Kali Linux Tutorials
dnsReaper : Subdomain Takeover Tool For Attackers, Bug Bounty Hunters And The Blue Team!

DNS Reaper is yet another sub-domain takeover tool, but with an emphasis on accuracy, speed and the number of signatures in our arsenal!

We can scan around 50 subdomains per second, testing each one with over 50 takeover signatures. This means most organisations can scan their entire DNS estate in less than 10 seconds. You can use DNS Reaper as an attacker or bug hunter!You can run it by providing a list of domains in a file, or a single domain on the command line. DNS Reaper will then scan the domains with all of its signatures, producing a CSV file. You can use DNS Reaper as a defender!You can run it by letting it fetch your DNS records for you! Yes that’s right, you can run it with credentials and test all your domain config quickly and easily. DNS Reaper will connect to the DNS provider and fetch all your records, and then test them.

We currently support AWS Route53, Cloudflare, and Azure. Documentation on adding your own provider can be found here You can use DNS Reaper as a DevSecOps Pro!Punk Security are a DevSecOps company, and DNS Reaper has its roots in modern security best practice.

You can run DNS Reaper in a pipeline, feeding it a list of domains that you intend to provision, and it will exit Non-Zero if it detects a takeover is possible. You can prevent takeovers before they are even possible! UsageTo run DNS Reaper, you can use the docker image or run it with python 3.10.

Findings are returned in the output and more detail is provided in a local “results.csv” file. We also support json output as an option. Run it with dockerdocker run punksecurity/dnsreaper –help

Run it with python

pip install -r requirements.txt
python main.py –help Common commands* Scan AWS account:docker run punksecurity/dnsreaper aws --aws-access-key-id For more information, see the documentation for the aws provider
* Scan all domains from file:docker run -v $(pwd):/etc/dnsreaper punksecurity/dnsreaper file --filename /etc/dnsreaper/
* Scan single domaindocker run punksecurity/dnsreaper single --domain
* Scan single domain and output to stdout:You should either redirect the stderr output or save stdout output with >docker run punksecurity/dnsreaper single --domain output

Full usage ____ __ _____ _ __
/ __ \__ ______ / /__/ ___/___ _______ _______(_) /___ __
/ /_/ / / / / __ \/ //_/\__ \/ _ \/ ___/ / / / ___/ / __/ / / /
/ ____/ /_/ / / / / ,< ___/ / __/ /__/ /_/ / / / / /_/ /_/ /
/_/ \__,_/_/ /_/_/|_|/____/\___/\___/\__,_/_/ /_/\__/\__, /
PRESENTS /____/
DNS Reaper ☠
Scan all your DNS records for subdomain takeovers!usage:
.\main.py provider [options]
output:
findings output to screen and (by default) results.csv
help:
.\main.py –help
providers:
aws – Scan multiple domains by fetching them from AWS Route53
azure – Scan multiple domains by fetching them from Azure DNS services
bind – Read domains from a dns BIND zone file, or path to multiple
cloudflare – Scan multiple domains by fetching them from Cloudflare
file – Read domains from a file, one per line
single – Scan a single domain by providing a domain on the commandline
zonetransfer – Scan multiple domains by fetching records via DNS zone transfer
positional arguments:
{aws,azure,bind,cloudflare,file,single,zonetransfer}
options:
h, –help Show this help message and exit
out OUT Output file (default: results) – use ‘stdout’ to stream out
out-format {csv,json}
resolver RESOLVER
Provide a custom DNS resolver (or multiple seperated by commas)
parallelism PARALLELIS[...]

___________________________
@hacking_Attack
@Hacking_Video

M
Number of domains to test in parallel – too high and you may see odd DNS results (default: 30)
disable-probable Do not check for probable conditions
enable-unlikely Check for more conditions, but with a high false positive rate
signature SIGNATURE
Only scan with this signature (multiple accepted)
exclude-signature EXCLUDE_SIGNATURE
Do not scan with this signature (multiple accepted)
pipeline Exit Non-Zero on detection (used to fail a pipeline)
v, –verbose -v for verbose, -vv for extra verbose
nocolour Turns off coloured text
aws:
Scan multiple domains by fetching them from AWS Route53
aws-access-key-id AWS_ACCESS_KEY_ID
Optional
aws-access-key-secret AWS_ACCESS_KEY_SECRET
Optionalazure:
Scan multiple domains by fetching them from Azure DNS services
az-subscription-id AZ_SUBSCRIPTION_ID
Required
az-tenant-id AZ_TENANT_ID
Required
az-client-id AZ_CLIENT_ID
Required
az-client-secret AZ_CLIENT_SECRET
Required
bind:
Read domains from a dns BIND zone file, or path to multiple
bind-zone-file BIND_ZONE_FILE
Required
cloudflare:
Scan multiple domains by fetching them from Cloudflare
cloudflare-token CLOUDFLARE_TOKEN
Required
file:
Read domains from a file, one per line
filename FILENAME Required
single:
Scan a single domain by providing a domain on the commandline
domain DOMAIN Required
zonetransfer:
Scan multiple domains by fetching records via DNS zone transfer
zonetransfer-nameserver ZONETRANSFER_NAMESERVER
Required
zonetransfer-domain ZONETRANSFER_DOMAIN
Required Download

