and unrelated Internet noise or IR/AV/EDRs out of bound packets.

The program benefits from the marvelous known bad IP ranges coming from: curi0usJack and the others: https://gist.github.com/curi0usJack/971385e8334e189d93a6cb4671238b10

Using an IP addresses blacklisting along with known bad keywords lookup through Reverse-IP DNS queries and HTTP headers inspection, brings the reliability to considerably increase redirector's resiliency to the unauthorized peers wanting to examine attacker infrastructures.

Invalid packets may be misrouted according to three strategies:

* redirect: Simply redirect peer to another websites, such as Rick Roll.
* reset: Kill TCP connection straightaway.
* proxy: Fetch a response from another website, to mimic cloned/hijacked website as closely as possible.

This configuration is mandated in configuration file: #
# What to do with the request originating not conforming to Beacon, whitelisting or
# ProxyPass inclusive statements:
# - 'redirect' it to another host with (HTTP 301),
# - 'reset' a TCP connection with connecting client
# - 'proxy' the request, acting as a reverse-proxy against specified action_url
# (may be dangerous if client fetches something it shouldn't supposed to see!)
#
# Valid values: 'reset', 'redirect', 'proxy'.
#
# Default: redirect
#
drop_action: redirectBelow example shows outcome of redirectto https://googole.com: https://1.bp.blogspot.com/-s-98u3l2sA8/YLc38rF7zmI/AAAAAAAAXuo/yPlKcbb--Y467jHJ_LQ-dDZRjlkV69PfwCNcBGAsYHQ/w640-h328/RedWarden_3_3.png Use wisely, stay safe. RequirementsThis program can run only on Linux systems as it uses fork to spawn multiple processes.

Also, the opensslsystem command is expected to be installed as it is used to generate SSL certificates.

Finally, install all of the Python3 PIP requirements easily with: bash $ sudo pip3 install -r requirements.txtUsageExample usageThe minimal RedWarden's config.yaml configuration file could contain: port:
- 80/http
- 443/https

profile: jquery-c2.3.14.profile

ssl_cacert: /etc/letsencrypt/live/attacker.com/fullchain.pem
ssl_cakey: /etc/letsencrypt/live/attacker.com/privkey.pem

teamserver_url:
- 1.2.3.4:8080

drop_action: resetThen, the program can be launched by giving it a path to the config file: bash$ sudo python3 RedWarden.py -c config.yaml

[INFO] 19:21:42: Loading 1 plugin...
[INFO] 19:21:42: Plugin "malleable_redirector" has been installed.
[INFO] 19:21:42: Preparing SSL certificates and keys for https traffic interception...
[INFO] 19:21:42: Using provided CA key file: ca-cert/ca.key
[INFO] 19:21:42: Using provided CA certificate file: ca-cert/ca.crt
[INFO] 19:21:42: Using provided Certificate key: ca-cert/cert.key
[INFO] 19:21:42: Serving http proxy on: 0.0.0.0, port: 80...
[INFO] 19:21:42: Serving https proxy on: 0.0.0.0, port: 443...
[INFO] 19:21:42: [REQUEST] GET /jquery-3.3.1.min.js
[INFO] 19:21:42: == Valid malleable http-get request inbound.
[INFO] 19:21:42: Plugin redirected request from [code.jquery.com] to [1.2.3.4:8080]
[INFO] 19:21:42: [RESPONSE] HTTP 200 OK, length: 5543
[INFO] 19:21:45: [REQUEST] GET /jquery-3.3.1.min.js
[INFO] 19:21:45: == Valid malleable http-get request inbound.
[INFO] 19:21:45: Plugin redirected request from [code.jquery.com] to [1.2.3.4:8080]
[INFO] 19:21:45: [RESPONSE] HTTP 200 OK, length: 5543
[INFO] 19:21:46: [REQUEST] GET /
[...]
[ERROR] 19:24:46: [DROP, reason:1] inbound User-Agent differs from the one defined in C2 profile.
[...]
[INFO] 19:24:46: [RESPONSE] HTTP 301 Moved Permanently, length: 212
[INFO] 19:24:48: [REQUEST] GET /jquery-3.3.1.min.js
[INFO] 19:24:48: == Valid malleable http-get request inbound.
[INFO] 19:24:48: Plugin redirected request from [code.jquery.com] to [1.2.3.4:8080]
[...]The above output contains a line pointing out that ther[...]

