Blog of James Brown
2022-07-13
2022-07-11
2022-07-11
common web applications could be big, like search engines. this is a list of open-sourced self hosted services:
2022-07-11
2022-07-11
zeroday ai, hacking assistant: 0dai
免杀 av evasion
https://github.com/fdx-xdf/darkPulse
https://www.shellterproject.com/
别动不动就想日站 收集信息 熟悉工具 做好能做到的 把一路学到的经验总结下来
trufflehug find credentials from open sources
stryker: wifi hacking tool includes dust attack, pin attack
found multiple websites on lonely planet tourist guide of america (all over the place!)
oneforall subdomain finder
hack in one including:
1 | Anonymously Hiding Tools |
all defense tool: 半/全自动化利用工具, 信息收集工具, 漏洞利用工具, 内网渗透工具, 运维&甲方&防守方工具, 安全资料整理
botnet ips are detected by some websites like URLHaus. there’s a tendency to use common passwords to bruteforce the credential for such botnets, such as inori miral cnc scraper, l4tt/Botnet-Reaper. setting botnets by yourself has advantage of connecting to machines without public ip.
MHDDoS best ddos tool (someone may make living on that), providing multiple WAF bypass techniques (what about Akamai?)
although sqlmap is somehow out-of-date (wracked by WAF, unable to exploit latest nodedb library), there is a tendency to combine subdirectory/url collector like subfinder with it like codewatchorg/sqlipy and zt2/sqli-hunter, automate the exploitation. search for sql injection (deep/machine learning) in github for latest tools and wiki.
undetectable credential stealer created by psauxxx. is it coincidence?
psauxx (twitter) created multiple accounts on github. the original one (in archive) is deactivated, now named as l4tt. vulnnr (auto exploiter) has some tutorials from geekforgeeks and xploitlab (linked to other interesting tools), and is renamed as uscan. search for vulnnr in github and there is a favourite hack tool collection
socialfish clone website and collect credentials (phishing) with web controller interfaces
sploitus search for latest sploits and POC-code (usually after patching is done)
bearSG 符合国人习惯的社工密码生成器 java开发 自带GUI
cupper 社工密码生成器
社会工程工具列表 是security list的一部分 其中推荐独立开发者怎么赚钱 (有免费API接口介绍 但是有的站已经没了) -> 国内独立开发者项目列表 -> bufpay 免签支付 (需要按月交费)
内容包括:
1 | 虚拟身份 |
mosint email osint
payloadallthethings (40k stars!) by swisskyrepo
openai written phishing and directory bruteforcing
ghunt google osint
scarecrow payload generator targeting win 10-11
scarecrow cobalt strike plugin
cryptographic related python libraries gmpy2 pycryptodome libnum yafu rsa-wiener-attack RsaCtfTool
ciphery auto decryption
pwntools used by fmyy and more doc
angr to reverse engineer binaries, mostly in ctf? docs
angr ctf use cases: case 1 case 2
angr ctf reverse binaries and print “good job”
angr ctf build binaries from source
factordb.com find prime numbers, decomposition for rsa
reverse shell generator while shellcode cannot have null bytes, you need to xor your things with tool or assembly.
挖0day 或者利用现成漏洞 fuzzers for kali
don’t aim big, aim small. things like bilibili password database dump, or some Intel internal data leak, are done by professional hackers on professional hardware. some corp will even attempt to retaliate like nvidia. you have been warned.
To exploit zerodays, you need rasp, aka ‘is my application doing something undefined/unexpected?’
