ZenBuster is a multi-threaded, multi-platform URL enumeration tool written in Python by Zach Griffin (@0xTas (https://twitter.com/0xTas)). I wrote this tool as a way to deepen my familiarity with Python, and to help increase my understanding of Cybersecurity (https://www.kitploit.com/search/label/Cybersecurity) tooling in general. ZenBuster may not be the fastest or most comprehensive tool of its kind. It is however, simple to use, decently flexible, and in practice only marginally slower than other "tried-and-true" tools like Gobuster. Personally, I have been using it to help me solve CTF challenges on platforms like TryHackMe, and have found my implementation to be satisfactorily reliable. This software is intended for use in CTF challenges, or by security professionals to gather information on their targets: It is capable of brute-force (https://www.kitploit.com/search/label/Brute-force) enumerating subdomains and also URI resources (directories/files). Both methods of enumeration require use of an appropriate wordlist or dictionary file. Features Include: Hostname format supports standard, IPv4, and IPv6. Support for logging results to a file with -O [filename]. Specifying custom ports for nonstandard webservers with -p . Optional file extensions in directory mode with -x . Quiet mode for less distracting output with -Q. Color can be disabled for less distracting output with -nc/-nl. Tested on Python versions 3.9 and 3.10, with theoretical support for versions >= 3.6 CAUTION/DISCLAIMER ZenBuster is capable of producing a potentially unwelcome number of HTTP requests in a short amount of time. The developers and contributors are not liable or responsible for any damage caused by misuse or abuse of this software. Please Enumerate Responsibly! License

ZenBuster is licensed under the GNU GPLv3 License, see here for more information. Credits Yin-Yang ASCII art in the banners were created by Joan G. Stark (jgs) and Hayley Jane Wakenshaw (hjw). Modifications were made by me, when specified with: 'zg'.
Installation Firstly, ensure that Python version >= 3.6 is installed, then clone the repository with: git clone https://github.com/0xTas/zenbuster.git Next, cd zenbuster. Dependencies ZenBuster relies on 3 external libraries to function, and it is recommended to install these with: pip install -r requirements.txt The modules that will be installed and their purposes are as follows: Python requests (https://pypi.org/project/requests/) The backbone of each enumeration request. Without this, the script will not function. termcolor (https://pypi.org/project/termcolor/) Enables colored terminal output. Non-critical, the script can still run without color if this is not present. colorama (Windows only) (https://pypi.org/project/colorama/) Primes the Windows terminal to accept ANSI color codes (from Termcolor). Non-critical. These dependencies may be installed manually, with pip using requirements.txt, or via interaction with the script upon first run.
Usage Once dependencies have been installed, you can run the program in the following ways: On Linux (+Mac?): ./zenbuster.py [options] or python3 zenbuster.py [options] On Windows: python zenbuster.py [options] [Options] Short Flag Long Flag Purpose -h --help Displays the help screen and exits -d --dirs Enables Directory Enumeration (https://www.kitploit.com/search/label/Enumeration) Mode -s -ssl Forces usage of HTTPS in requests -v --verbose Prints verbose info to terminal/log -q --quiet Minimal terminal output until final results -nc --no-color Disables colored terminal output -nl --no-lolcat Disables lolcat-printed banner (Linux only) -u --host Host to target for the scan -w --wordlist Path to wordlist/dictionary file -x --ext Comma-separated list of file extensions (Dirs only) -p --port Custom port option for nonstandard webservers -o [filename] --out-file Log results to a file (accepts custom name/path) Example Usage ./zenbuster.py -d -w /usr/share/wordlists/dirb/common.txt -u target.thm -v python3 zenbuster.py -w ../subdomains.txt --host target.thm --ssl -O myResults.log zenbuster -w subdomains.txt -u target.thm --quiet (With .bashrc alias)
Planned Features/Improvements Increased levels of optional verbosity. Allow optional throttling of task thread-count. Allow users to modify the list of ignored status codes. Allow greater user control over various request headers. Allow optional ignoring of responses based on content-length. Expand subdomain enumeration (https://www.kitploit.com/search/label/Subdomain%20Enumeration) to include OSINT methods instead of just brute-forcing. Explore a more comprehensive and source-readable solution to fancy colored output (possibly using rich (https://pypi.org/project/rich/)).
Known Issues/Limitations Enumerating long endpoints may result in ugly terminal output due to line-wraping on smaller console windows. Logging to a file is recommended, especially on Windows. If target host is a vHost on a shared webserver, enumeration via IP may not function as expected. Use domain/hostname instead.

