www
ftp
backoffice

www.dumain.com
ftp.dumain.com
backoffice.dumain.com

com
net
org

dumain.com
dumain.net
dumain.org

wordlist1   wordlist2   wordlist3
www         foo         com
ftp         bar         net

www.foo.com
ftp.foo.com
www.bar.com
ftp.bar.com
www.foo.net
ftp.foo.net
www.bar.net
ftp.bar.net

• One mask:
  

  $ dumb "DUMB.dumain.com" wordlists/foo.txt

• Two masks:
  

  $ dumb "DUMB.dumain.DUMB" wordlists/foo.txt wordlists/bar.txt

• Several masks:
  

  $ dumb "DUMB-DUMB-DUMB_DUMB.DUMB.DUMB" wordlists/foo_1.txt ... wordlists/foo_6.txt

• docker run -it giovanifss/dumb "DUMB.dumain.com" subdomains.txt

• docker run -it giovanifss/dumb "DUMB.dumain.com" (subdomains.txt|subdominios.txt|domain-endings.txt)

docker run -v local/wordlist.txt:/opt/wordlist.txt -it giovanifss/dumb "DUMB.dumain.com" /opt/wordlist.txt

• Enter in the project directory and run $ stack build.
• To execute:

  $ stack exec dumb "DUMB.dumain.com" wordlists/subdomains.txt

• Argument parser support, for better configuration of the tool execution;
• Post analysis of found dumains, generating statistics and metrics;

git clone https://github.com/rezasp/joomscan.git
cd joomscan
perl joomscan.pl

Usage: joomscan.pl [options]

--url | -u <URL>                         |   The Joomla URL/domain to scan.
--enumerate-components          | -ec    |   Try to enumerate components.

--cookie <String>                       |   Set cookie.
--user-agent | -a <user-agent>   |   Use the specified User-Agent.
--random-agent | -r                   |   Use a random User-Agent.
--timeout <time-out>                  |   set timeout.
--about                                      |   About Author
--update                                    |   Update to the latest version.
--help | -h                                 |   This help screen.
--version                                   |   Output the current version and exit.

perl joomscan.pl --url www.example.com

perl joomscan.pl -u www.example.com

perl joomscan.pl --url www.example.com --enumerate-components

perl joomscan.pl -u www.example.com --ec

perl joomscan.pl --url www.example.com --cookie "test=demo;"

perl joomscan.pl --url www.example.com --user-agent "Googlebot/2.1 (+http://www.googlebot.com/bot.html)"

perl joomscan.pl -u www.example.com -a "Googlebot/2.1 (+http://www.googlebot.com/bot.html)"

perl joomscan.pl -u www.example.com --random-agent

perl joomscan.pl --url www.example.com -r

perl joomscan.pl --update

• Mohammad Reza Espargham [ reza[dot]espargham[at]owasp[dot]org ]
• Ali Razmjoo [ ali[dot]razmjoo[at]owasp[dot]org ]

• DVWA (low/medium/high)
• bWAPP (low/medium/high)

git clone https://github.com/jcesarstef/dotdotslash/

python3 dotdotslash.py --help

usage: dotdotslash.py [-h] --url URL --string STRING [--cookie COOKIE]

optional arguments:
  -h, --help       show this help message and exit
  --url URL        Url to attack.
  --string STRING  String in --url to attack. Ex: document.pdf
  --cookie COOKIE  Document cookie.

python3 dotdotslash.py \
--url "http://192.168.58.101/bWAPP/directory_traversal_1.php?page=a.txt" \
--string "a.txt" \
--cookie "PHPSESSID=089b49151627773d699c277c769d67cb; security_level=3"

