Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Nasıl Hacker Olunur
Konuyla ilgili tüm makaleye buradan ulaşabilirsiniz
Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖
Nasıl Hacker Olunur
Konuyla ilgili tüm makaleye buradan ulaşabilirsiniz
Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
İşte O Hackerın Bize Özel Anlattıkları
konuşmanın özetini okumak için buraya tıklayın
Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖
İşte O Hackerın Bize Özel Anlattıkları
konuşmanın özetini okumak için buraya tıklayın
Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Hacked sites push TeamViewer using fake expired certificate alert
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hacked sites push TeamViewer using fake expired certificate alertPost Views: 159
Reading Time: 1 Minute
Threat actors are compromising Windows IIS servers to add expired certificate notification pages that prompt visitors to download a malicious fake installer.
Internet Information Services (IIS) is Microsoft Windows web server software included with all Windows versions since Windows 2000, XP, and Server 2003.
The message shown on the malicious certificate expiration error pages reads: “Detected a potential security risk and has not extended the transition to [sitename]. Updating a security certificate may allow this connection to succeed. NET::ERR_CERT_OUT_OF_DATE.”
As Malwarebytes Threat Intelligence security researchers observed, the malware installed via a fake update installer [VirusTotal] signed with a Digicert certificate.
https://www.bleepstatic.com/images/news/u/1109292/2021/Malicious%20page%20hosted%20on%20hacked%20IIS%20server.png
<figcaptionMalicious page hosted on hacked IIS server
See Also: Complete Offensive Security and Ethical Hacking Course
The payload dropped on infected systems is TVRAT (aka TVSPY, TeamSpy, TeamViewerENT, or Team Viewer RAT), a malware designed to provides its operators with full remote access to infected hosts.
Once deployed on infected device, the malware will silently install and launch an instance of the TeamViewer remote control software.
After being launched, the TeamViewer server will reach out to a command-and-control (C2) server to let the attackers know they can remotely take complete control of the newly compromised computer.
TVRAT first surfaced in 2013 when it was delivered via spam campaigns as malicious attachments that tricked targets into enabling Office macros.
https://www.bleepstatic.com/images/news/u/1109292/2021/TeamViewerr%20installed%20by%20TVRAT.png
<figcaptionTeamViewer installed by TVRAT IIS servers: vulnerable and targetedWhile the method used by the attackers to compromise IIS servers is not yet known, attackers can use various ways to breach a Windows IIS serverr.
For instance, exploit code targeting a critical wormable vulnerability found in the HTTP Protocol Stack (HTTP.sys) used by the Windows IIS web server has been publicly available since May.
Microsoft patched the security flaw (tracked as CVE-2021-31166) during the May Patch Tuesday and said it only impacts Windows 10 versions 2004/20H2 and Windows Server versions 2004/20H2.
There hasn’t been any malicious activity abusing this flaw in the wild since then and, as we reported at the time, most potential targets were likely safe from attacks given that home users with the latest Windows 10 versions would’ve updated and companies don’t commonly use the latest Window Server versions.
See Also: Windows MSHTML zero-day defenses bypassed as new info emerges I've built a PoC for CVE-2021-31166 the "HTTP Protocol Stack Remote Code Execution Vulnerability": https://t.co/8mqLCByvCp 🔥🔥 pic.twitter.com/yzgUs2CQO5
— Axel Souchet (@0vercl0k) May 16, 2021
However, state-sponsored level threat actors have also leveraged various other exploits to compromise internet-facing IIS servers in the past.
The most recent example is an advanced persistent threat (APT) group tracked as Praying Mantis or TG1021, which targeted Microsoft IIS web servers according to an August report from Israeli security firm Sygnia.
In their attacks, Praying Mantis used a Checkbox Survey RCE Exploit (CVE-2021-27852), a VIEWSTATE Deserialization[...]
Hacked sites push TeamViewer using fake expired certificate alert
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hacked sites push TeamViewer using fake expired certificate alertPost Views: 159
Reading Time: 1 Minute
Threat actors are compromising Windows IIS servers to add expired certificate notification pages that prompt visitors to download a malicious fake installer.
Internet Information Services (IIS) is Microsoft Windows web server software included with all Windows versions since Windows 2000, XP, and Server 2003.
