• Stars
    star
    373
  • Rank 110,624 (Top 3 %)
  • Language
    Ruby
  • License
    MIT License
  • Created over 6 years ago
  • Updated over 1 year ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Metasploit custom modules, plugins, resource script and.. awesome metasploit collection

Metasploit custom modules, plugins, resource script and.. awesome metasploit collection
https://www.hahwul.com/p/mad-metasploit.html

Awesome

open awesome.md

Add mad-metasploit to metasploit framework

  1. config your metasploit-framework directory
$ vim config/config.rb
$metasploit_path = '/opt/metasploit-framework/embedded/framework/'
#                    /usr/share/metasploit-framework

2-A. Interactive Mode

$ ./mad-metasploit

2-B. Commandline Mode(preset all)

$ ./mad-metasploit [-a/-y/--all/--yes]

Use custom modules

search auxiliary/exploits, other..

HAHWUL > search springboot

Matching Modules
================

   Name                                          Disclosure Date  Rank    Check  Description
   ----                                          ---------------  ----    -----  -----------
   auxiliary/mad_metasploit/springboot_actuator                   normal  No     Springboot actuator check

Use custom plugins

load mad-metasploit/{plugins} in msfconsole

HAHWUL > load mad-metasploit/db_autopwn
[*] Successfully loaded plugin: db_autopwn

HAHWUL > db_autopwn
[-] The db_autopwn command is DEPRECATED
[-] See http://r-7.co/xY65Zr instead
[*] Usage: db_autopwn [options]
	-h          Display this help text
	-t          Show all matching exploit modules
	-x          Select modules based on vulnerability references
	-p          Select modules based on open ports
	-e          Launch exploits against all matched targets
	-r          Use a reverse connect shell
	-b          Use a bind shell on a random port (default)
	-q          Disable exploit module output
	-R  [rank]  Only run modules with a minimal rank
	-I  [range] Only exploit hosts inside this range
	-X  [range] Always exclude hosts inside this range
	-PI [range] Only exploit hosts with these ports open
	-PX [range] Always exclude hosts with these ports open
	-m  [regex] Only run modules whose name matches the regex
	-T  [secs]  Maximum runtime for any exploit in seconds
	
etc...

List of

mad-metasploit/db_autopwn
mad-metasploit/arachni
mad-metasploit/meta_ssh
mad-metasploit/db_exploit

Use Resource-scripts

 #> msfconsole

 MSF> load alias
 MSF> alias ahosts 'resource /mad-metasploit/resource-script/ahosts.rc' 
 MSF> ahosts
 [Custom command!]

List of rs

ahosts.rc
cache_bomb.rb
feed.rc
getdomains.rb
getsessions.rb
ie_hashgrab.rb
listdrives.rb
loggedon.rb
runon_netview.rb
search_hash_creds.rc
virusscan_bypass8_8.rb

Archive(Informal metasploit modules)

archive/
โ””โ”€โ”€ exploits
    โ”œโ”€โ”€ aix
    โ”‚ย ย  โ”œโ”€โ”€ dos
    โ”‚ย ย  โ”‚ย ย  โ”œโ”€โ”€ 16657.rb
    โ”‚ย ย  โ”‚ย ย  โ””โ”€โ”€ 16929.rb
    โ”‚ย ย  โ”œโ”€โ”€ local
    โ”‚ย ย  โ”‚ย ย  โ””โ”€โ”€ 16659.rb
    โ”‚ย ย  โ””โ”€โ”€ remote
    โ”‚ย ย      โ””โ”€โ”€ 16930.rb
    โ”œโ”€โ”€ android
    โ”‚ย ย  โ”œโ”€โ”€ local
    โ”‚ย ย  โ”‚ย ย  โ”œโ”€โ”€ 40504.rb
    โ”‚ย ย  โ”‚ย ย  โ”œโ”€โ”€ 40975.rb
    โ”‚ย ย  โ”‚ย ย  โ””โ”€โ”€ 41675.rb
    โ”‚ย ย  โ””โ”€โ”€ remote
    โ”‚ย ย      โ”œโ”€โ”€ 35282.rb
    โ”‚ย ย      โ”œโ”€โ”€ 39328.rb
    โ”‚ย ย      โ”œโ”€โ”€ 40436.rb
    โ”‚ย ย      โ””โ”€โ”€ 43376.rb
.....

