Adblock Detected

Faraday V3.5 - Collaborative Penetration Exam In Addition To Vulnerability Management Platform

Reviewed by 0x000216 on Monday, September 23, 2019 Rating: 5

Faraday V3.5 - Collaborative Penetration Exam In Addition To Vulnerability Management Platform

Read

Here’s the principal novel features in addition to improvements inwards Faraday v3.5:

New vulnerability form

2nd-factor authentication
We added the optional characteristic for 2nd-factor authentication. You tin move operate whatever mobile application to operate our 2nd-factor authentication.

Download Faraday v3.5

Faraday V3.5 - Collaborative Penetration Exam In Addition To Vulnerability Management Platform

Reviewed by 0x000216 on Monday, September 23, 2019 Rating: 5

Spaghetti: A Website Applications Security Scanner

Read

About Spaghetti
Author: m4ll0k

Github: m4ll0k
Twitter: m4ll0k

Spaghetti is an Open Source web application scanner, it is designed to find various default and insecure files, configurations, and misconfigurations. Spaghetti is built on Python 2.7 and can run on any platform which has a Python environment.

Spaghetti Installation:

Spaghetti's Features:
Fingerprints:

Server:
Web Frameworks (CakePHP,CherryPy,...)
Web Application Firewall (Waf)
Content Management System (CMS)
Operating System (Linux,Unix,..)
Language (PHP,Ruby,...)
Cookie Security

Discovery:

Bruteforce:Admin Interface
Common Backdoors
Common Backup Directory
Common Backup File
Common Directory
Common FileLog File
Disclosure: Emails, Private IP, Credit Cards

Attacks:

HTML Injection
SQL Injection
LDAP Injection
XPath Injection
Cross Site Scripting (XSS)
Remote File Inclusion (RFI)
PHP Code Injection

Other:

HTTP Allow Methods
HTML Object
Multiple Index
Robots Paths
Web Dav
Cross Site Tracing (XST)
PHPINFO
.Listing

Vulns:

ShellShock
Anonymous Cipher (CVE-2007-1858)
Crime (SPDY) (CVE-2012-4929)
Struts-Shock

Spaghetti Example:
python spaghetti --url example.com --scan 0 --random-agent --verbose

Download Spaghetti

Spaghetti: A Website Applications Security Scanner

Reviewed by 0x000216 on Sunday, September 22, 2019 Rating: 5

Faraday V3.6 - Collaborative Penetration Exam As Well As Vulnerability Management Platform

Read

Here are the master copy novel features together with improvements inwards Faraday v3.6:

Welcome Service Now
H5N1 novel agency to post vulnerabilities is available! We integrated Faraday amongst Service Now, giving you lot to a greater extent than options to operate with.

Burp plugin was totally revamped
We accept been working difficult to brand several changes to get upward your daily workflow:

Burp plugin that uses the Faraday server API, then you lot don't accept to occupation the GTK client
The plugin was rewritten inwards Java
We added 2FA back upward to increase security

We empowered Jira integration
Can you lot imagine sending multiple vulns to Jira without filling the shape out every time? With Faraday v3.6 at 1 time you lot can!

With this integration, you lot don’t accept to connect your Jira credentials every fourth dimension you lot occupation it, merely produce it 1 time together with you’re ready to go. You likewise accept the choice to override default settings together with switch projects or username.

Jira is 1 of our most of import integrations together with nosotros desire to assistance you lot to teach the most out of it.

Learn to a greater extent than virtually your vulns to mitigate them better

In this novel version, nosotros added to a greater extent than fields to enrich the Vulnerability Templates, hopefully improving an of import purpose of your daily workflow. This novel characteristic allows you lot to accept all the information you lot postulate inwards 1 place.

Added fields

'impact',
'easeofresolution'
'policyviolations'

Other plugins updated inwards this version

Netsparkers
SQLMap
Dnsmap
SSLyze
Nessus
Goohost

Download Faraday v3.6

Faraday V3.6 - Collaborative Penetration Exam As Well As Vulnerability Management Platform

Reviewed by 0x000216 on Friday, September 20, 2019 Rating: 5

Faraday V3.6 - Collaborative Penetration Exam As Well As Vulnerability Management Platform

Read

Here are the master copy novel features together with improvements inwards Faraday v3.6:

Welcome Service Now
H5N1 novel agency to post vulnerabilities is available! We integrated Faraday amongst Service Now, giving you lot to a greater extent than options to operate with.

