What's new arround internet
Last one

Src Date (GMT) Titre Description Tags Stories Notes
Pirate.webp 2018-03-25 15:34:02 Cambridge Analytica Facebook Data Scandal (lien direct) Cambridge Analytica Facebook Data ScandalOne of the biggest stories of the year so far has been the scandal surrounding Cambridge Analytica that came out after a Channel 4 expose that demonstrated the depths they are willing to go to profile voters, manipulate elections and much more. It's kicking off in the UK and the US and Mark Zuckerberg has had to come out publically and apologise about the involvement of Facebook. This goes deep with ties to elections and political activities in Malaysia, Mexico, Brazil, Australia and Kenya. Read the rest of Cambridge Analytica Facebook Data Scandal now! Only available at Darknet.
Pirate.webp 2018-03-19 08:19:03 GetAltName – Discover Sub-Domains From SSL Certificates (lien direct) GetAltName – Discover Sub-Domains From SSL CertificatesGetAltName it's a little script to discover sub-domains that can extract Subject Alt Names for SSL Certificates directly from HTTPS websites which can provide you with DNS names or virtual servers. It's useful in a discovery phase of a pen-testing assessment, this tool can provide you with more information about your target and scope. Features of GetAltName to Discover Sub-Domains Strips wildcards and www's Returns a unique list (no duplicates) Works on verified and self-signed certs Domain matching system Filtering for main domains and TLDs Gets additional sub-domains from crt.sh Outputs to clipboard GetAltName Subdomain Exctraction Tool Usage You can output to a text file and also copy the output to your clipboard as a List or a Single line string, which is useful if you're trying to make a quick scan with Nmap or other tools. Read the rest of GetAltName – Discover Sub-Domains From SSL Certificates now! Only available at Darknet.
Pirate.webp 2018-03-13 14:32:04 Memcrashed – Memcached DDoS Exploit Tool (lien direct) Memcrashed – Memcached DDoS Exploit ToolMemcrashed is a Memcached DDoS exploit tool written in Python that allows you to send forged UDP packets to a list of Memcached servers obtained from Shodan. This is related to the recent record-breaking Memcached DDoS attacks that are likely to plague 2018 with over 100,000 vulnerable Memcached servers showing up in Shodan. What is Memcached? Memcached is an in-memory key-value store for small chunks of arbitrary data (strings, objects) from results of database calls, API calls, or page rendering. Read the rest of Memcrashed – Memcached DDoS Exploit Tool now! Only available at Darknet.
Pirate.webp 2018-03-11 11:31:04 QualysGuard – Vulnerability Management Tool (lien direct) QualysGuard – Vulnerability Management ToolQualysGuard is a web-based vulnerability management tool provided by Qualys, Inc, which was the first company to deliver vulnerability management services as a SaaS-based web-service. From reviews, it seems like a competent tool with a low rate of false positives that is fairly easy to work with and keep the more 'dangerous' parts of vulnerability scanning out of the hands of users, but with the flexibility for expert users to do what they need. Read the rest of QualysGuard – Vulnerability Management Tool now! Only available at Darknet.
Pirate.webp 2018-03-07 18:33:04 Memcached DDoS Attacks Will Be BIG In 2018 (lien direct) Memcached DDoS Attacks Will Be BIG In 2018So after the massive DDoS attack trend in 2016 it seems like 2018 is going to the year of the Memcached DDoS amplification attack with so many insecure Memcached servers available on the public Internet. Unfortunately, it looks like a problem that won't easily go away as there are so many publically exposed, poorly configured Memcached servers online (estimated to be over 100,000). Honestly, Github handled the 1.3Tbps attack like a champ with only 10 minutes downtime although they did deflect it by moving traffic to Akamai. Read the rest of Memcached DDoS Attacks Will Be BIG In 2018 now! Only available at Darknet. Tool ★★★
Pirate.webp 2018-03-05 17:54:04 libsodium – Easy-to-use Software Library For Encryption (lien direct) libsodium – Easy-to-use Software Library For EncryptionSodium is a new, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable, packageable fork of NaCl, with a compatible API, and an extended API to improve usability even further. Its goal is to provide all of the core operations needed to build higher-level cryptographic tools. Sodium supports a variety of compilers and operating systems, including Windows (with MingW or Visual Studio, x86 and x64), iOS, Android, as well as Javascript and Webassembly. Read the rest of libsodium – Easy-to-use Software Library For Encryption now! Only available at Darknet.
