Karkinos is a light-weight ‘Swiss Army Knife’ for penetration testing and/or hacking CTF’s. Currently, Karkinos offers the following:

• Encoding/Decoding characters
• Encrypting/Decrypting text or files
• 3 Modules
• Cracking and generating hashes

Disclaimer

This tool should be used on applications/networks that you have permission to attack only. Any misuse or damage caused will be solely the users’ responsibility.

More: https://github.com/helich0pper/Karkinos

Dependencies

• Any server capable of hosting PHP; tested with Apache Server
• Tested with PHP 7.4.9
• Tested with Python 3.8
  Make sure it is in your path as:
  Windows: python
  Linux: python3
  If it is not, please change the commands in includes/pid.php
• pip3
• Raspberry Pi Zero friendly (crack hashes at your own risk)

Installing

This installation guide assumes you have all the dependencies. A Wiki page with troubleshooting steps can be found here.

Linux/BSD

1. git clone https://github.com/helich0pper/Karkinos.git
2. cd Karkinos
3. pip3 install -r requirements.txt
4. cd wordlists && unzip passlist.zip You can also unzip it manually using file explorer. Just make sure passlist.txt is in wordlists directory.
5. Make sure you have write privileges for db/main.db
6. Enable extension=mysqli in your php.ini file.
   If you don’t know where to find this, refer to the PHP docs. Note: MySQLi is only used to store statistics.
7. Thats it! Now just host it using your preferred web server or run: php -S 127.0.0.1:8888 in the Karkinos directory.Important: using port 5555, 5556, or 5557 will conflict with the Modules
   If you insist on using these ports, change the PORT value in:

• • /bin/Server/app.py Line 87
  • /bin/Busting/app.py Line 155
  • /bin/PortScan/app.py Line 128

Windows

1. git clone https://github.com/helich0pper/Karkinos.git
2. cd Karkinos
3. pip3 install -r requirements.txt
4. cd wordlists && unzip passlist.zip
   You can also unzip it manually using file explorer. Just make sure passlist.txt is in wordlists directory.
5. Make sure you have write privileges for db/main.db
6. Enable extension=mysqli.dll in your php.ini file.
   If you don’t know where to find this, refer to the PHP docs. Note: MySQLi is only used to store statistics
7. Thats it! Now just host it using your preferred web server or run: php -S 127.0.0.1:8888 in the Karkinos directory.Important: using port 5555, 5556, or 5557 will conflict with the Modules
   If you insist on using these ports, change the PORT value in:

• /bin/Server/app.py Line 87
• /bin/Busting/app.py Line 155
• /bin/PortScan/app.py Line 128

Home Menu

Landing page and quick access menu.

User stats are displayed here. Currently, the stats recorded are only the total hashes and hash types cracked successfully.

Encoding/Decoding

This page allows you to encode/decode in common formats (more may be added soon)

Encrypt/Decrypt

Encrypting and decrypting text or files is made easy and is fully trusted since it is done locally.

Reverse Shell Handling

Reverse shells can be captured and interacted with on this page.

Create a listener instance

Configure the listener

Start the listener and capture a shell

Full reverse shell handling demo:

Directory and File Busting

Create an instance

Configure it

Start scanning

Full Directory and File Busting demo:

Port Scanning

Launch the scanner

Configure it

Start scanning

Full Port Scanning Demo:

Generating Hashes

Karkinos can generate commonly used hashes such as:

• MD5
• SHA1
• SHA256
• SHA512

Cracking Hashes

Karkinos offers the option to simultaneously crack hashes using a built-in wordlist consisting of over 15 million common and breached passwords. This list can easily be modified and/or completely replaced.

The post Karkinos – Penetration Testing and Hacking CTF’s Swiss Army Knife appeared first on Tech Chronicles.

Hackronian contains a diverse range of tools which allow the user to gain information, attack targets, perform sniffing and snooping on targets and perform post exploitation operations on the target. This main benefit of this suite is that all these different tools are available in one place and the user can experiment with different tools within the same terminal. The secondary benefit of this tool is that it can be installed on Android with all the same features.

