KitPloit - PenTest Tools!
Web-Hacking-Toolkit - A Multi-Platform Web Hacking Toolkit Docker Image With Graphical User Interface (GUI) Support

https://blogger.googleusercontent.com/img/a/AVvXsEguFZ94LoUCfLxbO9iksLhSoGAXJOFjMS5_CZSvdQgH1kWtiFo5sTRs3IBJ3oqL8imYvor6hr2EgzOrlRrJ8A3QfuIGnDqMM-oe2nfRurJdIwEQa8uIT0zReEhIDEOi4Bx2fzjcSBUiFRqUEaq3sfPVOPS-rzYmoGohQ1dPEK3cB4KiLwPrKm051smR3w=w640-h310 A multi-platform web hacking toolkit Docker image with Graphical User Interface (GUI) support. InstallationDockerPull the image from Docker Hub: docker pull signedsecurity/web-hacking-toolkitRun a container and attach a shell: docker run --rm -it --name web-hacking-toolkit signedsecurity/web-hacking-toolkit /usr/bin/zshDocker ComposeDocker-Compose can also be used. version: "3.9"

services:
web-hacking-toolkit:
image: signedsecurity/web-hacking-toolkit
container_name: web-hacking-toolkit
hostname: web-hacking-toolkit
stdin_open: true
ports:
- "22:22" # exposed for GUI support sing SSH with X11 forwarding
volumes:
- ./data:/root/data
restart: unless-stoppedBuild and run container: docker-compose upAttach shell: docker-compose exec web-hacking-toolkit /usr/bin/zshBuild from SourceClone this repository and build the image: git clone https://github.com/signedsecurity/web-hacking-toolkit.git && \
cd web-hacking-toolkit && \
make buildRun a container and attach a shell: docker run --rm -it --name web-hacking-toolkit signedsecurity/web-hacking-toolkit /usr/bin/zshGUI SupportBy default, no GUI tools can be run in a Docker container as no X11 server is available. To run them, you must change that. What is required to do so depends on your host machine. If you:

* run on Linux, you probably have X11
* run on Mac OS, you need Xquartz (brew install Xquartz)
* run on Windows, you have a problem Using SSH with X11 forwardingUse X11 forwarding through SSH if you want to go this way. Run start_sshinside the container to start the server, make sure you expose port 22 when starting the container: docker run -p 127.0.0.1:22:22 ..., then use ssh -X ...when connecting (the script prints the password). InstalledToolsInterface Name Description CLI Amass In-depth Attack Surface Mapping and Asset Discovery CLI anew A tool for adding new lines to files, skipping duplicates GUI Burp Suite Community The BurpSuite Project community edition CLI curl A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, MQTT, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features CLI dnsx dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers. CLI ffuf Fast web fuzzer written in Go CLI findomain The fastest and cross-platform subdomain enumerator, do not waste your time. GUI firefox Safe and easy web browser from Mozilla CLI html-tool Take URLs or filenames for HTML documents on stdin and extract tag contents, attribute values, or comments CLI httpx httpx is a fast and multi-purpose HTTP toolkit allow to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads. CLI naabu A fast port scanner written in go with focus on reliability and simplicity. Designed to be used in combination with other tools for attack surface discovery in bug bounties and pentests CLI nmap Nmap - the Network Mapper. Github mirror of official SVN repository. CLI sigsubfind3r A subdomain discovery tool - it gathers a list of subdomains passively using various online sources. CLI sigurlfind3r A passive reconnaissance tool[...]

___________________________
@hacking_Attack
@Hacking_Video

for known URLs discovery - it gathers a list of URLs passively using various online sources. CLI sigurlscann3r A web application attack surface mapping tool. It takes in a list of urls then performs numerous probes CLI subdomains.sh A wrapper around for subdomains gathering tools (amass, subfinder, findomain & sigsubfind3r) to increase gathering efficiency and automating the workflow. CLI subfinder Subfinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing. CLI tmux tmux is a terminal multiplexer: it enables a number of terminals to be created, accessed, and controlled from a single screen. tmux may be detached from a screen and continue running in the background, then later reattached CLI vim A highly configurable text editor built to make creating and changing any kind of text very efficient. CLI wappalyzer Wappalyzer identifies technologies on websites, such as CMS, web frameworks, ecommerce platforms, JavaScript libraries, analytics tools and more. CLI wuzz Interactive cli tool for HTTP inspection WordlistsWordlist Description SecLists SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. jhaddix / content_discovery_all.txt a masterlist of content discovery URLs and files (used most commonly with gobuster) Download Web-Hacking-Toolkit

