H4hacks

 Hello Security Enthusiast, Are you looking for a quick way to perform password audit thru spraying on a bunch of web applications part of your security assessment, then you have come to the right place. So i have written a small tool in python that can perform quick password spray attacks on different authentication methods (as of now its ntlm and form based authentication) across multiple targets and generate reports with enough details to help with the ongoing assessment. Motivation & Inspiration Part of my job is to run periodic assessments against large enterprises that have large number of applications deployed so i needed something to run across multiple targets at once and could generate detailed reports for each attempt.  Another objective is to measure the effectiveness of monitoring controls in the environment so i needed a versatile solution that can be configured to different behaviour when needed, for example, perform a spray attack with delay between each at...

Hey Folks, Update Apr 2018 : Finally added environmental metric to the sheet. Thanks to Lejla Memic for reading my blog and inspiring me to do it :). The Git now contains a new file with environment metric. Hope it helps What is going on? So i was searching for a decent example of CVSS Version 3 calculator in an excel spread sheet and i could not find it, though i got few formulas. So i thought may be i should do it. So here it is you can find a working calculator done in excel from the below link https://github.com/moheshmohan/cvssv3_Excel/ Please feel free to use it and modify it. Also please note that i have only considered the base metrics and temporal metrics in performing the calculations. It should be easy to add environmental too if you need that. You can find all the documentation on CVSS v3 here in the below link https://www.first.org/cvss/specification-document Hope you find this helpful somewhere. Please let me know your feedback via comments Thanks

Hi Folks, So if you are playing around with kali linux on a VM you might have faced the issue of getting the vmware tools work properly. Especially when you want to copy paste files and clipboard contents between guest and host. This is very annoying thing and took lot of my precious time when i was doing OSCP course. Here is how i fixed it. My Setup I run a kali linux distro on vmware player which is recommended for doing the OSCP course. By default it has GNOME as the default GUI. I kind of hate it as it uses lot of resources and has all those stupid animations and stuff. I want something clean and precise when i am working, i am not into looks and too many features, just the bare minimum responsive system is always my favourite. So I installed LXDE which is light weight GUI for linux. you can install it with following command apt-get install lxde-core lxde kali-defaults kali-root-login desktop-base This will not make LXDE you default GUI, so if you reboot, you will n...

Yeaaaa #diy #hacks #oled #arduino #Ironman #animation #makeraddictz A photo posted by Mohesh Mohan (@moheshmohan) on Oct 19, 2014 at 11:41pm PDT Hey folks, So i got this new cheap oled display that i wanted for a long time and its time for us to play with it. So you can find lot of tutorials on the web on how to drive the display but lets just move a step farther, lets do some animation with it. OLED 0.96" 128X64  from aliexpress what i have is an OLED 0.96" 128X64 I2C (or IIC) interface, with SSD1306 driver, 3.3/5V compatible. There are 4 pin on the OLED module, GND, VCC, SCL and SDA. Typically to use I2C on an arduino uno you need to connect it something like this GND - GND on Arduino Uno VCC - 5V on Arduino Uno SCL - A5 on Arduino Uno SDA - A4 on Arduino Uno Lets have a look at the fritzing view of the connections Now how do we drive this thing? Don't worry there is an awesome library for led/lcd displays its called u8glib and y...

Hi Security enthusiast, So if you were following closely on recent developments regarding SSL/TLS security, you might have heard that Qualys SSL labs released an API to automate the testing of internet hosted applications with their awesome hosted testing solution. If you have not heard about it here is the location to their server testing page -  https://www.ssllabs.com/ssltest/ And their API documentation here -  https://github.com/ssllabs/ssllabs-scan/blob/master/ssllabs-api-docs.md So now that the API is released you can automate testing of any number of servers with any language that is able to talk with qualys server via HTTP protocol. My company wanted to test all of our servers with SSL labs, so i thought why can't i automate it with python or something. So here it is, i made a multithreaded python script to test a large number of servers in one go and get results in neat format that my management wanted :-) The script is intended for python 2.7 Yo...

Hey guys, So here is a glimpse of my training trip to Abu Dhabi for SANS 2014. The course i attended was SEC-575 Mobile device security and ethical hacking. I really had a great time and the session was very informative. Since its not fare to shoot a video of the entire session and upload it on YouTube here in the below video is just glimpse to give you a feel of the class. Enjoy ... here it is Abu Dhabi was really beautiful and i really enjoyed the entire week though i was alone :P SEC575 course is awesome and i really learned quite a few tricks from the session. The instructor was Tim Medin and he was a cool guy. Here is myself and Tim. You can go through a lot of pics that i took on my facebook album here  https://www.facebook.com/mohesh.mohan/media_set?set=a.10152110007848811.1073741839.611573810&type=3