Skip to content

Commit 51e4137

Browse files
hdks-bughdks-bug
committed
updated
1 parent 6a0f3b0 commit 51e4137

File tree

13 files changed

+338
-2
lines changed

13 files changed

+338
-2
lines changed

‎CNAME‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

docs/exploit/reconnaissance/email/index.md renamed to docs/exploit/reconnaissance/emails/index.md

File renamed without changes.

‎docs/exploit/reconnaissance/leaked-api-keys.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,14 @@ Finding API keys which are leaked is crucial work for penetration testing or bug
1616
trufflehog git https://github.com/<username>/<repo> --results=verified,unknown
1717
```
1818

19+
## Using Leaker
20+
21+
[Leaker](https://github.com/vflame6/leaker) is a passive leak enumeration tool.
22+
23+
```sh
24+
leaker info@example.com
25+
```
26+
1927
## Google Dorks
2028

2129
Google Dorks is useful to search leaked API keys/tokens.

‎docs/exploit/reconnaissance/port-scan.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,14 @@ naabu -p - -host <target-ip>
190190
naabu -sD -s -p 22,80,443 -host <target-ip>
191191
```
192192

193+
## Smap
194+
195+
We can passively scan open ports using [Smap](https://github.com/s0md3v/Smap).
196+
197+
```sh
198+
smap -iL subdomains.txt -oN ports.txt
199+
```
200+
193201
## References
194202

195203
- [Nmap](https://nmap.org/book/nmap-defenses-trickery.html)

‎docs/exploit/reconnaissance/social-account-enumeration.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Social Account Enumeration
2+
3+
## [Sherlock](https://github.com/sherlock-project/sherlock)
4+
5+
```sh
6+
sherlock <SOCIAL_ACCOUT_NAME>
7+
```

docs/exploit/reconnaissance/subdomain/subdomain-discovery.md renamed to docs/exploit/reconnaissance/subdomains/subdomain-discovery.md

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,13 @@ To set API keys, add them to `$HOME/.config/subfinder/provider-config.yaml`. See
1818
```sh
1919
# -all: Use all sources for enumeration
2020
# -cs: Include all sources in the output
21-
subfinder -d example.com -all -cs > tmp.txt ; cat tmp.txt | cut -d "," -f 1 > domains.txt ; rm tmp.txt
21+
subfinder -d example.com -all -cs > tmp.txt ; cat tmp.txt | cut -d "," -f 1 > subdomains.txt ; rm tmp.txt
22+
```
23+
24+
In addition, we can **enumerate active web servers** from the collected subdomains using [httpx](https://github.com/projectdiscovery/httpx):
25+
26+
```sh
27+
cat subdomains.txt | httpx -silent -no-color -title -status-code -tech-detect > web_servers.txt
2228
```
2329

2430
### BBOT

docs/exploit/reconnaissance/subdomain/subdomain-takeover.md renamed to docs/exploit/reconnaissance/subdomains/subdomain-takeover.md

File renamed without changes.

‎docs/exploit/web/index.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,48 @@ nmap --script http-methods -p 80,443 <target-ip>
2424
whois example.com
2525
```
2626

27+
### [Wapiti](https://github.com/wapiti-scanner/wapiti)
28+
29+
```sh
30+
# Get login cookies
31+
wapiti-getcookie -u https://example.com/login -c cookies.json
32+
33+
# Scan
34+
wapiti -u https://example.com/ -c cookies.json
35+
36+
# List modules
37+
wapiti --list-modules
38+
39+
## Scan with specific modules
40+
# Fuzzing backups, directories, files
41+
wapiti -u https://example.com/ -c cookies.json -m backup,buster
42+
# Brute force login attemps
43+
wapiti -u https://example.com/login -c cookies.json -m brute_login_form
44+
# Bypass access control
45+
wapiti -u https://example.com/admin -c cookies.json -m htaccess
46+
# CMS detection
47+
wapiti -u https://example.com/ -c cookies.json -m cms
48+
# LDAP injection
49+
wapiti -u https://example.com/ -c cookies.json -m ldap
50+
# log4shell
51+
wapiti -u https://example.com/ -c cookies.json -m log4shell
52+
# Nikto
53+
wapiti -u https://example.com/ -c cookies.json -m nikto
54+
# spring4shell
55+
wapiti -u https://example.com/ -c cookies.json -m spring4shell
56+
# Subdomain takeover
57+
wapiti -u https://sub.example.com --scope subdomain -m takeover
58+
# Time-based SQL injection
59+
wapiti -u https://example.com/ -c cookies.json -m timesql
60+
# WordPress
61+
wapiti -u https://example.com/ -c cookies.json -m wp_enum
62+
# XXE
63+
wapiti -u https://example.com/ -c cookies.json -m xxe
64+
65+
# Scan API endpoints
66+
wapiti -u https://api.example.com/ --swagger /path/to/swagger.json
67+
```
68+
2769
### Nikto
2870

2971
```sh

