π¦This a good free hacking collection of Security and Hacking Tools, Exploits, Proof of Concepts, Shellcodes, Scripts.
https://github.com/nullsecuritynet/tools
https://github.com/nullsecuritynet/tools
GitHub
GitHub - nullsecuritynet/tools: Security and Hacking Tools, Exploits, Proof of Concepts, Shellcodes, Scripts.
Security and Hacking Tools, Exploits, Proof of Concepts, Shellcodes, Scripts. - nullsecuritynet/tools
Forwarded from UNDERCODE NEWS
Forwarded from UNDERCODE NEWS
Forwarded from DailyCVE
π΅golang-websocket: Denial of service - Remote/unauthenticated CVE-2020-27813 :
https://dailycve.com/golang-websocket-denial-service-remoteunauthenticated-cve-2020-27813
https://dailycve.com/golang-websocket-denial-service-remoteunauthenticated-cve-2020-27813
Dailycve
golang-websocket: Denial of service - Remote/unauthenticated CVE-2020-27813 | CVE
Details:
There was an integer overflow vulnerability concerning the length of websocket
frames received via a websocket connection. An attacker could use this flaw to
cause a denial of service attack on an HTTP Server allowing websocket
connections.
Forβ¦
There was an integer overflow vulnerability concerning the length of websocket
frames received via a websocket connection. An attacker could use this flaw to
cause a denial of service attack on an HTTP Server allowing websocket
connections.
Forβ¦
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Android APK reversing and analysis suite:
F E A T U R E S :
Package name, debug and backup status
Exported components (activities, services, providers and receivers)
Deeplinks
Implicit intent filters
Critical permissions
Bytecode Analysis
Usage Analysis
SQLite DBs
SharedPreferences
Vulnerability Analysis
ICC
Web Issues
Storage Issues
Networking
Crypto Issues
Secrets Analysis
URLs
API tokens
Strings from native libraries
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) CLONE https://github.com/abhi-r3v0/Adhrit
2) cd abhi-r3v0/Adhrit
3) python3 run.py
This will automatically launch the Web interface where the APK can be uploaded and the report will be generated.
4) If the UI didn't launch by itself, navigate to http://localhost:4200/
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Android APK reversing and analysis suite:
F E A T U R E S :
Package name, debug and backup status
Exported components (activities, services, providers and receivers)
Deeplinks
Implicit intent filters
Critical permissions
Bytecode Analysis
Usage Analysis
SQLite DBs
SharedPreferences
Vulnerability Analysis
ICC
Web Issues
Storage Issues
Networking
Crypto Issues
Secrets Analysis
URLs
API tokens
Strings from native libraries
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) CLONE https://github.com/abhi-r3v0/Adhrit
2) cd abhi-r3v0/Adhrit
3) python3 run.py
This will automatically launch the Web interface where the APK can be uploaded and the report will be generated.
4) If the UI didn't launch by itself, navigate to http://localhost:4200/
β β β Uππ»βΊπ«Δπ¬πβ β β β
GitHub
GitHub - abhi-r3v0/Adhrit: Android Security Suite for in-depth reconnaissance and static bytecode analysis based on Ghera benchmarks.
Android Security Suite for in-depth reconnaissance and static bytecode analysis based on Ghera benchmarks. - abhi-r3v0/Adhrit
Forwarded from DailyCVE
π΅UPDATE F5 BIG-IP and BIG-IQ products: Multiple CVE:
https://dailycve.com/update-f5-big-ip-and-big-iq-products-multiple-cve
https://dailycve.com/update-f5-big-ip-and-big-iq-products-multiple-cve
Dailycve
UPDATE F5 BIG-IP and BIG-IQ products: Multiple CVE | CVE
Details:
K43404629: F5 SSH server key size vulnerability CVE-2020-5917
Original Publication Date: 26 Aug, 2020
Latest Publication Date: 07 Jan, 2021
The BIG-IP and BIG-IQ host OpenSSH servers use keys less than 2048 bits that
are no longer consideredβ¦
Forwarded from UNDERCODE NEWS
Forwarded from UNDERCODE NEWS
Later this year, Samsung will announce a new Exynos processor that supports 8K 60FPS video capture.
