Kraken is an online distributed brute force (https://www.kitploit.com/search/label/Brute%20Force) password cracking tool. It allows you to parallelize dictionaries and crunch word generator (https://www.kitploit.com/search/label/Generator) based cracking across multiple machines both as a web app in a web browser and as a standalone electron based client. Kraken aims to be easy to use, fault tolerant and scalable. I wrote Kraken because I wanted to learn more about offensive security and to write an easy solution to overcome the limitation of using a single device when attempting distribute brute force workloads.
Installation Server and Browser Client Kraken is a dockerized application using docker-compose which will launch the db (Postgres), s3 compliant file storage (Minio), the server and the browser client. You can find the docker-compose file at the root directory (https://www.kitploit.com/search/label/Directory) of the repository. You can deploy it using the following command: docker-compose up
Kraken's Browser Client should be accessible at: HTTP : localhost:8080 (http://localhost:8080/) (use server url http://localhost:5000/api [default]) HTTPS : https://localhost:8443 (https://localhost:8443/) (use server url https://localhost:8443/api) Note: To run the Browser Client from a remote machine, you MUST use HTTPS for both server url and browser url. Eg. If you are hosting the server on 192.168.1.2, then browser client will be available at https://192.168.1.2:8443 (https://192.168.1.2:8443/) and the server url should be https://192.168.1.2:8443/api To upload password lists or dictionaries, upload them to Minio Console at localhost:9001 (http://localhost:9001/). Kraken's server runs on localhost:5000 (http://localhost:5000/) and also hosts swagger documentation at localhost:5000/swagger (http://localhost:5000/swagger). Portable Desktop Client The desktop client is an electron based portable application and can be run on Mac, Windows and Linux. Due to sensitive permissions required to function, it is highly recommended that you compile and it yourself by cloning the repo and using : cd kraken-client
npm install
npm run electron-start
Windows Note: Window EXE portable client needs to run in the folder with its hashcat dependencies. Hashcat files can be dowloaded from their home page or here (https://hashcat.net/files/hashcat-5.1.0.7z). Ive included a compressed zip file with the portable executable and required hashcat files. They can be downloaded: Portable Exe (https://github.com/arcaneiceman/kraken/releases/download/dockerUpdate/kraken-client.1.2.0.exe) Compressed Zip (https://github.com/arcaneiceman/kraken/releases/download/dockerUpdate/kraken-client-with-dependencies.zip) Linux Releases include a Linux AppImage which only requires hashcat to be installed. AppImage (https://github.com/arcaneiceman/kraken/releases/download/dockerUpdate/kraken-client-1.2.0.AppImage) Install hashcat: sudo apt-get install hashcat
You will have to give AppImage permission via properties to execute. Note This guide is on-going but please feel free to raise an issue or contact me for any help required.

Download Kraken (https://github.com/arcaneiceman/kraken)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to Prime Your Subconscious

https://cdn-images-1.medium.com/max/2600/0*vTiAdgWGKEdYp0MZ
Most people do not achieve their goals. 
 
The reason is not necessarily laziness or lack of willpower; they simply do not see themselves…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HackTheBox:Catch

https://cdn-images-1.medium.com/max/1400/1*Aoi7b1_YG5V9wq1fhDd9CQ.png
Overview:

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The First Big Thing in Web Hacking: Authentication

https://cdn-images-1.medium.com/max/640/0*Tl1MHtD8H-xNCLxp
Web hacking is where experimenting, analyzing, studying, and exploring hacking reaches a different level. The web is where the majority of…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Kraken - A Multi-Platform Distributed Brute-Force Password Cracking System

https://blogger.googleusercontent.com/img/a/AVvXsEh4LxtY9GLWW77N1jj4yB-CETIAdcw6FerefSdAu2miQYLxR5_8YVSRMX2xCIbnHDp-Rgkor4TCxra928ocKWvaO69W6pKjE3ARkvESKplLlr0YKq1_LMbnfo0pgDHoZTGt3BJvFlkeSGYQEyX2I4cHOpRW3h988dEz2OmHrNbsfwKKlPMvnzqh8cqC=s320 Kraken is an online distributed brute force password cracking tool. It allows you to parallelize dictionaries and crunch word generator based cracking across multiple machines both as a web app in a web browser and as a standalone electron based client. Kraken aims to be easy to use, fault tolerant and scalable.

I wrote Kraken because I wanted to learn more about offensive security and to write an easy solution to overcome the limitation of using a single device when attempting distribute brute force workloads. InstallationServer and Browser ClientKraken is a dockerized application using docker-compose which will launch the db (Postgres), s3 compliant file storage (Minio), the server and the browser client. You can find the docker-compose file at the root directory of the repository. You can deploy it using the following command: docker-compose up Kraken's Browser Client should be accessible at:

* HTTP : localhost:8080 (use server url http://localhost:5000/api [default])
* HTTPS : https://localhost:8443 (use server url https://localhost:8443/api)

Note: To run the Browser Client from a remote machine, you MUST use HTTPS for both server url and browser url. Eg. If you are hosting the server on 192.168.1.2, then browser client will be available at https://192.168.1.2:8443 and the server url should be https://192.168.1.2:8443/api

To upload password lists or dictionaries, upload them to Minio Console at localhost:9001.

