ADModule – Microsoft Signed ActiveDirectory PowerShell Module

ADModule is a Microsoft signed DLL for the ActiveDirectory PowerShell module.

Just a backup for the Microsoft’s ActiveDirectory PowerShell module from Server 2016 with RSAT and module installed. The DLL is usually found at this path: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ActiveDirectory.Management and the rest of the module files at this path: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ActiveDirectory\

Also ReadKillshot : Information gathering Tool

ADModule Usage

You can copy this DLL to your machine and use it to enumerate Active Directory without installing RSAT and without having administrative privileges.

PS C:> Import-Module C:\ADModule\Microsoft.ActiveDirectory.Management.dll -Verbose

To be able to list all the cmdlets in the module, import the module as well. Remember to import the DLL first.

PS C:> Import-Module C:\ADModule\Microsoft.ActiveDirectory.Management.dll -Verbose
PS C:> Import-Module C:\AD\Tools\ADModule\ActiveDirectory\ActiveDirectory.psd1
PS C:> Get-Command -Module ActiveDirectory

Benefits

There are many benefits like very low chances of detection by AV, very wide coverage by cmdlets, good filters for cmdlets, signed by Microsoft etc. The most useful one, however, is that this module works flawlessly from PowerShell’s Constrained Language Mode.

BFuzz – Fuzzing Chrome & Firefox Browsers

BFuzz is an input based fuzzer tool which take .html as an input, open’s up your browser with a new instance and pass multiple testcases generated by domato which is present in recurve folder of BFuzz, more over BFuzz is an automation which performs same task repeatedly.

Also ReadPython-Nubia : A Command-Line & Interactive Shell Framework

Run BFuzz

warmachine@ftw:~/BFuzz$ ./generate.sh
warmachine@ftw:~/BFuzz$ python BFuzz.py 
Enter the browser type:
 1: Chrome 
 2: Firefox
>>

Running python BFuzz.py will ask for option weather to fuzz Chrome or Firefox, however if selected 2 this will open Firefox firefox --new-instance and randomly open any of the testcase from recurve create the logs on the terminal wait for 3 seconds again it will open Firefox and the same process continue so on.

BFuzz is a small .py script which enables to open browser run testcase for 12 seconds then close wait for 3 seconds and again follow the same process.

Domato

The testcase’s in recurve are generated by domato generator.py contains the main script. It uses grammar.py as a library and contains additional helper code for DOM fuzzing.

grammar.py contains the generation engine that is mostly application-agnostic and can thus be used in other (i.e. non-DOM) generation-based fuzzers. As it can be used as a library, its usage is described in a separate section below.

.txt files contain grammar definitions. There are 3 main files, html.txt, css.txt and js.txt which contain HTML, CSS and JavaScript grammars, respectively. These root grammar files may include content from other files.

Video Tutorial

DarkSpiritz : A Penetration Testing Framework For Linux, MacOS, and Windows Systems

DarkSpiritz is a penetration testing framework for Linux and Windows systems. Created by the SynTel Team it was a project of one of the owners to update and clean-up an older pentesting framework he had created to something updated and modern.

It is a re-vamp of the very popular framework known as “Roxysploit”. You may be familiar with this framework and if you are then it will help you with it. It also works like another pentesting framework known as Metasploit.

If you know how to use metasploit setting up and working with it will be a breeze.

Also ReadPasteJacker : Hacking Systems With The Automation Of PasteJacking Attacks

DarkSpiritz Getting Started

Clone the repository with git:

git clone https://github.com/DarkSpiritz/DarkSpiritz.git

To install DarkSpiritz clone the github repo and run:

pip install -r requirements.txt

This will download all necessary modules for it. Once you run this you will be able to run:

python start.py

or

./start.py

(if ./start.py doesn’t work run chmod +x start.py from within the same directory as DarkSpiritz.)

You will see a start-up screen. This screen will display things like commands and configuration settings. You can set configuration settings inside the config.xml file itself or through commands in the DarkSpiritz shell.

