File types supported:
PDF DOCX XLSX PPTX any text-based format and many more!!
MAN-SPIDER will crawl every share on every target system. If provided creds don't work, it will fall back to "guest", then to a null session.

___________________________
@hacking_Attack
@Hacking_Video

Example #5: Search for certificates
$ manspider share.evilcorp.local -e pfx p12 pkcs12 pem key crt cer csr jks keystore key keys der -d evilcorp -u bob -p Passw0rd

Usage Tip #1:
You can run multiple instances of manspider at one time. This is useful when one instance is already running, and you want to search what it's downloaded (similar to grep -R). To do this, specify the keyword loot as the target, which will search the downloaded files in $HOME/.manspider/loot.
Usage Tip #2:
Reasonable defaults help prevent unwanted scenarios like getting stuck on a single target. All of these can be overridden: default spider (https://www.kitploit.com/search/label/Spider) depth: 10 (override with -m) default max filesize: 10MB (override with -s) default threads: 5 (override with -t) shares excluded: C$, IPC$, ADMIN$, PRINT$ (override with --exclude-sharenames)
Usage Tip #3:
Manspider accepts any combination of the following as targets: IPs hostnames subnets (CIDR format) files containing any of the above local folders containing files For example, you could specify any or all of these: 192.168.1.250 share.evilcorp.local 192.168.1.0/24 smb_hosts.txt loot (to search already-downloaded files) /mnt/share (to recursively search a directory) NOTE: when searching local files, you must specify a directory, not an individual file
Usage:
CIDR ranges, or files containing targets to spider (NOTE: local searching also supported, specify directory name or keyword "loot" to search downloaded files) optional arguments: -h, --help show this help message and exit -u USERNAME, --username USERNAME username for authentication -p PASSWORD, --password PASSWORD password for authentication -d DOMAIN, --domain DOMAIN domain for authentication -m MAXDEPTH, --maxdepth MAXDEPTH maximum depth to spider (default: 10) -H HASH, --hash HASH NTLM hash for authentication -t THREADS, --threads THREADS concurrent threads (default: 5) -f REGEX [REGEX ...], --filenames REGEX [REGEX ...] filter filenames using regex (space-separated) -e EXT [EXT ...], --extensions EXT [EXT ...] only show filenames with these extensions (space-separated, e.g. `docx xlsx` for only word & excel docs) --exclude-extensions EXT [EXT ...] ignore files with these extensions -c REGEX [REGEX ...], --content REGEX [REGEX ...] search for file content using regex (multiple supported) --sharenames SHARE [SHARE ...] only search shares with these names (multiple supported) --exclude-sharenames [SHARE ...] don't search shares with these names (multiple supported) --dirnames DIR [DIR ...] only search directories containing these strings (multiple supported) --exclude-dirnames DIR [DIR ...] don't search directories containing these strings (multiple supported) -q, --quiet don't display matching file content -n, --no-download don't download matching files -mfail INT, --max-failed-logons INT limit failed logons -o, --or-logic use OR logic instead of AND (files are downloaded if filename OR extension OR content match) -s SIZE, --max-filesize SIZE don't retrieve files over this size, e.g. "500K" or ".5M" (default: 10M) -v, --verbose show debugging (https://www.kitploit.com/search/label/Debugging) messages ">usage: manspider [-h] [-u USERNAME] [-p PASSWORD] [-d DOMAIN] [-m MAXDEPTH] [-H HASH] [-t THREADS] [-f REGEX [REGEX ...]] [-e EXT [EXT ...]] [--exclude-extensions EXT [EXT ...]]

___________________________
@hacking_Attack
@Hacking_Video

[-c REGEX [REGEX ...]] [--sharenames SHARE [SHARE ...]] [--exclude-sharenames [SHARE ...]] [--dirnames DIR [DIR ...]] [--exclude-dirnames DIR [DIR ...]] [-q] [-n]
[-mfail INT] [-o] [-s SIZE] [-v]
targets [targets ...]

