winAUTOPWN and bsdAUTOPWN are minimal Interactive Frameworks which act as a frontend for quick systems vulnerability exploitation. It takes inputs like IP address, Hostname, CMS Path, etc. and does a smart multi-threaded portscan for TCP ports 1 to 65535. Exploits capable of giving Remote Shells, which are released publicly over the Internet by active contributors and exploit writers are constantly added to winAUTOPWN/bsdAUTOPWN. A lot of these exploits are written in scripting languages like python, perl and php. Presence of these language interpreters is essential for successful exploitations using winAUTOPWN/bsdAUTOPWN.
Exploits written in languages like C, Delphi, ASM which can be compiled are pre-compiled and added along-with others. On successful exploitation winAUTOPWN/bsdAUTOPWN gives a remote shell and waits for the attacker to use the shell before trying other exploits. This way the attacker can count and check the number of exploits which actually worked on a Target System.
This version covers almost all remote exploits up-till September 2011 and a few older ones as well. Also added in this release are a few ruby exploits which require ‘socket’ alone for interpretation. Gee-Hence, winAUTOPWN now requires ruby installed as well, just like perl, python and php.
This version incorporates a new command-line parameters: -targetOS to allow selection of the target Operating System. This is essential for a few exploits to work perfectly. The List of OS and the corresponding OS codes are available and asked when winAUTOPWN OR bsdAUTOPWN is executed.
Untill the last release there was only a bind_shell TCP shellcode available in the exploits. This release brings yet another feature which gives the freedom to choose from a variety of shellcodes. You can now select reverse_tcp for Windows cmd and other shellcodes for Solaris, Linux, FreeBSD, etc. This is all done by mod_shellcode which has been created and added to WINDOWS AUTOPWN and BSD AUTOPWN as well. mod_shellcode gets automatically invoked by WINDOWS AUTOPWN for every scripted exploit code whose shellcode can be manually changed. Note that there are a few exploits in a compiled binary form which lack reverse shell and other shellcode features.
mod_shellcode is available as a separate binary in the exploits/ directory for Windows, FreeBSD x86, FreeBSD x64 and DragonFly BSD platforms (just like the main BSD AUTOPWN and other exploit binaries) and hence can also be manually used by exploit writers and exploiters to quickly change shellcodes in their exploit files.
You can download winAUTOPWn v2.8 here:
winAUTOPWN_2.8.7z
Or read more here.
CAINE (Computer Aided INvestigative Environment) – Digital Forensics LiveCD
CAINE (Computer Aided INvestigative Environment) is an Italian GNU/Linux live distribution created as a project of Digital Forensics. CAINE offers a complete forensic environment that is organized to integrate existing software tools as software modules and to provide a friendly graphical interface.
The main design objectives that CAINE aims to guarantee are the following:
“mounter” is a GUI mounting tool that sits in the system tray. Left clicking the system tray drive icon activates a window where the user can select devices to mount or un-mount. With rbfstab activated, all devices, except those with volume label “RBFSTAB”, are mounted read-only. Mounting of block devices in Nautilus (file browser) is not possible for a normal user with rbfstab activated making mounter a consistent interface for users.
You can download CAINE 2.5/Supernova here:
caine 2.5.iso
or you can read more here.
The main design objectives that CAINE aims to guarantee are the following:
- an interoperable environment that supports the digital investigator during the four phases of the digital investigation
- a user friendly graphical interface
- a semi-automated compilation of the final report
- New NAUTILUS SCripts
- ataraw
- bloom
- fiwalk
- xnview
- NOMODESET in starting menu
- xmount
- sshfs
- Reporting by Caine Interface fixed
- xmount-gui
- nbtempo
- fileinfo
- TSK_Gui
- Raid utils e bridge utils
- SMBFS
- BBT.py
- Widows Side
- Wintaylor updated & upgraded
“mounter” is a GUI mounting tool that sits in the system tray. Left clicking the system tray drive icon activates a window where the user can select devices to mount or un-mount. With rbfstab activated, all devices, except those with volume label “RBFSTAB”, are mounted read-only. Mounting of block devices in Nautilus (file browser) is not possible for a normal user with rbfstab activated making mounter a consistent interface for users.
You can download CAINE 2.5/Supernova here:
caine 2.5.iso
or you can read more here.
MagicTree v1.0 Released – Productivity Tool For Penetration Testers
MagicTree is a productivity tool for penetration testers. It allows consolidating data coming from various security tools, query and re-use the data and generate reports. It’s aim is to automate the boring and the mind-numbing work, so you can spend your time hacking.
Version 1.0 includes a lot of bug fixes and a number of new features, such as:
Version 1.0 includes a lot of bug fixes and a number of new features, such as:
- Support for Acunetix data import
- Support for W3AF data import
- Support for OpenVAS 4 XML format
- Importing data from flat text files
- Simplified manual creation of ports
- Copy/paste and drag and drop support for tree nodes, table view data, queries and tasks
- mt:sort() custom XPath function for sorting data, such as findings, in TableView and reports
- More sophisticated auto-creation of tree nodes. We now support netblocks in various formats (192.168.1.1/24 , 192.168.1.0-192.168.1.255, 192.168.1.0/255.255.255.0), DNS names, IP addresses and URLs.
- Search in output files panel
- Creating cross-references by drag and drop
- Better support for KDE and XFCE desktop environments on Linux. View in browser and opening reports now works on both.
The full changelog is available here – ChangeLog-1.0.txt
You can download MagicTree v1.0 here:
Or read more here.
