The Moment Notice

About Tishna:
Tishna is complete automated pentest framework for web servers, application layer to web security.

Tishna was tested on: Kali Linux, Parrot Security OS, Black Arch, Termux, Android Led TV.

Tishna's interface: Tishna has 62 options with full automation and can be use for web security swiss knife.

Tishna's installation: First, boot your Kali Linux or Parrot Security OS up. Then open Terminal and enter these commands

Appeared:

Cyber Space (Computer Security).

Terror Security (Computer Security).

National Cyber Security Services.

Brief Introduction

Tishna is useful in Banks, Private Organisations and Ethical hacker personnel for legal auditing.

It serves as a defense method to find as much as information possible for gaining unauthorised access and intrusion.

With the emergence of more advanced technology, cybercriminals have also found more ways to get into the system of many organizations.

Tishna software can audit, servers and web behaviour.

Tishna can perform Scanning & Enumeration as much as possible of target.

It's first step to stop cyber criminals by securing your Servers and Web Application Security.

Tishna is false positive free, when there is something it will show no matter what, if it is not, it will give blank results rather error.

Developer

Haroon Awan

mrharoonawan@gmail.com

Support to the coder
You can sponsor and support via BTC.
The bitcoin address: 3BuUYgEgsRuEra4GwqNVLKnDCTjLEDfptu
qr code

Download Tishna

More info

In the past I had to do several DoS security audits, with múltiples types of tests and intensities. Sometimes several DDoS protections were present like Akamai for static content, and Arbor for absorb part of the bandwith.

One consideration for the DoS/DDoS tools is that probably it will loss the control of the attacker host, and the tool at least has to be able to stop automatically with a timeout, but can also implement remote response checks.

In order to size the minimum mbps needed to flood a service or to retard the response in a significant amount of time, the attacker hosts need a bandwith limiter, that increments in a logarithmic way up to a limit agreed with the customer/isp/cpd.

There are DoS tools that doesn't have this timeouts, and bandwith limit based on mbps, for that reason I have to implement a LD_PRELOAD based solution: bwcontrol

Although there are several good tools for stressing web servers and web aplications like apache ab, or other common tools used for pen-testing, but I also wrote a fast web flooder in c++ named wflood.

As expected the most effective for taking down the web server are the slow-loris, slow-read and derivatives, few host were needed to DoS an online banking.

Remote attacks to database and highly dynamic web content were discarded, that could be impacted for sure.

I did another tool in c++ for crafting massive tcp/udp/ip malformed packets, that impacted sometimes on load balancers and firewalls, it was vulcan, it freezed even the firewall client software.

The funny thing was that the common attacks against Akamai hosts, where ineffective, and so does the slow-loris family of attacks, because are common, and the Akamai nginx webservers are well tunned. But when tried vulcan, few intensity was enough to crash Akamai hosts.

Another attack vector for static sites was trying to locate the IP of the customer instead of Akamai, if the customer doesn't use the Akamai Shadow service, it's possible to perform a HTTP Host header scan, and direct the attack to that host bypassing Akamai.

And what about Arbor protection? is good for reducing the flood but there are other kind of attacks, and this protection use to be disabled by default and in local holidays can be a mess.

More information

About EasySploit: EasySploit is Metasploit automation tool to use Metasploit Framework EASIER and FASTER than EVER.

EasySploit's options:

Windows --> test.exe (payload and listener)
Android --> test.apk (payload and listener)
Linux --> test.py (payload and listener)
MacOS --> test.jar (payload and listener)
Web --> test.php (payload and listener)
Scan if a target is vulnerable to ms17_010 (EnternalBlue)
Exploit Windows 7/2008 x64 ONLY by IP (ms17_010_eternalblue)
Exploit Windows Vista/XP/2000/2003 ONLY by IP (ms17_010_psexec)
Exploit Windows with a link (HTA Server)
Contact with me - My accounts

EasySploit's installation
You must install Metasploit Framework first.
For Arch Linux-based distros, enter this command: sudo pacman -S metasploit

For other Linux distros, enter these command to install Metasploit Framework: And then, enter these commands to install EasySploit:

How to use EasySploit? (EasySploit video series tutorials)

Disclaimer about EasySploit:

Usage of EASYSPLOIT for attacking targets without prior mutual consent is ILLEGAL. Developers are not responsible for any damage caused by this script. EASYSPLOIT is intented ONLY FOR EDUCATIONAL PURPOSES!!! STAY LEGAL!!!

You might like these similar tools:

You can support KALI LINUX TRICKS from Patreon.

Download EasySploit

Read more

The Zed Attack Proxy team is pleased to announce two recently released initiatives:

ZAP In Ten

The team have just launched a new series of videos called 'ZAP in Ten' in conjunction with AllDayDevOps.

ZAP in Ten is a series of short form videos featuring Simon Bennetts, project lead of the OWASP Zed Attack Proxy (ZAP) project. Each video highlights a specific feature or resource for ZAP.

ZAP API Docs

As part of OWASP's participation in Google's Season of Docs, the ZAP project has had @sshniro working on API documentation. The first iteration of the documentation is now live. It includes Java, Python, and shell example snippets all presented in a responsive and accessible design. Which we will continue to build on in the future.

Big thanks to Nirojan for his efforts on this wonderful initiative! Congratulations and thanks to Google Open Source for helping to bring the open source and technical writer communities together!

The Moment Notice

Monday, August 31, 2020

Tishna: An Automated Pentest Framework For Web Servers, Web Applications To Web Security

Sunday, August 30, 2020