Authenticated Blind & Error based SQL injection Lead To RCE.Continue reading on Medium » (https://medium.com/@J03KR/cve-2021-40578-127ceaf3f1bb?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Offensive Security Tool: Pentesting Tools
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Offensive Security Tool: Pentesting ToolsPost Views: 3 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 2 Minutes
Offensive Security Tool: Pentesting Tools GitHub Link
This repo was created containing over 48 starred tools for specific attack vectors, covering a wide range of techniques used by advanced Offensive Security and Red Teams to conduct wide range of Pentesting, Bug Bounty Hunting and more. It is a really important repo to have, and gives you the ability to train on more sophisticated attack scenarios as it gives a lot of explanation for each technique on practicality usages and more.
Some of the attack vectors covered, ranging from Recon, OSINT, Attack, Digital Forensics, Source Code, Reverse Engineering, Exploits:
* Payload Hosting & Reverse Shellz
* POST Exploitation
* Backdoor finder
* Persistence on windows
* Web Application Pentest
* Framework Scanner / Exploitation
* Network- / Service-level Vulnerability Scanner
* Windows & Linux Privilege Escalation / Audit
* Credential harvesting Linux & Windows
* Data Exfiltration – DNS/ICMP/Wifi Exfiltration
* Reverse Engineering
* Forensics
* Raspberry PI Exploitation
* Social Engineering
* Source Code Analysis
And much more. The great thing is that they have categories, helping a pentester easily choose which category of attacks is needed all in one place.
See Also: BotenaGo botnet targets millions of IoT devices with 33 exploits
See Also: Hacking stories – The first botnet hijacker aka the Zombie King Pentesting Tools* General useful PowerShell Scripts
* AMSI Bypass restriction Bypass
* Payload Hosting
* Network Share Scanner
* Lateral Movement
* Reverse Shellz
* POST Exploitation
* Pivot
* Backdoor finder
* Persistence on windows
* Web Application Pentest
* Framework Discovery
* Framework Scanner / Exploitation
* Web Vulnerability Scanner / Burp Plugins
* Network- / Service-level Vulnerability Scanner
* Crawler
* Web Exploitation Tools
* Windows Privilege Escalation / Audit
* T3 Enumeration
* Linux Privilege Escalation / Audit
* Credential harvesting Windows Specific
* Credential harvesting Linux Specific
* Data Exfiltration – DNS/ICMP/Wi-Fi Exfiltration
* Git Specific
* Reverse Engineering / decompiler
* Forensics
* Network Attacks
* Specific MITM service Exploitation
* Sniffing / Evaluation / Filtering
* Scanner / Exploitation-Frameworks / Automation
* Default Credential Scanner
* Payload Generation / AV-Evasion / Malware Creation
* Domain Finding / Subdomain Enumeration
* Scanner network level
* Email Gathering
* Domain Auth + Exploitation
* Network service – Login Brute Force + Wordlist attacks
* Command & Control Frameworks
* Wi-Fi Tools
* Raspberry PI Exploitation
* Social Engineering
* Wordlists / Wordlist generators
* Obfuscation
* Source Code Analysis
* No category yet
* Industrial Control Systems
* NAC bypass
* JMX Exploitation
To find out about all the rest of Repos, click here
See Also: Complete Offensive Security & Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/unknown-90x90.png Offensive Security Tool: DotDotPwn – The Directory Traversal Fuzzer1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/unknown-1-90x90.png Offensive Security Tool: ZipExec2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/carbon-2048x1374-1-90x90.png OSINT Tool: Osintgram3 weeks ag[...]
Offensive Security Tool: Pentesting Tools
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Offensive Security Tool: Pentesting ToolsPost Views: 3 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 2 Minutes
Offensive Security Tool: Pentesting Tools GitHub Link
This repo was created containing over 48 starred tools for specific attack vectors, covering a wide range of techniques used by advanced Offensive Security and Red Teams to conduct wide range of Pentesting, Bug Bounty Hunting and more. It is a really important repo to have, and gives you the ability to train on more sophisticated attack scenarios as it gives a lot of explanation for each technique on practicality usages and more.
Some of the attack vectors covered, ranging from Recon, OSINT, Attack, Digital Forensics, Source Code, Reverse Engineering, Exploits:
* Payload Hosting & Reverse Shellz
* POST Exploitation
* Backdoor finder
* Persistence on windows
* Web Application Pentest
* Framework Scanner / Exploitation
* Network- / Service-level Vulnerability Scanner
* Windows & Linux Privilege Escalation / Audit
* Credential harvesting Linux & Windows
* Data Exfiltration – DNS/ICMP/Wifi Exfiltration
* Reverse Engineering
* Forensics
* Raspberry PI Exploitation
* Social Engineering
* Source Code Analysis
And much more. The great thing is that they have categories, helping a pentester easily choose which category of attacks is needed all in one place.