Features:

These are features that Team prides them self on based on this program:

  • Real Time Updating of Configuration
  • Never a need to restart the program even when adding plugins or editing them.
  • Easy to use UX
  • Multi-functionality

Credit: Ryan & M4cs

Killshot : Information gathering Tool

KillShot is a Penetration Testing Framework, Information gathering tool & Website Vulnerability Scanner.

You Can use this tool to Spider your website and get important information and gather information automatically using whatweb-host-traceroute-dig-fierce-wafw00f or to Identify the cms and to find the vulnerability in your website using Cms Exploit Scanner && WebApp Vul Scanner Also You can use it to Scan automatically multiple type of scan with nmap and unicorn . And With this tool You can Generate PHP Simple Backdoors upload it manual and connect to the target using it.

This Tool Bearing A simple Ruby Fuzzer Tested on VULSERV.exe And Linux Log clear script To change the content of login paths Spider can help you to find parameter of the site and scan xss and sql.

Also ReadXSStrike – Most Advanced XSS Detection Suite

Killshot Menu

{0} Spider 
{1} Web technologie 
{2} WebApp Vul Scanner
{3} Port Scanner
{4} CMS Scanner
{5} Fuzzers 
{6} Cms Exploit Scanner
{7} Backdoor Generation
{8} Linux Log Clear

WebApp Vul Scanner

{1} Xss scanner
{2} Sql Scanner
{3} Tomcat RCE

Port Scanner

 [0] Nmap Scan
 [1] Unicorn Scan
Nmap Scan 
 [2] Nmap Os Scan 
 [3] Nmap TCP Scan
 [4] Nmap UDB Scan 
 [5] Nmap All scan
 [6] Nmap Http Option Scan 
 [7] Nmap Live target In Network
Unicorn Scan
[8] Services OS 
[9] TCP SYN Scan on a whole network 
[01] UDP scan on the whole network

Backdoor Generation

 {1} Generate Shell
 {2} Connect Shell

USAGE

1 ----- Help Command 
[site]  MAKE YOUR TARGET
[help] show this MESSAGE
[exit] show this MESSAGE
2 ------ Site command 
Put your target www.example.com
without the http

Linux Setup

git clone https://github.com/bahaabdelwahed/killshot
cd killshot
ruby setup.rb (if setup show any error just try to install the gems/tool manual )
ruby killshot.rb

Video Tutorial

PasteJacker : Hacking Systems With The Automation Of PasteJacking Attacks

PasteJacker the main purpose of the tool is automating (PasteJacking/Clipboard poisoning/whatever you name it) attack with collecting all the known tricks used in this attack in one place and one automated job as after searching I found there’s no tool doing this job the right way.

Now because this attack depends on what the user will paste, I implemented the Metasploit web-delivery module’s idea into the tool so when the user pastes into the terminal, you gets meterpreter session on his device.

In short, Pastejacking is a method that malicious websites employ to take control of your computers’ clipboard and change its content to something harmful without your knowledge.

So here what I did is automating the original attack and adding two other tricks to fool the user, using HTML and CSS Will talk about it then added meterpreter sessions as I said before.

Also ReadPython-Nubia : A Command-Line & Interactive Shell Framework

A simple scenario to make things clear:

  • The target opens an HTML page served by the tool and this page has anything that makes the user wants to copy from it and paste into the terminal. Ex: package installation instructions
  • Target copies anything from the page then in the background it gets replaced quickly with our liner.
  • The user pastes into the terminal and before he notices that the line he copied has been changed :
    • The line gets executed by itself in the background (Without pressing enter)
    • The terminal gets cleared.
    • The user sees the terminal is usable again.
    • You already got your meterpreter session by this time.
  • All of that happened in less than second and maybe the user thinks this is a bad program and he won’t install it.