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Really

For one it was legal for 2 i wasnt asking someone to do it for me nor did i have the intention of asking someone to do it and i also wasnt asking how to hack i know what i know and i specifically said is it possible not how do i do this so to remove that post is bogus and i did read the rules and how do i hack wasnt in my post

submitted by /u/Specialist-Hurry2749
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
PROFESSIONAL HACKER

I know a real professional hacker KASPERSKY who has worked for me once in this past month. He is very good at hacking. He offers legit…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Having trouble understanding WEP cracking and Initialization vectors

Hi guys, I'm going through a course on EH and came across WEP cracking, but can't grasp the theory behind it, particularly regarding Initialization vectors.

They explain that an IV is appended to the key which becomes a keystream that is used to encrpyt the data, and then go on to state that having multiple of the same IVs after collecting thousands of packets, we can go on to decrypt the data within.

My questions are:

1) How does an IV secure the key used to create the keystream? Or rather, why does adding a random value to the key make it harder to decrypt? How would we decrypt the key without the IV in the first place?

2) Why would having multiple IVs help us? If the key stream is just (IV + Key), what's the difference if we get two of the same ones?

Answers are appreicated, thanks for taking the time to read this :)

submitted by /u/Craedyth
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Using tor app on android just for browsing, yey or ney?

If I'll use this to serf the deep web would there be any incriminating traces left?

submitted by /u/Miserable_Molasses_5
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Best OS for HACKING…..

https://cdn-images-1.medium.com/max/2600/1*YKl5t47omYWL-ggNP_gibA.jpeg
Best Article for Beginners for choosing the perfect Operating Systems

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Intigritis October challenge Writeup
https://medium.com/@pr0fessor/intigritis-october-challenge-writeup-8445e864e245?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Welcome fellow Hackers this is my solution to the Halloween challenge from Intigriti it is definitely not the most complicated one and…Continue reading on Medium » (https://medium.com/@pr0fessor/intigritis-october-challenge-writeup-8445e864e245?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
The SolarWinds Hackers Are Looking for Their Next Big Score

https://external-preview.redd.it/lQDbIaNd9PlenU3xxbznMp1nMzImMjRyaYUWL5KObSQ.jpg?width=640&crop=smart&auto=webp&s=3c981fb69d074dfed48a0a88a83da3f8a52c37c8 submitted by /u/ohrobcow
[link] [comments]

hacking: security in practice
How many brute force attempts could an average computer nowadays try in an hour?

How many attempts could a modern computer attempt? I'm not sure how I could calculate or figure this out and I cant find any data online. Does anyone here know with a source if you could?

Edit: pretend that the only limiting factor was the capabilities of an average computer

submitted by /u/SewgMan
[link] [comments]

hacking: security in practice
‘Trojan Source’ Bug Threatens the Security of All Code

https://external-preview.redd.it/FT-JNmsiSHvG9OUScqH7Edwqa0hcBG2j3b5BOZ-I1jg.jpg?width=320&crop=smart&auto=webp&s=387f7b1574ee27e8c6bebd12c3ab524e0f0635c9 submitted by /u/pcaversaccio
[link] [comments]

hacking: security in practice
Hacking Forums (Are they legal?)

Okay, I'm just honestly curious. How are all of the hacking/doxing/cracking forums staying up? Like nulled, raid, etc. They post some illegal things on the clear web. What protects them? This intrigued me once I really started thinking abt it. Does anyone know?

Because some of them, people are selling fraud services, but also so was the silk road. What is protecting these clear-web sites, like how are they still up?

Sorry i got high and went on a rabbit hole

submitted by /u/Numbtuna
[link] [comments]

Hacking on Medium
AArch 64 Bytes: Part 2 (64-bit Immediate Values)

https://cdn-images-1.medium.com/max/1280/1*Fvq5caqqhQunJGD_TEMBEA.png
For a complete table of contents of all the lessons please click below as it will give you a brief of each lesson in addition to the…

Continue reading on Medium »