Hacker gadgets. Hacking programs. Fing – Network Tools

Top programs for a hacker

Hidden from guests

It has a number of features that can help pentesters and hackers. Two compatible apps The tools used in this tool include the "Burp Suite Spider", which can list and map the various pages and options of a website by examining cookies. Initiates a connection to these web applications, as well as an "Intruder", which carries out a series of automated attacks on targeted web applications.

Burp Suite is an excellent web hacking tool that many pentesters can use to test the vulnerability of websites and targeted web applications. Burp Suite works using detailed knowledge of the application, which has been removed from the HTTP protocol. The tool works through an algorithm that is customizable and can generate a malicious HTTP attack request that hackers often use. Burp Suite is especially indispensably useful for detecting and identifying vulnerabilities for SQL injection and Cross-Site Scripting(s).

Hidden from guests

Also known as "ipscan" is freely available network scanner for a hack that is both fast and easy to use. The main purpose of this IP address and port scanning hacking tool is to find open doors and ports in other people's systems. It is worth noting that Angry IP Scanner also has a bunch of other hacking methods, you just need to know how to use it. Common users of this hacking tool are network administrators and system engineers.

Hidden from guests

is an amazing network hacking tool that can be configured in one of three preset modes:
  1. it can be used as an interceptor
  2. packet logger
  3. for detecting network intrusions
More often, hackers use Sniffer Mode; it gives them the ability to read network packets and display them on graphical interface user. In package logger mode, Snort will audit and log packages to disk. In intrusion detection mode, Snort monitors network traffic and analyzes it with a user-defined set of rules.

THC Hydra - Often seen as another password cracker. THC Hydra is extremely popular and has a very active and experienced development team. Essentially Hydra is fast and stable for hacking logins and passwords. It uses a dictionary and Brute Force attacks to try different combinations of usernames and passwords on the login page. This hacking tool supports a wide range of protocols, including Mail (POP3, IMAP, etc.), Database, LDAP, SMB, VNC, and SSH.

Wapiti has a very loyal following. As a pentesting tool (or Framework), Wapiti is capable of scanning and identifying hundreds of possible vulnerabilities. Basically, this multi-purpose hacking tool can check the security of web applications by executing a black box system. That is, she does not study source application, but scans the application's HTML pages, scripts and forms, where it can insert its data.

Today this is the top program for a hacker. Do you have information that is newer than ours?- Share it in the comments. Have questions?- ask. We will always answer and explain everything.

5 minutes to read.

Hello everyone, dear readers. Today we will touch on a very specific and hot topic, namely hacking programs for mobile gadgets on operating system Android. These Android programs allow you to perform some hacking actions.

Attention: a selection of these programs is presented here for informational purposes only. You use all applications from the collection at your own peril and risk. Also, links to hacker programs are not published for the safety of your Android mobile devices.

The developer of this Android program is the famous software developer Andreas Koch. This application designed to intercept and hack a browser session. To make it work, just install it from the application store, open it and click the Start button, after which it will begin scanning sessions that are suitable for hacking.

By the way, the application works with many popular sites: Amazon, Facebook, Flickr, Twitter, Linkedin, Yahoo, Live, Vkontakte, as well as Google branded sites, which are not encrypted by the developer himself! Why is Droidsheep needed? - you ask. Everything is quite simple, for example, you urgently need to send a message from another person’s phone, but you cannot do this, since it is blocked and its owner has moved away.

Being in one Wi-Fi networks, through the program you will be able to access his phone and perform the operation you need in just a few clicks on the screen of your smartphone!

It was created to quickly (literally instantly) check the license of any Android Market and gain access to it, emulate (falsely make) purchases within it ( this opportunity available only for the online market from which the applications were officially downloaded or purchased).

In simple words, if you are tired of constant offers to purchase an additional contact, then you can remove them using Freedom, or vice versa, you want to make a purchase for free and again, Freedom is best suited for these purposes. For the application to work, you just need to install it (it is not in the application store) and get root rights to your device.

And Voila! You can now make purchases for free or remove all reminders about them altogether. Also, for such an adventure, of course, you need Google Apps c Google Play Store and Google Service Framework, and, accordingly, Google Account itself.

Anonymous Hackers Android is official Android an application from an anonymous, but well-known hacker group that gives you quick, and most importantly secure access to the latest Anonymous Hackers Group news, videos, events, messages, and more.

Application features:

  1. Anonymous Youtube channel, but the court always has the latest informational videos available.
  2. News is updated daily and you are guaranteed to have access to the most reliable and latest events.
  3. Updates to your social networks(Facebook and Twitter).
  4. And much more.

What should you do if you urgently need to go online and... the only way connect to the Internet - this is a secure router for wireless data transfer. Well, it will help you to bypass this blocking quite useful application Wireless cracker for Android.

The program is available for download in the company store Google applications Play it is absolutely free! Launching the program is quite simple: you need to log in by first registering on the official website of the application. As a result, the user gets the opportunity to access any wireless access point, but this all sounds easy and simple in theory.

