Search the Community

This framework is similar to metsploit. It's still under development, but it looks good. The author hopes to give more advice. Let's go and have a try! Github:https://github.com/hucmosin/purelove

Overview TL;DR: There are a ton of great JavaScript frameworks out there, and it can be a little overwhelming to keep up with them all. The learning curve for these frameworks can also be a bit steep. Vue.js is a breath of fresh air in this regard. In this tutorial, we'll see how easy it is to get up and running with a Vue.js app and how we can easily add authentication to it. Check out the repo to get the code. We are lucky to have plenty of JavaScript frameworks to choose from these days but, at the same time, it can be quite fatiguing to keep up with all of them. Some have a steep learning curve and require a lot of time for developers and their teams to become comfortable with. Others might be easy to learn, but perhaps lack some features that are crucial to a project. In either case, the level of complexity associated with learning a new framework can often hinder adoption and leave developers and teams frustrated. If you're still choosing a framework for your Single Page App (SPA), or if you just want to learn a new technology, I believe Vue.js is one of the best frameworks you can pick. I love Vue.js for its simplicity and elegance, and how I can be super productive with it without needing to spend tons of time learning. In my experience, Vue.js just works and gets out of my way when developing applications. Those are some anecdotal selling points, but let's cut to the hard facts: what exactly is Vue.js and how does it differ from other frameworks? If you're familiar with AngularJS 1.x, then Vue.js will probably look pretty familiar. In fact, Vue is heavily inspired by Angular. So what's the difference then? Essentially, Vue has a much simpler and cleaner API, is more flexible, and claims better performance. Vue.js is firstly a view layer for applications that allows for reactive data binding and composable view components, and many developers use it only for their view layers. However, when combined with other tools in the Vue ecosystem, such as vue-router, vue-resource, and vue-loader, we get all the benefits of a great SPA framework while simplicity and developer experience are maintained. What We'll Build: A Vue.js Authentication App To demonstrate how easy it is to get up and running with a full SPA using Vue, we'll build a simple app that retrieves Chuck Norris quotes from a NodeJS backend. Vue can easily be mixed with other technologies, and you can use Vue for as much or as little of your app as you wish. To demonstrate Vue's full potential though, we'll build the whole front-end SPA with Vue components and follow Vue's pattern for large-scale applications. The front-end app will be totally decoupled from the back end, and we'll make HTTP requets to RESTful endpoints on our server. We'll also demonstrate how we can easily add authentication to our Vue.js app. We'll put Login and Signup components in place to show how we can retrieve and save a user's JWT, and then send it back to the server for accessing protected endpoints. Rather than listing out how Vue implements certain features and comparing them to other frameworks, we'll let the code speak for itself. Again, if you're familiar with Angular, it will be easy to reason about Vue's features and syntax. Installation and Setup Everything we need to start our component-based Vue.js app is on NPM. To get started, let's pull down what we need by creating our package.json file and specifying the packages we need. We can take full advantage of ES6 for our Vue components, and to make that happen, we'll use Babel. We'll also bundle everything up with Webpack and use hot reloading to see changes to our modules happen immediately. If you wish, you can also use other build tools (like Browserify) instead of Webpack. // package.json ... "devDependencies": { "babel-core": "^6.1.2", "babel-loader": "^6.1.0", "babel-plugin-transform-runtime": "^6.1.2", "babel-preset-es2015": "^6.1.2", "babel-runtime": "^6.0.14", "css-loader": "^0.21.0", "style-loader": "^0.13.0", "vue-hot-reload-api": "^1.2.1", "vue-html-loader": "^1.0.0", "vue-loader": "^7.0.1", "webpack": "^1.12.3", "webpack-dev-server": "^1.12.1" }, "dependencies": { "bootstrap": "^3.3.5", "vue-resource": "^0.1.17", "vue-router": "^0.7.5", "vue": "^1.0.7" } ... Once the rest of our package.json file is in place, we can install everything. npm install To make Webpack work, we need a configuration file for it. Let's put in a file called webpack.config.js and populate it. // webpack.config.js module.exports = { // the main entry of our app entry: ['./src/index.js', './src/auth/index.js'], // output configuration output: { path: __dirname + '/build/', publicPath: 'build/', filename: 'build.js' }, module: { loaders: [ // process *.vue files using vue-loader { test: /\.vue$/, loader: 'vue' }, // process *.js files using babel-loader // the exclude pattern is important so that we don't // apply babel transform to