KitPloit - PenTest Tools!
Ppmap - A Scanner/Exploitation Tool Written In GO, Which Leverages Prototype Pollution To XSS By Exploiting Known Gadgets

http://1.bp.blogspot.com/-iP9i_8VMqr4/YPiojQGNE-I/AAAAAAAAjao/361K5qU2dXcjLf491-8oXKkJ2Twb9uYdwCK4BGAYYCw/w640-h562/ppmap_1-703557.gif

A simple scanner/exploitation tool written in GO which automatically exploits known and existing gadgets (checks for specific variables in the global context) to perform XSS via Prototype Pollution. NOTE: The program only exploits known gadgets, but does not cover code analysis or any advanced Prototype Pollution exploitation, which may include custom gadgets.
Requirements

Make sure to have chromedp installed:
go get -u github.com/chromedp/chromedp

Installation

*
Automatically

* Download the already compiled binary here
* Give it the permission to execute chmod +x ppmap

*
Manually (compile it yourself)

* Clone the project:
git clone https://github.com/kleiton0x00/ppmap.git
* Change directory to ppmap folder:
cd ~/ppmap
* Build the binary
go build ppmap.go
Usage

Using the program is very simple, you can either:

*
scan a directory/file (or even just the website): echo 'https://target.com/index.html' | ./ppmap

*
or endpoint: echo 'http://target.com/something/?page=home' | ./ppmap
For mass scanning:
cat url.txt | ./ppmapwhere url.txt contains all url(s) in column.

Demo

http://1.bp.blogspot.com/-iP9i_8VMqr4/YPiojQGNE-I/AAAAAAAAjao/361K5qU2dXcjLf491-8oXKkJ2Twb9uYdwCK4BGAYYCw/w640-h562/ppmap_1-703557.gif

Feel free to test the tool on the following websites as a part of demonstration:
https://msrkp.github.io/pp/2.html
https://ctf.nikitastupin.com/pp/known.html

Workflow

* Identify if the website is vulnerable to Prototype Pollution by heuristic scan
* Fingerprint the known gadgets (checks for specific variables in the global context)
* Display the final exploit & ready to perform XSS

Credits

Many thanks to @Tomnomnom for the inspiration: https://www.youtube.com/watch?v=Gv1nK6Wj8qM&t=1558s
The workflow of this program is hugely based on this article: https://infosecwriteups.com/javascript-prototype-pollution-practice-of-finding-and-exploitation-f97284333b2
The fingerprint javascript file is based on this git: https://gist.github.com/nikitastupin/b3b64a9f8c0eb74ce37626860193eaec
Download Ppmap

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is X-Frame-Options header?

https://cdn-images-1.medium.com/max/1191/1*M7QGo83Xz321_Atv8E-ryA.png
In this article we are going to discuss about the X-Frame-Option HTTP security header used to protect the website from clickjacking…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
COOK — THE WORDLISTS FRAMEWORK

https://cdn-images-1.medium.com/max/840/1*M1jbSMkLiEDqIZfW-YCvEg.png
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top 5 Best Books for Bug Bounty Hunting

https://cdn-images-1.medium.com/max/600/1*VhK5SK32vnrwQPjqLWfi2g.png
Best for Bug Bounty Business😉

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is Pegasus spyware?

https://cdn-images-1.medium.com/max/656/1*_z15B0ymTbDe_jTqUacqbQ.png
This might be the name for possibly one of the most powerful and sophisticated spyware developed by a private company.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking the Game an Watch Part 1

https://cdn-images-1.medium.com/max/2000/0*hqR5Jjw-b9jJ2Ykf.jpg
An Intro to Hardware Hacking

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Reconky-Automated Bash Script
https://www.reddit.com/r/Pentesting/comments/orastv/reconkyautomated_bash_script/

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/shivamrai24 (https://www.reddit.com/user/shivamrai24)
[link] (https://github.com/ShivamRai2003/Reconky-Automated_Bash_Script) [comments] (https://www.reddit.com/r/Pentesting/comments/orastv/reconkyautomated_bash_script/)

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Leaks

Okay so I was wondering if there are any websites for leaked nudes/ OF leaks because I had a few normal sites (surface web) but they got taken down and now I need a new source.

submitted by /u/lSuperSuccl
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Ppmap - A Scanner/Exploitation Tool Written In GO, Which Leverages Prototype Pollution To XSS By Exploiting Known Gadgets
http://www.kitploit.com/2021/07/ppmap-scannerexploitation-tool-written.html

___________________________
@hacking_Attack
@Hacking_Video

A simple scanner/exploitation tool written in GO which automatically exploits (https://www.kitploit.com/search/label/Exploits) known and existing gadgets (checks for specific variables in the global context) to perform XSS via Prototype Pollution. NOTE: The program only exploits known gadgets, but does not cover code analysis (https://www.kitploit.com/search/label/Code%20Analysis) or any advanced Prototype Pollution exploitation, which may include custom gadgets.
Requirements
Make sure to have chromedp (https://github.com/chromedp/chromedp) installed:
go get -u github.com/chromedp/chromedp
Installation
Automatically Download the already compiled binary here (https://github.com/kleiton0x00/ppmap/releases) Give it the permission to execute chmod +x ppmap Manually (compile it yourself) Clone the project:
git clone https://github.com/kleiton0x00/ppmap.git Change directory to ppmap folder:
cd ~/ppmap Build the binary
go build ppmap.go
Usage
Using the program is very simple, you can either: scan a directory/file (or even just the website): echo 'https://target.com/index.html' | ./ppmap or endpoint: echo 'http://target.com/something/?page=home' | ./ppmap For mass scanning:
cat url.txt | ./ppmap where url.txt contains all url(s) in column.
Demo

___________________________
@hacking_Attack
@Hacking_Video

Feel free to test the tool on the following websites as a part of demonstration:
https://msrkp.github.io/pp/2.html
https://ctf.nikitastupin.com/pp/known.html
Workflow
Identify if the website is vulnerable (https://www.kitploit.com/search/label/Vulnerable) to Prototype Pollution by heuristic scan Fingerprint the known gadgets (checks for specific variables in the global context) Display the final exploit & ready to perform XSS
Credits
Many thanks to @Tomnomnom for the inspiration: https://www.youtube.com/watch?v=Gv1nK6Wj8qM&t=1558s
The workflow of this program is hugely based on this article: https://infosecwriteups.com/javascript-prototype-pollution-practice-of-finding-and-exploitation-f97284333b2
The fingerprint (https://www.kitploit.com/search/label/Fingerprint) javascript file is based on this git: https://gist.github.com/nikitastupin/b3b64a9f8c0eb74ce37626860193eaec

Download Ppmap (https://github.com/kleiton0x00/ppmap)

___________________________
@hacking_Attack
@Hacking_Video