Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools!
ApacheTomcatScanner - A Python Script To Scan For Apache Tomcat Server Vulnerabilities

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGj0uEW_yRh4LDfBQYUFlVp6udCKpAfXyGf2b5ZtJVzDC63sD3mamdTGUdNLsK_U1ebJ5VmYviqrXfPzJGt7x7ydzmRvVoTgMsWTOM0ulwXRnqsxHYkhY5q-Q56ePVZxarwrMeTi3pZRSM7cQ8ku8_gVlnn0zNy0VmvVQq-LBX37KK52wEJH5fXo8qeQ/w640-h118/ApacheTomcatScanner_1_banner.png A python script to scan for Apache Tomcat server vulnerabilities. Features* Multithreaded workers to search for Apache tomcat servers.
* Multiple target source possible:
* Retrieving list of computers from a Windows domain through an LDAP query to use them as a list of targets.
* Reading targets line by line from a file.
* Reading individual targets (IP/DNS/CIDR) from -tt/--targetoption.

* Custom list of ports to test.
* Tests for /manager/htmlaccess and default credentials.
* List the CVEs of each version with the --list-cvesoption InstallationYou can now install it from pypi with this command: sudo python3 -m pip install apachetomcatscanner Usage

$ ./ApacheTomcatScanner.py -h
Apache Tomcat Scanner v2.3.2 - by @podalirius_

usage: ApacheTomcatScanner.py [-h] [-v] [--debug] [-C] [-T THREADS] [-s] [--only-http] [--only-https] [--no-check-certificate] [--xlsx XLSX] [--json JSON] [-PI PROXY_IP] [-PP PROXY_PORT] [-rt REQUEST_TIMEOUT] [-tf TARGETS_FILE]
[-tt TARGET] [-tp TARGET_PORTS] [-ad AUTH_DOMAIN] [-ai AUTH_DC_IP] [-au AUTH_USER] [-ap AUTH_PASSWORD] [-ah AUTH_HASH]

A python script to scan for Apache Tomcat server vulnerabilities.

optional arguments:
-h, --help            show this help message and exit
-v, --verbose         Verbose mode. (default: False)
--debug               Debug mode, for huge verbosity. (default: False)
-C, --list-cves       List CVE ids affecting each version found. (default: False)
-T THREADS, --threads THREADS
Number of threads (default: 5)
-s, --servers-only    If querying ActiveDirectory, only get servers and not all computer objects. (default: False)
--only-http           Scan only with HTTP scheme. (default: False, scanning with both HTTP and HTTPs)
--only-https          Scan only with HTTPs scheme. (default: False, scanning with both HTTP and HTTPs)
--no-check-certificate
Do not check certificate. (default: False)
--xlsx XLSX           Export results to XLSX
--json JSON           Export results to JSON

-PI PROXY_IP, --proxy-ip PROXY_IP
Proxy IP.
-PP PROXY_PORT, --proxy-port PROXY_PORT
Proxy port
-rt REQUEST_TIMEOUT, --request-timeout REQUEST_TIMEOUT

-tf TARGETS_FILE, --targets-file TARGETS_FILE
Path to file containing a line by line list of targets.
-tt TARGET, --target TARGET
Target IP, FQDN or CIDR
-tp TARGET_PORTS, --target-ports TARGET_PORTS
Target ports to scan top search for Apache Tomcat servers.
-ad AUTH_DOMAIN, --auth-domain AUTH_DOMAIN
Windows domain to authenticate to.
-ai AUTH_DC_IP, --auth-dc-ip AUTH_DC_IP
IP of the domain controller.
-au AUTH_USER, --auth-user AUTH_USER Username of the domain account.
-ap AUTH_PASSWORD, --auth-password AUTH_PASSWORD
Password of the domain account.
-ah AUTH_HASH, --auth-hash AUTH_HASH
LM:NT hashes to pass the hash for this user.

Examplehttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjA5BOT_IN-jOKWt8XSNz9ut1eGifuyjiodzEs0aGdnHu0-6hAth2gF5P0auhgBmm1o-kwAilSBBc9yMhFSzATp9s5hbTN6m9POQ63QyVUQ4n2X2GVp9pSaBij3N2zh2EVT-538CBPfcFZS8_Pv0Kk8dNh8zygQdlT_xBKoas-zLOxHZNNdVm-vahN8Rw/w640-h140/ApacheTomcatScanner_8_example.png You can also list the CVEs of each version with the --list-cvesoption: https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhhSVHlX3F1eiMQ4WcTfJEJ1pftYgekVtVYnFrdN33_E2z8eR757bqJPlxVS2TaQZ_d6_PTadoRJwSVELA9il4Xtr5doJVgi5wY9qpPaW8Isa_6E2xymN_1qYhHQp3Ar1IRCJUkOHoXqTCCrEJU0OvAtTK8O_QKbiwSni_12jB-6frt5sYEhMPBozecug/w640-h290/ApacheTomcatScanner_9_example_list_cves.png ContributingPull requests are welcome. Feel free to open an issue if you want to add other features. Download ApacheTomcatScanner

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

ApacheTomcatScanner - A Python Script To Scan For Apache Tomcat Server Vulnerabilities

6 viewsedited 15:30

Hacking Articles Tips Tricks Videos Tutorials

Hacking Wireless Networks around the Globe.(Practical WIFI Hacking)

How to hack wireless networks.Continue reading on System Weakness »
Read more...

8 views16:55

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
What Vuln is this?

Noob here. Found a vuln in a website that allows me to change the user id in a url so i can view contents from another account. For example, my url when logged in is "/user/1111/uploads" if i change it to "user/1112/uploads" it shows me the content of another user's account. Is this considered an IDOR? or something else ?

submitted by /u/fuzzy_bunnyzZ
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

What Vuln is this?

Noob here. Found a vuln in a website that allows me to change the user id in a url so i can view contents from another account. For example, my...

7 viewsedited 18:13

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Recommended work station.

Wondering what the recommended work station is these days hardware/ os or is a libreboot think pad still the go to.

submitted by /u/StressedBananaBoy
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Recommended work station.

Wondering what the recommended work station is these days hardware/ os or is a libreboot think pad still the go to.

4 viewsedited 18:13

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
ADB Vendor Key Bypass Research/Help Needed

So, long story short, a small group on a forum and I have been trying to root the head unit of the new 2022 Honda Civic (I mainly focus on the 9-inch display model). So far, we managed to find the developer settings, turned on USB debugging, got the device powered through a USB Hub, and connected to a PC. However, when an ADB connection is attempted, the device is labeled as unauthorized and needs the ADB Vendor Keys variable. The OS is Android 8.1.0, so I know there are some vulnerabilities/exploits out there, but unless there is a way to bypass the vendor key requirement (or use some form of privilege escalation or payload execution), we are pretty much stuck. Does anyone have any insight? Any info that is needed to make progress in this endeavor can be provided.

submitted by /u/jamieden
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

ADB Vendor Key Bypass Research/Help Needed

So, long story short, a small group on a forum and I have been trying to root the head unit of the new 2022 Honda Civic (I mainly focus on the...

4 viewsedited 18:13

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Is it possible to work in cybersecurity as a freelancer?

Hello everyone, I'm really interested in the software engineering field and cybersecurity. Do you think it's possible to work remotely and as a freelancer in the last one I mentioned? it's really what intrigues me more between the two.

submitted by /u/Quiet_Bus_6404
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Is it possible to work in cybersecurity as a freelancer?

Hello everyone, I'm really interested in the software engineering field and cybersecurity. Do you think it's possible to work remotely and as a...

4 viewsedited 18:13

Hacking Articles Tips Tricks Videos Tutorials

3 views18:18

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
CyberTalents BootCamp 2022 #WPACrack

https://cdn-images-1.medium.com/max/1231/1*ftlrpA3AK8M0pDVBZOQWHQ.png
~ f3ru0s Kormy says … Congratulations!!! For making it to CyberTalents BootCamp 2022. Good Luck in your journey :)

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

CyberTalents BootCamp 2022 #WPACrack

~ f3ru0s Kormy says … Congratulations!!! For making it to CyberTalents BootCamp 2022. Good Luck in your journey :)

3 viewsedited 18:18