利用公共WiFi 比如用WiFi炮连接远处的WiFi 控制云端的攻击服务器
黑客第一步是找目标 (CTF可能不会教你怎么找目标 白帽也不会 因为目标很单一)不管漏洞存不存在 目标究竟是个啥目标 是人(联系方式?)还是机器(URL?)还是AI (验证码?)怎么交互(可能)是什么漏洞 以及采取什么攻击措施 都得先把目标罗列清楚 可以借助搜索引擎 fofa漏洞搜索 邮箱信息 社交软件的信息 木马跟踪他人的信息 大多数人访问的信息 爬虫信息 监控本地软件访问网络的记录 或者直接随便扫描 存到数据库里面
第二步就是交互 利用漏洞 装后门 控制目标 比如挖矿 继续收集网站信息 密码信息 cookies 继续散播病毒 拓展攻击面
第三步持久作战 持续提高反侦查意识 学习收集信息工具 提高黑客能力 利用各种方法 比如社会工程学 利用匿名账号或者免费邮箱账号 传播带木马的免费应用程序 病毒邮件 坚持就是胜利
https://github.com/mikaelkall/HackingAllTheThings
https://github.com/akenofu/HackAllTheThings
memory editing, game hacking:
https://github.com/qb-0/pyMeow
https://github.com/srounet/Pymem
defcon for news, intro, wiki
infocon for software, code, wordlists
mec mass exploiting
notes
几个觉得还不错的靶场
封神台:https://hack.zkaq.cn/index
Hack The Box :https://www.hackthebox.com/
Vulhub:https://www.vulnhub.com/
Pikachu:https://github.com/zhuifengshaonianhanlu/pikachu
search engines
youcode search engine for coders, enter coding question to get result
self-hosted recon intelligence tool: osint
ivre network recon framework
publicwww: search for html/css/js source code in website
searchpedia: search engine collection
top 5 recon/intelligence/information gathering tools
search engine hacking, manual and automation
scripting
information gathering
uncover quickly discover hosts using multiple search engines
dirsearch scan web paths
1 | pip3 install dirsearch |
virus, botnet
botnet with super escalation system for linux and windows, automatically spread the virus out
Hacking tutorials
maybe you should follow kali/parrot/blackarch tutorials first?
暗网 社工库 数据库 暗网黑客教学
暗网自由社区,中文社区,无下限讨论
zuw2gvomnfx5mt6g626srambeqo2yxmac5jpoccttq54z7se36svmlyd.onion
the payload, dedicated tutorial
https://github.com/swisskyrepo/PayloadsAllTheThings
sure it needs everything to hack. the assembly, the tools, the experience, the examples, the automation, the persistence, the vision.
all in one hack tool:
https://github.com/Z4nzu/hackingtool
awesome hacking:
https://github.com/Hack-with-Github/Awesome-Hacking
hacking tutorials and tools:
https://github.com/carpedm20/awesome-hacking
https://github.com/sundowndev/hacker-roadmap
https://github.com/jekil/awesome-hacking
https://github.com/carlospolop/hacktrick
ctf tutorials and tools:
https://github.com/xtiankisutsa/awesome-mobile-CTF
https://github.com/Naetw/CTF-pwn-tips
https://github.com/firmianay/CTF-All-In-One
https://github.com/taviso/ctftool
https://github.com/UnaPibaGeek/ctfr
https://github.com/RsaCtfTool/RsaCtfTool
https://github.com/Gallopsled/pwntools
https://github.com/0Chencc/CTFCrackTools
https://github.com/google/google-ctf
https://github.com/ctf-wiki/ctf-wiki
https://github.com/apsdehal/awesome-ctf
https://github.com/p4-team/ctf
https://github.com/zardus/ctf-tools
some other tools and resources
https://github.com/sundowndev/hacker-roadmap
all in one hacking tool for kali linux
https://github.com/edoardottt/awesome-hacker-search-engines
hacker pro hacktool for termux and linux, maybe macos?
sql/xxs scanner, dos, bruteforce ftp/ssh/mail accounts
https://github.com/hacktoolspack/hack-tools
2022-07-11
Python Bytecode, Time Travel Debugging, Resurrection, Ante-Mortem Debugging, Interactive Debugging, Resume after Exception, Python ignore all exceptions and continue execute next line in given section of code
lisp-style resumption error-handling semantics
ruby
pry-rescue may not resume execution?
java
hot code replace in vscode for java
python
python lisp-style exception as condition handling
dump different level of reloading call history
reload code blocks which are syntatically different, if black formatter fails after dedent then there shall be error
decide to reload extra parts of functions in the next run if selected
load newly added functions, remove old functions, execute added lines, reload entire module and update namespace depending on condition
check other programming language whether it jas similar capabilities
visit this thread of ruby in archive.org
either bytecode or modify the source code
bookmarks
1 | https://docs.python.org/3/library/code.html |
contextlib usage detail, to make customized “with” statements:
1 | from contextlib import AbstractContextManager |
python grammar sugar: brackets
https://pypi.org/project/brackets/
does that work in eval()?
