources. Beside this, a malicious actor's objective can be to influence the End-User's session, for instance, to log in or log out a victim without indication to the user. If a web attacker targets a Service Provider or Identity Provider, the primary objective is also an authentication bypass in order to access restricted resources. Additionally, causing notable harm to the application or the underlying infrastructure of the Identity Provider or Service Provider can be the objective of a malicious actor.</p> <h4 data-sourcepos="35:1-35:33" dir="auto"> <a aria-hidden="true" class="anchor" href="#capabilities-of-the-attacker" id="user-content-capabilities-of-the-attacker"></a>Capabilities of the Attacker</h4> <p data-sourcepos="36:1-36:662" dir="auto">The web attacker is the least privileged attacker that is considered in the following. A web attacker is not able to intercept or eavesdrop communication that is not intended for him. If the victim is an End-User, we assume that the victim visits an attacker-controlled website. Additionally, the web attacker may send and receive HTTP requests and provide a trusted Transport Layer Security (TLS) certificate for a controlled domain, for example, <i>attacker.com</i>, to enable encrypted communication with Service Providers and Identity Providers. If explicitly outlined, the web attacker is in charge of a user account at the Identity Provider or the Service Provider.</p> <h3 data-sourcepos="38:1-38:31" dir="auto"> <a aria-hidden="true" class="anchor" href="#malicious-identity-provider" id="user-content-malicious-identity-provider"></a>Malicious Identity Provider</h3> <p data-sourcepos="39:1-39:408" dir="auto">The malicious Identity Provider attacker model was introduced in 2016 by Mainka, Mladenov, and Schwenk [<a href="https://arxiv.org/abs/1412.1623">10</a>]. They highlighted that the Identity Provider in traditional Single Sign-On setups like Kerberos is a trusted party. If customers can configure own Identity Providers or Identity Providers are dynamically discovered, these entities must be considered as third parties and must be treated accordingly.</p> <h4 data-sourcepos="41:1-41:11" dir="auto"> <a aria-hidden="true" class="anchor" href="#victim-1" id="user-content-victim-1"></a>Victim</h4> <p data-sourcepos="42:1-42:102" dir="auto">A malicious Identity Provider could either target an End-User or a benign Service Provider as victim.</p> <h4 data-sourcepos="44:1-44:31" dir="auto"> <a aria-hidden="true" class="anchor" href="#objectives-of-the-attacker-1" id="user-content-objectives-of-the-attacker-1"></a>Objectives of the Attacker</h4> <p data-sourcepos="45:1-45:463" dir="auto">If the malicious Identity Provider targets an End-User, the attacker's objective is to bypass the authentication of the End-User that used an honest Identity Provider to register at a Service Provider, in order to authenticate as the victim user. If a malicious Identity Provider directly targets a benign Service Provider, beside the authentication bypass, causing harm to the underlying application or infrastructure can be the objective of a malicious actor.</p> <h4 data-sourcepos="47:1-47:33" dir="auto"> <a aria-hidden="true" class="anchor" href="#capabilities-of-the-attacker-1" id="user-content-capabilities-of-the-attacker-1"></a>Capabilities of the Attacker</h4> <p data-sourcepos="48:1-48:794" dir="auto">A malicious Identity Provider is able to perform a genuine OpenID Connect flow and to authenticate users for a Relying Party. In doing so, it is not bound to restrictions being made by the specification and could also act maliciously. For instance, the malicious Identity Provider may send malformed requests, set <code>id_token</code> claims in a misleading manner or may tamper with the key references that are used for signature validation. A prerequisite for this is that either a victim Client supports Dynamic OpenID Provider Discovery, for example, using the <i>WebFinger</i> protocol [<a href="https://tools.ietf.org/html/rfc7033" target="_blank">16</a>] or a manually configured and initially trusted IdentityProvider turns rogue at some point in time. In general, as per the overall setup of Single Sign-On, the Identity Provider is a third party from a Client's perspective</p> <h3 data-sourcepos="50:1-50:30" dir="auto"> <a aria-hidden="true" class="anchor" href="#malicious-service-provider" id="user-content-malicious-service-provider"></a>Malicious Service Provider</h3> <h4 data-sourcepos="51:1-51:11" dir="auto"> <a aria-hidden="true" class="anchor" href="#victim-2" id="user-content-victim-2"></a>Victim</h4> <p data-sourcepos="52:1-52:100" dir="auto">A malicious Service Provider could either target an End-User or a benign Identity Provider as a victim.</p> <h4 data-sourcepos="54:1-54:31" dir="auto"> <a aria-hidden="true" class="anchor" href="#objectives-of-the-attacker-2" id="user-content-objectives-of-the-attacker-2"></a>Objectives of the Attacker</h4> <p data-sourcepos="55:1-55:401" dir="auto">If a malicious Service Provider targets an End-User, his main objective is to gather sensitive information about the End-User and to gain privileges to perform actions on behalf of the End-User. In contrast, if a benign Identity Provider is targeted, besides authentication bypasses, the underlying application and infrastructure of the Identity Provider can be the target of the malicious Service Provider.</p> <h4 data-sourcepos="57:1-57:33" dir="auto"> <a aria-hidden="true" class="anchor" href="#capabilities-of-the-attacker-2" id="user-content-capabilities-of-the-attacker-2"></a>Capabilities of the Attacker</h4> <p data-sourcepos="58:1-58:620" dir="auto">A malicious Service Provider is able to start a genuine OpenID Connect flow and retrieve a <code>code</code>, an <code>id_token</code> and an <code>access_token</code> from an Identity Provider. Just like the malicious Identity Provider, it may act maliciously when communicating with a victim Identity Provider or victim End-User. In contrast to the regular web attacker, it is in charge of valid client credentials. Thus, a malicious Service Provider needs to initially register at the benign Identity Provider in order to obtain these client credentials. This could either be done manually or using the OpenID Connect Dynamic Client Registration [<a href="https://openid.net/specs/openid-connect-registration-1_0.html" target="_blank">6</a>].</p> <h3 data-sourcepos="60:1-60:33" dir="auto"> <a aria-hidden="true" class="anchor" href="#malicious-administrative-user" id="user-content-malicious-administrative-user"></a>Malicious Administrative User</h3> <p data-sourcepos="61:1-61:212" dir="auto">The malicious administrative user attacker model was introduced by Matsumoto et al. in 2014 [<a href="https://dl.acm.org/doi/10.1145/2620728.2620750" target="_blank">17</a>, Section 3.1]. The impact of attacks under this attacker model is highly conditional, as described in the following.</p> <h4 data-sourcepos="63:1-63:11" dir="auto"> <a aria-hidden="true" class="anchor" href="#victim-3" id="user-content-victim-3"></a>Victim</h4> <p data-sourcepos="64:1-64:239" dir="auto">A malicious administrative user can either target a benign Service Provider or a benign Identity Provider as a victim. Additionally, a malicious administrative user could target End-Users of the Provider he has administrative privileges on.</p> <h4 data-sourcepos="66:1-66:31" dir="auto"> <a aria-hidden="true" class="anchor" href="#objectives-of-the-attacker-3" id="user-content-objectives-of-the-attacker-3"></a>Objectives of the Attacker</h4> <p data-sourcepos="67:1-67:400" dir="auto">The main objective of a malicious administrative user is to target the application or the underlying infrastructure of a Service Provider or Identity Provider. In some cases, a malicious administrative user could additionally target End-Users of the Service Provider or Identity Provider and try to obtain sensitive OpenID Connect related parameters that should not be accessible to administrative users.</p> <h4 data-sourcepos="69:1-69:33" dir="auto"> <a aria-hidden="true" class="anchor" href="#capabilities-of-the-attacker-3" id="user-content-capabilities-of-the-attacker-3"></a>Capabilities of the Attacker</h4> <p data-sourcepos="70:1-70:907" dir="auto">A malicious administrative user is a powerful attacker. As he is privileged, he may change OpenID Connect related configurations either at the Identity Provider <i>or</i> at the Service Provider. Thus, exploitability and severity of security issues that occur under this attacker model are highly conditional. Considering a hosted service, a customer that is able to exploit vulnerabilities to target the service directly could in fact cause notable harm. In contrast, if the software is self-hosted, the administrative user is highly trusted in most cases and might have even further access to the system than through a web service. Nevertheless, if the environment enforces the concept of least privileges, there may still be the possibility for malicious administrative users on one host to gain access to restricted resources by exploiting vulnerabilities in the self-hosted software and escalate privileges.</p> <h3 data-sourcepos="72:1-72:21" dir="auto"> <a aria-hidden="true" class="anchor" href="#man-in-the-middle" id="user-content-man-in-the-middle"></a>Man-in-the-Middle</h3> <p data-sourcepos="73:1-73:209" dir="auto">The most powerful attacker that is considered in the following is the man-in-the-middle attacker. Man-in-the-middle attacks are "well-known in security environments, and have drawn significant attention" [18].</p> <h4 data-sourcepos="75:1-75:11" dir="auto"> <a aria-hidden="true" class="anchor" href="#victim-4" id="user-content-victim-4"></a>Victim</h4> <p data-sourcepos="76:1-76:173" dir="auto">In an OpenID Connect Flow, every entity can be the target of a man-in-the-middle attacker, as the attacker operates on the requests and responses that are sent over the network.</p> <h4 data-sourcepos="78:1-78:31" dir="auto"> <a aria-hidden="true" class="anchor" href="#objectives-of-the-attacker-4" id="user-content-objectives-of-the-attacker-4"></a>Objectives of the Attacker</h4> <p data-sourcepos="79:1-79:252" dir="auto">A malicious entity's main goal is to bypass authentication and authenticate as an End-User at a Service Provider. Additionally, a man-in-the-middle attacker can aim to learn sensitive information and personal data that is transferred over the network.</p> <h4 data-sourcepos="81:1-81:33" dir="auto"> <a aria-hidden="true" class="anchor" href="#capabilities-of-the-attacker-4" id="user-content-capabilities-of-the-attacker-4"></a>Capabilities of the Attacker</h4> <p data-sourcepos="82:1-82:285" dir="auto">In the following, we consider that if TLS is used and enforced, all entities use TLS in a secure manner. Thus, the man-in-the-middle attacker is not able to tamper with HTTPS communication, but he is able to obtain, modify, or drop unencrypted communication like plain HTTP without TLS.</p> <h2 data-sourcepos="87:1-87:52" dir="auto"> <a aria-hidden="true" class="anchor" href="#high-level-setup-and-selection-of-implementations" id="user-content-high-level-setup-and-selection-of-implementations"></a>High-level Setup and Selection of Implementations</h2> <p data-sourcepos="88:1-88:436" dir="auto">During the analysis, we evaluated OIDC Identity Provider and Service Provider implementations regarding a defined set of assertions, based on the specification's security considerations [<a href="https://openid.net/specs/openid-connect-core-1_0.html" target="_blank">2</a>, Section 16][<a href="https://tools.ietf.org/html/rfc6749" target="_blank">3</a>] and the OAuth 2.0 Security Best Current Practices [<a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics">1</a>]. In doing so, we analyzed self-hosted software <i>and</i> hosted services. For Service Providers, we considered the ability to configure custom Identity Providers as mandatory.</p> <p data-sourcepos="90:1-90:50" dir="auto">The following software and services were analyzed:</p> <ul data-sourcepos="91:1-97:0" dir="auto"> <li data-sourcepos="91:1-91:49"><a href="https://www.keycloak.org/" rel="nofollow noreferrer noopener" target="_blank">Keycloak (Red Hat)</a></li> <li data-sourcepos="92:1-92:78"><a href="https://www.atlassian.com/software/bitbucket" rel="nofollow noreferrer noopener" target="_blank">Bitbucket Server (Atlassian)</a></li> <li data-sourcepos="93:1-93:37"><a href="https://about.gitlab.com/" rel="nofollow noreferrer noopener" target="_blank">GitLab</a></li> <li data-sourcepos="94:1-94:53"><a href="https://www.salesforce.com/" rel="nofollow noreferrer noopener" target="_blank">Salesforce Lightning</a></li> <li data-sourcepos="95:1-97:0"><a href="https://aws.amazon.com/cognito/" rel="nofollow noreferrer noopener" target="_blank">Amazon Cognito (AWS)</a></li> </ul> <h2 data-sourcepos="98:1-98:25" dir="auto"> <a aria-hidden="true" class="anchor" href="#derived-issue-patterns" id="user-content-derived-issue-patterns"></a>Derived Issue Patterns</h2> <p data-sourcepos="99:1-99:88" dir="auto">In the following, we outline <i>seven</i> issue-patterns that we derived within our test-set.</p> <h3 data-sourcepos="101:1-101:35" dir="auto"> <a aria-hidden="true" class="anchor" href="#pattern-1-redirect-uri-schemes" id="user-content-pattern-1-redirect-uri-schemes"></a>Pattern 1: Redirect URI Schemes</h3> <p data-sourcepos="102:1-102:131" dir="auto">The OpenID Connect Core specification is quite vague regarding allowed schemes for <code>redirect_uri</code> values, see [<a href="https://openid.net/specs/openid-connect-core-1_0.html" target="_blank">2</a>, Section 3.1.2.1]:</p> <blockquote data-sourcepos="104:1-104:689" dir="auto"> <p data-sourcepos="104:3-104:689">REQUIRED. Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider, with the matching performed as described in Section 6.2.1 of [<a href="https://tools.ietf.org/html/rfc3986" target="_blank">RFC3986</a>] (Simple String Comparison). When using this flow, the Redirection URI <b>SHOULD use the https scheme</b>; however, <b>it MAY use the http scheme</b>, provided that the Client Type is confidential, as defined in Section 2.1 of OAuth 2.0, and provided the OP allows the use of http Redirection URIs in this case. The Redirection URI <b>MAY use an alternate scheme</b>, such as one that is intended to identify a callback into a native application.</p> </blockquote> <p data-sourcepos="107:1-108:212" dir="auto">We observed that multiple Identity Providers support pre-registering <code>redirect_uri</code> values with any possible scheme. Such schemes' support is potentially dangerous, as browsers treat risky schemes like <i>data</i> or <i>javascript</i> very differently (some of my test cases can be found <a href="https://security.lauritz-holtmann.de/files/evaluation_results.xlsx">here</a>, recently <i>quinn</i> found an interesting vector for Firefox using the <a href="https://www.gremwell.com/firefox-xss-302" rel="nofollow noreferrer noopener" target="_blank"><i>ws</i> scheme</a>).<br /> Additionally, the specification defined the <code>redirect_uri</code> vague because it had native clients in mind. There are very few legitimate use-cases for these schemes as <code>redirect_uri</code> values in OpenID Connect setups.</p> <h4 data-sourcepos="110:1-110:39" dir="auto"> <a aria-hidden="true" class="anchor" href="#example-keycloak-cve-2020-10776" id="user-content-example-keycloak-cve-2020-10776"></a>Example: Keycloak (CVE-2020-10776)</h4> <p data-sourcepos="111:1-111:355" dir="auto">Keycloak is an open-source Identity and Access Management Software (IAM) maintained by Red Hat. In addition, Keycloak is used as the base for Red Hat's <a href="https://access.redhat.com/products/red-hat-single-sign-on" rel="nofollow noreferrer noopener" target="_blank">Red Hat Single Sign-On</a>. The following issue was resolved with <a href="https://www.keycloak.org/2020/11/keycloak-1103-released.html" rel="nofollow noreferrer noopener" target="_blank">Keycloak 11.0.3</a>.</p> <h5 data-sourcepos="113:1-113:20" dir="auto"> <a aria-hidden="true" class="anchor" href="#attacker-model" id="user-content-attacker-model"></a>Attacker Model</h5> <p data-sourcepos="114:1-114:179" dir="auto">A malicious administrative user or a malicious Service Provider that registers using OpenID Connect Dynamic Client Registration are considered as attacker models in the following.</p> <h5 data-sourcepos="116:1-116:17" dir="auto"> <a aria-hidden="true" class="anchor" href="#description" id="user-content-description"></a>Description</h5> <p data-sourcepos="117:1-117:327" dir="auto">According to the OpenID Connect specification, alternative schemes may be used as a <code>redirect_uri</code> besides <i>https</i>. If the Client Type is configured as <i>confidential</i>, <i>http</i> is allowed as a scheme. For native applications – e.g. the Twitter Application – even custom schemes like <i>twitter://</i> may be used [<a href="https://openid.net/specs/openid-connect-core-1_0.html" target="_blank">2</a>, Section 3.1.2.1.]:</p> <blockquote data-sourcepos="119:1-119:689" dir="auto"> <p data-sourcepos="119:3-119:689">REQUIRED. Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider, with the matching performed as described in Section 6.2.1 of [<a href="https://tools.ietf.org/html/rfc3986">RFC3986</a>] (Simple String Comparison). When using this flow, the Redirection URI <b>SHOULD use the https scheme</b>; however, <b>it MAY use the http scheme</b>, provided that the Client Type is confidential, as defined in Section 2.1 of OAuth 2.0, and provided the OP allows the use of http Redirection URIs in this case. The Redirection URI <b>MAY use an alternate scheme</b>, such as one that is intended to identify a callback into a native application.</p> </blockquote> <p data-sourcepos="121:1-121:444" dir="auto">Following the specification consequently, Keycloak did not restrict the <code>redirect_uri</code> regarding its scheme at all. This miss enabled dangerous behavior, as the <i>Authentication Response</i>'s 302 redirect was sent to this URI with an arbitrary scheme. As a result, depending on the Browser's behavior and treatment of the <code>Location</code> HTTP header, this could cause several security issues, potentially even leading to Cross-Site-Scripting (XSS).</p> <p data-sourcepos="123:1-124:80" dir="auto">Browser behavior regarding dangerous schemes in <code>Location</code> headers highly differs and changed in the last decade. Among a test-set of current and popular browser versions, only Safari 13.5 (iOS and macOS) executes JavaScript provided as <code>data</code>-URI, as shown in the following: </p><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiNgh4eJX7KwPWlt80GojSM3_i2-0y8JiocTruqAeAPWm_nn8c7SDIFdR4sBtPQrnf_QRMqxOKj3U1dXA8HWlYO1zqN_DNDUNxeCsPutzxcLlWx-yL75fuO2bHpnmh9Fjn9USfoa6TdnIQ/s1437/ma20200014.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="836" data-original-width="1437" height="373" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiNgh4eJX7KwPWlt80GojSM3_i2-0y8JiocTruqAeAPWm_nn8c7SDIFdR4sBtPQrnf_QRMqxOKj3U1dXA8HWlYO1zqN_DNDUNxeCsPutzxcLlWx-yL75fuO2bHpnmh9Fjn9USfoa6TdnIQ/w640-h373/ma20200014.png" title="Keycloak: JavaScript Execution using data-URL as redirect_uri" width="640" /></a></div><br />The JavaScript execution would be limited, as the script is executed in a different origin than the Identity Provider that sets the <code>Location</code> header (<i>null origin</i>). Thus, cross-origin access was restricted by the Same-Origin Policy. Nevertheless, an attacker may be able to launch a Cross-Origin State Inference (COSI) attack like Sudhodanan et al. pointed out in their paper "Cross-Origin State Inference (COSI) Attacks: Leaking Web Site States through XS-Leaks" [<a href="https://arxiv.org/abs/1908.02204">12</a>] using a <code>data</code>-URL as <code>redirect_uri</code>.<p></p> <h5 data-sourcepos="128:1-128:24" dir="auto"> <a aria-hidden="true" class="anchor" href="#steps-to-reproduce" id="user-content-steps-to-reproduce"></a>Steps to reproduce</h5> <p data-sourcepos="129:1-129:57" dir="auto">The following steps apply for Keycloak versions < 11.0.3:</p> <ol data-sourcepos="131:1-134:88" dir="auto"> <li data-sourcepos="131:1-132:85">Register a new client and configure the following <code>recirect_uri</code>: <code>data:text/html,%3Cscript%3Ealert%281%29%3C%2Fscript%3E</code> <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjazkSUldkqnVnXp_CMx53rXofeLBmMIjJLOl8gwQuvJ45fiBWU6Zx0ATFQfYS6nA07h-18SzefUiPvDYOnY8-SjNFJPe4T3tNHaLH3Sv6F8plizkwSd0BbDksfWW7R03IF8YtM4U2aqOU/s854/ma20200014-2.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="241" data-original-width="854" height="181" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjazkSUldkqnVnXp_CMx53rXofeLBmMIjJLOl8gwQuvJ45fiBWU6Zx0ATFQfYS6nA07h-18SzefUiPvDYOnY8-SjNFJPe4T3tNHaLH3Sv6F8plizkwSd0BbDksfWW7R03IF8YtM4U2aqOU/w640-h181/ma20200014-2.png" title="Keycloak: Client Configuration with data-URL as redirect_uri" width="640" /></a></div><br /> </li> <li data-sourcepos="133:1-133:516">Visit the Authentication Endpoint of the created Client: <a href="https://keycloak.local:8443/auth/realms/master/protocol/openid-connect/auth?scope=openid&state=a&response_type=code&client_id=test&redirect_uri=data%3Atext%2Fhtml%2C%253Cscript%253Ealert%25281%2529%253C%252Fscript%253E&nonce=b" rel="nofollow noreferrer noopener" target="_blank">https://keycloak.local:8443/auth/realms/master/protocol/openid-connect/auth?scope=openid&state=a&response_type=code&client_id=test&redirect_uri=data%3Atext%2Fhtml%2C%253Cscript%253Ealert%25281%2529%253C%252Fscript%253E&nonce=b</a> </li> <li data-sourcepos="134:1-134:88">After successful authentication, there is a redirect to the registered <code>redirect_uri</code>:</li> </ol> <pre class="code highlight js-syntax-highlight http white" lang="http" v-pre="true"><code><span class="line" id="LC1" lang="http"><span class="k">HTTP</span><span class="o">/</span><span class="m">1.1</span> <span class="m">302</span> <span class="ne">Found</span></span> <span class="line" id="LC2" lang="http"><span class="na">Location</span><span class="p">:</span> <span class="s">data:text/html,%3Cscript%3Ealert%281%29%3C%2Fscript%3E? state=a&session_state=b&code=c</span></span> <span class="line" id="LC3" lang="http"><span class="s">[...]</span></span></code></pre> <p data-sourcepos="140:1-140:194" dir="auto">Depending on the Browser's behavior, the <code>data</code>-URI is parsed and the embedded JavaScript is executed. For instance, Safari 13.5 evaluates the provided <code>Location</code> header, as presented earlier.