See Also: BotenaGo botnet targets millions of IoT devices with 33 exploits
See Also: Hacking stories – The first botnet hijacker aka the Zombie King Pentesting Tools* General useful PowerShell Scripts
* AMSI Bypass restriction Bypass
* Payload Hosting
* Network Share Scanner
* Lateral Movement
* Reverse Shellz
* POST Exploitation
* Pivot
* Backdoor finder
* Persistence on windows
* Web Application Pentest
* Framework Discovery
* Framework Scanner / Exploitation
* Web Vulnerability Scanner / Burp Plugins
* Network- / Service-level Vulnerability Scanner
* Crawler
* Web Exploitation Tools
* Windows Privilege Escalation / Audit
* T3 Enumeration
* Linux Privilege Escalation / Audit
* Credential harvesting Windows Specific
* Credential harvesting Linux Specific
* Data Exfiltration – DNS/ICMP/Wi-Fi Exfiltration
* Git Specific
* Reverse Engineering / decompiler
* Forensics
* Network Attacks
* Specific MITM service Exploitation
* Sniffing / Evaluation / Filtering
* Scanner / Exploitation-Frameworks / Automation
* Default Credential Scanner
* Payload Generation / AV-Evasion / Malware Creation
* Domain Finding / Subdomain Enumeration
* Scanner network level
* Email Gathering
* Domain Auth + Exploitation
* Network service – Login Brute Force + Wordlist attacks
* Command & Control Frameworks
* Wi-Fi Tools
* Raspberry PI Exploitation
* Social Engineering
* Wordlists / Wordlist generators
* Obfuscation
* Source Code Analysis
* No category yet
* Industrial Control Systems
* NAC bypass
* JMX Exploitation
To find out about all the rest of Repos, click here
See Also: Complete Offensive Security & Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/unknown-90x90.png Offensive Security Tool: DotDotPwn – The Directory Traversal Fuzzer1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/unknown-1-90x90.png Offensive Security Tool: ZipExec2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/carbon-2048x1374-1-90x90.png OSINT Tool: Osintgram3 weeks ag[...]
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Offensive Security Tool: Pentesting Tools https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Offensive Security Tool: Pentesting ToolsPost Views: 3 https://www.blackhatethicalhacking.com/wp…
o
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/dalfox-90x90.png Offensive Security Tool: Dalfox4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/unknown-90x90.png Offensive Security Tool: Whispers1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/Screenshot_20211001_133045-90x90.png Offensive Security Tool: URL Hunter1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unknown-90x90.png Offensive Security Tool: Discover2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/116777794-e9447880-aaa0-11eb-9697-af5f5617b279-90x90.png Offensive Security Tool: SniperPhish2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/jenkins-90x90.png Offensive Security Tool: Jenkins Attack Framework2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/pegasus-90x90.png Offensive Security Tool: Pegasus Spyware – Decompiled2 months ago
The post Offensive Security Tool: Pentesting Tools first appeared on Black Hat Ethical Hacking.
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/dalfox-90x90.png Offensive Security Tool: Dalfox4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/unknown-90x90.png Offensive Security Tool: Whispers1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/Screenshot_20211001_133045-90x90.png Offensive Security Tool: URL Hunter1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unknown-90x90.png Offensive Security Tool: Discover2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/116777794-e9447880-aaa0-11eb-9697-af5f5617b279-90x90.png Offensive Security Tool: SniperPhish2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/jenkins-90x90.png Offensive Security Tool: Jenkins Attack Framework2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/pegasus-90x90.png Offensive Security Tool: Pegasus Spyware – Decompiled2 months ago
The post Offensive Security Tool: Pentesting Tools first appeared on Black Hat Ethical Hacking.
Abaddon - Make red team operations faster, more repeatable, stealthier, while including value-added tools and bringing numerous reporting capabilities
http://www.kitploit.com/2021/11/abaddon-make-red-team-operations-faster.html
http://www.kitploit.com/2021/11/abaddon-make-red-team-operations-faster.html
Red team operations involve miscellaneous skills, last several months and are politically sensitive; they require a lot of monitoring, consolidating and caution. Wavestone’s red team operations management (https://www.kitploit.com/search/label/Management) software, Abaddon, has been designed to make red team operations faster, more repeatable, stealthier, while including value-added tools and bringing numerous reporting capabilities.
Because:There are tons of tools used by red teamers... but no operation management (and free and open-source) software... and no aggregation between these tools, anyway... and "Operational security" failures are commonWhat did we want with Abaddon ?:Abaddon aims at facilitating red team operations by:Reducing the time to build an infrastructureEnabling complex actions with 1 or 2 clicksEnabling easier reporting for long operationsReducing the “OPSEC failure” riskThe slides presenting Abaddon at RSAC2020 can be found here: (Abaddon, the red team angel (https://www.rsaconference.com/usa/us-2020/agenda/abaddon-the-red-team-angel))
What you can deploy
Because:There are tons of tools used by red teamers... but no operation management (and free and open-source) software... and no aggregation between these tools, anyway... and "Operational security" failures are commonWhat did we want with Abaddon ?:Abaddon aims at facilitating red team operations by:Reducing the time to build an infrastructureEnabling complex actions with 1 or 2 clicksEnabling easier reporting for long operationsReducing the “OPSEC failure” riskThe slides presenting Abaddon at RSAC2020 can be found here: (Abaddon, the red team angel (https://www.rsaconference.com/usa/us-2020/agenda/abaddon-the-red-team-angel))
What you can deploy
unzip awscliv2.zip
sudo ./aws/installClone this repository and move inside the repository foldergit clone git@github.com/wavestone-cdt/abaddon.git
cd abaddonCreate the files ~/.aws/credentials and ~/.aws/config with your AWS credentials (https://www.kitploit.com/search/label/Credentials) and configuration, using the following command:aws configureMove settings.py.sample to settings.py. Add change the database user password (This password will be asked durring the setup process)/g' abaddon/settings.py ">mv abaddon/settings.py.sample abaddon/settings.py
sed -i 's/yourPasswordHere//g' abaddon/settings.pyLaunch the following command in the abaddon/setup folder:bash setup/install.shThis script will:Update your OSInstall the packages that are required by Django and Abaddon (including docker and docker-compose)Install all the python dependencies (including Django 3.X)Create a PostgreSQL database and a user with the right role (the password for the database that you need to give is inside the abaddon/settings.py file, it is recommended to change the password)Apply Django migrationsCreate a superuser for the Django application, that will be used to connect to the graphical interface of Abaddon.Start the Red Team Angel !bash abaddon.shOpen a browser, and go to the URL 127.0.0.1:8000 (connect with the Django superuser credentials created during the installation).
