Mosca is a manual static analysis tool written in C designed to find bugs in the code before it is compiled, much like a grep unix command.
There are various ‘egg’ modules which contain patterns to scan for, it can scan through files recursively limited by file extension and logs results to an XML text file.
It’s also fairly easy to extend and add your own modules/eggs/languages.
Manual Static Analysis Tool Language Support
Languages it can scan for vulnerabilities are:
You can download Mosca here:
Or read more here.
Slurp is a blackbox/whitebox S3 bucket enumerator written in Go that can use a permutations list to scan from an external perspective or an AWS API to scan internally.
There are two modes that this tool operates at; blackbox and whitebox mode. Whitebox mode (or internal) is significantly faster than blackbox (external) mode.
In this mode, you are using the permutations list to conduct scans. It will return false positives and there is NO WAY to link the buckets to an actual AWS account.
In this mode, you are using the AWS API with credentials on a specific account that you own to see what is open. This method pulls all S3 buckets and checks Policy/ACL permissions. Your credentials should be in
Slurp – Amazon AWS S3 Bucket Enumerator Features
The main features of Slurp are:
- Scan via domain(s); you can target a single domain or a list of domains
- Scan via keyword(s); you can target a single keyword or a list of keywords
- Scan via AWS credentials; you can target your own AWS account to see which buckets have been exposed
- Colorized output for visual grep
- Currently generates over 28,000 permutations per domain and keyword
- Punycode support for internationalized domains
Usage of Slurp S3 Bucket Enumerator
Will enumerate the S3 domains for a specific target:
slurp domain <-t|--target> example.com
Will enumerate S3 buckets based on those 3 key words (linux, golang & python):
slurp keyword <-t|--target> linux,golang,python
Will perform an internal scan using the AWS API:
You can download Slurp here:
Or you can read more here.
Surprise, surprise, surprise – an internal audit of the US Government cyber security situation has uncovered widespread weaknesses, legacy systems and poor adoption of cyber controls and tooling.
US Government security has often been called into question but we’d hope in 2019 it would have gotten better and at least everyone would have adopted the anti-virus solution introduced in 2013..
A committee report (PDF) examining a decade of internal audits this week concluded that outdated systems, unpatched software, and weak data protection are so widespread that it’s clear American bureaucrats fail to meet even basic security requirements.
To produce this damning dossiers, the Senate’s Permanent Subcommittee on Investigations pored over a decade of findings from inspector-general-led probes into information security practices within the Department of Homeland Security, State Department, Department of Transportation, Department of Housing and Urban Development, Department of Agriculture, Department of Health and Human Services, Department of Education, and the Social Security Administration.
Of those eight organizations, seven were found to be unable to adequately protect personally identifiable information stored on their systems, six were unable to properly patch their systems against security threats, five were in violation of IT asset inventory-keeping requirements, and all eight were using either hardware or software that had been retired by the vendor and was no longer supported.
8 out of 8 agencies using end of life hardware or software that has been retired and is no longer supported – that’s pretty worrying.
Especially when one agency couldn’t account for how much of it’s $10 Billion budget was being spent on legacy systems, some having been around since 2005..
“Despite major data breaches like OPM, the federal government remains unprepared to confront the dynamic cyber threats of today,” the report noted.
“The longstanding cyber vulnerabilities consistently highlighted by Inspectors General illustrate the federal government’s failure to meet basic cybersecurity standards to protect sensitive data.”
In delivering the report, the Senate panel pointed out some of the previously reported security findings, such as a 2017 Homeland Security audit that found a malware scanning tool first introduced in 2013 was at the time only successfully running at 65 per cent of agencies. Or the 2018 inspector general finding that the department wasn’t even able to comply with its own standards for an effective security program.
And it’s not like they have a place to be complacent, the US government is a global cyber terrorism target and there have been many high visibility breaches across key government agencies.
Source: The Register
BloodHound is for hacking active directory trust relationships and it uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment.
Attackers can use BloodHound to easily identify highly complex attack paths that would otherwise be impossible to quickly identify. Defenders can use it to identify and eliminate those same attack paths. Both blue and red teams can use BloodHound to easily gain a deeper understanding of privilege relationships in an Active Directory environment.
