🥷 Top sites for passive reconnaissance

NCC group started an initiative called DASP for Decentralized Application Security Project in 2018. It covers the top 10 vulnerabilities found in smart contracts running on the Ethereum blockchain. This is a quick summary of the top 10: Reentrancy: Occurs when external contract calls are allowed to make new calls…

If you wanna dig deeper at the Ethereum Virtual Machine level, those are some resources to start: EthTx Transaction Decoder https://ethtx.info/ Ethereum Signature Database https://www.4byte.directory/ Ethereum JSON-RPC API https://ethereum.org/es/developers/docs/apis/json-rpc/#eth_call Ethereum Virtual Machine Opcodes https://ethervm.io/ Solidity compiler EVM and OPCodes Let’s try with the following vulnerable (do not use!) smart contract:

When performing a penetration test, one of the most crucial parts is scanning and enumeration. Because if you lose any important port at this stage, you are letting go a juicy part of the attack vector to compromise the machine. Nmap is the standard-de-facto for port scanning, however it’s great…

Radamsa is a test case generator, it receives some input data and then it scrambles it to return some random data. Random is truly random, that means that you can even receive the same string :)

In a penetration testing engagement, scanning is a very important phase in which we get to know better the potential vulnerabilities of the machines inside the scope. If you miss some UDP or TCP port with vulnerabilities to exploit, your probability to success will be much lower, so pay a…

Tool -> hydra Attack FTP: hydra -l $USERNAME -P /usr/share/wordlistsnmap.lst -f $IP ftp -V Attack POP3: hydra -l $USERNAME -P /usr/share/wordlistsnmap.lst -f $IP pop3 -V Attack SMTP: hydra -P /usr/share/wordlistsnmap.lst $IP smtp -V Attack SNMP: hydra -P /usr/share/wordlists/snmp.txt -v $IP snmp Attack HTTP form: hydra -l root@localhost -I -P cewl.txt $IP http-post-form "/$SCRIPT_PATH:Action=Login&User=^USER^&Password=^PASS^:Login…

Myth is a tool developed by Consensys that does dynamic analysis of a Solidity smart contract. It has a paid version called MythX and and free version called Mythril. We will check out how to use the latter in this post. A prerequisite is that you have already installed…

Ethlint (formerly solium) is a tool that analyze your smart contract for style and security issues. It can be installed easily with npm: # npm install -g ethlint Once installed, we can initialize a project in the current directory like this: $ solium -i This will create .soliumrc.json and .soliumignore…

Slither is a Solidity static analysis framework written in Python 3. It runs a suite of vulnerability detectors, prints visual information about contract details, and provides an API to easily write custom analyses. Slither enables developers to find vulnerabilities, enhance their code comprehension, and quickly prototype custom analyses. Prerequisites: You…