KitPloit - PenTest Tools!
openSquat - Detection Of Phishing Domains And Domain Squatting. Supports Permutations Such As Homograph Attack, Typosquatting And Bitsquatting

http://3.bp.blogspot.com/-U9azAjP77Ok/Yd2Ztzy0E6I/AAAAAAAA8v4/J2M6j6u5GGs2ExnqWyQuohFiO78iR15NQCK4BGAYYCw/w640-h221/opensquat_1_openSquat_logo-759121.png What is openSquatopenSquat is an opensource Intelligence (OSINT) security tool to identify cyber squatting threats to specific companies or domains, such as:

* Phishing campaigns
* Domain squatting
* Typo squatting
* Bitsquatting
* IDN homograph attacks
* Doppenganger domains
* Other brand/domain related scams

It does support some key features such as:

* Automatic newly registered domain updating (once a day)
* Levenshtein distance to calculate word similarity
* Fetches active and known phishing domains (Phishing Database project)
* IDN homograph attack detection
* Integration with VirusTotal
* Integration with Quad9 DNS service
* Use different levels of confidence threshold to fine tune
* Save output into different formats (txt, JSON and CSV)
* Can be integrated with other threat intelligence tools and DNS sinkholes

This is an opensource project so everyone's welcomed to contribute. Screenshot / Video Demohttp://1.bp.blogspot.com/-gW6FJifXP3k/Yd2ZuZ2Y9sI/AAAAAAAA8wA/uHlCwmgDTgs5fJibmHlV7aDy0OzYAu1iQCK4BGAYYCw/w640-h514/opensquat_2_openSquat-760624.png Check the 40 seconds Demo Video (v1.95) Demo / Forks* Phishy Domains for a simple web version of the openSquat.
* openSquat Bot for a simple Telegram bot.

Note: Both forks do not contain all openSquat features. How to Installgit clone https://github.com/atenreiro/opensquat
pip install -r requirements.txtMake sure you have Python 3.6+ and pip3 in your environment How to UpdateTo update your current version, just type the following commands inside the openSquat directory: git pull
pip install -r requirements.txtThe "pip install" is just to make sure no new libs were added with the new upgrade. Usage ExamplesEdit the "keywords.txt" with your customised keywords to hunt.

certificate transparency (ct) hunt python opensquat.py --ct # Period search - registrations from the last month (default: day) python opensquat.py -p month # Tweak confidence level. The lower values bring more false positives # (0: very high, 1: high (default), 2: medium, 3: low, 4: very low python opensquat.py -c 2 # All validations options python opensquat.py --phishing phishing_domains.txt --dns --ct --subdomains --portcheck "># Lazy run with default options
python opensquat.py

# for all the options
python opensquat.py -h

# Search for generic terms used in phishing campaigns (can lead to false positives)
python opensquat.py -k generic.txt

# With DNS validation (quad9)
python opensquat.py --dns

# Subdomain search
python opensquat.py --subdomains

# Check for domains with open ports 80/443
python opensquat.py --portcheck

# With Phishing validation (Phishing Database)
python opensquat.py --phishing phish_results.txt

# Save output as JSON
python opensquat.py -o example.json -t json

# Save output as CSV
python opensquat.py -o example.csv -t csv

# Conduct a certificate transparency (ct) hunt
python opensquat.py --ct

# Period search - registrations from the last month (default: day)
python opensquat.py -p month

# Tweak confidence level. The lower values bring more false positives
# (0: very high, 1: high (default), 2: medium, 3: low, 4: very low
python opensquat.py -c 2

# All validations options
python opensquat.py --phishing phishing_domains.txt --dns --ct --subdomains --portcheck To Do / Roadmap* Integration with VirusTotal (VT) for subdomains validation
* Integratration with[...]

___________________________
@hacking_Attack
@Hacking_Video

VirusTotal (VT) for malware detection
* Use certificate transparency
* Homograph detection done
* Improve code quality from B to A grade (codacy)
* PEP8 compliance
* AND logical condition for keywords search (e.g: goole+login) - Thanks to Steff T.
* Add documentation Feature RequestTo request for a new feature, create a "new issue" and describe the feature and potential use cases. If something similar already exists, you can upvote the "issue" and contribute to the discussions. Changelog* Check the CHANGELOG file. AuthorsProject founder

* Andre Tenreiro (LinkedInk)
* andre@cert.mz

Contributors

* Please check the contributors page on GitHub How to helpYou can help this project in many ways:

* Providing your time and coding skills to enhance the project
* Build a decent but simple project webpage
* Provide access to OSINT feeds
* Open new issues with new suggestions, ideas, bug report or feature requests
* Spread this project within your network
* Share your story how have you been using the openSquat and what impact it brought to you
* Make a project logo Download Opensquat

___________________________
@hacking_Attack
@Hacking_Video

Pentest-tool: Simple and secure web deployment for pentest and redteam with simwigo
https://www.reddit.com/r/Pentesting/comments/t1bzvd/pentesttool_simple_and_secure_web_deployment_for/

