• The purpose of O.G. Auto-Recon is to automate the initial information gathering phase and then enumerate based off those results as much as possible.
• This tool is intended for CTF's and can be fairly noisy. (Not the most stealth conscious tool...)
• All tools in this project are compliant with the OSCP exam rules.
• Command syntax can be easily modified in the Config settings. $variable names should remain unchanged.
• If Virtual Host Routing is detected, O.G. Auto-Recon will add the host names to your /etc/hosts file and continue to enumerate the newly discovered host names.
• DNS enumeration is nerfed to ignore .com .co .eu .uk domains etc... since this tool was designed for CTF's like for instance, "hack the box". It will try to find most .htb domains if dns server's are detected..
• This project use's various stand-alone & custom tools to enumerate a target based off nmap results.
• All Commands and output are logged to a Report folder using the naming context, "IP-ADDRESS-Report/" which will look something like, 10.10.10.10-Report/ with a directory tree structure similar to this report tree structure

cd /opt
git clone https://github.com/Knowledge-Wisdom-Understanding/recon.git
cd recon
chmod +x setup.sh
./setup.sh

         _____________          ____    ________________        /___/___      \        /  / |  /___/__          \      Mr.P-Millz   _____        O.G./  /   _   \______/__/  |______|__|_____ *   \_________________/__/  |___         __/__/   /_\   \ |  |  \   __\/  _ \|  |       __/ __ \_/ ___\/  _ \|       |        |   |     ___    \|  |  /|  | (  |_| )  |    |   \  ___/\  \__(  |_| )   |   |        |___|____/\__\____|____/_|__|\_\____/|__|____|_  /\___  |\___  \____/|___|  /        gtihub.com/Knowledge-Wisdom-Understanding  \___\/  \__\/  \__\_/ v3.6 \___\/      usage: python3 recon.py -t 10.10.10.10    An Information Gathering and Enumeration Framework    optional arguments:    -h, --help            show this help message and exit    -t TARGET, --target TARGET                          Single IPv4 Target to Scan    -F, --FUZZ            auto fuzz found urls ending with .php for params    -v, --version         Show Current Version    -f FILE, --file FILE  File of IPv4 Targets to Scan    -w [WEB], --web [WEB]                          Get open ports for IPv4 address, then only Enumerate                          Web & and Dns Services. -t,--target must be specified.                          -w, --web takes a URL as an argument. i.e. python3                          recon.py -t 10.10.10.10 -w secret    -i {http,httpcms,ssl,sslcms,aquatone,smb,dns,ldap,removecolor,oracle,source,sort_urls,proxy,proxycms,fulltcp,topports,remaining,searchsploit,peaceout,ftpAnonDL,winrm} [{http,httpcms,ssl,sslcms,aquatone,smb,dns,ldap,removecolor,oracle,source,sort_urls,proxy,proxycms,fulltcp,topports,remaining,searchsploit,peaceout,ftpAnonDL,winrm} ...], --ignore {http,httpcms,ssl,sslcms,aquatone,smb,dns,ldap,removecolor,oracle,source,sort_urls,proxy,proxycms,fulltcp,topports,remaining,searchsploit,peaceout,ftpAnonDL,winrm} [{http,httpcms,ssl,sslcms,aquatone,smb,dns,ldap,removecolor,oracle,source,sort_urls,proxy,proxycms,fulltcp,topports,remaining,searchsploit,peaceout,ftpAnonDL,winrm} ...]                          Service modules to ignore during scan.    -s {http,httpcms,ssl,sslcms,aquatone,smb,dns,ldap,removecolor,oracle,source,sort_urls,proxy,proxycms,fulltcp,topports,remaining,searchsploit,peaceout,ftpAnonDL,winrm} [{http,httpcms,ssl,sslcms,aquatone,smb,dns,ldap,removecolor,oracle,source,sort_urls,proxy,proxycms,fulltcp,topports,remaining,searchsploit,peaceout,ftpAnonDL,winrm} ...], --service {http,httpcms,ssl,sslcms,aquatone,smb,dns,ldap,removecolor,oracle,source,sort_urls,proxy,proxycms,fulltcp,topports,remaining,searchsploit,peaceout,ftpAnonDL,winrm} [{http,httpcms,ssl,sslcms,aquatone,smb,dns,ldap,removecolor,oracle,source,sort_urls,proxy,proxycms,fulltcp,topports,remaining,searchsploit,peaceout,ftpAnonDL,winrm} ...]                          Scan only specified service modules    -b {ftp,smb,http,ssh}, --brute {ftp,smb,http,ssh}                          Experimental! - Brute Force ssh,smb,ftp, or http. -t,                          --target is REQUIRED. Must supply only one protocol at                          a time. For ssh, first valid users will be enumerated                          before password brute is initiated, when no user or                          passwords are supplied as options.    -p PORT, --port PORT  port for brute forcing argument. If no port specified,                          default port will be used    -u USER, --user USER  Single user name for brute forcing, for SSH, if no                          user specified, will default to                          wordlists/usernames.txt and bruteforce usernames    -U USERS, --USERS USERS                          List of usernames to try for brute forcing. Not yet                          implimented    -P PASSWORDS, --PASSWORDS PASSWORDS                          List of passwords to try. Optional for SSH, By default                          wordlists/probable-v2-top1575.txt will be used.    

