FreshRSS

πŸ”’
❌ Secure Planet Training Courses Updated For 2019 - Click Here
There are new available articles, click to refresh the page.
Before yesterdayYour RSS feeds

Black Hat Arsenal 2024 Next Stop Singapore !

Excitement is building in the cybersecurity community as the renowned Black Hat Arsenal gears up

Arsenal - Just A Quick Inventory And Launcher For Hacking Programs

By: Zion3R


Arsenal is just a quick inventory, reminder and launcher for pentest commands.
This project written by pentesters for pentesters simplify the use of all the hard-to-remember commands



In arsenal you can search for a command, select one and it's prefilled directly in your terminal. This functionality is independent of the shell used. Indeed arsenal emulates real user input (with TTY arguments and IOCTL) so arsenal works with all shells and your commands will be in the history.

You have to enter arguments if needed, but arsenal supports global variables.
For example, during a pentest we can set the variable ip to prefill all commands using an ip with the right one.

To do that you just have to enter the following command in arsenal:

>set ip=10.10.10.10

Authors:

  • Guillaume Muh
  • mayfly

This project is inspired by navi (https://github.com/denisidoro/navi) because the original version was in bash and too hard to understand to add features

Arsenal new features

  • New colors
  • Add tmux new pane support (with -t)
  • Add default values in cheatsheets commands with <argument|default_value>
  • Support description inside cheatsheets
  • New categories and Tags
  • New cheatsheets
  • Add yml support (thx @0xswitch )
  • Add fzf support with ctrl+t (thx @mgp25)

Install & Launch

  • with pip :
python3 -m pip install arsenal-cli
  • run (we also advice you to add this alias : alias a='arsenal')
arsenal
  • manually:
git clone https://github.com/Orange-Cyberdefense/arsenal.git
cd arsenal
python3 -m pip install -r requirements.txt
./run

Inside your .bashrc or .zshrc add the path to run to help you do that you could launch the addalias.sh script

./addalias.sh
  • Also if you are an Arch user you can install from the AUR:
git clone https://aur.archlinux.org/arsenal.git
cd arsenal
makepkg -si
  • Or with an AUR helper like yay:
yay -S arsenal

Launch in tmux mode

./run -t #Β if you launch arsenal in a tmux window with one pane, it will split the window and send the command to the otherpane without quitting arsenal
#Β if the window is already splited the command will be send to the other pane without quitting arsenal
./run -t -e # just like the -t mode but with direct execution in the other pane without quitting arsenal

Add external cheatsheets

You could add your own cheatsheets insode the my_cheats folder or in the ~/.cheats folder.

You could also add additional paths to the file <arsenal_home>/arsenal/modules/config.py, arsenal reads .md (MarkDown) and .rst (RestructuredText).

Cheatsheets examples are in <arsenal_home>/cheats: README.md and README.rst

Troubleshooting

If you got on error on color init try :

export TERM='xterm-256color'

--

If you have the following exception when running Arsenal:

ImportError: cannot import name 'FullLoader'

First, check that requirements are installed:

pip install -r requirements.txt

If the exception is still there:

pip install -U PyYAML

Mindmap

https://orange-cyberdefense.github.io/ocd-mindmaps/img/pentest_ad_dark_2022_11.svg

  • AD mindmap black versionΒ 

  • Exchange Mindmap (thx to @snovvcrash)Β 

  • Active directory ACE mindmapΒ 



TODO cheatsheets

reverse shell

  • msfvenom
  • php
  • python
  • perl
  • powershell
  • java
  • ruby

whitebox analysis grep regex

  • php
  • nodejs
  • hash

Tools

smb

  • enum4linux
  • smbmap
  • smbget
  • rpcclient
  • rpcinfo
  • nbtscan
  • impacket

kerberos & AD

  • impacket
  • bloodhound
  • rubeus
  • powerview
  • shadow credentials attack
  • samaccountname attack

MITM

  • mitm6
  • responder

Unserialize

  • ysoserial
  • ysoserial.net

bruteforce & pass cracking

  • hydra
  • hashcat
  • john

scan

  • nmap
  • eyewitness
  • gowitness

fuzz

  • gobuster
  • ffuf
  • wfuzz

DNS

  • dig
  • dnsrecon
  • dnsenum
  • sublist3r

rpc

  • rpcbind

netbios-ssn

  • snmpwalk
  • snmp-check
  • onesixtyone

sql

  • sqlmap

oracle

  • oscanner
  • sqlplus
  • tnscmd10g

mysql

  • mysql

nfs

  • showmount

rdp

  • xfreerdp
  • rdesktop
  • ncrack

mssql

  • sqsh

winrm

  • evilwinrm

redis

  • redis-cli

postgres

  • psql
  • pgdump

vnc

  • vncviewer

x11

  • xspy
  • xwd
  • xwininfo

ldap

  • ldapsearch

https

  • sslscan

web

  • burp
  • nikto
  • tplmap

app web

  • drupwn
  • wpscan
  • nuclei


Black Hat Arsenal MEA Riyadh 2023 – Call For Tools Open

Black Hat MEA Arsenal is a space for developers to showcase the latest open-source tools

Introducing the 1st Arsenal Lab USA 2019

After several years of a dazzling success of the famous Black Hat Arsenal, the team has brainstormed to offer some new entertainment.Several ideas have been reviewed however the principle of an interactive hardware space was retained. So exclusively at the Black Hat Arsenal, we introduce the First Arsenal Lab USA 2019 on 2 consecutive days. [&hellip

Amazing Black Hat Arsenal USA 2019 Lineup Announced

After days of though reviewing, the whole Arsenal team has selected nearly 94 tools. Most of them will be released during the event. This USA session will introduce as well a new daily meet-up in the...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

Black Hat Arsenal Asia 2019 Lineup Announced

The Black Hat Arsenal event is back to Singapore after a successful session in London. In case you are attending the Blackhat Asia 2019, do not forget to stop by the Arsenal because we have selected...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

Black Hat Arsenal Asia 2019 CFT Open

The Black Hat Arsenal team will be back in Singapore with the very same goal: give hackers & security researchers the opportunity to demo their newest and latest code. The Arsenal tool demo area...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

Black Hat Arsenal Europe 2018 Lineup Announced

After days of reviewing the hundreds of submitted tools, ToolsWatch and Black Hat teams selected 50 tools. They will be demonstrated over 2 days the 5th and 6th of December 2018 at the Excel London...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

Black Hat Arsenal USA 2018 The β€œw0w” Lineup !!

Just woow. Finally after few days of reviewing, selecting, unselecting, doubting, screaming and re-reviewing. The BlackhatΒ  & ToolsWatch team released the selected tools for the USA...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

Black Hat Arsenal USA 2018 – Call For Tools (Now Closed)

The Black Hat Arsenal team will once again provide hackers & security researchers the opportunity to demo their newest and latest code! The Arsenal tool demo area is dedicated to independent...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]
❌