PortBender - TCP Port Redirection Utility

PortBender is a TCP port redirection utility that allows a red team operator to redirect inbound traffic destined for one TCP port (e.g., 445/TCP) to another TCP port (e.g., 8445/TCP). PortBender includes an aggressor script that operators can leverage to integrate the tool with Cobalt Strike. However, because the tool is implemented as a reflective DLL, it can integrate with any C2 framework supporting loading modules through a "ReflectiveLoader" interface 1. The tool also allows operators to simulate a backdoor/persistence mechanism leveraged within the "PortServ.sys" capability used by the Duqu 2.0 threat actor.DesignPortBender leverages the WinDivert library to intercept network traffic using the Windows Filtering Platform (WFP). The design of PortBender is heavily influenced by the DivertTCPConn utility which also leverages the WinDivert library 1.UsagePortBender has two modes of operation. The first is "redirector mode," and the second is "backdoor mode." In "redirector mode," any connection to a targeted destination port (e.g., 445/TCP) is redirected to an alternative port (e.g., 8445/TCP). In "backdoor mode," we only redirect traffic if an attacker sends a specially formatted TCP packet to a target port (e.g., 443/TCP). PortBender then adds that client IP address to a list of backdoor clients and redirects all traffic to that target port to an alternative port (e.g., 3389/TCP). An operator can leverage this mechanism to emulate the persistence technique used by the Duqu 2.0 threat actor when compromising Kaspersky.To execute PortBender we must first import the "PortBender.cna" script into Cobalt Strike and upload the WinDivert32.sys or WinDivert64.sys binary included in "PortBender.zip" to the target host depending on the operating system architecture. The help menu for PortBender with the example usage is shown below:beacon> help PortBenderRedirect Usage: PortBender redirect FakeDstPort RedirectedPortBackdoor Usage: PortBender backdoor FakeDstPort RedirectedPort PasswordExamples: PortBender redirect 445 8445 PortBender backdoor 443 3389 praetorian.antihackerExample UsageFor example, we may wish to execute PortBender in redirector mode to perform an SMB relay attack from a compromised Windows system. To facilitate this, we can instruct PortBender to redirect all traffic to 445/TCP to an alternative port 8445/TCP running an attacker SMB service. In this example, we run the command "PortBender redirect 445 8445" to accomplish this. The expected output is below:In this example, we want to deploy the covert persistence mechanism on a compromised Internet-facing IIS webserver. Here we run the "PortBender backdoor 443 3389 praetorian.antihacker" to instruct the backdoor service to redirect any connections to 443/TCP to 3389/TCP on the compromised host from any IP address that provides the specified "praetorian.antihacker" keyword. The expected output is shown below: AcknowledgementsArno0x0x for his work on DivertTCPConn 1Stephen Fewer for his work on Reflective DLL Injection 2Basil00 for his work on WinDivert 3Francisco Dominguez for his research into performing SMB relaying on Windows 4References1 https://github.com/Arno0x/DivertTCPconn 2 https://github.com/stephenfewer/ReflectiveDLLInjection 3 https://github.com/basil00/Divert 4 https://diablohorn.com/2018/08/25/remote-ntlm-relaying-through-meterpreter-on-windows-port-445Download PortBender
Read more...

Black Hat Ethical Hacking
OSINT Tool: Osintgram

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png OSINT Tool: OsintgramPost Views: 271 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 3 Minutes

OSINT Tool: Osintgram GitHub Link OsintgramOsintgram by datalux, is an OSINT tool on Instagram to collect, analyze, and run reconnaissance. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname.
Disclaimer: FOR EDUCATIONAL PURPOSE ONLY!

*Warning: It is advisable to not use your own/primary account when using this tool. Tools and CommandsFrom Viewing Pictures to searching bio these are list of some tools which can really help you while doing open source intelligence gathering on Instagram:
* addrs | Get all registered addressed by target photos
* captions | Get user’s photos captions
* comments | Get total comments of target’s posts
* followers | Get target followers
* followings | Get users followed by target
* fwersemail | Get email of target followers
* fwingsemail | Get email of users followed by target
* fwersnumber | Get phone number of target followers
* fwingsnumber | Get phone number of users followed by target
* hashtags | Get hashtags used by target
* info | Get target info
* likes | Get total likes of target’s posts
* mediatype | Get user’s posts type (photo or video)
* photodes | Get description of target’s photos
* photos | Download user’s photos in output folder
* propic | Download user’s profile picture
* stories | Download user’s stories
* tagged | Get list of users tagged by target
* wcommented | Get a list of user who commented target’s photos
* wtagged | Get a list of user who tagged target
You can find detailed commands usage here. Latest version | Commands | CHANGELOG
See Also: Massive campaign uses YouTube to push password-stealing malware FAQ⦿ Can I access the contents of a private profile? No, you cannot get information on private profiles. You can only get information from a public profile or a profile you follow. The tools that claim to be successful are scams!