       _____________          ____    ________________
      /___/___      \        /  / |  /___/__          \      Mr.P-Millz   _____
      O.G./  /   _   \______/__/  |______|__|_____ *   \_________________/__/  |___
       __/__/   /_\   \ |  |  \   __\/  _ \|  |       __/ __ \_/ ___\/  _ \|       |
      |   |     ___    \|  |  /|  | (  |_| )  |    |   \  ___/\  \__(  |_| )   |   |
      |___|____/\__\____|____/_|__|\_\____/|__|____|_  /\___  |\___  \____/|___|  /
      gtihub.com/Knowledge-Wisdom-Understanding  \___\/  \__\/  \__\_/ v3.6 \___\/


usage: python3 recon.py -t 10.10.10.10

An Information Gathering and Enumeration Framework

optional arguments:
  -h, --help            show this help message and exit
  -t TARGET, --target TARGET
                        Single IPv4 Target to Scan
  -F, --FUZZ            auto fuzz found urls ending with .php for params
  -v, --version         Sh   ow Current Version
  -f FILE, --file FILE  File of IPv4 Targets to Scan
  -w [WEB], --web [WEB]
                        Get open ports for IPv4 address, then only Enumerate
                        Web & and Dns Services. -t,--target must be specified.
                        -w, --web takes a URL as an argument. i.e. python3
                        recon.py -t 10.10.10.10 -w secret
  -i {http,httpcms,ssl,sslcms,aquatone,smb,dns,ldap,removecolor,oracle,source,sort_urls,proxy,proxycms,fulltcp,topports,remaining,searchsploit,peaceout,ftpAnonDL,winrm} [{http,httpcms,ssl,sslcms,aquatone,smb,dns,ldap,removecolor,oracle,source,sort_urls,proxy,proxycms,fulltcp,topports,remaining,searchsploit,peaceout,ftpAnonDL,winrm} ...], --ignore {http,httpcms,ssl,sslcms,aquatone,smb,dns,ldap,removecolor,oracle,source,sort_urls,proxy,proxycms,fulltcp,topports,remaining,searchsploit,peaceout,ftpAnonDL,winrm} [{http,httpcms,ssl,sslcms,aquatone,smb,dns,ldap,removecolor,oracle,   source,sort_urls,proxy,proxycms,fulltcp,topports,remaining,searchsploit,peaceout,ftpAnonDL,winrm} ...]
                        Service modules to ignore during scan.
  -s {http,httpcms,ssl,sslcms,aquatone,smb,dns,ldap,removecolor,oracle,source,sort_urls,proxy,proxycms,fulltcp,topports,remaining,searchsploit,peaceout,ftpAnonDL,winrm} [{http,httpcms,ssl,sslcms,aquatone,smb,dns,ldap,removecolor,oracle,source,sort_urls,proxy,proxycms,fulltcp,topports,remaining,searchsploit,peaceout,ftpAnonDL,winrm} ...], --service {http,httpcms,ssl,sslcms,aquatone,smb,dns,ldap,removecolor,oracle,source,sort_urls,proxy,proxycms,fulltcp,topports,remaining,searchsploit,peaceout,ftpAnonDL,winrm} [{http,httpcms,ssl,sslcms,aquatone,smb,dns,ldap,removecolor,oracle,source,sort_urls,proxy,proxycms,fulltcp,topports,remaining,searchsploit,peaceout,ftpAnonDL,winrm} ...]
                        Scan only specified service modules
  -b {ftp,smb,http,ssh}, --brute {ftp,smb,http,ssh}
                           Experimental! - Brute Force ssh,smb,ftp, or http. -t,
                        --target is REQUIRED. Must supply only one protocol at
                        a time. For ssh, first valid users will be enumerated
                        before password brute is initiated, when no user or
                        passwords are supplied as options.
  -p PORT, --port PORT  port for brute forcing argument. If no port specified,
                        default port will be used
  -u USER, --user USER  Single user name for brute forcing, for SSH, if no
                        user specified, will default to
                        wordlists/usernames.txt and bruteforce usernames
  -U USERS, --USERS USERS
                        List of usernames to try for brute forcing. Not yet
                        implimented
  -P PASSWORDS, --PASSWORDS PASSWORDS
                        List of passwords to try. Optional for SSH, By defaul   t
                        wordlists/probable-v2-top1575.txt will be used.

• If you don't want to specify a directory , you can just enter ' ' as the argument for --web

python3 recon.py -t 10.10.10.10

python3 recon.py -t 10.10.10.10 -w secret
python3 recon.py -t 10.10.10.10 -w somedirectory
python3 recon.py -t 10.10.10.10 -w ' '

python3 recon.py -t 10.10.10.10 -s topports dns http httpcms ssl sslcms sort_urls aquatone source

python3 recon.py -t 10.10.10.10 -i dns http httpcms ssl sslcms sort_urls aquatone source

python3 recon.py -f ips.txt

python3 recon.py -t 10.10.10.10 --FUZZ

python3 recon.py -t 10.10.10.10 -b ssh

http,httpcms,ssl,sslcms,aquatone,smb,dns,ldap,oracle,source,sort_urls,proxy,proxycms,fulltcp,topports,remaining,searchsploit,peaceout,ftpAnonDL,winrm  

python3 recon.py -t 10.10.10.10 -b ssh -p 2222
python3 recon.py -t 10.10.10.10 -b ssh -p 2222 -u slickrick

http,httpcms,ssl,sslcms,aquatone,smb,dns,ldap,oracle,source,sort_urls,proxy,proxycms,fulltcp,topports,remaining,searchsploit,peaceout,ftpAnonDL,winrm

python3 recon.py -t 10.10.10.10 -i http
python3 recon.py -t 10.10.10.10 -i http ssl
python3 recon.py --target 10.10.10.10 --ignore fulltcp http

• MAKE SURE TO CHECK OUT THE Config file for all your customization needs
• All required non-default kali linux dependencies are included in setup.sh.