This PasteJacker tool uses 3 methods to trick user into copying our payload instead of the command he copies:

  • Using javascript to hook the copy event and replace copied data.
    • Advantages :
      • Anything the user copies in the page will be replaced with our line.
      • Command executed by itself once target paste it without pressing enter.
    • Disadvantages :
      • Requires Javascript to be enabled on the target browser.
  • Using span style attribute to hide our lines by overwriting.
    • Advantages :
      • Doesn’t require javascript to be enabled.
      • Works on all browsers.
    • Disadvantages :
      • Target must select all the text in the page or the first two words to ensure that he copies our hidden malicious lines.
  • Using span style again but this time to make our text transparent and non-markable.
    • Advantages :
      • Doesn’t require javascript to be enabled.
    • Disadvantages :
      • Target must select all the text in the page to ensure that he copies our hidden malicious lines.
      • Not working on opera and chrome.
What’s the payload user copies ?

PasteJacker gives you the option to do one of this things:

  • Generate a msfvenom backdoor on our machine and the liner target gonna copy will download the backdoor on the its machine, through wget or certutil depends on the OS, then executes it on the background without printing anything to the terminal.
  • Serve a liner that gets you a reverse netcat connection on the target machine running in the background of course.
  • Serve your custom liner like Metasploit web-delivery payload with adding some touches to hide any possible output.

XSStrike – Most Advanced XSS Detection Suite

XSStrike is a Cross Site Scripting detection suite equipped with four hand written parsers, an intelligent payload generator, a powerful fuzzing engine and an incredibly fast crawler.

Instead of injecting payloads and checking it works like all the other tools do, it analyses the response with multiple parsers and then crafts payloads that are guaranteed to work with context analysis integrated with a fuzzing engine. Here are some examples of the payloads generated by it:

}]};(confirm)()//\
<A%0aONMouseOvER%0d=%0d[8].find(confirm)>z
</tiTlE/><a%0donpOintErentER%0d=%0d(prompt)``>z
</SCRiPT/><DETAILs/+/onpoINTERenTEr%0a=%0aa=prompt,a()//

Apart from that, it has crawling, fuzzing, parameter discovery, WAF detection capabilities as well. It also scans for DOM XSS vulnerabilities.

Also ReadPython-Nubia : A Command-Line & Interactive Shell Framework

XSStrike Gallery

DOM XSS

Reflected XSS

Crawling

Hidden Parameter Discovery

Interactive HTTP Headers Prompt

Python-Nubia : A Command-Line & Interactive Shell Framework

Python-Nubia is a lightweight framework for building command-line applications with Python. It was originally designed for the “logdevice interactive shell (aka. ldshell)” at Facebook. Since then it was factored out to be a reusable component and several internal Facebook projects now rely on it as a quick and easy way to get an intuitive shell/cli application without too much boilerplate.

Nubia is built on top of python-prompt-toolkit which is a fantastic toolkit for building interactive command-line applications.

Python-Nubia Features

  • Interactive mode that offers fish-style auto-completion
  • CLI mode that gets generated from your functions and classes.
  • Optional bash/zsh completions via an external utility ‘nubia-complete’ (experimental)
  • A customisable status-bar in interactive mode.
  • An optional IPython-based interactive shell
  • Arguments with underscores are automatically hyphenated
  • Python3 type annotations are used for input type validation

Also ReadWinspy – Windows Reverse Shell Backdoor Creator With An Automatic IP Poisener

Interactive mode

The interactive mode in Nubia is what makes it unique. It is very easy to build a unique shell for your program with zero overhead. The interactive shell in its simplistic form offers automatic completions for commands, sub-commands, arguments, and values. It also offers a great deal of control for developers to take control over auto-completions, even for commands that do not fall under the typical format. An example is the “select” command in ldshell which is expressed as a SQL-query. We expect that most use cases of Nubia will not need such control and the AutoCommand will be enough without further customisation.

If you start a nubia-based program without a command, it automatically starts an interactive shell. The interactive mode looks like this:

Non-interactive mode

The CLI mode works exactly like any traditional unix-based command line utility.

