XChat Credential Gatherer

This module searches for XChat credentials on a Windows host. XChat is an IRC chat program for both Linux and Windows. Module Options msf use post/windows/gather/credentials/xchat msf postxchat show actions ...actions... msf postxchat set ACTION msf postxchat show options ...show and set options...

Viber Credential Gatherer

This module searches for credentials in Viber desktop application on a Windows host. Viber is a cross-platform voice over IP and instant messaging software application. Module Options msf use post/windows/gather/credentials/viber msf postviber show actions ...actions... msf postviber set ACTION m...

Miranda Credential Gatherer

This module searches for Miranda credentials on a Windows host. Module Options msf use post/windows/gather/credentials/miranda msf postmiranda show actions ...actions... msf postmiranda set ACTION msf postmiranda show options ...show and set options... msf postmiranda run This module requires...

Operamail Credential Gatherer

This module searches for Operamail credentials on a Windows host. Module Options msf use post/windows/gather/credentials/operamail msf postoperamail show actions ...actions... msf postoperamail set ACTION msf postoperamail show options ...show and set options... msf postoperamail run This module...

Tlen Credential Gatherer

This module searches for Tlen credentials on a Windows host. Tlen is a free Polish instant messaging service. Module Options msf use post/windows/gather/credentials/tlen msf posttlen show actions ...actions... msf posttlen set ACTION msf posttlen show options ...show and set options... msf posttl...

Chrome Credential Gatherer

This module searches for credentials stored on Chrome on a Windows host. Module Options msf use post/windows/gather/credentials/chrome msf postchrome show actions ...actions... msf postchrome set ACTION msf postchrome show options ...show and set options... msf postchrome run This module requires...

emp3r0r

It is an offensive tool for Linux systems. The tool is called emp3r0r, a Linux post-exploitation framework made by a user named jm33-ng. It is designed to provide a better experience for remote administration on Linux systems, particularly for terminal-based interactions. The framework is written...

Detecting Credential Stealing Attacks Through Active In-Network Defense

ARCHIVED STORY Detecting Credential Stealing Attacks Through Active In-Network Defense By Chintan Shah · September 22, 2021 Executive Summary Today, enterprises tend to use multiple layers of security defenses, ranging from perimeter defense on network entry points to host based security solution...

CISA Warns of Actively Exploited Zoho ManageEngine ADSelfService Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Wednesday issued a bulletin warning of a zero-day flaw affecting Zoho ManageEngine ADSelfService Plus deployments that is currently being actively exploited in the wild. The flaw, tracked as CVE-2021-40539, concerns a REST API...

Exploit for OS Command Injection in Sophos Unified_Threat_Management

sophucked CVE-2020-25223 RCE PoC, gets reverse shell. Pre-auth...

PickleC2 - A Post-Exploitation And Lateral Movements Framework

PickleC2 is a post-exploitation and lateral movements framework. Documentation ReadTheDocs Overview PickleC2 is a simple C2 framework written in python3 used to help the community in Penetration Testers in their red teaming engagements. PickleC2 has the ability to import your own PowerShell modul...

AlanFramework - A Post-Exploitation Framework

Alan Framework is a post-exploitation framework useful during red-team activities. If you find my tool useful, please consider tosponsor me. Sponsored users have access to early releases and non public content. You can download the binary from:...

redpill

This is a PowerShell module repository called "redpill" that provides various post-exploitation tools for Windows systems. The repository contains several scripts that can be used to perform different tasks such as: Bypassing AppLocker restrictions Hijacking browser cookies Downloading and...

China's Cyberspies Targeting Southeast Asian Government Entities

A sweeping and "highly active campaign" that originally set its sights on Myanmar has broadened its focus to strike a number of targets located in the Philippines, according to new research. Russian cybersecurity firm Kaspersky, which first spotted the infections in October 2020, attributed them ...

Hackers Trick Microsoft Into Signing Netfilter Driver Loaded With Rootkit Malware

Microsoft on Friday said it's investigating an incident wherein a driver signed by the company turned out to be a malicious Windows rootkit that was observed communicating with command-and-control C2 servers located in China. The driver, called "Netfilter," is said to target gaming environments,...

Swift-Attack - Unit Tests For Blue Teams To Aid With Building Detections For Some Common macOS Post Exploitation Methods

Unit tests for blue teams to aid with building detections for some common macOS post exploitation methods. I have included some post exploitation examples using both command line history and on disk binaries which should be easier for detection as well as post exploitation examples using API call...

Live Cybersecurity Webinar — Deconstructing Cobalt Strike

Organizations' cybersecurity capabilities have improved over the past decade, mostly out of necessity. As their defenses get better, so do the methods, tactics, and techniques malicious actors devise to penetrate their environments. Instead of the standard virus or trojan, attackers today will...

Details Disclosed On Critical Flaws Affecting Nagios IT Monitoring Software

Cybersecurity researchers disclosed details about 13 vulnerabilities in the Nagios network monitoring application that could be abused by an adversary to hijack the infrastructure without any operator intervention. "In a telco setting, where a telco is monitoring thousands of sites, if a customer...

Evasor - A Tool To Be Used In Post Exploitation Phase For Blue And Red Teams To Bypass APPLICATIONCONTROL Policies

The Evasor is an automated security assessment tool which locates existing executables on the Windows operating system that can be used to bypass any Application Control rules. It is very easy to use, quick, saves time and fully automated which generates for you a report including description,...

3 Zero-Day Exploits Hit SonicWall Enterprise Email Security Appliances

SonicWall has addressed three critical security vulnerabilities in its hosted and on-premises email security ES product that are being actively exploited in the wild. Tracked as CVE-2021-20021 and CVE-2021-20022, the flaws were discovered and reported to the company by FireEye's Mandiant subsidia...