Monday, July 2, 2018

Jackhammer - Security vulnerability assessment / management tool


Security vulnerability assessment / management tool to solve all the security scanning related tasks.

What is Jackhammer?

Jackhammer is a collaboration tool built with an aim of bridging the gap between Security team vs dev team, QA team and being a facilitator for TPM to understand and track the quality of the code going into production. It could do static code analysis and dynamic analysis with inbuilt vulnerability management capability. It finds security vulnerabilities in the target applications and it helps security teams to manage the chaos in this new age of continuous integration and continuous/multiple deployments.

Key Features:

  • Provides unified interface to collaborate on findings
  • Scanning (code) can be done for all code management repositories
  • Scheduling of scans based on intervals # daily, weekly, monthly
  • Advanced false positive filtering
  • Publish vulnerabilities to bug tracking systems
  • Keep a tab on statistics and vulnerability trends in your applications
  • Integrates with majority of open source and commercial scanning tools
  • Users and Roles management giving greater control
  • Configurable severity levels on list of findings across the applications
  • Built-in vulnerability status progression
  • Easy to use filters to review targeted sets from tons of vulnerabilities
  • Asynchronous scanning (via sidekiq) that scale
  • Seamless Vulnerability Management
  • Track statistics and graph security trends in your applications
  • Easily integrates with a variety of open source, commercial and custom scanning tools.

Video demonstration for adding a new tool

Example: Nikto integration file

Default credentials:


Download Link :

User / Admin Guide : 


Monday, February 26, 2018

List of Free Internet of Things (IoT) Security Scanner

Internet of Things (IoT) Security / Vulnerability Scanners:

Retina IoT (RIoT) Scanner:

Many ‘Internet of Things’ devices use default or hard-coded passwords, making them easy prey for attackers. A new generation of distributed denial of service (DDoS) attacks (think Mirai) have emerged, and they want your IoT devices. Take the first step toward protecting defenseless IoT devices.


Organizations now have the ability to reliably identify at-risk IoT devices, such as IP cameras, DVRs, printers, routers, and more. Powered by Retina , an award-winning vulnerability scanner trusted by thousands of organizations, and delivered via the simplicity of BeyondSaaS ’ cloud-based interface, RIoT gives you an attacker’s view of your IoT devices and their associated vulnerabilities.

Shodan: is the world's first search engine for Internet-connected devices. 

Use Shodan to discover which of your devices are connected to the Internet, where they are located and who is using them.

Image Source & Download  URL :

 Kaspersky IoT Scanner:

Android app analyzes your home network, makes a list of all connected devices, and reveals common vulnerabilities.

After installation, IoT Scanner scans your home network and locates all of the devices connected to it. Then, the application scans specific network ports on those devices and finds out which of the ports are open and which are closed.

If IoT Scanner detects that some devices have open ports that can be potentially exploited, then the app will notify and prompt the user to close those ports, thus patching the hole.

Image Source & Download URL :

IoTSeeker -
                   is a free tool created for you by the Rapid7 Metasploit team, and we welcome your feedback. The tool will be periodically updated to include more device types which are of potential risk. 

Image Source & Download URL :

Bitdefender (IoT Scanner )

Bitdefender Home Scanner looks for vulnerable devices and passwords, and offers detailed security recommendations for your home network.

Image Source & Download URL :

Internet of Things ( IoT ) -Botnet Scanner

Do you have open ports that botnets can exploit? Press the button below for a quick check.

Image Source & Download URL :

Mirai Vulnerability Scanner : ( IoT)

Scan to see if your network hosts a device vulnerable to Mirai injection attacks. This scanner will identify and probe all devices that share your TCP/IP address. Mirai primarily targets Internet of Things (IoT) devices, such as routers, DVRS and CCTV cameras. The Mirai botnet has been used in some of the largest known DDoS attacks. This includes the recent takedown of Dyn DNS services, which led to the unavailability of major websites and services to many millions of users in Europe and North America.

