QRGen – Simple Script For Generating Malformed QRCodes

Simple Script For Generating Malformed QRCodes. These qrcodes are useful if you want to test some QRCode scanner’s parser or how the application handle QRCode data.Down side of this tool: you need to manually scan codes with camera.ProofInstallationWhat do you need:python3qrcodePillowargparseSteps1 git clone https://github.com/h0nus/QRGen2 cd QRGen3 pip3 install -r requirements.txt OR python3 -m pip install -r requirements.txt4 python3 qrcode.py5 Enjoy attacking QRCodes :PPersonalizationYou can change the default wordlists to what you want by passing -w/–wordlist 🙂 Order of default wordlists group:SQL InjectionXSSCommand InjectionFormat StringXXEString FuzzingSSI InjectionLFI/Directory Traversalcustom passed with -w/–wordlistDownload QRGen

Link: http://feedproxy.google.com/~r/PentestTools/~3/l5Kg34GFbeY/qrgen-simple-script-for-generating.html

ExtAnalysis – Browser Extension Analysis Framework

With ExtAnalysis you can :Download & Analyze Extensions From: Chrome Web StoreFirefox AddonsAnalyze Installed Extensions of: Google ChromeMozilla FirefoxOpera Browser (Coming Soon)Upload and Scan Extensions. Supported formats: .crx.xpi.zipFeatures of ExtAnalysis :View Basic Informations: Name, Author, Description and VersionManifest ViewerIn depth permission informationExtract Intels from files which include: URLs and domainsIPv6 and IPv4 addressesBitcoin addressesEmail addressesFile commentsBase64 encoded stringsView and Edit files. Supported file types: htmljsonJavaScriptcssVirusTotal Scans For: URLsDomainsFilesRetireJS Vulnerability scan for JavaScript filesNetwork graph of all files and URLsReconnaissance tools for extracted URLs: Whois ScanHTTP headers viewerURL Source viewerGEO-IP locationSome Fun Stuffs that include: Dark ModeInbuilt chiptune player (Jam on to some classic chiptune while ExtAnalysis does the work)How do I install it?Installing ExtAnalysis is simple! It runs on python3, so make sure python3 and python3-pip are installed and follow these steps:$ git clone https://github.com/Tuhinshubhra/ExtAnalysis$ cd ExtAnalysis$ pip3 install -r requirements.txt`For proper analysis don’t forget to add your virustotal api.How do I use it?Once the installation is done you can jump straight ahead and run ExtAnalysis by running the command: $ python3 extanalysis.py It should automatically launch ExtAnalysis in a new browser window.For other options check out the help menu $ python3 extanalysis.py –helpusage: extanalysis.py [-h HOST] [-p PORT] [-v] [-u] [-q] [–help]optional arguments: -h HOST, –host HOST Host to run ExtAnalysis on. Default host is 127.0.0.1 -p PORT, –port PORT Port to run ExtAnalysis on. Default port is 13337 -v, –version Shows version and quits -u, –update Checks for update -q, –quiet Quiet mode shows only errors on cli! –help Shows this help menu and exitsPython Modules Used:flask for the webserverpython-whois for Whois lookupmaxminddb for parsing the Geo-IP databaserequests for http headers and source code viewerContributionYou can contribute to the development of ExtAnalysis by improving some code or even reporting by bugs.For any other queries feel free to contact me via twitter: @r3dhax0rBelow is a list of people who contributed to the development of ExtAnalysis (only pull requests!)Download ExtAnalysis

Link: http://www.kitploit.com/2019/05/extanalysis-browser-extension-analysis.html

AutoSource – Automated Source Code Review Framework Integrated With SonarQube

AutoSource is an automated source code review framework integrated with SonarQube which is capable of performing static code analysis/reviews. It can be used for effectively finding the vulnerabilities at very early stage of the SDLC(Software Development Life Cycle). The user can scan the code by just giving GIT repository link into the framework.AutoSource framework is capable of performing a source code review on all platforms(MAC, Linux, and Windows).INSTALLDownload the AutoSource repository into your system.Read the prerequisites.txt file and install the dependencies (mentioned for each platform)Execute downloadSonar.py (python3 downloadSonar.py), this will download and setup the SonarQube framework which can be access from ‘http://127.0.0.1:9000’After that run executeScanner.py (python3 executeScanner.py), this will ask for your GIT repository that you want to scan.Access the results on SonarQube Portal(‘http://127.0.0.1:9000’)ScreenshotsDownloading SonarQube and SonarScannerSonarQube is up and runningExecuting ScannerScanning StartedScanner Execution SuccessfulResults showing in SonarQube DashboardCollaboratorsMalkit SinghShubham Shubhankar SharmaDownload autoSource

