ဦးဘုန္း (ဓာတု) မႏၱေလး

We are living in the era of fourth industrial revolution(4IR), where Artificial intelligence has a significant role to play. This 4IR technology embedded within societies and even into the human body. From Computer enthusiasts to common people, everyone should be aware and learn this breakthrough technology.

We think about gigantic Robots from Transformers when we hear about Artificial Intelligence(AI) which is a fiction in the past but a fact today, capable of transforming the whole tech world. The field of AI consists of more than Robots such as personal assistants, self-driving cars, apprenticeship learning, behavior cloning and so on. To learn about this advanced technology, thanks to the online learning resources which offers great content to get started with artificial intelligence.

Here are the 5 free e-learning courses on Artificial Intelligence

1. UC Berkeley CS188 Intro to AI

Get started with UC Berkeley AI course, this course is absolutely for beginners who are unaware of Artificial intelligence. It doesn't need any prior computer knowledge to know about AI. UC Berkeley allows anyone to learn this course for free. This course is systematically presented and consists of the following:

Course Schedule
Complete sets of Lecture Slides and Videos
Interface for Electronic Homework Assignments
Section Handouts
Specs for the Pacman Projects
Source files and PDFs of past Berkeley CS188 exams
Form to apply for edX hosted autograders for homework and projects (and more)
Contact information

Aside from this, you can also browse the following courses as well from UC Berkeley that are part of AI course:

Machine Learning: CS189, Stat154
Intro to Data Science: CS194-16
Probability: EE126, Stat134
Optimization: EE127
Cognitive Modeling: CogSci131
Machine Learning Theory: CS281A, CS281B
Vision: CS280
Robotics: CS287
Natural Language Processing: CS288

2. Artificial Intelligence: Principles and Techniques

This course is offered by Stanford with great content that includes topics, videos, assignments, projects, and exams. The whole course mainly focuses on the complex real-world problems and try to find similarity between web search, speech recognition, face recognition, machine translation, autonomous driving, and automatic scheduling. Here you will learn the foundational principles of AI and implement some the AI systems. The goal of this course is to help you tackle the real-world situations with the help of AI tools. So, it is the best for the beginner to get started with AI.

3. Learn with GOOGLE AI

Who will dislike the course from Google? absolutely no one. This company is one of the early adopters of AI has a lot to offer to learners. Learn with Google AI is an education platform for people at all experience levels, it is free to access and browse content. The education resources provided by Google is from the machine learning experts of the company. These resources are the collections of lessons, tutorials, and Hands-on exercises that help you start learning, building, and problem-solving.

4. MIT 6.S094: Deep Learning for Self-Driving Cars

This course gives the practical overview of Deep Learning and AI. It is the course for beginners, also for the people who are getting started with Machine Learning. The course also offers a lot of benefits to the experienced and advanced researchers in the field deep learning. This MIT's course takes people into the journey of Deep Learning with the applied theme of building Self-Driving cars. However, the course also offers slides and videos to engage the learners.

5. Fundamentals of Deep Learning for Computer Vision

This course is offered by Nvidia and Nvidia Deep learning Institute. Computer Vision is one of the disciplines of AI that acquire, analyze, process, and understand images. The course is completely free and everyone who is enthusiast about AI can access and learn the course. It is a hands-on course that able to provide basics of deep learning and deployment of neural networks. With this. you will also learn the following:

Identify the ingredients required to start a Deep Learning project.
Train a deep neural network to correctly classify images it has never seen before.
Deploy deep neural networks into applications.
Identify techniques for improving the performance of deep learning applications.
Assess the types of problems that are candidates for deep learning.
Modify neural networks to change their behavior.

Related word

Bypassing Blockchain Authorization via Unsecured Functions

Note: Since the first part of this series I have also uploaded some further videos on remediation of reentrancy and dealing with compiler versions when working with this hacking blockchain series. Head to the console cowboys YouTube account to check those out. Haha as mentioned before I always forget to post blogs when I get excited making videos and just move on to my next project… So make sure to subscribe to the YouTube if you are waiting for any continuation of a video series.. It may show up there way before here.