Deployment of a C&C infrastructure inside Abaddon
If no EC2 instance has been deployed before from Abaddon (it is important that you deploy the EC2 from Abaddon, so that you have access to the SSH key, located in the aws folder), go to the Delivery/Let’s phish! page. Click on Deploy EC2!. Wait for the end of the deployment (you can check inside the terminal used to start Abaddon if the EC2 is ready to be used, all the deployment steps appear in the shell).Go to the misc/apache/default-ssl.conf file and UPDATE the domain name of the EC2 inside the second VirtualHost. To avoid the detection of your infrastructure, buy a new domain name and configure it to point to your EC2. Use this domain name in the Apache configuration file and UPDATE misc/apache/topsecret.key and misc/apache/topsecret.crt accordingly, which is with the private key and the certificate of your new domain.Go then to the Monitor current Scenarios page and click on Configure a RedELK infrastructure. Give this scenario a name. Abaddon supports actually only one scenario at the time. Choose an EC2 instance deployed from your Abaddon and choose Local Deployment (because you deploy your Apache docker locally). Then, choose the ports used by the deployed EC2 to receive the HTTP and SSL connections, and the port and the IP address the Apache reverse proxy will forward the traffic to (for instance, the IP and port your SILENTTRINITY (https://www.kitploit.com/search/label/SILENTTRINITY) server listens to). A common configuration would be the following:http port = 80ssl port = 443Listening Port= 9999C2 IP adress = 172.16.0.1Wait for the end of the deployment and go back to the Monitor current Scenarios page.
Getting Involved
Please do not hesitate to send us Pull Requests, or send me questions (@Ibrahimous).
Call for Contributions
We really would like to see pentesters and other offensive security lovers get out of their secret zone, and share ideas, contribute to establishing a comprehensive framework for red team operations.So, I you want to enhance the tool, please do. If you want to reshape it radically, please submit your ideas.
Documentation, Setup & Basic Usage
The documentation is a work in progress, and will very soon be available in the Wiki (https://github.com/wavestone-cdt/abaddon/wiki).
Author
Charles IBRAHIM (@Ibrahimous (https://twitter.com/Ibrahimous))
Acknowledgments, Contributors & Involuntary Contributors
sudo ./aws/installClone this repository and move inside the repository foldergit clone git@github.com/wavestone-cdt/abaddon.git
cd abaddonCreate the files ~/.aws/credentials and ~/.aws/config with your AWS credentials (https://www.kitploit.com/search/label/Credentials) and configuration, using the following command:aws configureMove settings.py.sample to settings.py. Add change the database user password (This password will be asked durring the setup process)/g' abaddon/settings.py ">mv abaddon/settings.py.sample abaddon/settings.py
sed -i 's/yourPasswordHere//g' abaddon/settings.pyLaunch the following command in the abaddon/setup folder:bash setup/install.shThis script will:Update your OSInstall the packages that are required by Django and Abaddon (including docker and docker-compose)Install all the python dependencies (including Django 3.X)Create a PostgreSQL database and a user with the right role (the password for the database that you need to give is inside the abaddon/settings.py file, it is recommended to change the password)Apply Django migrationsCreate a superuser for the Django application, that will be used to connect to the graphical interface of Abaddon.Start the Red Team Angel !bash abaddon.shOpen a browser, and go to the URL 127.0.0.1:8000 (connect with the Django superuser credentials created during the installation).
Deployment of a C&C infrastructure inside Abaddon
If no EC2 instance has been deployed before from Abaddon (it is important that you deploy the EC2 from Abaddon, so that you have access to the SSH key, located in the aws folder), go to the Delivery/Let’s phish! page. Click on Deploy EC2!. Wait for the end of the deployment (you can check inside the terminal used to start Abaddon if the EC2 is ready to be used, all the deployment steps appear in the shell).Go to the misc/apache/default-ssl.conf file and UPDATE the domain name of the EC2 inside the second VirtualHost. To avoid the detection of your infrastructure, buy a new domain name and configure it to point to your EC2. Use this domain name in the Apache configuration file and UPDATE misc/apache/topsecret.key and misc/apache/topsecret.crt accordingly, which is with the private key and the certificate of your new domain.Go then to the Monitor current Scenarios page and click on Configure a RedELK infrastructure. Give this scenario a name. Abaddon supports actually only one scenario at the time. Choose an EC2 instance deployed from your Abaddon and choose Local Deployment (because you deploy your Apache docker locally). Then, choose the ports used by the deployed EC2 to receive the HTTP and SSL connections, and the port and the IP address the Apache reverse proxy will forward the traffic to (for instance, the IP and port your SILENTTRINITY (https://www.kitploit.com/search/label/SILENTTRINITY) server listens to). A common configuration would be the following:http port = 80ssl port = 443Listening Port= 9999C2 IP adress = 172.16.0.1Wait for the end of the deployment and go back to the Monitor current Scenarios page.
Getting Involved
Please do not hesitate to send us Pull Requests, or send me questions (@Ibrahimous).
Call for Contributions
We really would like to see pentesters and other offensive security lovers get out of their secret zone, and share ideas, contribute to establishing a comprehensive framework for red team operations.So, I you want to enhance the tool, please do. If you want to reshape it radically, please submit your ideas.
Documentation, Setup & Basic Usage
The documentation is a work in progress, and will very soon be available in the Wiki (https://github.com/wavestone-cdt/abaddon/wiki).