‎docs/malware/development/set-icon-for-an-executable.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Set Icon for an Executable
2+
3+
If you want to set a custom icon for your executable file, you can set it using some tools such as Resource Hacker.
4+
At first, you need to prepare a .ico file of the icon. To convert JPG/PNG to ICO, you may use [Favicon Converter](https://favicon.io/favicon-converter/).
5+
6+
## Using Resource Hacker
7+
8+
1. Launch **Resource Hacker**.
9+
2. Open your executable file.
10+
3. Click **Action -> Add an Image or Other Binary Resource**, then select the .ico file.
11+
4. Click **Add Resource**.
12+
5. Save the executable.

‎docs/malware/infostealers/target-files-for-infostealers.md‎

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
# Target Files for Infostealers
2+
3+
Since the files targeted by infostealers on compromised machines share common characteristics, I have summarized them below.
4+
5+
## AI
6+
7+
- OpenClaw: `%USERPROFILE%\.openclaw`
8+
9+
## Browser Credentials
10+
11+
### Chromium-based Browsers
12+
13+
- 360browser: `%LOCALAPPDATA%\360browser\Browser\User Data`
14+
- Brave: `%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data`
15+
- CentBrowser: `%LOCALAPPDATA%\CentBrowser\User Data`
16+
- Chrome: `%LOCALAPPDATA%\Google\Chrome\User Data`
17+
- CocCoc Browser: `%LOCALAPPDATA%\CocCoc\Browser\User Data`
18+
- Edge: `%LOCALAPPDATA%\Microsoft\Edge\User Data`
19+
- Opera: `%APPDATA%\Opera Software\Opera Stable`
20+
- Opera GX: `%APPDATA%\Opera Software\Opera Stable GX Stable`
21+
- Vivaldi: `%LOCALAPPDATA%\Vivaldi\User Data`
22+
- Yandex: `%LOCALAPPDATA%\Yandex\YandexBrowser\User Data`
23+
24+
Each Chromium-based browser stores a significant amount of sensitive information within its corresponding profile directory. Infostealers selectively extract specific data from these locations, particularly the following:
25+
26+
- **Decryption key**: `Local State`
27+
- **Autofill data**: `Default\Web Data` (SQL database)
28+
- **Local Storage**: `Default\Local Storage\leveldb` (LevelDB)
29+
- **Session Storage**: `Default\Session Storage` (LevelDB)
30+
- **Browsing History**: `Default\History` (SQL database)
31+
- **Browser Extensions**: `Default\Local Extension Settings` (LevelDB)
32+
33+
At the same time, browser-side protection mechanisms continue to improve. For example, Google Chrome has adopted **App-Bound Encryption**, making it significantly more difficult to steal credentials and cookies.
34+
35+
However, attackers attempt to bypass these protections by leveraging implementations such as [Chrome App Bound Encryption Decryption](https://github.com/xaitax/Chrome-App-Bound-Encryption-Decryption), which demonstrate methods to circumvent App-Bound Encryption and recover protected data.
