Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!ODBParser - OSINT Tool To Search, Parse And Dump Only The Open Elasticsearch And MongoDB Directories That Have The Data You Care About Exposing
ODBParser is a tool to search for PII being exposed in open databases.
ONLY to be used to identify exposed PII and warn server owners of irresponsible database maintenance
OR to query databases you have permission to access!
PLEASE USE RESPONSIBLY
What is this?
Wrote this as wanted to create one-stop OSINT tool for searching, parsing and analyzing open databases in order to identify leakages of PII on third-party servers. Other tools seem to either only search for open databases or dump them once you've identified them and then will grab data indiscriminately. Grew from function or two into what's in this repo, so code isn't as clean and pretty as it could be.
Features
To identify open databases you can:
* query Shodanand BinaryEdgeusing all possible parameters (filter by country, port number, whatever)
* specify single IP address
* load up file that has list of IP addresses
* paste list of IP addresses from clipboard
Dumping options:
* parses all databases/collections to identify data you specify
* grab everything hosted on server
* grab just one index/collection
* Use ctrl+c to skip dumping certain index
Post-Processing:
* convert JSON dumps to CSV
* remove useless columns from CSV
Other features:
* keeps track of all the IP addresses and databases you have queried along with info about each server.
* maintains stats file with number of IP's you've queried, number of databases you've parsed and number of records you've dumped
* convert JSON dumps you already have to CSV
* for every database that has total number of records above your limit, script will create an entry in a special file along with 5 sample records so you can review and decide whether the database is worth grabbing
* Default output is line-separated JSON file with a JSON object on each line. You can choose to have it output a "proper JSON" file by using the "properjson" flag
* You can convert the files to CSV on the fly or you can convert only certain files after run is complete (I recommend latter). Converted JSON files will be moved to folder called "JSON backups" in same directory. NOTE:When converting to CSV, script drops exact duplicate rows and drops columns and rows where all values are NaN, because that's what I wanted to do. Feel free to edit function if you'd rather have exact copy of JSON file.
* Windows ONLYIf script pulls back huge number of indices that have field you care about, script will list names of the dbs, pause and give you ten seconds to decide whether you want to go ahead and pull all the data from every index as I've found if you get too many databases returned even after you've specified fields you want, there is a good chance data is fake or useless logs and you can usually tell from name whether either possibility is the case. If you don't act within 10 seconds, script will go ahead and dump every index.
* as you may have noticed, lot of people have been scanning for MongoDB databases and holding them hostage, often changing name to something like "TO_RESTORE_EMAIL_XXXRESTORE.COM." The MongoDb scraper will ignore all databases and collections that have been pwned by checking name of DB/collection against list of strings that indicate pwnage
* script is pretty verbose (maybe too verbose) but I like seeing what's going on. Feel free to silence print statements if you prefer.
Customization
See the odbconfig.py file to specify your parameters, because really name of the game is exposing the data YOU are interested in. I provided some examples in the config file. Play around with them!
You can:
* specify what index or collection names you want to collect by specifying substrings in config file. For exam[...]
___________________________
@hacking_Attack
@Hacking_Video
ODBParser is a tool to search for PII being exposed in open databases.
ONLY to be used to identify exposed PII and warn server owners of irresponsible database maintenance
OR to query databases you have permission to access!
PLEASE USE RESPONSIBLY
What is this?
Wrote this as wanted to create one-stop OSINT tool for searching, parsing and analyzing open databases in order to identify leakages of PII on third-party servers. Other tools seem to either only search for open databases or dump them once you've identified them and then will grab data indiscriminately. Grew from function or two into what's in this repo, so code isn't as clean and pretty as it could be.
