Usage: python3 djangohunter.py --key {shodan}
Dorks: 'DisallowedHost', 'KeyError', 'OperationalError', 'Page not found at /'

• Shodan
• Pyfiglet
• Requests
• BeautifulSoup

pip -r install requirements

[sudo] npm install -g novahot

novahot config > ~/.novahotrc

1. View the available trojans with novahot trojan list.
   
2. Select a trojan in a language that is appropriate for your target, then copy its source to a new file. (Ex: novahot trojan view basic.php > ~/my-trojan.php)
   
3. Change the control password in the newly-created trojan.
   
4. Upload the trojan to a web-accessible location on the target.
   
5. Configure target information in the targets property in ~/.novahotrc.
   
6. Run novahot shell <target> to open a shell.
   

.mysql { "username" : "mysql-user", "password" : "the-password", "database" : "the-database" }

mysql> SELECT ID, user_login, user_email, user_pass FROM wp_users;

download <remote-filename> [<local-filename>]

upload <local-filename> [<remote-filename>]

view <remote-filename> [<local-filename>]

edit <remote-filename>

1. Clone and cd to this repository
2. Run: docker-compose up

1. Clone and cd to this repository
2. Provision a virtual machine: vagrant up
3. SSH into the virtual machine: vagrant ssh
4. Start the docker container: sudo su; cd /vagrant; docker-compose up

{

  "targets": {
    "dvwa" : {
      "uri"      : "http://localhost:8000/novahot.php",
      "password" : "the-password",

      "mysql" : {
        "username": "root",
        "password": "vulnerables",
        "database": "dvwa"
      }
    }
  }

}

novahot shell dvwa

• Configuration
• The Client/Trojan API
• sqlite3 "dot command" conflicts

git clone https://github.com/ismailtasdelen/hackertarget.git
cd hackertarget/
python hackertarget.py

root@ismailtasdelen:~# python hackertarget.py 

  _               _              _                          _   
 | |_   __ _  __ | |__ ___  _ _ | |_  __ _  _ _  __ _  ___ | |_ 
 | ' \ / _` |/ _|| / // -_)| '_||  _|/ _` || '_|/ _` |/ -_)|  _|
 |_||_|\__,_|\__||_\_\___||_|   \__|\__,_||_|  \__, |\___| \__|
                                                |___/           
           Ismail Tasdelen
 | github.com/ismailtasdelen | linkedin.com/in/ismailtasdelen |


[1] Traceroute
[2] Ping Test
[3] DNS Lookup
[4] Reverse DNS
[5] Find DNS Host
[6] Find Shared DNS
[7] Zone Transfer
[8] Whois Lookup
[9] IP Location Lookup
[10] Reverse IP Lookup
[11] TCP Port Scan
[12] Subnet Lookup
[13] HTTP Header Check
[14] Extract Page Links
[15] Exit

Which option number : 

• [1] Traceroute
• [2] Ping Test
• [3] DNS Lookup
• [4] Reverse DNS
• [5] Find DNS Host
• [6] Find Shared DNS
• [7] Zone Transfer
• [8] Whois Lookup
• [9] IP Location Lookup
• [10] Reverse IP Lookup
• [11] TCP Port Scan
• [12] Subnet Lookup
• [13] HTTP Header Check
• [14] Extract Page Links
• [15] Exit

root@ismailtasdelen:~# git clone https://github.com/ismailtasdelen/hackertarget.git

root@ismailtasdelen:~# git clone git@github.com:ismailtasdelen/hackertarget.git

• https://hackertarget.com/

$ dirhunt http://website.com/

• Process one or multiple sites at a time.
• Process 'Index Of' pages and report interesting files.
• Detect redirectors.
• Detect blank index file created on directory to hide things.
• Process some html files in search of new directories.
• 404 error pages and detect fake 404 errors.
• Filter results by flags.
• Analyze results at end. It also processes date & size of the Index Pages (NEW!)
• Get new directories using robots.txt, VirusTotal& Google (NEW!)
• Delay between requests
• One or multiple proxies option. It can also search for free proxies (NEW!)

