Microsoft Threat Intelligence (https://www.kitploit.com/search/label/Threat%20Intelligence) Python Security Tools.msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to:query log data from multiple sourcesenrich the data with Threat Intelligence, geolocations and Azure resource dataextract Indicators of Activity (IoA) from logs and unpack encoded dataperform sophisticated analysis such as anomalous session detection and time series decompositionvisualize data using interactive timelines, process trees and multi-dimensional Morph Charts
It also includes some time-saving notebook tools such as widgets to set query time boundaries, select and display items from lists, and configure the notebook environment.
___________________________
@hacking_Attack
@Hacking_Video
It also includes some time-saving notebook tools such as widgets to set query time boundaries, select and display items from lists, and configure the notebook environment.
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.
The msticpy package was initially developed to support Jupyter Notebooks (https://jupyter-notebook-beginner-guide.readthedocs.io/en/latest/)authoring for Azure Sentinel (https://azure.microsoft.com/en-us/services/azure-sentinel/). While Azure Sentinel is still a big focus of our work, we are extending the data query/acquisition components to pull log data from other sources (currently Splunk, Microsoft Defender for Endpoint and Microsoft Graph are supported but we are actively working on support for data from other SIEM platforms). Most of the components can also be used with data from any source. Pandas DataFrames are used as the ubiquitous input and output format of almost all components. There is also a data provider to make it easy to and process data from local CSV files and pickled DataFrames.The package addresses three central needs for security investigators and hunters:Acquiring and enriching dataAnalyzing dataVisualizing dataWe welcome feedback, bug reports, suggestions for new features and contributions.
Installing
For core install:pip install msticpyIf you are using MSTICPy with Azure Sentinel you should install with the "azsentinel" extra package:pip install msticpy[azsentinel]or for the latest dev buildpip install git+https://github.com/microsoft/msticpy
Documentation
Full documentation is at ReadTheDocs (https://msticpy.readthedocs.io/en/latest/)Sample notebooks for many of the modules are in the docs/notebooks (https://github.com/microsoft/msticpy/blob/master/docs/notebooks)folder and accompanying notebooks.You can also browse through the sample notebooks referenced at the end of this document to see some of the functionality used in context. You can play with some of the package functions in this interactive demo on mybinder.org.
Log Data Acquisition
QueryProvider is an extensible query library targeting Azure Sentinel/Log Analytics, Splunk, OData and other log data sources. It also has special support for Mordor (https://github.com/OTRF/mordor) data sets and using local data.Built-in parameterized queries allow complex queries to be run from a single function call. Add your own queries using a simple YAML schema.Data Queries Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/Data_Queries.ipynb)
Data Enrichment
Threat Intelligence providers
The TILookup class can lookup IoCs across multiple TI providers. built-in providers include AlienVault OTX, IBM XForce, VirusTotal and Azure Sentinel.The input can be a single IoC observable or a pandas DataFrame containing multiple observables. Depending on the provider, you may require an account and an API key. Some providers also enforce throttling (especially for free tiers), which might affect performing bulk lookups.TIProviders (https://msticpy.readthedocs.io/en/latest/data_acquisition/TIProviders.html)and TILookup Usage Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/TIProviders.ipynb)
GeoLocation Data
The GeoIP lookup classes allow you to match the geo-locations of IP addresses using either:GeoLiteLookup - Maxmind Geolite (see https://www.maxmind.com (https://www.maxmind.com/))IPStackLookup - IPStack (see https://ipstack.com (https://ipstack.com/))
___________________________
@hacking_Attack
@Hacking_Video
Installing
For core install:pip install msticpyIf you are using MSTICPy with Azure Sentinel you should install with the "azsentinel" extra package:pip install msticpy[azsentinel]or for the latest dev buildpip install git+https://github.com/microsoft/msticpy
Documentation
Full documentation is at ReadTheDocs (https://msticpy.readthedocs.io/en/latest/)Sample notebooks for many of the modules are in the docs/notebooks (https://github.com/microsoft/msticpy/blob/master/docs/notebooks)folder and accompanying notebooks.You can also browse through the sample notebooks referenced at the end of this document to see some of the functionality used in context. You can play with some of the package functions in this interactive demo on mybinder.org.
Log Data Acquisition
QueryProvider is an extensible query library targeting Azure Sentinel/Log Analytics, Splunk, OData and other log data sources. It also has special support for Mordor (https://github.com/OTRF/mordor) data sets and using local data.Built-in parameterized queries allow complex queries to be run from a single function call. Add your own queries using a simple YAML schema.Data Queries Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/Data_Queries.ipynb)
Data Enrichment
Threat Intelligence providers
The TILookup class can lookup IoCs across multiple TI providers. built-in providers include AlienVault OTX, IBM XForce, VirusTotal and Azure Sentinel.The input can be a single IoC observable or a pandas DataFrame containing multiple observables. Depending on the provider, you may require an account and an API key. Some providers also enforce throttling (especially for free tiers), which might affect performing bulk lookups.TIProviders (https://msticpy.readthedocs.io/en/latest/data_acquisition/TIProviders.html)and TILookup Usage Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/TIProviders.ipynb)
GeoLocation Data
The GeoIP lookup classes allow you to match the geo-locations of IP addresses using either:GeoLiteLookup - Maxmind Geolite (see https://www.maxmind.com (https://www.maxmind.com/))IPStackLookup - IPStack (see https://ipstack.com (https://ipstack.com/))
___________________________
@hacking_Attack
@Hacking_Video
Microsoft
Microsoft Sentinel: AI Powered Cloud SIEM Solution | Microsoft Security
Explore Microsoft Sentinel, a modern cloud-native SIEM, powered by AI and automation, offering comprehensive protection across your entire enterprise.
