Python Network Pentesting Tool - Pythem

PytheM is a python network/pentesting tool. Same has been developed in the hope that it will be useful and i don't take responsabillity of any misapplication of it. Only for GNU/Linux OS.

Installation

$sudo git clone https://github.com/m4n3dw0lf/PytheM/ 
$cd PytheM 
$sudo pip install -r requirements.txt 
$sudo ./pythem

Features

• [Brute-Force]
• [Man-In-The-Middle]:
• [Remote]:
• [Sniffing]:
• [Scanning]:
• [Web]:
• [Wireless]:

Download Pythem

Read More

Network Logon Cracker - THC-Hydra 8.2

 A very fast network logon cracker which support many different services.

See feature sets and services coverage page - incl. a speed comparison against ncrack and medusa.Number one of the biggest security holes are passwords, as every password security study shows.

This tool is a proof of concept code, to give researchers and security consultants the possiblity to show how easy it would be to gain unauthorized access from remote to a system.

There are already several login hacker tools available, however none does either support more than one protocol to attack or support parallized connects.

It was tested to compile cleanly on Linux, Windows/Cygwin, Solaris, FreeBSD/OpenBSD, QNX (Blackberry 10) and OSX.

Currently this tool supports the following protocols:

Asterisk, AFP, Cisco AAA, Cisco auth, Cisco enable, CVS, Firebird, FTP, HTTP-FORM-GET, HTTP-FORM-POST, HTTP-GET, HTTP-HEAD, HTTP-PROXY, HTTPS-FORM-GET, HTTPS-FORM-POST, HTTPS-GET, HTTPS-HEAD, HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MS-SQL, MYSQL, NCP, NNTP, Oracle Listener, Oracle SID, Oracle, PC-Anywhere, PCNFS, POP3, POSTGRES, RDP, Rexec, Rlogin, Rsh, SAP/R3, SIP, SMB, SMTP, SMTP Enum, SNMP v1+v2+v3, SOCKS5, SSH (v1 and v2), SSHKEY, Subversion, Teamspeak (TS2), Telnet, VMware-Auth, VNC and XMPP.

CHANGELOG for 8.2

 ! Development moved to a public github repository: https://github.com/vanhauser-thc/thc-hydra
 
 * Added RTSP module, thanks to jjavi89 for supplying!
 * Added patch for ssh that fixes hyra stopping to connect, thanks to ShantonRU for the patch
 * Added new -O option to hydra to support SSL servers that do not suport TLS
 * Added xhydra gtk patche by Petar Kaleychev to support modules that do not use usernames
 * Added patch to redis for initial service checking by Petar Kaleychev - thanks a lot!
 * Added support in hydra-http for http-post (content length 0)
 * Fixed important bug in http-*://server/url command line processing
 * Added SSL SNI support
 * Fixed bug in HTTP Form redirection following - thanks for everyone who reported and especially to Hayden Young for setting up a test page for debugging
 * Better library finding in ./configure for SVN + support for Darwin Homebrew (and further enhanced)
 * Fixed http-form module crash that only occurs on *BSD/OSX systems. Thanks to zdk for reporting!
 * Fixed for SSL connection to support TLSv1.2 etc.
 * Support for different RSA keylengths, thanks to fann95 for the patch
 * Fixed a bug where the cisco-enable module was not working with the password-only logon mode
 * Fixed an out of memory bug in http-form
 * Fixed imap PLAIN method
 * Fixed -x option to bail if it would generate too many passwords (more than 4 billion)
 * Added warning if HYDRA_PROXY_CONNECT environment is detected, that is an outdated setting
 * Added --fhs switch to configure (for Linux distribution usage)

Download THC-Hydra 8.2

Read More

Collection Of Tools To Detect, Record And Prevent Attacks On Web Applications - Shadowd

Shadow Daemon is a collection of tools to detect , record and prevent attacks on web application. Technically speaking, Shadow Daemon is a web application firewall that intercepts requests and filters out malicious parameters. It is a modular system that separates web application, analysis and interface to increase security, flexibility and expandability.

This is the main component that handles the analysis and storage of requests.

