Kali Linux Tutorials
Requests-Ip-Rotator : A Python Library To Utilize AWS API Gateway’s Large IP Pool

Requests-Ip-Rotator is a Python library to utilize AWS API Gateway’s large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing.

This library will allow the user to bypass IP-based rate-limits for sites and services.

X-Forwarded-For headers are automatically randomised and applied unless given. This is because otherwise, AWS will send the client’s true IP address in this header.

AWS’ ApiGateway sends its requests from any available IP – and since the AWS infrastructure is so large, it is almost guarented to be different each time. By using ApiGateway as a proxy, we can take advantage of this to send requests from different IPs each time. Please note that these requests can be easily identified and blocked, since they are sent with unique AWS headers (i.e. “X-Amzn-Trace-Id”). InstallationThis package is on pypi so you can install via any of the following:

* pip3 install requests-ip-rotator* python3 -m pip install requests-ip-rotatorSimple Usageimport requests
from requests_ip_rotator import ApiGateway
Create gateway object and initialise in AWS
gateway = ApiGateway(“https://site.com”)
gateway.start()
Assign gateway to session
session = requests.Session()
session.mount(“https://site.com”, gateway)
Send request (IP will be randomised)
response = session.get(“https://site.com/index.html”)
print(response.status_code)
Delete gateways
gateway.shutdown()

Alternate Usage (auto-start and shutdown)

import requests
from requests_ip_rotator import ApiGateway
with ApiGateway(“https://site.com”) as g:
session = requests.Session()
session.mount(“https://site.com”, g)
response = session.get(“https://site.com/index.html”)
print(response.status_code)

Please remember that if gateways are not shutdown via the shutdown()method when using method #1, you may be charged in future. CostsAPI Gateway is free for the first million requests per region, which means that for most use cases this should be completely free.
At the time of writing, AWS charges ~$3 per million requests after the free tier has been exceeded.
If your requests involve data stream, AWS would charge data transfer fee at $0.09 per GB. DocumentationAWS AuthenticationIt is recommended to setup authentication via environment variables. With awscli, you can run aws configureto do this, or alternatively, you can simply set the AWS_ACCESS_KEY_IDand AWS_SECRET_ACCESS_KEYvariables yourself. Creating ApiGateway objectThe ApiGateway class can be created with the following optional parameters:
NameDescriptionRequiredDefaultsiteThe site (without path) requests will be sent to.TrueregionsAn array of AWS regions to setup gateways in.Falseip_rotator.DEFAULT_REGIONSaccess_key_idAWS Access Key ID (will override env variables).FalseRelies on env variables.access_key_secretAWS Access Key Secret (will override env variables).FalseRelies on env variables.
from ip_rotator import ApiGateway, EXTRA_REGIONS, ALL_REGIONS
Gateway to outbound HTTP IP and port for only two regions
gateway_1 = ApiGateway(“http://1.1.1.1:8080”, regions=[“eu-west-1”, “eu-west-2”])
Gateway to HTTPS google for the extra regions pack, with specified access key pair
gateway_2 = ApiGateway(“https://www.google.com”, regions=EXTRA_REGIONS, access_key_id=”ID”, access_key_secret=”SECRET”) Starting API gatewayAn ApiGateway object must then be started using the startmethod.
By default, if an ApiGateway already exists for the site, it will use the existing endpoint instead of creating a new one.
This does not require any parameters, but accepts the following:
NameDescriptionRequiredforceCreate a new set of endpoints, even if some already exist.FalseendpointsArray of pre-existing endpoints (i.e. fro[...]

m previous session).False
Starts new ApiGateway instances for site, or locates existing endpoints if they already exist.
gateway_1.start()
Starts new ApiGateway instances even if some already exist.
gateway_2.start(force=True) Sending requestsRequests are sent by attaching the ApiGateway object to a requests Session object.
The site given in mountmust match the site passed in the ApiGatewayconstructor.