⦿ What is and how I can bypass the challenge_required error? The challenge_required error means that Instagram notice a suspicious behavior on your profile, so needs to check if you are a real person or a bot. To avoid this you should follow the suggested link and complete the required operation (insert a code, confirm email, etc) Installation1. Fork/Clone/Download this repo

git clone https://github.com/Datalux/Osintgram.git

2. Navigate to the directory

cd Osintgram

3. Create a virtual environment for this project

python3 -m venv venv

4. Load the virtual environment

⦿ On Windows Powershell: .\venv\Scripts\activate.ps1
⦿ On Linux and Git Bash: source venv/bin/activate

5. Run pip install -r requirements.txt

6. Open the credentials.ini file in the config folder and write your Instagram account username and password in the corresponding fields

Alternatively, you can run the make setup command to populate this file for you.

7. Run the main.py script in one of two ways

⦿ As an interactive prompt python3 main.py <target
⦿ Or execute your command straight away python3 main.py <target–command
See Also: Complete Offensive Security and Ethical Hacking Course Docker Quick StartThis section will explain how you can quickly use this image with Docker or Docker-compose. PrerequisitesBefore you can use either Docker or Docker-compose, please ensure you do have the following prerequisites met.
1. Docker installed – link
2. Docker-composed installed (if using Docker-compose) – link
3. Credentials configured – This can be done manually or[...]

by running the make setup command from the root of this repo
Important: Your container will fail if you do not do step #3 and configure your credentials DockerIf docker is installed you can build an image and run this as a container.

Build:

docker build -t osintgram .

Run:

docker run –rm -it -v “$PWD/output:/home/osintgram/output” osintgram <target

* The <targetis the Instagram account you wish to use as your target for recon.
* The required -i flag enables an interactive terminal to use commands within the container. docs
* The required -v flag mounts a volume between your local filesystem and the container to save to the ./output/ folder. docs
* The optional –rm flag removes the container filesystem on completion to prevent cruft build-up. docs
* The optional -t flag allocates a pseudo-TTY which allows colored output. docs Using docker-composeYou can use the docker-compose.yml file this single command:

docker-compose run osintgram <target

Where target is the Instagram target for recon.

Alternatively you may run docker-compose with the Makefile:

make run – Builds and Runs with compose. Prompts for a target before running. Makefile (easy mode)For ease of use with Docker-compose, a Makefile has been provided.

Here is a sample work flow to spin up a container and run osintgram with just two commands!

1. make setup – Sets up your Instagram credentials
2. make run – Builds and Runs a osintgram container and prompts for a target
Sample workflow for development:

1. make setup – Sets up your Instagram credentials
2. make build-run-testing – Builds an Runs a container without invoking the main.py script. Useful for an it Docker session for development
3. make cleanup-testing – Cleans up the testing container created from build-run-testing Development versionTo use the development version with the latest feature and fixes just switch to development branch using Git:

git checkout development

and update to last version using:

git pull origin development UpdatingTo update Osintgram with the stable release just pull the latest commit using Git.

1. Make sure you are in the master branch running: git checkout master
2. Download the latest version: git pull origin master
See Also: Offensive Security Tool: Dalfox Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/dalfox-90x90.png Offensive Security Tool: Dalfox1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/unknown-90x90.png Offensive Security Tool: Whispers2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/Screenshot_20211001_133045-90x90.png Offensive Security Tool: URL Hunter3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unknown-90x90.png Offensive Security Tool: Discover4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/116777794-e9447880-aaa0-11eb-9697-af5f5617b279-90x90.png Offensive Security Tool: SniperPhish1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/jenkins-90x90.png Offensive Security Tool: Jenkins Attack Framework1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/pegasus-90x90.png Offensive Security Tool: Pegasus Spyware – Decompiled2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/FIbbZME-90x90.png Offensive Security Tool: Starkiller2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/0URVvVK54SOsx1MEq-90x90.png Offensive Security Tool: FFUF2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/687474703a2f2f633666632e696f2f77617263616e6e6f6e2d636c692e706e67-90x90.png Offensive Security Tool: Warcannon2 months ago
The post OSINT Tool: Osintgram first appeared on Black Hat Ethical Hacking.

