Kali Linux Tutorials
AirStrike : Automatically Grab And Crack WPA-2 Handshakes With Distributed Client-Server Architecture

AirStrike is a tool that automates cracking of WPA-2 Wi-Fi credentials using client-server architecture.

Requirements

Airstrike uses Hashcat Brain Architecture, aircrack-ngsuite, entrutility and some helper scripts.

You can use install.shscript to download all dependencies (if you’re on system which has an access to apt or pacman, but if you’re using Gentoo, you’d have to install hcxtools by hand, they’re not available in their repos, or maybe I’ve missed something. Some other uncommon distros are not included, for example Alpine doesn’t have hashcat package, but if you’re distro is exotic, you can use Nix on that, all needed packages are in nixpkgs.)

If you’re using Nix/NixOS, you can jump into Nix-Shell with needed dependencies with: nix-shell -p hashcat hashcat-utils aircrack-ng entr hcxtools

Usage

Run aircrack_server.shon the machine on which you want to crack passwords. This script builds aircrack_client.shfile, which can be executed on any Linux host that is able to connect with the server started earlier. Upon execution, the client automatically captures handshakes, connects with the server and sends captured data.

Whenever a password is successfully cracked by the server, the watcher.shscript prints it out to terminal on the server side.

The only required option flag for airstrike_client.shis the -wflag: it specifies the wordlist that should be used by the server. Listening interface can be specified with -iflag. By default, a current wireless interface is automatically selected. Additionally, airstrike_client.shlistens for WPA-2 data without any filter, so it will capture and crack all of the passwords of all Wi-Fi networks in range (whenever handshakes are exchanged).

Navigation

Ctrl + Swill send captured assets (Wi-Fi handshakes in .hccapxform) to the server. Ctrl + Idisplays information about capture progress.

Above shortcuts can be used inside a running instance of airstrike_client.sh
Download

___________________________
@hacking_Attack
@Hacking_Video

Copy terraform.tfvars.exampleto terraform.tvvars* Uncomment the line #aws_local_profile = "profile_name"and enter the profile name you’d like to use
* If you are using a non-default profile, and still want to use the aws_credentails_file_examplefile, you can use this command to generate an AWS credentials file that works with your non-default profile name (Thanks @scriptingislife)
* Remember to replace nondefaultuserwith the profile name you are using):
* tail -n +7 aws_credentials_file_example | sed -e "s/111111111111/$(aws sts get-caller-identity | grep Account | awk -F\" '{print $4}')/g;s/default/nondefaultuser/g" >> ~/.aws/credentialsUse an ARN other than the caller as the principal that can assume the newly created roles* Copy terraform.tfvars.exampleto terraform.tvvars* Uncomment the line #aws_assume_role_arn = "arn:aws:iam::112233445566:user/you"and enter the ARN you’d like to use

Once created, each of the privesc roles will be assumable by the principal (ARN) you specified. Create the resource in account X, but use an ARN from account Y as the principal that can assume the newly created rolesIf you have configured AWS CLI profiles that assume roles into other accounts, you will want to specify the profile name AND manually specify the ARN you’d like to use to assume into the different roles.

In the example below, the resources will be created in the account that is tied to "prod-cross-org-access-role", but each role that Terraform creates can be accessed by "arn:aws:iam::112233445566:user/you", which belongs to another account.

aws_local_profile = “prod-cross-org-access-role”
aws_assume_role_arn = “arn:aws:iam::112233445566:user/you” Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Forbidden : Bypass 4Xx HTTP Response Status Codes

Forbidden is to Bypass 4xx HTTP response status codes. Based on PycURL.

Script uses multithreading, and is based on brute forcing so might have some false positives. Script uses colored output.

Results will be sorted by HTTP response status code ascending, content length descending, and ID ascending.

To filter out false positives, check each content length manually with the provided cURLcommand. If it does not results in bypass, just ignore all other results with the same content length.
TestScopeVarious HTTP methodsmethodVarious HTTP methods with ‘Content-Length: 0’ headermethodCross-site tracing (XST) with HTTP TRACE and TRACK methodsmethodFile upload with HTTP PUT methodmethodVarious HTTP method overridesmethod-overrideVarious HTTP headersheaderVarious URL overridesheaderURL override with two ‘Host’ headersheaderVarious URL path bypassespathVarious URL scheme overridesscheme-overrideBasic authentication/authorization including null sessionauthBroken URL parsersparser
Extend this script to your liking.