Kraken's server runs on localhost:5000 and also hosts swagger documentation at localhost:5000/swagger. Portable Desktop ClientThe desktop client is an electron based portable application and can be run on Mac, Windows and Linux. Due to sensitive permissions required to function, it is highly recommended that you compile and it yourself by cloning the repo and using : cd kraken-client
npm install
npm run electron-start Windows
Note: Window EXE portable client needs to run in the folder with its hashcat dependencies. Hashcat files can be dowloaded from their home page or here. Ive included a compressed zip file with the portable executable and required hashcat files. They can be downloaded:

* Portable Exe
* Compressed Zip
Linux
Releases include a Linux AppImage which only requires hashcat to be installed.

* AppImage

Install hashcat: sudo apt-get install hashcat You will have to give AppImage permission via properties to execute. NoteThis guide is on-going but please feel free to raise an issue or contact me for any help required. Download Kraken

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What will the scams be that we will fall for when we are older?

I can't imagine falling for the computer virus support scam or the send money to your relative Western Union scam.

But as we get old something new will be designed to catch us. What will it be?

submitted by /u/MushinZero
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Virtual machines

Anyone know any softwares to install virtual machines on an M1 Mac. There don't seem to be any around.

submitted by /u/GlassAd2991
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

[Recommendation] Best Android pentesting Course and Resources ?
https://www.reddit.com/r/Pentesting/comments/u5dtcj/recommendation_best_android_pentesting_course_and/

Hi everyone, Any recommendation for Android pentesting course? I checked TCM course android part, but it doesn't cover all topics. I come from web and network pentesting background. submitted by /u/0xA1MN (https://www.reddit.com/user/0xA1MN)
[link] (https://www.reddit.com/r/Pentesting/comments/u5dtcj/recommendation_best_android_pentesting_course_and/) [comments] (https://www.reddit.com/r/Pentesting/comments/u5dtcj/recommendation_best_android_pentesting_course_and/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Self-Loathing Rant — 1

https://cdn-images-1.medium.com/max/1440/0*fWDvyH3jARbzMqGU.jpg
I actually don’t really hate myself that much right now. I know, surprising because I just created this new rant series(?).

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

SQL Injection in Harvard’s Subdomain
https://nb1b3k.medium.com/sql-injection-in-harvards-subdomain-c3148f8be156?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi there! I’m Bibek Neupane from Nepal. In this first-ever write-up of mine, I’ll try to cover my story of finding a SQL Injection on…Continue reading on Medium » (https://nb1b3k.medium.com/sql-injection-in-harvards-subdomain-c3148f8be156?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

SQL Injection in Harvard’s Subdomain

Hi there! I’m Bibek Neupane from Nepal. In this first-ever write-up of mine, I’ll try to cover my story of finding a SQL Injection on…Continue reading on Medium »
Read more...

hacking: security in practice
What happened to Recon Dev?

Some YouTube video mentioned recon.dev service. Went to site, but didn’t resolve. What happened, is service down or no longer in biz?

submitted by /u/LateniteCrocs
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Some Assistance

I'm hoping I can speak to an expert to put my mind at ease.

submitted by /u/Icy_Mud_341
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Trouble installing sherlock in Kali

Hi all

I'm trying to install sherlock on kali, but I'm having issues with the installation, specifically, with the initial command:

$python3 -m pip install -r requirements.txt
it returns this message: /usr/bin/python3: no module named pip

Is someone able to assist with this one?

Thank you 🙏🏻

submitted by /u/DiccDaddy69
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is automatically rendering a raw excel file's contents as html a security risk?

Because if so I need to contact the owners of the website I just came across whilst searching for electrical components.

submitted by /u/Syntaximus
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is automatically rendering a raw excel file's contents as html a security risk?

Because if so I need to contact the owners of the website I just came across whilst searching for electrical components.

submitted by /u/Syntaximus
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Open Redirection & Broken Link Hijacking

Let us learn about Open Redirection & Broken Link HijackingContinue reading on Medium »
Read more...

hacking: security in practice
Nmap reading all ports filtered or host is down?

Hi, I am running openvpn to connect to a pentesting lab website and I am able to nmap scan the web application servers. However when I attempt to scan its windows machine nmap reads host is down. And if i use the flag -Pn it reads all 1000 ports filtered (host unreach). I have tried everything from slowing down the nmap scan, tracing the packets, -sT, -sV, -vv, -p-, and any range of ports. Nothing seems to work? How am I supposed to identify vulnerabilities in this system?

Thanks

submitted by /u/yettie566
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video