Wordlistgen - Quickly Generate Context-Specific Wordlists For Content Discovery From Lists Of URLs Or Paths
http://www.kitploit.com/2021/09/wordlistgen-quickly-generate-context.html
http://www.kitploit.com/2021/09/wordlistgen-quickly-generate-context.html
wordlistgen is a tool to pass a list of URLs and get back a list of relevant words for your wordlists. Wordlists (https://www.kitploit.com/search/label/Wordlists) are much more effective when you take the application's context into consideration. wordlistgen (https://www.kitploit.com/search/label/WordListGen) pulls out URL components, such as subdomain (https://www.kitploit.com/search/label/Subdomain) names, paths, query strings, etc. and spits them back to stdout so you can easily add them to your wordlists
Installation
If you don't have Go installed, "go" do that! go get -u github.com/ameenmaali/wordlistgen
Usage
wordlistgen takes URLs and paths from stdin, of which you will most likely want in a file such as: $ cat file.txt
https://google.com/home/?q=2&d=asd
http://my.site
/api/v2/auth/me?id=123
Get unique URL components from a file of URLs and/or paths: cat hosts.txt | wordlistgen Get unique URL components from a file of URLs and/or paths, including query string values, and save to a file: cat hosts.txt | wordlistgen -qv > urlComponents.txt wordlistgen works at it's best when chained with other tools, such as @tonnomnom's (https://github.com/tomnomnom) waybackurls (https://github.com/tomnomnom/waybackurls) : cat hosts.txt | waybackurls (https://www.kitploit.com/search/label/Waybackurls) | wordlistgen
Help
$ wordlistgen -h
Usage of wordlistgen:
-fq
If enabled, filter out query strings (e.g. if enabled /?q=123 - q would NOT be included in results
-qv
If enabled, include query string values (e.g. if enabled /?q=123 - 123 would be included in results
Download Wordlistgen (https://github.com/ameenmaali/wordlistgen)
Installation
If you don't have Go installed, "go" do that! go get -u github.com/ameenmaali/wordlistgen
Usage
wordlistgen takes URLs and paths from stdin, of which you will most likely want in a file such as: $ cat file.txt
https://google.com/home/?q=2&d=asd
http://my.site
/api/v2/auth/me?id=123
Get unique URL components from a file of URLs and/or paths: cat hosts.txt | wordlistgen Get unique URL components from a file of URLs and/or paths, including query string values, and save to a file: cat hosts.txt | wordlistgen -qv > urlComponents.txt wordlistgen works at it's best when chained with other tools, such as @tonnomnom's (https://github.com/tomnomnom) waybackurls (https://github.com/tomnomnom/waybackurls) : cat hosts.txt | waybackurls (https://www.kitploit.com/search/label/Waybackurls) | wordlistgen
Help
$ wordlistgen -h
Usage of wordlistgen:
-fq
If enabled, filter out query strings (e.g. if enabled /?q=123 - q would NOT be included in results
-qv
If enabled, include query string values (e.g. if enabled /?q=123 - 123 would be included in results
Download Wordlistgen (https://github.com/ameenmaali/wordlistgen)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Unpatched Apple Zero-Day in macOS Finder Allows Code Execution
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Unpatched Apple Zero-Day in macOS Finder Allows Code ExecutionPost Views: 134
Reading Time: 1 Minute
A zero-day security vulnerability in Apple’s macOS Finder system could allow remote attackers to trick users into running arbitrary commands, according to researchers – and a silent patch hasn’t fixed it.
For those not in the Apple camp, the macOS Finder is the default file manager and GUI front-end used on all Macintosh operating systems. It’s the first thing users see upon booting, and it governs the launching of other applications and the overall user management of files, disks and network volumes. It’s the overlord application for everything else on the Mac, in other words.
According to an SSD Secure Disclosure advisory this week, the vulnerability exists in the way macOS Finder handles .Inetloc files. Inetloc files are Apple-specific, and function as shortcuts to internet locations, such as an RSS feed or a telnet location; or they can be used to open documents locally on someone’s Mac within a browser using the “file://” format (in place of http://). It’s the latter function that’s at issue with the zero day, researchers said.
In an exploit scenario for the bug, the .Inetloc files can be specially crafted to contain embedded commands. The crafted files can then be attached to (or linked in) malicious emails, researchers added – and if users are socially engineered into clicking on them, those commands embedded inside automatically execute in stealth mode, with no alert or prompt given to victims.