</p> <h5 data-sourcepos="142:1-142:28" dir="auto"> <a aria-hidden="true" class="anchor" href="#responsible-disclosure" id="user-content-responsible-disclosure"></a>Responsible Disclosure</h5> <ul data-sourcepos="143:1-147:0" dir="auto"> <li data-sourcepos="143:1-143:91"> <b>2020-05-27</b> Report to Red Hat using <a href="https://issues.redhat.com/projects/KEYCLOAK/issues" rel="nofollow noreferrer noopener" target="_blank">https://issues.redhat.com/projects/KEYCLOAK/issues</a> </li> <li data-sourcepos="144:1-144:43"> <b>2020-06-17</b> CVE-2020-10776 is assigned</li> <li data-sourcepos="145:1-145:85"> <b>2020-10-20</b> Red Hat is informed that this blog post is scheduled for 2020-11-12.</li> <li data-sourcepos="146:1-147:0"> <b>2020-11-04</b> Red Hat publishes the advisory for <a href="https://access.redhat.com/security/cve/cve-2020-10776" rel="nofollow noreferrer noopener" target="_blank">CVE-2020-10776</a> alongside <a href="https://www.keycloak.org/2020/11/keycloak-1103-released.html" rel="nofollow noreferrer noopener" target="_blank">Keycloak 11.0.3</a>.</li> </ul> <h3 data-sourcepos="150:1-150:42" dir="auto"> <a aria-hidden="true" class="anchor" href="#pattern-2-server-side-request-forgery" id="user-content-pattern-2-server-side-request-forgery"></a>Pattern 2: Server-Side-Request-Forgery</h3> <p data-sourcepos="151:1-152:213" dir="auto">Multiple Identity and Service Provider implementations were vulnerable to different types of Server-Side Request Forgery (SSRF) vulnerabilities. The Identity Provider's <code>request_uri</code> parameter is already known to be vulnerable for SSRF by design since 2017 [<a href="https://publ.sec.uni-stuttgart.de/fettkuestersschmitz-csf-2017.pdf" target="_blank">4</a>, Section III;A. 8)]. Notably, this vulnerability could be exploited by any unauthenticated user.</p> <p data-sourcepos="154:1-155:268" dir="auto">In 2017, Mladenov and Mainka pointed out [<a href="https://www.nds.ruhr-uni-bochum.de/media/ei/veroeffentlichungen/2017/01/13/OIDCSecurity_1.pdf" target="_blank">5</a>, Section 2.1.2] that a malicious <i>Discovery Service</i> could be used to launch an SSRF attack against a Service Provider. Thus, the attacker can use SSRF for port scans or for retrieving data. Additionally, having access to the endpoint configuration, administrative users could launch SSRF attacks on the Service Provider by design. Depending on the actual setup, this yields to severe security implications, especially considering hosted and <i>cloud</i> services.</p> <p data-sourcepos="157:1-157:150" dir="auto">Even though these issues were theoretically discussed earlier, SSRF to <i>private IPs</i> or <i>localhost</i> was a common and serious issue among our test-set.</p> <h4 data-sourcepos="159:1-159:65" dir="auto"> <a aria-hidden="true" class="anchor" href="#example-1-unauthenticated-ssrf-in-keycloak-cve-2020-10770" id="user-content-example-1-unauthenticated-ssrf-in-keycloak-cve-2020-10770"></a>Example 1: Unauthenticated SSRF in Keycloak (CVE-2020-10770)</h4> <p data-sourcepos="160:1-160:234" dir="auto">Keycloak is an open-source Identity and Access Management Software (IAM) maintained by Red Hat. In addition, Keycloak is used as a base for Red Hat's <a href="https://access.redhat.com/products/red-hat-single-sign-on" rel="nofollow noreferrer noopener" target="_blank">Red Hat Single Sign-On</a>.</p> <h5 data-sourcepos="162:1-162:20" dir="auto"> <a aria-hidden="true" class="anchor" href="#attacker-model-1" id="user-content-attacker-model-1"></a>Attacker Model</h5> <p data-sourcepos="163:1-163:377" dir="auto">The attacker model applied for the following attack is an unauthenticated web attacker model introduced by Barth et al. in 2008 [<a href="https://www.adambarth.com/papers/2008/barth-jackson-mitchell.pdf">13</a>]. In the following, the malicious entity targets a benign Identity Provider. The attacker's objective is to gain access to internal hosts that are situated within the internal network; direct access to these hosts is restricted using a firewall.</p> <h5 data-sourcepos="166:1-166:17" dir="auto"> <a aria-hidden="true" class="anchor" href="#description-1" id="user-content-description-1"></a>Description</h5> <p data-sourcepos="167:1-167:394" dir="auto">The <code>request_uri</code> is an optional parameter within the OpenID Connect <i>Authentication Request</i> that allows specifying an external URI where the <i>Request Object</i> can be found. Fett et al. discovered in 2017 [<a href="https://dl.acm.org/doi/10.1145/2976749.2978385" target="_blank">14</a>, Section III;A. 8)] that, as the Identity Provider is supposed to request the external <i>Request Object</i>, this parameter can easily launch an SSRF attack against the Identity Provider.</p> <p data-sourcepos="169:1-169:382" dir="auto">The OpenID Connect Core specification defines the <code>request_uri</code> as an <i>Authentication Request</i> parameter that "[...] enables OpenID Connect requests to be passed by reference, rather than by value" [<a href="https://dl.acm.org/doi/10.1145/2976749.2978385" target="_blank">14</a>, Section 6.]. If a Service Provider uses this parameter, the Identity Provider retrieves the <i>Request Object</i> "[...] from the resource at the specified URL" [<a href="https://openid.net/specs/openid-connect-core-1_0.html" target="_blank">2</a>, Section 6.2.].</p> <p data-sourcepos="171:1-173:131" dir="auto">The Identity Provider could restrict allowed URLs by allowing the Service Provider to specify the <code>request_uris</code> parameter that is an "[...] array of <code>request_uri</code> values [...]", within OpenID Connect Dynamic Client Registration [<a href="https://openid.net/specs/openid-connect-registration-1_0.html" target="_blank">6</a>, Section 2.]. If the OpenID Connect Dynamic Client Registration is used, the Identity Provider can require the Service Provider to "[...] pre-register <code>request_uri</code> values using the <code>request_uris</code> parameter [...]" [<a href="https://openid.net/specs/openid-connect-core-1_0.html" target="_blank">2</a>, Section 6.2.]. Thus, only if OpenID Connect is implemented with the Registration Extension, there is a mitigation hint given by the specification.</p> <p data-sourcepos="175:1-175:226" dir="auto">Keycloak supported using a <i>Request Object</i> and referencing it externally. The "Fine Grained OpenID Connect Configuration" for a specific client allowed to specify the following values for the option "Request Object Required":</p> <ul data-sourcepos="177:1-181:0" dir="auto"> <li data-sourcepos="177:1-177:24">Not required (default)</li> <li data-sourcepos="178:1-178:26">request or <code>request_uri</code> </li> <li data-sourcepos="179:1-179:14">request only</li> <li data-sourcepos="180:1-181:0"> <code>request_uri</code> only</li> </ul> <p data-sourcepos="182:1-182:54" dir="auto"><br /></p><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRiyJB__XJMcuhU2evh-jS324-RCY_3iYY8KNi2MhJz8wVolUfW2YjDmzTCySfX2CwBUBGJW7sew6bqiRuiwF6KR-fx0FfKyWcNKfMwgRccWVzZdOWT45gB6W_mB3_ItgTVgegSbLw5Rw/s714/ma20200003.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="195" data-original-width="714" height="174" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRiyJB__XJMcuhU2evh-jS324-RCY_3iYY8KNi2MhJz8wVolUfW2YjDmzTCySfX2CwBUBGJW7sew6bqiRuiwF6KR-fx0FfKyWcNKfMwgRccWVzZdOWT45gB6W_mB3_ItgTVgegSbLw5Rw/w640-h174/ma20200003.png" title="Keycloak: Request URI configuration" width="640" /></a></div><br /><p></p> <p data-sourcepos="184:1-186:322" dir="auto">As one could observe, if an OpenID Connect Client was set-up with default settings, the default value for this option was "Not required". There was no option to do not support a <i>Request Object</i> at all, as "not required" meant submitting the request object is optional, but if you submitted one, it was used by Keycloak. Additionally, there was no option to manually define the <code>request_uris</code> parameter during manual client registration. Finally, using the default configuration, Keycloak did not require a <i>Request Object</i>, but supported passing the <code>request_uri</code> parameter with an <i>Authentication Request</i>. As a result, Keycloak was vulnerable to the SSRF attack Fett et al. described in 2017 [<a href="https://dl.acm.org/doi/10.1145/2976749.2978385" target="_blank">14</a>, Section III;A. 8)] in its default configuration for Clients.</p> <h5 data-sourcepos="189:1-189:22" dir="auto"> <a aria-hidden="true" class="anchor" href="#proof-of-concept" id="user-content-proof-of-concept"></a>Proof-of-Concept</h5> <p data-sourcepos="190:1-191:218" dir="auto">A straight forward PoC to trigger the SSRF issue is given with the following URL (<i>Authentication Response</i>): <a href="https://keycloak.local/auth/realms/master/protocol/openid-connect/auth?scope=openid&response_type=code&redirect_uri=%5BValid-RedirectURI%5D&state=aaaa&nonce=bbbb&client_id=%5BValid-ClientID%5D&request_uri=http://127.0.0.1:1234" rel="nofollow noreferrer noopener" target="_blank">https://keycloak.local/auth/realms/master/protocol/openid-connect/auth?scope=openid&response_type=code&redirect_uri=[Valid-RedirectURI]&state=aaaa&nonce=bbbb&client_id=[Valid-ClientID]&request_uri=http://127.0.0.1:1234</a></p> <p data-sourcepos="193:1-193:153" dir="auto">Thus, to launch the SSRF in a real-life scenario, an attacker would obtain an <i>Authentication Request</i> (to get the valid <code>client_id</code> and <code>redirect_uri</code>).</p> <p data-sourcepos="195:1-195:224" dir="auto">If the attacker then sends the <i>Authentication Response</i> GET request including valid <code>client_id</code> and <code>redirect_uri</code>, Keycloak sends a GET request to <code>127.0.0.1:1234</code> to fetch the <i>Request Object</i> resulting in <b>blind SSRF</b>.</p> <p data-sourcepos="197:1-197:180" dir="auto">By measuring the response time, a malicious actor may additionally perform a <b>port scan</b> of <i>localhost</i> or internally accessible hosts. The following ports are open on localhost:</p> <ul data-sourcepos="198:1-202:0" dir="auto"> <li data-sourcepos="198:1-198:54">8080: Open, Keycloak, 1087 Bytes as default response</li> <li data-sourcepos="199:1-199:57">8081: Open, Mailslurper, 4086 Bytes as default response</li> <li data-sourcepos="200:1-200:14">5555: Closed</li> <li data-sourcepos="201:1-202:0">5556: Closed</li> </ul> <p data-sourcepos="203:1-204:50" dir="auto"><b>Demo</b>: An example using the Timeinator Burp Plugin [<a href="https://github.com/FSecureLABS/timeinator" target="_blank">15</a>] is presented below: </p><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjwcRsjKixWQM-TRy5IrEHihkn3qzON-WO7r6Gshi-lSwF0KZ7k6hVnNm9Fg1t38meCAfzH0uvQC_ulVIxzH_tnVxvnJKW3LuE73TV2qTGqUSe2xBwEIavxvVKUU5q6Cfwx7rSrNq5ja_c/s1015/ma20200003-2.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="571" data-original-width="1015" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjwcRsjKixWQM-TRy5IrEHihkn3qzON-WO7r6Gshi-lSwF0KZ7k6hVnNm9Fg1t38meCAfzH0uvQC_ulVIxzH_tnVxvnJKW3LuE73TV2qTGqUSe2xBwEIavxvVKUU5q6Cfwx7rSrNq5ja_c/w640-h360/ma20200003-2.png" title="Keycloak: Portscan using SSRF" width="640" /></a></div><br /><p></p> <p data-sourcepos="206:1-206:164" dir="auto">In our test, Keycloak responded significantly faster if the port was closed. Thus, the Blind SSRF enabled an attacker to learn about the internal network structure.</p> <h5 data-sourcepos="210:1-210:28" dir="auto"> <a aria-hidden="true" class="anchor" href="#responsible-disclosure-1" id="user-content-responsible-disclosure-1"></a>Responsible Disclosure</h5> <ul data-sourcepos="211:1-216:0" dir="auto"> <li data-sourcepos="211:1-211:93"> <b>2020-04-29</b>: Initial Report to Red Hat via <a href="https://issues.redhat.com/projects/KEYCLOAK/" rel="nofollow noreferrer noopener" target="_blank">https://issues.redhat.com/projects/KEYCLOAK/</a>.</li> <li data-sourcepos="212:1-212:55"> <b>2020-06-05</b>: Red Hat triages the submitted report.</li> <li data-sourcepos="213:1-213:45"> <b>2020-06-11</b>: CVE-2020-10770 is assigned.</li> <li data-sourcepos="214:1-214:81"> <b>2020-10-16</b>: Red Hat is informed that this post is scheduled for 2020-11-10.</li> <li data-sourcepos="215:1-216:0"> <b>2020-10-19</b>: Red Hat approves to disclosed this post on the described vulnerability:</li> </ul> <blockquote data-sourcepos="217:1-219:43" dir="auto"> <p data-sourcepos="217:3-217:213">Thank you for informing about this. Since this is a Moderate impact flaw, we have 365 calendar days to publish the fix after the issue has been made public so should not be a problem publishing it on 2020-11-10.</p> <p data-sourcepos="219:3-219:43">- <i>Internal Comment by Red Hat Employee</i></p> </blockquote> <p data-sourcepos="221:1-221:127" dir="auto">According to the internal ticket status, Red Hat planned to resolve this issue with the upcoming major version v12 of Keycloak.</p> <h4 data-sourcepos="224:1-224:44" dir="auto"> <a aria-hidden="true" class="anchor" href="#example-2-ssrf-in-amazon-cognito-aws" id="user-content-example-2-ssrf-in-amazon-cognito-aws"></a>Example 2: SSRF in Amazon Cognito (AWS)</h4> <p data-sourcepos="225:1-225:196" dir="auto">Likewise Keycloak, Amazon Cognito implements Identity and Access Management (IAM). But in contrast, as part of the AWS family, Amazon Cognito is a hosted service instead of a self-hosted software.</p> <h3 data-sourcepos="227:1-227:18" dir="auto"> <a aria-hidden="true" class="anchor" href="#attacker-model-2" id="user-content-attacker-model-2"></a>Attacker Model</h3> <p data-sourcepos="228:1-228:390" dir="auto">The attacker model that is applied in the following is a malicious administrative user. The impact of attacks under this attacker model is highly conditional, but in this case, as Amazon Cognito is a hosted service, administrative users only have access to the configuration interface. The underlying infrastructure in Amazon's hosted environment should not be accessible to external users.</p> <p data-sourcepos="230:1-230:264" dir="auto">Alternatively, a malicious Identity Provider could be considered as the attacker model. The actual configuration is fetched using OpenID Connect Discovery from the Identity Provider's <i>Configuration Endpoint</i> so that the endpoints are Identity-Provider-controlled.</p> <h3 data-sourcepos="232:1-232:15" dir="auto"> <a aria-hidden="true" class="anchor" href="#description-2" id="user-content-description-2"></a>Description</h3> <p data-sourcepos="233:1-233:497" dir="auto">Amazon Cognito allowed specifying custom OpenID Connect Identity Providers for user pools. Within the configuration of an Identity Provider, an administrative user could choose to "Run discovery", triggering an OpenID Connect Discovery that requests the <i>Configuration Endpoint</i> of the Identity Provider. Amazon Cognito did not restrict the endpoints observed using OpenID Connect Discovery regarding internal IP addresses or localhost so that SSRF to the local network and localhost was possible.</p> <p data-sourcepos="235:1-235:225" dir="auto">A malicious actor could utilize this to perform port scans or send nearly arbitrary HTTP requests to hosts that are intentionally not exposed to the internet. An example <i>Configuration Response</i> is presented in the following:</p> <pre class="code highlight js-syntax-highlight plaintext white" lang="plaintext" v-pre="true"><code><span class="line" id="LC1" lang="plaintext">{</span> <span class="line" id="LC2" lang="plaintext"> "issuer":"https://example.com/",</span> <span class="line" id="LC3" lang="plaintext"> "authorization_endpoint":"https://example.com/auth",</span> <span class="line" id="LC4" lang="plaintext"> "token_endpoint":"http://127.0.0.1:22",</span> <span class="line" id="LC5" lang="plaintext"> "userinfo_endpoint":"http://127.0.0.1:22",</span> <span class="line" id="LC6" lang="plaintext"> "jwks_uri":"https://example.com/jwks",</span> <span class="line" id="LC7" lang="plaintext"> "registration_endpoint":"https://example.com/register",</span> <span class="line" id="LC8" lang="plaintext"> "response_types_supported":["code","token id_token"],</span> <span class="line" id="LC9" lang="plaintext"> "subject_types_supported":["public","pairwise"],</span> <span class="line" id="LC10" lang="plaintext"> "id_token_signing_alg_values_supported":["RS256"]</span> <span class="line" id="LC11" lang="plaintext">}</span></code></pre> <h3 data-sourcepos="252:1-252:12" dir="auto"> <a aria-hidden="true" class="anchor" href="#portscan" id="user-content-portscan"></a>Portscan</h3> <p data-sourcepos="253:1-253:523" dir="auto">The following error messages could be used to determine which ports are internally open on localhost, as the error message sent to the <code>redirect_uri</code> (<a href="https://a.com/cb?error_description=%5BERROR%5D&error=invalid_request" rel="nofollow noreferrer noopener" target="_blank">https://a.com/cb?error_description=[ERROR]&error=invalid_request</a>) differed. Depending on the underlying Transmission Control Protocol (TCP) connection (if it cannot be established) and the HTTP error code Amazon Cognito received in response to the <i>Token Request</i>, the following error messages were used:</p> <ul data-sourcepos="255:1-258:0" dir="auto"> <li data-sourcepos="255:1-255:151">If the <i>Token Endpoint</i> was specified as "<a href="http://localhost:22" rel="nofollow noreferrer noopener" target="_blank">http://localhost:22</a>", the error message was "Connection reset", so that we could assume Port 22 to be open.</li> <li data-sourcepos="256:1-256:200">If the <i>Token Endpoint</i> was specified as "<a href="http://localhost:20" rel="nofollow noreferrer noopener" target="_blank">http://localhost:20</a>", the error message was "Connect to 127.0.0.1:20 [/127.0.0.1] failed: Connection refused", so that we could assume Port 20 to be closed.</li> <li data-sourcepos="257:1-258:0">If the <i>Token Endpoint</i> was specified as "<a href="http://test123.ngrok.io" rel="nofollow noreferrer noopener" target="_blank">http://test123.ngrok.io</a>", the error message was "test Error – 502 error getting token", so that we could assume that there was an HTTP request to the specified target, but the webserver responded with HTTP Error Code 502.</li> </ul> <h3 data-sourcepos="259:1-259:27" dir="auto"> <a aria-hidden="true" class="anchor" href="#arbitrary-http-requests" id="user-content-arbitrary-http-requests"></a>Arbitrary HTTP requests</h3> <p data-sourcepos="260:1-260:485" dir="auto">Besides the feedback an attacker receives that enabled him to determine the connection's status, there was no information on the actual response to the HTTP request. Thus, this gadget could be considered as <b>blind SSRF</b> to the local network. The attacker had no direct feedback but could still control a GET request (<i>UserInfo Request</i>) and a POST request (<i>Token Request</i>) regarding scheme (<i>http</i> or <i>https</i>), host (potentially localhost or internal IP), path and query parameters.</p> <p data-sourcepos="263:1-263:105" dir="auto">Combining port scan and blind SSRF, a malicious administrative user or malicious Identity Provider could:</p> <ol data-sourcepos="265:1-267:0" dir="auto"> <li data-sourcepos="265:1-265:197"> <b>Gather information</b>: Which ports are open on localhost? Are there other hosts accessible? If HTTP error codes are reflected, which web service is running at this destination (fingerprinting)?</li> <li data-sourcepos="266:1-267:0"> <b>If a service could be identified</b>: Use blind SSRF to target internally accessible service directly.</li> </ol> <h3 data-sourcepos="268:1-268:18" dir="auto"> <a aria-hidden="true" class="anchor" href="#recommendation" id="user-content-recommendation"></a>Recommendation</h3> <p data-sourcepos="269:1-269:220" dir="auto">A blacklist is never perfect. Nevertheless, Amazon Cognito should introduce a restriction for internal IPs and localhost as OpenID Connect endpoints, as there is no legitimate use-case in the context of a hosted service.</p> <p data-sourcepos="271:1-271:89" dir="auto">The fix that was applied in late August 2020 mitigates the above described vulnerability.</p> <h3 data-sourcepos="273:1-273:26" dir="auto"> <a aria-hidden="true" class="anchor" href="#responsible-disclosure-2" id="user-content-responsible-disclosure-2"></a>Responsible Disclosure</h3> <p data-sourcepos="274:1-274:124" dir="auto">Mitigations for the described issues were introduced by AWS / Amazon Cognito soon after we reported the issue on 2020-08-12.</p> <ul data-sourcepos="276:1-279:151" dir="auto"> <li data-sourcepos="276:1-276:94"> <b>2020-08-12</b>: Initial report to <a href="mailto:aws-security@amazon.com">aws-security@amazon.com</a>.</li> <li data-sourcepos="277:1-277:76"> <b>2020-08-19</b>: Call with AWS Security Team and Amazon Cognito Developers.</li> <li data-sourcepos="278:1-278:139"> <b>2020-08-??</b>: A fix is applied at the end of August 2020. As Amazon Cognito is a hosted service, we could not determine the exact date.</li> <li data-sourcepos="279:1-279:151"> <b>2020-10-21</b>: AWS Security Team acknowledges that the blog post is scheduled for 2020-11-10 and offers feedback for the draft prior to publication:</li> </ul> <blockquote data-sourcepos="280:1-282:169" dir="auto"> <p data-sourcepos="280:3-280:140">Thanks again for bringing your security concern to our attention. We greatly appreciate and encourage reports from the security community.</p> <p data-sourcepos="282:3-282:169">I understand you wish to do a write up on this - would you be interested in sharing your draft with us before publishing so we may provide any assistance and feedback?</p> </blockquote> <ul data-sourcepos="283:1-284:0" dir="auto"> <li data-sourcepos="283:1-284:0"> <b>2020-11-05</b>: After providing an initial draft, the AWS Security team would like to explicitly outline that the described vulnerability was mitigated shortly after we reported it responsibly.</li> </ul> <h3 data-sourcepos="287:1-287:30" dir="auto"> <a aria-hidden="true" class="anchor" href="#pattern-3-tls-enforcement" id="user-content-pattern-3-tls-enforcement"></a>Pattern 3: TLS Enforcement</h3> <p data-sourcepos="288:1-288:422" dir="auto">The OpenID Connect Core specification already enforces TLS for communication with <i>Authentication</i>, <i>Token</i>, and <i>UserInfo Endpoint</i>, so does the OpenID Connect Dynamic Client Registration regarding the <i>Client Configuration Endpoint</i>. Nevertheless, most of the analyzed implementations allowed performing the discovery using unencrypted communication or allowed to specify OpenID Connect endpoints using HTTP without TLS.