The message shown on the malicious certificate expiration error pages reads: “Detected a potential security risk and has not extended the transition to [sitename]. Updating a security certificate may allow this connection to succeed. NET::ERR_CERT_OUT_OF_DATE.”
As Malwarebytes Threat Intelligence security researchers observed, the malware installed via a fake update installer [VirusTotal] signed with a Digicert certificate.
https://www.bleepstatic.com/images/news/u/1109292/2021/Malicious%20page%20hosted%20on%20hacked%20IIS%20server.png
<figcaptionMalicious page hosted on hacked IIS server
See Also: Complete Offensive Security and Ethical Hacking Course
The payload dropped on infected systems is TVRAT (aka TVSPY, TeamSpy, TeamViewerENT, or Team Viewer RAT), a malware designed to provides its operators with full remote access to infected hosts.
Once deployed on infected device, the malware will silently install and launch an instance of the TeamViewer remote control software.
After being launched, the TeamViewer server will reach out to a command-and-control (C2) server to let the attackers know they can remotely take complete control of the newly compromised computer.
TVRAT first surfaced in 2013 when it was delivered via spam campaigns as malicious attachments that tricked targets into enabling Office macros.
https://www.bleepstatic.com/images/news/u/1109292/2021/TeamViewerr%20installed%20by%20TVRAT.png
<figcaptionTeamViewer installed by TVRAT IIS servers: vulnerable and targetedWhile the method used by the attackers to compromise IIS servers is not yet known, attackers can use various ways to breach a Windows IIS serverr.
For instance, exploit code targeting a critical wormable vulnerability found in the HTTP Protocol Stack (HTTP.sys) used by the Windows IIS web server has been publicly available since May.
Microsoft patched the security flaw (tracked as CVE-2021-31166) during the May Patch Tuesday and said it only impacts Windows 10 versions 2004/20H2 and Windows Server versions 2004/20H2.
There hasn’t been any malicious activity abusing this flaw in the wild since then and, as we reported at the time, most potential targets were likely safe from attacks given that home users with the latest Windows 10 versions would’ve updated and companies don’t commonly use the latest Window Server versions.
See Also: Windows MSHTML zero-day defenses bypassed as new info emerges I've built a PoC for CVE-2021-31166 the "HTTP Protocol Stack Remote Code Execution Vulnerability": https://t.co/8mqLCByvCp 🔥🔥 pic.twitter.com/yzgUs2CQO5
— Axel Souchet (@0vercl0k) May 16, 2021
However, state-sponsored level threat actors have also leveraged various other exploits to compromise internet-facing IIS servers in the past.
The most recent example is an advanced persistent threat (APT) group tracked as Praying Mantis or TG1021, which targeted Microsoft IIS web servers according to an August report from Israeli security firm Sygnia.
In their attacks, Praying Mantis used a Checkbox Survey RCE Exploit (CVE-2021-27852), a VIEWSTATE Deserialization[...]
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Hacked sites push TeamViewer using fake expired certificate alert https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hacked sites push TeamViewer using fake expired certificate alertPost Views:…
and Altserialization Insecure Deserialization exploits, and a Telerik-UI Exploit (CVE-2019-18935, CVE-2017-11317).
See Also: Offensive Security Tool: SniperPhish “The operators behind the activity targeted Windows internet-facing servers, using mostly deserialization attacks, to load a completely volatile, custom malware platform tailored for the Windows IIS environment,” the researchers said.
Praying Mantis actors then used the access the hacked IIS servers provided to conduct additional malicious tasks, including credential harvesting, reconnaissance, and lateral movement on their targets’ networks.
Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/hackers-waging-living-off-land-attacks-on-azure-showcase_image-7-a-16158-90x90.jpg Azure Zero-Day Flaws Highlight Lurking Supply-Chain Risk1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Anonymous-90x90.png Anonymous leaks gigabytes of data from alt-right web host Epik4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-90x90.jpg New malware uses Windows Subsystem for Linux for stealthy attacks4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Google-Chrome-Browser-90x90.jpg Pair of Google Chrome Zero-Day Bugs Actively Exploited5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/banner-2021.3-release-90x90.jpg Kali Linux 2021.3 released: Kali NetHunter on a smartwatch, wider OpenSSL compatibility, new tools6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-exploit-90x90.jpg Microsoft Patches Actively Exploited Windows Zero-Day Bug6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Apple-marketing-communications-mix-90x90.jpg Apple Issues Emergency Fix for NSO Zero-Click Zero Day1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/zeroday-90x90.png Windows MSHTML zero-day exploits shared on hacking forums1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks2 weeks ago
The post Hacked sites push TeamViewer using fake expired certificate alert first appeared on Black Hat Ethical Hacking.
