DocumentsDate added

Gooscan (Linux)hot!

01.11.2006

Gooscan is a tool that automates queries against Google search appliances, but with a twist. These particular queries are designed to find potential vulnerabilities on web pages. Think "cgi scanner" that never communicates directly with the target web server, since all queries are sent to Google, not to the target. This is the latest version (v1.0) with many security fixes and updates by Mike Schiraldi. Thanks, Mike!

Hits: 63764

• Details
• Download

Trojan Explorer.exehot!

21.09.2001

This trojan explorer creates a user account called "hack0r" with a password of "cha0srul3sall!" on a windows NT machine, then runs explorer like normal. Plop it in the root of c: and when an admin user logs in, the pathing problem runs this one instead. Then, log in and enjoy. Props to Jimmy for the user creation piece! The trojan was hand-rolled by yours truly. This should definitely set off your virus scanner.

Hits: 55012

• Details
• Download

DNS Predict - Windows versionhot!

17.02.2005

This PERL script, by Jimmy Neutron, is great for determining DNS names with Google. This tool, which is essential for network mapping, accepts two somewhat related words, and a domain name as arguments. The two words are sent through Google sets which expands the words into a list of related words. For example, "earth" and "mars" would expand to Venus, Mercury, Jupiter, Saturn, Neptune, Uranus, Pluto. If fed domain foo.com, dnspredict would then attempt to DNS resolve venus.foo.com, mercury.foo.com, etc. This Windows version is standalone, and requires nothing other than this executable.

Hits: 10737

• Details
• Download

Win2K LDAP authentication bruteforcerhot!

05.04.2001

This never really got finished... Anyhow, I noticed when playing around with LDAP on Win2k that LDAP authentication requests came back with different response codes when using an existing username vs a non-existing one. Using this technique, you can enumerate usernames on the server. In addition, LDAP authentications don't seem to count as invalid logins as far as the 2k user is concerned. This means you can remotely determine usernames, and attempt passwords to your heart's content without bothering the set lockouts. Nice.

Hits: 8161

• Details
• Download
• View

Unicode Attackerhot!

08.08.2001

This basic perl script does the unicode attack. Very basic, but made unicode easier to visualize. My second perl script ever. I didn't realize perl was so c00l! ;-)

Hits: 6517

• Details
• Download