___________________________
@hacking_Attack
@Hacking_Video

e has been an unauthorized, not compliant with our C2 profile inbound request, which got dropped due to incompatible User-Agent string presented: [...]
[DROP, reason:1] inbound User-Agent differs from the one defined in C2 profile.
[...] Use CasesImpose IP Geolocation on your Beacon traffic originatorsYou've done your Pre-Phish and OSINT very well. You now know where your targets live and have some clues where traffic should be originating from, or at least how to detect completely auxiliary traffic. How to impose IP Geolocation on Beacon requests on a redirector?

RedWarden comes at help!

Let's say, you want only to accept traffic originating from Poland, Europe. Your Pre-Phish/OSINT results indicate that:

* 89.64.64.150is a legitimate IP of one of your targets, originating from Poland
* 59.99.140.76whereas this one is not and it reached your systems as a regular Internet noise packet.

You can use RedWarden's utility lib/ipLookupHelper.pyto collect IP Geo metadata about these two addresses: bash$ python3 ipLookupHelper.py

Usage: ./ipLookupHelper.py The former brings: bash$ python3 ipLookupHelper.py 89.64.64.150
[dbg] Following IP Lookup providers will be used: ['ip_api_com', 'ipapi_co']
[.] Lookup of: 89.64.64.150
[dbg] Calling IP Lookup provider: ipapi_co
[dbg] Calling IP Lookup provider: ip_api_com
[dbg] New IP lookup entry cached: 89.64.64.150
[.] Output:
{
"organization": [
"UPC Polska Sp. z o.o.",
"UPC.pl",
"AS6830 Liberty Global B.V."
],
"continent": "Europe",
"continent_code": "EU",
"country": "Poland",
"country_code": "PL",
"ip": "89.64.64.150",
"city": "Warsaw",
"timezone": "Europe/Warsaw",
"fulldata": {
"status": "success",
"country": "Poland",
"countryCode": "PL",
"region": "14",
"regionName": "Mazovia",
"city": "Warsaw",
"zip": "00-202",
"lat": 52.2484,
"lon": 21.0026,
"timezone": "Europe/Warsaw",
"isp": "UPC.pl",
"or g": "UPC Polska Sp. z o.o.",
"as": "AS6830 Liberty Global B.V.",
"query": "89.64.64.150"
},
"reverse_ip": "89-64-64-150.dynamic.chello.pl"
}and the latter gives: bash$ python3 ipLookupHelper.py 59.99.140.76
[dbg] Following IP Lookup providers will be used: ['ip_api_com', 'ipapi_co']
[dbg] Read 1 cached entries from file.
[.] Lookup of: 59.99.140.76
[dbg] Calling IP Lookup provider: ip_api_com
[dbg] New IP lookup entry cached: 59.99.140.76
[.] Output:
{
"organization": [
"",
"BSNL Internet",
"AS9829 National Internet Backbone"
],
"continent": "Asia",
"continent_code": "AS",
"country": "India",
"country_code": "IN",
"ip": "59.99.140.76",
"city": "Palakkad",
"timezone": "Asia/Kolkata",
"fulldata": {
"status": "success",
"country": "India",
"countryCode": "IN",
"region": "KL",
"regionName": "Kerala",
"city": "Palakkad",
"zip": "678001",
"lat": 10.7739,
"lon": 76.6487,
"timezone": "Asia/Kolkata",
"isp": "BSNL Internet",
"org": "",
"as": "AS9829 National Internet Backbone",
"query": "59.99.140.76"
},
"reverse_ip": ""
}Now you see that the former one had "country": "Poland"whereas the latter "country": "India". With that knowledge we are ready to devise our constraints in form of a hefty YAML dictionary: ip_geolocation_requirements:
organization:
continent:
continent_code:
country:
- Poland
- PL
- Polska
country_code:
city:
timezone:Each of that dictionary's entries accept regular expression to be matched upon determined IP Geo metadata of inbound peer's IP address. We use three entries in countryproperty to allow requests having one of specified v[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
RedWarden - Flexible CobaltStrike Malleable Redirector

___________________________
@hacking_Attack
@Hacking_Video

Trending repositories on GitHub today · GitHub
luong-komorebi / Awesome-Linux-Software

A list of awesome applications, software, tools and other materials for Linux distros.

