A Penetration Testing Framework - Fsociety Hacking Tools Pack

A Penetration Testing Framework , you will have evry script that a hacker needs

Menu

• Information Gathering
• Password Attacks
• Wireless Testing
• Exploitation Tools
• Sniffing & Spoofing
• Web Hacking
• Private Web Hacking
• Post Exploitation
• INSTALL & UPDATE

Information Gathering :

• Nmap
• Setoolkit
• Port Scanning
• Host To IP
• wordpress user
• CMS scanner
• XSStracer
• Dork - Google Dorks Passive Vulnerability Auditor
• Scan A server's Users

Password Attacks :

• Cupp
• Ncrack

Wireless Testing :

• reaver
• pixiewps

Exploitation Tools :

• Venom
• sqlmap
• Shellnoob
• commix
• FTP Auto Bypass
• jboss-autopwn

Sniffing & Spoofing :

• Setoolkit
• SSLtrip
• pyPISHER
• SMTP Mailer

Web Hacking :

• Drupal Hacking
• Inurlbr
• Wordpress & Joomla Scanner
• Gravity Form Scanner
• File Upload Checker
• Wordpress Exploit Scanner
• Wordpress Plugins Scanner
• Shell and Directory Finder
• Joomla! 1.5 - 3.4.5 remote code execution
• Vbulletin 5.X remote code execution
• BruteX - Automatically brute force all services running on a target
• Arachni - Web Application Security Scanner Framework

Private Web Hacking

• Get all websites
• Get joomla websites
• Get wordpress websites
• Control Panel Finder
• Zip Files Finder
• Upload File Finder
• Get server users
• SQli Scanner
• Ports Scan (range of ports)
• ports Scan (common ports)
• Get server Info
• Bypass Cloudflare

Post Exploitation

• Shell Checker
• POET
• Phishing Framework

Install Me

• Install Directly On System (Only For Linux & Mac System )
• Update instantly When There are New Update

Installation Linux
[✓] git clone https://github.com/Manisso/fsociety.git
[✓] cd fsociety && python fsociety.py
[◉] 0 : INSTALL & UPDATE
[◉] -> 0
[✓] press 0
[✓] Congratulation Fsociety is Installed !

Installation Windows
[✔] Download python 2.7
[✓] Download fsociety
[✓] Extract fsociety into Desktop
[◉]Open CMD and type the following commands:
[✓] $cd Desktop/fsociety-master/
[✓] $python fsociety.py

Use

Download Fsociety

Read More

Ultimate Network Stealther that makes Linux a Ghost In The Net and protects from MITM/DOS/scan - GhostInTheNet

Ultimate Network Stealther that makes Linux a Ghost In The Net and protects from MITM/DOS/scan.

Properties:

• Network Invisibility
• Network Anonymity
• Protects from MITM/DOS
• Transparent
• Cross-platform
• Minimalistic

Dependencies:

• Linux 2.4.26+ - will work on any Linux-based OS, including Whonix and RaspberryPI
• BASH - the whole script
• root privileges - for kernel controlling

Limitations:

• You can still be found with VLAN logs if using ethernet or by triangulation/broadcast if using WiFi
• MAC spoofing won't work if appropriate mitigations has been taken, like DAI or sticky MAC
• Might be buggy with some CISCO switches
• Not suitable for production servers

How it works
The basic and primary network protocol is ARP for IPv4 and NDP (ICMPv6) for IPv6, located in the link and network layer, provides main connectivity in a LAN.
Despite its utility and simplicity, it has numerous vulnerabilities that can lead to a MITM attack and leak of confidentiality.
Patching of such a widely used standard is a practically impossible task.
A very simple, but at the same time effective solution is to disable ARP and NDP responses on an interface and be very cautious with broadcasting.
Considering the varieties of implementations, this means that anyone in the network wouldn't be able to communication with such host, only if the host is willing it-self.
The ARP/NDP cache will be erased quickly afterwards.
Here is an example schema:

A >>> I need MAC address of B >>> B

A <<< Here it is <<< B

A <<< I need MAC address of A <<< B

A >>> I'm not giving it >>> B

To increase privacy, it's advised to spoof the MAC address, which will provide a better concealment.
All this is possible using simple commands in Linux kernel and a script that automates it all.

Analysis
No ARP/NDP means no connectivity, so an absolute stealth and obscurity on the network/link layer.
This protects from all possible DOSes and MITMs (ARP, DNS, DHCP, ICMP, Port Stealing) and far less resource consuming like ArpON.
Such mitigation implies impossibility of being scanned (nmap, arping).
Besides, it doesn't impact a normal internet or LAN connection on the host perspective.
If you're connecting to a host, it will be authorised to do so, but shortly after stopping the communication, the host will forget about you because, ARP/NDP tables won't stay long without a fresh request.
Regarding the large compatibility and cross-platforming, it's very useful for offsec/pentest/redteaming as well.
You see everyone, but nobody sees you, you're a ghost.
Mitigation and having real supervision on the network will require deep reconfiguration of OSes, IDPSes and all other equipement, so hardly feasible.

HowTo
You can execute the script after the connection to the network or just before:

sudo GhostInTheNet.sh on eth0

This will activate the solution until reboot.
If you want to stop it:

sudo GhostInTheNet.sh off eth0

Of course, you will have to make the script executable in the first place:

chmod u+x GhostInTheNet.sh

Notes
ARP/NDP protocol can be exploited for defensive purpose.
Now your Poisontap is literally undetectable and your Tails is even more anonymous.
You should learn some stuff about IPv6.