all the dependencies! { test: /\.js$/, loader: 'babel', exclude: /node_modules/ } ] }, babel: { presets: ['es2015'], plugins: ['transform-runtime'] } } In this config file, we're first specifying where our app's main entry point is and what the output path should be. The bundled JavaScript will be served as one file called build.js. In the module.loaders array, we're setting up processing for our Vue components. These components have an extension of .vue and are processed by vue-loader. That's all the configuration we need for now. Once we have our files in place, we just need to run webpack-dev-server --inline --hot to bundle and serve everything. Setting Up the Back End We're using our trusty nodejs-jwt-authentication-sample to retrieve Chuck Norris quotes. Clone the repo wherever you like (here we're putting it in a server directory) and follow the readme for installation steps. Setting Up the Vue Components Let's get started with the actual components for our app. But first, what exactly is a Vue component and how does it work? Vue components allow us to specify a template, a script, and style rules all in one file. If you're familiar with React, this will likely be familiar. This move toward composition and splitting the app into small components is helpful for maintainence and reasoning about the app. To see how this works, let's start with the Home component. <!-- src/components/Home.vue --> <template> <div class="col-sm-6 col-sm-offset-3"> <h1>Get a Free Chuck Norris Quote!</h1> <button class="btn btn-primary" v-on:click="getQuote()">Get a Quote</button> <div class="quote-area" v-if="quote"> <h2><blockquote>{{ quote }}</blockquote></h2> </div> </div> </template> <script> export default { data() { return { quote: '' } }, methods: { getQuote() { this.$http .get('http://localhost:3001/api/random-quote', (data) => { this.quote = data; }) .error((err) => console.log(err)) } } } </script> The template is just some simple markup with a button that calls the method getQuote. We can notice some similarities to Angular in this code already. The template uses directives like v-on:click for click events, and v-if to conditionally show and hide the quote-area div. Vue also uses the double curly brace syntax for templating, which is how we take care of rendering the quoteproperty. The script area exports an object that is converted into a component constructor function by Vue. It has on it a data method and a methods object where we can register custom methods. When we want to register a data property to be used in the template, we need to do so in the data method. If we were to leave out the quote property from the returned object, that property wouldn't be rendered in the template. The getQuote method makes an HTTP request to our back end and sets the returned data on the quote property. This gives us a good idea of what Vue components look like, but this won't work quite yet because we need to set up our app's main entry point, as well as a main App component. Here's how this component will render once everything is set up: Setting Up index.js and App.vue The index.js file is the place where we set up our main imports and do other configuration like routing. Let's set up everything we'll need for the whole app right now. // src/index.js import Vue from 'vue' import App from './components/App.vue' import Home from './components/Home.vue' import SecretQuote from './components/SecretQuote.vue' import Signup from './components/Signup.vue' import Login from './components/Login.vue' import VueRouter from 'vue-router' import VueResource from 'vue-resource' Vue.use(VueResource) Vue.use(VueRouter) export var router = new VueRouter() // Set up routing and match routes to components router.map({ '/home': { component: Home }, 'secretquote': { component: SecretQuote }, '/login': { component: Login }, '/signup': { component: Signup } }) // Redirect to the home route if any routes are unmatched router.redirect({ '*': '/home' }) // Start the app on the #app div router.start(App, '#app') We're importing some components we've yet to create, as well as vue-router and vue-resource. For the app to recognize vue-router and vue-resource, we just need to call Vue.use on them. We can set up our route definitions with the simple map method on our instance of vue-router. The reason we're exporting this instance is so we can get a reference to it in our other components. <!-- src/components/App.vue --> <template> <nav class="navbar navbar-default"> <div class="container"> <ul class="nav navbar-nav"> <li><a v-link="'home'">Home</a></li> <li><a v-link="'login'">Login</a></li> <li><a v-link="'signup'">Sign Up</a></li> <li><a v-link="'secretquote'">Secret Quote</a></li> <li><a v-link="'login'">Logout</a></li> </ul> </div> </nav> <div class="container"> <router-view></router-view> </div> </template> To start out, our App component just needs a template. This top-level component has a navbar and exposes a router-view which is where our various routes will be rendered. Linking to routes is as simple as placing v-link on the anchor tags. Finally, we need to be sure to place a div with an id of app within index.html, as this is where the whole app will be exposed. <!