Image Source & Downlaod Link :

Sunday, November 12, 2017

COBRA - Crysis / Dharma Ransomware


New variant of the Crysis / Dharma ransomware that adds the .cobra extension to the encrypted files

Recently, security researcher Jakub Kroustek discovered a new ransomware sample that appears to be a new variant of the ransomware Crysis that appends the .cobra extension to the file name of the encrypted file.

It is not known exactly how this variant is distributed, but in the past Crysis is normally propagated by piracy in remote desktop services and manually installs the ransomware.
When this variant of Cobra ransomware is installed, a computer will be scanned for data files and encryption of them. When you encrypt a file, an extension will be added in the .id- [id]. [E-mail] .cobra format .id- [id]. [E-mail] .cobra .id- [id]. [E-mail] .cobra . For example, a file called pepe.jpg was encrypted and the name was changed to[].cobra .

It should be noted that this ransomware will encrypt assigned network drives and unassigned network shares. Therefore, it is important to make sure that the actions of your network are blocked so that only those who really need access have permission.
When this variant encodes a computer, it will also remove all plumes from volume snapshots on the machine so that they can not be used to recover encrypted files. It is removed by running the vssadmin delete shadows /all /quiet .
This ransomware will also create two different rescue notes on the infected machine. One of them is the file info.hta , which was launched by an automatic execution when a user initiates a session on the computer.

The other note is called encrypted files !!. Txt and can be found on the desktop.
Both rescue notes contain instructions to contact in order to obtain payment instructions.
Finally, the ransomware will be configured to start automatically when it connects to Windows. This allows you to encrypt new files that are created since the last time executed.

It is not possible to decipher the new variant of Crysis Cobra

Unfortunately, at this time it is not possible to decrypt the files encrypted by the .cobra Crysis ransomware for free. The only way to recover the encrypted files is through a backup, or if you are unbelievably lucky, through volume snapshots. Although Crysis does not attempt to remove volume snapshots, in rare cases, ransomware infections do not do so for any reason.

How to protect yourself from the Crysis ransomware

In order to protect yourself from Crysis, or from any ransomware, it is important that you use good computer habits and security software. First and foremost, you should always have a reliable and proven backup of data that can be restored in the event of an emergency, such as an attack on the ransomware. You must also have security software that contains behavioral detections such as squared Anti-Malware, Malwarebytes, or HitmanPro


COBRA SHA256: de6376e23536b3039afe6b0645da4fc180969b1dc3cc038b1c6bd5941d88c4d8

Cobra Associated Emails:
 Ref Link :

Tuesday, November 7, 2017

QRadar Community Edition - Free

QRadar Community Edition:

 Download and use the QRadar Community Edition for free.!!!!

Install on your laptop, run it at home, try out apps, build apps, or just have some fun !


Download Link :

Videos / Other Resources :

Saturday, November 4, 2017

Janusec - WebCruiser Ultimate Web Penetration Testing Tool

                   Web Vulnerability Scanner for Windows, Mac OS, and iOS (iPhone/iPad) , HTTP Replay/Repeater for iPhone and iPad, SQL Injection, XSS. Also an effective and powerful web penetration testing tool that will aid you in auditing your website! It can support scanning website as well as POC (Proof of concept) for web vulnerabilities: SQL Injection, Cross Site Scripting, Local File Inclusion, Remote File Inclusion, Redirect, Obsolete Backup etc.

The most typical feature of WebCruiser comparing with other Web Vulnerability Scanners is that WebCruiser Web Vulnerability Scanner focuses on high risk vulnerabilities, and WebCruiser can scan a designated vulnerability type, or a designated URL, or a designated page separately, while the others usually will not.

WebCruiser v3.4.0 is available, new feature: support scanning absolete backup files which may cause potential information leakage.

User Guide :


Tuesday, October 31, 2017

FireEye - GoCrack Password Cracking tool

FireEye - GoCrack Tool

                           FireEye's Innovation and Custom Engineering (ICE) team released a tool called GoCrack that allows red teams to efficiently manage password cracking tasks across multiple GPU servers by providing an easy-to-use, web-based real-time UI (Below Figure shows the dashboard) to create, view, and manage tasks. Simply deploy a GoCrack server along with a worker on every GPU/CPU capable machine and the system will automatically distribute tasks across those GPU/CPU machines.