Burp plugin was totally revamped
We accept been working difficult to brand several changes to get upward your daily workflow:

Burp plugin that uses the Faraday server API, then you lot don't accept to occupation the GTK client
The plugin was rewritten inwards Java
We added 2FA back upward to increase security

'impact',
'easeofresolution'
'policyviolations'

Other plugins updated inwards this version

Netsparkers
SQLMap
Dnsmap
SSLyze
Nessus
Goohost

Download Faraday v3.6

Faraday V3.6 - Collaborative Penetration Exam As Well As Vulnerability Management Platform

Reviewed by 0x000216 on Friday, September 20, 2019 Rating: 5

Faraday V3.8 - Collaborative Penetration Examination As Well As Vulnerability Administration Platform

Read

Here are the principal novel features in addition to improvements inwards Faraday v3.8:

Set upwards Faraday alongside a double click!

We are committed to facilitate your operate processes. With that inwards mind, nosotros enhanced our installation phases, then directly it’s easier to bring Faraday on your devices: You tin download our platform alongside simply 2 clicks.

This is the rootage footstep on the difficult operate we’re doing to migrate our platform to Python 3 (In progress!).

Sailing downwind alongside Faraday on Docker!

Explore Faraday’s whole potential yesteryear testing it rootage alongside our novel Docker images. When you lot are ready, you lot tin download the whole matter to laid it upwards in addition to upgrade your Risk Management Ecosystem :)

More powerful than a viscous note!

To render value, information must live on complete, updated in addition to good focused.

Now, you lot tin enrich Vuln information yesteryear leaving Comments in addition to Notes, land mentioning other users to notify them nigh of import events inwards existent time. Also, you lot are directly able to configure alerts to follow upwards on each project, having a to a greater extent than efficient stance of their condition in addition to updates.

The thought behind this is promoting improve ways to instruct involved alongside your co-workers yesteryear improving communication in addition to daily results.

New setting options on Web UI!

Forget nigh logging inwards each fourth dimension you lot desire to post a Vuln to Jira or ServiceNOW. Just configure the ticketing tool you’ll live on using from the Settings carte du jour in addition to relish working seamlessly.

Download Faraday v3.8

Faraday V3.8 - Collaborative Penetration Examination As Well As Vulnerability Administration Platform

Reviewed by 0x000216 on Monday, September 09, 2019 Rating: 5

Faraday V3.8 - Collaborative Penetration Examination As Well As Vulnerability Administration Platform

Read

Here are the principal novel features in addition to improvements inwards Faraday v3.8:

Download Faraday v3.8

Faraday V3.8 - Collaborative Penetration Examination As Well As Vulnerability Administration Platform

Reviewed by 0x000216 on Monday, September 09, 2019 Rating: 5

Hacktronian: All in One Hacking Tools Installer For Linux And Android

Read

Hacktronian Installation
Termux users must install Python and Git first: pkg install git python
Then enter these commands: You can watch the full installation tutorial here:

Hacktronian Menu:

Information Gathering

Password Attacks

Wireless Testing

Exploitation Tools

Sniffing & Spoofing

Web Hacking

Private Web Hacking

Post Exploitation

Install The HACKTRONIAN

Information Gathering menu:

Nmap

SEToolkit

Port Scanning

Host To IP

wordpress user

CMS scanner

XSStrike Dork - Google Dorks Passive Vulnerability Auditor

Scan A server's Users Crips

Password Attacks menu:

Cupp

Ncrack

Wireless Testing menu:

Reaver

PixieWPS

Fluxion

Exploitation Tools menu:

ATSCAN

SQLMap

Shellnoob

commix

FTP Auto Bypass

jboss-autopwn

Sniffing and Spoofing menu:

SEToolkit

SSLtrip

pyPISHER

SMTP Mailer

Web Hacking menu:

