mimipenguin - A Tool To Dump The Login Password From The Current Linux User

A tool to dump the login password from the current linux desktop user. Adapted from the idea behind the popular Windows tool mimikatz.

Details

Takes advantage of cleartext credentials in memory by dumping the process and extracting lines that have a high probability of containing cleartext passwords. Will attempt to calculate each word's probability by checking hashes in /etc/shadow, hashes in memory, and regex searches.

Requires

• root permissions

Supported/Tested Systems

• Kali 4.3.0 (rolling) x64 (gdm3)
• Ubuntu Desktop 12.04 LTS x64 (Gnome Keyring 3.18.3-0ubuntu2)
• Ubuntu Desktop 16.04 LTS x64 (Gnome Keyring 3.18.3-0ubuntu2)
• XUbuntu Desktop 16.04 x64 (Gnome Keyring 3.18.3-0ubuntu2)
• Archlinux x64 Gnome 3 (Gnome Keyring 3.20)
• VSFTPd 3.0.3-8+b1 (Active FTP client connections)
• Apache2 2.4.25-3 (Active/Old HTTP BASIC AUTH Sessions) [Gcore dependency]
• openssh-server 1:7.3p1-1 (Active SSH connections - sudo usage)

Notes

• Password moves in memory - still honing in on 100% effectiveness
• Plan on expanding support and other credential locations
• Working on expanding to non-desktop environments
• Known bug - sometimes gcore hangs the script, this is a problem with gcore
• Open to pull requests and community research
• LDAP research (nscld winbind etc) planned for future

Development Roadmap

MimiPenguin is slowly being ported to multiple languages to support all possible post-exploit scenarios. The roadmap below was suggested by KINGSABRI to track the various versions and features. An "X" denotes full support while a "~" denotes a feature with known bugs.

Feature	.sh	.py
GDM password (Kali Desktop, Debian Desktop)	~	X
Gnome Keyring (Ubuntu Desktop, ArchLinux Desktop)	X	X
VSFTPd (Active FTP Connections)	X	X
Apache2 (Active HTTP Basic Auth Sessions)	~	~
OpenSSH (Active SSH Sessions - Sudo Usage)	~	~

Download mimipenguin

Read More

tinfoleak - Get detailed information about a Twitter user activity

tinfoleak is a simple Python script that allow to obtain:

• basic information about a Twitter user (name, picture, location, followers, etc.)
• devices and operating systems used by the Twitter user
• applications and social networks used by the Twitter user
• place and geolocation coordinates to generate a tracking map of locations visited
• show user tweets in Google Earth!
• download all pics from a Twitter user
• hashtags used by the Twitter user and when are used (date and time)
• user mentions by the the Twitter user and when are occurred (date and time)
• topics used by the Twitter user

You can filter all the information by:

• start date / time
• end date / time
• keywords

Download tinfoleak 

Read More

[Twitter Password Dump v2.0] Command-line Tool to Recover Twitter Password from Web Browsers

Twitter Password Dump is the command-line tool to instantly recover your lost Twitter password from all the popular web browsers.

Currently it can recover your Twitter password from following applications,

• Firefox
• Internet Explorer (v6.x - v10.x)
• Google Chrome
• Chrome Canary/SXS
• CoolNovo Browser
• Opera Browser
• Apple Safari
• Flock Browser
• SeaMonkey Browser
• Comodo Dragon Browser

It automatically discovers installed applications on your system and recovers all the stored Twitter login passwords within seconds.

By default it dumps all the recovered passwords to console. Now with version v2.0 onwards, you can also save the passwords to TEXT file.

Download TwitterPasswordDump v2.0

Read More

[Twitter Password Decryptor v5.0] Recover Lost Twitter Password from all Web Browsers & Messengers

Twitter Password Decryptor is the FREE software to instantly recover Twitter account passwords stored by popular web browsers.

Most web browsers store the login passwords for visited websites so that user don't have to remember and enter the password every time. Each of these web browsers use their own proprietary encryption mechanism to store the login passwords including Twitter account passwords.

TwitterPasswordDecryptor automatically crawls through each of these browsers and instantly recovers all of the stored Twitter passwords.

Features
It currently supports recovering of the stored Twitter account password from following popular Internet browsers.