go get -u github.com/zricethezav/gitleaks

./gitleaks [options] <url/path>

usage: gitleaks [options] <URL>/<path_to_repo>

Options:
 -u --user              Git user mode
 -r --repo              Git repo mode
 -o --org               Git organization mode
 -l --local             Local mode, gitleaks will look for local repo in <path>
 -t --temp              Clone to temporary directory
 -v --verbose           Verbose mode, will output leaks as gitleaks finds them
 --report-path=<STR>    Save report to path, gitleaks default behavior is to save report to pwd
 --clone-path=<STR>     Gitleaks will clone repos here, default pwd
 --concurrency=<INT>    Upper bound on concurrent diffs
 --since=<STR>          Commit to stop at
 --b64Entropy=<INT>     Base64 entropy cutoff (default is 70)
 --hexEntropy=<INT>     Hex entropy cutoff (default is 40)
 -e --entropy           Enable entropy
 -h --help              Display this message
 --token=<STR>          Github API token
 --stopwords            Enables stopwords

gitleaks

gitleaks --local $HOME/audits/some/repo

gitleaks https://github.com/some/repo

gitleaks --clone-path=$HOME/Desktop/audits https://github.com/some/repo

gitleaks --temp https://github.com/some/repo

gitleaks --temp -u https://github.com/some-user

docker run --rm --name=gitleaks zricethezav/gitleaks https://github.com/zricethezav/gitleaks

docker build -t gitleaks .
docker run --rm --name=gitleaks gitleaks https://github.com/zricethezav/gitleaks

pip3 install git+http://git@github.com/Te-k/harpoon  --process-dependency-links

npm install -g phantomjs

help                Give help on an Harpoon command
safebrowsing        Check if the given domain is in Google safe Browsing list
hibp                Request Have I Been Pwned API (https://haveibeenpwned.com/)
cache               Requests webpage cache from different sources
misp                Get information from a MISP server through the API
spyonweb            Search in SpyOnWeb through the API
censys              Request information from Censys database (https://censys.io/)
shodan              Requests Shodan API
vt                  Request Virus Total API
config              Configure Harpoon
fullcontact         Requests Full Contact API (https://www.fullcontact.com/)
googl               Requests Google url shortener API
ip                  Gather information on an IP address
twitter             Requests Twitter API
asn                 Gather information on an ASN
robtex              Search in Robtex API (https://www.robtex.com/api/)
hunter              Request hunter.io information through the API
otx                 Requests information from AlienVault OTX
crtsh               Search in https://crt.sh/ (Certificate Transparency database)
github              Request Github information through the API
bitly               Request bit.ly information through the API
screenshot          Takes a screenshot of a webpage
greynoise           Request Grey Noise API
telegram            Request information from Telegram through the API
threatgrid          Request Threat Grid API
pgp                 Search for information in PGP key servers
totalhash           Request Total Hash API
dns                 Map DNS information for a domain or an IP
hybrid              Requests Hybrid Analysis platform
malshare            Requests MalShare database

• Telegram : Create an application
• Virus Total : for public, create an account and get the API key in the Settings page
• Total Hash
• Hybrid Analysis
• MalShare

Python 3.0 or later.
pip3 (sudo apt-get install python3-pip).

git clone https://github.com/UnaPibaGeek/ctfr.git
cd ctfr
pip3 install -r requirements.txt

python3 ctfr.py --help

-d --domain [target_domain] (required)
-o --output [output_file] (optional)

python3 ctfr.py -d starbucks.com

python3 ctfr.py -d facebook.com -o /home/shei/subdomains_fb.txt

• Sheila A. Berta - (@UnaPibaGeek).

• Bypass all anti-virus.
• Inject a malicious powershell script into memory.
• Establish a reverse https connection to attacker machine.
• Check every 10 seconds and make sure that the connection still exists, If not it will re-establish a new connection.
• Add a startup register key to re-connect to the attacker after reboot.