See Also: Offensive Security Tool: SniperPhish “The operators behind the activity targeted Windows internet-facing servers, using mostly deserialization attacks, to load a completely volatile, custom malware platform tailored for the Windows IIS environment,” the researchers said.
Praying Mantis actors then used the access the hacked IIS servers provided to conduct additional malicious tasks, including credential harvesting, reconnaissance, and lateral movement on their targets’ networks.
Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/hackers-waging-living-off-land-attacks-on-azure-showcase_image-7-a-16158-90x90.jpg Azure Zero-Day Flaws Highlight Lurking Supply-Chain Risk1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Anonymous-90x90.png Anonymous leaks gigabytes of data from alt-right web host Epik4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-90x90.jpg New malware uses Windows Subsystem for Linux for stealthy attacks4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Google-Chrome-Browser-90x90.jpg Pair of Google Chrome Zero-Day Bugs Actively Exploited5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/banner-2021.3-release-90x90.jpg Kali Linux 2021.3 released: Kali NetHunter on a smartwatch, wider OpenSSL compatibility, new tools6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-exploit-90x90.jpg Microsoft Patches Actively Exploited Windows Zero-Day Bug6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Apple-marketing-communications-mix-90x90.jpg Apple Issues Emergency Fix for NSO Zero-Click Zero Day1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/zeroday-90x90.png Windows MSHTML zero-day exploits shared on hacking forums1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks2 weeks ago
The post Hacked sites push TeamViewer using fake expired certificate alert first appeared on Black Hat Ethical Hacking.
MailRipV2 - Improved SMTP Checker / SMTP Cracker With Proxy-Support, Inbox Test And Many More Features
http://www.kitploit.com/2021/09/mailripv2-improved-smtp-checker-smtp.html
http://www.kitploit.com/2021/09/mailripv2-improved-smtp-checker-smtp.html
Your SMTP checker / SMTP cracker for mailpass combolists including features like: proxy-support (SOCKS4 / SOCKS5) with automatic proxy-scraper and checker, e-mail delivery / inbox check and DNS lookup for unknown SMTP-hosts. Made for easy usage and always working!
Overview
Legal Notices
You are ONLY allowed to use the following code for educational purposes! Mail.Rip V2 shall not be used for any kind of illegal activity nor law enforcement at any time. This restriction applies to all cases of usage, no matter whether the code as a whole or only parts of it are being used. By downloading and / or using any part of the code and / or any file of this repository, you agree to this restriction without remarks.
Features
Mail.Rip v2 is a SMTP checker / SMTP cracker written in Python 3.8. Using the "smtplib", it allows you to check common mailpass combolists for valid SMTP logins. It has included dictionaries and lists containing details of common email providers as well as most common ports used for SMTP servers. In case any data is missing, "dnspython" is used to lookup unknown SMTP hosts in MX records. Moreover, Mail.Rip V2 comes with SOCKS-proxy support including a proxy-scraper and checker function. If the proxy-support is activated, the checker / cracker scrapes SOCKS4 or SOCKS5 proxys from common online sources and will check the results, then.. The working proxys will be used randomly. And you can add new sources by editing the library.json at any time. Last but not least, Mail.Rip V2 includes an email delivery test / inbox check for found SMTP logins. For every valid combo, it tries to send a plain text email with the found SMTP login. All test messages are sent to your own user-defined receiving address whereby the content of the test emails is generated randomly. The templates can be edited in the "library.json", too. Mail.Rip V2 is full functional and ready to use!
How-to use Mail.Rip V2
Mail.Rip V2 has been written and tested with Python 3.8. It should run on any OS as long as Python and all dependencies are installed.
Just follow the steps below!
Installing needed Python modules
All Python modules / packages needed are listed in the txt-file requirements.txt. For an easy installation, type: pip3 install -r requirements.txt
Installing any missing dependencies may take some time. Be patient, please.
