Kali Linux Tutorials
Web-Hacking-Toolkit : A Multi-Platform Web Hacking Toolkit Docker Image With Graphical User Interface (GUI) Support

Web-Hacking-Toolkit multi-platform web hacking toolkit Docker image with Graphical User Interface (GUI) support.

Installation Docker

Pull the image from Docker Hub:
docker pull signedsecurity/web-hacking-toolkit
Run a container and attach a shell:
docker run \
-it \
--rm \
--shm-size="2g" \
--name web-hacking-toolkit \
--hostname web-hacking-toolkit \
-p 22:22 \
-v $(pwd)/data:/root/data \
signedsecurity/web-hacking-toolkit \
/bin/bash
Docker Compose

Docker-Compose can also be used.
version: "3.9" services:
web-hacking-toolkit:
image: signedsecurity/web-hacking-toolkit
container_name: web-hacking-toolkit
hostname: web-hacking-toolkit
stdin_open: true
shm_size: 2gb
ports:
- "22:22" # exposed for GUI support sing SSH with X11 forwarding
volumes:
- ./data:/root/data
restart: unless-stopped
Build and run container:
docker-compose up
Attach shell:
docker-compose exec web-hacking-toolkit /bin/bash
Build from Source

Clone this repository and build the image:
git clone https://github.com/signedsecurity/web-hacking-toolkit.git && \
cd web-hacking-toolkit && \
make build-images
Run a container and attach a shell:
make run
GUI Support

By default, no GUI tools can be run in a Docker container as no X11 server is available. To run them, you must change that. What is required to do so depends on your host machine. If you:

* run on Linux, you probably have X11
* run on Mac OS, you need Xquartz (brew install Xquartz)
* run on Windows, you have a problem Using SSH with X11 forwarding

Use X11 forwarding through SSH if you want to go this way. Run start_sshinside the container to start the server, make sure you expose port 22 when starting the container: docker run -p 127.0.0.1:22:22 ..., then use ssh -X ...when connecting (the script prints the password). Installed Tools
CategoryNameDescriptionDiscovery/DOMAINAmassIn-depth Attack Surface Mapping and Asset DiscoveryUtility/ANYanewA tool for adding new lines to files, skipping duplicatesDiscovery/PARAMArjunHTTP parameter discovery suite.Army-Knife/PROXYBurp Suite CommunityThe BurpSuite Project community edition.Utility/HTTPcurlA command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, MQTT, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful featuresDiscovery/DNSdnsxdnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers.Discovery/FUZZffufFast web fuzzer written in GoDiscovery/DOMAINfindomainThe fastestBrowserfirefoxSafe and easy web browser from MozillaUtility/SHOTgowitnessmag gowitness – a golang, web screenshot utility using Chrome HeadlessMischtml-toolTake URLs or filenames for HTML documents on stdin and extract tag contents, attribute values, or commentsUtility/HTTPhttpxhttpx is a fast and multi-purpose HTTP toolkit allow to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads.Discovery/PORTmasscanTCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.Discovery/PORTnaabuA fast port scanner written in go with focus on reliability and simplicity. Designed to be used in combination with other tools for attack surface discovery in bug bounties and pentestsDiscovery/PORTnmapNmap – the Network Mapper. Github mirror of official SVN repository.Army-Knife/SCANnucleiNuclei is a fast tool for configurable targeted scanning based on templates offering massive extensibility and ea[...]

se of use.Discovery/PORTps.shA wrapper around tools used for port scanning(nmap, naabu & masscan), the goal being reducing scan time, increasing scan efficiency and automating the workflow.Discovery/DOMAINsigsubfind3rA subdomain discovery tool – it gathers a list of subdomains passively using various online sources.Discovery/URLsigurlfind3rA passive reconnaissance tool for known URLs discovery – it gathers a list of URLs passively using various online sources.Army-Knife/SCANsigurlscann3rA web application attack surface mapping tool. It takes in a list of urls then performs numerous probesDiscovery/DOMAINsubdomains.shA wrapper around for subdomains gathering tools (amass, subfinder, findomain & sigsubfind3r) to increase gathering efficiency and automating the workflow.Discovery/DOMAINsubfinderSubfinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing.Utility/Terminaltmuxtmux is a terminal multiplexer: it enables a number of terminals to be created, accessed, and controlled from a single screen. tmux may be detached from a screen and continue running in the background, then later reattachedUtility/EditorvimA highly configurable text editor built to make creating and changing any kind of text very efficient.Discovery/TechwappalyzerWappalyzer identifies technologies on websites, such as CMS, web frameworks, ecommerce platforms, JavaScript libraries, analytics tools and more.Utility/HTTPwuzzInteractive cli tool for HTTP inspection Wordlists
WordlistDescriptionSecListsSecLists is the security tester’s companion. It’s a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.jhaddix / content_discovery_all.txta masterlist of content discovery URLs and files (used most commonly with gobuster) Download

IDOR that worth $3k, the first bug I found in HackerOne

That’s why you should analyze sussy IDs :)Continue reading on Medium »
Read more...

