Log Monitoring Daemon - agentsmith

agentsmith is a daemon that continuously monitors a log file for
break-in attempts by remote hosts.


Upon detection of a break-in attempt, it launches a user defined script or application, which can do virtually anything from sending mails to whatever you might think of, e.g: monitor

ºmail logs and block spammers right away
ºfirewall logs and block malicious hosts
ºlogs for brute-force login attempts using ssh and block them

The criteria what is considered a break-in attempt can be configured by means of a regular expression.


As of version 0.2, agentsmith is able to exchange host information with other agentsmith instances running on remote hosts and thus trigger actions on remote hosts. It uses OpenSSL to accomplish this in a secure manner. It runs on Solaris, *BSD, and Linux and requires the PCRE library and OpenSSL as external dependencies.


Log Monitoring Daemon: agentsmith Installation


The build and installation is pretty straight forward. First, call

$ ./configure
$ make
$ make install

By default, the pid file used by the daemon will live in $LOCALSTATEDIR/agentsmith/agentsmith.pid

The default location of the configuration file is $SYSCONFDIR/agentsmith/agentsmith.conf

Those location can be changed by either specifying –localstatedir=<PATH>, –sysconfdir=<PATH>, –with-pid=<FILEPATH>, or –with-config=<FILEPATH>.


If the PCRE or OpenSSL library cannot be found, make sure you set the proper CPPFLAGS, and LDFLAGS environment variable before calling configure, e.g.

$ export CPPFLAGS='-I/usr/local/include'
$ export LDFLAGS='-L/usr/local/lib'

Further, ensure that the development packages for PCRE and OpenSSL are installed, this is especially important if you build agentsmith on a Linux distribution.

Download  agentsmith

Read More

Blind SQL Injections - BSQL Hacker

BSQL (Blind SQL) Hacker is an automated SQL Injection Framework / Tool designed to exploit SQL injection vulnerabilities virtually in any database.

BSQL Hacker aims for experienced users as well as beginners who want to automate SQL Injections (especially Blind SQL Injections).It allows metasploit alike exploit repository to share and update exploits.

Blind SQL Hacker Key Features


ºEasy Mode
ºSQL Injection Wizard
ºAutomated Attack Support (database dump)
ºORACLE
ºMSSQL
ºMySQL (experimental)

ºGeneral
ºFast and Multithreaded
º4 Different SQL Injection Support
ºBlind SQL Injection
ºTime Based Blind SQL Injection
ºDeep Blind (based on advanced time delays) SQL Injection
ºError Based SQL Injection
ºCan automate most of the new SQL Injection methods those relies on Blind SQL Injection
ºRegEx Signature support
ºConsole and GUI Support
ºLoad / Save Support
ºToken / Nonce / ViewState etc. Support
ºSession Sharing Support
ºAdvanced Configuration Support
ºAutomated Attack mode, Automatically extract all database schema and data mode

ºUpdate / Exploit Repository Features
ºMetasploit alike but exploit repository support
ºAllows to save and share SQL Injection exploits
ºSupports auto-update
ºCustom GUI support for exploits (cookie input, URL input etc.)

ºGUI Features
ºLoad and Save
ºTemplate and Attack File Support (Users can save sessions and share them. Some sections like username, password or cookie in the templates can be show to the user in a     GUI)
ºVisually view true and false responses as well as full HTML response, including time and stats

ºConnection Related
ºProxy Support (Authenticated Proxy Support)
ºNTLM, Basic Auth Support, use default credentials of current user/application
ºSSL (also invalid certificates) Support
ºCustom Header Support

ºInjection Points (only one of them or combination)
ºQuery String
ºPost
ºHTTP Headers
ºCookies

ºOther
ºPost Injection data can be stored in a separated file
ºXML Output (not stable)
ºCSRF protection support

Download BSQL Hacker

Read More

Final Released - Bruter v1.0

Bruter is a parallel network login brute-forcer on Win32. This tool is intended to demonstrate the importance of choosing strong passwords. The goal  is to support a variety of services that allow remote authentication.


It currently supports following services:

º FTP
º HTTP (Basic)
º HTTP (Form)
º IMAP
º MSSQL
º MySQL
º POP3
º SMB-NT
º SMTP
º SNMP
º SSH2
º Telnet
º VNC

Bruter Recent Changes

º Re-licensed to new-BSD license
º Added proxy support (CONNECT, SOCKS4, SOCKS5)
º Allowed more delimiter in combo file
º Added password length filtered in combo and dictionary mode
º Fixed miscellaneous bugs
º Updated openssl library to 0.9.8n

Download Bruter

Read More

V For Vendetta

The story begins after the end of political conflict with the disabled concentration camps and compliant population with the situation until it comes "V" - an Anarchist wearing a stylized Guy Fawkes mask and is possessed of a wide range of skills and resources. He then begins an elaborate and theatrical campaign to overthrow the state .

In the process, you know Evey , girl who lost her parents during the war. Evey is handled by V as an apprentice , always being presented to the remnants of a culture lost because of the war and degradation of society.






 Source: topfilmesonlinehd 

 By OffensiveSec

Read More

AfterGlow

AfterGlow is a collection of scripts which facilitate the process of generating link graphs. The tool is written in Perl and needs to be invoked via the command line. Sorry, there is no graphical interface, however using the tool is quite simple. As input, AfterGlow expects a CSV file. The file can either contain two or three columns of data. A common way of generating the CSV files are parsers which take a raw input file, analyze it and output a comma separated list of records based on the data they found. The output of AfterGlow is one of two formats. Either it generates a dot attributed graph language file – the input required by the graphviz library – or it can generate GDF files that can, for example, be visualized with Gephi.

