Archive | March, 2020

zBang – Privileged Account Threat Detection Tool


zBang is a risk assessment tool for Privileged Account Threat Detection on a scanned network, organizations and red teamers can utilize zBang to identify potential attack vectors and improve the security posture of the network.

zBang -  Privileged Account Threat Detection Tool


The results can be analyzed with the graphic interface or by reviewing the raw output files.

The tool is built from five different scanning modules:

  • ACLight scan – discovers the most privileged accounts that must be protected, including suspicious Shadow Admins.
  • Skeleton Key scan – discovers Domain Controllers that might be infected by Skeleton Key malware.
  • SID History scan – discovers hidden privileges in domain accounts with secondary SID (SID History attribute).
  • RiskySPNs scan – discovers risky configuration of SPNs that might lead to credential theft of Domain Admins
  • Mystique scan – discovers risky Kerberos delegation configuration in the network.

Requirements to run zBang Privileged Account Threat Detection Tool

  1. Run it with any domain user. The scans do not require any extra privileges; the tool performs read-only LDAP queries to the DC.
  2. Run the tool from a domain joined machine (a Windows machine).
  3. PowerShell version 3 or above and .NET 4.5 (it comes by default in Windows 8/2012 and above).

zBang Privileged Account Threat Detection Tool Performance

zBang runs quickly and doesn’t need any special privileges over the network. As the only communication required is to the domain controller through legitimate read-only LDAP queries, a typical execution time of zBang on a network with around 1,000 user accounts will be seven minutes.

When you intend to scan large networks with multiple trust-connected domains, it’s recommended to check the domain trusts configuration or run zBang separately from within each domain to avoid possible permission and connectivity issues.

You can download zBang here:

zBang-v1.00.exe
zBang-source-v1.00.zip

Or read more here.

Posted in: Hacking Tools

Topic: Hacking Tools


Latest Posts:


SharpHose - Asynchronous Password Spraying Tool SharpHose – Asynchronous Password Spraying Tool
SharpHose is an asynchronous password spraying tool in C# for Windows environments that takes into consideration fine-grained password policies and can be run over Cobalt Strike's execute-assembly.
Axiom - Pen-Testing Server For Collecting Bug Bounties Axiom – Pen-Testing Server For Collecting Bug Bounties
Project Axiom is a set of utilities for managing a small dynamic infrastructure setup for bug bounty, basically a pen-testing server out of the box with 1-line.
Quasar RAT - Windows Remote Administration Tool Quasar RAT – Windows Remote Administration Tool
Quasar is a fast and light-weight Windows remote administration tool coded in C#. Used for user support through day-to-day administrative work to monitoring.
Pingcastle - Active Directory Security Assessment Tool Pingcastle – Active Directory Security Assessment Tool
PingCastle is a Active Directory Security Assessment Tool designed to quickly assess the Active Directory security level based on a risk and maturity framework.
Second Order - Subdomain Takeover Scanner Tool Second Order – Subdomain Takeover Scanner Tool
Second Order Subdomain Takeover Scanner Tool scans web apps for second-order subdomain takeover by crawling the application and collecting URLs (and other data)
Binwalk - Firmware Security Analysis & Extraction Tool Binwalk – Firmware Security Analysis & Extraction Tool
Binwalk is a fast and easy to use Python-based firmware security analysis tool that allows for firmware analysis, reverse engineering & extracting of firmware.


Memhunter – Automated Memory Resident Malware Detection


Memhunter is an Automated Memory Resident Malware Detection tool for the hunting of memory resident malware at scale, improving the threat hunter analysis process and remediation times.

Memhunter - Automated Memory Resident Malware Detection


It’s a self contained binary that can be deployed and managed at scale, does not use memory dumps and relies purely on memory inspection to do its work. It also does not require any complex infrastructure to deploy.

The tool was designed as a replacement of memory forensic volatility plugins such as malfind and hollowfind. The idea of not requiring memory dumps helps on performing the memory resident malware threat hunting at scale, without manual analysis, and without the complex infrastructure needed to move dumps to forensic environments.

Memhunter in a nutshell:

  • It is an standalone binary that gets itself deployed as a windows service
  • It uses a set of memory inspection heuristics and ETW data collection to find footprints left by common injection techniques.
  • Forensic information on findings gets reported through console or event logs for forwarding

Memhunter Automated Memory Resident Malware Detection Features

The detection process is performed through a combination of endpoint data collection and memory inspection scanners. The tool is a standalone binary that, upon execution, deploys itself as a windows service. Once running as a service, memhunter starts the collection of ETW events that might indicate code injection attacks. The live stream of collected data events is feed into memory inspection scanners that use detection heuristics to down select the potential attacks. The entire detection process does not require human intervention, neither memory dumps, and it can be performed by the tool itself at scale.