NetworkMiner v1.1 Released – Windows Packet Analyzer & Sniffer
NetworkMiner is a Network Forensic Analysis Tool (NFAT) for Windows. NetworkMiner can be used as a passive network sniffer/packet capturing tool in order to detect operating systems, sessions, hostnames, open ports etc. without putting any traffic on the network. NetworkMiner can also parse PCAP files for off-line analysis and to regenerate/reassemble transmitted files and certificates from PCAP files.
NetworkMiner collects data (such as forensic evidence) about hosts on the network rather than to collect data regarding the traffic on the network. The main user interface view is host centric (information grouped per host) rather than packet centric (information showed as a list of packets/frames).
NetworkMiner has, since the first release in 2007, become popular tool among incident response teams as well as law enforcement. NetworkMiner is today used by companies and organizations all over the world.
NetworkMiner collects data (such as forensic evidence) about hosts on the network rather than to collect data regarding the traffic on the network. The main user interface view is host centric (information grouped per host) rather than packet centric (information showed as a list of packets/frames).
NetworkMiner has, since the first release in 2007, become popular tool among incident response teams as well as law enforcement. NetworkMiner is today used by companies and organizations all over the world.
New in v1.1
The new version supports features such as:
- Extraction of Google Analytics data
- Better parsing of SMB data
- Support for PPP frames
- Even more stable than the 1.0 release
You can download NetworkMiner v1.1 here:
Or read more here.
Lilith – Web Application Security Audit Tool
LiLith is a tool written in Perl to audit web applications. This tool analyses webpages and looks for html form tags , which often refer to dynamic pages that might be subject to SQL injection or other flaws. It works as an ordinary spider and analyses pages, following hyperlinks, injecting special characters that have a special meaning to any underlying platform.
Any Web applications scanner can never perform a full 100% correct audit. Therefore, a manual re-check is necessary. Hence, be aware that Lilith might come up with several false positives.
LiLith is a program that verifies the security of a web application. As a security consultant, the author often sees web applications that contain security flaws. A web application is a complex entity and cannot be fully checked with “just any tool”, therefor I recommend you to manually verify any results.
How the entire “scanning” process works is different from so called “CGI scanners”, such as nikto and n-stealth. This program will surf to a website and crawls through all the links, just as a user would to. On any possible input field, such as text boxes, page id’s, … LiLith will attempt to inject any characters that might have a special meaning for any underlying technology such as SQL.
For more information, it is recommended to read the following white paper: web dissection using lilith.
You can download Lilith here:
Or read more here.
WAVSEP – Web Application Vulnerability Scanner Evaluation Project
The benchmark tests the SQL Injection and Reflected XSS vulnerability detection accuracy of12 commercial web application scanners and 48 free & open source web application scanners, and discusses the capabilities of many others (including information about a potential Trojan horse in one of them).
In addition to the benchmark, the author has published a detailed feature comparison between all the scanners (which generally include every open source or free to use web application vulnerability scanner commonly available)
The research compares the following aspects of these tools:
- Number & Type of Vulnerability Detection Features
- SQL Injection Detection Accuracy
- Reflected Cross Site Scripting Detection Accuracy
- General & Special Scanning Features
And what the author believes to me most important is that during his research he has developed a toolkit that can be used by any individual or organization to test the accuracy of web application scanners in a very detailed and accurate manner.
I for one applaud his efforts and I think this is a great project, of course there’s no completely objective ranking for these kind of things – but this study does give you a good idea of where different apps stand especially in terms of SQL Injection and XSS detection.
A lot of the tools we’ve written about here at Darknet come out tops (unsurprisingly).
The benchmark and reports (about 13 in total) can be found here:
http://sectooladdict.blogspot.com/
The framework for assessing vulnerability scanners was implemented in JEE and can be downloaded here:
Or you can read more here.
winAUTOPWN v2.7 Released – Windows Autohacking Tool
winAUTOPWN and bsdAUTOPWN are minimal Interactive Frameworks which act as a frontend for quick systems vulnerability exploitation. It takes inputs like IP address, Hostname, CMS Path, etc. and does a smart multi-threaded portscan for TCP ports 1 to 65535. Exploits capable of giving Remote Shells, which are released publicly over the Internet by active contributors and exploit writers are constantly added to winAUTOPWN/bsdAUTOPWN. A lot of these exploits are written in scripting languages like python, perl and php. Presence of these language interpreters is essential for successful exploitations using winAUTOPWN/bsdAUTOPWN.
Exploits written in languages like C, Delphi, ASM which can be compiled are pre-compiled and added along-with others. On successful exploitation winAUTOPWN/bsdAUTOPWN gives a remote shell and waits for the attacker to use the shell before trying other exploits. This way the attacker can count and check the number of exploits which actually worked on a Target System.
New in v2.7
This version covers almost all remote exploits up-till mid-July 2011 and a few older ones as well. This version incorporates a few new commandline parameters: -perlrevshURL (for a PERL Reverse Shell URL), – mailFROM (smtpsender) and -mailTO (smtpreceiver). These are the commandline arguments required for a few exploits which require remote connect-back using a perl shell and email server exploits requiring authentication respectively. This version also tackles various internal bugs and fixes them.
A complete list of all Exploits in winAUTOPWN is available in CHANGELOG.TXT
A complete list of User Interface changes is available in UI_CHANGES.txt
Also, in this version :
- BSDAUTOPWN has been upgraded to version 1.5.
- In this release you will also find pre-compiled binaries for :
- FreeBSD x86
- FreeBSD x64
- DragonFly BSD x86
You can download winAUTOPWN v2.7 here:
Or read more here.
Subscribe to:
Posts (Atom)