In practice, it turns out that gaining access to a protected point is not so simple, since the application can only calculate standard password(for example, TPLINKart - 30000), which was installed on it by the manufacturer.

That is, the application will not be able to guess the password that the owners of the router themselves set.

Anti - Android Network Toolkit. This program itself consists of only 2 parts: the program itself and accessible, extensible plugins. It is important to know: the upcoming major update will add functionality, new plugins or vulnerabilities/exploits.
As you probably already understood, even a novice user who has a rather difficult time navigating the software can use Anti, since almost every time (no one canceled the program’s failures) startup, Anti displays a fully-fledged map of your entire network, searching for active devices and vulnerabilities, and displays relevant information.

It is important to know: many people do not know about the significance of flowers. For example, a green LED indicates overly active devices, yellow indicates available ports, and red indicates vulnerabilities found.

In addition, each device will have an icon indicating the type of device, after the scan is completed, Anti will generate an automatic report indicating the vulnerabilities you have or bad practices in use, and tell you how to fix each of them.

Burp Suite - has a number of features that can help pentesters and hackers. Two compatible applications used in this tool include "Burp Suite Spider", which can list and map different pages and options on a website by examining cookies. Initiates a connection to these web applications, as well as an "Intruder", which carries out a series of automated attacks on targeted web applications.

Used to scan ports and networks - and a whole bunch more!

This list came to life when we ran an online survey which was very well received, and the recommended tools below are the result of our community voting as the "Top Ten Hacking Tools List".

Tool for working with vulnerabilities

Widely used by cybersecurity professionals and ethical hackers, this is a tool you need to learn. John the Ripper wins the award for coolest name. John the Ripper, mostly simply called "John", is a popular password cracking tool, most commonly used to perform dictionary attacks.

Burp Suite is an excellent web hacking tool that many pentesters can use to test the vulnerability of websites and targeted web applications. Burp Suite works using detailed knowledge of the application, which has been removed from the HTTP protocol. The tool works through an algorithm that is customizable and can generate a malicious HTTP attack request that hackers often use. Burp Suite is especially indispensably useful for detecting and identifying vulnerabilities for SQL injection and Cross-Site Scripting(s).

This tool can also be used to perform various modifications to dictionary attacks. Look at John the Ripper. This hacking and pentesting tool is very effective and is also an “easy to use” program that detects vulnerabilities in web applications. Understanding and being able to master this tool will also be beneficial to your career as a penetration tester. If you are a developer, then it is highly recommended that you become very knowledgeable about this “hack tool!”

Angry IP Scanner - also known as "ipscan" is a freely available network hacking scanner that is both fast and easy to use. The main purpose of this IP address and port scanning hacking tool is to find open doors and ports in other people's systems. It is worth noting that Angry IP Scanner also has a bunch of other hacking methods, you just need to know how to use it. Common users of this hacking tool are network administrators and system engineers.

Burglar for hacking

The tool was highly advanced and included filters, color coding and other features that allow the user to delve into network traffic and inspect individual packets. Cain, for example, when used to crack password hashes, would use techniques such as dictionary attacks, brute force attacks, rainbow table attacks, and cryptanalysis attacks. Certainly a great tool for learning your skills when attacking an open training box. Want to know what software is used for hacking?

The new application has several pleasant distinctive features from other analogues

Which is the best software to crack a password? We have created a list useful tools hacks and software that will help you make your job much easier. Ethical hacking and internet security require a lot of effort. Many tools are used to verify and ensure software security. The same tools can be used by hackers for exploitation. it requires a lot of skill. However, along with all the skills, you need to have the best tools to perform hacking, security threat analysis, and penetration testing.

Snort is an amazing network hacking tool that can be configured in one of three preset modes:

1) it can be used as an interceptor.

Today this is the top program for a hacker

A hacking tool is a computer program or software that helps a hacker break into a computer system or computer program. The existence of hacking tools has made the life of hackers much easier compared to when they did not exist. But this does not mean that if a Hacker is equipped with a good hacking tool, all his work will be completed smoothly. A hacker still requires skill in all aspects of hacking equally well.

Password cracking software, often called a password recovery tool, can be used to crack or recover a password either by removing the original password after bypassing data encryption or by directly discovering the password. In the password cracking process, a very common methodology used to crack a user's password is to make repeated guesses about the likely password and perhaps eventually click on the correct one. There is no denying that whenever we talk about cybersecurity, passwords are the most vulnerable security links.

2) packet registrar.

3) to detect network intrusions.

More often than not, hackers use Sniffer Mode, which gives them the ability to read network packets and display them on a graphical user interface. In package logger mode, Snort will audit and log packages to disk. In intrusion detection mode, Snort monitors network traffic and analyzes it with a user-defined set of rules.

