hacklib - Pentesting, Port Scanning, and Logging in anywhere with Python

Toolkit for hacking enthusiasts using Python. hacklib is a Python module for hacking enthusiasts interested in network security. It is currently in active development. Installation To get hacklib, simply run in command line: pip install hacklib hacklib also has a user interface. To use it, you ca...

Google Docs XSPA / SSRF

================================================================================ Google Docs - XSPA/SSRF ================================================================================ Author: Ashiyane Digital Security Team Vendor Homepage: http://docs.google.com/ Date : 09 September 2016...

D-TECT - Pentesting the Modern Web

D-TECT is an All-In-One Tool for Penetration Testing. This is specially programmed for Penetration Testers and Security Researchers to make their job easier, instead of launching different tools for performing different task. D-TECT provides multiple features and detection features which gather...

Command line Network Diagnostic Tool: myLG

Command line Network Diagnostic Tool myLG, my looking glass is software utility which combines the functions of the different network probes in one network diagnostic tool. Features Popular looking glasses ping/trace/bgp like Telia, Level3 More than 200 countries DNS Lookup information Local fast...

Xerosploit - Efficient And Advanced Man In The Middle Framework

Xerosploit is a penetration testing toolkit whose goal is to perform man in the middle attacks for testing purposes. It brings various modules that allow to realise efficient attacks, and also allows to carry out denial of service attacks and port scanning. Powered by bettercap and nmap...

Apache PDFBox XML External Entity Vulnerability

Apache PDFBox is the United States Apache Apache Software Foundation of an open source, Java-based and provide the creation of new PDF documents, modify existing PDF documents and other features of the tool library. Apache PDFBox version 1.8.0 to 1.8.11 and 2.0.0 version of the XML external entit...

The use of SSRF vulnerability to take over the APP server-the vulnerabilities and early warning-the black bar safety net

SSRF attack refers to an attacker forcibly control the presence of vulnerabilities of the server,thereby sending a malicious request to a third party server or internal resources. And then use the vulnerability to launch specific attacks,such as cross-site port attacks,service enumeration, and a...

Dropbox: Dropbox apps Server side request forgery

Hi, SSRF is a vulnerability that appears when an attacker has the ability to create requests from the vulnerable server. Usually, Server Side Request Forgery SSRF attacks target internal systems behind the firewall that are normally inaccessible from the outside world but using SSRF it’s possible...

Ruby-Nmap - A Rubyful interface to the Nmap exploration tool and security / port scanner

A Ruby interface to nmap , the exploration tool and security / port scanner. Features Provides a Ruby interface for running nmap. Provides a Parser for enumerating nmap XML scan files. Examples Run Nmap from Ruby: require 'nmap/program' Nmap::Program.scan do |nmap| nmap.synscan = true...

New Relic: Server Side Browsing - localhost open port enumeration

Hi again to all, I've found that is possible to scan all the open ports and network information of internal instances of your amazon DC that are related with synthetics monitors. NOTE: I do not have a pro account so I can use the more advanced synthetics functions or the Insights db query to get...

Nikto Port Scanning Detection

Binary data 9086.prm...

Umbraco SSRF / Cross Site Request Forgery / Cross Site Scripting

image: Vulnerable Umbraco Recently I got an assignment where I had to work on the Umbraco application - a free Open Source Content Management System built on the ASP.NET platform and is used by more than 2,25,000 websites. While performing the security testing of this application, I discovered...

ParanoicScan - Vulnerability Scanner

Old Options Google & Bing Scanner that also scan : XSS SQL GET / POST SQL GET SQL GET + Admin Directory listing MSSQL Jet Database Oracle LFI RFI Full Source Discloure HTTP Information SQLi Scanner Bypass Admin Exploit FSD Manager Paths Finder IP Locate Crack MD5 Panel Finder Console Fixes +...

Port Scan v2.0 iOS - Command Inject Vulnerability

Port Scan version 2.0 suffers from a command injection vulnerability. Document Title: =============== Port Scan v2.0 iOS - Command Inject Vulnerability Product & Service Introduction: =============================== Port Scanning is a essential network utility for every IT professional and this i...

The vulnerability of the iOS operating system allows a hacker to bypass existing security mechanisms and scan ports of random processes.

The vulnerability of the processorsettasks component in the iOS operating system is related to access control deficiencies. Exploiting this vulnerability could allow an attacker acting locally to bypass existing security mechanisms and scan ports of random processes...

PortDog - Simple Python Script to Detect Port Scanning Techniques

PortDog is a network anomaly detector aimed to detect port scanning techniques. It is entirely written in python and has easy-to-use interface. It was tested on Ubuntu 15. Please note that, it is not working on Windows OS due to suffering from capturing RAW packets.I am working on to write this...

Unspecified Vulnerability in the 802.11n Wireless Network Standard Frame Aggregation Mechanism

802.11 protocol group is the International Electrotechnical and Electronics Engineering Society IEEE for wireless local area network standard. 802.11n is in 802.11g and 802.11a above the development of a technology, the most important feature is the rate of enhancement, the theoretical rate of up...

A year later, Yahoo finally fixes the SSRF vulnerability-vulnerability warning-the black bar safety net

! After a lapse of a year later, Yahoo finally fixes the image processing system of the SSRF service end request forgery）vulnerabilities. SSRF service end request forgery）vulnerability, also known as XSPA（cross-site port attacks, the problem exists in the application program loading the user...

Shopify: SSRF via 'Insert Image' feature of Products/Collections/Frontpage

Hi Security team, I would like to report an another SSRF issue like my previous bug 67377 https://hackerone.com/reports/67377. The description, threats, risks, exploatations are the same. The base request is the following POST /admin/settings/files.json HTTP/1.1 Host: test-4925.myshopify.com...

YASUO - Scans for Vulnerable & Exploitable 3rd-party Web Applications

Yasuo is a ruby script that scans for vulnerable 3rd-party web applications. While working on a network security assessment internal, external, redteam gigs etc., we often come across vulnerable 3rd-party web applications or web front-ends that allow us to compromise the remote server by exploiti...