Search the Community

Digital Forensics with Open Source Tools is the definitive book on investigating and analyzing computer systems and media using open source tools. The book is a technical procedural guide, and explains the use of open source tools on Mac, Linux and Windows systems as a platform for performing computer forensics. Both well-known and novel forensic methods are demonstrated using command-line and graphical open source computer forensic tools for examining a wide range of target systems and artifacts. Written by world-renowned forensic practitioners, this book uses the most current examination and analysis techniques in the field. It consists of 9 chapters that cover a range of topics such as the open source examination platform; disk and file system analysis; Windows systems and artifacts; Linux systems and artifacts; Mac OS X systems and artifacts; Internet artifacts; and automating analysis and extending capabilities. The book lends itself to use by students and those entering the field who do not have means to purchase new tools for different investigations. This book will appeal to forensic practitioners from areas including incident response teams and computer forensic investigators; forensic technicians from legal, audit, and consulting firms; and law enforcement agencies. Download Link -> [Hidden Content]

WAF bypass Tool is an open-source tool to analyze the security of any WAF for False Positives and False Negatives using predefined and customizable payloads. Check your WAF before an attacker does. WAF Bypass Tool is developed by the Nemesida WAF team with the participation of the community. Payloads Depending on the purpose, payloads are located in the appropriate folders: FP – False Positive payloads API – API testing payloads CM – Custom HTTP Method payloads GraphQL – GraphQL testing payloads LDAP – LDAP Injection etc. payloads LFI – Local File Include payloads MFD – multipart/form-data payloads NoSQLi – NoSQL injection payloads OR – Open Redirect payloads RCE – Remote Code Execution payloads RFI – Remote File Inclusion payloads SQLi – SQL injection payloads SSI – Server-Side Includes payloads SSRF – Server-side request forgery payloads SSTI – Server-Side Template Injection payloads UWA – Unwanted Access payloads XSS – Cross-Site Scripting payloads Write your own payloads When compiling a payload, the following zones, methods, and options are used: URL – request’s path ARGS – request’s query BODY – request’s body COOKIE – request’s cookie USER-AGENT – request’s user-agent REFERER – request’s referer HEADER – request’s header METHOD – request’s method BOUNDARY – specifies the contents of the request’s boundary. Applicable only to payloads in the MFD directory. ENCODE – specifies the type of payload encoding (Base64, HTML-ENTITY, UTF-16) in addition to the encoding for the payload. Multiple values are indicated with a space (e.g. Base64 UTF-16). Applicable only to for ARGS, BODY, COOKIE and HEADER zone. Not applicable to payloads in API and MFD directories. Not compatible with option JSON. JSON – specifies that the request’s body should be in JSON format BLOCKED – specifies that the request should be blocked (FN testing) or not (FP) [hide][Hidden Content]]

Description I have always been a huge fan of leveraging Chat GPT’s artificial intelligence to earn passive income and building online and home businesses due to the flexibility and freedom they offer. The income I have made (and continue to make) from content generation through Open AI’s tool Chat GPT helps me earn extra streams of passive income which I can use to invest or pay my bills without even touching the money I make from my day job. It’s truly life changing! Passive Income W/ ChatGPT Artificial Intelligence by Open AI is a course about the best passive income and online business which you can start today while working from home or anywhere else in the world by leveraging artificial intelligence. Easy to start, flexible to complete anytime and a great compensation for my time made Chat GPT a life-changing passive income source and side hustle which I do while working, traveling, and vacationing! Having a side hustle like this can be truly empowering and even life-altering. To be very transparent, this online business does not require any upfront investment at all of your time or money, prior qualifications, or any other demanding pre-requisites. No prior experience or knowledge is required to start this side hustle. This Chat GPT course also does not have any software or equipment requirements. Who this course is for: Those looking to start new streams of passive income. People aspiring to start new online businesses from the comfort of their own home. People looking to explore the best side hustles. Individuals who want to learn more about artificial intelligence, content creation and the ChatGPT tool. Anyone with a few minutes of free time per day to start. IMPORTANT: If you love getting paid in USD$, this is a must for you! Requirements No additional requirements. Get started with all the income streams the minute you’re done my course! 30 mins a week to invest in learning artificial intelligence. A laptop or desktop with a good internet connection. [Hidden Content] [hide][Hidden Content]]

FirebaseExploiter is a vulnerability discovery tool that discovers Firebase databases which are open and can be exploitable. Primarily built for mass hunting bug bounties and for penetration testing. Mass vulnerability scanning from a list of hosts Custom JSON data in exploit.json to upload during the exploit Custom URI path for exploit [hide][Hidden Content]]

[Hidden Content]

Sub3 Suite is a research-grade suite of tools for Subdomain Enumeration, OSINT Information gathering & Attack Surface Mapping. Supports both manual and automated analysis on a variety of target types with many available features & tools. Use Cases These enumerations processes can be used for offensive & defensive cyber operations, Bug-Bounty hunting & Research. Multiple techniques are normally used by multiple tools to attain this goal. sub3suite combines these different techniques and provides you with multiple capability tools into one suite for effective enumeration both manually and automatically. General Concepts Passive Subdomain Enumeration. Active Subdomain Enumeration. OSINT (Open-source intelligence). OSINT Information gathering. Target Mapping. Changelog v0.0.4 changed ACTIVE Tool to HOST Tool. changed no longer use the term ENGINES now its TOOLS added IP Tool added Ping feature for HOST & IP tools. added light theme added hostname querying in URL Tool fix unwanted selection in results tree views fix json highlighter fix hackertarget crashing OSINT Tool on hostsearch [hide][Hidden Content]]

black-widow is one of the most useful, powerful, and complete offensive penetration testing tools. It provides easy ways to execute many kinds of information gatherings and attacks. Fully Open Source Written in Python Continuously updated and extended [hide][Hidden Content]]

Sub3 Suite is a research-grade suite of tools for Subdomain Enumeration, OSINT Information gathering & Attack Surface Mapping. Supports both manual and automated analysis on variety of target types with many available features & tools. For more information checkout the documentation [hide][Hidden Content]]

Sub3 Suite is a research-grade suite of tools for Subdomain Enumeration, OSINT Information gathering & Attack Surface Mapping. Supports both manual and automated analysis on a variety of target types with many available features & tools. Use Cases These enumerations processes can be used for offensive & defensive cyber operations, Bug-Bounty hunting & Research. Multiple techniques are normally used by multiple tools to attain this goal. sub3suite combines these different techniques and provides you with multiple capability tools into one suite for effective enumeration both manually and automatically. General Concepts Passive Subdomain Enumeration. Active Subdomain Enumeration. OSINT (Open-source intelligence). OSINT Information gathering. Target Mapping. Subdomain Enumeration Subdomain enumeration is the process of finding sub-domains for one or more domains. It helps to broader the attack surface, and find hidden applications and forgotten subdomains. why subdomain enumeration? Sub-domain enumeration helps to create a scope of security assessment by revealing domains/sub-domains of a target organization. Sub-domain enumeration increases the chance of finding vulnerabilities. The sub-domain enumeration helps us in finding the web applications that might be forgotten/left unattended by the organization for maintenance or other reasons and may lead to the disclosure of critical vulnerabilities. Passive Subdomain Enumeration For passive subdomain enumeration, the subdomains are obtained from a third party without directly connecting to the target’s infrastructures. These 3rd parties gather and store open information gathered from devices connected to the internet and contain an interface to share this data e.gAPI . Passive sources include VirusTotal, shodan, host, SecurityTrails, etc. Multiple tools are available For this purpose. Open source tools like theHarvester & amass are among the most popular in this field. sub3suite has an OSINT tool that can be used for passive subdomain enumeration able to pull data from 50+ osint sources in a matter of seconds & gives users the ability to manipulate this data to their liking. [hide][Hidden Content]]

[Hidden Content]

SpiderFoot is an open-source intelligence automation tool. Its goal is to automate the process of gathering intelligence about a given target, which may be an IP address, domain name, hostname, or network subnet. SpiderFoot can be used offensively, i.e. as part of a black-box penetration test to gather information about the target or defensively to identify what information your organization is freely providing for attackers to use against you. Features Utilises a shedload of data sources; over 50 so far and counting, including SHODAN, RIPE, Whois, PasteBin, Google, SANS, and more. Designed for maximum data extraction; every piece of data is passed on to modules that may be interested so that they can extract valuable information. No piece of discovered data is saved from the analysis. Runs on Linux and Windows. And fully open-source so you can fork it on GitHub and do whatever you want with it. Visualisations. Built-in JavaScript-based visualizations or export to GEXF/CSV for use in other tools, like Gephi for instance. Web-based UI and CLI. Choose between a GUI that is easy to use and a powerful command-line interface. Take a look through the gallery for screenshots of the GUI and the collection of CLI videos on asiinema.org. Highly configurable. Almost every module is configurable so you can define the level of intrusiveness and functionality. Modular. Each major piece of functionality is a module, written in Python. Feel free to write your own and submit them to be incorporated! SQLite backend. All scan results are stored in a local SQLite database, so you can play with your data to your heart’s content. Simultaneous scans. Each footprint scan runs as its own thread, so you can perform footprinting of many different targets simultaneously. So much more.. check out the documentation for more information. Changelog v4.0 SpiderFoot 4.0 introduces the concept of writing your own correlation rules in YAML, plus integration with a number of open source security tools. SpiderFoot has integrated with a few popular open source tools such as DNSTwist, CMSeek, Whatweb, WAFW00F and Nmap for some time nbtscan: Scans for open NETBIOS nameservers on your target’s network. Nuclei: Fast and customizable vulnerability scanner with a powerful templating framework for custom detections. onesixtyone: Fast scanner to find publicly exposed SNMP services. Retire.js: Scanner detecting the use of JavaScript libraries with known vulnerabilities. snallygaster: Finds file leaks and other security problems on HTTP servers. testssl.sh: Identify various TLS/SSL weaknesses, including Heartbleed, CRIME and ROBOT. TruffleHog: Searches through git repositories for high entropy strings and secrets, digging deep into commit history. Wappalyzer: Wappalyzer indentifies technologies on websites. [hide][Hidden Content]]

[Hidden Content] [Hidden Content]

Why should I care? RPC is the underlying mechanism which is used for numerous lateral movement techniques, reconnaissance, relay attacks, or simply to exploit vulnerable RPC services. DCSync attack? over RPC. Remote DCOM? over RPC. WMIC? over RPC. SharpHound? over RPC. PetitPotam? over RPC. PsExec? over RPC. ZeroLogon? over RPC… well, you get the idea 🙂 What is it used for? Install the RPC Firewall and configure it to audit all remote RPC calls. Once executing any remote attack tools, you will see which RPC UUIDs and Opnums were called remotely. Remote RPC Attacks Detection When the RPC Firewall is configured to audit, it writes events to the Windows Event Log. Forward this log to your SIEM, and use it to create baselines of remote RPC traffic for your servers. Once an abnormal RPC call is audited, use it to trigger an alert for your SOC team. Remote RPC Attacks Protection The RPC Firewall can be configured to block & audit only potentially malicious RPC calls. All other RPC calls are not audited to reduce noise and improve performance. Once a potentially malicious RPC call is detected, it is blocked and audited. This could be used to alert your SOC team, while keeping your servers protected. What are the RPC Firewall Components? It is made up of 3 components: RpcFwManager.exe – In charge of managing the RPC Firewall. RpcFirewall.dll – Injected DLL which performs the audit & filtering of RPC calls. RpcMessages.dll – A common library for sharing functions, and logic that writes data into Windows Event Viewer. Changelog v1.0.3 Event Log changed to “RPCFW” Event Log size is now 2MB C++ Refactoring Code is signed, resolves #9 [hide][Hidden Content]]

A tool to find open S3 buckets and dump their contents The tool takes in a list of bucket names to check. Found S3 buckets are output to file. The tool will also dump or list the contents of ‘open’ buckets locally. Features ⚡️ Multi-threaded scanning 🔭 Supports tons of S3-compatible APIs 🕵️‍♀️ Scans all bucket permissions to find misconfigurations 💾 Dump bucket contents to a local folder 🐳 Docker support Changelog v2.0.2 Fixes #122 – CVE-2021-32061: Path Traversal via dump of malicious bucket [hide][Hidden Content]]

𝚔𝚊𝚛𝚖𝚊 𝚟𝟸 can be used by Infosec Researchers, Penetration Testers, Bug Hunters to find deep information, more assets, WAF/CDN bypassed IPs, Internal/External Infra, Publicly exposed leaks and many more about their target. Shodan Premium API key is required to use this automation. Output from the 𝚔𝚊𝚛𝚖𝚊 𝚟𝟸 is displayed to the screen and saved to files/directories. Features Powerful and flexible results via Shodan Dorks SSL SHA1 checksum/fingerprint Search Only hit In-Scope IPs Verify each IP with SSL/TLS certificate issuer match RegEx Provide Out-Of-Scope IPs Find out all ports including well known/uncommon/dynamic Grab all targets vulnerabilities related to CVEs Banner grab for each IP, Product, OS, Services & Org etc. Grab favicon Icons Generate Favicon Hash using python3 mmh3 Module Favicon Technology Detection using nuclei custom template ASN Scan BGP Neighbour IPv4 & IPv6 Profixes for ASN Interesting Leaks like Indexing, NDMP, SMB, Login, SignUp, OAuth, SSO, Status 401/403/500, VPN, Citrix, Jfrog, Dashboards, OpenFire, Control Panels, Wordpress, Laravel, Jetty, S3 Buckets, Cloudfront, Jenkins, Kubernetes, Node Exports, Grafana, RabbitMQ, Containers, GitLab, MongoDB, Elastic, FTP anonymous, Memcached, DNS Recursion, Kibana, Prometheus, Default Passwords, Protected Objects, Moodle, Spring Boot, Django, Jira, Ruby, Secret Key and many more... [hide][Hidden Content]]

rpcfirewall: Open Source Ransomware Kill Switch Tool Why should I care? RPC is the underlying mechanism which is used for numerous lateral movement techniques, reconnaissance, relay attacks, or simply to exploit vulnerable RPC services. DCSync attack? over RPC. Remote DCOM? over RPC. WMIC? over RPC. SharpHound? over RPC. PetitPotam? over RPC. PsExec? over RPC. ZeroLogon? over RPC… well, you get the idea 🙂 What is it used for? Research Install the RPC Firewall and configure it to audit all remote RPC calls. Once executing any remote attack tools, you will see which RPC UUIDs and Opnums were called remotely. Remote RPC Attacks Detection When the RPC Firewall is configured to audit, it writes events to the Windows Event Log. Forward this log to your SIEM, and use it to create baselines of remote RPC traffic for your servers. Once an abnormal RPC call is audited, use it to trigger an alert for your SOC team. Remote RPC Attacks Protection The RPC Firewall can be configured to block & audit only potentially malicious RPC calls. All other RPC calls are not audited to reduce noise and improve performance. Once a potentially malicious RPC call is detected, it is blocked and audited. This could be used to alert your SOC team, while keeping your servers protected. What are the RPC Firewall Components? It is made up of 3 components: RpcFwManager.exe – In charge of managing the RPC Firewall. RpcFirewall.dll – Injected DLL which performs the audit & filtering of RPC calls. RpcMessages.dll – A common library for sharing functions, and logic that writes data into Windows Event Viewer. [hide][Hidden Content]]

The World’s First Truly Open Threat Intelligence Community Gain FREE access to over 19 million threat indicators contributed daily Collaborate with over 100,000 global participants to investigate emerging threats in the wild Quickly identify if your endpoints have been compromised in major cyber attacks using OTX Endpoint Security™. Share your threat research and subscribe to pulses from other OTX contributors to stay up to date with their threat research Leverage the latest OTX threat intelligence directly in your AlienVault USM™ or AlienVault OSSIM™ environment Synchronize OTX threat intelligence with your other security products using the OTX DirectConnect API [Hidden Content]

ReconSpider ReconSpider is most Advanced Open Source Intelligence (OSINT) Framework for scanning IP Address, Emails, Websites, Organizations and find out information from different sources. ReconSpider can be used by Infosec Researchers, Penetration Testers, Bug Hunters and Cyber Crime Investigators to find deep information about their target. ReconSpider aggregate all the raw data, visualize it on a dashboard and facilitate alerting and monitoring on the data. Recon Spider also combines the capabilities of Wave, Photon and Recon Dog to do a comprehensive enumeration of attack surface. [hide][Hidden Content]]

REDasm – The Open Source Disassembler REDasm is a cross-platform disassembler with a modern codebase useful from the hobbyist to the professional reverse engineer. All features are provided by LibREDasm which loads plugins developed in C, C++, and Python3 (you can also support new languages if you want!) and a user-friendly Qt frontend. LibREDasm also provides a plain C API for maximum ABI compatibility along with a C++17 core. Changelog v3.0 beta5 REDasm Fixed Dialog plugins implementation (QtDialogUI) Improved QHexView integration (still WIP) Code cleanup Minor Fixes LibREDasm Redesigned internal address space representation (for performance) Redesigned and simplified Document API Improved surface rendering performance Improved analysis accuracy and speed Fixed Control Flow Graph generation Separate comments from autocomments Expanded Type System and its APIs Drastically reduced memory usage Improved string detection performance Analyzers can now be hidden from plugins Code cleanup Minor Fixes Plugins Implemented DEX Loader Implemented Dalvik Assembler ELF: Fixed segmentation fault [hide][Hidden Content]]

Description Network protection is vital to organizations big and small, but it doesn’t have to be an expensive proposition. Learn how to protect your network with open-source tools, and do it completely free. Jungwoo Ryoo shows how to set up firewalls, investigate network traffic with a packet analyzer, detect threats and malicious activity with an intrusion-detection system, and enable network logging and monitoring. Start here for a low-cost route to a more secure network. [Hidden Content] [hide][Hidden Content]]

Needs Proxy (HQ) Combo Type: Email:Pass Bot: 50_100 Capture: Balance [Hidden Content]

RAT-el is an open-source penetration test tool that allows you to take control of a windows machine. It works on the client-server model, the server sends commands and the client executes the commands and sends the result back to the server. The client is completely undetectable by anti-virus software. Features RATelServer: Multiple Connections Broadcast commands to all clients Stores client information in the database Encryption of data on the network via XOR Token management system to identify clients Client: Encryption of data sent over the network Startup persistence Remote command execution via CMD Remote command execution via Powershell Encryption of data on the network via XOR Automatic persistence when running the client Automatic reconnection RATelGenerator: Automatic client compilation [hide][Hidden Content]]

REDasm – The Open Source Disassembler REDasm is an interactive, multiarchitecture disassembler written in modern C++11 using Qt5 as UI Framework, its core is modular and it can be easily extended in order to support new file formats and instruction sets. You can hack and improve REDasm without any issues and limitations. REDasm is under heavy development but it provides several interesting features: IDA-Like interactive listing. Multithreaded analysis. Graphing support. Project management. Signature engine. Cross-platform. Easy to use. Changelog v3.0 beta2 Reimplemented cross references analysis Implemented Tensilica Xtensa and ESP32 support Added support for Xtensa ELF executables Implemented COFF plugin Improved build system Restored RDCommandPlugin (WIP) Fixed UI related APIs Minor fixes [hide][Hidden Content]]

REDasm – The Open Source Disassembler REDasm is an interactive, multiarchitecture disassembler written in modern C++11 using Qt5 as UI Framework, its core is modular and it can be easily extended in order to support new file formats and instruction sets. You can hack and improve REDasm without any issues and limitations. REDasm is under heavy development but it provides several interesting features: IDA-Like interactive listing. Multithreaded analysis. Graphing support. Project management. Signature engine. Cross-platform. Easy to use. Changelog v3.0 beta1 New User Interface Brand new Disassembler Engine Plugin interface Plain C API C++17 Core Support for x86 and x86_64, ARM64 and MIPS architectures Support for PE, ELF, PSX and XBOX1 executables 32 Bit MSVC RTTI support [hide][Hidden Content]]

Watcher is a Django & React JS automated platform for discovering new potentially cybersecurity threats targeting your organisation. It should be used on webservers and available on Docker. Watcher capabilities Detect emerging vulnerability, malware using social network & other RSS sources (www.cert.ssi.gouv.fr, www.cert.europa.eu, www.us-cert.gov, www.cyber.gov.au...). Detect Keywords in pastebin & in other IT content exchange websites (stackoverflow, github, gitlab, bitbucket, apkmirror, npm...). Monitor malicious domain names (IPs, mail/MX records, web pages using TLSH). Detect suspicious domain names targeting your organisation, using dnstwist. Useful as a bundle regrouping threat hunting/intelligence automated features. Additional features Create cases on TheHive and events on MISP. Integrated IOCs export to TheHive and MISP. LDAP & Local Authentication. Email notifications. Ticketing system feeding. Admin interface. Advance users permissions & groups. [hide][Hidden Content]]