Author
Charles IBRAHIM (@Ibrahimous (https://twitter.com/Ibrahimous))
Acknowledgments, Contributors & Involuntary Contributors
(In no particular order)Marcello Salvati (@byt3bl33d3r (https://twitter.com/byt3bl33d3r)), for SILENTTRINITY. Boo-lang, omg.Arthur Villeneuve (@crypt0-M3lon (https://twitter.com/crypt0_m3lon)), for his gorgeous ideas about docker, the proxy protocol, and more.Romain Melchiorre, for integrating lots of great ideasTimon Glasser, for patching SILENTTRINITY, fixing bugs, integrating ideas, and making everything work smoothly during actual engagements!@sbnsec, for currently terraforming all the things!Arnaud Soullié (@arnaudsoullie (https://twitter.com/arnaudsoullie)), because he overviewed most of the project!
Download Abaddon (https://github.com/wavestone-cdt/abaddon)
Download Abaddon (https://github.com/wavestone-cdt/abaddon)
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
Abaddon - Make red team operations faster, more repeatable, stealthier, while including value-added tools and bringing numerous reporting capabilities
https://blogger.googleusercontent.com/img/a/AVvXsEivByT9o0xqQYC-npGn2EZghL4rcF3BxvxGiK5rS4Na4DP3dg3Mdh7zotWR1FItSlBEeuyvhFzueeKWpfULdlX7g8UBT5qtUrZ1qR_-fSxUoSnBCrtXDP2Qt4-QUWtLKbAaBo4c7UpU3Knf7oXZNGIS30E5BhEHoBtS3HZEkzveFqjkkxyLqQEwTiLYxg=s320 Red team operations involve miscellaneous skills, last several months and are politically sensitive; they require a lot of monitoring, consolidating and caution. Wavestone’s red team operations management software, Abaddon, has been designed to make red team operations faster, more repeatable, stealthier, while including value-added tools and bringing numerous reporting capabilities.
Because:
* There are tons of tools used by red teamers
* ... but no operation management (and free and open-source) software
* ... and no aggregation between these tools, anyway
* ... and "Operational security" failures are common
What did we want with Abaddon ?:
Abaddon aims at facilitating red team operations by:
* Reducing the time to build an infrastructure
* Enabling complex actions with 1 or 2 clicks
* Enabling easier reporting for long operations
* Reducing the “OPSEC failure” risk
The slides presenting Abaddon at RSAC2020 can be found here: (Abaddon, the red team angel) What you can deployhttps://blogger.googleusercontent.com/img/a/AVvXsEh2TrG0m_TjQthnOh718EuPLC_JvRNMzOZPT8yZ7hg8MDuDfv3NCzUIdHmb7Xz4hagmyBnU3-uJL8A2Ajp-XMc0TwPZCJTQyq_EGmm64gLala7vFKMN1s9sdQoei4dQtxej4c8VvWT8bjx2Z8NNhT3qA7-M91jxQGdXv5jvm1ppuHPLSR8ftkmb2sDGRw=w640-h310 * Deployed within 30 minutes
* Throwable, authenticated, stealth
* Enables phishing as well as remote command execution Other features* Reconnaissance: graphical interface to NMAP, Recon-NG, HunterIO, and Amass
* Weaponization: generation of obfuscated payloads under development
* Delivery: one or two-clicks deployment of EC2 instances, Gophish, and of a fully functionnal, stealthy & dockerized C&C infrastructure as shown above
* Exploitation & Post-Exploitation: ideas under development :)
* Reporting: a simple dashboard ready but still under development to follow your operations Installing and launching AbaddonAbaddon has been tested on Debian, LUbuntu, and of course KALI Linux (latest tests have been performed on the 5.4.0 amd64 version). You also need to have Internet access, and a public IP address if you want to deploy your C&C server locally.
Note that to configure your AWS environment, the easiest way is probably to install the aws-cli like indicated here: https://docs.aws.amazon.com/fr_fr/cli/latest/userguide/install-cliv2-linux.html
* Update your OS
* Install the packages that are required by Django and Abaddon (including docker and docker-compose)
* Install all the python dependencies (including Django 3.X)
* Create a PostgreSQL database and a user with the right role (the password for the database that you need to give is [...]
Abaddon - Make red team operations faster, more repeatable, stealthier, while including value-added tools and bringing numerous reporting capabilities
https://blogger.googleusercontent.com/img/a/AVvXsEivByT9o0xqQYC-npGn2EZghL4rcF3BxvxGiK5rS4Na4DP3dg3Mdh7zotWR1FItSlBEeuyvhFzueeKWpfULdlX7g8UBT5qtUrZ1qR_-fSxUoSnBCrtXDP2Qt4-QUWtLKbAaBo4c7UpU3Knf7oXZNGIS30E5BhEHoBtS3HZEkzveFqjkkxyLqQEwTiLYxg=s320 Red team operations involve miscellaneous skills, last several months and are politically sensitive; they require a lot of monitoring, consolidating and caution. Wavestone’s red team operations management software, Abaddon, has been designed to make red team operations faster, more repeatable, stealthier, while including value-added tools and bringing numerous reporting capabilities.