Note 2: You WILL run into issues when dealing with Ethereum hacking, and you will have to google them as versions and functionality changes often... Be cognizant of versions used hopefully you will not run into to many hard to fix issues.

In the second part of this lab series we are going to take a look at privacy issues on the blockchain which can result in a vulnerably a traditional system may not face. Since typically blockchain projects are open source and also sometimes viewable within blockchain explorers but traditional application business logic is not usually available to us. With traditional applications we might not find these issues due to lack of knowledge of internal functionality or inability to read private values on a remote server side script. After we review some issues we are going to exploit an authorization issues by writing web3.js code to directly bypass vertical authorization restrictions.

Blockchain projects are usually open source projects which allow you to browse their code and see what's going on under the hood. This is fantastic for a lot of reasons but a developer can run into trouble with this if bad business logic decisions are deployed to the immutable blockchain. In the first part of this series I mentioned that all uploaded code on the blockchain is immutable. Meaning that if you find a vulnerability it cannot be patched. So let's think about things that can go wrong..

A few things that can go wrong:

Randomization functions that use values we can predict if we know the algorithm
Hard-coded values such as passwords and private variables you can't change.
Publicly called functions which offer hidden functionality
Race conditions based on how requirements are calculated

Since this will be rather technical, require some setup and a lot of moving parts we will follow this blog via the video series below posting videos for relevant sections with a brief description of each. I posted these a little bit ago but have not gotten a chance to post the blog associated with it. Also note this series is turning into a full lab based blockchain exploitation course so keep a lookout for that.

In this first video you will see how data about your project is readily available on the blockchain in multiple formats for example:

ABI data that allows you to interact with methods.
Actual application code.
Byte code and assembly code.
Contract addresses and other data.

Lab Video Part 1: Blockchain OSINT:

Once you have the data you need to interact with a contract on the blockchain via some OSINT how do you actually interface with it? That's the question we are going to answer in this second video. We will take the ABI contract array and use it to interact with methods on the blockchain via Web3.js and then show how this correlates to its usage in an HTML file

Lab Video Part 2: Connecting to a Smart Contract:

Time to Exploit an Application:

Exploit lab time, I created an vulnerable application you can use to follow along in the next video. Lab files can be downloaded from the same location as the last blog located below. Grab the AuthorizationLab.zip file:

Lab file downloads:

https://github.com/cclabsInc/BlockChainExploitation

Ok so you can see what's running on the blockchain, you can connect to it, now what? Now we need to find a vulnerability and show how to exploit it. Since we are talking about privacy in this blog and using it to bypass issues. Lets take a look at a simple authorization bypass we can exploit by viewing an authorization coding error and taking advantage of it to bypass restrictions set in the Smart Contract. You will also learn how to setup a local blockchain for testing purposes and you can download a hackable application to follow along with the exercises in the video..

Lab Video Part 3: Finding and hacking a Smart Contract Authorization Issue:

Summary:

In this part of the series you learned a lot, you learned how to transfer your OSINT skills to the blockchain. Leverage the information found to connect to that Smart Contract. You also learned how to interact with methods and search for issues that you can exploit. Finally you used your browsers developer console as a means to attack the blockchain application for privilege escalation.

DSploit

After playing with the applications installed on the Pwn Pad, I found that the most important application (at least for me) was missing from the pre-installed apps. Namely, DSploit. Although DSploit has tons of features, I really liked the multiprotocol password sniffing (same as dsniff) and the session hijacking functionality.

The DSploit APK in the Play Store was not working for me, but the latest nightly on http://dsploit.net worked like a charm.

Most features require that you and your target uses the same WiFi network, and that's it. It can be Open, WEP, WPA/WPA2 Personal. On all of these networks, DSploit will sniff the passwords - because of the active attacks. E.g. a lot of email clients still use IMAP with clear text passwords, or some webmails, etc.

First, DSploit lists the AP and the known devices on the network. In this case, I chose one victim client.

In the following submenu, there are tons of options, but the best features are in the MITM section.

