It’s Tool Time! Building Out New Tools to Make My Life a Bit Easier and Hopefully Yours

Ok, going to admit here, these tools aren't exactly perfect, but I made them nerdy as I could. I've been automating every day and revisited older repos to give them a polish. Slapping a fresh coat of paint on some and some new tools that I put out there. I still need to test a few, but I love Python and am getting better at bash.

Tool #1: My Custom Repo Install, basically the normal stuff for Kali I install regularly:

GitHub - HackingHusky/My-custom-repo-install-: Bash script for all the stuff I need or use on the… Bash script for all the stuff I need or use on a regular basis- GitHub - HackingHusky/My-custom-repo-install-: Bash…

Basically, I got tired of going to kali.org to get the basic tools (because I've been that lazy, ha) and made a script for quick Kali installs. I still would go to pimp my kali:

GitHub - Dewalt-arch/pimpmykali: Kali Linux Fixes for Newly Imported VM's Kali Linux Fixes for Newly Imported VM's. Contribute to Dewalt-arch/pimpmykali development by creating an account on…

Still one of my to-go's, for sure if Impacket has to get reinstalled. But for other tools not on this list, I made quick adds, like Ligolo or Bloodyad. Pretty straightforward.

Tool #2: Malevolent Shrine

GitHub - HackingHusky/Malevolent_Shrine_Enumeration: Linux quick wins bash script Linux quick wins bash script. Contribute to HackingHusky/Malevolent_Shrine_Enumeration development by creating an…

Each tool has a theme, and I love it. Not every tool, but the recent ones, yes, because I wanted to throw some fun into the script. This is a Linux enumeration. I used my old manual script and polished this one to test the waters. It runs the same, but has been beefed up a bit. This auto-saves the report, too. This also hunts for what's in the /opt folder. It's not as strong as Linpeas, but it really looks for short wins.

Tool #3: Infinite Void

GitHub - HackingHusky/infinite_void: Python script based on Gojo from JJK that does Domain… Python script based on Gojo from JJK that does Domain enumeration - HackingHusky/infinite_void

So, how can I describe this one? It's an Active Directory Object Dumper. I want to do closer wins on AD, look for what's kerberoastable first, abuse the core Domain Admin group, and password-harvest in one tool. This one is going to take a bit of playing around with. I'm open to pull requests. I want to automate AD first and enumerate with a user. This is a work in progress. Can I automate more on AD with just the user account? I'll take open criticism and notes on how to improve this.

Tool #4: Zoro LFI Fuzzer

GitHub - HackingHusky/zoro_lfi_fuzzer: Zoro from One Piece lfi fuzzer Zoro from One Piece lfi fuzzer. Contribute to HackingHusky/zoro_lfi_fuzzer development by creating an account on…

I get a bit impatient with LFI, not going to lie on that one. So instead of fuff and burp's tool (they're not bad, just wanted to get to the point, ha), I made a quick search and scan for LFI. Combine that with seclists/payloadallthethings, and this will get what you need.

Tool #5: Rock's Shared Server

GitHub - HackingHusky/rocko-s_shared_server: bash script that you can either spin up a smb server… bash script that you can either spin up a smb server or a Python HTTP server- HackingHusky/rocko-s_shared_server

I basically just automated the SMB/HTTP server to run with either Samba or open a Python server on port 8000. I want the option to run the script. Is it necessary? Probably not. I guess I was that lazy, ha!

Tool #6 No Longer Human FTP Server

GitHub - HackingHusky/No-Longer-Human-FTP-Server: Dazai' Dazai'. Contribute to HackingHusky/No-Longer-Human-FTP-Server development by creating an account on GitHub.

Totally got the idea from watching Bungo Stray Dogs since my wife really loves the show, and honestly, Dazai and Gojo are probably my favorite characters.

So this tool is basically a Python FTP server; I just wanted to make my own with a fun spin. Handles the same as the other ftp python servers.

You can change this, and during my studies for the CPTS, it's one way to get the hashes downloaded and run secret dumps. You can probably use the curl command in PowerShell, too.

Tool #7 The Armed Detective Agency

GitHub - HackingHusky/The-Armed-Detective-Agency: built-in Python server in case ftp doesn't work built-in Python server in case ftp doesn't work. Contribute to HackingHusky/The-Armed-Detective-Agency development by…

So my second thought here, too, is to spin up a Python HTTP server and exfiltrate data back to you via a POST request. Is it like the Rocko tool? Yes, but in this case, the FTP server isn't working.

Yes, you could use it to share files, but also to get files back over the port connection.

Tool #8: Web Brute Force Login

GitHub - HackingHusky/web-brute-force-login Contribute to HackingHusky/web-brute-force-login development by creating an account on GitHub.

I updated the script and the readme for better, clearer documentation. Basically automating brute force over Python vs fuff/hydra/burp.

Tool #9: SQL Injections

GitHub - HackingHusky/sql-injections Contribute to HackingHusky/sql-injections development by creating an account on GitHub.

Same thing with the Web Brute Force, updated the script and documentation. So you can try the attack first to see if SQLi is available.

Tool #10: SSH Brute Force Login Script

GitHub - HackingHusky/ssh-bruteforce-login.py Contribute to HackingHusky/ssh-bruteforce-login.py development by creating an account on GitHub.

Like the other two, I gave it an update, but you probably can use Hydra. This was one of my coding projects in school.

Tool #11 Web Surface Inspector

GitHub - HackingHusky/web-surface-inspector: It's a web scraper, recon tool, and prompt detector… It's a web scrapper, recon, and also detects prompt injection patterns - HackingHusky/web-surface-inspector

This is probably still my favorite repo in general. From my first tool, I shared out:

https://medium.com/@TheHuskyHacker/my-new-tool-web-surface-inspector-54354860e6f1

It was about 6 months ago, when I was still trying to build tools and figure out which model to use; it has evolved since then.

I added more trigger words for the model hunting and auditing. And functions just as before. This is my first coding project where I pushed myself to build a tool that detects AI injection and checks for header abuse. This was the first tool I brought to the table as a Purple Teamer and as my own coding project. Not for work, not for school, not for a cert. A tool that I say, I see a problem, I'll make a solution — simply putting the website in and scanning for the issue, or finding the pattern of abuse, which could end up in a pentest report or incident. It's not perfect, but my security team loved it at my current role in the help desk department. And this is where I really pushed myself to make content after. It's probably my true start, then just putting CTF writeups. And the model for this looked like my Husky named Sadie. That's why this one is special for me.

Thanks for reading, and I'm not excited for Campaign Evolved… Nope!! Next tool will probably be Halo themed and Stoked for the CPTS!! People haven't said it was fun, pass or fail, what other test allows you to hack and prove that you can do it like the PNPT or OSCP*?

*** There are way more tests like it, like Alter Security Red Team exams, as an example. But still, those are probably my favorite tests.