hackUtils: hack tool kit for pentest and web security research

by do son · Published · Updated

hackUtils

hackUtils

It is a hacking toolkit for pentest and web security research, which is based on BeautifulSoup bs4 module.

Feature

  • Add exploit module for Joomla 1.5 – 3.4.5 – Object Injection Remote Code Execution
  • Modify exploit payload for Joomla 1.5 – 3.4.5 – Object Injection Remote Code Execution
  • Update Baidu URLs fetching module
  • Update Wooyun URLs fetching module
  • Update Subdomains Scan module
  • Add Censys IPs fetching module
  • Add exploit module for FeiFeiCMS 2.8 Remote Code Execution
  • Add Censys URLs fetching module
  • Add exploit module for XStream (Jenkins CVE-2016-0792) Remote Code Execution
  • Add exploit module for Struts 2 (S2-032) Remote Code Execution
  • Add exploit module for Apache Shiro 1.2.4 Remote Code Execution

Download

git clone https://github.com/brianwrf/hackUtils.git

Usage

hackUtils.py [options]

-h, --help                                  Show basic help message and exit

-b keyword, --baidu=keyword                 Fetch URLs from Baidu based on specific keyword

-g keyword, --google=keyword                Fetch URLs from Google based on specific keyword

-i keyword, --censysip=keyword              Fetch IPs from Censys based on specific keyword

-u keyword, --censysurl=keyword             Fetch URLs from Censys based on specific keyword

-w keyword, --wooyun=keyword                Fetch URLs from Wooyun Corps based on specific keyword

-j url|file, --joomla=url|file              Exploit SQLi for Joomla 3.2 - 3.4

-r url|file, --rce=url|file                 Exploit Remote Code Execution for Joomla 1.5 - 3.4.5

-f url|file, --ffcms=url|file               Exploit Remote Code Execution for FeiFeiCMS 2.8

-k ip|file[::cmd], --jenkins=ip|file[::cmd] Exploit Remote Code Execution for XStream (Jenkins CVE-2016-0792)

-o url|file[::cmd], --shiro=url|file[::cmd] Exploit Remote Code Execution for Apache Shiro 1.2.4

-s url|file, --s2032=url|file               Exploit Remote Code Execution for Struts2 (S2-032)

-d site, --domain=site                      Scan subdomains based on specific site

-e string, --encrypt=string                 Encrypt string based on specific encryption algorithms (e.g. base64, md5, sha1, sha256, etc.)

Example

hackUtils.py -b inurl:www.example.com

[!] legal disclaimer: Usage of hackUtils for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.

Source: https://github.com/brianwrf/

Tags: hackUtils