Download Zenbuster (https://github.com/0xTas/zenbuster)

Hacking on Medium
Security Source Code Review

The way to be safe is never to be Secure - Benjamin Franklin

Continue reading on Medium »

Hacking on Medium
Wireless Hacking

https://cdn-images-1.medium.com/max/2600/0*a8jP-e2ffcyJhLxu
WPA/WPA2 Cracking

Continue reading on Medium »

KitPloit - PenTest Tools!
Zenbuster - Multi-threaded URL Enumeration/Brute-Forcing Tool

https://blogger.googleusercontent.com/img/a/AVvXsEi9pYeob2mXu7cnwIfM_BLsokyDEfTHEh8r_Bcc59ZU-4N5-Rm0kXCfEpPoQwGCFWwUt0M7x44EdXquMlM0ZgZCGFXYOTAQq-M0EAKMEMns0FVolknn2SzZUywKK9iMFxiwNPTeEfFLykhzjgO_BU1Mr22xrgB1KgYHTsOD0tZb0GxQ8AYLijfRqmY9=w608-h640 ZenBuster is a multi-threaded, multi-platform URL enumeration tool written in Python by Zach Griffin (@0xTas).

I wrote this tool as a way to deepen my familiarity with Python, and to help increase my understanding of Cybersecurity tooling in general. ZenBuster may not be the fastest or most comprehensive tool of its kind. It is however, simple to use, decently flexible, and in practice only marginally slower than other "tried-and-true" tools like Gobuster. Personally, I have been using it to help me solve CTF challenges on platforms like TryHackMe, and have found my implementation to be satisfactorily reliable.
This software is intended for use in CTF challenges, or by security professionals to gather information on their targets:

* It is capable of brute-force enumerating subdomains and also URI resources (directories/files).
* Both methods of enumeration require use of an appropriate wordlist or dictionary file.
* Features Include:
1. Hostname format supports standard, IPv4, and IPv6.
2. Support for logging results to a file with -O [filename].
3. Specifying custom ports for nonstandard webservers with -p .
4. Optional file extensions in directory mode with -x .
5. Quiet mode for less distracting output with -Q.
6. Color can be disabled for less distracting output with -nc/-nl.
7. Tested on Python versions 3.9 and 3.10, with theoretical support for versions >= 3.6 CAUTION/DISCLAIMERZenBuster is capable of producing a potentially unwelcome number of HTTP requests in a short amount of time.

The developers and contributors are not liable or responsible for any damage caused by misuse or abuse of this software.

Please Enumerate Responsibly! Licensehttps://camo.githubusercontent.com/555cfccab30d7e960e97fca169185250a39c44c21aa9dfd2ab0f25589cc361cd/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f30785461732f7a656e6275737465723f636f6c6f723d253233353245324530266c6162656c3d4c6963656e7365266c6f676f3d474e55266c6f676f436f6c6f723d253233464646464646267374796c653d666c61742d737175617265 ZenBuster is licensed under the GNU GPLv3 License, see here for more information. CreditsYin-Yang ASCII art in the banners were created by Joan G. Stark (jgs) and Hayley Jane Wakenshaw (hjw). Modifications were made by me, when specified with: 'zg'. InstallationFirstly, ensure that Python version >= 3.6 is installed, then clone the repository with: git clone https://github.com/0xTas/zenbuster.gitNext, cd zenbuster. DependenciesZenBuster relies on 3 external libraries to function, and it is recommended to install these with: pip install -r requirements.txtThe modules that will be installed and their purposes are as follows:

1. Python requests

* The backbone of each enumeration request. Without this, the script will not function.

2. termcolor

* Enables colored terminal output. Non-critical, the script can still run without color if this is not present.

3. colorama (Windows only)

* Primes the Windows terminal to accept ANSI color codes (from Termcolor). Non-critical.
These dependencies may be installed manually, with pipusing requirements.txt, or via interaction with the script upon first run. UsageOnce dependencies have been installed, you can run the program in the following ways: On Linux (+Mac?):./zenbuster.py [options]or python3 zenbuster.py [options]On Windows:python zenbuster.py [options][Options]Short Flag Long Flag Purpose -h --help Displays the help screen and [...]

exits -d --dirs Enables Directory Enumeration Mode -s -ssl Forces usage of HTTPS in requests -v --verbose Prints verbose info to terminal/log -q --quiet Minimal terminal output until final results -nc --no-color Disables colored terminal output -nl --no-lolcat Disables lolcat-printed banner (Linux only) -u <hostname--host Host to target for the scan -w <wordlist--wordlist Path to wordlist/dictionary file -x <exts--ext Comma-separated list of file extensions (Dirs only) -p <port#--port Custom port option for nonstandard webservers -o [filename] --out-file Log results to a file (accepts custom name/path) Example Usage./zenbuster.py -d -w /usr/share/wordlists/dirb/common.txt -u target.thm -vpython3 zenbuster.py -w ../subdomains.txt --host target.thm --ssl -O myResults.logzenbuster -w subdomains.txt -u target.thm --quiet(With .bashrc alias) Planned Features/Improvements* Increased levels of optional verbosity.
* Allow optional throttling of task thread-count.
* Allow users to modify the list of ignored status codes.
* Allow greater user control over various request headers.
* Allow optional ignoring of responses based on content-length.
* Expand subdomain enumeration to include OSINT methods instead of just brute-forcing.
* Explore a more comprehensive and source-readable solution to fancy colored output (possibly using rich). Known Issues/Limitations* Enumerating long endpoints may result in ugly terminal output due to line-wraping on smaller console windows. Logging to a file is recommended, especially on Windows.
* If target host is a vHost on a shared webserver, enumeration via IP may not function as expected. Use domain/hostname instead. Download Zenbuster

A Story Of My First Bug Bounty
https://medium.com/@rajqureshi07/a-story-of-my-first-bug-bounty-dda320db78d9?source=rss------bug_bounty-5

Hello everyone,Continue reading on Medium » (https://medium.com/@rajqureshi07/a-story-of-my-first-bug-bounty-dda320db78d9?source=rss------bug_bounty-5)

hacking: security in practice
I had a backdoor running on my PC for two weeks, what should I do ?

So, two weeks ago, I installed some shady stuff, hacking tools ( script kiddie stuff tbh ) and other things like that from a random forum, it looked clean and stuff but one of the thing I downloaded wasn't working well and it just seemed weird for some reason. Got rid of it, didn't really thought much about it. Fast forward today, I notice in my task manager that at the startup there's a process called "Windows services" actually two of them. Browse to the directory and there's a .zip called license and other things that doesn't seems very official for something in the system32 directory. So I try to shut them off with the task manager to delete it and I can't. So I make them not able to start at the startup and then restart my PC, and finally the files. I don't really save my password with my browser, at least not the most important one so I feel safe and I had no connection attempt to my steam account, epic games, Minecraft etc. Should I be worried ?

submitted by /u/Logane72
[link] [comments]

hacking: security in practice
Offline stores in Canada to buy Alfa wireless tools

Any Canada peeps in here? My friend has been staying in Ontario for a while and he will be returning soon so I just wanted to know if there are any offline stores in Ontario where he could find the Alfa AWUS036NHA wifi adapter which comes with the ar9271 chipset below the 50$ price tag. Please help me out if you know about any offline stores in Ontario where I could find this adapter.

I'm not considering online stores as it would take some time to deliver and he will have to leave soon.

submitted by /u/SolomonDaGod
[link] [comments]

hacking: security in practice
Would it be possible to track APT's through their infrastructure?

So I was wondering after reading Sandworm the book,...

Would it be possible, to look at the infrastructure like a Command and Control server and take a few unique aspects of their configuration and scan the internet for those same unique identifiers?

