Python and Powershell internal penetration testing framework

Pentestly is a combination of expanding Python tools for use in penetration tests. The goal is to utilize a familiar user interface while making contributions to the framework easy with the power of Python.   

How to use :  

Current features

• Import NMAP XML
• Test SMB authentication using:
  • individual credentials
  • file containing credentials
  • null credentials
  • NTLM hash
• Test local administrator privileges for successful SMB authentication
• Identify readable SMB shares for valid credentials
• Store Domain/Enterprise Admin account names
• Determine location of running Domain Admin processes
• Determine systems of logged in Domain Admins
• Execute Powershell commands in memory and exfil results
• Execute Mimikatz to gather plaintext password from memory (Invoke-Mimikatz.ps1)
• Receive a command shell (Powercat)
• Receive a meterpreter session (Invoke-Shellcode.ps1) 

Download tool : https://goo.gl/8UeqtD

php tool for network scanning

Hostscan is a php tool which allows you to scan specific range of hosts, mostly for information gathering and testing for weak passwords. I guess it's a pentest tool, i'd created it to automate some tests that i often do. Since it's PHP, it works quite slowly compared to client-side soft. 


How to install : 

step1 :

           

step 2 : Start the apache server   

step 3 : Copy the hostscan.php file and past in /var/www path  

step 4 : The type url : localhost/hostscan.php  

          

              

step 5 : After the scanning completed see the results in general info and ip address 

         

            

step 6 : it use Brute force attack automatically       

          

Download tool : https://github.com/Smaash/hostscan

   

Joomla_Components_Scanner

A free and open source software to find the components installed in Joomla CMS, built out of the ashes of Joomscan.            

     Features

• Scanning the Joomla CMS sites in search of components/extensions (database of more than 500 components);
• Locate the browsable folders of component (Index of ...);
• Locate the components disabled or protected
• Locate the robots.txt file or error_log file
• Supports HTTP or HTTPS connections                                                                                                                                                                                                                             

How to use   

Download tool : https://goo.gl/nKTAI0

javascript static security analysis tool

Introduction

Today, more and more developers are switching to JavaScript as their first choice of language. The reason is simple JavaScript has now been started to be accepted as the mainstream programming for applications, be it on the web or on the mobile; be it on client-side, be it on the server side. JavaScript flexibility and its loose typing is friendly to developers to create rich applications at an unbelievable speed. Major advancements in the performance of JavaScript interpreters, in recent days, have almost eliminated the question of scalability and throughput from many organizations. So the point is JavaScript is now a really important and powerful language we have today and it's usage growing everyday. From client-side code in web applications it grew to server-side through Node.JS and it's now supported as proper language to write applications on major mobile operating system platforms like Windows 8 apps and the upcoming Firefox OS apps.

But the problem is, many developers practice insecure coding which leads to many client side attacks, out of which DOM XSS is the most infamous. We tried to understand the root cause of this problem and figured out is that there are not enough practically usable tools that can solve real-world problems. Hence as our first attempt towards solving this problem, we want to talk about JSPrime: A JavaScript static analysis tool for the rest of us. It's a very light-weight and very easy to use point-and-click tool! The static analysis tool is based on the very popular Esprima ECMAScript parser by Aria Hidayat.

I would like to highlight some of the interesting features of the tool below:

• JS Library Aware Source & Sinks
• Most dynamic or static analyzers are developed to support native/pure JavaScript which actually is a problem for most developers since the introductions and wide-adoption for JavaScript frameworks/libraries like jQuery, YUI etc. Since these scanners are designed to support pure JavaScript, they fail at understanding the context of the development due to the usage of libraries and produce many false-positives and false-negatives. To solve this we have identified the dangerous user input sources and code execution sink functions for jQuery and YUI, for the initial release and we shall talk about how users can easily extend it for other frameworks.
• Variable & Function Tracing (This feature is a part of our code flow analysis algorithm)
• Variable & Function Scope Aware analysis (This feature is a part of our code flow analysis algorithm)
• Known filter function aware
• OOP & Protoype Compliant
• Minimum False Positive alerts
• Supports minified JavaScript
• Blazing fast performance
• Point and Click :-) (my personal favorite)

Upcoming features:

• Automatic code de-obfuscation & decompression through Hybrid Analysis (Ra.2 improvisation;http://code.google.com/p/ra2-dom-xss-scanner)
• ECMAScript family support (ActionScript 3, Node.JS, WinJS)  

Web Client : 

Open "index.html" in your browser.

Server-Side (Node.JS)

1. In the terminal type "node server.js"
2. Go to 127.0.0.1:8888 in your browser.  

Download link : https://goo.gl/3HF2Qz

Fingerprint Web Application Firewall (WAF) Tool

WAFW00F

WAFW00F identifies and fingerprints Web Application Firewall (WAF) products.

How does it work?

To do its magic, WAFW00F does the following:

• Sends a normal HTTP request and analyses the response; this identifies a number of WAF solutions
• If that is not successful, it sends a number of (potentially malicious) HTTP requests and uses simple logic to deduce which WAF it is
• If that is also not successful, it analyses the responses previously returned and uses another simple algorithm to guess if a WAF or security solution is actively responding to our attacks

What does it detect?

It detects a number of WAFs. To view which WAFs it is able to detect run WAFW00F with the -l option. At the time of writing the output is as follows:

$ ./wafw00f -l

                                 ^     ^
        _   __  _   ____ _   __  _    _   ____
       ///7/ /.' \ / __////7/ /,' \ ,' \ / __/
      | V V // o // _/ | V V // 0 // 0 // _/
      |_n_,'/_n_//_/   |_n_,' \_,' \_,'/_/
                                <
                                 ...'

    WAFW00F - Web Application Firewall Detection Tool

    By Sandro Gauci && Wendel G. Henrique

Can test for these WAFs:

Applicure dotDefender
Art of Defence HyperGuard
Aqtronix WebKnight
Barracuda Aplication Firewall
BinarySec
Cisco ACE XML Gateway
Citrix NetScaler
CloudFlare
DenyALL WAF
eEye Digital Security - SecureIIS
F5 FirePass
F5 TrafficShield
F5 BIG-IP (LTM, APM, ASM)
IBM Web Application Security
IBM DataPower
Imperva SecureSphere
InfoGuard Airlock
Incapsula WAF
Juniper WebApp Secure
Microsoft ISA Server
Microsoft UrlScan
NetContinuum
Profense
TrustWave ModSecurity
Teros WAF
USP Secure Entry Server 

How do I install it?







Download tool : https://goo.gl/zGQgTB