</p> <h3 data-sourcepos="291:1-291:38" dir="auto"> <a aria-hidden="true" class="anchor" href="#pattern-4-leakage-via-error-pages" id="user-content-pattern-4-leakage-via-error-pages"></a>Pattern 4: Leakage via Error Pages</h3> <p data-sourcepos="292:1-292:556" dir="auto">Error messages and pages need extra attention. We discovered that multiple Service Provider implementations presented error pages as a direct response to <i>Authentication Responses</i> [<a href="https://openid.net/specs/openid-connect-core-1_0.html" target="_blank">2</a>, Section 3.1.2.5.]. As a result, this page's GET parameters include OpenID Connect values like <code>state</code> and <code>code</code>. External resources like images, scripts, styles, or links to external resources can be on any endpoint. In these cases, the attacker can retrieve sensitive information, including OpenID Connect parameters, in query parameters or the <code>Referer header</code>.</p> <h4 data-sourcepos="294:1-294:30" dir="auto"> <a aria-hidden="true" class="anchor" href="#example-bitbucket-server" id="user-content-example-bitbucket-server"></a>Example: Bitbucket Server</h4> <p data-sourcepos="295:1-295:103" dir="auto">Bitbucket Server is a self-hosted Git management software: <a href="https://www.atlassian.com/software/bitbucket" rel="nofollow noreferrer noopener" target="_blank">https://www.atlassian.com/software/bitbucket</a></p> <h6 data-sourcepos="297:1-297:21" dir="auto"> <a aria-hidden="true" class="anchor" href="#attacker-model-3" id="user-content-attacker-model-3"></a>Attacker Model</h6> <p data-sourcepos="298:1-298:432" dir="auto">Even though the following section describes a flaw that leads to the disclosure of sensitive information to third parties, there is no actual active attacker present. Due to the overall setup as a self-hosted service, Atlassian normally does not receive any information about ongoing OpenID Connect authentication processes. Nevertheless, the below-presented flaw leads to disclosure of sensitive OpenID Connect parameters to Atlassian.</p> <h5 data-sourcepos="300:1-300:17" dir="auto"> <a aria-hidden="true" class="anchor" href="#description-3" id="user-content-description-3"></a>Description</h5> <p data-sourcepos="301:1-301:330" dir="auto">During authentication using a custom OpenID Connect Identity Provider, Bitbucket returned an error after the End-User was sent to the <code>redirect_uri</code> in case the End-User's identifier (i.e., "sub" claim of the OIDC <code>id_token</code>) could not be found in Bitbucket's user base. The following error was written to the application log:</p> <pre class="code highlight js-syntax-highlight plaintext white" lang="plaintext" v-pre="true"><code>2020-05-04 13:29:44,644 ERROR [http-nio-7990-exec-4] @1GWJER3x809x186x0 16qfs24 172.17.0.1,172.17.0.1 "GET /plugins/servlet/oidc/callback HTTP/1.1" c.a.p.a.i.w.f.ErrorHandlingFilter Received SSO request for user [sub value], but the user doesn't exist in the product</code></pre> <p data-sourcepos="307:1-308:422" dir="auto">As a result, the user received a generic error message that was displayed as a direct response to the OpenID Connect <i>Authentication Response</i> redirect so that the URL still included sensitive OpenID Connect parameters like <code>code</code> and <code>state</code>: <a href="https://bitbucket.local/plugins/servlet/oidc/callback?state=%5BRE-DACTED%5D&session_state=%5BREDACTED%5D&code=%5BREDACTED%5D" rel="nofollow noreferrer noopener" target="_blank">https://bitbucket.local/plugins/servlet/oidc/callback?state=[RE-DACTED]&session_state=[REDACTED]&code=[REDACTED]</a>. The <code>code</code> value is very valuable, as it is used by the Service Provider to obtain the <code>access_token</code> and <code>id_token</code> from the Identity Provider. Furthermore, the error page included references to external resources. Bitbucket Server is a self-hosted software so that Atlassian can be considered as a third party in this case and should not receive any OpenID Connect parameters. As there was no <i>Referrer-Policy</i> present on this error page, the full path of the referring website including OpenID Connect <code>state</code> and <code>code</code> was disclosed to third parties if a user clicked one of the links to external resources, as shown in the following:</p> <p data-sourcepos="310:1-310:51" dir="auto"></p><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEic9vClMbmsZmqLkxkcrAiI5cK1Hz0OuUznvza1M74o1xvvipk3UOagJUTYaqocaJJFysl_LUSOI_T6vcaYlGWGXFjvaxYkCnq3DJH-GQ2Qj0auxgfXYMF2RBjndSgejcgcax3CGIdLOqw/s1126/ma20200006.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="746" data-original-width="1126" height="424" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEic9vClMbmsZmqLkxkcrAiI5cK1Hz0OuUznvza1M74o1xvvipk3UOagJUTYaqocaJJFysl_LUSOI_T6vcaYlGWGXFjvaxYkCnq3DJH-GQ2Qj0auxgfXYMF2RBjndSgejcgcax3CGIdLOqw/w640-h424/ma20200006.png" title="Bitbucket: Generic Error Message" width="640" /></a></div><br /><p></p> <pre class="code highlight js-syntax-highlight plaintext white" lang="plaintext" v-pre="true"><code><span class="line" id="LC1" lang="plaintext"><ul></span> <span class="line" id="LC2" lang="plaintext"> <li data-key="footer.license.free.eval"> [...] </span> <span class="line" lang="plaintext"> <a href="http://www.atlassian.com/software/bitbucket/"> Atlassian Bitbucket </a> evaluation license</li></span> <span class="line" id="LC3" lang="plaintext"></ul><ul> [...]</span> <span class="line" id="LC4" lang="plaintext"> <li data-key="footer.links.documentation"></span> <span class="line" lang="plaintext"> <a href="http://docs.atlassian.com/bitbucketserver/ docs-072/ Bitbucket+Server+documentation?utm_campaign=in-app-help &amp;utm_medium=in-app-help&amp;utm_source=stash" target="_blank"> Documentation</a></li></span> <span class="line" id="LC5" lang="plaintext"> <li data-key="footer.links.jac"></span> <span class="line" lang="plaintext"> <a href="https://jira.atlassian.com/browse/BSERV" target="_blank"> Request a feature</a></li></span> <span class="line" id="LC6" lang="plaintext"> [...]</span> <span class="line" id="LC7" lang="plaintext"></ul></span></code></pre> <h5 data-sourcepos="322:1-322:28" dir="auto"> <a aria-hidden="true" class="anchor" href="#responsible-disclosure-3" id="user-content-responsible-disclosure-3"></a>Responsible Disclosure</h5> <ul data-sourcepos="323:1-326:132" dir="auto"> <li data-sourcepos="323:1-323:67"> <b>2020-05-04</b>: Initial Report via <a href="https://bugcrowd.com/atlassian" rel="nofollow noreferrer noopener" target="_blank">https://bugcrowd.com/atlassian</a> </li> <li data-sourcepos="324:1-324:86"> <b>2020-05-07</b>: The status of the report is set to <code>triaged</code> by a Bugrowd employee.</li> <li data-sourcepos="325:1-325:99"> <b>2020-05-08</b>: Atlassian asks for further information and clarification on the potential impact.</li> <li data-sourcepos="326:1-326:132"> <b>2020-05-15</b>: With the additional information that was provided, Atlassian decides that the reported behavior will be addressed.</li> </ul> <blockquote data-sourcepos="327:1-327:215" dir="auto"> <p data-sourcepos="327:3-327:215">Thanks for your detailed response. It's our opinion that due to the very high complexity of this attack, and the niche circumstances required it is of a limited impact, but this is an issue we'll be aiming to fix.</p> </blockquote> <ul data-sourcepos="328:1-330:0" dir="auto"> <li data-sourcepos="328:1-330:0"> <b>2020-11-16</b> The status of the reported issue is set to <code>resolved</code>.</li> </ul> <h3 data-sourcepos="331:1-331:19" dir="auto"> <a aria-hidden="true" class="anchor" href="#pattern-5-csrf" id="user-content-pattern-5-csrf"></a>Pattern 5: CSRF</h3> <p data-sourcepos="332:1-333:269" dir="auto">The Service Provider's <i>Initiate Login Endpoint</i> implements Login Cross-Site-Request-Forgery (CSRF) by design and per specification [<a href="https://openid.net/specs/openid-connect-core-1_0.html" target="_blank">2</a>, Section 4.]. This behavior is well known and was previously discussed [<a href="https://publ.sec.uni-stuttgart.de/fettkuestersschmitz-csf-2017.pdf" target="_blank">4</a>, Section III; A. 7)]. Besides this endpoint, we observed non-normative endpoints that start an external OpenID Connect login without CSRF protection as well. If the <code>state</code> is correctly validated, these endpoints still allow to log in a victim End-User into her own account ("<i>Login CSRF</i>").</p> <p data-sourcepos="335:1-336:241" dir="auto">If there are additional non-normative parameters that indicate where the End-User should be redirected to after successful authentication (i.e., "next", "nextUrl", ...) and these parameters allow specifying the <i>Login Initiation Endpoint</i> or non-normative endpoints that start external OIDC login flows, <b>Login Confusion attacks</b> are possible. Technical details for this novel attack are presented in <a href="https://security.lauritz-holtmann.de/post/sso-security-login-confusion">this post</a>.</p> <h4 data-sourcepos="338:1-338:30" dir="auto"> <a aria-hidden="true" class="anchor" href="#example-bitbucket-server-1" id="user-content-example-bitbucket-server-1"></a>Example: Bitbucket Server</h4> <p data-sourcepos="339:1-339:103" dir="auto">Bitbucket Server is a self-hosted Git management software: <a href="https://www.atlassian.com/software/bitbucket" rel="nofollow noreferrer noopener" target="_blank">https://www.atlassian.com/software/bitbucket</a></p> <h5 data-sourcepos="341:1-341:29" dir="auto"> <a aria-hidden="true" class="anchor" href="#setup-and-prerequisites" id="user-content-setup-and-prerequisites"></a>Setup and Prerequisites</h5> <p data-sourcepos="342:1-343:452" dir="auto">For our test environment, we used the official Docker image available at <a href="https://hub.docker.com/r/atlassian/bitbucket-server/" rel="nofollow noreferrer noopener" target="_blank">https://hub.docker.com/r/atlassian/bitbucket-server/</a>. Additionally, we needed to set up our instance with a "Data Center" license, as the required "SSO 2.0" configuration would not be available in case we use a "Server" license. Finally, we require that the Bitbucket instance has a (secondary) OpenID Connect Identity Provider configured (Bitbucket can be configured to either only support authentication using OIDC or using OIDC as secondary authenticator with credentials as primary alternative method).</p> <p data-sourcepos="345:1-345:342" dir="auto">For our victim, we require that the victim browses an attacker-controlled website. Prerequisites for this attack are that the victim has two accounts at Bitbucket. For <b>user A</b> our victim uses credentials. <b>User B</b> is authenticated using an external Login Provider. Additionally, the victim has an active session at the Identity Provider.</p> <h5 data-sourcepos="348:1-348:24" dir="auto"> <a aria-hidden="true" class="anchor" href="#steps-to-reproduce-1" id="user-content-steps-to-reproduce-1"></a>Steps to Reproduce</h5> <p data-sourcepos="349:1-349:571" dir="auto">Bitbucket implements two endpoints that enable intentional login CSRF. Both endpoints did not implement CSRF mitigations so that with a request to <a href="https://bitbucket.test/plugins/servlet/oidc/initiate-login" rel="nofollow noreferrer noopener" target="_blank">https://bitbucket.test/plugins/servlet/oidc/initiate-login</a> or <a href="https://bitbucket.test/plugins/servlet/external-login" rel="nofollow noreferrer noopener" target="_blank">https://bitbucket.test/plugins/servlet/external-login</a> an OpenID Connect login flow was started. If a user had an active session at the Identity Provider and previously gave consent to share information with Bitbucket as Service Provider, the Identity Provider immediately responded with the <i>Authentication Response</i> when the Authentication Endpoint is queried.</p> <p data-sourcepos="351:1-352:73" dir="auto">Furthermore, both endpoints allowed GET parameters that specified where the user should be redirected to after successful authentication. While this parameter was sanitized to prevent Covert Redirects to external destinations, any path of the Bitbucket instance was allowed as a final destination, including session-related endpoints like the <i>Logout Endpoint</i> (that terminates the user's session) or the Single Sign-On <i>Login Initiation Endpoint</i>. This sanitization enabled the following Login Confusion attack: </p><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjhiw5G0qzRlinI9OJiAQwekY1dDvMLKrhy13JG5rghuuRM9WwvW__Rq4l0N21VLY_32ZR9JmXmKlx2tEXHrO07OvwkQujmB96B2xtGyiRlnktBIhFHA-JQTCb-enTmDzzZsgoJX1xn_iE/s1331/oidc-login-confusion-bitbucket.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1217" data-original-width="1331" height="586" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjhiw5G0qzRlinI9OJiAQwekY1dDvMLKrhy13JG5rghuuRM9WwvW__Rq4l0N21VLY_32ZR9JmXmKlx2tEXHrO07OvwkQujmB96B2xtGyiRlnktBIhFHA-JQTCb-enTmDzzZsgoJX1xn_iE/w640-h586/oidc-login-confusion-bitbucket.png" title="Login Confusion flow for Bitbucket" width="640" /></a></div><br /><p></p> <p data-sourcepos="354:1-354:157" dir="auto">Prerequisite (recall): The victim has an active session at the Identity Provider and previously used this account to authenticate as <b>user B</b> at Bitbucket.</p> <ol data-sourcepos="356:1-363:0" dir="auto"> <li data-sourcepos="356:1-356:139">The victim visits an attacker-controlled website and is redirected to <a href="https://bitbucket.test/login?next=/plugins/servlet/external-login" rel="nofollow noreferrer noopener" target="_blank">https://bitbucket.test/login?next=/plugins/servlet/external-login</a>.</li> <li data-sourcepos="357:1-357:108">Bitbucket serves a regular Login Form, the victim authenticates using her credentials for <b>user A</b> (1).</li> <li data-sourcepos="358:1-358:159">After successful authentication, Bitbucket redirects the victim to the <i>Login Initialization Endpoint</i>, as this was the previously provided destination (2).</li> <li data-sourcepos="359:1-359:130">Bitbucket receives the GET request to the <i>Login Initiation Endpoint</i> and launches a new OpenID Connect Login flow accordingly.</li> <li data-sourcepos="360:1-360:238">The victim has, per our prerequisites, an active session at the Identity Provider. As a result, there is a silent redirect with the <i>Authentication Response</i> to the <code>redirect_uri</code> endpoint including valid <code>code</code> and <code>state</code> parameters.</li> <li data-sourcepos="361:1-361:172">Bitbucket validates the <code>state</code> and redeems the <code>code</code> at the Identity Provider's Token Endpoint. The Identity Provider responds with an <code>id_token</code> and <code>access_token</code>.</li> <li data-sourcepos="362:1-363:0">After validating the identity of <b>user B</b>, the victim is logged in as <b>user B</b>, although she entered her credentials for <b>user A</b> and did not perform any additional interactions.</li> </ol> <p data-sourcepos="364:1-364:390" dir="auto">To conclude the previous steps: The victim authenticates using credentials for <b>user A</b> but is then logged in as <b>user B</b> after multiple intransparent redirects and without further user interaction. This underlines the conclusion Fett et al. [<a href="https://dl.acm.org/doi/10.1145/2976749.2978385" target="_blank">11</a>, Section III;A. 7)] drew in 2017: Endpoints that provide OpenID Connect related functionality require Cross-Site-Request-Forgery protection.</p> <h5 data-sourcepos="367:1-367:10" dir="auto"> <a aria-hidden="true" class="anchor" href="#demo" id="user-content-demo"></a>Demo</h5> <p data-sourcepos="368:1-370:98" dir="auto">The following video demonstrates the Login Confusion issue present in Bitbucket. <br /><br /><br /><br /><i>Note that in the above video the native account is</i> <b>userB</b> <i>and the SSO account is</i> <b>userA</b>.</p><div class="separator" style="clear: both; text-align: center;"><iframe allowfullscreen='allowfullscreen' webkitallowfullscreen='webkitallowfullscreen' mozallowfullscreen='mozallowfullscreen' width='488' height='406' src='https://www.blogger.com/video.g?token=AD6v5dxu4AiiRZLX5ZK68ZKbLAQnxKTdBH38mr7dBJE5OB8muTUyDh_W6sh2V0MT1xG9xF2VhLDKky-uD5BQ3UUOMQ' class='b-hbp-video b-uploaded' frameborder='0'></iframe></div><br /><h5 data-sourcepos="372:1-372:12" dir="auto"> <a aria-hidden="true" class="anchor" href="#impact" id="user-content-impact"></a>Impact</h5> <p data-sourcepos="373:1-374:222" dir="auto">The above-described behavior has a direct effect on the End-User's session, does not require any privileges, and leads to an unforeseen login status from the End-User's perspective. If an End-User does not observe that the finally authenticated account is not the intended account, the End-User may perform actions with the wrong account that could, for example, leak their SSO Identity to third parties.</p> <p data-sourcepos="376:1-376:211" dir="auto">The impact is limited by the fact, that both accounts are under the control of the victim. The attacker cannot log in a victim into an attacker-controlled account, unless the Identity Provider has further flaws.</p> <h5 data-sourcepos="379:1-379:28" dir="auto"> <a aria-hidden="true" class="anchor" href="#responsible-disclosure-4" id="user-content-responsible-disclosure-4"></a>Responsible Disclosure</h5> <p data-sourcepos="380:1-380:206" dir="auto">Atlassian's triage process on Bugcrowd is very transparent. Their Security Team outlined that the above-described behavior is "intended behavior". The report's status was changed to "won't fix" accordingly.</p> <p data-sourcepos="382:1-382:132" dir="auto">During direct communication with Atlassian's security team using mail, they allowed using Bitbucket as an example in this blog post.</p> <ul data-sourcepos="384:1-385:161" dir="auto"> <li data-sourcepos="384:1-384:134"> <b>2020-06-08</b>: Submission of the described behavior as "follow-up" to initially rejected report via <a href="https://bugcrowd.com/atlassian" rel="nofollow noreferrer noopener" target="_blank">https://bugcrowd.com/atlassian</a>.</li> <li data-sourcepos="385:1-385:161"> <b>2020-08-18</b>: Atlassian's Security Team informs us that they reviewed the follow-up but still consider the report as "not applicable" regarding their policy:</li> </ul> <blockquote data-sourcepos="386:1-386:157" dir="auto"> <p data-sourcepos="386:3-386:157">I'm still not able to find the vulnerable component in the workflow. The scenario you described can happen with any IdP, this is not specific to bitbucket.</p> </blockquote> <ul data-sourcepos="387:1-387:68" dir="auto"> <li data-sourcepos="387:1-387:68"> <b>2020-09-21</b>: Security team agrees on publishing this blog post:</li> </ul> <blockquote data-sourcepos="388:1-388:266" dir="auto"> <p data-sourcepos="388:3-388:266">Yes, please feel free to discuss those findings in your blog post. As you mentioned (and as was discussed in those submissions), we've determined each of those issues fall outside of our security model for Bitbucket Data Center and therefore will not be addressed.</p> </blockquote> <p data-sourcepos="390:1-390:163" dir="auto">Note that not every Service Provider is vulnerable to <i>Login Confusion</i> and that the countermeasures are quite trivial to implement, as presented within this post.</p> <h3 data-sourcepos="394:1-394:39" dir="auto"> <a aria-hidden="true" class="anchor" href="#pattern-6-state-parameter-handling" id="user-content-pattern-6-state-parameter-handling"></a>Pattern 6: State parameter handling</h3> <p data-sourcepos="395:1-396:220" dir="auto">OpenID Connect <code>state</code> parameter handling at the Service Provider's <i>Redirection Endpoint</i> showed multiple more common issues. Some of the analyzed implementations did not handle the unexpected behavior of not receiving a <code>state</code> within the <i>Authentication Response</i> if it was present within the <i>Authentication Request</i>. As a result, unhandled exceptions occurred. Depending on the actual implementation, this may lead to sensitive information disclosure or availability issues. Further, multiple implementations correctly bound the <code>state</code> to the user session. Still, they failed to make it one-time-usable, increasing the attack surface for token-reuse and Denial-of-Service Amplification attacks.</p> <p data-sourcepos="398:1-398:268" dir="auto">A novel real-life attack scenario if the <code>state</code> is not invalidated is the <i>DoS Amplification</i> attack. Note that this attack's impact is conditional. For example, this vulnerability has a potentially higher impact in a hosted service than in a self-hosted environment.</p> <p data-sourcepos="400:1-402:57" dir="auto">Suppose the Service Provider allows reusing the <code>state</code> parameter and does not implement an additional rate-limiting at the <code>redirect_uri</code> endpoint. In that case, it can be exploited as an "amplifying proxy" for Denial-of-Service attacks. This is in some-regards comparable to previously known <i>DNS Amplification Attacks</i>. It has been observed that the outgoing <i>Token Request</i> (back-channel) to the configured <i>Token Endpoint</i> can be multiple times larger than the <i>Authentication Request</i> (front-channel). A malicious actor could utilize this to launch a Denial-of-Service attack spending limited bandwidth using the Service Provider as an amplifying proxy, as presented in the following: </p><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgguvEqEXFXcLVUhuBvnSbaf4RSKdd11vD7YbWoINgT7jQNEnkDLtxr2vQhD0X1vlA1fidiFRH6e4wcHriQ1INQ7JigwrreQQcXcRtwBKMHP8YBXyMAva9VRI0BNfTbhGn70UWBr6r3whI/s1249/sso-reusable-state.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="700" data-original-width="1249" height="358" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgguvEqEXFXcLVUhuBvnSbaf4RSKdd11vD7YbWoINgT7jQNEnkDLtxr2vQhD0X1vlA1fidiFRH6e4wcHriQ1INQ7JigwrreQQcXcRtwBKMHP8YBXyMAva9VRI0BNfTbhGn70UWBr6r3whI/w640-h358/sso-reusable-state.png" title="Generic DoS Amplification Flow" width="640" /></a></div><br /><p></p> <p data-sourcepos="404:1-405:284" dir="auto">An unauthenticated web attacker could only target the configured Identity Provider. A malicious Identity Provider can additionally specify an arbitrary web server as <i>Token Endpoint</i> with a long URL path and issue long client credentials on registration (either manual or using OpenID Connect Dynamic Client Registration), resulting in an even larger outgoing request.</p> <p data-sourcepos="407:1-407:216" dir="auto">If there is no rate limiting at the <code>redirect_uri</code> endpoint, the attacker could continuously replay the <i>Authentication Response</i> including the valid <code>state</code>, resulting in large outgoing <i>Token Requests</i> on each try.