GeoIP Lookup (https://msticpy.readthedocs.io/en/latest/data_acquisition/GeoIPLookups.html)and GeoIP Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/GeoIPLookups.ipynb)
Azure Resource Data, Storage and Azure Sentinel API
The AzureData module contains functionality for enriching data regarding Azure host details with additional host details exposed via the Azure API. The AzureSentinel module allows you to query incidents, retrieve detector and hunting queries. AzureBlogStorage lets you read and write data from blob storage.Azure Resource APIs (https://msticpy.readthedocs.io/en/latest/data_acquisition/AzureData.html), Azure Sentinel APIs (https://msticpy.readthedocs.io/en/latest/data_acquisition/AzureSentinel.html), Azure Storage (https://msticpy.readthedocs.io/en/latest/data_acquisition/AzureBlobStorage.html)
Security Analysis
This subpackage contains several modules helpful for working on security investigations and hunting:
Anomalous Sequence Detection
Detect unusual sequences of events in your Office, Active Directory (https://www.kitploit.com/search/label/Active%20Directory) or other log data. You can extract sessions (e.g. activity initiated by the same account) and identify and visualize unusual sequences of activity. For example, detecting an attacker setting a mail forwarding rule on someone's mailbox.Anomalous Sessions (https://msticpy.readthedocs.io/en/latest/data_analysis/AnomalousSequence.html)and Anomalous Sequence Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/AnomalousSequence.ipynb)
Time Series Analysis
Time series analysis allows you to identify unusual patterns in your log data taking into account normal seasonal variations (e.g. the regular ebb and flow of events over hours of the day, days of the week, etc.). Using both analysis and visualization highlights unusual traffic flows or event activity for any data set.
___________________________
@hacking_Attack
@Hacking_Video
Azure Resource Data, Storage and Azure Sentinel API
The AzureData module contains functionality for enriching data regarding Azure host details with additional host details exposed via the Azure API. The AzureSentinel module allows you to query incidents, retrieve detector and hunting queries. AzureBlogStorage lets you read and write data from blob storage.Azure Resource APIs (https://msticpy.readthedocs.io/en/latest/data_acquisition/AzureData.html), Azure Sentinel APIs (https://msticpy.readthedocs.io/en/latest/data_acquisition/AzureSentinel.html), Azure Storage (https://msticpy.readthedocs.io/en/latest/data_acquisition/AzureBlobStorage.html)
Security Analysis
This subpackage contains several modules helpful for working on security investigations and hunting:
Anomalous Sequence Detection
Detect unusual sequences of events in your Office, Active Directory (https://www.kitploit.com/search/label/Active%20Directory) or other log data. You can extract sessions (e.g. activity initiated by the same account) and identify and visualize unusual sequences of activity. For example, detecting an attacker setting a mail forwarding rule on someone's mailbox.Anomalous Sessions (https://msticpy.readthedocs.io/en/latest/data_analysis/AnomalousSequence.html)and Anomalous Sequence Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/AnomalousSequence.ipynb)
Time Series Analysis
Time series analysis allows you to identify unusual patterns in your log data taking into account normal seasonal variations (e.g. the regular ebb and flow of events over hours of the day, days of the week, etc.). Using both analysis and visualization highlights unusual traffic flows or event activity for any data set.
___________________________
@hacking_Attack
@Hacking_Video
Time Series (https://msticpy.readthedocs.io/en/latest/visualization/TimeSeriesAnomalies.html)
Visualization
Event Timelines
Display any log events on an interactive timeline. Using the Bokeh (https://bokeh.org/)Visualization (https://www.kitploit.com/search/label/Visualization) Library the timeline control enables you to visualize one or more event streams, interactively zoom into specific time slots and view event details for plotted events.
___________________________
@hacking_Attack
@Hacking_Video
Visualization
Event Timelines
Display any log events on an interactive timeline. Using the Bokeh (https://bokeh.org/)Visualization (https://www.kitploit.com/search/label/Visualization) Library the timeline control enables you to visualize one or more event streams, interactively zoom into specific time slots and view event details for plotted events.
___________________________
@hacking_Attack
@Hacking_Video
Timeline (https://msticpy.readthedocs.io/en/latest/visualization/EventTimeline.html)and Timeline Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/EventTimeline.ipynb)
Process Trees
The process tree functionality has two main components:Process Tree creation - taking a process creation log from a host and building the parent-child relationships between processes in the data set.Process Tree visualization - this takes the processed output displays an interactive process tree using Bokeh plots.There are a set of utility functions to extract individual and partial trees from the processed data set.
___________________________
@hacking_Attack
@Hacking_Video
Process Trees
The process tree functionality has two main components:Process Tree creation - taking a process creation log from a host and building the parent-child relationships between processes in the data set.Process Tree visualization - this takes the processed output displays an interactive process tree using Bokeh plots.There are a set of utility functions to extract individual and partial trees from the processed data set.
