Heartbleed Tools (OpenSSL CVE-2014-0160)

ခုတေလာ နာမည္ၾကီးေနတဲ့ Heartbleed နဲ႔ဆုိင္တဲ့ Tool ေတြျဖစ္ပါတယ္။ စမ္းခ်င္တယ္ဆုိရင္ ကုိယ့္ဘာသာစမ္းၾကည့္ေပါ့။

• A checker (site and tool) for CVE-2014-0160: https://github.com/FiloSottile/Heartbleed
• ssltest.py: Quick and dirty demonstration of CVE-2014-0160 by Jared Stafford http://pastebin.com/WmxzjkXJ
• SSL Server Test https://www.ssllabs.com/ssltest/index.html
• Metasploit Module: https://github.com/rapid7/metasploit-framework/pull/3206/files
• Nmap NSE script: Detects whether a server is vulnerable to the OpenSSL Heartbleed: https://svn.nmap.org/nmap/scripts/ssl-heartbleed.nse
• Nmap NSE script: Quick'n'Dirty OpenVAS nasl wrapper for ssl_heartbleed based on ssl_cert_expiry.nas https://gist.github.com/RealRancor/10140249
• Heartbleeder: Tests your servers for OpenSSL: https://github.com/titanous/heartbleeder?files=1
• Heartbleed Attack POC and Mass Scanner: https://bitbucket.org/fb1h2s/cve-2014-0160
• Heartbleed Honeypot Script: http://packetstormsecurity.com/files/126068/hb_honeypot.pl.txt

Read more »

BurpSuite Pro 1.6 Cracked [BETA]

BurpSuite Pro 1.6 Cracked ကုိ ျပန္ရွယ္လုိက္ပါတယ္။ ကြ်န္ေတာ္ရွာထားတာ မဟုတ္ပါဘူး။ MSF က Anubis ကေနျပန္ရွယ္တာပါ။ ခိခိ။ Feature အသစ္ေတြထပ္ေပါင္းထားတယ္လုိ႔ဆုိပါတယ္။ ကြ်န္ေတာ္ေတာ့ ေသခ်ာမစမ္းရေသးပါဘူး။  Mirror အသစ္ကေနျပန္တင္ထားပါတယ္။

[Download] [Mirror]

Password: fuckallah

Thanks: Anubis [4sectors.com]

Read more »

Netsparker Community Edition

Netsparker Community Edition is a SQL Injection Scanner. It's a free edition of our web vulnerability scanner for the community so you can start securing your website now. It's user friendly, fast, smart and as always False-Positive-Free. It shares many features with professional edition. It can detect SQL Injection vulnerabilities better than many other scanners (if not all), and it's completely FREE.
[Screenshot proof]

[Download]
[Mirror]
Virustotal

Read more »

Egyptian Team Shell Toolkit [Priv8]

ေဒါင္းျပီး စမ္းၾကည့္ေပါ့ဗ်ာ။ အထဲမွာေတာ့ Tool ေတြေတာ္ေတာ္စုံတယ္။ Virustotal မွာ အေကာင္ 15 ေကာင္ထိေတြ႕ထားတယ္။ Use your own risk ေပါ့ဗ်ာ။ ဟီး ဘာေတြပါသလဲဆုိေတာ့က

Tool Includes:
Shells
Sql Injection Tools
Local Root Exploits
Symlinks\Bypass
Vulnerabily Scanners
Script/Windows Tools
Trojans
Windows Scanners
Encryptation
Crypters
Tutoriais
Sistemas

[Download]
Virustotal:  https://www.virustotal.com/en/file/7647302da5e5064bac9e337d2dbdf5d4ec54b974859f3e283e220aaaa078f0ae/analysis/

Read more »

IP-Digger v4 by Freak Coderz

IP-Digger version အသစ္မွာ အရင္ဗားရွင္းက Function ေတြအျပင္ ေနာက္ထပ္ function အသစ္ေတြထပ္ေပါင္းထားပါတယ္။ Usage ကုိ readme file မွာဖတ္ႏုိင္ပါတယ္။ Happy New Year!! All my blog readers.