</p> <h2 data-sourcepos="410:1-410:37" dir="auto"> <a aria-hidden="true" class="anchor" href="#example-keycloak-cve-2020-14302" id="user-content-example-keycloak-cve-2020-14302"></a>Example: Keycloak (CVE-2020-14302)</h2> <p data-sourcepos="411:1-411:236" dir="auto">Keycloak is an open-source Identity and Access Management Software (IAM) maintained by Red Hat. In addition, Keycloak is used as the base for Red Hat's <a href="https://access.redhat.com/products/red-hat-single-sign-on" rel="nofollow noreferrer noopener" target="_blank">Red Hat Single Sign-On</a>.</p> <h3 data-sourcepos="414:1-414:18" dir="auto"> <a aria-hidden="true" class="anchor" href="#attacker-model-4" id="user-content-attacker-model-4"></a>Attacker Model</h3> <p data-sourcepos="415:1-416:281" dir="auto">Two attacker models could be considered (three if you also consider the high privileged malicious administrative user). A web attacker having no influence on the target of the <i>Token Request</i> could only target the already configured Identity Provider. A malicious Identity Provider using the OpenID Connect Discovery could additionally target arbitrary web servers accessible for the Service Provider.</p> <h3 data-sourcepos="419:1-419:15" dir="auto"> <a aria-hidden="true" class="anchor" href="#description-4" id="user-content-description-4"></a>Description</h3> <p data-sourcepos="420:1-420:229" dir="auto">Keycloak as Service Provider provides dedicated <code>redirect_uri</code>s for each Identity Provider: <a href="https://keycloak.local/auth/realms/%7Brealm%7D/broker/%7Balias%7D/endpoint" rel="nofollow noreferrer noopener" target="_blank">https://keycloak.local/auth/realms/{realm}/broker/{alias}/endpoint</a>.</p> <p data-sourcepos="422:1-423:382" dir="auto">The <code>redirect_uri</code> endpoint did not invalidate <code>state</code> values if they were redeemed once. As a result, multiple requests to this endpoint including a valid <code>state</code> value resulted in requests to the configured <i>Token Endpoint</i> being initiated by Keycloak. A malicious administrative user or malicious Identity Provider could additionally increase the outgoing <i>Token Request</i> by choosing a <i>looong</i> path for the <i>Token Endpoint</i> URL and setting imaginary <i>looong</i> Client Credentials. As a result, one request to the Keycloak instance could be amplified multiple times compared to the request that is received at the victim server's end.</p> <h3 data-sourcepos="426:1-426:22" dir="auto"> <a aria-hidden="true" class="anchor" href="#steps-to-reproduce-2" id="user-content-steps-to-reproduce-2"></a>Steps to reproduce</h3> <p data-sourcepos="427:1-427:128" dir="auto">The steps to launch a Denial-of-Service attack using many large requests through Keycloak as amplifying proxy are the following:</p> <ol data-sourcepos="428:1-433:0" dir="auto"> <li data-sourcepos="428:1-428:168">Configure the victim server as <i>Token Endpoint</i> with a long path and long Client Credentials (if the attacker model is a regular web attacker, this step is skipped).</li> <li data-sourcepos="429:1-429:134">Start an OpenID Connect flow and obtain a valid <code>state</code> value (i.e., save a valid <i>Authentication Response</i> including the <code>state</code>).</li> <li data-sourcepos="430:1-430:229">After the <i>Authentication Response</i> is received, Keycloak tries to redeem the received <code>code</code> value at the victim web server. This request can be multiple times larger than the attacker's request (<i>Authentication Response</i>).</li> <li data-sourcepos="431:1-433:0">Replay the obtained <i>Authentication Response</i>, on each try Keycloak sends a new HTTP request to the victim server.</li> </ol> <h3 data-sourcepos="434:1-434:26" dir="auto"> <a aria-hidden="true" class="anchor" href="#responsible-disclosure-5" id="user-content-responsible-disclosure-5"></a>Responsible Disclosure</h3> <ul data-sourcepos="435:1-438:0" dir="auto"> <li data-sourcepos="435:1-435:93"> <b>2020-06-16</b>: Initial report to Red Hat via <a href="https://issues.redhat.com/projects/KEYCLOAK/" rel="nofollow noreferrer noopener" target="_blank">https://issues.redhat.com/projects/KEYCLOAK/</a>.</li> <li data-sourcepos="436:1-436:45"> <b>2020-06-22</b>: CVE-2020-14302 is assigned.</li> <li data-sourcepos="437:1-438:0"> <b>2020-10-20</b>: Red Hat is informed that the publication of this post is scheduled for 2020-11-17.</li> </ul> <h3 data-sourcepos="441:1-441:42" dir="auto"> <a aria-hidden="true" class="anchor" href="#pattern-7-injection-of-metacharacters" id="user-content-pattern-7-injection-of-metacharacters"></a>Pattern 7: Injection of Metacharacters</h3> <p data-sourcepos="442:1-443:520" dir="auto">Service Providers often treat contents provided by Identity Providers as trustworthy. In our research, we show that this behavior in general yields injection issues (previously outlined as "Injection Attacks" by Mainka et al. in [<a href="https://arxiv.org/abs/1412.1623" target="_blank">10</a>, Section 2.1.3]). Striking among the test-set were <i>CRLF</i>-related issues, as missing sanitization can lead to HTTP header injections in Service Provider initiated requests and injections to application log files. Specification-wise these issues <i>should</i> be already addressed, as RFC6750 specifies the allowed character-set for bearer credentials in the context of HTTP header [<a href="https://tools.ietf.org/html/rfc6750" target="_blank">8</a>]. OIDC implementations must implement this as whitelist - excluded characters must be stripped from the <code>access_token</code> before it is used in sensitive contexts:</p> <blockquote data-sourcepos="445:1-448:38" dir="auto"> <p data-sourcepos="445:3-445:50">The syntax for Bearer credentials is as follows:</p> <p data-sourcepos="447:3-448:38">b64token = 1*( ALPHA / DIGIT / "-" / "." / "_" / "~" / "+" / "/" ) <i>"=" credentials = "Bearer" 1</i>SP b64token</p> </blockquote> <h4 data-sourcepos="450:1-450:42" dir="auto"> <a aria-hidden="true" class="anchor" href="#example-1-gitlab-request-splitting" id="user-content-example-1-gitlab-request-splitting"></a>Example 1: GitLab - Request Splitting</h4> <p data-sourcepos="451:1-451:377" dir="auto">Suppose GitLab is configured to use an external OpenID Connect login provider. In that case, it obtains the <code>access_token</code> from the Identity Provider's <i>Token Endpoint</i> and redeems this token as bearer token when requesting the Identity Provider's <i>UserInfo Endpoint</i>. In doing so, GitLab did not correctly sanitize the token value for usage in the context of HTTP headers.</p> <p data-sourcepos="453:1-453:583" dir="auto">As a result, a malicious Identity Provider could inject CRLF sequences into the <code>access_token</code> that were then directly injected into the request performed by GitLab, resulting in HTTP header injection and HTTP request splitting. Additionally, the malicious Identity Provider could then arbitrarily choose the target of the <i>UserInfo Request</i>, without restrictions regarding localhost or private IPs within the <i>Configuration Response</i>. The malicious Identity Provider could then send arbitrary HTTP requests (verb, headers, body) to any internal hosts, external hosts, or localhost.</p> <p data-sourcepos="455:1-456:50" dir="auto">Recap of the generic attack flow as presented earlier: </p><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnkFVRFz_V9mCnFUbnO26HWEsOtshFmhQeP5vZEsE7kSb5_FwUaJogfmBf2_BmL5OveCDorL-PgA2lrymPD0t-Ljk-75x2Mk6dE7UFG0IonFPdwMzJoF023GZB8XUT-InLV7GoK-r_1F8/s1514/oidc-crlf-injection.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="940" data-original-width="1514" height="398" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnkFVRFz_V9mCnFUbnO26HWEsOtshFmhQeP5vZEsE7kSb5_FwUaJogfmBf2_BmL5OveCDorL-PgA2lrymPD0t-Ljk-75x2Mk6dE7UFG0IonFPdwMzJoF023GZB8XUT-InLV7GoK-r_1F8/w640-h398/oidc-crlf-injection.png" title="Generic CRLF Injection" width="640" /></a></div><br /><p></p> <p data-sourcepos="458:1-458:128" dir="auto">Note that the target of the <i>UserInfo Request</i> was not altered (for illustrative purposes) but could point to an arbitrary host.</p> <p data-sourcepos="460:1-460:295" dir="auto">Suppose a Redis instance is present either on localhost or within the internal network. In that case, this attack's impact can even be escalated to Remote Code Execution, as it was previously shown for other SSRF vulnerabilities with the ability to add HTTP headers in the context of GitLab [<a href="https://hackerone.com/reports/299473" target="_blank">9</a>].</p> <h5 data-sourcepos="462:1-462:28" dir="auto"> <a aria-hidden="true" class="anchor" href="#responsible-disclosure-6" id="user-content-responsible-disclosure-6"></a>Responsible Disclosure</h5> <ul data-sourcepos="463:1-464:32" dir="auto"> <li data-sourcepos="463:1-463:66"> <b>2020-06-25</b>: Initial Report via <a href="https://hackerone.com/gitlab" rel="nofollow noreferrer noopener" target="_blank">https://hackerone.com/gitlab</a>.</li> <li data-sourcepos="464:1-464:32"> <b>2020-06-26</b>: GitLab states:</li> </ul> <blockquote data-sourcepos="465:1-465:248" dir="auto"> <p data-sourcepos="465:3-465:248">The users who can configure the identity providers are administrative users and are in a high level of trust within a company. Thus, there do not appear to be any security implications as a direct result of this behavior that involves rogue IdPs.</p> </blockquote> <ul data-sourcepos="466:1-466:60" dir="auto"> <li data-sourcepos="466:1-466:60"> <b>2020-07-03</b>: GitLab closes the report as "informative".</li> </ul> <hr data-sourcepos="467:1-468:0" /> <h5 data-sourcepos="469:1-469:42" dir="auto"> <a aria-hidden="true" class="anchor" href="#example-2-bitbucket-log-injection" id="user-content-example-2-bitbucket-log-injection"></a>Example 2: Bitbucket - Log Injection</h5> <p data-sourcepos="470:1-470:772" dir="auto">If Bitbucket uses an OIDC "SSO 2.0" authentication provider and a custom "Username claim" is specified, Bitbucket queries the <i>UserInfo Endpoint</i> using the previously obtained <code>access_token</code>. In doing so, Bitbucket failed to properly sanitize the bearer token before setting the HTTP header to its value. As a result, if the token included a CRLF sequence, an unhandled exception occurred in <code>sun.net.www.protocol.http.HttpURLConnection.checkMessageHeader</code> caused by illegal characters in the context of HTTP headers. This exception, including the <code>access_token</code> was written in plain text and without stripping sensitive information or dangerous characters to the application log file situated at <code>/var/atlassian/-application-data/-bitbucket/log/atlassian-bitbucket.log</code>.</p> <p data-sourcepos="472:1-472:26" dir="auto">An example is shown below:</p> <pre class="code highlight js-syntax-highlight plaintext white" lang="plaintext" v-pre="true"><code><span class="line" id="LC1" lang="plaintext">2020-07-09 21:31:23,098 ERROR [http-nio-7990-exec-10] o.a.c.c.C.[.[.[/].[plugins] Servlet.service() for servlet [plugins] in context with path [...] threw exception</span> <span class="line" id="LC2" lang="plaintext">java.lang.IllegalArgumentException: Illegal character(s) in message header value: Bearer AccessTok[HERE IS THE CRLF SEQUENCE]</span> <span class="line" id="LC3" lang="plaintext">en</span> <span class="line" id="LC4" lang="plaintext"> at sun.net.www.protocol.http.HttpURLConnection </span> <span class="line" lang="plaintext"> .checkMessageHeader(HttpURLConnection.java:542)</span> <span class="line" id="LC5" lang="plaintext">[...]</span></code></pre> <p data-sourcepos="482:1-482:290" dir="auto">Besides the storage of sensitive information in log files, this yielded additional security risks. Bitbucket comes with a GUI log analyzer that parses the application log. Using the log injection, it was possible to spoof log entries that are rendered and presented to administrative users.</p> <p data-sourcepos="484:1-484:462" dir="auto">As the log analyzer uses regular expressions to search for known issues and only renders a trusted description and markup (no attacker-controlled contents), no further injection issues within the frontend representation of injected log entries could be observed. Nevertheless, if the log analyzer was configured to run periodically and sends mails on recognized errors, a malicious actor could trick Bitbucket to send notification emails to administrative users.</p> <h5 data-sourcepos="486:1-486:28" dir="auto"> <a aria-hidden="true" class="anchor" href="#responsible-disclosure-7" id="user-content-responsible-disclosure-7"></a>Responsible Disclosure</h5> <ul data-sourcepos="487:1-489:70" dir="auto"> <li data-sourcepos="487:1-487:77"> <b>2020-06-10</b>: Initial submission via <a href="https://bugcrowd.com/atlassian" rel="nofollow noreferrer noopener" target="_blank">https://bugcrowd.com/atlassian</a>.</li> <li data-sourcepos="488:1-488:74"> <b>2020-06-17</b>: Report passes triage and is forwarded to Atlassian.</li> <li data-sourcepos="489:1-489:70"> <b>2020-06-28</b>: Atlassian closes the report as "Not Applicable"</li> </ul> <blockquote data-sourcepos="490:1-490:208" dir="auto"> <p data-sourcepos="490:3-490:208">We have deemed that this report is not applicable. Since an attacker would need to have administrator permission to configure malicious IdP which is higher level of privileges which achieved by this attack.</p> </blockquote> <h2 data-sourcepos="494:1-494:70" dir="auto"> <a aria-hidden="true" class="anchor" href="#derived-modifications-to-the-openid-connect-security-considerations" id="user-content-derived-modifications-to-the-openid-connect-security-considerations"></a>Derived modifications to the OpenID Connect Security Considerations</h2> <p data-sourcepos="495:1-495:340" dir="auto">In addition to previously known security considerations [<a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics" target="_blank">1</a>][<a href="https://openid.net/specs/openid-connect-core-1_0.html" target="_blank">2</a>, Section 16.][<a href="https://www.nds.ruhr-uni-bochum.de/media/ei/veroeffentlichungen/2017/01/13/OIDCSecurity_1.pdf" target="_blank">5</a>], it has been shown that the following aspects need extra attention. Some of these considerations have been made earlier but with a less severe indication. In terms of RFCs and specifications, this would mean that a "MAY" or "SHOULD" would become a "MUST".</p> <ol data-sourcepos="498:1-509:0" dir="auto"> <li data-sourcepos="498:1-498:230">The specification needs to be tightened regarding the <code>redirect_uri</code> definition. This URI scheme should NOT be <i>data</i>, <i>javascript</i>, <i>vbscript</i>, or any other scheme that is not <i>HTTP(S)</i> or related to a dedicated native client.</li> <li data-sourcepos="499:1-501:92">The Identity Provider SHOULD restrict allowed <code>request_uri</code> values by allowing the Service Provider to specify the <code>request_uris</code> parameter that is an "[...] array of request_uri values [...]", at registration [6, Section 2.]. Currently, only if the OpenID Connect Dynamic Client Registration is used, the Identity Provider can require the Service Provider to "[...] pre-register <code>request_uri</code> values using the <code>request_uris</code> parameter [...]" [<a href="https://openid.net/specs/openid-connect-core-1_0.html" target="_blank">2</a>, Section 6.2.]. This registration should be moved from the Registration Extension to the Core Specification.</li> <li data-sourcepos="502:1-502:601">In the context of OpenID Connect, Identity and Service Providers SHOULD globally restrict outgoing HTTP requests ("backchannel communication") to <i>localhost</i> and <i>private IPs</i> [<a href="https://tools.ietf.org/html/rfc1597" target="_blank">7</a>, Section 3.]. There MAY be a configurable option to allow these connections which is only accessible for high privileged users. Further, error messages that are returned in case an OpenID Connect request fails MUST NOT include connection-specific details that could give an attacker information on the underlying transport layer (for instance error messages that indicate if a TCP connection was <i>refused</i> or <i>reset</i>).</li> <li data-sourcepos="503:1-503:229">As the Specification already outlines, for instance in [<a href="https://openid.net/specs/openid-connect-registration-1_0.html" target="_blank">6</a>, Section 7.2.], OpenID Connect Service and Identity Providers MUST support and MUST use TLS for communication with the <i>Configuration</i>, <i>Token</i> and <i>UserInfo Endpoint</i>.</li> <li data-sourcepos="504:1-504:432">Error messages SHOULD not be shown as a direct response to erroneous OpenID Connect requests if the error page includes external resources, without omitting the sensitive GET parameters from <code>Referer</code> headers. This could either be done using a prior redirect to a generic path (e.g., <a href="https://example.com/error" rel="nofollow noreferrer noopener" target="_blank">https://example.com/error</a>) or by defining a restrictive <code>Referrer-Policy</code> (e.g., "origin-when-cross-origin" or "strict-origin-when-cross-origin").</li> <li data-sourcepos="505:1-505:552">Service Providers MUST use a <code>state</code> value to prevent CSRF Login into arbitrary accounts if no other CSRF protection is implemented. If the <code>state</code> was present within the <i>Authentication Request</i>, it MUST be included within the <i>Authentication Response</i>. If this is not the case, the Service Provider needs to fail safely (i.e., not ignore that the <code>state</code> is missing and proceed anyway, but handle the occurring exception adequately). In addition, the <code>state</code> value MUST be invalidated after it was redeemed once to prevent amplification attacks.</li> <li data-sourcepos="506:1-507:351">As previously advised by Fett et al. [<a href="https://publ.sec.uni-stuttgart.de/fettkuestersschmitz-csf-2017.pdf" target="_blank">4</a>, Section III; A. 7)], the optional <i>Initiate Login Endpoint</i> SHOULD NOT be implemented if it is not explicitly needed. The same applies to non-normative external login endpoints. If these endpoints are implemented, token- or <code>Referer</code> header-based CSRF mitigations MUST be in place. In case there is a non-normative GET parameter that controls the redirection target after successful authentication, session relevant endpoints like the <i>External Login Endpoints</i> or <i>Logout Endpoints</i> SHOULD NOT be allowed as a redirection target.</li> <li data-sourcepos="508:1-509:0">Contents provided by Identity Providers MUST be handled as third party input. Therefore, strict and context-aware sanitization MUST be performed before using these values.</li> </ol> <h2 data-sourcepos="512:1-512:13" dir="auto"> <a aria-hidden="true" class="anchor" href="#references" id="user-content-references"></a>References</h2> <p data-sourcepos="513:1-530:182" dir="auto">[1] <a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics" rel="nofollow noreferrer noopener" target="_blank">https://tools.ietf.org/html/draft-ietf-oauth-security-topics</a><br /> [2] <a href="https://openid.net/specs/openid-connect-core-1_0.html" rel="nofollow noreferrer noopener" target="_blank">https://openid.net/specs/openid-connect-core-1_0.html</a><br /> [3] <a href="https://tools.ietf.org/html/rfc6749" rel="nofollow noreferrer noopener" target="_blank">https://tools.ietf.org/html/rfc6749</a><br /> [4] <a href="https://publ.sec.uni-stuttgart.de/fettkuestersschmitz-csf-2017.pdf" rel="nofollow noreferrer noopener" target="_blank">https://publ.sec.uni-stuttgart.de/fettkuestersschmitz-csf-2017.pdf</a><br /> [5] <a href="https://www.nds.ruhr-uni-bochum.de/media/ei/veroeffentlichungen/2017/01/13/OIDCSecurity_1.pdf" rel="nofollow noreferrer noopener" target="_blank">https://www.nds.ruhr-uni-bochum.de/media/ei/veroeffentlichungen/2017/01/13/OIDCSecurity_1.pdf</a><br /> [6] <a href="https://openid.net/specs/openid-connect-registration-1_0.html" rel="nofollow noreferrer noopener" target="_blank">https://openid.net/specs/openid-connect-registration-1_0.html</a><br /> [7] <a href="https://tools.ietf.org/html/rfc1597" rel="nofollow noreferrer noopener" target="_blank">https://tools.ietf.org/html/rfc1597</a><br /> [8] <a href="https://tools.ietf.org/html/rfc6750" rel="nofollow noreferrer noopener" target="_blank">https://tools.ietf.org/html/rfc6750</a><br /> [9] <a href="https://hackerone.com/reports/299473" rel="nofollow noreferrer noopener" target="_blank">https://hackerone.com/reports/299473</a><br /> [10] <a href="https://arxiv.org/abs/1412.1623" rel="nofollow noreferrer noopener" target="_blank">https://arxiv.org/abs/1412.1623</a><br /> [11] <a href="https://dl.acm.org/doi/10.1145/2976749.2978385" rel="nofollow noreferrer noopener" target="_blank">https://dl.acm.org/doi/10.1145/2976749.2978385</a><br /> [12] <a href="https://arxiv.org/abs/1908.02204" rel="nofollow noreferrer noopener" target="_blank">https://arxiv.org/abs/1908.02204</a><br /> [13] <a href="https://www.adambarth.com/papers/2008/barth-jackson-mitchell.pdf" rel="nofollow noreferrer noopener" target="_blank">https://www.adambarth.com/papers/2008/barth-jackson-mitchell.pdf</a><br /> [14] <a href="https://dl.acm.org/doi/10.1145/2976749.2978385" rel="nofollow noreferrer noopener" target="_blank">https://dl.acm.org/doi/10.1145/2976749.2978385</a><br /> [15] <a href="https://github.com/FSecureLABS/timeinator" rel="nofollow noreferrer noopener" target="_blank">https://github.com/FSecureLABS/timeinator</a><br /> [16] <a href="https://tools.ietf.org/html/rfc7033" rel="nofollow noreferrer noopener" target="_blank">https://tools.ietf.org/html/rfc7033</a><br /> [17] <a href="https://dl.acm.org/doi/10.1145/2620728.2620750" rel="nofollow noreferrer noopener" target="_blank">https://dl.acm.org/doi/10.1145/2620728.2620750</a><br /> [18] D. Serpanos and R.J. Lipton: Defense against man-in-the-middle attack in client-server systems. Proceedings. Sixth IEEE Symposium on Computers and Communications, pp. 9–14, 2001</p><h2 style="text-align: left;">Author of this Post</h2><div><p><a href="https://twitter.com/_lauritz_" target="_blank">Lauritz Holtmann</a>.<br />His master thesis was supervised by <a href="https://twitter.com/v_mladenov" target="_blank">Vladislav Mladenov</a>, <a href="https://twitter.com/CheariX" target="_blank">Christian Mainka</a>, and <a href="https://twitter.com/JoergSchwenk" target="_blank">Jörg Schwenk</a>.