Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Hack The Box — Sense: Walkthrough (without Metasploit)
https://cdn-images-1.medium.com/max/600/1*a8WmUHy4QZ8m_bvx17L0Mw.png
Hack The Box — Sense: Walkthrough (without Metasploit) | Road to OSCP | Linux Easy Level | Web enumeration | Security Misconfiguration |…
Continue reading on Medium »
Hack The Box — Sense: Walkthrough (without Metasploit)
https://cdn-images-1.medium.com/max/600/1*a8WmUHy4QZ8m_bvx17L0Mw.png
Hack The Box — Sense: Walkthrough (without Metasploit) | Road to OSCP | Linux Easy Level | Web enumeration | Security Misconfiguration |…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Falsas ofertas de trabajo en Linkedin propagan malware.
https://cdn-images-1.medium.com/max/852/0*KUCHOHg0DL6scILy
PUBLICADO EN 12 ABRIL, 2021 POR EHACKING
Continue reading on Medium »
Falsas ofertas de trabajo en Linkedin propagan malware.
https://cdn-images-1.medium.com/max/852/0*KUCHOHg0DL6scILy
PUBLICADO EN 12 ABRIL, 2021 POR EHACKING
Continue reading on Medium »
Dwn - D(Ockerp)Wn - A Docker Pwn Tool Manager
http://www.kitploit.com/2021/04/dwn-dockerpwn-docker-pwn-tool-manager.html
http://www.kitploit.com/2021/04/dwn-dockerpwn-docker-pwn-tool-manager.html
dwn is a "docker-compose for hackers". Using a simple YAML "plan" format similar to docker-compose, image names, versions and volume / port mappings are defined to setup a tool for use.
features
With dwn you can: Configure common pentest tools for use in a docker container Have context aware volume mounts Dynamically modify port bindings without container (https://www.kitploit.com/search/label/Container) restarts And more!
installation
Simply run pip3 install dwn.
usage
dwn is actually really simple. The primary concept is that of "plans" where information about a tool (such as name, version, mounts and binds) are defined. There are a few built-in plans (https://github.com/sensepost/dwn/blob/master/plans) already available, but you can also roll your own. Without arguments, just running dwn would look like this. ❯ dwn
Usage: dwn [OPTIONS] COMMAND [ARGS]...
__
___/ / _____
/ _ / |/|/ / _ \
\_,_/|__,__/_//_/
docker pwn tool manager
by @leonjza / @sensepost
Options:
--debug enable debug logging
--help Show this message and exit.
Commands:
check Check plans and Docker environment
network Work with networks
plans Work with plans
run Run a plan
show Show running plans
stop Stop a plan
To list the available plans, run dwn plans show. ❯ dwn plans show
dwn plans
┏━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ name ┃ path ┃
┡━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ sqlmap │ /tools/dwn/plans/sqlmap.yml │
│ wpscan │ /tools/dwn/plans/wpscan.yml │
│ gowitness-report │ /tools/dwn/plans/gowitness-report.yml │
│ msfconsole │ /tools/dwn/plans/msfconsole.yml │
│ gowitness │ /tools/dwn/plans/gowitness.yml │
│ nginx │ /tools/dwn/plans/nginx.yml │
│ cme │ /tools/dwn/plans/cme.yml │
│ netcat-reverse │ /tools/dwn/plans/netcat-reverse.yml │
│ semgrep-sec │ /tools/dwn/plans/semgrep-sec.yml │
│ semgrep-ci │ ~/.dwn/plans/semgrep-ci.yml │
│ neo4j │ ~/.dwn/plans/neo4j.yml │
└──────────────────┴───────────────────────────────────────┘
11 plans
To run a plan such as gowitness screenshotting https://google.com (https://google.com/), run dwn run gowitness --disable-db single https://www.google.com. This plan will exit when done, so you don’t have to dwn stop gowitness. ❯ dwn run gowitness --disable-db single https://www.google.com
(i) found plan for gowitness
(i) volume: ~/scratch -> /data
(i) streaming container logs
08 Feb 2021 10:46:18 INF preflight result statuscode=200 title=Google url=https://www.google.com
❯
❯ ls screenshots
https-www.google.com.png
A plan such as netcat-reverse however will stay alive. You can connect to the plans TTY after it is started to interact with any shells you may receive. Example usage would be: ❯ dwn run netcat-reverse