Start the Checker (https://www.kitploit.com/search/label/Checker) / Cracker
With all dependencies being installed, you can start Mail.Rip V2 with: python3 MailRipV2.py
No extra arguments are needed. You only need to copy your combofile into the same directory before starting the checker / cracker. After starting it, just follow the steps from (1) to (4). For more information see "Options in Main Menu".
Please regard:
Your combofile needs to be encoded with utf-8! Any other encoding (https://www.kitploit.com/search/label/Encoding) may cause errors.
Options in Main Menu
[1] Set Default Values
Use this option to edit the default values for Mail.Rip V2. You can edit the following here: Amount of threads to use for checking / cracking. Default timeout for connections. De-/activate the blacklist check for email domains. Set your email address as receiver for test messages.
[2] De-/Activate Proxy-Support
This option allows you to activate or deactivate the proxy-support. If activated, you will be asked for the proxy-type to use. Just enter SOCKS4 or SOCKS5. The scraper starts automatically then. You can add more sources by editing the library.json. After the scraping (https://www.kitploit.com/search/label/Scraping) is done, you will be asked whether you want to skip the checker. DO NOT SKIP THE CHECKER except you really, really need to start an attack immediately.
[3] Load Combos
Overview
Legal Notices
You are ONLY allowed to use the following code for educational purposes! Mail.Rip V2 shall not be used for any kind of illegal activity nor law enforcement at any time. This restriction applies to all cases of usage, no matter whether the code as a whole or only parts of it are being used. By downloading and / or using any part of the code and / or any file of this repository, you agree to this restriction without remarks.
Features
Mail.Rip v2 is a SMTP checker / SMTP cracker written in Python 3.8. Using the "smtplib", it allows you to check common mailpass combolists for valid SMTP logins. It has included dictionaries and lists containing details of common email providers as well as most common ports used for SMTP servers. In case any data is missing, "dnspython" is used to lookup unknown SMTP hosts in MX records. Moreover, Mail.Rip V2 comes with SOCKS-proxy support including a proxy-scraper and checker function. If the proxy-support is activated, the checker / cracker scrapes SOCKS4 or SOCKS5 proxys from common online sources and will check the results, then.. The working proxys will be used randomly. And you can add new sources by editing the library.json at any time. Last but not least, Mail.Rip V2 includes an email delivery test / inbox check for found SMTP logins. For every valid combo, it tries to send a plain text email with the found SMTP login. All test messages are sent to your own user-defined receiving address whereby the content of the test emails is generated randomly. The templates can be edited in the "library.json", too. Mail.Rip V2 is full functional and ready to use!
How-to use Mail.Rip V2
Mail.Rip V2 has been written and tested with Python 3.8. It should run on any OS as long as Python and all dependencies are installed.
Just follow the steps below!
Installing needed Python modules
All Python modules / packages needed are listed in the txt-file requirements.txt. For an easy installation, type: pip3 install -r requirements.txt
Installing any missing dependencies may take some time. Be patient, please.
Start the Checker (https://www.kitploit.com/search/label/Checker) / Cracker
With all dependencies being installed, you can start Mail.Rip V2 with: python3 MailRipV2.py
No extra arguments are needed. You only need to copy your combofile into the same directory before starting the checker / cracker. After starting it, just follow the steps from (1) to (4). For more information see "Options in Main Menu".
Please regard:
Your combofile needs to be encoded with utf-8! Any other encoding (https://www.kitploit.com/search/label/Encoding) may cause errors.
Options in Main Menu
[1] Set Default Values
Use this option to edit the default values for Mail.Rip V2. You can edit the following here: Amount of threads to use for checking / cracking. Default timeout for connections. De-/activate the blacklist check for email domains. Set your email address as receiver for test messages.
[2] De-/Activate Proxy-Support
This option allows you to activate or deactivate the proxy-support. If activated, you will be asked for the proxy-type to use. Just enter SOCKS4 or SOCKS5. The scraper starts automatically then. You can add more sources by editing the library.json. After the scraping (https://www.kitploit.com/search/label/Scraping) is done, you will be asked whether you want to skip the checker. DO NOT SKIP THE CHECKER except you really, really need to start an attack immediately.