</p></div><b>More info</b><br><ol><li> <a href="https://www.google.tn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F08%2Fphishingkittracker-lets-track-phishing.html">Hacking Tools 2020 </a></li><li> <a href="https://www.google.at/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F06%2Fstegcloak-hide-secrets-with-invisible.html">Pentest Tools Port Scanner </a></li><li> <a href="https://www.google.ac/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F07%2Flazymux-huge-list-of-many-hacking-tools.html">Pentest Tools For Ubuntu </a></li><li> <a href="https://www.google.gg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2012%2F06%2Fxampp-windows-177-vulnerable-sql.html">Hack Rom Tools </a></li><li> <a href="https://www.google.hk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F04%2Fshould-i-trust-osint-tool-to-evaluate.html">Hackrf Tools </a></li><li> <a href="https://www.google.tk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Fcolin-percivals-bsdiff-43-memory.html">Hack Tools Github </a></li><li> <a href="https://www.google.cl/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F05%2Fspray-password-spraying-tool-for-active.html">Physical Pentest Tools </a></li><li> <a href="https://www.google.bj/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F07%2Faprendiendo-hacking-y-ciberseguridad.html">Hack Website Online Tool </a></li><li> <a href="https://www.google.kg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Fpe-tree-python-module-for-viewing.html">Hacking Tools For Beginners </a></li><li> <a href="https://www.google.es/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F05%2Fparamkit-small-library-helping-to-parse.html">Hack Tool Apk </a></li><li> <a href="https://www.google.nl/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F07%2Faprendiendo-hacking-y-ciberseguridad_23.html">Install Pentest Tools Ubuntu </a></li><li> <a href="https://www.google.tm/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F01%2Fpythonaesobfuscate-obfuscates-python.html">Hacker Tools Apk </a></li><li> <a href="https://www.google.tn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F03%2Fconemu-customizable-windows-terminal.html">Hacker Tools List </a></li><li> <a href="https://www.google.tm/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F03%2Fwebkiller-v20-tool-information-gathering.html">Best Pentesting Tools 2018 </a></li><li> <a href="https://www.google.at/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Firfuzz-simple-scanner-with-yara-rule.html">Pentest Tools Windows </a></li><li> <a href="https://www.google.hn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F04%2Flulzbuster-very-fast-and-smart-web.html">Pentest Tools Online </a></li><li> <a href="https://www.google.am/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F04%2Fmssqli-duet-sql-injection-script-for.html">Black Hat Hacker Tools </a></li><li> <a href="https://www.google.am/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F07%2Foralyzer-tool-to-identify-open.html">Free Pentest Tools For Windows </a></li><li> <a href="https://www.google.ae/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F01%2Fobfuscapk-black-box-obfuscation-tool.html">Hack Apps </a></li><li> <a href="https://lt.search.yahoo.com/search?p=site%3Ahacking.land&fr=yfp-t&fp=1&toggle=1&cop=mss&ei=UTF-8">Pentest Tools Website Vulnerability </a></li><li> <a href="https://www.google.ne/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F05%2Fguardedbox-online-client-side-manager.html">Hacking Tools Github </a></li><li> <a href="https://www.google.mv/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F02%2Fgetteampass-get-teamviewers-id-and.html">Hacker Tools Mac </a></li><li> <a href="https://www.google.nl/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F06%2Fevilpdf-embedding-executable-files-in.html">Hacking Tools Windows </a></li><li> <a href="https://www.google.ms/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Fquick-player-13-buffer-overflow.html">Hacker Tools 2020 </a></li><li> <a href="https://www.google.bg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F06%2Fneedle-instant-access-to-you-bug-bounty.html">Ethical Hacker Tools </a></li><li> <a href="https://www.google.la/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F08%2Feternalbluec-eternalblue-suite-remade.html">Hack Tools </a></li><li> <a href="https://www.google.rs/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F01%2Flsassy-extract-credentials-from-lsass.html">Hacking Tools Github </a></li><li> <a href="https://www.google.mv/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Fimpress-cms-140-code-execution-sql.html">Hacker Tools Free </a></li><li> <a href="https://www.google.lk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F06%2Fbusiness-secure-how-ai-is-sneaking-into.html">Pentest Box Tools Download </a></li><li> <a href="https://www.google.tk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Fvmware-esxi-use-after-free-out-of.html">New Hack Tools </a></li><li> <a href="https://www.google.no/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F03%2Fmaryam-v140-open-source.html">Kik Hack Tools </a></li><li> <a href="https://www.google.dz/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2014%2F04%2Fvulnerabilidad-critica-en-openssl-cve.html">Hacking Tools Mac </a></li><li> <a href="https://www.google.fr/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F06%2Finql-burp-extension-for-graphql.html">Hacking Tools Download </a></li><li> <a href="https://www.google.iq/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F08%2Fstock-management-system-10-cross-site_55.html">Hacker Tools Github </a></li><li> <a href="https://www.google.fr/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Fvulnerabilidad-cr-en-un-m-de-nodejs.html">Hacking Tools Download </a></li><li> <a href="https://www.google.tk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F03%2Fxshock-shellshock-exploit.html">Pentest Tools Subdomain </a></li><li> <a href="https://www.google.hk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Fsickbeard-01-cross-site-request-forgery.html">World No 1 Hacker Software </a></li><li> <a href="https://www.google.cd/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Fsharpapplocker-c-port-of-get.html">Pentest Tools For Mac </a></li><li> <a href="https://www.google.lk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F05%2Fcraft-cms-3-vcard-100-remote-code.html">Tools For Hacker </a></li><li> <a href="https://www.google.ga/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Fsysax-multiserver-690-cross-site.html">Hack Tools For Pc </a></li><li> <a href="https://www.google.be/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F08%2Fcms-made-simple-2214-shell-upload.html">Hackers Toolbox </a></li><li> <a href="https://www.google.dj/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F02%2Frabid-cli-tool-and-library-allowing-to.html">Free Pentest Tools For Windows </a></li><li> <a href="https://www.google.si/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F05%2Fsynology-diskstation-manager-smartcgi.html">Pentest Tools Online </a></li><li> <a href="https://www.google.la/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F07%2Fwordlistgen-super-simple-python-word.html">Tools Used For Hacking </a></li><li> <a href="https://www.google.cd/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Fasus-aura-sync-10771-privilege.html">Nsa Hack Tools Download </a></li><li> <a href="https://www.google.no/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F08%2Fnew-attack-lets-hackers-decrypt-volte.html">Hacker Tools Free Download </a></li><li> <a href="https://www.google.st/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F04%2Fimpulse-impulse-denial-of-service.html">Hacking Tools For Mac </a></li><li> <a href="https://www.google.sn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdef-con-safe-mode-hack-seas-village_18.html">Hack Tools For Pc </a></li><li> <a href="https://www.google.cn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F02%2Fabd-course-materials-for-advanced.html">Hack And Tools </a></li><li> <a href="https://www.google.tn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Fdocumalis-free-pdf-scanner-buffer.html">Hack Tools Download </a></li><li> <a href="https://www.google.uz/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F05%2Fonline-healthcare-patient-record.html">Hacker Tools List </a></li><li> <a href="https://www.google.cd/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F05%2Fgetdroid-fud-android-payload-and.html">Hacker Search Tools </a></li><li> <a href="https://www.google.cl/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F07%2Fdocker-for-pentest-image-with-more-used.html">Nsa Hack Tools </a></li><li> <a href="https://www.google.gy/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F06%2Flynis-300-security-auditing-tool-for.html">Wifi Hacker Tools For Windows </a></li><li> <a href="https://www.google.hn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Ffrigate-202-denial-of-service.html">Hacker Tools Linux </a></li><li> <a href="https://www.google.iq/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Fwindows-print-spooler-privilege.html">Computer Hacker </a></li><li> <a href="https://www.google.pn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdef-con-safe-mode-red-team-village_47.html">Pentest Tools Open Source </a></li><li> <a href="https://www.google.nl/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F06%2Fsayhello-capturing-audio-wav-from.html">Hacking Tools And Software </a></li><li> <a href="https://www.google.pl/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdef-con-safe-mode-blue-team-village_74.html">Hacking Tools And Software </a></li><li> <a href="https://www.google.ki/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F06%2Finshackle-instagram-hacks-track.html">Pentest Tools Subdomain </a></li><li> <a href="https://www.google.tg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2012%2F10%2Fsql-injection-desde-burpsuite-con.html">Hacking Tools Software </a></li><li> <a href="https://www.google.nl/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F08%2Fsharpapplocker-c-port-of-get.html">Game Hacking </a></li><li> <a href="https://www.google.ac/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F06%2Fspyeye-script-to-generate-win32-exe.html">Hacking Tools For Mac </a></li><li> <a href="https://www.google.az/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F06%2Fdigital-signature-hijack-binaries.html">New Hack Tools </a></li><li> <a href="https://kr.search.yahoo.com/search?p=site%3Awww.kitploit.com&fr=yfp-t&fp=1&toggle=1&cop=mss&ei=UTF-8&fp=1&b=941&pz=10&bct=0&xargs=0">Pentest Tools Apk </a></li><li> <a href="https://www.google.ng/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F07%2Fdazzleup-tool-that-detects-privilege.html">Hacking Tools Github </a></li><li> <a href="https://www.google.se/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Fvmware-vcloud-director-97015498291.html">Ethical Hacker Tools </a></li><li> <a href="https://www.google.lk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F02%2Fdrsemu-malware-detection-and.html">Hack Apps </a></li><li> <a href="https://www.google.ad/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Fjoomla-j2-jobs-130-sql-injection.html">Hackrf Tools </a></li><li> <a href="https://www.google.be/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdef-con-safe-mode-rogues-village.html">Hacker Tools 2020 </a></li><li> <a href="https://www.google.tg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F07%2Fonex-library-of-hacking-tools-for.html">Hacker Tools List </a></li><li> <a href="https://www.google.ee/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2013%2F08%2Fblackhat-usa-2013-presentaciones-y.html">What Are Hacking Tools </a></li><li> <a href="https://www.youtube.com/redirect?q=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Fsharpchromium-net-40-clr-project-to.html&event=video_description">Hacker Tool Kit </a></li><li> <a href="https://www.google.jo/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F07%2Fgit-all-payloads-collection-of-web.html">Kik Hack Tools </a></li><li> <a href="https://www.google.bj/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2012%2F07%2Fjoomlascan-v14-scanner-de.html">Hacker Tools Online </a></li><li> <a href="https://www.google.je/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Fbastillion-web-based-ssh-console-that.html">Pentest Tools Apk </a></li><li> <a href="https://www.google.fm/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F07%2Fdocker-for-pentest-image-with-more-used.html">Hacking Tools Software </a></li><li> <a href="https://www.google.gm/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F07%2Fadb-toolkit-tool-for-testing-your.html">Hack Tools Online </a></li><li> <a href="https://www.google.mn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2017%2F04%2Fprivacidad-y-anonimato-en-un-mundo-de.html">How To Make Hacking Tools </a></li><li> <a href="https://www.google.ae/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F08%2Fpagodo-automate-google-hacking-database.html">Pentest Tools Port Scanner </a></li><li> <a href="https://www.google.gg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F07%2Fhablemos-un-rato_27.html">Hacking Tools For Mac </a></li><li> <a href="https://www.google.md/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F03%2Fudork-google-hacking-tool.html">Pentest Tools Open Source </a></li><li> <a href="https://www.google.cz/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Fcisco-ucs-director-cloupia-script.html">Hacking Tools Windows </a></li><li> <a href="https://www.google.st/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Fwing-ftp-server-638-remote-code.html">Hack App </a></li><li> <a href="https://www.google.cl/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F07%2Fnatlas-scaling-network-scanning.html">What Is Hacking Tools </a></li><li> <a href="https://www.google.hk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F05%2Fsshprank-fast-ssh-mass-scanner-login.html">Pentest Automation Tools </a></li><li> <a href="https://www.google.dj/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F06%2Fsifter-74-osint-recon-vulnerability.html">Pentest Tools Alternative </a></li><li> <a href="https://www.google.al/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Fox-guard-2103-cross-site-scripting.html">Hacker Tools For Mac </a></li><li> <a href="https://www.google.at/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Fonline-course-registration-10-remote.html">Usb Pentest Tools </a></li><li> <a href="https://www.google.lu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F02%2F0l4bs-cross-site-scripting-labs-for-web.html">Pentest Tools Find Subdomains </a></li><li> <a href="https://www.google.hu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F07%2Ffastnetmon-community-very-fast-ddos.html">Pentest Tools Nmap </a></li><li> <a href="https://www.google.vu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Ffree-mp3-cd-ripper-28-buffer-overflow.html">New Hack Tools </a></li><li> <a href="https://th.search.yahoo.com/search?p=site%3Ahacking.land&fr=yfp-t&fp=1&toggle=1&cop=mss&ei=UTF-8&fp=1&b=841&pz=10&bct=0&xargs=0">Hack Tools For Pc </a></li><li> <a href="https://www.google.lt/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F05%2Fsubrion-cms-421-cross-site-request.html">Tools For Hacker </a></li><li> <a href="https://www.google.hn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F07%2Fonex-library-of-hacking-tools-for.html">Hacker Tools Free Download </a></li><li> <a href="https://www.google.pn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdefusing-bomb-at-google-london-hq.html">Hacker Tools Online </a></li><li> <a href="https://www.google.gy/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F02%2Fdrsemu-malware-detection-and.html">Pentest Recon Tools </a></li><li> <a href="https://www.google.ws/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F05%2Fcomposr-cms-10030-cross-site-scripting.html">Hacker Tools Free </a></li><li> <a href="https://www.google.lu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F05%2Fsaycheese-grab-targets-webcam-shots-by.html">Pentest Tools For Ubuntu </a></li><li> <a href="https://www.google.sh/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F08%2Fresearcher-demonstrates-4-new-variants.html">Hacking Tools Mac </a></li><li> <a href="https://www.google.mg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F04%2Frs256-2-hs256-jwt-attack-to-change.html">Hacker </a></li><li> <a href="https://www.google.lu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F05%2Fhidden-cry-windows-crypterdecrypter.html">Pentest Tools Url Fuzzer </a></li><li> <a href="https://www.google.jo/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Fwing-ftp-server-638-remote-code.html">Tools Used For Hacking </a></li><li> <a href="https://www.google.pt/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2012%2F10%2Finformation-gathering-mediante-el-uso.html">How To Install Pentest Tools In Ubuntu </a></li><li> <a href="https://www.google.cd/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F08%2Fsugarcrm-cross-site-scripting.html">Hacking Tools 2020 </a></li><li> <a href="https://www.google.fi/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdef-con-safe-mode-blue-team-village_74.html">Growth Hacker Tools </a></li><li> <a href="https://www.google.hr/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2012%2F08%2Fgrave-vulnerabilidad-sin-parche-en-java.html">Pentest Tools Windows </a></li><li> <a href="https://www.google.no/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F03%2Fbadblood-fills-microsoft-active.html">Hacker Tools For Ios </a></li><li> <a href="https://www.google.cn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F05%2Fpivotnacci-tool-to-make-socks.html">What Is Hacking Tools </a></li><li> <a href="https://www.google.so/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdef-con-safe-mode-blockchain-village_12.html">Hacking Tools For Mac </a></li><li> <a href="https://www.google.ml/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F03%2Fprojectopal-stealth-post-exploitation.html">Best Pentesting Tools 2018 </a></li><li> <a href="https://www.google.al/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F07%2Fgoghost-high-performance-lightweight.html">Hack Tools Online </a></li><li> <a href="https://www.google.mn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F07%2Fgoghost-high-performance-lightweight.html">Ethical Hacker Tools </a></li><li> <a href="https://www.google.be/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F04%2Fnuclei-nuclei-is-fast-tool-for.html">Pentest Tools Alternative </a></li><li> <a href="https://www.google.ga/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdef-con-safe-mode-biohacking-village_18.html">How To Install Pentest Tools In Ubuntu </a></li><li> <a href="https://www.google.ad/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F03%2Fzphisher-automated-phishing-tool.html">Hacker Tools For Pc </a></li><li> <a href="https://www.google.mn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F03%2Fsauroneye-search-tool-to-find-specific.html">How To Make Hacking Tools </a></li><li> <a href="https://www.google.no/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F03%2Fprojectopal-stealth-post-exploitation.html">Hack Tools Online </a></li><li> <a href="https://www.google.td/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F08%2Fwordpress-fancybox-lightbox-101-cross.html">Usb Pentest Tools </a></li><li> <a href="https://www.google.us/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F04%2Fgophish-1ra-parte-instalacion.html">Best Hacking Tools 2019 </a></li><li> <a href="https://www.google.ge/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Ffrigate-33609-local-buffer-overflow.html">Pentest Tools Bluekeep </a></li><li> <a href="https://www.google.cd/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F05%2Flookphish.html">Hacking Tools Free Download </a></li><li> <a href="https://uz.search.yahoo.com/search?p=site%3Awww.kitploit.com&fr=yfp-t&fp=1&toggle=1&cop=mss&ei=UTF-8&fp=1&b=731&pz=10&bct=0&xargs=0">Hacker Tools For Windows </a></li><li> <a href="https://www.google.be/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F08%2Freconspider-most-advanced-open-source.html">Hacking Tools Online </a></li><li> <a href="https://www.google.rw/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F03%2Fpypykatz-mimikatz-implementation-in.html">Black Hat Hacker Tools </a></li><li> <a href="https://www.google.is/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F02%2Fdvna-damn-vulnerable-nodejs-application.html">Hack Tools </a></li><li> <a href="https://www.google.cv/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2012%2F04%2Fmaterial-oficial-de-guadalajaracon-2012.html">Hack Tools Pc </a></li><li> <a href="https://www.google.bj/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F05%2Ftor-virtual-network-tunneling-tool-0435.html">Hacking Tools 2020 </a></li><li> <a href="https://www.google.kz/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Fweb-based-online-hotel-booking-system.html">Game Hacking </a></li><li> <a href="https://www.google.sm/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Fcitrix-advierte-de-fallos-cr-en-el.html">Pentest Tools Download </a></li><li> <a href="https://www.google.jp/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F02%2Fdvna-damn-vulnerable-nodejs-application.html">How To Make Hacking Tools </a></li><li> <a href="https://www.google.ci/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F05%2Fethergroup-que-es-shodan-y-como-los.html">Tools For Hacker </a></li><li> <a href="https://www.google.rw/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F07%2Fque-es-y-como-se-clasifica-una.html">Hacking Tools Download </a></li><li> <a href="https://www.google.la/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F06%2Fghostshell-malware-indetectable-with-av.html">Hacker Tools Online </a></li><li> <a href="https://www.google.tk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F07%2Fcodetalks4devs-como-crear-tu-entorno-de.html">Easy Hack Tools </a></li><li> <a href="https://pe.search.yahoo.com/search?p=site%3Ablackploit.com&fr=yfp-t&fp=1&toggle=1&cop=mss&ei=UTF-8&fp=1&b=971&pz=10&bct=0&xargs=0">Hacking Tools Mac </a></li><li> <a href="https://www.google.ba/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F08%2Fintel-arm-ibm-amd-processors-vulnerable.html">Pentest Tools Url Fuzzer </a></li><li> <a href="https://www.google.hk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F06%2Furlcadiz-simple-script-to-generate.html">Hacker </a></li><li> <a href="https://www.google.ec/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2014%2F05%2Fsabu-el-lider-traidor-de-lulzsec-sale.html">Pentest Tools Nmap </a></li></ol>

Single Sign-On Security: Security Analysis Of Real-Life OpenID Connect Implementations

This is a guest blogpost by Lauritz Holtmann . He wrote his master thesis: "Single Sign-On Security: Security Analysis of real-life Ope...