  • 9 hunter heuristics included (see next slide)
  • 15 code injection techniques implemented on minjector test tool
  • ETW data collection of suspicious events used for heuristic triggering
  • Windows Event Log generation
  • Exclusion of baseline detection
  • Basic forensic information
  • Sqlite storage integration

Memhunter Automated Memory Resident Malware Detection minjector.exe

Besides the data collection and hunting heuristics, the project has also led to the creation of a companion tool called “minjector” that contains +15 code injection techniques. The minjector tool cannot only be used to exercise memhunter detections, but also as a one-stop location to learn on well-known code injection techniques out there.

You can download Memhunter here:

memhunter-master.zip

Or read more here.

Posted in: Forensics

Topic: Forensics


Latest Posts:


SharpHose - Asynchronous Password Spraying Tool SharpHose – Asynchronous Password Spraying Tool
SharpHose is an asynchronous password spraying tool in C# for Windows environments that takes into consideration fine-grained password policies and can be run over Cobalt Strike's execute-assembly.
Axiom - Pen-Testing Server For Collecting Bug Bounties Axiom – Pen-Testing Server For Collecting Bug Bounties
Project Axiom is a set of utilities for managing a small dynamic infrastructure setup for bug bounty, basically a pen-testing server out of the box with 1-line.
Quasar RAT - Windows Remote Administration Tool Quasar RAT – Windows Remote Administration Tool
Quasar is a fast and light-weight Windows remote administration tool coded in C#. Used for user support through day-to-day administrative work to monitoring.
Pingcastle - Active Directory Security Assessment Tool Pingcastle – Active Directory Security Assessment Tool
PingCastle is a Active Directory Security Assessment Tool designed to quickly assess the Active Directory security level based on a risk and maturity framework.
Second Order - Subdomain Takeover Scanner Tool Second Order – Subdomain Takeover Scanner Tool
Second Order Subdomain Takeover Scanner Tool scans web apps for second-order subdomain takeover by crawling the application and collecting URLs (and other data)
Binwalk - Firmware Security Analysis & Extraction Tool Binwalk – Firmware Security Analysis & Extraction Tool
Binwalk is a fast and easy to use Python-based firmware security analysis tool that allows for firmware analysis, reverse engineering & extracting of firmware.


Sandcastle – AWS S3 Bucket Enumeration Tool


Sandcastle is a Python-based Amazon AWS S3 Bucket Enumeration Tool, formerly known as bucketCrawler. The script takes a target’s name as the stem argument (e.g. shopify) and iterates through a file of bucket name permutations.

Sandcastle - AWS S3 Bucket Enumeration Tool


Amazon S3 [Simple Storage Service] is cloud storage for the Internet. To upload your data (photos, videos, documents etc.), you first create a bucket in one of the AWS Regions. You can then upload any number of objects to the bucket.

In terms of implementation, buckets and objects are resources, and Amazon S3 provides APIs for you to manage them.

Examples of the kinds of bucket names it would look for:

  • -training
  • -bucket
  • -dev
  • -attachments
  • -photos
  • -elasticsearch
  • […]

You can find the example bucket names file here.

Using Sandcastle – AWS S3 Bucket Enumeration Tool

Here’s how to get started:

  • Clone this repo (PyPi distribution temporarily disabled).
  • Run sandcastle.py with a target name and input file (grab an example from this repo)
  • Matching bucket permutations will be identified, and read permissions tested.

Status codes and testing for Sandcastle – AWS S3 Bucket Enumeration Tool

  • 404 – Bucket Not Found – Not a target for analysis (hidden by default)
  • 403 – Access Denied – Potential target for analysis via the CLI
  • 200 – Publicly Accessible – Potential target for analysis via the CLI

You can download Sandcastle here:

sandcastle-1.2.3.zip

Or read more here.

Posted in: Hacking Tools

Topic: Hacking Tools


Latest Posts:


SharpHose - Asynchronous Password Spraying Tool SharpHose – Asynchronous Password Spraying Tool
SharpHose is an asynchronous password spraying tool in C# for Windows environments that takes into consideration fine-grained password policies and can be run over Cobalt Strike's execute-assembly.
Axiom - Pen-Testing Server For Collecting Bug Bounties Axiom – Pen-Testing Server For Collecting Bug Bounties
Project Axiom is a set of utilities for managing a small dynamic infrastructure setup for bug bounty, basically a pen-testing server out of the box with 1-line.
Quasar RAT - Windows Remote Administration Tool Quasar RAT – Windows Remote Administration Tool
Quasar is a fast and light-weight Windows remote administration tool coded in C#. Used for user support through day-to-day administrative work to monitoring.
Pingcastle - Active Directory Security Assessment Tool Pingcastle – Active Directory Security Assessment Tool
PingCastle is a Active Directory Security Assessment Tool designed to quickly assess the Active Directory security level based on a risk and maturity framework.
Second Order - Subdomain Takeover Scanner Tool Second Order – Subdomain Takeover Scanner Tool
Second Order Subdomain Takeover Scanner Tool scans web apps for second-order subdomain takeover by crawling the application and collecting URLs (and other data)
Binwalk - Firmware Security Analysis & Extraction Tool Binwalk – Firmware Security Analysis & Extraction Tool
Binwalk is a fast and easy to use Python-based firmware security analysis tool that allows for firmware analysis, reverse engineering & extracting of firmware.