{"id": "KITPLOIT:7030656015270383596", "bulletinFamily": "tools", "title": "MalwareSourceCode - Collection Of Malware Source Code For A Variety Of Platforms In An Array Of Different Programming Languages", "description": "[  ](<https://1.bp.blogspot.com/-n3X7BvJhX1o/X40TdgYcYYI/AAAAAAAAUG4/EYCWPmIG1vwAMCYlkfNXwpZ0zr-qPNA1QCNcBGAsYHQ/s1500/MalwareSourceCode_1_logo.png>)\n\n \n\n\n** Malware Source Code Collection ** \n\n\n!!! DISCLAIMER !!! \n\nWe do not take any responsibility for any damage done by the code in this repository. Download, compile or run at your own risk \n\n \n** Contents: ** \n\n\nThis repository contains the source code for the following: \n \n \n . \n \u251c\u2500\u2500 Acad \n \u251c\u2500\u2500 Engines \n \u2502\u00a0\u00a0 \u251c\u2500\u2500 BAT \n \u2502\u00a0\u00a0 \u251c\u2500\u2500 Linux \n \u2502\u00a0\u00a0 \u251c\u2500\u2500 VBS \n \u2502\u00a0\u00a0 \u2514\u2500\u2500 Win32 \n \u251c\u2500\u2500 Java \n \u251c\u2500\u2500 Leaks \n \u2502\u00a0\u00a0 \u251c\u2500\u2500 Android \n \u2502\u00a0\u00a0 \u251c\u2500\u2500 Bootkit \n \u2502\u00a0\u00a0 \u251c\u2500\u2500 Other \n \u2502\u00a0\u00a0 \u2514\u2500\u2500 Win32 \n \u251c\u2500\u2500 LegacyWindows \n \u2502\u00a0\u00a0 \u251c\u2500\u2500 Win2k \n \u2502\u00a0\u00a0 \u251c\u2500\u2500 Win32 \n \u2502\u00a0\u00a0 \u251c\u2500\u2500 Win95 \n \u2502\u00a0\u00a0 \u251c\u2500\u2500 Win98 \n \u2502\u00a0\u00a0 \u251c\u2500\u2500 Win9x \n \u2502\u00a0\u00a0 \u2514\u2500\u2500 WinCE \n \u251c\u2500\u2500 Libs \n \u2502\u00a0\u00a0 \u251c\u2500\u2500 Bootkit \n \u2502\u00a0\u00a0 \u251c\u2500\u2500 DDoS \n \u2502\u00a0\u00a0 \u2514\u2500\u2500 Win32 \n \u251c\u2500\u2500 Linux \n \u251c\u2500\u2500 Perl \n \u251c\u2500\u2500 PHP \n \u251c\u2500\u2500 Python \n \u251c\u2500\u2500 Ruby \n \u2514\u2500\u2500 Win32 \n \n\n \n \n\n\n** [ Download MalwareSourceCode ](<https://github.com/vxunderground/MalwareSourceCode> \"Download MalwareSourceCode\" ) **\n", "published": "2020-10-21T20:30:00", "modified": "2020-10-21T20:30:00", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "href": "http://www.kitploit.com/2020/10/malwaresourcecode-collection-of-malware.html", "reporter": "KitPloit", "references": ["https://github.com/vxunderground/MalwareSourceCode"], "cvelist": ["CVE-2018-13379"], "type": "kitploit", "lastseen": "2020-12-01T15:25:01", "edition": 2, "viewCount": 42, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2018-13379"]}, {"type": "attackerkb", "idList": ["AKB:35B88369-C440-49C0-98FF-C50E258FB32C"]}, {"type": "kitploit", "idList": ["KITPLOIT:4039790738926215375", "KITPLOIT:6316059664688705671", "KITPLOIT:5834604300745056017", "KITPLOIT:1136445043250273758", "KITPLOIT:3366468831487246117", "KITPLOIT:4436587334431275989", "KITPLOIT:1569074273575184300", "KITPLOIT:1917035265467807555", "KITPLOIT:182965409804659651", "KITPLOIT:8870073298424661488"]}], "modified": "2020-12-01T15:25:01", "rev": 2}, "score": {"value": 4.3, "vector": "NONE", "modified": "2020-12-01T15:25:01", "rev": 2}, "vulnersScore": 4.3}, "toolHref": "https://github.com/vxunderground/MalwareSourceCode", "scheme": null}

{"cve": [{"lastseen": "2020-11-30T00:34:32", "description": "An Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.", "edition": 11, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2019-06-04T21:29:00", "title": "CVE-2018-13379", "type": "cve", "cwe": ["CWE-22"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-13379"], "modified": "2020-11-19T13:15:00", "cpe": ["cpe:/o:fortinet:fortios:5.6.7", "cpe:/o:fortinet:fortios:6.0.4"], "id": "CVE-2018-13379", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13379", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:o:fortinet:fortios:6.0.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.7:*:*:*:*:*:*:*"]}], "attackerkb": [{"lastseen": "2020-11-22T21:06:58", "bulletinFamily": "info", "cvelist": ["CVE-2018-13379"], "description": "An Improper Limitation of a Pathname to a Restricted Directory (\u201cPath Traversal\u201d) in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.\n\n \n**Recent assessments:** \n \n**bulw4rk** at March 25, 2020 8:04pm UTC reported:\n\n**Description**\n\nDue to a pre-authenticated Path Trasversal vulnerability under the SSL VPN portal on FortiOS, an attacker is able to pull arbitrary system files from the file system. One of the most critical files which an attacker may pull is \u201csslvpn_websessions\u201d which contains session information including usernames and password.\n\nOnce the attacker has obtained the credentials from this file, he can authenticated with those credentials, compromising the corporate perimeter.\n\n**Mitigation**\n\n * Upgrade to FortiOS 5.4.13, 5.6.8, 6.0.5 or 6.2.0 and above. \n\n * Enable 2FA. Note the attacker will not be able to log in to the VPN, but the obtained credentials are still valid (potencial domain creds) to access corporate mail, etc. \n\n\n**Affected Systems**\n\n * FortiOS 6.0: 6.0.0 to 6.0.4 \n\n * FortiOS 5.6: 5.6.3 to 5.6.7 \n\n * FortiOS 5.4: 5.4.6 to 5.4.12 \n\n\nNOTE: Only if the SSL VPN service (web-mode or tunnel-mode) is enabled.\n\n**PoC**\n\nThere are some public working exploits for this vulnerability, targeting the \u201csslvpn_websessions\u201d system file.\n\nAn attacker would access the following URL:\n\n * https://`<IP_ADDRESS>`/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession \n\n\nAnd after some parsing to the binary file, something like the following output would be obtained:\n\n\n\nNOTE: Example image obtained from <https://devco.re/blog/2019/08/09/attacking-ssl-vpn-part-2-breaking-the-Fortigate-ssl-vpn/>\n\nAssessed Attacker Value: 5 \nAssessed Attacker Value: 5**gwillcox-r7** at November 04, 2020 4:04pm UTC reported:\n\n**Description**\n\nDue to a pre-authenticated Path Trasversal vulnerability under the SSL VPN portal on FortiOS, an attacker is able to pull arbitrary system files from the file system. One of the most critical files which an attacker may pull is \u201csslvpn_websessions\u201d which contains session information including usernames and password.\n\nOnce the attacker has obtained the credentials from this file, he can authenticated with those credentials, compromising the corporate perimeter.\n\n**Mitigation**\n\n * Upgrade to FortiOS 5.4.13, 5.6.8, 6.0.5 or 6.2.0 and above. \n\n * Enable 2FA. Note the attacker will not be able to log in to the VPN, but the obtained credentials are still valid (potencial domain creds) to access corporate mail, etc. \n\n\n**Affected Systems**\n\n * FortiOS 6.0: 6.0.0 to 6.0.4 \n\n * FortiOS 5.6: 5.6.3 to 5.6.7 \n\n * FortiOS 5.4: 5.4.6 to 5.4.12 \n\n\nNOTE: Only if the SSL VPN service (web-mode or tunnel-mode) is enabled.\n\n**PoC**\n\nThere are some public working exploits for this vulnerability, targeting the \u201csslvpn_websessions\u201d system file.\n\nAn attacker would access the following URL:\n\n * https://`<IP_ADDRESS>`/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession \n\n\nAnd after some parsing to the binary file, something like the following output would be obtained:\n\n\n\nNOTE: Example image obtained from <https://devco.re/blog/2019/08/09/attacking-ssl-vpn-part-2-breaking-the-Fortigate-ssl-vpn/>\n\n**ccondon-r7** at November 22, 2020 6:52pm UTC reported:\n\n**Description**\n\nDue to a pre-authenticated Path Trasversal vulnerability under the SSL VPN portal on FortiOS, an attacker is able to pull arbitrary system files from the file system. One of the most critical files which an attacker may pull is \u201csslvpn_websessions\u201d which contains session information including usernames and password.