Search the Community

Showing results for tags 'v0.1'.



More search options

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • Staff Control
    • Staff Announcements
    • Moderators
    • Staff
    • Administration
  • General doubts | News
    • General doubts
    • News
  • Hacking | Remote Administration | Bugs & Exploits
    • Hacking
    • Remote Administration
    • Bugs & Exploits
  • Programming | Web | SEO | Prefabricated applications
    • General Programming
    • Web Programming
    • Prefabricated Applications
    • SEO
  • Pentesting Zone
  • Security & Anonymity
  • Operating Systems | Hardware | Programs
  • Graphic Design
  • vBCms Comments
  • live stream tv
  • Marketplace
  • Pentesting Premium
  • Modders Section
  • PRIV8-Section
  • Pentesting Zone PRIV8
  • Carding Zone PRIV8
  • Recycle Bin

Blogs

There are no results to display.

There are no results to display.


Find results in...

Find results that contain...


Date Created

  • Start

    End


Last Updated

  • Start

    End


Filter by number of...

Joined

  • Start

    End


Group


About Me


Location


Interests


Occupation


TeamViewer


Twitter


Facebook


Youtube


Google+


Tox

Found 26 results

  1. itsMe

    BigBountyRecon v0.1

    BigBountyRecon: expediate the process of intial reconnaissance on the target organisation BigBountyRecon tool utilises 58 different techniques using various Google dorks and open source tools to expedite the process of initial reconnaissance on the target organisation. Reconnaissance is the most important step in any penetration testing or a bug hunting process. It provides an attacker with some preliminary knowledge on the target organisation. Furthermore, it will be useful to gain insights into what controls are in place as well as some rough estimations on the security maturity level of the target organisation. This tool can be used in addition to your usual approach for bug hunting. The idea is to quickly check and gather information about your target organisation without investing time and remembering these syntaxes. In addition, it can help you define an approach towards finding some quick wins on the target. Techniques Directory Listing: Finding open directories using Google Dork on your target organisation helps one to understand the directory structure on the webserver. It may reveal sensitive information or it may lead to information disclosure. Configuration Files: Often times configuration files contains sensitive information such as hardcoded passwords, sensitive drive locations or API tokens which can help you gain privilege access to the internal resources. Database Files: Database Files are data files that are used to store the contents of the database in a structured format into a file in separate tables and fields. Depending on the nature of the web application these files could provide access to sensitive information. WordPress: WordPress is an open-source CMS written in PHP. WordPress has thousands of plugins to build, customise and enhance the websites. There are numerous vulnerabilities in these plugins. Finding WordPress related Log Files: Log files sometimes provide detailed information of the users’ activities in a particular application. These files are good to look at session cookies or other types of tokens. Backup and Old Files: Backup files are original copies of the critical systems. These provide access to PII or access to sensitive records. Login Pages: It is extremely important to identify login pages of your target organisation to perform bruteforce attempts or trying default credentials to gain further access to organisation resources. SQL Errors: SQL errors leaks sensitive information about the backend systems. This can help one to perform enumeration on the database types and see if the application is vulnerable to input validation related attacks such as SQL Injection. Apache Config Files: Apache HTTP Server is configured by placing directives in plain text configuration files. The main configuration file is usually called httpd.conf. In addition, other configuration files may be added using the Include directive, and wildcards can be used to include many configuration files. Any directive may be placed in any of these configuration files. Depending on the entries in these config files it may reveal database connection strings, username and passwords, the internal workings, used and referenced libraries and business logic of application. Robots.txt File: Robots.txt file instructs web robots how to crawl pages on their website. Depending on the content of the file, an attacker might discover hidden directories and files. DomainEye: DomainEye is a domain/host investigation tool that has the largest domain databases. They provide services such as reverse Whois, reverse IP lookup, as well as reverse NS and MX. Publicly Exposed Documents: Such documents can be used to extract metadata information. phpinfo(): Exposing phpinfo() on its own isn’t necessarily a risk, but in combination with other vulnerabilities could lead to your site becoming compromised. Additionally, module versions could make attackers life easier when targeting application using newly discovered exploits. Finding Backdoors: This can help one to identify website defacements or server hijacking related issues. By exploiting the open redirect vulnerability on the trusted web application, the attacker can redirect victims to a phishing page. Install/Setup Files: Such files allows an attacker to perform enumeration on the target organisation. Information gathered using these files can help discover version details which can then be used to perform the targeted exploit. Open Redirects: With these, we look at various known parameters vulnerable to open redirect related issues. Apache Struts RCE: Successfully exploiting an RCE vulnerability could allow the attacker to run arbitrary programs. Here, we are looking for files with extensions of “.action” or “.do”. 