Last updated: September 26, 2018 | 24,058 views
Intercepter-NG is a multi functional network toolkit including an Android app for hacking, the main purpose is to recover interesting data from the network stream and perform different kinds of MiTM attacks.
Specifically referring to Intercepter-NG Console Edition which works on a range of systems including NT, Linux, BSD, MacOSX, IOS and Android.
The Windows version is the one with the most powerful feature-set, but the Android app is fairly handy too.
Intercepter-NG – Android App For Hacking Features
- Sniffing passwords or hashes of the types: ICQ, IRC, AIM, FTP, IMAP, POP3, SMTP, LDAP, BNC, SOCKS, HTTP, WWW, NNTP, CVS, TELNET, MRA, DC++, VNC, MYSQL, ORACLE, NTLM, KRB5, RADIUS
- Sniffing chat messages of: ICQ, AIM, JABBER, YAHOO, MSN, IRC, MRA
- Reconstructing files from: HTTP, FTP, IMAP, POP3, SMTP, SMB
- Promiscuous-mode, ARP, DHCP, Gateway, Port, Smart Scanning
- Capturing packets and post-capture (offline) analyzing, RAW Mode
- Remote traffic capturing via RPCAP daemon and PCAP Over IP
- NAT, SOCKS, DHCP
- ARP, DNS over ICMP, DHCP, SSL, SSLSTRIP, WPAD, SMB Relay, SSH MiTM
- SMB Hijack, LDAP Relay, MySQL LOAD DATA Injection
- ARP Watch, ARP Cage, HTTP Injection, Heartbleed exploit, Kerberos Downgrade, Cookie Killer
- DNS, NBNS, LLMNR Spoofing
Works on Windows NT based systems (2K\XP\2k3\Vista\7\8).
Other Android Hacking Apps include:
– Hijacker – Reaver For Android Wifi Hacker App
– BootStomp – Find Android Bootloader Vulnerabilities
You can download Intercepter-NG here:
Windows:
|
|
https://github.com/intercepter-ng/mirror/raw/master/Intercepter-NG.v1.0.zip |
Android:
|
|
https://github.com/intercepter-ng/mirror/raw/master/Intercepter-NG.2.0.apk |
Or read more at sniff.su
Posted in: Hacking Tools
Latest Posts:
SecLists – Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place.
April 30, 2019 - 222 Shares
DeepSound – Audio Steganography Tool
DeepSound is an audio steganography tool and audio converter that hides secret data into audio files, the application also enables you to extract from files. March 5, 2019 - 507 Shares
What are the MOST Critical Web Vulnerabilities in 2019?
So what is wild on the web this year? Need to know about the most critical web vulnerabilities in 2019 to protect your organization? February 27, 2019 - 230 Shares
GoBuster – Directory/File & DNS Busting Tool in Go
GoBuster is a tool used to brute-force URIs (directories and files) in web sites and DNS subdomains (inc. wildcards) - a directory/file & DNS busting tool. February 25, 2019 - 244 Shares
BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy
BDFProxy allows you to patch binaries via MiTM with The Backdoor Factory combined with mitmproxy enabling on the fly patching of binary downloads February 4, 2019 - 292 Shares
Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains. January 20, 2019 - 245 Shares
Last updated: August 20, 2018 | 5,982 views
dcipher is a JavaScript-based online hash cracking tool to decipher hashes using online rainbow & lookup table attack services.
The capacity to programmatically crack passwords is also a function of the number of possible passwords per second which can be checked. If a hash of the target password is available to the attacker, this number can be in the billions or trillions per second, since an offline attack is possible.
In this case dcipher uses online hash checking services, which have extremely large Rainbow Table sets of pre-computed hashes, to rapidly find hash collisions.
Usage for dcipher Online Hash Cracking Tool
|
|
const dcipher = require('dcipher'); dcipher('21232f297a57a5a743894a0e4a801fc3').then(plaintext => { console.log(plaintext); //=> 'admin' }); dcipher('8843d7f92416211de9ebb963ff4ce28125932878').then(plaintext => { console.log(plaintext); //=> 'foobar' }); dcipher('dW5pY29ybg==').then(plaintext => { console.log(plaintext); //=> 'unicorn' }); |
Supported Hashes for dcipher online hash cracking
- Base64
- MD5
- SHA1
- SHA224
- SHA256
- SHA384
- SHA512
- RIPEMD320
Of course there’s plenty of options when it comes to hash cracking:
– hashcat Download – Password Hash Cracking Tool
– IGHASHGPU – GPU Based Hash Cracking – SHA1, MD5 & MD4
– crack.pl – SHA1 & MD5 Hash Cracking Tool
You can download dcipher here:
dcipher-master.zip
Or read more here.
Posted in: Hacking Tools
Latest Posts:
SecLists – Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place.
April 30, 2019 - 222 Shares
DeepSound – Audio Steganography Tool
DeepSound is an audio steganography tool and audio converter that hides secret data into audio files, the application also enables you to extract from files. March 5, 2019 - 507 Shares
What are the MOST Critical Web Vulnerabilities in 2019?