[3] Load Combos
Option #3 starts the Comboloader. Enter the name of your combofile, for example: combos.txt. All combos in the file will be loaded and prepared for an attack. Therefor, the Comboloader performs the following steps: Any other separator than ":" is replaced. The email address in the combo is verified by its format using regular expressions. For verified email addresses, the domain is checked against the blacklist included in library.json. Then, the loader checks whether it has already loaded the given combo before (duplicates check). All combos passing the checks will be loaded for an attack and saved to a txt-file called targets.txt. Please make sure that your combofile is encoded with utf-8 or errors may occur.
[4] Start Attack
This one is obvious.
Various
See the sections below for any tips, hints and other information.
SMTP cracking (https://www.kitploit.com/search/label/Cracking) / SMTP checking process
Mail.Rip V2 uses the smtplib for the checking / cracking process. The "magic" is done this way: The SMTP cracker / SMTP checker reads the next combo from the list loaded. It looks up the email domain in the "smtphost" dictionary (https://www.kitploit.com/search/label/Dictionary) for the SMTP-host to attack. For unknown hosts, it will try to get the address from the MX records of the email domain. The connection port for host found in MX records is searched using the most common ones in a trial and error process. Afterwards it establishes a connection to the SMTP host (trying SSL and non-SSL as well as TLS) and sends the login data using the target email address and the given password from the combo. If the login is denied, the cracker / checker will try to login with the user-ID (email without @...) and the password. In case the login data is valid, the so-called "hit" will be saved to a txt-file. In the end Mail.Rip V2 will try to send a test message to you using the found SMTP. For best results every user should edit the host information in the library.json before starting Mail.Rip V2 the first time. Adding the data of the most common e-mail providers in a combolist will always speed up the checking / cracking process. And it will probably raise less security flags on the server-side. Other ways to improve your results are: deactivating the proxy-support and adjusting default values. In fact, IT IS RECOMMENDED TO LEAVE THE PROXY-SUPPORT DEACTIVATED. Without using proxys, you will receive much better results - for the checker as well as for the inbox check.
Notes on the email delivery test (inbox check)
The email content is generated randomly using templates in the "library.json". Edit those templates for your needs. Editing the templates from time to time will provide a higher success rate. Always regard that the email delivery test may return false negative results for many reasons. It just confirms that the given SMTP host can be used for sending emails with any software. Well-known email providers may block or restrict access to SMTP accounts, especially for tools like Mail.Rip V2. Moreover, free proxys may be blacklisted as well as the certain SMTP account itself. You should test valid logins for which the delivery test failed again after the attack has been finished.
Notes on the blacklist check
The library.json includes a blacklist for email domains. More than 500 trashmail domains have been added to it. But there are also some very popular email providers on it. Those email providers are most often a waste of time when you check or crack mailpass combolists. Sometimes they just block the access, sometimes they ask for further verification. If you want to attack those providers, too, edit the blacklist for your needs.
Support Mail.Rip V2
[4] Start Attack
This one is obvious.
Various
See the sections below for any tips, hints and other information.
SMTP cracking (https://www.kitploit.com/search/label/Cracking) / SMTP checking process
Mail.Rip V2 uses the smtplib for the checking / cracking process. The "magic" is done this way: The SMTP cracker / SMTP checker reads the next combo from the list loaded. It looks up the email domain in the "smtphost" dictionary (https://www.kitploit.com/search/label/Dictionary) for the SMTP-host to attack. For unknown hosts, it will try to get the address from the MX records of the email domain. The connection port for host found in MX records is searched using the most common ones in a trial and error process. Afterwards it establishes a connection to the SMTP host (trying SSL and non-SSL as well as TLS) and sends the login data using the target email address and the given password from the combo. If the login is denied, the cracker / checker will try to login with the user-ID (email without @...) and the password. In case the login data is valid, the so-called "hit" will be saved to a txt-file. In the end Mail.Rip V2 will try to send a test message to you using the found SMTP. For best results every user should edit the host information in the library.json before starting Mail.Rip V2 the first time. Adding the data of the most common e-mail providers in a combolist will always speed up the checking / cracking process. And it will probably raise less security flags on the server-side. Other ways to improve your results are: deactivating the proxy-support and adjusting default values. In fact, IT IS RECOMMENDED TO LEAVE THE PROXY-SUPPORT DEACTIVATED. Without using proxys, you will receive much better results - for the checker as well as for the inbox check.
