Skip to content

Instantly share code, notes, and snippets.

@thecyberd3m0n

thecyberd3m0n/gist:ab0850dbdfeb3706808f5bbee52aed22

Created February 27, 2022 08:43
Show Gist options
  • Save thecyberd3m0n/ab0850dbdfeb3706808f5bbee52aed22 to your computer and use it in GitHub Desktop.
Save thecyberd3m0n/ab0850dbdfeb3706808f5bbee52aed22 to your computer and use it in GitHub Desktop.
Download ZIP
OpRedScare
Raw
gistfile1.txt
https://rentry.co/opredscare
+-------------------------------------------------------------------------------------+
OBJECTIVE - To disable Russian and Belarusian infrastructure (banking, transportation, military, energy)
DO NOT TARGET HOSPITALS, EDUCATION, OR SOCIAL SERVICES
TARGETS :
Russia
- https://anonfiles.com/hcPfm8K5xe/gov.ru_domains_csv
- https://anonfiles.com/j4Pdm9K2x5/mil.ru_domains_csv
Belarus
- https://anonfiles.com/n8K9y5K1x1/mil.by_domains_csv
- https://anonfiles.com/paK7y0Kcxc/gov.by_domains_csv
Request from the Vice Minister of Ukraine
- https://pastebin.com/fH6hyaJG
Basic outline of what to do:
Run masscan of Russian IP space for specific ports.
Collect scan data to see what is responding.
Run focused scans with specialized scanners - SQLmap,OpenVAS, WPScan, etc.
Validate data with multiple scans and OSINT.
Find vulnerability and exploit data based on scans.
Exploit vulnerabilities with MetaSploit, etc.
Take down these services.
Disclaimer:
Don't do attacks under the OPUkraine banner as this could compromise the OP
Guides:
How to run masscan looking for OSINT data: https://pad.riseup.net/p/scanner-howto-keep
Find real IP's behind CloudFlare: https://www.secjuice.com/finding-real-ips-of-origin-servers-behind-cloudflare-or-tor/
Knowledge is power - Use Tor, VPN, or Proxies!
And rememeber.....OPSEC! OPSEC! OPSEC!
Recommended Software:
https://www.torproject.org/
https://www.whonix.org/
https://tails.boum.org/
https://www.kali.org/
https://www.virtualbox.org/
Quickly get up to speed, hacking tips and tricks: http://archiveiya74codqgiixo33q62qlrqtkgmcitqx5u2oeqnmn5bpcbiyd.onion/m5spr
Brush up on Log4j: https://www.reddit.com/r/blueteamsec/comments/rd38z9/log4j_0day_being_exploited/
Buy web shells, cpanels and RDP's: https://xleet.pw/
ReconFTW: https://github.com/six2dez/reconftw
Shodan: admin bypass: http://kfahv6wfkbezjyg4r6mlhpmieydbebr5vkok5r34ya464gqz6c44bnyd.onion/p/4QfmFLDBg5Wv7NISCtkp-keep
Bruteforce servers on mass!: http://kfahv6wfkbezjyg4r6mlhpmieydbebr5vkok5r34ya464gqz6c44bnyd.onion/p/uL5oQGQCjfMiB3An3PV--keep
https://pad.riseup.net/p/uL5oQGQCjfMiB3An3PV--keep
Open Source Intelligence Tools:
https://github.com/cipher387
Autonomous Systems Numbers:
Russia - https://bgp.he.net/search?search%5Bsearch%5D=russia&commit=Search
Belarus - https://bgp.he.net/search?search%5Bsearch%5D=belarus&commit=Search
Russian IP Blocks:
https://pastebin.6com/H3FU4X3h
Belarus IP Blocks:
https://apps.db.ripe.net/db-web-ui/query?bflag=false&dflag=false&rflag=true&searchtext=Belarus&source=RIPE
Russian mil.ru and gov.ru domains:
https://anonfiles.com/j4Pdm9K2x5/mil.ru_domains_csv
https://anonfiles.com/hcPfm8K5xe/gov.ru_domains_csv
https://pastebin.com/rbqKeZ1p
Belarus mil.by and gov.by domains:
https://anonfiles.com/r0l0n2Kax3/mil.by_domains_csv
https://anonfiles.com/valfn9K0xc/gov.by_domains_csv
Russian Network Recon:
https://pad.riseup.net/p/BtLcKr1O6bcMyBVvk6NL
Russian hosts and info: (biggie list)
strongerw2ise74v3duebgsvug4mehyhlpa7f6kfwnas7zofs3kov7yd.onion/pmn27ntm1/ik41es
https://pad.riseup.net/p/Euh-UQeWC-gqZdLcObkb
DNS Servers
ns3.rttv.ru.