use contextlib.suppress to replace try…except: pass
might investigate source code of the suppress object.
https://opensource.com/article/18/5/how-retrieve-source-code-python-functions
to execute code grouped by lowest level of indentation, we can def those lines of code and pass the code by dill.source.getsource(functionName) and eval within given global/local variables.
my solution is down here, with concrete examples.
hereby we recommend to insert a conditional return statement to ensure we will exit this buggy code at the best time. maybe we could put it into a dictionary somehow, tuples within string or something.
1 | import dill |
2022-07-10
slideshows:
https://github.com/gre/diaporama
https://github.com/h2non/videoshow
after effects like video effects
https://github.com/NatronGitHub/Natron
https://github.com/brianchirls/Seriously.js
video ai transition tool using pose estimation
https://github.com/jungdj/AI-Effects
https://github.com/IronSpiderMan/VideoSpecialEffects
video transitions:
https://github.com/advplyr/img2vid
https://github.com/ice45571/video-transition
https://github.com/povdocs/video-transitions
https://github.com/transitive-bullshit/ffmpeg-concat
https://github.com/transitive-bullshit/ffmpeg-gl-transition
shot detect key frame saving:
2022-07-10
Advanced ASS Subtitle Karaoke Effects
library collection and guide on how to create karakoe effects programmatically
lrc files
crop music that does not sing too early? maybe no need.
we need to sort them out by time! prevent serious issues.
skip empty lines?
lrc files only have start time but no end time.
we group parallel lyrics by time, if they are close enough we make it into a group.
groups act as time separators. no two group share the same time. also group have maximum span time, minimum span time calculated by content, and group should always in bound.
should apply the same min-max rule when selecting my video clips
all ass file tags, for custom karaoke effects creation
my karaoke effect:
1 | {\k-50\K400} |
play ass file with mpv on demo video, full screen, no audio:
1 | rootpath=/Users/jamesbrown/desktop/works/pyjom_remote/ |
create karaoke effects
https://github.com/Kagu-chan/FXSpindle
karaoke effects
https://github.com/Youka/NyuFX
recommend to use effect 2 beginners -> 3 variants
in examples, while 3 advanced -> 2 testing pixels
as reference (more advanced but incomplete, and might be very intensive)
https://github.com/logarrhythmic/karaOK
aegisub and its plugins
https://github.com/Myaamori/aegisub-cli
https://github.com/qwe7989199/Lyric-Importer-for-Aegisub
https://github.com/qwe7989199/aegisub_scripts
https://github.com/lyger/Aegisub_automation_scripts
eyecandy create karaoke ass files:
https://github.com/Alquimista/Eyecandy-py
create karaoke effects subtitle with lrc file, support chinese
2022-07-10
video transitions:
ffmpeg filters for gl transitions, as ffmpeg commandline args
javascript video editor:
remotion edit video with react
creating and rendering dynamic videos
1 | npm i -g editly |
concat videos with opengl transitions
complex react native animation engine, not open source
vidpy based on mltframework, shotcut
auto video editor by audio loudness:
https://github.com/WyattBlue/auto-editor
position video by face:
https://github.com/diego3g/video-to-reels
machine video editor using deepfake, with gui, not open sourced:
https://github.com/MachineEditor/MachineVideoEditor
openshot python:
https://github.com/OpenShot/openshot-qt
youtube video summarizer:
https://github.com/codelucas/shorten.tv
commandline video editor from suckless:
https://github.com/maandree/blind
remove slience from video:
https://github.com/gusals3587/jumpcutterV2
https://github.com/carykh/jumpcutter
https://github.com/jappeace/cut-the-crap
ai video editor:
https://github.com/MashiMaroLjc/rabbitVE
commandline video editor:
2022-07-10
opencv bilateral filter python
1 | import cv2 as cv |
https://github.com/xujingzhou/VideoBeautify
python美颜瘦脸
https://github.com/Sharpiless/opencv-pyqt-makeup-software
https://github.com/geeklili/Opencv_PIL
https://github.com/PerpetualSmile/BeautyCamera
JavaScript 美颜