Archive for the ‘Pentest Scripts’ Category

metasploitHelper and nmap2nessus released at Blackhat Asia Arsenal 2015

March 30, 2015 Leave a comment

@mgianarakis and me (@keith55) presented two new tools (metasploitHelper and nmap2nessus) at Blackhat Asia Arsenal in Singapore on 26th and 27th of March, 2015.

The tools were developed to help guys like us during vulnerability assessments and penetration tests.

Blog posts about the tools will be coming soon. Meanwhile, the information on the Github pages should be sufficient to get you started.
The tools are open source.  Feel free to contribute to the projects. Thank you



Pentesting Firebird Databases

January 9, 2015 Leave a comment

There seems to be limited information on pentesting Firebird databases on the Internet.
Firebird database server listens on TCP port 3050.

One good resource I found is

It seems like most people do not change the default SYSDBA credentials for their Firebird database. Below are the default credentials. 
Password: masterkey

I have encountered before that the access card database system was using Firebird database for its backend.
This python script requires pyfirebirdsql library from

Firebird requires you to supply the database name on the server you are trying to.
One way to get around it is to check for active connections on the Firebird database server.

What this tools does is to
1. Connect to the Firebird database server using the default credentials
2. List the connected databases
3. Dump the records from the Firebird database server

You can also use the -wordlist argument to supply it a wordlist of database names so that it can attempt to brute-force. That is useful if there aren’t any active connections (or databases not mounted) on the Firebird database that you are trying to access.

Below is a screenshot of the tool in action.

The common-tables.txt file from sqlmap is useful if you need a wordlist.

The tool can be downloaded from the below Github repo.

Proxy Tester Script

January 8, 2015 Leave a comment

I wrote a script to tests and sorts proxy servers (socks4, socks5, http, https).
There are readily available scripts out there on the Internet that does the same. I just want to write my own.

Sometimes, during a web application test, your IP address might get flagged and blocked by the target’s WAF.
Proxy servers might just be useful in this type of situation. However, regard all proxy servers as malicious and unsafe. You do not want to send sensitive data like credentials over the proxy servers.

If you are doing anything malicious, do not access the proxy servers directly as the ISP might be able to pinpoint the end point of the attack easily.

Below is a screenshot of the help menu for the script.
By default, the script tests the proxy servers to see if it supports SSL connections.

Below is an example of the command to run

python -i proxies.txt -o profile1 -n 100  -time -t https -sort

The script accepts a text file containing proxy servers in the below format

The input file can contain a mixture of Socks4, Socks5, HTTPs, HTTP proxies.

In the below example, the script reads the list of proxies from the file using the -in argument, tests and sorts the proxies using 80 concurrent threads into categories (Socks4, Socks5, HTTPs) and outputs a Proxifier profile PPX file (which you can import into Proxifier if you are using this).

You can use the -time argument in the script to test the latency of the connection.
It might be useful as you might want to avoid using a proxy that has a high latency.
Your computer -> Proxy server -> Website

You can download the script from the below Github repo.

Categories: Pentest Scripts

Test AS/400 for default credentials

December 7, 2014 Leave a comment

I wrote a simple script to test default credentials in AS/400. I made use of the library and sample code from  It currently only works with IBM AS/400 telnet servers for now.

You can pull the code from
You will have to supply the ip and port of the AS400 server in the command line

Help screen for AS/400 tool

Below is a screenshot of the tool in action.

Test AS/400 Default Credentials

Corelabs Impacket Scripts (Modded)

September 9, 2014 Leave a comment

I made some changes to script due to some anonyances I encountered during peneration tests.

The use case scenario for these modded scripts is that if the password contains special characters like @ or : and you can’t use it with the default scripts (maybe its just me who can’t figure out how to know how to use them :P)

These 3 scripts ( are the common tools that you can use if you want to get the remote host to execute a meterpreter exe file generated via Veil-Evasion.

Using the modded scripts, you can get a list of hosts to run a single command (eg ipconfig) using one line of command.

The source code for the modded scriptscan be found here

Special thanks for Corelabs for making these scripts. Impacket scripts can be found here

Screenshot of

Examples of how you can use the modded
python -d testdomain -u user -p pass -ip -command ipconfig
python -d testdomain -u user -p pass -ip -f ips.txt -command ipconfig


Screenshot of

Examples of how you can use the modded
python -d testdomain -u user -p pass -ip
python -d testdomain -u user -p pass -f ips.txt


Screenshot of
Examples of how you can use the modded
python -d testdomain -u user -p pass -ip -command ipconfig
python -d testdomain -u user -p pass -f ips.txt -command ipconfig



August 27, 2014 Leave a comment


– Python2.7
– Impacket (svn checkout impacket-read-only)
– Ruby
– Veil Evasion (git clone


If you are working on a penetration test remotely, its sometimes hard to determine when the users start work or connect their laptops to the network.

winboxHunter is useful if you have managed to capture and cracked a bunch of NTLM credentails and want to run Metasploit against these windows boxes as and when they are connected to the network.

winboxHunter listens for NBNS broadcast packets so that when a new winBox is connected to the network, it will use the Impacket scripts ( and to push an executable onto the winBox and runs it.

In the background, winboxHunter runs Metasploit with payload handler (multi/handler) and listens for incoming connections from the winboxes.

You might want to modify autorunCmd.rc to specify the Metasploit commands you want to run on the pwned winbox upon connecting back to Metasploit.

See meterpreter.rc and autorunCmd.rc for more details.

If a host changes its IP address due to DHCP lease expiration, it will not attempt to exploit the winbox twice.

Format of password.txt

domain/username password


Meterpreter executable

You only need to use one of the below 2 options

– You can either use your own meterpreter payload executable using the -e or –exe argument (payload=windows/meterpreter/reverse_https, rport=8443) or

– You can use the -n or –enableVeil argument to generate a meterpreter payload executable using Veil Evasion
You can run winboxHunter using the below sample command

ruby winboxHunter.rb -n -f password.txt -v

When you run winboxHunter, a linux screen with the name “msfscreen” will be created and msfconsole will be executed. You can connect to the screen via the below command

screen -dr msfscreen

The source code for winboxHunter can be found at

Medusa ‘combo’ word lists (default usernames and passwords) for SSH and Telnet services

August 16, 2014 Leave a comment is a useful resource that contains the default credentials for various devices.

I wrote a script that crawls, parses and extracts the credentials from and outputs them into the “combo” format as required by medusa. Medusa is a brute force tool for numerous services like MySQL, SMB, SSH, Telnet and etc.

Currently, only ssh and telnet related credentials are extracted from

You can download the “combo” word lists for ssh and telnet via the direct links below.

SSH combo list for Medusa

Telnet combo list for Medusa

Combined users.txt and passwords.txt that you can use with Patator ( which is another awesome brute force tool.

Sample command for medusa “combo” SSH attack.
medusa -M ssh -C wordList_ssh.txt -H port22.txt

If you would like to play around with the python script, you can download the file at the below location.


Patator is another awesome tool that you can use for brute forcing SSH logins

Sample command for patator SSH attack ssh_login host= user=FILE0 password=FILE1 0=users.txt 1=passwords.txt -x ignore:mesg=’Authentication failed.’


Special shoutout to for maintaining and providing the extensive database of default credentials at


Get every new post delivered to your Inbox.