Tool Name :- IP-Digger v4.0 The WeB Xploit3r The Next Level
Coded by :- Manoj Nath aka Silent Hacker and Gurender Singh aka Un_NoN

Features of IP - Digger
All features of V1 , 2 , 3 + Additional features :)
New Features Added :)

17 - FTP Brute Force                       [+] New Feature Added
18 - Admin Panel Finder                    [+] New Feature Added

 Website Vulnerability Scanning To0ls
--------------------------------------------
19 - Joomla Vulnerability Scanner          [+] New Feature Added
20 - Wordpress Vulnerability Scanner       [+] New Feature Added
21 - UniScan -> Web Vulnerability Scanner  [+] New Feature Added
--------------------------------------------
22 - Uploaded Shell Finder ( Website )     [+] New Feature Added
--------------------------------------------

 Web-Backd0or ( Weevely )
--------------------------------------------
23 - Web Backd0or Generator ( Weevely )
24 - Web Backd0or Server Connect0r ( Weevely )

 Other Hacking To0lKit
--------------------------------------------
25 - W3bSploit T0olkit by 0x0ptim0us

[Download] [Mirror]
Vitustotal: https://www.virustotal.com/en/file/3589df3e59471da5baab55296f64ea50dd704c10350c6e2a2a7e327c3d0e8910/analysis/

[Screenshot]

 

Read more »

Dork Searcher

Dork ေတြ Google မွာ Typing လုပ္ျပီး ရွာမေနနဲ႕ေတာ့ လုိခ်င္တာကုိ select လုပ္ျပီး ရွာရုံပဲ။ အဓိက ရွာေပးမွာက SQLi Vul ျဖစ္ေနတဲ့ဆုိဒ္ေတြကုိ ရွာေပးမွာပါ။ ကုိယ့္ဆီမွာ Dork list ေတြရွိေနရင္လည္း ထပ္ေပါင္းလုိ႔ ရေသးတယ္။

[Download]

Read more »

LFI Server Scanner

Don't ask me how and where to use it. I don't know really :(

Virustotal: https://www.virustotal.com/en/file/17da98c633d90be74c9c85d26dac8c84271a8135f40ef6ce36c0e46b26b34df2/analysis/1387476034/

[Download]

Read more »

Bjoomla v3 [Py]

Python နဲ႔ေရးထားတဲ့ Tool ေလးတစ္ခုပါ။ BT/Kali မွာဆုိ Terminal ကေနတန္းျပိး run ရုံပါပဲ။ usage ကုိလည္း ေတြ႕ရမွာပါ။ ကြ်န္ေတာ္စမ္းမိသေလာက္ေတာ့ အဆင္မေျပပါဘူး။ :( စမ္းခ်င္တယ္ဆုိရင္ စမ္းၾကည့္ေပါ့ဗ်ာ။ ဒါကေတာ့ သူ႔မူရင္းဆုိဒ္မွာ ေရးထားတာပါ။
New Feature:
    + Import multi urls from file
    + User Friendly Interface
    + Support Joomla version 3
    Changelog for Version 3:
    + Fix bug valid login with -U option (Thanks to Anton)
    + Add -H option (Scan multi urls)
    + Improve speed
    Changelog for Version 2:
    + Add -x option (use proxy)
    + Support Joomla 2.x
   
Tested with joomla 1.5.xx , 2.x , 3.x (beta)

Download:

Read more »

TechnoCrytpter Crack Version

FUD Crypter ေတြအေၾကာင္း ကြ်န္ေတာ္အရင္ကပုိ႔စ္မွာ ေဖာ္ျပျပီးပါျပီ။ ဒီ Tool ေလးကေတာ့ ကြ်န္ေတာ္စက္ထဲမွာ Avira Antivirus က Detect ျဖစ္ပါတယ္။ ကြ်န္ေတာ္ virustotal ကေနစစ္ၾကည့္တာလည္း Detection က 2/51 ရွိပါတယ္။ ဒါေၾကာင့္ use your own ေပါ့ဗ်ာ။