Installing Nubia

If you are installing nubia for your next project, you should be able to easily use pip for that:

pip3 install python-nubia

Building Nubia from source

Ensure is pipenv installed:

pip3 install pipenv

You can either setup.py to build a tarball, or use pipenv to setup a virtualenv with all the dependencies installed.

Running example in virtualenv:

If you would like to run the example, then you need to add the root of the source tree into your PYTHONPATH.

pipenv update --dev
pipenv shell

export PYTHONPATH="$(pwd)"
cd example/
python nubia_example.py

To run the unit tests:

pipenv run nosetests

Examples

It starts with a function like this:

import socket
import typing

from termcolor import cprint
from nubia import argument, command, context

@command
@argument("hosts", description="Hostnames to resolve", aliases=["i"])
@argument("bad_name", name="nice", description="testing")
def lookup(hosts: typing.List[str], bad_name: int):
    """
    This will lookup the hostnames and print the corresponding IP addresses
    """
    ctx = context.get_context()
    print(f"hosts: {hosts}")
    cprint(f"Verbose? {ctx.verbose}")

    for host in hosts:
        cprint(f"{host} is {socket.gethostbyname(host)}")

    # optional, by default it's 0
    return 0

Disclaimer

Nubia is beta for non-ldshell use-cases. Some of the design decisions might sound odd but they fit the ldshell usecase perfectly. We are continuously making changes to make it more consistent and generic outside of the ldshell use-case. Until a fully stable release is published, use it on your own risk.

Slither – Static Analyzer for Solidity

Slither is a Solidity static analysis framework written in Python 3. It runs a suite of vulnerability detectors, prints visual information about contract details, and provides an API to easily write custom analyses. Slither enables developers to find vulnerabilities, enhance their code comphrehension, and quickly prototype custom analyses.

Slither Features

  • Detects vulnerable Solidity code with low false positives
  • Identifies where the error condition occurs in the source code
  • Easy integration into continuous integration and Truffle builds
  • Built-in ‘printers’ quickly report crucial contract information
  • Detector API to write custom analyses in Python
  • Ability to analyze contracts written with Solidity >= 0.4
  • Intermediate representation enables simple, high-precision analyses

Also Readct-exposer : An OSINT Tool That Discovers Sub-Domains By Searching Certificate Transparency Logs

Usage

Run Slither on a Truffle application:

truffle compile
slither .

Run Slither on a single file:

$ slither tests/uninitialized.sol # argument can be file, folder or glob, be sure to quote the argument when using a glob
[..]
INFO:Detectors:Uninitialized state variables in tests/uninitialized.sol, Contract: Uninitialized, Vars: destination, Used in ['transfer']
[..]

If Slither is run on a directory, it will run on every .sol file in the directory.

Configuration

  • --solc SOLC: Path to solc (default ‘solc’)
  • --solc-args SOLC_ARGS: Add custom solc arguments. SOLC_ARGS can contain multiple arguments
  • --disable-solc-warnings: Do not print solc warnings
  • --solc-ast: Use the solc AST file as input (solc file.sol --ast-json > file.ast.json)
  • --json FILE: Export results as JSON

Detectors

By default, all the detectors are run.

Num Detector What it Detects Impact Confidence
1 suicidal Suicidal functions High High
2 uninitialized-state Uninitialized state variables High High
3 uninitialized-storage Uninitialized storage variables High High
4 arbitrary-send Functions that send ether to arbitrary destinations High Medium
5 reentrancy Reentrancy vulnerabilities High Medium
6 locked-ether Contracts that lock ether Medium High
7 tx-origin Dangerous usage of tx.origin Medium Medium
8 assembly Assembly usage Informational High
9 constable-states State variables that could be declared constant Informational High
10 external-function Public function that could be declared as external Informational High
11 low-level-calls Low level calls Informational High
12 naming-convention Conformance to Solidity naming conventions Informational High
13 pragma If different pragma directives are used Informational High
14 solc-version Old versions of Solidity (< 0.4.23) Informational High
15 unused-state Unused state variables Informational High

Printers

To run a printer, use --printers and a comma-separated list of printers.

