This short post is about HatCloud, an open source tool coded in Ruby that helps you find the IP addresses of websites that are protected by CloudFlare. You know why would you need the real IP addresses right?The tool is quiet simple, needs just net/http, open-uri, json, socket and optparse. It leverages CrimeFlare to get the IP address behind CloudFlare and then uses ipinfo.io to get more information about the IP address. It sends a HTTP POST with your input via the cfS parameter Read more about HatCloud: Identify CloudFlare Protected IP Addresses!
Archives for May 2017
Process injection is an old technique used for hiding code execution, avoiding detection and bypassing security solutions by injecting into whitelisted processes. This is a short post about InjectProc, an open source project that demonstrates the following common process injection techniques:DLL injection: Works by opening the target process, allocates space and then write code into the remote process, finally to execute the remote code using CreateRemoteThread. Process replacement: Read more about [SHORT POST] InjectProc: Process Injection Techniques!
There are exploitation frameworks and then there is Metasploit. Though it has a few modules targeted towards embedded devices, it is your "general purpose" framework. If you are looking at a comprehensive embedded devices/router exploitation framework you now have RouterSploit! Read more about RouterSploit: The Metasploit For Routers!
Close on the heels of my earlier post about MicroSploit, the Microsoft Office Exploitation Toolkit, that was on the *NIX platform, this post is about Luckystrike, a malicious Microsoft Office malicious document generator on Microsoft's very own Windows platform. Read more about Luckystrike: An Malicious Office Document Generator!
My last post about WordPress security was WPSeku, the simple WordPress security scanner. This post is about WPXF, short for the WordPress Exploit Framework, which will help you go one step further and perform penetration tests on WordPress powered websites. Read more about WPXF: The WordPress Exploit Framework!
This is a short post about MicroSploit, an open source toolkit that helps you create custom office platform based backdoors using the Metasploit framework and the different payloads it supports.It is a simple bash script that uses command line inputs and Zenity for creating GTK+ dialog boxes to accept additional input. As of now, MicroSploit supports the creation of backdoors for the following platforms:MS12-027 MSCOMCTL ActiveX Buffer Overflow Microsoft Office Word Malicious Read more about MicroSploit: The Office Exploitation Toolkit!
This short post is about Invoke-Phant0m, which "walks" thread stacks of the Event Log Service process (specifically svchost.exe), identifies them and kills Event Log Service Threads. This will render the system unable to collect system logs, while the Event Log Service appears to be running.Invoke-Phant0m is an open source Microsoft Windows based event log killer in PowerShell that can help you hide your activities on a server post-exploitation. The only problem I see with this script is Read more about Invoke-Phant0m: The Windows Event Log Killer!