Features:

• Contains more than 50 different tools
• Modules range from information gathering to post exploitation
• Available for both Android and Linux
• Perfect for creating a penetration testing workflow

HACKTRONIAN Menu :

• Information Gathering
• Password Attacks
• Wireless Testing
• Exploitation Tools
• Sniffing & Spoofing
• Web Hacking
• Private Web Hacking
• Post Exploitation
• Install The HACKTRONIAN

Information Gathering:

• Nmap
• Setoolkit
• Port Scanning
• Host To IP
• wordpress user
• CMS scanner
• XSStrike
• Dork – Google Dorks Passive Vulnerability Auditor
• Scan A server’s Users
• Crips

Password Attacks:

• Cupp
• Ncrack

Wireless Testing:

• reaver
• pixiewps
• Fluxion

Exploitation Tools:

• ATSCAN
• sqlmap
• Shellnoob
• commix
• FTP Auto Bypass
• jboss-autopwn

Sniffing & Spoofing:

• Setoolkit
• SSLtrip
• pyPISHER
• SMTP Mailer

Web Hacking:

• Drupal Hacking
• Inurlbr
• WordPress & Joomla Scanner
• Gravity Form Scanner
• File Upload Checker
• WordPress Exploit Scanner
• WordPress Plugins Scanner
• Shell and Directory Finder
• Joomla! 1.5 – 3.4.5 remote code execution
• Vbulletin 5.X remote code execution
• BruteX – Automatically brute force all services running on a target
• Arachni – Web Application Security Scanner Framework

Private Web Hacking:

• Get all websites
• Get joomla websites
• Get wordpress websites
• Control Panel Finder
• Zip Files Finder
• Upload File Finder
• Get server users
• SQli Scanner
• Ports Scan (range of ports)
• ports Scan (common ports)
• Get server Info
• Bypass Cloudflare

Post Exploitation:

• Shell Checker
• POET
• Weeman

Supported Platforms:

• Linux
• Android (Termux)

Installation in Linux :

This Tool Must Run As ROOT !!!

git clone https://github.com/thehackingsage/hacktronian.git

cd hacktronian

chmod +x install.sh

./install.sh

That’s it.. you can execute tool by typing hacktronian

Installation in Android :

Open Termux

pkg install git

pkg install python

git clone https://github.com/thehackingsage/hacktronian.git

cd hacktronian

chmod +x hacktronian.py

python2 hacktronian.py

Video Tutorial :

YouTube : https://www.youtube.com/watch?v=1LJlyQAQby4

Hacktronian Usage

To execute Hacktronian, run:

$ hacktronian

 _   _    _    ____ _  _______ ____   ___  _   _ ___    _    _   _ 
| | | |  / \  / ___| |/ /_   _|  _ \ / _ \| \ | |_ _|  / \  | \ | |
| |_| | / _ \| |   | ' /  | | | |_) | | | |  \| || |  / _ \ |  \| |
|  _  |/ ___ \ |___| . \  | | |  _ <| |_| | |\  || | / ___ \| |\  |
|_| |_/_/   \_\____|_|\_\ |_| |_| \_\_ __/|_| \_|___/_/   \_\_| \_|
 
[!] This Tool Must Run As ROOT [!] https://linktr.ee/thehackingsage
 
   {1}--Information Gathering
   {2}--Password Attacks
   {3}--Wireless Testing
   {4}--Exploitation Tools
   {5}--Sniffing & Spoofing
   {6}--Web Hacking
   {7}--Private Web Hacking
   {8}--Post Exploitation
   {0}--Install The HACKTRONIAN
   {99}-Exit
 
hacktronian~#

Download: https://github.com/thehackingsage/hacktronian

The post Hacktronian: All in One Hacking Tool for Linux appeared first on Tech Chronicles.

Features of Grype Vulnerability Scanner For Container Images & Filesystems

Scan the contents of a container image or filesystem to find known vulnerabilities and find vulnerabilities for major operating system packages in:

• Alpine
• BusyBox
• CentOS / Red Hat
• Debian
• Ubuntu

Find vulnerabilities for language-specific packages:

• Ruby (Bundler)
• Java (JARs, etc)
• JavaScript (NPM/Yarn)
• Python (Egg/Wheel)
• Python pip/requirements.txt/setup.py listings

Grype Supports Docker and OCI image formats.

Using Grype Vulnerability Scanner For Container Images & Filesystems

To scan for vulnerabilities in an image:

grype <image>

Grype can scan a variety of sources beyond those found in Docker.

The output format for Grype is configurable as well:
grype <image> -o <format>

Where the formats available are:

• json: Use this to get as much information out of Grype as possible!
• cyclonedx: An XML report conforming to the CycloneDX 1.2 specification.
• table: A columnar summary (default).

Getting started

Install the binary, and make sure that grype is available in your path. To scan for vulnerabilities in an image:

grype <image>

The above command scans for vulnerabilities that are visible in the container (i.e., the squashed representation of the image). To include software from all image layers in the vulnerability scan, regardless of its presence in the final image, provide --scope all-layers:

grype <image> --scope all-layers

Grype can scan a variety of sources beyond those found in Docker.