(i) found plan for netcat-reverse
(i) port: 4444<-4444
(i) container booted! attach & detach commands are:
(i) attach: docker attach dwn_wghz_netcat-reverse
(i) detach: ctrl + p, ctrl + q
Attaching to the plan (and executing nc -e somewhere else) ❯ docker attach dwn_wghz_netcat-reverse
connect to [::ffff:172.19.0.2]:4444 from dwn_wghz_netcat-reverse_net_4444_4444.dwn:46318 ([::ffff:172.19.0.3]:46318)
env | grep -i shell
SHELL=/bin/zsh
read escape sequence
You can get a running plan report too ❯ dwn show
running plan report
┏━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━┓
┃ plan ┃ container(s) ┃ port(s) ┃ volume(s) ┃
┡━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━┩
│ netcat-reverse │ dwn_wghz_netcat-reverse_net_4444_4444 │ 4444<-4444 │ │
features
With dwn you can: Configure common pentest tools for use in a docker container Have context aware volume mounts Dynamically modify port bindings without container (https://www.kitploit.com/search/label/Container) restarts And more!
installation
Simply run pip3 install dwn.
usage
dwn is actually really simple. The primary concept is that of "plans" where information about a tool (such as name, version, mounts and binds) are defined. There are a few built-in plans (https://github.com/sensepost/dwn/blob/master/plans) already available, but you can also roll your own. Without arguments, just running dwn would look like this. ❯ dwn
Usage: dwn [OPTIONS] COMMAND [ARGS]...
__
___/ / _____
/ _ / |/|/ / _ \
\_,_/|__,__/_//_/
docker pwn tool manager
by @leonjza / @sensepost
Options:
--debug enable debug logging
--help Show this message and exit.
Commands:
check Check plans and Docker environment
network Work with networks
plans Work with plans
run Run a plan
show Show running plans
stop Stop a plan
To list the available plans, run dwn plans show. ❯ dwn plans show
dwn plans
┏━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ name ┃ path ┃
┡━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ sqlmap │ /tools/dwn/plans/sqlmap.yml │
│ wpscan │ /tools/dwn/plans/wpscan.yml │
│ gowitness-report │ /tools/dwn/plans/gowitness-report.yml │
│ msfconsole │ /tools/dwn/plans/msfconsole.yml │
│ gowitness │ /tools/dwn/plans/gowitness.yml │
│ nginx │ /tools/dwn/plans/nginx.yml │
│ cme │ /tools/dwn/plans/cme.yml │
│ netcat-reverse │ /tools/dwn/plans/netcat-reverse.yml │
│ semgrep-sec │ /tools/dwn/plans/semgrep-sec.yml │
│ semgrep-ci │ ~/.dwn/plans/semgrep-ci.yml │
│ neo4j │ ~/.dwn/plans/neo4j.yml │
└──────────────────┴───────────────────────────────────────┘
11 plans
To run a plan such as gowitness screenshotting https://google.com (https://google.com/), run dwn run gowitness --disable-db single https://www.google.com. This plan will exit when done, so you don’t have to dwn stop gowitness. ❯ dwn run gowitness --disable-db single https://www.google.com
(i) found plan for gowitness
(i) volume: ~/scratch -> /data
(i) streaming container logs
08 Feb 2021 10:46:18 INF preflight result statuscode=200 title=Google url=https://www.google.com
❯
❯ ls screenshots
https-www.google.com.png
A plan such as netcat-reverse however will stay alive. You can connect to the plans TTY after it is started to interact with any shells you may receive. Example usage would be: ❯ dwn run netcat-reverse
(i) found plan for netcat-reverse
(i) port: 4444<-4444
(i) container booted! attach & detach commands are:
(i) attach: docker attach dwn_wghz_netcat-reverse
(i) detach: ctrl + p, ctrl + q
Attaching to the plan (and executing nc -e somewhere else) ❯ docker attach dwn_wghz_netcat-reverse
connect to [::ffff:172.19.0.2]:4444 from dwn_wghz_netcat-reverse_net_4444_4444.dwn:46318 ([::ffff:172.19.0.3]:46318)
env | grep -i shell
SHELL=/bin/zsh
read escape sequence
