1.Web Developer

The Web Developer extension adds a toolbar button to the browser with various web developer tools. This is the official port of the Web Developer extension for Firefox.

2.d3coder

This extension enables you to encode and decode selected text via the context menu. This reduces the time you spend on looking up encoded values and gives you more time to concentrate on the important things of development. 

3.Site Spider

Use this extension to spider a website looking for dead links. One can restrict the spidering to a directory, a domain, or any other regular expression. The spider can also follow one link beyond this restriction, allowing one to find broken external links.

4.Session Manager

A simple yet powerful extension for managing sets of tabs. Session Manager is a simple yet powerful extension that makes it quick and easy to save, update, remove, and restore sets of tabs.

5.Request Maker

Request Maker is a tool for penetration testing. With it you can easily capture requests made by web pages, tamper with the URL, headers and POST data and, of course, make new requests. Request Maker only captures requests sent via HTML forms and XMLHttpRequests; it doesn't fill the log with useless information about images and style sheets.

6.EditThisCookie

EditThisCookie is a cookie manager. You can add, delete, edit, search, protect and block cookies.

7.Cache Killer

This extension allows you to easily disable caching in Chrome. When Cache Killer is activated, it will clean your Browser Cache before every page load. With just one click you can disable or enable this feature.

8.XSS Rays

XSS Rays is a security tool to help pen test large web sites. It's core features include a XSS scanner, XSS Reverser and object inspection. Need to know how a certain page filters output? Don't have the source? No problem. XSS Rays will blackbox reverse a XSS filter without needing the source code.

9.Port Scanner

The Port Scanner extension determines lively services on the host using TCP port interrogations. Port Scanner will check which TCP ports are listening. You can test these ports to see if they are running. It is recommended that any services which are not necessary be disabled. Use Port Scanner to scan individual ports to determine if the device is listening on that port. Port Scanner will analyse given IP address or URL for open ports to help you to secure it.

10.HPP Finder

HPP Finder is a Chrome extension designed for detecting HPP attempts. HPP Finder can detect URLs and HTML forms that might be susceptible of parameter pollution, but it is not a complete solution against HPP. 

Turn Your Chrome Browser Into A Penetration Testing tool

Unknown Reply 12:23 AM

1. Web Developer The Web Developer extension adds a toolbar button to the browser with various web developer tools. This is the...

Read more »
index-post-thumbnail

10 Useful Firefox Add-ons For Hackers

Unknown 2 2:53 PM

Mozilla Firefox 1. Greasemonkey Allows you to customise the way a web page displays or behaves, by using small bits of JavaScrip...

Read more »
index-post-thumbnail

8 Simple Tips to Secure your Apache Web Server

Unknown Reply 12:13 PM

apache http server Apache is the most widely used Web server on the Internet. It was developed to work in Unix environment, but was po...

Read more »
Kali Linux


Intention/Intro

Educational purposes only.
This tutorial will teach how to ARP Spoof a network and get user information even from websites with that use encryption (HTTPS). This tutorial we’ll use the Kali Linux (Live CD), the sslstrip software, we’ll modify the etter.conf file, add new rules to the iptables and use the ettercap software.

Pre-configurations

The commands below will set the iptables to redirect everything that comes from port 80 to port 10000. Our goal here is to set the sslstrip to strip HTTPS from pages and give to the end user a HTTP page (with no security, no encryption). So, the port that we’ll use to redirect the striped content will be the port 10000.
$echo 1 > /proc/sys/net/ipv4/ip_forward
$iptables -t nat -A PREROUTING -p tcp –destination-port 80 -j REDIRECT –to-port 10000

Usage

It’s time to run sslstrip and do the tricks that I mentioned before. To run it, use the command below:
$sslstrip -l 10000
Now, open another terminal windows and run the command below:
$ettercap -G
A windows will pop and that’s the ettercap GUI. Click on Sniff > Unifed sniff and choose the interface that you have a internet connection (same as your victims). For exemple, I choose wlan0, but if I’re using a cable, and would’ve choose the eth0 interface. Now click on Host > Scan for hosts. Now click again on Host > Host List. Select your gateway (the IP that you can access your router. It’s usually some IP that ends with 1 [like 192.168.2.1] . Keep in mind that’s not a rule!) and click on the button Target 1. Select the IP that your target is using and click on the button Target 2 (you can select multiples IP’s if you click on them holding the Ctrl or Command key). Now, click on Plugins > Manage Plugins and a list of plugins will appear. Now, double click on dns_spoof and make shore that there’s an asterisk ( * ) by it when you double click it. Now, click on Mitm > Arp spoofing and select the first option that you see in the windows that pop up and click on OK. Now click onStart > Start sniffing. You’re all set! Wait until your target access pages like gmail, facebook, twitter or anything that you have to use credentials. When your target access those sites, the ettercap will show the user and password that your target used. Remember: Thesslstrip is the responsible for making the HTTPS website unsecured! What I’m saying is that the target’s browser will request the page and the server will return a HTTPS page. The sslstrip intercept it on port 10000 and return to the user a HTTP page (no encryption). Beautiful, isn’t it?

Conclusion

This attack is simple to do and very effective. I strongly recommend that you use the Live Kali (instead of installing on your machine or on a VM). I have Kali installed on a computer and it often gives me headache to fix my mistakes. The ettercap might not work if your using a VM. In order to work, you should download/install all the extras VM tools that’s available. The ettercap might not work on a installed Kali. I couldn’t find one reason for that problem yet, but I read that if you uninstall it and install it from the Github resource, it might work better than the one that came with Kali. Warning: To install ettercap from Github, you might face missing libs. It uses a lot of different libs and it will take some time to you get them all installed on your machine. If you want to try to install it, use the commands below:
$sudo apt-get remove ettercap-common ettercap-graphic
$git clone https://github.com/Ettercap/ettercap
$cd ettercap && mkdir build && cmake ../ && make install
Ettercap, sometimes, didn’t work when I pressed the Star Sniffing option. What I did to make it work? Went to the first step of this tutorial and repeated everything.
How can you protect yourself from attacks like this? You could use a software like XArp, create static ARP tables, or you could read this.

Source:http://l33ttutorials.wordpress.com

sslstrip and arpspoofing with Kali linux Tutorial

Unknown Reply 12:00 PM

Kali Linux Intention/Intro Educational purposes only. This tutorial will teach how to ARP Spoof a network and get user information...

Read more »
Older Posts Home index

Search

Technology & Computers - Top Blogs Philippines

Popular Posts

Categories