KitPloit - PenTest Tools!
Fapro - Free, Cross-platform, Single-file mass network protocol server simulator

https://blogger.googleusercontent.com/img/a/AVvXsEiuMjdLcPd9eavE4tZ0q8WccugfeTpnSw3wzxw2mpO-ijfIXxhhWWAny5kthIVnfxsy9IBfHP1VAvaFGu7Eu3JIds8cTND19gMabdasVvEFYkSEBf3MjQ5UtYrgOHaskmxF7pYrtyZWqMaGFr1IaVNd9TyDPGpbOk6WMUl8_27U7snY3jSJ9P8QLADo9Q=w640-h394 FaPro is a Fake Protocol Server tool, Can easily start or stop multiple network services.

The goal is to support as many protocols as possible, and support as many deep interactions as possible for each protocol. Features* Supported Running Modes:
* Local Machine
* Virtual Network

* Supported Protocols:
* DNS
* DCE/RPC
* EIP
* Elasticsearch
* FTP
* HTTP
* IEC 104
* Memcached
* Modbus
* MQTT
* MySQL
* RDP
* Redis
* S7
* SMB
* SMTP
* SNMP
* SSH
* Telnet
* VNC
* IMAP
* POP3

* Use TcpForward to forward network traffic
* Support tcp syn logging Protocol simulation demosRdpSupport credssp ntlmv2 nla authentication.

Support to configure the image displayed when user login. https://blogger.googleusercontent.com/img/a/AVvXsEiuMjdLcPd9eavE4tZ0q8WccugfeTpnSw3wzxw2mpO-ijfIXxhhWWAny5kthIVnfxsy9IBfHP1VAvaFGu7Eu3JIds8cTND19gMabdasVvEFYkSEBf3MjQ5UtYrgOHaskmxF7pYrtyZWqMaGFr1IaVNd9TyDPGpbOk6WMUl8_27U7snY3jSJ9P8QLADo9Q=w640-h394 SSHSupport user login.

Support fake terminal commands, such as id, uid, whoami, etc.

Account format: username:password:home:uid https://blogger.googleusercontent.com/img/a/AVvXsEj3rqg_UHR8FVD1AenjbEXGrvH7NrbHE_2Tx6TNYX_fupBrU8yDRqdtjBf_X3qP2McVhzM5RHgLiN8N62oRkJgMhPGnaTEqsSDp720MbJ61usRcU6DUAoeS_F1wNGeYmpGqQ1XhdNAtGJJbzvBYWq-JiuJ9onyslvfgJmm33VMt-xk78I003vYXfA_3ZQ=w640-h444 IMAP & SMTPSupport user login and interaction. https://blogger.googleusercontent.com/img/a/AVvXsEjsxp1cGMLACtSsZ0I7felgtDlJCus_jrhqACOu0uoW2lyxL3Nb4TUHfoK39GxsTv9LlUVR1LmOEeAi3UrXwQo_czX4bdPmNpuoTTqQTZx7LUVIDGSSm3Mvu-43fbg6NjlxTczoPR_d8XNHZUsp-FaCoh4s3ZZkIfcfYIQOYI3oHgu2WQRgx1Hdm4KOQw=w640-h362 MysqlSupport sql statement query interaction https://blogger.googleusercontent.com/img/a/AVvXsEhaRTZr-Bgs9_XvFUDtBjdOlADvDWMUXHmgaX2wlg9bRQazVBB9R19NTmA337p_Iic8UFEGx3v2YuchH6w59049__xOAcouhJnbVtxea1RBnZFfBTopC6i4C2hnS0hH1R2zvD3BegV0lAS_A4oSNSzDFslIEz2yF3vyLupzUux88azwyxWcfxyKiJtVzA=w640-h368 HTTPSupport website clone, You need to install the chrome browser and chrome driver to work. Quick StartGenerate ConfigThe configuration of all protocols and parameters is generated by genConfig subcommand.

Use 172.16.0.0/16 subnet to generate the configuration file: fapro genConfig -n 172.16.0.0/16 > fapro.jsonOr use local address instead of the virtual network: fapro genConfig > fapro.jsonRun the protocol simulatorRun FaPro in verbose mode and start the web service on port 8080: fapro run -v -l :8080Tcp syn loggingFor windows users, please install winpcap or npcap. Log analysisUse ELK to analyze protocol logs: https://blogger.googleusercontent.com/img/a/AVvXsEjqXQMNerBSmPXLA3QqAIgJBu9KMu-0e7tGzjqIPJJpeKxmKskmMA0KvEB9urP8oPE0PBm8FAcVziVaoT5LfpEUxKl2oyvUwnDBCawV96QoxKRiv99zuvmOw5ALyhYQDBDt2kudkhtzGen-PBeYtXnGxGZ7bNtOOkwcXgjVCWzwqRkgpK5gCYJ3jwVwaQ=w640-h370 ConfigurationThis section contains the sample configuration used by FaPro. {
"version": "0.38",
"network": "127.0.0.1/32",
"network_build": "localhost",
"storage": null,
"geo_db": "/tmp/geoip_city.mmdb",
"hostname": "fapro1",
"use_logq": true,
"cert_name": "unknown",
"syn_dev": "any",
"exclusions": [],
"hosts": [
{
"ip": "127.0.0.1",
"handlers": [
{
"handler": "dcerpc",
"port": 135,
"params": {
"accounts": [
"administrator:123456",
],
"domain_name": "DESKTOP-Q1Test"
}
}
]
}
]
} * version: Configuration version.
* network: The subnet used by the vir[...]

