KitPloit - PenTest Tools!Pollenisator - Collaborative Pentest Tool With Highly Customizable Tools





Pollenisator is a tool aiming to assist pentesters and auditor automating the use of some tools/scripts and keep track of them.

* Written in python 3
* Provides a modelisation of "pentest objects" : Scope, Hosts, Ports, Commands, Tools etc.
* Tools/scripts are separated into 4 categories : wave, Network/domain, IP, Port
* Objects are stored in a NoSQL DB (Mongo)
* Keep links between them to allow queries
* Objects can be created through parsers / manual input
* Business logic can be implemented (auto vuln referencing, item triggers, etc.)
* Many tools/scripts launch conditions are availiable to avoid overloading the target or the scanner.
* A GUI based on tcl/tk



Documentation

Everything is the wiki, including installation

Features

*
Register your own tools

* Add command line options in your database.
* Create your own light plugin to parse your tool output.
* Use the objects Models to add, update or delete objects to the pentest inside plugins.
* Limit the number of parallel execution of noisy/heavy tools

*
Define a recon/fingerprinting procedure with custom tools

* Choose a period to start and stop the tools
* Define your scope with domains and network IP ranges.
* Custom settings to include new hosts in the scope
* Keep results of all files generated through tools executions
* Start the given docker to implement numerous tools for LAN and Web pentest

*
Collaborative pentests

* Split the work between your machines by starting one worker by computer you want to use.
* Tags ip or tools to show your team mates that you powned it.
* Take notes on every object to keep trace of your discoveries
* Follow tools status live
* Search in all your objects properties with the fitler bar.
* have a quick summary of all hosts and their open ports and check if some are powned.

*
Reporting

* Create security defects on IPs and ports
* Make your plugins create defects directly so you don't have to
* Generate a Word report of security defects found. You can use your own template with extra work.
* Generate a Powerpoint report of security defects found. You can use your own template with extra work.

*
Currently integrated tools

* IP / port recon : Nmap (Quick nmaps followed by thorough scan)
* Domain enumeration : Knockpy, Sublist3r, dig reverse, crtsh
* Web : WhatWeb, Nikto, http methods, Dirsearch
* LAN : Crackmapexec, eternalblue and bluekeep scan, smbmap, anonymous ftp, enum4linux
* Unknown ports : amap, nmap scripts
* Misc : ikescan, ssh_scan, openrelay


Roadmap

* Change the architecture to an API based one
* Get rid of Celery
* Add flexibity for commands
* Improve UX
* Add more plugin and improve existing ones
* Add real support for users / authenticated commands



Download Pollenisator

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
source
photo
Making a Team

Hello everyone. A big thing that people don't take into account when pursuing a career and or pursuing this hobby is that its crucial to surround yourself with likeminded people. A big thing I've noticed in popular communities is the total disconnect I get with the people there. Thats why I've decided to make a server to address this issue. Im planning on doing ctf's as a team, hosting events, and just providing a place for people in the industry to chill. If you're interested join up.

https://discord.gg/wKnHMprfEP

submitted by /u/TotallyNotaCTF
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can a app from a defunct company be re-activated?

Hello everyone,

TL;DR: Is it possible to reactivate a program if I have the activation code and receipt even if the company just suddenly stopped "existing".

A little context. I recently switched from a HDD to a SSD to add a few more years to my laptop, this was done at a official service shop. It's for a T430 Thinkpad. Anyway, the hard drive was cloned in order to keep everything the same.

Now, I used a video editing program called TrakAx, I had the licence and activation done on the HDD and everything worked great. Upon trying to use the software on the SSD I had a message that the trial version had expired (it was a 14 days trial).

About 4 years ago I had activated the software and I worked fine for the past few years, it worked on the HDD but I had to switch the hard drive in the laptop in order to use it, also the HDD has started to fail to load windows upon bootup.

I still have the activation code but when I input it I get an error code, it seems that the program needs a server authentication in order to be activated. This seems to be the main problem.

​

What can be done in order to use the program again?

​

The reason I still want to use this software is that I pretty much learned all the tools and buttons, also its really stable, easy and covers my editing needs.

The company that distributed this software was called HighAndes and was based on Ireland, but suddenly they seemed to just shutdown, their twitter and youtube channels just end in 2016 with no warning.

Here are some links to the tweeter and youtube channel if anyone is curious of how the program was an stuff.

https://twitter.com/trakax?lang=es

https://www.youtube.com/user/trakAxPC/videos

Thanks in advance.

submitted by /u/Teyarual
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
source
photo
John gives up without attempting to crack password.

I'm doing the introductory "Blue" lesson on TryHackMe, which requires cracking a Windows password hash. I've used John before, but I have no clue what's going on here.

So, I have the formatted password hash extracted:
Jon:1000:aad3b435b51404eeaad3b435b51404ee:ffb43f0de35be4d9917ac0cc8ad57f8d:::
I redirect this to a file:
echo -n "Jon:1000:aad3b435b51404eeaad3b435b51404ee:ffb43f0de35be4d9917ac0cc8ad57f8d:::" > jon_hash
Then load it and rockyou.txtinto john:
john -w /usr/share/wordlists/rockyou.txt --format=nt jon_hash
The output though isn't encouraging. It finishes instantly, and shows this:
Created directory: /home/name/.john Using default input encoding: UTF-8 Loaded 52 password hashes with no different salts (NT [MD4 256/256 AVX2 8x3]) Warning: no OpenMP support for this hash type, consider --fork=8 Press 'q' or Ctrl-C to abort, almost any other key for status 0g 0:00:00:00 DONE (2021-09-11 17:11) 0g/s 7708p/s 7708c/s 400852C/s !@#$%..sss Session completed
Then, if I try to show cracked passwords:
$ john --show jon_hash 0 password hashes cracked, 1 left
I kept at it for awhile, then looked up a guide. It shows essentially the procedure I already did though, and they were able to get it cracked. And yes, I checked my copy of rockyou.txt, and it does contain the expected password.

