Kraker is a distributed (https://www.kitploit.com/search/label/Distributed) password brute-force (https://www.kitploit.com/search/label/Brute-force) system that allows you to run and manage the hashcat on different servers and workstations, focused on easy of use. There were two main goals during the design and development: to create the most simple tool for distributed hash cracking (https://www.kitploit.com/search/label/Cracking) and make it fault-tolerant. Kraker consists of two main components - a server and an agent, which communicate through a REST API. You can read about their installation and configuration below. Kraker continues to be in development, so the new functionality, documentation, and updates will be released as they become available. If you have suggestions for improvement or want to participate in the development or find bugs - feel free to open issues, pull requests, or contact us: @_w34kp455 (https://twitter.com/w34kp455) and @_asSheShouldBe (https://twitter.com/asSheShouldBe).
Setup
Here you can find a manual on how to setup your own server, build an agent from the source and run it. You always can download a Release that is already built and run it.
Server
Server is written on Laravel and provides a web interface for creating brute force (https://www.kitploit.com/search/label/Brute%20Force) tasks and also serves for managing agents.
Setup
sudo apt update
curl -fsSL https://get.docker.com -o get-docker.sh
sh get-docker.sh
rm get-docker.sh
sudo curl -L "https://github.com/docker/compose/releases/download/1.25.3/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose
sudo systemctl enable docker

sudo docker-compose build app
sudo docker-compose up -d
sudo docker-compose exec app composer install
sudo docker-compose exec app php artisan key:generate
sudo docker-compose exec app php artisan migrate
sudo docker-compose exec app php artisan db:seed --class=HashtypeSeeder
sudo docker-compose exec app php artisan db:seed --class=UserSeeder

Navigate the server IP address and enter the next credentials: Login: admin Password: kraker
Agent
It is written in .NET Core 5 and works on any OS where this framework is available - Linux, Windows, MacOS (not tested yet). The agent is responsible for performing brute-force tasks that it receives from the server.
Setup
For the agent to work on the host, you need to install .NET Core 5, which can be downloaded from the following link: https://dotnet.microsoft.com/download/dotnet/5.0 Linux - https://docs.microsoft.com/ru-ru/dotnet/core/install/linux Windows -https://dotnet.microsoft.com/download/dotnet/thank-you/runtime-5.0.4-windows-x64-installer
Build from source
Install .NET Core 5 SDK. Linux example: wget https://packages.microsoft.com/config/debian/10/packages-microsoft-prod.deb -O packages-microsoft-prod.deb
sudo dpkg -i packages-microsoft-prod.deb
sudo apt-get update
sudo apt-get install -y apt-transport-https
sudo apt-get update
sudo apt-get install -y dotnet-sdk-5.0

To compile agent from source code, go to agent folder and run the next command: dotnet build --configuration Release. After that in Kracker.App/bin/Release/net5.0 folder you will get the built project. You need to download hashcat from the official page at https://hashcat.net/hashcat/, unpack it into the agent's folder. Modify appsettings.json in Kracker.App/bin/Release/net5.0 and put ServerURL and Hashcat.Path like: {
"HashCat":{
"Path": "/home/admin/Kraker/agent/Kracker.App/bin/Release/net5.0/hashcat/hashcat.bin", //hashcat path
"SilencePeriodBeforeKill": 5, //default - 60 minutes
"RepeatedStringsBeforeKill": 100, //defaut 1000 strings
"NeedForce": true,
"Options": "--quiet --status --status-timer=1 --machine-readable --logfile-disable --restore-disable --outfile-format=2"
},
"ServerUrl": "http://8.8.8.8/", //server url
"InventoryCheckPeriod": 600,
"HearbeatPeriod": 15
}

Create a folder wordlist and rule and put there your favorite wordlist (https://www.kitploit.com/search/label/Wordlist) and rules. Run Kraker.app.exe or use command dotnet run Kraker.app.dll You can copy-paste the agent folder from server to server for easy setup. Happy cracking!

Using release
In release you can find: pre-installed hashcat https://hashcat.net/hashcat/ rules from https://github.com/ttmyst/tmyst_rules Running agent from release: Install .NET Core 5 runtime. Modify appsettings.json in Kracker.App/bin/Release/net5.0 and put ServerURL and Hashcat.Path. Put your favorite wordlist and rules in wordlist and rule folders. You can find lots of wordlists on https://weakpass.com (https://weakpass.com/). Run Kraker.app.exe or use command dotnet Kraker.app.dll
Contacts
@_w34kp455 (https://twitter.com/w34kp455) @_asSheShouldBe (https://twitter.com/asSheShouldBe) https://weakpass.com (https://weakpass.com/)

Download Kraker (https://github.com/zzzteph/kraker)

Deep Web
Torrezz

Is torrezz down for good or going through maintenance? Been offline since yesterday

submitted by /u/justgowithit44444
[link] [comments]

