Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Webstor : A Script To Quickly Enumerate All Websites Across All Of Your Organization’s Networks Webstor is a tool implemented in Python under the MIT license for quickly enumerating all websites across all of your organization’s networks…
ADD, -a HTTPPORTTOADD
Add a custom HTTP port.
–CLEAR-HTTP, -aC Clear any custom HTTP ports and revert to default of
80.
–ADD-HTTPS-PORT HTTPSPORTTOADD, -b HTTPSPORTTOADD
Add a custom HTTPS port.
–CLEAR-HTTPS, -bC Clear any custom HTTPS ports and revert to default of
443.
–ADD-CUSTOM-FINGERPRINT FINGERPRINT, -c FINGERPRINT
Add a custom fingerprint in the form ,.
–DELETE-CUSTOM-FINGERPRINT FINGERPRINTNAMETODELETE, -cD FINGERPRINTNAMETODELETE
Delete a custom fingerprint by name.
–IMPORT-CUSTOM-FINGERPRINT IMPORTFINGERPRINTFILE, -cI IMPORTFINGERPRINTFILE
Import a custom fingerprint file with the path
specified.
–CLEAR-CUSTOM-FINGERPRINTS, -cC
Clears all custom fingerprints stored in DB.
–SHOW-CONFIG, -g Show current WebStor configuration (brief).
–SHOW-CONFIG-FULL, -gF
Show current WebStor configuration (full).
–RUN-MASSCAN, -m Runs a new port scan with Masscan on all configured
TCP ports for HTTP and HTTPS, against all configured
ranges and any IP addresses from DNS records that are
outside those ranges.
–SET-MASSCAN-RANGES SETSCANRANGES, -mR SETSCANRANGES
Scan range or ranges, replaces existing ranges in DB,
comma separated, such as: -s
10.10.0.0/16,10.13.0.0/16,192.168.1.0/24
–IMPORT-MASSCAN-RANGES IMPORTSCANRANGES, -mI IMPORTSCANRANGES
Import scan ranges (CIDR blocks) from a specified
file.
–DELETE-RANGE RANGETODELETE, -mD RANGETODELETE
Delete scan range.
–ADD-PATH PATHTOADD, -p PATHTOADD
Add paths for which to request and store responses
besides ‘/’.
–DELETE-PATH PATHTODELETE, -pD PATHTODELETE
Delete paths for which to request and store responses
besides ‘/’.
–CLEAR-PATHS, -pC Clear any custom URL request paths and revert to
default of ‘/’.
–REFRESH-RESPONSES, -r
Refresh URL responses in DB.
–SEARCH-PATTERN SEARCHPATTERN, -sP SEARCHPATTERN
Search for string or regular expression in WebStor
database.
–SEARCH-CUSTOM-FINGERPRINT SEARCHFINGERPRINT, -sC SEARCHFINGERPRINT
Search for technology by name of user-provided custom
fingerprint.
–SEARCH-WAPPALYZER SEARCHWAPPALYZER, -sW SEARCHWAPPALYZER
Search for technology by name (from Wappalyzer Tech
DB) in WebStor DB.
–NO-TSIG-KEY, -tN Do not use DNSSec TSIG key stored in database or a
file, even if present.
–TSIG-KEY-IMPORT IMPORTTSIGFILE, -tI IMPORTTSIGFILE
Import a specified TSIG key file into the database
–TSIG-KEY-REPLACE REPLACEMENTTSIGFILE, -tR REPLACEMENTTSIGFILE
Replace a TSIG key in the database with a specified
file
–DELETE-TSIG TSIGTODELETE, -dT TSIGTODELETE
Delete a TSIG key from the database by name.
–USE-TSIG-FILE-ONLY USETSIGFILEONLY, -tF USETSIGFILEONLY
Only use tsig file specified (full path), do not use
TSIGs stored in the DB. Applies to all domains,
limiting WebStor to one TSIG for zone transfers in the
current execution.