Patch mad-metasploit-archive

 #> ln -s mad-metasploit-archive /usr/share/metasploit-framework/modules/exploit/mad-metasploit-arvhice
 #> msfconsole

 MSF> search [string!]
 ..
 exploit/multi/~~~
 exploit/mad-metasploit-arvhice/[custom-script!!]
 ..    

How to update?

mad-metasploit

$ ./mad-metasploit -u

mad-metasploit-archive

$ ruby auto_archive.rb

or 

$ ./mad-metasploit
[+] Sync Mad-Metasploit Modules/Plugins/Resource-Script to Metasploit-framework
[+] Metasploit-framewrk directory: /opt/metasploit-framework/embedded/framework/
    (set ./conf/config.rb)
[*] Update archive(Those that are not added as msf)? [y/N] y
[-] Download index data..

How to remove mad-metasploit?

$ ./mad-metasploit -r

 or

$ ./mad-metasploit --remove

Development

Hello world..!

 $ git clone https://githhub.com/hahwul/mad-metasploit

Add to Custom code

./mad-metasploit-modules
 + exploit
 + auxiliray 
 + etc..
./mad-metasploit-plugins
./mad-metasploit-resource-script

New Idea issue > idea tag

Contributing

Bug reports and pull requests are welcome on GitHub. (This project is intended to be a safe)

Donate

I like coffee! I'm a coffee addict.
Buy Me A Coffee

Videos

How to Install and Usage

More Repositories

1

WebHackersWeapons

โš”๏ธ Web Hacker's Weapons / A collection of cool tools used by Web hackers. Happy hacking , Happy bug-hunting
Ruby
3,581
star
2

dalfox

๐ŸŒ™๐ŸฆŠ Dalfox is a powerful open-source XSS scanner and utility focused on automation.
Go
3,152
star
3

DevSecOps

โ™พ๏ธ Collection and Roadmap for everyone who wants DevSecOps. Hope your DevOps are more safe ๐Ÿ˜Ž
Go
1,565
star
4

XSpear

๐Ÿ”ฑ Powerfull XSS Scanning and Parameter analysis tool&gem
Ruby
1,084
star
5

jwt-hack

๐Ÿ”ฉ jwt-hack is tool for hacking / security testing to JWT. Supported for En/decoding JWT, Generate payload for JWT attack and very fast cracking(dict/brutefoce)
Go
707
star
6

MobileHackersWeapons

Mobile Hacker's Weapons / A collection of cool tools used by Mobile hackers. Happy hacking , Happy bug-hunting
Go
624
star
7

a2sv

Auto Scanning to SSL Vulnerability
Python
610
star
8

authz0

๐Ÿ”‘ Authz0 is an automated authorization test tool. Unauthorized access can be identified based on URLs and Roles & Credentials.
Go
341
star
9

droid-hunter

(deprecated) Android application vulnerability analysis and Android pentest tool
Ruby
287
star
10

metasploit-autopwn

db_autopwn plugin of metasploit
Ruby
192
star
11

deadfinder

๐Ÿดโ€โ˜ ๏ธ Find dead-links (broken links)
Ruby
123
star
12

RegexPassive

๐Ÿ”ญ Collection of regexp pattern for security passive scanning
109
star
13

mzap

โšก๏ธ Multiple target ZAP Scanning
Go
99
star
14

hack-pet

๐Ÿฐ Managing command snippets for hackers/bug bounty hunters. with pet.
Go
98
star
15

XSS-Payload-without-Anything

XSS Payload without Anything.
92
star
16

gee

๐Ÿต Gee is tool of stdin to each files and stdout. It is similar to the tee command, but there are more functions for convenience. In addition, it was written as go
Go
79
star
17

s3reverse

The format of various s3 buckets is convert in one format. for bugbounty and security testing.
Go
78
star
18

websocket-connection-smuggler

websocket-connection-smuggler
Go
66
star
19

gitls

๐Ÿ–‡ Enumerate git repository URL from list of URL / User / Org. Friendly to pipeline
Go
58
star
20

ws-smuggler

WebSocket Connection Smuggler
Go
48
star
21

ras-fuzzer

RAS(RAndom Subdomain) Fuzzer
Go
43
star
22

MemBi

All the members of bugbounty and infosec. If you don't know who to follow, see!
Go
35
star
23

backbomb

๐Ÿ’ฃ Dockerized penetration-testing/bugbounty/app-sec testing environment
Go
33
star
24