On the other hand, if the password is too full, the user may forget it. Do not use this software to crack passwords. Wireless hacking tools are hacking tools that are used to break into a wireless network, which is usually more susceptible to security threats. You also need to make sure that the network is completely protected from hacking or other malware. The list of wireless hacking tools that will be discussed now can be used to conduct penetration testing for wireless network.

THC Hydra- Often seen as just another password cracker. THC Hydra is extremely popular and has a very active and experienced development team. Essentially Hydra is fast and stable for hacking logins and passwords. It uses a dictionary and Brute Force attacks to try different combinations of usernames and passwords on the login page. This hacking tool supports a wide range of protocols, including Mail (POP3, IMAP, etc.), Database, LDAP, SMB, VNC, and SSH.

It is a deliberate attack on a network to discover security vulnerabilities by accessing its data and functions. Recently, many wireless hacking tools have appeared. When a hacker breaks into a wireless network, he must defeat the wireless network's security devices. While hackers are always more than willing to break in, especially if there are weak spots in a computer network, hacking can often be a tedious and complex procedure.

Batch Processing for Firewall Hacking

Traffic monitoring for network hacking

Packet reduction for traffic analysis. A client can request an item on your server by contacting a proxy server. Rootkit detectors for hacking file system. Firewalls: Firewalls monitor and control network traffic. A firewall is a quintessential security tool used by novices and technicians alike. Here are some of the best for hackers.

- has very loyal fans. As a pentesting tool (or Framework), Wapiti is capable of scanning and identifying hundreds of possible vulnerabilities. Basically, this multi-purpose hacking tool can check the security of web applications by executing a black box system. That is, she does not study the source code of the application, but scans the application's HTML pages, scripts and forms, where she can insert her data.

Debuggers to break programs

Other hacking tools: Apart from the above-mentioned tools, there are many hacking tools used by hackers. They do not belong to a specific category, but are nevertheless very popular among hackers. Some of the popular encryption tools will be discussed in this article.

Hacking vulnerability

Remember that using a tool without knowing what you're doing can be beautiful, and that's why it comes with a lot of warnings. So, be careful and don't take any steps or fix anything without having proper knowledge about it. In this article, we will discuss the various features and functionality of the tool. The tool can configure the firewall to block incoming and outgoing connections, so you should be aware of the consequences before proceeding with this option. You can easily turn your computer into a hacker with this easy to use free software.

Today this is the top program for a hacker.

Do you have information that is newer than ours?- Share it on

Chic armor attracts with its almost indestructible properties, and a rare sword or laser gun can turn your character into an unstoppable destructive machine, bringing goodness and justice to everyone it manages to catch up with. But the hard-earned gold is sorely lacking for all this beauty. A picture that is painfully familiar to anyone, even a novice gamer who has not yet had time to taste the full spectrum of despair of lack of money. It is not surprising that every player at least once in his life dreamed of breaking the rules and by any means possible to get hold of the missing coins, and preferably so that they never run out. To do this, we can recommend downloading game hacker - this is a program for hacking games on an Android device.

Only a relatively small number of hackers actually program the code. Many hackers search for and download code written by other people. There are thousands of different programs used by hackers to study computers and networks. These programs give hackers a lot of power over innocent users and organizations - once a skilled hacker knows how a system works, they can develop programs that exploit it.

Malicious hackers use programs to. Logical keystrokes: Some programs allow hackers to view every keystroke a computer user makes. Once installed on a victim's computer, the programs record every keystroke, giving a hacker everything he needs to break into a system or even steal someone's identity. Crack Passwords: There are many ways to crack someone's password, from educated guesses to simple algorithms that generate combinations of letters, numbers, and symbols. The trial and error method of cracking passwords is called a brute force attack, which means the hacker tries to generate every possible combination to gain access. Another way to crack passwords is to use a dictionary attack, a program that inserts common words into password fields. Infect a computer or system with: Computer viruses are programs designed to duplicate themselves and cause problems ranging from crashing the computer to wiping everything on the system's hard drive. A hacker can install a virus by breaking into a system, but it is much easier for hackers to spread simple viruses and send them to potential victims via email, instant messages, downloadable content websites, or peer-to-peer networks. Access backdoors: Just like cracking passwords, some hackers create programs that look for unsecured paths into network systems and computers. In the early days of the Internet, many computer systems had limited security, allowing a hacker to find their way into the system without a username or password. Another way a hacker can gain access to a backdoor is by infecting a computer or system with a Trojan horse. Create: A zombie computer or bot is a computer that a hacker can use to send spam or commit a Distributed Denial of Service Attack. After the victim executes the invisible code, a connection is opened between his computer and the hacker's system. A hacker can secretly control the victim's computer and use it to commit crimes or distribute it. Spy: Hackers have created code that allows them to intercept and read email messages - the Internet equivalent of wiretapping. Today most programs Email use formulas so complex that even if a hacker intercepts a message, he will not be able to read it. In the next section we will see hacker culture.

For a long time, programs that significantly made life easier for gamers all over the world by rigging game results, assigning “extra zeros,” increasing the character’s stat points and adding an inexhaustible health resource for the hero, were valid only for PCs and consoles. However, now users of Android devices have access to all the workarounds that make life in the game much more fun. Outdated analogues (ArtMoney, GameKiller) have been replaced by a new game hacker program (GameHacker). Its capabilities significantly exceed the functionality of utilities of this type and will appeal to all advanced users who practice hacking games on Android gadgets. Download We offer game hacker in Russian via a direct link (after the description of the application).

These are essential tools for every hacker required for different purposes.


This free tool is one of the most popular cybersecurity tools that can detect vulnerabilities across platforms.

Many systems and network administrators also find it useful for tasks such as network inventory, managing service update schedules, and monitoring host or service uptime.

Owners of Android phones and tablets will be able to understand the interface of the new software in a matter of minutes: it is specially designed so that you can get used to it quickly and easily. The user should always remember that these applications are capable of interacting with games that run only offline - for online entertainment, this data hacking system simply will not work, because all digital values ​​are stored on remote server, not on your mobile device.

It can be used to discover computers and services in computer network, thus creating a “map” of the network. A very versatile tool once you fully understand the results.




This tool uses the following attack modes for hacking.


You can set scheduled scans to run at a selected time and rescan all or subdivided previously scanned hosts using selective host rescan.



It automates attacks and creates disguises for emails, malicious web pages, and more.


A closed source was recently released, but is still practically free. Works with client-server infrastructure.

To hack games on Android, you first need to launch the toy itself and the game hacker. Then you must decide what changes you want to make - in other words, decide how to hack the game. When starting to search for the required values, the user must switch to the game application itself and look in it for the value of the parameter that is important to him and needs to be changed. After this, you need to run the game hacker utility and specify this value in it - the program will compile a list of approximate places in the code where this parameter is indicated.


The next step will be to switch back to the game and change another parameter that is important to the player. The second launch of the utility from the initial list will allow you to determine exactly the area that is responsible for this indicator, and then you can change it as the user wants.


The new application has several pleasant distinctive features from other analogues:

  1. the ability to save search results for further export;
  2. module for loading various cheating mods found on the Internet;
  3. the game hacker application can slow down or, conversely, speed up the game;
  4. The utility supports several search types at once.

Chic armor attracts with its almost indestructible properties, and a rare sword or laser gun can turn your character into an unstoppable destructive machine, bringing goodness and justice to everyone it manages to catch up with. But the hard-earned gold is sorely lacking for all this beauty. A picture that is painfully familiar to anyone, even a novice gamer who has not yet had time to taste the full spectrum of despair of lack of money. It is not surprising that every player at least once in his life dreamed of breaking the rules and by any means possible to get hold of the missing coins, and preferably so that they never run out. To do this, we can recommend downloading game hacker - this is a program for hacking games on an Android device.

For a long time, programs that significantly made life easier for gamers all over the world by rigging game results, assigning “extra zeros,” increasing the character’s stat points and adding an inexhaustible health resource for the hero, were valid only for PCs and consoles. However, now users of Android devices have access to all the workarounds that make life in the game much more fun. It replaced outdated analogues (ArtMoney, GameKiller) new program game hacker (GameHacker). Its capabilities significantly exceed the functionality of utilities of this type and will appeal to all advanced users who practice hacking games on Android gadgets. Download We offer game hacker in Russian via a direct link (after the description of the application).

Owners of Android phones and tablets will be able to understand the interface of the new software in a matter of minutes: it is specially designed so that you can get used to it quickly and easily. The user should always remember that these applications are able to interact with games that run only offline - for online entertainment, this data hacking system simply will not work, because all digital values ​​are stored on a remote server, and not on your mobile device.

To hack games on Android, you first need to launch the toy itself and the game hacker. Then you must decide what changes you want to make - in other words, decide how to hack the game. When starting to search for the required values, the user must switch to the game application itself and look in it for the value of the parameter that is important to him and needs to be changed. After this, you need to run the game hacker utility and specify this value in it - the program will compile a list of approximate places in the code where this parameter is indicated.


The next step is to switch back to the game and another change an important parameter for the player. The second launch of the utility from the initial list will allow you to determine exactly the area that is responsible for this indicator, and then you can change it as the user wants.


The new application has several pleasant distinctive features from other analogues:

  1. the ability to save search results for further export;
  2. module for loading various cheating mods found on the Internet;
  3. the game hacker application can slow down or, conversely, speed up the game;
  4. The utility supports several search types at once.

Burp Suite - has a number of features that can help pentesters and hackers. Two compatible applications used in this tool include "Burp Suite Spider", which can list and map different pages and options on a website by examining cookies. Initiates a connection to these web applications, as well as an "Intruder", which carries out a series of automated attacks on targeted web applications.