-- index.html --> ... <body> <div id="app"></div> <script src="build/build.js"></script> </body> ... User Authentication - Login and Signup Components To log users in, we'll need to make an HTTP request to our authentication endpoint and save the JWT that is returned in localStorage. We could place this logic right within our Login component, but we should really have a service to make it more reusable. Let's create a directory called auth and provide an index.js file there. // src/auth/index.js import {router} from '../index' // URL and endpoint constants const API_URL = 'http://localhost:3001/' const LOGIN_URL = API_URL + 'sessions/create/' const SIGNUP_URL = API_URL + 'users/' export default { // User object will let us check authentication status user: { authenticated: false }, // Send a request to the login URL and save the returned JWT login(context, creds, redirect) { context.$http.post(LOGIN_URL, creds, (data) => { localStorage.setItem('id_token', data.id_token) localStorage.setItem('access_token', data.access_token) this.user.authenticated = true // Redirect to a specified route if(redirect) { router.go(redirect) } }).error((err) => { context.error = err }) }, signup(context, creds, redirect) { context.$http.post(SIGNUP_URL, creds, (data) => { localStorage.setItem('id_token', data.id_token) localStorage.setItem('access_token', data.access_token) this.user.authenticated = true if(redirect) { router.go(redirect) } }).error((err) => { context.error = err }) }, // To log out, we just need to remove the token logout() { localStorage.removeItem('id_token') localStorage.removeItem('access_token') this.user.authenticated = false }, checkAuth() { var jwt = localStorage.getItem('id_token') if(jwt) { this.user.authenticated = true } else { this.user.authenticated = false } }, // The object to be passed as a header for authenticated requests getAuthHeader() { return { 'Authorization': 'Bearer ' + localStorage.getItem('access_token') } } } Our auth service exposes methods for logging users in and out, signing them up, and checking their authentication status. Note that "logging in" is just a matter of saving the JWT that is returned by the server. These methods and properties will all be useful throughout the app. For example, we can use the user.authenticated property to conditionally show elements in the app. Implementing the Login Component The Login component will need some HTML for the user inputs and a method to call our auth service. <!-- src/components/Login.vue --> <template> <div class="col-sm-4 col-sm-offset-4"> <h2>Log In</h2> <p>Log in to your account to get some great quotes.</p> <div class="alert alert-danger" v-if="error"> <p>{{ error }}</p> </div> <div class="form-group"> <input type="text" class="form-control" placeholder="Enter your username" v-model="credentials.username" > </div> <div class="form-group"> <input type="password" class="form-control" placeholder="Enter your password" v-model="credentials.password" > </div> <button class="btn btn-primary" @click="submit()">Access</button> </div> </template> <script> import auth from '../auth' export default { data() { return { // We need to initialize the component with any // properties that will be used in it credentials: { username: '', password: '' }, error: '' } }, methods: { submit() { var credentials = { username: this.credentials.username, password: this.credentials.password } // We need to pass the component's this context // to properly make use of http in the auth service auth.login(this, credentials, 'secretquote') } } } </script> HTTP calls made with vue-resource require a component's context, and since we're abstracting that logic to a service, we need to pass the Login component's this context to the service. The second argument is the object with the user's credentials, and the third is the route we want to redirect to upon successfully authenticating. Note that we're using @click on our submit button here. This is a shorthand alternative to v-on:click. The Signup component is nearly identical, except it will use the signup method from the auth service to send the user's credentials to a different endpoint. Implementing the Secret Quote Component When a user successfully authenticates, they will be able to access the secret-quote route from the API. The SecretQuote component will look similar to the Home component, but we'll attach the user's JWT as an Authorization header when requests are sent. <!-- src/components/SecretQuote.vue --> <template> <div class="col-sm-6 col-sm-offset-3"> <h1>Get a Secret Chuck Norris Quote!</h1> <button class="btn btn-warning" v-on:click="getQuote()">Get a Quote</button> <div class="quote-area" v-if="quote"> <h2><blockquote>{{ quote }}</blockquote></h2> </div> </div> </template> <script> import auth from '../auth' export default { data() { return { quote: '' } }, methods: { getQuote() { this.