Hacking | Scripting and security

NUNCA HAY QUE HACER CASO A ESTE TIPO DE CORREOS SON UN TIMO. Esto ha llegado hoy a mi correo: Hi! I am a hacker who has access to your operating system. I also have full access to your account: At the time of hacking your account(@gmail.com) had this password: You can say: this is my, but old password! Or: I can change my password at any time! Of course! You will be right, but the fact is that when you change the password, my malicious code every time saved a new one! I’ve been watching you for a few […]

Security

Hacking Windows Passwords in Minutes – SMB Brute Force Payload for Bash Bunny – Hak5 2518

02/06/201902/06/2019

PowerShell Security

PowerShell y RickyBobby en la filtración de WikiLeaks (Vault 7: CIA Hacking Tools Revealed)

10/03/201709/03/2017

About RickyBobby v4.x.x (S) RickyBobby 4.x is developed by IOC/EDG/AED/Operational Support Branch (OSB) as a lightweight implant for target computers running newer versions of Microsoft Windows and Windows Server. The RickyBobby implant enables COG operators to upload and download files and execute commands and executables on the target computer without detection as malicious software by personal security products (PSPs). RickyBobby 4.x improves upon previous versions of RickyBobby by being easier to install, task using the Listening Post (LP), and manage multiple implant installations. (S) RickyBobby 4.x is comprised of several .NET DLLs and a Windows PowerShell script. RickyBobby uses Windows […]

Network Security

Wireshark en la filtración de WikiLeaks (Vault 7: CIA Hacking Tools Revealed)

08/03/201708/03/2017

Configure Wireshark on Ubuntu By default, wireshark can not be run as a non-root user when attempting to capture traffic on an interface. The following steps can rectify this issue: Install Wireshark

sudo apt-get install wireshark

1	sudo apt-get install wireshark

Create a wireshark group

sudo groupadd wireshark

1	sudo groupadd wireshark

Add your username to the wireshark group

sudo usermod -a -G wireshark YOUR_USERNAME

1	sudo usermod -a -G wireshark YOUR_USERNAME

Change the group ownership of the file dumpcap to wireshark

sudo chgrp wireshark /usr/bin/dumpcap

1	sudo chgrp wireshark /usr/bin/dumpcap

Chage the mode of the file dumpcap to allow execution by the group wireshark

sudo chmod 750 /usr/bin/dumpcap

1	sudo chmod 750 /usr/bin/dumpcap

Grant capabilities with setcap

sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap

1	sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap

Verify the change

sudo getcap /usr/bin/dumpcap

1	sudo getcap /usr/bin/dumpcap

config_wireshark-ubuntu_user.txt Attachments: config_wireshark-ubuntu_user.txt Previous versions: | 1 | 2 |

PowerShell Security

PowerShell en la filtración de WikiLeaks (Vault 7: CIA Hacking Tools Revealed)

07/03/201707/03/2017

PowerShell Notes Create and Modify Your Powershell Profile First check whether or not your profile exists. Test-Path $profile If the query returned “False”, then your profile does not exist. Create your profile New-Item -path $profile -type file -force The output of the previous command will tell you where your profile was created. The path given as the “Directory” output is the directory containing your profile. It will be something like C:\Users\user1\Documents\WindowsPowerShell. Open Windows Explorer and go to that directory. Your profile will be “Microsoft.PowerShell_profile.ps1”. By default your profile will be empty. You can edit your profile to customize your powershell […]

Security

Vault 7: CIA Hacking Tools Revealed

07/03/201708/03/2017

Today, Tuesday 7 March 2017, WikiLeaks begins its new series of leaks on the U.S. Central Intelligence Agency. Code-named “Vault 7” by WikiLeaks, it is the largest ever publication of confidential documents on the agency. The first full part of the series, “Year Zero”, comprises 8,761 documents and files from an isolated, high-security network situated inside the CIA’s Center for Cyber Intelligence in Langley, Virgina. It follows an introductory disclosure last month of CIA targeting French political parties and candidates in the lead up to the 2012 presidential election. Recently, the CIA lost control of the majority of its hacking […]

