This is a repository filled with scripts that were made with Python, and designed to exploit computer systems.

Last update: Oct 30, 2021

Overview

PYTHON-EXPLOITATION

This is a repository filled with scripts that were made with Python, and designed to exploit computer systems.

Networking

tcp_clinet.py

The tcp_clinet.py script is used to push data to a server in the event that you are not able to use the typical networking tools. In the script we:

Create a socket object (line 8): the AF_INET parameter indicates we will use a standard IPv4 address or hostname, and SOCK_STREAM indicates that this will be a TCP client.

Connect to the client server (line 11): note that, since we are using a TCP client, we must first connect to our server (via the TCP handshake) to send data to it.

Send the server some data in bytes (line 14)

Recieve data back from the server and print out the response (line 17)

Note that this script makes numerous assumptions about the server we are engaging with:

It assumes that our connection will always succeed as it does not have a fallback function in the event that the server rejects our connection.

It assumes that the server expects us to send data first. Sometimes, the server will want to send us data first - this is especially true if the server is being guarded by a firewall of some kind.

The script assumes that the server will always return data to us in a timely fashion.

The assumptions are made for simplicity's sake. All things considered, sometimes less is more.

udp_client.py

Our udp_client.py script is much different from our tcp script, only that it it configured to send data via the user datagram protocol (but that much was obvious):

We change the socket type to SOCK_DGRAM to indicate that we will be using sending data via the UDP (line 6).
Also, notice that there is no connect() method beforehand, since we do not need to connect to a server beforehand using UDP. This is because UDP is a connectionaless protocol.
The last step is to call the recvfrom() method to receive UDP data back. This returns both the data and the details of the remote host and port (line 9).

tcp_server.py

The tcp_server.py is just that, a multi-threaded python TCP server that we can use in the event we want to write a command shell or craft a proxy.

Firstly, we pass in the IP address and port we want the server to listen on (line 9).
Next, we tell the server to simply start listening with a max backlog of connections set to 5 (line 10). Now ther server waits for a connection.
Once the clinet connects, we get the client socket in the client variable and the remote connection details in teh address variable.
We tehn start the thread to handle the client connection (line 17).
The handle_client function performs rec() and then sens a simple message back to the client.

This is a repository filled with scripts that were made with Python, and designed to exploit computer systems.

Related tags

Overview

PYTHON-EXPLOITATION

Networking

tcp_clinet.py

udp_client.py

tcp_server.py

Owner

Nathan Galindo

exchange-ssrf-rce

Python-based proof-of-concept tool for generating payloads that utilize unsafe Java object deserialization.

Open Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.

com_media allowed paths that are not intended for image uploads to RCE

Instagram brute force tool that uses tor as its proxy connections

Android Malware Behavior Deleter

ProxyLogon Full Exploit Chain PoC (CVE-2021–26855, CVE-2021–26857, CVE-2021–26858, CVE-2021–27065)

FIVE, Vulnerability Scanner And Mass Exploiter, made for pentesting.

CVE-2021-45232-RCE-多线程批量漏洞检测

All in One CRACKER911181's Tool. This Tool For Hacking and Pentesting. 🎭

Webpack自动化信息收集

Analyse a forensic target (such as a directory) to find and report files found and not found from CIRCL hashlookup public service

Simple Dos-Attacker.

🍯 16 honeypots in a single pypi package (DNS, HTTP Proxy, HTTP, HTTPS, SSH, POP3, IMAP, STMP, VNC, SMB, SOCKS5, Redis, TELNET, Postgres & MySQL)

Fast Fb Cracking Tool

A simple password generator using Python Tkinter.

SecurAID securely connects aid organizations directly with individuals in dangerous situations to allow them to discreetly and effectively get the assistance they need.

Data Recovery from your broken Android phone

PreviewGram is for users that wants get a more private experience with the Telegram's Channel.

A fast sub domain brute tool for pentesters