BloodHound Hacking Active Directory Options
- CollectionMethod – The collection method to use. This parameter accepts a comma separated list of values. Has the following potential values (Default: Default):
- Default – Performs group membership collection, domain trust collection, local admin collection, and session collection
- Group – Performs group membership collection
- LocalAdmin – Performs local admin collection
- RDP – Performs Remote Desktop Users collection
- DCOM – Performs Distributed COM Users collection
- GPOLocalGroup – Performs local admin collection using Group Policy Objects
- Session – Performs session collection
- ComputerOnly – Performs local admin, RDP, DCOM and session collection
- LoggedOn – Performs privileged session collection (requires admin rights on target systems)
- Trusts – Performs domain trust enumeration
- ACL – Performs collection of ACLs
- Container – Performs collection of Containers
- ObjectProps – Collects object properties such as LastLogon and DisplayName
- DcOnly – Performs collection using LDAP only. Includes Group, Trusts, ACL, ObjectProps, Container, and GPOLocalGroup.
- All – Performs all Collection Methods except GPOLocalGroup
- SearchForest – Search all the domains in the forest instead of just your current one
- Domain – Search a particular domain. Uses your current domain if null (Default: null)
- Stealth – Performs stealth collection methods. All stealth options are single threaded.
- SkipGCDeconfliction – Skip Global Catalog deconfliction during session enumeration. This can speed up enumeration, but will result in possible inaccuracies in data.
- ExcludeDc – Excludes domain controllers from enumeration (avoids Microsoft ATA flags :) )
- ComputerFile – Specify a file to load computer names/IPs from
- OU – Specify which OU to enumerate
- DomainController – Specify which Domain Controller to connect to (Default: null)
- LdapPort – Specify what port LDAP lives on (Default: 0)
- SecureLdap – Connect to AD using Secure LDAP instead of regular LDAP. Will connect to port 636 by default.
- IgnoreLdapCert – Ignores LDAP SSL certificate. Use if there’s a self-signed certificate for example
- LDAPUser – Username to connect to LDAP with. Requires the LDAPPass parameter as well (Default: null)
- LDAPPass – Password for the user to connect to LDAP with. Requires the LDAPUser parameter as well (Default: null)
- DisableKerbSigning – Disables LDAP encryption. Not recommended.
- Threads – Specify the number of threads to use (Default: 10)
- PingTimeout – Specifies the timeout for ping requests in milliseconds (Default: 250)
- SkipPing – Instructs Sharphound to skip ping requests to see if systems are up
- LoopDelay – The number of seconds in between session loops (Default: 300)
- MaxLoopTime – The amount of time to continue session looping. Format is 0d0h0m0s. Null will loop for two hours. (Default: 2h)
- Throttle – Adds a delay after each request to a computer. Value is in milliseconds (Default: 0)
- Jitter – Adds a percentage jitter to throttle. (Default: 0)
- JSONFolder – Folder in which to store JSON files (Default: .)
- JSONPrefix – Prefix to add to your JSON files (Default: “”)
- NoZip – Don’t compress JSON files to the zip file. Leaves JSON files on disk. (Default: false)
- EncryptZip – Add a randomly generated password to the zip file.
- ZipFileName – Specify the name of the zip file
- RandomFilenames – Randomize output file names
- PrettyJson – Outputs JSON with indentation on multiple lines to improve readability. Tradeoff is increased file size.
- CacheFile – Filename for the Sharphound cache. (Default: BloodHound.bin)
- NoSaveCache – Don’t save the cache file to disk. Without this flag, BloodHound.bin will be dropped to disk
- Invalidate – Invalidate the cache file and build a new cache
- StatusInterval – Interval to display progress during enumeration in milliseconds (Default: 30000)
- Verbose – Enables verbose output
You can download BloodHound here:
Or read more here.
SecLists is the security tester’s companion. It’s a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. The goal is to enable a security tester to pull this repository onto a new testing box […]
DeepSound is an audio steganography tool and audio converter that hides secret data into audio files, the application also enables you to extract secret files directly from audio files or audio CD tracks. This audio steganography tool can be used as copyright marking software for wave, flac, wma, ape, and audio CD. DeepSound also support […]