akde/infosec

Click Here

  • Network packet analyzation and modification

    Scapy fundamentals Com­mands for the inter­ac­tive scapy interpreter: conf.iface shows the cur­rent­ly used interface  conf.iface='tun0' sets the inter­face to use ls shows all protocols ls(TCP) shows all known head­ers for a giv­en protocol lsc shows build-in functions Details about a pack­et p: p shows gen­er­al information p.summary() shows also gen­er­al information p.show() shows each field and…

  • Scapy

    Net­work pack­et manip­u­la­tion shell and library for Python. (Github)

  • Bettercap

    A Etter­cap suc­ces­sor, writ­ten in Go. Basic commands: Pas­sive ARP probing:  net.recon on net.recon off Active prob­ing: net.probe on net.probe off Sniff­ing: set net.sniff.output /tmp/sniff.pcap // optional net.sniff on net.sniff off Spoof­ing: set arp.spoof.targets $target1, $target2, $target3 arp.spoof on arp.spoof off DNS Spoof­ing: set dns.spoof.domains target.domain // the domain which should be resolved as… set…

  • Shellter: Adding payloads in executeables

    Shell­ter kann add a reverse shell pay­load into a exe file.

  • PowerShell Empire

    Main­ly post exploita­tion for AD envi­ron­ments. (Down­load — also includ­ed in Kali sources) Quick usage for privilege escalation General usage Metas­ploit syn­tax / PSE syntax Note: After use­mod­ule don’t for­get to go “back” and to “inter­act” with the agent to see job results! Com­mands with an aster­ix require a high-integri­ty Empire Agent. To upgrade one…

  • Beef

    https://beefproject.com/ Injects code into a site which tracks all actions from a user and sends it back. The brows­er can also be controlled!

  • Drupal

    Down­load: https://github.com/droope/droopescan droopescan scan drupal -u http://$target/ -t 32 Or just install via pip pip install droopescan

  • Joomla: Jomscan

  • Sniffing network traffic (tcpdump)

    tcpdump Get incom­ing ICMP packets: sudo tcpdump -i any icmp and src host $target Nützliche Parameter Domains nicht auflösen, IPs anzeigen -n Dump der Dat­en anzeigen -X Paket in ASCII anzeigen -A Umgang mit Dateien Dump in Datei schreiben tcpdump -w file Dump aus Datei lesen tcpdump -r file Standard-Abfragen tcpdump -n src|dst 10.10.10.10 and port…

  • Wireshark

    See a pack­et in its context Kontextmenü, Follow auswählen Show only ICMP pack­ets from a host tcpdump host 10.11.1.128 and icmp -i tun0 Show oth­er sys­tems com­mu­ni­cat­ing out­side the own address ip.addr == 10.11.1.0/24 && !(ip.addr == 192.168.119.0/24) && ! dns && !browser && !ssdp && !nbns && !llmnr Record audio Wire­shark can trans­form cap­tured audio…

  • ncat

    Namenskonfusion Datei ausliefern: echo -e "HTTP/1.1 200 OK\nContent-Length: 5\n\nHallo" | nc -l localhost 8000 Datei anfragen über SSL: echo -e "GET / HTTP/1.1\nHost: localhost\n\n" | ncat -C --ssl localhost 443 Gebe Ausgabe von Programm zurück: ncat -l localhost 3000 --exec /bin/date Datei direkt übertragen (unverschlüsselt!): 1. Empfänger: user@host02:~$ ncat -l > aha oder nc -nlvp 4444…

  • Linux Smart Enumeration

    https://github.com/diego-treitos/linux-smart-enumeration This script will show rel­e­vant infor­ma­tion about the secu­ri­ty of the local Lin­ux system. Quick install Details from the manual It has 3 lev­els of ver­bosi­ty so you can con­trol how much infor­ma­tion you see. In the default lev­el you should see the high­ly impor­tant secu­ri­ty flaws in the sys­tem. The lev­el 1 (./lse.sh -l1)…

  • FTP File Transfer Protocol

    Note that FTP does­n’t show hid­den files! Try in Win­dows e.g “cd ProgramData”. Enumeration With nmap. Scans a net­work for ftp servers which allow anony­mous access. nmap -v -p21 --script=ftp-anon.nse 10.11.1.1-254 FTP relays The FTP spec­i­fi­ca­tion defines FTP relays. One FTP serv­er can say to anoth­er FTP serv­er to send files to anoth­er third-par­ty serv­er.…

  • redline

    Like OSX­col­lec­tor, but for Win­dows. Col­lects infor­ma­tion on a host for lat­er analyzation. https://www.fireeye.com/services/freeware/redline.html

  • osxcollector

    osx­col­lec­tor http://yelp.github.io/osxcollector/ Stand alone python script. Exe­cute it on a Mac which should be analysed. It cre­ates an archive with “every­thing” inter­esst­ing which the vic­tim can hand over an expert. See red­line for Windows

  • Ettercap

    Sniff­ing and live con­tent fil­ter­ing. Oper­a­tion modes: Uni­fied:  sniffs all pack­ets from one inter­face. Pack­ets for an attack host are end­ing here, but are direct­ly for­ward­ed after receiving Brid­get: For­wards traf­fic from one inter­face to anoth­er. Absolute­ly secret because there is real­ly no one “between the cable” Usage ettercap OPTIONS TARGET1 TARGET2 Tar­gets are defined as MAC/IPv4s/IPv6s/PORT…

  • p0f

    Pas­sive OS fingerprinting http://tools.kali.org/information-gathering/p0f

  • dnmap

    Dis­trib­uted port scan­ning. Install dnmap_client on many machines and install one dnsmap_server. The serv­er con­trols the clients to split port scans. http://tools.kali.org/information-gathering/dnmap

  • dmitry

    Active Infor­ma­tion Gath­er­ing tool. See http://tools.kali.org/information-gathering/dmitry

  • sslyze

    Analy­ses SSL https://github.com/nabla-c0d3/sslyze python ‑m sslyze –reg­u­lar URL

  • WordPress

    Enumeration Github wpscan --url $target Maybe an API token could be use­ful — then, the Word­Press Vul­ner­a­bil­i­ty Data­base is used. Login brute force hydra -l thinc -P best110.txt 10.11.1.234 -V http-form-post '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location' Check users: http://spectra.htb/main/?author=1 http://spectra.htb/main/?author=2 … Most beautiful wordpress plugin XSS injection If there is a way to inject code some­where (e.g. via a plu­g­in)…

  • Nikto

    Web serv­er scanner ./nikto.pl ‑host <IP> scans a host and cre­ates a report with details and pos­si­ble vulnerabilities. Inter­est­ing parameters: -eva­sion [12345678AB] (see options) -mutate (see options) -Pause -Save -T (see options)