Websploit Framework Version 2.0.1 Released

WebSploit Is an Open Source Project for Scan and Analysis Remote System from Vulnerability.
WebSploit Is An Open Source Project For :
[>]Social Engineering Works
[>]Scan,Crawler & Analysis Web
[>]Automatic Exploiter
[>]Support Network Attacks
---->
[*]Autopwn - Used From Metasploit For Scan and Exploit Target Service
[*]wmap - Scan,Crawler Target Used From Metasploit wmap plugin
[*]format infector - inject reverse & bind payload into file format
[*]phpmyadmin Scanner
[*]LFI Bypasser
[*]Apache Users Scanner
[*]Dir Bruter
[*]admin finder
[*]MLITM Attack - Man Left In The Middle, XSS Phishing Attacks
[*]MITM - Man In The Middle Attack
[*]Java Applet Attack
[*]MFOD Attack Vector
[*]USB Infection Attack
[*]ARP Dos Attack
[*]Web Killer Attack
[*]Fake Update Attack
[*]Fake Access point Attack


Download WebSploit Framework  :         LINK 1



Note: websploit toolkit project closed and new project started called Websploit Framework

NOWASP (Mutillidae): application for testing your Web PenTesting and Hacking skills

NOWASP (Mutillidae) is a free, open source web application provided to allow security enthusiest to pen-test a web application.

NOWASP (Mutillidae) can be installed on Linux, Windows XP, and Windows 7 using XAMMP making it easy for users who do not want to administrate a webserver.

It is already installed on Samurai WTF and Rapid7 Metasploitable-2. The existing version can be updated on either. Containing dozens of vulns and hints to help the user; this is an easy-to-use web hacking environment deliberately designed for labs, security enthusiast, classrooms, CTF, and vulnerability assessment tool targets. Mutillidae has been used in graduate security courses, in corporate web sec training courses, and as an "assess the assessor" target for vulnerability assessment software.

Instructional videos using NOWASP (Mutillidae) are available on the "webpwnized" YouTube account at https://www.youtube.com/user/webpwnized. Updates on the project and video posts are tweeted to @webpwnized

Download NOWASP :       LINK 1

Portspoof : Service Signature Obfuscator

The portspoof program is designed to enhance OS security through emulation of legitimate service signatures on otherwise closed ports. The general goal of the program is to make the port scanning process very slow and output very difficult to interpret, thus making the attack reconnaissance phase a challenging and bothersome task.

Portspoof features:

* Fast: Multithreaded (by default 10 threads handle new incoming connections).
* Lightweight: Requires small amount of system resources.
* Portable: runs on BSD/Linux (support for OSX/Windows will be added).
* Flexible: You can easily use your firewall rules to define ports that are going to be spoofed.
* Effective against popular port scanners
* By default, portspoof will bind only to one port – 4444 on all interfaces and is extremely CPU friendly. So, after running this program and scanning it with Nmap, you will find that though not many ports are open in reality, a lot of false open ports will be detected.

DOWNLOAD  :      LINK 1    LINK 1

Download Backtrack 5 R3 , a Penetration testing linux

BackTrack 5 R3 has been released. R3 focuses on bug-fixes as well as the addition of over 60 new tools – several of which were released in BlackHat and Defcon 2012. A whole new tool category was populated – “Physical Exploitation”, which now includes tools such as the Arduino IDE and libraries, as well as the Kautilya Teensy payload collection.


For the insanely impatient, you can download the BackTrack 5 R3 release via torrent right now. Direct ISO downloads will be available once all our HTTP mirrors have synched, which should take a couple more hours. Once this happens, we will update our BackTrack Download page with all links.
BT5R3-GNOME-64.torrent (md5: 8cd98b693ce542b671edecaed48ab06d)
BT5R3-GNOME-32.torrent (md5: aafff8ff5b71fdb6fccdded49a6541a0)
BT5R3-KDE-64.torrent (md5: 981b897b7fdf34fb1431ba84fe93249f)
BT5R3-KDE-32.torrent (md5: d324687fb891e695089745d461268576)
BT5R3-GNOME-32-VM.torrent (md5: bca6d3862c661b615a374d7ef61252c5)

jSQL Injection, a Java GUI for database injection

An easy to use SQL injection tool for retrieving database informations from a distant server.

jSQL Injection features:

* GET, POST, header, cookie methods
* visual, errorbase, blind algorithms
* automatic best algorithms detection
* data retrieving progression
* proxy setting


For now supports MySQL.

Running injection requires the distant server url and the name of parameter to inject.


Download jSQLi  :            LINK 1

WSO New update 2.5.1 (PHP WebShell ) -Download now

This utility provides a Web interface for remote operation c operating system and its service / daemon.

Features:


* Authorization for the cookies
* Server Information
* File manager (copy, rename, move, delete, chmod, touch, create files and folders)
* View, hexview, editing, downloading, uploading files
* Working with zip archives (packing, unpacking) + compression tar.gz
* Console
* SQL Manager (MySql, PostgreSql)
* Execute PHP code
* Working with Strings + hash search online databases
* Bindport and back-Connect (Perl)
* Bruteforce FTP, MySQL, PgSQL
* Search files, search text in files
* Support for * nix-like and Windows systems
* Antipoiskovik (check User-Agent, if a search engine then returns 404 error)
* You can use AJAX
* Small size. Packaged version is 22.8 Kb
* The choice of encoding, which employs a shell.


Changelog (v2.5.1):

Remove comments from the first line .
Added option to dump certain columns of tables.
the size of large files are now well defined .
in the file properties field "Create time" changed to "Change time" (http://php.net/filectime).
Fixed a bug that caused not working mysql brute force if there was a port of the server .
Fixed a bug due to which one can not see the contents of a table called download in the database.

Download it from here:      LINK 1          LINK 2

Burp Suite Free Edition v1.5 released

Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting security vulnerabilities.

Burp gives you full control, letting you combine advanced manual techniques with state-of-the-art automation, to make your work faster, more effective, and more fun.

Burp Suite contains the following key components:

An intercepting Proxy, which lets you inspect and modify traffic between your browser and the target application.
An application-aware Spider, for crawling content and functionality.
An advanced web application Scanner, for automating the detection of numerous types of vulnerability.
An Intruder tool, for performing powerful customized attacks to find and exploit unusual vulnerabilities.
A Repeater tool, for manipulating and resending individual requests.
A Sequencer tool, for testing the randomness of session tokens.
The ability to save your work and resume working later.
Extensibility, allowing you to easily write your own plugins, to perform complex and highly customized tasks within Burp.


This is a significant upgrade with a wealth of new features added since
v1.4, most notably:


Completely new user interface with numerous usability enhancements.
Several new Proxy listener options, to deal with unusual situations.
New payload types in Burp Intruder.
JSON support.
Support for streaming HTTP responses.
Support for Android SSL connections (device and emulator).
Numerous new session handling options.
Full contextual documentation within the software itself.



Download Burp Suite Free Edition v1.5:        LINK 1

SSLsplit: Tool for man-in-the-middle attacks against SSL/TLS encrypted network connections.

SSLsplit is a tool for man-in-the-middle attacks against SSL/TLS encryptednetwork connections. Connections are transparently intercepted through a network address translation engine and redirected to SSLsplit. SSLsplit terminates SSL/TLS and initiates a new SSL/TLS connection to the original destination address, while logging all data transmitted. SSLsplit is intended to be useful for network forensics and penetration testing.

SSLsplit supports plain TCP, plain SSL, HTTP and HTTPS connections over both
IPv4 and IPv6. For SSL and HTTPS connections, SSLsplit generates and signs
forged X509v3 certificates on-the-fly, based on the original server certificate
subject DN and subjectAltName extension. SSLsplit fully supports Server Name
Indication (SNI) and is able to work with RSA, DSA and ECDSA keys and DHE and
ECDHE cipher suites. SSLsplit can also use existing certificates of which the
private key is available, instead of generating forged ones. SSLsplit supports
NULL-prefix CN certificates and can deny OCSP requests in a generic way.

SSLsplit version 0.4.5 released on Nov 07, change logs are
- Add support for 2048 and 4096 bit Diffie-Hellman.
- Fix syslog error messages (issue #6).
- Fix threading issues in daemon mode (issue #5).
- Fix address family check in netfilter NAT lookup (issue #4).
- Fix build on recent glibc systems (issue #2).
- Minor code and build process improvements.


Download the SSLsplit:     LINK 1

OWASP Joomscan -Joomla vulnerability scanner identifies 673 vulnerabilities

Joomscan is one of penetration testing tool that help to find the vulnerability in Joomla CMS. The Updated version can detects 673 vulnerabilities . Detects file inclusion, sql injection, command execution vulnerabilities of a target Joomla! web site.

DOWNLAOD JOOMACAN :              LINK 1

How to use Joomscan?

How to use Joomscan to find the Joomla Vulnerability in Backtrack 5 Linux?