Pirate.webp 2018-03-03 15:49:03 XSStrike – Advanced XSS Fuzzer & Exploitation Suite (lien direct) XSStrike – Advanced XSS Fuzzer & Exploitation SuiteXSStrike is an advanced XSS detection suite, which contains a powerful XSS fuzzer and provides zero false positive results using fuzzy matching. XSStrike is the first XSS scanner to generate its own payloads. It is also built in an intelligent enough manner to detect and break out of various contexts. Features of XSStrike XSS Fuzzer & Hacking Tool XSStrike has: Powerful fuzzing engine Context breaking technology Intelligent payload generation GET & POST method support Cookie Support WAF Fingerprinting Handcrafted payloads for filter and WAF evasion Hidden parameter discovery Accurate results via levenshtein distance algorithm There are various other XSS security related tools you can check out like: – XSSYA v2.0 Released – XSS Vulnerability Confirmation Tool – xssless – An Automated XSS Payload Generator Written In Python – XSSer v1.0 – Cross Site Scripter Framework You can download XSStrike here: XSStrike-master.zip Or read more here. Read the rest of XSStrike – Advanced XSS Fuzzer & Exploitation Suite now! Only available at Darknet.
Pirate.webp 2018-02-28 16:46:05 Bitdefender Releases FREE GandCrab Ransomware Decryption Tool (lien direct) Bitdefender Releases FREE GandCrab Ransomware Decryption ToolThe latest ransomware kicking everyone's ass is Gandcrab which has infected an estimated 50,000 computers, fortunately for the victims, Bitdefender has released a free Gandcrab ransomware decryption tool as a part of the No More Ransom Project. There's nothing particularly notable about the ransomware itself other than it combines two existing exploit kits to compromise people and it takes payment in Dash, which is a privacy coin, rather than Bitcoin (which is a first as far as I know). Read the rest of Bitdefender Releases FREE GandCrab Ransomware Decryption Tool now! Only available at Darknet.
Pirate.webp 2018-02-26 20:53:03 Quickjack – Advanced Clickjacking & Frame Slicing Attack Tool (lien direct) Quickjack – Advanced Clickjacking & Frame Slicing Attack ToolQuickjack is an intuitive, point-and-click tool for performing advanced and covert clickjacking and frame slicing attacks. It also allows you to easily perform clickjacking, or steal “clicks” from users on many websites, forcing the user to unknowingly click buttons or links (for example the Facebook Like button) using their own cookies. Quickjack By placing the auto-generated code on any site, you can obtain thousands of clicks quickly from different users, or perform targeted attacks by luring a victim to a specific URL. Read the rest of Quickjack – Advanced Clickjacking & Frame Slicing Attack Tool now! Only available at Darknet.
Pirate.webp 2018-02-12 09:59:51 BootStomp – Find Android Bootloader Vulnerabilities (lien direct) BootStomp – Find Android Bootloader VulnerabilitiesBootStomp is a Python-based tool, with Docker support that helps you find two different classes of Android bootloader vulnerabilities and bugs. It looks for memory corruption and state storage vulnerabilities. Note that BootStomp works with boot-loaders compiled for ARM architectures (32 and 64 bits both) and that results might slightly vary depending on angr and Z3's versions. This is because of the time angr takes to analyze basic blocks and to Z3's expression concretization results. Read the rest of BootStomp – Find Android Bootloader Vulnerabilities now! Only available at Darknet.
Pirate.webp 2018-02-09 18:08:35 Google Chrome Marking ALL Non-HTTPS Sites Insecure July 2018 (lien direct) Google Chrome Marking ALL Non-HTTPS Sites Insecure July 2018Google is ramping up its campaign against HTTP only sites and is going to mark ALL Non-HTTPS sites insecure in July 2018 with the release of Chrome 68. It's a pretty strong move, but Google and the Internet, in general, has been moving in this direction for a while. It started with suggestions, then forced SSL on all sites behind logins, then mixed-content warnings, then showing HTTP sites are not-secured and now it's going to be outright marked as insecure. Read the rest of Google Chrome Marking ALL Non-HTTPS Sites Insecure July 2018 now! Only available at Darknet.
Pirate.webp 2018-02-06 17:07:07 altdns – Subdomain Recon Tool With Permutation Generation (lien direct) altdns – Subdomain Recon Tool With Permutation GenerationAltdns is a Subdomain Recon Tool in Python that allows for the discovery of subdomains that conform to patterns. The tool takes in words that could be present in subdomains under a domain (such as test, dev, staging) as well as takes in a list of subdomains that you know of. From these two lists that are provided as input to altdns, the tool then generates a massive output of “altered” or “mutated” potential subdomains that could be present. Read the rest of altdns – Subdomain Recon Tool With Permutation Generation now! Only available at Darknet.
Pirate.webp 2018-02-03 11:54:08 0-Day Flash Vulnerability Exploited In The Wild (lien direct) 0-Day Flash Vulnerability Exploited In The WildSo another 0-Day Flash Vulnerability is being exploited in the Wild, a previously unknown flaw which has been labelled CVE-2018-4878 and it affects 28.0.0.137 and earlier versions for both Windows and Mac (the desktop runtime) and for basically everything in the Chrome Flash Player (Windows, Mac, Linux and Chrome OS). The full Adobe Security Advisory can be found here: – Security Advisory for Flash Player | APSA18-01 Adobe warned on Thursday that attackers are exploiting a previously unknown security hole in its Flash Player software to break into Microsoft Windows computers. Read the rest of 0-Day Flash Vulnerability Exploited In The Wild now! Only available at Darknet. ★★★★★
Pirate.webp 2018-02-01 14:33:18 dorkbot – Command-Line Tool For Google Dorking (lien direct) dorkbot – Command-Line Tool For Google Dorkingdorkbot is a modular command-line tool for Google dorking, which is performing vulnerability scans against a set of web pages returned by Google search queries in a given Google Custom Search Engine. How dorkbot works It is broken up into two sets of modules: Indexers – modules that issue a search query and return the results as targets Scanners – modules that perform a vulnerability scan against each target Targets are stored in a local database file upon being indexed. Read the rest of dorkbot – Command-Line Tool For Google Dorking now! Only available at Darknet.