Documentation
For the full documentation please refer to shadowd.zecure.org .

Installation

Preparation
Use cmake to configure and prepare the project. It is a good idea to create a separate directory for this. A typical installation might look like this.

mkdir build
cd build
cmake -DCMAKE_INSTALL_PREFIX:PATH=/usr -DCMAKE_BUILD_TYPE=Release ..

Compilation
If cmake is successful it creates a makefile. Use it to compile and install the project.

make shadowd
make install

Database
Install and configure a database server. At the moment shadowd officially supports PostgreSQL and MySQL. Afterwards create a new user and database for shadowd and import the correct layout.
If you are using PostgreSQL you can use psql to import the layout.

psql -Ushadowd shadowd < /usr/share/shadowd/pgsql_layout.sql

If you are using MySQL you can use mysql to import the layout. The user requires the CREATE ROUTINE privilege.

mysql -ushadowd -p shadowd < /usr/share/shadowd/mysql_layout.sql

Configuration
The installer copies the configuration file to /etc/shadowd/shadowd.ini . The file is annotated and should be self-explanatory.

Download Shadowd

Read More

Ruby In The Middle (HTTP/HTTPS Interception Proxy) - RITM

Ruby in the middle (RITM) is an HTTP/HTTPS interception proxy with on-the-fly certificate generation and signing, which leaves the user with the full power of the Ruby language to intercept and even modify requests and responses as she pleases.

Installation

    gem install ritm   

Basic usage

1. Write your interception handlers
   

   require 'ritm'
   
   # A single answer for all your google searches
   Ritm.on_request do |req|
     if req.request_uri.host.start_with? 'www.google.'
       new_query_string = req.request_uri.query.gsub(/(?<=^q=|&q=)(((?!&|$).)*)(?=&|$)/, 'RubyInTheMiddle')
       req.request_uri.query = new_query_string
     end
   end
   
   my_picture = File.read('i_am_famous.jpg')
   
   # Replaces every picture on the web with my pretty face
   Ritm.on_response do |_req, res|
     if res.header['content-type'] && res.header['content-type'].start_with?('image/')
       res.header['content-type'] = 'image/jpeg'
       res.body = my_picture
     end
   end

2. Start the proxy server
   

   proxy = Ritm::Proxy::Launcher.new
   proxy.start
   
   puts 'Hit enter to finish'
   gets
   
   proxy.shutdown

3. Configure your browser
   Or whatever HTTP client you want to intercept traffic from, to connect to the proxy in localhost:8080
   
4. Browse the web!
   For the examples above, search anything in google and also visit your favorite newspaper website.
   

Trusting self-signed certificates generated by RITM

With the previous example your client might have encountered issues when trying to access HTTPS resources. In some cases you can add an exception to your browser (or instruct your http client not to verify certificates) but in some other cases you won't be able to add exceptions. The reason for this is that in order to decrypt and to be able to modify SSL traffic, RITM will have to be the one doing the SSL negotiatiation with the client (using its own set of certificates) and then it will establish a separate SSL session towards the server. I.e.:

Client <--- SSL session ---> RITM <--- SSL session ---> Server

For every different server's hostname your client tries to communicate with, RITM will generate a certificate on the fly and sign it with a pre-configured Certificate Authority (CA). So, in order to be able to establish a secure connection you will need to configure your client (e.g. browser) to trust RITM's CA.

For security reasons, every time you start RITM's proxy with the default settings it will generate a new internal Certificate Authority. To use your own CA instead (so it can be loaded and trusted by your browser) perform the following steps:

1. Generate a Certificate Authority PEM and Private Key files
   You can use OpenSSL or RITM to generate these two files. With OpenSSL:
   

   openssl req -new -nodes -x509 -days 365 -extensions v3_ca -keyout insecure_ca.key -out insecure_ca.crt

   Or with RITM:
   

   require 'ritm/certs/ca'
   
   ca = Ritm::CA.create common_name: 'InsecureCA'
   
   File.write('insecure_ca.crt', ca.pem)
   File.write('insecure_ca.key', ca.private_key.to_s)

2. Repeat step 2 from the previous example, this time indicating what CA should be used to sign certificates
   

   proxy = Ritm::Proxy::Launcher.new(ca_crt_path: 'path/to/insecure_ca.crt',
                                     ca_key_path: 'path/to/insecure_ca.key')
   proxy.start
   
   puts 'Hit enter to finish'
   gets
   
   proxy.shutdown

3. Trust the CA certificate into your browser or client
   I'll leave it to you to figure out how this is done in your browser or client.
   