Scan for juicy data on SMB shares. Matching files and logs are stored in $HOME/.manspider. All filters are case-insensitive.

positional arguments:
targets IPs, Hostnames, CIDR ranges, or files containing targets to spider (NOTE: local searching also supported, specify directory name or keyword "loot" to search
downloaded files)

optional arguments:
-h, --help show this help message and exit
-u USERNAME, --username USERNAME
username for authentication
-p PASSWORD, --password PASSWORD
password for authentication
-d DOMAIN, --domain DOMAIN
domain for authentication
-m MAXDEPTH, --maxdepth MAXDEPTH
maximum depth to spider (default: 10)
-H HASH, --hash HASH NTLM hash for authentication
-t THREADS, --threads THREADS
concurrent threads (default: 5)
-f REGEX [REGEX ...], --filenames REGEX [REGEX ...]
filter filenames using regex (space-separated)
-e EXT [EXT ...], --extensions EXT [EXT ...]
only show filenames with these extensions (space-separated, e.g. `docx xlsx` for only word & excel docs)
--exclude-extensions EXT [EXT ...]
ignore files with these extensions
-c REGEX [REGEX ...], --content REGEX [REGEX ...]
search for file content using regex (multiple supported)
--sharenames SHARE [SHARE ...]
only search shares with these names (multiple supported)
--exclude-sharenames [SHARE ...]
don't search shares with these names (multiple supported)
--dirnames DIR [DIR ...]
only search directories containing these strings (multiple supported)
--exclude-dirnames DIR [DIR ...]
don't search directories containing these strings (multiple supported)
-q, --quiet don't display matching file content
-n, --no-download don't download matching files
-mfail INT, --max-failed-logons INT
limit failed logons
-o, --or-logic use OR logic instead of AND (files are downloaded if filename OR extension OR content match)
-s SIZE, --max-filesize SIZE
don't retrieve files over this size, e.g. "500K" or ".5M" (default: 10M)
-v, --verbose show debugging messages


Download MANSPIDER (https://github.com/blacklanternsecurity/MANSPIDER)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
US Accuses China of Using Criminal Hackers in Cyber Espionage Operations

DOJ indicts four Chinese individuals for alleged role in attacks targeting intellectual property, trade secrets belonging to defense contractors, maritime companies, aircraft service firms, and others.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Law Firm for Ford, Pfizer, Exxon Discloses Ransomware Attack

Campbell Conroy & O'Neil reports the attack affected personal data including Social Security numbers, passport numbers, and payment card data for some individuals.

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
MANSPIDER - Spider Entire Networks For Juicy Files Sitting On SMB Shares. Search Filenames Or File Content - Regex Supported!

http://4.bp.blogspot.com/-1VejID09mE8/YOfZjjCEplI/AAAAAAAAizQ/MOsQC5GieQguI-NBPVTJKHy6DaWSa7CywCK4BGAYYCw/w640-h348/MANSPIDER_2-741248.png Crawl SMB shares for juicy information. File content searching + regex is supported!http://2.bp.blogspot.com/-GwxIwSE3Uqg/YOfZiJjAkCI/AAAAAAAAizI/PYVJTu7judo4GoJtp0OZzOuBvCX2jenVgCK4BGAYYCw/w640-h360/MANSPIDER_1-736157.gif File types supported:* PDF* DOCX* XLSX* PPTX* any text-based format
* and many more!! MAN-SPIDER will crawl every share on every target system. If provided creds don't work, it will fall back to "guest", then to a null session.http://4.bp.blogspot.com/-1VejID09mE8/YOfZjjCEplI/AAAAAAAAizQ/MOsQC5GieQguI-NBPVTJKHy6DaWSa7CywCK4BGAYYCw/w640-h348/MANSPIDER_2-741248.png Installation:(Optional) Install these dependencies to add additional file parsing capability: # for images (png, jpeg)
$ sudo apt install tesseract tesseract-data-eng

