Te-k

{
    "threatLists": [
        {
            "threatType": "MALWARE",
            "platformType": "ANY_PLATFORM",
            "threatEntryType": "URL"
        },
        {
            "threatType": "MALWARE",
            "platformType": "WINDOWS",

Te-k

Threat intelligence platforms

Port Scans

• Shodan : community access + commercial access
• Censys : community + commercial access (access posible for independent researchers)
• ZoomEye : community + commercial access
• Onyphe : community + commercial access
• BinaryEdge : commercial access only

Te-k

List of published Amnesty Reports

• October 2021 : Togo: Hackers-for-hire in West Africa: Activist in Togo attacked with Indian-made spyware
  • Press Release
  • French Press Release
• July 2021 : Pegasus Project
  • Forensic Methodology Report: How to catch NSO Group’s Pegasus
  • Appendix D
• [Appendix E](https://www.amnesty.org/en/latest/research/2021/08/appendix-e-pegasus-forensic-traces-per-target-identified-in-the-aftermath-of-the-rev

Te-k

Ocean Lotus

aka Cobalt Kitty, APT-C-00, SeaLotus, Sea Lotus, APT-32, APT 32, Ocean Buffalo, POND LOACH, TIN WOODLAWN, BISMUTH

• MITRE
• Malpedia
• ThaiCERT Card

Reports

Te-k

Many tools do not fully remove metadata, but just remove the link with in the metadata table. The data are thus still available in the PDF file itself.

While a lot of people rely on Exiftool to remove metadata, it actually does the same in PDFs. If you remove metadata with exiftool -all= some.pdf, you can always restore the data with exiftool -pdf-update:all= some.pdf.

There are several options to remove PDF metadata safely:

Option 1 : Exiftool with qpdf

• Remove metadata with exiftool : exiftool -all= some.pdf
• Then remove ununsed objects with qpdf : qpdf --linearize some.pdf - > some.cleaned.pdf

Te-k

                _   _            _      ____             _    _ 
               | | | | __ _  ___| | __ | __ )  __ _  ___| | _| |
               | |_| |/ _` |/ __| |/ / |  _ \ / _` |/ __| |/ / |
               |  _  | (_| | (__|   <  | |_) | (_| | (__|   <|_|
               |_| |_|\__,_|\___|_|\_\ |____/ \__,_|\___|_|\_(_)
                                                 
                                  A DIY Guide

Te-k

#
# Updated Maltego Python library
# 2013/03/30
# See TRX documentation
#
# RT

import sys
from xml.dom import minidom

Te-k

Originally posted at: http://pastebin.com/MP8zpQ26

HACKING TEAM CLIENT RENEWAL DATES
From: Client List_Renewal date.xlsx
 
Name    Country Name    Maintenance     Status
AFP     Australia       Australian Federal Police       -       Expired
AZNS    Azerbaijan      Ministry of National Defence    6/30/2015       Active
BHR     Bahrain Bahrain         5/5/2015        Not Active
PHANTOM Chile   Policia de Investigation        12/10/2018      Delivery scheduled (end of november)

Te-k

import re
from urllib.parse import parse_qs

regex = re.compile('^(?P<ip>\S+)\s+-\s*(?P<userid>\S+)\s+\[(?P<datetime>[^\]]+)\]\s+"(?P<method>[A-Z]+)\s*(?P<request>[^ "]+)?\s*(HTTP/(?P<http_version>[0-9.]+))?"\s+(?P<status>[0-9]{3})\s+(?P<size>[0-9]+|-)\s+"(?P<referer>[^"]*)"\s+"(?P<user_agent>[^"]*)"')

def parse_log(log):
    res = regex.match(line)
    if not res:
        raise(ValueError('Invalid log format'))
    res = res.groupdict()

Te-k

import requests
from bs4 import BeautifulSoup

def get_info(key):
    # Returns the date and raw data
    if key.startswith('http'):
        r = requests.get(key)
    else:
        r = requests.get('https://pastebin.com/' + key)
    soup = BeautifulSoup(r.text, 'html.parser')