Kube-Hunter – Hunt For Security Weaknesses In Kubernetes Clusters

Kube-hunter hunts for security weaknesses in Kubernetes clusters. The tool was developed to increase awareness and visibility for security issues in Kubernetes environments. You should NOT run kube-hunter on a Kubernetes cluster you don’t own!Run kube-hunter: kube-hunter is available as a container (aquasec/kube-hunter), and we also offer a web site at kube-hunter.aquasec.com where you can register online to receive a token allowing you see and share the results online. You can also run the Python code yourself as described below.Contribute: We welcome contributions, especially new hunter modules that perform additional tests. If you would like to develop your own modules please read Guidelines For Developing Your First kube-hunter Module.HuntingWhere should I run kube-hunter?Run kube-hunter on any machine (including your laptop), select Remote scanning and give the IP address or domain name of your Kubernetes cluster. This will give you an attackers-eye-view of your Kubernetes setup.You can run kube-hunter directly on a machine in the cluster, and select the option to probe all the local network interfaces.You can also run kube-hunter in a pod within the cluster. This gives an indication of how exposed your cluster would be in the event that one of your application pods is compromised (through a software vulnerability, for example).Scanning optionsBy default, kube-hunter will open an interactive session, in which you will be able to select one of the following scan options. You can also specify the scan option manually from the command line. These are your options: Remote scanning To specify remote machines for hunting, select option 1 or use the –remote option. Example: ./kube-hunter.py –remote some.node.com Internal scanning To specify internal scanning, you can use the –internal option. (this will scan all of the machine’s network interfaces) Example: ./kube-hunter.py –internal Network scanning To specify a specific CIDR to scan, use the –cidr option. Example: ./kube-hunter.py –cidr 192.168.0.0/24 Active HuntingActive hunting is an option in which kube-hunter will exploit vulnerabilities it finds, in order to explore for further vulnerabilities. The main difference between normal and active hunting is that a normal hunt will never change state of the cluster, while active hunting can potentially do state-changing operations on the cluster, which could be harmful.By default, kube-hunter does not do active hunting. To active hunt a cluster, use the –active flag. Example: ./kube-hunter.py –remote some.domain.com –activeList of testsYou can see the list of tests with the –list option: Example: ./kube-hunter.py –listTo see active hunting tests as well as passive: ./kube-hunter.py –list –activeOutputTo control logging, you can specify a log level, using the –log option. Example: ./kube-hunter.py –active –log WARNING Available log levels are:DEBUGINFO (default)WARNINGTo see only a mapping of your nodes network, run with –mapping option. Example: ./kube-hunter.py –cidr 192.168.0.0/24 –mapping This will output all the Kubernetes nodes kube-hunter has found.DeploymentThere are three methods for deploying kube-hunter:On MachineYou can run the kube-hunter python code directly on your machine.PrerequisitesYou will need the following installed:python 2.7pipClone the repository:git clone [email protected]:aquasecurity/kube-hunter.gitInstall module dependencies:cd ./kube-hunterpip install -r requirements.txtIn the case where you have python 3.x in the path as your default, and python2 refers to a python 2.7 executable, use “python2 -m pip install -r requirements.txt"Run: ./kube-hunter.pyContainerAqua Security maintains a containerised version of kube-hunter at aquasec/kube-hunter. This container includes this source code, plus an additional (closed source) reporting plugin for uploading results into a report that can be viewed at kube-hunter.aquasec.com. Please note that running the aquasec/kube-hunter container and uploading reports data are subject to additional terms and conditions.The Dockerfile in this repository allows you to build a containerised version without the reporting plugin.If you run the kube-hunter container with the host network it will be able to probe all the interfaces on the host:docker run -it –rm –network host aquasec/kube-hunterNote for Docker for Mac/Windows: Be aware that the "host" for Docker for Mac or Windows is the VM which Docker runs containers within. Therefore specifying –network host allows kube-hunter access to the network interfaces of that VM, rather than those of your machine. By default kube-hunter runs in interactive mode. You can also specify the scanning option with the parameters described above e.g.docker run –rm aquasec/kube-hunter –cidr 192.168.0.0/24PodThis option lets you discover what running a malicious container can do/discover on your cluster. This gives a perspective on what an attacker could do if they were able to compromise a pod, perhaps through a software vulnerability. This may reveal significantly more vulnerabilities.The job.yaml file defines a Job that will run kube-hunter in a pod, using default Kubernetes pod access settings.Run the job with kubectl create with that yaml file.Find the pod name with kubectl describe job kube-hunterView the test results with kubectl logs Download Kube-Hunter