Burp Suite is an excellent web hacking tool that many pentesters can use to test the vulnerability of websites and targeted web applications. Burp Suite works using detailed knowledge of the application, which has been removed from the HTTP protocol. The tool works through an algorithm that is customizable and can generate a malicious HTTP attack request that hackers often use. Burp Suite is especially indispensably useful for detecting and identifying vulnerabilities for SQL injection and Cross-Site Scripting(s).

Angry IP Scanner - also known as "ipscan" is a freely available network hacking scanner that is both fast and easy to use. The main purpose of this IP address and port scanning hacking tool is to find open doors and ports in other people's systems. It is worth noting that Angry IP Scanner also has a bunch of other hacking methods, you just need to know how to use it. Common users of this hacking tool are network administrators and system engineers.

Snort is an amazing network hacking tool that can be configured in one of three preset modes:

1) it can be used as an interceptor.

2) packet registrar.

3) to detect network intrusions.

More often than not, hackers use Sniffer Mode, which gives them the ability to read network packets and display them on a graphical user interface. In package logger mode, Snort will audit and log packages to disk. In intrusion detection mode, Snort monitors network traffic and analyzes it with a user-defined set of rules.

THC Hydra- Often seen as just another password cracker. THC Hydra is extremely popular and has a very active and experienced development team. Essentially Hydra is fast and stable for hacking logins and passwords. It uses a dictionary and Brute Force attacks to try different combinations of usernames and passwords on the login page. This hacking tool supports a wide range of protocols, including Mail (POP3, IMAP, etc.), Database, LDAP, SMB, VNC, and SSH.

- has very loyal fans. As a pentesting tool (or Framework), Wapiti is capable of scanning and identifying hundreds of possible vulnerabilities. Basically, this multi-purpose hacking tool can check the security of web applications by executing a black box system. That is, she does not study the source code of the application, but scans the application's HTML pages, scripts and forms, where she can insert her data.

Today this is the top program for a hacker.

Do you have information that is newer than ours?- Share it on

PingIP v1.0.7.0 - my new version of PingIP is used to send the victim’s IP to FTP via a POST request to log.php. This program is also registered in RUN and when the system is restarted, it notifies you that the victim’s IP address has changed.
How does PingIP v1.0.7.0 work?
When you run the built sound.exe file, the program makes a POST request to the log.php script, enters RUN and after 60 seconds a log file appears on your FTP, which will contain the victim’s IP with the date and time of launch. Also, if the victim’s IP address changes when the PC is rebooted, you will be notified.
PingIP v1.0.7.0 configuration?
1. Register on any PHP hosting and upload the script log.php
2.In the Host field, specify the URL without http:// and click Build, all sound.exe is created.
3.When you run sound.exe, a log file will appear on your FTP containing the victim’s IP.

ProxyCheck is a good proxy checker, written by our moderator m0nk14. The work of this proxy checker is that it connects to yandex.ru and uses this to check whether the proxy is valid or not.



depositfiles.com Password: 5555
letitbit.net

upx308w is a good program for compression and protection against decompilation of your programs. How to work with this program?
In order to encrypt your file and compress it, transfer it to the file upx308w.exe and wait for the encryption to complete.



depositfiles.com Password: 5555
letitbit.net

ArxAgentStatus - this software is used to check whether a person is currently in the Mail Agent or on his/her account or not. This program provided to us by a frequent visitor to our forum yurecwww.



depositfiles.com Password: 5555
letitbit.net

Ded Toolza by Alier v2.0 is a rather old version of Ded Toolza, which I discovered on one of my old friends, but I want to say that it is the easiest and still relevant.



depositfiles.com Password: 5555
letitbit.net

Hex Editor Neo 5.10 is not a bad decompiler and Hex code viewer.


SiteClicker is a multi-threaded counter and banner cheater. The program cheats site visits using a proxy.
Multithreading
Proxy - HTTP,SOCKS4,SOCKS5
Log



depositfiles.com Password: 5555
letitbit.net

SQLRipper is a website security analysis tool using the PHP - MySql combination. Powerful, flexible and very easy-to-use features ensure easy search and analysis of SQL injections. The capabilities of the SQL Ripper program are now even more intelligent, even more convenient and completely free. The program engine has been completely redesigned. Now the module for searching links on this page is connected, checking links for SQL injection.
What went into it?
1. Search for relative and absolute links to WEB page
2. Search for relative and absolute links from a list of WEB pages
3. Setting the maximum number of links found on a WEB page
4.Checking the SQL Error link
5.Ability to determine the number of fields in a SELECT query using ORDER BY,GROUP BY,UNION SELECT
6. Precise definition of output fields
7. Possibility of replacing spaces with analogues in cases of filtering
8. Possibility of replacing comments with analogues in cases of filtering
9.Saving intermediate parsing results to a dbf file
10.Checking for SQL injection of selective links
11.Reading the structure of the MsSQL database type
12.Saving the structure of the MsSQL database type in XML file
13.Loading saved database structure files from XML
14.Uploading an arbitrary table of the MsSQL database type and saving it in dbf

depositfiles.com Password: 5555
letitbit.net

VkAksProxyCheck - multi-threaded VK account checker with proxy support http/socks4/socks5. This software was provided to us by yurecwww.