Pirate.webp 2018-01-24 10:14:05 USBPcap – USB Packet Capture For Windows (lien direct) USBPcap – USB Packet Capture For WindowsUSBPcap is an open-source USB Packet Capture tool for Windows that can be used together with Wireshark in order to analyse USB traffic without using a Virtual Machine. Currently, the live capture can be done on “standard input” capture basis: you write a magic command in cmd.exe and you get the Wireshark to capture raw USB traffic on Windows. USBPcapDriver has three “hats”: Root Hub (USBPCAP_MAGIC_ROOTHUB) Control (USBPCAP_MAGIC_CONTROL) Device (USBPCAP_MAGIC_DEVICE) What you won't see using USBPcap As USBPcap captures URBs passed between functional device object (FDO) and physical device object (PDO) there are some USB communications elements that you will notice only in hardware USB sniffer. Read the rest of USBPcap – USB Packet Capture For Windows now! Only available at Darknet.
Pirate.webp 2018-01-15 18:05:01 OWASP ZSC – Obfuscated Code Generator Tool (lien direct) OWASP ZSC – Obfuscated Code Generator ToolOWASP ZSC is an open source obfuscated code generator tool in Python which lets you generate customized shellcodes and convert scripts to an obfuscated script. Shellcodes are small codes in Assembly language which could be used as the payload in software exploitation. Other usages are in malware, bypassing antivirus software, obfuscating code for protection and so on. This software can be run on Windows/Linux/OSX under Python. Why use OWASP ZSC Obfuscated Code Generator Tool Another good reason for obfuscating files or generating shellcode with ZSC is that it can be used for pen-testing assignments. Read the rest of OWASP ZSC – Obfuscated Code Generator Tool now! Only available at Darknet.
Pirate.webp 2018-01-14 15:20:48 A Look Back At 2017 – Tools & News Highlights (lien direct) A Look Back At 2017 – Tools & News HighlightsSo here we are in 2018, taking a look back at 2017, quite a year it was. We somehow forgot to do this last year so just have the 2015 summary and the 2014 summary but no 2016 edition. 2017 News Stories All kinds of things happened in 2017 starting with some pretty comical shit and the MongoDB Ransack – Over 33,000 Databases Hacked, I've personally had very poor experienced with MongoDB in general and I did notice the sloppy defaults (listen on all interfaces, no password) when I used it, I believe the defaults have been corrected – but I still don't have a good impression of it. Read the rest of A Look Back At 2017 – Tools & News Highlights now! Only available at Darknet.
Pirate.webp 2018-01-10 18:04:15 Spectre & Meltdown Checker – Vulnerability Mitigation Tool For Linux (lien direct) Spectre & Meltdown Checker – Vulnerability Mitigation Tool For LinuxSpectre & Meltdown Checker is a simple shell script to tell if your Linux installation is vulnerable against the 3 “speculative execution” CVEs that were made public early 2018. Without options, it'll inspect you currently running kernel. You can also specify a kernel image on the command line, if you'd like to inspect a kernel you're not running. The script will do its best to detect mitigations, including backported non-vanilla patches, regardless of the advertised kernel version number. Read the rest of Spectre & Meltdown Checker – Vulnerability Mitigation Tool For Linux now! Only available at Darknet.
Pirate.webp 2018-01-02 16:02:39 Hijacker – Reaver For Android Wifi Hacker App (lien direct) Hijacker – Reaver For Android Wifi Hacker AppHijacker is a native GUI which provides Reaver for Android along with Aircrack-ng, Airodump-ng and MDK3 making it a powerful Wifi hacker app. It offers a simple and easy UI to use these tools without typing commands in a console and copy & pasting MAC addresses. Features of Hijacker Reaver For Android Wifi Hacker App Information Gathering View a list of access points and stations (clients) around you (even hidden ones) View the activity of a specific network (by measuring beacons and data packets) and its clients Statistics about access points and stations See the manufacturer of a device (AP or station) from the OUI database See the signal power of devices and filter the ones that are closer to you Save captured packets in .cap file Reaver for Android Wifi Cracker Attacks Deauthenticate all the clients of a network (either targeting each one or without specific target) Deauthenticate a specific client from the network it's connected MDK3 Beacon Flooding with custom options and SSID list MDK3 Authentication DoS for a specific network or to every nearby AP Capture a WPA handshake or gather IVs to crack a WEP network Reaver WPS cracking (pixie-dust attack using NetHunter chroot and external adapter) Other Wifi Hacker App Features Leave the app running in the background, optionally with a notification Copy commands or MAC addresses to clipboard Includes the required tools, no need for manual installation Includes the nexmon driver and management utility for BCM4339 devices Set commands to enable and disable monitor mode automatically Crack .cap files with a custom wordlist Create custom actions and run them on an access point or a client easily Sort and filter Access Points and Stations with many parameters Export all gathered information to a file Add a persistent alias to a device (by MAC) for easier identification Requirements to Crack Wifi Password with Android This application requires an ARM Android device with an internal wireless adapter that supports Monitor Mode. Read the rest of Hijacker – Reaver For Android Wifi Hacker App now! Only available at Darknet.
