array whose first element is the protocol, and the second element is an IP:PORT string of the upstream proxy server that Cloak will forward the traffic to. Example: {
"ProxyBook": {
"shadowsocks": [
"tcp",
"localhost:51443"
],
"openvpn": [
"tcp",
"localhost:12345"
]
}
} PrivateKey is the static curve25519 Diffie-Hellman private key encoded in base64. BypassUID is a list of UIDs that are authorised without any bandwidth or credit limit restrictions AdminUID is the UID of the admin user in base64. You can leave this empty if you only ever add users to BypassUID. DatabasePath is the path to userinfo.db, which is used to store user usage information and restrictions. Cloak will create the file automatically if it doesn't exist. You can leave this empty if you only ever add users to BypassUID. This field also has no effect if AdminUID isn't a valid UID or is empty. KeepAlive is the number of seconds to tell the OS to wait after no activity before sending TCP KeepAlive probes to the upstream proxy server. Zero or negative value disables it. Default is 0 (disabled). Client UID is your UID in base64. Transport can be either direct or CDN. If the server host wishes you to connect to it directly, use direct. If instead a CDN is used, use CDN. PublicKey is the static curve25519 public key in base64, given by the server admin. ProxyMethod is the name of the proxy method you are using. This must match one of the entries in the server's ProxyBook exactly. EncryptionMethod is the name of the encryption (https://www.kitploit.com/search/label/Encryption) algorithm you want Cloak to use. Options are plain, aes-256-gcm ( synonymous to aes-gcm), aes-128-gcm, and chacha20-poly1305. Note: Cloak isn't intended to provide transport security. The point of encryption is to hide fingerprints of proxy protocols and render the payload statistically random-like. You may only leave it as plain if you are certain that your underlying proxy tool already provides BOTH encryption and authentication (https://www.kitploit.com/search/label/Authentication) (via AEAD or similar techniques). ServerName is the domain you want to make your ISP or firewall think you are visiting. Ideally it should match RedirAddr in the server's configuration, a major site the censor allows, but it doesn't have to. AlternativeNames is an array used alongside ServerName to shuffle between different ServerNames for every new connection. This may conflict with CDN Transport mode if the CDN provider prohibits domain fronting (https://www.kitploit.com/search/label/Domain%20Fronting) and rejects the alternative domains. Example: {
"ServerName": "bing.com",
"AlternativeNames": ["cloudflare.com", "github.com"]
} CDNOriginHost is the domain name of the origin server (i.e. the server running Cloak) under CDN mode. This only has effect when Transport is set to CDN. If unset, it will default to the remote hostname supplied via the commandline argument (in standalone mode), or by Shadowsocks (in plugin mode). After a TLS session is established with the CDN server, this domain name will be used in the HTTP request to ask the CDN server to establish a WebSocket connection with this host. NumConn is the amount of underlying TCP connections you want to use. The default of 4 should be appropriate for most people. Setting it too high will hinder the performance. Setting it to 0 will disable connection multiplexing and each TCP connection will spawn a separate short-lived session that will be closed after it is terminated. This makes it behave like GoQuiet. This maybe useful for people with unstable connections. BrowserSig is the browser you want to appear to be using. It's not relevant to the browser you are actually using. Currently, chrome and firefox are supported. KeepAlive is the number of seconds to tell the OS to wait after no activity before sending TCP KeepAlive probes to the Cloak server. Zero or

negative value disables it. Default is 0 (disabled). Warning: Enabling it might make your server more detectable as a proxy, but it will make the Cloak client detect internet interruption more quickly. StreamTimeout is the number of seconds of Cloak waits for an incoming connection from a proxy program to send any data, after which the connection will be closed by Cloak. Cloak will not enforce any timeout on TCP connections after it is established. Setup Server Install at least one underlying proxy server (e.g. OpenVPN, Shadowsocks). Download the latest release (https://github.com/cbeuw/Cloak/releases) or clone and build this repo. Run ck-server -key. The public should be given to users, the private key should be kept secret. (Skip if you only want to add unrestricted users) Run ck-server -uid. The new UID will be used as AdminUID. Copy example_config/ckserver.json into a desired location. Change PrivateKey to the private key you just obtained; change AdminUID to the UID you just obtained. Configure your underlying proxy server so that they all listen on localhost. Edit ProxyBook in the configuration file accordingly Configure the proxy program. (https://github.com/cbeuw/Cloak/wiki/Underlying-proxy-configuration-guides) Run sudo ck-server -c . ck-server needs root privilege because it binds to a low numbered port (443). Alternatively you can follow https://superuser.com/a/892391 to avoid granting ck-server root privilege unnecessarily. To add users Unrestricted users Run ck-server -uid and add the UID into the BypassUID field in ckserver.json Users subject to bandwidth and credit controls First make sure you have AdminUID generated and set in ckserver.json, along with a path to userinfo.db in DatabasePath (Cloak will create this file for you if it didn't already exist). On your client, run ck-client -s -l -a -c to enter admin mode Visit https://cbeuw.github.io/Cloak-panel (Note: this is a pure-js static site, there is no backend and all data entered into this site are processed between your browser and the Cloak API endpoint you specified. Alternatively you can download the repo at https://github.com/cbeuw/Cloak-panel and open index.html in a browser. No web server is required). Type in 127.0.0.1: as the API Base, and click List. You can add in more users by clicking the + panel Note: the user database is persistent as it's in-disk. You don't need to add the users again each time you start ck-server. Client Android client is available here: https://github.com/cbeuw/Cloak-android Install the underlying proxy client corresponding to what the server has. Download the latest release (https://github.com/cbeuw/Cloak/releases) or clone and build this repo. Obtain the public key and your UID from the administrator of your server Copy example_config/ckclient.json into a location of your choice. Enter the UID and PublicKey you have obtained. Set ProxyMethod to match exactly the corresponding entry in ProxyBook on the server end Configure the proxy program. (https://github.com/cbeuw/Cloak/wiki/Underlying-proxy-configuration-guides) Run ck-client -c -s Support me If you find this project useful, you can visit my merch store (https://www.redbubble.com/people/cbeuw/explore); alternatively you can donate directly to me BTC: bc1q59yvpnh0356qq9vf0j2y7hx36t9ysap30spx9h ETH: 0x8effF29a8F9bD38A367580527AC303972c92b60c