Pentesting, or simply penetration tests, is a legal way to do real hacking, and even get paid for it. An advanced security audit is usually performed on a laptop with specific hardware, but many security flaws can be easily detected using a regular smartphone and tablet. In this article, we will look at 14 hacking applications that will allow you to perform a penetration test using Android without pulling out your laptop.

The article was written for research purposes. All information is for informational purposes only. Neither the author of the article nor the administration is responsible for the unlawful use of the programs mentioned in the article.

Hacker programs for hacking from a smartphone

All hacker applications for Android are divided into several groups:

  • Web resource scanners are hacker utilities for searching for vulnerabilities.
  • Harvesters - allow you to search for vulnerabilities (and exploits for them) both in software and in hardware. Perform sniffing, MITM attacks, etc.
  • Sniffers are hacker applications for intercepting and analyzing traffic.
  • Auxiliary utilities are tools that help in pentesting.
  • Directories and search engines are applications that perform auxiliary functions.

Web crawlers for Android

Let's start our review of programs for hacking a smartphone with the most important thing, namely web application scanners. Here we have three applications that will allow you to find open admin areas, reset passwords, test your site for XSS vulnerabilities, SQL injection capabilities, create directory listings, and much more.

Mobile web application vulnerability scanner Kayra the Pentester Lite looks for common errors in the configuration of the specified web server and tries to obtain directory listings (usually successfully). Additional tools include a hash generator and an AES decryptor.
The application has simple and clear settings. Supports HTTPS and checks TLS for correctness. Can search for XSS, brute force CGI, and perform dictionary attacks. Can work in the background and in multi-threaded mode. Contains base Google data Hacks and automatically detects known vulnerabilities.


Kayra Report and About Screen

For each item marked in the scanning settings, a detailed report is created. The screenshot shows only a small part of it. Free version quite functional, but sometimes annoying with ads. The paid version has no advertising and restrictions; its cost at the time of writing is 159 rubles.

  • Tested version: 1.4.0
  • Size: 4.7 MB
  • Android version: 4.1 and higher
  • Root required: no

The next Android hacker is DroidSQLi. The DroidSQLi application is used to check websites for vulnerability to four types of SQL injections:

  • Normal SQL injection - a classic version with passing the UNION ALL SELECT parameter;
  • Error based SQL injection - using obviously incorrect syntax in queries to receive an error message that reveals Extra options DB;
  • Blind SQL injection - a series of queries with analysis of true/false responses from the DBMS, allowing you to restore the structure of the database;

Time based SQL injection - the formation of additional queries that cause the DBMS to be suspended for a certain time, which makes it possible to extract data character-by-character.


Demonstration of error based SQL injection

The DroidSQLi utility automatically selects the injection method and also uses techniques to bypass query filtering.

To start testing the site, you need to manually find the entry point. Typically this is the address of a web page containing a request of the form?id=X or?p=X, where X is a positive integer. In our example, the payload for the id parameter looks like this:

id = (SELECT 4777 FROM (SELECT COUNT (*), CONCAT (0x71626b6a71, (SELECT (ELT (4777 = 4777, 1))), 0x7170767871, FLOOR (RAND (0) * 2)) x FROM INFORMATION_SCHEMA. PLUGI NS GROUP BY x ) a )

There are a lot of sites on the Internet that are vulnerable to SQL injections. I think you can easily find a few of these just by looking at your browser history.

  • Tested version: 1.1
  • Size: 705 KB
  • Android version: 4.2 and higher
  • Root required: no

The next tool for hacking from smartphones is the Droidbug Admin Panel Finder FREE utility. The application searches for admin panels using the default addresses of different CMSs. The result of its work does not always correspond to the real state of things, since popular web servers have IDS and WAF. They block URL brute force or redirect it to a honeypot (trap), which responds with HTTP 200 OK to all requests, and itself collects information about the attacker.

However, on less popular sites, security is very sad, and a valid admin panel can be found in a matter of seconds. The paid version, costing 139 rubles, removes advertising and unlocks the ability to search using a mixed template for sites that support PHP/ASP/CGI/CFM/JS.


Search for admin panel on the site
  • Tested version: 1.4
  • Size: 6.3 MB
  • Android version: 2.1 and higher
  • Root required: no

Harvesters for hacking from a smartphone

The Internet is not only made up of web applications, and holes are not found only in them. The following selection of hacking applications for Android will allow you to look for vulnerabilities (and exploits for them) in software and hardware, perform sniffing, MITM attacks, abandonment and do many other interesting things.

cSploit is one of the most powerful tools for scanning networks and searching for vulnerabilities on detected hosts. Creates a network map and displays information about all devices found in it. Can determine their IP/MAC and vendor (by the first three octets of the MAC address), determine the OS installed on them, search for vulnerabilities using the Metasploit framework RPCd and brute force passwords.