Features
To identify open databases you can:
* query Shodanand BinaryEdgeusing all possible parameters (filter by country, port number, whatever)
* specify single IP address
* load up file that has list of IP addresses
* paste list of IP addresses from clipboard
Dumping options:
* parses all databases/collections to identify data you specify
* grab everything hosted on server
* grab just one index/collection
* Use ctrl+c to skip dumping certain index
Post-Processing:
* convert JSON dumps to CSV
* remove useless columns from CSV
Other features:
* keeps track of all the IP addresses and databases you have queried along with info about each server.
* maintains stats file with number of IP's you've queried, number of databases you've parsed and number of records you've dumped
* convert JSON dumps you already have to CSV
* for every database that has total number of records above your limit, script will create an entry in a special file along with 5 sample records so you can review and decide whether the database is worth grabbing
* Default output is line-separated JSON file with a JSON object on each line. You can choose to have it output a "proper JSON" file by using the "properjson" flag
* You can convert the files to CSV on the fly or you can convert only certain files after run is complete (I recommend latter). Converted JSON files will be moved to folder called "JSON backups" in same directory. NOTE:When converting to CSV, script drops exact duplicate rows and drops columns and rows where all values are NaN, because that's what I wanted to do. Feel free to edit function if you'd rather have exact copy of JSON file.
* Windows ONLYIf script pulls back huge number of indices that have field you care about, script will list names of the dbs, pause and give you ten seconds to decide whether you want to go ahead and pull all the data from every index as I've found if you get too many databases returned even after you've specified fields you want, there is a good chance data is fake or useless logs and you can usually tell from name whether either possibility is the case. If you don't act within 10 seconds, script will go ahead and dump every index.
* as you may have noticed, lot of people have been scanning for MongoDB databases and holding them hostage, often changing name to something like "TO_RESTORE_EMAIL_XXXRESTORE.COM." The MongoDb scraper will ignore all databases and collections that have been pwned by checking name of DB/collection against list of strings that indicate pwnage
* script is pretty verbose (maybe too verbose) but I like seeing what's going on. Feel free to silence print statements if you prefer.
Customization
See the odbconfig.py file to specify your parameters, because really name of the game is exposing the data YOU are interested in. I provided some examples in the config file. Play around with them!
You can:
* specify what index or collection names you want to collect by specifying substrings in config file. For exam[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
ODBParser - OSINT Tool To Search, Parse And Dump Only The Open Elasticsearch And MongoDB Directories That Have The Data You Care About Exposing
https://1.bp.blogspot.com/-48RWt9wOaPM/YTq6Kfx-jEI/AAAAAAAAul0/Aa1E2Q3fFzAJdW_gygsTlaGB1HcPInqpgCNcBGAsYHQ/w400-h400/ODBParser_1_glassdb.png
ODBParser is a tool to search for PII being exposed in open databases.
ONLY to be used to identify exposed PII and warn server owners of irresponsible database maintenance
OR to query databases you have permission to access!
PLEASE USE RESPONSIBLY
What is this?
Wrote this as wanted to create one-stop OSINT tool for searching, parsing and analyzing open databases in order to identify leakages of PII on third-party servers. Other tools seem to either only search for open databases or dump them once you've identified them and then will grab data indiscriminately. Grew from function or two into what's in this repo, so code isn't as clean and pretty as it could be.
Features
To identify open databases you can:
* query Shodanand BinaryEdgeusing all possible parameters (filter by country, port number, whatever)
* specify single IP address
* load up file that has list of IP addresses
* paste list of IP addresses from clipboard
Dumping options:
* parses all databases/collections to identify data you specify
* grab everything hosted on server
* grab just one index/collection
* Use ctrl+c to skip dumping certain index
Post-Processing:
* convert JSON dumps to CSV
* remove useless columns from CSV
Other features:
* keeps track of all the IP addresses and databases you have queried along with info about each server.