Drupal Hacking

Inurlbr

Wordpress & Joomla Scanner

Gravity Form Scanner

File Upload Checker

Wordpress Exploit Scanner

Wordpress Plugins Scanner

Shell and Directory Finder

Joomla! 1.5 - 3.4.5 remote code execution

Vbulletin 5.X remote code execution

BruteX - Automatically brute force all services running on a target

Arachni - Web Application Security Scanner Framework

Private Web Hacking:

Get all websites

Get joomla websites

Get wordpress websites

Control Panel Finder

Zip Files Finder

Upload File Finder

Get server users

SQli Scanner

Ports Scan (range of ports)

ports Scan (common ports)

Get server Info

Bypass Cloudflare

Post Exploitation:

Shell Checker

POET

Weeman

Hacktronian's License: MIT Licence

That's It... If You Like This Repo. Please Share This With Your Friends. And Don't Forget To Follow The Author At Twitter, Instagram, Github & SUBSCRIBE His YouTube Channel!!!

Thank you. Keep Visiting.. Enjoy.!!! :)

Download Hacktronian

Hacktronian: All in One Hacking Tools Installer For Linux And Android

Reviewed by 0x000216 on Thursday, September 05, 2019 Rating: 5

OWASP-ZSC: A Shellcode/Obfuscate Customized Code Generating Tool

Read

About OWASP-ZSC
OWASP ZSC is open source software written in python which lets you generate customized shellcodes and convert scripts to an obfuscated script. This software can be run on Windows/Linux/OSX with Python 2 or 3.

What is shellcode?: Shellcode is a small codes in Assembly language which could be used as the payload in software exploitation. Other usages are in malwares, bypassing antiviruses, obfuscated codes...

You can read more about OWASP-ZSC in these link:

OWASP ZSC Tool Project - OWASP
Document: OWASP ZSC · GitBook (Legacy)
Home page: OWASP ZSC | OWASP ZCR Shellcoder
Features: OWASP ZSC | OWASP ZCR Shellocder Available Features
Archive: ZCR-Shellcoder-Archive
Mailing List: Google Groups
API: api.z3r0d4y.com

Why use OWASP-ZSC?
Another good reason for obfuscating files or generating shellcode with OWASP-ZSC is that it can be used during your pen-testing. Malicious hackers use these techniques to bypass anti-virus and load malicious files in systems they have hacked using customized shellcode generators. Anti-virus work with signatures in order to identify harmful files. When using very well known encoders such as msfvenom, files generated by this program might be already flagged by Anti-virus programs.

Our purpose is not to provide a way to bypass anti-virus with malicious intentions, instead, we want to provide pen-testers a way to challenge the security provided by Anti-virus programs and Intrusion Detection systems during a pen test.In this way, they can verify the security just as a black-hat will do.

According to other shellcode generators same as Metasploit tools and etc, OWASP-ZSC using new encodes and methods which antiviruses won't detect. OWASP-ZSC encoders are able to generate shell codes with random encodes and that allows you to generate thousands of new dynamic shellcodes with the same job in just a second, that means, you will not get the same code if you use random encodes with same commands, And that make OWASP-ZSC one of the best! During the Google Summer of Code we are working on to generate Windows Shellcode and new obfuscation methods. We are working on the next version that will allow you to generate OSX.

OWASP-ZSC Installation:
You must install Metasploit and Python 2 or 3 first:

For Debian-based distro users: sudo apt install python2 python3 metasploit-framework
For Arch Linux based distro users: sudo pacman -S python2 python3 metasploit
For Windows users: Download Python and Metasploit here.

And then, enter these command (If you're Windows user, don't enter sudo):
DISCLAIMER: THIS SOFTWARE WAS CREATED TO CHALLENGE ANTIVIRUS TECHNOLOGY, RESEARCH NEW ENCRYPTION METHODS, AND PROTECT SENSITIVE OPEN SOURCE FILES WHICH INCLUDE IMPORTANT DATA. CONTRIBUTORS AND OWASP FOUNDATION WILL NOT BE RESPONSIBLE FOR ANY ILLEGAL USAGE.