Notes on the email delivery test (inbox check)
The email content is generated randomly using templates in the "library.json". Edit those templates for your needs. Editing the templates from time to time will provide a higher success rate. Always regard that the email delivery test may return false negative results for many reasons. It just confirms that the given SMTP host can be used for sending emails with any software. Well-known email providers may block or restrict access to SMTP accounts, especially for tools like Mail.Rip V2. Moreover, free proxys may be blacklisted as well as the certain SMTP account itself. You should test valid logins for which the delivery test failed again after the attack has been finished.
Notes on the blacklist check
The library.json includes a blacklist for email domains. More than 500 trashmail domains have been added to it. But there are also some very popular email providers on it. Those email providers are most often a waste of time when you check or crack mailpass combolists. Sometimes they just block the access, sometimes they ask for further verification. If you want to attack those providers, too, edit the blacklist for your needs.
Support Mail.Rip V2
If you like Mail.Rip V2 support it, please! Every donation helps. Or just buy me coffee! The more coffee I drink the more time I can spend on projects like this one. Just use the wallets (BTC / LTC) below for your donation. All donations are appreciated - no matter how much you send. A single Dollar can keep me awake for one or two hours ... ;-)
Donation wallets
BTC (Bitcoin): 1CU8WukMCDmeBfqJpsR4Vq9kxvNiRdYhf5 LTC (Litecoin): LeJsHzcMixhvR1qEfgHJU32joVAJDgQwR7
Last Update
2021-03-27: release X - FINAL VERSION! See commit comments for further details.
Download MailRipV2 (https://github.com/DrPython3/MailRipV2)
Donation wallets
BTC (Bitcoin): 1CU8WukMCDmeBfqJpsR4Vq9kxvNiRdYhf5 LTC (Litecoin): LeJsHzcMixhvR1qEfgHJU32joVAJDgQwR7
Last Update
2021-03-27: release X - FINAL VERSION! See commit comments for further details.
Download MailRipV2 (https://github.com/DrPython3/MailRipV2)
A fever Worth 750$- [Accessing Private Projects ]
https://medium.com/@shakti.gtp/a-fever-worth-750-accessing-private-projects-d113c561311f?source=rss------bug_bounty-5
https://medium.com/@shakti.gtp/a-fever-worth-750-accessing-private-projects-d113c561311f?source=rss------bug_bounty-5
Hello Champs, Shakti here , I hope you all are having some good times. Usually i’m not a person who makes writeup for the findings, but i…Continue reading on Medium » (https://medium.com/@shakti.gtp/a-fever-worth-750-accessing-private-projects-d113c561311f?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!MailRipV2 - Improved SMTP Checker / SMTP Cracker With Proxy-Support, Inbox Test And Many More Features
Your SMTP checker / SMTP cracker for mailpass combolists including features like: proxy-support (SOCKS4 / SOCKS5) with automatic proxy-scraper and checker, e-mail delivery / inbox check and DNS lookup for unknown SMTP-hosts. Made for easy usage and always working!
Overview
Legal Notices
You are ONLY allowed to use the following code for educational purposes!Mail.Rip V2 shall not be used for any kind of illegal activity nor law enforcement at any time. This restriction applies to all cases of usage, no matter whether the code as a whole or only parts of it are being used.
By downloading and / or using any part of the code and / or any file of this repository, you agree to this restriction without remarks.
Features
Mail.Rip v2 is a SMTP checker / SMTP cracker written in Python 3.8. Using the "smtplib", it allows you to check common mailpass combolists for valid SMTP logins. It has included dictionaries and lists containing details of common email providers as well as most common ports used for SMTP servers.In case any data is missing, "dnspython" is used to lookup unknown SMTP hosts in MX records.
Moreover, Mail.Rip V2 comes with SOCKS-proxy supportincluding a proxy-scraper and checkerfunction. If the proxy-support is activated, the checker / cracker scrapes SOCKS4 or SOCKS5 proxys from common online sources and will check the results, then.. The working proxyswill be used randomly. And you can add new sources by editing the library.jsonat any time.
Last but not least, Mail.Rip V2 includes an email delivery test / inbox checkfor found SMTP logins. For every valid combo, it tries to send a plain text email with the found SMTP login. All test messages are sent to your own user-defined receiving address whereby the content of the test emails is generated randomly. The templates can be edited in the "library.json", too.
Mail.Rip V2 is full functional and ready to use!
