Web Cache Vulnerability Scanner (https://www.kitploit.com/search/label/Vulnerability%20Scanner) (WCVS) is a fast and versatile CLI scanner for web cache poisoning (https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner#background-information) developed by Hackmanit (https://hackmanit.de/).The scanner supports many different web cache poisoning techniques, includes a crawler to identify further URLs to test, and can adapt to a specific web cache for more efficient testing. It is highly customizable (https://www.kitploit.com/search/label/Customizable) and can be easily integrated into existing CI/CD pipelines.
FeaturesSupport for 9 web cache poisoning techniques: Unkeyed header poisoningUnkeyed parameter poisoningParameter cloakingFat GETHTTP response splittingHTTP request smugglingHTTP header oversize (HHO)HTTP meta character (HMC)HTTP method override (HMO)Analyzing a web cache before testing and adapting to it for more efficient testingGenerating a report in JSON formatCrawling websites for further URLs to scanRouting traffic through a proxy (e.g., Burp Suite)Limiting requests per second to bypass rate limitingInstallationOption 1: Pre-built Binary (Recommended)Prebuilt binaries of WCVS are provided on the releases page (https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases). These releases include 2 default wordlists, as well.Option 2: Fetch Repository Using GoThe repository can be fetched using Go.go get -u https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner
UsageWCVS is highly customizable using its flags. Many of the flags can either contain a value directly or the path to a file.The only mandatory flag is -u/--url to provide the target URL which should be tested for web cache poisoning. The target URL can be provided in different formats,WCVS needs two wordlists in order to test for the first 5 techniques - one wordlist with header names and one with parameter names. The wordlists can either be present in the same directory WCVS is executed from or specified using the --headerwordlist/-hw and --parameterwordlist/-pw flags.Examples:wcvs -u 127.0.0.1
wcvs -u http://127.0.0.1
wcvs -u https://example.com
wcvs -u file:path/to/url_list
wcvs -u https://example.com -hw "file:/home/user/Documents/wordlist-header.txt"
wcvs -u https://example.com -pw "file:/home/user/Documents/wordlist-parameter.txt"
wcvs -u https://example.com -hw "file:/home/user/Documents/wordlist-header.txt" -pw "file:/home/user/Documents/wordlist-parameter.txt"
Specify Headers, Parameters, Cookies, and More--setcookies/-sc specifies cookies which shall be added to the request--setheaders/-sh specifies headers which shall be added to the request--setparameters/-sp specifies parameters which shall be added to the request. While it is also possible to simply add them to the URL, it might be more useful in some cases to add them via this flag.--post/-post changes the HTTP method from GET to POST--setbody/-sb specifies the body which shall be added to the request--contenttype/-ct specifies the value of the Content-Type header--useragentchrome/-uac changes the User-Agent from WebCacheVulnerabilityScanner v{Version-Number} to Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36. While the same can be achieved with e.g. -sh "Mozilla/5.0 (Windows NT 10.0; Win64; x64) ..., this flag provides a quicker way.Examples:wcvs -u https://example.com -sc "PHPSESSID=123"
wcvs -u https://example.com -sc "file:/home/user/Documents/cookies.txt"
wcvs -u https://example.com -sh "Referer: localhost"
wcvs -u https://example.com -sh "file:/home/user/Documents/headers.txt"
wcvs -u https://example.com -sp "admin=true"
wcvs -u https://example.com -sp "file:/home/user/Documents/parameters.txt"
wcvs -u https://example.com -post -sb "admin=true"
wcvs -u https://example.com -post -sb "file:/home/user/Documents/body.txt"
wcvs -u https://example.com -post -sb "{}" -ct "application/json"
FeaturesSupport for 9 web cache poisoning techniques: Unkeyed header poisoningUnkeyed parameter poisoningParameter cloakingFat GETHTTP response splittingHTTP request smugglingHTTP header oversize (HHO)HTTP meta character (HMC)HTTP method override (HMO)Analyzing a web cache before testing and adapting to it for more efficient testingGenerating a report in JSON formatCrawling websites for further URLs to scanRouting traffic through a proxy (e.g., Burp Suite)Limiting requests per second to bypass rate limitingInstallationOption 1: Pre-built Binary (Recommended)Prebuilt binaries of WCVS are provided on the releases page (https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases). These releases include 2 default wordlists, as well.Option 2: Fetch Repository Using GoThe repository can be fetched using Go.go get -u https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner
UsageWCVS is highly customizable using its flags. Many of the flags can either contain a value directly or the path to a file.The only mandatory flag is -u/--url to provide the target URL which should be tested for web cache poisoning. The target URL can be provided in different formats,WCVS needs two wordlists in order to test for the first 5 techniques - one wordlist with header names and one with parameter names. The wordlists can either be present in the same directory WCVS is executed from or specified using the --headerwordlist/-hw and --parameterwordlist/-pw flags.Examples:wcvs -u 127.0.0.1
wcvs -u http://127.0.0.1
wcvs -u https://example.com
wcvs -u file:path/to/url_list
wcvs -u https://example.com -hw "file:/home/user/Documents/wordlist-header.txt"
wcvs -u https://example.com -pw "file:/home/user/Documents/wordlist-parameter.txt"
wcvs -u https://example.com -hw "file:/home/user/Documents/wordlist-header.txt" -pw "file:/home/user/Documents/wordlist-parameter.txt"
Specify Headers, Parameters, Cookies, and More--setcookies/-sc specifies cookies which shall be added to the request--setheaders/-sh specifies headers which shall be added to the request--setparameters/-sp specifies parameters which shall be added to the request. While it is also possible to simply add them to the URL, it might be more useful in some cases to add them via this flag.--post/-post changes the HTTP method from GET to POST--setbody/-sb specifies the body which shall be added to the request--contenttype/-ct specifies the value of the Content-Type header--useragentchrome/-uac changes the User-Agent from WebCacheVulnerabilityScanner v{Version-Number} to Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36. While the same can be achieved with e.g. -sh "Mozilla/5.0 (Windows NT 10.0; Win64; x64) ..., this flag provides a quicker way.Examples:wcvs -u https://example.com -sc "PHPSESSID=123"
wcvs -u https://example.com -sc "file:/home/user/Documents/cookies.txt"
wcvs -u https://example.com -sh "Referer: localhost"
wcvs -u https://example.com -sh "file:/home/user/Documents/headers.txt"
wcvs -u https://example.com -sp "admin=true"
wcvs -u https://example.com -sp "file:/home/user/Documents/parameters.txt"
wcvs -u https://example.com -post -sb "admin=true"
wcvs -u https://example.com -post -sb "file:/home/user/Documents/body.txt"
wcvs -u https://example.com -post -sb "{}" -ct "application/json"
wcvs -u https://example.com -uac
Generate a JSON ReportA JSON report is generated and updated after each scanned URL if the flag --generatereport/-gr is set. The report is written, just like a log file, into the same directory WCVS is executed from. In order to change the directory for all output files use --generatepath/-gp. If HTML special chars shall be encoded in the report, use --escapejson/-ej.Examples:wcvs -u https://example.com -gr
wcvs -u https://example.com -gr -ej
wcvs -u https://example.com -gr -gp /home/user/Documents
wcvs -u https://example.com -gr -gp /home/user/Documents -ej
Crawl for URLsIn order to crawl for URLs, --recursivity/-r needs to be set. It specifies how deep the crawler shall go recursion-wise. By default WCVS only crawls for URLs of the same domain. To also crawl for other domains, --recdomains/red can be used. To only crawl URLs which inherit a specific string, --recinclude/-rin can be used. --reclimit/-rl limits how many URLs are crawled for each recursion depth. Also, a list with URLs which shall not be crawled can be specified with --recexclude/-rex. --generatecompleted/-gc can, for example, be used to generate a list with all already tested URLs. If a scan is repeated, but WCVS shall not crawl and test again the same URLs, this list can be used for --recexclude/-rex.Examples:wcvs -u https://example.com -r 5
wcvs -u https://example.com -r 5 -red /home/user/Documents/mydomains.txt
wcvs -u https://example.com -r 5 -rl 2
wcvs -u https://example.com -r 5 -rex /home/user/Documents/donttest.txt
Use a ProxyTo use a proxy, a CA certificate of the proxy in PEM format is needed. Burp Suite certificates (https://www.kitploit.com/search/label/Certificates) are provided in DER format, for example. To convert them, the following command can be used: openssl x509 -inform DER -outform PEM -text -in cacert.der -out cacert.pem. The path to the certificate can be specified with --proxycertpath/-ppath. The default URL for the proxy is http://127.0.0.1:8080. In order to change it, use --proxyurl/-purl.Examples:wcvs -u https://example.com -ppath /home/user/Documents/cacert.pem
wcvs -u https://example.com -ppath /home/user/Documents/cacert.pem -purl http://127.0.0.1:8081
Throttle or AccelerateThe number of maximum allowed requests per second can be set with --reqrate/-rr. By default, this number is unrestricted. Contrary, the number of requests per second can be increased potentially, if --threads/-t is used to increase the number of concurrent threads WCVS utilizes. The default value is 20.Examples:wcvs -u https://example.com -rr 10