An example of OWASP-ZSC

Download OWASP-ZSC

OWASP-ZSC: A Shellcode/Obfuscate Customized Code Generating Tool

Reviewed by 0x000216 on Wednesday, September 04, 2019 Rating: 5

EHTools Framework: A Framework Of Serious Penetration Tools And Wi-Fi Pentesting

Read

About EHTools Framework
Wi-Fi tools keep getting more and more accessible to beginners, and the EHTools Framework is a framework of serious penetration tools that can be explored easily from within it. This powerful and simple tool can be used for everything from installing new add-ons to grabbing a WPA handshake in a matter of seconds. Plus, it's easy to install, set up, and utilize.

Why choice EHTools Framework?
Lots of pentesting tools installed by default: More than 58 options installed by default you can find in EHTools Framework such as Metasploit Framework, WireShark and other tools!

Password protection and config encryption: In version 2.1.6 the authors added pasword protection for users who think that his/her friend or parents will turn into EHTools Framework and will remove or destroy it. Only for this people the authors create password protection for EHTools Framework 🙂

Easy in learning and this is the best framework for beginners: EHTools Framework's TUI is very simple for beginners, you can start attack on the local network by choosing an option from main menu. It is very simple, is not it?

UX/UI impruvements for beginners: It uses the names you supply to connect to the tools needed to execute any attacks you select! Aside from that initial input, the majority of the possible attacks can be performed merely by choosing the option number from the menu. This means you can grab a network handshake or download a new hacking tool like Pupy by just selecting from one of the menu options!

More than 100 tools you can install from EHTools Framework or Lite: Our framework has more than 100 packages in EHTools Framework archive (on server this archive: 2.3 TB)!

System requirements for EHTools Framework
Full root access and access to /root folder: All EHTools Framework files and folders will copy to /root, /bin and /etc system folders, for copy ehtools data to your system needed root access!

Bourne-again shell and Gnome-terminal shell needed for EHTools Framework GUI and also without Gnome-terminall shell modules such as (eht1, eht2 and etc.) will not work!

Good internet connection for server support (only EHTools Framework Pro): The server support for ehtools PRO is one of system requirements, it is needed for collect information about EHTools Framework crashes and it is also needed for check product status such as (you bought ehtools/you did not buy ehtools)

EHTools Framework Installation

To uninstall EHTools Framework, enter this command: ehtools -r

How to activate EHTools Framework Pro
This key you can buy on the EHTools website for one dollar! This key is used to activate EHTools Framework PRO enter it in the input field of the activation key in the file install.sh and then you can install EHTools Framework and use it only for educational purposes!

WARNING: The key works only one week then it changes!
You need to have time to enter it before it is updated!

Enter your ehtools activation key!
You can buy it on the ehtools site!
(activation_key)>

Also, the the authors do not recommend to change the source code of ehtools because it is very complex and you can mess up something and disrupt the framework!

Selecting version of EHTools Framework
After executing install.sh it will be ask you to select version of EHTools Framework: Pro or Lite.
Select Lite if you did not buy EHTools Framework Pro. If you bought Ehtools Framework pro license key from EHTools website, select Pro.

What version of Ehtools Framework do you want to install?(pro/lite):
If you did not buy Ehtools Framework PRO, select LITE!
If you bought Ehtools Framework PRO, select PRO
(version)>

If you select EHTools Framework Pro, you will need to activate it with your EHTools Framework Activation Key that you need to bought on the EHTools website. If you have EHTools Framework Activation Key, read the following instructions.

Attacking Frameworks
Most new Wi-Fi hacking tools rely on many of the same underlying attacks, and scripts that automate using other more familiar tools like Aireplay-ng are often referred to as frameworks. These frameworks try to organize tools in smart or useful ways to take them a step beyond the functionality or usability of the original program.

An excellent example of this are programs that integrate scanning tools like Airodump-ng, attacks like WPS Pixie-Dust, and cracking tools like Aircrack-ng to create an easy-to-follow attack chain for beginners. Doing this makes the process of using these tools easier to remember and can be seen as sort of a guided tour. While each of these attacks is possible without the hand-holding, the result can be faster or more convenient than trying to do so yourself.

An example of this the authors have covered is the Airgeddon, a wireless attack framework that does useful things like automating the target selection process and eliminating the time a user spends copying and pasting information between programs. This saves valuable time for even experienced pentesters but has the disadvantage of preventing beginners from understanding what's happening "under the hood" of the attack. While this is true, most of these frameworks are fast, efficient, and dead simple to use, enabling even beginners to take on and disable an entire network.