–DOWNLOAD-NEW-WAPPALYZER, -w
Download a new Wappalyzer fingerprints file directly
from GitHub. Overwrites existing Wappalyzer
fingerprint data.
–LIST-WAPPALYZER-TECH-NAMES, -wL
List the names of all Wappalyzer technologies in the
database.
–ZONE-XFER, -z Forces a new zone transfer using all domains, servers,
and associated TSIG keys in DB
–ADD-DOMAIN DOMAINDETAILS, -zA DOMAINDETAILS
Add a domain in the form ,,.
–DELETE-DOMAIN DOMAINTODELETE, -zD DOMAINTODELETE
Delete a DNS domain from the database by name.
–IMPORT-ZONE-FILE IMPORTZONEFILE, -zI IMPORTZONEFILE
Add domains for zone transfers from a file.
–CLEAR-DOMAINS, -zC Clears all DNS domains stored in DB.
–LIST-DOMAINS, -zL Lists all DNS domains stored in DB.
–LIST-OUTSIDE, -e Prints a list of all names and IPs from our zone
transfers that are outside defined net ranges.
–SQL-CREDS SQLCREDSFILE, -q SQLCREDSFILE
Use SQL credentials in file at specified path.
Steps to initially configure WebStor and populate database
NOTE: These steps assume your organization uses just one TSIG key for zone transfers and that all records can be queried from one DNS server. If this is not the case, see the secure/es[...]
Add a custom HTTP port.
–CLEAR-HTTP, -aC Clear any custom HTTP ports and revert to default of
80.
–ADD-HTTPS-PORT HTTPSPORTTOADD, -b HTTPSPORTTOADD
Add a custom HTTPS port.
–CLEAR-HTTPS, -bC Clear any custom HTTPS ports and revert to default of
443.
–ADD-CUSTOM-FINGERPRINT FINGERPRINT, -c FINGERPRINT
Add a custom fingerprint in the form ,.
–DELETE-CUSTOM-FINGERPRINT FINGERPRINTNAMETODELETE, -cD FINGERPRINTNAMETODELETE
Delete a custom fingerprint by name.
–IMPORT-CUSTOM-FINGERPRINT IMPORTFINGERPRINTFILE, -cI IMPORTFINGERPRINTFILE
Import a custom fingerprint file with the path
specified.
–CLEAR-CUSTOM-FINGERPRINTS, -cC
Clears all custom fingerprints stored in DB.
–SHOW-CONFIG, -g Show current WebStor configuration (brief).
–SHOW-CONFIG-FULL, -gF
Show current WebStor configuration (full).
–RUN-MASSCAN, -m Runs a new port scan with Masscan on all configured
TCP ports for HTTP and HTTPS, against all configured
ranges and any IP addresses from DNS records that are
outside those ranges.
–SET-MASSCAN-RANGES SETSCANRANGES, -mR SETSCANRANGES
Scan range or ranges, replaces existing ranges in DB,
comma separated, such as: -s
10.10.0.0/16,10.13.0.0/16,192.168.1.0/24
–IMPORT-MASSCAN-RANGES IMPORTSCANRANGES, -mI IMPORTSCANRANGES
Import scan ranges (CIDR blocks) from a specified
file.
–DELETE-RANGE RANGETODELETE, -mD RANGETODELETE
Delete scan range.
–ADD-PATH PATHTOADD, -p PATHTOADD
Add paths for which to request and store responses
besides ‘/’.
–DELETE-PATH PATHTODELETE, -pD PATHTODELETE
Delete paths for which to request and store responses
besides ‘/’.
–CLEAR-PATHS, -pC Clear any custom URL request paths and revert to
default of ‘/’.
–REFRESH-RESPONSES, -r
Refresh URL responses in DB.
–SEARCH-PATTERN SEARCHPATTERN, -sP SEARCHPATTERN
Search for string or regular expression in WebStor
database.