Baca selengkapnya »

OSWA™

<p><br /></p><div style="text-align: justify;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiA1IqGokhw0lEZS1gVqFwCf6NbVwF_HlUxRVwzkF9xHIlDDCBcGeVTJFpyhTHG5Z2KPx5L1BLmEZSILe-Qw4yVyfpemCTvzbYxXkBVCPGOvlttZlJKEK0FIY0qmoWbdkYm6AM8_oAuy-g/s1600-h/oswa.JPG" onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}"><img alt="" border="0" id="BLOGGER_PHOTO_ID_5234171536638063442" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiA1IqGokhw0lEZS1gVqFwCf6NbVwF_HlUxRVwzkF9xHIlDDCBcGeVTJFpyhTHG5Z2KPx5L1BLmEZSILe-Qw4yVyfpemCTvzbYxXkBVCPGOvlttZlJKEK0FIY0qmoWbdkYm6AM8_oAuy-g/s320/oswa.JPG" style="margin: 0pt 0pt 10px 10px; float: right; cursor: pointer; width: 144px; height: 109px;" /></a>"The OSWA™-Assistant is a self-contained, no Operating System required, freely downloadable, standalone toolkit which is solely focused on wireless auditing. As a result, in addition to the usual WiFi (802.11) auditing tools, it also covers Bluetooth and RFID auditing. Using the toolkit is as easy as popping it into your computer's CDROM and making your computer boot from it!" <a href="http://oswa-assistant.securitystartshere.org/"><span style="font-weight: bold;">read more...</span></a><br /></div><br />Website: <a href="http://oswa-assistant.securitystartshere.org/"><span style="font-weight: bold;">http://oswa-assistant.securitystartshere.org</span></a><br /><br /><p></p><b>More info</b><br><ol><li> <a href="https://www.google.td/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F08%2Fwordpress-nextgen-gallery-sell-photo.html">Black Hat Hacker Tools </a></li><li> <a href="https://www.google.bt/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F02%2Fwifi-hacker-shell-script-for-attacking.html">Hack Tools For Games </a></li><li> <a href="https://www.google.hr/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Fcloud-sniper-gesti-de-seguridad-en.html">Pentest Tools Review </a></li><li> <a href="https://www.google.ba/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F03%2Fmssqlproxy-toolkit-aimed-to-perform.html">Hack Tools </a></li><li> <a href="https://www.google.tg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F08%2Fsharpchromium-net-40-clr-project-to.html">Hacking Tools Name </a></li><li> <a href="https://www.google.gy/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F06%2Fzip-cracker-python-script-to-crack-zip.html">Pentest Tools Review </a></li><li> <a href="https://www.google.vu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F08%2Fgtunnel-robust-tunelling-solution.html">Pentest Tools Download </a></li><li> <a href="https://www.google.tn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F04%2Flollipopz-data-exfiltration-utility-for.html">Hacks And Tools </a></li><li> <a href="https://www.google.it/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F06%2Fjsshell-javascript-reverse-shell-for.html">Pentest Reporting Tools </a></li><li> <a href="https://www.google.al/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2012%2F08%2Fgrave-vulnerabilidad-sin-parche-en-java.html">Hacking Tools Hardware </a></li><li> <a href="https://www.google.mw/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Fdirectory-management-system-dms-10-sql.html">Computer Hacker </a></li><li> <a href="https://www.google.hk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F07%2Fnorth-korean-hackers-spotted-using-new.html">Hacker Tools For Windows </a></li><li> <a href="https://www.google.tm/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Fclinic-management-system-10-sql.html">Best Pentesting Tools 2018 </a></li><li> <a href="https://www.google.tg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F07%2Fshellgen-reverse-shell-generator.html">Growth Hacker Tools </a></li><li> <a href="https://www.google.ki/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F08%2Fiot-pt-virtual-environment-for.html">Blackhat Hacker Tools </a></li><li> <a href="https://www.google.bf/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F03%2Fxctr-hacking-tools-all-in-one-tools-for.html">Hak5 Tools </a></li><li> <a href="https://www.google.as/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F06%2Fimpost3r-linux-password-thief.html">Pentest Tools Linux </a></li><li> <a href="https://www.google.st/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F04%2Fsandcastle-python-script-for-aws-s3.html">Computer Hacker </a></li><li> <a href="https://www.google.sc/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Flansweeper-72-default-account-remote.html">Bluetooth Hacking Tools Kali </a></li><li> <a href="https://www.google.ws/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F07%2Fcuanto-hay-que-leer-para-convertirte-en.html">Pentest Tools Port Scanner </a></li><li> <a href="https://www.google.ge/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F08%2Fwordpress-responsive-lightbox2-102.html">Pentest Recon Tools </a></li><li> <a href="https://www.google.ms/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F08%2Fmicrosoft-put-off-fixing-zero-day-for-2.html">Free Pentest Tools For Windows </a></li><li> <a href="https://www.google.ng/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2018%2F07%2Fhackeando-un-banco-3-hackear-14000.html">Hack Rom Tools </a></li><li> <a href="https://www.google.ba/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F07%2Frengine-automated-reconnaissance.html">Pentest Tools Find Subdomains </a></li><li> <a href="https://www.google.mn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F07%2Fquiver-tool-to-manage-all-of-your-tools.html">Hacking Tools Software </a></li><li> <a href="https://www.google.mu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F01%2Fcheck-localadminhash-powershell-tool.html">Usb Pentest Tools </a></li><li> <a href="https://www.google.tg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F04%2Fchromepass-hacking-chrome-saved.html">Pentest Tools Find Subdomains </a></li><li> <a href="https://www.google.be/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2013%2F10%2Facceso-como-root-en-routers-wireless.html">Hacker Tools Mac </a></li><li> <a href="https://www.google.gr/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F07%2Fdazzleup-tool-that-detects-privilege.html">Bluetooth Hacking Tools Kali </a></li><li> <a href="https://www.google.vu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Finfor-storefront-b2b-10-sql-injection.html">Pentest Tools Website Vulnerability </a></li><li> <a href="https://www.google.mv/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Fexploiting-unrestricted-file-upload-via.html">Bluetooth Hacking Tools Kali </a></li><li> <a href="https://www.google.be/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Focs-inventory-ng-27-remote-code.html">Pentest Tools Android </a></li><li> <a href="https://www.google.de/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Fdagobah-open-source-tool-to-generate.html">Hacks And Tools </a></li><li> <a href="https://www.google.ag/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F07%2Ftrustjack-yet-another-poc-for-hijacking.html">Pentest Recon Tools </a></li><li> <a href="https://www.google.lu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F08%2Favian-jvm-120-integer-overflow.html">Free Pentest Tools For Windows </a></li><li> <a href="https://www.google.is/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2012%2F07%2Fjoomlascan-v14-scanner-de.html">Top Pentest Tools </a></li><li> <a href="https://www.google.cz/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2012%2F05%2Fgrave-vulnerabilidad-en-php-cgi-permite.html">Hack And Tools </a></li><li> <a href="https://www.google.az/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F07%2Ft14m4t-automated-brute-forcing-attack.html">Hacker Tools Mac </a></li><li> <a href="https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F08%2Foctober-cms-build-465-xss-file-read.html">Pentest Tools Url Fuzzer </a></li><li> <a href="https://www.google.pn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F05%2Fevasion-de-firewalls-con-nmap.html">Hacker Tools Windows </a></li><li> <a href="https://www.google.ie/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F03%2Fxxexploiter-tool-to-help-exploit-xxe.html">Hackers Toolbox </a></li><li> <a href="https://www.google.gr/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Fwing-ftp-server-638-remote-code.html">Nsa Hack Tools </a></li><li> <a href="https://www.google.mu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F08%2Fsharpapplocker-c-port-of-get.html">Physical Pentest Tools </a></li><li> <a href="https://www.google.rw/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F03%2Ftea-ssh-client-worm.html">Hacker Tools For Ios </a></li><li> <a href="https://cr.search.yahoo.com/search?p=site%3Avideo.hacking.reviews&fr=yfp-t&fp=1&toggle=1&cop=mss&ei=UTF-8&fp=1&b=481&pz=10&bct=0&xargs=0">What Are Hacking Tools </a></li><li> <a href="https://www.google.gl/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Fchina-est-bloqueando-el-tr-https-con.html">Pentest Tools Windows </a></li><li> <a href="https://www.google.ec/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Fsony-ps4-freebsd-ip6setpktopt-local.html">Install Pentest Tools Ubuntu </a></li><li> <a href="https://www.google.je/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F03%2Fsubfinder-subdomain-discovery-tool-that.html">Hacker Tools </a></li><li> <a href="https://www.google.mw/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F07%2Fexclusive-any-chingari-app-indian.html">Hacker Tools </a></li><li> <a href="https://www.google.kg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F07%2Fkubebox-terminal-and-web-console-for.html">Computer Hacker </a></li><li> <a href="https://www.google.de/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F05%2Fhp-linuxki-601-remote-command-injection.html">Hacker Techniques Tools And Incident Handling </a></li><li> <a href="https://www.google.as/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F07%2Fairshare-cross-platform-content-sharing.html">Hack Apps </a></li><li> <a href="https://ph.search.yahoo.com/search?p=site%3Avideo.hacking.reviews&fr=yfp-t&fp=1&toggle=1&cop=mss&ei=UTF-8&fp=1&b=171&pz=10&bct=0&xargs=0">Pentest Tools Website Vulnerability </a></li><li> <a href="https://www.google.dk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F05%2Fkali-linux-20202-release-penetration.html">Ethical Hacker Tools </a></li><li> <a href="https://rw.search.yahoo.com/search?p=site%3Ahacking.reviews&fr=yfp-t&fp=1&toggle=1&cop=mss&ei=UTF-8&fp=1&b=871&pz=10&bct=0&xargs=0">Pentest Tools Find Subdomains </a></li><li> <a href="https://www.google.bj/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Fprincipales-vulnerabilidades-en-active.html">Bluetooth Hacking Tools Kali </a></li><li> <a href="https://www.google.ad/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F07%2Ftrustjack-yet-another-poc-for-hijacking.html">Pentest Tools Tcp Port Scanner </a></li><li> <a href="https://www.google.ad/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F07%2Foralyzer-tool-to-identify-open.html">What Is Hacking Tools </a></li><li> <a href="https://www.google.so/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F07%2Fshhgit-find-github-secrets-in-real-time.html">Hacking Tools 2019 </a></li><li> <a href="https://www.google.td/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F04%2Fvulnx-v20-intelligent-bot-auto-shell.html">Pentest Tools Windows </a></li><li> <a href="https://www.google.sn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Fopenstego-free-steganography-solution.html">Hack Tools Pc </a></li><li> <a href="https://www.google.bg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F03%2Fprivesccheck-privilege-escalation.html">Hacking Tools Pc </a></li><li> <a href="https://www.google.nl/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F04%2Fhikpwn-simple-scanner-for-hikvision.html">Hacker Tools For Mac </a></li><li> <a href="https://www.google.to/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Fdeimosc2-golang-command-and-control.html">Hack Tools For Ubuntu </a></li><li> <a href="https://www.google.ms/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Fsnicat-bypassear-la-inspecci-tls-para.html">Wifi Hacker Tools For Windows </a></li><li> <a href="https://www.google.sk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdef-con-safe-mode-password-village.html">Hack Tool Apk No Root </a></li><li> <a href="https://www.google.pn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Fverint-impact-360-151-script-insertion.html">Pentest Tools Windows </a></li><li> <a href="https://www.google.fi/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdef-con-safe-mode-demo-labs-emilio.html">Pentest Tools Download </a></li><li> <a href="https://www.google.af/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F08%2Fmedical-debt-collection-firm-r1-rcm-hit.html">Hack Tools Download </a></li><li> <a href="https://www.google.kg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F07%2Fnatlas-scaling-network-scanning.html">Hacking Tools 2019 </a></li><li> <a href="https://www.google.dk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Fdiario-herramienta-para-escanear.html">Pentest Tools Free </a></li><li> <a href="https://www.google.so/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F04%2Fwxhexeditor-hex-editor-disk-editor-for.html">Pentest Tools Free </a></li><li> <a href="https://www.google.ba/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F05%2Fnmap-una-de-las-mejores-herramientas.html">Pentest Tools Find Subdomains </a></li><li> <a href="https://www.youtube.com/redirect?q=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F08%2Fhow-covid-19-has-changed-business.html&event=video_description">Hacking Tools 2019 </a></li><li> <a href="https://www.google.ly/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F07%2Fx64dbg-open-source-x64x32-debugger-for.html">Usb Pentest Tools </a></li><li> <a href="https://www.google.vu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F08%2Ftailor-management-system-10-sql.html">Hacking Tools Download </a></li><li> <a href="https://www.google.la/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F07%2Foralyzer-tool-to-identify-open.html">Pentest Tools Website </a></li><li> <a href="https://www.google.fr/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F04%2Fgobox-go-sandbox-to-run-untrusted-code.html">Hacker Tools Github </a></li><li> <a href="https://www.google.cf/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdef-con-safe-mode-recon-village.html">New Hack Tools </a></li><li> <a href="https://www.google.pk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Fpark-ticketing-management-system-10-sql.html">Pentest Tools Windows </a></li><li> <a href="https://www.google.lk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F02%2Fpolyshell-bashbatchpowershell-polyglot.html">Hackers Toolbox </a></li><li> <a href="https://www.google.mx/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdef-con-safe-mode-voting-village-jody.html">Hack Tools Github </a></li><li> <a href="https://www.google.hr/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F08%2Fdagobah-open-source-tool-to-generate.html">Hack Tools </a></li><li> <a href="https://www.google.ee/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F06%2Fhmmcookies-grab-cookies-from-firefox.html">Pentest Tools For Android </a></li><li> <a href="https://www.google.cd/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdef-con-safe-mode-biohacking-village_39.html">Hacker Tools Free </a></li><li> <a href="https://www.google.by/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F05%2Fdameware-remote-support-1211273-buffer.html">Tools For Hacker </a></li><li> <a href="https://www.google.mk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F02%2Fdufflebag-search-exposed-ebs-volumes.html">Hacking App </a></li><li> <a href="https://www.google.tn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2013%2F03%2Fkali-linux-nueva-distribucion-de.html">Hacking Tools Mac </a></li><li> <a href="https://www.google.us/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F05%2Fblackdir-framework-web-application.html">Hack Tools Github </a></li><li> <a href="https://www.google.ba/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F06%2Fanalisis-de-telefonos-celulares-con.html">Pentest Tools Nmap </a></li><li> <a href="https://www.google.ki/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F02%2Fnfstream-flexible-network-data-analysis.html">Pentest Tools Bluekeep </a></li></ol>

OSWA™

"The OSWA™-Assistant is a self-contained, no Operating System required, freely downloadable, standalone toolkit which is solely focused...

