KitPloit - PenTest Tools!
autoSSRF - Smart Context-Based SSRF Vulnerabiltiy Scanner

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-JaILtfigUubebTUNqpF1TWzOVEKQhY3xq7ywDG_35FE-KFLxsIDQkQz7aHeulzlY1zHT8q-1xlVHRRsUAd_bd9IY_jKYjfESkoFZQmTI5lP_2sB0KKu_CoeJzJUohlD7cjqa6Bgpf1lJTPg42seSD_JQrb5b2tI5mSoVVGUSs0ivfXLX-PBjIKCTgg/w640-h274/SSRF.png
autoSSRF is your best ally for identifying SSRF vulnerabilities at scale. Different from other ssrf automation tools, this one comes with the two following original features :

*
Smart fuzzing on relevant SSRF GET parameters

When fuzzing, autoSSRF only focuses on the common parameters related to SSRF (?url=, ?uri=, ..) and doesn’t interfere with everything else. This ensures that the original URL is still correctly understood by the tested web-application, something that might doesn’t happen with a tool which is blindly spraying query parameters.

*
Context-based dynamic payloads generation

For the given URL : https://host.com/?fileURL=https://authorizedhost.com, autoSSRF would recognize authorizedhost.com as a potentially white-listed host for the web-application, and generate payloads dynamically based on that, attempting to bypass the white-listing validation. It would result to interesting payloads such as : http://authorizedhost.attacker.com, http://authorizedhost%252F@attacker.com, etc.
Furthermore, this tool guarantees almost no false-positives. The detection relies on the great ProjectDiscovery’s interactsh, allowing autoSSRF to confidently identify out-of-band DNS/HTTP interactions.
Usage

python3 autossrf.py -h

This displays help for the tool.

usage: autossrf.py [-h] [--file FILE] [--url URL] [--output] [--verbose]

options:
-h, --help show this help message and exit
--file FILE, -f FILE file of all URLs to be tested against SSRF
--url URL, -u URL url to be tested against SSRF
--output, -o output file path
--verbose, -v activate verbose mode

Single URL target:

python3 autossrf.py -u https://www.host.com/?param1=X¶m2=Y¶m2=Z

Multiple URLs target with verbose:

python3 autossrf.py -f urls.txt -v

Installation

1 - Clone

git clone https://github.com/Th0h0/autossrf.git

2 - Install requirements

Python libraries :

cd autossrf
pip install -r requirements.txt

Interactsh-Client :

go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest

License

autoSSRF is distributed under MIT License.
Download Autossrf

___________________________
@hacking_Attack
@Hacking_Video

Bug Zero at a Glance [Week 5–11 November]

Bug Zero is happy to be a part of #GEW2022Continue reading on Bug Zero »
Read more...

Bug Zero at a Glance [Week 5–11 November]
https://blog.bugzero.io/bug-zero-at-a-glance-week-5-11-november-354a2325a07?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Bug Zero is happy to be a part of #GEW2022Continue reading on Bug Zero » (https://blog.bugzero.io/bug-zero-at-a-glance-week-5-11-november-354a2325a07?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

New here !
https://www.reddit.com/r/Pentesting/comments/yt8168/new_here/

submitted by /u/Cryptonoob9988 (https://www.reddit.com/user/Cryptonoob9988)
[link] (https://www.reddit.com/r/Pentesting/comments/yt8168/new_here/) [comments] (https://www.reddit.com/r/Pentesting/comments/yt8168/new_here/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Kali Linux airodump-ng doesn't show ESSID's (

I'm pretty new here, so bear with me.
When running airodump-ng wlan0mon in Kali, it picks up several AP's, including my own router. The BSSID's of all AP's are shown without an issue. All of the ESSID's are displayed as /u/osciiator
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Wagyu XSS

Hi everyone, so I have been working on this tool for a few months now and it’s still very early stages but I thought I’d share it with everyone!

Wagyu is a dynamic cross-site scripting payload delivery system with team server abilities. I’m super excited for where this app is heading and all your guys support would be greatly appreciated.

All suggestions and improvements are encouraged, you can check it out here: Wagyu XSS

submitted by /u/JamiP42
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Timing Attacks

https://cdn-images-1.medium.com/max/670/0*hyGnYs7QfBtSgI52.jpg
Timing attacks are security exploits that attack the system by analyzing how long it takes to process different inputs. These kinds of…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe VulnNet: dotjar Writeup

https://cdn-images-1.medium.com/max/940/1*zeB5ADL_fAlnMI36AtdPGg.png
VulnNet: dotjar Walkthrough

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Tr0ll:1

https://cdn-images-1.medium.com/max/600/1*bcMVRDFKuY9OKmXiIc4QQw.png
Herkese Merhaba,

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Minimum honeypot specs

I’m studying honeypot strategies and trying to understand how hackers might go about locating and qualifying targets AFTER they are roaming freely inside a corp network. I’ll ask my question in two ways 1) what are the minimum characteristics to make it look like a legit target (e.g. data volume, types of data, last modified meta data, what services). Or 2) what would be the giveaways that it’s a honeypot aside from really obvious naming conventions like “banking” folder :). How would you construct something that looks normal ?

submitted by /u/2BucChuck
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Does something like barcode injection exist?

Does something like that exist? Like if you "infect" the barcode with malicious code. I am really sorry if this sound really stupid. I don't fully know how barcodes work and this is just a random idea I got.

submitted by /u/Ill_Garage7425
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
c0lddbox : Walkthrough

https://cdn-images-1.medium.com/max/1357/1*nG3DW7ulPygt4991iwuAVw.gif
This is a write-up for the VulnHub CTF machine, COLDDBOX: EASY (download here). Recently, I had a project to solve this machine, and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Kali Linux GUI on Windows

https://cdn-images-1.medium.com/max/1600/0*4HYL0HjZBxGv5mWC.jpg
How to set up Kali Linux with GUI on Windows 10

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video