___________________________
@hacking_Attack
@Hacking_Video

tual network or the address bound to the local machine(Local mode).
* network_build: Network mode(supported value: localhost, all, userdef)
* localhost: Local mode, all services are listening on the local machine
* all: Create all hosts in the subnet(i.e., Can ping all the host in the subnet)
* userdef: Create only the hosts specified in the hosts configuration.

* storage: Specify the storage used for log collection, support sqlite, mysql, elasticsearch. e.g.
* sqlite3:logs.db
* mysql://user:password@tcp(127.0.0.1:3306)/logs
* es://http://127.0.0.1:9200 (currently only supports Elasticsearch 7.x)

* geo_db: MaxMind geoip2 database file path, used to generate ip geographic location information. if you use Elasticsearch storage, never need this field, it will be automatically generated using the geoip processor of Elasticsearch.
* hostname: Specify the host field in the log.
* use_logq: Use local disk message queue to save logs, and then send it to remote mysql or Elasticsearch to prevent remote log loss.
* cert_name: Common name of the generated certificate.
* syn_dev: Specify the network interface used to capture tcp syn packets. If it is empty, the tcp syn packet will not be recorded. On windows, the device name is like "\Device\NPF_{xxxx-xxxx}".
* exclusions: Exclude remote ips from logs.
* hosts: Each item is a host configuration.
* handlers: Service configuration, the service configured on the host, each item is a service configuration.
* handler: Service name (i.e., protocol name)
* params: Set the parameters supported by the service. ExampleCreate a virtual network, The subnet is 172.16.0.0/24, include 2 hosts,

172.16.0.3 run dns, ssh service,

and 172.16.0.5 run rpc, rdp service,

protocol access logs are saved to elasticsearch, exclude the access log of 127.0.0.1. {
"version": "0.38",
"network": "172.16.0.0/24",
"network_build": "userdef",
"storage": "es://http://127.0.0.1:9200",
"use_logq": true,
"cert_name": "unknown",
"syn_dev": "any",
"geo_db": "",
"exclusions": ["127.0.0.1"],
"hosts": [
{
"ip": "172.16.0.3",
"handlers": [
{
"handler": "dns",
"port": 53,
"params": {
"accounts": [
"admin:123456"
],
"appname": "domain"
}
},
{
"handler": "ssh",
"port": 22,
"params": {
"accounts": [
"root:5555555:/root:0"
],
"prompt": "$ ",
"server_version": "SSH-2.0-OpenSSH_7.4"
}
}
]
},
{
"ip": "172.16.0.5",
"handlers": [
{
"handler": "dcerpc",
"port": 135,
"params": {
"accounts": [
"administrator:123456"
],
"domain_name": "DESKTOP-Q1Test"
}
},
{
"handler": "rdp",
"port": 3389,
"params": {
"accounts": [
"administrator:123456"
],
"auth": false,
"domain_name": "DESKTOP-Q1Test",
"image": "rdp.jpg",
"sec_layer": "auto"
}
}
]
}
]
} FAQWe have collected some frequently asked questions. Before reporting an issue, please search if the FAQ has the answer to your problem. Contributing* Issues are welcome. Download Fapro

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
retrieve txt file using netcat

I am trying to solve a CTF. Not much information given, but the source code for the program.

I do see that the program tries to open 2 text files. file1.txt and file2.txt.

I was given a clue to use nc to start using the program, so I can mess around with the program when using nc . But can I also try to open these 2 text files somehow? I think they may have more information

​

thanks

submitted by /u/ligonsker
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Best USB Wi-Fi adapter under $20?

Can anyone suggest a good dual-band USB Wi-Fi adapter compatible with Kali running in virtual box and supports the typical monitor mode, packet injection, etc…

I’m on a tight budget and looking for something under $20 US in the US Amazon store. Any suggestions are appreciated.

Thanks!

submitted by /u/EthernetNFT
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do I unlock a secure .bat folder (windows10)?

