Categories: Kali Linux

Tangalanga : The Zoom Conference Scanner Hacking Tool

Tangalanga is a Zoom Conference scanner. This scanner will check for a random meeting id and return information if available.

Install

First try to see if there’s any prebaked version for the date: https://github.com/elcuervo/tangalanga/releases.
This versions already have a token ready to use.
Either way you can find the Windows, Linux and Mac version on Releases https://github.com/elcuervo/tangalanga/releases.
Download, uncompress and enjoy.

Usage

This are all the possible flags:

tangalanga \

-token=user-token \ # [default: env TOKEN] user token to use.
-colors=false \ # [default: true] enable/disable colors
-censor=true \ # [default: false] censors output
-output=history \ # [default: stdout] write found meetings to file
-debug=true \ # [default: false] show all the attmpts
-tor=true \ # [default: false] enable tor connection (will use default socks proxy)
-hidden=true \ # [default: false] enable embedded tor connection (only linux)
-rate=7 \ # [default: ncpu] overwrite the default worker pool
-proxy=socks5://… \ # [default: socks5://127.0.0.1:9150] proxy url to use

Tokens

Unfortunately I couldn’t find the way the tokens are being generated but the core concept is that the zpk cookie key is being sent during a Join will be usable for ~24 hours before expiring. This makes trivial to join several known meetings, gether some tokens and then use them for the scans.

Tokens can be sniffed after a join attempt to a meeting. This means that to “fish” a token you’ll need a setup that can sniff traffic and also spoof certificates.

Using Wireshark, Charles or any other of the ssl-proxying-capable tools out there will do the trick.

TOR (only linux)

Tangalanga has a tor runtime embedded so it can connect to the onion network and run the queries there instead of exposing your own ip.

For any other system I recommend a VPN

Why the bizarre name?

This makes reference to a famous 80s/90s personality in the Rio de la Plata. Doctor Tangalanga who loved to do phone pranks.

R K

Recent Posts

Kali Linux 2024.4 Released, What’s New?

Kali Linux 2024.4, the final release of 2024, brings a wide range of updates and…

18 hours ago

Lifetime-Amsi-EtwPatch : Disabling PowerShell’s AMSI And ETW Protections

This Go program applies a lifetime patch to PowerShell to disable ETW (Event Tracing for…

18 hours ago

GPOHunter – Active Directory Group Policy Security Analyzer

GPOHunter is a comprehensive tool designed to analyze and identify security misconfigurations in Active Directory…

3 days ago

2024 MITRE ATT&CK Evaluation Results – Cynet Became a Leader With 100% Detection & Protection

Across small-to-medium enterprises (SMEs) and managed service providers (MSPs), the top priority for cybersecurity leaders…

5 days ago

SecHub : Streamlining Security Across Software Development Lifecycles

The free and open-source security platform SecHub, provides a central API to test software with…

1 week ago

Hawker : The Comprehensive OSINT Toolkit For Cybersecurity Professionals

Don't worry if there are any bugs in the tool, we will try to fix…

1 week ago