import requests
Posts a request to the site created in gateway_1. Will be sent from a random IP.
session_1 = requests.Session()
session_1.mount(“http://1.1.1.1:8080”, gateway_1)
session_1.post(“http://1.1.1.1:8080/update.php”, headers={“Hello”: “World”})
Send 127.0.0.1 as X-Forwarded-For header in outbound request (otherwise X-Forwarded-For is randomised).
session_1.post(“http://1.1.1.1:8080/update.php”, headers={“X-Forwarded-For”, “127.0.0.1”})
Execute Google search query from random IP
session_2 = requests.Session()
session_2.mount(“https://www.google.com”, gateway_2)
session_2.get(“https://www.google.com/search?q=test”) Closing ApiGateway ResourcesIt’s important to shutdown the ApiGateway resources once you have finished with them, to prevent dangling public endpoints that can cause excess charges to your account.
This is done through the shutdownmethod of the ApiGateway object. It will close all resources for the regions specified in the ApiGateway object constructor.

Alternatively, you can selectively shutdown specific endpoints, if needed. To do this, simply pass in an array of endpoints to the shutdown() method, i.e:

This will force start a new gateway (i.e. create new endpoints even if some exist on the region already), and then delete the first 3 of them only.
gateway_3 = ApiGateway(“http://1.1.1.1:8082”, regions=ALL_REGIONS)
endpoints = gateway_3.start(force=True)
gateway_3.shutdown(endpoints[:3]) Download

CRLF injection scanner
https://medium.com/@reconshell.com/crlf-injection-scanner-3aa66cd6ffff?source=rss------bug_bounty-5

The most powerful CRLF injection (HTTP Response Splitting) scanner. CRLFsuite — CRLF injection scannerContinue reading on Medium » (https://medium.com/@reconshell.com/crlf-injection-scanner-3aa66cd6ffff?source=rss------bug_bounty-5)

CRLF injection scanner

The most powerful CRLF injection (HTTP Response Splitting) scanner. CRLFsuite — CRLF injection scannerContinue reading on Medium »
Read more...

Hacking on Medium
What’s all the hype about Cybersecurity?

https://cdn-images-1.medium.com/max/2600/1*dE12AuNUZMJl7bIokKDmAg.jpeg
What if Stark never fought Stane and admitted being Iron Man? Avengers: Endgame would have had a very different ending then, which seems…

Continue reading on Medium »

Hacking on Medium
TryHackMe : Source write-up

https://cdn-images-1.medium.com/max/2600/1*Z7t_iMberqG2SCd-vA97Bw.png
I start usually by updating the hosts file on my computer, in order to make accessing the machine easier without the need of typing the IP…

Continue reading on Medium »

Hacking on Medium
Anonymous — TryHackMe WriteUp

https://cdn-images-1.medium.com/max/972/1*p4rQnkBzBpTnVaTIdhq8pQ.png
ANONYMOUS is a LINUX machine, of MEDIUM difficulty.

Continue reading on Medium »

Hacking on Medium
Vulnerabilities in JS based Applications

https://cdn-images-1.medium.com/max/1400/0*8mbMihOcjOTdVrD7
Introduction

Continue reading on InfoSec Write-ups »

https://a.thumbs.redditmedia.com/0tKUD6H48Iqu017F03RZgmNBXVD83wctxIw8oNP06s0.jpg submitted by /u/NightcoreSpectrum
[link] [comments]

hacking: security in practice
Best place to find DB leaks?

I want to check breaches against users in my system. I've scavenged a few torrents here and there but never found any site that would be a reliable source. Also I'm particularly interested in the db8151dd breach now and I haven't found that one yet so any help with that would be very much appreciated.

submitted by /u/LuciusBurns
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Jail time and searches

I was curious to if someone gets caught with the law for hacking can the police legally search your phone for anything?

submitted by /u/hackinghat
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking a NFT Platform
https://medium.com/@mahitman1/hacking-a-nft-platform-56fc59479d3b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Background:Continue reading on Medium » (https://medium.com/@mahitman1/hacking-a-nft-platform-56fc59479d3b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Atlassian Confluence Server Bug Under Active Attack to Distribute Ransomware

Most of the attacks involve the use of automated exploits, security vendor says.