wcvs -u https://example.com -rr 1
wcvs -u https://example.com -rr 0.5
wcvs -u https://example.com -t 50
Further FlagsWCVS provides even more than the beforehand mentioned flags and options. --help/-h provides a list of each flag, its meaning, and how to use it.Example:wcvs -h
Background InformationA short series of blog posts giving more information about web cache poisoning and WCVS can be found here:Is Your Application (https://www.hackmanit.de/en/blog-en/142-is-your-application-vulnerable-to-web-cache-poisoning)Vulnerable (https://www.kitploit.com/search/label/Vulnerable) to Web Cache Poisoning?Web Cache (https://www.hackmanit.de/en/blog-en/145-web-cache-vulnerability-scanner-wcvs-free-customizable-easy-to-use)Vulnerability (https://www.kitploit.com/search/label/Vulnerability) Scanner (WCVS) - Free, Customizable, Easy-To-UseLicenseWCVS is developed by Hackmanit (https://hackmanit.de/) and licensed under the Apache License, Version 2.0 (https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/blob/master/license.txt).
Download Web-Cache-Vulnerability-Scanner (https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner)
Generate a JSON ReportA JSON report is generated and updated after each scanned URL if the flag --generatereport/-gr is set. The report is written, just like a log file, into the same directory WCVS is executed from. In order to change the directory for all output files use --generatepath/-gp. If HTML special chars shall be encoded in the report, use --escapejson/-ej.Examples:wcvs -u https://example.com -gr
wcvs -u https://example.com -gr -ej
wcvs -u https://example.com -gr -gp /home/user/Documents
wcvs -u https://example.com -gr -gp /home/user/Documents -ej
Crawl for URLsIn order to crawl for URLs, --recursivity/-r needs to be set. It specifies how deep the crawler shall go recursion-wise. By default WCVS only crawls for URLs of the same domain. To also crawl for other domains, --recdomains/red can be used. To only crawl URLs which inherit a specific string, --recinclude/-rin can be used. --reclimit/-rl limits how many URLs are crawled for each recursion depth. Also, a list with URLs which shall not be crawled can be specified with --recexclude/-rex. --generatecompleted/-gc can, for example, be used to generate a list with all already tested URLs. If a scan is repeated, but WCVS shall not crawl and test again the same URLs, this list can be used for --recexclude/-rex.Examples:wcvs -u https://example.com -r 5
wcvs -u https://example.com -r 5 -red /home/user/Documents/mydomains.txt
wcvs -u https://example.com -r 5 -rl 2
wcvs -u https://example.com -r 5 -rex /home/user/Documents/donttest.txt
Use a ProxyTo use a proxy, a CA certificate of the proxy in PEM format is needed. Burp Suite certificates (https://www.kitploit.com/search/label/Certificates) are provided in DER format, for example. To convert them, the following command can be used: openssl x509 -inform DER -outform PEM -text -in cacert.der -out cacert.pem. The path to the certificate can be specified with --proxycertpath/-ppath. The default URL for the proxy is http://127.0.0.1:8080. In order to change it, use --proxyurl/-purl.Examples:wcvs -u https://example.com -ppath /home/user/Documents/cacert.pem
wcvs -u https://example.com -ppath /home/user/Documents/cacert.pem -purl http://127.0.0.1:8081
Throttle or AccelerateThe number of maximum allowed requests per second can be set with --reqrate/-rr. By default, this number is unrestricted. Contrary, the number of requests per second can be increased potentially, if --threads/-t is used to increase the number of concurrent threads WCVS utilizes. The default value is 20.Examples:wcvs -u https://example.com -rr 10
wcvs -u https://example.com -rr 1
wcvs -u https://example.com -rr 0.5
wcvs -u https://example.com -t 50
Further FlagsWCVS provides even more than the beforehand mentioned flags and options. --help/-h provides a list of each flag, its meaning, and how to use it.Example:wcvs -h
Background InformationA short series of blog posts giving more information about web cache poisoning and WCVS can be found here:Is Your Application (https://www.hackmanit.de/en/blog-en/142-is-your-application-vulnerable-to-web-cache-poisoning)Vulnerable (https://www.kitploit.com/search/label/Vulnerable) to Web Cache Poisoning?Web Cache (https://www.hackmanit.de/en/blog-en/145-web-cache-vulnerability-scanner-wcvs-free-customizable-easy-to-use)Vulnerability (https://www.kitploit.com/search/label/Vulnerability) Scanner (WCVS) - Free, Customizable, Easy-To-UseLicenseWCVS is developed by Hackmanit (https://hackmanit.de/) and licensed under the Apache License, Version 2.0 (https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/blob/master/license.txt).