\n\nOnce the attacker has obtained the credentials from this file, he can authenticated with those credentials, compromising the corporate perimeter.\n\n**Mitigation**\n\n * Upgrade to FortiOS 5.4.13, 5.6.8, 6.0.5 or 6.2.0 and above. \n\n * Enable 2FA. Note the attacker will not be able to log in to the VPN, but the obtained credentials are still valid (potencial domain creds) to access corporate mail, etc. \n\n\n**Affected Systems**\n\n * FortiOS 6.0: 6.0.0 to 6.0.4 \n\n * FortiOS 5.6: 5.6.3 to 5.6.7 \n\n * FortiOS 5.4: 5.4.6 to 5.4.12 \n\n\nNOTE: Only if the SSL VPN service (web-mode or tunnel-mode) is enabled.\n\n**PoC**\n\nThere are some public working exploits for this vulnerability, targeting the \u201csslvpn_websessions\u201d system file.\n\nAn attacker would access the following URL:\n\n * https://`<IP_ADDRESS>`/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession \n\n\nAnd after some parsing to the binary file, something like the following output would be obtained:\n\n\n\nNOTE: Example image obtained from <https://devco.re/blog/2019/08/09/attacking-ssl-vpn-part-2-breaking-the-Fortigate-ssl-vpn/>\n\nAssessed Attacker Value: 5 \nAssessed Attacker Value: 4\n", "modified": "2020-07-23T00:00:00", "published": "2019-06-04T00:00:00", "id": "AKB:35B88369-C440-49C0-98FF-C50E258FB32C", "href": "https://attackerkb.com/topics/VEc81wfDS7/cve-2018-13379-path-traversal-in-fortinet-fortios", "type": "attackerkb", "title": "CVE-2018-13379 Path Traversal in Fortinet FortiOS", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "kitploit": [{"lastseen": "2020-12-01T21:29:56", "bulletinFamily": "tools", "cvelist": ["CVE-2018-13379"], "description": "[  ](<https://1.bp.blogspot.com/-oCZSf90of-I/XgAiOpM6xeI/AAAAAAAARLw/nYbQGqmdKAYz77foEIqbzXW1z5ghEgifwCNcBGAsYHQ/s1600/huskyCI_1_huskyCI-logo.png>)\n\n \n\n\nhuskyCI is an open-source tool that performs security tests inside CI pipelines of multiple projects and centralizes all results into a database for further [ analysis ](<https://www.kitploit.com/search/label/Analysis> \"analysis\" ) and metrics. \n \n** How does it work? ** \nThe main goal of this project is to help development teams improve the quality of their code by finding [ vulnerabilities ](<https://www.kitploit.com/search/label/vulnerabilities> \"vulnerabilities\" ) as quickly as possible, and thus addressing them. \nhuskyCI can perform static security analysis in Python ( [ Bandit ](<https://github.com/PyCQA/bandit> \"Bandit\" ) and [ Safety ](<https://github.com/pyupio/safety> \"Safety\" ) ), Ruby ( [ Brakeman ](<https://github.com/presidentbeef/brakeman> \"Brakeman\" ) ), JavaScript ( [ Npm Audit ](<https://docs.npmjs.com/cli/audit> \"Npm Audit\" ) and [ Yarn Audit ](<https://yarnpkg.com/lang/en/docs/cli/audit/> \"Yarn Audit\" ) ), Golang ( [ Gosec ](<https://github.com/securego/gosec> \"Gosec\" ) ), and Java( [ SpotBugs ](<https://spotbugs.github.io/> \"SpotBugs\" ) plus [ Find Sec Bugs ](<https://find-sec-bugs.github.io/> \"Find Sec Bugs\" ) ). It can also [ audit ](<https://www.k%20%20%20itploit.com/search/label/Audit> \"audit\" ) repositories for secrets like AWS Secret Keys, Private SSH Keys, and many others using [ GitLeaks ](<https://github.com/zricethezav/gitleaks> \"GitLeaks\" ) . You should check our [ wiki ](<https://github.com/globocom/huskyCI/wiki/How-does-huskyCI-work%3F> \"wiki\" ) to better understand how this tool could help securing your organization projects! \n\n\n \n\n\n[  ](<https://1.bp.blogspot.com/-jw7qVR2d-sA/XgAivGvudAI/AAAAAAAARL4/w8cGRLNWfmAsNNfEf85ouhGVCr0TjKtVgCNcBGAsYHQ/s1600/huskyCI_9_huskyCI.gif>)\n\n** Requirements ** \n \n** Docker and Docker-Compose ** \nThe easiest way to deploy huskyCI locally is by using [ Docker ](<https://docs.docker.com/install/> \"Docker\" ) and [ Docker Compose ](<https://docs.docker.com/compose/install/> \"Docker Compose\" ) , thus you should have them installed on your machine. \n \n** Golang ** \nYou must also have [ Go ](<https://golang.org/doc/install> \"Go\" ) installed and huskyCI needs to be inside your [ $GOPATH ](<https://github.com/golang/go/wiki/GOPATH> \"$GOPATH\" ) to run properly. \n \n** Installing ** \nAfter cloning this repository, simply run the command inside huskyCI's folder: \n\n \n \n make install\n\n \n** Running ** \nAfter installing, an ` .env ` file with instructions to huskyCI should be generated: \n\n \n \n $ cat .env\n export HUSKYCI_CLIENT_REPO_URL=\"https://github.com/globocom/huskyCI.git\"\n export HUSKYCI_CLIENT_REPO_BRANCH=\"vulns-Golang\"\n export HUSKYCI_CLIENT_API_ADDR=\"http://localhost:8888\"\n export HUSKYCI_CLIENT_API_USE_HTTPS=\"false\"\n export HUSKYCI_CLIENT_TOKEN=\"{YOUR_TOKEN_HERE}\"\n\nYou can change the repository and branch being analysed by modifying the contents of ` HUSKYCI_CLIENT_REPO_URL ` and ` HUSKYCI_CLIENT_REPO_BRANCH ` . Then simply source it through the command: \n\n \n \n . .env\n\nMac OS: \n\n \n \n make run-client\n\nLinux: \n\n \n \n make run-client-linux\n\n \n** Frontend ** \nhuskyCI has also a cool [ Frontend ](<https://github.com/globocom/huskyCI-dashboard> \"Frontend\" ) built in React so you can check some stats regarding your huskyCI results! After running your first scan, simply visit: \n\n \n \n http://localhost:8080\n\n \n\n\n[  ](<https://1.bp.blogspot.com/-SX3bWwT2uJU/XgAi4-5HOOI/AAAAAAAARL8/36s94SqBYhgxFzKeMVQHV8FQJoeAsBPegCNcBGAsYHQ/s1600/huskyCI_10_charts.png>)\n\n \n\n\n** Documentation ** \nYou can find huskyCI documentation [ here ](<https://github.com/globocom/huskyCI/wiki> \"here\" ) . \n \n \n\n\n** [ Download huskyCI ](<https://github.com/globocom/huskyCI> \"Download huskyCI\" ) **\n", "edition": 12, "modified": "2019-12-23T20:14:04", "published": "2019-12-23T20:14:04", "id": "KITPLOIT:4197172456156795397", "href": "http://www.kitploit.com/2019/12/huskyci-performing-security-tests.html", "title": "huskyCI - Performing Security Tests Inside Your CI", "type": "kitploit", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-12-01T15:27:18", "bulletinFamily": "tools", "cvelist": ["CVE-2018-13379"], "description": "[  ](<https://1.bp.blogspot.com/-ra7Uxs9O3sk/XgAkQFKw4pI/AAAAAAAARMM/BZsiNAEZ828cxgnmQxjV1QryeiNTHHt_ACNcBGAsYHQ/s1600/pylane_2_pylane_show.gif>)\n\n \nPylane is a python vm [ injector ](<https://www.kitploit.com/search/label/Injector> \"injector\" ) with debug tools, based on [ gdb ](<https://www.kitploit.com/search/label/GDB> \"gdb\" ) and ptrace. Pylane uses gdb to trace python process, inject and run some code in its python vm. \n \n** Usage ** \nuse inject command to inject a python script in an process: \n\n \n \n pylane inject <PID> <YOUR_PYTHON_FILE>\n\nuse shell command to inject an interactive shell: \n\n \n \n pylane shell <PID>\n\nPylane shell features: \n\n\n * use IPython as its interactive interface, support magic functions like ? and % \n * support [ remote ](<https://www.kitploit.com/search/label/Remote> \"remote\" ) automatic completion \n * provide debug [ toolkit ](<https://www.kitploit.com/search/label/Toolkit> \"toolkit\" ) functions, such as: \n * lookup class or instance by name \n * get source code of an object \n * print all threads' stack and locals \n \n** Install ** \n\n \n \n pip install pylane\n\npylane should be installed in virtualenv the target process uses or in os python lib. \n \n** Compatibility ** \nSupport [ Linux ](<https://www.kitploit.com/search/label/Linux> \"Linux\" ) and BSD \n \n \n\n\n** [ Download Pylane ](<https://github.com/NtesEyes/pylane> \"Download Pylane\" ) **\n", "edition": 8, "modified": "2019-12-24T20:20:06", "published": "2019-12-24T20:20:06", "id": "KITPLOIT:5391824882035857145", "href": "http://www.kitploit.com/2019/12/pylane-python-vm-injector-with-debug.html", "title": "Pylane - An Python VM Injector With Debug Tools, Based On GDB", "type": "kitploit", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-12-01T15:27:07", "bulletinFamily": "tools", "cvelist": ["CVE-2018-13379"], "description": "A normal [ flask ](<https://www.kitploit.com/search/label/Flask> \"flask\" ) web app to learn [ win32api ](<https://www.kitploit.com/search/label/Win32API> \"win32api\" ) with code snippets and references. \n \n** Prerequisite ** \nYou need to download the following package before starting it \n\n \n \n pip install flask\n pip install pefile\n pip install requests\n\n \n** Usage ** \n\n \n \n $ python flaskapp.py\n\n \n** Live Demo ** \n \n\n\n \n** Here is the Walkthrough: ** \n\n\n 1. Upload the exe or dll. \n\n[  ](<https://1.bp.blogspot.com/-dR1mXyN7nbw/XgJtB81d31I/AAAAAAAARQ8/xD8YofWi5uEm9mBO1XqBtIFI26PCctMzACNcBGAsYHQ/s1600/malwinx_1.png>)\n\n 2. The function of exe and [ dll ](<https://www.kitploit.com/search/label/DLL> \"dll\" ) will appear. \n\n[  ](<https://1.bp.blogspot.com/-WzNNIkn7Co8/XgJtG3jgiAI/AAAAAAAARRA/ZFtOLYq1NNUMobaB2sIj4rCZVz0klQRIwCNcBGAsYHQ/s1600/malwinx_2.png>)\n\n 3. We need to just click any of the function. For example, purpose lets choose LoadLibraryA. \n\n[  ](<https://1.bp.blogspot.com/-Dw6g7uvkaE0/XgJtLLsh_1I/AAAAAAAARRE/_v32O3kvb5s8CQZzwOIZLLV7O825PHgfACNcBGAsYHQ/s1600/malwinx_3.png>)\n\n 4. The code usage of any function can be extracted by clicking on these options. \n\n[  ](<https://1.bp.blogspot.com/-RwrfXTOxpnI/XgJtO43iGyI/AAAAAAAARRI/ogc94_Skes8TvIBpRPQE1S-Pi9xBI-ecACNcBGAsYHQ/s1600/malwinx_4.png>)\n\n \n\n\n[  ](<https://1.bp.blogspot.com/-IX4Cp1vkR9I/XgJtWt9MZ2I/AAAAAAAARRQ/mZys2EJaVo0x4IV1rcgWqBHeMHYJbnTKwCNcBGAsYHQ/s1600/malwinx_5.png>)\n\n \n \n\n\n** [ Download Malwinx ](<https://github.com/MohitDabas/malwinx> \"Download Malwinx\" ) **\n", "edition": 10, "modified": "2019-12-25T20:54:02", "published": "2019-12-25T20:54:02", "id": "KITPLOIT:412577043601450839", "href": "http://www.kitploit.com/2019/12/malwinx-just-normal-flask-web-app-to.html", "title": "Malwinx - Just A Normal Flask Web App To Understand Win32Api With Code Snippets And References", "type": "kitploit", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-12-01T15:24:30", "bulletinFamily": "tools", "cvelist": ["CVE-2018-13379"], "description": "[  ](<https://1.bp.blogspot.com/-UC13nDaV1pU/XgJ3e7NHTPI/AAAAAAAARR0/bnkcjZwuq3ATZXGlQFYpHjCP88-0OwwjQCNcBGAsYHQ/s1600/RansomCoinPublic_1_ransomware.png>)\n\n \nExtracting metadata and hardcoded [ Indicators of Compromise ](<https://www.kitploit.com/search/label/Indicators%20of%20Compromise> \"Indicators of Compromise\" ) from ransomware, in a scalable, efficient, way with cuckoo integrations. Ideally, is it run during cuckoo dynamic analysis, but can also be used for [ static analysis ](<https://www.kitploit.com/search/label/Static%20Analysis> \"static analysis\" ) on large collections of ransomware. Designed to be fast, with low false positive for [ cryptocurrency ](<https://www.kitploit.com/search/label/Cryptocurrency> \"cryptocurrency\" ) addresses. Limited false positives for emails, urls, onions, and domains (which is pretty hard to make perfect). \nIn short, this is fast and easy initial triage if you only want monetisation vectors. \n \n** Installation instructions ** \nPlease ensure you have Python3 installed. \n \n** In a Linux Virtual Machine ** \nIt is advisable to download and install a virtualizer such as [ VirtualBox ](<https://www.virtualbox.org/wiki/Downloads> \"VirtualBox\" ) . Install your desired [ Linux virtual machine ](<https://www.osboxes.org/virtualbox-images/> \"Linux virtual machine\" ) (i.e. Lubuntu, Kali Linux, etc) then follow the instructions below. \nFrom the tools folder: \n\n \n \n sudo apt-get install build-essential libpoppler-cpp-dev pkg-config python-dev python3-tlsh\n \n \n python3 -m pip install -r requirements.txt\n\nNote: If you get an error saying No module named pip, try running \n\n \n \n sudo apt-get install python3-pip\n\n \n** Usage instructions ** \nA tutorial video is available: [ https://youtu.be/3pUDh5HvqVI ](<https://youtu.be/3pUDh5HvqVI> \"https://youtu.be/3pUDh5HvqVI\" ) \nThe following commands can be run from the \"Tools\" folder to analyse [ malware samples ](<https://www.kitploit.com/search/label/Malware%20Samples> \"malware samples\" ) located in this directory. This will run the code across all files in the directoy and provide feedback on the estimated time to completion via TQDM. You will need write access for a file called Ransomware.csv in the directory you are working in (which contains the results). It should be possible to run the code across read only malware files though, so only Ransomware.csv need write access. \n \n** Coinlector.py ** \nAfter running coinlector.py the results are output to a file in the same directory called Ransomware.csv \n\n \n \n python3 coinlector.py\n\nView the results by running \n\n \n \n less Ransomware.csv\n\n \n\n\n[  ](<https://1.bp.blogspot.com/-UC13nDaV1pU/XgJ3e7NHTPI/AAAAAAAARR0/bnkcjZwuq3ATZXGlQFYpHjCP88-0OwwjQCNcBGAsYHQ/s1600/RansomCoinPublic_1_ransomware.png>)\n\n \nCurrently we are testing for: \n\n\n * Bitcoin Addresses (BTC) \n * Bitcoin Cash Addresses (BCH) \n * Monero Addresses (XMR) \n * Bitcoin Private Keys \n * Ethereum addresses (ETH) \n * Ripple addresses (XRP) \n * LTC addresses (LTC) \n * DOGECOIN addresses (DOGE) \n * NEO addresses (NEO) \n * DASH addresses (DASH) \n * Domains (Address) \n * Email Addresses (Email) \n * Onion Addresses (Address) \nView URLs, email addresses, and cryptocurrency addresses by running the following grep commands. \n\n \n \n less Ransomware.csv | grep URL\n \n \n less Ransomware.csv | grep Email\n \n \n less Ransomware.csv | grep Address\n\nGrep for Monero addresses by running \n\n \n \n less Ransomware.csv | grep XMR\n\nThe same command can be used to search for other cryptocurrencies using the abbreviations in the list above. \n \n** Tempuscoin.py ** \ntempuscoin.py outputs a list of timestamped ransom transactions. The file TemporalRansoms.csv is created showing the sending and receiving Bitcoin addresses, the amount in BTC and its equivalent value in EUR, USD at the time of the transaction. \n\n \n \n python3 tempuscoin.py\n\nView the results by running. \n\n \n \n less TemporalRansoms.csv\n\n \n\n\n[  ](<https://1.bp.blogspot.com/-BUwm6Kt7kDY/XgJ3sNB3UXI/AAAAAAAARR4/wgD0coZIE5MjSGRNwn6zvVKmBamSc2JfQCNcBGAsYHQ/s1600/RansomCoinPublic_2_temporal-ransoms.png>)\n\n \n** Eventcoin.py ** \nThis code will probably need to be altered to be made usable with your own MISP instance. It uses PyMISP to create events from the Ransomware.csv file, and groups of events share the same name. The default is to create events that are not published, and then to add details by hand before publishing. YMMV. \n \n \n\n\n** [ Download RansomCoin ](<https://github.com/Concinnity-Risks/RansomCoinPublic> \"Download RansomCoinPublic\" ) **\n", "edition": 8, "modified": "2019-12-27T11:30:06", "published": "2019-12-27T11:30:06", "id": "KITPLOIT:1250903811043992946", "href": "http://www.kitploit.com/2019/12/ransomcoin-dfir-tool-to-extract.html", "title": "RansomCoin - A DFIR Tool To Extract Cryptocoin Addresses And Other Indicators Of Compromise From Binaries", "type": "kitploit", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-12-01T20:27:09", "bulletinFamily": "tools", "cvelist": ["CVE-2018-13379"], "description": "[  ](<https://1.bp.blogspot.com/--DrvdEjRr7E/XgFxEzywxBI/AAAAAAAARQE/k_t7Bgzo9V8dDhA5WXyaoVLu-P72naYgwCNcBGAsYHQ/s1600/tools-2019-title.png>)\n\n \n\n\nAs [ last year ](<https://www.kitploit.com/2018/12/top-20-most-popular-hacking-tools-in.html>) , this year we made a ranking with the most popular tools between January and December 2019. \n\n \n\n\nTopics of the tools focus on [ ** OSINT ** ](<https://www.kitploit.com/search/label/OSINT>) , [ ** Information Gathering ** ](<https://www.kitploit.com/search/label/Information%20Gathering>) , [ ** Android Hacking Tools ** ](<https://www.kitploit.com/search/label/Android>) , [ ** Automation Tools ** ](<https://www.kitploit.com/search/label/Security%20Automation>) , [ ** Phishing ** ](<https://www.kitploit.com/search/label/Phishing>) , among others. \n\n \n\n\nWithout going into further details, we have prepared a useful list of the most popular tools in Kitploit 2019: \n\n \n\n\n## \n\n 1. [ Hijacker - All-in-One Wi-Fi Cracking Tools for Android ](<https://www.kitploit.com/2018/04/hijacker-v15-all-in-one-wi-fi-cracking.html>)\n\n[  ](<https://1.bp.blogspot.com/-s5Tte11EOWI/XgFk_8i8XII/AAAAAAAARNk/i8P1A7uyzY4tlfDRajptGY5X_FK0xm63QCNcBGAsYHQ/s1600/Hijacker.png>)\n\n \n\n\n## \n\n 2. [ Findomain - The Fastest And Cross-Platform Subdomain Enumerator ](<https://www.kitploit.com/2019/12/findomain-v093-fastest-and-cross.html>)\n\n[  ](<https://1.bp.blogspot.com/-y_DOk_VYMpk/XgFlrSoTDhI/AAAAAAAARNs/ORiX9bimRX4TVAsEXYUxt86e4_NxP0KAACNcBGAsYHQ/s1600/findomain_4_findomain.png>)\n\n \n\n\n## \n\n 3. [ EagleEye - Stalk Your Friends. Find Their Instagram, FB And Twitter Profiles Using Image Recognition And Reverse Image Search ](<https://www.kitploit.com/2018/07/eagleeye-stalk-your-friends-find-their.html>)\n\n[  ](<https://1.bp.blogspot.com/-yiZh5nJ0x1k/XgFl70XeH1I/AAAAAAAARN0/HWJXq0KlP3EbVwcLMFTXQ8ME0HRiyLrYgCNcBGAsYHQ/s1600/EagleEye.png>)\n\n \n\n\n## \n\n 4. [ ANDRAX - Penetration Testing on Android ](<https://www.kitploit.com/2019/12/andrax-v4-dragonfly-penetration-testing.html>)\n\n[  ](<https://1.bp.blogspot.com/-TvRtMikytzE/XgFmPGcfaFI/AAAAAAAARN8/BJKDyV6oF7gQtyNEhzQkPd6WxOG8BwFYwCNcBGAsYHQ/s1600/andrax-logo.png>)\n\n \n\n\n## \n\n 5. [ CQTools - The New Ultimate Windows Hacking Toolkit ](<https://www.kitploit.com/2019/05/cqtools-new-ultimate-windows-hacking.html>)\n\n[  ](<https://1.bp.blogspot.com/-1dsTQs_MSk4/XgFmvbQbGII/AAAAAAAAROE/FU5wocBpOqET9E_9HPDy0Ib2DqJp5b9jACNcBGAsYHQ/s1600/cqurebhasia.jpg>)\n\n \n\n\n## \n\n 6. [ Sampler - A Tool For Shell Commands Execution, Visualization And Alerting (Configured With A Simple YAML File) ](<https://www.kitploit.com/2019/08/sampler-tool-for-shell-commands.html>)\n\n[  ](<https://1.bp.blogspot.com/-EeDWByYwvqE/XgFnFqjRpuI/AAAAAAAAROM/rwdIuedCiMkbPYwKbsUg74N6tWJyscxKACNcBGAsYHQ/s1600/sampler_3.gif>)\n\n \n\n\n## \n\n 7. [ LOIC (Low Orbit Ion Cannon) - A network stress testing application ](<https://www.kitploit.com/2014/12/loic-108-low-orbit-ion-cannon-network.html>)\n\n[  ](<https://1.bp.blogspot.com/-olm6taCTMJk/XgFnU3TSFnI/AAAAAAAAROQ/M2RA5fcAws0BKAYyujsYnJBJazYZ_BjAACNcBGAsYHQ/s1600/LOIC.jpg>)\n\n \n\n\n## \n\n 8. [ EasySploit - Metasploit Automation (EASIER And FASTER Than EVER) ](<https://www.kitploit.com/2019/04/easysploit-metasploit-automation-easier.html>)\n\n[  ](<https://1.bp.blogspot.com/-SvxV9B9yrj8/XgFnkUqVGbI/AAAAAAAAROY/zFiN6yG9DF8nqsU9CEIJfJWpaY0dnBFnQCNcBGAsYHQ/s1600/EasySploit.jpg>)\n\n \n\n\n## \n\n 9. [ ScanQLi - Scanner To Detect SQL Injection Vulnerabilities ](<https://www.kitploit.com/2019/04/scanqli-scanner-to-detect-sql-injection.html>)\n\n[  ](<https://1.bp.blogspot.com/-5z6bM89HMYY/XgFn0VWGFaI/AAAAAAAAROk/GDf4Vd6sAeQCSesIfVf0n7eyUllsBMXQgCNcBGAsYHQ/s1600/ScanQLi_4_scanqli.jpeg>)\n\n \n\n\n## \n\n 10. [ SQLMap - Automatic SQL Injection And Database Takeover Tool ](<https://www.kitploit.com/2019/10/sqlmap-v1310-automatic-sql-injection.html>)\n\n[  ](<https://1.bp.blogspot.com/-pvCUeqDoxxQ/XgFoIIloKrI/AAAAAAAAROs/7oS7YfawsHghb5Bd30MsShRn39dLMPhwwCNcBGAsYHQ/s1600/sqlmap.png>)\n\n \n\n\n## \n\n 11. [ OKadminFinder - Admin Panel Finder / Admin Login Page Finder ](<https://www.kitploit.com/2019/12/okadminfinder-admin-panel-finder-admin.html>)\n\n[  ](<https://1.bp.blogspot.com/--L2Mr5_tiIQ/XgFos7bhBhI/AAAAAAAARO0/w0GYYFXyqx0ZfQqA1QZesZhAA54UMpNxACNcBGAsYHQ/s1600/okadminfinder3.png>)\n\n \n\n\n## \n\n 12. [ Shellphish - Phishing Tool For 18 Social Media (Instagram, Facebook, Snapchat, Github, Twitter...) ](<https://www.kitploit.com/2019/06/shellphish-phishing-tool-for-18-social.html>)\n\n[  ](<https://1.bp.blogspot.com/-w9_3IzJnTSE/XgFo7C6-YFI/AAAAAAAARO4/URM-kxU9jfol9RcpqPsKFVv-H0aVgBNNwCNcBGAsYHQ/s1600/shellphish_1.png>)\n\n \n\n\n## \n\n 13. [ DNS-Shell - An Interactive Shell Over DNS Channel ](<https://www.kitploit.com/2019/03/dns-shell-interactive-shell-over-dns.html>)\n\n[  ](<https://1.bp.blogspot.com/-73-x_ff9lvQ/XgFpJGZpbrI/AAAAAAAARPA/7O-O8SyL8pwSxsYfwAXKSJOYJ5phBubmACNcBGAsYHQ/s1600/DNS-Shell.png>)\n\n \n\n\n## \n\n 14. [ QRLJacker - QRLJacking Exploitation Framework ](<https://www.kitploit.com/2019/04/qrljacker-v20-qrljacking-exploitation.html>)\n\n[  ](<https://1.bp.blogspot.com/-GSqcXfeT_nA/XgFpWsUUN6I/AAAAAAAARPI/hBne0ZIWBAUjUbM_b4E_bP_ltWlfN9g3wCNcBGAsYHQ/s1600/QRLJacker.png>)\n\n \n\n\n## \n\n 15. [ PhoneSploit - Using Open Adb Ports We Can Exploit A Devive ](<https://www.kitploit.com/2019/05/phonesploit-using-open-adb-ports-we-can.html>)\n\n[  ](<https://1.bp.blogspot.com/-1882HE0fExc/XgFpmke9IKI/AAAAAAAARPQ/G6qcXYQR9do5UZMSrWpIKFaGQGonMXY8wCNcBGAsYHQ/s1600/PhoneSploit_1_Screenshot.png>)\n\n \n\n\n## \n\n 16. [ SocialBox - A Bruteforce Attack Framework (Facebook, Gmail, Instagram, Twitter) ](<https://www.kitploit.com/2018/09/socialbox-bruteforce-attack-framework.html>)\n\n[  ](<https://1.bp.blogspot.com/-ShbjPyQSlQ0/XgFp2tTP-eI/AAAAAAAARPc/PVWTMLkmWtIxGIHr8n2BbXyvtZir_Xc5ACNcBGAsYHQ/s1600/SocialBox_1_sb.png>)\n\n \n\n\n## \n\n 17. [ Instainsane - Multi-threaded Instagram Brute Forcer ](<https://www.kitploit.com/2019/04/instainsane-multi-threaded-instagram.html>)\n\n[  ](<https://1.bp.blogspot.com/-RmwiycE3HxA/XgFqC0SbvdI/AAAAAAAARPg/J8L0MrvBUtArlsFiP_kaUo74xeC2ywmGACNcBGAsYHQ/s1600/instainsane_1.png>)\n\n \n\n\n## \n\n 18. [ Tool-X - A Kali Linux Hacking Tool Installer ](<https://www.kitploit.com/2019/01/tool-x-kali-linux-hacking-tool-installer.html>)\n\n[  ](<https://1.bp.blogspot.com/-INHXX0qd1U0/XgFqNiCotZI/AAAAAAAARPo/EmWIwIxjtFIilrcCdUDRYWx_zkV0h3lfgCNcBGAsYHQ/s1600/Tool-X_1_Logo.png>)\n\n \n\n\n## \n\n 19. [ Hacktronian - All In One Hacking Tool For Linux &amp; Android ](<https://www.kitploit.com/2019/08/hacktronian-all-in-one-hacking-tool-for.html>)\n\n[  ](<https://1.bp.blogspot.com/-fZ16992c34Y/XgFqX_RWNGI/AAAAAAAARPw/RbEXPmX32Ro-MwmauoT0GpKO2yXWvVBwACNcBGAsYHQ/s1600/hacktronian_1_logo.png>)\n\n \n\n\n## \n\n 20. [ Ultimate Facebook Scraper - A Bot Which Scrapes Almost Everything About A Facebook User'S Profile Including All Public Posts/Statuses Available On The User'S Timeline, Uploaded Photos, Tagged Photos, Videos, Friends List And Their Profile Photos ](<https://www.kitploit.com/2019/11/ultimate-facebook-scraper-bot-which.html>)\n\n[  ](<https://1.bp.blogspot.com/-dlnwGtScduU/XgFqlEXI_WI/AAAAAAAARP4/K6-Vh3raY7AlQvm-LZ8OvBf4pp0KwCvEQCNcBGAsYHQ/s1600/Ultimate-Facebook-Scraper_19_screenshot.png>)\n\n \n \n** Happy New Year wishes the KitPloit team! ** \n \n \n\n", "edition": 8, "modified": "2019-12-28T11:30:01", "published": "2019-12-28T11:30:01", "id": "KITPLOIT:3942020756098074635", "href": "http://www.kitploit.com/2019/12/top-20-most-popular-hacking-tools-in.html", "title": "Top 20 Most Popular Hacking Tools in 