How Blockchain Projects Can Run Ethical Bug Bounty Programs — And What Happens If They Don’t
https://medium.com/immunefi/how-blockchain-projects-can-run-ethical-bug-bounty-programs-and-what-happens-if-they-dont-7dc8a092ede3?source=rss------bug_bounty-5

Crypto is the wild west, which is both a strength and a weakness. It’s a strength because its norms of freedom, tolerance, and…Continue reading on Immunefi » (https://medium.com/immunefi/how-blockchain-projects-can-run-ethical-bug-bounty-programs-and-what-happens-if-they-dont-7dc8a092ede3?source=rss------bug_bounty-5)

Hacking on Medium
Cewlkid:1 Vulnhub Walkthrough

https://cdn-images-1.medium.com/max/820/0*OftDuVpdu9j5GSn4.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

Hacking on Medium
How Blockchain Projects Can Run Ethical Bug Bounty Programs — And What Happens If They Don’t

https://cdn-images-1.medium.com/max/2600/1*ybZh-vq6t4h8K6zbcsQkxw.jpeg
Crypto is the wild west, which is both a strength and a weakness. It’s a strength because its norms of freedom, tolerance, and…

Continue reading on Immunefi »

Hacking on Medium
Emotet regresó y se distribuye a través de correos con adjuntos maliciosos

https://cdn-images-1.medium.com/max/1412/0*DAEHubkyK-dGXQxd
PUBLICADO EN 19 NOVIEMBRE, 2021POR EHACKING

Continue reading on Medium »

hacking: security in practice
Search engine

I'm looking for a username/search engine equivalent to pipl. Any?

submitted by /u/weenur1991
[link] [comments]

hacking: security in practice
Have any of you guys made/tried making sneaker/gpu/console bots?

I'm in the middle of making my second PS5/Xbox (console) bot and I've found the process pretty interesting. My first bot I just used a headless browser and spammed actions on the site which wasn't very useful when there was high traffic. The second one I'm working on right now is 100x better and doesn't use those slow methods at all. I come from app and web development so this really isn't domain but it seems like so much fun!

​

Always knew it was the pen test/hacker guys making bots. Just curious to see if it's a common thing to dabble with coming from this field

submitted by /u/A4_Ts
[link] [comments]

Try hack me premium VS Hack the box academy premium
https://www.reddit.com/r/Pentesting/comments/qxo25w/try_hack_me_premium_vs_hack_the_box_academy/

<!-- SC_OFF -->I am a beginner and I am thinking about a pro account so which one would you guys recommend View Poll (https://www.reddit.com/poll/qxo25w) <!-- SC_ON --> submitted by /u/Massive_Buy5210 (https://www.reddit.com/user/Massive_Buy5210)
[link] (https://www.reddit.com/r/Pentesting/comments/qxo25w/try_hack_me_premium_vs_hack_the_box_academy/) [comments] (https://www.reddit.com/r/Pentesting/comments/qxo25w/try_hack_me_premium_vs_hack_the_box_academy/)

Nosferatu - Lsass NTLM Authentication Backdoor
http://www.kitploit.com/2021/11/nosferatu-lsass-ntlm-authentication.html

Lsass NTLM Authentication (https://www.kitploit.com/search/label/Authentication) Backdoor
How it Works
First, the DLL is injected into the lsass.exe process, and will begin hooking authentication WinAPI calls. The targeted function is MsvpPasswordValidate(), located in NtlmShared.dll. In the pursuit of not being detected, the hooked function will call the original function and allow for the normal flow of authentication. Only after seeing that authentication has failed will the hook swap out the actual NTLM hash with the backdoor (https://www.kitploit.com/search/label/Backdoor) hash for comparison.
Usage
Nosferatu must be compiled as a 64 bit DLL. It must be injected using the a DLL Injector (https://www.kitploit.com/search/label/DLL%20Injector) with SeDebugPrivilege.

You can see it loaded using Procexp: