4 ms·
Bjorn: A powerful network scanning and offensive security tool for Raspberry Pi
- pvitz 2y agoFor the brute-force attack, THC's hydra could be used instead of reinventing the wheel. Or are there licensing issues involved?
- 3abiton 2y agoI don't see the "selling value" of this, can you give me a qrd?
- StrauXX 2y agoHydra unifies brute forcing dozens of protocols into a singular (cli) API. It is useful in that you don't have to have dozens of tools for each kind of service you might want to enumerate, each with their own interfaces.
- notsofast24 2y agoPreparing my honeypot right now: https://github.com/infinition/Bjorn/blob/9ea706ccc03437a9dd15f8f256b63eb66c438e23/actions/steal_files_rdp.py#L90 https://github.com/infinition/Bjorn/blob/9ea706ccc03437a9dd1...
- neilv 2y agoNice catch. IMHO, it's a little too obvious, so probably not a bugdoor. Maybe someone who knows better wasn't getting enough sleep.
- IshKebab 2y agoPython is a pretty big "I don't know what I'm doing" flag so I wouldn't be too surprised. Not always of course - there are plenty of well written Python projects - but Python and JavaScript are so popular for beginners that projects written by beginners tend to concentrate in those languages.
- 2-3-7-43-1807 2y agoand you know what you're doing, aren't you? lol
- IshKebab 2y agoYes I do know how to avoid basic string injection vulnerabilities.
- handwarmers 2y agosit down rust boy.
- mikeweiss 2y agoCan someone explain for those of us who aren't as savvy?
- tecleandor 2y agoI know just a little bit of python and that looks like it does what the description says. Maybe I wouldn't use subprocess but do it via the standard lib. What should we be looking for in the code?
- craigds 2y agoshell=True is a security risk unless you're very careful with escaping inputs. In this case any filename with a `;` in it (or various other shell characters) will run arbitrary commands on the attacker's computer. best to pass a list of arguments to subprocess rather than a string, and avoid shell=True
- sandreas 2y agoI never understood why there even is an api for using a string... Same for SQL statements, single quotes in a query string should generate a warning to just use prepared statements instead :-)
- tecleandor 2y agoAh true! I fixated on exactly the line that was marked. I guess it's not that bad because you're choosing the file to copy, but I wouldn't have used a subshell for copying a file anyway.
- tapanih 2y agoWith a well-crafted filename, you can run arbitrary commands on the attackers computer.
- pstoll 2y agoIf it ends up living up to the promise of the quality of the documentation (ie the README), I can’t wait to try it. Also screenshots of the display look cool.
- insomagent 2y agoThe documentation looks a bit LLMish to me.
- alisaleh88 2y agoWhich is good tbh, we get quality write down. LLMs are around for 2 years now, but not all the documentations use them.
- bjored 2y agoLooking at the SSH actions, the "brute force" attack is just iterating through a list of usernames and passwords from an external file. Wow. Much impress. So Hacker.
- ipnon 2y agoIs there a simpler approach than dictionary attack?
- PhilipRoman 2y agoTake a look at the list of CVEs and start hammering, chances are the SSH server was last updated some time around 2010.
- dartos 2y agoA lot of complexity in that “start hammering” bit.
- poincaredisk 2y agoMock all you want, a brute force attack (why the quotes? This is literally the textbook brute force attack) is an important part of pentesting.
- mike_d 2y ago[flagged]
- khana 2y ago[dead]
- assanineass 2y agoI know I’m just a troll account but I can’t believe all it takes to get 1k stars on GitHub is just rewriting an automated file transfer script using five different protocols and claiming it’s some powerful offensive capability lmfao
- miah_ 2y agoIf this integrated with Metasploit or some other tooling I might be impressed.the graphics are cool though.
- jamaicanindian 2y ago[dead]
- boomskats 2y agoAhh yeah Bjorn, my pwnagotchi's new older brother. I really hope he can cheer him up - the little guy hasn't been the same ever since daddy decided he was more interested in penetrating that cups server.