8,753 reputation
2642
bio website
location
age
visits member for 4 years, 5 months
seen 1 hour ago

1d
comment Web Crawler for ASP.NET site
Have found that Netsparker Community or Pro editions work on ASP.NET apps especially well
Apr
14
comment What is the fastest way to scan all ports of a single machine
Use fast ports (e.g., 10GbE, GbE) and either a fast switch backplane (e.g., Cisco Catalyst 6500) or a cross-over cable with unicornscan 10.0.0.0/24:50000-62000 -L 45 -r 10000 -Iv -mU
Apr
10
comment what is the best keylogger for security uses?
Here is a recent screencast of Cobalt Strike Beacon -- youtube.com/watch?v=7Yl_JJymQcY
Apr
10
comment what is the best keylogger for security uses?
I agree. Thoughts on Cobalt Strike Beacon? I'm going to update my answer with it
Apr
9
comment How can I portscan large subnets?
I would use dnmap to do this, but only after careful analysis using bnat_suite and some selective nmap point-solution analysis. See my question and answer here -- security.stackexchange.com/a/82529/140 -- with an additional note that many other answers to your question and mine were inaccurate. For example, nmap requires very certain flag combinations. Using -PS or the timeout flags may cause massive errors and omissions.
Apr
9
comment How can Antivirus differentiate between a Trojan and a normal remote desktop application software?
this is an incredibly good answer
Apr
1
comment Is there an HSTS equivalent for DNSSec?
dns2proxy breaks HSTS and yes, one could also downgrade or block DNSSec. It is up to the user to write their own network stack that only supports DNSSec
Mar
24
comment How to pen-test RAP applications
retire.js and Burp Suite Professional may be your best bets then
Mar
18
comment Firewalk through a Firewall on our subnet
Try using `strace -fx firewalk <flags> <ip> <ip>' and see what's stopping it. Or use tcpdump (or Wireshark) and compare the firewalkk traffic from the original tool to the nmap NSE scripts.
Mar
17
comment Firewalk through a Firewall on our subnet
Try the -t, -T, and -x flags with values that make sense to your environment as well
Mar
17
comment Firewalk through a Firewall on our subnet
@ Shrout1: Did you try putting them both together like the above?
Mar
17
comment Firewalk through a Firewall on our subnet
Perhaps it would be `firewalk -d 80 -n -pTCP 192.168.1.2 192.168.3.11''? See the man page -- freebsd.org/cgi/…
Mar
17
comment Firewalk through a Firewall on our subnet
Can you try specifying more flags for firewalk(1)? e.g., `firewalk -n -pTCP -S25,53,80,443,465,587,5353 192.168.1.2 192.168.3.11'. Maybe it's a name resolution or ICMP/UDP issue?
Mar
10
comment proxychains-ng with nmap issues
I had almost exactly this -- github.com/rofl0r/proxychains-ng/blob/master/src/… -- except the last line. I had "http proxyservername 8080 username passwordsecret" instead of "socks4 127.0.0.1 9050"
Mar
10
comment How to bypass Nmap blockage?
This might work! I'd also try port 88 or ports 9100-9107 since Kerberos and printer traffic are likely to be hole-punched through any interfering proxy or fireall.
Mar
10
comment How do I report a vulnerability to a large organization that doesn't believe it has a problem?
The HD Moore method is to notify the company, wait 15 days, notify CERT, wait 45 days, if CERT releases anything then call the press, even if CERT doesn't release anything (and even if they do) then start building a module for Metasploit, commit it to unstable, and make sure it gets committed to master within 30 days
Mar
10
comment Transparent way to send logs from honeypot to logging server
LibVMI -- libvmi.com -- gets inside the guest VM from the host hypervisor.
Mar
10
comment Similar products to MS EMET
Invincea has a comparison to EMET -- invincea.com/why-invincea/microsoft-emet-comparison
Mar
10
comment Manipulating data during a MiTM
I prefer Kali Linux, a few Alfa WiFi external-USB radios, and to `apt-get install mana-toolkit mitmf'. These last two tools provide a lot more than the MITM-focused tools I've seen in 2014 or earlier
Mar
10
comment Open-source penetration-test automation
@ schroeder : Yes, I came across AutoPwn -- github.com/nccgroup/autopwn -- while writing this post. It supports serial and parallel, multi-tool operation. For me, personally, I'd just rather run screen(1) in one or more X11 terminals (e.g., rxvt). I like to decide when I want to make something run in parallel, and I like to watch the output. Storing data in Dradis or LAIR allows me to organization my information rather well. Thoughts?