UX/UI impruvements for beginners
The EHTools Framework starts by merely typing the letter ehtools or eht into a terminal window, then it asks for the name of your network interfaces after the first run. It uses the names you supply to connect to the tools needed to execute any attacks you select. Aside from that initial input, the majority of the possible attacks can be performed merely by choosing the option number from the menu. This means you can grab a network handshake or download a new hacking tool like Pupy by just selecting from one of the menu options.

Use basic networking tools
To begin, the we can access data about the network they're currently connected to, as well as any network interfaces, from the main menu. Here, we can find local information by just typing l to pull up local IP information, as seen below.

This allows us to do things like scan the network for other devices. This part of EHTools Framework gives us better visibility on a network and situational awareness of what devices are around us. The various information can be broken down as follows:

if: To run ifconfig and gives the names and information about all network devices
1: Enables wlan0
d1: Disables wlan0
2: Enables wlan0mon
d2: Disables wlan0mon
3: Randomize or set the MAC address to a specific value
7: View the public IP address your computer is leaving on sites you visit
19: Look up the physical address of a given IP address to determine it's relative location
scan: Start an ARP scan on the network to discover nearby devices
start: Start monitor mode on the wireless network adapter
stop: Stop wireless monitor mode on the network adapter

Use EHTools Framework quick access
Run it to open quick access menu: ehtools -o
Run it to update EHTools Framework: ehtools -u
Run it to remove EHTools Framework: ehtools -r
Run it to make handshake: ehtools -h
Run it to open WPS menu: ehtools -w

Install new tools on EHTools Framework
Part of the fun of Ehtools Framework is how easy it is to add new tools to our arsenal. To demonstrate this, let's download Pupy, a Python-based RAT designed to take control of other computers on the network. We can select option 9 to access the list of tools in EHTools Framework.

From the next menu, the tools are broken down into major categories, with options for managing the installation of scripts. The options presented are:

1: Wi-Fi tools (tools for attacking wireless networks and network databases)
2: Remote access (tools for getting remote access to other devices and remotely managing them)
3: Information gathering (collecting intelligence on people or website)
4: Website tools (tools for exploiting or attacking sites)
5: Other (a miscellaneous collection of other hacking tools)

You can also manage your installed tools by accessing option 6. To download Pupy, we'll go to option 2, which is remote access. Here, we will see a list of different tools for remote access, and we can select option 3 for Pupy.

About EHTools Framework server support
Server support for ehtools Pro is very important, as all error reports are sent to it in order to improve and fix vulnerabilities and bugs!

COUNCIL: Make a good internet connection for EHTools Framework, to help EHTools Framework access to server!

If in consequence of bad Internet connection EHTools Framework will not be able to communicate with the server then the framework will not start because of access denial and due to a validation error for check ehtools bought or not bought!

If there is the bad internet connection, EHTools Framework will say you this:
[*] There is no connection!

If you did not buy EHTools Framework, EHTools Framework will say you this:
[*] Failed to open session for ehtools!

How to protect EHTools Framework with password

Do it with install.sh: Create login and password from install.sh.
Defaults is login: ehtools, password: sloothe.

Do it when you are going to exit from EHTools Framework, exit with shortcuts:
0 or exit.

Do not do it when you are going to exit from EHTools Framework. WARNING: Do not just close EHTools Framework window!

Terms of use
This tool is only for educational purposes only.
Use this tool wisely and never without permission.
The authors are not responsible for anything you do with this tool.

Download EHTools Framework

EHTools Framework: A Framework Of Serious Penetration Tools And Wi-Fi Pentesting

Reviewed by 0x000216 on Wednesday, September 04, 2019 Rating: 5

NetSet: An Operational Security Utility And Automation Tool

Read

About NetSet
   NetSet is an Operational Security utility and automator (Version 1.1.0).
   NetSet is designed to automate a number of operations that will help the user with securing their network traffic. It also provides an easy way to gather proxies and run utilities through TOR.

   All the utilities installed and used by NetSet will be automatically configured as well. Of course the tool itself isn't the be all of Operational Security. Rather it is a convenient way of getting yourself set up with the basics.