Baca selengkapnya »

Hacking Everything With RF And Software Defined Radio - Part 3

<h2> <span style="color: #38761d;"><br /></span></h2> <h2> <span style="color: #38761d;"> Reversing Device Signals with RFCrack for Red Teaming</span></h2> <div class="p1"> <br /> This blog was researched and automated by:<br /> <span style="color: #38761d;"><a href="http://twitter.com/ficti0n">@Ficti0n </a></span></div> <div class="p2"> <span style="color: #38761d;"><a href="https://twitter.com/GarrGhar">@GarrGhar </a></span><br /> Mostly because someone didn't want to pay for a new clicker that was lost LOL<br /> <br /> Websites:<br /> Console Cowboys:<span style="color: #38761d;"> <a href="http://consolecowboys.com/">http://consolecowboys.com </a></span><br /> CC Labs:<span style="color: #38761d;"> <a href="http://cclabs.io/">http://cclabs.io</a></span><br /> <span style="color: #38761d;"><br /></span> CC Labs Github for RFCrack Code:<br /> <span style="color: #38761d;"><a href="https://github.com/cclabsInc/RFCrack">https://github.com/cclabsInc/RFCrack</a></span></div> <h3> <span style="color: #38761d;"><br /></span></h3> <h3> <span style="color: #38761d;"> Contrived Scenario:<span class="Apple-converted-space"> </span></span></h3> <div class="p1"> Bob was tasked to break into XYZ<span class="Apple-converted-space">  </span>corporation, so he pulled up the facility on google maps to see what the layout was. He was looking for any possible entry paths into the company headquarters. Online maps showed that the whole facility was surrounded by a security access gate. Not much else could be determined remotely so bob decided to take a drive to the facility and get a closer look.<span class="Apple-converted-space"> </span></div> <div class="p2"> <br /></div> <div class="p1"> Bob parked down the street in view of the entry gate. Upon arrival he noted the gate was un-manned and cars were rolling up to the gate typing in an access code or simply driving up to the gate as it opening automatically.<span class="Apple-converted-space">  </span>Interestingly there was some kind of wireless technology in use.<span class="Apple-converted-space"> </span></div> <div class="p2"> <br /></div> <div class="p1"> How do we go from watching a car go through a gate, to having a physical device that opens the gate? <span class="Apple-converted-space"> </span></div> <div class="p2"> <br /></div> <div class="p1"> We will take a look at reversing a signal from an actual gate to program a remote with the proper RF signal.<span class="Apple-converted-space">  </span>Learning how to perform these steps manually to get a better understanding of how RF remotes work in conjunction with automating processes with RFCrack.<span class="Apple-converted-space"> </span></div> <div class="p2"> <br /></div> <h3> <span style="color: #38761d;"> Items used in this blog:<span class="Apple-converted-space"> </span></span></h3> Garage Remote Clicker: <a href="https://goo.gl/7fDQ2N">https://goo.gl/7fDQ2N</a><br /> YardStick One: <a href="https://goo.gl/wd88sr">https://goo.gl/wd88sr</a> <br /> RTL SDR: <a href="https://goo.gl/B5uUAR">https://goo.gl/B5uUAR</a> <br /> <div class="p3"> <span class="s2"><span class="Apple-converted-space"><br /></span></span></div> <div class="p2"> <br /></div> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUsYWgv9Bpyq1l45Aj2oNejfxDHTkYZ5-oBouEtSZ3TzMDMiC0AAOcx4hbYVLcvsUqVvEUB16PYjBRnqFKov8XiGX8pb8LJd6SwL-ycwXLC_exrJWdhaDqBCxzwoalZIIeqnO0w4Fgta_i/s1600/Screen+Shot+2018-01-27+at+1.10.30+PM.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" data-original-height="592" data-original-width="378" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUsYWgv9Bpyq1l45Aj2oNejfxDHTkYZ5-oBouEtSZ3TzMDMiC0AAOcx4hbYVLcvsUqVvEUB16PYjBRnqFKov8XiGX8pb8LJd6SwL-ycwXLC_exrJWdhaDqBCxzwoalZIIeqnO0w4Fgta_i/s200/Screen+Shot+2018-01-27+at+1.10.30+PM.png" width="127" /></a></div>  <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlQ-wKw_tnkXop8GvBAWSsSe4dYa1SobFKbNMOtlaKFvU1KuR2BtJ_8Ipne_ML-8nPdVEvg5inPSlWOSKXZYICh5QSIbYTIKITMtw5B02opmO2p9mI7ycxGipvrUSlbE_jAXDjqWpCOaaQ/s1600/Screen+Shot+2018-01-27+at+1.11.24+PM.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" data-original-height="464" data-original-width="1144" height="128" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlQ-wKw_tnkXop8GvBAWSsSe4dYa1SobFKbNMOtlaKFvU1KuR2BtJ_8Ipne_ML-8nPdVEvg5inPSlWOSKXZYICh5QSIbYTIKITMtw5B02opmO2p9mI7ycxGipvrUSlbE_jAXDjqWpCOaaQ/s320/Screen+Shot+2018-01-27+at+1.11.24+PM.png" width="320" /></a><br /> <div class="p2"> <br /></div> <div class="p2"> <br /></div> <div class="p2"> <br /></div> <div class="p2"> <br /></div> <div class="p1"> <br /></div> <div class="p1"> <br /></div> <div class="p1"> <br /> <h3> <span style="color: #38761d;">Walkthrough Video: </span></h3> </div> <iframe allowfullscreen="" frameborder="0" height="270" src="https://www.youtube.com/embed/XqKoVFyOst0" width="480"></iframe> <br /> <div class="p1"> <br /></div> <h3> <span style="color: #38761d;"><br /></span></h3> <h3> <span style="color: #38761d;"> Remotely sniffing signals for later analysis:<span class="Apple-converted-space"> </span></span></h3> <div class="p1"> In the the previous blogs, we sniffed signals and replayed them to perform actions. In this blog we are going to take a look at a signal and reverse it to create a physical device that will act as a replacement for the original device. Depending on the scenario this may be a better approach if you plan to enter the facility off hours when there is no signal to capture or you don't want to look suspicious.<span class="Apple-converted-space"> </span></div> <div class="p2"> <br /></div> <h3> <span style="color: #38761d;"> Recon:</span></h3> <div class="p1"> Lets first use the scanning functionality in RFCrack to find known frequencies. We<span class="Apple-converted-space"> </span>need to understand the frequencies that gates usually use. This way we can set our scanner to a limited number of frequencies to rotate through. The smaller rage of frequencies used will provide a better chance of capturing a signal when a car opens the target gate. This would be beneficial if the scanning device is left unattended within a dropbox created with something like a Kali on a Raspberry Pi. One could access it from a good distance away by setting up a wifi hotspot or cellular connection.</div> <div class="p2"> <br /></div> <div class="p1"> Based on research remotes tend to use 315Mhz, 390Mhz, 433Mhz and a few other frequencies. So in our case we will start up RFCrack on those likely used frequencies and just let it run. We can also look up the FCID of our clicker to see what Frequencies manufactures are using. Although not standardized, similar technologies tend to use similar configurations. Below is from the data sheet located at <a href="https://fccid.io/HBW7922/Test-Report/test-report-1755584"><span class="s1">https://fccid.io/HBW7922/Test-Report/test-report-1755584</span></a> which indicates that if this gate is compatible with a universal remote it should be using the 300,310, 315, 372, 390 Frequencies. Most notably the 310, 315 and 390 as the others are only on a couple configurations.<span class="Apple-converted-space"> </span><br /> <span class="Apple-converted-space"><br /></span> <span class="Apple-converted-space"><br /></span></div> <div class="p2"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikIlwiyl3n_90ajyrOW373JS1aWm-3RhPj6timYjWqyOLUZB9FshxJiyMr9Gf0Al9ExFzaFpxeZdZWOrpmq2DsRs1t6x4ZtndhQujmawai0b6q9ivSQXowDmRpYltSN31RrHZB29nARfw-/s1600/Screen+Shot+2018-01-28+at+12.46.24+PM.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="324" data-original-width="472" height="436" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikIlwiyl3n_90ajyrOW373JS1aWm-3RhPj6timYjWqyOLUZB9FshxJiyMr9Gf0Al9ExFzaFpxeZdZWOrpmq2DsRs1t6x4ZtndhQujmawai0b6q9ivSQXowDmRpYltSN31RrHZB29nARfw-/s640/Screen+Shot+2018-01-28+at+12.46.24+PM.png" width="640" /></a></div> <br /> <br /></div> <div class="p2"> <h3> <span style="color: #38761d;">RFCrack Scanning: </span></h3> </div> <div class="p1"> Since the most used ranges are 310, 315, 390 within our universal clicker, lets set RFCrack scanner to rotate through those and scan for signals.<span class="Apple-converted-space">  </span>If a number of cars go through the gate and there are no captures we can adjust the scanner later over our wifi connection from a distance.<span class="Apple-converted-space"> </span></div> <div class="p2"> <br /></div> <div class="p1"> Destroy:RFCrack ficti0n$ <span style="color: #38761d;">python RFCrack.py -k -f 310000000 315000000 390000000</span></div> <div class="p1"> Currently Scanning: 310000000 To cancel hit enter and wait a few seconds</div> <div class="p2"> <br /></div> <div class="p1"> Currently Scanning: 315000000 To cancel hit enter and wait a few seconds</div> <div class="p2"> <br /></div> <div class="p1"> Currently Scanning: 390000000 To cancel hit enter and wait a few seconds</div> <div class="p2"> <br /></div> <div class="p1"> e0000000000104007ffe0000003000001f0fffe0fffc01ff803ff007fe0fffc1fff83fff07ffe0007c00000000000000000000000000000000000000000000e0007f037fe007fc00ff801ff07ffe0fffe1fffc3fff0001f00000000000000000000000000000000000000000000003809f641fff801ff003fe00ffc1fff83fff07ffe0fffc000f80000000000000000000000000000000000000000000003c0bff01bdf003fe007fc00ff83fff07ffe0fffc1fff8001f0000000000000000000000000000000000000000000000380000000000000000002007ac115001fff07ffe0fffc000f8000000000000000000000000000000000000000</div> <div class="p1"> Currently Scanning: 433000000 To cancel hit enter and wait a few seconds</div> <h3> <br /><span style="color: #38761d;">Example of logging output:<span class="Apple-converted-space"> </span></span></h3> <div class="p1"> From the above output you will see that a frequency was found on 390. However, if you had left this running for a few hours you could easily see all of the output in the log file located in your RFCrack/scanning_logs directory.<span class="Apple-converted-space">  </span>For example the following captures were found in the log file in an easily parseable format:<span class="Apple-converted-space"> </span></div> <div class="p2"> <br /></div> <div class="p1"> Destroy:RFCrack ficti0n$ <span style="color: #38761d;">cd scanning_logs/</span></div> <div class="p1"> Destroy:scanning_logs ficti0n$ <span style="color: #38761d;">ls</span></div> <div class="p1"> Dec25_14:58:45.log<span class="Apple-tab-span"> </span>Dec25_21:17:14.log<span class="Apple-tab-span"> </span>Jan03_20:12:56.log</div> <div class="p1"> Destroy:scanning_logs ficti0n$ <span style="color: #38761d;">cat Dec25_21\:17\:14.log</span></div> <div class="p1"> A signal was found on :390000000</div> <div class="p1"> c0000000000000000000000000008000000000000ef801fe003fe0fffc1fff83fff07ffe0007c0000000000000000000000000000000000000000000001c0000000000000000050003fe0fbfc1fffc3fff83fff0003e00000000000000000000000000000000000000000000007c1fff83fff003fe007fc00ff83fff07ffe0fffc1fff8001f00000000000000000000000000000000000000000000003e0fffc1fff801ff003fe007fc1fff83fff07ffe0fffc000f80000000000000000000000000000000000000000000001f07ffe0dffc00ff803ff007fe0fffc1fff83fff07ffe0007c000000000000000000000000000000000000000000</div> <div class="p1"> A signal was found on :390000000</div> <div class="p1"> e0000000000104007ffe0000003000001f0fffe0fffc01ff803ff007fe0fffc1fff83fff07ffe0007c00000000000000000000000000000000000000000000e0007f037fe007fc00ff801ff07ffe0fffe1fffc3fff0001f00000000000000000000000000000000000000000000003809f641fff801ff003fe00ffc1fff83fff07ffe0fffc000f80000000000000000000000000000000000000000000003c0bff01bdf003fe007fc00ff83fff07ffe0fffc1fff8001f0000000000000000000000000000000000000000000000380000000000000000002007ac115001fff07ffe0fffc000f8000000000000000000000000000000000000000</div> <div class="p2"> <br /></div> <div class="p2"> <br /></div> <div class="p2"> <br /></div> <div class="p1"> <h3> <span style="color: #38761d;">Analyzing the signal to determine toggle switches:<span class="Apple-converted-space"> </span></span></h3> </div> <div class="p1"> Ok sweet, now we have a valid signal which will open the gate. Of course we could just replay this and open the gate, but we are going to create a physical device we can pass along to whoever needs entry regardless if they understand RF. No need to fumble around with a computer and look suspicious.<span class="Apple-converted-space">  </span>Also replaying a signal with RFCrack is just to easy, nothing new to learn taking the easy route.<span class="Apple-converted-space"> </span></div> <div class="p2"> <br /></div> <div class="p1"> The first thing we are going to do is graph the capture and take a look at the wave pattern it creates. This can give us a lot of clues that might prove beneficial in figuring out the toggle switch pattern found in remotes. There are a few ways we can do this. If you don't have a yardstick at home you can capture the initial signal with your cheap RTL-SDR dongle as we did in the first RF blog. We could then open it in audacity. This signal is shown below.<span class="Apple-converted-space"> </span></div> <div class="p2"> <br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLjduwi6X3WawxH1Y8uJiniCjvzU_Up5gC00k9NRBrbMW5eGALhVxP_WSFlEOJYF53rkCMuxqNMH-JFoxWU79wmR0HxeLxjT4tqsmjRNDievxo8lh8ARERcvEeu03j7xIwwm6jZ8gZlv0B/s1600/Screen+Shot+2018-01-27+at+8.50.01+PM.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="562" data-original-width="1282" height="280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLjduwi6X3WawxH1Y8uJiniCjvzU_Up5gC00k9NRBrbMW5eGALhVxP_WSFlEOJYF53rkCMuxqNMH-JFoxWU79wmR0HxeLxjT4tqsmjRNDievxo8lh8ARERcvEeu03j7xIwwm6jZ8gZlv0B/s640/Screen+Shot+2018-01-27+at+8.50.01+PM.png" width="640" /></a></div> <br /> <br /> <h3> <span style="color: #38761d;">Let RFCrack Plot the Signal For you: </span></h3> </div> <div class="p1"> The other option is let RFCrack help you out by taking a signal from the log output above and let RFCrack plot it for you.<span class="Apple-converted-space">  </span>This saves time and allows you to use only one piece of hardware for all of the work.<span class="Apple-converted-space">  </span>This can easily be done with the following command:<span class="Apple-converted-space"> </span></div> <div class="p2"> <br /></div> <div class="p1"> Destroy:RFCrack ficti0n$ <span style="color: #38761d;">python RFCrack.py -n -g -u 1f0fffe0fffc01ff803ff007fe0fffc1fff83fff07ffe0007c</span></div> <div class="p1"> -n = No yardstick attached</div> <div class="p1"> -g = graph a single signal</div> <div class="p1"> -u = Use this piece of data</div> <div class="p2"> <br /> <br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZfh0mN7NmEfq_8acit6f_MqaN9MilpsvTVkvdnqztX-N_xJrpzbovyIL7mVDgvp3euItYVb1hN4IUSiAz0dA9bRk_NHWSGwc2gyrehnapxNsQ30tjoIptHk5U0Q2-VQlCSOuSjg327jQX/s1600/Screen+Shot+2018-01-27+at+8.33.42+PM.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="238" data-original-width="1400" height="108" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZfh0mN7NmEfq_8acit6f_MqaN9MilpsvTVkvdnqztX-N_xJrpzbovyIL7mVDgvp3euItYVb1hN4IUSiAz0dA9bRk_NHWSGwc2gyrehnapxNsQ30tjoIptHk5U0Q2-VQlCSOuSjg327jQX/s640/Screen+Shot+2018-01-27+at+8.33.42+PM.png" width="640" /></a></div> <br /></div> <div class="p2"> <br /></div> <div class="p1"> From the graph output we see 2 distinct crest lengths and some junk at either end we can throw away. These 2 unique crests correspond to our toggle switch positions of up/down giving us the following 2 possible scenarios using a 9 toggle switch remote based on the 9 crests above:<span class="Apple-converted-space"> </span></div> <div class="p2"> <br /></div> <div class="p1"> <h3> <span style="color: #38761d;">Possible toggle switch scenarios:</span></h3> <div> <ol> <li>down down up up up down down down down</li> <li>up up down down down up up up up<span class="Apple-converted-space"> </span></li> </ol> </div> </div> <div class="p1"> <h3> <span style="color: #38761d;">Configuring a remote:<span class="Apple-converted-space"> </span></span></h3> </div> <div class="p1"> Proper toggle switch configuration allows us to program a universal remote that sends a signal to the gate. However even with the proper toggle switch configuration the remote has many different signals it sends based on the manufacturer or type of signal.<span class="Apple-converted-space">  </span>In order to figure out which configuration the gate is using without physically watching the gate open, we will rely on local signal analysis/comparison. <span class="Apple-converted-space"> </span></div> <div class="p2"> <br /></div> <div class="p1"> Programming a remote is done by clicking the device with the proper toggle switch configuration until the gate opens and the correct manufacturer is configured. Since we don't have access to the gate after capturing the initial signal we will instead compare each signal from he remote to the original captured signal.<span class="Apple-converted-space"> </span><br /> <span class="Apple-converted-space"><br /></span> <br /> <h3> <span class="Apple-converted-space" style="color: #38761d;">Comparing Signals: </span></h3> </div> <div class="p1"> This can be done a few ways, one way is to use an RTLSDR and capture all of the presses followed by visually comparing the output in audacity. Instead I prefer to use one tool and automate this process with RFCrack so that on each click of the device we can compare a signal with the original capture. Since there are multiple signals sent with each click it will analyze all of them and provide a percent likelihood of match of all the signals in that click followed by a comparing the highest % match graph for visual confirmation. If you are seeing a 80-90% match you should have the correct signal match. <span class="Apple-converted-space"> </span></div> <div class="p2"> <br /></div> <div class="p1"> <i><span style="color: #38761d;">Note:<span class="Apple-converted-space">  </span>Not every click will show output as some clicks will be on different frequencies, these don't matter since our recon confirmed the gate is communicating on 390Mhz.<span class="Apple-converted-space"> </span></span></i></div> <div class="p2"> <br /></div> <div class="p1"> In order to analyze the signals in real time you will need to open up your clicker and set the proper toggle switch settings followed by setting up a sniffer and live analysis with RFCrack:<span class="Apple-converted-space"> </span></div> <div class="p2"> <br /></div> <div class="p1"> <h3> <span style="color: #38761d;">Open up 2 terminals and use the following commands:<span class="Apple-converted-space"> </span></span></h3> </div> <div class="p1"> #Setup a sniffer on 390mhz<br />   Setup sniffer:<span class="Apple-converted-space">      </span><span style="color: #38761d;">python RFCrack.py -k -c -f 390000000. </span><span class="Apple-converted-space" style="color: #38761d;">    </span></div> <div class="p1"> #Monitor the log file, and provide the gates original signal<br />   Setup Analysis: <span class="Apple-converted-space">    </span><span style="color: #38761d;">python RFCrack.py -c -u 1f0fffe0fffc01ff803ff007fe0fffc1fff83fff07ffe0007c -n.<span class="Apple-converted-space">  </span></span></div> <div class="p2"> <br /></div> <div class="p1"> Cmd switches used</div> <div class="p1"> -k = known frequency</div> <div class="p1"> -c = compare mode</div> <div class="p1"> -f = frequency</div> <div class="p1"> -n = no yardstick needed for analysis</div> <div class="p2"> <br /></div> <div class="p1"> Make sure your remote is configured for one of the possible toggle configurations determined above. In the below example I am using the first configuration, any extra toggles left in the down position: <span style="color: #38761d;">(down down up up up down down down down)</span><br /> <br /></div> <div class="p2"> <br /></div> <div class="p2"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPEdgeMWwfEW3l5oOuZlXlGVeHNIvNXYuAkgxajkJjbOPRQdN8QI40SscmsREyrAzybbyC7aAsWIkASV01xY9WyLcxs3vvduvp9p78wY9CgQCeDHWZUmkT1lmtPOz8usgGS7Qs1IDiou3x/s1600/Screen+Shot+2018-01-27+at+9.08.07+PM.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="666" data-original-width="492" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPEdgeMWwfEW3l5oOuZlXlGVeHNIvNXYuAkgxajkJjbOPRQdN8QI40SscmsREyrAzybbyC7aAsWIkASV01xY9WyLcxs3vvduvp9p78wY9CgQCeDHWZUmkT1lmtPOz8usgGS7Qs1IDiou3x/s320/Screen+Shot+2018-01-27+at+9.08.07+PM.png" width="236" /></a></div> <br /> <br /></div> <div class="p1"> <h3> <span style="color: #38761d;">Analyze Your Clicks:<span class="Apple-converted-space"> </span></span></h3> </div> <div class="p1"> Now with the two terminals open and running click the reset switch to the bottom left and hold till it flashes. Then keep clicking the left button and viewing the output in the sniffing analysis terminal which will provide the comparisons as graphs are loaded to validate the output.<span class="Apple-converted-space">  </span>If you click the device and no output is seen, all that means is that the device is communicating on a frequency which we are not listening on.<span class="Apple-converted-space">  </span>We don't care about those signals since they don't pertain to our target.<span class="Apple-converted-space"> </span></div> <div class="p2"> <br /></div> <div class="p1"> At around the 11th click you will see high likelihood of a match and a graph which is near identical. A few click outputs are shown below with the graph from the last output with a 97% match.<span class="Apple-converted-space">  </span>It will always graph the highest percentage within a click.<span class="Apple-converted-space">  </span>Sometimes there will be blank graphs when the data is wacky and doesn't work so well. This is fine since we don't care about wacky data.<span class="Apple-converted-space"> </span></div> <div class="p2"> <br /></div> <div class="p1"> You will notice the previous clicks did not show even close to a match, so its pretty easy to determine which is the right manufacture and setup for your target gate. Now just click the right hand button on the remote and it should be configured with the gates setup even though you are in another location setting up for your test.