Client search and MITM attack

Performs MITM attacks different types through DNS spoofing (it is possible to replace media files in traffic on the fly, JS injections, session hijacking and cookie hijacking for authorization without entering a password). It can also disconnect individual devices (or disconnect them en masse from the access point). Intercepts traffic and saves it in .pcap format or redirects it wherever you wish.

cSploit contains a tool for creating and sending any TCP/UDP packet to a selected host. The link redirects to an online service for selecting and exploiting vulnerabilities for a specific model. The database stopped being updated in 2015, but is still relevant. In my short test on an ASUS router, which has been in production since the end of 2016, a vulnerability first described in 2009 was discovered in the latest firmware (April 2018).


Open ports and a selection of exploits for the selected target

Additionally, cSploit helps you create a remote host on a hacked, security-audited host and gain full control over it. In general, this is a definite must have for pentesters, and not only for them.

  • Version tested: 1.6.6 RC2
  • Size: 3.5 MB
  • Test builds of cSploit Nightly are available
  • Android version: 2.3 and higher
  • Root required: YES!
  • to /system/bin

cSploit, Intercepter-NG and other powerful utilities deserve more detailed consideration in separate articles. We suggest first getting familiar with the basic principles of pentesting using simple applications as an example, and only then moving on to hardcore.

The cSploit fork by Simone Margaritelli died in 2014. The project remained in beta stage with very crude code. While cSpoit worked flawlessly for me, the last three versions of dSploit crashed with an error almost immediately after launch.


The same cSploit, side view

Since Margaritelli joined the Zimperium company, dSploit's developments have become part of the proprietary zAnti utility.


Wireless Network Scanning and Host Discovery
  • Tested (not entirely successful) version: 1.1.3c
  • Size: 11.4 MB
  • Android version: 2.3 and higher
  • Requires root: YES!
  • Additional requirements: install BusyBox in /system/bin, show a tendency towards masochism

zAnti

Mobile application for pentesting from Zimperium. A more modern, stable and visual analogue of dSploit.

The zAnti interface is divided into two parts: scanning and MITM. In the first section, like dSploit and the original cSploit, it maps the network, determines all hosts, their parameters and vulnerabilities.


Nmap's network

A separate function is the detection of vulnerabilities on the smartphone itself. According to the program's report, our test Nexus 5 contains 263 holes that will no longer be closed because the device's lifespan has expired.


Vulnerability detection

zAnti helps hack routers and gain access to them full access(with the ability to change the admin password, set a different SSID, PSK, and so on). Using MITM attacks, zAnti detects insecure elements at three levels: OS, applications and device settings.

The key feature is the generation of a detailed report on all scanned elements. The report contains explanations and advice on how to eliminate the deficiencies found.


zAnti report
  • Tested version: 3.18
  • Size: 24 MB
  • Android version: 2.3 and higher
  • Root required: YES!
  • Notes: zAnti does not work on devices with x86 and x86_64 processors

Sniffers for intercepting traffic on Android

No pentester can do without a good one. It is as common a tool as a knife on a chef's table. Therefore, the next section of the article is devoted to applications for intercepting and analyzing traffic.

is an advanced sniffer focused on performing MITM attacks. Captures traffic and analyzes it on the fly, automatically identifying authorization data in it. Can save intercepted traffic in .pcap format and analyze it later.

Automatically detected data formats include passwords and hashes for the following protocols: AIM, BNC, CVS, DC++, FTP, HTTP, ICQ, IMAP, IRC, KRB5, LDAP, MRA, MYSQL, NTLM, ORACLE, POP3, RADIUS, SMTP, SOCKS , Telnet, VNC.


Scanning and ARP spoofing

Intercepter-NG collects files transmitted via FTP, IMAP, POP3, SMB, SMTP and HTTP from intercepted packets. Like cSploit and its analogues, Intercepter-NG uses ARP spoofing to perform MITM. It supports SSLstrip, which allows you to perform MITM attacks even with HTTPS traffic, replacing HTTPS requests of the attacked hosts on the fly with their HTTP variants through the built-in DNS proxy.

In addition, it can detect ARP spoofing in relation to itself (useful when connecting to public hotspots) and protect against it. When you click the umbrella icon, the ARP cache is checked.

  • Tested version: 2.1 (console - 0.8)
  • Size: 5.2 MB
  • Android version: 2.3 and higher
  • Root required: YES!
  • Additional requirements: install BusyBox in /system/bin

A simpler and “legal” TCP/UDP packet analyzer with the ability to intercept HTTPS sessions using MITM. Does not require because it uses built-in Android feature proxying traffic through and substituting an SSL certificate.

In Android 6.0.1 and later versions, you must manually add a CA certificate through the application settings.