Scan link: https://www.virustotal.com/en/url/15f9467276a942e0ab7f63f094a96371f65d39e922acff83920b79de2b6516be/analysis/1385392594/

Download: Tusfiles Rghost

Read more »

AnonGhost Shell Priv8

AnonGhost Team ရဲ႕ shell ေလးပါခင္ဗ်။ ထြက္တာသိပ္မၾကာေသးဘူး။ စမ္းခ်င္ရင္ ယူလုိက္ေပါ့။ default password က AnonGhost<3AG6 ပါ။ တကယ္လုိ႔ အဲဒါအလုပ္မျဖစ္ရင္ {shell.php?ag} ဆုိျပီးဝင္ဗ်ာ။ စမ္းစရာ site မရွိရင္ ကြ်န္ေတာ္လုိ local မွာ CMS တစ္ခုခုသြင္းျပီး စမ္းေပါ့ေနာ္ ဟီး။

 AnonGhost Shell Priv8: Click Here

All Credit to: Uber Zodiac & Shell Creator

Read more »

Metasploit in Ubuntu

Ubuntu မွာလည္း ကြ်န္ေတာ္တုိ႔ Pen-testing tool ေတြကုိအသုံးျပဳႏုိင္ပါတယ္။ တခ်ဳိ႕ Tool ေတြက်ေတာ့ အဆင္မေျပဘူးဗ်။ apt-get install နည္းနဲ႔ update လုပ္ခုိင္းတာမ်ဳိးက်ေတာ့။ ခုနည္းကေတာ့ လုိအပ္တဲ့ဖုိင္ကုိ ေဒါင္းျပီး run ေပးရုံပဲမုိ႔ ရွယ္ေပးလုိက္တာပါ။ ကြ်န္ေတာ္ကေတာ့ Ubuntu 13.10 မွာ Test လုပ္ထားပါတယ္။ VM နဲ႔ပါ။ လုိအပ္တဲ့ Metasploit Framework ကုိ http://www.rapid7.com/products/metasploi...ad.jsp#msf မွာသြားျပီး မိမိတုိ႔စက္နဲ႔ ကုိက္မယ့္ Version ကုိေဒါင္းႏုိင္ပါတယ္။
Linux အတြက္ 32 Bit & 64 Bit ကုိ Support လုပ္ေပးပါတယ္။ Windows ကေတာ့ 64 တစ္ခုကုိပဲ support လုပ္ထားပါတယ္။ အုိခီ။ ကြ်န္ေတာ္ကေတာ့ 32 ကုိပဲေဒါင္းလုိက္ပါတယ္။ 169 MB ဗ်။ Terminal မွာ ခုလုိ ရုိက္လုိက္ပါမယ္။

cd Desktop ls
chmod 775 metasploit-latest-linux-installer.run
sudo ./ metasploit-latest-linux-installer.run

 

 က်န္တာကေတာ့ Installation Wizard အတုိင္း လုပ္သြားရုံပါပဲခင္ဗ်။ ေအာက္မွာ ပံုေတြကုိ screenshot ရုိက္ျပထားပါတယ္။ 

Screenshot:

 

Metasploit ကုိသုံးခ်င္ရင္ BT/Kali မွာလုိပဲ Terminal မွာ msfconsole လုိ႔ရုိက္ထည့္လုိက္ရင္ ရပါျပီ။ Metasploit Framework ေပၚလာဖုိ႔ တခါတေလ နည္းနည္းေတာ့ေစာင့္ေပးရပါတယ္။

Video Tutorial:

Read more »

