Hackersh is an interactive console for security research and testing. It uses Pythonect as its scripting language. Pythonect is a new, experimental, general-purpose high-level dataflow programming language based on Python. It aims to combine the intuitive feel of shell scripting (and all of its perks like implicit parallelism) with the flexibility and agility of Python. The combination of the two makes:
"http://localhost" -> url -> nmap -> w3af -> printReturn something like this:
+------------------------------------------------------------------------------+-----------------------------------------------------------------+ | VULNERABILITY DESCRIPTION | URL | +------------------------------------------------------------------------------+-----------------------------------------------------------------+ | Cross Site Scripting was found at: | http://localhost:8080/black/vulnerabilities/xss_r/ | | "http://localhost:8080/black/vulnerabilities/xss_r/", using HTTP method GET. | | | The sent data was: | | | "name=%3CSCrIPT%3Efake_alert%28%22v3bd%22%29%3C%2FSCrIPT%3E". This | | | vulnerability affects ALL browsers | | +------------------------------------------------------------------------------+-----------------------------------------------------------------+ | The whole target has no protection (X-Frame-Options header) against | Undefined | | ClickJacking attack | | +------------------------------------------------------------------------------+-----------------------------------------------------------------+ | "X-Powered-By" header for this HTTP server is: "PHP/5.3.3-7+squeeze3" | Undefined | +------------------------------------------------------------------------------+-----------------------------------------------------------------+ | The server header for the remote web server is: "Apache/2.2.16 (Debian)" | Undefined | +------------------------------------------------------------------------------+-----------------------------------------------------------------+ | An error page sent this Apache version: "addressApache/2.2.16 (Debian) | http://localhost:8080/black/vulnerabilities/xss_r/_vti_inf.html | | Server at localhost Port 8080/address" | | +------------------------------------------------------------------------------+-----------------------------------------------------------------+ | The remote Web server sent a strange HTTP response code: "405" with the | http://localhost:8080/black/vulnerabilities/xss_r/GeBrG | | message: "Method Not Allowed", manual inspection is advised | | +------------------------------------------------------------------------------+-----------------------------------------------------------------+ | The remote Web server sent a strange HTTP reason message: "The HTTP server | http://localhost:8080/black/login.php | | returned a redirect error that would lead to an infinite loop. The last 30x | | | error message was: Found" manual inspection is advised | | +------------------------------------------------------------------------------+-----------------------------------------------------------------+ | The remote Web server has a custom configuration, in which any non existent | http://localhost:8080/black/vulnerabilities/xss_r/ | | methods that are invoked are defaulted to GET instead of returning a "Not | | | Implemented" response | | +------------------------------------------------------------------------------+-----------------------------------------------------------------+ | The URL: "http://localhost:8080/black/vulnerabilities/xss_r/" sent the | http://localhost:8080/black/vulnerabilities/xss_r/ | | cookie: "security=low" | | +------------------------------------------------------------------------------+-----------------------------------------------------------------+ | The URL: "http://localhost:8080/black/index.php" sent the cookie: | http://localhost:8080/black/index.php | | "PHPSESSID=lut893qvd4gdngp1rud5ei8pc2; path=/" | | +------------------------------------------------------------------------------+-----------------------------------------------------------------+ | A cookie matching the cookie fingerprint DB has been found when requesting | http://localhost:8080/black/index.php | | "http://localhost:8080/black/index.php" . The remote platform is: "PHP" | | +------------------------------------------------------------------------------+-----------------------------------------------------------------+So, how does it work? As a dataflow programming language, Pythonect treats data as something that originates from a source - it flows through a number of processing components and arrives at a final destination. As such, it is most suitable for creating applications that are themselves focused on the "flow" of data. Perhaps the most readily available example of a dataflow-oriented application comes from the realm of real-time signal processing, e.g. a video signal processor which starts with a video input, modifies it through a number of processing components (i.e. video filters), and finally outputs it to a video display.
As with video, penetration testing (and other security domains) can be expressed as a network of different components such as: targets, network scanners, web security scanners, etc, connected by a number of communication channels. These components (and more) are provided by Hackersh, and can be either internal (e.g. url is an internal component that converts String to URL) or external (e.g. nmap is a wrapper around the Nmap security scanner). Every Hackersh component (except the Hackersh Root Component) is standardized to accept and return a context. Context is a dict (i.e. associative array) that can be piped through different components, just like text can be piped through different Unix tools (e.g. cat, grep, wc, and etc.).
Back to real life examples, here is how you can pass command line arguments to an external Hackersh component (e.g. nmap):
"http://localhost" -> url -> nmap("-sS -P0 -T3") -> w3af -> print
Here is how you can debug a Hackersh component:
"http://localhost" -> url -> nmap("-sS -P0 -T3", debug=True) -> w3af -> print
Please note that this is not a component-specific option as almost every Hackersh component can be debugged this way.Moving on to more advanced options:
"http://localhost" -> url -> nmap("-sS -P0 -T3") -> [_['PORT'] == '8080' and _['SERVICE'] == 'HTTP'] -> w3af -> print
Support for Metadata is a major strength of Hackersh as it enables potential AI applications to fine-tune their service selection strategy based on service-specific characteristics."http://localhost" -> url -> [nmap, pass] -> amapThe script above is an example for a multithreaded application. It scans http://localhost alternately, using nmap + amap and amap. The output is:
http://localhost +-3306/tcp (MYSQL) +-25/tcp (SMTP) +-25/tcp (NNTP) +-902/tcp (VMWARE-AUTHD) +-21/tcp (FTP) +-21/tcp (SMTP) +-22/tcp (SSH) +-22/tcp (SSH-OPENSSH) +-80/tcp (HTTP) +-80/tcp (HTTP-APACHE-2) +-80/tcp (HTTP) +-80/tcp (HTTP-APACHE-2) +-631/tcp (HTTP) +-631/tcp (HTTP-APACHE-2) +-631/tcp (HTTP-CUPS) +-8080/tcp (HTTP) +-631/tcp (SSL) +-8080/tcp (HTTP) +-8080/tcp (HTTP-APACHE-2) +-53/tcp (DNS) +-8080/tcp (HTTP-APACHE-2) +-2222/tcp (SSH) +-2222/tcp (SSH-OPENSSH) +-3000/tcp (HTTP) +-111/tcp (RPC) `-111/tcp (RPC-RPCBIND-V4)To read more about Pythonect's multi-thread and multi-process capabilities, please visit Pythonect Tutorial: Learn By Example.
External Hackersh components (sorted by alphabetical order) supported in this version include: As well as the internal Hackersh components (in alphabetical order) supported in this version include:
- Hostname
- IPv4_Address
- IPv4_Range (supports CIDR, Netmask Source-IP Notation, IP Range and etc.)
- Nslookup
- Stateful programmatic Web Browser (i.e. Browse, Submit, and Iterate_Links)
- URL
- Scraping LinkedIn Public Profiles (using Pythonect) for Fun and Profit
- Fuzzing Like A Boss with Pythonect
- Automated Static Malware Analysis with Pythonect
- GitHub Issues Tracker
- Twitter @hackershell
No comments:
Post a Comment