Okay so I hope I'm on the correct subreddit. A couple of years ago I created a bunch of secure folders on the PC me and my ex used to share by following instructions from a yt video. My ex was abusive and in these folders were videos and screenshots proving exactly that. I now need to hand these folders over to my lawyer and I successfully unlocked two of them, but theres something wrong with the third one. I enter the password and hit enter, but the window simply closes without the folder being unlocked. I'm not sure whether I'm doing something wrong or I had used a different password for this folder, but I really need to unlock it. Does anyone know what I could do? Thank you all so much.

submitted by /u/sooodamnfancy
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Trying to recover gift card pin

I received a gift card as a gift but when scratching the sticker for the pin, the pin is illegible. Anyone know how I could use a script to get the pin? I was thinking I could use the vendor’s website to check the balance and brute force the pin but I’m not sure how to do that. I believe I can make out the third number is all.

If not I’ll probably just have to use it at their physical store.

submitted by /u/Big_Jack21
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
IDE

https://cdn-images-1.medium.com/max/1911/1*PVVivF6PoRe2iAIppWRVug.png
Room Link: https://tryhackme.com/room/ide

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Facebook account takeover due to unsafe redirects after the OAuth flow
https://bountyget.medium.com/facebook-account-takeover-due-to-unsafe-redirects-after-the-oauth-flow-a186f0c16924?source=rss------bug_bounty-5

DescriptionContinue reading on Medium » (https://bountyget.medium.com/facebook-account-takeover-due-to-unsafe-redirects-after-the-oauth-flow-a186f0c16924?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
L0phtCrack Is Now Open Source

submitted by /u/binaryfor
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
LANtenna attack reveals Ethernet cable traffic contents

https://external-preview.redd.it/ECfBOgfJww98vBO3fj5_xQTvMKnJ4iZO5J94LrdxONg.jpg?width=640&crop=smart&auto=webp&s=1a6f57dfeb6527ff6d24806d1941b7ea0a7bbd38 submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Social Engineering or Hacking?

So here's a wild story. My girlfriend and I share a tinder account trying to find people for 3somes and stuff like that. She turned on guys and was quickly met with a guy acting like a hard ass. He said "So what happens if I screenshot this convo and post it online for everyone to see?" I immediately called him out on his bluff and told him he was pathetic, etc. We unmatched and reported and moved on with our lives. Maybe a half an hour later he ended up finding me on Facebook and sent me a friend request. I immediately blocked him. For reference, I was the one sending the last few messages, but the account is under my girlfriend's name and pictures with no reference to me at all. Furthermore her Instagram is private (profile pic is of us though), and her Twitter contains no reference to me. My question: How did he find my Facebook, when he had no reference to my name, doesn't really know what I look like, etc? Is this just some no-life with a plethora of time on his hands and was bored enough to sift around the internet until he found me? Or is there something bigger at stake? Perhaps he got my number and found my Facebook that way? I somewhat doubt he has my number because he hasn't texted, called, etc. However it would of course be trouble if he did somehow obtain that. One important note is that he lives in the area and allegedly goes to the same university that I just graduated from. I don't recognize him though and I'm sure he doesn't recognize me (no mutual friends in the request either).

submitted by /u/expodavid
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Dear proffessional hackers <3

oday was a terrible day, I seemed to have sprained my ankle, and my phone got stolen. I went to the address, after tracking down my phone, and confronted them. They, however, claimed they dont have it, despite the tracking location being there. Another thing, "let me go check" (his response after I told him that my phone was here), sus, i know. I left and went back home in tears, called the police and they did not show. Very shitty day and I wanted to have even a little sense of justice due. So my purpose here is to hopefully get him trolled, immensely. I currently have a potentially sprained ankle, emotional damage, and no phone. Let me know if you guys are willing to try and see what you can do. All I know is where they live, what could I do?

submitted by /u/rotten-kimchii
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How long can a reverse connection last in a machine?
https://www.reddit.com/r/Pentesting/comments/qacyfw/how_long_can_a_reverse_connection_last_in_a/

I'm wondering how APT does intrusion and persistence in a system for months, even years. is it possible to maintain a shell on a victim's machine for a lot of time? how this can be done using netcat or similar? submitted by /u/Repulsiv-e (https://www.reddit.com/user/Repulsiv-e)
[link] (https://www.reddit.com/r/Pentesting/comments/qacyfw/how_long_can_a_reverse_connection_last_in_a/) [comments] (https://www.reddit.com/r/Pentesting/comments/qacyfw/how_long_can_a_reverse_connection_last_in_a/)

___________________________
@hacking_Attack
@Hacking_Video

Facebook account takeover due to unsafe redirects after the OAuth flow

DescriptionContinue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
In Cyberwar, Attribution Can Be Impossible — and That's OK

Instead of using a substantial proportion of resources to determine attribution, organizations should focus on defenses that will help them remediate an attack.

hacking: security in practice
Google Warns Government-Backed Hackers Are on the Rise

Google’s Threat Analysis Group (TAG) is warning high-risk groups that there has been a surge in activity by government-backed hacking campaigns, up 33% so far this year over the same time period in 2020, according to a blog post.

https://www.pymnts.com/news/security-and-risk/2021/google-warns-government-backed-hackers-are-on-the-rise/

submitted by /u/Finlay_Lee
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video