91.217.21.1
ns8-l2.nic.ruRU-CENTER
Russia pns31.cloudns.net.
185.136.96.66
pns31.cloudns.netCLOUDNSNET
United States ns33.cloudns.net.
54.36.26.145
ns33.cloudns.netOVH
France ns34.cloudns.net.
185.206.180.104
ns34.cloudns.netPUBLICLOUD
Germany ns4.rttv.ru.
91.217.20.1
ns4-l2.nic.ruRU-CENTER
Russia pns33.cloudns.net.
185.136.98.66
pns33.cloudns.netCLOUDNSNET
United States ns32.cloudns.net.
209.58.140.85
ns32.cloudns.netLEASEWEB-USA-SFO-12
United States ns1.rttv.ru.
109.73.15.35
ns1.rttv.ruRUSSIA_TODAY
Russia ns2.rttv.ru.
185.79.236.245
ns2.rttv.ruRTTV
Russia pns34.cloudns.net.
185.136.99.66
pns34.cloudns.netCLOUDNSNET
unknown ns31.cloudns.net.
109.201.133.111
ns31.cloudns.netNFORCE
Netherlands pns32.cloudns.net.
185.136.97.66
pns32.cloudns.netCLOUDNSNET
unknown
MX Records ** This is where email for the domain goes...
10 aspmx.l.google.com.
142.250.123.26
gh-in-f26.1e100.netGOOGLE
United States 30 aspmx3.googlemail.com.
64.233.186.26
cb-in-f26.1e100.netGOOGLE
United States 30 aspmx4.googlemail.com.
209.85.202.27
dg-in-f27.1e100.netGOOGLE
United States 20 alt2.aspmx.l.google.com.
64.233.186.26
cb-in-f26.1e100.netGOOGLE
United States 30 aspmx5.googlemail.com.
64.233.184.27
wa-in-f27.1e100.netGOOGLE
United States 20 alt1.aspmx.l.google.com.
108.177.12.27
ua-in-f27.1e100.netGOOGLE
United States 30 aspmx2.googlemail.com.
108.177.12.27
ua-in-f27.1e100.netGOOGLE
United States
TXT Records ** Find more hosts in Sender Policy Framework (SPF) configurations
"2022011010555941x7yj86eamnw0fqybdwpugz9sa9coq2jlzkv1a4rr04avj64t""v=spf1 include:_spf.google.com ~all"
Host Records (A) ** this data may not be current as it uses a static database (updated monthly)
rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx207.244.80.170
LEASEWEB-USA-WDC
United States creativelab.rt.com
HTTP: nginx54.194.41.141
ec2-54-194-41-141.eu-west-1.compute.amazonaws.comAMAZON-02
Ireland mail1.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx185.79.236.186
mail1.rt.comRTTV
Russia social.rt.com
HTTP: nginx
HTTPS: nginx
SSH: SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.2
HTTP TECH: nginx95.131.27.119
DTLN
Russia ns0.rt.com
207.244.80.161
LEASEWEB-USA-WDC
United States ns.wpc.ar.rt.com
0.0.0.0
unknown wpc.fr.rt.com
37.48.108.104
LEASEWEB-NL-AMS-01 Netherlands
Netherlands ar.wpc.rt.com
37.48.108.110
LEASEWEB-NL-AMS-01 Netherlands
Netherlands m102.subscribe.rt.com
185.9.230.102
m102.subscribe.rt.comCIREX
Russia ns4.rt.com
185.79.236.249
ns4.rt.comRTTV
Russia dev.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx185.79.236.100
RTTV
Russia ns3.rt.com
82.202.190.82
KL-KDP
Russia api.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx89.191.237.181
ROSTELECOM-AS
Russia ns.wpc.fcm.rt.com
0.0.0.0
unknown wpc.fcm.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx185.79.236.168