# scan a container image archive (from the result of `docker image save ...`, `podman save ...`, or `skopeo copy` commands)
grype path/to/image.tar

# scan a directory
grype dir:path/to/dir

Grype’s Database

Grype pulls a database of vulnerabilities derived from the publicly available Anchore Feed Service. This database is updated at the beginning of each scan, but an update can also be triggered manually.

Shell Completion

Grype supplies shell completion through its CLI implementation (cobra). Generate the completion code for your shell by running one of the following commands:

• grype completion <bash|fish>
• go run main.go completion <bash|fish>

This will output a shell script to STDOUT, which can then be used as a completion script for Grype. Running one of the above commands with the -h or --help flags will provide instructions on how to do that for your chosen shell.

You can download Grype or read more here.

The post Grype – Vulnerability Scanner For Container Images & Filesystems appeared first on Tech Chronicles.

GitHub Link

adfsbrute

ADFSBrute by ricardojoserf, is a script to test credentials against Active Directory Federation Services (ADFS), calculating the ADFS url of an organization and allowing password spraying or bruteforce attacks.

The main idea is carrying out password spraying attacks with a random and high delay between each test and using a list of proxies or Tor to make the detection by the Blue Team more difficult. Brute force attacks are also possible, or testing credentials with the format username:password (for example from Pwndb). Tested logins will get stored in a log file to avoid testing them twice.

Usage

./adfsbrute.py -t TARGET [-u USER] [-U USER_LIST] [-p PASSWORD] [-P PASSWORD_LIST] [-UL userpassword_list]
[-m MIN_TIME] [-M MAX_TIME] [-tp TOR_PASSWORD] [-pl PROXY_LIST] [-n NUMBER_OF_REQUESTS_PER_IP]
[-s STOP_ON_SUCCESS] [-r RANDOM_COMBINATIONS] [-d DEBUG] [-l LOG_FILE]

The parameters for the attacks are:

* -t: Target domain. Example: test.com

* -u: Single username. Example: agarcia@domain.com

* -U: File with a list of usernames. Example: users.txt

* -p: Single password: Example: Company123

* -P: File with a list of passwords. Example: passwords.txt

* -UP: File with a list of credentials in the format "username:password". Example: userpass.txt

* -m : Minimum value of random seconds to wait between each test. Default: 30

* -M : Maximum value of random seconds to wait between each test. Default: 60

* -tp: Tor password (change IP addresses using Tor)

* -pl: Use a proxy list (change IP addresses using a list of proxy IPs)

* -n: Number of requests before changing IP address (used with -tp or -pl). Default: 1

* -s: Stop on success, when one correct credential is found. Default: False

* -r: Randomize the combination of users and passwords. Default: True

* -d: Show debug messages. Default: True

* -l: Log file location with already tested credentials. Default: tested.txt

Examples

Password spraying with password “Company123”, tor password is “test123” and changing the IP every 3 requests:

python3 adfsbrute.py -t company.com -U users.txt -p Company123 -tp test123 -n 3

Password spraying with password “Company123”, tor password is “test123”, changing the IP for every request, random delay time between 10 and 20 seconds and do not randomize the order of users:

python3 adfsbrute.py -t company.com -U users.txt -p Company123 -tp test123 -m 10 -M 20 -r False

Finding ADFS url:

python3 adfsbrute.py -t company.com

Using Tor

To use Tor to change the IP for every request, you must hash a password:

tor --hash-password test123

In the file /etc/tor/torrc, uncomment the variable ControlPort and the variable HashedControlPassword, and in this last one add the hash:

ControlPort 9051
HashedControlPassword 16:7F314CAB402A81F860B3EE449B743AEC0DED9F27FA41831737E2F08F87

Restart the tor service and use this password as argument for the script (“-tp test123” or “–tor_password 123”)

service tor restart

Note

This script is implemented to test in security audits, DO NOT use without proper authorization from the company owning the ADFS or you will block accounts.

The post Offensive Security Tool: ADFSBrute appeared first on Tech Chronicles.

Mapping the system’s attack surface is a practice that enables you to think about most of your assets and their value. DNS Lookup, WHOIS Lookup, etc., techniques help to map the attack surface.

Let’s get going to have a proper understanding of Attack Surface Mapping.

What is an Attack Surface?

The Attack Surface is a term that defines all the various points where an intruder might gain access to a system and access information.

These flaws are usually associated with a system’s privacy issues. A simple security measure is to make the attack surface as minimal as practicable.

What About the Attack Surface Types?

There are two kinds of attack surfaces: the digital and the physical attack surface.

Since these dual attack surfaces intersect and are linked, it is critical to protect them together. Web services, networks, networking protocols, and domain names are all part of the digital attack surface. The physical attack surface refers to the external threats against an organization, such as building windows, manufacturing services, or a flame.