So what is wild on the web this year? Need to know about the most critical web vulnerabilities in 2019 to protect your organization? February 27, 2019 - 230 Shares
GoBuster – Directory/File & DNS Busting Tool in Go
GoBuster is a tool used to brute-force URIs (directories and files) in web sites and DNS subdomains (inc. wildcards) - a directory/file & DNS busting tool. February 25, 2019 - 244 Shares
BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy
BDFProxy allows you to patch binaries via MiTM with The Backdoor Factory combined with mitmproxy enabling on the fly patching of binary downloads February 4, 2019 - 292 Shares
Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains. January 20, 2019 - 245 Shares
Last updated: August 12, 2018 | 10,842 views
HTTP is ubiquitous now with pretty much everything being powered by an API, a web application or some kind of cloud-based HTTP driven infrastructure. With that HTTP Security becomes paramount and to secure HTTP you have to understand it.
HTTP is the protocol that powers the web and to penetrate via a web service it pays to have a good solid foundational understanding of HTTP, how it works and the common response codes – many of which can lead to some kind of vulnerability which is exploitable.
The Hypertext Transfer Protocol (HTTP) is an application protocol for distributed, collaborative, and hypermedia information systems.[1] HTTP is the foundation of data communication for the World Wide Web.
Hypertext is structured text that uses logical links (hyperlinks) between nodes containing text. HTTP is the protocol to exchange or transfer hypertext.
Development of HTTP was initiated by Tim Berners-Lee at CERN in 1989. Standards development of HTTP was coordinated by the Internet Engineering Task Force (IETF) and the World Wide Web Consortium (W3C), culminating in the publication of a series of Requests for Comments (RFCs). The first definition of HTTP/1.1, the version of HTTP in common use, occurred in RFC 2068 in 1997, although this was made obsolete by RFC 2616 in 1999 and then again by the RFC 7230 family of RFCs in 2014.
Source: Wikipedia
From a security perspective it’s important to understand:
– Requests
– Request methods
– Responses
– Response status codes
All of which are covered in the Security-focused HTTP article by Acunetix.
You can find the article with the full details here:
HTTP Security: A Security-focused Introduction to HTTP, Part 1
Posted in: Countermeasures
Latest Posts:
SecLists – Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place.
April 30, 2019 - 222 Shares
DeepSound – Audio Steganography Tool
DeepSound is an audio steganography tool and audio converter that hides secret data into audio files, the application also enables you to extract from files. March 5, 2019 - 507 Shares
What are the MOST Critical Web Vulnerabilities in 2019?
So what is wild on the web this year? Need to know about the most critical web vulnerabilities in 2019 to protect your organization? February 27, 2019 - 230 Shares
GoBuster – Directory/File & DNS Busting Tool in Go
GoBuster is a tool used to brute-force URIs (directories and files) in web sites and DNS subdomains (inc. wildcards) - a directory/file & DNS busting tool. February 25, 2019 - 244 Shares
BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy
BDFProxy allows you to patch binaries via MiTM with The Backdoor Factory combined with mitmproxy enabling on the fly patching of binary downloads February 4, 2019 - 292 Shares
Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains. January 20, 2019 - 245 Shares
Last updated: August 6, 2018 | 4,496 views
Cangibrina is a Python-based multi platform admin dashboard finder tool which aims to obtain the location of website dashboards by using brute-force, wordlists, Google, Nmap and robots.txt.
It is multi-threaded, supports modifying your user agent, using a TOR proxy, custom dorks, Nmap integration and can use both DuckDuckGo and Google.
Cangibrina Admin Dashboard Finder Requirements
- Python 2.7
- mechanize
- PySocks
- beautifulsoup4
- html5lib
- Nmap
- TOR
Cangibrina Usage to Find Admin Dashboards
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
usage: cangibrina.py [-h] -u U [-w W] [-t T] [-v] [--ext EXT] [--user-agent] [--tor] [--search] [--dork DORK] [--nmap [NMAP]] Fast and powerful admin finder optional arguments: -h, --help show this help message and exit -u U target site -w W set wordlist (default: wl_medium) -t T set threads number (default: 5) -v enable verbose --ext EXT filter path by target extension --user-agent modify user-agent --sub-domain search for sub domains instead of directories --tor set TOR proxy --search use google and duckduckgo to search --dork DORK set custom dork --nmap [NMAP] use nmap to scan ports and services |
There are other specific tools in this area like WPScan for WordPress and DruPwn for Drupal – and in those cases the dashboard URLs are already known.
You can download Cangibrina here:
cangibrina-master.zip
Or read more here.
Posted in: Hacking Tools
Latest Posts:
SecLists – Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place.
April 30, 2019 - 222 Shares
DeepSound – Audio Steganography Tool
DeepSound is an audio steganography tool and audio converter that hides secret data into audio files, the application also enables you to extract from files. March 5, 2019 - 507 Shares
What are the MOST Critical Web Vulnerabilities in 2019?
So what is wild on the web this year? Need to know about the most critical web vulnerabilities in 2019 to protect your organization? February 27, 2019 - 230 Shares
GoBuster – Directory/File & DNS Busting Tool in Go
GoBuster is a tool used to brute-force URIs (directories and files) in web sites and DNS subdomains (inc. wildcards) - a directory/file & DNS busting tool. February 25, 2019 - 244 Shares
BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy
BDFProxy allows you to patch binaries via MiTM with The Backdoor Factory combined with mitmproxy enabling on the fly patching of binary downloads February 4, 2019 - 292 Shares
Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains. January 20, 2019 - 245 Shares