#Technologies
#Technologies
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Hacking with shells pdfs :
https://paper.seebug.org/papers/Security%20Conf/KCon/2015/Shell%20Hacking.pdf
http://langevin.univ-tln.fr/cours/UPS/extra/Linux-101-Hacks.pdf
http://opensecuritytraining.info/HTID_files/Day11-SoftwareExploitation-Shellcode.pdf
http://docshare01.docshare.tips/files/26981/269810551.pdf
https://doc.lagout.org/security/linux-server-hacks.pdf
http://www.deer-run.com/~hal/EUGLUG-Hacking.pdf
http://www.it-docs.net/download/doc/900/linux-101-hacks---practical-examples-to-build-a-strong-fundation-in-linux---.html
https://www.imperva.com/docs/HII_Remote_and_Local_File_Inclusion_Vulnerabilities.pdf
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Hacking with shells pdfs :
https://paper.seebug.org/papers/Security%20Conf/KCon/2015/Shell%20Hacking.pdf
http://langevin.univ-tln.fr/cours/UPS/extra/Linux-101-Hacks.pdf
http://opensecuritytraining.info/HTID_files/Day11-SoftwareExploitation-Shellcode.pdf
http://docshare01.docshare.tips/files/26981/269810551.pdf
https://doc.lagout.org/security/linux-server-hacks.pdf
http://www.deer-run.com/~hal/EUGLUG-Hacking.pdf
http://www.it-docs.net/download/doc/900/linux-101-hacks---practical-examples-to-build-a-strong-fundation-in-linux---.html
https://www.imperva.com/docs/HII_Remote_and_Local_File_Inclusion_Vulnerabilities.pdf
β β β Uππ»βΊπ«Δπ¬πβ β β β
Forwarded from UNDERCODE NEWS
It is confirmed that Samsung is betting on the simple model, planning to substantially . the price of the Galaxy S21.
#Technologies
#Technologies
Forwarded from UNDERCODE NEWS
How did NASDAQ jumped 2.6% ? Is Tesla worth more than Facebook ?
#Analytiques
#Analytiques
Forwarded from DailyCVE
π΅Unpacthed Telegram Desktop Vulnerability - Api issue could allow attacker to disable notification for specific user:
https://dailycve.com/unpacthed-telegram-desktop-vulnerability-api-issue-could-allow-attacker-disable-notification
https://dailycve.com/unpacthed-telegram-desktop-vulnerability-api-issue-could-allow-attacker-disable-notification
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Powerfull real hacking utilities :
Automatically collects basic recon
Automatically launches Google hacking queries against a target domain
Automatically enumerates open ports via NMap port scanning
Automatically brute forces sub-domains, gathers DNS info and checks for zone transfers
Automatically checks for sub-domain hijacking
Automatically runs targeted NMap scripts against open ports
Automatically runs targeted Metasploit scan and exploit modules
Automatically scans all web applications for common vulnerabilities
Automatically brute forces ALL open services
Automatically test for anonymous FTP access
Automatically runs WPScan, Arachni and Nikto for all web services
Automatically enumerates NFS shares
Automatically test for anonymous LDAP access
Automatically enumerate SSL/TLS ciphers, protocols and vulnerabilities
Automatically enumerate SNMP community strings, services and users
Automatically list SMB users and shares, check for NULL sessions and exploit MS08-067
Automatically exploit vulnerable JBoss, Java RMI and Tomcat servers
Automatically tests for open X11 servers
Auto-pwn added for Metasploitable, ShellShock, MS08-067, Default Tomcat Creds
Performs high level enumeration of multiple hosts and subnets
Automatically integrates with Metasploit Pro, MSFConsole and Zenmap for reporting
Automatically gathers screenshots of all web sites
Create individual workspaces to store all scan output
AUTO-PWN:
Apache Struts CVE-2018-11776 RCE exploit
Android Insecure ADB RCE auto exploit
Apache Tomcat CVE-2017-12617 RCE exploit
Oracle WebLogic WLS-WSAT Component Deserialisation RCE CVE-2017-10271 exploit
Drupal Drupalgedon2 RCE CVE-2018-7600
GPON Router RCE CVE-2018-10561
Apache Struts 2 RCE CVE-2017-5638
Apache Struts 2 RCE CVE-2017-9805
Apache Jakarta RCE CVE-2017-5638
Shellshock GNU Bash RCE CVE-2014-6271
HeartBleed OpenSSL Detection CVE-2014-0160
Default Apache Tomcat Creds CVE-2009-3843
MS Windows SMB RCE MS08-067
Webmin File Disclosure CVE-2006-3392
Anonymous FTP Access
PHPMyAdmin Backdoor RCE
PHPMyAdmin Auth Bypass
JBoss Java De-Serialization RCEs
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) Download https://github.com/telnet22/Kn0ck
2) -> knock.conf
CENSYS_APP_ID="REDACTED"
CENSYS_API_SECRET="REDACTED"
Β» KALI LINUX INSTALL:
chmod +x install.sh
