Post Syndicated from Darknet original https://www.darknet.org.uk/2020/03/zbang-privileged-account-threat-detection-tool/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
zBang is a risk assessment tool for Privileged Account Threat Detection on a scanned network, organizations and red teamers can utilize zBang to identify potential attack vectors and improve the security posture of the network.
The results can be analyzed with the graphic interface or by reviewing the raw output files.
The tool is built from five different scanning modules:
- ACLight scan – discovers the most privileged accounts that must be protected, including suspicious Shadow Admins.
Read the rest of zBang – Privileged Account Threat Detection Tool now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2020/03/memhunter-automated-memory-resident-malware-detection/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
Memhunter is an Automated Memory Resident Malware Detection tool for the hunting of memory resident malware at scale, improving the threat hunter analysis process and remediation times.
It’s a self contained binary that can be deployed and managed at scale, does not use memory dumps and relies purely on memory inspection to do its work. It also does not require any complex infrastructure to deploy.
The tool was designed as a replacement of memory forensic volatility plugins such as malfind and hollowfind.
Read the rest of Memhunter – Automated Memory Resident Malware Detection now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2020/03/sandcastle-aws-s3-bucket-enumeration-tool/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
Sandcastle is a Python-based Amazon AWS S3 Bucket Enumeration Tool, formerly known as bucketCrawler. The script takes a target’s name as the stem argument (e.g. shopify) and iterates through a file of bucket name permutations.
Amazon S3 [Simple Storage Service] is cloud storage for the Internet. To upload your data (photos, videos, documents etc.), you first create a bucket in one of the AWS Regions. You can then upload any number of objects to the bucket.
Read the rest of Sandcastle – AWS S3 Bucket Enumeration Tool now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2020/02/astra-api-automated-security-testing-for-rest/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
Astra is a Python-based tool for API Automated Security Testing, REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs.
Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can automatically detect and test login & logout (Authentication API), so it’s easy for anyone to integrate this into CI/CD pipeline.
Read the rest of Astra – API Automated Security Testing For REST now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2020/02/judas-dns-nameserver-dns-poisoning-attack-tool/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
Judas DNS is a Nameserver DNS Poisoning Attack Tool which functions as a DNS proxy server built to be deployed in place of a taken over nameserver to perform targeted exploitation. Judas works by proxying all DNS queries to the legitimate nameservers for a domain.
The magic comes with Judas’s rule configurations which allow you to change DNS responses depending on source IP or DNS query type. This allows an attacker to configure a malicious nameserver to do things like selectively re-route inbound email coming from specified source IP ranges (via modified MX records), set extremely long TTLs to keep poisoned records cached, and more.
Read the rest of Judas DNS – Nameserver DNS Poisoning Attack Tool now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2020/02/dsniff-download-tools-for-network-auditing-password-sniffing/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
Dsniff download is a collection of tools for network auditing & penetration testing. Dsniff, filesnarf, mailsnarf, msgsnarf, URLsnarf, and WebSpy passively monitor a network for interesting data (passwords, e-mail, files, etc.).
ARPspoof, DNSspoof, and macof facilitate the interception of network traffic normally unavailable to an attacker (e.g, due to layer-2 switching). sshmitm and webmitm implement active monkey-in-the-middle attacks against redirected SSH and HTTPS sessions by exploiting weak bindings in ad-hoc PKI.
Read the rest of dsniff Download – Tools for Network Auditing & Password Sniffing now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2020/02/owasp-amass-dns-enumeration-attack-surface-mapping-external-asset-discovery/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
The OWASP Amass Project is a DNS Enumeration, Attack Surface Mapping & External Asset Discovery tool to help information security professionals perform network mapping of attack surfaces and perform external asset discovery using open source information gathering and active reconnaissance techniques.
Information Gathering Techniques Used by OWASP Amass for DNS Enumeration and More
The main functionality of Amass is as follows:
- DNS: Basic enumeration, Brute forcing (optional), Reverse DNS sweeping, Subdomain name alterations/permutations, Zone transfers (optional)
- Scraping: Ask, Baidu, Bing, DNSDumpster, DNSTable, Dogpile, Exalead, Google, HackerOne, IPv4Info, Netcraft, PTRArchive, Riddler, SiteDossier, ViewDNS, Yahoo
- Certificates: Active pulls (optional), Censys, CertSpotter, Crtsh, Entrust, GoogleCT
- APIs: AlienVault, BinaryEdge, BufferOver, CIRCL, CommonCrawl, DNSDB, GitHub, HackerTarget, IPToASN, Mnemonic, NetworksDB, PassiveTotal, Pastebin, RADb, Robtex, SecurityTrails, ShadowServer, Shodan, Spyse (CertDB & FindSubdomains), Sublist3rAPI, TeamCymru, ThreatCrowd, Twitter, Umbrella, URLScan, VirusTotal, WhoisXML
- Web Archives: ArchiveIt, ArchiveToday, Arquivo, LoCArchive, OpenUKArchive, UKGovArchive, Wayback
Usage of Amass for DNS Enumeration, Attack Surface Mapping & External Asset Discovery
The Amass tool has several subcommands shown below for handling your Internet exposure investigation.