$http .get('http://localhost:3001/api/protected/random-quote', (data) => { this.quote = data; }, { // Attach the JWT header headers: auth.getAuthHeader() }) .error((err) => console.log(err)) } }, route: { // Check the users auth status before // allowing navigation to the route canActivate() { return auth.user.authenticated } } } </script> The header is attached by providing an options object as the third argument to the HTTP request. To get the JWT header, we call the getAuthHeader method from the auth service. Since we don't want users to access this route if they are not authenticated, we can tap into vue-router's transition pipeline. Specifically, we use the canActivate hook and consult the auth service to check if the user is authenticated. If so, the route can be navigated to. Final Touches We're nearly done, but there are a couple of improvements we can make before we finish out. It would be good to conditionally show and hide menu items based on the user's auth status. To do that, we'll use v-if. <!-- src/components/App.vue --> <template> <nav class="navbar navbar-default"> <div class="container"> <ul class="nav navbar-nav"> <li><a v-link="'home'">Home</a></li> <li><a v-link="'login'" v-if="!user.authenticated">Login</a></li> <li><a v-link="'signup'" v-if="!user.authenticated">Sign Up</a></li> <li><a v-link="'secretquote'" v-if="user.authenticated">Secret Quote</a></li> <li><a v-link="'login'" v-if="user.authenticated" @click="logout()">Logout</a></li> </ul> </div> </nav> <div class="container"> <router-view></router-view> </div> </template> <script> import auth from '../auth' export default { data() { return { user: auth.user } }, methods: { logout() { auth.logout() } } } </script> The auth service sets the user's authentication status when the login or logout methods are used, but if the page is refreshed or the app closed and reopened, that status will be lost. To get around that, let's call checkLogin when the app is first loaded. // src/index.js ... import auth from './auth' // Check the users auth status when the app starts auth.checkAuth() ... Setting Global Headers When we make a request to the protected secret-quote route, we pass an options object that has the Authorization header and user's JWT access_tokenon it. If, instead, we wanted to globally set the Authorization header and not worry about setting it on each HTTP request, we could set up a global header. // src/index.js ... // Optional Vue.http.headers.common['Authorization'] = auth.getAuthHeader(); ... Aside: Using Auth0 With Your Vue.js App uth0 issues JSON Web Tokens on every login for your users. This means that you can have a solid identity infrastructure, including single sign-on, user management, support for social identity providers (Facebook, Github, Twitter, etc.), enterprise identity providers (Active Directory, LDAP, SAML, etc.) and your own database of users with just a few lines of code. We can easily set up authentication in our Vue.js apps by using the Lock Widget. Step 1: Include Auth0's Lock Widget <!-- index.html --> ... <!-- Auth0 Lock script --> <script src="//cdn.auth0.com/js/lock-7.11.1.min.js"></script> ... Step 2: Instantiate Lock in index.js // src/index.js ... // Instantiate a Lock export var lock = new Auth0Lock(YOUR_CLIENT_ID, YOUR_CLIENT_DOMAIN) ... Step 3: Call the Lock Widget from a Vue.js Component <!-- src/components/Login.vue --> <template> <div class="col-sm-4 col-sm-offset-4"> <h2>Log In</h2> <p>Log In with Auth0's Lock Widget.</p> <button class="btn btn-primary" @click="login()">Log In</button> </div> </template> <script> // Import the Lock instance import {lock} from '../index' export default { methods: { login() { // Show the Lock Widget and save the user's JWT on a successful login lock.show((err, profile, id_token) => { localStorage.setItem('profile', JSON.stringify(profile)) localStorage.setItem('id_token', id_token) }) }, logout() { // Remove the profile and token from localStorage localStorage.removeItem('profile') localStorage.removeItem('id_token') } } } </script> Important API Security Note: If you want to use Auth0 authentication to authorize API requests, note that you'll need to use a different flow depending on your use case. Auth0 idToken should only be used on the client-side. Access tokens should be used to authorize APIs. You can read more about making API calls with Auth0 here. Wrapping Up We have many great choices for SPA frameworks these days, and this can easily cause analysis paralysis. Further, it can be fatiguing to keep up with the pace of new framework development and to learn their ins and outs. I find Vue.js to be a breath of fresh air in this regard. The library and ecosystem are feature-rich, but they get out of your way as you develop your apps. I've found that the learning curve with Vue.js isn't as steep as it can be with other frameworks, and from my experience, it seems to always just work. As we saw in this tutorial, we can easily add authentication to our Vue.js apps. Also, Vue's HTTP library, vue-resource, makes it trivial to send requests with an Authorization header. I hope you'll consider Vue.js for your next project--it really is great to work with! Source: https://auth0.com/blog/build-an-app-with-vuejs/.