$ sudo pip3 install dirhunt

$ mkdir /tmp/webmap
$ docker run -d \
         --name webmap \
         -h webmap \
         -p 8000:8000 \
         -v /tmp/webmap:/opt/xml \
         rev3rse/webmap

$ # now you can run Nmap and save the XML Report on /tmp/webmap
$ nmap -sT -A -T4 -oX /tmp/webmap/myscan.xml 192.168.1.0/24

$ curl -sL http://bit.ly/webmapsetup | bash

$ # stop running webmap container
$ docker stop webmap

$ # remove webmap container
$ docker rm webmap

$ # pull new image from dockerhub
$ docker pull rev3rse/webmap

$ # run WebMap
$ curl -sL http://bit.ly/webmapsetup | bash

• Import and parse Nmap XML files
• Statistics and Charts on discovered services, ports, OS, etc...
• Inspect a single host by clicking on its IP address
• Attach labels on a host
• Insert notes for a specific host
• Create a PDF Report with charts, details, labels and notes
• Copy to clipboard as Nikto, Curl or Telnet commands
• Search for CVE and Exploits based on CPE collected by Nmap

• Better usage of Django template
• Fixed some Nmap XML parse problems
• Fixed CVE and Exploit collecting problems
• Add new Network View

• _ will replaced by a space ()
• .xml will be removed

• Django
• Materialize CSS
• Clipboard.js
• Chart.js
• Wkhtmltopdf
• API cve.circl.lu
• vis.js

• s3th_0x @adubaldo (bug on single host report)
• Neetx @Neetx (bug on xml with no host up)

• Multi-threading
• 3 modes of detection
• Regex powered heuristic scanning
• Huge list of 3370 parameter names

Note:Arjun doesn't work with python < 3.4

python3 arjun.py -u https://api.example.com/endpoint --get

python3 arjun.py -u https://api.example.com/endpoint --get -t 22

python3 arjun.py  -u https://api.example.com/endpoint --get -d 2

Note: Arjun uses nano as the default editor for the prompt but you can change it by tweaking /core/prompt.py.

• keytool
• jarsigner
• Apache2
• Metasploit-Framework
• xterm

sudo apt-get install git
git clone https://github.com/TunisianEagles/Androspy.git
cd Androspy
chmod +x setup.sh
sudo ./setup.sh
chmod +x androspy.sh
sudo ./androspy.sh

• BackBox Linux
• Kali linux
• Parrot os

• Contact - Tunisian Eagles
• [Email] - tunisianeagles@protonmail.com - TunisianEagles
• Website - TunisianEagles

Note: Beginning with version 0.2.0, Python 3.6+ is required.

• Input Generation: Manticore automatically generates inputs that trigger unique code paths
• Crash Discovery: Manticore discovers inputs that crash programs via memory safety violations
• Execution Tracing: Manticore records an instruction-level trace of execution for each generated input
• Programmatic Interface: Manticore exposes programmatic access to its analysis engine via a Python API

• Ethereum smart contracts (EVM bytecode)
• Linux ELF binaries (x86, x86_64 and ARMv7)

$ manticore ./path/to/contract.sol  # runs, and creates a mcore_* directory with analysis results
$ manticore --detect-reentrancy ./path/to/contract.sol  # Above, but with reentrancy detection enabled
$ manticore --detect-all ./path/to/contract.sol  # Above, but with all detectors enabled