Good sources for HTTP headers:

* Common HTTP Response Headers

Tested on Kali Linux v2021.4 (64-bit).

Made for educational purposes. I hope it will help!

Future plans:

* add option to test only allowed HTTP methods,
* add option to test a specific/custom HTTP header for all the domains/subdomains,
* add option to test less common/application specific HTTP headers,
* separate HTTP headers in categories to reduce false positive results,
* do not ignore URL parameters and fragments.

How to Run

Open your preferred console from /src/ and run the commands shown below.

Install required tools:

apt-get install -y curl

Install required packages:

pip3 install -r requirements.txt

Run the script:

python3 forbidden.py

Be aware of rate limiting. Give it some time before you run the script again for the same domain in order to get better results.

Some websites require a user agent header. Download a user agent list from here.

Automation

Bypass 403 ForbiddenHTTP response status code:

count=0; for subdomain in $(cat subdomains_403.txt); do count=$((count+1)); echo “#${count} | ${subdomain}”; python3 forbidden.py -u “${subdomain}” -t method,method-override,header,path,scheme-override -f GET -o “forbidden_403_results_${count}.json”; done

Bypass 401 UnauthorizedHTTP response status code:

count=0; for subdomain in $(cat subdomains_401.txt); do count=$((count+1)); echo “#${count} | ${subdomain}”; python3 forbidden.py -u “${subdomain}” -t auth -f GET -o “forbidden_401_results_${count}.json”; done

Broken URL parser check:

count=0; for subdomain in $(cat subdomains_live_long.txt); do count=$((count+1)); echo “#${count} | ${subdomain}”; python3 forbidden.py -u “${subdomain}” -t parser -f GET -o “forbidden_parser_results_${count}.json”; done

HTTP Methods

ACL
ARBITRARY
BASELINE-CONTROL
BIND
CHECKIN
CHECKOUT
CONNECT
COPY
DELETE
GET
HEAD
INDEX
LABEL
LINK
LOCK
MERGE
MKACTIVITY
MKCALENDAR
MKCOL
MKREDIRECTREF
MKWORKSPACE
MOVE
OPTIONS
ORDERPATCH
PATCH
POST
PRI
PROPFIND
PROPPATCH
PUT
REBIND
REPORT
SEARCH
SHOWMETHOD
SPACEJUMP
TEXTSEARCH
TRACE
TRACK
UNBIND
UNCHECKOUT
UNLINK
UNLOCK
UPDATE
UPDATEREDIRECTREF
VERSION-CONTROL

HTTP Headers

Method override HTTP headers:

X-HTTP-Method
X-HTTP-Method-Override
X-Method-Override

HTTP headers:

Client-IP
Cluster-Client-IP
Connection
Contact
Forwarded
Forwarded-For
Forwarded-For-Ip
From
Host
Origin
Referer
Stuff
True-Client-IP
X-Client-IP
X-Custom-IP-Authorization
X-Forward
X-Forwarded
X-Forwarded-By
X-Forwarded-For
X-Forwarded-For-Original
X-Forwarded-Host
X-Forwarded-Server
X-Forward-For
X-Forwared-Host
X-Host
X-HTTP-Host-Override
X-Original-URL
X-Originat[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Toutatis : A Tool That Allows You To Extract Information From Instagram Accounts Such As E-Mails, Phone Numbers And More

Toutatis is a tool that allows you to extract information from instagrams accounts such as e-mails, phone numbers and more
For BTC Donations : 1FHDM49QfZX6pJmhjLE5tB2K6CaTLMZpXZ

Prerequisite

Python 3

Installation

With PyPI

pip install toutatis

With Github

git clone https://github.com/megadose/toutatis.git
cd toutatis/
python3 setup.py install