Salutare, Dupa cum spune si titlul caut 4 programatori capabili si muncitori. Pozitiile necesare sunt 2 de front-end si 2 de back-end. Jobul permite munca in regim remote programul fiind de 8 ore pe zi. Probabil este de la sine inteles ca nu vreau sa ne pierdem timpul unii cu altii si ca ceea ce incercam sa facem se numeste business. Primeaza in fata oricarui lucru onestitatea, determinarea,integritatea si mai ales seriozitatea. Cele 8 ore de munca trebuiesc cumva alese in cursul zilei in asa fel incat un minim de 3-4 ore sa te poti intersecta cu ceilalti membrii ai echipei. Daca consideri ca vei putea fi disponibil/a pe perioada veri pentru o perioada de minim 3 luni poti aplica linistit/a. Salariul este in functie de cunostintele tale si disponibilitatea ta asa ca nu iti fie frica sa ceri cat consideri ca meriti. Oferta ta poate fi de genul ron/ora ori ron/luna. Cateva lucruri care te-ar putea ajuta: - referinte de la fosti clienti/angajatori. - cateva exemple recente de munca care ai facut-o. - contributia ta in diferite proiecte. Va stau la dispozitie pentru orice informatie sau pentru a aplica: radustefan820@gmail.com Aceasta propunere nu vine din partea unei firme ce crede ca un web developer, programator trebuie sa se ocupe de 3 posturi intr-o firma. Va multumesc frumos pentru interesul acordat si ca ati pierdut cateva minute sa cititi post-ul meu. O zi cat mai buna, Radu

FITA is a most preferred Hadoop Course in Chennai.Hadoop Training in Chennai from Big Data Training.IN is a leading Global Talent Development Corporation, building skilled manpower pool for global industry requirements. BigData Training.in has today grown to be amongst world’s leading talent development companies offering learning solutions to Individuals, Institutions & Corporate Clients.

ScanBox is a framework in the form of a JavaScript file. The function of ScanBox is to collect information about the visitor’s system without infecting the system. And this information includes things like the last page the user was on before visiting the compromised website, the OS of the system and the language settings of the system, the screen width and height, the web browsers used by the victim, the geographical location, security softwares used and programs like Java, Acrobat Reader, MS Office and Adobe Flash versions used. ScanBox also can log the keystrokes the victim is typing inside the website under the control of the attacker, which could include the passwords and other sensitive information of the users. And all this information is then sent to a remote C&C server controlled by the attackers. ScanBox’s goal is to collect information that will later be misused to compromise specific targets. The ScanBox framework has been deployed on several websites belonging to disparate companies and organizations in different countries. Attackers were able to compromise the website and include code that loaded a malicious JavaScript file from a remote server. ScanBox is particularly dangerous, as it doesn’t require malware to be successfully deployed to disk in order to steal information. Instead the key logging functionality would do the same work by simply requiring the JavaScript code to be executed by the web browser. The framework also facilitates surveillance, enabling attackers to exploit vulnerabilities in visitors’ systems by pushing & executing malware. ScanBox is designed to be a modular and reusable JavaScript based exploit kit. It allows a lesser number of sophisticated attackers to first compromise a website using basic attacks such as SQL injection or WordPress bugs and set up a waterhole attack to infect hundreds to thousands of victims who visit that website. Some of the recent attacks which used ScanBox are the following: Table 1: List Of Attacks Month Identified Country Sector/Type Scan Box domain August 2014 JP Industrial sector js.webmailgoogle.com September 2014 CN Uyghur code.googlecaches.com October 2014 US Think tank news.foundationssl.com October 2014 KR Hospitality qoog1e.com By analyzing the script used in these attacks, it has been found that the base codes are pretty much the same and they differ in implementation. This shows that different attackers are using ScanBox as a tool for their attack. The framework was altered according to the victims’ browsers and other factors in every case. Researchers say that the changes may be the result of the upgrades in the framework. The common codebase in all the attacks leads to a conclusion that all the attackers share some resources in using this framework. Working Step 1: The basic step of the ScanBox framework is to configure the C&C server. This server helps to collect and store the information obtained from the compromised website. Figure 1: ScanBox framework for collecting data Step 2: The collected