Discover: A Custom Bash Scripts Used To Perform Pentesting Tasks With Metasploit

About discover: discover is a custom bash scripts used to automate various penetration testing tasks including recon, scanning, parsing, and creating malicious payloads and listeners with Metasploit Framework. For use with Kali Linux, Parrot Security OS and the Penetration Testers Framework (PTF).

About authors:

• Lee Baird: @discoverscripts
• Jay "L1ghtn1ng" Townsend: @jay_townsend1
• Jason Ashton: @ninewires

discover Installation and Updating

About RECON in discover
   Domain

RECON

1. Passive
2. Active
3. Import names into an existing recon-ng workspace
4. Previous menu

   Passive uses ARIN, dnsrecon, goofile, goog-mail, goohost, theHarvester, Metasploit Framework, URLCrazy, Whois, multiple websites, and recon-ng.

   Active uses dnsrecon, WAF00W, traceroute, Whatweb, and recon-ng.
   [*] Acquire API keys for Bing, Builtwith, Fullcontact, GitHub, Google, Hashes, Hunter, SecurityTrails, and Shodan for maximum results with recon-ng and theHarvester.

API key locations:

recon-ng
   show keys
   keys add bing_api <value>

theHarvester
   /opt/theHarvester/api-keys.yaml

   Person: Combines info from multiple websites.

RECON

First name:
Last name:

   Parse salesforce: Gather names and positions into a clean list.

Create a free account at salesforce (https://connect.data.com/login).
Perform a search on your target company > select the company name > see all.
Copy the results into a new file.

Enter the location of your list:

About SCANNING in discover
   Generate target list: Use different tools to create a target list including Angry IP Scanner, arp-scan, netdiscover and nmap pingsweep.

SCANNING

1. Local area network
2. NetBIOS
3. netdiscover
4. Ping sweep
5. Previous menu


   CIDR, List, IP, Range, or URL

Type of scan:

1. External
2. Internal
3. Previous menu

• External scan will set the nmap source port to 53 and the max-rrt-timeout to 1500ms.
• Internal scan will set the nmap source port to 88 and the max-rrt-timeout to 500ms.
• Nmap is used to perform host discovery, port scanning, service enumeration and OS identification.
• Matching nmap scripts are used for additional enumeration.
• Addition tools: enum4linux, smbclient, and ike-scan.
• Matching Metasploit auxiliary modules are also leveraged.

About WEB in discover
   Insecure direct object reference

Using Burp, authenticate to a site, map & Spider, then log out.
Target > Site map > select the URL > right click > Copy URLs in this host.
Paste the results into a new file.


Enter the location of your file:

   Open multiple tabs in Firefox

Open multiple tabs in Firefox with:

1. List
2. Directories from robots.txt.
3. Previous menu

• Use a list containing IPs and/or URLs.
• Use wget to pull a domain's robot.txt file, then open all of the directories.

   Nikto

Run multiple instances of Nikto in parallel.

1. List of IPs.
2. List of IP:port.
3. Previous menu

   SSL: Use sslscan and sslyze to check for SSL/TLS certificate issues.

Check for SSL certificate issues.

Enter the location of your list:

About MISC in discover
   Parse XML

Parse XML to CSV.

1. Burp (Base64)
2. Nessus (.nessus)
3. Nexpose (XML 2.0)
4. Nmap
5. Qualys
6. revious menu

   Generate a malicious payload

Malicious Payloads

1. android/meterpreter/reverse_tcp
2. cmd/windows/reverse_powershell
3. java/jsp_shell_reverse_tcp (Linux)
4. java/jsp_shell_reverse_tcp (Windows)
5. linux/x64/meterpreter_reverse_https
6. linux/x64/meterpreter_reverse_tcp
7. linux/x64/shell/reverse_tcp
8. osx/x64/meterpreter_reverse_https
9. osx/x64/meterpreter_reverse_tcp
10. php/meterpreter/reverse_tcp
11. python/meterpreter_reverse_https 12. python/meterpreter_reverse_tcp
13. windows/x64/meterpreter_reverse_https
14. windows/x64/meterpreter_reverse_tcp
15. Previous menu

   Start a Metasploit listener

Metasploit Listeners

1. android/meterpreter/reverse_tcp
2. cmd/windows/reverse_powershell
3. java/jsp_shell_reverse_tcp
4. linux/x64/meterpreter_reverse_https
5. linux/x64/meterpreter_reverse_tcp
6. linux/x64/shell/reverse_tcp
7. osx/x64/meterpreter_reverse_https
8. osx/x64/meterpreter_reverse_tcp
9. php/meterpreter/reverse_tcp
10. python/meterpreter_reverse_https
11. python/meterpreter_reverse_tcp
12. windows/x64/meterpreter_reverse_https
13. windows/x64/meterpreter_reverse_tcp
14. Previous menu