• Recon Demo
• Brute Demo

• AIX
• FreeBSD
• HP-UX
• Linux
• Mac OS
• NetBSD
• OpenBSD
• Solaris
• and others

1. Determine operating system
2. Search for available tools and utilities
3. Check for Lynis update
4. Run tests from enabled plugins
5. Run security tests per category
6. Report status of security scan

• Security auditing
• Compliance testing (e.g. PCI, HIPAA, SOx)
• Vulnerability detection and scanning
• System hardening

• Best practices
• CIS
• NIST
• NSA
• OpenSCAP data
• Vendor guides and recommendations (e.g. Debian Gentoo, Red Hat)

## Lynis 3.0.0 (2020-06-18)

This is a major release of Lynis and includes several big changes.
Some of these changes may break your current usage of the tool, so test before
deployment!

### Security issues
This release resolves two security issues
* CVE-2020-13882 - Discovered by Sander Bos, code submission by Katarina Durechova
* CVE-2019-13033 - Discovered by Sander Bos

### Breaking change: Non-interactive by default
Lynis now runs non-interactive by default, to be more in line with the Unix
philosophy. So the previously used '--quick' option is now default, and the tool
will only wait when using the '--wait' option.

### Breaking change: Deprecated options
- Option: -c
- Option: --check-update/--info
- Option: --dump-options
- Option: --license-key

### Breaking change: Profile options
The format of all profile options are converted (from key:value to key=value).
You may have to update the changes you made in your custom.prf.

### Security
An important focus area for this release is on security. We added several
measures to further tighten any possible misuse.

## New: DevOps, Forensics, and pentesting mode
This release adds initial support to allow defining a specialized type of audit.
Using the relevant options, the scan will change base on the intended goal.

See full changelog on GitHub page.

git clone https://github.com/thelinuxchoice/sayhello
cd sayhello
bash sayhello.sh

• None Algorithm
• RSAtoHMAC

usage: TheNone.py [-h] -t TOKEN

TokenBreaker: 1.TheNoneAlgorithm

optional arguments:
  -h, --help            show this help message and exit

required arguments:
  -t TOKEN, --token TOKEN
                        JWT Token value

Example Usage: python TheNone.py -t [JWTtoken]

$ ./TheNone.py -t eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXUyJ9.eyJsb2dpbiI6ImFkbSIsImlhdCI6IjE1Mzc1MjMxMjIifQ.ZWZhNjRmZDgzYWYzNDcxMjk5OTQ4YzE0NDVjMTNhZmJmYTQ5ZDhmYjY0ZDgyMzlhMjMwMGJlMTRhODA2NGU4MQ

TheNone

[*] Decoded Header value is: {"alg":"HS256","typ":"JWS"}
[*] Decoded Payload value is: {"login":"adm","iat":"1537523122"}
[*] New header value with none algorithm: {"alg":"None","typ":"JWS"}
[<] Modify Header? [y/N]: n
[<] Enter your payload: {"login":"sprAdm","iat":"0"}
[+] Successfully encoded Token: eyJhbGciOiJOb25lIiwidHlwIjoiSldTIn0.eyJsb2dpbiI6InNwckFkbSIsImlhdCI6IjAifQ.

usage: RsaToHmac.py [-h] -t TOKEN -p PUBKEY

TokenBreaker: 1.RSAtoHMAC

optional arguments:
  -h, --help                        show this help message and exit

required arguments:
  -t TOKEN, --token TOKEN           JWT Token value
  -p PUBKEY, --pubkey PUBKEY        Path to Public key File

Example Usage: python RsatoHMAC.py -t [JWTtoken] -p [PathtoPublickeyfile]

$ ./RsaToHmac.py -t eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwOlwvXC9kZW1vLnNqb2VyZGxhbmdrZW1wZXIubmxcLyIsImlhdCI6MTU0MDM3NjA2MSwiZXhwIjoxNTQwMzc2MTgxLCJkYXRhIjp7ImhlbGxvIjoid29ybGQifX0.HI50KvoHzcf7znWkrdugn5-O-68PpJAeiS21cLisC1WgEI21gWnqqvv3oqsnzbGkIt21NvPVHWFXoKJmLPKHeMeYLgc7nuVdF37WWd7M1XzZEP8zLoed7Z6K0KfNuR_CRsjogv1KAt8fJQvRzRhFi9dORHGxWRqpiInIgLKROLgXB-7Rv2SOYdyD_XylRaVJ1JpmmCyVmIbzVWhVuRJWT59AUm43yYRP3bBt-bnhMfkzFpwxTk3O84-On4DoIt6NIkRJaxXDUdDKscLGmSWQmdZsZds3XSV0ZgN0PObADqkZwwCBAqUTT7l5BVcBmasdnNuZ8cCDKzNtJr2cdow6zQ -p public.pem