___________________________
@hacking_Attack
@Hacking_Video
Process Tree (https://msticpy.readthedocs.io/en/latest/visualization/ProcessTree.html)and Process Tree Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/ProcessTree.ipynb)
Data Manipulation and Utility functions
Pivot Functions
Lets you use MSTICPy functionality in an "entity-centric" way. All functions, queries and lookups that relate to a particular entity type (e.g. Host, IpAddress, Url) are collected together as methods of that entity class. So, if you want to do things with an IP address, just load the IpAddress entity and browse its methods.Pivot Functions (https://msticpy.readthedocs.io/en/latest/data_analysis/PivotFunctions.html)and Pivot Functions Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/PivotFunctions.ipynb)
base64unpack
Base64 and archive (gz, zip, tar) extractor. It will try to identify any base64 encoded strings and try decode them. If the result looks like one of the supported archive types it will unpack the contents. The results of each decode/unpack are rechecked for further base64 content and up to a specified depth.Base64 Decoding (https://msticpy.readthedocs.io/en/latest/data_analysis/Base64Unpack.html)and Base64Unpack Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/Base64Unpack.ipynb)
iocextract
Uses regular expressions (https://www.kitploit.com/search/label/Regular%20Expressions) to look for Indicator of Compromise (IoC) patterns - IP Addresses, URLs, DNS domains, Hashes, file paths. Input can be a single string or a pandas dataframe.IoC Extraction (https://msticpy.readthedocs.io/en/latest/data_analysis/IoCExtract.html)and IoCExtract Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/IoCExtract.ipynb)
eventcluster (experimental)
This module is intended to be used to summarize large numbers of events into clusters of different patterns. High volume repeating events can often make it difficult to see unique and interesting items.
___________________________
@hacking_Attack
@Hacking_Video
Data Manipulation and Utility functions
Pivot Functions
Lets you use MSTICPy functionality in an "entity-centric" way. All functions, queries and lookups that relate to a particular entity type (e.g. Host, IpAddress, Url) are collected together as methods of that entity class. So, if you want to do things with an IP address, just load the IpAddress entity and browse its methods.Pivot Functions (https://msticpy.readthedocs.io/en/latest/data_analysis/PivotFunctions.html)and Pivot Functions Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/PivotFunctions.ipynb)
base64unpack
Base64 and archive (gz, zip, tar) extractor. It will try to identify any base64 encoded strings and try decode them. If the result looks like one of the supported archive types it will unpack the contents. The results of each decode/unpack are rechecked for further base64 content and up to a specified depth.Base64 Decoding (https://msticpy.readthedocs.io/en/latest/data_analysis/Base64Unpack.html)and Base64Unpack Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/Base64Unpack.ipynb)
iocextract
Uses regular expressions (https://www.kitploit.com/search/label/Regular%20Expressions) to look for Indicator of Compromise (IoC) patterns - IP Addresses, URLs, DNS domains, Hashes, file paths. Input can be a single string or a pandas dataframe.IoC Extraction (https://msticpy.readthedocs.io/en/latest/data_analysis/IoCExtract.html)and IoCExtract Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/IoCExtract.ipynb)
eventcluster (experimental)
This module is intended to be used to summarize large numbers of events into clusters of different patterns. High volume repeating events can often make it difficult to see unique and interesting items.
___________________________
@hacking_Attack
@Hacking_Video
This is an unsupervised learning module implemented using SciKit Learn DBScan.Event Clustering (https://msticpy.readthedocs.io/en/latest/data_analysis/EventClustering.html)and Event Clustering Notebook (https://github.com/microsoft/msticpy/blob/master/docs/notebooks/EventClustering.ipynb)
auditdextract
Module to load and decode Linux audit logs. It collapses messages sharing the same message ID into single events, decodes hex-encoded data fields and performs some event-specific formatting and normalization (e.g. for process start events it will re-assemble the process command line (https://www.kitploit.com/search/label/Command%20Line) arguments into a single string).
syslog_utils
Module to support an investigation of a Linux host with only syslog logging enabled. This includes functions for collating host data, clustering logon events and detecting user sessions containing suspicious activity.
cmd_line
A module to support he detection of known malicious command line activity or suspicious patterns of command line activity.
domain_utils
A module to support investigation of domain names and URLs with functions to validate a domain name and screenshot a URL.
Notebook widgets
These are built from the Jupyter ipywidgets (https://ipywidgets.readthedocs.io/) collection and group common functionality useful in InfoSec tasks such as list pickers, query time boundary settings and event display into an easy-to-use format.
___________________________
@hacking_Attack
@Hacking_Video
auditdextract
Module to load and decode Linux audit logs. It collapses messages sharing the same message ID into single events, decodes hex-encoded data fields and performs some event-specific formatting and normalization (e.g. for process start events it will re-assemble the process command line (https://www.kitploit.com/search/label/Command%20Line) arguments into a single string).
syslog_utils
Module to support an investigation of a Linux host with only syslog logging enabled. This includes functions for collating host data, clustering logon events and detecting user sessions containing suspicious activity.
cmd_line
A module to support he detection of known malicious command line activity or suspicious patterns of command line activity.
domain_utils
A module to support investigation of domain names and URLs with functions to validate a domain name and screenshot a URL.
Notebook widgets
These are built from the Jupyter ipywidgets (https://ipywidgets.readthedocs.io/) collection and group common functionality useful in InfoSec tasks such as list pickers, query time boundary settings and event display into an easy-to-use format.