Link: http://feedproxy.google.com/~r/PentestTools/~3/Dr1bT8peAAc/kube-hunter-hunt-for-security.html

H8Mail – Email OSINT And Password Breach Hunting

Email OSINT and password finder.Use h8mail to find passwords through different breach and reconnaissance services, or the infamous “Breach Compilation" torrent.FeaturesEmail pattern matching (reg exp), useful for all those raw HTML filesSmall and fast Alpine Dockerfile availableCLI or Bulk file-reading for targetingOutput to CSV fileReverse DNS + Open PortsCloudFlare rate throttling avoidanceExecution flow remains synchronous and throttled according to API usage guidelines written by service providersQuery and group results from different breach service providersQuery a local copy of the "Breach Compilation"Get related emailsDelicious colorsDemosOut of the boxWith API servicesWith the BreachedCompilation torrentAPIs Service Functions Status HaveIBeenPwned Number of email breachs Yes Shodan Reverse DNS, Open ports Yes Hunter.io – Public Number of related emails Yes Hunter.io – Service (free tier) Cleartext related emails Yes WeLeakInfo – Public Number of search-able breach results Soon WeLeakInfo – Service Cleartext passwords, hashs and salts Soon Snusbase – Service Cleartext passwords, hashs and salts – Fast Yes InstallIf you’re using Docker, make sure to add your targets.txt and your API keys in the configuration file before buildingLocallyNodeJS is required to ensure CloudFlare bypassing. You can find out how to install it for your distribution hereThese instructions assume you are running Python3 as default. If unsure, please check the troubleshooting sectionapt-get install nodejsgit clone https://github.com/khast3x/h8mail.gitcd h8mailpip install -r requirements.txtpython h8mail.py -hDockergit clone https://github.com/khast3x/h8mail.gitcd h8maildocker build -t h8mail .docker run -ti h8mail -hUsage> python h8mail.py –helpusage: h8mail.py [-h] -t TARGET_EMAILS [-c CONFIG_FILE] [-o OUTPUT_FILE] [-bc BC_PATH] [-v] [-l] [-k CLI_APIKEYS]Email information and password finding tooloptional arguments: -h, –help show this help message and exit -t TARGET_EMAILS, –targets TARGET_EMAILS Either single email, or file (one email per line). REGEXP -c CONFIG_FILE, –config CONFIG_FILE Configuration file for API keys -o OUTPUT_FILE, –output OUTPUT_FILE File to write output -bc BC_PATH, –breachcomp BC_PATH Path to the breachcompilation Torrent. https://ghostbin.com/paste/2cbdn -v, –verbose Show debug information -l, –local Run local actions only -k CLI_APIKEYS, –apikey CLI_APIKEYS Pass config options. Format is "K:V,K:V"Usage examplesQuery for a single targetpython h8mail.py -t [email protected] for list of targets, indicate config file for API keys, output to pwned_targets.csvpython h8mail.py -t targets.txt -c config.ini -o pwned_targets.csvQuery a list of targets against local copy of the Breach Compilation, pass API keys for Snusbase from the command linepython h8mail.py -t targets.txt -bc ../Downloads/BreachCompilation/ -k "snusbase_url:$snusbase_url,snusbase_token:$snusbase_token"Query without making API calls against local copy of the Breach Compilationpython h8mail.py -t targets.txt -bc ../Downloads/BreachCompilation/ –localTroubleshootingPython version & KaliThe above instructions assume you are running python3 as default. If unsure, type:python –versionin your terminal. It should be either Python 3.* or Python 2.*.If you are running python2 as default :Make sure you have python3 installed, then replace python commands with explicit python3 calls:apt-get install nodejsgit clone https://github.com/khast3x/h8mail.gitcd h8mailpip3 install -r requirements.txtpython3 h8mail.py -hNotes & LinksService providers that wish being integrated can send me an email at k at khast3x dot club (Protonmail encryption friendly)Special thanks to Snusbase for being developer friendlySpecial thanks to kodykinzie for making a nice introduction and walktrough article and video on installing and using h8mailDownload H8Mail