GoCrack provides APIs to manage password cracking tasks across supported cracking engines.


  • Linux (Ubuntu 16.04+ although other distributions may work) or MacOS
  • Computer(s) with NVIDIA or AMD GPUs
Some use cases for a password cracking tool can include cracking passwords on exfil archives, auditing password requirements in internal tools, and offensive/defensive operations. We’re releasing GoCrack to provide another tool for distributed teams to have in their arsenal for managing password cracking and recovery tasks.

Keeping in mind the sensitivity of passwords, GoCrack includes an entitlement-based system that prevents users from accessing task data unless they are the original creator or they grant additional users to the task. Modifications to a task, viewing of cracked passwords, downloading a task file, and other sensitive actions are logged and available for auditing by administrators. Engine files (files used by the cracking engine) such as Dictionaries, Mangling Rules, etc. can be uploaded as “Shared”, which allows other users to use them in task yet do not grant them the ability to download or edit. This allows for sensitive dictionaries to be used without enabling their contents to be viewed.

GoCrack is shipping with support for hashcat v3.6+, requires no external database server (via a flat file), and includes support for both LDAP and database backed authentication. In the future, we plan on adding support for MySQL and Postgres database engines for larger deployments, ability to manage and edit files in the UI, automatic task expiration, and greater configuration of the hashcat engine. We’re shipping with Dockerfile’s to help jumpstart users with GoCrack. The server component can run on any Linux server with Docker installed. Users with NVIDIA GPUs can use NVIDIA Docker to run the worker in a container with full access to the GPUs.

GoCrack is available immediately for download along with its source code on the project's GitHub page. If you have any feature requests, questions, or bug reports, please file an issue in GitHub.

 Ref Link :

Thursday, October 26, 2017

Updated IOC's - Bad Rabbit Ransomware

A new ransomware worm named "Bad Rabbit" began spreading across the world Last Tuesday (Oct. 24), and it appeared to be a much-modified version of the NotPetya worm that hit eastern Europe in June.

This ransomware attack is most likely hitting computers in Russia and Ukraine, bearing similarities to the NotPetya outbreak that caused billions of pounds of damage in June.

The self-titled “Bad Rabbit” malware encrypts data on infected machines before demanding a payment of 0.05 bitcoin (£250) for the decryption key. The ransom demand is phrased similarly to that of June’s outbreak, and researchers at Russian security firm Kaspersky say that the malware uses “methods similar to those used” during the NotPetya attack.

Briefly about yesterday's events :

  • The initial infection was due to compromised websites and a fake update to Flash Player, which required user interaction to activate and continue exploitation (the user had to confirm the agreement to install the update);
  • Distribution on the local network was done by scanning the internal network for open SMB-open access files, as well as an attempt to use the HTTP-based WebDAV protocol based on HTTP and allowing the use of the Web as a resource for reading and writing;
  • Mimikatz was used to extract user credentials from the memory of an infected PC;
  • Legitimate DiskCryptor software used to encrypt files;
  • Types of file extensions that were encrypted on a user's PC:
#Bad-Rabbit encrypts following files: .dib.disk.djvu.doc.docx.dwg.eml.fdb .odt.ora.ost.ova.ovf.p12.p7b.p7c .tiff.vb.vbox.vbs.vcb.vdi.vfd.vhd

Original Name 
de5c8d858e6e41da715dca1c019df0bfb92d32c0– SHA1
79116fe99f2b421c52ef64097f0f39b815b20907 – SHA1
DLL payload
DiskCryptor Driver (x64)
DiskCryptor Client
16605a4a29a101208457c47ebfde788487be788d – SHA1
Mimikatz (x64)
413eba3973a15c1a6429d9f170f3e8287f98c21c -SHA1
Mimikatz (x32)
DiskCryptor driver x86
DiskCryptor driver x86

C&C servers

Payment site: http://caforssztxqzf2nm[.]onion
Inject URL: http://185.149.120[.]3/scholargoogle/
Distribution URL: hxxp://1dnscontrol[.]com/flash_install.php

Scheduled Tasks names:

In Taskschd.msc, look for and remove these tasks
  • viserion_
  • rhaegal
  • drogon

List of compromised web sites


 Distribution Paths:

  • /flash_install.php
  • /index.php

Intermediary Server:
  • 185.149.120[.]3

Hidden service:
  • caforssztxqzf2nm[.]onion

Kill Switch: to create read-only file C:\windows\infpub.dat. In case of infection files won't be encrypted

Restrict Scheduled Tasks: viserion_, rhaegal, drogon
Make backup of important data
Update operation systems and security systems
Isolate infected PCs
Block IP-addresses and domain names from Indicators list
Block inbound SMB
Use Credential Guard in Windows
Control # of admins
 Monitor scheduled tasks and service creation

Open source Tools for Live Meeting(Web Conferencing)

posts. Guys the most of you find these posts a valuable resource for the e-Learning community. As a result, the following post is Free and Open Source Web Conferencing (Online Meetings, Webinars) Tools for e-Learning.

The following list contains free and open source Web Conferencing tools that are n't in particular order.

Also, you should be sure that the e-Learning community will highly appreciate:

  1. if you post a comment with your experience with these tools and/or,

  2. if you post a comment with a link to any other free and open source Web Conferencing tool.

We support Free eLearning! Do you?

I support Free eLearning

BigBluebutton* is built for Higher Education. It enables universities and colleges to deliver a high-quality learning experience to remote students. BigBlueButton is an active open source project that focuses on usability, modularity, and clean design -- both for the user and the developer. The project is hosted at Google Code. BigBlueButton is built by combining over fourteen open source components.

*note: Epignosis has created a module that provides integration of BigBlueButton conferencing in eFront Open Source Learning Management System. BigBlueButton is a free web-conferencing tool with text chat, audio and video capabilites, a virtual whiteboard and many more presentation and conferencing features.

OpenMeetings is a free browser-based software that allows you to set up instantly a conference in the Web. You can use your microphone or webcam, share documents on a white board, share your screen or record meetings. It is available as hosted service or you download and install a package on your server with no limitations in usage or users.

OpenMeetings Key Features Mini Demo

Mikogo is a free desktop sharing tool full of features to assist you in conducting the perfect online meeting or web conference. Take advantage of the opportunity to share any screen content or application over the Internet in true color quality with up to 10 participants simultaneously, while still sitting at your desk.

Yugma free web conferencing allows anyone, anywhere to instantly share their desktop and ideas online with others. To start hosting your own meetings you have to sign up for FREE. Your Yugma Free web conferencing account allows you to invite up to 20 attendees

Using WebHuddle, you have options and flexibility. Meetings can be conducted either in conjunction with an enterprise’s existing teleconferencing service, or utilizing WebHuddle’s optional voice over IP. WebHuddle also offers recording capabilities -- presentations can easily be recorded for playback over any web browser for those who missed the live meeting.

With Vyew you can give a presentation to a hundred people online or post a document you've been working on for review by your colleagues at the convenience. Vyew is extremely flexible alloying you to bring online collaboration and conferencing into your workflow on your terms.

Dimdim delivers synchronized live presentations, whiteboards and web pages while sharing your voice and video over the Internet - with no download. With the Free edition you can get 10 person meetings, 1 way video, standard support, Dimdim branded rooms, and public meetings.

*note: Epignosis has created a module that provides integration of Dimdim conferencing in eFront  Open Source Learning Management System.

Adobe® ConnectNow is a great way to share ideas, discuss details, and complete work with others all online. Reduce travel costs, save time, and increase productivity with a web conferencing solution that's easy to access and simple to use. ConnectNow operates inside a web browser. There's no installation required, so getting started is easy and Free