___________________________
@hacking_Attack
@Hacking_Video
More Notebooks on Azure Sentinel Notebooks GitHub
Azure Sentinel Notebooks (https://github.com/Azure/Azure-Sentinel-Notebooks)Example notebooks:Account Explorer (https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Entity%20Explorer%20-%20Account.ipynb)Domain and URL Explorer (https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Entity%20Explorer%20-%20Domain%20and%20URL.ipynb)IP Explorer (https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Entity%20Explorer%20-%20IP%20Address.ipynb)Linux Host Explorer (https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Entity%20Explorer%20-%20Linux%20Host.ipynb)Windows Host Explorer (https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Entity%20Explorer%20-%20Windows%20Host.ipynb)View directly on GitHub or copy and paste the link into nbviewer.org (https://nbviewer.jupyter.org/)
Notebook examples with saved data
See the following notebooks for more examples of the use of this package in practice:Windows Alert Investigation in GitHub (https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Sample-Notebooks/Example%20-%20Guided%20Investigation%20-%20Process-Alerts.ipynb)or NbViewer (https://nbviewer.jupyter.org/github/Azure/Azure-Sentinel-Notebooks/blob/master/Sample-Notebooks/Example%20-%20Guided%20Investigation%20-%20Process-Alerts.ipynb)Office 365 Exploration in GitHub (https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Sample-Notebooks/Example%20-%20Guided%20Hunting%20-%20Office365-Exploring.ipynb)or NbViewer (https://nbviewer.jupyter.org/github/Azure/Azure-Sentinel-Notebooks/blob/master/Sample-Notebooks/Example%20-%20Guided%20Hunting%20-%20Office365-Exploring.ipynb)Cross-Network Hunting in GitHub (https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Sample-Notebooks/Example%20-%20Step-by-Step%20Linux-Windows-Office%20Investigation.ipynb)or NbViewer (https://nbviewer.jupyter.org/github/Azure/Azure-Sentinel-Notebooks/blob/master/Sample-Notebooks/Example%20-%20Step-by-Step%20Linux-Windows-Office%20Investigation.ipynb)
Supported Platforms and Packages
msticpy is OS-independentRequires Python 3.6 or later (https://www.python.org/dev/peps/pep-0494/)See requirements.txt (https://github.com/microsoft/msticpy/blob/main/requirements.txt) for more details and version requirements.
Contributing
For (brief) developer guidelines, see this wiki article Contributor Guidelines (https://github.com/microsoft/msticpy/wiki/Contributor-guidelines)This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com (https://cla.microsoft.com/).When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.This project has adopted the Microsoft Open Source Code of Conduct (https://opensource.microsoft.com/codeofconduct/). For more information see the Code of Conduct FAQ (https://opensource.microsoft.com/codeofconduct/faq/) or contact opencode@microsoft.com (mailto:opencode@microsoft.com) with any additional questions or comments.
Download Msticpy (https://github.com/microsoft/msticpy)
___________________________
@hacking_Attack
@Hacking_Video
Azure Sentinel Notebooks (https://github.com/Azure/Azure-Sentinel-Notebooks)Example notebooks:Account Explorer (https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Entity%20Explorer%20-%20Account.ipynb)Domain and URL Explorer (https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Entity%20Explorer%20-%20Domain%20and%20URL.ipynb)IP Explorer (https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Entity%20Explorer%20-%20IP%20Address.ipynb)Linux Host Explorer (https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Entity%20Explorer%20-%20Linux%20Host.ipynb)Windows Host Explorer (https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Entity%20Explorer%20-%20Windows%20Host.ipynb)View directly on GitHub or copy and paste the link into nbviewer.org (https://nbviewer.jupyter.org/)
Notebook examples with saved data
See the following notebooks for more examples of the use of this package in practice:Windows Alert Investigation in GitHub (https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Sample-Notebooks/Example%20-%20Guided%20Investigation%20-%20Process-Alerts.ipynb)or NbViewer (https://nbviewer.jupyter.org/github/Azure/Azure-Sentinel-Notebooks/blob/master/Sample-Notebooks/Example%20-%20Guided%20Investigation%20-%20Process-Alerts.ipynb)Office 365 Exploration in GitHub (https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Sample-Notebooks/Example%20-%20Guided%20Hunting%20-%20Office365-Exploring.ipynb)or NbViewer (https://nbviewer.jupyter.org/github/Azure/Azure-Sentinel-Notebooks/blob/master/Sample-Notebooks/Example%20-%20Guided%20Hunting%20-%20Office365-Exploring.ipynb)Cross-Network Hunting in GitHub (https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Sample-Notebooks/Example%20-%20Step-by-Step%20Linux-Windows-Office%20Investigation.ipynb)or NbViewer (https://nbviewer.jupyter.org/github/Azure/Azure-Sentinel-Notebooks/blob/master/Sample-Notebooks/Example%20-%20Step-by-Step%20Linux-Windows-Office%20Investigation.ipynb)
Supported Platforms and Packages
msticpy is OS-independentRequires Python 3.6 or later (https://www.python.org/dev/peps/pep-0494/)See requirements.txt (https://github.com/microsoft/msticpy/blob/main/requirements.txt) for more details and version requirements.
Contributing
For (brief) developer guidelines, see this wiki article Contributor Guidelines (https://github.com/microsoft/msticpy/wiki/Contributor-guidelines)This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com (https://cla.microsoft.com/).When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.This project has adopted the Microsoft Open Source Code of Conduct (https://opensource.microsoft.com/codeofconduct/). For more information see the Code of Conduct FAQ (https://opensource.microsoft.com/codeofconduct/faq/) or contact opencode@microsoft.com (mailto:opencode@microsoft.com) with any additional questions or comments.