• Update viRu5/source.py parameters with your lhost and lport
• Change source.py name to GoogleChromeAutoLaunch.py
• Add GoogleChromeAutoLaunch.py, setup.py and your icon as icon.ico to c:\python27 dir
• From cmd do

  
  cd c:\python27
  
  
  python setup.py py2exe
  
  

• Find the RAT exe file in Dist dir.
• Blind it with any photo, pdf, word or any kind of files
• Send it to the victim
• Use your social engineer skills to make him open the file
• You will receive a reverse https metasoplit connection :)

• Windows 7 32bit
• Windows 7 64bit
• Windows 8 32bit
• Windows 8 64bit
• Windows 8.1 32bit
• Windows 8.1 64 bit
• Windows 10 32bit
• Windows 10 64bit

• Sigma rule specification in the Wiki
• Open repository for sigma signatures in the ./rulessubfolder
• A converter that generate searches/queries for different SIEM systems [work in progress]

• Describe your once discovered detection method in Sigma to make it sharable
• Share the signature in the appendix of your analysis along with file hashes and C2 servers
• Share the signature in threat intel communities - e.g. via MISP
• Provide Sigma signatures for malicious behaviour in your own application (Error messages, access violations, manipulations)
• Integrate a new log into your SIEM and check the Sigma repository for available rules
• Write a rule converter for your custom log analysis tool and process new Sigma rules automatically
• Provide a free or commercial feed for Sigma signatures

• Parsing of Sigma rule files
• Conversion of searches into Elasticsearch and Splunk queries

• Conversion of aggregation expressions (after the pipe character)
• Output of Kibana JSON configurations

• Splunk
• ElasticSearch
• Elastic X-Pack Watcher
• Logpoint

pip3 install sigmatools

• Integration of feedback into the rule specifications
• Integration into Threat Intel Exchanges, e.g. MISP
• Attempts to convince others to use the rule format in their reports, threat feeds, blog posts, threat sharing platforms

• Augmentd
• TA-Sigma-Searches (Splunk App)

rop-tool v2.4.1
Help you to make binary exploits.

Usage: rop-tool <cmd> [OPTIONS]

Commands :
   gadget        Search gadgets
   patch         Patch the binary
   info          Print info about binary
   heap          Display heap structure
   disassemble   Disassemble the binary
   search        Search on binary
   help          Print help
   version       Print version

Try "rop-tool help <cmd>" for more informations about a command.

Usage : rop-tool gadget [OPTIONS] [FILENAME]

OPTIONS:
  --arch, -A               Select an architecture (x86, x86-64, arm, arm64)
  --all, -a                Print all gadgets (even gadgets which are not uniq)
  --depth, -d         [d]  Specify the depth for gadget searching (default is 5)
  --flavor, -f        [f]  Select a flavor (att or intel)
  --no-filter, -F          Do not apply some filters on gadgets
  --help, -h               Print this help message
  --no-color, -N           Do not colorize output

Usage : rop-tool search [OPTIONS] [FILENAME]

OPTIONS:
  --all-string, -a    [n]  Search all printable strings of at least [n] caracteres. (default is 6)
  --byte, -b          [b]  Search the byte [b] in binary
  --dword, -d         [d]  Search the dword [d] in binary
  --help, -h               Print this help message
  --no-color, -N           Don't colorize output
  --qword, -q         [q]  Search the qword [q] in binary
  --raw, -r                Open file in raw mode (don't considere any file format)
  --split-string, -s  [s]  Search a string "splited" in memory (which is not contiguous in memory)
  --string, -S        [s]  Search a string (a byte sequence) in binary
  --word, -w          [w]  Search the word [w] in binary

Usage : rop-tool patch [OPTIONS] [FILENAME]

OPTIONS:
  --address, -a       [a]  Select an address to patch
  --bytes, -b         [b]  A byte sequence (e.g. : "\xaa\xbb\xcc") to write
  --filename, -f      [f]  Specify the filename
  --help, -h               Print this help message
  --offset, -o        [o]  Select an offset to patch (from start of the file)
  --output, -O        [o]  Write to an another filename
  --raw, -r                Open file in raw mode

Usage : rop-tool info [OPTIONS] [FILENAME]

OPTIONS:
  --all, -a                Show all infos
  --segments, -l           Show segments
  --sections, -s           Show sections
  --syms, -S               Show symbols
  --filename, -f      [f]  Specify the filename
  --help, -h               Print this help message
  --no-color, -N           Disable colors

Usage : rop-tool heap [OPTIONS] [COMMAND]