• Internet Explorer
• Firefox
• Google Chrome
• Chrome SXS/Canary
• CoolNovo Browser
• Opera Browser
• Apple Safari
• Flock Browser
• Comodo Dragon Browser
• SeaMonkey Browser

Download Twitter Password Decryptor v5.0

Read More

[Twitter Password Dump] Command-line Tool to Recover Twitter Password from Web Browsers

Twitter Password Dump is the command-line tool to instantly recover your lost Twitter password from all the popular web browsers.


Currently it can recover your Twitter password from following applications,

• Firefox
• Internet Explorer (v6.x - v10.x)
• Google Chrome
• Chrome Canary/SXS
• CoolNovo Browser
• Opera Browser
• Apple Safari
• Flock Browser
• SeaMonkey Browser
• Comodo Dragon Browser

It automatically discovers installed applications on your system and recovers all the stored Twitter login passwords within seconds.

Download TwitterPasswordDump v1.0

Read More

[Avivore] The Twitter-searching Data Miner

Avivore is a Python-based tool that searches Twitter for keywords and then parses any tweets that are found. When parsing, it looks for the following sort of data:

• Phone numbers in NPA-NXX format (ex: 604-555-1212)
• IPv4 addresses (127.0.0.1)
• Blackberry PINs (ABCDEF12)

It presently uses a SQLite backend to store the data that is found and outputs results via a Console. It has only been tested on Ubuntu Linux but there should be no real reason for it not to work under OS X, Windows, or any other platform capable of running Python.

I am certainly open to new data sets that it could pull. E-mail addresses were considered but at the time that I was writing all of this, I was not as interested in that information.

This tool is intended to be used for demonstration purposes and has some of my more extensive keyword searches removed. It was first presented at BSides Vancouver on March 4th, 2013.

Requirements

• Python 3
• SQLite and Twitter modules (pip install twitter)

No Twitter account is required for access.

Download Avivore

Read More

[Twitter Password Decryptor v4.0] Recover Twitter Password

Twitter Password Decryptor is the FREE software to instantly recover Twitter account passwords stored by popular web browsers.

Most web browsers store the login passwords for visited websites so that user don't have to remember and enter the password every time. Each of these web browsers use their own proprietary encryption mechanism to store the login passwords including Twitter account passwords.

TwitterPasswordDecryptor automatically crawls through each of these browsers and instantly recovers all of the stored Twitter passwords.
It supports both GUI interface as well as command line version making it very useful tool for Penetration testers & Forensic investigators.

It currently supports recovering of the stored Twitter account password from following popular Internet browsers.

Internet Explorer Firefox Google Chrome Chrome SXS/Canary CoolNovo Browser Opera Browser Apple Safari Flock Browser Comodo Dragon Browser SeaMonkey Browser

Here are the main features

Instantly decrypt and recover stored encrypted Twitter account password from Popular Web browsers. Comes with both GUI interface as well as Command-line version. Automatically discovers the supported applications from their respective install location and recovers the password instantly. Sort feature to arrange the displayed password list by username and password which makes it easy to search through 100's of entries. Save the recovered Twitter password list to HTML/XML/Text file Easier and faster to use with its enhanced user friendly interface. It comes with Installer for helping you in local Installation & Uninstallation.

Download TwitterPasswordDecryptor v4.0

Read More

[AnonTwi 1.0] Twittea Anónimanente

AnonTwi es un software gratuito diseñado para navegar anónimamente en las redes sociales. Es compatible con Identi.ca y Twitter.com. Puedes aprovechar la aleatorización de proxy, enviar datos falsos geolocalización, y más.

+ Cifrado AES + HMAC-SHA1 en Tweets y Mensajes Directos --> [Más Info]

      + Secure Sockets Layer (SSL) para interactuar con la API
      + Proxy Socks (por ejemplo, para conectar a la red TOR)
      + Valores aleatórios para las cabeceras HTTP
      + Enviar mensajes largos que divide de forma automática
      + Descifrado automático a partir de urls de tweets o código cifrado
      + Copia de seguridad de mensajes a disco (máx: 3200)
      + Enviar falsas geolocalizaciones
      + Borrar datos y cerrar cuenta (suicidarse)
      + Ver los Trending Topics globales
      + Soporte UTF-8 + Unicode (chino, árabe, símbolos, etc)
      + Multiplataforma: GNU/Linux, MacOS, Win32
      + Resultados con colores  
      + Generar herramientas y módulos
      + Interfaz visual GTK+
      + Un bot de irc     

Y otras muchas más opciones que puedes ver detalladas aquí                                                  

hg clone http://hg.code.sf.net/p/anontwi/code anontwi-code

Descargar AnonTwi 1.0

Read More