XAttacker - Website Vulnerability Scanner & Auto Exploiter

XAttacker is a Website Vulnerability Scanner & Auto Exploiter developed by Mohamed Riahi

Installation

git clone https://github.com/Moham3dRiahi/XAttacker.git

Auto Cms Detect

• [1] WordPress :
• [+] Adblock Blocker
• [+] WP All Import
• [+] Blaze
• [+] Catpro
• [+] Cherry Plugin
• [+] Download Manager
• [+] Formcraft
• [+] levoslideshow
• [+] Power Zoomer
• [+] Gravity Forms
• [+] Revslider Upload Shell
• [+] Revslider Dafece Ajax
• [+] Revslider Get Config
• [+] Showbiz
• [+] Simple Ads Manager
• [+] Slide Show Pro
• [+] WP Mobile Detector
• [+] Wysija
• [+] InBoundio Marketing
• [+] dzs-zoomsounds
• [+] Reflex Gallery
• [+] Creative Contact Form
• [+] Work The Flow File Upload
• [+] WP Job Manger
• [+] PHP Event Calendar
• [+] Synoptic
• [+] Wp Shop
• [+] Content Injection
• [2] Joomla
• [+] Com Jce
• [+] Com Media
• [+] Com Jdownloads
• [+] Com Fabrik
• [+] Com Jdownloads Index
• [+] Com Foxcontact
• [+] Com Ads Manager
• [+] Com Blog
• [+] Com Users
• [+] Com Weblinks
• [+] mod_simplefileupload
• [3] DruPal
• [+] Add Admin
• [4] PrestaShop
• [+] columnadverts
• [+] soopamobile
• [+] soopabanners
• [+] Vtermslideshow
• [+] simpleslideshow
• [+] productpageadverts
• [+] homepageadvertise
• [+] homepageadvertise2
• [+] jro_homepageadvertise
• [+] attributewizardpro
• [+] 1attributewizardpro
• [+] AttributewizardproOLD
• [+] attributewizardpro_x
• [+] advancedslider
• [+] cartabandonmentpro
• [+] cartabandonmentproOld
• [+] videostab
• [+] wg24themeadministration
• [+] fieldvmegamenu
• [+] wdoptionpanel
• [+] pk_flexmenu
• [+] pk_vertflexmenu
• [+] nvn_export_orders
• [+] megamenu
• [+] tdpsthemeoptionpanel
• [+] psmodthemeoptionpanel
• [+] masseditproduct
• [5] Lokomedia
• SQL injection

Video

Usage

Short Form	Long Form	Description
-l	--list	websites list

Example
if you have list websites run tool with this command line

perl XAttacker.pl -l list.txt

if you don't have list websites run the tool with this command

perl XAttacker.pl

For coloring in windows Add This Line

use Win32::Console::ANSI;

Version
Current version is 2.1 What's New 
• Wordpress Levo-Slideshow 2.3 - Arbitrary File Upload
• GS-Dorker
• speed up
• Bug fixes
version 2.0 
• speed up
• Bug fixes
version 1.9
• Bug fixes

Download XAttacker

Read More

BruteSpray v1.6.0 - Brute-Forcing from Nmap output (Automatically attempts default creds on found services)

BruteSpray takes nmap GNMAP/XML output and automatically brute-forces services with default credentials using Medusa. BruteSpray can even find non-standard ports by using the -sV inside Nmap.

Installation

pip install -r requirements.txt

On Kali:

apt-get install brutespray

Usage
First do an nmap scan with -oG nmap.gnmap or -oX nmap.xml.

Command: 

python brutespray.py -h

Command:

python brutespray.py --file nmap.gnmap

Command:

python brutesrpay.py --file nmap.xml

Command:

python brutespray.py --file nmap.xml -i

Examples

Using Custom Wordlists:

python brutespray.py --file nmap.gnmap -U /usr/share/wordlist/user.txt -P /usr/share/wordlist/pass.txt --threads 5 --hosts 5

Brute-Forcing Specific Services:

python brutespray.py --file nmap.gnmap --service ftp,ssh,telnet --threads 5 --hosts 5

Specific Credentials:

python brutespray.py --file nmap.gnmap -u admin -p password --threads 5 --hosts 5

Continue After Success:

python brutespray.py --file nmap.gnmap --threads 5 --hosts 5 -c

Use Nmap XML Output

python brutespray.py --file nmap.xml --threads 5 --hosts 5

Interactive Mode

python brutespray.py --file nmap.xml -i

Supported Services

• ssh
• ftp
• telnet
• vnc
• mssql
• mysql
• postgresql
• rsh
• imap
• nntp
• pcanywhere
• pop3
• rexec
• rlogin
• smbnt
• smtp
• svn
• vmauthd
• snmp