36+
37+
#### Browser Extension IDs
38+
39+
In Chromium-based browsers, the `User Data\Default\Local Extension Settings` directory contains ID-specific subdirectories corresponding to installed browser extensions. Infostealers target and exfiltrate the **LevelDB** data stored within each of these directories.
40+
41+
**Authenticators**
42+
43+
- Aegis Authenticator: `ppdjlkfkedmidmclhakfncpfdmdgmjpm`
44+
- Authenticator: `bhghoamapcdpbohphigoooaddinpkbai`
45+
- Authy: `gjffdbjndmcafeoehgdldobgjmlepcal`
46+
- Duo Mobile: `eidlicjlkaiefdbgmdepmmicpbggmhoj`
47+
- EOS Authenticator: `oeljdldpnmdbchonielidgobddffflal`
48+
- FreeOTP: `elokfmmmjbadpgdjmgglocapdckdcpkn`
49+
- Google Authenticator: `khcodhlfkpmhibicdjjblnkgimdepgnd`
50+
- LastPass Authenticator: `cfoajccjibkjhbdjnpkbananbejpkkjb`
51+
- MEW CX: `nlbmnnijcnlegkjjpcfjclmcfggfefdm`
52+
- Microsoft Authenticator: `bfbdnbpibgndpjfhonkflpkijfapmomn`
53+
- OTP Auth: `bobfejfdlhnabgglompioclndjejolch`
54+
- Sollet: `fhmfendgdocmcbmfikdcogofphimnkno`
55+
56+
**Crypto Wallets**
57+
58+
- Airbitz: `ieedgmmkpkbiblijbbldefkomatsuahh`
59+
- Atomic: `bhmlbgebokamljgnceonbncdofmmkedg`
60+
- BinanceChain: `fhbohimaelbohpjbbldcngcnapndodjp`
61+
- BitBox: `ocmfilhakdbncmojmlbagpkjfbmeinbd`
62+
- BRD: `nbokbjkelpmlgflobbohapifnnenbjlh`
63+
- Coin98: `aeachknmefphepccionboohckonoeemg`
64+
- Coinomi: `blbpgcogcoohhngdjafgpoagcilicpjh`
65+
- Copay: `ieedgmmkpkbiblijbbldefkomatsuahh`
66+
- Digital Bitbox: `dbhklojmlkgmpihhdooibnmidfpeaing`
67+
- Electrum: `hieplnfojfccegoloniefimmbfjdgcgp`
68+
- Exodus: `idkppnahnmmggbmfkjhiakkbkdpnmnon`
69+
- GreenAddress: `gflpckpfdgcagnbdfafmibcmkadnlhpj`
70+
- Guarda Wallet: `fcglfhcjfpkgdppjbglknafgfffkelnm`
71+
- iWallet: `kncchdigobghenbbaddojjnnaogfppfj`
72+
- Jaxx Liberty: `mhonjhhcgphdphdjcdoeodfdliikapmj`
73+
- KeepKey: `dojmlmceifkfgkgeejemfciibjehhdcl`
74+
- LastPass: `gabedfkgnbglfbnplfpjddgfnbibkmbb`
75+
- Keplr: `dmkamcknogkgcdfhhbddcghachkejeap`
76+
- Ledger Live: `pfkcfdjnlfjcmkjnhcbfhfkkoflnhjln`
77+
- Ledger Wallet: `hbpfjlflhnmkddbjdchbbifhllgmmhnm`
78+
- MetaMask: `nkbihfbeogaeaoehlefnkodbefgpgknn`
79+
- Mycelium: `pidhddgciaponoajdngciiemcflpnnbg`
80+
- NeoLine: `cphhlgmgameodnhkjdmkpanlelnlohao`
81+
- OneKey: `ilbbpajmiplgpehdikmejfemfklpkmke`
82+
- Phantom: `bfnaelmomeimhlpmgjnjophhpkkoljpa`
83+
- Ronin: `fnjhmkhhmkbjkkabndcnnogagogbneec`
84+
- Samourai Wallet: `apjdnokplgcjkejimjdfjnhmjlbpgkdi`
85+
- Station Wallet: `aiifbnbfobpmeekipheeijimdpnlpgpp`
86+
- TezBox: `mnfifefkajgofkcjkemidiaecocnkjeh`
87+
- TronLink: `ibnejdfjmmkpcnlpebklmnkoeoihofec`
88+