OWASP Mantra Security Toolkit

OWASP ရဲ႕ေနာက္ထပ္ open source project တစ္ခုပါ။ ဒီေကာင္ကေတာ့ Windows, linux, Mac စတဲ့ platform 3 ခုထိေတာင္ Support လုပ္ပါတယ္။ Browser-base Security Framework တစ္ခုပါ။ စမ္းမယ္ဆုိရင္ ဒီ မွာသြားျပီးေဒါင္းႏုိင္ပါတယ္။ ဖုိင္ဆုိဒ္ကေတာ့ 100 MB ေက်ာ္တယ္ဗ်ဳိ႕။ အေသးစိတ္ေလ့လာခ်င္ရင္ေတာ့ ဒီ မွာသြားျပီးေလ့လာလုိ႔ရပါတယ္။

Read more »

Web-Sorrow v1.5.0 (security scanner for the information disclosure and fingerprinting phases of pentesting)

Perl Language နဲ႔ေရးထားတဲ့ Tool ေလးတစ္ခုပါ။  ဒီေကာင္က ပုံမွာျမင္ရတဲ့အတုိင္း website ေတြကုိ Scan ေပးမွာပါ။  ဒါေၾကာင့္ windows သမားေတြကေတာ့ Perl ကုိသြင္းထားရပါမယ္။ အဲဒီအတြက္ Active Perl ဆုိတာကုိသြင္းထားရင္ အဆင္ေျပပါတယ္။ Active perl ကုိအင္စေတာ့လုပ္ထားရင္ C:\Perl ဆုိတဲ့ Directory တစ္ခုရွိလာပါမယ္။ အဲဒီ Directory မွာေဒါင္းထားတဲ့ဖုိင္ကုိ (တကယ္လုိ႔ Zip ဖုိင္ဆုိရင္ျဖည္ေပးလုိက္ေပါ့) extract ျပီး ထားလုိက္ပါ။ ဥပမာ C:\Perl\Something ေပါ့။ ကြ်န္ေတာ္ကေတာ့ C:\Perl ထဲမွာ extract လုပ္ထားေတာ့ CMD မွာ ခုလုိ dir change လုိက္ပါမယ္။

အသုံးျပဳနည္းကုိေတာ့  ဒီ မွာအေသးစိတ္ေလ့လာလုိ႔ရပါတယ္။ ကြ်န္ေတာ္ကေတာ့ ခုလုိ Google ကုိ scan ၾကည့္လုိက္ပါတယ္။ အဆင္ေတာ့ မေျပဘူးေပါ့။ အေသးစိတ္ကုိ ကုိယ့္ဘာသာကလိေပါ့ဗ်ာ။ login page ကုိရွာတာတုိ႔ အမ်ားၾကီးပါတယ္။ အုိေက။ စမ္းမယ္ဆုိရင္ ေအာက္ကေနေဒါင္းလုိက္ဗ်ာ။

Basic overview of capabilities:

Web Services: a CMS and it's version number, Social media widgets and buttons, Hosting provider, CMS plugins, and favicon fingerprints
Authentication areas: logins, admin logins, email webapps
Bruteforce: Subdomains, Files and Directories
Stealth: with -ninja you can gather valuable info on the target with as few as 6 requests, with -shadow you can request pages via google cache instead of from the host
AND MORE: Sensitive files, default files, source disclosure, directory indexing, banner grabbing (see below for full capabilities)

Download: Direct Mirror

Read more »

Nmap for Android

Nmap ဆုိတာကုိေတာ့ အားလုံးသိၾကမွာပါ။ နာမည္ၾကီး Scanner တစ္ခုေပါ့။ Android မွာစမ္းလုိ႔ရေအာင္ ရွယ္ေပးလုိက္ပါတယ္။ ကြန္ပ်ဴတာမရွိတဲ့အခ်ိန္မွာ ဖုန္းကေန ေကာင္းေကာင္းကလိၾကေပါ့။ အဆင္ေျပၾကပါေစဗ်ာ။ 

Download: Solidfiles

Read more »

OWASP Xenotix XSS Exploit Framework

OWASP ဆုိတာ နာမည္ၾကီး pen-testing tool, project ေတြေရးေနတဲ့ နာမည္ၾကီး Open source အဖြဲ႕တစ္ခုပါ။ သူဆီကထုတ္တဲ့ အျခား project ေတြလည္းမနည္းပါဘူး။ ဒီဟာက free version ဆုိေပမယ့္ vul ေတြကုိစစ္တဲ့အခါ အသုံးဝင္မွာပါ။ အဓိကေတာ့ XSS Atack ေတြကုိ စစ္ေဆးေပးမွာပါ။