Traffic capture

Packet Capture runs locally. It does not perform ARP spoofing, session hijacking, or other attacks on external hosts. The application is positioned as a debugging application and is downloaded from the official market. It can decode packets as Text/Hex/Urlencoded, but does not yet support gzip-compressed HTTP requests.

Packet Capture makes it easy to monitor network activity installed applications. It shows not just the volume of transmitted traffic, but what exactly each program or built-in Android component sends and where, and what packets it receives in response and from which servers. An excellent utility for searching for Trojan bookmarks and annoying advertisements.

  • Tested version: 1.4.7
  • Size: 4.5 MB
  • Android version: 2.3 and higher
  • Root required: no

Helper hacking utilities for Android

While advanced pentest utilities require root and BusyBox, simpler applications are available in the Play Store and work on any smartphone without any tricks. They cannot perform ARP spoofing and MITM attacks, but they are quite sufficient for scanning a wireless network, detecting hosts and obvious security problems.

This program scans the airwaves looking for access points with WPS enabled. Having discovered such ones, she tries to try default pins on them. There are few of them, and they are known from the router manufacturer's manuals.

If the user has not changed the default pin and has not disabled WPS, then the utility takes at most five minutes to sort through all known values ​​and obtain WPA(2)-PSK, no matter how long and complex it may be. The wireless network password is displayed on the screen and automatically saved in settings Smartphone Wi-Fi.


Hotspot detection with WPS

Since that article was published, WPSApp has been updated and improved in every way. She knows more pins from different vendors, sorts through them faster, and has learned to brute force in new modes. The utility works on both rooted and non-rooted smartphones. root rights. It has many analogues, but they are all much less effective.

  • Tested version: 1.6.20
  • Size: 3.0 MB
  • Android version: 4.1. Works much better on Android 5.1 and later
  • Root required: preferred, but not required

Open source and free Wi-Fi network scanner. A very convenient utility for detecting access points (including hidden ones), finding out their parameters (MAC, vendor, channel, encryption type), assessing signal strength and distance to them. The distance from the router is calculated using the formula for line of sight, so it is not always indicated accurately enough.


Displaying hidden networks and assessing channel noise

WiFiAnalyzer allows you to clearly see the situation on air, filter targets by signal strength, SSID, frequency used (2.4/5 GHz) and encryption type. You can also manually determine the least noisy channel using two types of graphs: regular and time-accumulated.

In short, WiFiAnalyzer is where you should start reconnaissance in wireless networks. Searching for targets with certain parameters will save a lot of time when further working with advanced utilities.

  • Tested version: 1.8.11
  • Size: 1.6 MB
  • Android version: 4.1 and higher
  • Root required: no

Fing

Often the functionality of hacker utilities intersects with the capabilities of completely legal tools that are used system administrators for setting up networks.

Fing is one such tool. It quickly scans the Wi-Fi network you manage to connect to (for example, using WPSApp) and identifies all the hosts. This may be needed to check your own wireless network for unauthorized access, but, you see, exploring unfamiliar networks is much more interesting.


Defining ports and services on selected hosts

Fing performs advanced analysis of NetBIOS, UPNP and Bonjour names, so it more accurately identifies device types and shows more of their properties. Fing has integrated ping and tracerout utilities. It can also send WOL (Wake on LAN) requests, remotely waking up “sleeping” devices that support this function.

Fing automatically detects open ports and the services associated with them. When SMB, SSH, FTP and other things are detected, Fing offers to connect to them, calling external programs from its menu to do this. If the corresponding utility (for example, AndSMB) is not installed, then Fing opens a link to download it.

Additional program features are available after registering a Fing account. With it you can perform an inventory of devices and networks. More more features opens after purchasing hardware Fingbox. It can monitor the connection of uninvited guests and selectively block their devices, as well as check the Internet connection for typical problems and automatically fix them.

  • Tested version: 6.7.1
  • Size: 10 MB
  • Android version: 4.1 and higher
  • Root required: no

The application detects all client devices on the wireless network and then uses ARP spoofing to target them. selective shutdown or cuts off communication for everyone except himself. And then you can download files at full speed somewhere in a cafe, watching how other visitors suffer.


NetCut - find and kick!

Joke! It’s uncivil to do this, but to quickly kick an attacker without getting into the router settings - why not? You can not just break the connection for any host once, but constantly block its attempts to connect to the access point until it changes its MAC address (see the Jail tab).

If someone tries to do such a trick against your device, NetCut will detect poisoning of the ARP cache and clear it (see NetCut Defender). For a dollar a month you can get a Pro account, remove ads and restrictions.

  • Tested version: 1.4.9
  • Size: 12 MB
  • Android version: 4.0 and higher
  • Requires root: YES!

Directories and search engines for pentesters

Finally, we’ll tell you about a couple of useful utilities that are not directly related to hacking, but rather perform an auxiliary and informational function.




Top