Because:
* There are tons of tools used by red teamers
* ... but no operation management (and free and open-source) software
* ... and no aggregation between these tools, anyway
* ... and "Operational security" failures are common
What did we want with Abaddon ?:
Abaddon aims at facilitating red team operations by:
* Reducing the time to build an infrastructure
* Enabling complex actions with 1 or 2 clicks
* Enabling easier reporting for long operations
* Reducing the “OPSEC failure” risk
The slides presenting Abaddon at RSAC2020 can be found here: (Abaddon, the red team angel) What you can deployhttps://blogger.googleusercontent.com/img/a/AVvXsEh2TrG0m_TjQthnOh718EuPLC_JvRNMzOZPT8yZ7hg8MDuDfv3NCzUIdHmb7Xz4hagmyBnU3-uJL8A2Ajp-XMc0TwPZCJTQyq_EGmm64gLala7vFKMN1s9sdQoei4dQtxej4c8VvWT8bjx2Z8NNhT3qA7-M91jxQGdXv5jvm1ppuHPLSR8ftkmb2sDGRw=w640-h310 * Deployed within 30 minutes
* Throwable, authenticated, stealth
* Enables phishing as well as remote command execution Other features* Reconnaissance: graphical interface to NMAP, Recon-NG, HunterIO, and Amass
* Weaponization: generation of obfuscated payloads under development
* Delivery: one or two-clicks deployment of EC2 instances, Gophish, and of a fully functionnal, stealthy & dockerized C&C infrastructure as shown above
* Exploitation & Post-Exploitation: ideas under development :)
* Reporting: a simple dashboard ready but still under development to follow your operations Installing and launching AbaddonAbaddon has been tested on Debian, LUbuntu, and of course KALI Linux (latest tests have been performed on the 5.4.0 amd64 version). You also need to have Internet access, and a public IP address if you want to deploy your C&C server locally.
Note that to configure your AWS environment, the easiest way is probably to install the aws-cli like indicated here: https://docs.aws.amazon.com/fr_fr/cli/latest/userguide/install-cliv2-linux.html
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install1. Clone this repository and move inside the repository folder git clone git@github.com/wavestone-cdt/abaddon.git
cd abaddon1. Create the files ~/.aws/credentials and ~/.aws/config with your AWS credentials and configuration, using the following command: aws configure1. Move settings.py.sample to settings.py. Add change the database user password (This password will be asked durring the setup process) mv abaddon/settings.py.sample abaddon/settings.py
sed -i 's/yourPasswordHere/<databasepassword/g' abaddon/settings.py1. Launch the following command in the abaddon/setup folder: bash setup/install.shThis script will:* Update your OS
* Install the packages that are required by Django and Abaddon (including docker and docker-compose)
* Install all the python dependencies (including Django 3.X)
* Create a PostgreSQL database and a user with the right role (the password for the database that you need to give is [...]
Hacking Articles Tips Tricks Videos Tutorials
KitPloit - PenTest Tools! Abaddon - Make red team operations faster, more repeatable, stealthier, while including value-added tools and bringing numerous reporting capabilities https://blogger.googleusercontent.com/img/a/AVvXsEivByT9o0xqQYC-npGn2EZghL4rc…
inside the abaddon/settings.py file, it is recommended to change the password)
* Apply Django migrations
* Create a superuser for the Django application, that will be used to connect to the graphical interface of Abaddon.
Start the Red Team Angel !
If no EC2 instance has been deployed before from Abaddon (it is important that you deploy the EC2 from Abaddon, so that you have access to the SSH key, located in the aws folder), go to the Delivery/Let’s phish! page. Click on Deploy EC2!. Wait for the end of the deployment (you can check inside the terminal used to start Abaddon if the EC2 is ready to be used, all the deployment steps appear in the shell).
2.
Go to the misc/apache/default-ssl.conf file and UPDATE the domain name of the EC2 inside the second VirtualHost. To avoid the detection of your infrastructure, buy a new domain name and configure it to point to your EC2. Use this domain name in the Apache configuration file and UPDATE misc/apache/topsecret.key and misc/apache/topsecret.crt accordingly, which is with the private key and the certificate of your new domain.
3.
Go then to the Monitor current Scenarios page and click on Configure a RedELK infrastructure. Give this scenario a name. Abaddon supports actually only one scenario at the time. Choose an EC2 instance deployed from your Abaddon and choose Local Deployment (because you deploy your Apache docker locally). Then, choose the ports used by the deployed EC2 to receive the HTTP and SSL connections, and the port and the IP address the Apache reverse proxy will forward the traffic to (for instance, the IP and port your SILENTTRINITY server listens to). A common configuration would be the following:
So, I you want to enhance the tool, please do. If you want to reshape it radically, please submit your ideas. Documentation, Setup & Basic UsageThe documentation is a work in progress, and will very soon be available in the Wiki. AuthorCharles IBRAHIM (@Ibrahimous) Acknowledgments, Contributors & Involuntary Contributors(In no particular order)
* Marcello Salvati (@byt3bl33d3r), for SILENTTRINITY. Boo-lang, omg.
* Arthur Villeneuve (@crypt0-M3lon), for his gorgeous ideas about docker, the proxy protocol, and more.
* Romain Melchiorre, for integrating lots of great ideas
* Timon Glasser, for patching SILENTTRINITY, fixing bugs, integrating ideas, and making everything work smoothly during actual engagements!
* @sbnsec, for currently terraforming all the things!
* Arnaud Soullié (@arnaudsoullie), because he overviewed most of the project! Download Abaddon
* Apply Django migrations
* Create a superuser for the Django application, that will be used to connect to the graphical interface of Abaddon.
Start the Red Team Angel !
bash abaddon.shOpen a browser, and go to the URL 127.0.0.1:8000 (connect with the Django superuser credentials created during the installation). Deployment of a C&C infrastructure inside Abaddon1. If no EC2 instance has been deployed before from Abaddon (it is important that you deploy the EC2 from Abaddon, so that you have access to the SSH key, located in the aws folder), go to the Delivery/Let’s phish! page. Click on Deploy EC2!. Wait for the end of the deployment (you can check inside the terminal used to start Abaddon if the EC2 is ready to be used, all the deployment steps appear in the shell).
2.
Go to the misc/apache/default-ssl.conf file and UPDATE the domain name of the EC2 inside the second VirtualHost. To avoid the detection of your infrastructure, buy a new domain name and configure it to point to your EC2. Use this domain name in the Apache configuration file and UPDATE misc/apache/topsecret.key and misc/apache/topsecret.crt accordingly, which is with the private key and the certificate of your new domain.