Language: Python
Star: 15,822
Fork: 1,622

___________________________
@hacking_Attack
@Hacking_Video

Trending repositories on GitHub today · GitHub
jhu-ep-coursera / fullstack-course4

Example code for HTML, CSS, and Javascript for Web Developers Coursera Course

Language: JavaScript
Star: 5,559
Fork: 8,405

___________________________
@hacking_Attack
@Hacking_Video

Trending repositories on GitHub today · GitHub
firstcontributions / first-contributions

🚀✨ Help beginners to contribute to open source projects

Language: unknown
Star: 18,672
Fork: 36,515

___________________________
@hacking_Attack
@Hacking_Video

Trending repositories on GitHub today · GitHub
chubin / cheat.sh

the only cheat sheet you need

Language: Python
Star: 25,146
Fork: 1,275

___________________________
@hacking_Attack
@Hacking_Video

Trending repositories on GitHub today · GitHub
freqtrade / freqtrade

Free, open source crypto trading bot

Language: Python
Star: 8,810
Fork: 2,182

___________________________
@hacking_Attack
@Hacking_Video

Trending repositories on GitHub today · GitHub
ParthJadhav / Tkinter-Designer

Create Beautiful Tkinter GUIs by Drag and Drop ☄️

Language: Python
Star: 578
Fork: 42

___________________________
@hacking_Attack
@Hacking_Video

Trending repositories on GitHub today · GitHub
maaslalani / slides

Terminal based presentation tool

Language: Go
Star: 175
Fork: 7

___________________________
@hacking_Attack
@Hacking_Video

Trending repositories on GitHub today · GitHub
topjohnwu / Magisk

The Magic Mask for Android

Language: C++
Star: 18,354
Fork: 3,512

___________________________
@hacking_Attack
@Hacking_Video

Trending repositories on GitHub today · GitHub
python-telegram-bot / python-telegram-bot

We have made you a wrapper you can't refuse

Language: Python
Star: 15,192
Fork: 3,230

___________________________
@hacking_Attack
@Hacking_Video

Trending repositories on GitHub today · GitHub
swisskyrepo / PayloadsAllTheThings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Language: Python
Star: 24,777
Fork: 7,347

___________________________
@hacking_Attack
@Hacking_Video

Trending repositories on GitHub today · GitHub
atlas-engineer / nyxt

Nyxt - the internet on your terms.

Language: Common Lisp
Star: 6,148
Fork: 266

___________________________
@hacking_Attack
@Hacking_Video

Updated Mimikatz in Metasploit to play with recent features like RDP plaintext credential dumping
https://www.reddit.com/r/redteamsec/comments/nucui9/updated_mimikatz_in_metasploit_to_play_with/

HOWTO: https://an0n-r0.medium.com/updating-mimikatz-in-metasploit-1ce505e811e1 submitted by /u/an0n_r0 (https://www.reddit.com/user/an0n_r0)
[link] (https://www.reddit.com/r/redteamsec/comments/nucui9/updated_mimikatz_in_metasploit_to_play_with/) [comments] (https://www.reddit.com/r/redteamsec/comments/nucui9/updated_mimikatz_in_metasploit_to_play_with/)

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
What’s the best way to make money off the dark web ?

I would like to know if i can make money off the dark web. Whats the best ways? I would refer legal options like selling info about one topic etc. Is there any chance?

submitted by /u/Doctoras21
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

OAuth Misconfig → Account Takeover
https://0xparth.medium.com/oauth-misconfig-account-takeover-df68afe3245b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Folks 👋,Continue reading on Medium » (https://0xparth.medium.com/oauth-misconfig-account-takeover-df68afe3245b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video