–SEARCH-CUSTOM-FINGERPRINT SEARCHFINGERPRINT, -sC SEARCHFINGERPRINT
Search for technology by name of user-provided custom
fingerprint.
–SEARCH-WAPPALYZER SEARCHWAPPALYZER, -sW SEARCHWAPPALYZER
Search for technology by name (from Wappalyzer Tech
DB) in WebStor DB.
–NO-TSIG-KEY, -tN Do not use DNSSec TSIG key stored in database or a
file, even if present.
–TSIG-KEY-IMPORT IMPORTTSIGFILE, -tI IMPORTTSIGFILE
Import a specified TSIG key file into the database
–TSIG-KEY-REPLACE REPLACEMENTTSIGFILE, -tR REPLACEMENTTSIGFILE
Replace a TSIG key in the database with a specified
file
–DELETE-TSIG TSIGTODELETE, -dT TSIGTODELETE
Delete a TSIG key from the database by name.
–USE-TSIG-FILE-ONLY USETSIGFILEONLY, -tF USETSIGFILEONLY
Only use tsig file specified (full path), do not use
TSIGs stored in the DB. Applies to all domains,
limiting WebStor to one TSIG for zone transfers in the
current execution.
–DOWNLOAD-NEW-WAPPALYZER, -w
Download a new Wappalyzer fingerprints file directly
from GitHub. Overwrites existing Wappalyzer
fingerprint data.
–LIST-WAPPALYZER-TECH-NAMES, -wL
List the names of all Wappalyzer technologies in the
database.
–ZONE-XFER, -z Forces a new zone transfer using all domains, servers,
and associated TSIG keys in DB
–ADD-DOMAIN DOMAINDETAILS, -zA DOMAINDETAILS
Add a domain in the form ,,.
–DELETE-DOMAIN DOMAINTODELETE, -zD DOMAINTODELETE
Delete a DNS domain from the database by name.
–IMPORT-ZONE-FILE IMPORTZONEFILE, -zI IMPORTZONEFILE
Add domains for zone transfers from a file.
–CLEAR-DOMAINS, -zC Clears all DNS domains stored in DB.
–LIST-DOMAINS, -zL Lists all DNS domains stored in DB.
–LIST-OUTSIDE, -e Prints a list of all names and IPs from our zone
transfers that are outside defined net ranges.
–SQL-CREDS SQLCREDSFILE, -q SQLCREDSFILE
Use SQL credentials in file at specified path.
Steps to initially configure WebStor and populate database
NOTE: These steps assume your organization uses just one TSIG key for zone transfers and that all records can be queried from one DNS server. If this is not the case, see the secure/es[...]
Hacking Articles Tips Tricks Videos Tutorials
ADD, -a HTTPPORTTOADD Add a custom HTTP port. –CLEAR-HTTP, -aC Clear any custom HTTP ports and revert to default of 80. –ADD-HTTPS-PORT HTTPSPORTTOADD, -b HTTPSPORTTOADD Add a custom HTTPS port. –CLEAR-HTTPS, -bC Clear any custom HTTPS ports and revert to…
oteric use cases section below.
* Obtain a TSIG key file that allows you to pull zone transfers, place it in your working directory.
* Obtain a newline-delimited list file of all your organization’s network ranges (CIDR notation). If you are using vast amounts of private RFC1918 space, most notably 10.X space, do not simply add 10.0.0.0/8 as this would cause Masscan to take a very long time later on. Instead, use multiple smaller blocks that are actually allocated (such as 10.10.3.0/24). With a typical corporate or university network as of the time of this writing, you can expect every million IP addresses scanned to take about 15 minutes during the masscan with WebStor’s current throttling settings.
* Create a text file with the domains names for which you will be pulling zone transfers. At the top of the file, insert two lines: the first with name of your TSIG key (if you don’t know what it is, it will be in the first line of your TSIG file right after “key”), and the second line must be the name or IP address of your DNS server. The rest of the file must be every DNS domain name for your organization, one per line. For a typical large university, this will be names like engineering.stateu.edu.