4. Surf the web!
5. When you are done Remove the CA from your trusted authorities!
   Or take really good care of the CA private key since anyone in possession of that key will be capable of decrypting all your traffic! Also notice that when using the proxy every server will be automatically trusted even if the end server certificate is not valid.

Download RITM

Read More

Hackpack & Kali Linux Tools - Lalin

Lalin is a remake of Lazykali by bradfreda with fixed bugs , added new features and uptodate tools . It's compatible with the latest release of Kali (Rolling)

Changelog

Lalin gets updated weekly with new features, improvements and bugfixes. Be sure to check out the [Changelog]

How it works

• Extract The lalin-master to your home or another folder
• chmod +x Lalin.sh
• And run the tools
• Easy to Use just input your number

Usage

How to start a script?

$ sudo chmod +x Lalin.sh

$ sudo ./Lalin.sh

Screenshots

Credits

1. Miffly @Edo -m- main developer of Lalin
   
2. Bradfrea @Lazykali main developer of Lazykali
3. Daniel for lazynmap www.commonexploits.com
4. https://github.com/mazen160/Firefox-Security-Toolkit
5. http://www.linuxsec.org/ ( Jack Wilder )
6. Offensive Secuirty for the awesome os
7. http://www.kali.org
8. http://www.offensive-security.com

Disclaimer
Note: modifications, changes, or alterations to this sourcecode is acceptable, however,any public releases utilizing this code must be approved by writen this tool ( Edo -m- ).

Download Lalin

Read More

Web Application XSS Scanner - XssPy

XssPy is a python tool for finding Cross Site Scripting vulnerabilities in websites. This tool is the first of its kind. Instead of just checking one page as most of the tools do, this tool traverses the website and find all the links and subdomains first. After that, it starts scanning each and every input on each and every page that it found while its traversal. It uses small yet effective payloads to search for XSS vulnerabilities.

The tool has been tested parallel with paid Vulnerability Scanners and most of the scanners failed to detect the vulnerabilities that the tool was able to find. Moreover, most paid tools scan only one site whereas XSSPY first finds a lot of subdomains and then scan all the links altogether. The tool comes with:

• Short Scanning
• Comprehensive Scanning
• Finding subdomains
• Checking every input on every page

With this tool, Cross Site Scripting vulnerabilities have been found in the websites of MIT, Stanford, Duke University, Informatica, Formassembly, ActiveCompaign, Volcanicpixels, Oxford, Motorola, Berkeley and many more.

Download XssPy

Read More

A Tool that Transforms Firefox Browsers into a Penetration Testing Suite - Firefox Security Toolkit

A tool that transforms Firefox Browsers into a penetration testing suite

How?

It downloads the most important extensions, and install it on your browser. The used extensions has been chosen by a survey among the information security community. Based on it's results, Firefox Security Toolkit was made. Also, it allows you to download Burp Suite certificate and a large user-agent list for User-Agent Switcher. Making it one-click away to prepare your web-application testing browser.

How does it differs from well-known projects, such as OWASP Mantra and Hcon STF ?

OWASP Mantra and Hcon STF are not regularly updated, and needs a lot of work in order to develop and maintain. Meanwhile, Firefox Security Toolkit does not need a additional maintaining, although I would be maintaining it for any issues/bugs if needed. The used extensions are downloaded from Mozilla Addons Store with its latest version, to ensure the best testing experience for the penetration tester.

Who can use Firefox Security Toolkit ?

Web-Application Penetration Testers, Information Security Learners, and basically anyone interested in web-application security.

Compatibility:

The project currently supports Linux/Unix environments.