Link: http://feedproxy.google.com/~r/PentestTools/~3/u6x3-7n6oMI/h8mail-email-osint-and-password-breach.html

Scapy-sploit: Python Network Tool is Vulnerable to Denial of Service (DoS) Attack CVE pending

We recently discovered that the latest version of Scapy, a powerful packet manipulation tool used by cybersecurity researchers and network engineers, is susceptible to a Denial of Service (DoS) vulnerability. Ironically, we found this vulnerability while researching ways to better detect and fight DDoS attacks. Written in the very popular Python coding language, Scapy uses […]
The post Scapy-sploit: Python Network Tool is Vulnerable to Denial of Service (DoS) Attack CVE pending appeared first on Blog.

Link: http://feedproxy.google.com/~r/Imperviews/~3/_y4yVr4tQ88/

Stretcher – Tool Designed To Help Identify Open Elasticsearch Servers That Are Exposing Sensitive Information

Stretcher is a tool to search for open elasticsearch servers.Usage: python stretcher.py –shodan {key} –action analyze –threads {0..100} –dork python stretcher.py –help _____ __ __ __ / ___// /_________ / /______/ /_ ___ _____ \__ \/ __/ ___/ _ \/ __/ ___/ __ \/ _ \/ ___/ ___/ / /_/ / / __/ /_/ /__/ / / / __/ / /____/\__/_/ \___/\__/\___/_/ /_/\___/_/ Tool designed to help identify incorrectly Applications that are exposing sensitive [+] Interesting indexes were found payment, address, email, user Browser: http://34.224.104.129:80 Organization: Amazon.com Hostnames: ec2-34-224-104-129.compute-1.amazonaws.com Domains: amazonaws.com City: Ashburn Country: United States Status: Without authentication (Open)Installation$ sudo pip3 install pyfiglet shodan elasticsearch $ cd $HOME/$ git clone https://github.com/6IX7ine/stretcher/$ sudo chmod -R 777 stretcher/DisclaimerCode samples are provided for educational purposes. Adequate defenses can only be built by researching attack techniques available to malicious actors. Using this code against target systems without prior permission is illegal in most jurisdictions. The authors are not liable for any damages from misuse of this information or code.Download Stretcher

Link: http://feedproxy.google.com/~r/PentestTools/~3/PdXu9zuRDIg/stretcher-tool-designed-to-help.html

SQLMap v1.3 – Automatic SQL Injection And Database Takeover Tool

SQLMap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.FeaturesFull support for MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase, SAP MaxDB, HSQLDB and Informix database management systems.Full support for six SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query-based, stacked queries and out-of-band.Support to directly connect to the database without passing via a SQL injection, by providing DBMS credentials, IP address, port and database name.Support to enumerate users, password hashes, privileges, roles, databases, tables and columns.Automatic recognition of password hash formats and support for cracking them using a dictionary-based attack.Support to dump database tables entirely, a range of entries or specific columns as per user’s choice. The user can also choose to dump only a range of characters from each column’s entry.Support to search for specific database names, specific tables across all databases or specific columns across all databases’ tables. This is useful, for instance, to identify tables containing custom application credentials where relevant columns’ names contain string like name and pass.Support to download and upload any file from the database server underlying file system when the database software is MySQL, PostgreSQL or Microsoft SQL Server.Support to execute arbitrary commands and retrieve their standard output on the database server underlying operating system when the database software is MySQL, PostgreSQL or Microsoft SQL Server.Support to establish an out-of-band stateful TCP connection between the attacker machine and the database server underlying operating system. This channel can be an interactive command prompt, a Meterpreter session or a graphical user interface (VNC) session as per user’s choice.Support for database process’ user privilege escalation via Metasploit’s Meterpreter getsystem command.InstallationYou can download the latest tarball by clicking here or latest zipball by clicking here.Preferably, you can download sqlmap by cloning the Git repository:git clone –depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-devsqlmap works out of the box with Python version 2.6.x and 2.7.x on any platform.UsageTo get a list of basic options and switches use:python sqlmap.py -hTo get a list of all options and switches use:python sqlmap.py -hhYou can find a sample run here. To get an overview of sqlmap capabilities, list of supported features and description of all options and switches, along with examples, you are advised to consult the user’s manual.DemoLinksHomepage: http://sqlmap.orgDownload: .tar.gz or .zipCommits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atomIssue tracker: https://github.com/sqlmapproject/sqlmap/issuesUser’s manual: https://github.com/sqlmapproject/sqlmap/wikiFrequently Asked Questions (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQTwitter: @sqlmapDemos: http://www.youtube.com/user/inquisb/videosScreenshots: https://github.com/sqlmapproject/sqlmap/wiki/ScreenshotsTranslationsBulgarianChineseCroatianFrenchGreekIndonesianItalianJapanesePortugueseSpanishTurkishDownload SQLMap v1.2.11

