audit – MrHacker

Password Attacks

Jan 10, 2021

Solarflare – SolarWinds Orion Account Audit / Password Dumping Utility

Credential Dumping Tool for SolarWinds Orion Blog post: https://malicious.link/post/2020/solarflare-release-password-dumper-for-solarwinds-orion/ Credit to @asolino, @gentilkiwi, and @skelsec for helping me figuring out DPAPI. ============================================ | Collecting RabbitMQ Erlang Cookie | Erlang Cookie: abcdefg12456789abcde ============================================ | Collecting SolarWinds Certificate | SolarWinds Orion Certificate Found! | Subject Name: CN=SolarWinds-Orion | Thumbprint : BE85C6C3AACA8840E166187B6AB8C6BA9DA8DE80 | Password : alcvabkajp4 | […]

root

System Administration

Dec 30, 2020

Wynis – Audit Windows Security With Best Practice

Just a powershell scripts for auditing security with CIS BEST Practices Windows 10 and Window Server 2016 You just need to run the script, it will create a directory named : AUDIT_CONF_%DATE% The directory output will contain the files belows: -Antivirus-%COMPUTERNAME% : List installed Antivirus software -APPDATA%COMPUTERNAME% : List all […]

root

Security Tools

Jun 30, 2018

Firecall – Automate SSH Communication With Firewalls, Switches, Etc.

Automate SSH communication with firewalls, switches, etc. Description These scripts are designed to automate sending commands to a Cisco ASA firewall. The intended purpose here is to eliminate the need to manually log in to a firewall to make changes. This code can be run directly via command line or it can be incorporated into […]

root

Video Tutorials

Feb 03, 2018

WPSploit – WordPress Plugin Code Scanner – Kali Linux 2017.3

WPSploit is intended for Penetration Testers who audit WordPress plugins or developers who wish to audit their own WordPress plugins. It checks for: Cross-Site Scripting (XSS) SQL Injection File Download File Inclusion File Manipulation Command Execution PHP Code Execution Authorisation Open Redirect Cross-Site Request Forgery (CSRF) SSL/TLS Usage $ git clone https://github.com/m4ll0k/wpsploit.git $ cd wpsploit […]

root

Dec 02, 2017

Bucket Stream – Find interesting Amazon S3 Buckets by watching certificate transparency logs

Some quick tips if you use S3 buckets: Randomise your bucket names! There is no need to use company-backup.s3.amazonaws.com. Set appropriate permissions and audit regularly. If possible create two buckets – one for your public assets and another for private data. Be mindful about your data. What are suppliers, contractors and third parties doing with […]

root

Security Tools

Dec 02, 2017

WPSploit – WordPress Plugin Code Scanner

This tool is intended for Penetration Testers who audit WordPress plugins or developers who wish to audit their own WordPress plugins. For more info click here. Usage $ git clone https://github.com/m4ll0k/wpsploit.git $ cd wpsploit $ python wpsploit.py plugin_file.php or $ wget https://raw.githubusercontent.com/m4ll0k/wp_sploit/master/wpsploit.py $ python wpsploit.py plugin_file.php Example $ wget https://plugins.svn.wordpress.org/analytics-for-woocommerce-by-customerio/trunk/admin/class-wccustomerio-admin.php $ python wpsploit.py class-wccustomerio-admin.php Download […]

root