Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials
GraphCrawler : GraphQL Automated Security Testing Toolkit

Graph Crawler is the most powerful automated testing toolkit for any GraphQL endpoint.

Version 1.2 is out

NEW: Can search for endpoints for you using Escape Technology’s powerful Graphinder tool. Just point it towards a domain and add the ‘-e’ option and Graphinder will do subdomain enumeration + search popular directories for GraphQL endpoints. After all this GraphCrawler will take over and work through each find. If the schema can not be introspected, you can supply it as a json file with the ‘-s’ option.

It will run through and check if mutation is enabled, check for any sensitive queries available, such as users and files, and it will also test any easy queries it find to see if authentication is required.

If introspection is not enabled on the endpoint it will check if it is an Apollo Server and then can run Clairvoyance to brute force and grab the suggestions to try to build the schema ourselves. (See the Clairvoyance project for greater details on this). It will then score the findings 1-10 with 10 being the most critical.

If you want to dig deeper into the schema you can also use graphql-path-enum to look for paths to certain types, like user IDs, emails, etc.

I hope this saves you as much time as it has for me

Usage

python graphCrawler.py -u https://test.com/graphql/api -o -a “”

██████╗ ██████╗ █████╗ ██████╗ ██╗ ██╗ ██████╗██████╗ █████╗ ██╗ ██╗██╗ ███████╗██████╗
██╔════╝ ██╔══██╗██╔══██╗██╔══██╗██║ ██║██╔════╝██╔══██╗██╔══██╗██║ ██║██║ ██╔════╝██╔══██╗
██║ ███╗██████╔╝███████║██████╔╝███████║██║ ██████╔╝███████║██║ █╗ ██║██║ █████╗ ██████╔╝
██║ ██║██╔══██╗██╔══██║██╔═══╝ ██╔══██║██║ ██╔══██╗██╔══██║██║███╗██║██║ ██╔══╝ ██╔══██╗
╚██████╔╝██║ ██║██║ ██║██║ ██║ ██║╚██████╗██║ ██║██║ ██║╚███╔███╔╝███████╗███████╗██║ ██║
╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚═╝ ╚═╝ ╚══╝╚══╝ ╚══════╝╚══════╝╚═╝ ╚═╝

The output option is not required and by default it will output to schema.json

Example output
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgwbzuS4shMg33vZpiLw4xrLtsLK8GXrMwxvKTfAH41XJ5-YXPPCbr85MknuyM58UFqYS1fJfcsYhJwCtuJVXm1XCv9lTsxH8-M3grQyq_aX7Qvi65Wwh8oFPo7j15-5BpQ0KApZh3Nu9uUoKHEax1rI06lM6XKHyuM3ISwFDNIz6iQir2CMWQ1RmMm/s618/output.png
Requirements

* Python3
* Docker
* Install all Python dependencies with pip

Wordlist from google-10000-english
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

GraphCrawler : GraphQL Automated Security Testing Toolkit

Graph Crawler is the most powerful automated testing toolkit for any GraphQL endpoint. It will run through and check if mutation is enabled.

15 viewsedited 11:01

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Administrator Passwort vergessen MacBook

Hey, ich habe mein Administrator Passwort vergessen, habe keine Rechnung mehr, weil ich das MacBook gebraucht auf eBay gekauft habe. Deshalb verweigert Apple mir ihre Hilfe. Es ist ein MacBook Pro von 2017. Die Daten habe ich alle gesichert. Ein Festplatten Austausch ist bei dem Modell nicht möglich. Die Methode mit Cmd + S habe ich schon ausprobiert, ich kann aber nichts in die Befehlsleiste eingeben, wenn alle Befehlsleisten runtergelaufen sind verschwinden sie wieder alle und ich lade auf dem Sperrbildschirm. Ich habe gehört, dass es einen Weg gibt, Arch Linus runterzuladen und damit die Festplatte zu "reparieren". Genauso habe ich es schon probiert, indem ich Windows gebootet habe, das hat aber nicht funktioniert. Auch wenn man MacOs neu aufsetzt habe ich weiterhin keine Administratorrechte. Danke für die Hilfe. Ich würde mich über "Anleitungen" freuen.

Mit freundlichen Grüßen

submitted by /u/Technical_Mistake_58
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Administrator Passwort vergessen MacBook

Hey, ich habe mein Administrator Passwort vergessen, habe keine Rechnung mehr, weil ich das MacBook gebraucht auf eBay gekauft habe. Deshalb...