You can get a running plan report too ❯ dwn show
running plan report
┏━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━┓
┃ plan ┃ container(s) ┃ port(s) ┃ volume(s) ┃
┡━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━┩
│ netcat-reverse │ dwn_wghz_netcat-reverse_net_4444_4444 │ 4444<-4444 │ │
│ │ dwn_wghz_netcat-reverse │ │ │
└────────────────┴───────────────────────────────────────┴────────────┴───────────┘
And finally, stop a plan. ❯ dwn stop netcat-reverse -y
(i) stopping 2 containers for plan netcat-reverse
networking
dwn lets you dynamically map ports to plans without any container restarts. Networking (https://www.kitploit.com/search/label/Networking) commands live under the dwn network subcommand. Taking the nginx (https://github.com/sensepost/dwn/blob/master/plans/nginx.yml) plan as an example, we can add a port mapping dynamically. First, start the nginx plan. ❯ dwn run nginx
(i) found plan for nginx
(i) volume: ~/scratch -> /usr/share/nginx/html
(i) port: 80<-8888
(i) container dwn_wghz_nginx started for plan nginx, detaching
Next, test the communication with cURL ❯ curl localhost:8888/poo.txt
haha, you touched it!
❯ curl localhost:9000/poo.txt
curl: (7) Failed to connect to localhost port 9000: Connection refused
Port 9000 is not open, so let's add a new port binding and test connectivity ❯ dwn network add nginx -i 80 -o 9000
(i) port binding for 9000->nginx:80 created
❯
❯ curl localhost:9000/poo.txt
haha, you touched it!
updating plans
The dwn plans pull command can be used to update the images defined in plans. To only update a single plan, add the plan name after pull. Eg: dwn plans pull nginx.
writing plans
A dwn plans new command exists to quickly scaffold a new plan. While only a few options are needed to get a plan up and running, all of the options that exist in the Python Docker SDK for the run (https://docker-py.readthedocs.io/en/stable/containers.html#docker.models.containers.ContainerCollection.run) call are valid tags that can be used.
Download Dwn (https://github.com/sensepost/dwn)
└────────────────┴───────────────────────────────────────┴────────────┴───────────┘
And finally, stop a plan. ❯ dwn stop netcat-reverse -y
(i) stopping 2 containers for plan netcat-reverse
networking
dwn lets you dynamically map ports to plans without any container restarts. Networking (https://www.kitploit.com/search/label/Networking) commands live under the dwn network subcommand. Taking the nginx (https://github.com/sensepost/dwn/blob/master/plans/nginx.yml) plan as an example, we can add a port mapping dynamically. First, start the nginx plan. ❯ dwn run nginx
(i) found plan for nginx
(i) volume: ~/scratch -> /usr/share/nginx/html
(i) port: 80<-8888
(i) container dwn_wghz_nginx started for plan nginx, detaching
Next, test the communication with cURL ❯ curl localhost:8888/poo.txt
haha, you touched it!
❯ curl localhost:9000/poo.txt
curl: (7) Failed to connect to localhost port 9000: Connection refused
Port 9000 is not open, so let's add a new port binding and test connectivity ❯ dwn network add nginx -i 80 -o 9000
(i) port binding for 9000->nginx:80 created
❯
❯ curl localhost:9000/poo.txt
haha, you touched it!
updating plans
The dwn plans pull command can be used to update the images defined in plans. To only update a single plan, add the plan name after pull. Eg: dwn plans pull nginx.
writing plans
A dwn plans new command exists to quickly scaffold a new plan. While only a few options are needed to get a plan up and running, all of the options that exist in the Python Docker SDK for the run (https://docker-py.readthedocs.io/en/stable/containers.html#docker.models.containers.ContainerCollection.run) call are valid tags that can be used.
Download Dwn (https://github.com/sensepost/dwn)
Deep Web
Trying to explore the deep web. I am new.