RSA to HMAC

[*] Decoded Header value: {"typ":"JWT","alg":"RS256"}
[*] Decode Payload value: {"iss":"http:\/\/demo.sjoerdlangkemper.nl\/","iat":1540376061,"exp":1540376181,"data":{"hello":"world"}}
[*] New header value with HMAC: {"typ":"JWT","alg":"HS256"}
[<] Modify Header? [y/N]: n
[<] Enter Your Pay   load value: {"iss":"http:\/\/www.google.com\/","iat":2351287873,"exp":1843945693,"data":{"hello":"hacked!"}}
[+] Successfully Encoded Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwOlwvXC93d3cuZ29vZ2xlLmNvbVwvIiwiaWF0IjoyMzUxMjg3ODczLCJleHAiOjE4NDM5NDU2OTMsImRhdGEiOnsiaGVsbG8iOiJoYWNrZWQhIn19.8jfUVCZPA7cWaSfe0LIjRt692RaFHnnvtw0jHoSAneQ

• Queries, mutations, subscriptions
• Its fields and arguments
• Objects and custom object types

usage: inql [-h] [--nogui] [-t TARGET] [-f SCHEMA_JSON_FILE] [-k KEY]
            [-p PROXY] [--header HEADERS HEADERS] [-d] [--generate-html]
            [--generate-schema] [--generate-queries] [--insecure]
            [-o OUTPUT_DIRECTORY]

InQL Scanner

optional arguments:
  -h, --help            show this help message and exit
  --nogui               Start InQL Without Standalone GUI [Jython-only]
  -t TARGET             Remote GraphQL Endpoint (https://<Target_IP>/graphql)
  -f SCHEMA_JSON_FILE   Schema file in JSON format
  -k KEY                API Authentication Key
  -p PROXY              IP of web proxy to go through (http://127.0.0.1:8080)
  --header HEADERS HEADERS
  -d                    Replace known GraphQL arguments types with placeholder
                        values (useful for Burp Suite)
  --generate-html       Generate HTML Documentation
  --generate-schema     Generate JSO   N Schema Documentation
  --generate-queries    Generate Queries
  --insecure            Accept any SSL/TLS certificate
  -o OUTPUT_DIRECTORY   Output Directory

• Search for known GraphQL URL paths; the tool will grep and match known values to detect GraphQL endpoints within the target website
• Search for exposed GraphQL development consoles (GraphiQL, GraphQL Playground, and other common consoles)
• Use a custom GraphQL tab displayed on each HTTP request/response containing GraphQL
• Leverage the templates generation by sending those requests to Burp's Repeater tool ("Send to Repeater")
• Leverage the templates generation and editor support by sending those requests to embedded GraphIQL ("Send to GraphiQL")
• Configure the tool by using a custom settings tab

• Download the Jython Jar
• Start Burp Suite
• Extender Tab > Options > Python Enviroment > Set the location of Jython standalone JAR
• Extender Tab > Extension > Add > Extension Type > Select Python
• Download the latest inql_burp.py release here
• Extension File > Set the location of inql_burp.py> Next
• The output should now show the following message: InQL Scanner Started!

1. Load a GraphQL endpoint or a JSON schema file location inside the top input field
2. Press the "Load" button
3. After few seconds, the left panel will refresh loading the directory structure for the selected endpoint as in the following example:

• url
• query
• timestamp 1
• query1.query
• query2.query
• timestamp 2
• query1.query
• query2.query
• mutation
• subscription

4. Selecting any query/mutation/subscription will load the corresponding template in the main text area

• Download and Install Jython. This can be obtained on macOS through brew brew install jython or on Ubuntu derivates through apt-get install -y jython
• Install inql through pip with jython -m pip install inql
• Start the UI through jython with jython -m inql

Applications

Manage Inventory Easily

AI-Based Recommendations

git clone https://github.com/thelinuxchoice/hmmcookies
cd hmmcookies
bash hmmcookies.sh

* This will download and install all required tools
*
$ git clone https://github.com/s1l3nt78/sifter.git
$ cd sifter
$ chmod +x install.sh
$ ./install.sh

# Information Modules
  = Enterprise Information Gatherers
   -theHarvester  - https://github.com/laramies/theHarvester
   -Osmedeus - https://github.com/j3ssie/Osmedeus
   -ReconSpider - https://github.com/bhavsec/reconspider
   -CredNinja - -CredNinja - https://github.com/Raikia/CredNinja

= Targeted Information Gatherers
   -Maryam - https://github.com/saeeddhqan/Maryam
   -Seeker - https://github.com/thewhiteh4t/seeker
   -Sherlock - https://github.com/sherlock-project/sherlock
   -xRay - https://github.com/evilsocket/xray

# Domain Recon Gathering
 -DnsTwist - https://github.com/elceef/dnstwist
 -Armory - https://github.com/depthsecurity/armory
 -SayDog - https://github.com/saydog/saydog-framework

# Router Tools
 -MkCheck - https://github.com/s1l3nt78/MkCheck
 -RouterSploit - https://github.com/threat9/routersploit

# Exploitation Tools
   = MS Exploiters
   -ActiveReign    - https://github.com/m8r0wn/ActiveReign
   -iSpy - https://github.com/Cyb0r9/ispy
   -SMBGhost
    --SMBGhost Scanner - https://github.com/ioncube/SMBGhost
    --SMBGhost Exploit - https://github.com/chompie1337/SMBGhost_RCE_PoC