* maintains stats file with number of IP's you've queried, number of databases you've parsed and number of records you've dumped
* convert JSON dumps you already have to CSV
* for every database that has total number of records above your limit, script will create an entry in a special file along with 5 sample records so you can review and decide whether the database is worth grabbing
* Default output is line-separated JSON file with a JSON object on each line. You can choose to have it output a "proper JSON" file by using the "properjson" flag
* You can convert the files to CSV on the fly or you can convert only certain files after run is complete (I recommend latter). Converted JSON files will be moved to folder called "JSON backups" in same directory. NOTE:When converting to CSV, script drops exact duplicate rows and drops columns and rows where all values are NaN, because that's what I wanted to do. Feel free to edit function if you'd rather have exact copy of JSON file.
* Windows ONLYIf script pulls back huge number of indices that have field you care about, script will list names of the dbs, pause and give you ten seconds to decide whether you want to go ahead and pull all the data from every index as I've found if you get too many databases returned even after you've specified fields you want, there is a good chance data is fake or useless logs and you can usually tell from name whether either possibility is the case. If you don't act within 10 seconds, script will go ahead and dump every index.
* as you may have noticed, lot of people[...]
___________________________
@hacking_Attack
@Hacking_Video
ODBParser - OSINT Tool To Search, Parse And Dump Only The Open Elasticsearch And MongoDB Directories That Have The Data You Care About Exposing
https://1.bp.blogspot.com/-48RWt9wOaPM/YTq6Kfx-jEI/AAAAAAAAul0/Aa1E2Q3fFzAJdW_gygsTlaGB1HcPInqpgCNcBGAsYHQ/w400-h400/ODBParser_1_glassdb.png
ODBParser is a tool to search for PII being exposed in open databases.
ONLY to be used to identify exposed PII and warn server owners of irresponsible database maintenance
OR to query databases you have permission to access!
PLEASE USE RESPONSIBLY
What is this?
Wrote this as wanted to create one-stop OSINT tool for searching, parsing and analyzing open databases in order to identify leakages of PII on third-party servers. Other tools seem to either only search for open databases or dump them once you've identified them and then will grab data indiscriminately. Grew from function or two into what's in this repo, so code isn't as clean and pretty as it could be.
Features
To identify open databases you can:
* query Shodanand BinaryEdgeusing all possible parameters (filter by country, port number, whatever)
* specify single IP address
* load up file that has list of IP addresses
* paste list of IP addresses from clipboard
Dumping options:
* parses all databases/collections to identify data you specify
* grab everything hosted on server
* grab just one index/collection
* Use ctrl+c to skip dumping certain index
Post-Processing:
* convert JSON dumps to CSV
* remove useless columns from CSV
Other features:
* keeps track of all the IP addresses and databases you have queried along with info about each server.
* maintains stats file with number of IP's you've queried, number of databases you've parsed and number of records you've dumped
* convert JSON dumps you already have to CSV
* for every database that has total number of records above your limit, script will create an entry in a special file along with 5 sample records so you can review and decide whether the database is worth grabbing
* Default output is line-separated JSON file with a JSON object on each line. You can choose to have it output a "proper JSON" file by using the "properjson" flag
* You can convert the files to CSV on the fly or you can convert only certain files after run is complete (I recommend latter). Converted JSON files will be moved to folder called "JSON backups" in same directory. NOTE:When converting to CSV, script drops exact duplicate rows and drops columns and rows where all values are NaN, because that's what I wanted to do. Feel free to edit function if you'd rather have exact copy of JSON file.
* Windows ONLYIf script pulls back huge number of indices that have field you care about, script will list names of the dbs, pause and give you ten seconds to decide whether you want to go ahead and pull all the data from every index as I've found if you get too many databases returned even after you've specified fields you want, there is a good chance data is fake or useless logs and you can usually tell from name whether either possibility is the case. If you don't act within 10 seconds, script will go ahead and dump every index.
* as you may have noticed, lot of people[...]
