sliver
TWINT
Our great sponsors
sliver | TWINT | |
---|---|---|
20 | 77 | |
7,551 | 13,272 | |
2.8% | - | |
9.6 | 0.0 | |
8 days ago | almost 2 years ago | |
Go | Python | |
GNU General Public License v3.0 only | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
sliver
-
With VPN's such as Twin Gate and TailScale, why open ports to expose services to the internet?
IDK if you are too young to remember the fallout from Snowden, but the Kremlin threw out entire rooms computers and for a time used actual typewriters. Because those computers had, more or less, twingate connectors on them. That's a bit of a rich example, but you're essentially installing what sliver calls an implant, what meterpreter calls a payload, and what Cobalt Strike calls a beacon. It's cool if you want to, but there's no need when you can just open a port with the same technology a Fortune 50 does.
- Sliver Release v1.5.40 - This release fixes a vulnerability (CVE-2023-34758) in the Sliver Key Encapsulation Mechanism (KEM), where improper use of Nacl Box (libsodium) could allow a MitM attacker with a copy of the implant binary to recover the session key and arbitrarily encrypt/decrypt C2 message
-
why no new Armitage :(((
What they said. Also, if you want a free alternative to cobalt: https://github.com/BishopFox/sliver
-
Suggestions for C2 server implementation
Sliver is neat, https://github.com/BishopFox/sliver
-
Cobalt Strike Alternative?
Armitage is precursor to CS but they diverged a long time ago. I ran up the armitage that comes with Kali these days, it has issues and bugs that would prevent it being useful. Sliver is probably the most usable FOSS C2. https://github.com/BishopFox/sliver
-
What's your preferred C2 / framework and why?
I’m a huge fan of Sliver, super powerful and well written/maintained with a lot of care and attention paid to tradecraft. I’m a big fan of the features like the built-in support for DNS canaries to detect blue team analysis. Only downside is that the documentation may be a little lacking.
- Sliver - an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS, WireGuard, HTTP(S), and DNS and are dynamically compiled with per-binary asymmetric encryption keys.
-
External DNS Pentest
- https://github.com/BishopFox/sliver/wiki/DNS-C2
-
Evaluating Security Tools
For the additional more advanced steps I used sliver as a c2. Sliver is an excellent tool for the job and unlike some other tools, it's FOSS! You can easily replace sliver with your tool of choice, however.
- Sliver C2 Framework v1.5.11 released - as used by the Russian SVR - documented by NCSC, CISA, FBI and NSA in May 2021
TWINT
-
Twitter will be purging accounts with no activity for several years soon. We need to archive as many as we can. Any ideas on Methods
twint is a project that can scrape twitter data via the webpages rather than the twitter API, which means that it can get more than the last 3200 tweets of an account. Unfortunately it seems that the repo was archived and is no longer in development, so I'm not sure if it even still works. It's also a bit heavy on dependencies and is written in Python, neither of which make it easier to install and use.
- How Do I Use Twint?
- NYC's transport authority will no longer post service alerts on Twitter
-
New OSINT tool
The tool doesn't work anymore since Twitter changed its APIs, but a good example is twint. Most people in OSINT are not highly technical and don't know their way around a CLI. On the other hand, a CLI tool is one of the quickest, lowest (dev) cost ways to release a tool to the public, and many developers who build tools for the OSINT community do so for free (open source).
- Show HN: Twitter API Reverse Engineered
-
What’s currently the best method to archive a twitter account?
You can try twint which is extensive and should be able to do that. Another is via this twitter downloader but might require multiple runs depending on what you want to archive.
-
Gbf.life will be gone at the end of April
They do have examples that don't specify a username such as number 3 on this page or this one on the main page: "twint -g="48.880048,2.385939,1km" -o file.csv --csv - Scrape Tweets from a radius of 1km around a place in Paris and export them to a csv file."
- Do I have to pay now for the Twitter API if I want to use it for data analysis?
-
Twitter’s $42,000-per-Month API Prices Out Nearly Everyone | Tiers will start at $500,000 a year for access to 0.3 percent of the company’s tweets. Researchers say that’s too much for too little data
This will motivate researchers to web scrape to circumvent these restrictions. Twint can scrape tweets and it supports proxies. It can also be multi threaded. A huge hassle and it's prone to breaking when the site changes.
-
Basically the current state of granblue
The comment I saw said they used this: https://github.com/twintproject/twint
What are some alternatives?
Empire - Empire is a PowerShell and Python post-exploitation agent.
snscrape - A social networking service scraper in Python
Mythic - A collaborative, multi-platform, red teaming framework
Scweet - A simple and unlimited twitter scraper : scrape tweets, likes, retweets, following, followers, user info, images...
merlin - Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.
newspaper - newspaper3k is a news, full-text, and article metadata extraction in Python 3. Advanced docs:
venom - venom - C2 shellcode generator/compiler/handler
twitterscraper - Scrape Twitter for Tweets
ScareCrow - ScareCrow - Payload creation framework designed around EDR bypass.
gallery-dl - Command-line program to download image galleries and collections from several image hosting sites
empire - A PaaS built on top of Amazon EC2 Container Service (ECS)
trafilatura - Python & command-line tool to gather text on the Web: web crawling/scraping, extraction of text, metadata, comments