3.
Go then to the Monitor current Scenarios page and click on Configure a RedELK infrastructure. Give this scenario a name. Abaddon supports actually only one scenario at the time. Choose an EC2 instance deployed from your Abaddon and choose Local Deployment (because you deploy your Apache docker locally). Then, choose the ports used by the deployed EC2 to receive the HTTP and SSL connections, and the port and the IP address the Apache reverse proxy will forward the traffic to (for instance, the IP and port your SILENTTRINITY server listens to). A common configuration would be the following:
http port = 80ssl port = 443Listening Port= 9999C2 IP adress = 172.16.0.1Wait for the end of the deployment and go back to the Monitor current Scenarios page. Getting InvolvedPlease do not hesitate to send us Pull Requests, or send me questions (@Ibrahimous). Call for ContributionsWe really would like to see pentesters and other offensive security lovers get out of their secret zone, and share ideas, contribute to establishing a comprehensive framework for red team operations.So, I you want to enhance the tool, please do. If you want to reshape it radically, please submit your ideas. Documentation, Setup & Basic UsageThe documentation is a work in progress, and will very soon be available in the Wiki. AuthorCharles IBRAHIM (@Ibrahimous) Acknowledgments, Contributors & Involuntary Contributors(In no particular order)
* Marcello Salvati (@byt3bl33d3r), for SILENTTRINITY. Boo-lang, omg.
* Arthur Villeneuve (@crypt0-M3lon), for his gorgeous ideas about docker, the proxy protocol, and more.
* Romain Melchiorre, for integrating lots of great ideas
* Timon Glasser, for patching SILENTTRINITY, fixing bugs, integrating ideas, and making everything work smoothly during actual engagements!
* @sbnsec, for currently terraforming all the things!
* Arnaud Soullié (@arnaudsoullie), because he overviewed most of the project! Download Abaddon
Harvest Finance Uninitialized Proxies Bug Fix Postmortem — $200k Bounty
Software development is an iterative process, and mistakes can happen at any time. That’s why, in the practice of developing software…Continue reading on Immunefi »
Read more...
Software development is an iterative process, and mistakes can happen at any time. That’s why, in the practice of developing software…Continue reading on Immunefi »
Read more...
Medium
Harvest Finance Uninitialized Proxies Bug Fix Postmortem — $200k Bounty
Software development is an iterative process, and mistakes can happen at any time. That’s why, in the practice of developing software…
CVE-2021–40578.
Authenticated Blind & Error based SQL injection Lead To RCE.Continue reading on Medium »
Read more...
Authenticated Blind & Error based SQL injection Lead To RCE.Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Clash : A Rule-Based Tunnel In Go
Clash a rule-based tunnel in Go.
Features
* Local HTTP/HTTPS/SOCKS server with authentication support
* VMess, Shadowsocks, Trojan, Snell protocol support for remote connections
* Built-in DNS server that aims to minimize DNS pollution attack impact, supports DoH/DoT upstream and fake IP.
* Rules based off domains, GEOIP, IPCIDR or Process to forward packets to different nodes
* Remote groups allow users to implement powerful rules. Supports automatic fallback, load balancing or auto select node based off latency
* Remote providers, allowing users to get node lists remotely instead of hardcoding in config
* Netfilter TCP redirecting. Deploy Clash on your Internet gateway with
* Comprehensive HTTP RESTful API controller
Premium Features
* TUN mode on macOS, Linux and Windows. Doc
* Match your tunnel by Script
* Rule Provider
Getting Started
You can either grab the pre-built binaries of Clash from https://github.com/Dreamacro/clash/releases or build locally.
Clash requires Golang 1.17 or a higher version.
$ go install github.com/Dreamacro/clash@latest
The binary is built under $GOPATH/bin
$ clash -v
You can now move forward to the next chapters of this wiki in which we’ll cover the configuration syntax of Clash.
configuration
Introduction
Clash uses YAML, YAML Ain’t Markup Language, for configuration files. YAML is designed to be easy to be read, be written, and be interpreted by computers, and is commonly used for exact configuration files. In this chapter, we’ll cover the common features of Clash and how they should be used and configured.
Clash works by opening HTTP, SOCKS5, or the transparent proxy server on the local end. When a request, or say packet, comes in, Clash routes the packet to different remote servers (“nodes”) with either VMess, Shadowsocks, Snell, Trojan, SOCKS5 or HTTP protocol. All Configuration Options
Port of HTTP(S) proxy server on the local end
port: 7890
Port of SOCKS5 proxy server on the local end
socks-port: 7891
Transparent proxy server port for Linux and macOS (Redirect TCP and TProxy UDP)
redir-port: 7892
Transparent proxy server port for Linux (TProxy TCP and TProxy UDP)
tproxy-port: 7893
HTTP(S) and SOCKS4(A)/SOCKS5 server on the same port
mixed-port: 7890
authentication of local SOCKS5/HTTP(S) server
authentication:
“user1:pass1”
“user2:pass2”
Set to true to allow connections to the local-end server from
other LAN IP addresses
allow-lan: false
This is only applicable when
192.168.122.11: bind a single IPv4 address
[aaaa::a8aa:ff:fe09:57d8]”: bind a single IPv6 address
bind-address: ‘*’
Clash router working mode
rule: rule-based packet routing
global: all packets will be forwarded to a single endpoint
direct: directly forward the packets to the Internet
mode: rule
Clash by default prints logs to STDOUT
info / warning / error / debug / silent
log-level: info
When set to false, resolver won’t translate hostnames to IPv6 addresses
ipv6: false
RESTful web API listening address
external-controller: 127.0.0.1:9090
A relative path to the configuration directory or an absolute path to a
directory in which you put some static web resource. Clash core will then
serve it at
external-ui: folder
Secret for the RESTful API (optional)
Authenticate by spedifying HTTP header
secret: “”
Outbound interface name
interface-name: en0
Static hosts for DNS server and connection establishment (like /etc/hosts)
Wildcard hostnames are supported (e.g. *.clash.dev, .foo..example.com)
Non-wildcard domain names have a higher priority than wildcard domain names
e.g. foo.[...]