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
ODBParser - OSINT Tool To Search, Parse And Dump Only The Open Elasticsearch And MongoDB Directories That Have The Data You Care…
IDOR THE HARD WAY (IDOR TO ACCOUNT TAKEOVER)
Hello My name hazem yaser, I’m a Junior Penetration Tester, Bug Hunter, Computer Science Student As I want To share my Findings with the…Continue reading on Medium »
Read more...
Hello My name hazem yaser, I’m a Junior Penetration Tester, Bug Hunter, Computer Science Student As I want To share my Findings with the…Continue reading on Medium »
Read more...
IDOR THE HARD WAY (IDOR TO ACCOUNT TAKEOVER)
https://medium.com/@hazeemyasseer/idor-the-hard-way-idor-to-account-takeover-3f0176bd7d8a?source=rss------bug_bounty-5
https://medium.com/@hazeemyasseer/idor-the-hard-way-idor-to-account-takeover-3f0176bd7d8a?source=rss------bug_bounty-5
Hello My name hazem yaser, I’m a Junior Penetration Tester, Bug Hunter, Computer Science Student As I want To share my Findings with the…Continue reading on Medium » (https://medium.com/@hazeemyasseer/idor-the-hard-way-idor-to-account-takeover-3f0176bd7d8a?source=rss------bug_bounty-5)
hacking: security in practice
What happened to GitHackTools?
The repo's been deleted from GitHub. Does anyone know what happened?
https://github.com/GitHackTools
Edit: Typo
submitted by /u/gekab82055
[link] [comments]
What happened to GitHackTools?
The repo's been deleted from GitHub. Does anyone know what happened?
https://github.com/GitHackTools
Edit: Typo
submitted by /u/gekab82055
[link] [comments]
reddit
What happened to GitHackTools?
The repo's been deleted from GitHack. Does anyone know what happened? [https://github.com/GitHackTools](https://github.com/GitHackTools)
https://b.thumbs.redditmedia.com/iKUYClCmRRjdBNBfLZnY8nqZmfqwkCl5aq4yTioivBM.jpg I need some help! My wife's phone suddenly started showing this. It's a Samsung S9. Can't find anything on google. Anyone have any idea on what this could be? Thanks!
https://preview.redd.it/h3xvedq7c3n71.png?width=1771&format=png&auto=webp&s=01c762338b4809ca3698b5a0d4acc459ac7a9c51
submitted by /u/frankisan
[link] [comments]
https://preview.redd.it/h3xvedq7c3n71.png?width=1771&format=png&auto=webp&s=01c762338b4809ca3698b5a0d4acc459ac7a9c51
submitted by /u/frankisan
[link] [comments]
hacking: security in practice
IP address location, missing 14 yo son
Hi everyone, I have an IP address from where my son(or someone) checked his email through mobile this morning. He never came home Thursday which isn’t like him and the police aren’t doing too much being a weekend. I would appreciate any help with this.
submitted by /u/KillerEd85
[link] [comments]
IP address location, missing 14 yo son
Hi everyone, I have an IP address from where my son(or someone) checked his email through mobile this morning. He never came home Thursday which isn’t like him and the police aren’t doing too much being a weekend. I would appreciate any help with this.
submitted by /u/KillerEd85
[link] [comments]
reddit
IP address location, missing 14 yo son
Hi everyone, I have an IP address from where my son(or someone) checked his email through mobile this morning. He never came home Thursday which...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
whoami
Hey, welcome! My name is Mehmet Deniz Özkahraman. I’m 20. I live in Turkey and I am a Computer Engineering Student at Izmir University of…
Continue reading on Medium »
whoami
Hey, welcome! My name is Mehmet Deniz Özkahraman. I’m 20. I live in Turkey and I am a Computer Engineering Student at Izmir University of…
Continue reading on Medium »
Autoharness - A Tool That Automatically Creates Fuzzing Harnesses Based On A Library
http://www.kitploit.com/2021/09/autoharness-tool-that-automatically.html
http://www.kitploit.com/2021/09/autoharness-tool-that-automatically.html