“A vulnerability in the way macOS processes .Inetloc files causes it to run commands embedded inside, the commands it runs can be local to the macOS allowing the execution of arbitrary commands by the user without any warning/prompts,” according to the advisory.
See Also: Complete Offensive Security and Ethical Hacking Course It’s a simple exploitation scenario – as demoed in an SSD video included in the alert.
Independent security researcher Park Minchan reported the vulnerability to SSD, noting that the bug affects the macOS Big Sur edition and all those prior to it. In response, Apple chose not to issue a CVE and instead silently patched the issue. However, the fix was botched, researchers said.
“The vendor has notified us that file:// [function] has been silently patched,” the advisory explained. However, researchers added that the bug can still be exploited by using a mangled value, like FiLe:// in the file’s execution routine.
“Newer versions of macOS (from Big Sur) have blocked the file:// prefix…however they did case-matching causing File:// or fIle:// to bypass the check,” they explained.
“We…have not received any response from them since the report has been made,” according to the advisory. “As far as we know, at the moment, the vulnerability has not been patched.”
See Also: Windows MSHTML zero-day defenses bypassed as new info emerges There’s no word on whether it’s been exploited in the wild, and Apple did not immediately return a request for comment.
The computing giant has had its share of zero days this year. In May, it patched a critical bug in macOS that could be exploited to take screenshots of someone’s computer and to capture images of their activity within applications or on videoconferences without that person knowing. In July, it patched an actively exploited zero-day flaw in both its iOS and macOS platforms that could allow attackers to take over an affected system. And earlier this month, it rushed an emergency patch for the “ForcedEntry” zer[...]
Unpatched Apple Zero-Day in macOS Finder Allows Code Execution
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Unpatched Apple Zero-Day in macOS Finder Allows Code ExecutionPost Views: 134
Reading Time: 1 Minute
A zero-day security vulnerability in Apple’s macOS Finder system could allow remote attackers to trick users into running arbitrary commands, according to researchers – and a silent patch hasn’t fixed it.
For those not in the Apple camp, the macOS Finder is the default file manager and GUI front-end used on all Macintosh operating systems. It’s the first thing users see upon booting, and it governs the launching of other applications and the overall user management of files, disks and network volumes. It’s the overlord application for everything else on the Mac, in other words.
According to an SSD Secure Disclosure advisory this week, the vulnerability exists in the way macOS Finder handles .Inetloc files. Inetloc files are Apple-specific, and function as shortcuts to internet locations, such as an RSS feed or a telnet location; or they can be used to open documents locally on someone’s Mac within a browser using the “file://” format (in place of http://). It’s the latter function that’s at issue with the zero day, researchers said.
In an exploit scenario for the bug, the .Inetloc files can be specially crafted to contain embedded commands. The crafted files can then be attached to (or linked in) malicious emails, researchers added – and if users are socially engineered into clicking on them, those commands embedded inside automatically execute in stealth mode, with no alert or prompt given to victims.
“A vulnerability in the way macOS processes .Inetloc files causes it to run commands embedded inside, the commands it runs can be local to the macOS allowing the execution of arbitrary commands by the user without any warning/prompts,” according to the advisory.
See Also: Complete Offensive Security and Ethical Hacking Course It’s a simple exploitation scenario – as demoed in an SSD video included in the alert.
Independent security researcher Park Minchan reported the vulnerability to SSD, noting that the bug affects the macOS Big Sur edition and all those prior to it. In response, Apple chose not to issue a CVE and instead silently patched the issue. However, the fix was botched, researchers said.
“The vendor has notified us that file:// [function] has been silently patched,” the advisory explained. However, researchers added that the bug can still be exploited by using a mangled value, like FiLe:// in the file’s execution routine.
“Newer versions of macOS (from Big Sur) have blocked the file:// prefix…however they did case-matching causing File:// or fIle:// to bypass the check,” they explained.
“We…have not received any response from them since the report has been made,” according to the advisory. “As far as we know, at the moment, the vulnerability has not been patched.”
See Also: Windows MSHTML zero-day defenses bypassed as new info emerges There’s no word on whether it’s been exploited in the wild, and Apple did not immediately return a request for comment.
