Powershell-RAT - Python Based Backdoor That Uses Gmail To Exfiltrate Data Through Attachment

Python based backdoor that uses Gmail to exfiltrate data as an e-mail attachment. This RAT will help someone during red team engagements to backdoor any Windows machines. It tracks the user activity using screen capture and sends the information to an attacker as an e-mail attachment. Note: This...

PoT - Phishing On Twitter

Generate tweet automatically like him/her How it works? 1- Collect data from target's twitter account 2- Find target's friend and copy her/him account 3- Generate tweet automatically with markov chain algorithm and send it Installation git clone https://github.com/omergunal/PoT cd PoT pip3 instal...

Altdns - Generates permutations, alterations and mutations of subdomains and then resolves them

Altdns is a DNS recon tool that allows for the discovery of subdomains that conform to patterns. Altdns takes in words that could be present in subdomains under a domain such as test, dev, staging as well as takes in a list of subdomains that you know of. From these two lists that are provided as...

Stacer - Linux System Optimizer and Monitoring

Linux System Optimizer And Monitoring. Required Packages curl systemd Debian x64 1. Download stacer1.0.8amd64.deb from the Stacer releases page. 2. Run sudo dpkg -i stacer.deb on the downloaded package. 3. Launch Stacer using the installed stacer command. Fedora x64 1. Download stacer1.0.8x64.rpm...

Twebit - Bitcoin Analysis in Twitter With Machine Learning

Bitcoin analysis with machine learning. How it works? 1- Get tweets from twitter. 2- Filter tweets. 3- Tweet classification with naive bayes algorithm Positive,negative and neut. Installation git clone https://github.com/omergunal/twebit cd twebit pip3 install -r requirements.txt Update your api...

LocalTapiola: Authorization issue on 'valtakirjat' (/e2/verkkopalvelu/)

Issue The reporter found some inconsistencies related to authorizations and access between family members. Fix The application was fixed in a monthly release. Reasoning The issue was valid and the reporter provided a lot of valuable information for us to go on including traces, screenshots and...

New macOS malware hijacks DNS settings and takes screenshots

By Waqas The general perception about Apple devices is that they are This is a post from HackRead.com Read the original post: New macOS malware hijacks DNS settings and takes screenshots...

JexBoss - JBoss (and others Java Deserialization Vulnerabilities) verify and EXploitation Tool

JexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server and others Java Platforms, Frameworks, Applications, etc. Requirements Python = 2.7.x urllib3 ipaddress Installation on Linux\Mac To install the latest version of JexBoss, please use the following commands: g...

LocalTapiola: PHPMYADMIN Setup is accessible without authentication on https://lml.lahitapiola.fi/

Vulnerability Detail PhpMyAdmin setup page is accessible over the internet in which it's possible for the user setup the servers with required details. Vulnerable Endpoint https://lml.lahitapiola.fi/admin/phpMyAdmin/setup/index.php Attached screenshots F246247 F246248 Impact Its possible for an...

Dr0p1t-Framework 1.3.2.1 - A Framework That Creates An Advanced FUD Dropper With Some Tricks

Have you ever heard about trojan droppers ? In short dropper is type of malware that downloads other malwares and Dr0p1t gives you the chance to create a stealthy dropper that bypass most AVs and have a lot of tricks. Features + Generated executable properties: The executable size is smaller...

Hijacker v1.4 - All-in-One Wi-Fi Cracking Tools for Android

Hijacker is a Graphical User Interface for the penetration testing tools Aircrack-ng , Airodump-ng , MDK3 and Reaver. It offers a simple and easy UI to use these tools without typing commands in a console and copy&pasting MAC addresses. This application requires an ARM android device with a...

Threat Round Up for Nov 10 - Nov 17

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between November 10 and November 17. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior...

AlienVault : Server Side Request Forgery protection bypass № 2

Hi, you haven't fixed the vulnerability.The bypass of this report 287762 This is a classic example of url bypass. POC https://www.threatcrowd.org/domain.php?domain=173.0302.0x2c.70 https://www.threatcrowd.org/domain.php?domain=0xad.0xc2.0x2c.0x46...

SQLiv - Massive SQL Injection Vulnerability Scanner

Massive SQL injection vulnerability scanner. Features 1. multiple domain scanning with SQL injection dork by Bing, Google, or Yahoo 2. targetted scanning by providing specific domain with crawling 3. reverse domain scanning both SQLi scanning and domain info checking are done in multiprocessing s...

objection - Runtime Mobile Exploration

objection is a runtime mobile exploration toolkit, powered by Frida. It was built with the aim of helping assess mobile applications and their security posture without the need for a jailbroken or rooted mobile device. The project's name quite literally explains the approach as well, whereby...

Wifite 2 - A complete re-write of Wifite (Automated Wireless Attack Tool)

A complete re-write of wifite, a Python script for auditing wireless networks. What's new? Lots of files instead of "one big script". Cleaner process management -- No longer leaves processes running in the background. UX: Target access points are refreshed every second instead of every 5 seconds...

raven - Linkedin Information Gathering Tool

raven is a Linkedin information gathering tool that can be used by pentesters to gather information about an organization employees using Linkedin. Please do not use this program to do stupid things. The author does not keep any responsability of what damage has been done by this program...

lscript - This script will make your life easier, and of course faster

This is a script that automates many procedures about wifi penetration and hacking. Features Enabling-Disabling interfaces faster Changing Mac faster Anonymizing yourself faster View your public IP faster View your MAC faster TOOLS You can install whichever tools you want from within lscript!...

A new era in mobile banking Trojans

In mid-July 2017, we found a new modification of the well-known mobile banking malware family Svpeng – Trojan-Banker.AndroidOS.Svpeng.ae. In this modification, the cybercriminals have added new functionality: it now also works as a keylogger, stealing entered text through the use of accessibility...

maltran - Tool To Download Malware Exercises From MALware-TRaffic-ANalysis.net

This tool was developed with the purpose of furthering and organizing access to traffic analysis exercises and malware files captured and published almost daily. Maltran makes the views and downloads exercises and malspams easier in an extremely simple and organized way. Visit website...