Link: http://feedproxy.google.com/~r/PentestTools/~3/alJwKx_iHdQ/autosource-automated-source-code-review.html

Vulmap – Online Local Vulnerability Scanners Project

Vulmap is an open source online local vulnerability scanner project. It consists of online local vulnerability scanning programs for Windows and Linux operating systems. These scripts can be used for defensive and offensive purposes. It is possible to make vulnerability assessments using these scripts. Also they can be used for privilege escalation by pentesters/red teamers.Vulmap can be used to, scan vulnerabilities on localhost, see related exploits and download them. Scripts basically, scan localhost to gather installed software information and ask vulmon.com api if there are any vulnerabilies and exploits related with installed software. If vulnerabilities exist, vulmap give CVE ID, risk score, vulnerability’s detail link, exploit id and exploit title. Exploits can be downloaded with vulmap also.Use below links to get detailed information about vulmap:Vulmap Linux – Python script for Linux systemsVulmap Windows – Powershell script for Windows systemsDownload Vulmap

Link: http://www.kitploit.com/2019/05/vulmap-online-local-vulnerability.html

ScanQLi – Scanner To Detect SQL Injection Vulnerabilities

ScanQLi is a simple SQL injection scanner with somes additionals features. This tool can’t exploit the SQLi, it just detect them. Tested on Debian 9Features Classic Blind Time based GBK (soon) Recursive scan (follow all hrefs of the scanned web site) Cookies integration Adjustable wait delay between requests Ignore given URLsPrerequisites1. Install git toolapt updateapt install git2. Clone the repo.git clone https://github.com/bambish/ScanQLi3. Install python required libsapt install python-pipcd ScanQLipip install -r requirements.txtFor python3 please install python3-pip and use pip3Usage./scanqli -u [URL] [OPTIONS]ExamplesSimple url scan with output filepython scanqli.py -u ‘http://127.0.0.1/test/?p=news’ -o output.logRecursive URL scanning with cookiespython scanqli.py -u ‘https://127.0.0.1/test/’ -r -c ‘{“PHPSESSID":"4bn7uro8qq62ol4o667bejbqo3" , "Session":"Mzo6YWMwZGRmOWU2NWQ1N2I2YTU2YjI0NTMzODZjZDVkYjU="}’Download ScanQLi

Link: http://www.kitploit.com/2019/04/scanqli-scanner-to-detect-sql-injection.html

Osmedeus – Fully Automated Offensive Security Tool For Reconnaissance And Vulnerability Scanning

Osmedeus allows you automated run the collection of awesome tools to reconnaissance and vulnerability scanning against the target.How to useIf you have no idea what are you doing just type the command below or check out the Advanced Usage./osmedeus.py -t example.comInstallationgit clone https://github.com/j3ssie/Osmedeuscd Osmedeus./install.shThis install only focus on Kali linux, check more install on Wiki pageFeaturesSubdomain Scan.Subdomain TakeOver Scan.Screenshot the target.Basic recon like Whois, Dig info.Web Technology detection.IP Discovery.CORS Scan.SSL Scan.Headers Scan.Port Scan.Vulnerable Scan.Seperate workspaces to store all scan output and details logging.REST API.React Web UI.Slack notifications.DemoScreenshotsContact@j3ssiejjjDownload Osmedeus

Link: http://feedproxy.google.com/~r/PentestTools/~3/62_7K6wE8Hk/osmedeus-fully-automated-offensive_27.html

EasySploit – Metasploit Automation (EASIER And FASTER Than EVER)