The computing giant has had its share of zero days this year. In May, it patched a critical bug in macOS that could be exploited to take screenshots of someone’s computer and to capture images of their activity within applications or on videoconferences without that person knowing. In July, it patched an actively exploited zero-day flaw in both its iOS and macOS platforms that could allow attackers to take over an affected system. And earlier this month, it rushed an emergency patch for the “ForcedEntry” zer[...]
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Unpatched Apple Zero-Day in macOS Finder Allows Code Execution https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Unpatched Apple Zero-Day in macOS Finder Allows Code ExecutionPost Views: 134…
o-click zero-day, which was being exploited by NSO Group to install spyware.
See Also: Offensive Security Tool: SniperPhish Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-1-90x90.jpg New macOS zero-day bug lets attackers run commands remotely1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Windows-attack-90x90.jpg Hacked sites push TeamViewer using fake expired certificate alert2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/hackers-waging-living-off-land-attacks-on-azure-showcase_image-7-a-16158-90x90.jpg Azure Zero-Day Flaws Highlight Lurking Supply-Chain Risk3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Anonymous-90x90.png Anonymous leaks gigabytes of data from alt-right web host Epik6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-90x90.jpg New malware uses Windows Subsystem for Linux for stealthy attacks6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Google-Chrome-Browser-90x90.jpg Pair of Google Chrome Zero-Day Bugs Actively Exploited1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/banner-2021.3-release-90x90.jpg Kali Linux 2021.3 released: Kali NetHunter on a smartwatch, wider OpenSSL compatibility, new tools1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-exploit-90x90.jpg Microsoft Patches Actively Exploited Windows Zero-Day Bug1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Apple-marketing-communications-mix-90x90.jpg Apple Issues Emergency Fix for NSO Zero-Click Zero Day1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/zeroday-90x90.png Windows MSHTML zero-day exploits shared on hacking forums1 week ago
The post Unpatched Apple Zero-Day in macOS Finder Allows Code Execution first appeared on Black Hat Ethical Hacking.
See Also: Offensive Security Tool: SniperPhish Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-1-90x90.jpg New macOS zero-day bug lets attackers run commands remotely1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Windows-attack-90x90.jpg Hacked sites push TeamViewer using fake expired certificate alert2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/hackers-waging-living-off-land-attacks-on-azure-showcase_image-7-a-16158-90x90.jpg Azure Zero-Day Flaws Highlight Lurking Supply-Chain Risk3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Anonymous-90x90.png Anonymous leaks gigabytes of data from alt-right web host Epik6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-90x90.jpg New malware uses Windows Subsystem for Linux for stealthy attacks6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Google-Chrome-Browser-90x90.jpg Pair of Google Chrome Zero-Day Bugs Actively Exploited1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/banner-2021.3-release-90x90.jpg Kali Linux 2021.3 released: Kali NetHunter on a smartwatch, wider OpenSSL compatibility, new tools1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-exploit-90x90.jpg Microsoft Patches Actively Exploited Windows Zero-Day Bug1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Apple-marketing-communications-mix-90x90.jpg Apple Issues Emergency Fix for NSO Zero-Click Zero Day1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/zeroday-90x90.png Windows MSHTML zero-day exploits shared on hacking forums1 week ago
The post Unpatched Apple Zero-Day in macOS Finder Allows Code Execution first appeared on Black Hat Ethical Hacking.
Wordlistgen - Quickly Generate Context-Specific Wordlists For Content Discovery From Lists Of URLs Or Paths
wordlistgen is a tool to pass a list of URLs and get back a list of relevant words for your wordlists. Wordlists are much more effective when you take the application's context into consideration. wordlistgen pulls out URL components, such as subdomain names, paths, query strings, etc. and spits them back to stdout so you can easily add them to your wordlists Installation If you don't have Go installed, "go" do that! go get -u github.com/ameenmaali/wordlistgen Usage wordlistgen takes URLs and paths from stdin, of which you will most likely want in a file such as: $ cat file.txthttps://google.com/home/?q=2&d=asdhttp://my.site/api/v2/auth/me?id=123 Get unique URL components from a file of URLs and/or paths: cat hosts.txt | wordlistgen Get unique URL components from a file of URLs and/or paths, including query string values, and save to a file: cat hosts.txt | wordlistgen -qv > urlComponents.txt wordlistgen works at it's best when chained with other tools, such as @tonnomnom's waybackurls : cat hosts.txt | waybackurls | wordlistgen Help $ wordlistgen -hUsage of wordlistgen: -fq If enabled, filter out query strings (e.g. if enabled /?q=123 - q would NOT be included in results -qv If enabled, include query string values (e.g. if enabled /?q=123 - 123 would be included in results Download Wordlistgen
Read more...