Video

Changelog

• v1.6.0
  • added support for SNMP
• v1.5.3
  • adjustments to wordlists
• v1.5.2
  • change tmp and output directory behavior
• v1.5.1
  • added check for no services
• v1.5
  • added interactive mode
• v1.4
  • added ability to use nmap XML
• v1.3
  • added the ability to stop on success
  • added the ability to reference custom userlists and passlists
  • added the ability to specify specific users & passwords

Download BruteSpray

Read More

PiKarma - Detects Wireless Network Attacks

Detects wireless network attacks performed by KARMA module (fake AP). Starts deauthentication attack (for fake access points)

Working Principle for PiKarma

• Collects all the packets from Wireless Network. (Probe Response)
• Analyses all the packets in real time.
• If PiKarma finds more than one SSID info from unique mac address in Probe Response;
• Logs the activity with some extra information within defined template and sends deauthentication packets

How works KARMA Attack?

• Sends Probe Response for all Probe Requests

Example:

Softwares and hardwares that uses KARMA module

• FruityWifi
• WiFi Pineapple
• Mana (improvements to KARMA attacks)
• ..

Soon to be added features

• New techniques for KARMA and MANA attacks

DEMO

Download PiKarma

Read More

Fsociety Hacking Tools Pack

A Penetration Testing Framework , you will have evry script that a hacker needs

Menu

• Information Gathering
• Password Attacks
• Wireless Testing
• Exploitation Tools
• Sniffing & Spoofing
• Web Hacking
• Private Web Hacking
• Post Exploitation
• INSTALL & UPDATE

Information Gathering :

• Nmap
• Setoolkit
• Port Scanning
• Host To IP
• wordpress user
• CMS scanner
• XSStracer
• Dork - Google Dorks Passive Vulnerability Auditor
• Scan A server's Users

Password Attacks :

• Cupp
• Ncrack

Wireless Testing :

• reaver
• pixiewps

Exploitation Tools :

• Venom
• sqlmap
• Shellnoob
• commix
• FTP Auto Bypass
• jboss-autopwn

Sniffing & Spoofing :

• Setoolkit
• SSLtrip
• pyPISHER
• SMTP Mailer

Web Hacking :

• Drupal Hacking
• Inurlbr
• Wordpress & Joomla Scanner
• Gravity Form Scanner
• File Upload Checker
• Wordpress Exploit Scanner
• Wordpress Plugins Scanner
• Shell and Directory Finder
• Joomla! 1.5 - 3.4.5 remote code execution
• Vbulletin 5.X remote code execution
• BruteX - Automatically brute force all services running on a target
• Arachni - Web Application Security Scanner Framework

Private Web Hacking

• Get all websites
• Get joomla websites
• Get wordpress websites
• Control Panel Finder
• Zip Files Finder
• Upload File Finder
• Get server users
• SQli Scanner
• Ports Scan (range of ports)
• ports Scan (common ports)
• Get server Info
• Bypass Cloudflare

Post Exploitation

• Shell Checker
• POET
• Phishing Framework

Install Me

• Install Directly On System (Only For Linux & Mac System )
• Update instantly When There are New Update

Installation Linux
[✓] git clone https://github.com/Manisso/fsociety.git
[✓] cd fsociety && python fsociety.py
[◉] 0 : INSTALL & UPDATE
[◉] -> 0
[✓] press 0
[✓] Congratulation Fsociety is Installed !

Installation Windows
[✔] Download python 2.7
[✓] Download fsociety
[✓] Extract fsociety into Desktop
[◉]Open CMD and type the following commands:
[✓] $cd Desktop/fsociety-master/
[✓] $python fsociety.py

Use

Download Fsociety

Read More

Crack MD5, SHA1, MySQL, NTLM Free Online!

Hace algún tiempo salió InsidePro Hash Finder un buscador de hashes másivo, gratuito y online donde se pueden encontrar hasta 25 mil hashes de una tanda. Detecta automáticamente el hash que buscas y encuentra la mayoría de las veces el password. Soporta más de 100 algoritmo, entre ellos:

• MD5
• SHA-1
• MySQL
• NTLM
• vbulliten
• oscommerce
• Invision Power Board
• Joomla
• MyBB
• SMF
• MaNGOS
• LM
• md4
• md5(md5_hex)
• md5-half
• sha224
• sha256
• sha384
• sha512
• ripeMD160
• whirlpool
• MySQL 4.1+ (sha1(sha1_bin))
• md5(md5($salt).md5($pass))  
• etc...

InsidePro Hash Finder

Otras alternativas son:

• https://crackstation.net/
• https://md5db.net/decrypt
• https://hashkiller.co.uk/md5-decrypter.aspx

Read More