* Run ./webstor.py -g to show the config and confirm database functionality.
* Run ./webstor.py -tI <tsig-mI <net-zI <domainsNOTE: during the TSIG import part of this process you will be asked for a domain to associate with the TSIG and a DNS server to target for that TSIG. This is because the TSIG file itself does not contain this information. Simply provide any one of your domains, e.g. stateu.edu, and your DNS server’s IP address. The information in the domain import file, processed afterward, will supercede the domain association.
* Webstor is now ready to collect data. Run ./webstor.py -z -m -r -w. This will collect DNS records via zone transfer, scan for open web ports with Masscan, perform HTTP/HTTPS requests against all hosts with open web ports (the superset of those in your network ranges and hosts with DNS records falling outside those ranges), and store the responses in the database. The -w option also downloads the most recent copy of the Wappalyzer Web Technologies database from GitHub.
Example usage
#Search for a string/regex associated with a web technology:
./webstor.py -sP “content=\”wordpress 4.[7-9]”
#A list of sites with this regex, expected responses from WordPress v4.7-9 sites,
will be returned.
#To save the regex in the example above as a custom fingerprint you can query
by name (and do not need to remember the regex each time):
./webstor.py -c “wordpress4.7-9,content=\”wordpress 4.[7-9]”
#After the above command has been run, the query may be performed simply with:
./webstor.py -sC wordpress4.7-9
#Using WebStor to search for WordPress sites via Wappalyzer definitions:
./webstor.py -sW wordpress
#A list of reachable WordPress sites on your organization’s networks will be
returned. NOTE: Wappalyzer searches may be slower than pattern/regex searches
due to the number of properties being queried to verify.
Results shown by name and IP
Sites are queried based on responses to both names and IP addresses. This is important because some webservers host multiple sites under multiple names. Some other servers may serve only a default site or a hosting provider’s default response when requested by IP (e.g. https://68.66.216.42), and an actual line-of-business site when queried by name (e.g. https://www.seekerdlp.com). For this reason, if you have a named site that also is served when the webserver’s IP is requested, you will see query results for both. Keeping Results Fresh
It is recommended that you set up a cron job to run WebStor daily so that your query results will always reflect the current state of your network. Secure Options
If you do not want to use default MariaDB credentials (root, blank password), you can use the -q option to specify the path to a fil[...]
* Obtain a TSIG key file that allows you to pull zone transfers, place it in your working directory.
* Obtain a newline-delimited list file of all your organization’s network ranges (CIDR notation). If you are using vast amounts of private RFC1918 space, most notably 10.X space, do not simply add 10.0.0.0/8 as this would cause Masscan to take a very long time later on. Instead, use multiple smaller blocks that are actually allocated (such as 10.10.3.0/24). With a typical corporate or university network as of the time of this writing, you can expect every million IP addresses scanned to take about 15 minutes during the masscan with WebStor’s current throttling settings.
* Create a text file with the domains names for which you will be pulling zone transfers. At the top of the file, insert two lines: the first with name of your TSIG key (if you don’t know what it is, it will be in the first line of your TSIG file right after “key”), and the second line must be the name or IP address of your DNS server. The rest of the file must be every DNS domain name for your organization, one per line. For a typical large university, this will be names like engineering.stateu.edu.
* Run ./webstor.py -g to show the config and confirm database functionality.
* Run ./webstor.py -tI <tsig-mI <net-zI <domainsNOTE: during the TSIG import part of this process you will be asked for a domain to associate with the TSIG and a DNS server to target for that TSIG. This is because the TSIG file itself does not contain this information. Simply provide any one of your domains, e.g. stateu.edu, and your DNS server’s IP address. The information in the domain import file, processed afterward, will supercede the domain association.