Download Msticpy (https://github.com/microsoft/msticpy)
___________________________
@hacking_Attack
@Hacking_Video
GitHub
GitHub - Azure/Azure-Sentinel-Notebooks: Interactive Azure Sentinel Notebooks provides security insights and actions to investigate…
Interactive Azure Sentinel Notebooks provides security insights and actions to investigate anomalies and hunt for malicious behaviors. - Azure/Azure-Sentinel-Notebooks
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Offensive Security Tools: Awesome Bug Bounty Tools
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Offensive Security Tools: Awesome Bug Bounty ToolsPost Views: 214 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 4 Minutes
Offensive Security Tools: Awesome Bug Bounty Tools GitHub Link Awesome Bug Bounty ToolsUnlike Pentesting, Bug Bounty requires a totally different approach when it comes to working on platforms like HackerOne, Bugcrowd. The competition is high and speed is crucial. Methodologies can range from one person to another, this repo has some of the most important curated list of various bug bounty tools that will help you perform better quality attack vectors. Contents⦿ Recon
○ Subdomain Enumeration
○ Port Scanning
○ Screenshots
○ Technologies
○ Content Discovery
○ Links
○ Parameters
○ Fuzzing
⦿ Exploitation
○ Command Injection
○ CORS Misconfiguration
○ CRLF Injection
○ CSRF Injection
○ Directory Traversal
○ File Inclusion
○ GraphQL Injection
○ Header Injection
○ Insecure Deserialization
○ Insecure Direct Object References
○ Open Redirect
○ Race Condition
○ Request Smuggling
○ Server Side Request Forgery
○ SQL Injection
○ XSS Injection
○ XXE Injection
⦿ Miscellaneous
○ Passwords
○ Secrets
○ Git
○ Buckets
○ CMS
○ JSON Web Token
○ postMessage
○ Subdomain Takeover
○ Uncategorized
See Also: Android malware BrazKing returns as a stealthier banking trojan ReconSubdomain Enumeration* Sublist3r – Fast subdomains enumeration tool for penetration testers
* Amass – In-depth Attack Surface Mapping and Asset Discovery
* massdns – A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)
* Findomain – The fastest and cross-platform subdomain enumerator, do not waste your time.
* Sudomy – Sudomy is a subdomain enumeration tool to collect subdomains and analyzing domains performing automated reconnaissance (recon) for bug hunting / pentesting
* chaos-client – Go client to communicate with Chaos DNS API.
* domained – Multi Tool Subdomain Enumeration
* bugcrowd-levelup-subdomain-enumeration – This repository contains all the material from the talk “Esoteric sub-domain enumeration techniques” given at Bugcrowd LevelUp 2017 virtual conference
* shuffledns – shuffleDNS is a wrapper around massdns written in go that allows you to enumerate valid subdomains using active bruteforce as well as resolve subdomains with wildcard handling and easy input-output…
* censys-subdomain-finder – Perform subdomain enumeration using the certificate transparency logs from Censys.
* Turbolist3r – Subdomain enumeration tool with analysis features for discovered domains
* censys-enumeration – A script to extract subdomains/emails for a given domain using SSL/TLS certificate dataset on Censys
* tugarecon – Fast subdomains enumeration tool for penetration testers.
* as3nt – Another Subdomain Enumeration Tool
* Subra – A Web-UI for subdomain enumeration (subfinder)
* Substr3am – Passive reconnaissance/enumeration of interesting targets by watching for SSL certificates being issued
* domain – enumall.py Setup script for Regon-ng
* altdns – Generates permutations, alterations and mutations of subdomains and then resolves them
* brutesubs – An automation framework for running multiple open sourced subdomain bruteforcing tools (in parallel) using your own wordlists via Docker Compose
* dns-parallel-prober – his is a parallelized domain name prober to find as many subdomains of a given domain as fast as possible.
* dnscan – dnscan is a python wordlist-based DNS subdomain scanner.
* knock – Knockpy is a[...]
___________________________
@hacking_Attack
@Hacking_Video
Offensive Security Tools: Awesome Bug Bounty Tools
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Offensive Security Tools: Awesome Bug Bounty ToolsPost Views: 214 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 4 Minutes
Offensive Security Tools: Awesome Bug Bounty Tools GitHub Link Awesome Bug Bounty ToolsUnlike Pentesting, Bug Bounty requires a totally different approach when it comes to working on platforms like HackerOne, Bugcrowd. The competition is high and speed is crucial. Methodologies can range from one person to another, this repo has some of the most important curated list of various bug bounty tools that will help you perform better quality attack vectors. Contents⦿ Recon
○ Subdomain Enumeration
○ Port Scanning
○ Screenshots
○ Technologies
○ Content Discovery
○ Links
○ Parameters
○ Fuzzing
⦿ Exploitation
○ Command Injection
○ CORS Misconfiguration
○ CRLF Injection
○ CSRF Injection
○ Directory Traversal
○ File Inclusion
○ GraphQL Injection
○ Header Injection
○ Insecure Deserialization
○ Insecure Direct Object References
○ Open Redirect
○ Race Condition
○ Request Smuggling
○ Server Side Request Forgery
○ SQL Injection
○ XSS Injection
○ XXE Injection
⦿ Miscellaneous
○ Passwords
○ Secrets
○ Git
○ Buckets
○ CMS
○ JSON Web Token
○ postMessage
○ Subdomain Takeover
○ Uncategorized
See Also: Android malware BrazKing returns as a stealthier banking trojan ReconSubdomain Enumeration* Sublist3r – Fast subdomains enumeration tool for penetration testers
* Amass – In-depth Attack Surface Mapping and Asset Discovery
* massdns – A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)
* Findomain – The fastest and cross-platform subdomain enumerator, do not waste your time.