Usage

toutatis -u username -s instagramsessionid

Example

Informations about : xxxusernamexxx
Full Name : xxxusernamesxx | userID : 123456789
Verified : False | Is buisness Account : False
Is private Account : False
Follower : xxx | Following : xxx
Number of posts : x
Number of tag in posts : x
External url : http://example.com
IGTV posts : x
Biography : example biography
Public Email : public@example.com
Public Phone : +00 0 00 00 00 00
Obfuscated email : mes@examplemail.com

Obfuscated phone : +00 0xx xxx xx 00

Profile Picture : https://scontent-X-X.cdninstagram.com/
Download

___________________________
@hacking_Attack
@Hacking_Video

ing-IP
X-Override-URL
X-ProxyUser-IP
X-Real-IP
X-Remote-Addr
X-Remote-IP
X-Rewrite-URL
X-Wap-Profile
X-Server-IP
X-Target

Scheme override HTTP headers:

X-Forwarded-Proto
X-Forwarded-Protocol
X-Forwarded-Scheme
X-Url-Scheme
X-URLSCHEME

URL Paths

Inject in front, back, and both front and back of URL path; with and without prepending and appending slashes.

/
//
%09
%20
%2e
.
..
;
.;
..;
;foo=bar;

Inject in back of URL path.

~
random
*
**
**random
###random
?
??
??random

Inject in back of URL path only if URL path does not end with ‘/’.

.php
.jsp
.jspa
.jspx
.jhtml
.html
.sht
.shtml
.xhtml
.asp
.aspx
.esp

Results Format

[
{
“id”:501,
“url”:”http://example.com:80/admin”,
“method”:”GET”,
“headers”:[
“Host: 127.0.0.1”
],
“agent”:”Forbidden/5.4″,
“proxy”:null,
“data”:null,
“command”:”curl -m 5 –connect-timeout 5 -i -s -k -L –path-as-is -H ‘Host: 127.0.0.1’ -H ‘User-Agent: Forbidden/5.4’ -X ‘GET’ ‘http://example.com:80/admin'”,
“code”:200,
“length”:255408
},
{
“id”:541,
“url”:”http://example.com:80/admin”,
“method”:”GET”,
“headers”:[
“Host: 127.0.0.1:80”
],
“agent”:”Forbidden/5.4″,
“proxy”:null,
“data”:null,
“command”:”curl -m 5 –connect-timeout 5 -i -s -k -L –path-as-is -H ‘Host: 127.0.0.1:80’ -H ‘User-Agent: Forbidden/5.4’ -X ‘GET’ ‘http://example.com:80/admin'”,
“code”:200,
“length”:255408
}
]

Images
https://blogger.googleusercontent.com/img/a/AVvXsEg6rdkh5NJsGuMKRgU91NJJDDxAqF5R-POrw921sIbm8kE05eh3o4sz5Qp5-7eHIdg1wYQzu9rHz8A1Lpy4YD0NZFvg_NFzSEqWC8SQ2dpG0p0Kpt58LbEj_i2DnA2AWVNEa6b4AOzQnLeBLvSmXT-5gsPpSRpc-LKwQx_geB5epOETkrcFLv51FGY0=s1496 Download

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
The Looming CISO Mental Health Crisis — and What to Do About It, Part 2

Letting mental health issues fester may result in burnout and attrition, which affect both the company and the humans it employs.

hacking: security in practice
i want to find out who keeps spamming me fake messages that my package is on the way.

i am no expert in coding or hacking, i am looking for advice/opinions on what i can do. the spam does not stop. i am getting messages all day long. there is gotta be a way to find out who he is. keeps using different local phone numbers.

submitted by /u/somehowgothacked
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Call for Experts

Hello everyone,

My company is looking for a cybersecurity/ethical hacking expert as a consultant for the development of technical courses and practical labs.

I represent a certification body that offers certification for individuals in various disciplines.

If you or anyone you know is interested, please DM me.

submitted by /u/A-M0rph3u5
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Bluffy - Convert Shellcode Into Different Formats!