RTTV
Russia ns1.rt.com
82.202.189.162
KL-KDP
Russia monitoring.wpc.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.165
mail2.rt.comROSTELECOM-AS
Russia m103.subscribe.rt.com
185.9.230.103
m103.subscribe.rt.comCIREX
Russia dvlp.wpc.rt.com
89.191.237.180
ROSTELECOM-AS
Russia files.wpc.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.185
ROSTELECOM-AS
Russia contacts.rt.com
HTTP: nginx
HTTPS: nginx
SSH: SSH-2.0-OpenSSH_7.4
HTTP TECH: nginx91.218.228.51
hosted-by.ihc.ruEUROBYTE Eurobyte LLC
Russia en.wpc.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx37.48.108.112
LEASEWEB-NL-AMS-01 Netherlands
Netherlands mp.wpc.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.184
ROSTELECOM-AS
Russia wpc.es.rt.com
207.244.80.171
LEASEWEB-USA-WDC
United States ns.wpc.es.rt.com
0.0.0.0
unknown ddbm.rt.com
HTTP: nginx
HTTPS: nginx
SSH: SSH-2.0-OpenSSH_7.4
HTTP TECH: nginx91.218.228.51
hosted-by.ihc.ruEUROBYTE Eurobyte LLC
Russia fcm.wpc.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.182
ROSTELECOM-AS
Russia ns.wpc.en.rt.com
0.0.0.0
unknown m104.subscribe.rt.com
185.9.230.104
m104.subscribe.rt.comCIREX
Russia ns5.rt.com
37.48.108.98
LEASEWEB-NL-AMS-01 Netherlands
Netherlands charity.rt.com
109.73.15.153
RUSSIA_TODAY
Russia mgmt.wpc.rt.com
HTTP: nginx
HTTPS: nginx
SSH: SSH-2.0-OpenSSH_8.1
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.163
ROSTELECOM-AS
Russia ru.wpc.rt.com
37.48.108.113
LEASEWEB-NL-AMS-01 Netherlands
Netherlands subscribe.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.183
ROSTELECOM-AS
Russia ns.wpc.fr.rt.com
0.0.0.0
unknown wpc.dvlp.rt.com
89.191.237.180
ROSTELECOM-AS
Russia ns.wpc.ru.rt.com
0.0.0.0
unknown wpc.bk.rt.com
185.79.236.196
RTTV
Russia ns.wpc.bk.rt.com
0.0.0.0
unknown ns.wpc.spprj.rt.com
0.0.0.0
unknown doc.wpc.rt.com
37.48.108.111
LEASEWEB-NL-AMS-01 Netherlands
Netherlands wpc.mp.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.184
ROSTELECOM-AS
Russia ns.wpc.d.rt.com
0.0.0.0
unknown bk2.wpc.rt.com
89.191.237.150
ROSTELECOM-AS
Russia mail1.wpc.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx185.79.236.186
mail1.rt.comRTTV
Russia wpc.ar.rt.com
37.48.108.103
LEASEWEB-NL-AMS-01 Netherlands
Netherlands ns2.rt.com
207.244.80.162
LEASEWEB-USA-WDC
United States wpc.files.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.185
ROSTELECOM-AS
Russia wiki-tst.api.rt.com
HTTP: nginx/1.18.0 (Ubuntu)
HTTPS: nginx/1.18.0 (Ubuntu)
SSH: SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.337.143.10.157
hosted-by.ihc.ruEUROBYTE Eurobyte LLC
Russia bk.wpc.rt.com
89.191.237.170
ROSTELECOM-AS
Russia m101.subscribe.rt.com
185.9.230.101
m101.subscribe.rt.comCIREX
Russia de.wpc.rt.com
37.48.108.107
LEASEWEB-NL-AMS-01 Netherlands
Netherlands wpc.de.rt.com
37.48.108.107
LEASEWEB-NL-AMS-01 Netherlands
Netherlands fr.wpc.rt.com