Simwigo (https://github.com/8iche/simwigo/) is a cross-plateform tool, written in Go, that allows you to quickly deploy a secure web service (with a nice and neat display:)). It was created to replace the use of tools such as SimpleHTTPServer and http.server from python. It implements additional features allowing easy file exchange. It can be used for a pentest or a redteam, as well as for personal use. An API token authentication, a white list system, and the use of TLS (automatic deployment via Let's Encrypt (https://letsencrypt.org/)) are integrated and increase the security of the service. Check out the latest release: https://github.com/8iche/simwigo/ submitted by /u/B1che (https://www.reddit.com/user/B1che)
[link] (https://www.reddit.com/r/Pentesting/comments/t1bzvd/pentesttool_simple_and_secure_web_deployment_for/) [comments] (https://www.reddit.com/r/Pentesting/comments/t1bzvd/pentesttool_simple_and_secure_web_deployment_for/)

___________________________
@hacking_Attack
@Hacking_Video

openSquat - Detection Of Phishing Domains And Domain Squatting. Supports Permutations Such As Homograph Attack, Typosquatting And Bitsquatting
http://www.kitploit.com/2022/02/opensquat-detection-of-phishing-domains.html

___________________________
@hacking_Attack
@Hacking_Video

What is openSquat openSquat is an opensource Intelligence (https://www.kitploit.com/search/label/Intelligence) (OSINT) security tool to identify cyber squatting threats to specific companies or domains, such as: Phishing campaigns Domain squatting Typo squatting Bitsquatting IDN homograph attacks Doppenganger domains Other brand/domain related scams It does support some key features such as: Automatic newly registered domain updating (once a day) Levenshtein distance to calculate word similarity Fetches active and known phishing domains (Phishing Database project) IDN homograph attack detection Integration with VirusTotal Integration with Quad9 DNS service Use different levels of confidence threshold to fine tune Save output into different formats (txt, JSON and CSV) Can be integrated with other threat intelligence (https://www.kitploit.com/search/label/Threat%20Intelligence) tools and DNS sinkholes This is an opensource project so everyone's welcomed to contribute.
Screenshot / Video Demo

___________________________
@hacking_Attack
@Hacking_Video

Check the 40 seconds Demo Video (https://asciinema.org/a/361931) (v1.95) Demo / Forks Phishy Domains (https://phishydomains.com/) for a simple web version of the openSquat. openSquat Bot (https://telegram.me/opensquat_bot) for a simple Telegram bot. Note: Both forks do not contain all openSquat features. How to Install git clone https://github.com/atenreiro/opensquat
pip install -r requirements.txt Make sure you have Python 3.6+ and pip3 in your environment How to Update To update your current version, just type the following commands inside the openSquat directory: git pull
pip install -r requirements.txt The "pip install" is just to make sure no new libs were added with the new upgrade. Usage Examples Edit the "keywords.txt" with your customised keywords to hunt. certificate transparency (ct) hunt python opensquat.py --ct # Period search - registrations from the last month (default: day) python opensquat.py -p month # Tweak confidence level. The lower values bring more false positives # (0: very high, 1: high (default), 2: medium, 3: low, 4: very low python opensquat.py -c 2 # All validations options python opensquat.py --phishing phishing_domains.txt --dns --ct --subdomains --portcheck "> # Lazy run with default options
python opensquat.py

# for all the options
python opensquat.py -h

# Search for generic terms used in phishing campaigns (can lead to false positives)
python opensquat.py -k generic.txt

# With DNS validation (quad9)
python opensquat.py --dns

# Subdomain search
python opensquat.py --subdomains

# Check for domains with open ports 80/443
python opensquat.py --portcheck

# With Phishing validation (Phishing Database)
python opensquat.py --phishing phish_results.txt

# Save output as JSON
python opensquat.py -o example.json -t json

# Save output as CSV
python opensquat.py -o example.csv -t csv

# Conduct a certificate transparency (https://www.kitploit.com/sea%20%20%20rch/label/Transparency) (ct) hunt
python opensquat.py --ct

# Period search - registrations from the last month (default: day)
python opensquat.py -p month

# Tweak confidence level. The lower values bring more false positives
# (0: very high, 1: high (default), 2: medium, 3: low, 4: very low
python opensquat.py -c 2

# All validations options
python opensquat.py --phishing phishing_domains.txt --dns --ct --subdomains --portcheck To Do / Roadmap Integration with VirusTotal (VT) for subdomains validation Integratration with VirusTotal (VT) for malware detection Use certificate transparency Homograph detection done Improve code quality (https://www.kitploit.com/search/label/Code%20Quality) from B to A grade (codacy) PEP8 compliance AND logical condition for keywords search (e.g: goole+login) - Thanks to Steff T. Add documentation Feature Request To request for a new feature, create a "new issue" and describe the feature and potential use cases. If something similar already exists, you can upvote the "issue" and contribute to the discussions. Changelog Check the CHANGELOG (https://github.com/atenreiro/opensquat/blob/master/CHANGELOG) file. Authors Project founder Andre Tenreiro (LinkedInk) (https://www.linkedin.com/in/andretenreiro/) andre@cert.mz (mailto:andre@cert.mz) Contributors Please check the contributors page on GitHub How to help You can help this project in many ways: Providing your time and coding skills to enhance the project Build a decent but simple project webpage (https://opensquat.com/) Provide access to OSINT feeds Open new issues with new suggestions, ideas, bug report or feature requests Spread this project within your network Share your story how have you been using the openSquat and what impact it brought to you Make a project logo