Link: http://feedproxy.google.com/~r/PentestTools/~3/RNZTk3qTooc/sqlmap-v13-automatic-sql-injection-and.html

Crashcast-Exploit – This Tool Allows You Mass Play Any YouTube Video With Chromecasts Obtained From Shodan.io

This tool allows you to mass play any YouTube video with Chromecasts obtained from Shodan.ioAuthor: @037PrerequisitesThe only thing you need installed is Python 3.xsudo apt-get install python3You also require to have cURL installedsudo apt-get install curlYou also require Shodan python modulepip install shodanUsing Shodan APIThis tool requires you to own an upgraded Shodan APIYou may obtain one for free in Shodan if you sign up using a .edu emailDownload Crashcast-Exploit

Link: http://feedproxy.google.com/~r/PentestTools/~3/xeXSGXnN_xA/crashcast-exploit-this-tool-allows-you.html

Exrex – Irregular Methods On Regular Expressions

Exrex is a command line tool and python module that generates all – or random – matching strings to a given regular expression and more. It’s pure python, without external dependencies.There are regular expressions with infinite matching strings (eg.: [a-z]+), in these cases exrex limits the maximum length of the infinite parts.Exrex uses generators, so the memory usage does not depend on the number of matching strings.FeaturesGenerating all matching stringsGenerating a random matching stringCounting the number of matching stringsSimplification of regular expressionsInstallationTo install exrex, simply:$ pip install exrexor$ easy_install exrexUsageas python module>>> import exrex>>> exrex.getone(‘(ex)r\\1’)’exrex’>>> list(exrex.generate(‘((hai){2}|world!)’))[‘haihai’, ‘world!’]>>> exrex.getone(‘\d{4}-\d{4}-\d{4}-[0-9]{4}’)’3096-7886-2834-5671’>>> exrex.getone(‘(1[0-2]|0[1-9])(:[0-5]\d){2} (A|P)M’)’09:31:40 AM’>>> exrex.count(‘[01]{0,9}’)1023>>> print ‘\n’.join(exrex.generate(‘This is (a (code|cake|test)|an (apple|elf|output))\.’))This is a code.This is a cake.This is a test.This is an apple.This is an elf.This is an output.>>> print exrex.simplify(‘(ab|ac|ad)’)(a[bcd])Command line usage> exrex –helpusage: exrex.py [-h] [-o FILE] [-l] [-d DELIMITER] [-v] REGEXexrex – regular expression string generatorpositional arguments: REGEX REGEX stringoptional arguments: -h, –help show this help message and exit -o FILE, –output FILE Output file – default is STDOUT -l N, –limit N Max limit for range size – default is 20 -c, –count Count matching strings -m N, –max-number N Max number of strings – default is -1 -r, –random Returns a random string that matches to the regex -s, –simplify Simplifies a regular expression -d DELIMITER, –delimiter DELIMITER Delimiter – default is \n -v, –verbose Verbose modeExamples:$ exrex ‘[asdfg]’asdfg$ exrex -r ‘(0[1-9]|1[012])-\d{2}’09-85$ exrex ‘[01]{10}’ -c1024Documentationhttp://exrex.readthedocs.org/en/latest/Fun/artsBoat: exrex ‘( {20}(\| *\\|-{22}|\|)|\.={50}| ( ){0,5}\\\.| {12}~{39})’Eyes: exrex ‘(o|O|0)(_)(o|O|0)’Similar projectsTools that generate a list of all possible strings that match a given pattern:regldg (features a live demo on the website)regex-genex (supports using multiple regex patterns simultaneously)Tools that generate random strings, one by one, that match a given pattern:randexp.js (features several live demos on the website)rstr.xeger (a method of the rstr Python module)Profilingpython -m cProfile exrex.py ‘[a-zA-Z][a-zA-Z][a-zA-Z][a-zA-Z]’ -o /dev/nullpython -m cProfile exrex.py ‘[0-9]{6}’ -o /dev/nullDownload Exrex