Deep Web
User Survey for my master thesis

Dear,

I am a master's student at TU/eindhoven, The Netherlands. I am doing research on Examining user experiences when using the Tor browser. The purpose of this user survey is to examine/explore who finds the broken functionality of webpages an issue when using the Tor browser in the different security levels. The survey is completely anonymous and confidential, the answers will be deleted after a conclusion is drawn from it. I request Tor users to help me with my master thesis by answering the survey :)

​

https://blocksurvey.io/survey/1MoQ1V6xG53egT5S7HcsZ99EUKzbHBN8kM/f242bfff-9507-4d30-9538-2446de103c09

submitted by /u/10johnwick01
[link] [comments]

First Pentesting experience
https://www.reddit.com/r/Pentesting/comments/mc454c/first_pentesting_experience/

<!-- SC_OFF -->Hello there, I'm a 21 year's old college student and I'm currently on a pentesting internship at a small company and my mission is to pentest the local network and infrastructure and write back a detailed report. They already gave me a Local PC connected to the Active Directory and i have a guest privileges. The problem is that I'm a bit newbie in the pentesting world and this is my first professional experience so I really don't know what should I do and what should I test and which things should I focus on etc .. I already tried some small things like scanning the wireless networks and check the traffic with wireshark and airodump/airmon and i also tried nmap and netdiscover to get to know more about the infrastructure and to specify the targets but i didn't reach or get anything.. I would really appreciate some help with some headlines specifications or a pentesing methodology to follow or any kind of help. <!-- SC_ON --> submitted by /u/Lu3as33 (https://www.reddit.com/user/Lu3as33)
[link] (https://www.reddit.com/r/Pentesting/comments/mc454c/first_pentesting_experience/) [comments] (https://www.reddit.com/r/Pentesting/comments/mc454c/first_pentesting_experience/)

hacking: security in practice
Free Ethical Hacking Courses

Hi guys i found Free Ethical hacking courses on Udemy. If you wanna get that, you can visit https://dailycourse.top/free-ethical-hacking-capture-the-flag-walkthroughs-courses/

submitted by /u/jpntr
[link] [comments]

hacking: security in practice
Email hygiene - Creating a system/strategy for email security

https://b.thumbs.redditmedia.com/cJ2-Sn-Dj1AGrYswMq1YiwWlxkD7cNBMKOIkZYKlsxs.jpg submitted by /u/El_galZyrian
[link] [comments]

hacking: security in practice
Email hygiene - Creating a system/strategy for email security

https://b.thumbs.redditmedia.com/cJ2-Sn-Dj1AGrYswMq1YiwWlxkD7cNBMKOIkZYKlsxs.jpg submitted by /u/jwion
[link] [comments]

hacking: security in practice
Can I publish an exploit code to exploit-db.com after a CVE ID gets assigned?

I have found a vulnerability in a local vendor's product, who wasn't found in MITRE's CNA table. Also, there is no Vulnerability research programs in my country AFA my research went.

Edit: There is, but the application procedure is terrible. Looking into it.

I intend to email the vendor first and then request MITRE for a CVE-ID. However, I have three questions on the subject.

1. In the event of the vendor not acknowledging my findings (the chances of this happening is pretty high), and a CVE-ID gets assigned, can I still publish the exploit code to exploit-db.com?
2. Can I publish a writeup on how I have found the vulnerability once a CVE ID is assigned?
3. On MITRE's website, they says that the researcher who request a CVE-ID won't be credited. Is there any way that I could get credited for the vulnerability I found?

This is my first zero day and I don't know how to proceed further as different websites propose conflicting information on this. Kindly guide me on how to report this.

PS: I am not looking for bounty money; I'm just trying to mark my humble presence into the vast cyber security world.

submitted by /u/Mr-introVert
[link] [comments]

Kali Linux Tutorials
Mole : A Framework For Identifying & Exploiting Out-Of-Band Application Vulnerabilities

Mole is a framework for identifying and exploiting out-of-band (OOB) vulnerabilities. Installation & Setup Mole Install Python >= 3.6 virtualenv -p /usr/bin/python3 venvsource venv/bin/activate./venv/bin/pip3 install -r requirements.txtgit submodule update --init --recursive Set an API key in config.yml (must be the same for the client and server) DNS Configuration You’ll need to configure the DNS records […]

The post Mole : A Framework For Identifying & Exploiting Out-Of-Band Application Vulnerabilities appeared first on Kali Linux Tutorials.

Hacking on Medium
OWASP API #9: Improper Assets Management

https://cdn-images-1.medium.com/max/700/0*VOxZb0CcO0psFL9k
Want to learn how big enterprises such as Facebook can easily be hacked? Can have a look to learn about Improper Assets Management.

Continue reading on strike.sh »