Crawlergo - A Powerful Browser Crawler For Web Vulnerability Scanners
http://www.kitploit.com/2021/10/crawlergo-powerful-browser-crawler-for.html

___________________________
@hacking_Attack
@Hacking_Video

crawlergo is a browser crawler that uses chrome headless mode for URL collection. It hooks key positions of the whole web page with DOM rendering stage, automatically fills and submits forms, with intelligent JS event triggering, and collects as many entries exposed by the website as possible. The built-in URL de-duplication module filters out a large number of pseudo-static URLs, still maintains a fast parsing and crawling speed for large websites, and finally gets a high-quality collection of request results. crawlergo currently supports the following features: chrome browser environment rendering Intelligent form filling, automated submission Full DOM event collection with automated triggering Smart URL de-duplication to remove most duplicate requests Intelligent analysis of web pages and collection of URLs, including javascript file content, page comments, robots.txt (https://www.kitploit.com/search/label/Robots.txt) files and automatic Fuzz of common paths Support Host binding, automatically fix and add Referer Support browser request proxy Support pushing the results to passive web vulnerability scanners
Installation
Please read and confirm disclaimer (https://github.com/Qianlitp/crawlergo/blob/master/Disclaimer.md) carefully before installing and using。 Build cd crawlergo/cmd/crawlergo
go build crawlergo_cmd.go crawlergo relies only on the chrome environment to run, go to download (https://www.chromium.org/getting-involved/download-chromium) for the new version of chromium, or just click to download Linux version 79 (https://storage.googleapis.com/chromium-browser-snapshots/Linux_x64/706915/chrome-linux.zip). Go to download page (https://github.com/0Kee-Team/crawlergo/releases) for the latest version of crawlergo and extract it to any directory. If you are on linux or macOS, please give crawlergo executable permissions (+x). Or you can modify the code and build it yourself. If you are using a linux system and chrome prompts you with missing dependencies, please see TroubleShooting below
Quick Start

Go！
Assuming your chromium installation directory is /tmp/chromium/, set up 10 tabs open at the same time and crawl the testphp.vulnweb.com: ./crawlergo -c /tmp/chromium/chrome -t 10 http://testphp.vulnweb.com/
Using Proxy
./crawlergo -c /tmp/chromium/chrome -t 10 --request-proxy socks5://127.0.0.1:7891 http://testphp.vulnweb.com/
Calling crawlergo with python
By default, crawlergo prints the results directly on the screen. We next set the output mode to json, and the sample code for calling it using python is as follows: #!/usr/bin/python3
# coding: utf-8

import simplejson
import subprocess


def main():
target = "http://testphp.vulnweb.com/"
cmd = ["./crawlergo", "-c", "/tmp/chromium/chrome", "-o", "json", target]
rsp = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
output, error = rsp.communicate()
# "--[Mission Complete]--" is the end-of-task separator string
result = simplejson.loads(output.decode().split("--[Mission Complete]--")[1])
req_list = result["req_list"]
print(req_list[0])


if __name__ == '__main__':
main()
Crawl Results
When the output mode is set to json, the returned result, after JSON deserialization, contains four parts: all_req_list： All requests found during this crawl task, containing any resource type from other domains. req_list：Returns the current domain results of this crawl task, pseudo-statically de-duplicated, without static resource links. It is a subset of all_req_list . all_domain_list：List of all domains found. sub_domain_list：List of subdomains found.
Examples
crawlergo returns the full request and URL, which can be used in a variety of ways: Used in conjunction with other passive web vulnerability scanners First, start a passive scanner (https://www.kitploit.com/search/label/Passive%20scanner) and set the listening address to: http://127.0.0.1:1234/ Next, assuming

___________________________
@hacking_Attack
@Hacking_Video

crawlergo is on the same machine as the scanner, start crawlergo and set the parameters: --push-to-proxy http://127.0.0.1:1234/ Host binding (not available for high version chrome) (example) (https://github.com/0Kee-Team/crawlergo/blob/master/examples/host_binding.py) Custom Cookies (example) (https://github.com/0Kee-Team/crawlergo/blob/master/examples/request_with_cookie.py) Regularly clean up zombie processes generated by crawlergo (example) (https://github.com/0Kee-Team/crawlergo/blob/master/examples/zombie_clean.py) , contributed by @ring04h
Bypass headless detect
crawlergo can bypass headless mode detection by default. https://intoli.com/blog/not-possible-to-block-chrome-headless/chrome-headless-test.html

___________________________
@hacking_Attack
@Hacking_Video

TroubleShooting
'Fetch.enable' wasn't found Fetch is a feature supported by the new version of chrome, if this error occurs, it means your version is too low, please upgrade the chrome version. chrome runs with missing dependencies such as xxx.so // Ubuntu
apt-get install -yq --no-install-recommends \
libasound2 libatk1.0-0 libc6 libcairo2 libcups2 libdbus-1-3 \
libexpat1 libfontconfig1 libgcc1 libgconf-2-4 libgdk-pixbuf2.0-0 libglib2.0-0 libgtk-3-0 libnspr4 \
libpango-1.0-0 libpangocairo-1.0-0 libstdc++6 libx11-6 libx11-xcb1 libxcb1 \
libxcursor1 libxdamage1 libxext6 libxfixes3 libxi6 libxrandr2 libxrender1 libxss1 libxtst6 libnss3

// CentOS 7
sudo yum install pango.x86_64 libXcomposite.x86_64 libXcursor.x86_64 libXdamage.x86_64 libXext.x86_64 libXi.x86_64 \
libXtst.x86_64 cups-libs.x86_64 libXScrnSaver.x86_64 libXrandr.x86_64 GConf2.x86_64 alsa-lib.x86_64 atk.x86_64 gtk3.x86_64 \
ipa-gothic-fonts xorg-x11-fonts-100dpi xorg-x11-fonts-75dpi xorg-x11-utils xorg-x11-fonts-cyrillic xorg-x11-fonts-Type1 xorg-x11-fonts-misc -y

sudo yum update nss -y Run prompt Navigation timeout / browser not found / don't know correct browser executable path Make sure the browser executable path is configured correctly, type: chrome://version in the address bar, and find the executable file path:

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Crawlergo - A Powerful Browser Crawler For Web Vulnerability Scanners

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
How Attackers Hack Humans

Inside their motivations, how they go about it -- and what businesses can do about it, according to Counterintelligence Institute founder Peter Warmka.