Download discover

More articles

• Hacking System
• Hacking Curso
• Hacking Growth Sean Ellis
• Hacking Curso
• Hacking Roblox
• Libro De Hacking
• Programa Hacker
• Hacking Kali Linux
• Hacking Y Forensic Desarrolle Sus Propias Herramientas En Python Pdf
• Hacking Usb
• Como Aprender A Hackear

CEH: Gathering Host And Network Information | Scanning

Scanning

It is important that the information-gathering stage be as complete as possible to identify the best location and targets to scan. After the completion of  footprinting and information gathering methodologies, scanning is performed.
During scanning, the hacker has vision to get information about network an hosts which are connected to that network that can help hackers to determine which type of exploit to use in hacking a system precisely. Information such as an IP addresses, operating system, services, and installed applications.

Scanning is the methodology used to detect the system that are alive and respond on the network or not. Ethical hackers use these type of scanning to identify the IP address of target system. Scanning is also used to determine the availability of the system whether it is connected to the network or not.

Types Of Scanning 

Network Scanning	Identifies IP addresses on a given network or subnet
Port Scanning	Determines open, close, filtered and unfiltered ports and services
Vulnerability Scanner	Detect the vulnerability on the target system

Port Scanning ​

Port scanning is the process of identifying open and available TCP/IP ports on a system. Port-scanning tools enable a hacker to learn about the services available on a given system. Each service or application on a machine is associated with a well-known port number. Port Numbers are divided into three ranges:

• Well-Known Ports: 0-1023
• Registered Ports: 1024-49151
• Dynamic Ports: 49152-6553

Network Scanning

Network scanning is performed for the detection of active hosts on a network either you wanna attack them or as a network administrator. Network-scanning tools attempt to identify all the live or responding hosts on the network and their corresponding IP addresses. Hosts are identified by their individual IP addresses.

Vulnerability Scanning

This methodology is used to detect vulnerabilities of computer systems on a network. A vulnerability scanner typically identifies the operating system and version number, including applications that are installed. After that the scanner will try to detect vulnerabilities and weakness in the operating system. During the later attack phase, a hacker can exploit those weaknesses in order to gain access to the system. Moreover, the vulnerability scanner can be detected as well, because the scanner must interact over the network with target machine.

The CEH Scanning Methodology

As a CEH, you should understand the methodology about scanning presented in the figure below. Because this is the actual need of hackers to perform further attacks after the information about network and hosts which are connected to the network. It detects the vulnerabilities in the system bu which hackers can be accessible to that system by exploitation of that vulnerabilities.

Related articles

• Hacking In Spanish
• Hacker Blanco
• Drupal Hacking
• Hacking Ethical
• Como Convertirse En Hacker
• Ethical Hacking Certification

C++ Std::Condition_Variable Null Pointer Derreference

This story is about a bug generated by g++ and clang compilers (at least)
The condition_variables is a feature on the standard library of c++ (libstdc++), when its compiled statically a weird asm code is generated.


Any example on the link below will crash if its compiled statically:
 https://en.cppreference.com/w/cpp/thread/condition_variable

In this case the condition_variable.wait() crashed, but this happens with other methods, a simple way to trigger it:

If this program is compiled dynamically the crash doesn't occur:

Looking the dissasembly there is a surprise created by the compiler:

Compilers:
    g++  9.2.1+20200130-2
    clang++ v9

Both compilers are generating the "call 0x00"

If we check this call in a dynamic compiled:

The implementation of condition_variable in github:
https://github.com/gcc-mirror/gcc/blob/b7c9bd36eaacac42631b882dc67a6f0db94de21c/libstdc%2B%2B-v3/include/std/condition_variable

The compilers can't copile well this code in static,  and same happens on  other condition_variable methods.
I would say the _lock is being assembled improperly in static, is not exacly a null pointer derreference but the effects are the same, executing code at address 0x00 which on linux is a crash on most of cases.

Read more

1. White Hacking
2. Nivel Basico
3. Arduino Hacking
4. Hacking Web Technologies Pdf
5. Curso Hacking Etico
6. Whatsapp Hacking
7. Linux Hacking Distro
8. Hacking With Swift
9. Hacking Videos

Video Archives Of Security Conferences And Workshops

Just some links for your enjoyment

List of security conferences in 2014

Video archives:



AIDE (Appalachian Institute of Digital Evidence)

• 2013
• 2012
• 2011

Blackhat

• 2012 or 2012 torrent

Botconf

• 2013

Bsides

• BSides DC 2014
• BSides Chicago 2014
• BSides Nashville 2014
• BSides Augusta 2014
• BSides Huntsville 2014
• BSides Las Vegas 2014
• BSidesDE 2013
• BSidesLV 2013
• BSidesRI 2013
• Bsides Cleveland 2012 BsidesCLE
• Bsides Las Vegas 2012