Visualize an Attack Surface

As per Skybox Security’s white paper, there are three measures to grasp and visualize an attack surface.

1. To envision a company’s infrastructure by mapping out all the systems, routes, and channels.
2. To compare each indication of a weakness that reveals to its last step’s visualized chart.
3. Look for compromise measures. It is a sign that a threat is already accomplishing.

How Can You Assess Your Attack Surface?

Identifying your information system’s attack surface is a challenge that allows you to consider most of your resources and the importance they have. To build a global map, you will need to do the following:

• List down
  • DNS records, sub-domains, etc.
  • External and known servers like FTP, SSH, etc.
  • Different software as well as their variants.
• Take account of physical access to the corporation’s properties (structures, system robbery, manufacturing facility, etc.).
• Look for more networks and servers to exploit after identifying all hosts of an organization.
• Consider a standard web server; the open ports themselves (HTTP, RDP, etc.) are all sources of threat. It is crucial to map out the virtual clients operating on the server; web apps running on any of them are also an attack vector.
• Most domains have a DNS server, SMTP server, etc. While evaluating the attack surface, these would be the first reference point. Using DNS lookup and WHOIS, map out where the A records, MX records, and DNS records services get housed.

Examples

DNS Lookup

To locate the IP address of a specific domain name, use a DNS lookup method. The IP addresses in the DNS records obtained from name servers include in the outcome. Two categories to DNS lookups:

• Forward DNS lookup.

The Forward DNS lookup or basic DNS lookup is a widely use DNS method. Discovering a domain’s IP address is the forward method to DNS.

• Reverse DNS lookup.

The procedure is similar in a reverse DNS lookup, only that it begins via an IP address and ends with the domain name.

IP Netblocks

IP netblocks are sets of IP addresses that belong to a specific server. Regional Internet Registry (RIRs) allocate IP blocks to netblock users who are usually ISPs and big firms with many IP addresses.

WHOIS Lookup

Whois is a popular Internet database. It outlines who possesses a domain name, IP address, etc. Whois databases are valuable and have become an indispensable tool for ensuring the legality of the domain name registry and website management procedures. A Whois database includes all the contact details for the user, community, or organization that owns a domain name.

Mitigate Attack Surface?

Monitor the attack surface and determine the threats involved with it until you know what it is. Once the attack surface is crucial, the inventory also aids in the prioritization of the components to secure. Identifying the attack surface helps in reducing it and implement appropriate defenses. With fewer potential attack sources, defense measures get focus, resulting in increased security. A few recommendations are:

• Delete unnecessary files and documents.
• Monitor network devices and logs.
• Segment the networks.
• Strong passwords.
• Monthly awareness training for employees.
• Monitor zero-day vulnerabilities.
• Apply patches on vulnerable systems.
• Use Honeypots.

The post The Attack Surface Mapping guide for Ethical Hackers appeared first on Tech Chronicles.

Installing Lynis

Lynis is an extensible security audit tool for computer systems running Linux, FreeBSD, macOS, OpenBSD, Solaris, and other Unix derivatives. It assists system administrators and security professionals with scanning a system and its security defenses, with the final goal being system hardening.

Lynis is available as a package for most Linux distributions, we can install it by running the following command:
sudo apt install lynis

To display all the options and commands available, we can run the following command:
lynis show options

Before we get started with scanning, we need to ensure that Lynis is up to date. To check if we are running the latest version we can run the following command:

System Auditing With Lynis

To perform a system audit with Lynis we run the following command:
sud

Lynis will output a lot of information that will also be stored under the /var/log/lynis.log file for easier access. The summary of the system audit will reveal important information about your system’s security posture and various security misconfigurations and vulnerabilities.

Lynis will also generate output on how these vulnerabilities and misconfigurations can be fixed or tweaked.

The output also contains a hardening index score that is rated out of 100, this is used to give you a trackable tangible score of your system’s current security posture.

Lynis will also display any potential warnings that will indicate a severe security vulnerability or misconfiguration that needs to be fixed or patched, in this case, we have no warnings.

To increase our hardening index score, Lynis provides us with helpful suggestions that detail the various security configurations we need to make.

After following the suggestions and making the necessary changes, we can run the system audit with Lynis again.

As shown above, there is a significant improvement in the hardening index score that confirms the changes and configurations we made are applied and effective.

Pentest With Lynis

Lynis also has the ability to simulate a privileged/internal pentest on the system, this can be invoked by using the following command:
sudo lynis –pentest

This will perform a pentest on the system and will output a hardening index score that reflects the overall security posture of the system.