Does anyone know why it isn't attempting to crack it?

Thank you

submitted by /u/carcigenicate
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Expiration of SSL handshake

After physically obtaining (pre)master key, which was generated in SSL handshake - how long can one use it to decrypt HTTPS traffic? For session? To next reboot? Or maybe it has to be manually deleted on client side to force making next SSL handshake with generating new master key?

submitted by /u/Dry_Equal_9398
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Vehicle infotainment system as an attack vector?

So my brain started firing off signals today and im curious. Has anyone heard of someone pulling files or injecting a payload to a connected device from a vehicles infotainment system? When I get in a newer vehicle it starts asking for all sorts of permissions when I access Bluetooth or plug in via cable. My first thought was:

"A O.MG cable left in your vehicle could probably work."

However, that isn't really weaponizing any vehicle systems so my question isn't satisfied. Then I thought:

"Well, what if someone built out a raspberry pi to function as a normal infotainment system and programmed malicious code into the Pi so when a device is connected it starts dumping payloads."

But that solution in itself is just a more complicated version of the O.MG cable.

Does anyone have any insight that might satisfy my noggin?

submitted by /u/usrnamealreadytaken1
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Randomly kick a win10 machine off my wifi

I have a new user in my house who is being an utter prick.

I wish to, at random times, boot the machine off my network.

I was using aireplay-ng -0 100 [bssid] [clientid] wlan0mon but while this works on other machines, I am assuming its not working on this win10 machine because of windows security?

Is there any way I can mod that command, any other flags etc that may give me my goal?

submitted by /u/iGraveling
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe Write-up: VulnNet Roasted.


Dificultad : Fácil.

Continue reading on Medium »

Deep Web
I'm sick of tor!

Is there another anonymous browser that's almost identical to tor that doesn't take to 5hours to connect. Tor is really annoying. Any suggestions? (Help) I need another browser

submitted by /u/mscott303
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Looking for local crime links, is their anyway or any website that would have leaks or something of that nature, recently moved into a place with a known high organiser crime rate and I’m just wanting to know which places to steer clear off

submitted by /u/Smegma_on_bread
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
State of wireless keyboard and mouse security?

Last I heard there were reported vulnerabilities with wireless keyboards even with encryption. Is this still the case today?

How about mice? Are they less of a risk since it is mostly clicking and coordinates, except when you cut and paste?

submitted by /u/Necessary-Helpful
[link] [comments]

hacking: security in practice
Dear reddit...

Recently, I joined a Minecraft realm on bedrock. The server is neat, but somebody had to come in and ruin the peace. They managed to get a command block from who knows where and type some lousy command to make the entire server essentially useless. What happens when you join is you are greeted by a lovely sound of thousands upon thousands of totems of undying breaking. Your inventory is also filled with barriers and you get a pumpkin put on your head. you also get every debuff in the game. how do we fix this? The hackers alias was "Cookieman"

submitted by /u/StrongMonkies
[link] [comments]

hacking: security in practice
Figuring out if a werkzeug 1.0.1 server is running in debugger mode.

Hey everyone, new to finding exploits. Currently working on a ctf that has a site that is running a wsgi server with werkzeug 1.0.1 and python 2.7 on it. I know that there is a vulnerability with running a werkzeug server with debugger enabled. How can I figure out if the debugger mode is currently enabled? Ive looked it up and have found its easiest to try and cause an internal server error, then this would show if debugger mode is enabled. How would I go about doing that?

submitted by /u/tmag97
[link] [comments]

hacking: security in practice
Not sure if this has been asked before, but how secure are React states?

I know that browser cookies are insecure and used for CSRF and stuff. What about info that are stored in React/Redux? How do hackers go about to access them, since they're gone after a refresh? And any good practice to secure it?

submitted by /u/ohlesl1e
[link] [comments]

Deep Web
thoughts on dark0de?

submitted by /u/boonerpatooner
[link] [comments]

Deep Web
What’s the new alphabay? Hit my dm🙏

submitted by /u/gvnsvn
[link] [comments]

Loader shellcode that executes an ELF in-memory using an anonymous file descriptor
https://www.reddit.com/r/redteamsec/comments/pmoseh/loader_shellcode_that_executes_an_elf_inmemory/

submitted by /u/0xDangerous_bit (https://www.reddit.com/user/0xDangerous_bit)
[link] (https://gist.github.com/zznop/0117c24164ee715e750150633c7c1782) [comments] (https://www.reddit.com/r/redteamsec/comments/pmoseh/loader_shellcode_that_executes_an_elf_inmemory/)

How I Found 7 XSS Vulnerabilities in Filename Reflecting
https://alimanshester.medium.com/how-i-found-7-xss-vulnerabilities-in-filename-reflecting-6347279ee82a?source=rss------bug_bounty-5