PortBender - TCP Port Redirection Utility
http://www.kitploit.com/2021/10/portbender-tcp-port-redirection-utility.html

PortBender is a TCP port redirection utility that allows a red team operator to redirect inbound traffic destined for one TCP port (e.g., 445/TCP) to another TCP port (e.g., 8445/TCP). PortBender includes an aggressor (https://www.kitploit.com/search/label/Aggressor) script that operators can leverage to integrate the tool with Cobalt Strike. However, because the tool is implemented as a reflective DLL, it can integrate with any C2 framework supporting loading modules through a "ReflectiveLoader" interface [1]. The tool also allows operators to simulate a backdoor/persistence mechanism leveraged within the "PortServ.sys" capability used by the Duqu 2.0 threat actor.
Design
PortBender leverages the WinDivert library to intercept network traffic using the Windows Filtering Platform (WFP). The design of PortBender is heavily influenced by the DivertTCPConn utility which also leverages the WinDivert library [1].
Usage
PortBender has two modes of operation. The first is "redirector mode," and the second is "backdoor mode." In "redirector mode," any connection to a targeted destination port (e.g., 445/TCP) is redirected to an alternative port (e.g., 8445/TCP). In "backdoor mode," we only redirect traffic if an attacker sends a specially formatted TCP packet to a target port (e.g., 443/TCP). PortBender then adds that client IP address to a list of backdoor clients and redirects all traffic to that target port to an alternative port (e.g., 3389/TCP). An operator can leverage this mechanism to emulate the persistence technique used by the Duqu 2.0 threat actor when compromising Kaspersky.To execute PortBender we must first import the "PortBender.cna" script into Cobalt Strike (https://www.kitploit.com/search/label/Cobalt%20Strike) and upload the WinDivert32.sys or WinDivert64.sys binary included in "PortBender.zip" to the target host depending on the operating system architecture. The help menu for PortBender with the example usage is shown below: help PortBender Redirect Usage: PortBender redirect FakeDstPort RedirectedPort Backdoor Usage: PortBender backdoor FakeDstPort RedirectedPort Password Examples: PortBender redirect 445 8445 PortBender backdoor 443 3389 praetorian.antihacker ">beacon> help PortBender
Redirect Usage: PortBender redirect FakeDstPort RedirectedPort
Backdoor Usage: PortBender backdoor FakeDstPort RedirectedPort Password
Examples:
PortBender redirect 445 8445
PortBender backdoor 443 3389 praetorian.antihacker

Example Usage
For example, we may wish to execute PortBender in redirector (https://www.kitploit.com/search/label/Redirector) mode to perform an SMB relay attack from a compromised Windows system. To facilitate this, we can instruct PortBender to redirect all traffic to 445/TCP to an alternative port 8445/TCP running an attacker SMB service. In this example, we run the command "PortBender redirect 445 8445" to accomplish this. The expected output is below:

In this example, we want to deploy the covert persistence mechanism on a compromised Internet-facing IIS webserver. Here we run the "PortBender backdoor 443 3389 praetorian.antihacker" to instruct the backdoor service to redirect any connections to 443/TCP to 3389/TCP on the compromised host from any IP address that provides the specified "praetorian.antihacker" keyword. The expected output is shown below:

 Acknowledgements
Arno0x0x for his work on DivertTCPConn [1]Stephen Fewer for his work on Reflective DLL Injection (https://www.kitploit.com/search/label/DLL%20Injection) [2]Basil00 for his work on WinDivert [3]Francisco Dominguez for his research into performing SMB relaying on Windows [4]
References
[1] https://github.com/Arno0x/DivertTCPconn
[2] https://github.com/stephenfewer/ReflectiveDLLInjection
[3] https://github.com/basil00/Divert
[4] https://diablohorn.com/2018/08/25/remote-ntlm-relaying-through-meterpreter-on-windows-port-445

Download PortBender (https://github.com/praetorian-inc/PortBender)

