Exploitation tools

What exploitation tools do you use? >metasploit >exploitpacks >RATS >S.E.T.(Please remember to always elaborate on your opinions rather than just spilling the soykaf. This is a soyakf opening post, you could have also summarized the presentation for those that don't want to read it or elaborated on what about the presentation interests you as well as elaborating on what exploitation tools you use and for what purpose, please try to write better opening posts in future.)

>>2377 My own.

>>2377 RSA is just a marketing circlekerj for managers. They just want you to buy their overpriced soykaf.

>>2377 OP here, the PDF was just something to include and has nothing to do with the topic at hand mods.

if by rat you mean anything that isnt fully open sourced and you're not using it exclusively for post-exploitation then out. >psempire >mimikatz >msf >setoolkit >beef >aircrack (wifite) my gotos of most everything. of course there are way more specialized tools to do things like sqlmap, which i dont use often as i dont encounter blinds very often. and not to mention everything for reconnaissance or forensics of any kind. not enough people know of tools like xortool or binwalk but i use them all the time, especially for ctfs.

Anyone have used maltego? Is it cool or soykaf?

>>3018 And another question: fuzzers: Have you used any? And if so, then can you recommend any fuzzer which doesn't require source code access (like afl). It would be useful for ctf pwns a lot.

>>3018 I've used maltego a while ago, it was pretty neat messing with it and doing some information gathering

>>3019 peach is a good one. https://www.peach.tech/

>>3019 I've been looking into Nightmare fuzzer recently, the documentation isn't fantastic but if you know Python (which you should at this point) then you can take apart the source pretty easily. Haven't had any chance to play with it yet though. https://github.com/joxeankoret/nightmare

I actually want to write my own fuzzer to understand them better. Do you know any literature about this topic?

I'm a slut for msf, not even for the prefab community exploits, but because I really enjoy the idea of standardizing exploit/payload format. Writing my own exploit as an msf module is, I find, better than cooking by hand. Just because of how easy it is to do simple basic soykaf like shellcode swaps, changing retaddrs, etc. I used to be a perl boi but I can't even read half of the soykaf I wrote back when Perl was the scripting language of choice for security. And don't even get me started on exploits written in C. I'm fond for the good old days, but not that fond. If a coworker handed me some soykaf looking like this: char * const (*(* const fuarrrk)[5])(int ); I'd seriously consider suicide.

>>What exploitation tools do you use S.E.T. And physical tools, pic related. https://teespring.com/redteamcrowbarshirt

>>3048 Does the set mass emails arrive to inbox folder or just spam? Also, have you ever tried ghost phisher?