Read the rest of OWASP Amass – DNS Enumeration, Attack Surface Mapping & External Asset Discovery now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2020/01/cameradar-hack-rtsp-video-surveillance-cctv-cameras/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
Cameradar is a Go-based tool to hack RTSP Video Surveillance CCTV Cameras, it can detect open RTSP hosts, detect device models and launch automated attacks.
The main features of Cameradar are:
- Detect open RTSP hosts on any accessible target host
- Detect which device model is streaming
- Launch automated dictionary attacks to get their stream route (e.g.: /live.sdp)
- Launch automated dictionary attacks to get the username and password of the cameras
- Retrieve a complete and user-friendly report of the results
Using Cameradar to Hack RTSP Video Cameras
"-t, –targets": Set target.
Read the rest of Cameradar – Hack RTSP Video Surveillance CCTV Cameras now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2020/01/dsploit-apk-download-hacking-security-toolkit-for-android/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
dSploit APK Download is a Hacking & Security Toolkit For Android which can conduct network analysis and penetration testing activities. It aims to offer to IT security experts the most complete and advanced professional toolkit to perform network security assessments on a mobile device.
Once dSploit is started, you will be able to easily map your network, fingerprint alive hosts operating systems and running services, search for known vulnerabilities, crack logon procedures of many TCP protocols, perform man in the middle (MiTM) attacks such as password sniffing (with common protocols dissection), real-time traffic manipulation and more.
Read the rest of dSploit APK Download – Hacking & Security Toolkit For Android now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2020/01/scallion-gpu-based-onion-hash-generator/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
Scallion is a GPU-driven Onion Hash Generator written in C#, it lets you create vanity GPG keys and .onion addresses (for Tor’s hidden services) using OpenCL.
Scallion runs on Mono (tested in Arch Linux) and .NET 3.5+ (tested on Windows 7 and Server 2008)
Scallion was used to find collisions for every 32bit key id in the Web of Trust’s strong set demonstrating how insecure 32bit key ids are.
Read the rest of Scallion – GPU Based Onion Hash Generator now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2019/12/wifi-dumper-dump-wifi-profiles-and-cleartext-passwords/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
WiFi-Dumper is an open-source Python-based tool to dump WiFi profiles and cleartext passwords of the connected access points on a Windows machine. This tool will help you in a Wifi penetration testing and could also be useful when performing red team assessments or internal infrastructure engagements.
Each option in the tool generates the “.txt” file as an output, if you run the tool multiple times, the output gets appended to the previous results.
Read the rest of WiFi-Dumper – Dump WiFi Profiles and Cleartext Passwords now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2019/12/trufflehog-search-git-for-high-entropy-strings-with-commit-history/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
truffleHog is a Python-based tool to search Git for high entropy strings, digging deep into commit history and branches. This is effective at finding secrets accidentally committed.
truffleHog previously functioned by running entropy checks on git diffs. This functionality still exists, but high signal regex checks have been added, and the ability to surpress entropy checking has also been added.
truffleHog –regex –entropy=False https://github.com/dxa4481/truffleHog.git
truffleHog will go through the entire commit history of each branch, and check each diff from each commit, and check for secrets.
Read the rest of truffleHog – Search Git for High Entropy Strings with Commit History now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2019/11/aiengine-ai-driven-network-intrusion-detection-system/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
AIEngine is a next-generation interactive/programmable Python/Ruby/Java/Lua and Go AI-driven Network Intrusion Detection System engine with capabilities of learning without any human intervention, DNS domain classification, Spam detection, network collector, network forensics and many others.
AIEngine also helps network/security professionals to identify traffic and develop signatures for use them on NIDS, Firewalls, Traffic classifiers and so on.
Functionality of AIEngine AI-driven Network Intrusion Detection System
The main functionalities of AIEngine are:
- Support for interacting/programing with the user while the engine is running.