OPTIONS:
  --calloc, -C             Trace calloc calls
  --free, -F               Trace free calls
  --realloc, -R            Trace realloc calls
  --malloc, -M             Trace malloc calls
  --dumpdata, -d           Dump chunk's data
  --output, -O             Output in a file
  --help, -h               Print this help message
  --tmp, -t        <d>     Specify the writable directory, to dump the library (default: /tmp/)
  --no-color, -N           Do not colorize output

• addr: is the real address of the malloc chunk
  
• usr_addr: is the address returned by malloc functions to user
  
• size: is the size of the malloc chunk
  
• flags: P is PREV_INUSE, M is IS_MAPED and A is NON_MAIN_ARENA
  

Usage : rop-tool dis [OPTIONS] [FILENAME]

OPTIONS:
  --help, -h               Print this help message
  --no-color, -N           Do not colorize output
  --address, -a    <a>     Start disassembling at address <a>
  --offset, -o     <o>     Start disassembling at offset <o>
  --sym, -s        <s>     Disassemble symbol
  --len, -l        <l>     Disassemble only <l> bytes
  --arch, -A       <a>     Select architecture (x86, x86-64, arm, arm64)
  --flavor, -f     <f>     Change flavor (intel, att)

• String searching, Gadget searching, patching, info, heap visualization, disassembling
• Colored output
• Intel and AT&T flavor
• Support of ELF, PE and MACH-O binary format
• Support of big and little endian
• Support of x86, x86_64, ARM and ARM64 architecture

• rop-tool gadget ./program

• rop-tool gadget ./program -f att -a

• rop-tool gadget ./program -A x86

• rop-tool search ./program -s "/bin/sh"

• rop-tool search ./program -a

• rop-tool patch ./program -o 0x1000 -b "\xaa\xbb\xcc\xdd" -O patched

• rop-tool heap /bin/ls

• rop-tool dis /bin/ls -l 0x100 -a 0x08048452

rop-tool gadget /bin/ls

rop-tool search /bin/ls -a

rop-tool search /bin/ls -s "/bin/sh\x00"

rop-tool search /bin/ls -w 0x90

rop-tool heap ./a.out

rop-tool dis ./bin  # Many formats

• Programming (see TODO file if you need ideas)
• Report bugs
• Improve documentation
• Submit new ideas
• ...

• capstone

• requests
• threading

python arjun.py -u http://example.com/index.php --get

python arjun.py -u http://example.com/index.php --get --threads 4

• Submit new issue
• pm me in gmail
• do you want ask about all my tools ? you can add me in https://fb.me/moham3driahi

git clone https://github.com/Moham3dRiahi/XBruteForcer.git
cd XBruteForcer
perl XBruteForcer.pl -l list.txt -p passwords.txt 

cpan install LWP::UserAgent
cpan install HTTP::Request
git clone https://github.com/Moham3dRiahi/XBruteForcer.git
cd XBruteForcer
perl XBruteForcer.pl -l list.txt -p passwords.txt 

Download Perl
Download XBruteForcer
Extract XBruteForcer into Desktop
Open CMD and type the following commands:
cd Desktop/XBruteForcer-master/
perl XBruteForcer.pl -l list.txt -p passwords.txt 

 python sub6.py    -i list.txt  -o output.txt       -s phpinfo.php -x 4
<optional>           <optional>   <optional>
[+]Options
 -i      input  files                  twitterdomains.txt    #if many separate by comma
 -o      output file                   twitterResult.txt
 -p      protocol                      http or https
 -s      suffix                        phpinfo.php           #used to look for ceratin files (CTF mode)
 -t      Set time out for requests     5                     #in seconds
 -x      starting index                1:                    #if script stopped , you can resume it with this.
 -X      To use proxy                  #prompt
 -R      Follow redirects
 -H      For Host injection Testing
 -O      For open redirect  Testing

• x86_64
• x86
• arm

$ make
cc -Wall -Wextra -O2 -c -o bin/sh_remotedata.o src/sh_remotedata.c
cc -Wall -Wextra -O2 -c -o bin/sh_string.o src/sh_string.c
cc -Wall -Wextra -O2 -c -o bin/sudohulk.o src/sudohulk.c
cc -Wall -Wextra -O2 -o sudohulk bin/sh_remotedata.o bin/sh_string.o bin/sudohulk.o
$ ./sudohulk 
sudohulk [-qdk] PID COMMAND [ARGS]

Options:
   -q quit when change a command
   -d run in background
   -k keep original command line (appending to new)

$ ./sudohulk -qd $$ id
running in background, pid:20899
$ sudo ls -lah
[sudo] senha para mmxm: 
uid=0(root) gid=0(root) grupos=0(root)

1. Start a web server.
2. Type your server IP and port in the ps1 script.
3. Execute the batch file.

• Box title should be changed.
• Different windows versions has different credential boxes. Needs to be pulled from WINAPI.

• Gets Twitter Usernames based on a latitude and longitude
• Profiles URLs
• Tweet Latitude and Longitude
• Google Maps link to Latitude and Longitude

git clone https://github.com/UltimateHackers/XSStrike

cd TwLocation

pip install -r requirements.txt

cat config.txt
consumer_key = "XxXxXxxXXXxxxxXXXxXX"
consumer_secret = "xXXXXXXXXxxxxXxXXxxXxxXXxXxXxxxxXxXXxxxXXx"
access_key = "XXXXXXXX-xxXXxXXxxXxxxXxXXxXxXxXxxxXxxxxXxXXxXxxXX"
access_secret = "XxXXXXXXXXxxxXXXxXXxXxXxxXXXXXxXxxXXXXx"

python TwLocation.py

• first.last.txt: Usernames like Joe.Schmoe
• flast.txt: Usernames like JSchmoe
• firstl.txt: Usernames like JoeS
• rawnames.txt: Full name like Joe Schmoe

$ python linkedin2username.py myname@email.com uber-com

$ python linkedin2username.py myname@email.com uber-com -d 5 -n 'uber.com'

usage: linkedin2username.py [-h] [-p PASSWORD] [-n DOMAIN] [-d DEPTH]
                            [-s SLEEP]
                            username company

positional arguments:
  username              A valid LinkedIn username.
  company               Company name.

optional arguments:
  -h, --help            show this help message and exit
  -p PASSWORD, --password PASSWORD
                        Specify your password on in clear-text on the command
                        line. If not specified, will prompt and not display on
                        screen.
  -n DOMAIN, --domain DOMAIN
                        Append a domain name to username output. [example: '-n
                        uber.com' would ouput jschmoe@uber.com]
  -d DEPTH, --depth DEPTH
                        Search depth. If unset, will try to grab them all.
  -s SLEEP, --sleep SLEEP
                        Seconds to sleep between pages. defaults to 3.

git clone https://github.com/rezasp/joomscan.git
cd joomscan
perl joomscan.pl

Usage: joomscan.pl [options]

--url | -u <URL>                         |   The Joomla URL/domain to scan.
--enumerate-components          | -ec    |   Try to enumerate components.

--cookie <String>                       |   Set cookie.
--user-agent | -a <user-agent>   |   Use the specified User-Agent.
--random-agent | -r                   |   Use a random User-Agent.
--timeout <time-out>                  |   set timeout.
--about                                      |   About Author
--update                                    |   Update to the latest version.
--help | -h                                 |   This help screen.
--version                                   |   Output the current version and exit.

perl joomscan.pl --url www.example.com

perl joomscan.pl -u www.example.com

perl joomscan.pl --url www.example.com --enumerate-components

perl joomscan.pl -u www.example.com --ec

perl joomscan.pl --url www.example.com --cookie "test=demo;"

perl joomscan.pl --url www.example.com --user-agent "Googlebot/2.1 (+http://www.googlebot.com/bot.html)"

perl joomscan.pl -u www.example.com -a "Googlebot/2.1 (+http://www.googlebot.com/bot.html)"

perl joomscan.pl -u www.example.com --random-agent

perl joomscan.pl --url www.example.com -r

perl joomscan.pl --update

• Mohammad Reza Espargham [ reza[dot]espargham[at]owasp[dot]org ]
• Ali Razmjoo [ ali[dot]razmjoo[at]owasp[dot]org ]