How-to use Mail.Rip V2
Mail.Rip V2has been written and tested with Python 3.8. It should run on any OS as long as Python and all dependencies are installed.
Just follow the steps below!
Installing needed Python modules
All Python modules / packages needed are listed in the txt-file requirements.txt. For an easy installation, type:
Installing any missing dependencies may take some time. Be patient, please.
Start the Checker / Cracker
With all dependencies being installed, you can start Mail.Rip V2 with:
No extra arguments are needed. You only need to copy your combofile into the same directory before starting the checker / cracker. After starting it, just follow the steps from (1) to (4). For more information see "Options in Main Menu".
Please regard:
Your combofile needs to be encoded with utf-8! Any other encoding may cause errors.
Options in Main Menu
[1] Set Default Values
Use this option to edit the default values for Mail.Rip V2. You can edit the following here:
* Amount of threads to use for checking / cracking.
* Default timeout for connections.
* De-/activate the blacklist check for email domains.
* Set your email address as receiver for test messages.
[2] De-/Activate Proxy-Support
This option allows you to activate or deactivate the proxy-support. If activated, you will be asked for the proxy-type to use. Just enter SOCKS4or SOCKS5. The scraper starts automatically then. You can add more sources by editing the library.json. After the scraping is done, you will be asked whether you want to skip the checker[...]
Your SMTP checker / SMTP cracker for mailpass combolists including features like: proxy-support (SOCKS4 / SOCKS5) with automatic proxy-scraper and checker, e-mail delivery / inbox check and DNS lookup for unknown SMTP-hosts. Made for easy usage and always working!
Overview
Legal Notices
You are ONLY allowed to use the following code for educational purposes!Mail.Rip V2 shall not be used for any kind of illegal activity nor law enforcement at any time. This restriction applies to all cases of usage, no matter whether the code as a whole or only parts of it are being used.
By downloading and / or using any part of the code and / or any file of this repository, you agree to this restriction without remarks.
Features
Mail.Rip v2 is a SMTP checker / SMTP cracker written in Python 3.8. Using the "smtplib", it allows you to check common mailpass combolists for valid SMTP logins. It has included dictionaries and lists containing details of common email providers as well as most common ports used for SMTP servers.In case any data is missing, "dnspython" is used to lookup unknown SMTP hosts in MX records.
Moreover, Mail.Rip V2 comes with SOCKS-proxy supportincluding a proxy-scraper and checkerfunction. If the proxy-support is activated, the checker / cracker scrapes SOCKS4 or SOCKS5 proxys from common online sources and will check the results, then.. The working proxyswill be used randomly. And you can add new sources by editing the library.jsonat any time.
Last but not least, Mail.Rip V2 includes an email delivery test / inbox checkfor found SMTP logins. For every valid combo, it tries to send a plain text email with the found SMTP login. All test messages are sent to your own user-defined receiving address whereby the content of the test emails is generated randomly. The templates can be edited in the "library.json", too.
Mail.Rip V2 is full functional and ready to use!
How-to use Mail.Rip V2
Mail.Rip V2has been written and tested with Python 3.8. It should run on any OS as long as Python and all dependencies are installed.
Just follow the steps below!
Installing needed Python modules
All Python modules / packages needed are listed in the txt-file requirements.txt. For an easy installation, type:
pip3 install -r requirements.txt
Installing any missing dependencies may take some time. Be patient, please.
Start the Checker / Cracker
With all dependencies being installed, you can start Mail.Rip V2 with:
python3 MailRipV2.py
No extra arguments are needed. You only need to copy your combofile into the same directory before starting the checker / cracker. After starting it, just follow the steps from (1) to (4). For more information see "Options in Main Menu".
Please regard:
Your combofile needs to be encoded with utf-8! Any other encoding may cause errors.
Options in Main Menu
[1] Set Default Values
Use this option to edit the default values for Mail.Rip V2. You can edit the following here:
* Amount of threads to use for checking / cracking.
* Default timeout for connections.
* De-/activate the blacklist check for email domains.
* Set your email address as receiver for test messages.
[2] De-/Activate Proxy-Support
This option allows you to activate or deactivate the proxy-support. If activated, you will be asked for the proxy-type to use. Just enter SOCKS4or SOCKS5. The scraper starts automatically then. You can add more sources by editing the library.json. After the scraping is done, you will be asked whether you want to skip the checker[...]