<span class="Apple-converted-space"> </span></div> <div class="p2"> <br /></div> <div class="p1"> For Visual of the last signal comparison go to ./imageOutput/LiveComparison.png</div> <div class="p1"> ----------Start Signals In Press--------------</div> <div class="p1"> Percent Chance of Match for press is: 0.05</div> <div class="p1"> Percent Chance of Match for press is: 0.14</div> <div class="p1"> Percent Chance of Match for press is: 0.14</div> <div class="p1"> Percent Chance of Match for press is: 0.12</div> <div class="p1"> ----------End Signals In Press------------</div> <div class="p1"> For Visual of the last signal comparison go to ./imageOutput/LiveComparison.png</div> <div class="p1"> ----------Start Signals In Press--------------</div> <div class="p1"> Percent Chance of Match for press is: 0.14</div> <div class="p1"> Percent Chance of Match for press is: 0.20</div> <div class="p1"> Percent Chance of Match for press is: 0.19</div> <div class="p1"> Percent Chance of Match for press is: 0.25</div> <div class="p1"> ----------End Signals In Press------------</div> <div class="p1"> For Visual of the last signal comparison go to ./imageOutput/LiveComparison.png</div> <div class="p1"> ----------Start Signals In Press--------------</div> <div class="p1"> Percent Chance of Match for press is: 0.93</div> <div class="p1"> Percent Chance of Match for press is: 0.93</div> <div class="p1"> Percent Chance of Match for press is: 0.97</div> <div class="p1"> Percent Chance of Match for press is: 0.90</div> <div class="p1"> Percent Chance of Match for press is: 0.88</div> <div class="p1"> Percent Chance of Match for press is: 0.44</div> <div class="p1"> ----------End Signals In Press------------</div> <div class="p1"> For Visual of the last signal comparison go to ./imageOutput/LiveComparison.png</div> <div class="p2"> <br /> <br /></div> <div class="p1"> <h3> <span style="color: #38761d;">Graph Comparison Output for 97% Match:<span class="Apple-converted-space"> </span></span></h3> </div> <div class="p2"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjHzuUYqlaRXkt8WxK-35QT8QP-5BB_ZmH4JGLvca_uYsjZzGn3faVhLdiR1cUJyyEO7X-2YIp9CacwWAhSFsvlT_8wknxz0ipbIdKuTUEdy7htRKzNmiktKqhpI6WaT1_Aj33oIVrHdVa/s1600/Screen+Shot+2018-01-27+at+9.28.13+PM.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" data-original-height="276" data-original-width="1260" height="87" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjHzuUYqlaRXkt8WxK-35QT8QP-5BB_ZmH4JGLvca_uYsjZzGn3faVhLdiR1cUJyyEO7X-2YIp9CacwWAhSFsvlT_8wknxz0ipbIdKuTUEdy7htRKzNmiktKqhpI6WaT1_Aj33oIVrHdVa/s400/Screen+Shot+2018-01-27+at+9.28.13+PM.png" width="400" /></a></div> <br /></div> <div class="p2"> <br /></div> <div class="p2"> <br /></div> <div class="p1"> <h3> </h3> <div> <br /></div> <h3> <span style="color: #38761d;"><br /></span></h3> <div> <span style="color: #38761d;"><br /></span></div> <h3> <span style="color: #38761d;">Conclusion:<span class="Apple-converted-space"> </span></span></h3> </div> <style type="text/css"> p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px 'Helvetica Neue'; color: #454545} p.p2 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px 'Helvetica Neue'; color: #454545; min-height: 14.0px} p.p3 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px 'Helvetica Neue'; color: #e4af0a} span.s1 {color: #e4af0a} span.s2 {color: #454545} span.Apple-tab-span {white-space:pre} </style> <br /> <div class="p1"> You have now walked through successfully reversing a toggle switch remote for a security gate. You took a raw signal and created a working device using only a Yardstick and RFCrack.<span class="Apple-converted-space">  </span>This was just a quick tutorial on leveraging the skillsets you gained in previous blogs in order to learn how to analyze<span class="Apple-converted-space">  </span>RF signals within embedded devices. There are many scenarios these same techniques could assist in.<span class="Apple-converted-space">  </span>We also covered a few new features in RF crack regarding logging, graphing and comparing signals.<span class="Apple-converted-space">  </span>These are just a few of the features which have been added since the initial release. For more info and other features check the wiki.<span class="Apple-converted-space"> </span></div><h2>More information</h2><br><ol><li> <a href="https://www.google.ee/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F05%2Fguardedbox-online-client-side-manager.html">Tools Used For Hacking </a></li><li> <a href="https://www.google.ae/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F01%2Fcheck-localadminhash-powershell-tool.html">Pentest Tools Website </a></li><li> <a href="https://www.google.hr/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F05%2Fspray-password-spraying-tool-for-active.html">Hacker Tools Online </a></li><li> <a href="https://www.google.fi/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F08%2Fnautilus-grammar-based-feedback-fuzzer.html">Hacker </a></li><li> <a href="https://www.google.ge/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F08%2Fstock-management-system-10-cross-site.html">How To Install Pentest Tools In Ubuntu </a></li><li> <a href="https://www.google.cat/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F08%2Fbuscando-redes-sociales-con-sherlock.html">Hack Tool Apk No Root </a></li><li> <a href="https://www.google.rw/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2013%2F01%2Fconseguir-shell-desde-un-sqli-con-sqlmap.html">Hacking Tools For Mac </a></li><li> <a href="https://www.google.lu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Fsharpchromium-net-40-clr-project-to.html">Usb Pentest Tools </a></li><li> <a href="https://www.google.nr/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F08%2Ffestin-s3-bucket-weakness-discovery.html">Pentest Reporting Tools </a></li><li> <a href="https://www.google.se/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F06%2Flynis-300-security-auditing-tool-for.html">Bluetooth Hacking Tools Kali </a></li><li> <a href="https://www.google.gr/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F06%2Fneedle-instant-access-to-you-bug-bounty.html">Pentest Tools For Mac </a></li><li> <a href="https://www.google.cv/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F05%2Fthreadtear-multifunctional-java.html">Hacking Tools Mac </a></li><li> <a href="https://www.google.gl/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Fdetect-sql-injection-wordpress-plugin.html">Hack Tools Github </a></li><li> <a href="https://pk.search.yahoo.com/search?p=site%3Akitploit.com&fr=yfp-t&fp=1&toggle=1&cop=mss&ei=UTF-8&fp=1&b=461&pz=10&bct=0&xargs=0">Hack Tool Apk </a></li><li> <a href="https://www.google.ge/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Fsonar-qube-831-unquoted-service-path.html">Hacking Tools </a></li><li> <a href="https://www.google.no/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fhow-to-maximize-your-privacy-by-using.html">Hacker Tools 2020 </a></li><li> <a href="https://www.google.tl/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fyoutube_95.html">How To Make Hacking Tools </a></li><li> <a href="https://www.google.nr/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F01%2Faaia-aws-identity-and-access-management.html">Pentest Tools Free </a></li><li> <a href="https://www.google.tl/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F08%2Frepaso-vi-metasploit-post-explotation.html">How To Make Hacking Tools </a></li><li> <a href="https://www.google.ge/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F05%2Fsharingan-offensive-security-recon-tool.html">Wifi Hacker Tools For Windows </a></li><li> <a href="https://www.google.fi/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F06%2Fhmmcookies-grab-cookies-from-firefox.html">Hack Tools For Mac </a></li><li> <a href="https://www.google.pk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F03%2Fpentest-tools-framework-database-of.html">Hacking Tools 2019 </a></li><li> <a href="https://www.google.ae/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Fcayin-content-management-server-110.html">Pentest Tools Port Scanner </a></li><li> <a href="https://www.google.dm/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F07%2Fkubei-flexible-kubernetes-runtime.html">Hacking Tools For Windows 7 </a></li><li> <a href="https://www.google.mk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F03%2Fhttps-everywhere-browser-extension-that.html">Hackrf Tools </a></li><li> <a href="https://www.google.kz/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2013%2F10%2Fdef-con-20-presentaciones-videos.html">How To Make Hacking Tools </a></li><li> <a href="https://www.google.sc/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Fnodejs-hostname-verification-bypass.html">Hacking Tools For Beginners </a></li><li> <a href="https://www.google.ae/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F08%2Fonline-shopping-alphaware-10-arbitrary.html">Pentest Tools Find Subdomains </a></li><li> <a href="https://www.google.pk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F06%2Fcamino-de-hackers-introduccion-de-nueva.html">Hacker Tools Apk </a></li><li> <a href="https://www.google.mu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F06%2Fwords-scraper-selenium-based-web.html">Hacking Tools For Mac </a></li><li> <a href="https://www.google.lu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F02%2Fxss-freak-xss-scanner-fully-written-in.html">Hak5 Tools </a></li><li> <a href="https://www.google.tn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F08%2Ftaowu-cobaltstrike-toolkit.html">Hacker Tool Kit </a></li><li> <a href="https://www.google.gg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F08%2Fevine-interactive-cli-web-crawler.html">Pentest Tools Find Subdomains </a></li><li> <a href="https://www.google.ps/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F03%2Fsauroneye-search-tool-to-find-specific.html">Underground Hacker Sites </a></li><li> <a href="https://www.google.se/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F07%2Fintelspy-perform-automated-network.html">What Are Hacking Tools </a></li><li> <a href="https://www.google.cl/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdef-con-safe-mode-blue-team-village_79.html">Hacker Techniques Tools And Incident Handling </a></li><li> <a href="https://www.google.it/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F02%2Fgospider-fast-web-spider-written-in-go.html">Pentest Tools Android </a></li><li> <a href="https://rw.search.yahoo.com/search?p=site%3Avideos.hacking.land&fr=yfp-t&fp=1&toggle=1&cop=mss&ei=UTF-8&fp=1&b=641&pz=10&bct=0&xargs=0">Hack Tools </a></li><li> <a href="https://www.google.ec/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F07%2Ffaxhell-bind-shell-using-fax-service.html">Hacker Tools Free </a></li><li> <a href="https://www.google.bi/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F03%2Fmssqlproxy-toolkit-aimed-to-perform.html">Physical Pentest Tools </a></li><li> <a href="https://www.google.gy/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F08%2Fsharpchromium-net-40-clr-project-to.html">Kik Hack Tools </a></li><li> <a href="https://www.google.ee/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F07%2Fpoc-dll-injection-con-powershellmafia.html">Game Hacking </a></li><li> <a href="https://www.google.ae/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdef-con-safe-mode-demo-labs-ajin.html">Install Pentest Tools Ubuntu </a></li><li> <a href="https://www.google.sh/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2012%2F07%2Fg00rec0n-herramienta-de-gathering-para.html">Hackrf Tools </a></li><li> <a href="https://www.google.nu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F07%2Fharbian-audit-hardened-debian-gnulinux.html">Pentest Tools Review </a></li><li> <a href="https://www.google.is/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F05%2Fopen-xchange-dovecot-2310-null-pointer.html">Hacker Tools For Pc </a></li><li> <a href="https://www.google.us/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdef-con-safe-mode-biohacking-village_18.html">Pentest Tools Bluekeep </a></li><li> <a href="https://www.google.ng/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Feternalbluec-eternalblue-suite-remade.html">Pentest Tools Website </a></li><li> <a href="https://www.google.vg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F08%2Fall-dynamics-software-enlogicshow_3.html">Hacker Tools Apk Download </a></li><li> <a href="https://www.google.tl/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F02%2Ftaskmanager-button-disabler-simple-way.html">Computer Hacker </a></li><li> <a href="https://www.google.tg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2012%2F08%2Fnuevo-autor-caleb-bucker.html">How To Install Pentest Tools In Ubuntu </a></li><li> <a href="https://www.google.be/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F08%2Fsafari-webkit-for-ios-712-jit.html">Hacking Tools For Mac </a></li><li> <a href="https://www.google.ne/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F06%2Fattacker-group-predictor-tool-to.html">Nsa Hack Tools Download </a></li><li> <a href="https://www.google.cd/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2018%2F12%2F0day-en-windows-permite-la-lectura-de.html">Android Hack Tools Github </a></li><li> <a href="https://www.google.lu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F02%2Finjuredandroid-vulnerable-android.html">Hack Tools For Windows </a></li><li> <a href="https://www.google.fr/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F07%2Fkubebox-terminal-and-web-console-for.html">Hacking Tools Hardware </a></li><li> <a href="https://www.google.hk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Fseczetta-neprofile-3311-remote-code.html">Pentest Tools Github </a></li><li> <a href="https://www.google.sk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F08%2Fgtunnel-robust-tunelling-solution.html">Pentest Tools Free </a></li><li> <a href="https://www.google.bt/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F08%2Fsms-b0mb3r.html">Hack Tools Pc </a></li><li> <a href="https://www.google.ml/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdef-con-safe-mode-blue-team-village.html">Pentest Reporting Tools </a></li><li> <a href="https://www.google.iq/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F08%2Fmocha-telnet-lite-for-ios-42-denial-of.html">Black Hat Hacker Tools </a></li><li> <a href="https://www.google.td/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F06%2Fligolo-reverse-tunneling-made-easy-for.html">Hacking Tools Pc </a></li><li> <a href="https://www.google.bt/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F05%2Fjaeles-v09-swiss-army-knife-for.html">Hack Apps </a></li><li> <a href="https://www.google.vu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F07%2Fbad-guys-never-sleep.html">Install Pentest Tools Ubuntu </a></li><li> <a href="https://www.google.ml/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F07%2Fadb-toolkit-tool-for-testing-your.html">Pentest Tools Website Vulnerability </a></li><li> <a href="https://www.google.de/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2018%2F08%2Fpresentaciones-y-demos-de-la-def-con-26.html">Wifi Hacker Tools For Windows </a></li><li> <a href="https://www.google.de/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F05%2Fsshprank-fast-ssh-mass-scanner-login.html">Wifi Hacker Tools For Windows </a></li><li> <a href="https://www.google.tn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2016%2F11%2Fbypass-cifrado-en-linux-cryptsetup.html">Hack Website Online Tool </a></li><li> <a href="https://www.google.af/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F07%2Fntlmrecon-tool-to-enumerate-information.html">Pentest Tools Website Vulnerability </a></li><li> <a href="https://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.blackploit.com%2F2019%2F12%2Flas-20-herramientas-de-hacking-mas.html">Hack Tools For Ubuntu </a></li><li> <a href="https://www.google.sc/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F07%2Fautoenum-automatic-service-enumeration.html">Pentest Tools Website </a></li><li> <a href="https://www.google.hk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F07%2Foralyzer-tool-to-identify-open.html">Hacker Tools 2019 </a></li><li> <a href="https://www.google.ki/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdef-con-safe-mode-monero-village-rehrar.html">Pentest Tools For Mac </a></li><li> <a href="https://www.google.tt/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F07%2Fauthmatrix-burp-suite-extension-that.html">How To Make Hacking Tools </a></li><li> <a href="https://www.google.pt/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Falexa-can-be-hacked-instagram-retains.html">Hacking Apps </a></li><li> <a href="https://www.google.sr/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideo.hacking.reviews%2F2020%2F08%2Fdef-con-safe-mode-payment-village-leigh.html">Hacking Tools Windows </a></li><li> <a href="https://www.google.ac/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F01%2Fgophish-open-source-phishing-toolkit.html">Hacking Tools 2020 </a></li><li> <a href="https://www.google.mn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F03%2Fntlmrecon-tool-to-enumerate-information.html">Pentest Tools Nmap </a></li><li> <a href="https://www.google.jo/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F08%2Fcms-made-simple-2214-shell-upload.html">Pentest Box Tools Download </a></li><li> <a href="https://www.google.no/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F06%2Fquedate-en-casapractica-con-nosotros.html">Hacker Tools </a></li><li> <a href="https://www.google.tk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F08%2Fdaily-expenses-management-system-10.html">Pentest Tools Bluekeep </a></li><li> <a href="https://www.google.ch/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F07%2Fserver-side-template-injection-payloads.html">Nsa Hack Tools </a></li><li> <a href="https://www.google.ee/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Fqmail-local-privilege-escalation-remote.html">Hacking Tools Software </a></li><li> <a href="https://www.google.bt/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F03%2Fpentest-tools-framework-database-of.html">Easy Hack Tools </a></li><li> <a href="https://www.google.kz/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F08%2Feternalbluec-eternalblue-suite-remade.html">Hack Tools Mac </a></li><li> <a href="https://www.google.cg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F04%2Flunar-lightweight-native-dll-mapping.html">Pentest Tools Review </a></li><li> <a href="https://www.google.ly/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F07%2Fdazzleup-tool-that-detects-privilege.html">Pentest Tools Port Scanner </a></li><li> <a href="https://www.google.ie/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F08%2Fcnitch-container-snitch-checks-running.html">Hacker Tools </a></li><li> <a href="https://www.google.tl/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F05%2Fautordpwn-v51-shadow-attack-framework.html">Hacking Tools Github </a></li><li> <a href="https://www.google.dz/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Fkiteservice-120206180-unquoted-service.html">Pentest Tools Review </a></li><li> <a href="https://www.google.mu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.reviews%2F2020%2F07%2Flazymux-huge-list-of-many-hacking-tools.html">Pentest Tools Windows </a></li><li> <a href="https://www.google.bs/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Fphirautee-poc-crypto-virus-to-spread.html">Computer Hacker </a></li><li> <a href="https://www.google.im/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Fdetenidos-los-responsables-del-mayor.html">Hack And Tools </a></li><li> <a href="https://www.google.am/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F02%2Fmisp-dashboard-dashboard-for-real-time.html">Hacking App </a></li><li> <a href="https://www.google.ga/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fvideos.hacking.land%2F2020%2F05%2Ffear-foca-curso-de-ethical-hacking.html">Install Pentest Tools Ubuntu </a></li><li> <a href="https://www.google.ae/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F04%2Ffprobe-take-list-of-domainssubdomains.html">Hacker Tools For Ios </a></li><li> <a href="https://www.google.at/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.kitploit.com%2F2020%2F05%2Fpivotnacci-tool-to-make-socks.html">Easy Hack Tools </a></li><li> <a href="https://www.google.gy/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F02%2Fburpsuite-random-user-agents-burp-suite.html">Computer Hacker </a></li><li> <a href="https://www.google.sc/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F05%2Fdiscordrat-discord-remote.html">Pentest Tools For Mac </a></li><li> <a href="https://www.google.bi/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F04%2Fvulnx-v20-intelligent-bot-auto-shell.html">Hacker Hardware Tools </a></li><li> <a href="https://www.google.sk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Fgila-cms-1118-sql-injection.html">Hacking Tools For Pc </a></li><li> <a href="https://www.google.tn/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fwww.hacking.land%2F2020%2F08%2Furlbuster-powerful-mutable-web.html">Hack Tools Github </a></li><li> <a href="https://www.google.al/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F07%2Fpfsense-244-p3-cross-site-request.html">Hack Website Online Tool </a></li><li> <a href="https://rw.search.yahoo.com/search?p=site%3Avideos.hacking.land&fr=yfp-t&fp=1&toggle=1&cop=mss&ei=UTF-8&fp=1&b=931&pz=10&bct=0&xargs=0">Hacking Tools Mac </a></li><li> <a href="https://www.google.ba/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F08%2Ftailor-ms-10-cross-site-scripting.html">Hacker Tools Windows </a></li><li> <a href="https://fj.search.yahoo.com/search?p=site%3Akitploit.com&fr=yfp-t&fp=1&toggle=1&cop=mss&ei=UTF-8&fp=1&b=381&pz=10&bct=0&xargs=0">Hacker Techniques Tools And Incident Handling </a></li><li> <a href="https://www.google.al/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Fexploit.kitploit.com%2F2020%2F06%2Fopensis-74-local-file-inclusion.html">Hack Apps </a></li><li> <a href="https://www.google.so/url?sa=t&rct=j&q=&esrc=s&source=web&cd=15&url=https%3A%2F%2Famp.kitploit.com%2F2020%2F02%2Fqiling-advanced-binary-emulation.html">Hacking Tools Software </a></li></ol>

Hacking Everything With RF And Software Defined Radio - Part 3

Reversing Device Signals with RFCrack for Red Teaming This blog was researched and automated by: @Ficti0n  @GarrGhar  Mostly beca...

Baca selengkapnya »