14 viewsedited 11:55

Hacking Articles Tips Tricks Videos Tutorials

12 views12:44

Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools!
Pinecone - A WLAN Red Team Framework

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Pinecone - A WLAN Red Team Framework

13 viewsedited 12:44

Hacking Articles Tips Tricks Videos Tutorials

Pinecone - A WLAN Red Team Framework
http://www.kitploit.com/2022/09/pinecone-wlan-red-team-framework.html

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Pinecone - A WLAN Red Team Framework

12 viewsedited 13:01

Hacking Articles Tips Tricks Videos Tutorials

12 views13:01

Hacking Articles Tips Tricks Videos Tutorials

InstallationFor running Pinecone, you need a Debian-based operating system (it has been tested on Raspbian, Raspberry Pi (https://www.kitploit.com/search/label/Raspberry%20Pi) Desktop and Kali Linux). Pinecone has the following requirements:Python 3.5+. Your distribution probably comes with Python3 already installed, if not it can be installed using apt-get install python3.dnsmasq (tested with version 2.76). Can be installed using apt-get install dnsmasq.hostapd-wpe (tested with version 2.6). Can be installed using apt-get install hostapd-wpe. If your distribution repository does not have a hostapd-wpe package, you can either try to install it using a Kali Linux repository pre-compiled package (https://http.kali.org/pool/main/h/hostapd-wpe), or compile it from its source code (https://github.com/aircrack-ng/aircrack-ng/tree/master/patches/wpe/hostapd-wpe).After installing the necessary packages, you can install the Python packages requirements (https://www.kitploit.com/search/label/Requirements) for Pinecone using pip3 install -r requirements.txt in the project root folder.UsageFor starting Pinecone, execute python3 pinecone.py from within the project root folder:root@kali:~/pinecone# python pinecone.py
[i] Database file: ~/pinecone/db/database.sqlite
pinecone >
Pinecone is controlled via a Metasploit-like command-line interface. You can type help to get the list of available commands, or help 'command' to get more information about a specific command:pinecone > help

Documented commands (type help ):
========================================
alias help load pyscript set shortcuts use
edit history py quit shell unalias

Undocumented commands:
======================
back run stop

pinecone > help use
Usage: use module [-h]

Interact with the specified module.

positional arguments:
module module ID

optional arguments:
-h, --help show this help message and exit
Use the command use 'moduleID' to activate a Pinecone module. You can use Tab auto-completion to see the list of current loaded modules:pinecone > use
attack/deauth daemon/hostapd-wpe report/db2json scripts/infrastructure/ap
daemon/dnsmasq discovery/recon scripts/attack/wpa_handshake
pinecone > use discovery/recon
pcn module(discovery/recon) >
Every module has options, that can be seen typing help run or run --help when a module is activated. Most modules have default values for their options (check them before running):pcn module(discovery/recon) > help run
usage: run [-h] [-i INTERFACE]

optional arguments:
-h, --help show this help message and exit
-i INTERFACE, --iface INTERFACE
monitor mode capable WLAN interface (default: wlan0)
When a module is activated, you can use the run [options...] command to start its functionality. The modules provide feedback of their execution state:pcn script(attack/wpa_handshake) > run -s TEST_SSID
[i] Sending 64 deauth frames to all clients from AP 00:11:22:33:44:55 on channel 1...
................................................................
Sent 64 packets.
[i] Monitoring for 10 secs on channel 1 WPA handshakes between all clients and AP 00:11:22:33:44:55...
If the module runs in background (for example, scripts/infrastructure/ap), you can stop it using the stop command when the module is running:When you are done using a module, you can deactivate it by using the back command. You can also activate another module issuing the use command again. Shell commands may be executed with the command shell or the ! shortcut:pinecone > !ls
LICENSE modules module_template.py pinecone pinecone.py README.md requirements.txt TODO.md
Currently, Pinecone reconnaissance (https://www.kitploit.com/search/label/Reconnaissance) SQLite database is stored in the db/ directory inside the project root folder. All the temporary files that Pinecone needs to use are stored in the tmp/ directory also under the project root folder.

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.

12 viewsedited 13:01

Hacking Articles Tips Tricks Videos Tutorials

Download Pinecone (https://github.com/pinecone-wifi/pinecone)

___________________________
@hacking_Attack
@Hacking_Video

GitHub

GitHub - pinecone-wifi/pinecone: A WLAN red team framework.

A WLAN red team framework. Contribute to pinecone-wifi/pinecone development by creating an account on GitHub.

13 viewsedited 13:01

Hacking Articles Tips Tricks Videos Tutorials

11 views14:53

Hacking Articles Tips Tricks Videos Tutorials