information is first encrypted before sending it to the C&C server to ensure security. Figure 2: Function for data encryption Step 3: After completion of the encryption process the following request is passed: Figure 3: Request produced after encryption Step 4: The encrypted data finally reaches the C&C server and is decrypted to obtain the original data. These pieces of information are the key for starting the attack. Figure 4: Decrypted data Figure 5: Working of ScanBox framework Plugins Several plugins are loaded accordingly in between to extract the required information. These are selectively added to avoid any kind of suspicious alerts when the page loads. The following are some plugins used during the process: Pluginid 1: List the software installed in the system and also to check if the system is running any different versions of EMET (Enhanced Mitigation Experience Toolkit). Figure 6: Pluginid 1 code Pluginid 2: Determines Adobe Flash versions Pluginid 5: Determines Microsoft Office versions Pluginid 6: Enumerates Adobe Reader versions Pluginid 8: Lists Java versions Pluginid 21: Plants a keylogger inside the compromised website. It records all the keystrokes the person is typing in the website. The logs may include account password and other details. The recorded logs are sent to the corresponding command and control center. This information is later used to launch an attack against the particular user. The keylogger feature of ScanBox helps the attacker to collect the data without loading a malware from the disc. Therefore any malware removal tool won’t be able to find this. Figure 7: Keylogger plugin code The plugins required to load a page on different browsers are different. An attacker should be well aware of the version and type of browser used by the victim. According to the requirement, the plugins are loaded so that the desired result could be obtained. The following is the list of plugins loaded per browser on code.googlecaches.com. Table 2: Plugins loaded per browser on code.googlecaches.com Plugin ID Description Internet Explorer Chrome Firefox Safari 1 Software reconnaissance Y N N N 2 Browser plugin N Y Y Y 3 Flash recon Y Y Y Y 4 SharePoint recon Y N N N 5 Adobe PDF reader recon Y N N N 6 Chrome security plugins recon N N Y N 7 Java recon Y Y Y Y 8 Internal IP recon N Y N N 9 JavaScript keylogger Y Y Y Y It has been found that Google Chrome is less vulnerable to such attacks than others on the list due to their security update between the interval of 15 days, which makes it a bit difficult to carry out the attack. Also the Aviator Web browser set up by WhiteHat Security provides impressive privacy and security settings by default. Watering Hole Attack This is a type of attack is mainly targeted on businesses and organizations. Waterholing attacks drive the ScanBox framework. The attacker keeps an eye on the websites the victim visits frequently and infects the websites with a malware. These type of attacks are hard to detect. Once the targeted victim enters the infected website, the malware finds a way into the victim’s network or system. The dropped malware may be in the form of a Remote Access Trojan (RAT), which allows the attacker to access delicate and personal information. The main goal of the watering hole attack is not to serve maximum malware to the system, but to exploit the websites frequently visited by the targeted victim. Figure 8: Watering hole working A watering hole attack could be carried out with the help of ScanBox framework. In this method the JavaScript does its job and saves the attacker from using a malware. This type of attack using ScanBox has much more efficiency than using a malware and could not be detected by any malware removal tool. You can see the list of watering hole attacks which used ScanBox in Table 1. Precautions Regular Software Updating: Timely upgrade on the software reduces the vulnerability of such attacks. Vulnerability Shielding: It helps to scan suspicious traffic and any deviation from the normal protocols used. Network Traffic Detection: Even though hackers find different ways to access the information, the traffic generated by the final malware in communicating with the C&C server remains consistent. Identifying these paths helps to take control of the effect of such attacks. Threat Intelligence: A subscription of prominent threat intelligence providers will help you to track down all the command and control servers that it connects to. These C&C servers can be fed to proxy or perimeter devices to see any successful communication has been established or not. Least privilege: The concept of least privilege has to be implemented on all users who log on to the machine. Admin privilege has to be limited to certain users only. Next generation firewall: Use of a next