The Facebook CTF is a platform to host Jeopardy and “King of the Hill” style Capture the Flag competitions. How do I use FBCTF? Organize a competition. This can be with as few as two participants, all the way up to several hundred. The participants can be physically present, active…
-
-
Weeman v1.7 – HTTP Server for Phishing
HTTP server for phishing in python. (and framework) Usually you will want to run Weeman with DNS spoof attack. (see dsniff, ettercap). Press 1.7 – is out 25-03-2016 Added profiles Weeman framework 0.1 is out !!! Added command line options. Beautifulsoup dependency removed. Weeman will do the following steps: Create…
-
SQLMap – Automatic SQL Injection And Database Takeover Tool
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting,…
-
VBScan – a Black Box vBulletin Vulnerability Scanner
VBScan is an opensource project in perl programming language to detect VBulletin CMS vulnerabilities and analyses them Why VBScan ? If you want to do a penetration test on a vBulletin Forum, VBScan is Your best shot ever! This Project is being faster than ever and updated with the latest…
-
Bluto – DNS Recon, DNS Zone Transfer, and Email Enumeration
BLUTO DNS recon | Brute forcer | DNS Zone Transfer | Email Enumeration The target domain is queried for MX and NS records. Sub-domains are passively gathered via NetCraft. The target domain NS records are each queried for potential Zone Transfers. If none of them gives up their spinach, Bluto…
-
WordPress XML RPC Brute Force Exploit by 1N3
WordPress XML-RPC Brute Force Amplification PoC by 1N3, this is a small PoC exploit to launch a brute force amplification attack on affected WordPress sites. USAGE: ./wp-xml-brute http://target.com/xmlrpc.php passwords.txt #!/usr/bin/python # WordPress XML-RPC Brute Force Amplification PoC by 1N3 # Last Updated: 20151018 # https://crowdshield.com # # ABOUT: This exploit…
-
B374K – PHP Webshell with handy features
This PHP Shell is a useful tool for system or web administrator to do remote management without using cpanel, connecting using ssh, ftp etc. All actions take place within a web browser. Features : File manager (view, edit, rename, delete, upload, download, archiver, etc) Search file, file content, folder…
-
Weeman – HTTP Server for Phishing
Weeman – HTTP server for phishing in python. Weeman has support for most of the (bigest) websites. Usually you will want run Weeman with DNS spoof attack. (see dsniff, ettercap). Weeman will do the following steps: Create fake html page. Wait for clients Grab the data (POST). Try to login…
-
WPHardening – Fortify the security of any WordPress Installation
Installation: Installing WPHardening requires you to execute one console command: $ pip install -r requirements.txt Usage: $ python wphardening.py -h __ _______ _ _ _ _ \ \ / / __ \| | | | | | (_) \ \ /\ / /| |__) | |__| | __ _ _…
-
Weevely3 – Weaponized PHP Web Shell
Weevely is a command line web shell dynamically extended over the network at runtime designed for remote administration and pen testing. It provides a weaponized telnet-like console through a PHP script running on the target, even in restricted environments. The low footprint agent and over 30 modules shape an extensible…