wordlistgen is a tool to pass a list of URLs and get back a list of relevant words for your wordlists. Wordlists are much more effective when you take the application's context into consideration. wordlistgen pulls out URL components, such as subdomain names, paths, query strings, etc. and spits them back to stdout so you can easily add them to your wordlists Installation If you don't have Go installed, "go" do that! go get -u github.com/ameenmaali/wordlistgen Usage wordlistgen takes URLs and paths from stdin, of which you will most likely want in a file such as: $ cat file.txthttps://google.com/home/?q=2&d=asdhttp://my.site/api/v2/auth/me?id=123 Get unique URL components from a file of URLs and/or paths: cat hosts.txt | wordlistgen Get unique URL components from a file of URLs and/or paths, including query string values, and save to a file: cat hosts.txt | wordlistgen -qv > urlComponents.txt wordlistgen works at it's best when chained with other tools, such as @tonnomnom's waybackurls : cat hosts.txt | waybackurls | wordlistgen Help $ wordlistgen -hUsage of wordlistgen: -fq If enabled, filter out query strings (e.g. if enabled /?q=123 - q would NOT be included in results -qv If enabled, include query string values (e.g. if enabled /?q=123 - 123 would be included in results Download Wordlistgen
Read more...
GitHub
GitHub - ameenmaali/wordlistgen: Quickly generate context-specific wordlists for content discovery from lists of URLs or paths
Quickly generate context-specific wordlists for content discovery from lists of URLs or paths - ameenmaali/wordlistgen
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
Wordlistgen - Quickly Generate Context-Specific Wordlists For Content Discovery From Lists Of URLs Or Paths
https://1.bp.blogspot.com/-Ady00T1Rchw/YUq1gcP9-OI/AAAAAAAAvR4/W7Kfw8YwuzM_w-8RcjOTBtXPkFoguK10wCNcBGAsYHQ/w640-h176/words.png
wordlistgen is a tool to pass a list of URLs and get back a list of relevant words for your wordlists. Wordlists are much more effective when you take the application's context into consideration. wordlistgen pulls out URL components, such as subdomain names, paths, query strings, etc. and spits them back to stdout so you can easily add them to your wordlists
Installation
If you don't have Go installed, "go" do that!
Usage
wordlistgen takes URLs and paths from stdin, of which you will most likely want in a file such as:
Get unique URL components from a file of URLs and/or paths:
Get unique URL components from a file of URLs and/or paths, including query string values, and save to a file:
wordlistgen works at it's best when chained with other tools, such as @tonnomnom's waybackurls :
Help
Download Wordlistgen
Wordlistgen - Quickly Generate Context-Specific Wordlists For Content Discovery From Lists Of URLs Or Paths
https://1.bp.blogspot.com/-Ady00T1Rchw/YUq1gcP9-OI/AAAAAAAAvR4/W7Kfw8YwuzM_w-8RcjOTBtXPkFoguK10wCNcBGAsYHQ/w640-h176/words.png
wordlistgen is a tool to pass a list of URLs and get back a list of relevant words for your wordlists. Wordlists are much more effective when you take the application's context into consideration. wordlistgen pulls out URL components, such as subdomain names, paths, query strings, etc. and spits them back to stdout so you can easily add them to your wordlists
Installation
If you don't have Go installed, "go" do that!
go get -u github.com/ameenmaali/wordlistgenUsage
wordlistgen takes URLs and paths from stdin, of which you will most likely want in a file such as:
$ cat file.txt
https://google.com/home/?q=2&d=asd
http://my.site
/api/v2/auth/me?id=123
Get unique URL components from a file of URLs and/or paths:
cat hosts.txt | wordlistgenGet unique URL components from a file of URLs and/or paths, including query string values, and save to a file:
cat hosts.txt | wordlistgen -qv > urlComponents.txtwordlistgen works at it's best when chained with other tools, such as @tonnomnom's waybackurls :
cat hosts.txt | waybackurls | wordlistgenHelp
$ wordlistgen -h
Usage of wordlistgen:
-fq
If enabled, filter out query strings (e.g. if enabled /?q=123 - q would NOT be included in results
-qv
If enabled, include query string values (e.g. if enabled /?q=123 - 123 would be included in results
Download Wordlistgen
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
WWWGrep : OWASP Foundation Web Respository
WWWGrep is a rapid search “grepping” mechanism that examines HTML elements by type and permits focused (single), multiple (file based URLs) and recursive (with respect to root domain or not) searches to be performed. Header names and values may also be recursively searched in this manner. WWWGrep was designed to help both breakers and builders to quickly examine code bases under inspection, some use cases and examples are shown below.
Installation
git clone
pip3 install -r requirements.txt
python3 wwwgrep.py
Dependencies (pip3 install -r requirements.txt)
* Python 3.5+
* BeautifulSoup 4
* UrlLib.parse
* requests_html
* argparse
* requests
* re
* os.path
Breakers
* Quickly locate login pages by searching for input fields named “username” or “password” on a site an using a recursion flag
* Quickly check headers for the use of specific technologies
* Quickly locate cookies and JWT tokens by search response headers
* Use with a proxy tool to automate recursion through a set links rapidly
* Locate all input sinks on a page (or site) by search for input fields and parameter processing symbology
* Locate all developer comments on a page to identify commented out code (or To Do’s)
* Quickly test consistency of site controls implemented during recursion (headers, HSTS, CSP etc)
* Quickly find vulnerable JavaScript code present in web pages
* Identify API tokens and access keys present in page code Builders
* Quickly test multiple sites under management for the use of vulnerable code
* Quickly test multiple sites under management for the use of vulnerable frameworks/technologies
* Find sites which may share a common codebase to determine the impact of flaws/vulnerabilities
* Find sites which share a common authentication token (header auth token)
* Find sites which may contain developer comments for server hygiene purposes Command line switches
wwwgrep.py [target/file] [search_string] [search params/criteria/recursion etc]
Search Inputs
search_string Specify the string to search for or alternatively “”
for all objects of type specified in search parameters
-t –target Specify a single URL as a target for the search
-f –file Specify a file containing a list of URLs to search
Recursion
-rr –recurse-root Limits URL recursion to the domain provided in the target
-ra –recurse-any Allows recursion to extend beyond the domain of the target
Matching Criteria
-i –ignore-case Performs case insensitive matching (default is to respect case)
-d –dedupe Allow duplicate findings per page (default is to de-duplicate findings)
-r –no-redirects Do not allow redirects (default is to allow redirects)
-b –no-base-url Omit the URL of the match from the output (default is to include the URL)
-x –regex Allows the use of RegEX matches (search_string is treated as a RegEX, default is off)
-e –separator Specify and output specifier (default is : )
-j –java-render Turns on JavaScript rendering of page objects and text (default is off)
-p –linked-js-on Turns on searching of linked (script src tags) Java Script (default is off)
Request Parameters
-ps –https-proxy Specify a proxy for the HTTPS protocol in https://: format
-pp –http-proxy Specify a proxy for the HTTP protocol in http://: format
-hu –user-agent Specify a string to use as the user agent in the request
-ha –auth-header Specify a bearer token or other auth string to use in the request header
Search Parameters
-s –all Search all page HTML and scripts for terms that match the search specification
-sr –relative Search page links that match the search specification as relative URLs
-sa –absolute Search page links that match the search specification as absolute URLs
-si –input-fields Search page input fields that match the search specification
-ss –scripts Search scripts tags that match the search spe[...]
WWWGrep : OWASP Foundation Web Respository
WWWGrep is a rapid search “grepping” mechanism that examines HTML elements by type and permits focused (single), multiple (file based URLs) and recursive (with respect to root domain or not) searches to be performed. Header names and values may also be recursively searched in this manner. WWWGrep was designed to help both breakers and builders to quickly examine code bases under inspection, some use cases and examples are shown below.
Installation
git clone
pip3 install -r requirements.txt
python3 wwwgrep.py
Dependencies (pip3 install -r requirements.txt)
* Python 3.5+
* BeautifulSoup 4
* UrlLib.parse
* requests_html
* argparse
* requests
* re
* os.path
Breakers
* Quickly locate login pages by searching for input fields named “username” or “password” on a site an using a recursion flag
* Quickly check headers for the use of specific technologies
* Quickly locate cookies and JWT tokens by search response headers
* Use with a proxy tool to automate recursion through a set links rapidly
* Locate all input sinks on a page (or site) by search for input fields and parameter processing symbology
* Locate all developer comments on a page to identify commented out code (or To Do’s)
* Quickly test consistency of site controls implemented during recursion (headers, HSTS, CSP etc)
* Quickly find vulnerable JavaScript code present in web pages
* Identify API tokens and access keys present in page code Builders
* Quickly test multiple sites under management for the use of vulnerable code
* Quickly test multiple sites under management for the use of vulnerable frameworks/technologies
* Find sites which may share a common codebase to determine the impact of flaws/vulnerabilities
* Find sites which share a common authentication token (header auth token)
* Find sites which may contain developer comments for server hygiene purposes Command line switches
wwwgrep.py [target/file] [search_string] [search params/criteria/recursion etc]
Search Inputs
search_string Specify the string to search for or alternatively “”
for all objects of type specified in search parameters
-t –target Specify a single URL as a target for the search
-f –file Specify a file containing a list of URLs to search
Recursion
-rr –recurse-root Limits URL recursion to the domain provided in the target
-ra –recurse-any Allows recursion to extend beyond the domain of the target
Matching Criteria
-i –ignore-case Performs case insensitive matching (default is to respect case)
-d –dedupe Allow duplicate findings per page (default is to de-duplicate findings)
-r –no-redirects Do not allow redirects (default is to allow redirects)
-b –no-base-url Omit the URL of the match from the output (default is to include the URL)
-x –regex Allows the use of RegEX matches (search_string is treated as a RegEX, default is off)
-e –separator Specify and output specifier (default is : )
-j –java-render Turns on JavaScript rendering of page objects and text (default is off)
-p –linked-js-on Turns on searching of linked (script src tags) Java Script (default is off)
Request Parameters
-ps –https-proxy Specify a proxy for the HTTPS protocol in https://: format
-pp –http-proxy Specify a proxy for the HTTP protocol in http://: format
-hu –user-agent Specify a string to use as the user agent in the request
-ha –auth-header Specify a bearer token or other auth string to use in the request header
Search Parameters
-s –all Search all page HTML and scripts for terms that match the search specification
-sr –relative Search page links that match the search specification as relative URLs
-sa –absolute Search page links that match the search specification as absolute URLs
-si –input-fields Search page input fields that match the search specification
-ss –scripts Search scripts tags that match the search spe[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials WWWGrep : OWASP Foundation Web Respository WWWGrep is a rapid search “grepping” mechanism that examines HTML elements by type and permits focused (single), multiple (file based URLs) and recursive (with respect to root domain or not)…
cification
-st –text Search visible text on the page that matches the search specification
-sc –comments Search comments on the page that match the search specification
-sm –meta Search in page metadata for matches to the search specification
-sf –hidden Search in hidden fields for specific matches to the search specification
-sh –header-name Search response headers for specific matches to the search specification
-sv –header-value Search response header values for specific matches to the search specification
Examples of use
Find all input fields named login on a site recursively while not leaving the root domain without case sensitivity in the match
wwwgrep.py -t https://www.target.com -i -si “login” -rr
Find all comments containing the term “to do” on all pages in a site
wwwgrep.py -t https://www.target.com -i -sc “to do” -rr
Find all comments on a specific web page
wwwgrep.py -t https://www.target.com/some_page -i -sc “”
Find all hidden fields within a list of web applications contained in the file input.txt using site recursion
wwwgrep.py -f input.txt -sf “” -rr Download
-st –text Search visible text on the page that matches the search specification
-sc –comments Search comments on the page that match the search specification
-sm –meta Search in page metadata for matches to the search specification
-sf –hidden Search in hidden fields for specific matches to the search specification
-sh –header-name Search response headers for specific matches to the search specification
-sv –header-value Search response header values for specific matches to the search specification
Examples of use
Find all input fields named login on a site recursively while not leaving the root domain without case sensitivity in the match
wwwgrep.py -t https://www.target.com -i -si “login” -rr
Find all comments containing the term “to do” on all pages in a site
wwwgrep.py -t https://www.target.com -i -sc “to do” -rr
Find all comments on a specific web page
wwwgrep.py -t https://www.target.com/some_page -i -sc “”
Find all hidden fields within a list of web applications contained in the file input.txt using site recursion
wwwgrep.py -f input.txt -sf “” -rr Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Karta : Source Code Assisted Fast Binary Matching Plugin For IDA
“Karta” (Russian for “Map”) is an IDA Python plugin that identifies and matches open-sourced libraries in a given binary. The plugin uses a unique technique that enables it to support huge binaries (>200,000 functions), with almost no impact on the overall performance.
The matching algorithm is location-driven. This means that it’s main focus is to locate the different compiled files, and match each of the file’s functions based on their original order within the file. This way, the matching depends on K (number of functions in the open source) instead of N (size of the binary), gaining a significant performance boost as usually N >> K.
We believe that there are 3 main use cases for this IDA plugin:
* Identifying a list of used open sources (and their versions) when searching for a useful 1-Day
* Matching the symbols of supported open sources to help reverse engineer a malware
* Matching the symbols of supported open sources to help reverse engineer a binary / firmware when searching for 0-Days in proprietary code
Installation (Python 3 & IDA >= 7.4)
For the latest versions, using Python 3, simply git clone the repository and run the
Installation (Python 2 & IDA < 7.4)
As of the release of IDA 7.4, Karta is only actively developed for IDA 7.4 or newer, and Python 3. Python 2 and older IDA versions are still supported using the release version v1.2.0, which is most probably going to be the last supported version due to python 2.X end of life.
Identifier
Karta’s identifier is a smaller plugin that identifies the existence, and fingerprints the versions, of the existing (supported) open source libraries within the binary. No more need to reverse engineer the same open-source library again-and-again, simply run the identifier plugin and get a detailed list of the used open sources. Karta currently supports more than 10 open source libraries, including:
* OpenSSL
* Libpng
* Libjpeg
* NetSNMP
* zlib
* Etc.
Matcher
After identifying the used open sources, one can compile a .JSON configuration file for a specific library (libpng version 1.2.29 for instance). Once compiled, Karta will automatically attempt to match the functions (symbols) of the open source in the loaded binary. In addition, in case your open source used external functions (memcpy, fread, or zlib_inflate), Karta will also attempt to match those external functions as well.
Folder Structure
* src: source directory for the plugin
* configs: pre-supplied *.JSON configuration files (hoping the community will contribute more)
* compilations: compilation tips for generating the configuration files, and lessons from past open sources
* docs: sphinx documentation directory
Download
Karta : Source Code Assisted Fast Binary Matching Plugin For IDA
“Karta” (Russian for “Map”) is an IDA Python plugin that identifies and matches open-sourced libraries in a given binary. The plugin uses a unique technique that enables it to support huge binaries (>200,000 functions), with almost no impact on the overall performance.
The matching algorithm is location-driven. This means that it’s main focus is to locate the different compiled files, and match each of the file’s functions based on their original order within the file. This way, the matching depends on K (number of functions in the open source) instead of N (size of the binary), gaining a significant performance boost as usually N >> K.
We believe that there are 3 main use cases for this IDA plugin:
* Identifying a list of used open sources (and their versions) when searching for a useful 1-Day
* Matching the symbols of supported open sources to help reverse engineer a malware
* Matching the symbols of supported open sources to help reverse engineer a binary / firmware when searching for 0-Days in proprietary code
Installation (Python 3 & IDA >= 7.4)
For the latest versions, using Python 3, simply git clone the repository and run the
setup.py installscript. Python 3 is supported since versions v2.0.0 and above.Installation (Python 2 & IDA < 7.4)
As of the release of IDA 7.4, Karta is only actively developed for IDA 7.4 or newer, and Python 3. Python 2 and older IDA versions are still supported using the release version v1.2.0, which is most probably going to be the last supported version due to python 2.X end of life.
Identifier
Karta’s identifier is a smaller plugin that identifies the existence, and fingerprints the versions, of the existing (supported) open source libraries within the binary. No more need to reverse engineer the same open-source library again-and-again, simply run the identifier plugin and get a detailed list of the used open sources. Karta currently supports more than 10 open source libraries, including:
* OpenSSL
* Libpng
* Libjpeg
* NetSNMP
* zlib
* Etc.
Matcher
After identifying the used open sources, one can compile a .JSON configuration file for a specific library (libpng version 1.2.29 for instance). Once compiled, Karta will automatically attempt to match the functions (symbols) of the open source in the loaded binary. In addition, in case your open source used external functions (memcpy, fread, or zlib_inflate), Karta will also attempt to match those external functions as well.
Folder Structure
* src: source directory for the plugin
* configs: pre-supplied *.JSON configuration files (hoping the community will contribute more)
* compilations: compilation tips for generating the configuration files, and lessons from past open sources
* docs: sphinx documentation directory
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Setting Amass config file?
I posted this question on the amass discord and haven't gotten a reply so I thought I would throw it up here.
I'm trying to get the config file setup. I added a file to /etc/amass/ using nano and named it config.ini and copy/pasted the example config.ini from github ( Amass/config.ini at master · OWASP/Amass (github.com ). Tried running it, permission denied, did chmod+x config.ini, ran with sudo and still permission denied.
I've tried running the command as amass enum -d example.com -config /etc/amass/config.ini.
Halp
submitted by /u/DoubleAgent10
[link] [comments]
Setting Amass config file?
I posted this question on the amass discord and haven't gotten a reply so I thought I would throw it up here.
I'm trying to get the config file setup. I added a file to /etc/amass/ using nano and named it config.ini and copy/pasted the example config.ini from github ( Amass/config.ini at master · OWASP/Amass (github.com ). Tried running it, permission denied, did chmod+x config.ini, ran with sudo and still permission denied.
I've tried running the command as amass enum -d example.com -config /etc/amass/config.ini.
Halp
submitted by /u/DoubleAgent10
[link] [comments]
hacking: security in practice
I want to catch a scammer who had been ripping off my brother until he died last month. He's been dead less than 4 weeks and this person is now already hitting me up for money. Any ideas on how to get info on them to turn over to LE without scaring them away?
My older brother was 53 and lonely. He died of a heart attack at the end of August, and since then I have found out that he was being scammed by at least two people. The first person had conned him into sending over $5K to "invest in cryptocurrency". Soon after he passed away, I found this person on Facebook and I quickly scared them off by saying my brother's probate attorney needed to get in touch with them to discuss liquefying his investments. Within minutes, I got blocked on FB and that's the only connection I had.
Now I am being texted by someone who claims they were my brother's fiancee. He never told me he was engaged or even seeing anyone, but that's not out of his character; he was very introverted and private.
I got his "fiancee"'s phone number when she called his phone shortly after he died. At that point, all she would say was that they were engaged. But now, less than a month after he died, she has begun asking me for money. Her story is: she is starting an online business and my brother had helped her finance it, and now that he's gone she needs help keeping her business afloat. She had the gall to include the line, "it would make your brother sad if our business failed."
I haven't scared this one away yet. All I have is a phone number. Any ideas on ways I could get closer to finding out this scumbag's identity? I would like to report them to the authorities for online fraud.
submitted by /u/izimand
[link] [comments]
I want to catch a scammer who had been ripping off my brother until he died last month. He's been dead less than 4 weeks and this person is now already hitting me up for money. Any ideas on how to get info on them to turn over to LE without scaring them away?
My older brother was 53 and lonely. He died of a heart attack at the end of August, and since then I have found out that he was being scammed by at least two people. The first person had conned him into sending over $5K to "invest in cryptocurrency". Soon after he passed away, I found this person on Facebook and I quickly scared them off by saying my brother's probate attorney needed to get in touch with them to discuss liquefying his investments. Within minutes, I got blocked on FB and that's the only connection I had.
Now I am being texted by someone who claims they were my brother's fiancee. He never told me he was engaged or even seeing anyone, but that's not out of his character; he was very introverted and private.
I got his "fiancee"'s phone number when she called his phone shortly after he died. At that point, all she would say was that they were engaged. But now, less than a month after he died, she has begun asking me for money. Her story is: she is starting an online business and my brother had helped her finance it, and now that he's gone she needs help keeping her business afloat. She had the gall to include the line, "it would make your brother sad if our business failed."
I haven't scared this one away yet. All I have is a phone number. Any ideas on ways I could get closer to finding out this scumbag's identity? I would like to report them to the authorities for online fraud.
submitted by /u/izimand
[link] [comments]
reddit
I want to catch a scammer who had been ripping off my brother...
My older brother was 53 and lonely. He died of a heart attack at the end of August, and since then I have found out that he was being scammed by...