Download Web-Cache-Vulnerability-Scanner (https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner)
hacking: security in practice
Developing an open-source C2 framework. A worthy pursuit?
Lately I've been thinking about ideas to start a really challenging project. I'd like to try something tough to implement that I could maintain for a long time (possibly years).
I thought about an open-source C2 framework with some sort of agent to start with. It would have multiple methods of exfiltration, obfuscation, control of multiple agents, multi-stage deployment, addition of modules, etc. The technology stack would most likely be built on top of C for any client-side code and Python for the server-side. A web-based GUI can be implemented with one of those nice, off-the-shelf administration panels that we see on CMS out there.
I know there are CS, MSF and others out there, but the challenge seems interesting.
This one will be hard. Assuming I have what it takes as a programmer to pull this off, do you think this could be worth a shot?
submitted by /u/EONRaider
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
Developing an open-source C2 framework. A worthy pursuit?
Lately I've been thinking about ideas to start a really challenging project. I'd like to try something tough to implement that I could maintain for a long time (possibly years).
I thought about an open-source C2 framework with some sort of agent to start with. It would have multiple methods of exfiltration, obfuscation, control of multiple agents, multi-stage deployment, addition of modules, etc. The technology stack would most likely be built on top of C for any client-side code and Python for the server-side. A web-based GUI can be implemented with one of those nice, off-the-shelf administration panels that we see on CMS out there.
I know there are CS, MSF and others out there, but the challenge seems interesting.
This one will be hard. Assuming I have what it takes as a programmer to pull this off, do you think this could be worth a shot?
submitted by /u/EONRaider
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
reddit
Developing an open-source C2 framework. A worthy pursuit?
Lately I've been thinking about ideas to start a really challenging project. I'd like to try something tough to implement that I could maintain...
hacking: security in practice
I don’t understand much about this topic tbh but is Collection #1 downloadable as a list of passwords? Where?
(Title)
submitted by /u/HYPE_100
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
I don’t understand much about this topic tbh but is Collection #1 downloadable as a list of passwords? Where?
(Title)
submitted by /u/HYPE_100
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
reddit
r/hacking - I don’t understand much about this topic tbh but is Collection #1 downloadable as a list of passwords? Where?
0 votes and 0 comments so far on Reddit
hacking: security in practice
Im being dumb
can anyone tell me how to pick the exploit in metasploit. I imported the xmp report form openVAS and want to use one of the exploits from that report but I dont know how to pick one of them.
edit sorry its for a uni assignment, we have dedicated targets
submitted by /u/F0KUS228
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
Im being dumb
can anyone tell me how to pick the exploit in metasploit. I imported the xmp report form openVAS and want to use one of the exploits from that report but I dont know how to pick one of them.
edit sorry its for a uni assignment, we have dedicated targets
submitted by /u/F0KUS228
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
reddit
r/hacking - Im being dumb
0 votes and 0 comments so far on Reddit
How my OSCP Preparation got RUINED!
