Penetration Testing library written in Python
A GFOSS project for the Google Summer of Code 2018 programme
Development of a Python library for penetration testers. The library will include a set of tools for performing the basic tasks for attacking a remote host. It will include reconnaissance tools such as modules that will be able to collect data for a specific target either through the web or through user input. Moreover, other tools will be developed to create custom dictionaries for username and password attacks. Other attack techniques that will be supported include DoS attack, and BruteForce attack. The library will also include various statistical functions for extracting additional information from a captured host.
There's a detailed documentation section for each module of this project. It contains information regarding:
- requirements
- installation
- usage
- examples
See Wiki tab
See Projects tab
This project consists of three main modules:
- User Reconnaissance & Information Gathering. This module's purpose is to gather information about Facebook users with public information on their profiles, and to create a collection of that information, which will be used in a dictionary attack.
- Target System Reconnaissance & Information Gathering. A set of functions have been developed in order to get useful information for a target system such as open ports, OS info etc.
- Attack PenTest Tools. A set of simple tools that try to take advantage of any information gathered with the use of our User Reconnaissance module and Target System Reconnaissance module, in order to succeed in some basic attack techniques.
Possible additions or improvements to this project could be the following:
- An SSH bruteforce module (brutSSH.py), similar to bruftp.py
- The improvement of pydos_scapy.py, as it is not very effective at the moment, plus the improvement of the simple socket implementation, in order for the script to be cross platfrom and not depend on hping3
- An extension of the User Reconnaissance module so that it covers a wider variety of social networks, such as Instagram, Twitter, LinkedIn etc.
- A distributed, online password cracking module, based on our User Reconnaissance data, that will possibly use spoofed IPs to ensure a large number of attempts.
- Konstantinos Christos Liosis
Open Technologies Alliance - GFOSS
The purpose of this library is educational, for Penetration Testing and Ethical Hacking and under no circumstances for malicious actions. It's use will comply to all current data protection legislation.