Pirate.webp 2017-12-29 17:38:40 Sublist3r – Fast Python Subdomain Enumeration Tool (lien direct) Sublist3r – Fast Python Subdomain Enumeration ToolSublist3r is a Python-based tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting. It also integrates with subbrute for subdomain brute-forcing with word lists. Features of Sublist3r Subdomain Enumeration Tool It enumerates subdomains using many search engines such as: Google Yahoo Bing Baidu Ask The tool also enumerates subdomains using: Netcraft Virustotal ThreatCrowd DNSdumpster ReverseDNS Requirements of Sublist3r Subdomain Search It currently supports Python 2 and Python 3. Read the rest of Sublist3r – Fast Python Subdomain Enumeration Tool now! Only available at Darknet. Yahoo
Pirate.webp 2017-12-19 18:20:45 coWPAtty Download – Audit Pre-shared WPA Keys (lien direct) coWPAtty Download – Audit Pre-shared WPA KeyscoWPAtty is a C-based tool for running a brute-force dictionary attack against WPA-PSK and audit pre-shared WPA keys. If you are auditing WPA-PSK networks, you can use this tool to identify weak passphrases that were used to generate the PMK. Supply a libpcap capture file that includes the 4-way handshake, a dictionary file of passphrases to guess with, and the SSID for the network. What is coWPAtty? coWPAtty is the implementation of an offline dictionary attack against WPA/WPA2 networks using PSK-based authentication (e.g. Read the rest of coWPAtty Download – Audit Pre-shared WPA Keys now! Only available at Darknet.
Pirate.webp 2017-12-14 18:48:19 net-creds – Sniff Passwords From Interface or PCAP File (lien direct) net-creds – Sniff Passwords From Interface or PCAP Filenet-creds is a Python-based tool for sniffing plaintext passwords and hashes from a network interface or PCAP file – it doesn't rely on port numbers for service identification and can concatenate fragmented packets. Features of net-creds for Sniffing Passwords It can sniff the following directly from a network interface or from a PCAP file: URLs visited POST loads sent HTTP form logins/passwords HTTP basic auth logins/passwords HTTP searches FTP logins/passwords IRC logins/passwords POP logins/passwords IMAP logins/passwords Telnet logins/passwords SMTP logins/passwords SNMP community string NTLMv1/v2 all supported protocols: HTTP, SMB, LDAP, etc. Read the rest of net-creds – Sniff Passwords From Interface or PCAP File now! Only available at Darknet.
Pirate.webp 2017-12-08 17:33:58 DAST vs SAST – Dynamic Application Security Testing vs Static (lien direct) DAST vs SAST – Dynamic Application Security Testing vs StaticIn security testing, much like most things technical there are two very contrary methods, Dynamic Application Security Testing or DAST and Static Application Security Testing or SAST. Dynamic testing relying on a black-box external approach, attacking the application in its running state as a regular malicious attacker would. Static testing is more white-box looking at the source-code of the application for potential flaws. Personally, I don't see them as 'vs' each other, but more like they compliment each other – it's easy to have SAST tests as part of your CI/CD pipeline with tools like Code Climate. Read the rest of DAST vs SAST – Dynamic Application Security Testing vs Static now! Only available at Darknet.
Pirate.webp 2017-12-04 17:09:46 Cr3dOv3r – Credential Reuse Attack Tool (lien direct) Cr3dOv3r – Credential Reuse Attack ToolCr3dOv3r is a fairly simple Python-based set of functions that carry out the prelimary work as a credential reuse attack tool. You just give the tool your target email address then it does two fairly straightforward (but useful) jobs: Search for public leaks for the email and if it any, it returns with all available details about the leak (Using hacked-emails site API). Then you give it this email's old or leaked password then it checks this credentials against 16 websites (ex: facebook, twitter, google…) and notifies of any successful logins. Read the rest of Cr3dOv3r – Credential Reuse Attack Tool now! Only available at Darknet.