3rd Party Exposure: Here we are looking for exposure of information on third party sites such as Codebeautify, Codeshare and Codepen. Check Security Headers: Identify quickly if the target site is using security related headers in the server response. GitLab: Quickly look for sensitive information on the GitLab. Find Pastebin Entries: Shows you the results related to the target organisation on the Pastebin site. This could be passwords or any other sensitive information related to the target organisation. Employees on LINKEDIN: Identifying employee names on LinkedIn can help you build a username list when it comes to password spraying attack. .HTACCESS / Sensitive Files: Look for sensitive file exposure. This may indicate a server misconfiguration. Find Subdomains: Subdomain helps you expand the attack surface on the target organisation. There are numerous tools available to automate the process of subdomain enumeration. Find Sub-Subdomains: Identify sub-sub domains on the target organisation using Google Dork, Find WordPress related exposure: WordPress related exposure helps you gain access to sensitive files and folders. BitBucket & Atlassian: Source code leakage, hardcoded credentials and access to cloud infrastructure. PassiveTotal: PassiveTotal is a great tool to perform threat investigation. Using BigBountyRecon we will use PassiveTotal to identify subdomains on the target information. Stackoverflow: Source code exposure or any technology-specific questions mentioned on the Stackoverflow. Find WordPress related exposure using Wayback Machine: Look for archieved WordPress files using WaybackMachine. GitHub: Quickly look for sensitive information on the GitHub. OpenBugBounty: Look for publicly exposed security issues on the OpenBugBounty website. Reddit: Information about the particular organisation on the Reddit platform. Crossdomain.xml: Look for misconfigured crossdomain.xml files on the target organisation. ThreatCrowd: Search engine for threats, however, we are going to use this to identify additional sub-domains. .git Folder: Source code exposure. it’s possible to download the entire repository content if accessible. YouTube: Look for any recent news on Youtube. Digitalocean Spaces: Spaces is an S3-compatible object storage service that lets you store and serve large amounts of data. We will look for any data exposures. .SWF File (Google): Flash is dead. We are going to use Google Dorks to look for older versions of flash .swf’s which contain vulnerabilities. .SWF File (Yandex): Flash is dead. We are going to use Yandex to look for older versions of flash .swf’s which contain vulnerabilities. .SWF File (Wayback Machine): Flash is dead. We are going to use WaybackMachine to look for older versions of flash .swf’s which contain vulnerabilities. Wayback Machine: Look for archived files to access old files. Reverse IP Lookup: Reverse IP Lookup lets you discover all the domain names hosted on any given IP address. This will help you to explore the attack surface for a target organisation. Traefik: Look for an open-source Edge Router for an unauthenticated interface which exposes internal services. Cloud Storage and Buckets: Google CSE for various cloud storages – aws, digitalocean, backblaze, wasabi, rackspace, dropbox, ibm, azure, dreamhost, linode, gcp, box, mailru s3 Buckets: Open s3 buckets. PublicWWW: Source code search engine indexes the content of over 200 million web sites and provides a query interface that lets the caller find any alphanumeric snippet, signature or keyword in the web pages ‘HTML’, ‘JavaScript’ and ‘CSS’ style sheet code. Censys (IPv4, Domains & Certs): Search engine for finding internet devices. We will use this to look for additional sub-domains using various endpoints on Censys. Shodan: Search engine for Internet-connected devices SharePoint RCE: Look for CVE-2020-0646 SharePoint RCE related endpoint. API Endpoints: Find WSDL files. Gist Searches: Quickly look for sensitive information on the Gist pastes. CT Logs: Certificate Transparency (CT) is an Internet security standard and open-source framework for monitoring and auditing digital certificates. We will use to look for additional sub-domains for a targeted organisation. Password Leak: Look for plaintext passwords of internal employees exposed in various leaks. What CMS: Identify the version and type of CMS used by a target organisation for targeted enumeration and [hide][Hidden Content]]
  2. itsMe

