Oneliner – Nmap – List alive hosts in specific subnet

Standard

Nmap – List alive hosts in specific subnet

nmap -sP 192.168.1.0/24

sample output:

Nmap scan report for sky.johlem.net (192.168.1.1)

Host is up (0.0012s latency).

Nmap scan report for pulpe.johlem.net (192.168.1.2)

Host is up (0.0017s latency).

Nmap scan report for orange.johlem.net (192.168.1.21)

Host is up (0.0055s latency).

Nmap scan report for mouse.johlem.net (192.168.1.51)

Host is up (0.0014s latency).

Nmap done: 256 IP addresses (4 hosts up) scanned in 0.01 seconds

 

READ ALSO  Sitadel - Web Application Security Scanner

How to disabled windows firewall with command line

Standard

How to disabled or enable windows firewall with command line

windows firewall is enable by default on windows.

To Turn Off

netsh advfirewall set allprofile state off

To Turn On

netsh advfirewall set allprofile state on

To check status of Firewall:

netsh advfirewall show allprofiles

 

How to receive a SMS anonymously

Standard

How to receive an SMS anonymously

Sometimes you need to register for a service and they ask for your phone number, but you want to protect your privacy
Some websites are available to provide you with a temporary telephone number to receive SMS.

 

www.receive-sms-online.info

Description: receive-SMS-online.info is FREE service for receive SMS messages online, based on REAL SIM and shows you the exact information received by the modem with Dynamic Sender ID

link: https://www.receive-sms-online.info

tested: OK

how to receive sms without phone number

sellaite.com

Description: receive sms online

link: http://sms.sellaite.com

 

 

receivefreesms.com

Description: Receive SMS Online For FREE. Get Free SMS here to Verify your Services and APP. Receive Free SMS text Online Worldwide

link: http://receivefreesms.com

no tested.

 

 

READ ALSO  Online tools - GRABIFY (IP logger)

 

 

 

 

 

 

WhatWeb (web scanner )

Standard

WhatWeb

WhatWeb is a web scanner

 

Description:

WhatWeb identifies websites. Its goal is to answer the question, “What is that Website?”. WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 1700 plugins, each to recognise something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more.

WhatWeb can be stealthy and fast, or thorough but slow. WhatWeb supports an aggression level to control the trade off between speed and reliability. When you visit a website in your browser, the transaction includes many hints of what web technologies are powering that website. Sometimes a single webpage visit contains enough information to identify a website but when it does not, WhatWeb can interrogate the website further. The default level of aggression, called ‘stealthy’, is the fastest and requires only one HTTP request of a website. This is suitable for scanning public websites. More aggressive modes were developed for use in penetration tests.

Most WhatWeb plugins are thorough and recognise a range of cues from subtle to obvious. For example, most WordPress websites can be identified by the meta HTML tag, e.g. ”, but a minority of WordPress websites remove this identifying tag but this does not thwart WhatWeb. The WordPress WhatWeb plugin has over 15 tests, which include checking the favicon, default installation files, login pages, and checking for “/wp-content/” within relative links.

download : v0.4.9

This product is subject to the terms detailed in the license agreement. For more information about WhatWeb visit:

	Homepage:	http://www.morningstarsecurity.com/research/whatweb
	Wiki:		https://github.com/urbanadventurer/WhatWeb/wiki/

novahot – A webshell framework for penetration testers.

Standard

novahot – A webshell framework for penetration testers.

github: https://github.com/chrisallenlane/novahot

 

description:

novahot is a webshell framework for penetration testers. It implements a JSON-based API that can communicate with trojans written in any language. By default, it ships with trojans written in PHP, ruby, and python.

 

LEGAL DISCLAMER

The author does not hold any responsibility for the bad use of this tool, remember that attacking targets without prior consent it’s illegal and punished by law.

Online tools – GRABIFY (IP logger)

Standard

GRABIFY Create or Track URLs

website url: https://grabify.link/

Description:

Grabify IP Logger helps you track who has clicked your links. Track IP addresses, find IPs from Facebook, Twitter, friends on other sites.

 

screenshot:

 

How to use it:

  1. Enter a URL that you want Grabify to track.
  2. Give the link Grabify generated to the client.
  3. Save your tracking code that was generated when Grabify generated the link.
  4. Enter the tracking code on the home page and click “Tracking Code” to see all the information captured with Grabify.

WiFi HID Injector

Standard

WiFi HID Injector – An USB Rubberducky / BadUSB On Steroids.

Description: Remote WiFi HID Keyboard Injector

It stands for WiFi HID Injector. It is a WiFi remotely-controlled {Keyboard, Mouse} Emulator. Practically is an USB Rubberducky or BadUSB device on Steroids!

Github: https://github.com/whid-injector/WHID

Youtube tutorial: https://youtu.be/ADqMCKtufNY

QRadar Community Edition

Standard

QRadar Community Edition

Description:
QRadar Community Edition is a free version of QRadar that is based off of our core enterprise SIEM. Users, students, security professionals, and app developers are encouraged to download QRadar Community Edition to learn and become familiar with QRadar. This version is limited to 50 events per second and 5,000 network flows a minute, supports apps, but is based on a smaller footprint for non-enterprise use. Download, contribute, create, and engage with an ensemble of users leveraging security at home or in labs with QRadar Community Edition 7.3.1.

download: qradar ce

 

CertGraph – An open source intelligence tool to crawl the graph of certificate

Standard

CertGraph

An open source intelligence tool to crawl the graph of certificate Alternate RamesA tool to crawl the graph of certificate Alternate Names

Description

CertGraph crawls SSL certificates creating a directed graph where each domain is a node and the certificate alternative names for that domain’s certificate are the edges to other domain nodes. New domains are printed as they are found. In Detailed mode upon completion the Graph’s adjacency list is printed

Github: https://github.com/lanrat/certgraph

A web UI is provided in the docs folder and is accessible at the github pages url https://lanrat.github.io/certgraph/.

 

READ ALSO  Online tools - GRABIFY (IP logger)

Sitadel – Web Application Security Scanner

Standard

Sitadel – Web Application Security Scanner

Description

Sitadel is basically an update for WAScan making it compatible for python >= 3.4 It allows more flexibility for you to write new modules and implement new features :

  • Frontend framework detection
  • Content Delivery Network detection
  • Define Risk Level to allow for scans
  • Plugin system
  • Docker image available to build and run

github : Sitadel

Features

Fingerprints

  • Server
  • Web Frameworks (CakePHP,CherryPy,…)
  • Frontend Frameworks (AngularJS,MeteorJS,VueJS,…)
  • Web Application Firewall (Waf)
  • Content Management System (CMS)
  • Operating System (Linux,Unix,..)
  • Language (PHP,Ruby,…)
  • Cookie Security
  • Content Delivery Networks (CDN)

    Attacks:

    • Bruteforce
      • Admin Interface
      • Common Backdoors
      • Common Backup Directory
      • Common Backup File
      • Common Directory
      • Common File
      • Log File
    • Injection
      • HTML Injection
      • SQL Injection
      • LDAP Injection
      • XPath Injection
      • Cross Site Scripting (XSS)
      • Remote File Inclusion (RFI)
      • PHP Code Injection
    • Other
      • HTTP Allow Methods
      • HTML Object
      • Multiple Index
      • Robots Paths
      • Web Dav
      • Cross Site Tracing (XST)
      • PHPINFO
      • .Listing
    • Vulnerabilities
      • ShellShock
      • Anonymous Cipher (CVE-2007-1858)
      • Crime (SPDY) (CVE-2012-4929)
      • Struts-Shock