Clash : A Rule-Based Tunnel In Go
Clash a rule-based tunnel in Go.
Features
* Local HTTP/HTTPS/SOCKS server with authentication support
* VMess, Shadowsocks, Trojan, Snell protocol support for remote connections
* Built-in DNS server that aims to minimize DNS pollution attack impact, supports DoH/DoT upstream and fake IP.
* Rules based off domains, GEOIP, IPCIDR or Process to forward packets to different nodes
* Remote groups allow users to implement powerful rules. Supports automatic fallback, load balancing or auto select node based off latency
* Remote providers, allowing users to get node lists remotely instead of hardcoding in config
* Netfilter TCP redirecting. Deploy Clash on your Internet gateway with
iptables.* Comprehensive HTTP RESTful API controller
Premium Features
* TUN mode on macOS, Linux and Windows. Doc
* Match your tunnel by Script
* Rule Provider
Getting Started
You can either grab the pre-built binaries of Clash from https://github.com/Dreamacro/clash/releases or build locally.
Clash requires Golang 1.17 or a higher version.
$ go install github.com/Dreamacro/clash@latest
The binary is built under $GOPATH/bin
$ clash -v
You can now move forward to the next chapters of this wiki in which we’ll cover the configuration syntax of Clash.
configuration
Introduction
Clash uses YAML, YAML Ain’t Markup Language, for configuration files. YAML is designed to be easy to be read, be written, and be interpreted by computers, and is commonly used for exact configuration files. In this chapter, we’ll cover the common features of Clash and how they should be used and configured.
Clash works by opening HTTP, SOCKS5, or the transparent proxy server on the local end. When a request, or say packet, comes in, Clash routes the packet to different remote servers (“nodes”) with either VMess, Shadowsocks, Snell, Trojan, SOCKS5 or HTTP protocol. All Configuration Options
Port of HTTP(S) proxy server on the local end
port: 7890
Port of SOCKS5 proxy server on the local end
socks-port: 7891
Transparent proxy server port for Linux and macOS (Redirect TCP and TProxy UDP)
redir-port: 7892
Transparent proxy server port for Linux (TProxy TCP and TProxy UDP)
tproxy-port: 7893
HTTP(S) and SOCKS4(A)/SOCKS5 server on the same port
mixed-port: 7890
authentication of local SOCKS5/HTTP(S) server
authentication:
“user1:pass1”
“user2:pass2”
Set to true to allow connections to the local-end server from
other LAN IP addresses
allow-lan: false
This is only applicable when
allow-lanis truebind all IP addresses192.168.122.11: bind a single IPv4 address
[aaaa::a8aa:ff:fe09:57d8]”: bind a single IPv6 address
bind-address: ‘*’
Clash router working mode
rule: rule-based packet routing
global: all packets will be forwarded to a single endpoint
direct: directly forward the packets to the Internet
mode: rule
Clash by default prints logs to STDOUT
info / warning / error / debug / silent
log-level: info
When set to false, resolver won’t translate hostnames to IPv6 addresses
ipv6: false
RESTful web API listening address
external-controller: 127.0.0.1:9090
A relative path to the configuration directory or an absolute path to a
directory in which you put some static web resource. Clash core will then
serve it at
http://{{external-controller}}/ui.external-ui: folder
Secret for the RESTful API (optional)
Authenticate by spedifying HTTP header
Authorization: Bearer ${secret}ALWAYS set a secret if RESTful API is listening on 0.0.0.0secret: “”
Outbound interface name
interface-name: en0
Static hosts for DNS server and connection establishment (like /etc/hosts)
Wildcard hostnames are supported (e.g. *.clash.dev, .foo..example.com)
Non-wildcard domain names have a higher priority than wildcard domain names
e.g. foo.[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Clash : A Rule-Based Tunnel In Go Clash a rule-based tunnel in Go. Features * Local HTTP/HTTPS/SOCKS server with authentication support * VMess, Shadowsocks, Trojan, Snell protocol support for remote connections * Built-in DNS server…
example.com > .example.com > .example.com P.S. +.foo.com equals to .foo.com and foo.com hosts: clash.dev’: 127.0.0.1 dev’: 127.0.0.1 ‘alpha.clash.dev’: ‘::1’ profile: Store the
localhost.ptlogin2.qq.com
Supports UDP, TCP, DoT, DoH. You can specify the port to connect to.
All DNS questions are sent directly to the nameserver, without proxies
involved. Clash answers the DNS question with the first result gathered.
nameserver:
114.114.114.114 # default value
8.8.8.8 # default value
tls://dns.rubyfish.cn:853 # DNS over TLS
https://1.1.1.1/dns-query # DNS over HTTPS
dhcp://en0 # dns from dhcp
When
to the servers in this section along with servers in
The answers from fallback servers are used when the GEOIP country
is not
fallback:
– tcp://1.1.1.1
If IP addresses resolved with servers in
subnets below, they are considered invalid and results from
IP address resolved with servers in
If
are always used if not match
This is a countermeasure against DNS pollution attacks.
fallback-filter:
geoip: true
geoip-code: CN
ipcidr:
– 240.0.0.0/4
domain:
– ‘+.google.com’
– ‘+.facebook.com’
– ‘+.youtube.com’
Lookup domains via specific nameservers
nameserver-policy:
‘www.baidu.com’: ‘114.114.114.114’
‘+.internal.crop.com’: ‘10.0.0.1’
proxies:
# Shadowsocks
# The supported ciphers (encryption methods):
# aes-128-gcm aes-192-gcm aes-256-gcm
# aes-128-cfb aes-192-cfb aes-256-cfb
# aes-128-ctr aes-192-ctr aes-256-ctr
# rc4-md5 chacha20-ietf xchacha20
# chacha20-ietf-poly1305 xchacha20-ietf-poly1305
name: “ss1”
type: ss
server: server
port: 443
cipher: chacha20-ietf-poly1305
password: “password”
# udp: true
name: “ss2”
type: ss
server: server
port: 443
cipher: chacha20-ietf-poly1305
password: “password”
plugin: obfs
plugin-opts:
mode: tls # or http
# host: bing.com
name: “ss3”
type: ss
server: server
port: 443
cipher: chacha20-ietf-poly1305
password: “password”
plugin: v2ray-plugin
plugin-opts:
mode: websocket # no QUIC now
# tls: true # wss
# skip-cert-verify: true
# host: bing.com
# path: “/”
# mux: true
# headers:
# custom: value
vmess
# cipher support auto/aes-128-gcm/chacha20-poly1305/none
name: “vmess”
type: vmess
server: server
port: 443
uuid: uuid
alterId: 32
cipher: auto
# udp: true
# tls: true
# skip-cert-verify: true
# servername: example.com # priority over wss host
# network: ws
# ws-opts:
# path: /path
# headers:
# Host: v2ray.com
# max-early-data: 2048
# early-data-header-name: Sec-WebSocket-Protocol
name: “vmess-h2”
type: vmess
server: server
port: 443
uuid: uuid
alterId: 32
cipher: aut[...]
selectresults in $HOME/.config/clash/.cache set false If you don’t want this behavior when two different configurations have groups with the same name, the selected values are shared store-selected: false DNS server settings This section is optional. When not present, the DNS server will be disabled. dns: enable: false listen: 0.0.0.0:53 ipv6: false # when the false, response to AAAA questions will be empty These nameservers are used to resolve the DNS nameserver hostnames below. Specify IP addresses only default-nameserver: – 114.114.114.114 – 8.8.8.8 enhanced-mode: redir-host # or fake-ip fake-ip-range: 198.18.0.1/16 # Fake IP addresses pool CIDR use-hosts: true # lookup hosts and return IP record Hostnames in this list will not be resolved with fake IPs i.e. questions to these domain names will always be answered with their real IP addresses fake-ip-filter: ‘.lan’localhost.ptlogin2.qq.com
Supports UDP, TCP, DoT, DoH. You can specify the port to connect to.
All DNS questions are sent directly to the nameserver, without proxies
involved. Clash answers the DNS question with the first result gathered.
nameserver:
114.114.114.114 # default value
8.8.8.8 # default value
tls://dns.rubyfish.cn:853 # DNS over TLS
https://1.1.1.1/dns-query # DNS over HTTPS
dhcp://en0 # dns from dhcp
When
fallbackis present, the DNS server will send concurrent requeststo the servers in this section along with servers in
nameservers.The answers from fallback servers are used when the GEOIP country
is not
CN.fallback:
– tcp://1.1.1.1
If IP addresses resolved with servers in
nameserversare in the specifiedsubnets below, they are considered invalid and results from
fallbackservers are used instead.IP address resolved with servers in
nameserveris used when fallback-filter.geoipis true and when GEOIP of the IP address is CN.If
fallback-filter.geoipis false, results from nameservernameserversare always used if not match
fallback-filter.ipcidr.This is a countermeasure against DNS pollution attacks.
fallback-filter:
geoip: true
geoip-code: CN
ipcidr:
– 240.0.0.0/4
domain:
– ‘+.google.com’
– ‘+.facebook.com’
– ‘+.youtube.com’
Lookup domains via specific nameservers
nameserver-policy:
‘www.baidu.com’: ‘114.114.114.114’
‘+.internal.crop.com’: ‘10.0.0.1’
proxies:
# Shadowsocks
# The supported ciphers (encryption methods):
# aes-128-gcm aes-192-gcm aes-256-gcm
# aes-128-cfb aes-192-cfb aes-256-cfb
# aes-128-ctr aes-192-ctr aes-256-ctr
# rc4-md5 chacha20-ietf xchacha20
# chacha20-ietf-poly1305 xchacha20-ietf-poly1305
name: “ss1”
type: ss
server: server
port: 443
cipher: chacha20-ietf-poly1305
password: “password”
# udp: true
name: “ss2”
type: ss
server: server
port: 443
cipher: chacha20-ietf-poly1305
password: “password”
plugin: obfs
plugin-opts:
mode: tls # or http
# host: bing.com
name: “ss3”
type: ss
server: server
port: 443
cipher: chacha20-ietf-poly1305
password: “password”
plugin: v2ray-plugin
plugin-opts:
mode: websocket # no QUIC now
# tls: true # wss
# skip-cert-verify: true
# host: bing.com
# path: “/”
# mux: true
# headers:
# custom: value
vmess
# cipher support auto/aes-128-gcm/chacha20-poly1305/none
name: “vmess”
type: vmess
server: server
port: 443
uuid: uuid
alterId: 32
cipher: auto
# udp: true
# tls: true
# skip-cert-verify: true
# servername: example.com # priority over wss host
# network: ws
# ws-opts:
# path: /path
# headers:
# Host: v2ray.com
# max-early-data: 2048
# early-data-header-name: Sec-WebSocket-Protocol
name: “vmess-h2”
type: vmess
server: server
port: 443
uuid: uuid
alterId: 32
cipher: aut[...]