Pular para o conteúdo principal

Postagens

Mostrando postagens de 2017

MKBRUTUS – Brute Force para MikroTik e dispositivos com RouterOS

O MKBRUTUS é uma ferramenta desenvolvida em Python 3 que realiza ataques de força bruta em sistemas (baseados em dicionário) contra RouterOS (ver. 3.x ou superior), que têm a porta 8728/TCP aberto. O MKBRUTUS é uma ferramenta desenvolvida em Python 3 que realiza ataques de força bruta em sistemas (baseados em dicionário) contra RouterOS (ver. 3.x ou superior), que têm a porta 8728/TCP aberto. Desenvolvedores: Ramiro Caire  | ramiro.caire@gmail.com | Twitter: @rcaire Federico Massa | fgmassa@vanguardsec.com | Twitter: @fgmassa Projeto:   github.com/mkbrutusproject/mkbrutus 01 Passo Verifique a versão atual do python em seguida realiza a instalação da versão 3 root@kali:~# python –version (Exibe a versão do Python) root@kali:~# apt-get install python3 (Realiza a instalação do Python 3) 02 Passo Execute o comando de verificação da versão do Python novamente e observe que a versão não mudou mas a instalação da versão 3 foi realizada com suce

SMB Zero-Day vulnerability in Windows 8.1/10/Server

The United States Computer Emergency Readiness Team (US-CERT) has releases an official Advisory yesterday. Microsoft Windows contains a memory corruption bug in the handling of SMB traffic, which may allow a remote, unauthenticated attacker to cause a denial of service or potentially execute arbitrary code on a vulnerable system. Microsoft Windows fails to properly handle traffic from a malicious server. In particular, Windows fails to properly handle a server response that contains too many bytes following the structure defined in the SMB2 TREE_CONNECT Response structure. By connecting to a malicious SMB server, a vulnerable Windows client system may crash (BSOD) in mrxsmb20.sys. In short – some Windows versions (clients an servers) contains a memory corruption bug in the code to handle SMB data traffic. The bug is contained within the kernel file mrxsmb20.sys. US-CERT writes, that the bug may be used by unauthenticated attacker to cause a denial of service (aka B

python_gdork_sqli: Automatically Finding and Exploiting SQL injection

Find SQL injections This python script is developed to show, how many vulnerables websites, which are laying around on the web. The main focus of the script is to generate a list of vuln urls. Please use the script with causing and alert the webadmins of vulnerable pages. The SQLmap implementation is just for showcasing. Installing git clone https://github.com/ThomasTJdev/python_gdork_sqli.git apt-get install python3-dev python3-pip pip3 install bs4 psutil cd python_gdork_sqli python3 findsqlinj.py Usage On section 1: In this section you’ll have to provide a search string, which ‘connects’ to the websites database, e.g. ‘php?id=’. The script then crawls Bing or Google for urls containing it. All of the urls can then be saved into a file. (Please be aware that you might get banned for crawling to fast, remember an appropriate break/sleep between request). Example of searchs: php?bookid=, php?idproduct=, php?bookid=, php?catid=, php?action=, php?cart_id=, php?title=, php?item