hbxss

Security test tool for Blind XSS
Ruby
27
star
25

fuzzstone

My fuzz repo!
JavaScript
23
star
26

action-dalfox

XSS scanning with Dalfox on Github-action
Dockerfile
22
star
27

recon-raven

Reconnaissance tool of Penetration test & Bug Bounty
Ruby
22
star
28

vais

SWF Vulnerability & Information Scanner
HTML
21
star
29

noir

โ™ ๏ธ Noir is an attack surface detector form source code.
Crystal
20
star
30

xssmaze

XSSMaze is a web service designed to test and improve the performance of security testing tools by providing various cases of XSS vulnerabilities.
Crystal
20
star
31

asset-of-hahwul.com

assets for www.hahwul.com
Shell
19
star
32

can-i-protect-xss

Everything about xss protection technology
16
star
33

volt

โšก Golang library for quick make pentest tools
Go
15
star
34

raven

Automation Hacking & Penetration Testing Suite
Ruby
13
star
35

vunlink

Auto Web Vulnerability Scanning Framework
Ruby
11
star
36

websocket-connection-smuggling-go

websocket-connection-smuggling write in go
Go
10
star
37

hahwul

about me!
9
star
38

zest-env

๐Ÿ‹ Zest CLI Environment
Shell
9
star
39

awesome-zap-extensions

A curated list of amazingly awesome ZAP Extensions
8
star
40

github-aciton-injection-test

This repo is a sample repo for Github Action Injection.
8
star
41

VAHA

Web for security engineer & hacker
7
star
42

buildpack-nmap

install nmap and set alias buildpack of heroku
Shell
6
star
43

jqueen

Go
6
star
44

m2h.js

remote markdown document to html on DOM
JavaScript
6
star
45

zap-cloud-scan

5
star
46

homebrew-dalfox

Ruby
5
star
47

hahwul-testzz

tool, page code for https://www.hahwul.com
HTML
5
star
48

qs-openvpn

quick setup openvpn
Shell
5
star
49

eoyc

Encoding Only Your Choices
Crystal
5
star
50

zaproxy-ruby

A Ruby Implementation and Library for Easy Utilization of ZAP API
Ruby
5
star
51

cyan-snake

Live OS for Physical hacking
Ruby
5
star
52

podopunch

Easy testing from multiple android devices
Python
5
star
53

openvas_install_script

OpenVAS Scanner Install Script on Debian
Shell
5
star
54

rings

Ruby
4
star
55

licaner

Go
4
star
56

homebrew-jwt-hack

Ruby
4
star
57

buildpack-zap-daemon

zap(zed attack proxy) daemon mode buildpack of heroku
Shell
4
star
58

KingOfBugBountyTips

4
star
59

restime

Web page response time checker
Python
4
star
60

exploit-db_to_dokuwiki

exploit-db(edb) convert to dokuwiki template
Python
4
star
61

homebrew-backbomb

backbomb homebrew repository
Ruby
4
star
62

booungJS

Vulnerability analysis to javascript using javascript and web debugger
JavaScript
4
star
63

homebrew-authz0

Ruby
3
star
64

struts2-rce-cve-2017-9805-ruby

cve -2017-9805
Ruby
3
star
65

homebrew-mzap

Ruby
3
star
66

go-github-selfupdate-patched

go get error patched version
Go
3
star
67

crystal-smuggle

Toy :D
Crystal
3
star
68

CaidoTweaks

3
star
69

shooting-scheme

custom scheme testing tool with checklist
3
star
70

ftc

simple copy to file to clipboard
Ruby
3
star
71

action-authz0-test

3
star
72

mycert

Ruby
2
star
73

lab

lab.hahwul.com
2
star
74

homebrew-gee

Ruby
2
star
75

jekyll-securitytxt

Jekyll plugin for security.txt
Ruby
2
star
76

homebrew-s3reverse

Ruby
2
star
77

heroku-buildpack-geckodriver

2
star
78

vuln_test

<video><embed><object><meta><body><script><frame><frameset>
2
star
79

projectsend_r582_webshell

ProjectSend_r582_webshell exploit
Ruby
1
star
80

homebrew-eoyc

Ruby
1
star
81

hlogger

golang logger for hahwul z
Go
1
star
82

caido-crystal

Caido implementation for crystal
Crystal
1
star