   NetSet facilitates, among other things;
   A terminal multiplexer on demand, that has it's sessions routed through Tor. Secured DNS traffic through automatic installation and configuration of DNSCrypt-proxy. Tor Wall functionality that forces all traffic through the Tor Network. Easy access to online OPSEC resources, the web resources in question can be opened in-script

   And more.

NetSet's screenshots

NetSet Installer

NetSet Menu

NetSet Installation
NetSet Options
Update of NetSet
   From now on NetSet will install veracrypt and pwgen and provide automated operations related to those utilities on top of all the features Version 1.0.0 provides.

   Using sudo to start the script will execute every operation within the script as root, this means you won't be prompted for your sudo password when an operation requires elevated privileges. However all items written by NetSet will consequently be owned by root as well, including backup directories. Last but not least; when considering security implications, it is not recommended to run everything with super user privileges.

   Starting the main script with sudo will be optional from now on to reflect the above considerations.

Note of NetSet
   NetSet was tested on Ubuntu 19.04.
   NullArray plans on expanding this tool in the future with even more OPSEC related resources and/or operations.
   Should you happen to come across a bug or have any questions regarding this tool. Please feel free to Open a Ticket.
   Thank you.

Download NetSet

NetSet: An Operational Security Utility And Automation Tool

Reviewed by 0x000216 on Monday, August 26, 2019 Rating: 5

BlueKeep: A Proof Of Concept Tool For CVE-2019-0708 Called "Bluekeep"

Read

About Bluekeep PoC Tool
This tool contains research concerning CVE-2019-0708.
Bluekeep or CVE-2019-0708 is an RCE exploit that effects the following versions of Windows systems:

Windows 2003
Windows XP
Windows Vista
Windows 7
Windows Server 2008
Windows Server 2008 R2

   The vulnerability occurs during pre-authorization and has the potential to run arbitrary malicious code in the NT Authority\system user security context.

How CVE-2019-0708 "Bluekeep" works
   By sending a specially crafted packet an attacker is able to set the value for the Channel ID to something the RDP service isn't expecting, this causes a memory corruption bug that will create the conditions for Remote Code Execution to occur. Should the attacker choose to follow up with packets designed to take advantage of this flaw remote code execution can be achieved with System user privileges.

BlueKeep Installation and Using
   To use BlueKeep PoC, use this command:
python2 bluekeep_poc.py -i [target]

   And then, to perform a DoS attack through Bluekeep vulnerability, use this command:
python2 bluekeep_weaponized_dos.py -i [target] -v

Credits of BlueKeep PoC:
   Research by Ekultek and (VectorSEC)/NullArray.
   Development & Testing by Ekultek.

   Follow they on Twitter:

Ekultek
VectorSEC

In Closing: You can see some of they research, along with a list of potentially vulnerable targets under the research directory. They started with very little and decided that we weren't going to stop until we had a working exploit. Ekultek has been able to execute commands on Windows XP with this PoC personally.

Note: There are no payloads. This is just a PoC. HOWEVER it is easily ported to an exploit since you can easily add payloads to this.

Download BlueKeep PoC

BlueKeep: A Proof Of Concept Tool For CVE-2019-0708 Called "Bluekeep"

Reviewed by 0x000216 on Monday, August 26, 2019 Rating: 5

Spykeyboard: An Undetectable Python Keylogger Which Sends The Captured Keys To Your Gmail

Read

About Spykeyboard
Spykeyboard is a Python 2 script which allows us to generate an undetectable keylogger which sends the captured keys to our Gmail account address. Once we generated our keylogger, we would have to pass the .py file to a Windows machine to convert it to an .exe. The tool is in development.

Spykeyboard Installation and Running
For Windows users, you must in install Python 2 first, but you don't have to install Git if you want:

First, download and run Python 2.7.x setup file from Python.org. On Install Python 2.7.x Setup, choose Add python.exe to Path.
Download and run Git setup file from Git-scm.com and enable Use Git from Windows Command Propmt.

For Linux users, Python 2 is already installed on your GNU/Linux distro.

Then, open Terminal and enter these command to download Spykeyboard, install requirements, generate and convert .py keylogger file to .exe file to run in Windows.
Spykeyboard screenshots

Enter your Gmail address and password to generate keylogger

Compile .py keylogger file to .exe file

Download Spykeyboard