Joomscan is one of penetration testing tool that help to find the vulnerability in Joomla CMS. TheUpdated version can detects 550 Vulnerabilities. Let me show how to use this joomscan in Backtrack5.

Download the Joomscan from here:
http://web-center.si/joomscan



Step 1: Moving to PenTest folder

Copy/Move the downloaded files in directory

/pentest/web/scanners/joomscan/

Step2: Set Permission

Now you have to set permission for the Joomscan file. In order to this, Type the following command in Terminal(if you don't know how to open terminal at all, please stop reading this and start it from basics of Linux).

CHMOD 0777 joomscan.pl

Step 3: Update

Update the scanner to latest version. To do this, enter the following command in Terminal:

./joomscan.pl update

Step 4: Scanning for Vulnerability

Now everything ok, we have to scan our joomla site for vulnerability. To do this, enter the following command in Terminal:

./joomscan.pl -u www.YourJoomlasite.com

Wait for a while, and it will list of the vulnerability found.

How to Use Premium Cookies?edit cookies in any websites

In my last post i have explain how to hack the hotfile cookies and download like a premium account user(this article is example of cookie editing). Here is the general tutorial to add or edit premium cookies.

Requirements:

Web Developer Add on



Step 1: Install Web Developer Add on
Install the Web developer add on. Using this add on we are going to edit the cookies

https://addons.mozilla.org/en-US/firefox/addon/web-developer/
Restart the browser. now you can see the web developer toolbar. It consist of Disbale, cookies,css,forms....etc.

Step 2: Visit website
Visit the appropriate website corresponding to your premium cookies.

Step 3:
Now click the Cookies option in the Web developer tool bar. and select View Cookies information. It will show list of cookies.

For adding cookies click the "Add the cookie" in the toolbar instead. then skip to the step 6.

Step 4: Find the cookie
Find the cookie that you want to edit. Some website store login cookie as "auth" cookie. So find the auth cookie.

Step 5: Edit the cookie
click the edit the cookie link.
this will popup the cookie window

Step 6:

paste the premium cookies in the value field

If you are adding cookies manually, cookie name will be blank. So you have to set the correct cookie name also. usually it will be "auth"

Increase the Download speed of Hotfile like premium account-cookies hack

Hi Friends, i think this is my first about hotfile. Hotfile is file sharing website. In hotfile , downloading speed for normal user is very slow. But for premium account it will be faster. In this post, i am going to explain how to downlod files from hotfile like premium account.


Here is video Version of this tutorial:
How to use Premium cookies? Video Tutorial

In this method, we are going to use the premium cookies(cookie got from cookie stealing method). Website detects the user based on the cookies. cookies is only factor that detects whether you are normal user or premium user. More details aboutsession and cookies. So Using the Premium cookies , you can make the website to believe that you are the premium user. Sounds good..!! but how to do? This can achieved by Cookies Editing.


Method 1:  Requirements:


normal Free account in Hotfile
Premium cookies
Install Web Developer Add on

Step 1: Install Web Developer Add on
Install the Web developer add on. Using this add on we are going to edit the cookies


https://addons.mozilla.org/en-US/firefox/addon/web-developer/Restart the browser. now you can see the web developer toolbar. It consist of Disbale, cookies,css,forms....etc. We are going to use cookies option alone for this hack.

Step 2: Login with Free account

Login to your Free account in Hotfile.com

Step 3:
I hope you are in hotfile.com. Now click the Cookies option in the Web developer tool bar. and select View Cookies information. It will list of cookies.

Step 4: Find auth cookie
Find the cookie that named as "auth". (you can see this if you are login ).


Step 5: Edit cookie
Click the Edit cookie link. It will open the new pop up window.

Step 6: Change the Value
Now Delete the contents of Value Label. Paste the premium cookie that you have inside the value text field. and Click ok.

Step 7: What is the next step?
You are now premium member.!!! Start to download hot file like a premium member. Enjoy..!!!


Method 2:

Method 2 is same as method 1. Instead of editing cookie , we just add new cookie. So for this method, no need of free account also.


Visit hotfile.com
Click the cookie option as said in the above method.
Select Add cookie
It will open the small pop up window.
enter "auth" in the name field
Paste the premium cookies in the "Value" field.
Reload the page
That's all you finished.

Both methods works perfectly.
Having doubts ..??!! Post comments here.


Here is the one premium cookie for you:(copy it to your desktop, i will delete as soon as possible)

4afa81803373a6e2c29fcc1f782f8161d327c529eaa4e124e6eff19a822bfe9b