67 matches found
bettercap-proxy-modules
This is a collection of HTTP proxy modules for the BetterCap framework, a tool for performing network attacks and penetration testing. The modules are designed to be used with the BetterCap proxy server, which can be configured to intercept and modify HTTP traffic between a client and a server. T...
almond (=0.2.0), ascesis (=0.0.6) +86 more potentially affected by CVE-2020-36442 via beef (>=0.1.5 <=0.4.4)
beef CARGO version =0.1.5, =0.2.0, =0.1.0, =0.5.6, =0.1.0, =0.1.0, =0.5.4, =0.2.0, =0.2.0, =0.1.0, =0.1.2 and more Source cves: CVE-2020-36442 Source advisory: OSV:RUSTSEC-2020-0122...
BeEF - The Browser Exploitation Framework Project
What is BeEF? BeEF is short for The BrowserExploitation Framework. It is a penetration testing tool that focuses on the web browser. Amid growing concerns about web-borne attacks against clients, including mobile clients, BeEF allows the professional penetration tester to assess the actual securi...
BeEF Browser Exploitation Framework Hooking Request
Browser Exploitation Framework BeEF operates by delivering malicious js payload to the victim's browser. Successful infection will allow the attacker host to take control of the victim's browser to lunch further attacks...
Zomato: XSS in "explore-keywords-dropdown" results.
It seems that people have exploited this vulnerability before on this website, however, it remains unpatched, so here I am reporting the vulnerability. A XSS vulnerability exists when a restaurant or dish is created with a malicious name. The title of the dish or restaurant is not properly filter...
Injectify - Perform Advanced MiTM Attacks On Websites With Ease
A modern BeEF inspired framework for the 21st century. Cross-platform clients = Web in-browser and Desktop Electron. Created from-scratch using pure NodeJS and Typescript. What can it do? Create a reverse Javascript shell between the victim and the attacker. Records keystrokes and logs them to a...
Iranian APT33 Targets U.S. Firms with Destructive Malware
The Iranian group known as APT33 is believed to be behind a cyberespionage campaign targeting aerospace, petrochemical and energy sector firms located in the United States, Saudi Arabia and South Korea. The group’s latest attack leverages a dropper called DropShot that is tied to the StoneDrill...
LANs.py - Inject Code, Jam Wifi, And Spy on Wifi Users
LANs.py Automatically find the most active WLAN users then spy on one of them and/or inject arbitrary HTML/JS into pages they visit. Individually poisons the ARP tables of the target box, the router and the DNS server if necessary. Does not poison anyone else on the network. Displays all most the...
Pythem - Penetration Testing Framework
pythem is a multi-purpose pentest framework written in Python. It has been developed to be used by security researchers and security professionals. The tool intended to be used only for acts within the law. I am not liable for any undue and unlawful act practiced by this tool, for more informatio...
Friday Squid Blogging: Squid and Chips
The excellent Montreal chef Marc-Olivier Frappier, of Joe Beef fame, has created a squid and chips dish for Brit & Chips restaurant. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...
Universal MITM Web Server: CopyCat
Universal MITM Web Server CopyCat is a Node.js based universal MITM web server. Used with DNS spoofing or another redirect attack, this server will act as a MITM for web traffic between the victim and a real server. Most often we see DNS spoofing used to redirect victims to an attackers server...
Automating Phishing Activities: PhishLulz
Automating Phishing Activities PhishLulz is a Ruby toolset aimed at automating Phishing activities When you start a phishing campaign, a dedicated Amazon EC2 Debian 7 instance is spawned. The VM comes with various open source tools that have been glued together. The two main components are:...
PhishLulz - Ruby toolset aimed at automating Phishing activities
PhishLulz is a Ruby toolset aimed at automating Phishing activities. When you start a phishing campaign, a dedicated Amazon EC2 Debian 7 instance is spawned. The VM comes with various open source tools that have been glued together. The two main components are: PhishingFrenzy...
Revive Adserver: Reflected XSS on Zones > Invocation Code
"Cricetinae" : This report is similar to my earlier report: 170156. Short Description The Close text parameter in Inventory Zone Invocation Code is vulnerable to Cross-Site Scripting vulnerability. Steps to Reproduce 1. Logon or Work as an agent. 2. Navigate to Inventory Zones Invocation Code...
WiFi-Pumpkin v0.8.1 - Framework for Rogue Wi-Fi Access Point Attack
Framework for Rogue Wi-Fi Access Point Attack Description WiFi-Pumpkin is a open source security tool that provides the Rogue access point to Man-In-The-Middle and network attacks. Installation Kali 2.0/WifiSlax 4.11.1/Parrot 3.0.1/2.0.5 Python 2.7 git clone...
ntop / nbox 2.3 <= 2.5 - Multiple Vulnerabilities
Exploit for linux platform in category remote exploits E-DB Note: Source http://carnal0wnage.attackresearch.com/2016/08/got-any-rces.html The issues were found originally in nbox 2.3 and confirmed in nbox 2.5 To make things easier, I created a Vagrantfile with provisioning so you can have your ow...
ntop 2.5 Cross Site Request Forgery / Command Execution
To make things easier, I created a Vagrantfile with provisioning so you can have your own nbox appliance and test my findings or give it a shot. There is more stuff to be found, trust me : https://github.com/javuto/nbox-pwnage Replace NTOP-BOX with the IP address of your appliance presuming that...
ntop/nbox 2.3 < 2.5 - Multiple Vulnerabilities
E-DB Note: Source http://carnal0wnage.attackresearch.com/2016/08/got-any-rces.html The issues were found originally in nbox 2.3 and confirmed in nbox 2.5 To make things easier, I created a Vagrantfile with provisioning so you can have your own nbox appliance and test my findings or give it a shot...
Unraveling Turla APT Attack Against Swiss Defense Firm
Ever since hackers targeted Swiss defense contractor RUAG, government officials have been tight lipped about the breach. But on Monday Switzerland’s CERT Computer Emergency Readiness Team spilled the beans on the attack against the firm and the how perpetrators pulled it off. While Monday’s repor...
WiFi-Pumpkin v0.7.5 - Framework for Rogue Wi-Fi Access Point Attack
WiFi-Pumpkin is a security tool that provides the Rogue access point to Man-In-The-Middle and network attacks. Installation Kali 2.0/WifiSlax 4.11.1/Parrot 2.0.5 Python 2.7 git clone https://github.com/P0cL4bs/WiFi-Pumpkin.git cd WiFi-Pumpkin chmod +x installer.sh ./installer.sh --install refer t...