___________________________
@hacking_Attack
@Hacking_Video

Download Opensquat (https://github.com/atenreiro/opensquat)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Dahua ToolBox 1.010.0000000.0 DLL Hijacking

https://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png
Dahua ToolBox version 1.010.0000000.0 suffers from a dll hijacking vulnerability.

MD5 | 2242bfd27631e5e2136fd12407074fad

Download
Hi all,

I have actually contacted Dahua PSIRT team and they confirmed the
vulnerability exists few days ago but then since this product is not in
that scope on requesting CVE and therefore I am going to disclose the
details here:

Vulnerable Software and Version:
ToolBox-V1.010.0000000.0 (versions prior to this are probably vulnerable
but just tested against V1.010.0000000.0)

Vulnerable software download link:
https://www.dahuasecurity.com/support/downloadCenter/tools/MaintenanceTools

Date reported to Dahua:
20 Feb 2022

Date of issue acknowledgement and finding validated from Dahua PSIRT team:
22 Feb 2022

Description:
The ToolBox-V1.010.0000000.0 is suffering from DLL hijacking which allows
arbitrary code execution and even privilege escalation when a malcious dll
name as "DHLog.dll" is dropped to followng folders during my research, PE
could be achieved since the exeutable has to be run with administrator
privilege by design.

Attack vector:
A malicious x86 dll named as "DHLog.dll" has to be dropped in ANY of the
following folders, which depends on what softwares have been installed in
the target windows machine

1. C:\Users\User\AppData\Local\Microsoft\WindowsApps (*Pre-installed in
every windows)
2. C:\Users\User\AppData\Local\Programs\Python\Python38\Scripts (Only
Applicable when users have installed python in their windows machine)
3. C:\Users\User\AppData\Local\Programs\Python\Python38\ (Only
Applicable when users have installed python in their windows machine)

PoC code of dll can be found in this repository

Attack steps:

1. Craft and drop a malicious DLL named as "DHLog.dll" with entry point
DllMain
2. Double click the executable "ToolBox", administrator privilege is
required to run
3. Malicious DLL has been called and an admin shell can be obtained as
PoC
4. [image: image]

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Photoswipe Masonry Gallery 1.2.14 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Technitium Installer 4.4 DLL Hijacking

https://3.bp.blogspot.com/-00fiGlDHfKo/WWlvZ5odqlI/AAAAAAAAIO4/nnZp17OtkHAWqiO0pbFBQSys2U4_yu8pACLcBGAs/s1600/h7.png
Technitium Installer version 4.4 suffers from a dll hijacking vulnerability.

MD5 | f364dd8a6ca3259170dfee9c857c8d09

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Bank Management System 1.0 SQL Injection

https://2.bp.blogspot.com/-QZ2Sf2sxziM/WWlvZhEG73I/AAAAAAAAIO0/d0s8s4TXkHwnfXzbpubNEBqDxa568NQgwCLcBGAs/s1600/h60.png
Bank Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | a1b518f4ff9226b46978f92199b94421

Download
# Title: Bank Management System - MCB Bank v1.0 - SQLi
# Author: nu11secur1ty
# Date: 02.25.2022
# Vendor: https://www.campcodes.com/projects/php/ by:Tariq Fareeds
# Software: https://www.campcodes.com/projects/php/bank-management-system-in-php-mysql-free-download/
# Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/edit/main/vendors/campcodes.com/Bank-Management-System
## Description:
The email parameter from Bank Management System - MCB Bank v1.0
appears to be vulnerable to SQL injection attacks.
The payloads 30735302' or 9098=9098-- and 41995976' or 3071=3078--
were each submitted in the email parameter.
These two requests resulted in different responses, indicating that
the input is being incorporated into a SQL query in an unsafe way
WARNING: If this is in some external domain, or some subdomain
redirection, or internal whatever, this will be extremely dangerous!
Status: CRITICAL
[+] Payloads:

```mysql
---
Parameter: email (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: email=-9337' OR 4870=4870-- Cgzq&password=q7A!t8j!H2&cashierLogin=
---

```
## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/edit/main/vendors/campcodes.com/Bank-Management-System)

## Proof and Exploit:
[href](https://streamable.com/hvaaiu)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Microsoft Exchange Server Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Ukrainian Troops Targeted in Phishing Attacks by Suspected Belarusian APT

Ukraine's Computer Emergency Response Team calls out UNIC1151 nation-state hacking group out of Belarus as behind the attacks.