$ manticore ./path/to/binary        # runs, and creates a mcore_* directory with analysis results
$ manticore ./path/to/binary ab cd  # use concrete strings "ab", "cd" as program arguments
$ manticore ./path/to/binary ++ ++  # use two symbolic strings of length two as program arguments

from manticore.ethereum import ManticoreEVM
contract_src="""
contract Adder {
    function incremented(uint value) public returns (uint){
        if (value == 1)
            revert();
        return value + 1;
    }
}
"""
m = ManticoreEVM()

user_account = m.create_account(balance=1000)
contract_account = m.solidity_create_contract(contract_src,
                                              owner=user_account,
                                              balance=0)
value = m.make_symbolic_value()

contract_account.incremented(value)

for state in m.running_states:
    print("can value be 1? {}".format(state.can_be_true(value == 1)))
    print("can value be 200? {}".format(state.can_be_true(value == 200)))

# example Manticore script
from manticore import Manticore

hook_pc = 0x400ca0

m = Manticore('./path/to/binary')

@m.hook(hook_pc)
def hook(state):
  cpu = state.cpu
  print('eax', cpu.EAX)
  print(cpu.read_int(cpu.ESP))

  m.terminate()  # tell Manticore to stop

m.run()

• Manticore is supported on Linux and requires Python 3.6+.
• Ubuntu 18.04 is strongly recommended.
• Ethereum smart contract analysis requires the solc program in your $PATH.

# Install system dependencies
sudo apt-get update && sudo apt-get install python3 python3-pip -y

# Install Manticore and its dependencies
sudo pip3 install manticore

# Download the examples
git clone https://github.com/trailofbits/manticore.git && cd manticore/examples/linux

# Build the examples
make

# Use the Manticore CLI
manticore basic
cat mcore_*/*0.stdin | ./basic
cat mcore_*/*1.stdin | ./basic

# Use the Manticore API
cd ../script
python3 count_instructions.py ../linux/helloworld

# Download the Manticore image
docker pull trailofbits/manticore

# Download the examples
git clone https://github.com/trailofbits/manticore.git && cd manticore

# Run container with a shared examples/ directory
docker run -it -v $PWD/examples:/home/manticore/examples trailofbits/manticore

# Change to examples directory
manticore@80d441275ebf$ cd examples/linux

# Build the examples
manticore@80d441275ebf$ make

# Use the Manticore CLI
manticore@80d441275ebf$ manticore basic
manticore@80d441275ebf$ cat mcore_*/*0.stdin | ./basic
manticore@80d441275ebf$ cat mcore_*/*1.stdin | ./basic

# Use the Manticore API
manticore@80d441275ebf$ cd ../script
manticore@80d441275ebf$ python3 count_instructions.py ../linux/helloworld

echo "PATH=\$PATH:~/.local/bin" >> ~/.profile
source ~/.profile
pip3 install --user manticore

sudo pip3 install virtualenvwrapper
echo "source /usr/local/bin/virtualenvwrapper.sh" >> ~/.profile
source ~/.profile
mkvirtualenv manticore
sudo ./manticore/bin/pip3 install manticore

sudo pip3 install manticore

docker pull trailofbits/manticore

• The wiki contains some basic information about getting started with Manticore and contributing
  
• The examples directory has some very minimal examples that showcase API features
  
• The API reference has more thorough and in-depth documentation on our API
  
• The manticore-examples repository has some more involved examples, for instance solving real CTF problems

• Information Gathering
• Exploitation
• Post Exploitation
• Bruteforcing
• Phishing
• Cryptography/Stenography

• Nmap
• IP Info
• Tcpdump (In The Works)
• Datasploit (In The Works)
• Censys Lookup
• DNS Lookup

• Searchsploit
• ReverseShell Wizard

• In The Works

• In The Works

• BlackEye Python

• MetaKiller (In The Works)

git clone https://github.com/j3ssie/Osmedeus
cd Osmedeus
chmod +x install.sh
./install.sh

• Doing normal routine include: Subdomain Scanning, Subdomain TakeOver Scanning, Port Scanning and ScreenShot the target.