Link: http://feedproxy.google.com/~r/PentestTools/~3/Ec04s7GUw1c/exrex-irregular-methods-on-regular.html

Shodanploit – Shodan Command Line Interface Written In Python

Shodan is a search engine on the internet where you can find interesting things all over the world. For example, we can find cameras, bitcoin streams, zombie computers, ports with weakness in service, SCADA systems, and more. Moreover, more specific searches are possible. As a result of the search, Shodan shows us the number of vulnerable hosts on Earth.So what does shodansploit do ?With Shodan Exploit, you will have all your calls on your terminal. It also allows you to make detailed searches. All you have to do without running Shodansploiti is to add shodan api. Note : The quality of the search will change according to the api privileges you have used.Shodan API Documention : REST API Documentation Exploits REST API Documentation Shodan API Specification :Banner Specification The banner is the main type of information that Shodan provides through the REST and Streaming API. This document outlines the various properties that are always present and which ones are optional. Exploit Specification The exploit type contains the normalized data from a variety of vulnerability data sources. The Exploits REST API returns this type for its search results. This document outlines the various properties that are always present and which ones are optional. Programming Languages :PythonSystem :[email protected]:~# git clone https://github.com/ismailtasdelen/[email protected]:~# cd [email protected]:~/shodansploit# python shodansploit.pyWhat’s on the tool menu ?[1] GET > /shodan/host/{ip} [2] GET > /shodan/host/count[3] GET > /shodan/host/search [4] GET > /shodan/host/search/tokens [5] GET > /shodan/ports [6] GET > /shodan/exploit/author[7] GET > /shodan/exploit/cve[8] GET > /shodan/exploit/msb[9] GET > /shodan/exploit/bugtraq-id[10] GET > /shodan/exploit/osvdb[11] GET > /shodan/exploit/title[12] GET > /shodan/exploit/description[13] GET > /shodan/exploit/date[14] GET > /shodan/exploit/code[15] GET > /shodan/exploit/platform[16] GET > /shodan/exploit/port[17] GET > /dns/resolve[18] GET > /dns/reverse [19] GET > /labs/honeyscore/{ip}[20] GET > /account/profile [21] GET > /tools/myip [22] GET > /tools/httpheaders[23] GET > /api-info [24] ExitCloning an Existing Repository ( Clone with HTTPS )[email protected]:~# git clone https://github.com/ismailtasdelen/shodansploit.gitCloning an Existing Repository ( Clone with SSH )[email protected]:~# git clone https://github.com/ismailtasdelen/ismailtasdelen.gitContact :Mail : [email protected] : https://www.linkedin.com/in/ismailtasdelen/GitHub : https://github.com/ismailtasdelen/Telegram : https://t.me/ismailtasdelen/Download Shodanploit

Link: http://feedproxy.google.com/~r/PentestTools/~3/EPn0Sf3TI7Q/shodanploit-shodan-command-line.html

JSShell – An Interactive Multi-User Web JS Shell

An interactive multi-user web based javascript shell. It was initially created in order to debug remote esoteric browsers during experiments and research. This tool can be easily attached to XSS (Cross Site Scripting) payload to achieve browser remote code execution (similar to the BeeF framework).Version 2.0 is created entirely from scratch, introducing new exciting features, stability and maintainability.AuthorDaniel Abeles.Shell VideoFeaturesMulti client supportCyclic DOM objects supportPre flight scriptsCommand Queue & ContextExtensible with PluginsInjectable via