* Sudomy – Sudomy is a subdomain enumeration tool to collect subdomains and analyzing domains performing automated reconnaissance (recon) for bug hunting / pentesting
* chaos-client – Go client to communicate with Chaos DNS API.
* domained – Multi Tool Subdomain Enumeration
* bugcrowd-levelup-subdomain-enumeration – This repository contains all the material from the talk “Esoteric sub-domain enumeration techniques” given at Bugcrowd LevelUp 2017 virtual conference
* shuffledns – shuffleDNS is a wrapper around massdns written in go that allows you to enumerate valid subdomains using active bruteforce as well as resolve subdomains with wildcard handling and easy input-output…
* censys-subdomain-finder – Perform subdomain enumeration using the certificate transparency logs from Censys.
* Turbolist3r – Subdomain enumeration tool with analysis features for discovered domains
* censys-enumeration – A script to extract subdomains/emails for a given domain using SSL/TLS certificate dataset on Censys
* tugarecon – Fast subdomains enumeration tool for penetration testers.
* as3nt – Another Subdomain Enumeration Tool
* Subra – A Web-UI for subdomain enumeration (subfinder)
* Substr3am – Passive reconnaissance/enumeration of interesting targets by watching for SSL certificates being issued
* domain – enumall.py Setup script for Regon-ng
* altdns – Generates permutations, alterations and mutations of subdomains and then resolves them
* brutesubs – An automation framework for running multiple open sourced subdomain bruteforcing tools (in parallel) using your own wordlists via Docker Compose
* dns-parallel-prober – his is a parallelized domain name prober to find as many subdomains of a given domain as fast as possible.
* dnscan – dnscan is a python wordlist-based DNS subdomain scanner.
* knock – Knockpy is a[...]
___________________________
@hacking_Attack
@Hacking_Video
Black Hat Ethical Hacking
Offensive Security Tools: Awesome Bug Bounty Tools | Black Hat Ethical Hacking
Unlike Pentesting, Bug Bounty requires a totally different approach when it comes to working on platforms like HackerOne, BugCrowd. This repo has some of the most important curated list of various bug bounty tools.
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Offensive Security Tools: Awesome Bug Bounty Tools https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Offensive Security Tools: Awesome Bug Bounty ToolsPost Views: 214 https://www.blackhate…
python tool designed to enumerate subdomains on a target domain through a wordlist.
* hakrevdns – Small, fast tool for performing reverse DNS lookups en masse.
* dnsx – Dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers.
* subfinder – Subfinder is a subdomain discovery tool that discovers valid subdomains for websites.
* assetfinder – Find domains and subdomains related to a given domain
* crtndstry – Yet another subdomain finder
* VHostScan – A virtual host scanner that performs reverse lookups
* scilla – Information Gathering tool – DNS / Subdomains / Ports / Directories enumeration Port Scanning* masscan – TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.
* RustScan – The Modern Port Scanner
* naabu – A fast port scanner written in go with focus on reliability and simplicity.
* nmap – Nmap – the Network Mapper. GitHub mirror of official SVN repository.
* sandmap – Nmap on steroids. Simple CLI with the ability to run pure Nmap engine, 31 modules with 459 scan profiles.
* ScanCannon – Combines the speed of masscan with the reliability and detailed enumeration of Nmap Screenshots* EyeWitness – EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.
* aquatone – Aquatone is a tool for visual inspection of websites across a large amount of hosts and is convenient for quickly gaining an overview of HTTP-based attack surface.
* screenshoteer – Make website screenshots and mobile emulations from the command line.
* gowitness – gowitness – a golang, web screenshot utility using Chrome Headless
* WitnessMe – Web Inventory tool, takes screenshots of webpages using Pyppeteer (headless Chrome/Chromium) and provides some extra bells & whistles to make life easier.
* eyeballer – Convolutional neural network for analyzing pentesting screenshots
* scrying – A tool for collecting RDP, web and VNC screenshots all in one place
* Depix – Recovers passwords from pixelized screenshots
* httpscreenshot – HTTPScreenshot is a tool for grabbing screenshots and HTML of large numbers of websites. Technologies* wappalyzer – Identify technology on websites.
* webanalyze – Port of Wappalyzer (uncovers technologies used on websites) to automate mass scanning.
* python-builtwith – BuiltWith API client
* whatweb – Next generation web scanner
* retire.js – scanner detecting the use of JavaScript libraries with known vulnerabilities
* httpx – httpx is a fast and multi-purpose HTTP toolkit allows to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads. Content Discovery* gobuster – Directory/File, DNS and VHost busting tool written in Go
* recursebuster – rapid content discovery tool for recursively querying webservers, handy in pentesting and web application assessments
* feroxbuster – A fast, simple, recursive content discovery tool written in Rust.
* dirsearch – Web path scanner
* dirsearch – A Go implementation of dirsearch.
