n0ncetonic

#!/bin/bash
# Command Injection via Homebrew $PATH trickery
# n0ncetonic
# Blacksun Research Labs 2019
# https://github.com/n0ncetonic
# https://github.com/BlacksunLabs

banner=$(/bin/cat <<EOF

n0ncetonic

// ninjaVanish hides from webdriver/headless browser detection
//
// Focused specifically on HeadlessChrome / Puppeteer.
// When using Puppeteer this should be instrumented with the
// `Page.evaluateOnNewDocument()` method which injects our code
// after the document loads but before any scripts run
//
// Techniques leveraged are:
// - Removes "Headless" from User-Agent
// - Deletes `navigator.webdriver` to mimick standard navigator object properties

n0ncetonic

vim -c 'execute "silent !echo " . &fileencoding | q' {filename} # Extremely good file encoding detection

n0ncetonic

Strings dump of TCC.framework as a starting point

$ strings /System/Library/PrivateFrameworks/TCC.framework/TCC | grep kTCCService

kTCCServiceAll
kTCCServiceAddressBook
kTCCServiceCalendar
kTCCServiceReminders
kTCCServiceTwitter
kTCCServiceFacebook

n0ncetonic

var detectExt = {
    is_install: "",
    /**
     * поиск расширения в chrome
     * @param onload
     * @param onerror
     */
    detect_ext_chrome: function (onload, onerror) {
        var detect = function (base, if_installed, if_not_installed) {
            var s = document.createElement('script');

n0ncetonic

#!/bin/bash
#filename      :gimmeAuthToken 
#description   :macOS < 10.13 Keychain-less Passwordless iCloud authentication token dumper 
#author        :noncetonic
#date          :20180614
#version       :0.1
#usage         :./gimmeAuthToken
#notes         :Leverages the Accounts(3|4).sqlite file to dump cached plaintext iCloud tokens
#copyright     :© 2018 Blacksun Labs
#===============================================================================

n0ncetonic

Intercepts HTTPs Traffic with Python & mitmproxy

Introduction

Modern applications usually make use of back-end API servers to provide their services. With a non-transparent HTTPs proxy, which intercepts the communication between clients and servers (aka the man-in-the-middle scheme), you can easily manipulate both API requests and responses.

This manual helps you create your own proxy with Python and mitmproxy/libmproxy. Mitmproxy ships with both a standalone command-line tool (mitmproxy) and a Python library (libmproxy).

n0ncetonic

# hax hax hax hax hax

import ctypes, os, sys
newstderr = os.dup(2)                          # This is to mute dyld LC_RPATH warnings
os.dup2(os.open('/dev/null', os.O_WRONLY), 2)  # because we're loading Xcode frameworks from python
CM = ctypes.CDLL('/Applications/Xcode.app/Contents/SharedFrameworks/DVTMarkup.framework/Versions/A/Frameworks/CommonMark.framework/CommonMark')
sys.stderr = os.fdopen(newstderr, 'w')         # This restores stderr

cmark_markdown_to_html = CM.cmark_markdown_to_html
cmark_markdown_to_html.restype = ctypes.c_char_p

n0ncetonic

Simple Security Guidelines

Using an iDevice? (Best option)

• Use an iPod or an iPad without a SIM card
• Use an iPhone
• Do not jailbreak
• Always upgrade to new iOS versions
• Use Brave browser

Need Secure chat?

n0ncetonic

Operational PGP

This is a guide on how to email securely.

There are many guides on how to install and use PGP to encrypt email. This is not one of them. This is a guide on secure communication using email with PGP encryption. If you are not familiar with PGP, please read another guide first. If you are comfortable using PGP to encrypt and decrypt emails, this guide will raise your security to the next level.