https://www.reddit.com/r/Pentesting/comments/rlngxy/how_my_oscp_preparation_got_ruined/
<!-- SC_OFF -->I know it's a bit dramatic, but it's kinda true 😅 🎥 Link - https://www.youtube.com/watch?v=dByIKRu5QfQ <!-- SC_ON --> submitted by /u/0xc0sm0s (https://www.reddit.com/user/0xc0sm0s)
[link] (https://www.reddit.com/r/Pentesting/comments/rlngxy/how_my_oscp_preparation_got_ruined/) [comments] (https://www.reddit.com/r/Pentesting/comments/rlngxy/how_my_oscp_preparation_got_ruined/)
https://www.reddit.com/r/Pentesting/comments/rlngxy/how_my_oscp_preparation_got_ruined/
<!-- SC_OFF -->I know it's a bit dramatic, but it's kinda true 😅 🎥 Link - https://www.youtube.com/watch?v=dByIKRu5QfQ <!-- SC_ON --> submitted by /u/0xc0sm0s (https://www.reddit.com/user/0xc0sm0s)
[link] (https://www.reddit.com/r/Pentesting/comments/rlngxy/how_my_oscp_preparation_got_ruined/) [comments] (https://www.reddit.com/r/Pentesting/comments/rlngxy/how_my_oscp_preparation_got_ruined/)
Pentest Documentation tool recommendations ?
https://www.reddit.com/r/Pentesting/comments/rlp1jg/pentest_documentation_tool_recommendations/
<!-- SC_OFF -->Hi all, I'm still new to the industry, I'm looking for some tools recommendations to create a deliverable professional pentests report. Currently I'm trying to use pwndoc, I'm still looking for a guide on how to effectively use the tool as the information I found doesn't have a much detail on creating graphs or creating document templets. Any recommendations are appreciated, thanks <!-- SC_ON --> submitted by /u/IIIRexBannerIII (https://www.reddit.com/user/IIIRexBannerIII)
[link] (https://www.reddit.com/r/Pentesting/comments/rlp1jg/pentest_documentation_tool_recommendations/) [comments] (https://www.reddit.com/r/Pentesting/comments/rlp1jg/pentest_documentation_tool_recommendations/)
https://www.reddit.com/r/Pentesting/comments/rlp1jg/pentest_documentation_tool_recommendations/
<!-- SC_OFF -->Hi all, I'm still new to the industry, I'm looking for some tools recommendations to create a deliverable professional pentests report. Currently I'm trying to use pwndoc, I'm still looking for a guide on how to effectively use the tool as the information I found doesn't have a much detail on creating graphs or creating document templets. Any recommendations are appreciated, thanks <!-- SC_ON --> submitted by /u/IIIRexBannerIII (https://www.reddit.com/user/IIIRexBannerIII)
[link] (https://www.reddit.com/r/Pentesting/comments/rlp1jg/pentest_documentation_tool_recommendations/) [comments] (https://www.reddit.com/r/Pentesting/comments/rlp1jg/pentest_documentation_tool_recommendations/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
UK Security Agency Shares 225M Passwords With 'Have I Been Pwned'
The UK's NCA and NCCU have shared 225 million stolen emails and passwords with HIBP, which tracks stolen credentials.
UK Security Agency Shares 225M Passwords With 'Have I Been Pwned'
The UK's NCA and NCCU have shared 225 million stolen emails and passwords with HIBP, which tracks stolen credentials.
Hack Your Own JWT Implementation
https://thexssrat.medium.com/hack-your-own-jwt-implementation-1d9dd4315de5?source=rss------bug_bounty-5
https://thexssrat.medium.com/hack-your-own-jwt-implementation-1d9dd4315de5?source=rss------bug_bounty-5
Build, hack and secure your own JWT implementationContinue reading on Medium » (https://thexssrat.medium.com/hack-your-own-jwt-implementation-1d9dd4315de5?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Learning How To Ethical Hack: Step 3 — Creating a Web Application using a Virtual Machine.
https://cdn-images-1.medium.com/max/2380/1*CzvrIv2l2BcuC65-vwdAsA.png
In this step I learn how to create a simple Django web application using VS Code on Ubuntu within a virtual machine through VirtualBox.
Continue reading on System Weakness »
Learning How To Ethical Hack: Step 3 — Creating a Web Application using a Virtual Machine.
https://cdn-images-1.medium.com/max/2380/1*CzvrIv2l2BcuC65-vwdAsA.png
In this step I learn how to create a simple Django web application using VS Code on Ubuntu within a virtual machine through VirtualBox.
Continue reading on System Weakness »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Devel: HTB Writeup
https://cdn-images-1.medium.com/max/824/1*-Q8zZVDV-t_VDy7NvYdBzQ.png
The first thing I did was launch a series of nmap scans against this machine.
Continue reading on Medium »
Devel: HTB Writeup
https://cdn-images-1.medium.com/max/824/1*-Q8zZVDV-t_VDy7NvYdBzQ.png
The first thing I did was launch a series of nmap scans against this machine.
Continue reading on Medium »