Chaos Communication Congress

• Chaos Communications Channel YouTube
• 31c3 Recordings

Defcon

• Defcon: All Conference CDs and DVDs with Presentation PDF files (updated 2014 for DEF CON 22): Torrent
• Defcon Wireless Village 2014
• Defcon: all other

Derbycon

• Derbycon 4
• DerbyCon 3
• Derbycon 2
• Derbycon 1

Digital Bond's S4x14

• Digital Bond's S4x14 ISC Security

Circle City Con

• Circle City Con 2014

GrrCON Information Security Summit & Hacker Conference

• GrrCON 2014

Hack in the box HITB

• 2011

Hack in Paris :

• 2011  https://www.youtube.com/playlist?list=PL70E48008B3E43448
• 2012  https://www.youtube.com/playlist?list=PL1F1B29D6E0D89A5F
• 2013  https://www.youtube.com/playlist?list=PL3UAg9Zuj1yK5nePRJCq1Y3gVLkoqVj9a
• 2014  https://www.youtube.com/playlist?list=PL3UAg9Zuj1yLmemIKw-domjg5UkbN-pLc

Hack3rcon

• Hack3rcon 4
• Hack3rcon 3

InfowarCon

• InfowarCon 2014

Free and Open Source Software Conference 2014

• froscon2014

International Cyber Security Conference 

• Tel-Aviv 2014

KIACS Cyber Security Conference

• KIACS 2014

Louisville

• Louisville Infosec 2014
• Louisville InfoSec 2013

NATO Cyber Security Conference

• 2014

Notacon

• Notacon 2013

Nuit du Hack

• 2011 https://www.youtube.com/playlist?list=PL311C7F71E22EA36A
• 2012 https://www.youtube.com/playlist?list=PLA446F5E0B2847F06
• 2013 https://www.youtube.com/playlist?list=PLzGIjwtabBqjyvyt1eUdlfXg0EbcLND-8
• 2014 https://www.youtube.com/playlist?list=PLzGIjwtabBqggpaJe51ZuifYYovBy3HhS

Nullcon

• Nullcon 2014
• Nullcon 2013
• Nullcon 2012

OWASP

• OWASP Global Webinars
• AppSec California 2014
• AppSecEU 2014
• AppSecUSA 2013
• AppSec EU Research 2013
• AppSecUSA 2012
• AppSecUSA 2011

OISF

• OISF 2014
• OISF 2013

OHM

• OHM2013. Observe, Hack, Make

Outerz0ne 9

• 2013
• 2011

Passwordscon

• Passwordscon 2014

PhreakNIC

• PhreakNIC 16

RSA

• Videos
• 2014 Big data should be dead. Unisys

Ruxcon

• Ruxcon 2012
• Ruxcon 2011

Shmoocon

• Shmoocon 2014
• Firetalks 2015
• Firetalks 2014
• Firetalks 2013
• Firetalks 2011

ShowMeCon

• 2014

SkyDogCon

• SkyDogCon 2013
• SkyDogCon 2012

TakeDownCon

• Rocket City 2014

Troopers

Heidelberg Germany

• Troopers 2014
• Troopers 2013
• Troopers 2012

Virus Bulletin

•  VB2014

Workshops, How-tos, and Demos

• Adrian Crenshaw. Intro to Darknets: Tor and I2P Workshop
• Installing the I2P darknet software in Linux
• Adrian Crenshaw. Installing Nessus on Kali Linux and Doing a Credentialed Scan
• Intro to Metasploit Class at IU Southeast
• Louisville ISSA Web PenTesting Workshop
• Louisville Nmap Class 2014
• ISSA Kentuckiana - RESTful Web Services - Jeremy Druin - @webpwnized
• Introduction to HTML Injection (HTMLi) and Cross Site Scripting (XSS) Using Mutillidae
• Introduction to Pen Testing Simple Network Management Protocol (SNMP) - ISSA Kentuckiana workshop 9 - Jeremy Druin
• Liam Randall- Shmoocon 2013: Bro IDS and the Bro Network Programming Language
• Basics of using sqlmap - ISSA Kentuckiana workshop 8 - Jeremy Druin
• SQL Server Hacking from ISSA Kentuckiana workshop 7 - Jeremy Druin
• Introduction to buffer overflows from ISSA KY workshop 6 - Jeremy Druin
• The potential impact of Software Defined Networking on security - Brent Salisbury
• Into to Metasploit - Jeremy Druin
• Traceroute and Scapy Jeremy Druin @webpwnized
• Basic Setup of Security-Onion: Snort, Snorby, Barnyard, PulledPork, Daemonlogger
• NetworkMiner Professional for Network Forensics

Special thanks to  Adrian Crenshaw for his collection of videos

More information

• Aprender Hacking Desde Cero
• Growth Hacking Cursos
• Hacking Hardware Tools
• Wargames Hacking
• Pagina Hacker
• Programa De Hacking
• Hacking Con Python
• Hacking Ético Curso
• Hacking Wikipedia
• Hacking Articles

CEH: Gathering Host And Network Information | Scanning

Scanning

It is important that the information-gathering stage be as complete as possible to identify the best location and targets to scan. After the completion of  footprinting and information gathering methodologies, scanning is performed.
During scanning, the hacker has vision to get information about network an hosts which are connected to that network that can help hackers to determine which type of exploit to use in hacking a system precisely. Information such as an IP addresses, operating system, services, and installed applications.

