TXDNS 2.0.0 – DNS Digger for Brute Force

TXDNS 2.0.0 has been released.

TXDNS is a Win32 aggressive multithreaded DNS digger. Capable of placing, on the wire, thousands of DNS queries per minute. TXDNS main goal is to expose a domain namespace trough a number of techniques:

• Typos
• TLD rotation
• Dictionary attack
• Brute force

This new version features a distributed model which further boosts TXDNS’s parallelism and performance. This model allows a TXDNS client to send jobs to a TXDNS server over a clear or encrypted TCP channel.

For example, to put a TXDNS host on listening mode:

> txdns -l

By default TXDNS listens on port 5353. On the client side you may postany query jobs by appending ‘-c xx.xx.xx.xx’ to the regular query syntax (where xx.xx.xx.xx is the host’s IP running TXDNS on listening mode), for example:

> txdns foo.com -rt -t -c xx.xx.xx.xx

Using -cr instead of -c will force the TXDNS server to redirect all output to the client, so basically you get the results from the server’s job right on the client console. Note that file system streams are not redirected, which means that any file switches (-f or -h) will still have the remote host as root reference.

To encrypt all the traffic between the client and the server just append ‘–key ‘ to the regular syntax on both the client and server.

A new –countdown option has been added as a very basic synchronization mechanism, and by default, any jobs, no matter remote or local will now delay for 5s before firing. If you want to bypass this countdown delay you’ll have to add ‘–countdown 0′.

You can read more and download at:

http://www.txdns.net

XSS Shell v0.3.9 – Cross Site Scripting Backdoor Tool

XSS Shell is a powerful XSS backdoor which allows interactively getting control over a Cross-site Scripting (XSS) vulnerability in a web application. Demonstrates the real power and damage of Cross-site Scripting attacks.

WHAT IS XSS SHELL ?

XSS Shell is powerful a XSS backdoor and zombie manager. This concept first presented by XSS-Proxy (http://xss-proxy.sourceforge.net/). Normally in XSS attacks attacker has one shot, in XSS Shell you can interactively send requests and get responses from victim, you can backdoor the page.

You can steal basic auth, you can bypass IP restrictions in administration panels, you can DDoS some systems with a permanent XSS vulnerability etc. Attack possibilities are limited with ideas. Basically this tool demonstrates that you can do more with XSS.

FEATURES

XSS Shell has several features to gain whole access over victim. Also you can simply add your own commands.

Most of the features can enable or disabled from configuration or can be tweaked from source code.

Features:

• Regenerating Pages
• Keylogger
• Mouse Logger (click points + current DOM)

Built-in Commands:

• Get Keylogger Data
• Get Current Page (Current rendered DOM / like screenshot)
• Get Cookie
• Execute supplied javaScript (eval)
• Get Clipboard (IE only)
• Get internal IP address (Firefox + JVM only)
• Check victim’s visited URL history
• DDoS
• Force to Crash victim’s browser

Online URL (Download, Screenshots, demo etc.):

http://ferruh.mavituna.com/article/?1338

Download :

http://www.portcullis-security.com/tools/free/XSSShell039.zip
or
http://ferruh.mavituna.com/xssshell/download/xssshellv039.zip

SinFP 2.0.4

SinFP is a new approach to OS fingerprinting, which bypasses limitations that nmap has.

Nmap approaches to fingerprinting as shown to be efficient for years. Nowadays, with the omni-presence of stateful filtering devices, PAT/NAT configurations and emerging packet normalization technologies, its approach to OS fingerprinting is becoming to be obsolete.

SinFP uses the aforementioned limitations as a basis for tests to be obsolutely avoided in used frames to identify accurately the remote operating system. That is, it only requires one open TCP port, sends only fully standard TCP packets, and limits the number of tests to 2 or 3 (with only 1 test giving the OS reliably in most cases).

SinFP 2.04 is now available, which for the first time, can now run under Windows ActivePerl.

More info here:

SinFP

SinFP has now more than 130 signatures in its database.

For Windows users, follow these instructions:

This was tested with ActivePerl 5.8.8.819, with PPM v4.0.