Dark Reading: Attacks/Breaches
Cisco Duo Trusted Access Report: More Than 50% of Companies Plan Passwordless Move

Multifactor authentications soar as enterprises move away from passwords to secure hybrid workers.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
debit info stolen.

I had a quick question regarding debit card numbers. I ordered a new card (through coinbase) and within a day found that someone already had tried to run transactions on the card. This is even before I've used the card myself, even before I read the numbers. This confuses me a great deal. What are the implications? Edit: the card is already locked by me

submitted by /u/Tear-Sensitive
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Free Training on ComTIA A+ | Will Cover Full Course

Hi everyone,

I'm currently delivering free training on the CompTIA A+ course. The course consists of 18 modules and I will be doing a dedicated video on each module. Some of these videos might be a bit long since it will be a whole module in each video so please feel free to make use of the time stamps in descriptions if your looking for specific topics only or just want to refresh on certain topics only.

The time stamps are there to make life easier for you so it's your own fault if you end up skimming through the module back and forth like a crazy person looking for their lost teeth.

I will make 20 videos for this course, the first is just the 4min intro explaining the course, the last will be a dedicated exam tips video and then obviously the 18 videos in between will be your modules.

The training should be enough to pass both the international exams for A+ and the other courses I deliver should also be enough to pass the exams associated if there is a exam associated to that specific course.

If you have a question about a specific topic in a module or the course in general that you would like more clarity on, please feel free to ask and I will try to assist you where I can if I'm online.

Here is the course intro

CompTIA A+ Course Intro

submitted by /u/BurningIce2020
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How did I get a phishing e-mail from intel.com?

I don't understand, where do you just go and get an email with /u/florilsk
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Learn C or more ethical hacking courses?

I have completed a basic ethical hacking courses with has taught me all basic stuff about kali Linux and other tools. Not i am confused whether i should learn C language so that in future I could learn assembly language and then code my own penetration tools. Or should I take one more ethical hacking course which is specifically about web applications.

I want to go into IoT hacking and bug bounties.

Kindly suggest

submitted by /u/Odd-Perspective1423
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
This weird-

its a odd question but can someone teach me how to hack stuff mostly in discord
i dont have money but u can have a student 'me' if any1 really wants to help me or sumn like that add me on Discord Miski#5030, its my alt only if ur willing to help i'll let u know my main.

submitted by /u/Xzoyo-Senpai
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Deauthing client on 5Ghz band airplay-ng

is it possible to deauth a client on a 5Ghz band i use this command and works for 2.5Ghz but not 5Ghz

aireplay-ng --deauth 0 -D -a (AP) -c (Client) wlan0

any input would be appreciated

also my wifi adapter is 5Ghz compatible

submitted by /u/gregt0799
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Directional antenna

So I just picked up a new wifi directional antenna specifically the Yagi long range directional antenna from simple wifi. I currently live in a pretty hilly area so i thought hmm maybe I bring this and my laptop up a hill see what I can see so I did. Hooked the antenna in using my Alfa long range wifi dongle specifically the AWUS036ACH with the modded drivers so I could use it running a Kali vm and hot damn I was getting signals from all over the valley I took the pcap kismet generated and cross referenced it against the wiggle wifi app logging page and I was pulling signals from anywhere from a half mile to a mile away and some weaker signals from even further I think ile do some more experimentation maybe time some icmp pings from send to receive so I can time them so yeah that.

Tldr. Got long range directional wifi antenna really surprised at the range.

submitted by /u/deathreaper1129
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Ambiguous Recovery Password
https://www.reddit.com/r/Pentesting/comments/q8ze4m/ambiguous_recovery_password/

Hi all, I have a 100 character password written on paper, most of which I can read. There are 7 characters that are ambiguous and I'd rather not go through the task of guessing the combinations in my head. Is there a tool I can use to brute force the password's missing characters from a list of possible characters? For example if I have what looks like a capital O, is there a tool I can use to attempt the password with o, O, and 0? Edit: I forgot to mention the purpose. I'm trying to sign in to my recovery email for my primary email, which was locked somehow. The account is mine, but because 13 year old me didn't understand the concept of ambiguity (or encrypted thumb drives), I have a 100 character password scrawled on the back of a paper CD holder. submitted by /u/SavantOfSuffering (https://www.reddit.com/user/SavantOfSuffering)
[link] (https://www.reddit.com/r/Pentesting/comments/q8ze4m/ambiguous_recovery_password/) [comments] (https://www.reddit.com/r/Pentesting/comments/q8ze4m/ambiguous_recovery_password/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Simple Brute Force Attack on Zip File Using Python

https://cdn-images-1.medium.com/max/2600/1*P56YpAbKCvlM2wreS2mxYg.jpeg
ZIP is an archive formatter that supports data compression. A ZIP file can be filled by one or more files or directories. The size of ZIP…

Continue reading on Geek Culture »

___________________________
@hacking_Attack
@Hacking_Video