Posts

Showing posts from February, 2016

4n4lDetector v1.1

Image
Fuck what fucking time ago out there!   Now it is the awkward moment when everyone is back to haunt you. If you get into bed and I enfold, raisins heat. If you poke a foot by the end of the sheet, you run the risk of losing the little freeze.  If you come out on long pants, even gayumbos merge with the cheeks of your buttocks, and this with perspiration your balls become number one public enemy.  Why you the start to sweat all!  And if Instead decide to spend the shorts ... date by fucked because something bad has to happen to you, you listen to me ...   this is a no live! The truth is that I do not want to write the post jajajaa pffffffff ... rather be thrown into the little sun  on my terrace sucking flash pole  , but as alternatives after a weekend so I was only movidito post something or enter  Putalocura  , and I know what will be happening, but lately not updated with good content, for that ... I'm losing interest. So I said ... I will give them to the kids and especially the

Raptor WAF - Web Application firewall to Train Attacks

Image
Raptor is an Open Source Tool, yout focus is study of attacks and find intelligent ways to block attacks. Raptor is made in pure C, don’t use regex or other common ways to block attacks, yes is diferent and fast like a raptor dinosaur, Raptor follow principle KISS (Keep It Simple), you can use Raptor to simulate attacks and bypasses at wafs. WAF stands for Web Application Firewall. It is widely used nowadays to detect and defend SQL Injections and XSS... You can block XSS, SQL injection attacks and path traversal with Raptor You can use blacklist of IPs to block some users at config/blacklist ip.txt You can use IPv6 and IPv4 at communications At the future DoS protector, request limit, rule interpreter and Malware detector at uploads. At the future SSL/TLS... to run: $ git clone https://github.com/CoolerVoid/raptor_waf $ cd raptor_waf; make; bin/raptor Example Up some HTTPd server at port 80  $ bin/Raptor -h localhost -p 80 -r 8883 -w 4 -o loglog.txt you can test at http://localhost:88

RouterhunterBR 2.0 - Automated Tool for Testing in Vulnerable Routers

Image
The  RouterhunterBR  is an automated security tool que finds vulnerabilities and performs tests on routers and vulnerable devices on the Internet. The  RouterhunterBR  was designed to run over the Internet looking for defined ips tracks or random in order to automatically exploit the vulnerability  DNSChanger  on home routers. The   DNSChanger   is a trojan   able to direct   user requests   to   illegal   sites.   In practice , this  malware has the   ability to change   the DNS settings   of our machine   redirecting   the user to   sites   with   malicious purposes .  Imagine   for example   that your system   is infected with   this malware ,  what might   happen is that the   user   to   access a particular   site   (eg . Facebook.com )  may be   forwarded to   an unsolicited   website and   potentially   illegal. The script explores four vulnerabilities in routers Shuttle Tech ADSL Modem-Router 915 WM / Unauthenticated Remote DNS Change Exploit reference:  http://www.exploit-db.c

AndroL4b - A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis

Image
AndroL4b is an android security virtual machine based on ubuntu Mate includes the collection of latest framework, tutorials and labs from different security geeks and researcher for reverse engineering and malware analysis. Tools APKStudio  Cross-platform Qt5 based IDE for reverse-engineering android applications ByteCodeViewer  Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger) Lobotomy  Android Reverse Engineering Framework & Toolkit (Static and Dynamic Analysis) Mobile Security Framework (MobSF)  (Android/iOS) Automated Pentesting Framework (Just Static Analysis in this VM) DroidBox  Dynamic Analysis of Android Applications Dorzer  Security Assessment Framework for Android Applications APKtool  Reverse Engineering Android Apks AndroidStudio  IDE For Android Application Development ClassyShark  Android executable browser BurpSuite  Assessing Application Security Wireshark  Network Protocol Analyzer Smartphone Pentest Framework (SPF) Metasploit DOWNLOAD LINK

Arpy - Mac OSX Arp Spoof (MITM) Tool

Image
Arpy is an easy-to-use  ARP  spoofing MiTM tool for Mac. It provides 3 targeted functions:  Packet Sniffing Visited Domains Visited Domains with  Gource Each function will be explained below.  Tested OS (to date)  Darwin 14.3.0 Darwin Kernel Version 14.3.0 (Mac OS X) Requirements  Python 2.7 Gource Scapy Installation  Gource  brew install gource Scapy  pip install scapy Sample Commands  ivanvza:~/ > sudo arpy _____ | _ |___ ___ _ _ | | _| . | | | |__|__|_| | _|_ | MiTM Tool |_| |___| v3.15 -@viljoenivan Usage: arpy -t <Target IP> -g <Gateway IP> -i <Interface> ARP MiTM Tool Options: -h, --help show this help message and exit -t TARGET, --target=TARGET The Target IP -g GATEWAY, --gateway=GATEWAY The Gateway -i INTERFACE, --interface=INTERFACE Interface to use --tcp Filters out only tcp traffic --udp Filters

VBScan 0.1.4 - Black Box vBulletin Vulnerability Scanner

Image
VBScan is an opensource project in perl programming language to detect VBulletin CMS vulnerabilities and analyses them. Why VBScan ? If you want to do a penetration test on a vBulletin Forum, VBScan is Your best shot ever! This Project is being faster than ever and updated with the latest VBulletin vulnerabilities. Project Leader :  Mohammad Reza Espargham Github :  https://github.com/rezasp/vbscan/ SourceForge :  https://sourceforge.net/projects/vbscan/ usage : ./vbscan.pl <target> ./vbscan.pl http://target.com/vbulletin VBScan 0.1.4 [Dennis Ritchie] Changed vulnerability scanner engine Changed default specified timeout to 180 seconds Added VBulletin 5.x RCE Exploit Added txt report output Fixed YUI 2.9.0 XSS false positive Fixed reported bugs DOWNLOAD LINK

Gophish - Open-Source Phishing Toolkit

Image
Gophish  is an open-source phishing toolkit designed for businesses and penetration testers. It provides the ability to quickly and easily setup and execute phishing engagements and security awareness training. One-Click Installation Download and Extract the ZIP -  Gophish binaries are provided for most platforms Run the Binary   Gophish is a standalone, portable binary with static assets. That's It. -   Gophish is now available on http://localhost:3333. Login with  admin:gophish Point-and-Click Phishing Beautiful Web UI   A full web UI makes creating simulated phishing campaigns easy. Pixel-Perfect Phishing   Create pixel-perfect emails and landing pages from scratch or by importing them directly into gophish. Automate Phishing Campaigns RESTful API -  Gophish is built from the ground-up with a fully-featured JSON API. Automated Training   Use your favorite language or API utility to manage every aspect of your phishing training automatically. DOWNLOAD LINK

NetworkMiner 2.0 - Network Forensic Analysis Tool (NFAT)

Image
NetworkMiner is a Network Forensic Analysis Tool (NFAT) for Windows (but also works in Linux / Mac OS X / FreeBSD). NetworkMiner can be used as a passive network sniffer/packet capturing tool in order to detect operating systems, sessions, hostnames, open ports etc. without putting any traffic on the network. NetworkMiner can also parse PCAP files for off-line analysis and to regenerate/reassemble transmitted files and certificates from PCAP files. NetworkMiner collects data (such as forensic evidence) about hosts on the network rather than to collect data regarding the traffic on the network. The main user interface view is host centric (information grouped per host) rather than packet centric (information showed as a list of packets/frames). NetworkMiner has, since the first release in 2007, become a popular tool among incident response teams as well as law enforcement. NetworkMiner is today used by companies and organizations all over the world.      NetworkMiner can extract files a