Stealthiness warning: in some cases, I received the following popup on the victim Windows:

This is what we have under the MITM submenu:

Password sniffing

For example, let's start with the Password Sniffer. It is the same as EvilAP and DSniff in my previous post. With the same results for the popular Hungarian webmail with the default secure login checkbox turned off. Don't forget, this is not an Open WiFi network, but one with WPA2 protection!

Session hijack

Now let's assume that the victim is very security-aware and he checks the secure login checkbox. Another cause can be that the victim already logged in, long before we started to attack. The session hijacking function is similar to the Firesheep tool, but it works with every website where the session cookies are sent in clear text, and there is no need for any additional support.

In a session hijacking attack (also called "sidejacking"), after the victim browser sends the authentication cookies in clear text, DSploit copies these cookies into its own browser, and opens the website with the same cookies, which results in successful login most of the time. Let's see session hijacking in action!

Here, we can see that the session cookies have been sniffed from the air:

Let's select that session, and be amazed that we logged into the user's webmail session.

Redirect traffic

This feature can be used both for fun or profit. For fun, you can redirect all the victim traffic to http://www.kittenwar.com/. For-profit, you can redirect your victim to phishing pages.

Replace images, videos

I think this is just for fun here. Endless Rick Rolling possibilities.

Script injection

This is mostly for profit. client-side injection, drive-by-exploits, endless possibilities.

Custom filter

If you are familiar with ettercap, this has similar functionalities (but dumber), with string or regex replacements. E.g. you can replace the news, stock prices, which pizza the victim ordered, etc. If you know more fun stuff here, please leave a comment (only HTTP scenario - e.g. attacking Facebook won't work).

Additional fun (not in DSploit) - SSLStrip

From the MITM section of DSploit, I really miss the SSLStrip functionality. Luckily, it is built into the Pwn Pad. With the help of SSLStrip, we can remove the references to HTTPS links in the clear text HTTP traffic, and replace those with HTTP. So even if the user checks the secure login checkbox at freemail.hu, the password will be sent in clear text - thus it can be sniffed with DSniff.

HTML source on the client-side without SSLstrip:

HTML source on the client-side with SSL strip:

With EvilAP, SSLStrip, and DSniff, the password can be stolen. No hacking skillz needed.

Lessons learned here

If you are a website operator where you allow your users to login, always:

Use HTTPS with a trusted certificate, and redirect all unencrypted traffic to HTTPS ASAP
Mark the session cookies with the secure flag
Use HSTS to prevent SSLStrip attacks

If you are a user:

Don't trust sites with your confidential data if the above points are not fixed. Choose a more secure alternative
Use HTTPS everywhere plugin
For improved security, use VPN

Because hacking has never been so easy before.
And last but not least, if you like the DSploit project, don't forget to donate them!

Continue reading

ဦးဘုန္း (ဓာတု) မႏၱေလး

Sunday, January 28, 2024

5 Free Online Courses To Learn Artificial Intelligence

Here are the 5 free e-learning courses on Artificial Intelligence

1. UC Berkeley CS188 Intro to AI

2. Artificial Intelligence: Principles and Techniques

3. Learn with GOOGLE AI

4. MIT 6.S094: Deep Learning for Self-Driving Cars

5. Fundamentals of Deep Learning for Computer Vision

Related word

Blockchain Exploitation Labs - Part 2 Hacking Blockchain Authorization

Bypassing Blockchain Authorization via Unsecured Functions

Lab Video Part 1: Blockchain OSINT:

Lab Video Part 2: Connecting to a Smart Contract:

Time to Exploit an Application:

Lab file downloads:

Lab Video Part 3: Finding and hacking a Smart Contract Authorization Issue:

Summary:

More articles

Saturday, January 27, 2024

DSploit

DSploit

Password sniffing

Session hijack

Redirect traffic

Replace images, videos

Script injection

Custom filter

Additional fun (not in DSploit) - SSLStrip

Lessons learned here

DAY:DATE:TIME

Labels

Blog Archive

ဘာသာေရးဆုိင္ရာဆုိဒ္မ်ား

ဘေလာ့မိတ္ေဆြမ်ား

IT ေလ့လာႏိုင္ရန္

ဧည့္သည္ေတာ္ မွတ္တမ္း

Ads 468x60px

Counter

Country