./osmedeus.py -t example.com

• Scanning subdomain and Subdomain TakeOver

./osmedeus.py -m subdomain -t example.com

• Git repo scanning

./osmedeus.py -m git --git https://github.com/whatever/repo

• Doing some stuff with Burp State file

./osmedeus.py -m burp -t example.com --burp yourburpstate.xml

• Subdomain Scanning
  
  • amass
  • subfinder
  • massdns
• Subdomain TakeOver Scanning
  
  • subjack
  • SubOver
• Port Scanning and ScreenShot the target
  
  • aquaton
  • EyeWitness
  • masscan
• Git repo scanning
  
  • truffleHog
  • gitrob
• Doing some stuff with Burp State file
  
  • sqlmap
  • SleuthQL
  • LinkFinder

$ git clone https://github.com/m4ll0k/DeepSearch.git deepsearch
$ cd deepsearch 
$ pip3 install requests
$ python3 deepsearch.py

python3 deepsearch.py -u http://testphp.vulnweb.com/ -e php -w wordlist.txt

python3 deepsearch.py -u http://testphp.vulnweb.com/ -e php -w wordlist.txt -f

python3 deepsearch.py -u http://testphp.vulnweb.com/ -e php -w wordlist.txt -b

python3 deepsearch.py -u http://testphp.vulnweb.com/ -e php -w wordlist.txt -l

python3 deepsearch.py -u http://testphp.vulnweb.com/ -e php -w wordlist.txt -p

python3 deepsearch.py -u http://testphp.vulnweb.com/ -e php -w wordlist.txt -o 200,301,302

python3 deepsearch.py -u http://testphp.vulnweb.com/ -e php -w wordlist.txt -x 501,502,503,401

python3 deepsearch.py -u http://testphp.vulnweb.com/test%1%.php -e php -w wordlist.txt

python3 deepsearch.py -u http://testphp.vulnweb.com/id/%1%/index.html -e php -w wordlist.txt

python3 deepsearch.py -u http://testphp.vulnweb.com/index.php?id=%2%&user=1 -e php -w wordlist.txt

python3 deepsearch.py -u http://testphp.vulnweb.com/index.php?%id%=1&user=2 -e php -w wordlist.txt

python3 deepsearch.py -u http://testphp.vulnweb.com/ -e php -w wordlist.txt -H "Content-Type:text/html\nETag:1234" 

python3 deepsearch.py -u http://testphp.vulnweb.com/ -e php -w wordlist.txt -P 127.0.0.1:8080

python3 deepsearch.py -U my_urls.txt -e php -w wordlist.txt

python3 deepsearch.py -u http://testphp.vulnweb.com/ -e php -w wordlist.txt -t 10 -T 3 -d 2 -R -c "test=test" --random-agent

Shodan - https://account.shodan.io/
Censys - https://censys.io/account/api
ZoomEye - https://www.zoomeye.org/profile