* Webstor is now ready to collect data. Run ./webstor.py -z -m -r -w. This will collect DNS records via zone transfer, scan for open web ports with Masscan, perform HTTP/HTTPS requests against all hosts with open web ports (the superset of those in your network ranges and hosts with DNS records falling outside those ranges), and store the responses in the database. The -w option also downloads the most recent copy of the Wappalyzer Web Technologies database from GitHub.
Example usage
#Search for a string/regex associated with a web technology:
./webstor.py -sP “content=\”wordpress 4.[7-9]”
#A list of sites with this regex, expected responses from WordPress v4.7-9 sites,
will be returned.
#To save the regex in the example above as a custom fingerprint you can query
by name (and do not need to remember the regex each time):
./webstor.py -c “wordpress4.7-9,content=\”wordpress 4.[7-9]”
#After the above command has been run, the query may be performed simply with:
./webstor.py -sC wordpress4.7-9
#Using WebStor to search for WordPress sites via Wappalyzer definitions:
./webstor.py -sW wordpress
#A list of reachable WordPress sites on your organization’s networks will be
returned. NOTE: Wappalyzer searches may be slower than pattern/regex searches
due to the number of properties being queried to verify.
Results shown by name and IP
Sites are queried based on responses to both names and IP addresses. This is important because some webservers host multiple sites under multiple names. Some other servers may serve only a default site or a hosting provider’s default response when requested by IP (e.g. https://68.66.216.42), and an actual line-of-business site when queried by name (e.g. https://www.seekerdlp.com). For this reason, if you have a named site that also is served when the webserver’s IP is requested, you will see query results for both. Keeping Results Fresh
It is recommended that you set up a cron job to run WebStor daily so that your query results will always reflect the current state of your network. Secure Options
If you do not want to use default MariaDB credentials (root, blank password), you can use the -q option to specify the path to a fil[...]
Hacking Articles Tips Tricks Videos Tutorials
oteric use cases section below. * Obtain a TSIG key file that allows you to pull zone transfers, place it in your working directory. * Obtain a newline-delimited list file of all your organization’s network ranges (CIDR notation). If you are using vast amounts…
e with credentials. The first line of the file must be the server, e.g. localhost. The second line must be the sql user name. The third line must be the password.
If you do not wish to store your TSIG in key the database, you may use the -tF option to specify the path to an ACLed TSIG key file.
If your organization utilizes multiple TSIG keys, you will need to store them in the database. They can each be added with the -tI option and domains can be through the normal options, specifying the appropriate key and server. Download
If you do not wish to store your TSIG in key the database, you may use the -tF option to specify the path to an ACLed TSIG key file.
If your organization utilizes multiple TSIG keys, you will need to store them in the database. They can each be added with the -tI option and domains can be through the normal options, specifying the appropriate key and server. Download
hacking: security in practice
Game Lobby DDoS'ing (NOT A REQUEST FOR HOW-TO)
How is that someone can DDoS a game lobby? Don't most game lobbies proxy traffic? I just need help understanding how this happens. Obviously an attacker won't immediately have access to all the lobby's player IP addresses, so is there another course of action they take to knock multiple players offline? Asking for a friend ..
submitted by /u/NewYorkApe
[link] [comments]
Game Lobby DDoS'ing (NOT A REQUEST FOR HOW-TO)
How is that someone can DDoS a game lobby? Don't most game lobbies proxy traffic? I just need help understanding how this happens. Obviously an attacker won't immediately have access to all the lobby's player IP addresses, so is there another course of action they take to knock multiple players offline? Asking for a friend ..
submitted by /u/NewYorkApe
[link] [comments]
reddit
Game Lobby DDoS'ing (NOT A REQUEST FOR HOW-TO)
How is that someone can DDoS a game lobby? Don't most game lobbies proxy traffic? I just need help understanding how this happens. Obviously an...
hacking: security in practice
Is there a website that shows domains that have been XSS'd before?