Pirate.webp 2017-11-28 16:00:59 Mr.SIP – SIP Attack And Audit Tool (lien direct) Mr.SIP – SIP Attack And Audit ToolMr.SIP was developed in Python as a SIP Attack and audit tool which can emulate SIP-based attacks. Originally it was developed to be used in academic work to help developing novel SIP-based DDoS attacks and defence approaches and then as an idea to convert it to a fully functional SIP-based penetration testing tool, it has been redeveloped into the current version. Mr.SIP – SIP Attack Features Mr.SIP currently comprises of four sub-modules named SIP-NES, SIP-ENUM, SIP-DAS and SIP-ASP. Read the rest of Mr.SIP – SIP Attack And Audit Tool now! Only available at Darknet.
Pirate.webp 2017-11-23 11:33:06 Uber Paid Hackers To Hide 57 Million User Data Breach (lien direct) Uber Paid Hackers To Hide 57 Million User Data BreachUber is not known for it's high level of ethics, but it turns out Uber paid hackers to not go public with the fact they'd breached 57 Million accounts – which is a very shady thing to do. Getting hacked is one thing (usually someone f*cked up), but choosing as a company to systematically cover up a breach to the tune of $100,000 – that's just wrong. 57 Million is a fairly significant number as well with Uber having around 40 Million monthly users, of course, it's not the scale of Equifax with 143 Million (or more). Read the rest of Uber Paid Hackers To Hide 57 Million User Data Breach now! Only available at Darknet. Equifax Uber
Pirate.webp 2017-11-20 18:05:46 RDPY – RDP Security Tool For Hacking Remote Desktop Protocol (lien direct) RDPY – RDP Security Tool For Hacking Remote Desktop ProtocolRDPY is an RDP Security Tool in Twisted Python with RDP Man in the Middle proxy support which can record sessions and Honeypot functionality. RDPY is a pure Python implementation of the Microsoft RDP (Remote Desktop Protocol) protocol (client and server side). RDPY is built over the event driven network engine Twisted. RDPY support standard RDP security layer, RDP over SSL and NLA authentication (through ntlmv2 authentication protocol). RDPY RDP Security Tool Features RDPY provides the following RDP and VNC binaries: RDP Man In The Middle proxy which record session RDP Honeypot RDP Screenshoter RDP Client VNC Client VNC Screenshoter RSS Player RDPY is fully implemented in python, except the bitmap decompression algorithm which is implemented in C for performance purposes. Read the rest of RDPY – RDP Security Tool For Hacking Remote Desktop Protocol now! Only available at Darknet.
Pirate.webp 2017-11-18 09:35:50 Terabytes Of US Military Social Media Spying S3 Data Exposed (lien direct) Terabytes Of US Military Social Media Spying S3 Data ExposedOnce again the old, default Amazon AWS S3 settings are catching people out, this time the US Military has left terabytes of social media spying S3 data exposed to everyone for years. It's not long ago since a Time Warner vendor and their sloppy AWS S3 config leaked over 4 million customer records and left S3 data exposed, and that's not the only case – there's plenty more. Three misconfigured AWS S3 buckets have been discovered wide open on the public internet containing “dozens of terabytes” of social media posts and similar pages – all scraped from around the world by the US military to identify and profile persons of interest. Read the rest of Terabytes Of US Military Social Media Spying S3 Data Exposed now! Only available at Darknet.
Pirate.webp 2017-11-15 09:20:54 SNIFFlab – Create Your Own MITM Test Environment (lien direct) SNIFFlab – Create Your Own MITM Test EnvironmentSNIFFlab is a set of scripts in Python that enable you to create your own MITM test environment for packet sniffing through a WiFi access point. Essentially it's a WiFi hotspot that is continually collecting all the packets transmitted across it. All connected clients' HTTPS communications are subjected to a “Man-in-the-middle” attack, whereby they can later be decrypted for analysis What is SNIFFLab MITM Test Environment In our environment, dubbed Snifflab, a researcher simply connects to the Snifflab WiFi network, is prompted to install a custom certificate authority on the device, and then can use their device as needed for the test. Read the rest of SNIFFlab – Create Your Own MITM Test Environment now! Only available at Darknet.
Pirate.webp 2017-11-10 14:35:48 Skype Log Viewer Download – View Logs on Windows (lien direct) Skype Log Viewer Download – View Logs on WindowsSkype Log Viewer allows you to download and view the Skype history and log files, on Windows, without actually downloading the Skype client itself. What does Skype Log Viewer do? This program allows you to view all of your Skype chat logs and then easily export them as text files. It correctly organizes them by conversation and makes sure that group conversations do not get jumbled with one on one chats. Read the rest of Skype Log Viewer Download – View Logs on Windows now! Only available at Darknet.
Pirate.webp 2017-11-09 11:00:05 Ethereum Parity Bug Destroys Over $250 Million In Tokens (lien direct) Ethereum Parity Bug Destroys Over $250 Million In TokensIf you are into cryptocurrency or blockchain at all, you will have heard about the Ethereum Parity Bug that has basically thrown $280 Million value or more of Ethereum tokens in the bin. It's a bit of a mess really, and a mistake by the developers who introduced it after fixing another bug back in July to do with multisig wallets (wallets which multiple people have to agree to transactions). You can see the thread on Github here: anyone can kill your contract #6995 There's a lot of hair-pulling among Ethereum alt-coin hoarders today – after a programming blunder in Parity's wallet software let one person bin $280m of the digital currency belonging to scores of strangers, probably permanently. Read the rest of Ethereum Parity Bug Destroys Over $250 Million In Tokens now! Only available at Darknet.
