Starefossen

Sessions

New Session

• tmux new [-s name] [cmd] (:new) - new session

Switch Session

• tmux ls (:ls) - list sessions
• tmux switch [-t name] (:switch) - switches to an existing session

jesusprubio

Proposal: Node.js penetration test framework

Hi guys! Since I started to write Bluebox-ng I've been tracking the different security projects I found written in Node.js. Now we've published the first stable version we think it's the right moment to speak among us (and, of course, everyone interested in it :).

Why?

• I think we're rewriting the same stuff in our respective projects again and again. For example, almost any tool supports IPv6 because the functions we need are still not present in the Node core and the libraries I found (IMHO) were not enough.
• There're different projects implementing exactly the same thing, ie: port scanners.
• We're working in a too new environment, so we need to make it together.

kaito834

#!/usr/bin/env python
#
# tested by Python 3.4.3 on Windows 8.1
# Python 3.4.3 (v3.4.3:9b73f1c3e601, Feb 24 2015, 22:43:06) [MSC v.1600 32 bit (Intel)] on win32

# If you need to access web site/service via proxy, set http_proxy or https_proxy.
# https://docs.python.org/3/library/urllib.request.html#urllib.request.ProxyHandler
# set http_proxy=http://127.0.0.1:8888/
# set https_proxy=https://127.0.0.1:8888/

MaxMyalkin

public static void addTests(ClassLoader loader, TestSuite suite) {
        try {
            Class[] classes = getClasses("ru.mail.mailbox.cmd.server", loader);
            System.out.println("class size " + classes.length);
            for(Class clazz : classes) {
                for(Method method : clazz.getDeclaredMethods()) {
                    for(Annotation annotation : method.getAnnotations()) {
                        if(annotation instanceof MockMethod) {
//                            suite.addTest(TestSuite.createTest(clazz, method.getName()));
                            System.out.println("add method " + method.getName() + " for class " + clazz.getName());

kaito834

#!/usr/bin/env python
#
# I tested by Python 3.4.3 on Windows 8.1
# Python 3.4.3 (v3.4.3:9b73f1c3e601, Feb 24 2015, 22:43:06) [MSC v.1600 32 bit (Intel)] on win32

import urllib.request
import getpass

# If you access to url below via Proxy,
# set environment variable 'http_proxy' before execute this.

tikolakin

Directly from CLI

alias x='exit'
funcsave x

or create a file in

~/.config/fish/functions 

with name

skulltech

#!/usr/bin/env ruby
# apk_backdoor.rb
# This script is a POC for injecting metasploit payloads on 
# arbitrary APKs.
# Authored by timwr, Jack64
#


require 'nokogiri'
require 'fileutils'

unfo

How to pass the OSCP

1. Recon
2. Find vuln
3. Exploit
4. Document it

Recon

Unicornscans in cli, nmap in msfconsole to help store loot in database.

artttj

import urllib.request
import urllib.response

userName = "user"
passWord  = "password"
top_level_url = "http://127.0.0.1/api/update"

# create an authorization handler
p = urllib.request.HTTPPasswordMgrWithDefaultRealm()
p.add_password(None, top_level_url, userName, passWord);

royshil

# This is kind-of based off of this:  http://stackoverflow.com/questions/5974595/download-all-the-linksrelated-documents-on-a-webpage-using-python

import cookielib 
import urllib2 
import mechanize
from time import sleep
import os
import cgi

# A routine to download a file from a link, by simulating a click on it