I have tried xssed.com but it seems like it's not being updated anymore
submitted by /u/emiliathewhite
[link] [comments]
Is there a website that shows domains that have been XSS'd before?
I have tried xssed.com but it seems like it's not being updated anymore
submitted by /u/emiliathewhite
[link] [comments]
reddit
Is there a website that shows domains that have been XSS'd before?
I have tried xssed.com but it seems like it's not being updated anymore
Bypass of biometrics & password security functionality for Android
Reported : Sat, Feb 27, 8:52 PM — 2020
Reported Again : Mon, Nov 2, 2020, 3:12 AM
Req for an update : Sat, Nov 7, 2020, 10:02 AM
Another…
Read more...
Reported : Sat, Feb 27, 8:52 PM — 2020
Reported Again : Mon, Nov 2, 2020, 3:12 AM
Req for an update : Sat, Nov 7, 2020, 10:02 AM
Another…
Read more...
Beginner Guide To Exploit Server Side Request Forgery (SSRF) Vulnerability
Server Side Request Forgery (SSRF) is simply an attack where the server will make a request (act like a proxy) for the attacker either to a…
Read more...
Server Side Request Forgery (SSRF) is simply an attack where the server will make a request (act like a proxy) for the attacker either to a…
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Tre — Offensive Security Machine Pwned!!
https://cdn-images-1.medium.com/max/900/1*IlmUmEjMfadfmK9-Spn4iw.jpeg
This is one of the official machine from Offensive Security Proving Grounds
Continue reading on Medium »
Tre — Offensive Security Machine Pwned!!
https://cdn-images-1.medium.com/max/900/1*IlmUmEjMfadfmK9-Spn4iw.jpeg
This is one of the official machine from Offensive Security Proving Grounds
Continue reading on Medium »
Hunting for Prototype Pollution and it’s vulnerable code on JS libraries
https://infosecwriteups.com/hunting-for-prototype-pollution-and-its-vulnerable-code-on-js-libraries-5bab2d6dc746?source=rss------bug_bounty-5
https://infosecwriteups.com/hunting-for-prototype-pollution-and-its-vulnerable-code-on-js-libraries-5bab2d6dc746?source=rss------bug_bounty-5
It’s been months since I have released ppmap and it didn’t take much for the tool to be popular because of how crazy and trending…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/hunting-for-prototype-pollution-and-its-vulnerable-code-on-js-libraries-5bab2d6dc746?source=rss------bug_bounty-5)
A Web Server For Bug Bounty Hunters (Part 1)
https://fulplan.medium.com/a-web-server-for-bug-bounty-hunters-part-1-feb5ad68821a?source=rss------bug_bounty-5
https://fulplan.medium.com/a-web-server-for-bug-bounty-hunters-part-1-feb5ad68821a?source=rss------bug_bounty-5
Hello respectful readers. I am Mutasim Abubakar known as fulplan a bug bounty hunter and cybersecurity enthusiasm in today’s write-up. I…Continue reading on Medium » (https://fulplan.medium.com/a-web-server-for-bug-bounty-hunters-part-1-feb5ad68821a?source=rss------bug_bounty-5)
A Web Server For Bug Bounty Hunters (Part 1)
Hello respectful readers. I am Mutasim Abubakar known as fulplan a bug bounty hunter and cybersecurity enthusiasm in today’s write-up. I…Continue reading on Medium »
Read more...
Hello respectful readers. I am Mutasim Abubakar known as fulplan a bug bounty hunter and cybersecurity enthusiasm in today’s write-up. I…Continue reading on Medium »
Read more...
Black Hat Ethical Hacking
FontOnLake malware infects Linux systems
FontOnLake malware infects Linux systems
Black Hat Ethical Hacking
FontOnLake malware infects Linux systems | Black Hat Ethical Hacking
A newly discovered malware family has been infecting Linux systems concealed in legitimate binaries. Dubbed FontOnLake, the threat delivers backdoor and rootkit components.