Pirate.webp 2017-11-06 17:11:13 WPSeku – Black-Box Remote WordPress Security Scanner (lien direct) WPSeku – Black-Box Remote WordPress Security ScannerWPSeku is a black box WordPress Security scanner that can be used to scan remote WordPress installations to find security issues and vulnerabilities. Features of WPSeku WordPress Security Scanner WPSeku supports various types of scanning including: Testing for XSS Vulnerabilities Testing for SQL Injection Vulnerabilities Testing for LFI Vulnerabilities Bruteforce login via xmlrpc Username Enumeration Proxy Support Method (GET/POST) Custom Wordlists Custom user-agent It also uses the WPVulnDB Vulnerability Database API at https://wpvulndb.com/api. Read the rest of WPSeku – Black-Box Remote WordPress Security Scanner now! Only available at Darknet.
Pirate.webp 2017-11-04 10:49:23 Malaysia Telco Hack – Corporations Spill 46 Million Records (lien direct) Malaysia Telco Hack – Corporations Spill 46 Million RecordsThe Malaysia Telco Hack has been blowing up in the news with over 46 Million Records being leaked including IMEI numbers, SIM card details, serial numbers and home addresses. This is an interesting one for me as I live in Malaysia, so this Malaysia Telco Hack was big news over here, especially seen as though from the numbers it looks to affect pretty much every single person in the country (and many more than once with a popular of 31 million). Read the rest of Malaysia Telco Hack – Corporations Spill 46 Million Records now! Only available at Darknet.
Pirate.webp 2017-10-31 17:20:23 WAFNinja – Web Application Firewall Attack Tool – WAF Bypass (lien direct) WAFNinja – Web Application Firewall Attack Tool – WAF BypassWAFNinja is a Python-based Web Application Firewall Attack Tool designed to help penetration testers execute WAF bypass by automating the steps necessary to bypass input validation. The tool was created with the objective to be easily extendible, simple to use and usable in a team environment. What can WAFNinja Web Application Firewall Attack Tool Do? Many payloads and fuzzing strings, which are stored in a local database file come shipped with the tool. Read the rest of WAFNinja – Web Application Firewall Attack Tool – WAF Bypass now! Only available at Darknet.
Pirate.webp 2017-10-28 10:21:13 dirsearch – Website Directory Scanner For Files & Structure (lien direct) dirsearch – Website Directory Scanner For Files & Structuredirsearch is a Python-based command-line website directory scanner designed to brute force site structure including directories and files in websites. dirsearch Website Directory Scanner Features dirsearch supports the following: Multithreaded Keep alive connections Support for multiple extensions (-e|–extensions asp,php) Reporting (plain text, JSON) Heuristically detects invalid web pages Recursive brute forcing HTTP proxy support User agent randomization Batch processing Request delaying dirsearch Web Directory Structure Scanner & Wordlists Dictionaries must be text files. Read the rest of dirsearch – Website Directory Scanner For Files & Structure now! Only available at Darknet.
Pirate.webp 2017-10-25 18:18:34 XXE Injection Attacks – XML External Entity Vulnerability With Examples (lien direct) XXE Injection Attacks – XML External Entity Vulnerability With ExamplesXXE Injection Attacks or XML External Entity vulnerabilities are a specific type of Server Side Request Forgery or SSRF attack relating to abusing features within XML parsers. The features these attacks go after are widely available but rarely used and when trigged can cause a DoS (Denial of Service) attack and in some cases much more serious escalation like extraction of sensitive data or in worst case scenarios RCE or Remote Code Execution. Read the rest of XXE Injection Attacks – XML External Entity Vulnerability With Examples now! Only available at Darknet.
Pirate.webp 2017-10-23 14:35:10 SQLiv – SQL Injection Dork Scanning Tool (lien direct) SQLiv – SQL Injection Dork Scanning ToolSQLiv is a Python-based massive SQL Injection dork scanning tool which uses Google, Bing or Yahoo for targetted scanning, multiple-domain scanning or reverse domain scanning. SQLiv Massive SQL Injection Scanner Features Both the SQLi scanning and domain info checking are done in a multiprocess manner so the script is super fast at scanning a lot of URLs. It's a fairly new tool and there are plans for more features and to add support for other search engines like DuckDuckGo. Read the rest of SQLiv – SQL Injection Dork Scanning Tool now! Only available at Darknet. Yahoo
Pirate.webp 2017-10-20 15:37:03 OSSIM Download – Open Source SIEM Tools & Software (lien direct) OSSIM Download – Open Source SIEM Tools & SoftwareOSSIM is a popular Open Source SIEM or Security Information and Event Management (SIEM) product, providing event collection, normalization and correlation. OSSIM stands for Open Source Security Information Management, it was launched in 2003 by security engineers because of the lack of available open source products, OSSIM was created specifically to address the reality many security professionals face: A SIEM, whether it is open source or commercial, is virtually useless without the basic security controls necessary for security visibility. Read the rest of OSSIM Download – Open Source SIEM Tools & Software now! Only available at Darknet.