OWASP Xenotix XSS Exploit Framework is an advanced Cross Site Scripting (XSS) vulnerability detection and exploitation framework. It provides Zero False Positive scan results with its unique Triple Browser Engine (Trident, WebKit, and Gecko) embedded scanner. It is claimed to have the world’s 2nd largest XSS Payloads of about 1500+ distinctive XSS Payloads for effective XSS vulnerability detection and WAF Bypass. It is incorporated with a feature rich Information Gathering module for target Reconnaissance. The Exploit Framework includes highly offensive XSS exploitation modules for Penetration Testing and Proof of Concept creation.

 Download: link1 Link2 Link3

Via OWASP

Read more »

Acunetix Consultant Edition 9

Acunetix ကေတာ့နာမည္ၾကီး web scanner ပါ။ ကြ်န္ေတာ္အရင္ v8 ကုိတင္ေပးဖူးပါတယ္။ ဒီဟာက v9 ပါ။ crack version ျဖစ္ပါတယ္။ လုိရမယ္ရ ေဆာင္ထားခ်င္တယ္ဆုိရင္ ယူလုိက္ပါ။ ကြ်န္ေတာ္ Google ကေန price list ကုိရွာၾကည့္တာ အနည္းဆုံး $300 ေက်ာ္ကေန $ ေထာင္ေက်ာ္တာေတြ႕ရတယ္ဗ်ဳိ႕။ File Size ကေတာ့ 27 MB ေက်ာ္ေလးပါ။ ၾကဳံတုန္းေလး ဆြဲစိထားလုိက္ဗ်ာ။ :D

Download: Solidfiles Mirrorcreator

Credit: Anubis, MSF

Read more »

XiaoPan OS

Wifi ကုိဟတ္ခ်င္တဲ့သူမ်ား စမ္းႏုိင္ပါတယ္။ ဒီေကာင္ကေတာ့ နာမည္ၾကီးပါ။ ဟုိးအရင္ကတည္းက။ ကြ်န္ေတာ္ဝင္ေရးေပးတဲ့ ညီအကုိ Xerouplink ဘေလာ့မွာေတြ႕လုိ႔ ျပန္ရွယ္လုိက္ပါတယ္။ ဖုိင္ဆုိဒ္ကလည္း 72.5 MB ေလာက္ပဲရွိပါတယ္။ Linux-based OS ပါ။ စမ္းခ်င္တယ္ဆုိ ေဒါင္းႏုိင္ပါျပီ။ မူရင္းလင့္နဲ႔ခ်ိတ္ေပးလုိက္ပါတယ္။ သူရဲ႕ features ေတြကုိတခ်က္ၾကည့္လုိက္ပါအုံး။ အေသးစိတ္ကုိ မူရင္းလင့္မွာ ၾကည့္ႏုိင္ပါတယ္။  

 Feature List :

Reaver: newly developed application with the ability to brute force crack WPS (WPA / WPA2) pins.
Inflator: this is the GUI version of command line reaver.
Aircrack-ng: the major backbone of many other Xiaopan tools including FeedingBottle (FB) and Minidwep with the ability to attack WPA networks through a dictionary attack and WEP networks through collecting and injecting packets.
FeedingBottle: so easy a baby could use it! FB is essentially the Aircrack-ng GUI and was created by Beini.
Minidwep: is similar to FB but has a better and similar GUI that is even easier to use than FB. The added advantage of Minidwep is that you can also run Reaver and Inflator from here as well.
Xfe: this is a simple file manager similar to say windows explorer. 