37.48.108.104
LEASEWEB-NL-AMS-01 Netherlands
Netherlands mail2.wpc.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.165
mail2.rt.comROSTELECOM-AS
Russia wpc.d.rt.com
37.48.108.111
LEASEWEB-NL-AMS-01 Netherlands
Netherlands mail2.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.165
mail2.rt.comROSTELECOM-AS
Russia wpc.monitoring.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.165
mail2.rt.comROSTELECOM-AS
Russia ns6.rt.com
37.48.108.97
LEASEWEB-NL-AMS-01 Netherlands
Netherlands chtd.rt.com
HTTP: nginx
HTTPS: nginx
SSH: SSH-2.0-OpenSSH_7.4
HTTP TECH: nginx91.218.228.51
hosted-by.ihc.ruEUROBYTE Eurobyte LLC
Russia ns7.rt.com
89.191.237.247
ROSTELECOM-AS
Russia es.wpc.rt.com
37.48.108.115
LEASEWEB-NL-AMS-01 Netherlands
Netherlands spprj.wpc.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx185.79.236.160
RTTV
Russia award.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.184
ROSTELECOM-AS
Russia wpc.en.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx37.48.108.105
LEASEWEB-NL-AMS-01 Netherlands
Netherlands ns.wpc.de.rt.com
0.0.0.0
unknown wpc.spprj.rt.com
HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx185.79.236.160
RTTV
Russia wpc.ru.rt.com
207.244.80.181
LEASEWEB-USA-WDC
United States
Military d
Vulnerable targets:
https://sudak.rk.gov.ru/
Linux sudak.rk.gov.ru 2.6.26.3-29.0.140asp.i686 #1 SMP Mon Sep 15 07:08:05 EDT 2008 i686
Samba (port 445):
Samba3.2.0-17.0.140asp
SMB Status:
Authentication: disabled
SMB Version: 1
OS: Unix
Software: Samba 3.2.0-17.0.140asp
Capabilities: dfs, extended-security, infolevel-passthru, large-files, large-readx, large-writex, level2-oplocks, lock-and-read, nt-find, nt-smb, nt-status, raw-mode, rpc-remote-api, unicode, unix
Shares
Name Type Comments
work Disk Share for work
consult Disk Share for consultant
www Disk Share for web
IPC$ IPC IPC Service (Samba Server)
ns8-l2.nic.ru.
91.217.21.1
ns8-l2.nic.ruRU-CENTER
Russia ns4-cloud.nic.ru.
185.42.137.111
ns4-cloud.nic.ruNETNOD-IX Netnod Internet Exchange Sverige AB
Sweden ns8-cloud.nic.ru.
194.58.196.62
ns8-cloud.nic.ruNETNOD-IX Netnod Internet Exchange Sverige AB
Sweden ns3-l2.nic.ru.
193.232.146.1
ns3-l2.nic.ruRU-CENTER
Russia ns4-l2.nic.ru.
91.217.20.1
ns4-l2.nic.ruRU-CENTER
Russia
MX Records ** This is where email for the domain goes...
TXT Records ** Find more hosts in Sender Policy Framework (SPF) configurations
Host Records (A) ** this data may not be current as it uses a static database (updated monthly)
www.defence.ru
HTTP: ddos-guard
HTTPS: ddos-guard185.215.4.19
DDOS-GUARD
Russia
To get around DDOS-Guard, try finding
http://budget.gov.ru/dms - database management web interface e
Pub: Feb 25 2022 14:47 UTC
Edit: Feb 26 2022 21:26 UTC
Views: 2100
new·what·how·langs
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment