The Experts below are selected from a list of 12 Experts worldwide ranked by ideXlab platform
Jason Andress - One of the best experts on this subject based on the ideXlab platform.
-
Introduction to command Shell scripting
Coding for Penetration Testers, 2017Co-Authors: Jason Andress, Ryan LinnAbstract:In this chapter, we talk about Shells, in the sense of the text-based interfaces we use to communicate with operating systems. UNIX, Linux, and OS X, as well as most UNIX-like operating systems, tend to work on the same general principles for purposes of Shell scripting, and make use of many common programming concepts such as data structures, variables, control statements, if-then clauses, and while loops. In Microsoft operating systems, we can find many similar Shell scripting tools as well. In Windows, we can carry out commands and write scripts using the generic Shells command.com and CMD.exe, the PowerShell Shell, and add-on tools such as Cygwin to give us access to bash on Windows, just to name a few.
-
Chapter 6 – Manipulating Windows with PowerShell
Coding for Penetration Testers, 2012Co-Authors: Jason AndressAbstract:Publisher Summary PowerShell can be put to a number of penetration testing uses. Since PowerShell has access to Microsoft's .NET set of tools, and many of the existing functionality that ships with it is intended for system administration, this provides a great deal of utility to the penetration tester as well. One can simply issue the commands directly at the prompt in the PowerShell Shell and have the data returned to the console such as, if one wants to get a list of all the running processes on a system then Get-Process can be executed. In PowerShell, one can kill a process using the Stop-Process cmdlet. Stop-Process can be run using either the process ID or the process name as an argument. If one uses the process ID, the Stop-Process 13768 run. One can use PowerShell to perform several types of network activity with relative ease. On a Linux system, one of the most useful tools that one has to pull data down from a Web server is wget. Metasploit can be used to interface with PowerShell. There are several great modules such as PowerDump that allow spawning Shells, and make use of some of the code through Metasploit.
Ryan Linn - One of the best experts on this subject based on the ideXlab platform.
-
Introduction to command Shell scripting
Coding for Penetration Testers, 2017Co-Authors: Jason Andress, Ryan LinnAbstract:In this chapter, we talk about Shells, in the sense of the text-based interfaces we use to communicate with operating systems. UNIX, Linux, and OS X, as well as most UNIX-like operating systems, tend to work on the same general principles for purposes of Shell scripting, and make use of many common programming concepts such as data structures, variables, control statements, if-then clauses, and while loops. In Microsoft operating systems, we can find many similar Shell scripting tools as well. In Windows, we can carry out commands and write scripts using the generic Shells command.com and CMD.exe, the PowerShell Shell, and add-on tools such as Cygwin to give us access to bash on Windows, just to name a few.
Yunbo Wang - One of the best experts on this subject based on the ideXlab platform.
-
SEC - IMShell-Dec: Pay More Attention to External Links in PowerShell
ICT Systems Security and Privacy Protection, 2020Co-Authors: Ruidong Han, Chao Yang, Yunbo WangAbstract:Windows proposes the PowerShell Shell command line to substitute the traditional CMD. However, it is often utilized by the attacker to invade the victim because of its versatile functionality. In this paper, we investigate an attack combined PowerShell and image steganography. Compared with the traditional method, this attack can deceive the defender by hiding its malicious contents in benign images. To effectively detect this attack, we propose a framework IMShell-Dec, whose main target is to check external links before the execution of PowerShell script. IMShell-Dec trains a machine learning classifier with image examples, where the features are generated by merging histograms of three image color channels. Then IMShell-Dec examines the script through tracking and classifying the related images. The detector achieves more than 95% precision in 9,589 high-definition images.
Ruidong Han - One of the best experts on this subject based on the ideXlab platform.
-
SEC - IMShell-Dec: Pay More Attention to External Links in PowerShell
ICT Systems Security and Privacy Protection, 2020Co-Authors: Ruidong Han, Chao Yang, Yunbo WangAbstract:Windows proposes the PowerShell Shell command line to substitute the traditional CMD. However, it is often utilized by the attacker to invade the victim because of its versatile functionality. In this paper, we investigate an attack combined PowerShell and image steganography. Compared with the traditional method, this attack can deceive the defender by hiding its malicious contents in benign images. To effectively detect this attack, we propose a framework IMShell-Dec, whose main target is to check external links before the execution of PowerShell script. IMShell-Dec trains a machine learning classifier with image examples, where the features are generated by merging histograms of three image color channels. Then IMShell-Dec examines the script through tracking and classifying the related images. The detector achieves more than 95% precision in 9,589 high-definition images.
Chao Yang - One of the best experts on this subject based on the ideXlab platform.
-
SEC - IMShell-Dec: Pay More Attention to External Links in PowerShell
ICT Systems Security and Privacy Protection, 2020Co-Authors: Ruidong Han, Chao Yang, Yunbo WangAbstract:Windows proposes the PowerShell Shell command line to substitute the traditional CMD. However, it is often utilized by the attacker to invade the victim because of its versatile functionality. In this paper, we investigate an attack combined PowerShell and image steganography. Compared with the traditional method, this attack can deceive the defender by hiding its malicious contents in benign images. To effectively detect this attack, we propose a framework IMShell-Dec, whose main target is to check external links before the execution of PowerShell script. IMShell-Dec trains a machine learning classifier with image examples, where the features are generated by merging histograms of three image color channels. Then IMShell-Dec examines the script through tracking and classifying the related images. The detector achieves more than 95% precision in 9,589 high-definition images.