  # If you are behind a proxy:
 C:\> set http_proxy=http://username:password@proxy:port

 # Add gomor repository
 C:\> ppm repo add gomor http://www.gomor.org/files/ppm/repo-8xx

 # Disable all other repo, if you have many. Or only ActiveState repo
 # by default
 C:\> ppm repo 1 off
 ...
 C:\> ppm install Net-SinFP

 # Re-enable all other repo
 C:\> ppm repo 1 on
 ...

 Launch it:
 C:\> perl C:\perl\site\bin\sinfp.pl

If you have error messages about failing to load some .dll, go to www.microsoft.com. Then, in the search field, type in vcredist_x86.exe, download it and install it.

Backframe (Formerly Backweb) JavaScript Attack Console

There has been a recent release of Backframe (Formerly Backweb) Attack Console.

Backframe Attack Console was started as an experiment to create a full featured attack console for exploiting web browsers, web users and remote applications. Those who are familiar with XSS Proxy or even BEEF might already be familiar with the core principles of the project.

The console is based on simple client-server interaction. Both parts are required for successful operation. The server, also known as the attack channel, provides functionalities for establishing bi-directional communication with remote clients. On the other hand, the console is responsible for interacting with the channel providing the necessary toolkit for launching attacks against these clients.

The result of these core principles is an easy to use and understand web-client-oriented attack framework that keep the data, the presentation layer, and the underlying logic apart. This design is known as “the separation of concerns model”. This is highly effective practice which allows to easily extend upon the core elements.

Right now it is quite stable and it should work well with attack channels similar to the one described here:

Persistent Bi-directional Communication Channels

Check the AttackAPI project for the attack channel complete source code.

More information here:

Backframe

You can try out Backframe here:

Backframe Application

NMAP 4.20

This is just a simple warning to all NMAP users out there. If you’re registered on the announcement mailing list you already now this, otherwise, heads up.

NMAP 4.20 has been released with something that looks promising. 2nd generation OS detection. The changelog is available here.

Metasploit 3.0 Beta 3

The Metasploit Framework is an advanced open-source exploit development platform. The 3.0 tree represents a complete rewrite of the 2.0 codebase and provides a scalable and extensible framework for security tool development. The 3.0 Beta 3 release includes support for exploit automation, 802.11 wireless packet injection, and kernel-mode payloads.

Windows users are now presented with a RXVT console and an updated Cygwin environment, which greatly improves the usability of the 3.0 interface on the Windows platform.

The Metasploit Web Interface is still in development, but this release includes a preview of what the end functionality will look like. The web interface provides a “webtop” interface for interacting with the framework and uses aynschronous javascript to provide live searching. A early version of Metasploit IDE is also included with the web interface.

Downloads for all platforms can be found here:
– http://metasploit.com/projects/Framework/msf3/#download

The latest version can be pulled directly from Subversion:

$ svn co http://metasploit.com/svn/framework3/trunk/

Unix users may need to install the openssl zlib and dl ruby modules for the Framework to load. If you are using Ubuntu you will need to run the following commands:

# apt-get install libzlib-ruby
# apt-get install libopenssl-ruby
# apt-get install libdl-ruby

Unix users who wish to try the new web interface will need to install the ‘rubygems’ package and the ‘rails’ gem. Please see www.rubyonrails.com for more information and platform-specific installation instructions.

Users of other distributions or Unix flavors may want to grab the latest version of ruby from www.ruby-lang.org and build it from source. We highly recommend using Ruby version 1.8.4 or newer.Windows users will need to exit out of any running Cygwin-based applications before running the installer or using the Framework. The old 3.0 installation should be uninstalled prior to installing and using this version.

The release packages include Subversion repository information allowing you to synchronize your Beta 3 installation with the live development tree. The Windows installer includes a “MSFUpdate” menu item that uses Subversion to download the latest updates.Unix users will need to install the Subversion client change into the framework directory and execute ’svn update’.

On Unix systems, Subversion will complain about the self-signed certificate in use at metasploit.com. Please verify that the fingerprint matches the one below before accepting it:

Hostname: metasploit.com
Valid: from Jun 3 06:56:22 2005 GMT until Mar 31 06:56:22 2007 GMT
Issuer: Development The Metasploit Project San Antonio Texas US
Fingerprint: 1f:a2:8e:ad:14:57:53:75:b7:ab:de:67:e8:fa:17:49:76:f2:ee:ad