Num Printer Description
1 call-graph Export the call-graph of the contracts to a dot file
2 contract-summary Print a summary of the contracts
3 function-summary Print a summary of the functions
4 inheritance Print the inheritance relations between contracts
5 inheritance-graph Export the inheritance graph of each contract to a dot file
6 slithir Print the slithIR representation of the functions
7 vars-and-auth Print the state variables written and the authorization of the functions

Installation

Slither requires Python 3.6+ and solc, the Solidity compiler.

Using Pip

$ pip install slither-analyzer

Using Git

$ git clone https://github.com/trailofbits/slither.git && cd slither
$ python setup.py install 

HttpLab : The Interactive Web Server

HttpLab is the interactive web server. HTTPLabs let you inspect HTTP requests and forge responses.

HttpLab

HttpLab Installation

Golang

go get github.com/gchaincl/httplab
go install github.com/gchaincl/httplab/cmd/httplab

Archlinux

yaourt httplab

FIXME

On systems where snap is supported:

snap install httplab

Also ReadWinspy – Windows Reverse Shell Backdoor Creator With An Automatic IP Poisener

Help

Usage of httplab:
  -a, --auto-update       Auto-updates response when fields change. (default true)
  -b, --body string       Specifies the inital response body. (default "Hello, World")
  -c, --config string     Specifies custom config path.
      --cors              Enable CORS.
      --cors-display      Display CORS requests. (default true)
  -d, --delay int         Specifies the initial response delay in ms.
  -H, --headers strings   Specifies the initial response headers. (default [X-Server:HTTPLab])
  -p, --port int          Specifies the port where HTTPLab will bind to. (default 10080)
  -s, --status string     Specifies the initial response status. (default "200")
  -v, --version           Prints current version.

Key Bindings

Key Description
Tab Next Input
Shift+Tab Previous Input
Ctrl+a Apply Response changes
Ctrl+r Resets Request history
Ctrl+s Save Response as
Ctrl+f Save Request as
Ctrl+l Toggle Responses list
Ctrl+t Toggle Response builder
Ctrl+o Open Body file
Ctrl+b Switch Body mode
Ctrl+h Toggle Help
Ctrl+w Toggle line wrapping
q Close popup
PgUp Previous Request
PgDown Next Request
Ctrl+c Quit

HTTPLab uses file to store pre-built responses, it will look for a file called .httplab on the current directory if not found it will fallback to $HOME.

Telebix – Telebix is an application that communicates with a Bot on the Telegram to receive commands and send information from an infrastructure monitored by Zabbix

Telebix is an application that communicates with a Bot on the Telegram to receive commands and send information from an infrastructure monitored by Zabbix, which also sends messages in real time if any problems occur in the infrastructure, it is totally written in Python with Shell Script and has a graphical interface to help the network administrator more intuitively. The application can run on any computer as long as all credentials are properly posted.

How to use Telebix ?

  • Creating a bot

  • In the search bar on Telegram, type “BotFather” and send the command “/newbot”.
  • The BotFather will ask for a name for your bot, after it will ask for a username as well.
  • Copy the generated access Token.
  • Send any message to your bot by Telegram.

Also Readct-exposer : An OSINT Tool That Discovers Sub-Domains By Searching Certificate Transparency Logs

Installation

git clone https://github.com/Warflop/Telebix.git
cd Telebix
chmod +x setup.sh
sudo ./setup.sh --install

Video Tutorial

Configuration

  • In the Settings tab are the fields to be populated with the Zabbix login information, bot token and Telegram user ID (or Group ID).
  • The token you already have after creating the Bot.
  • To get the user ID you can use the “GET ID” button in the settings tab after talking to the bot or add manually, access the address below by changing TOKENHERE by the token you copied, there will be your user ID.
  • You can use the ID of any group that you are entered as well. https://api.telegram.org/botTOKENHERE/getUpdates