PowerShell Web scraping

Obtener información de los resultados sobre las búsquedas en Google Hacking Database

01/04/201602/04/2016

#Buscar los últimos dorks en https://www.exploit-db.com/google-hacking-database/
(Invoke-WebRequest 'https://www.exploit-db.com/google-hacking-database/').AllElements | %{$_.href | Select-String https://www.exploit-db.com/ghdb/} | %{
#Para cada enlace obtener el contenido del dork (where class “l-titlebar-h i-cf”)
$buscar=((Invoke-WebRequest $_.tostring()).AllElements | Where class -eq “l-titlebar-h i-cf”).outerText
$buscar
$url='https://www.google.es/search?q='+$buscar
$url
#Buscar en Google el dork
((Invoke-WebRequest $url).AllElements | Where Class -eq “g”).outerText | %{
Start-Sleep -Seconds 5
$_
}
}

#Buscar los últimos dorks en https://www.exploit-db.com/google-hacking-database/

(Invoke-WebRequest 'https://www.exploit-db.com/google-hacking-database/').AllElements | %{$_.href | Select-String https://www.exploit-db.com/ghdb/} | %{

#Para cada enlace obtener el contenido del dork (where class “l-titlebar-h i-cf”)

$buscar=((Invoke-WebRequest $_.tostring()).AllElements | Where class -eq “l-titlebar-h i-cf”).outerText

$buscar

$url='https://www.google.es/search?q='+$buscar

$url

#Buscar en Google el dork

((Invoke-WebRequest $url).AllElements | Where Class -eq “g”).outerText | %{

Start-Sleep -Seconds 5

}

PowerShell Security Web scraping

Obtener el número de resultados sobre búsquedas en Google Hacking Database (GHDB)

06/12/201517/08/2017

(Invoke-WebRequest 'https://www.exploit-db.com/google-hacking-database/').AllElements | %{$_.href | Select-String https://www.exploit-db.com/ghdb/} | %{
$buscar=((Invoke-WebRequest $_.tostring()).AllElements | Where class -eq “w-pagehead”).outerText
$buscar
$url='https://www.google.es/search?q='+$buscar
(Invoke-WebRequest $url).AllElements | Where Class -eq “sd” | %{$_.innerText}
Start-Sleep -Seconds 10
}

(Invoke-WebRequest 'https://www.exploit-db.com/google-hacking-database/').AllElements | %{$_.href | Select-String https://www.exploit-db.com/ghdb/} | %{

$buscar=((Invoke-WebRequest $_.tostring()).AllElements | Where class -eq “w-pagehead”).outerText

$buscar

$url='https://www.google.es/search?q='+$buscar

(Invoke-WebRequest $url).AllElements | Where Class -eq “sd” | %{$_.innerText}

Start-Sleep -Seconds 10

}

Database PowerShell Security Web scraping

Obtener nuevos Google Dorks

01/12/201519/12/2015

(Invoke-WebRequest 'https://www.exploit-db.com/google-hacking-database/').AllElements | %{$_.href | Select-String https://www.exploit-db.com/ghdb/} | %{
((Invoke-WebRequest $_.tostring()).AllElements | Where class -eq “w-pagehead”).outerText
}

(Invoke-WebRequest 'https://www.exploit-db.com/google-hacking-database/').AllElements | %{$_.href | Select-String https://www.exploit-db.com/ghdb/} | %{

((Invoke-WebRequest $_.tostring()).AllElements | Where class -eq “w-pagehead”).outerText

}

Network PowerShell Wireless

Hacking wifi with Powershell

11/02/201511/02/2017

(netsh wlan show interface | Select-String SSID)[0] | %{
[String]$SSID=$_
$SSID=$SSID.replace("SSID","").replace(":","").trim()
$SSID
netsh wlan show profile name=$SSID key=clear | Select-String 'Contenido de la clave'
}

(netsh wlan show interface | Select-String SSID)[0] | %{

[String]$SSID=$_

$SSID=$SSID.replace("SSID","").replace(":","").trim()

$SSID

netsh wlan show profile name=$SSID key=clear | Select-String 'Contenido de la clave'

}