$ sudo pip install -r requirements.txt

$ python cloudbunny.py -u securityattack.com.br

$ python cloudbunny.py -h

$ python cloudbunny.py -u site_example.com.br

             /|      __  
            / |   ,-~ /  
           Y :|  //  /    
           | jj /( .^  
>-"~"-v"  
          /       Y    
         jo  o    |  
        ( ~T~     j   
>._-' _./   
        /   "~"  |    
       Y     _,  |      
      /| ;-"~ _  l    
     / l/ ,-"~    \  
     \//\/      .- \  
      Y        /    Y*  
      l       I     ! 
      ]\      _\    /"\ 
     (" ~----( ~   Y.  )   
 ~~~~~~~~~~~~~~~~~~~~~~~~~~    
CloudBunny - Bypass WAF with Search Engines 
Author: Eddy Oliveira (@Warflop)
https://github.com/Warflop 

[+] Looking for target on Shodan...
[+] Looking for target on Censys...
[+] Looking for certificates on Censys...
[+] Looking for target on ZoomEye...
[-] Just more some seconds...


+---------------+------------+-----------+----------------------------+
|   IP Address  |    ISP     |   Ports   |        Last Update         |
+---------------+------------+-----------+----------------------------+
|  55.14.232.4  | Amazon.com | [80, 443] | 2018-11-02T16:02:51.074543 |
| 54.222.146.40 | Amazon.com |    [80]   | 2018-11-02T10:16:38.166829 |
| 18.235.52.237 | Amazon.com | [443, 80] | 2018-11-08T01:22:11.323980 |
| 54.237.93.127 | Amazon.com | [443, 80] | 2018-11-05T15:54:40.248599 |
| 53.222.94.157 | Amazon.com | [443, 80] | 2018-11-06T08:46:03.377082 |
+---------------+------------+-----------+----------------------------+
    We may have some false positives :)

$ go get -u github.com/edoz90/pastego

pastego -s "password,keygen,PASSWORD"

pastego -s "quake && ~earthquake, password && ~(php || sudo || Linux || '<body>')"

usage: pastego [<flags>]

Flags:
      --help              Show context-sensitive help (also try --help-long and --help-man).
  -s, --search="pass"     Strings to search, i.e: "password,ssh"
  -o, --output="results"  Folder to save the bins
  -i, --insensitive       Search for case-insensitive strings

`&&` - and

`||` - or

`~` - not

`'string with space'`

`(myexpression && 'with operators')`

go get -u "github.com/PuerkitoBio/goquery"

go get -u "gopkg.in/alecthomas/kingpin.v2"

go get -u "github.com/jroimartin/gocui"

go get -u github.com/mna/pigeon

• increase the time between each request
• create a script to restart your router when pastebin warns you

> git clone https://github.com/RhinoSecurityLabs/pacu
> cd pacu
> bash install.sh
> python3 pacu.py

• Improve interface formatting
• Database forward-migrations and version tracking
• "Attack Playbooks" to allow for easier use of complex module execution chains
• Colored console output
• Module Dry-Run functionality
• Allow use of standalone config files
• Plugin architecture improvements

• Pacu is officially supported in OSX and Linux.
• Pacu is Open-Source Software, and is distributed with a BSD-3-Clause License.

• list will list the available modules for the regions that were set in the current session.
• help module_name will return the applicable help information for the specified module.
• run module_name will run the specified module with its default parameters.
• run module_name --regions eu-west-1,us-west-1 will run the specified module against the eu-west-1 and us-west-1 regions (for modules that support the --regions argument)

• Report vulnerabilities in Pacu directly to us via email: pacu@rhinosecuritylabs.com .
• Pacu creates error logs within each session's folder, as well as a global error log for out-of-session errors which is created in the main directory. If you can, please include these logs with your bug reports, as it will dramatically simplify the debugging process.
• If you have a feature request, an idea, or a bug to report, please submit them here.
  • Please include a description sufficient to reproduce the bug you found, including tracebacks and reproduction steps, and check for other reports of your bug before filing a new bug report. Don't submit duplicates.

• We'd love to hear from you, whatever the reason. Shoot us an email at pacu@rhinosecuritylabs.com anytime!

• To the best of our knowledge Pacu's capabilities are compliant with the AWS Acceptable Use Policy, but as a flexible and modular tool we cannot guarantee this will be true in every situation. It is entirely your responsibility to ensure that how you use Pacu is compliant with the AWS Acceptable Use Policy.
• Depending on what AWS services you use and what your planned testing entails, you may need to request authorization from Amazon prior to actually running Pacu against your infrastructure. Determining whether or not such authorization is necessary is your responsibility.
• As with any penetration testing tool, it is your responsibility to get proper authorization before using Pacu outside of your own environment.
• Pacu is software that comes with absolutely no warranties whatsoever. By using Pacu, you take full responsibility for any and all outcomes that result.

• Use in highly controlled, well understood environments, where any fingerprints outside of a known good set are alertable.
• It is possible to detect, control and investigate brute force or Cred Stuffing password attempts at a higher level of granularity than IP Source - which may be impacted by NAT or botnet-like behaviour. The hassh will be a feature of the specific Client software implementation being used, even if the IP is NATed such that it is shared by many other SSH clients.
• Detect covert exfiltration of data within the components of the Client algorithm sets. In this case, a specially coded SSH Client can send data outbound from a trusted to a less trusted environment within a series of SSH_MSG_KEXINIT packets. In a scenario similar to the more known exfiltration via DNS, data could be sent as a series of attempted, but incomplete and unlogged connections to an SSH server controlled by bad actors who can then record, decode and reconstitute these pieces of data into their original form. Until now such attempts - much less the contents of the clear text packets - are not logged even by mature packet analyzers or on end point systems. Detection of this style of exfiltration can now be performed easily by using anomaly detection or alerting on SSH Clients with multiple different hassh
• Use in conjunction with other contextual indicators, for example detect Network discovery and Lateral movement attempts by unusual hassh such as those used by Paramiko, Powershell, Ruby, Meterpreter, Empire.
• Share malicious hassh as Indicators of Compromise.
• Create an additional level of Client application control, for example one could block all Clients from connecting to an SSH server that are outside of an approved known set of hassh values.
• Contribute to Non Repudiation in a Forensic context - at a higher level of abstraction than IPSource - which may be impacted by NAT, or where multiple IP Sources are used.
• Detect Deceptive Applications. Eg a hasshServer value known to belong to the Cowry/Kippo SSH honeypot server installation, which is purporting to be a common OpenSSH server in the Server String.
• Detect devices having a hassh known to belong to IOT embedded systems. Examples may include cameras, mics, keyloggers, wiretaps that could be easily be hidden from view and communicating quietly over encrypted channels back to a control server.

• RFC4253 The Secure Shell (SSH) Transport Layer Protocol
• Salesforce Engineering blog

• Re-check all known hosts as new credentials are added. It will only check the new credentials.
• Queue a full credential scan on any new host discovered.
• Queue a full credential scan on any known host whose ssh version or key fingerprint changes.
• Attempt command execution as well as attempt to tunnel a TCP connection.
• Re-check each credential using a per credential scan_interval - default 14 days.

$ brew install go # or however you want to install the go compiler
$ go get github.com/ncsa/ssh-auditor

$ go build

$ make static

$ ulimit -n 4096

$ ./ssh-auditor discover -p 22 -p 2222 192.168.1.0/24 10.0.0.1/24

$ ./ssh-auditor addcredential root root
$ ./ssh-auditor addcredential admin admin
$ ./ssh-auditor addcredential guest guest --scan-interval 1 #check this once per day

$ ./ssh-auditor scan

$ ./ssh-auditor vuln

$ ./ssh-auditor rescan

$ ./ssh-auditor dupes

select
        hc.hostport, hc.user, hc.password, hc.result, hc.last_tested, h.version
 from
        host_creds hc, hosts h
 where
        h.hostport = hc.hostport
 and    result!='' order by last_tested asc

“Following extensive customer research, it became clear to us that a number of customers and security community professionals preferred to run on Linux. Tech professionals have long chosen Linux for their servers and computers due to its robust security. However, in recent years, this open source operating system has become much more user-friendly. We are very proud to be one of the first commercial web vulnerability scanners to be released for Linux.”

Nicholas Sciberras, CTO

• Reliability and security: Linux is the operating system most often selected for servers that need close to 100% uptime. Using Linux increases the reliability needed for the thousands of operations required to scan a website.
• Cost-effectiveness: Acunetix customers can run the scanner in their own private cloud on either Amazon AWS, Digital Ocean or Google Cloud, for example.
• Performance: Linux requires fewer resources to run, resulting in extra resources to increase scanner performance.

• an interoperable environment that supports the digital investigator during the four phases of the digital investigation
• a user-friendly graphical interface
• user-friendly tools

• Kernel 4.15.0-38
• Based on Ubuntu 18.04 64BIT - UEFI/SECURE BOOT Ready!
• CAINE 10.0 can boot on Uefi/Uefi+secure boot/Legacy Bios/Bios.