Read the rest of AIEngine – AI-driven Network Intrusion Detection System now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2019/11/sooty-soc-analyst-all-in-one-cli-tool/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
Sooty is a tool developed with the task of aiding a SOC analyst to automate parts of their workflow and speed up their process.
The main goal of Sooty is to perform as much of the routine checks as possible which allows the analyst more time to spend on deeper analysis.
Features of Sooty SOC Analyst CLI Tool
- Sanitise URL’s to be safe to send in emails
- Perform reverse DNS and DNS lookups
- Perform reputation checks from:
- Abuse IPDB
- Check if an IP address is a TOR exit node
- Decode Proofpoint URL’s, UTF-8 encoded URLS, Office SafeLink URL’s and Base64 Strings
- Get file hashes and compare them against VirusTotal (see requirements)
- Perform WhoIs Lookups
- Check Usernames and Emails against HaveIBeenPwned to see if a breach has occurred.
Read the rest of Sooty – SOC Analyst All-In-One CLI Tool now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2019/10/uboat-proof-of-concept-poc-http-botnet-project/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
UBoat is a PoC HTTP Botnet designed to replicate a full weaponised commercial botnet like the famous large scale infectors Festi, Grum, Zeus and SpyEye.
Reviews of popular botnets have shown HTTP-based botnets have a set of attributes that make it difficult for them to be detected. On the other hand, the number of studies focusing on the detection of HTTP-based botnets is relatively low (compared to the number of those on IRC-based and P2P botnets) especially in the HTTP-based mobile botnets which operate on the mobile devices and networks.
Read the rest of UBoat – Proof Of Concept PoC HTTP Botnet Project now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2019/10/lambdaguard-aws-lambda-serverless-security-scanner/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
LambdaGuard is a tool which allows you to visualise and audit the security of your serverless assets, an open-source AWS Lambda Serverless Security Scanner.
AWS Lambda is an event-driven, serverless computing platform provided by Amazon Web Services. It is a computing service that runs code in response to events and automatically manages the computing resources required by that code.
LambdaGuard is an AWS Lambda auditing tool designed to create asset visibility and provide actionable results.
Read the rest of LambdaGuard – AWS Lambda Serverless Security Scanner now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2019/09/exe2powershell-convert-exe-to-bat-files/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
exe2powershell is used to convert EXE to BAT files, the previously well known tool for this was exe2bat, this is a version for modern Windows.
This will convert any binary file (*.exe) to a BAT file, the resulting BAT file contains only echo commands followed by a PowerShell command to re-create the original binary file.
This kind of tool can be useful during a pen-test when you want to trigger a shell without any upload feature.
Read the rest of exe2powershell – Convert EXE to BAT Files now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2019/09/hiddenwall-create-hidden-kernel-modules/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
HiddenWall is a Linux kernel module generator used to create hidden kernel modules to protect your server from attackers. It supports custom rules with netfilter (block ports, hidden mode, rootkit functions etc).
The motivation is basically another layer of protection, much like a hidden firewall – setting securelevel to 2 on BSD would have a similar effect.
In a typical attack, the bad actor can alter your IPTables or UFW rules – with HiddenWall you still have another layer that can block external access because it hooks directly into netfilter from kernel land.
Read the rest of HiddenWall – Create Hidden Kernel Modules now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2019/08/anteater-ci-cd-security-gate-check-framework/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
Anteater is a CI/CD Security Gate Check Framework to prevent the unwanted merging of nominated strings, filenames, binaries, deprecated functions, staging environment code/credentials etc.
It’s main function is to block content based on regular expressions.
Anything that can be specified with regular expression syntax, can be sniffed out by Anteater. You tell Anteater exactly what you don’t want to get merged, and anteater looks after the rest.
How Anteater CI/CD Security Gate Check Framework Works
If Anteater finds something, it exits with a non-zero code which in turn fails the build of your CI tool, with the idea that it would prevent a pull request merging.
Read the rest of Anteater – CI/CD Security Gate Check Framework now! Only available at Darknet.
Post Syndicated from Darknet original https://www.darknet.org.uk/2019/08/stardox-github-stargazers-information-gathering-tool/?utm_source=rss&utm_medium=social&utm_campaign=darknetfeed
Stardox is a Python-based GitHub stargazers information gathering tool, it scrapes Github for information and displays them in a list tree view. It can be used for collecting information about your or someone else’s repository stargazers details.
GitHub allows visitors to star a repo to bookmark it for later perusal. Stars represent a casual interest in a repo, and when enough of them accumulate, it’s natural to wonder what’s driving interest.
Read the rest of Stardox – Github Stargazers Information Gathering Tool now! Only available at Darknet.