For example, a hacking group uses TCP Port 50051, would it be possible to scan millions of IP's on just that one port?

Or is it possible to simply open and execute malware, and see which IP's it tries to connect to? And then Nmap that IP and see if its vulnerable for some exploits, infect it with your own malware and track the hackers that way?

Or... does someone have an explanation on how this cat and mouse game could be played? Maybe a blog? I am quite a noob to it all, but super interested after reading books listening to DarknetDiaries etc.

Thanks in advance and have a wonderful Sunday folks :)

submitted by /u/Routine_Inspection_5
[link] [comments]

Kali Linux Tutorials
Atomic-Operator : A Python Package Is Used To Execute Atomic Red Team Tests

atomic-operatorenables security professionals to test their detection and defensive capabilities against prescribed techniques defined within atomic-red-team. By utilizing a testing framework such as atomic-operator, you can identify both your defensive capabilities as well as gaps in defensive coverage.

Additionally, atomic-operatorcan be used in many other situations like:

* Generating alerts to test products
* Testing EDR and other security tools
* Identifying way to perform defensive evasion from an adversary perspective
* Plus more. Features* Support local and remote execution of Atomic Red Teams tests on Windows, macOS, and Linux systems
* Supports running atomic-tests against iaas:aws* Can prompt for input arguments but not required
* Assist with downloading the atomic-red-team repository
* Can be automated further based on a configuration file
* A command-line and importable Python package
* Select specific tests when one or more techniques are specified
* Plus more Getting Startedatomic-operatoris a Python-only package hosted on PyPi and works with Python 3.6 and greater.

If you are wanting a PowerShell version, please checkout Invoke-AtomicRedTeam

pip install atomic-operator

The next steps will guide you through setting up and running atomic-operator.

* Get Atomics Install / clone Atomic Red Team repository
* atomic-operator Understand the options availble in atomic-operator
* Running Test on Command Line or Running Tests within a Script
* Running Tests via Configuration File InstallationYou can install atomic-operator on OS X, Linux, or Windows. You can also install it directly from the source. To install, see the commands under the relevant operating system heading, below. PrerequisitesThe following libraries are required and installed by atomic-operator:

pyyaml==5.4.1
fire==0.4.0
requests==2.26.0
attrs==21.2.0
pick==1.2.0

macOS, Linux and Windows:

pip install atomic-operator

macOS using M1 processor

git clone https://github.com/swimlane/atomic-operator.git
cd atomic-operator
Satisfy ModuleNotFoundError: No module named ‘setuptools_rust’
brew install rust
pip3 install –upgrade pip
pip3 install setuptools_rust
Back to our regularly scheduled programming . . .
pip install -r requirements.txt
python setup.py install

Installing from source

git clone https://github.com/swimlane/atomic-operator.git
cd atomic-operator
pip install -r requirements.txt
python setup.py install Usage example (command line)You can run atomic-operatorfrom the command line or within your own Python scripts. To use atomic-operatorat the command line simply enter the following in your terminal:

atomic-operator –help
atomic-operator run — –help Retrieving Atomic TestsIn order to use atomic-operatoryou must have one or more atomic-red-team tests (Atomics) on your local system. atomic-operatorprovides you with the ability to download the Atomic Red Team repository. You can do so by running the following at the command line:

atomic-operator get_atomics
You can specify the destination directory by using the –destination flag
atomic-operator get_atomics –destination “/tmp/some_directory” Running Tests LocallyIn order to run a test you must provide some additional properties (and options if desired). The main method to run tests is named run.

This will run ALL tests compatiable with your local operating system
atomic-operator run –atomics-path “/tmp/some_directory/redcanaryco-atomic-red-team-3700624”

You can select individual tests when you provide one or more specific techniques. For example running the following on the command line:

atomic-operator run –techniques[...]