Usage:

bash ./firefox_security_toolkit.sh

Demo Video:

Available Addons:

• Cookie Export/Import
• Cookie Manager
• Copy as Plain Text
• Crypto Fox
• CSRF-Finder
• Disable WebRTC
• FireBug
• Fireforce
• FlagFox
• Foxy Proxy
• HackBar
• Live HTTP Headers
• Multi Fox
• PassiveRecon
• Right-Click XSS
• Tamper Data
• User Agent Switcher
• Wappalyzer
• Web Developer

Additional Features:

• Downloading Burp Suite Certificate
• Downloading a large user-agent list for User-Agent Swithcer

Download Firefox-Security-Toolkit

Read More

Security Layer for Arch Linux - ArchStrike

An Arch Linux repository for security professionals and enthusiasts.

Done the Arch Way and optimized for i686, x86_64, ARMv6, and ARMv7.

ArchStrike is a penetration testing and security layer on top of Arch Linux. We follow the Arch Linux standards very closely in order to keep our packages clean, proper and easy to maintain.

The team is working very hard to maintain the repository and give you the best ArchStrike experience.

Twitter: https://twitter.com/ArchStrike

Send us a pull request: https://github.com/ArchStrike/ArchStrike

FAQ

Q: What difference does ArchStrike have from other penetration distributions?

A: We are a layer on top of ArchLinux that you can install and remove easily. We try and follow the Arch Linux standards when making our packages.

Q: Do you have an ISO?

A: As of yet, we do not have an ISO, although our team is working on an ISO to be released as you are reading this. Updates on the ISO will be made on twitter and our website.

Download ArchStrike

Read More

The Amnesic Incognito Live System - Tails 2.4

Tails is a live system that aims to preserve your privacy and anonymity. It helps you to use the Internet anonymously and circumvent censorship almost anywhere you go and on any computer but leaving no trace unless you ask it to explicitly.

It is a complete operating system designed to be used from a DVD, USB stick, or SD card independently of the computer's original operating system. It is Free Software and based on Debian GNU/Linux.

Tails comes with several built-in applications pre-configured with security in mind: web browser, instant messaging client, email client, office suite, image and sound editor, etc.

New features

• We enabled the automatic account configuration of Icedove which discovers the correct parameters to connect to your email provider based on your email address. We improved it to rely only on secure protocol and we are working on sharing these improvements with Mozilla so that users of Thunderbird outside Tails can benefit from them as well.

Upgrades and changes

• Update Tor Browser to 6.0.1, based on Firefox 45.
• Remove the preconfigured #tails IRC channel. Join us on XMPP instead!
• Always display minimize and maximize buttons in titlebars. (#11270)
• Remove GNOME Tweak Tool and hledger. You can add them back using the Additional software packages persistence feature.
• Use secure HKPS OpenPGP key server in Enigmail.
• Harden our firewall by rejecting RELATED packets and restricting Tor to only send NEW TCP syn packets. (#11391)
• Harden our kernel by:
  • Setting various security-related kernel options: slab_nomerge slub_debug=FZ mce=0 vsyscall=none. (#11143)
  • Removing the .map files of the kernel. (#10951)

Fixed problems

• Update the DRM and Mesa graphical libraries. This should fix recent problems with starting Tails on some hardware. (#11303)
• Some printers that stopped working in Tails 2.0 should work again. (#10965)
• Enable Packetization Layer Path MTU Discovery for IPv4. This should make the connections to obfs4 Tor bridges more reliable. (#9268)
• Fix the translations of Tails Upgrader. (#10221)
• Fix displaying the details of a circuit in Onion Circuits when using Tor bridges. (#11195)

For more details, read our changelog.

Known issues

• The automatic account configuration of Icedove freezes when connecting to some email providers. (#11486)
• In some cases sending an email with Icedove results in the error: "The message could not be sent using Outgoing server (SMTP) mail.riseup.net for an unknown reason." When this happens, simply click "Ok" and try again and it should work. (#10933)
• The update of the Mesa graphical library introduce new problems at least on AMD HD 7770 and nVidia GT 930M.

See the list of long-standing issues.

Download Tails 2.4

Read More