KitPloit - PenTest Tools!
PortBender - TCP Port Redirection Utility

https://blogger.googleusercontent.com/img/a/AVvXsEgsLbXft5RnhzfABWPcELLQCI2dNJONpLPBUpabztI6mGBqar4zwOwdycko0byOditx6zCHWq2Nn46-_OnCeyA6Oj_2FFli3pIkLS7N3HUgKN2Y84PoD84-U35YDZNeGy-SkGhSYN6kKdkxFjYpOkUPY15U4Q9c5_lJVKCxSpv2B2Ow33IeVC3YDvJgrQ=w640-h388 PortBender is a TCP port redirection utility that allows a red team operator to redirect inbound traffic destined for one TCP port (e.g., 445/TCP) to another TCP port (e.g., 8445/TCP). PortBender includes an aggressor script that operators can leverage to integrate the tool with Cobalt Strike. However, because the tool is implemented as a reflective DLL, it can integrate with any C2 framework supporting loading modules through a "ReflectiveLoader" interface [1]. The tool also allows operators to simulate a backdoor/persistence mechanism leveraged within the "PortServ.sys" capability used by the Duqu 2.0 threat actor. DesignPortBender leverages the WinDivert library to intercept network traffic using the Windows Filtering Platform (WFP). The design of PortBender is heavily influenced by the DivertTCPConn utility which also leverages the WinDivert library [1]. UsagePortBender has two modes of operation. The first is "redirector mode," and the second is "backdoor mode." In "redirector mode," any connection to a targeted destination port (e.g., 445/TCP) is redirected to an alternative port (e.g., 8445/TCP). In "backdoor mode," we only redirect traffic if an attacker sends a specially formatted TCP packet to a target port (e.g., 443/TCP). PortBender then adds that client IP address to a list of backdoor clients and redirects all traffic to that target port to an alternative port (e.g., 3389/TCP). An operator can leverage this mechanism to emulate the persistence technique used by the Duqu 2.0 threat actor when compromising Kaspersky.

To execute PortBender we must first import the "PortBender.cna" script into Cobalt Strike and upload the WinDivert32.sys or WinDivert64.sys binary included in "PortBender.zip" to the target host depending on the operating system architecture. The help menu for PortBender with the example usage is shown below: beacon> help PortBender
Redirect Usage: PortBender redirect FakeDstPort RedirectedPort
Backdoor Usage: PortBender backdoor FakeDstPort RedirectedPort Password
Examples:
PortBender redirect 445 8445
PortBender backdoor 443 3389 praetorian.antihacker Example UsageFor example, we may wish to execute PortBender in redirector mode to perform an SMB relay attack from a compromised Windows system. To facilitate this, we can instruct PortBender to redirect all traffic to 445/TCP to an alternative port 8445/TCP running an attacker SMB service. In this example, we run the command "PortBender redirect 445 8445" to accomplish this. The expected output is below: https://blogger.googleusercontent.com/img/a/AVvXsEgsLbXft5RnhzfABWPcELLQCI2dNJONpLPBUpabztI6mGBqar4zwOwdycko0byOditx6zCHWq2Nn46-_OnCeyA6Oj_2FFli3pIkLS7N3HUgKN2Y84PoD84-U35YDZNeGy-SkGhSYN6kKdkxFjYpOkUPY15U4Q9c5_lJVKCxSpv2B2Ow33IeVC3YDvJgrQ=w640-h388 In this example, we want to deploy the covert persistence mechanism on a compromised Internet-facing IIS webserver. Here we run the "PortBender backdoor 443 3389 praetorian.antihacker" to instruct the backdoor service to redirect any connections to 443/TCP to 3389/TCP on the compromised host from any IP address that provides the specified "praetorian.antihacker" keyword. The expected output is shown below: https://blogger.googleusercontent.com/img/a/AVvXsEjf2QV8NEhLB03jdYSkzqqbv3PVlXHHowuX_7CzgO9c7LCIp0Pu3F28kWS9vvzKMrIu5wmbWFN2FWe8HI7svE8lz85RmCELtzfacPkPHhWXL96WOn333rhEyxD_igONWbCg879tkQ12YxgSPvZGvmhuVkNJ_lNUUumTe1Xu7WUJzsXDh-jtx1veXLFoww=w640-h362 Acknowledgements* Arno0x0x for his work on DivertTCPConn [1]
* Stephen Fewer for his wor[...]

k on Reflective DLL Injection [2]
* Basil00 for his work on WinDivert [3]
* Francisco Dominguez for his research into performing SMB relaying on Windows [4] References[1] https://github.com/Arno0x/DivertTCPconn
[2] https://github.com/stephenfewer/ReflectiveDLLInjection
[3] https://github.com/basil00/Divert
[4] https://diablohorn.com/2018/08/25/remote-ntlm-relaying-through-meterpreter-on-windows-port-445 Download PortBender