* filebuster – An extremely fast and flexible web fuzzer
* dirstalk – Modern alternative to dirbuster/dirb
* dirbuster-ng – dirbuster-ng is C CLI implementation of the Java dirbuster tool
* gospider – Gospider – Fast web spider written in Go
* hakrawler – Simple, fast web crawler designed for easy, quick discovery of endpoints and assets within a web application Links* LinkFinder – A python script that finds endpoints in JavaScript files
* JS-Scan – a .js scanner, built in php. designed to scrape URLs and other info
* LinksDumper – Extract (links/possible endpoints) from responses & filter them via decoding/sorting
* GoLinkFinder – A fast and minimal JS endpoint extractor
* BurpJSLinkFinder – Burp Extension for a passive scanning JS files for endpoint links.
* urlgrab – A g[...]
___________________________
@hacking_Attack
@Hacking_Video
* hakrevdns – Small, fast tool for performing reverse DNS lookups en masse.
* dnsx – Dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers.
* subfinder – Subfinder is a subdomain discovery tool that discovers valid subdomains for websites.
* assetfinder – Find domains and subdomains related to a given domain
* crtndstry – Yet another subdomain finder
* VHostScan – A virtual host scanner that performs reverse lookups
* scilla – Information Gathering tool – DNS / Subdomains / Ports / Directories enumeration Port Scanning* masscan – TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.
* RustScan – The Modern Port Scanner
* naabu – A fast port scanner written in go with focus on reliability and simplicity.
* nmap – Nmap – the Network Mapper. GitHub mirror of official SVN repository.
* sandmap – Nmap on steroids. Simple CLI with the ability to run pure Nmap engine, 31 modules with 459 scan profiles.
* ScanCannon – Combines the speed of masscan with the reliability and detailed enumeration of Nmap Screenshots* EyeWitness – EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.
* aquatone – Aquatone is a tool for visual inspection of websites across a large amount of hosts and is convenient for quickly gaining an overview of HTTP-based attack surface.
* screenshoteer – Make website screenshots and mobile emulations from the command line.
* gowitness – gowitness – a golang, web screenshot utility using Chrome Headless
* WitnessMe – Web Inventory tool, takes screenshots of webpages using Pyppeteer (headless Chrome/Chromium) and provides some extra bells & whistles to make life easier.
* eyeballer – Convolutional neural network for analyzing pentesting screenshots
* scrying – A tool for collecting RDP, web and VNC screenshots all in one place
* Depix – Recovers passwords from pixelized screenshots
* httpscreenshot – HTTPScreenshot is a tool for grabbing screenshots and HTML of large numbers of websites. Technologies* wappalyzer – Identify technology on websites.
* webanalyze – Port of Wappalyzer (uncovers technologies used on websites) to automate mass scanning.
* python-builtwith – BuiltWith API client
* whatweb – Next generation web scanner
* retire.js – scanner detecting the use of JavaScript libraries with known vulnerabilities
* httpx – httpx is a fast and multi-purpose HTTP toolkit allows to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads. Content Discovery* gobuster – Directory/File, DNS and VHost busting tool written in Go
* recursebuster – rapid content discovery tool for recursively querying webservers, handy in pentesting and web application assessments
* feroxbuster – A fast, simple, recursive content discovery tool written in Rust.
* dirsearch – Web path scanner
* dirsearch – A Go implementation of dirsearch.
* filebuster – An extremely fast and flexible web fuzzer
* dirstalk – Modern alternative to dirbuster/dirb
* dirbuster-ng – dirbuster-ng is C CLI implementation of the Java dirbuster tool
* gospider – Gospider – Fast web spider written in Go
* hakrawler – Simple, fast web crawler designed for easy, quick discovery of endpoints and assets within a web application Links* LinkFinder – A python script that finds endpoints in JavaScript files
* JS-Scan – a .js scanner, built in php. designed to scrape URLs and other info
* LinksDumper – Extract (links/possible endpoints) from responses & filter them via decoding/sorting
* GoLinkFinder – A fast and minimal JS endpoint extractor
* BurpJSLinkFinder – Burp Extension for a passive scanning JS files for endpoint links.
* urlgrab – A g[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
python tool designed to enumerate subdomains on a target domain through a wordlist. * hakrevdns – Small, fast tool for performing reverse DNS lookups en masse. * dnsx – Dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your…
olang utility to spider through a website searching for additional links.
* waybackurls – Fetch all the URLs that the Wayback Machine knows about for a domain
* gau – Fetch known URLs from AlienVault’s Open Threat Exchange, the Wayback Machine, and Common Crawl.
* getJS – A tool to fastly get all JavaScript sources/files Parameters* parameth – This tool can be used to brute discover GET and POST parameters
* param-miner – This extension identifies hidden, unlinked parameters. It’s particularly useful for finding web cache poisoning vulnerabilities.
* ParamPamPam – This tool for brute discover GET and POST parameters.
* Arjun – HTTP parameter discovery suite.
* ParamSpider – Mining parameters from dark corners of Web Archives Fuzzing* wfuzz – Web application fuzzer
* ffuf – Fast web fuzzer written in Go
* fuzzdb – Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.
* IntruderPayloads – A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.
* fuzz.txt – Potentially dangerous files
* fuzzilli – A JavaScript Engine Fuzzer
* fuzzapi – Fuzzapi is a tool used for REST API pentesting and uses API_Fuzzer gem
* qsfuzz – qsfuzz (Query String Fuzz) allows you to build your own rules to fuzz query strings and easily identify vulnerabilities.