2019", "type": "kitploit", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-12-01T20:28:12", "bulletinFamily": "tools", "cvelist": ["CVE-2018-13379"], "description": "[  ](<https://1.bp.blogspot.com/-pkkkx6MH1Kw/Xh0v56wP_VI/AAAAAAAARcQ/ufXrYI294PE2KDNlK12OavJmByEK2MRawCNcBGAsYHQ/s1600/AntiCheat-Testing-Framework.png>)\n\n \nFramework to test any Anti-Cheat on the market. This can be used as Template or Code Base to test any Anti-Cheat and learn along the way. The entry level to [ reverse ](<https://www.kitploit.com/search/label/Reverse> \"reverse\" ) AntiCheats and Cheats is quite high, therefore, I'm realeasing all the code I developed during my research. The main idea is to help people and motive them to get into this topic which is really interesting and there is a lot to [ research ](<https://www.kitploit.com/search/label/Research> \"research\" ) about it. \nAll this code is the result of a research done for Recon2019 (Montreal) and [ BlackHat ](<https://www.kitploit.com/search/label/BlackHat> \"BlackHat\" ) Europe 2019 (London). \n \nTwitter: [ @Niemand_sec ](<https://twitter.com/niemand_sec> \"@Niemand_sec\" ) \nMore info: [ Personal Blog ](<https://niemand.com.ar/> \"Personal Blog\" ) \n\n\n * ** Description for each module can be found on each folder ** . \n * Modules can be used together or separated. \n * Cuztomization should be simple due to the modularity of the code. \n \n** Usage ** \nMost of the settings can be done by using config.ini file, however, some modules may require particular settings on the code, depending on your intentions. \n\n\n> Remember to change location of config.ini file at CheatHelper/CheatHelper.cpp (variable configFile) \n\n \n** Modules (more coming in the future) ** \n\n\n * CheatHelper \n * DriverDisabler \n * DriverHelper \n * DriverTester \n * HandleElevationDriver \n * HandleHijackingDLL \n * HandleHijackingMaster \n * LuaHook \n * StealthHijackingNormalDLL \n * StealthHijackingNormalMaster \n \n** About this Project ** \nAll this code is a result of the Researching presented at [ Recon ](<https://www.kitploit.com/search/label/Recon> \"Recon\" ) 2019 and BlackHat Europe 2019: \"Unveiling the underground world of Anti-Cheats\" \nLinks: \n\n\n * First Release Info: \n * [ https://recon.cx/2019/montreal/ ](<https://recon.cx/2019/montreal/> \"https://recon.cx/2019/montreal/\" )\n * [ https://cfp.recon.cx/reconmtl2019/talk/MRJ3CN/ ](<https://cfp.recon.cx/reconmtl2019/talk/MRJ3CN/> \"https://cfp.recon.cx/reconmtl2019/talk/MRJ3CN/\" )\n * Second Release: \n * [ https://www.blackhat.com/eu-19/briefings/schedule/index.html#unveiling-the-underground-world-of-anti-cheats-17359 ](<https://www.blackhat.com/eu-19/briefings/schedule/index.html#unveiling-the-underground-world-of-anti-cheats-17359> \"https://www.blackhat.com/eu-19/briefings/schedule/index.html#unveiling-the-underground-world-of-anti-cheats-17359\" )\n \n \n\n\n** [ Download AntiCheat-Testing-Framework ](<https://github.com/niemand-sec/AntiCheat-Testing-Framework> \"Download AntiCheat-Testing-Framework\" ) **\n", "edition": 8, "modified": "2020-01-17T20:30:11", "published": "2020-01-17T20:30:11", "id": "KITPLOIT:5121154549033547239", "href": "http://www.kitploit.com/2020/01/anticheat-testing-framework-framework.html", "title": "AntiCheat-Testing-Framework - Framework To Test Any Anti-Cheat", "type": "kitploit", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-12-01T20:27:35", "bulletinFamily": "tools", "cvelist": ["CVE-2018-13379"], "description": "[  ](<https://1.bp.blogspot.com/-ga9LAnSX1ZE/Xh0xDoKfvvI/AAAAAAAARcY/z_1zFTpnBT0Zxrqa90V4zmjA86wuIQ-owCNcBGAsYHQ/s1600/bluewall_1.png>)\n\n \n\n\nBluewall is a [ firewall ](<https://www.kitploit.com/search/label/Firewall> \"firewall\" ) framework designed for offensive and defensive cyber professionals. This framework allows [ Cybersecurity ](<https://www.kitploit.com/search/label/Cybersecurity> \"Cybersecurity\" ) professionals to quickly setup their environment while staying within their scope. \n \n** Credit ** \nInspired by Andrew Benson's [ hostfw iptable generation script ](<https://github.com/abenson/hostfw> \"hostfw iptable generation script\" ) . \n \n** Features ** \n \n** Bluewall ** \n\n \n \n * Configure Firewall\n * Configure Hostname\n * Configure Interface(s)\n\n \n** Supported Operating Systems ** \n\n \n \n * Redhat/CentOS\n * [Windows](<https://www.kitploit.com/search/label/Windows> \"Windows\" ) configuration can be generated but not executed.\n\n \n** Commandline ** \n\n \n \n * bluewall -c config/example.ini\n ** See example configuration\n\n \n** Utils ** \n\n \n \n * Enumerate - Identify live hosts inside your network (coming soon)\n\n \n** Symantecs ** \n\n \n \n * Target Host - Outbound communication\n * Trusted Host - Bidirectional communication\n * No Strike - Devices your computer should not communicate with\n\n \n** Setup ** \n\n \n \n # BUILT FOR PYTHON 2.x\n sudo python setup.py install\n sudo bluewall -h (for help)\n\n \n** Getting Started ** \n\n \n \n # Setup Initial Environment using Configuration\n sudo bluewall -c config/hostconfig.ini\n \n # Export optional windows configuration\n sudo bluewall -c config/hostconfig.ini -w autoconfig.ps1\n \n # Add additional inbound host or ranges\n sudo bluewall -ih 192.168.0.3,192.168.1.0/24\n \n # Exclude host to communicate with\n sudo bluewall -eh 192.168.1.1\n \n # Super easy wizard mode\n sudo bluewall --wizard\n\n \n** Help ** \n\n \n \n usage: bluewall [-h] [-V] [-v] [-r] [-p] [-i] [-d] [-w WINDOWS_CONFIG]\n [-ot TCP_PORTS_OUT] [-ou UDP_PORTS_OUT] [-it TCP_PORTS_IN]\n [-iu UDP_PORTS_IN] [-oh OUTBOUND_HOSTS] [-ih INBOUND_HOSTS]\n [-eh EXCLUDE_HOSTS] [-l] [-s] [-q] [-D] [-A] [-F] [-S] [-c CONFIG]\n [--info]\n \n /////////////////////////////////////////////////////\n | _____ __ _____ _____ _ _ _ _____ __ __ |\n | | __ | | | | | __| | | | - | | | | |\n | | __-| |__| | | __| | | | | |__| |__ |\n | |_____|_____|_____|_____|_____|__|__|_____|_____| |\n | |\n \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\n A python framework to automate firewall setup.\n \n Defaults:\n Outbound connections will be allowed on all ports to all hosts.\n Inbou nd connections will be limited to related outbound traffic.\n DHCP will be enabled.\n Ping responses will be enabled.\n Unsolicited inbound connections will be dropped.\n \n \n \n optional arguments:\n -h, --help show this help message and exit\n -V, --version Display Version\n -v, --verbose Verbose Mode\n -r, --reset Send TCP RST instead of dropping packet.\n -p, --disallow_ping Disallow incoming PING\n -i, --allow_outbound_icmp\n Don't restrict ICMP types\n -d, --disallow_dhcp Disallow DHCP\n -w WINDOWS_CONFIG, --windows_config WINDOWS_CONFIG\n Generate Windows Configuration. Usage: bluewall -w\n config.ps1\n -ot TCP_PORTS_OUT, --tcp_ports_out TCP_PORTS_OUT\n Comma separated list of allowed TCP ports outbound\n -ou UDP_PORTS_OUT, --udp_ports_ out UDP_PORTS_OUT\n Comma separated list of allowed UDP ports outbound\n -it TCP_PORTS_IN, --tcp_ports_in TCP_PORTS_IN\n Comma separated list of allowed TCP ports inbound\n -iu UDP_PORTS_IN, --udp_ports_in UDP_PORTS_IN\n Comma separated list of allowed UDP ports inbound\n -oh OUTBOUND_HOSTS, --outbound_hosts OUTBOUND_HOSTS\n Restrict outbound to specified hosts. -oh\n 192.168.3.0/24,192.168.4.0/24\n -ih INBOUND_HOSTS, --inbound_hosts INBOUND_HOSTS\n Restrict outbound to specified hosts. -ih\n 192.168.3.0/24,192.168.4.0/24\n -eh EXCLUDE_HOSTS, --exclude_hosts EXCLUDE_HOSTS\n Exclude hosts -eh 192.168.3.0/24\n -l, --log_exceptions Log Exceptions\n -s, --simulate Simulate only.