- Trust Wallet: `pknlccmneadmjbkollckpblgaaabameg`
89+
- Wombat: `amkmjjmmflddogmhpjloimipbofnfjih`
90+
91+
**Password Managers**
92+
93+
- Avira Password Manager: `caljgklbbfbcjjanaijlacgncafpegll`
94+
- Bitwarden: `inljaljiffkdgmlndjkdiepghpolcpki`
95+
- Browserpass: `naepdomgkenhinolocfifgehidddafch`
96+
- Dashlane: `flikjlpgnpcjdienoojmgliechmmheek`
97+
- KeePassXC: `kgeohlebpjgcfiidfhhdlnnkhefajmca`
98+
- Keeper: `gofhklgdnbnpcdigdgkgfobhhghjmmkj`
99+
- NordPass: `njgnlkhcjgmjfnfahdmfkalpjcneebpl`
100+
- Norton Password Manager: `admmjipmmciaobhojoghlmleefbicajg`
101+
- RoboForm: `hppmchachflomkejbhofobganapojjol`
102+
- Trezor Password Manager: `imloifkgjagghnncjkhggdhalmcnfklk`
103+
- Zoho Vault: `igkpcodhieompeloncfnbekccinhapdb`
104+
105+
**Others**
106+
107+
- Splikity: `jhfjfclepacoldmjmkmdlmganfaalklb`
108+
- YubiKey: `mammpjaaoinfelloncbbpomjcihbkmmc`
109+
110+
### Gecko-based Browsers
111+
112+
- Firefox: `%APPDATA%\Mozilla\Firefox\Profiles\<profile>`
113+
114+
Gecko-based browsers are targeted through files stored within the profile directory, including `cert9.db`, `key4.db`, `logins.json`, `cookies.sqlite`, `formhistory.sqlite`, `places.sqlite`, `sessionstore.jsonlz4`, and `storage\default\moz-extension+++`.
115+
116+
In some cases, the entire profile directory is exfiltrated, and tools such as [firefox_decrypt](https://github.com/unode/firefox_decrypt) are used to extract stored credentials.
117+
118+
## Chat Clients
119+
120+
- Discord: `%APPDATA%\discord`
121+
- Telegram: `%APPDATA%\Telegram Desktop\tdata`
122+
123+
## Crypto Wallets
124+
125+
- Armory: `%APPDATA%\Armory`
126+
- Atomic: `%APPDATA%\atomic`
127+
- Binance: `%APPDATA%\Binance`
128+
- Bitcoin Core: `%APPDATA%\Bitcoin\wallets`
129+
- Coinomi: `%LOCALAPPDATA%\Coinomi`
130+
- Daedalus Mainnet: `%APPDATA%\Daedalus Mainnet`
131+
- Dash Core: `%APPDATA%\DashCore`
132+
- Dogecoin Core: `%APPDATA%\Dogecoin`
133+
- Electron Cash: `%APPDATA%\Electron Cash`
134+
- Electrum: `%APPDATA%\Electrum`
135+
- Electrum LTC: `%APPDATA%\Electrum-LTC`
136+
- Ethereum: `%APPDATA%\Ethereum`
137+
- Exodus: `%APPDATA%\Exodus`
138+
- JaxxClassic: `%APPDATA%\Jaxx\Local Storage\leveldb`
139+
- JaxxLiberty: `%APPDATA%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb`
140+
- Ledger Live: `%APPDATA%\Ledger Live`
141+
- Litecoin Core: `%APPDATA%\Litcoin`
142+
- Monero GUI: `%USERPROFILE%\Documents\Monero\wallets`
143+
- Raven Core: `%APPDATA%\Raven`
144+
- Wasabi Wallet: `%APPDATA%\WalletWasabi\Client`
145+
- Zcash: `%APPDATA%\Zcash`
146+
147+
## Email Clients
148+
149+
- Thunderbird: `%APPDATA%\Thunderbird\Profiles`
150+
151+
## Game Clients
152+
153+
- Steam: `%ProgramFiles(x86)%\Steam`

0 commit comments

Comments
 (0)