    Downloader v0.1

    [hide][Hidden Content]]
  3. [hide][Hidden Content]]
  4. itsMe

    Ashwatthama Botnet v0.1 (beta)

    Ashwatthama botnet work over http use github and serveo and ngrok no portforwarding needed version >>> 0.1 (beta) last update >>> 2020-07-03 [hide][Hidden Content]]
  5. # blackhole-ransomware blackhole is a ransomware coded in c# Its only for educational purposes I will not be responsible for anything. [hide][Hidden Content]]
  6. GDBFrontend is an easy, flexible and extensionable gui debugger. Changelog v0.1 beta Added –plugins-dir option. Added –workdir option. Added random ports option. [HIDE][Hidden Content]]
  7. itsMe

    Crypt0r v0.1 [Source]

    Crypt0r is an PE crypter coded in both Delphi 7 and C++. Coded by wrh1d3 Main features: - CryptoGear encryption cipher (by Viotto, [Hidden Content]); - Stub installation and registry startup; - Error message box display; - PE assembly cloner (verpatch); - Icon changer; - Stub size pumper; - Small stub size (17 KB); - Stub compression (UPX). Dependencies (source code): - Borland Delphi 7 IDE for GUI - Dev-C++ 5.11 IDE for Console and Stub [HIDE][Hidden Content]]
  8. [HIDE][Hidden Content]]
  9. [HIDE][Hidden Content]]
  10. [HIDE][Hidden Content]]
  11. [HIDE][Hidden Content]]
  12. [HIDE][Hidden Content]]
  13. [HIDE][Hidden Content]]
  14. This tool will convert any .net exe to vbs [HIDE][Hidden Content]] [Hidden Content]
  15. itsMe

    Multi-Downloader v0.1

    Download any file from URL and run it, you can select VBS JS AUTOIT LNK C# Bypassed WD for now [HIDE][Hidden Content]] [Hidden Content]
  16. itsMe

    Tidal Checker V0.1

    [HIDE][Hidden Content]]
  17. Send Token via Email Gets discord token form ldb files c# [HIDE][Hidden Content]]
  18. Log: ===========HMA=========== COMBO: [email protected]:veczq123 CORREO: [email protected] CONTRASEÑA: veczq123 LICENCE KEY: UFH5JE-MSWMD2-4FC85J AUTO RENEW: true DATA: 1 user, 6 months [HIDE][Hidden Content]]
  19. Checker on balance. Saving The Bad's You can write any host. Base login:pass [HIDE][Hidden Content]] Use Tor as a proxy for brute After the launch, a text writer with IP:PORT will appear. data - tor browser itself, if that you can update yourself! But first set up: Write how much proxy you need. 1 proxy holds exactly 20 streams! That's why you don't need to make 100 proxies if you're a brute in 100 threads. [HIDE][Hidden Content]]
  20. [HIDE][Hidden Content]]
  21. [HIDE][Hidden Content]]
  22. [HIDE][Hidden Content]]
  23. [HIDE][Hidden Content]]
  24. [Hidden Content]