Link: http://sourceforge.net/projects/xiaopanos/

Read more »

Burp Suite 1.5.01 Pro

ကြ်န္ေတာ္လည္း ခုတေလာ Connection က မရတာမ်ားေတာ့ ပုိ႔စ္ေတြတင္ဖုိ႔အဆင္မေျပဘူးျဖစ္ေနပါတယ္။ ဒီေကာင္က Hacking Tool ေကာင္းေလးတစ္ခုပါ။ MSF မွ ျပန္ရွယ္လုိက္ပါတယ္။ Burp Suite လုပ္ႏုိင္တာေတြမ်ားပါတယ္။ ေတာ္ေတာ္မ်ားလုိ႔ အကုန္လည္းကြ်န္ေတာ္မသိပါဘူး။ Firefox Addon ျဖစ္တဲ့ Temper Data ေနရာမွာလည္းအစားထုိးလုိ႔ရပါတယ္။ MD5 Hash  ေတြကုိလည္း ကလိလုိ႔ရပါတယ္။ သူလုပ္ႏုိင္တာ ဒီထက္မ်ားပါတယ္။ ဒီေတာ့ ေဒါင္းျပီး ကုိယ့္ဘာသာ စမ္းၾကည့္ေပါ့ဗ်ာ။ Installation ပုိင္းနဲ႔ပတ္သက္ျပီး အထဲမွာ readme.txt ဖုိင္ေလးပါတယ္။ အဲဒီထဲကအတုိင္းလုပ္ၾကည့္ရင္ Portable ပုံစံ full version အျဖစ္အသုံးျပဳႏုိင္ပါလိမ့္မယ္။

Download: Box Solidfiles Mirrorcreator

Credit: Anubis, MSF

Read more »

Wifi Hacker Helper ( For Andriod )

 

ကြ်န္ေတာ္ Andriod Phone နဲ ့ Wifi Line ေတြကို Hack / Attack လုပ္ဖုိ ့ အျမဲ ၾကိဳးစားဖူးပါတယ္။

ေတာ္ေတာ္မ်ားမ်ားက Fake ေတြၾကီး ျဖစ္ေနပါတယ္။ တစ္ခ်ဳိ  ့ APK ေတြဆုိ သူမ်ားကို လုပ္ဖု ိ့ေနေန သာသာ ကုိ အရင္ထိ ေနတဲ့ပုံစံေတြရွိခဲ့ဖူးပါတယ္။ ခု ဒါေလးကေတာ့ wifi hacker helper ( Helper ) ေလး ပါ ။ ဒီေဆာ့၀ဲလ္ ေလး ဖုန္းတည္းထည့္ထားမယ္ဆုိရင္ အင္တာနက္ ဖြင့္ဖုိ ့ လုိပါတယ္။ အင္တာနက္ ဖြင့္လုိက္ျပီဆုိတာနဲ ့ ခု ေဆာ့၀ဲလ္ ေလး က အခ်ိန္ နဲ ့အမွ် ဘယ္နည္းနဲ ့ ဘယ္လုိ ဘယ္လုိင္း ေတြကုိ ပာက္နုိင္တယ္ဆုိ တဲ့နည္း လမ္းေတြကို သူတုိ ့က အျမဲ Update

လုပ္ေပးထားပါတယ္။ အေထာက္အကူျဖစ္မယ္ထင္လုိ ့တင္ေပးလုိက္တာပါ။ လုိခ်င္သူမ်ား Download ရယူနုိင္ပါျပီခင္ဗ်ာ။

Read more »

Andromeda v2.06 (Botnet)

 

Andromeda Botnet ကေတာ့ နည္းနည္း လန္းတယ္ဗ်.. interface ကလည္း ေတာ္ေတာ္ေလး အထာက်ပါတယ္။ Botnet ပုိင္းေလ့လာေနသူမ်ား.. မသုံးဖူးေသးလုိ ့သုံးဖူးခ်င္တယ္ဆုိတဲ့ ညီကိုမ်ားအတြက္ တင္ေပးလုိက္ပါတယ္.. DDOS Botnet ပါ..

ကဲၾကိုက္ရာလင့္မ်ား ေဒါင္းေလာ့ရယူနုိင္ပါျပီ။

Read more »