AfterGlow Parsers

AfterGlow provides a couple of example parsers to generate CSV input files. The first one to parse tcpdump output and the second one to parse sendmail log files. Here is an example of how to run the tcpdump parser file:


tcpdump -vttttnneli eth0 | parsers/tcpdump2csv.pl "sip dip dport"


This command will invoke tcpdump on interface eth0 and pipe the input through the parser. We tell the parser that we are interested in the source IP (sip), the destination IP (dip) and the destination port (dport). To see what other fields are available, have a look at the parser. The output of this command is a comma separate list of sip, dip, dport pairs for each of the lines tcpdump outputs. For example, if the tcpdump output is the following:


18:46:27.849292 IP 192.168.0.1.39559 > 127.0.0.1.80: S 1440554803:1440554803(0) win 32767 
18:46:27.849389 IP 192.168.0.1.80 > 127.0.0.1.39559: S 1448343500:1448343500(0) ack 1440554804 win 32767


the output would simply be:


192.168.0.1,127.0.0.1,80
192.168.0.1,127.0.0.1,80


You might wonder why the second entry shows the source and destination inverted, not following the exact output of tcpdump. Well, that’s because the parser remembers the source of a communication and automatically inverts the responses to reflect that behavior. It outputs the direction of the communication (client to server) and not the direction of the packets. This is very useful when visualizing network traffic. Think about it!

Another possible way to generate input for AfterGlow is to use Microsoft Excel, manually enter the data and save the output as a CSV file.


Invocation


To generate a dot graph file for graphviz, run the following command:


cat file.csv | perl afterglow.pl -c color.properties > file.dot


This file can then be used with dot or neato to render a graph.

Putting this all together, here is an example on how to generate a graph (gif file) from a saved pcap file:


tcpdump -vttttnnelr /home/ram/defcon.tcpdump | ./tcpdump2csv.pl "sip dip dport" | \
perl afterglow.pl -c color.properties | neato -Tgif -o test.gif


Invoking afterglow.pl, we specified a color property file. This file is used by AfterGlow to determine the colors of the edges and nodes in the graph. Read the section further down to find out more about that file.



Command Line Parameters


This is a list of all the command line parameters that afterglow.pl understands:


perl afterglow.pl [-adhnstv] [-b lines] [-c conffile] [-e length] [-f threshold ] [-g threshold] [-l lines] [-o threshold] [-p mode] [-x color] [-m maxsize]



-a                   : turn off labelelling of the output graph with the configuration used
-b  lines            : number of lines to skip (e.g., 1 for header line)
-c  conffile         : color config file
-d                   : print node count
-e  length           : edge length
-f  threshold        : source fan out threshold
-g  threshold        : event fan out threshold (only in three node mode)
-h                   : this (help) message
-l  lines            : the maximum number of lines to read
-m                   : the maximum size for a node
-n                   : don't print node labels
-o  threshold        : omit threshold (minimum count for nodes to be displayed) 
                       Non-connected nodes will be filtered too.
-p  mode             : split mode for predicate nodes where mode is
                       0 = only one unique predicate node (default)
                       1 = one predicate node per unique subject node.
                       2 = one predicate node per unique target node.
                       3 = one predicate node per unique source/target node.
-s                   : split subject and object nodes
-t                   : two node mode (skip over objects)
-u                   : export URL tags
-v                   : verbose output
-x                   : text label color

Download AfterGlow 

Read More

Network Forensics - Xplico

Xplico is a network forensics analysis tool (NFAT), which is a software that reconstructs the contents of acquisitions performed with a packet sniffer (e.g. Wireshark, tcpdump, Netsniff-ng).

Unlike the protocol analyzer, whose main characteristic is not the reconstruction of the data carried by the protocols, Xplico was born expressly with the aim to reconstruct the protocols's application data and it is able to recognize the protocols with a technique named Port Independent Protocol Identification (PIPI).

The name "xplico" refers to the latin verb explico and its significance.

Xplico is free and open-source software, subject to the requirements of the GNU General Public License (GPL), version 2.


Ubuntu 32/64bit from 11.04 to 15.10

sudo bash -c 'echo "deb http://repo.xplico.org/ $(lsb_release -s -c) main" >> /etc/apt/sources.list'
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 791C25CE
sudo apt-get update
sudo apt-get install xplico


VirtualBox Image:

Download OVA here.
Based on  Free VirtualBox Image.
user: ubuntu
password: reverse

Source code:

Download here.
Installation instructions are in the INSTALL file and in the Wiki.


Ubuntu 12.10 32bit:

Download here.

Ubuntu Server 12.10 64bit:


Download here

Deafult Users

user: admin, xplico
password: xplico, xplico

Download Xplico

Read More

Digital Forensics Framework - DFF

Digital Forensics Framework offers a graphical user interface (GUI) developed in PyQt and a classical tree view. Features such as recursive view, tagging, live search and bookmarking are available. Its command line interface allows the user to remotely perform digital investigation. It comes with common shell functions such as completion, task management, globing and keyboard shortcuts. DFF can run batch scripts at startup to automate repetitive tasks. Advanced users and developers can use DFF directly from a Python interpreter to script their investigation.

Download DFF

Read More

Digital Forensics - Autopsy

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.

Download Autopsy

Read More

Volatility 2.5 - Memory Forensics

This is the first release since the publication of The Art of Memory Forensics! It adds support for Windows 10 (initial), Linux kernels 4.2.3, and Mac OS X El Capitan. Additionally, the unified output rendering gives users the flexibility of asking for results in various formats (html, sqlite, json, xlsx, dot, text, etc.) while simplifying things for plugin developers. In short, less code leads to more functionality. This is especially useful for framework designers (GUIs, web interfaces, library APIs), because you can interface with a plugin directly and ask for json, which you then store, process, or modify however you want. 

Download Volatility 2.5

Read More