Bluffy is a utility which was used in experiments to bypass Anti-Virus products (statically) by formatting shellcode into realistic looking data formats. Proof-of-concept tools, such as 0xBoku's Ninja_UUID_Runner and ChoiSG's UuidShellcodeExec, inspired the initial concept for Bluffy. So far, we implemented: UUID CLSID SVG CSS CSV Help payload prior to C formatting --list List all the available masks">$ python3 bluffy.py -h ⣇⣿⠘⣿⣿⣿⡿⡿⣟⣟⢟⢟⢝⠵⡝⣿⡿⢂⣼⣿⣷⣌⠩⡫⡻⣝⠹⢿⣿⣷ ⡆⣿⣆⠱⣝⡵⣝⢅⠙⣿⢕⢕⢕⢕⢝⣥⢒⠅⣿⣿⣿⡿⣳⣌⠪⡪⣡⢑⢝⣇ ⡆⣿⣿⣦⠹⣳⣳⣕⢅⠈⢗⢕⢕⢕⢕⢕⢈⢆⠟⠋⠉⠁⠉⠉⠁⠈⠼⢐⢕⢽ ⡗⢰⣶⣶⣦⣝⢝⢕⢕⠅⡆⢕⢕⢕⢕⢕⣴⠏⣠& #10358;⠛⡉⡉⡛⢶⣦⡀⠐⣕⢕ ⡝⡄⢻⢟⣿⣿⣷⣕⣕⣅⣿⣔⣕⣵⣵⣿⣿⢠⣿⢠⣮⡈⣌⠨⠅⠹⣷⡀⢱⢕ ⡝⡵⠟⠈⢀⣀⣀⡀⠉⢿⣿⣿⣿⣿⣿⣿⣿⣼⣿⢈⡋⠴⢿⡟⣡⡇⣿⡇⡀⢕ ⡝⠁⣠⣾⠟⡉⡉⡉⠻⣦⣻⣿⣿⣿⣿⣿⣿⣿⣿⣧⠸⣿⣦⣥⣿⡇⡿⣰⢗⢄ ⠁⢰⣿⡏⣴⣌⠈⣌⠡⠈⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿&# 10495;⣬⣉⣉⣁⣄⢖⢕⢕⢕ ⡀⢻⣿⡇⢙⠁⠴⢿⡟⣡⡆⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣵⣵⣿ ⡻⣄⣻⣿⣌⠘⢿⣷⣥⣿⠇⣿⣿⣿⣿⣿⣿⠛⠻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿ ⣷⢄⠻⣿⣟⠿⠦⠍⠉⣡⣾⣿⣿⣿⣿⣿⣿⢸⣿⣦⠙⣿⣿⣿⣿⣿⣿⣿⣿⠟ ⡕⡑⣑⣈⣻⢗⢟⢞⢝⣻⣿⣿⣿⣿⣿⣿⣿⠸⣿⠿⠃ 0495;⣿⣿⣿⣿⣿⡿⠁⣠ ⡝⡵⡈⢟⢕⢕⢕⢕⣵⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣶⣿⣿⣿⣿⣿⠿⠋⣀⣈⠙ ⡝⡵⡕⡀⠑⠳⠿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠛⢉⡠⡲⡫⡪⡪⡣Convert shellcode into ✨ different ✨ formats!Written by: ~ Mez0 ~ Michael Ranaldousage: Bluffy -h -b -o -moptional arguments: -h, --help show this help message and exit -b , --bin Specify bin file to load -m , --mask Specify the mask for the shellcode -x , --xor XOR the payload -p , --preview Preview the created format -pp, --payload_preview Preview the payload prior to C formatting --list List all the available masks Written by: Michael Ranaldo Mez0 Requirements and installation The following items must be installed prior to using Bluff: python3.9 or greater: sudo apt install python3.9 rich: sudo pip3 install rich pcre2.8: Depending on whether its going to be ran on Kali, Ubuntu 18, 19, 20, and so on, the process of getting and building with pcre2.8 may be different. For us on Ubuntu, it was developed on: $ lsb_release -aNo LSB modules are available.Distributor ID: UbuntuDescription: Ubuntu 21.04Release: 21.04Codename: hirsute In order to link libpcre2-8.a, the .a file had to be included within: /usr/lib/gcc/x86_64-w64-mingw32/10-win32 As for obtaining the header and lib files, MSYS2 was used. But if you're smarter than us, then just do it from source for Mingw64: https://pcre.org/. The simplest way to thus acquire and install is to run the following commands (after double checking your architecture etc.): sudo apt install mingw-64sudo wget https://packages.msys2.org/package/mingw-w64-x86_64-pcre2?repo=mingw64 -P /usr/lib/gcc/x86_64-w64-mingw32/10-win32 Using Bluffy To build a payload, get your binary file. For this example, we used calc.bin, which just loads calc.exe as a proof of concept. As Bluffy only seeks to evade static analysis using steganography, by hiding the binary within an otherwise innocuous file, you will need to do further research to ensure that your payload also evades dynamic detection. Run bluffy, choosing a mask of your choice and providing your .bin file: python ./bluffy.py -b calc.bin -m css -x Check your payload, then build it. To build your payload, copy the .h file bluffy creates, rename it css.c, run make to build it to an executable, then test using the included examples directory: mv css.h examples/css/css.hcd examples/cssmake This will use the included "main.c" to build an Windows executable. Test this to confirm. If you have also used calc.bin, you should be greeted by a new Calc window opening. If so, congratulations! For more details on using Bluffy and a walkthrough of how it works and what the output looks like, check out our blog Here is a full example: Download Bluffy
Read more...