Kali Linux Tutorials
Viper : Intranet Pentesting Tool With Webui

* Viper is a graphical intranet penetration tool, which modularizes and weaponizes the tactics and technologies commonly used in the process of Intranet penetration
* Viper integrates basic functions such as bypass anti-virus software, intranet tunnel, file management, command line and so on
* Viper has integrated 80+ modules, covering Resource Development / Initial Access / Execution / Persistence / Privilege Escalation / Defense Evasion / Credential Access / Discovery / Lateral Movement / Collection and other categories
* Viper’s goal is to help red team engineers improve attack efficiency, simplify operation and reduce technical threshold
* Viper supports running native msfconsole in browser and multi – person collaboration
https://blogger.googleusercontent.com/img/a/AVvXsEiSfl0lG-11BP0Xj7ReCulDO_qTGdK2quU7fERcy7BrjkBO5gFXpUBl5oPf9SoMPQHTRZkUeBUFP9b_4mA17quyzKhuxRatTBcusHAIAxVmGSr8wefcxXqkD5HO9IpGaUkCBErzWPUuivnFOnWMOfNmc1jz6e8qIlV4-p-g8sjT5CMDJJowMj0zoYA3=s2048 https://blogger.googleusercontent.com/img/a/AVvXsEjL0kv4UOa1vmMuzq8pTVajBnIh45lJcCoAq94YrBDNAAOpwyk0kd3-QUvnneDZ79Y0WKA3cZnZ1vE8Jfc0KysAoreCaA-QFH0O2aNE7UocIZPLGy2lQizmdkZngEwpqi450Rr3T8cJkNEAjCzI9JrXeDb4-ILYlSTAu8ggReAdOgepW9fGmLCSQNCO=s2048 https://blogger.googleusercontent.com/img/a/AVvXsEjTKCvadsPxpIygX-y1BLy_pCGjuIJWuDNCrzwfOwnbGHV3mH5YaJ_hik_LKkZuH3cR38GoGygfAGHKz-tgqAWFjPLcx-I1ahW7K5He_CyJgZy8eHDKQFRz1pCvZF3mEBjB7zygGWBhTwmEcYHDNtI0Crde1gVqLFp9G1voxW3XD63f_Xd_tUlYlDAM=s2256 https://blogger.googleusercontent.com/img/a/AVvXsEijQ7vD_t6presgz9CMoglhvXcuIN9bEb_IM4tBUdMdaufgubaRi4TGzMLALODy9VjTiu6vaIqoWk9URiyfSowJCBZmx2taAOLAm_VAiRX2-Xd4mJtygbltiyaIjTXf81FgyLVUt-ZTTiPhnv202bsXU9dgiPmuK44Ykbdd29GgySO-k4tczvsfmf6r=s2048 https://blogger.googleusercontent.com/img/a/AVvXsEi580GbiW83lQ0oa_i6TcDu1dHcRD8F5qRG73bArZC4p59pEJXsik4XDRnC-Hgc-ZtQbyVwfFKmqo-vY9KOEcPYM-8oPtmrg-wf8CCfku4Xe2beCKVzkxyH_KdeJJFwBS8Utd7AQ5mUC9fl4kAGJmQP1-JPNjMQXWfabBA-865KgB-Mn-C1CmLQEtfa=s2256 https://blogger.googleusercontent.com/img/a/AVvXsEjIW3cVR51EwlgELEQGvXSyR_siMxo18LX74dOz3SFCbqUDEQNu_qr21IuEzdzZIEH9Zx_o6Zn67J7gnNJ5CjSv-oB7JFGNFP4EtzHFbwiMww-s2pzEWfbuSQ4bTg-6X18pL1pCJ0GRXxdPHLTBAUUcAWZ9uoJXQtkPyXhpGtBe11K91HgkQTP-rQvZ=s2048

Download

hacking: security in practice
Null.bin sent to random contacts on WhatsApp. I didn't do it. Is it a malware?

I can't locate Null.bin file on whatsapp. Yet it was sent to 3 people on my WhatsApp.

Is it a RAT type malware?

submitted by /u/Good-Bottle7238
[link] [comments]

Hacking on Medium
HackTheBox — Horizontall Writeup

https://cdn-images-1.medium.com/max/600/0*Dc8Brb_Y3CEdXd4_.png
So this is my write-up on one of the HackTheBox machines called Seal. Let’s go!

Continue reading on Medium »

Hacking on Medium
Hashing — Cryptography

https://cdn-images-1.medium.com/max/1026/1*LvCnivdO1y1YO3gXzePgeA.png
So before we dive in to Hashing, Hash functions are quite different from encryption. There is no key and it’s meant to be impossible or…

Continue reading on Medium »