Scanning is the methodology used to detect the system that are alive and respond on the network or not. Ethical hackers use these type of scanning to identify the IP address of target system. Scanning is also used to determine the availability of the system whether it is connected to the network or not.

Types Of Scanning 

Network Scanning	Identifies IP addresses on a given network or subnet
Port Scanning	Determines open, close, filtered and unfiltered ports and services
Vulnerability Scanner	Detect the vulnerability on the target system

Port Scanning ​

Port scanning is the process of identifying open and available TCP/IP ports on a system. Port-scanning tools enable a hacker to learn about the services available on a given system. Each service or application on a machine is associated with a well-known port number. Port Numbers are divided into three ranges:

• Well-Known Ports: 0-1023
• Registered Ports: 1024-49151
• Dynamic Ports: 49152-6553

Network Scanning

Network scanning is performed for the detection of active hosts on a network either you wanna attack them or as a network administrator. Network-scanning tools attempt to identify all the live or responding hosts on the network and their corresponding IP addresses. Hosts are identified by their individual IP addresses.

Vulnerability Scanning

This methodology is used to detect vulnerabilities of computer systems on a network. A vulnerability scanner typically identifies the operating system and version number, including applications that are installed. After that the scanner will try to detect vulnerabilities and weakness in the operating system. During the later attack phase, a hacker can exploit those weaknesses in order to gain access to the system. Moreover, the vulnerability scanner can be detected as well, because the scanner must interact over the network with target machine.

The CEH Scanning Methodology

As a CEH, you should understand the methodology about scanning presented in the figure below. Because this is the actual need of hackers to perform further attacks after the information about network and hosts which are connected to the network. It detects the vulnerabilities in the system bu which hackers can be accessible to that system by exploitation of that vulnerabilities.

Related articles

• Hacking Wifi Android
• Hacking Etico Pdf
• Hacking Pages
• Libro Hacker
• Hacking Etico 101 Pdf
• Hacking In Spanish

Voodoo-Kali - Kali Linux Desktop On Windows 10

How it works?
 * Kali Linux with XFCE Desktop Environment in Windows Subsystem for Linux (WSL)
 * VcXsrv X Server for Windows is doing the hard GUI lifting
 * XFCE is started natively in WSL and displayed by VcXsrv

Install Voodoo-Kali:
 1, Enable WSL and install Kali Linux from the Microsoft Store. Read Install Kali Linux desktop on Windows 10 from Microsoft Store

 2, To start Kali Linux in Windows 10, open Command Prompt and enter the command: kali

 3, Enter this commands:
      apt install wget -y 
      wget https://raw.githubusercontent.com/Re4son/WSL-Kali-X/master/install-WSL-Kali-X
      bash ./install-WSL-Kali-X

 4, Download and install VcXsrv Windows X Server from SourceForge

 5, Start VcXsrv, accept change in firewall rules, exit VcXsrv

Run Voodoo-Kali:
   Start kali in Windows as normal user (that's default), and launch Voodoo-Kali:
    * as normal user: ./start-xfce
    * as root: sudo /root/xtart-xfce

Run Kali Desktop in an RDP session:
   In Kali Linux WSL, type: sudo /etc/init.d/xrdp start
   In Windows 10, open Run and enter mstsc.exe and connect to "127.0.0.1:3390"

Status: Voodoo-Kali is in its infancy and it is far from being elegant. I'm working on it though and step by step I'll push out improvements. Below a snippet of the To-Do list:
 * Clean up and comment the scripts
 * Make for a cleaner exit
 * Better error handling and dependency checking (get rid of sleep, etc.)
 * Improve stability of Java programs
 * Improve the looks??
 * …

   Any help is truly appreciated, in any shape or form – from tips to pull requests.
   Why don't you join the forums to discuss?

Further Information:
 * Offsec – Kali Linux in the Windows App Store
 * MSDN – Windows Subsystem for Linux Overview

                                       Download Voodoo-Kali

More articles

• Hacking Code
• Hardware Hacking
• Hacking In Spanish
• Hacking Tor Funciona
• Hacking Etico Que Es
• Raspberry Hacking
• Hacker Blanco
• Hacking Pdf