Pirate.webp 2017-10-19 19:33:13 What You Need To Know About KRACK WPA2 Wi-Fi Attack (lien direct) What You Need To Know About KRACK WPA2 Wi-Fi AttackThe Internet has been blowing up in the past week about the KRACK WPA2 attack that is extremely widespread and is a flaw in the Wi-Fi standard itself, not the implementation. It's a flaw in the 4 way handshake for WP2 compromised by a Key Reinstallation Attack. This means any device that has correctly implemented WPA2 is likely affected (so basically everything that has Wi-Fi capability) – this includes Android, Linux, Apple, Windows, OpenBSD and more. Read the rest of What You Need To Know About KRACK WPA2 Wi-Fi Attack now! Only available at Darknet.
Pirate.webp 2017-10-17 18:27:58 Spaghetti Download – Web Application Security Scanner (lien direct) Spaghetti Download – Web Application Security ScannerSpaghetti is an Open-source Web Application Security Scanner, it is designed to find various default and insecure files, configurations, and misconfigurations. It is built on Python 2.7 and can run on any platform which has a Python environment. Features of Spaghetti Web Application Security Scanner Fingerprints Server Web Frameworks (CakePHP, CherryPy,…) Web Application Firewall (Waf) Content Management System (CMS) Operating System (Linux, Unix,..) Language (PHP, Ruby,…) Cookie Security Bruteforce Admin Interface Common Backdoors Common Backup Directory Common Backup File Common Directory Common File Log File Disclosure Emails Private IP Credit Cards Attacks HTML Injection SQL Injection LDAP Injection XPath Injection Cross Site Scripting (XSS) Remote File Inclusion (RFI) PHP Code Injection Other HTTP Allow Methods HTML Object Multiple Index Robots Paths Web Dav Cross Site Tracing (XST) PHPINFO .Listing Vulns ShellShock Anonymous Cipher (CVE-2007-1858) Crime (SPDY) (CVE-2012-4929) Struts-Shock Using Spaghetti Web Application Security Scanner root@darknet:~/Spaghetti# python spaghetti.py _____ _ _ _ _ | __|___ ___ ___| |_ ___| |_| |_|_| |__ | . Read the rest of Spaghetti Download – Web Application Security Scanner now! Only available at Darknet.
Pirate.webp 2017-10-11 17:29:39 Taringa Hack – 27 Million User Records Leaked (lien direct) Taringa Hack – 27 Million User Records LeakedThe Taringa hack is actually one of the biggest leaks of the year with 27 million weakly hashed passwords breached, but it's not often covered in the Western media with it being a Latin American site (something like Reddit). The leak happened in August and it seems like the hackers were able to brute force around 95% of the account passwords fairly quickly with Taringa using an outdated and flawing hashing algorithm – md5. Read the rest of Taringa Hack – 27 Million User Records Leaked now! Only available at Darknet.
Pirate.webp 2017-10-09 15:17:30 A2SV – Auto Scanning SSL Vulnerability Tool For Poodle & Heartbleed (lien direct) A2SV – Auto Scanning SSL Vulnerability Tool For Poodle & HeartbleedA2SV is a Python-based SSL Vulnerability focused tool that allows for auto-scanning and detection of the common and well-known SSL Vulnerabilities. SSL Vulnerabilities Detected by A2SV [CVE-2007-1858] Anonymous Cipher [CVE-2012-4929] CRIME(SPDY) [CVE-2014-0160] CCS Injection [CVE-2014-0224] HeartBleed [CVE-2014-3566] SSLv3 POODLE [CVE-2015-0204] FREAK Attack [CVE-2015-4000] LOGJAM Attack [CVE-2016-0800] SSLv2 DROWN Planned for future: [PLAN] SSL ACCF [PLAN] SSL Information Analysis Installation & Requirements for A2SV A. Read the rest of A2SV – Auto Scanning SSL Vulnerability Tool For Poodle & Heartbleed now! Only available at Darknet.
Pirate.webp 2017-10-08 15:11:54 VHostScan – Virtual Host Scanner With Alias & Catch-All Detection (lien direct) VHostScan – Virtual Host Scanner With Alias & Catch-All DetectionVHostScan is a Python-based virtual host scanner that can be used with pivot tools, detect catch-all scenarios, aliases and dynamic default pages. Features of VHostScan Virtual Host Scanner Quickly highlight unique content in catch-all scenarios Locate the outliers in catch-all scenarios where results have dynamic content on the page (such as the time) Identify aliases by tweaking the unique depth of matches Wordlist supports standard words and a variable to input a base hostname (for e.g. Read the rest of VHostScan – Virtual Host Scanner With Alias & Catch-All Detection now! Only available at Darknet.
