SpearPhisher – A Simple Phishing Email Generation Tool

SpearPhisher is a simple point and click Windows GUI tool designed for (mostly) non-technical people who would like to supplement the education and awareness aspect of their information security program. Not only is it useful to non-technical folks, penetration testers may find it handy for sending quick and easy ad-hoc phishing emails. The tool supports specifying different sending names and email addresses, multiple recipients via TO, CC, BCC, and allows bulk loading with one recipient email address per line in a file. It allows customization of the subject, adding one attachment, and SSL support for SMTP enabled mail servers.

ImpressPages CMS v3.6 Remote Arbitrary File Deletion Vulnerability

EDB-ID: 29328 CVE: N/A OSVDB-ID: N/A
Author: LiquidWorm Published: 2013-11-01 Verified: Not Verified
Exploit Code:   Download Vulnerable App:   N/A

Vendor: ImpressPages UAB
Product web page: http://www.impresspages.org
Affected version: 3.6

Summary: ImpressPages CMS is an open source web content
management system with revolutionary drag & drop interface.

Social Scheduling Tool Buffer Gets Hacked, Floods Twitter And Facebook With Weight Loss Spam

If you’re a user of social media scheduling app Buffer, there’s a good chance that your Saturday morning has been less than relaxing. There have been numerous reports circulating today purporting that the service has been hacked, and just a few moments ago the company officially confirmed those reports in a tweet.

“Hi all. So sorry, it looks like we’ve been compromised,” the terse statement reads. “Temporarily pausing all posts as we investigate. We’ll update ASAP.”

The Indian Prime Minister Is Spy-Proof, Has no Email or Cell Phone

Recent reports said that the U.S. National Security Agency has spied on over 35 unnamed world leaders, but Indian Prime Minister Manmohan Singh is sure he's not one of them — as he doesn't have a phone or an email address to hack.

Bozok RAT 1.4.3

Changelog:
-fixed socket timeout bug
-fixed small translation bugs
-added spanish/arabic/bulgarian/polish/french translation

Build a Basic IR Motion-Sensing Camera with Weekend Projects

The Crittergram Capture Cam combines several common components and software libraries to assemble a basic motion-sensing camera that takes photos whenever something interrupts the field of a Passive InfraRed (PIR) sensor.

Monitor GitHub Activity with an RGB LED Matrix

Ever wonder who is forking your code? [Jack] did, so he built a real time GitHub activity display for his company’s repositories. The display is based a Wyolum The Intelligent Matrix (TiM) board.

Kali Linux Summer Update Release (v1.0.4)

Uber lee7s at offensive Security have released an update Of kali linux just before the Famous Defcon and Black Hat.

You do not need to re-download Kali Linux 1.0.4 if you already have it installed. A regular “apt-get update && apt-get dist-upgrade” will do the job of getting you to the latest and greatest!

A great news is that Armitage is back in Kali Linux. woo7s !!!!

According to them,

“ we are pleased to announce the availability of Kali Linux 1.0.4. The last few months since the initial release of Kali have seen a large number of changes, upgrades, and improvements in the distribution, all of which are included in version 1.0.4.”

MSSQL Injection Cheat Sheet

Some of the queries in the table below can only be run by an admin. These are marked with “– priv” at the end of the query.

Misc Tips

In no particular order, here are some suggestions from pentestmonkey readers.

From Dan Crowley:

A way to extract data via SQLi with a MySQL backend

From Jeremy Bae:

Tip about sp_helpdb – included in table above.

From Trip:

List DBAs (included in table above now):

select name from master..syslogins where sysadmin = ’1′

From Daniele Costa:

Tips on using fn_my_permissions in 2005, 2008 – included in table above.

Also:

To check permissions on multiple database you will have to use the following pattern.

USE [DBNAME]; select permission_name FROM fn_my_permissions (NULL, ‘DATABASE’)

Note also that in case of using this data with a UNION query a collation error could occur.

In this case a simple trick is to use the following syntax:

select permission_name collate database_default FROM fn_my_permissions (NULL, ‘DATABASE’)