Hi, I have a MacBook Pro but I was told that MacBooks are not that secure. I am not tryna get hacked or something at all. Not just on the deep web but I want to be as secure as possible on tor. I've heard about tails, VM's, VPN's, and the such. What is the best way to be completely invisible whilst on the deep web or surface net.
submitted by /u/Clikkks
[link] [comments]
Trying to explore the deep web. I am new.
Hi, I have a MacBook Pro but I was told that MacBooks are not that secure. I am not tryna get hacked or something at all. Not just on the deep web but I want to be as secure as possible on tor. I've heard about tails, VM's, VPN's, and the such. What is the best way to be completely invisible whilst on the deep web or surface net.
submitted by /u/Clikkks
[link] [comments]
reddit
Trying to explore the deep web. I am new.
Hi, I have a MacBook Pro but I was told that MacBooks are not that secure. I am not tryna get hacked or something at all. Not just on the deep web...
hacking: security in practice
Is cox giving me free wifi
Hey guys, I'm scheduled to get cox internet installed tomorrow in this apt complex i just moved in, since Friday just messing around noticed there was no password required wifi in my phone network and they are from cox, when you connect it just takes you to a page to agree their terms and your in , you get a solid 15mbps I live alone so that's all I need, modem is off and unplugged, what gives?, Should I cancel my internet hook up for tomorrow 😁
submitted by /u/Sajor1975
[link] [comments]
Is cox giving me free wifi
Hey guys, I'm scheduled to get cox internet installed tomorrow in this apt complex i just moved in, since Friday just messing around noticed there was no password required wifi in my phone network and they are from cox, when you connect it just takes you to a page to agree their terms and your in , you get a solid 15mbps I live alone so that's all I need, modem is off and unplugged, what gives?, Should I cancel my internet hook up for tomorrow 😁
submitted by /u/Sajor1975
[link] [comments]
reddit
Is cox giving me free wifi
Hey guys, I'm scheduled to get cox internet installed tomorrow in this apt complex i just moved in, since Friday just messing around noticed there...
hacking: security in practice
Firewall IP/port based ?
If I am to block outgoing connections in a server firewall, should it be better done with IP or port? If I understand this correctly, we use IP addresses, we would need to create a whitelist of IPs (from/to) that is connected but that I think that would become complicated quickly without central administration. If use ports, how to decide upon random (source) ports as they can be anything for given connection.
submitted by /u/Harry_pentest
[link] [comments]
Firewall IP/port based ?
If I am to block outgoing connections in a server firewall, should it be better done with IP or port? If I understand this correctly, we use IP addresses, we would need to create a whitelist of IPs (from/to) that is connected but that I think that would become complicated quickly without central administration. If use ports, how to decide upon random (source) ports as they can be anything for given connection.
submitted by /u/Harry_pentest
[link] [comments]
reddit
Firewall IP/port based ?
If I am to block outgoing connections in a server firewall, should it be better done with IP or port? If I understand this correctly, we use IP...
Analysing JavaScript Files For Bug Bounty Hunters
What is JS even?Continue reading on Medium »
Read more...
What is JS even?Continue reading on Medium »
Read more...
Analysing JavaScript Files For Bug Bounty Hunters
https://thexssrat.medium.com/analysing-javascript-files-for-bug-bounty-hunters-71e2727abebe?source=rss------bug_bounty-5
https://thexssrat.medium.com/analysing-javascript-files-for-bug-bounty-hunters-71e2727abebe?source=rss------bug_bounty-5
What is JS even?Continue reading on Medium » (https://thexssrat.medium.com/analysing-javascript-files-for-bug-bounty-hunters-71e2727abebe?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
HTB — Devel (without Metasploit)
https://cdn-images-1.medium.com/max/600/1*cWTDLAfcw0sNl8EubK0Cdg.png
This is an easy Windows box released back in March 2017, we’re going to own this box without the use of Metasploit.
Continue reading on Medium »
HTB — Devel (without Metasploit)
https://cdn-images-1.medium.com/max/600/1*cWTDLAfcw0sNl8EubK0Cdg.png
This is an easy Windows box released back in March 2017, we’re going to own this box without the use of Metasploit.
Continue reading on Medium »