generation firewall can detect such type of attacks easier, as they have an inbuilt sandbox. SIEM: By using a SIEM solution, security administrators will be able to monitor all the traffic by capturing the logs. It will give a holistic view of what is happening on your network with a few clicks on a single dashboard. Conclusion By the detailed analysis of ScanBox framework, we can say that it could be very dangerous if the user is not cautious. Thorough monitoring and analysis of computer and network should keep such attacks bolted to an extent. References Cyber security updates: October 2014 ScanBox Framework — Krebs on Security https://www.alienvault.com/open-threat-exchange/blog/ScanBox-a-reconnaissance-framework-used-on-watering-hole-attacks AlienVault discovered Watering Hole attacks using Scanbox for reconnaissanceSecurity Affairs Source

NINJA-PingU Is Not Just a Ping Utility is a free open-source high performance network scanner tool for large scale analyses. It has been designed with performance as its primary goal and developed as a framework to allow easy plugin integration. Download: https://github.com/OWASP/NINJA-PingU

iSpy aims to be your one-stop-shop for reverse engineering and dynamic analysis of iOS applications. Features : – Easy to use Web GUI – Class dumps – Instance tracking – Automatic jailbreak-detection bypasses – Automatic SSL certificate pinning bypasses – Re-implemented objc_msgSend for logging and tracing function calls in realtime – Cycript integration; access Cycript from your browser! – Anti-anti-method swizzling – Automatic detection of vulnerable function calls – Easy to use soft-breakpoints The current release is a developer preview; code is subject to change, and will be unstable. However, we appreciate code contributions, feature requests, and bug reports. We currently do not have binary releases, stay tuned! Injecting iSpy : 1. Once iSpy is installed onto your device open the Settings application and you should see a new entry for iSpy. Enable the iSpy Global On/Off if it is disabled. From this panel you can also enable hooks for SSL Certificate Pinning, change web server settings, and optional features. 2. From here go to Select Target Apps and enable the switch for whichever applications you want to inject iSpy into. 3. Open any of the selected applications and you should see a Showtime overlay message in the upper right as the application loads, this indicates that iSpy was successfully injected into the process. 4. Open your browser and go to http://<iPad IP Address>:31337, note that the default port is 31337 but can be optionally changed in the iOS Settings. If iSpy fails to bind to the desired port it will increment the port number until it successfully finds an unbound port to use; you can see this activity in the Xcode console. We also recommend forwarding your TCP connections over USB using the iPhone Data Protection Suite’s tcprelay.sh script. 5. Have fun! Prerequisites : + Xcode 5+ running on OSX 10.8+ + Any jailbroken iOS device running: 32bit iOS 6, 7, or 8 Other versions may work but have not been tested Theos Setup Follow this guide to setup Theos and Ldid. Clone Repos First do a recursive clone of the public repo: git clone https://github.com/BishopFox/iSpy --recursive Build CocoaHTTPServer Next we need to build the CocoaHTTPServer dependency, this step is optional as a binary is included with the main iSpy repo. cd iSpyServer/CocoaHTTPServer/ ./build.sh This will create a new CocoaHTTPServer.a file in the iSpy/libs directory. Compile iSpy Next build the main repo, cd back to the root of the main iSpy git repo and: make clean make make package This will produce a new .deb If you get the error: /Applications/Xcode.app/Contents/Developer/usr/bin/make package requires dpkg-deb. make: *** [internal-package-check] Error 1 t means you need to install the Debian package manager. I use Brew, so it was just a case of running brew install dpkg to get up and running. Install onto iOS Device iSpy has three binary dependancies on the iOS device: cycript, preferenceloader and applist the easiest way to install these is to ssh into your device and use apt-get: apt-get install cycript applist preferenceloader After that just install the .deb we compiled in the previous step dpkg -i <.deb file> Cycript Integration iSpy injects Cycript into the target app automatically by default. In order for the iSpy UI integration to work, you must first install Cycript onto your device (just use Cydia). Once installed, you can access Cycript from the iSpy UI by simply hitting the hotkey (ctrl-`). You can also connect remotely from a command-line, like so: cycript -r ip_of_your_device:12345 Download Zipball | or clone git here Sources : https://github.com/BishopFox iSpy – A reverse engineering framework for iOS.