\n -q, --quiet Quiet (don't display status messages\n -D, --deny_all Absolute Deny all\n -A, --allow_all Absolute allow all\n -F, --flush Flush IPTables\n -S, --show_rules Show rules after setting\n --wizard Addressing and firewall wizard mode\n -c CONFIG, --config CONFIG\n Configuration for firewall\n --info About Bluewall\n\n \n** Config Example ** \nexample.ini \n\n \n \n [local_config]\n iface=em1\n rh_host=RHEL-Example\n rh_ipaddr=192.168.1.42\n netmask=255.255.255.0\n gateway_addr=172.16.63.1\n dns=8.8.8.8\n #win_ipaddr=192.168.1.42 - Optional windows IP Address\n #\n # Optional Windows host (Bluewall will generate a config file for windows)\n win_host=WINExample\n # MAC Addresses must be ALL CAPS Valid: AA:93:AB:EF:00:01\n # rh_mac=* will generate random MAC address\n rh_mac=*\n \n [firewall_config]\n # Target Range are networks you want to allow outbound communication with.\n target_range=172.16.63.0/24\n target_range=192.168.2.0/24\n #\n # Nostrike addresses are devices your computer should NOT communicate with\n nostrike=192.168.2.1\n #\n # Trusted Range are networks you wish to have bi-directional communication with\n trusted_range=172.16.63.0/24\n trusted_host=42.42.42.42\n\n \n** Output ** \n\n \n \n [[email\u00a0protected] bluewall]$ sudo bluewall -c configs/exampleconfig.ini \n [OK] 192.168.1.101 is a valid setting for dns\n [OK] 192.168.1.1 is a valid setting for gateway_addr\n [OK] 24 is a valid setting for cidr_prefix\n [OK] 192.168.1.254 is a valid setting for nostrike\n [OK] * is a valid setting for rh_mac\n [OK] WINtaylor is a valid setting for win_host\n [OK] 192.168.2.0/24 is a valid setting for target_range\n [OK] 192.168.3.0/24 is a valid setting for target_range\n [OK] 192.168.1.30 is a valid setting for rh_ipaddr\n [OK] RHEL-taylor is a valid setting for rh_host\n [OK] 42.42.42.42 is a valid setting for trusted_host\n [OK] 192.168.1.0/24 is a valid setting for trusted_range\n [OK] 192.168.1.50 is a valid setting for win_ipaddr\n ==============================\n \n [VALID CONFIG] No Errors Detected.\n \n CONFIGURING\n writing eth config to /etc/sysconfig/network-scripts/ifcfg-ens33\n [CONFIGURATION]\n TYPE=\"Etherne t\"\n BOOTPROTO=none\n NAME=ens33\n DEVICE=\"ens33\"\n ONBOOT=no\n DEFROUTE=\"yes\"\n IPV4_FAILURE_FATAL=no\n DNS1=192.168.1.101\n IPADDR=192.168.1.30\n PREFIX=24\n GATEWAY=192.168.1.1\n MACADDR=00:16:3E:52:7F:8D\n \n [+] Interface ens33 shutdown.\n [+] Restarting Network Service\n [+] Interface ens33 brought up.\n [+] Rules Flushed!\n [+] Allowing outbound ICMP/traceroute to 192.168.2.0/24...\n [+] Allowing outbound ICMP/traceroute to 192.168.3.0/24...\n [+] Allowing outbound ICMP/traceroute to 192.168.1.0/24...\n [+] Limiting outbound TCP connections to 192.168.2.0/24.\n [+] Limiting outbound TCP connections to 192.168.3.0/24.\n [+] Limiting outbound TCP connections to 192.168.1.0/24.\n [+] Limiting outbound UDP connections to 192.168.2.0/24.\n [+] Limiting outbound UDP connections to 192.168.3.0/24.\n [+] Limiting outbound UDP connections to 192.168.1.0/24.\n [+] Limiting inbound UDP connections to 192.168.1.0/24.\n [+] Limiting in bound TCP connections to 192.168.1.0/24.\n [+] Allowing traffic for localhost.\n [+] 192.168.1.254 applied to NOSTRIKE\n $ iptables -nvL\n Chain INPUT (policy DROP 0 packets, 0 bytes)\n pkts bytes target prot opt in out source destination \n 0 0 DROP all -- * * 192.168.1.254 0.0.0.0/0 \n 0 0 ACCEPT all -- * * 127.0.0.0/8 127.0.0.0/8 \n 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.0/24 \n 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.1.0/24 \n \n Chain FORWARD (policy DROP 0 packets, 0 bytes)\n pkts bytes target prot opt in out source destination \n < br/>Chain OUTPUT (policy DROP 0 packets, 0 bytes)\n pkts bytes target prot opt in out source destination \n 0 0 DROP all -- * * 0.0.0.0/0 192.168.1.254 \n 0 0 ACCEPT all -- * * 127.0.0.0/8 127.0.0.0/8 \n 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.1.0/24 \n 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.3.0/24 \n 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.2.0/24 \n 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.0/24 \n 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.3.0/24 \n 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.2.0/24 \n 0 0 ACCEPT icmp -- * * 0.0.0.0/0 192.168.1.0/24 icmptype 0\n 0 0 ACCEPT icmp -- * * 0.0.0.0/0 192.168.1.0/24 icmptype 8\n 0 0 ACCEPT icmp -- * * 0.0.0.0/0 192.168.3.0/24 icmptype 0\n 0 0 ACCEPT icmp -- * * 0.0.0.0/0 192.168.3.0/24 icmptype 8\n 0 0 ACCEPT icmp -- * * 0.0.0.0/0 192.168.2.0/24 icmptype 0\n 0 0 ACCEPT icmp -- * * 0.0.0.0/0 192.168.2.0/24 icmptype 8\n \n [+] Setup Complete.\n\n \n \n\n\n** [ Download Bluewall ](<https://github.com/austin-taylor/bluewall> \"Download Bluewall\" ) **\n", "edition": 30, "modified": "2020-01-18T11:30:02", "published": "2020-01-18T11:30:02", "id": "KITPLOIT:2951994230252402276", "href": "http://www.kitploit.com/2020/01/bluewall-firewall-framework-designed.html", "title": "Bluewall - A Firewall Framework Designed For Offensive And Defensive Cyber Professionals", "type": "kitploit", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-12-01T20:26:44", "bulletinFamily": "tools", "cvelist": ["CVE-2018-13379"], "description": "[  ](<https://1.bp.blogspot.com/-U7at-REDy8E/Xh1GPrBxOiI/AAAAAAAARcg/XiBXjmdy3nc-VszibeKX__qqe9f4P9UGACNcBGAsYHQ/s1600/tor-project-logo-onions.png>)\n\n \nScallion lets you create vanity GPG keys and .onion addresses (for [ Tor's ](<https://www.torproject.org/> \"Tor's\" ) [ hidden services ](<https://www.torproject.org/docs/hidden-services> \"hidden services\" ) ) using OpenCL. \nScallion runs on Mono (tested in Arch Linux) and .NET 3.5+ (tested on [ Windows ](<https://www.kitploit.com/search/label/Windows> \"Windows\" ) 7 and Server 2008). \nScallion is currently in beta stage and under active development. Nevertheless, we feel that it is ready for use. Improvements are expected primarily in performance, user interface, and ease of installation, not in the overall algorithm used to generate keys. \n \n** FAQ ** \nHere are some frequently asked questions and their answers: \n\n\n * Why generate GPG keys? \nScallion was used to find collisions for every 32bit key id in the Web of Trust's strong set demonstrating how insecure 32bit key ids are. There was/is [ a talk at DEFCON ](<https://www.defcon.org/html/defcon-22/dc-22-speakers.html#Klafter> \"a talk at DEFCON\" ) ( [ video ](<https://www.youtube.com/watch?v=Ow-YcP_KsIw> \"video\" ) ) and additional info can be found at [ https://evil32.com/ ](<https://evil32.com/> \"https://evil32.com/\" ) . \n\n * What are valid characters? \nTor .onion addresses use [ Base32 ](<https://www.ietf.org/rfc/rfc4648.txt> \"Base32\" ) , consisting of all letters and the digits 2 through 7, inclusive. They are case-insensitive. \nGPG fingerprints use [ hexadecimal ](<https://en.wikipedia.org/wiki/Hexadecimal> \"hexadecimal\" ) , consisting of the digits 0-9 and the letters A-F. \n\n * Can you use [ Bitcoin ](<https://www.kitploit.com/search/label/Bitcoin> \"Bitcoin\" ) ASICs (e.g. Jalapeno, KnC) to accelerate this process? \nSadly, no. While the process Scallion uses is conceptually similar (increment a nonce and check the hash), the details are different (SHA-1 vs double SHA-256 for Bitcoin). Furthermore, Bitcoin ASICs are as fast as they are because they are extremely tailored to Bitcoin mining applications. For example, here's the [ datasheet ](<https://bitmine.ch/wp-content/uploads/2013/11/CoinCraft-A1.pdf> \"datasheet\" ) for the CoinCraft A-1, an ASIC that never came out, but is probably indicitive of the general approach. The microcontroller sends work in the form of the final 128-bits of a Bitcoin block, the hash midstate of the previous bits, a target difficulty, and the maximum nonce to try. The ASIC chooses the location to insert the nonce, and it chooses what blocks meet the hash. Scallion has to insert the nonce in a different location, and it checks for a pattern match rather than just \"lower than XXXX\". \n\n * How can you use multiple devices? \nRun multiple Scallion instances. Scallion searches are probabilistic, so you won't be repeating work with the second device. True multi-device support wouldn't be too difficult, but it also wouldn't add much. I've run several scallion instances in [ tmux ](<http://tmux.sourceforge.net/> \"tmux\" ) or [ screen ](<https://www.gnu.org/software/screen/> \"screen\" ) with great success. You'll just need to manually abort all the jobs when one finds a pattern (or write a shell script to monitor the output file and kill them all when it sees results). \n\n \n** Dependencies ** \n\n\n * OpenCL and relevant drivers installed and configured. Refer to your distribution's documentation. \n * OpenSSL. For Windows, the prebuilt x86 DLLs are included \n * On windows only, [ VC++ Redistributable 2008 ](<https://www.microsoft.com/en-us/download/details.aspx?id=5582> \"VC++ Redistributable 2008\" )\n \n** Binary Download ** \nJust want the latest binary version? Grab it [ here ](<https://github.com/lachesis/scallion/raw/binaries/scallion-v2.0.zip> \"here\" ) . \n \n** Build Linux ** \nPrerequisites \n\n\n * Get the latest mono for your linux distribution: \n[ http://www.mono-project.com/download/ ](<https://www.mono-project.com/download/> \"http://www.mono-project.com/download/\" ) \n\n * Install Common dependencies: \n\n \n sudo apt-get update\n sudo apt-get install libssl-dev mono-devel\n\n * AMD/OpenSource build ` sudo apt-get install ocl-icd-opencl-dev ` \n\n * Nvidia build ` sudo apt-get install nvidia-opencl-dev nvidia-opencl-icd ` \n\n * Finally ` msbuild scallion.sln ` \n\n \n** Docker Linux (nvidia GPUs only) ** \n\n\n 1. Have the [ nvidia-docker container ](<https://github.com/NVIDIA/nvidia-docker> \"nvidia-docker container\" ) runtime \n\n 2. Build the container: \n\n \n docker build -t scallion -f Dockerfile.nvidia .\n\n 3. Run: \n\n \n docker run --runtime=nvidia -ti --rm scallion -l\n\n[ screenshot of expected output ](<https://user-images.githubusercontent.com/9354925/53215957-37ed6100-3653-11e9-97d0-97a6c06eabe4.png> \"screenshot of expected output\" ) \n\n \n** Build Windows ** \n\n\n 1. Open 'scallion.sln' in VS Express for Desktop 2012 \n 2. Build the solution, I did everything in debug mode. \n \n** Usage ** \n** Restarting Scallion during a search will not lose \"progress\". It is a probabilistic search and Scallion does not make \"progress\" ** \nList devices \n\n \n \n $ mono scallion/bin/Debug/scallion.exe -l\n\nGenerate a hash \n\n \n \n $ mono scallion/bin/Debug/scallion.exe -d 0 prefix\n Cooking up some delicious scallions...\n Using kernel optimized from file kernel.cl (Optimized4)\n Using work group size 128\n Compiling kernel... done.\n Testing SHA1 hash...\n CPU SHA-1: d3486ae9136e7856bc42212385ea797094475802\n GPU SHA-1: d3486ae9136e7856bc42212385ea797094475802\n Looks good!\n LoopIteration:40 HashCount:671.09MH Speed:9.5MH/s Runtime:00:01:10 Predicted:00:00:56 Found new key! Found 1 unique keys.\n <XmlMatchOutput>\n <GeneratedDate>2014-08-05T07:14:50.329955Z</GeneratedDate>\n <Hash>prefix64kxpwmzdz.onion</Hash>\n <PrivateKey>-----BEGIN RSA PRIVATE KEY-----\n MIICXAIBAAKBgQCmYmTnwGOCpsPOqvs5mZQbIM1TTqOHK1r6zGvpk61ZaT7z2BCE\n FPvdTdkZ4tQ3/95ufjhPx7EVDjeJ/JUbT0QAW/YflzUfFJuBli0J2eUJzhhiHpC/\n 1d3rb6Uhnwvv3xSnfG8m7LeI/Ao3FLtyZFgGZPwsw3BZYyJn3sD1mJIJrQIEB/ZP\n ZwKBgCTUQTR4zcz65zSOfo95l3YetVhfmApYcQQd8HTxgTqEsjr00XzW799ioIWt \n vaKMCtJlkWLz4N1EqflOH3WnXsEkNA5AVFe1FTirijuaH7e46fuaPJWhaSq1qERT\n eQT1jY2jytnsJT0VR7e2F83FKINjLeccnkkiVknsjrOPrzkXAkEA0Ky+vQdEj64e\n iP4Rxc1NreB7oKor40+w7XSA0hyLA3JQjaHcseg/bqYxPZ5J4JkCNmjavGdM1v6E\n OsVVaMWQ7QJBAMweWSWtLp6rVOvTcjZg+l5+D2NH+KbhHbNLBcSDIvHNmD9RzGM1\n Xvt+rR0FA0wUDelcdJt0R29v2t19k2IBA8ECQFMDRoOQ+GBSoDUs7PUWdcXtM7Nt\n QW350QEJ1hBJkG2SqyNJuepH4PIktjfytgcwQi9w7iFafyxcAAEYgj4HZw8CQAUI\n 3xXEA2yZf9/wYax6/Gm67cpKc3sgKVczFxsHhzEml6hi5u0FG7aNs7jQTRMW0aVF\n P8Ecx3l7iZ6TeakqGhcCQGdhCaEb7bybAmwQ520omqfHWSte2Wyh+sWZXNy49EBg\n d1mBig/w54sOBCUHjfkO9gyiANP/uBbR6k/bnmF4dMc=\n -----END RSA PRIVATE KEY-----\n </PrivateKey>\n <PublicModulusBytes>pmJk58BjgqbDzqr7OZmUGyDNU06jhyta+sxr6ZOtWWk+89gQhBT73U3ZGeLUN//ebn44T8exFQ43ifyVG09EAFv2H5c1HxSbgZYtCdnlCc4YYh6Qv9Xd62+lIZ8L798Up3xvJuy3iPwKNxS7cmRYBmT8LMNwWWMiZ97A9ZiSCa0=</PublicModulusBytes>\n <PublicExponentBytes>B/ZPZw==</PublicExponentBytes>\n </XmlMatchOutput>\n ini t: 491ms / 1 (491ms, 2.04/s)\n generate key: 1193ms / 6 (198.83ms, 5.03/s)\n cpu precompute: 10ms / 6 (1.67ms, 600/s)\n total without init: 70640ms / 1 (70640ms, 0.01/s)\n set buffers: 0ms / 40 (0ms, 0/s)\n write buffers: 3ms / 40 (0.08ms, 13333.33/s)\n read results: 67442ms / 40 (1686.05ms, 0.59/s)\n check results: 185ms / 40 (4.63ms, 216.22/s)\n \n 9.50 million hashes per second\n \n Stopping the GPU and shutting down...\n\n \n** Multipattern Hashing ** \nScallion supports finding one or more of multiple patterns through a primitive regex syntax. Only character classes (ex. ` [abcd] ` ) are supported. The ` . ` character represents any character. Onion addresses are always 16 characters long and GPG fingerprints are always 40 characters. You can find a suffix by putting ` $ ` at the end of the match (ex. ` DEAD$ ` ). Finally, the pipe syntax (ex. ` pattern1|pattern2 ` ) can be used to find multiple patterns. Searching for multible patterns (within reason) will NOT produce a significant decrease in speed. Many regexps will produce a single pattern on the GPU and result in no speed reduction. \nSome use cases with examples: \n\n\n * Generate a prefix followed by a number for better readability: \n\n \n mono scallion.exe prefix[234567]\n\n * Search for several patterns at once (n.b. -c causes scallion to continue generating even once it gets a hit) \n\n \n mono scallion.exe -c prefix scallion hashes\n mono scallion.exe -c \"prefix|scallion|hashes\"\n\n * Search for the suffix \"badbeef\" \n\n \n mono scallion.exe .........badbeef\n mono scallion.exe --gpg badbeef$ # Generate GPG key\n\n * Complicated self explanatory example: \n\n \n mono scallion.exe \"suffixa$|suffixb$|prefixa|prefixb|a.suffix$|a.test.$\"\n\n \n** How does Scallion work? ** \nAt a high level Scallion works as follows: \n\n\n 1. Generate RSA key using [ OpenSSL ](<https://www.kitploit.com/search/label/OpenSSL> \"OpenSSL\" ) on the CPU \n 2. Send the key to the GPU \n 3. Increase the key's public exponent \n 4. Hash the key \n 5. If the hashed key is not a partial collision go to step 3 \n 6. If the key does not pass the sanity checks recommended by PKCS #1 v2.1 (checked on the CPU) go to step 3 \n 7. Brand new key with partial collision! \nThe basic algorithm is described above. Speed / [ performance ](<https://www.kitploit.com/search/label/Performance> \"performance\" ) is the result of massive parallelization, both on the GPU and the CPU. \n \n** Speed / Performance ** \n** It is important to realize that Scallion preforms a probabilistic search. Actual times may very significantly from predicated ** \nThe inital RSA key generation is done the CPU. An ivybridge i7 can generate 51 keys per second using a single core. Each key can provide 1 gigahash worth of exponents to mine and a decent CPU can keep up with several GPUs as it is currently implemented. \nSHA1 [ hashing ](<https://www.kitploit.com/search/label/Hashing> \"hashing\" ) is done on the GPU. The hashrates for several GPUs we have tested are below (grouped by manufacturer and sorted by power): \nGPU | Speed \n---|--- \nIntel i7-2620M | 9.9 MH/s \nIntel i5-5200U | 118 MH/s \nNVIDIA GT 520 | 38.7 MH/s \nNVIDIA Quadro K2000M | 90 MH/s \nNVIDIA GTS 250 | 128 MH/s \nNVIDIA GTS 450 | 144 MH/s \nNVIDIA GTX 670 | 480 MH/s \nNVIDIA GTX 970 | 2350 MH/s \nNVIDIA GTX 980 | 3260 MH/s \nNVIDIA GTX 1050 (M) | 1400 MH/s \nNVIDIA GTX 1070 | 4140 MH/s \nNVIDIA GTX 1070 TI | 5100 MH/s \nNVIDIA GTX TITAN X | 4412 MH/s \nNVIDIA GTX 1080 | 5760 MH/s \nNVIDIA Tesla V100 | 11646 MH/s \nAMD A8-7600 APU | 120 MH/s \nAMD Radeon HD5770 | 520 MH/s \nAMD Radeon HD6850 | 600 MH/s \nAMD Radeon RX 460 | 840 MH/s \nAMD Radeon RX 470 | 957 MH/s \nAMD Radeon R9 380X | 2058 MH/s \nAMD FirePro W9100 | 2566 MH/s \nAMD Radeon RX 480 | 2700 MH/s \nAMD Radeon RX 580 | 3180 MH/s \nAMD Radeon R9 Nano | 3325 MH/s \nAMD Vega Frontier Edition | 7119 MH/s \nMH/s = million hashes per second \nIts worth noting that Intel has released OpenCL drivers for its processors and short collisions can be found on the CPU. \nTo calculate the number of seconds required for a given partial collision (on average), use the formula: \nType | Estimated time \n---|--- \nGPG Key | 2^(4*length-1) / hashspeed \n.onion Address | 2^(5*length-1) / hashspeed \nFor example on my nVidia Quadro K2000M, I see around 90 MH/s. With those speed I can generate an eight character .onion prefix in about 1h 41m, ` 2^(5*8-1)/90 million = 101 minutes ` . \n \n** Workgroup Size ** \nScallion will use your devices reported preferred work group size by default. This is a reasonable default but experimenting with the workgroup may increase performance. \n \n** Security ** \nThe keys generated by Scallion are quite similar to those generated by shallot. They have unusually large public exponents, but they are put through the full set of sanity checks recommended by PKCS #1 v2.1 via openssl's RSA_check_key function. Scallion supports several RSA key sizes, with optimized kernels for 1024b, 2048b, and 4096b. Other key sizes may work, but have not been tested. \n \n** Thanks / References ** \n\n\n * Scallion is based in part on [ shallot ](<https://github.com/katmagic/Shallot> \"shallot\" ) and inspired by [ vanitygen ](<https://github.com/samr7/vanitygen> \"vanitygen\" )\n * The OpenCL SHA-1 implementation was adapted from [ NearSHA ](<https://cr.yp.to/nearsha.html> \"NearSHA\" )\n * Includes components from [ OpenTK ](<http://www.opentk.com/> \"OpenTK\" ) and [ OpenSSL-net ](<http://openssl-net.sourceforge.net/> \"OpenSSL-net\" )\n \n** Donations ** \nFeel free to direct donations to the Bitcoin address: ` 1FxQcu6vhpwsqcTjPsjK43CZ9vjnuk4Hmo ` \n \n \n\n\n** [ Download Scallion ](<https://github.com/lachesis/scallion> \"Download Scallion\" ) **\n", "edition": 10, "modified": "2020-01-18T20:30:05", "published": "2020-01-18T20:30:05", "id": "KITPLOIT:5811407442918867054", "href": "http://www.kitploit.com/2020/01/scallion-gpu-based-onion-addresses-hash.html", "title": "Scallion - GPU-based Onion Addresses Hash Generator", "type": "kitploit", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-12-02T17:25:22", "bulletinFamily": "tools", "cvelist": ["CVE-2018-13379"], "description": "[  ](<https://1.bp.blogspot.com/-MMA_XS-SLk4/Xh1IWyeutcI/AAAAAAAARdA/3-OklS-bslEhrDQTM77OfbCyWee4UsfZwCNcBGAsYHQ/s1600/gophish_1.png>)\n\n \n[ Gophish ](<https://getgophish.com/> \"Gophish\" ) is an open-source phishing [ toolkit ](<https://www.kitploit.com/search/label/Toolkit> \"toolkit\" ) designed for businesses and penetration testers. It provides the ability to quickly and easily setup and execute [ phishing engagements ](<https://www.kitploit.com/search/label/Phishing%20Engagements> \"phishing engagements\" ) and security awareness training. \n \n** Install ** \nInstallation of [ Gophish ](<https://www.kitploit.com/search/label/Gophish> \"Gophish\" ) is dead-simple - just download and extract the zip containing the [ release for your system ](<https://github.com/gophish/gophish/releases/> \"release for your system\" ) , and run the binary. Gophish has binary releases for Windows, Mac, and Linux platforms. \n \n** Building From Source ** \n** If you are building from source, please note that Gophish requires Go v1.10 or above! ** \nTo build Gophish from source, simply run ` go get github.com/gophish/gophish ` and ` cd ` into the project source directory. Then, run ` go build ` . After this, you should have a binary called ` gophish ` in the current directory. \n \n** Docker ** \nYou can also use Gophish via an unofficial Docker [ container ](<https://www.kitploit.com/search/label/Container> \"container\" ) [ here ](<https://hub.docker.com/r/matteoggl/gophish/> \"here\" ) . \n \n** Setup ** \nAfter running the Gophish binary, open an Internet browser to [ https://localhost:3333 ](<https://localhost:3333/> \"https://localhost:3333\" ) and login with the default username (admin) and password (gophish). \n \n** Documentation ** \nDocumentation can be found on our [ site ](<https://getgophish.com/documentation> \"site\" ) . Find something missing? Let us know by filing an issue! \n \n \n\n\n** [ Download Gophish ](<https://github.com/gophish/gophish> \"Download Gophish\" ) ** \n** \n**\n", "edition": 8, "modified": "2020-01-19T20:30:03", "published": "2020-01-19T20:30:03", "id": "KITPLOIT:4289712318337957424", "href": "http://www.kitploit.com/2020/01/gophish-open-source-phishing-toolkit.html", "title": "Gophish - Open-Source Phishing Toolkit", "type": "kitploit", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-12-01T20:27:53", "bulletinFamily": "tools", "cvelist": ["CVE-2018-13379"], "description": "[  ](<https://1.bp.blogspot.com/-3K7AgBXm4gk/Xh1KYHabW4I/AAAAAAAARdg/Ty25LpqKN0srcVI8MmqLDugoPhupjZFewCNcBGAsYHQ/s1600/TeleGram-Scraper_1_20191203_205322.jpeg>)\n\n \nTelegram Group Scraper Tool. Fetch All Information About Group Members \n\n\n \n\n\n** \u2022 How To Install &amp; Setup API ( [ Termux ](<https://www.kitploit.com/search/label/Termux> \"Termux\" ) ) ** \n \n\n\n \n** \u2022 API Setup ** \n\n\n * Go to [ http://my.telegram.org ](<https://my.telegram.org/> \"http://my.telegram.org\" ) and log in. \n * Click on API development tools and fill the required fields. \n * put app name you want &amp; select other in platform Example : \n * copy \"api_id\" &amp; \"api_hash\" after clicking create app ( will be used in setup.py ) \n \n** \u2022 How To Install and Use ** \n` $ pkg install -y git python ` \n` $ git clone https://github.com/th3unkn0n/TeleGram-Scraper.git ` \n` $ cd TeleGram-Scraper ` \n\n\n * Install requierments \n` $ python3 setup.py -i ` \n\n\n * setup configration file ( apiID, apiHASH ) \n` $ python3 setup.py -c ` \n\n\n * To Genrate User Data \n` $ python3 scrapr.py ` \n\n\n * ( members.csv is default if you changed name use it ) \n * Send Bulk sms To Collected Data \n` $ python3 smsbot.py members.csv ` \n\n\n * add users to your group ( in devlopment ) \n` $ python3 add2group.py members.csv ` \n\n\n * Update Tool \n` $ python3 setup.py -u ` \n\n\n \n\n\n \n\n\n** [ Download TeleGram-Scraper ](<https://github.com/th3unkn0n/TeleGram-Scraper> \"Download TeleGram-Scraper\" ) **\n", "edition": 10, "modified": "2020-01-20T20:30:10", "published": "2020-01-20T20:30:10", "id": "KITPLOIT:2251053313103465855", "href": "http://www.kitploit.com/2020/01/telegram-scraper-telegram-group-scraper.html", "title": "TeleGram-Scraper - Telegram Group Scraper Tool (Fetch All Information About Group Members)", "type": "kitploit", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}]}