./install.sh
Β» DEBIAN OR UBUNTU INSTALL:
chmod +x install_for_debian_ubuntu.sh
./install_for_debian_ubuntu.sh
[*] NORMAL MODE
knock -t <TARGET>
[*] NORMAL MODE + OSINT + RECON
knock -t <TARGET> | -o (Osint) | -re (Recon)
[*] STEALTH MODE + OSINT + RECON
knock -t <TARGET> | -m stealth | -o (Osint) | -re (Recon)
[*] DISCOVER MODE
knock -t <Target> | -m discover | -w <WORSPACE_ALIAS>
[*] SCAN ONLY SPECIFIC PORT
knock -t <TARGET> | -m port | -p <portnum>
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Powerfull real hacking utilities :
Automatically collects basic recon
Automatically launches Google hacking queries against a target domain
Automatically enumerates open ports via NMap port scanning
Automatically brute forces sub-domains, gathers DNS info and checks for zone transfers
Automatically checks for sub-domain hijacking
Automatically runs targeted NMap scripts against open ports
Automatically runs targeted Metasploit scan and exploit modules
Automatically scans all web applications for common vulnerabilities
Automatically brute forces ALL open services
Automatically test for anonymous FTP access
Automatically runs WPScan, Arachni and Nikto for all web services
Automatically enumerates NFS shares
Automatically test for anonymous LDAP access
Automatically enumerate SSL/TLS ciphers, protocols and vulnerabilities
Automatically enumerate SNMP community strings, services and users
Automatically list SMB users and shares, check for NULL sessions and exploit MS08-067
Automatically exploit vulnerable JBoss, Java RMI and Tomcat servers
Automatically tests for open X11 servers
Auto-pwn added for Metasploitable, ShellShock, MS08-067, Default Tomcat Creds
Performs high level enumeration of multiple hosts and subnets
Automatically integrates with Metasploit Pro, MSFConsole and Zenmap for reporting
Automatically gathers screenshots of all web sites
Create individual workspaces to store all scan output
AUTO-PWN:
Apache Struts CVE-2018-11776 RCE exploit
Android Insecure ADB RCE auto exploit
Apache Tomcat CVE-2017-12617 RCE exploit
Oracle WebLogic WLS-WSAT Component Deserialisation RCE CVE-2017-10271 exploit
Drupal Drupalgedon2 RCE CVE-2018-7600
GPON Router RCE CVE-2018-10561
Apache Struts 2 RCE CVE-2017-5638
Apache Struts 2 RCE CVE-2017-9805
Apache Jakarta RCE CVE-2017-5638
Shellshock GNU Bash RCE CVE-2014-6271
HeartBleed OpenSSL Detection CVE-2014-0160
Default Apache Tomcat Creds CVE-2009-3843
MS Windows SMB RCE MS08-067
Webmin File Disclosure CVE-2006-3392
Anonymous FTP Access
PHPMyAdmin Backdoor RCE
PHPMyAdmin Auth Bypass
JBoss Java De-Serialization RCEs
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) Download https://github.com/telnet22/Kn0ck
2) -> knock.conf
CENSYS_APP_ID="REDACTED"
CENSYS_API_SECRET="REDACTED"
Β» KALI LINUX INSTALL:
chmod +x install.sh
./install.sh
Β» DEBIAN OR UBUNTU INSTALL:
chmod +x install_for_debian_ubuntu.sh
./install_for_debian_ubuntu.sh
[*] NORMAL MODE
knock -t <TARGET>
[*] NORMAL MODE + OSINT + RECON
knock -t <TARGET> | -o (Osint) | -re (Recon)
[*] STEALTH MODE + OSINT + RECON
knock -t <TARGET> | -m stealth | -o (Osint) | -re (Recon)
[*] DISCOVER MODE
knock -t <Target> | -m discover | -w <WORSPACE_ALIAS>
[*] SCAN ONLY SPECIFIC PORT
knock -t <TARGET> | -m port | -p <portnum>
β β β Uππ»βΊπ«Δπ¬πβ β β β
GitHub
GitHub - 0x0d3ad/Kn0ck: Automated Tools Pentest
Automated Tools Pentest. Contribute to 0x0d3ad/Kn0ck development by creating an account on GitHub.
Forwarded from DailyCVE
π΅MERCUSYS Mercury devices allow Directory Traversal :
https://dailycve.com/mercusys-mercury-devices-allow-directory-traversal
https://dailycve.com/mercusys-mercury-devices-allow-directory-traversal
Dailycve
MERCUSYS Mercury devices allow Directory Traversal | CVE
Details:
MERCUSYS Mercury X18G 1.0.5 devices, as shown by the /../../conf/template/uhttpd.json URI, allow Directory Traversal via ../ to the UPnP server.
Affected Versions:
X18G 1.0.5
Vulnerability:
Directory Traversal
References:
https:/β¦
MERCUSYS Mercury X18G 1.0.5 devices, as shown by the /../../conf/template/uhttpd.json URI, allow Directory Traversal via ../ to the UPnP server.
Affected Versions:
X18G 1.0.5
Vulnerability:
Directory Traversal
References:
https:/β¦
Forwarded from UNDERCODE NEWS
Horizon, the domestic artificial intelligence chip firm, announced the completion of the US$400 million C2 round.
#Technologies
#Technologies
Forwarded from UNDERCODE NEWS