___________________________
@hacking_Attack
@Hacking_Video

Red Teaming Methodology
https://www.reddit.com/r/redteamsec/comments/x0wma2/red_teaming_methodology/

Hi, could you tell me what is the methodology or steps to follow a rem team exercise. Thanks. submitted by /u/Equivalent_Year154 (https://www.reddit.com/user/Equivalent_Year154)
[link] (https://www.reddit.com/r/redteamsec/comments/x0wma2/red_teaming_methodology/) [comments] (https://www.reddit.com/r/redteamsec/comments/x0wma2/red_teaming_methodology/)

___________________________
@hacking_Attack
@Hacking_Video

SUBDOMAIN TAKEOVER
https://medium.com/@ivishnujs/subdomain-takeover-5c4974aa782f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

What are Subdomains?Continue reading on Medium » (https://medium.com/@ivishnujs/subdomain-takeover-5c4974aa782f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Avaware Audits — Peace Of Mind For Projects & Users
https://avaware.medium.com/audited-by-avaware-c3b48596d55?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

The end of August is upon us already! The cryptocurrency community feels like it’s waking up from a short slumber compared to the last few…Continue reading on Medium » (https://avaware.medium.com/audited-by-avaware-c3b48596d55?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

SUBDOMAIN TAKEOVER

What are Subdomains?Continue reading on Medium »
Read more...

Avaware Audits — Peace Of Mind For Projects & Users

The end of August is upon us already! The cryptocurrency community feels like it’s waking up from a short slumber compared to the last few…Continue reading on Medium »
Read more...

Hack With SQL Injection Attacks! DVWA medium security — StackZero
https://infosecwriteups.com/hack-with-sql-injection-attacks-dvwa-medium-security-stackzero-d4af0a9a5f9?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

In this simple tutorial we are going to keep learn SQL Injection by exploiting DVWA at medium and high security level.Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/hack-with-sql-injection-attacks-dvwa-medium-security-stackzero-d4af0a9a5f9?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Git object decompress
https://www.reddit.com/r/redteamsec/comments/x109p4/git_object_decompress/

Using perl to decompress Git objects. Using "perl -MCompress::Zlib -e 'undef $/; print uncompress(<>)'" and I know it works. When I attempt to decompress one of the tree object, the results are in literal bytes. I was expecting a hash for the blob object, but I get a bunch of ?????ff???1?: 1W?\ Anyways, when I use python3, I get b'tree 69\x004000 code\x00\x9c\xf4f...' at which point I can almost reconstruct the full hash. It's not perfect either. Can anyone shed some light? submitted by /u/derpiestGuy (https://www.reddit.com/user/derpiestGuy)
[link] (https://www.reddit.com/r/redteamsec/comments/x109p4/git_object_decompress/) [comments] (https://www.reddit.com/r/redteamsec/comments/x109p4/git_object_decompress/)

___________________________
@hacking_Attack
@Hacking_Video

Hack With SQL Injection Attacks! DVWA medium security — StackZero

In this simple tutorial we are going to keep learn SQL Injection by exploiting DVWA at medium and high security level.Continue reading on InfoSec Write-ups »
Read more...

hacking: security in practice
Great Upcoming Hacking Competition by the Zero Day Initiative, pwn2own

https://external-preview.redd.it/SNLCWSDU6blBtIG8E6I1NGNcQQwMkLamqnvZv2HxUV0.jpg?width=108&crop=smart&auto=webp&s=67f510d985e7a3f8a54d2b9a84bf8536f4513355 submitted by /u/Daniel_SalesEngineer
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
hello from New Zealand!

Hello from New Zealand!

So a bit about me - I'm 34 years old, always been into IT and began some study after I left school (networking and hardware), however that never really eventuated and due to having kids, getting married and not having much luck in IT with a job that paid enough to support my family, I changed careers to become a builder with my wife's Dad. I'm at a point in my life where I'm seriously considering a change in career or atleast toying with the idea. I love cyber security and hacking hits me right! I have just recently purchased my first house so definitely can't take a pay cut and return to full time study so whatever I do has to be self taught in the evenings, so I'm wondering what are some of the best resources available online for me to start learning!? I really hope it's not too late in life to make this change but I feel I'd regret it if I didn't atleast try!

Thanks!

submitted by /u/-Buzzlightyear_
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
An iOS devs safety

I want to understand what damage can be done with the developers data from an xcode project. Let’s say someone gets ahold of my iOS project (Xcode) this has my name, API keys, and and project name. What damage could be done if this info got into the wrong hands? Project uses Firebase as well. Also a GitHub account and possible LinkedIn account. (These typically have the same info).

submitted by /u/Ambitious-Mortgage73
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can temp-mails be reused?

I remember in like 4th grade, i made a shitty arg facebook account, just to fuck with my friends, i used a temp mail (i think) from temp-mail .org and somehow at 3am (6 years later btw) it messaged me with just a literal thumbs up.

I don't know how this could happen, i dont even remember the password to the account, infact it says "This person is unavailable on messenger"

So can temp mails be reused? Was it hacked or was this just a facebook employee? Please help.

submitted by /u/BullWorst
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video