EasySploit v3.1 (Linux) – Metasploit automation (EASIER and FASTER than EVER)Options:(1) Windows –> test.exe (payload and listener)(2) Android –> test.apk (payload and listener)(3) Linux –> test.py (payload and listener)(4) MacOS –> test.jar (payload and listener)(5) Web –> test.php (payload and listener)(6) Scan if a target is vulnerable to ms17_010(7) Exploit Windows 7/2008 x64 ONLY by IP (ms17_010_eternalblue)(8) Exploit Windows Vista/XP/2000/2003 ONLY by IP (ms17_010_psexec)(9) Exploit Windows with a link (HTA Server)(10) Contact with me – My accountsHow to install:git clone https://github.com/KALILINUXTRICKSYT/easysploit.gitcd easysploitbash installer.shHow to run (after installation):Type anywhere in your terminal “easysploit".Video tutorials:Download Easysploit

Link: http://feedproxy.google.com/~r/PentestTools/~3/fAldiqcnlVY/easysploit-metasploit-automation-easier.html

W12Scan – A Simple Asset Discovery Engine For Cybersecurity

ChineseW12scan is a network asset discovery engine that can automatically aggregate related assets for analysis and use.Here is a web source program, but the scanning end is at w12scan-clientThinkingBased on python3 + django + elasticsearch + redis and use the web restful api to add scan targets.FeatureWebPowerful search syntaxSearch for cms, service, titles, country regions, etc., to quickly find relevant targets.title=“abc” # Search from the titleheader=“abc” # Search from http headerbody=“123” # Search from body texturl = “*.baidu.com” # Search for subdomains of baidu.comip = ‘1.1.1.1’ # Search from IP,support ‘192.168.1.0/24’ and ‘192.168.1.*’port = ‘80’ # Search form portapp = ’nginx’ # Search applicationcountry = ‘cn’ # Search from countryservice = ‘mysql’ # Search from servicebug = ‘xx’ # Search from VulnerabilityCustom assertBy customizing a company-related domain name or ip asset, w12scan will automatically help you find the corresponding asset target. When you browse the target, there is a prominent logo to remind you of the target’s ownership.Automatic associationEnter the target details. If the target is ip, all domain names on the ip and all domain names on the c class will be automatically associated. If the target is a domain name, the adjacent station, segment c and subdomain are automatically associated.Multi-node managementWEB will check the status of the node every few minutes, you can see the number of node scans and the node scan log.Task restfulProvides an interface to add tasks, you can add it on the WEB side or integrate it in any software.Scanning endPocCall the latest poc script online via airbugBuilt-in scan scriptCommon vulnerability verification service built into the scanner.ScanningUse masscan,nmap,wappalyzer,w11scanEasy to distributeThis is taken into account in the design of the program architecture. It is very easy to distribute and run the scan terminal directly on another machine. It also can be distributed based on docker, celery service.InstallationQuickly build an environment with dockergit clone https://github.com/boy-hack/w12scancd w12scandocker-compose up -dWait a while to visit http://127.0.0.1:8000Telegram GroupTelegram Group:https://t.me/joinchat/MZ16xA9dfmJCYm4kbv15nADownload W12Scan