Download GhostInTheNet

Read More

anti-ARP-spoofing application software and uses active scanning method to detect any ARP-spoofing incidents - shARP

ARP spoofing allows an attacker to intercept data frames on a network, modify the traffic, or stop all traffic. Often the attack is used as an opening for other attacks, such as denial of service, man in the middle, or session hijacking attacks.Our anti- ARP spoofing program, (shARP) detects the presence of a third party in a private network actively. It has 2 mode: defensive and offensive. Defensive mode protects the end user from the spoofer by dissconnecting the user's system from the network and alerts the user by an audio message. The offensive mode dissconnects the user's system from the network and further kicks out the attacker by sending de-authentication packets to his system, unabling him to reconnect to the network until the program is manually reset. The program creates a log file (/usr/shARP/)containing the details of the attack such as, the attackers mac address, mac vendor time and date of the attack. We can identify the NIC of the attackers system with the help of the obtained mac address. If required the attacker can be permanently banned from the netwrk by feeding his mac address to the block list of the router. The whole program is designed specially for linux and is writen in Linux s is hell command (bash command). In the offensive mode the program downloads an open-source application from the internet with the permission of the user namely aircrack-ng (if not present in the user's system already ). Since it is written in python language, you must have python installed on your system for it to work. Visit https://www.aircrack-ng.org for more info.

If the user wants to secure his network by scanning for any attacker he can run the program. the program offers a simple command line interface which makes it easy for the new users.the user can directly access the defensive or offensive mode by inputing the respective command line arguments along with the execution code just as in any other linux command to operate a software through CLI. In case the user inputs any wrong command line argument, the program prompts the user to use the help option. the help option provides the details about the two modes. when the user runs the program in defensive mode, he recieves the original mac address of the gateway. If there is no man in the middle attack, the screen stays idle. As soon as the program detects a spoofer in the network, it outputs the mac address of the spoofer and the time of the attack. It then dissconnects the users's system from the network so as to protect the private data being transfered between the system and the server. It also saves a log file about the attacker for further use. when the user runs the program in offensive mode,he recieves the original mac address of the gateway. If there is no man in the middle attack, the screen stays idle. As soon as the program detects a spoofer in the network, it outputs the mac address of the spoofer and the time of the attack as in the defensive mode. But further, the program puts the user's Network Interface Card to monitor mode with the help of the application 'Airmon-ng'. Then the application 'Aircrack-ng' gets activated and starts sending deauthentication packets to the attacker's system. This process kicks out the attacker from the network. The program also creates a log file about the attack.

How to use

bash ./shARP.sh -r [interface] to reset the network card and driver.  
bash ./shARP.sh -d [interface] to activate the program in defense mode.  
bash ./shARP.sh -o [interface] to activate the program in offense mode.  
bash ./shARP.sh -h             for help.

Download shARP

Read More

Kick Devices Off Your Network - KickThemOut

A tool to kick devices out of your network and enjoy all the bandwidth for yourself. It allows you to select specific or all devices and ARP spoofs them off your local area network.
Compatible with Python 2.6 & 2.7.
Authors: Nikolaos Kamarinakis & David Schütz

Installation
You can download KickThemOut by cloning the Git Repo and simply installing its requirements:

$ git clone https://github.com/k4m4/kickthemout.git

$ cd kickthemout

$ pip install -r requirements.txt

Demo
Here's a short demo:

(For more demos click here )


Disclaimer
KickThemOut is provided as is under the MIT Licence (as stated below). It is built for educational purposes only. If you choose to use it otherwise, the developers will not be held responsible. In brief, do not use it with evil intent.

Download KickThemOut

Read More

Windows Tool For Spoofing The Mac Address - WinMACSpoofer

Windows application for spoofing the MAC address and host name.

Usage
The program must be run in "administrator mode" for the functions to work properly

1. Set a new Random MAC address
   
   • Press the randomize button to generate a random MAC address
   • Click the random radio button and hit "Set New Mac" to reset your MAC address to this new address
2. Set the MAC address manually
   
   • To use a specially selected MAC address enter the desired values in the text fields
   • CAUTION The second nibble can only be set with a value of ('A', 'E', '2' or '6')
   • e.g. xy-xx-xx-xx-xx-xx, y represents the second nibble and must be represented by ('A', 'E', '2' or '6')
   • x can be represented by any hexadecimal value
3. Reset the MAC address
   
   • To revert the MAC adrress back to the network adapter's original values press the "reset" button
4. Change Host Name
   
   • Enter the desired host name and press "Change Host Name"

Download WinMACSpoofer

Read More

A simple Python CLI to Spoof Emails - SimpleEmailSpoofer

A few Python programs designed to help penetration testers with email spoofing.


SimpleEmailSpoofer.py 

A program that spoofs emails. Currently in development 

spoofcheck.py 

A program that checks if a domain can be spoofed from. The program checks SPF and DMARC records for weak configurations that allow spoofing. 
Additionally it will alert if the domain has DMARC configuration that sends mail or HTTP requests on failed SPF/DKIM emails. 

Usage: 

./spoofcheck.py [DOMAIN]

Dependencies 

ºdnspython
ºcolorama

Download SimpleEmailSpoofer

Read More