   = Website Exploiters
   -DDoS
  --Dark Star - https://github.com/s1l3nt78/Dark-Star
  --Impulse - https://github.com/LimerBoy/Impulse
   -NekoBot - https://github.com/tegal1337/NekoBotV1
   -xShock - https://github.com/capture0x/XSHOCK
   -VulnX - https://github.com/anouarbensaad/vulnx

 = Exploit Searching
   -FindSploit - https://github.com/1N3/Findsploit
   -ShodanSploit - https://github.com/shodansploit/shodansploit

    -TigerShark (Phishing) - https://github.com/s1l3nt78/TigerShark

 = Post-Exploitation
      -EoP Exploit (Elevation of Priviledge Exploit) - https://github.com/padovah4ck/CVE-2020-0683
      -Omega - https://github.com/entynetproject/omega
        -WinPwn - https://github.com/S3cur3Th1sSh1t/WinPwn
   -CredHarvester - https://github.com/Technowlogy-Pushpender/creds_harvester
   -PowerSharp - https://github.com/S3cur3Th1sSh1t/PowerSharpPack
   -ACLight2 - https://github.com/cyberark/ACLight


    =FuzzyDander - Equation Group, Courtesy of the Shadow Brokers 
     (Obtained through issue request.)
      -FuzzBunch
   -Danderspritz

    =BruteDUM (Bruteforcer) - https://github.com/GitHackTools/BruteDum

# Password Tools
 -Mentalist - https://github.com/sc0tfree/mentalist
 -DCipher - https://github.com/k4m4/dcipher

# Network Scanners
 -Nmap - https://nmap.org
 -AttackSurfaceMapper - https://github.com/superhedgy/AttackSurfaceMapper
 -aSnip - https://github.com/harleo/asnip
 -wafw00f - https://github.com/EnableSecurity/wafw00f
 -Arp-Scan

# HoneyPot Detection Systems
 -HoneyCaught - https://github.com/aswinmguptha/HoneyCaught<   br/> -SniffingBear - https://github.com/MrSuicideParrot/SniffingBear
 -HoneyTel (telnet-iot-honeypot) - https://github.com/Phype/telnet-iot-honeypot


# Vulnerability Scanners
 -Flan - https://github.com/cloudflare/flan
   -Rapidscan - https://github.com/skavngr/rapidscan
 -Yuki-Chan - https://github.com/Yukinoshita47/Yuki-Chan-The-Auto-Pentest


# WebApplication Scanners
   -Sitadel - https://github.com/shenril/Sitadel
   -OneFind - https://github.com/nyxgeek/onedrive_user_enum
   -AapFinder - https://github.com/Technowlogy-Pushpender/aapfinder
   -BFAC - https://github.com/mazen160/bfac
   -XSStrike - https://github.com/s0md3v/XSStrike


# Website Scanners & Enumerators
   -Nikto - https://github.com/sullo/nikto
   -Blackwidow - https://github.com/1N3/blackwidow
   -Wordpress
    ---WPSc   an - https://github.com/wpscanteam/wpscan
    ---WPForce/Yertle - https://github.com/n00py/WPForce
   -Zeus-Scanner - https://github.com/Ekultek/Zeus-Scanner
   -Dirb
   -DorksEye - https://github.com/BullsEye0/dorks-eye

# Web Mini-Games
   -This was added in order to have a fun way to pass time
    during the more time intensive modules.
    Such as nMap Full Port scan or a RapidScan run.

@Codename: 7i7aN

• MkCheck - MikroTik Router Exploitation Framework.
• RouterSploit - Network Router Exploitation Framework.
• XSStrike - Cross Site Scripting detection suite.
• HoneyTel - TelNet-IoT-HoneyPot used to analyze collected botnet payloads.
• ACLight2 - Used to discover Shadow Admin accounts on an exploited system.
• SMBGhost - Now has a scanner, as well as an exploitative option.

What happens when you delete your files?

1. Moving the file to Trash folder and then emptying the trash folder.
2. Using the keyboard shortcut, Option + Command + Delete. This will delete the file immediately. If you wish to empty the trash completely, press Shift + Command + Delete.

Image 1: The Trash folder on the desktop of the Mac system.

Image 2: Un-deleting/Restoring the deleted files from Trash folder

Image 3: The Stellar Data Recovery software for Mac screen

Image 4: Selecting the location of the deleted files

4: Toggle on Deep Scan switch and then click on Scan. This will start the scanning process. This method is an advanced scan mode, which comprehensively scans your drive, based on the file signature. The scan time here is longer but the recovery results are quite detailed.

Image 5: Stellar Data Recovery software scanning all recoverable data

5: After scanning is completed, the software lists all the recoverable files present in that drive under the Classic, File, and Deleted Lists. You can select the “Deleted List” option to navigate through the folders.

Image 6: The dialog box confirming successful scan and list of items which can be recovered.

Image 7: Double clicking on file can help you see the preview of recoverable files

7: Click Recover after selecting the files or folders you wish to restore. While restoring, please select a different drive volume or an external storage.

Image 8: Recovery of selected file in progress

• Reflect Origin checks
• Prefix Match
• Suffix Match
• Not Esacped Dots
• Null
• ThirdParties (Like => github.io, repl.it etc.)
  • Taken from Chenjj's github repo
• SpecialChars (Like => "}","(", etc.)
  • See more in Advanced CORS Exploitation Techniques

$ go get -u github.com/shivangx01b/CorsMe

echo "https://example.com" | ./Corsme   

cat http_https.txt | ./CorsMe -t 70  

cat http_https.txt | ./CorsMe -t 70 --wildcard  

cat http_https.txt | ./CorsMe -t 70 -wildcard -header "Cookie: Session=12cbcx...."  

cat subdomains.txt | ./httprobe -c 70 -p 80,443,8080,8081,8089 | tee http_https.txt  cat http_https.txt | ./CorsMe -t 70  

• Scanner stores the error results as "error_requests.txt"... which contains hosts which cannot be requested

• Go to the link below to open a copy of the colabcat.ipynb file in Google Colab: https://colab.research.google.com/github/someshkar/colabcat/blob/master/colabcat.ipynb
• Click on Runtime, Change runtime type, and set Hardware accelerator to GPU.
• Go to your Google Drive and create a directory called dothashcat, with a hashes subdirectory where you can store hashes.
• Come back to Google Colab, click on Runtime and then Run all.
• When it asks for a Google Drive token, go to the link it provides and authenticate with your Google Account to get the token.
• You can edit the last few cells in the notebook to customize the wordlists it downloads and the type of hash it cracks. A full list of these can be found here.
• If needed, simply type !bash in a new cell to get access to an interactive shell on the Google Colab instance.

• Nvidia Tesla K80
• Nvidia Tesla T4
• Nvidia Tesla P4
• Nvidia Tesla P100

• mxrch/penglab : This is great if you're looking to use other tools like John and Hydra on Colab too.

Data Gathering

Data Storing

Data Providing

GUI

API

Productivity Enhancements 

wget https://raw.githubusercontent.com/JoelGMSec/Cloudtopolis/master/Cloudtopolis.sh
chmod +x Cloudtopolis.sh
./Cloudtopolis.sh

Now it is possible to select additional options!

AllwaysP100 = If selected, the script will not run unless the assigned GPU is a TESLA P100
Kaonashi = Will download Kaonashi.txt dictionary and OneRuleToRuleThemAll rule
Rockyou = Will download the dictionary rockyou.txt

To load them, it is only necessary to change "False" to "True" before starting the code from the notebook. 
By default, only Rockyou is selected to load at startup.

VBScript minifier

• Remove extra whitespace
  • Trailing whitespace
  • Leading whitespace
  • Blank lines
  • Inline extra spaces
• Remove comments
  • Single quote (start of the line)
  • Single quote (inline)
  • REM
• One-line
  • Line splitting (underscore)
  • Colon

$ gem install vbsmin

$ vbsmin samples/features.vbs
Original file size: 344 bytes
Minified file size: 244 bytes
Size saved: 100 bytes

Original file path: samples/features.vbs
Minified file path: samples/features.min.vbs

require 'vbsmin'

vm = VBSMin.new
vm.minify('samples/features.vbs')

' Get WMI Object.
On Error Resume Next
Set objWbemLocator = CreateObject _
  ("WbemScripting.SWbemLocator")

if Err.Number Then
  REM Display error
  WScript.Echo vbCrLf & "Error # " & _
               " " & Err.Description
End If
On Error GoTo 0 

On Error Resume Next:Set objWbemLocator = CreateObject ("WbemScripting.SWbemLocator"):if Err.Number Then:WScript.Echo vbCrLf & "Error # " & " " & Err.Description:End If:On Error GoTo 0

• SQLi: when having a SQLi with write permission, you can write some files on the system, but some DBMS like PostgreSQL doesn't support newlines in an insert statement so you have to be able to write a one-line payload
• File size:
  • in XSS or Word macro to get the more short and stealthy payload or even to bypass security mechanism based on length or size.
  • for performance or file upload limit

git clone https://github.com/thelinuxchoice/screenspy
cd screenspy
bash screenspy.sh

1. sudo python3 espionage.py --normal --iface wlan0 -f capture_output.pcap
   Command 1 will execute a clean packet sniff and save the output to the pcap file provided. Replace wlan0 with whatever your network interface is.
2. sudo python3 espionage.py --verbose --iface wlan0 -f capture_output.pcap
   Command 2 will execute a more detailed (verbose) packet sniff and save the output to the pcap file provided.
3. sudo python3 espionage.py --normal --iface wlan0
   Command 3 will still execute a clean packet sniff however, it will not save the data to a pcap file. Saving the sniff is recommended.
4. sudo python3 espionage.py --verbose --httpraw --iface wlan0
   Command 4 will execute a verbose packet sniff and will also show raw http/tcp packet data in bytes.
5. sudo python3 espionage.py --target <target-ip-address> --iface wlan0
   Command 5 will ARP spoof the target ip address and all data being sent will be routed back to the attackers machine (you/localhost).
6. sudo python3 espionage.py --iface wlan0 --onlyhttp
   Command 6 will only display sniffed packets on port 80 utilizing the HTTP protocol.
7. sudo python3 espionage.py --iface wlan0 --onlyhttpsecure
   Command 7 will only display sniffed packets on port 443 utilizing the HTTPS (secured) protocol.
8. sudo python3 espionage.py --iface wlan0 --urlonly
   Command 8 will only sniff and return sniffed urls visited by the victum. (works best with sslstrip).

• Press Ctrl+C in-order to stop the packet interception and write the output to file.

usage: espionage.py [-h] [--version] [-n] [-v] [-url] [-o] [-ohs] [-hr] [-f FILENAME] -i IFACE
                    [-t TARGET]

optional arguments:
  -h, --help            show this help message and exit
  --version             returns the packet sniffers version.
  -n, --normal          executes a cleaner interception, less sophisticated.
  -v, --verbose         (recommended) executes a more in-depth packet interception/sniff.
  -url, --urlonly       only sniffs visited urls using http/https.
  -o, --onlyhttp        sniffs only tcp/http data, returns urls visited.
  -ohs, --onlyhttpsecure
                        sniffs only https data, (port 443).
  -hr, --httpraw        displays raw packet data (byte order) recieved or sent on port 80.

(Recommended) arguments for data output (.pcap):
  -f FILENAME, --filename FILENAME
                        name of file to store the output (make extension '.pcap').

(Required) arguments required for execution:
  -i IFACE, --iface IFACE
                        specify network interface (ie. wlan0, eth0, wlan1, etc.)

(ARP Spoofing) required arguments in-order to use the ARP Spoofing utility:
  -t TARGET, --target TARGET

• realistic churn behavior
• variable bot behavior
• monitoring mechanisms (crawlers and sensors)
• anti-monitoring mechanisms

pip install dash==1.2.0      # The core dash backend
pip install dash-daq==0.1.0  # DAQ components (newly open-sourced!)

pip install networkx

make MODE=release all 

../BSF -r 0 -m -u Cmdenv -c SampleConfig_Crawler -n .. samples.ini

** Event #577792   t=64831.46985369179   Elapsed: 4.21157s (0m 04s)  37% completed  (37% total)
     Speed:     ev/sec=180486   simsec/sec=14682   ev/simsec=12.293
     Messages:  created: 406512   present: 2108   in FES: 487
Just crawled: 24 nodes at 88983.25891616358
Just crawled: 40 nodes at 92583.25891616358
** Event #1050880   t=93607.74036896409   Elapsed: 6.28757s (0m 06s)  54% completed  (54% total)
     Speed:     ev/sec=227885   simsec/sec=13861.4   ev/simsec=16.4402
     Messages:  created: 729732   present: 2106   in FES: 630
Just crawled: 108 nodes at 96183.25891616358
Just crawled: 286 nodes at 99783.25891616358
Just crawled: 570 nodes at 103383.25891616358

• python3 and Ngrok support.
• Automatically Xor encrypting with custum KEY that you can use for increasing bypass Av.
• Automatically Add Icon to executable.
• Automatically Add Manifest to executable.
• Bypass anti-virus backdoors with pure raw and xor.
• Support os windows 7 to windows 10.
• Fully Automating MSFvenom & Metasploit.
• custum icon (copy your icon to icon folder and rename it to icon.ico)
• add PowerShell to silent executable.
• bypass Top Antivirus like BitDefender,Malwarebytes,Avast,ESET-NOD32,AVG,...

• Add Right To Left unicode (Rtlo Attack) - Example: Xegpj.exe => Xeexe.jpg
• Add Random sign to Xeexe binary For Persistence FUD
• ...

git clone https://github.com/persianhydra/Xeexe-TopAntivirusEvasion.git
cd Xeexe-TopAntivirusEvasion
chmod +x install.sh && ./install.sh
chmod +x Xeexe.py && python3 Xeexe.py

• Metasploit Framework
• msfvenom
• Wine
• Mingw-w64 Compiler

1. kube-bench implements the CIS Kubernetes Benchmark as closely as possible. Please raise issues here if kube-bench is not correctly implementing the test as described in the Benchmark. To report issues in the Benchmark itself (for example, tests that you believe are inappropriate), please join the CIS community.
   
2. There is not a one-to-one mapping between releases of Kubernetes and releases of the CIS benchmark. See CIS Kubernetes Benchmark support to see which releases of Kubernetes are covered by different releases of the benchmark.
   
3. It is impossible to inspect the master nodes of managed clusters, e.g. GKE, EKS and AKS, using kube-bench as one does not have access to such nodes, although it is still possible to use kube-bench to check worker node configuration in these environments.
   

• run kube-bench from inside a container (sharing PID namespace with the host)
• run a container that installs kube-bench on the host, and then run kube-bench directly on the host
• install the latest binaries from the Releases page,
• compile it from source.

kube-bench master

kube-bench node --version 1.13

kube-bench node --benchmark cis-1.4

kube-bench --benchmark cis-1.4 run --targets master,node

kube-bench --benchmark cis-1.5 run --targets master,node,etcd,policies

docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -t aquasec/kube-bench:latest [master|node] --version 1.13

Note: the tests require either the kubelet or kubectl binary in the path in order to auto-detect the Kubernetes version. You can pass -v $(which kubectl):/usr/local/mount-from-host/bin/kubectl to resolve this. You will also need to pass in kubeconfig credentials. For example:

docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -v $(which kubectl):/usr/local/mount-from-host/bin/kubectl -v ~/.kube:/.kube -e KUBECONFIG=/.kube/config -t aquasec/kube-bench:latest [master|node] 

docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -t -v path/to/my-config.yaml:/opt/kube-bench/cfg/config.yam -v $(which kubectl):/usr/local/mount-from-host/bin/kubectl -v ~/.kube:/.kube -e KUBECONFIG=/.kube/config aquasec/kube-bench:latest [master|node]

$ kubectl apply -f job.yaml
job.batch/kube-bench created

$ kubectl get pods
NAME                      READY   STATUS              RESTARTS   AGE
kube-bench-j76s9   0/1     ContainerCreating   0          3s

# Wait for a few seconds for the job to complete
$ kubectl get pods
NAME                      READY   STATUS      RESTARTS   AGE
kube-bench-j76s9   0/1     Completed   0          11s

# The results are held in the pod's logs
kubectl logs kube-bench-j76s9
[INFO] 1 Master Node Security Configuration
[INFO] 1.1 API Server
...

1. Create an AKS cluster(e.g. 1.13.7) with RBAC enabled, otherwise there would be 4 failures
   
2. Use the [kubectl-enter plugin] (https://github.com/kvaps/kubectl-enter) to shell into a node kubectl-enter {node-name} or ssh to one agent node could open nsg 22 port and assign a public ip for one agent node (only for testing purpose)
   
3. Run CIS benchmark to view results:
   

docker run --rm -v `pwd`:/host aquasec/kube-bench:latest install
./kube-bench node

1. To create an EKS Cluster refer to Getting Started with Amazon EKS in the Amazon EKS User Guide

• Information on configuring eksctl, kubectl and the AWS CLI is within

2. Create an Amazon Elastic Container Registry (ECR) repository to host the kube-bench container image

aws ecr create-repository --repository-name k8s/kube-bench --image-tag-mutability MUTABLE

3. Download, build and push the kube-bench container image to your ECR repo

git clone https://github.com/aquasecurity/kube-bench.git
cd kube-bench
aws ecr get-login-password --region <AWS_REGION> | docker login --username <AWS_USERNAME> --password-stdin <AWS_ACCT_NUMBER>.dkr.ecr.<AWS_REGION>.amazonaws.com
docker build -t k8s/kube-bench .
docker tag k8s/kube-bench:latest <AWS_ACCT_NUMBER>.dkr.ecr.<AWS_REGION>.amazonaws.com/k8s/kube-bench:latest
docker push <AWS_ACCT_NUMBER>.dkr.ecr.<AWS_REGION>.amazonaws.com/k8s/kube-bench:latest

4. Copy the URI of your pushed image, the URI format is like this: <AWS_ACCT_NUMBER>.dkr.ecr.<AWS_REGION>.amazonaws.com/k8s/kube-bench:latest
5. Replace the image value in job-eks.yaml with the URI from Step 4
6. Run the kube-bench job on a Pod in your Cluster: kubectl apply -f job-eks.yaml
7. Find the Pod that was created, it should be in the default namespace: kubectl get pods --all-namespaces
8. Retrieve the value of this Pod and output the report, note the Pod name will vary: kubectl logs kube-bench-<value>

• You can save the report for later reference: kubectl logs kube-bench-<value> > kube-bench-report.txt

docker run --rm -v `pwd`:/host aquasec/kube-bench:latest install

go get github.com/aquasecurity/kube-bench
cd $GOPATH/src/github.com/aquasecurity/kube-bench
go build -o kube-bench .

# See all supported options
./kube-bench --help

# Run all checks
./kube-bench

kubectl apply -f job-gke.yaml

• [PASS] and [FAIL] indicate that a test was run successfully, and it either passed or failed.
• [WARN] means this test needs further attention, for example it is a test that needs to be run manually.
• [INFO] is informational output that needs no further action.

• If the test is Manual, this always generates WARN (because the user has to run it manually)
• If the test is Scored, and kube-bench was unable to run the test, this generates FAIL (because the test has not been passed, and as a Scored test, if it doesn't pass then it must be considered a failure).
• If the test is Not Scored, and kube-bench was unable to run the test, this generates WARN.
• If the test is Scored, type is empty, and there are no test_items present, it generates a WARN.

  checks:
  - id: 2.1.1
    text: "Ensure that the --allow-privileged argument is set to false (Scored)"
    type: "skip"
    scored: true

• Please spend a small amount of time giving due diligence to the issue tracker. Your issue might be a duplicate.
• Open a new issue if a duplicate doesn't already exist.
• Note the version of kube-bench you are running (from kube-bench version) and the command line options you are using.
• Note the version of Kubernetes you are running (from kubectl version or oc version for OpenShift).
• Set -v 10 --logtostderr command line options and save the log output. Please paste this into your issue.
• Remember users might be searching for your issue in the future, so please give it a meaningful title to help others.

• Open a new issue.
• Remember users might be searching for your issue in the future, so please give it a meaningful title to helps others.
• Clearly define the use case, using concrete examples. For example, I type this and kube-bench does that.
• If you would like to include a technical design for your feature please feel free to do so.

• Your PR is more likely to be accepted if it focuses on just one change.
• Please include a comment with the results before and after your change.
• Your PR is more likely to be accepted if it includes tests. (We have not historically been very strict about tests, but we would like to improve this!).
• You're welcome to submit a draft PR if you would like early feedback on an idea or an approach.
• Happy coding!