Download Cloak (https://github.com/cbeuw/Cloak)

smersh-a-pentest-oriented-collaborative-tool-used-to-track-the-progress-of-your-companys-missions

Smersh is a pentest oriented collaborative tool used to track the progress of your company’s missions and generate rapport. Preview front…Continue reading on Medium »
Read more...

Scrummage — The Ultimate OSINT And Threat Hunting Framework

VERSION 3.6Continue reading on Medium »
Read more...

carpunk-the-car-hacking-toolkit

CARPUNK IS VERY SIMILAR TO CANghost, ONLY THE DEFFERENCE IS, IT COMES WITH OPTIONS TO ENABLE OR DISABLE INTERFACE AND BASIC SNIFFING AS…Continue reading on Medium »
Read more...

af-shellhunter-auto-shell-lookup
https://medium.com/@pentesterclubpvtltd/af-shellhunter-auto-shell-lookup-2f0a8dda3ccc?source=rss------bug_bounty-5

AF-ShellHunter: Auto shell lookupContinue reading on Medium » (https://medium.com/@pentesterclubpvtltd/af-shellhunter-auto-shell-lookup-2f0a8dda3ccc?source=rss------bug_bounty-5)

smersh-a-pentest-oriented-collaborative-tool-used-to-track-the-progress-of-your-companys-missions
https://medium.com/@pentesterclubpvtltd/smersh-a-pentest-oriented-collaborative-tool-used-to-track-the-progress-of-your-companys-missions-83b33b49935e?source=rss------bug_bounty-5

Smersh is a pentest oriented collaborative tool used to track the progress of your company’s missions and generate rapport.
Preview front…Continue reading on Medium » (https://medium.com/@pentesterclubpvtltd/smersh-a-pentest-oriented-collaborative-tool-used-to-track-the-progress-of-your-companys-missions-83b33b49935e?source=rss------bug_bounty-5)

Scrummage — The Ultimate OSINT And Threat Hunting Framework
https://medium.com/@pentesterclubpvtltd/scrummage-the-ultimate-osint-and-threat-hunting-framework-edd4803d7fcd?source=rss------bug_bounty-5

VERSION 3.6Continue reading on Medium » (https://medium.com/@pentesterclubpvtltd/scrummage-the-ultimate-osint-and-threat-hunting-framework-edd4803d7fcd?source=rss------bug_bounty-5)

carpunk-the-car-hacking-toolkit
https://medium.com/@pentesterclubpvtltd/carpunk-the-car-hacking-toolkit-d2861e644546?source=rss------bug_bounty-5

CARPUNK IS VERY SIMILAR TO CANghost, ONLY THE DEFFERENCE IS, IT COMES WITH OPTIONS TO ENABLE OR DISABLE INTERFACE AND BASIC SNIFFING AS…Continue reading on Medium » (https://medium.com/@pentesterclubpvtltd/carpunk-the-car-hacking-toolkit-d2861e644546?source=rss------bug_bounty-5)

Hacking on Medium
redherd-framework-a-collaborative-and-serverless-framework-for-orchestrating-a-geographically-distri…

RedHerd is a collaborative and serverless framework for orchestrating a geographically distributed group of assets capable of conducting…

Continue reading on Medium »

Hacking on Medium
Limelighter — A Tool For Generating Fake Code Signing Certificates Or Signing Real Ones

https://cdn-images-1.medium.com/max/640/0*PHa3g_kVAfr5nmQA
A tool which creates a spoof code signing certificates and sign binaries and DLL files to help evade EDR products and avoid MSS and sock…

Continue reading on Medium »

Hacking on Medium
How to "Hack" more than 1000 databases (TSDB) in 48 hours and for less than 5 USD

https://cdn-images-1.medium.com/max/600/1*3cfHfGcq6ZC8iCTeOyLayw.jpeg
This article is a quick translation of the original (In Spanish); and has purely educational and security awareness purposes.

Continue reading on Medium »

Hacking on Medium
BruteLoops — Protocol Agnostic Online Password Guessing API

https://cdn-images-1.medium.com/max/640/0*k4GMlEG9SsbSyrqU
A dead simple library providing the foundational logic for efficient password brute force attacks against authentication interfaces.

Continue reading on Medium »