___________________________
@hacking_Attack
@Hacking_Video

UK could face cyberattacks as Ukraine tensions mount
https://www.reddit.com/r/Pentesting/comments/sh0zv8/uk_could_face_cyberattacks_as_ukraine_tensions/

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/noahthearc333 (https://www.reddit.com/user/noahthearc333)
[link] (http://www.digit.fyi/uk-could-face-cyberattacks-as-ukraine-tensions-mount/) [comments] (https://www.reddit.com/r/Pentesting/comments/sh0zv8/uk_could_face_cyberattacks_as_ukraine_tensions/)

___________________________
@hacking_Attack
@Hacking_Video

Most Common StartupCybersecurity Myths
https://www.reddit.com/r/Pentesting/comments/sh12j3/most_common_startupcybersecurity_myths/

https://silentbreach.com/BlogArticles/most-common-startup-cybersecurity-myths/ submitted by /u/Potential-Jaguar-223 (https://www.reddit.com/user/Potential-Jaguar-223)
[link] (https://www.reddit.com/r/Pentesting/comments/sh12j3/most_common_startupcybersecurity_myths/) [comments] (https://www.reddit.com/r/Pentesting/comments/sh12j3/most_common_startupcybersecurity_myths/)

___________________________
@hacking_Attack
@Hacking_Video

No clue where to Start Learning
https://www.reddit.com/r/Pentesting/comments/sh4zxp/no_clue_where_to_start_learning/

So I am not sure if this is the right place for this post. But I am looking to get involved with penetration testing based on a recommendation of a friend who does it for fun/hobby. He walked me though it and it has grabbed my attention. I was also told to find something that I can dive into and and learn as it would be good for my mental health by my therapist as I suffer from depression Anxiety and PTSD. from what my friend and I talked about and doing a shallow dive into the world. There is SO MUCH to learn and I have no clue where to start. I found HTB which is super cool and I was able to find my way in with a few vague tips here and there but loved that little bit and have started working on some CTF but I am just slamming my head agents a wall. So I want to start learning learning but being how vast and huge this world is I don't know where to start. Does any one have like a road map of some basics that I should learn first. If you have read this far thanks and hope you are having a great day. submitted by /u/204incs (https://www.reddit.com/user/204incs)
[link] (https://www.reddit.com/r/Pentesting/comments/sh4zxp/no_clue_where_to_start_learning/) [comments] (https://www.reddit.com/r/Pentesting/comments/sh4zxp/no_clue_where_to_start_learning/)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
HackTool.Win32.Muzzer.a Buffer Overflow

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
OpenStego Free Steganography Solution 0.8.3

https://4.bp.blogspot.com/-sHG2jViTb-c/WWlvSCf2XfI/AAAAAAAAINY/YxfxwjOK_o05QB9TpuqqysTdHaIb3yf8wCLcBGAs/s1600/h36.png
OpenStego is a tool implemented in Java for generic steganography, with support for password-based encryption of the data. It supports plugins for various steganographic algorithms (currently, only Least Significant Bit algorithm is supported for images).

MD5 | c457b2a7ed227841dc492a2b4a356442

Download
Source:packetstormsecurity.com
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video