See Also: Hacking stories – Operation Troy – How researchers linked the cyberattacks ExploitationCommand Injection* commix – Automated All-in-One OS command injection and exploitation tool. CORS Misconfiguration* Corsy – CORS Misconfiguration Scanner
* CORStest – A simple CORS misconfiguration scanner
* cors-scanner – A multi-threaded scanner that helps identify CORS flaws/misconfigurations
* CorsMe – Cross Origin Resource Sharing MisConfiguration Scanner CRLF Injection* crlfuzz – A fast tool to scan CRLF vulnerability written in Go
* CRLF-Injection-Scanner – Command line tool for testing CRLF injection on a list of domains.
* Injectus – CRLF and open redirect fuzzer CSRF Injection* XSRFProbe -The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit. Directory Traversal* dotdotpwn – DotDotPwn – The Directory Traversal Fuzzer
* FDsploit – File Inclusion & Directory Traversal fuzzing, enumeration & exploitation tool.
* off-by-slash – Burp extension to detect alias traversal via NGINX misconfiguration at scale.
* liffier – tired of manually add dot-dot-slash to your possible path traversal? this short snippet will increment ../ on the URL. File Inclusion* liffy – Local file inclusion exploitation tool
* Burp-LFI-tests – Fuzzing for LFI using Burpsuite
* LFI-Enum – Scripts to execute enumeration via LFI
* LFISuite – Totally Automatic LFI Exploiter (+ Reverse Shell) and Scanner
* LFI-files – Wordlist to bruteforce for LFI GraphQL Injection* inql – InQL – A Burp Extension for GraphQL Security Testing
* GraphQLmap – GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes.
* shapeshifter – GraphQL security testing tool
* graphql_beautifier – Burp Suite extension to help make Graphql request more readable
* clairvoyance – Obtain GraphQL API schema despite disabled introspection! Header Injection* headi – Customizable and automated HTTP header injection. Insecure Deserialization* ysoserial – A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
* GadgetProbe – Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpaths.
* ysoserial.net – Deserialization payload generator for a variety of .NET formatters
* phpggc – PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from comman[...]
___________________________
@hacking_Attack
@Hacking_Video
* waybackurls – Fetch all the URLs that the Wayback Machine knows about for a domain
* gau – Fetch known URLs from AlienVault’s Open Threat Exchange, the Wayback Machine, and Common Crawl.
* getJS – A tool to fastly get all JavaScript sources/files Parameters* parameth – This tool can be used to brute discover GET and POST parameters
* param-miner – This extension identifies hidden, unlinked parameters. It’s particularly useful for finding web cache poisoning vulnerabilities.
* ParamPamPam – This tool for brute discover GET and POST parameters.
* Arjun – HTTP parameter discovery suite.
* ParamSpider – Mining parameters from dark corners of Web Archives Fuzzing* wfuzz – Web application fuzzer
* ffuf – Fast web fuzzer written in Go
* fuzzdb – Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.
* IntruderPayloads – A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.
* fuzz.txt – Potentially dangerous files
* fuzzilli – A JavaScript Engine Fuzzer
* fuzzapi – Fuzzapi is a tool used for REST API pentesting and uses API_Fuzzer gem
* qsfuzz – qsfuzz (Query String Fuzz) allows you to build your own rules to fuzz query strings and easily identify vulnerabilities.
See Also: Hacking stories – Operation Troy – How researchers linked the cyberattacks ExploitationCommand Injection* commix – Automated All-in-One OS command injection and exploitation tool. CORS Misconfiguration* Corsy – CORS Misconfiguration Scanner
* CORStest – A simple CORS misconfiguration scanner
* cors-scanner – A multi-threaded scanner that helps identify CORS flaws/misconfigurations
* CorsMe – Cross Origin Resource Sharing MisConfiguration Scanner CRLF Injection* crlfuzz – A fast tool to scan CRLF vulnerability written in Go
* CRLF-Injection-Scanner – Command line tool for testing CRLF injection on a list of domains.
* Injectus – CRLF and open redirect fuzzer CSRF Injection* XSRFProbe -The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit. Directory Traversal* dotdotpwn – DotDotPwn – The Directory Traversal Fuzzer
* FDsploit – File Inclusion & Directory Traversal fuzzing, enumeration & exploitation tool.
* off-by-slash – Burp extension to detect alias traversal via NGINX misconfiguration at scale.
* liffier – tired of manually add dot-dot-slash to your possible path traversal? this short snippet will increment ../ on the URL. File Inclusion* liffy – Local file inclusion exploitation tool
* Burp-LFI-tests – Fuzzing for LFI using Burpsuite
* LFI-Enum – Scripts to execute enumeration via LFI
* LFISuite – Totally Automatic LFI Exploiter (+ Reverse Shell) and Scanner
* LFI-files – Wordlist to bruteforce for LFI GraphQL Injection* inql – InQL – A Burp Extension for GraphQL Security Testing
* GraphQLmap – GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes.
* shapeshifter – GraphQL security testing tool
* graphql_beautifier – Burp Suite extension to help make Graphql request more readable
* clairvoyance – Obtain GraphQL API schema despite disabled introspection! Header Injection* headi – Customizable and automated HTTP header injection. Insecure Deserialization* ysoserial – A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
* GadgetProbe – Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpaths.
* ysoserial.net – Deserialization payload generator for a variety of .NET formatters
* phpggc – PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from comman[...]
___________________________
@hacking_Attack
@Hacking_Video