___________________________
@hacking_Attack
@Hacking_Video

T1564.001 –select_tests

Will prompt the user with a selection list of tests associated with that technique. A user can select one or more tests by using the space bar to highlight the desired test: Additional parametersYou can see additional parameters by running the following command:
atomic-operator run -- --help Parameter NameTypeDefaultDescriptiontechniqueslistallOne or more defined techniques by attack_technique ID.test_guidslistNoneOne or more Atomic test GUIDs.select_testsboolFalseSelect one or more atomic tests to run when a techniques are specified.atomics_pathstros.getcwd()The path of Atomic tests.check_prereqsboolFalseWhether or not to check for prereq dependencies (prereq_comand).get_prereqsboolFalseWhether or not you want to retrieve prerequisites.cleanupboolFalseWhether or not you want to run cleanup command(s).copy_source_filesboolTrueWhether or not you want to copy any related source (src, bin, etc.) files to a remote host.command_timeoutint20Time duration for each command before timeout.debugboolFalseWhether or not you want to output details about tests being ran.prompt_for_input_argsboolFalseWhether you want to prompt for input arguments for each test.return_atomicsboolFalseWhether or not you want to return atomics instead of running them.config_filestrNoneA path to a conifg_file which is used to automate atomic-operator in environments.config_file_onlyboolFalseWhether or not you want to run tests based on the provided config_file only.hostslistNoneA list of one or more remote hosts to run a test on.usernamestrNoneUsername for authentication of remote connections.passwordstrNonePassword for authentication of remote connections.ssh_key_pathstrNonePath to a SSH Key for authentication of remote connections.private_key_stringstrNoneA private SSH Key string used for authentication of remote connections.verify_sslboolFalseWhether or not to verify ssl when connecting over RDP (windows).ssh_portint22SSH port for authentication of remote connections.ssh_timeoutint5SSH timeout for authentication of remote connections.**kwargsdictNoneIf additional flags are passed into the run command then we will attempt to match them with defined inputs within Atomic tests and replace their value with the provided value.
You should see a similar output to the following:

NAME
atomic-operator run – The main method in which we run Atomic Red Team tests.
SYNOPSIS
atomic-operator run
DESCRIPTION
The main method in which we run Atomic Red Team tests.
FLAGS
–techniques=TECHNIQUES
Type: list
Default: [‘all’]
One or more defined techniques by attack_technique ID. Defaults to ‘all’.
–test_guids=TEST_GUIDS
Type: list
Default: []
One or more Atomic test GUIDs. Defaults to None.
–select_tests=SELECT_TESTS
Type: bool
Default: False
Select one or more tests from provided techniques. Defaults to False.
–atomics_path=ATOMICS_PATH
Default: ‘/U…
The path of Atomic tests. Defaults to os.getcwd().
–check_prereqs=CHECK_PREREQS
Default: False
Whether or not to check for prereq dependencies (prereq_comand). Defaults to False.
–get_prereqs=GET_PREREQS
Default: False
Whether or not you want to retrieve prerequisites. Defaults to False.
–cleanup=CLEANUP
Default: False
Whether or not you want to run cleanup command(s). Defaults to False.
–copy_source_files=COPY_SOURCE_FILES
Default: True
Whether or not you want to copy any related source (src, bin, etc.) files to a remote host. Defaults to True.
–command_timeout=COMMAND_TIMEOUT
Default: 20
Timeout duration for each command. Defaults to 20.
–debug=DEBUG
Default: False
Whether or not you want to output details about tests being ran. Defaults to False.
–prompt_for_input_args=PROMPT_FOR_INPUT_ARGS
Default: False
Whether you want to prompt for input arguments for each test. Defaults to False.
–return_atomics=RETURN_ATOMICS
Default: False
Whether or not you want to return atomics instead of running them. Defaults to False.
–config_file=CONFIG_FILE
Type: Optional[]
Default: None
A path to a conifg_file [...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Puwr : SSH Pivoting Script For Expanding Attack Surfaces On Local Networks

Puwr will Easily expand your attack surface on a local network by discovering more hosts, via SSH. Using a machine running a SSH service, Puwr uses a given subnet range to scope out IP’s, sending back any successful ping requests it has. This can be used to create a pivoting attack from a compromised machine, by returning you hosts you couldn’t normally discover from your own device. Open ports can then be probed on these discovered devices, to find a gateway into attacking more devices.

Upcoming

Here are some new features I plan to add in along with the upcoming update.