Pirate.webp 2017-10-05 18:11:01 Equifax Hack Blamed On Single Employee (lien direct) Equifax Hack Blamed On Single EmployeeWe wrote about the Equifax Hack, Data Breach and Leak last month, which happened due to a flaw in Apache Struts that for some reason hadn't been patched. Now it seems the CEO Rick Smith is basically placing the blame on a single employee that failed to pass a message on to the right people, rather than taking responsibility for an organisational failure. It's also interesting there was a scheduled security scan not long after the flaw was disclosed and it wasn't detected. Read the rest of Equifax Hack Blamed On Single Employee now! Only available at Darknet. Equifax
Pirate.webp 2017-10-03 17:18:43 LOIC Download – Low Orbit Ion Cannon DDoS Booter (lien direct) LOIC Download – Low Orbit Ion Cannon DDoS BooterLOIC Download below – Low Orbit Ion Cannon is an Open Source Stress Testing and Denial of Service (DoS or DDoS) attack application written in C#. It's an interesting tool in that it's often used in what are usually classified as political cyber-terrorist attacks against large capitalistic organisations. The hivemind version gives average non-technical users a way to give their bandwidth as a way of supporting a cause they agree with. Read the rest of LOIC Download – Low Orbit Ion Cannon DDoS Booter now! Only available at Darknet.
Pirate.webp 2017-10-01 10:20:37 Yuki Chan – Automated Penetration Testing Tool (lien direct) Yuki Chan – Automated Penetration Testing ToolYuki Chan is an Automated Penetration Testing Tool that carries out a whole range of standard security auditing tasks automatically. It's highly recommended to use this tool within Kali Linux OS as it already contains all the dependencies. This tool is only designed for Linux OS so if you are not using Linux OS it won't be much use, but if you have Android Smartphone or Tablet you can run this tool via Termux or GNURoot Debian. Read the rest of Yuki Chan – Automated Penetration Testing Tool now! Only available at Darknet.
Pirate.webp 2017-09-29 09:54:51 Deloitte Hacked – Client Emails, Usernames & Passwords Leaked (lien direct) Deloitte Hacked – Client Emails, Usernames & Passwords LeakedIt seems to be non-stop lately, this time it's Deloitte Hacked, which has also revealed all kinds of publically accessible resources that really should be more secure (VPN, RDP & Proxy services). The irony is that Deloitte positions itself as a global leader in information security and offers consulting services to huge clients all over the planet, now it seems they don't take their own advice. Honestly this is not all that uncommon, it's human nature to leave your own stuff last as it doesn't directly impact revenue or value (until you get hacked). Read the rest of Deloitte Hacked – Client Emails, Usernames & Passwords Leaked now! Only available at Darknet. Guideline Deloitte
Pirate.webp 2017-09-26 14:31:37 Rapid7 Nexpose Community Edition – Free Vulnerability Scanner (lien direct) Rapid7 Nexpose Community Edition – Free Vulnerability ScannerRapid7 Nexpose Community Edition is a free vulnerability scanner & security risk intelligence solution designed for organizations with large networks, prioritize and manage risk effectively. It proactively supports the entire vulnerability management lifecycle, including discovery, detection, verification, risk classification, impact analysis, reporting and mitigation. Nexpose Community Edition Features Data breaches are growing at an alarming rate. Your attack surface is constantly changing, the adversary is becoming more nimble than your security teams, and your board wants to know what you are doing about it. Read the rest of Rapid7 Nexpose Community Edition – Free Vulnerability Scanner now! Only available at Darknet.
Pirate.webp 2017-09-22 14:21:22 BSQLinjector – Blind SQL Injection Tool Download in Ruby (lien direct) BSQLinjector – Blind SQL Injection Tool Download in RubyBSQLinjector is an easy to use Blind SQL Injection tool in Ruby, that uses blind methods to retrieve data from SQL databases. The download is below. The author recommends using the “--test” switch to clearly see how configured payload looks like before sending it to an application. What is Blind SQL Injection? Blind SQL Injection is a type of SQL Injection (SQLi) attack that asks the database true or false questions and determines the answer based on the application's response. Read the rest of BSQLinjector – Blind SQL Injection Tool Download in Ruby now! Only available at Darknet.
Pirate.webp 2017-09-21 14:14:33 CCleaner Hack – Spreading Malware To Specific Tech Companies (lien direct) CCleaner Hack – Spreading Malware To Specific Tech CompaniesThe CCleaner Hack is blowing up, with it initially estimated to be huge, it's hit at least 700,000 computers and is specifically targeting 20 top tech organisations including Cisco, Intel, Microsoft, Akamai, Samsung and more for a second, more intrusive and pervasive layer of infection. This could be classified as slightly ironic too as CCleaner is extremely popular software for removing crapware from computers, it was a clever assumption that a corrupt version would find itself installed in some very high-value networks. Read the rest of CCleaner Hack – Spreading Malware To Specific Tech Companies now! Only available at Darknet. CCleaner
Last update at: 2024-06-02 23:08:29
See our sources.
My email:

To see everything: Our RSS (filtrered) Twitter