# for legacy document support (.doc)
$ sudo apt install antiword Install manspider (please be patient, this can take a while): $ pip install pipx
$ pipx install man-spider Example #1: Search the network for filenames that may contain credsNOTE: matching files are automatically downloaded into $HOME/.manspider/loot! (-n to disable)

login logon cred -d evilcorp -u bob -p Passw0rd ">$ manspider 192.168.0.0/24 -f passw user admin account network login logon cred -d evilcorp -u bob -p Passw0rd Example #2: Search for XLSX files containing "password"$ manspider share.evilcorp.local -c password -e xlsx -d evilcorp -u bob -p Passw0rd Example #3: Search for interesting file extensions$ manspider share.evilcorp.local -e bat com vbs ps1 psd1 psm1 pem key rsa pub reg txt cfg conf config -d evilcorp -u bob -p Passw0rd Example #4: Search for finance-related filesThis example searches financy-sounding directories for filenames containing 5 or more consecutive numbers (e.g. 000202006.EFT)

swift -f '[0-9]{5,}' -d evilcorp -u bob -p Passw0rd ">$ manspider share.evilcorp.local --dirnames bank financ payable payment reconcil remit voucher vendor eft swift -f '[0-9]{5,}' -d evilcorp -u bob -p Passw0rd Example #5: Search for certificates$ manspider share.evilcorp.local -e pfx p12 pkcs12 pem key crt cer csr jks keystore key keys der -d evilcorp -u bob -p Passw0rd Usage Tip #1:You can run multiple instances of manspider at one time. This is useful when one instance is already running, and you want to search what it's downloaded (similar to grep -R). To do this, specify the keyword lootas the target, which will search the downloaded files in $HOME/.manspider/loot. Usage Tip #2:Reasonable defaults help prevent unwanted scenarios like getting stuck on a single target. All of these can be overridden:

* default spider depth: 10 (override with -m)
* default max filesize: 10MB (override with -s)
* default threads: 5 (override with -t)
* shares excluded: C$, IPC$, ADMIN$, PRINT$(override with --exclude-sharenames) Usage Tip #3:Manspider accepts any combination of the following as targets:

* IPs
* hostnames
* subnets (CIDR format)
* files containing any of the above
* local folders containing files

For example, you could specify any or all of these:

* 192.168.1.250* share.evilcorp.local* 192.168.1.0/24* smb_hosts.txt* loot(to [...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
MANSPIDER - Spider Entire Networks For Juicy Files Sitting On SMB Shares. Search Filenames Or File Content - Regex Supported!

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
CyberTalent — Exploiting Shellshock (CVE-2014–6271) on a Remote Server(Inside Lab)

https://cdn-images-1.medium.com/max/1200/1*gruWm7TwnL-qT3Psk7HtPg.png
Inside is a machine on Cyber talent that is rated as a medium machine. It presents a shellshock vulnerability that allows remote code…

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
I’m putting a WiFi router into a wall charger (Part 2)

https://cdn-images-1.medium.com/max/729/1*u3yE6cNDZBADh--L5eUThQ.png
This is the third part of a blog about putting a WiFi router into a phone charger; (see part zero here, see part one here) and feel free…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
find phone owner from picture

Is there a way to find a unique ID (sim or phone) from a picture's metadata? The picture in question is from an iPhone and in .jpg format. Thanks !

submitted by /u/dmc1oh1
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I think my pc is part of a botnet. Can I remove myself?

Please help

submitted by /u/Dropex-
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Using MitmProxy for passwords

I have MitmProxy configured successfully. Where in the HTTPS traffic can I find a client’s credentials. For example, their Facebook login

submitted by /u/Thanstor
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to Generate an Evil QR Code with Excel Sheets

https://cdn-images-1.medium.com/max/1600/0*LZukYgzn-TyCvWSX
Hello and welcome to my first article.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video