* Scan for open ports of discovered hosts (DONE)
* Change CLI output to look more neat and organized (DONE)
* Enumerate information on “victim” host for privilege escalation
* Optional colored output

Usage

Puwr is simple to run, only requiring 4 flags:
python3 puwr.py (MACHINE IP) (USER) (PASSWORD) (SUBNET VALUE)

example:
python3 puwr.py 10.0.0.53 xeonrx password123 10.0.0.1/24

If you need to connect through a port other than 22, use the -pflag. (example: -p 2222)
If you want to keep quiet, use the -sflag to wait specified seconds between request. (example: -s 5)
You can now use --scanto discover open ports on discovered devices. (example: –scan 80 443)
Use the -hflag for usage reference in the script.

The paramiko and netaddr modules are required for this script to work!
You can install them with the pip tool: pip install netaddr paramiko

Here I scanned devices and checked which ones has port 80 and 443 open to target web applications.
Notice how the TTL number also displays, giving you a hint at what the device may be running on.

Tested Operating Systems

So far, I have only confirmed Puwr to work on a few operating systems:

* Kali Linux
* Parrot OS
* Windows 10

However, it should work on almost any OS with Python, and the needed modules installed.

Port Scanning

As mentioned earlier a few times, you can now not only discover hosts, but also scan them for open ports.
This can be used to find an attack vector on devices running an accessable service. By default, ports will not be scanned, but you can use the --scanflag, and add the port numbers you’d like to scan.
Keep in mind however, that port scanning does take a good bit of additional time to complete. PORT SCANNING ONLY WORKS ON MACHINES WITH PYTHON 3 INSTALLED FOR NOW
Download

___________________________
@hacking_Attack
@Hacking_Video

which is used to automate atomic-operator in environments. Default to None.
–config_file_only=CONFIG_FILE_ONLY
Default: False
Whether or not you want to run tests based on the provided config_file only. Defaults to False.
–hosts=HOSTS
Default: []
A list of one or more remote hosts to run a test on. Defaults to [].
–username=USERNAME
Type: Optional[]
Default: None
Username for authentication of remote connections. Defaults to None.
–password=PASSWORD
Type: Optional[]
Default: None
Password for authentication of remote connections. Defaults to None.
–ssh_key_path=SSH_KEY_PATH
Type: Optional[]
Default: None
Path to a SSH Key for authentication of remote connections. Defaults to None.
–private_key_string=PRIVATE_KEY_STRING
Type: Optional[]
Default: None
A private SSH Key string used for authentication of remote connections. Defaults to None.
–verify_ssl=VERIFY_SSL
Default: False
Whether or not to verify ssl when connecting over RDP (windows). Defaults to False.
–ssh_port=SSH_PORT
Default: 22
SSH port for authentication of remote connections. Defaults to 22.
–ssh_timeout=SSH_TIMEOUT
Default: 5
SSH timeout for authentication of remote connections. Defaults to 5.
Additional flags are accepted.
If provided, keys matching inputs for a test will be replaced. Default is None. Running atomic-operator using a config_fileIn addition to the ability to pass in parameters with atomic-operatoryou can also pass in a path to a config_filethat contains all the atomic tests and their potential inputs. You can see an example of this config_file here:

atomic_tests:
guid: f7e6ec05-c19e-4a80-a7e7-241027992fdb
input_arguments:
output_file:
value: custom_output.txt
input_file:
value: custom_input.txt
guid: 3ff64f0b-3af2-3866-339d-38d9791407c3
input_arguments:
second_arg:
value: SWAPPPED argument
guid: 32f90516-4bc9-43bd-b18d-2cbe0b7ca9b2 Usage example (scripts)from atomic_operator import AtomicOperator
operator = AtomicOperator()
This will download a local copy of the atomic-red-team repository
print(operator.get_atomics(‘/tmp/some_directory’))
this will run tests on your local system
operator.run(
technique: str=’All’,
atomics_path=os.getcwd(),
check_dependencies=False,
get_prereqs=False,
cleanup=False,
command_timeout=20,
debug=False,
prompt_for_input_args=False,
**kwargs
) Download

___________________________
@hacking_Attack
@Hacking_Video