Link: http://www.kitploit.com/2019/04/w12scan-simple-asset-discovery-engine.html

Zeebsploit – Web Scanner / Exploitation / Information Gathering

zeebsploit is a tool for hackingsearching for web information andscanning vulnerabilities of a webInstallation & Usageapt-get install gitgit clone https://github.com/jaxBCD/Zeebsploit.gitcd Zeebsploitchmod +x install./installpython3 zeebsploit.pytype ‘help’ for show modulesand follow instructionModules[Main modules]+———-+——————————-+| Modules | Description |+———-+——————————-+| Exploit | Exploitation Modules || Scanners | Scanners Modules || infoga | information Gathering Modules |+———-+——————————-+[Exploit Modules]+—————————+————————————————–+| Modules | Description |+—————————+————————————————–+| wp content injection | wordpress content injection version 4.7 or 4.7.1 || wp revslider | wordpress plugin revslider remote file upload || wp learndash | wordpress leardash remote file upload || wp swhobiz | wordpress plugin showbiz remote file upload || joomla com fabrik | joomla component fabrik file upload || joomla manager get config | joomla component manager auto get config || joomla jdownload | joomla component jdownloads remote file upload || joomla | Joomla ads manager component auto shell upload || apache struts rce | CVE: 2017-5638 – Apache Struts2 S2-045 || | remote command execution || drupal8 rce | drupal version 8 remote command execution || dvr cam leak credential | TBK DVR4104 / DVR4216 || | – Credentials Leak (Get User and password || webdav file upload | Nothing || —More— | Coming Soon the following version |+—————————+————————————————–+[Scanner Module]+——————–+—————————————-+| Modules | Description |+——————–+—————————————-+| subdomain scanner | Scan Subdomain for Web || sqli scanner | Scan Sql Injection Vulnerability || xss scanner | Scan XSS Injection Vulnerability || lfi scanner | Local File Includes Scanner etc/passwd || admin login finder | Scan Admin Login page || directory scanner | scan directory on web us e dirhunt || subdomain takeover | scan type subdomain takeover || —More— | Coming Soon the following version |+——————–+—————————————-+[Information Gathering]+——————–+——————————————+| Modules | Description |+——————–+——————————————+| cms detector | a tool for detecting cms on a web || port scanner | Scan Open Port use Nmap || information header | response header information || ip geolocation | detect the location of an ip or host || email searcher | searching email from web || traceroute | to show the route the package has pas sed || robot.txt detector | Scan Robot.txt from Web || header information | Response Header Checker || whois lookup | looking for registered users or || | recipients of Internet resource rights || —More— | Coming Soon the following version |+——————–+——————————————+Join Team : [Click This]Contact : [Contact]Download Zeebsploit

Link: http://feedproxy.google.com/~r/PentestTools/~3/9xaMRbIv1Dk/zeebsploit-web-scanner-exploitation.html

Zeebsploit – Web Scanner / Exploitation / Information Gathering

zeebsploit is a tool for hackingsearching for web information andscanning vulnerabilities of a webInstallation & Usageapt-get install gitgit clone https://github.com/jaxBCD/Zeebsploit.gitcd Zeebsploitchmod +x install./installpython3 zeebsploit.pytype ‘help’ for show modulesand follow instructionModules[Main modules]+———-+——————————-+| Modules | Description |+———-+——————————-+| Exploit | Exploitation Modules || Scanners | Scanners Modules || infoga | information Gathering Modules |+———-+——————————-+[Exploit Modules]+—————————+————————————————–+| Modules | Description |+—————————+————————————————–+| wp content injection | wordpress content injection version 4.7 or 4.7.1 || wp revslider | wordpress plugin revslider remote file upload || wp learndash | wordpress leardash remote file upload || wp swhobiz | wordpress plugin showbiz remote file upload || joomla com fabrik | joomla component fabrik file upload || joomla manager get config | joomla component manager auto get config || joomla jdownload | joomla component jdownloads remote file upload || joomla | Joomla ads manager component auto shell upload || apache struts rce | CVE: 2017-5638 – Apache Struts2 S2-045 || | remote command execution || drupal8 rce | drupal version 8 remote command execution || dvr cam leak credential | TBK DVR4104 / DVR4216 || | – Credentials Leak (Get User and password || webdav file upload | Nothing || —More— | Coming Soon the following version |+—————————+————————————————–+[Scanner Module]+——————–+—————————————-+| Modules | Description |+——————–+—————————————-+| subdomain scanner | Scan Subdomain for Web || sqli scanner | Scan Sql Injection Vulnerability || xss scanner | Scan XSS Injection Vulnerability || lfi scanner | Local File Includes Scanner etc/passwd || admin login finder | Scan Admin Login page || directory scanner | scan directory on web us e dirhunt || subdomain takeover | scan type subdomain takeover || —More— | Coming Soon the following version |+——————–+—————————————-+[Information Gathering]+——————–+——————————————+| Modules | Description |+——————–+——————————————+| cms detector | a tool for detecting cms on a web || port scanner | Scan Open Port use Nmap || information header | response header information || ip geolocation | detect the location of an ip or host || email searcher | searching email from web || traceroute | to show the route the package has pas sed || robot.txt detector | Scan Robot.txt from Web || header information | Response Header Checker || whois lookup | looking for registered users or || | recipients of Internet resource rights || —More— | Coming Soon the following version |+——————–+——————————————+Join Team : [Click This]Contact : [Contact]Download Zeebsploit

Link: http://feedproxy.google.com/~r/PentestTools/~3/RZKskKnsCFU/zeebsploit-web-scanner-exploitation_10.html