Jablo(j3lo), yes. I basically derived it from the Lord Of Terror himself. A symbol for evilness, a representation of a demonic acts. The name does what this exploit toolkit could do, do evil deeds and just create damage on the target host.
After a few modules and implementations of some exploits, I have gathered the forces and collate my all my hand-made toolkit that would govern a system and perform an attack. The goal was set not later than 8 months ago, with all the learnings I have acquired from pentesting, I created a system that will perform an exploit on a certain target. All the modules I got and learned, all the exploitation concepts, may it be a remote or local attacks are now collated.
This project will continually grow, for I will be adding more modules once I have figure out a new type of exploit which I'll be sharing by a blogpost. You readers have been my motivation to create this kind of craft, and I would like to show all the thanks for you.
A Collection of Exploits
If you have been reading my previous posts, the components of this system are all familiar to you. Each exploit tool equates to a single post. I have articulated all these exploits and had given a walkthrough on each one.
Each entry has its own set of commands for operation.The system interface is command-line based, same UI as with Raven,Spyder and Tesla, giving the user a hacker-feel environment. Below are the set of commands for your information.
==================================================================================
Before launching the app, make sure you have installed the path, j3lo.exe on your environmental variables.
Type in the commands on the Win cmd or Linux terminal.
j3lo --> will launched the application. Will direct user to the UI.
sqlin --> Will launched SQL injector program that will perform sql injection attacks on a given URL.
*sqlin -input/-i -c/-cmd ---> this conducts SQL injection attacks on a given text input(url_sql.txt)
a list of URL targets that comprised a series of command injections from file 'bypass.txt'
*sqlin <url> <command injection> --> A single transaction.
azrel/az --> Will quickly launched azrel, a program that performs dictionary attack on the target.
ch/capth/capthook --> Will launched Captain Hook, a keylogger application.
webhis/webh --> Will give you web history of the host.
nm/nmapper --> launched AutoNmapper. Nmap that automates in bulk input requests.
dirt --> Run directory traversal on target domain.
sniff --> Will sniff the host's traffic.
exit --> To halt the program
cls/clear --> Perform clear screen
==================================================================================
UI & Commands
All my tools are run through cmd. I know its a old, but the feel of being a hacker will never fade. Green text black screen with a converted image to text logo intro, has been my thing. Simplicity, yet beauty is the bottomline. My works has always been to contain the best user experience my application can attain. Clean background, better and faster performance will always be my trademark. I have make sure to apply those on this tool, with the minimilist code and design. J3lo will be as smooth as a Johnnie Walker's Black Label.
With the remarks and reviews from my peers, I have made sure that input and output is 'gold'. No unnecessary data will be printed, for as long as what the user needed.
Like Spyder, I have set the command utilities to be flexible and user friendly. User won't need to worry and be conscious on their inputs, as escaped characters(space,tab,new line) are well handled. So if one has accidentally typed on extra space or any escaped chars, operation will still execute. Inputs are also not case sensitive.
A Quick Refresher...
If you have read on my previous blogs, my modules are no longer new to you. But for the sake of refresher and for first time readers(Welcome by the way! =)) I will provide a brief walkthroughs of each one.
SQLin- This is a SQL injector. To give you an idea, it will automatically inject sql injection commands on your targeted host. User will input all his SQL injection commands and on a certain text file, no limits has been set so input as many as you can. Targeted URLs will be in another file. Once launched, my program will perform the exploits from the given inputs. Output will be the web server response and feedback if with the execution the server is vulnerable to SQL injection. You can visit on the article below for further infos,
https://kenciceron45.wixsite.com/krontek/main/sql-injection-scanner-for-web-applications
Azrel- This is every web app's nightmare. The angel of death for every web applications. A password brutforcer that will perform a dictionary attack on a certain site. This tool will rely on your given dictionary lists of password input, the exact URL login and the targeted username. IF you run the program, it will perform the bruteforce and will attempt on every possible passwords from your list. No size limits of dictionary list file has been set. Have test to execute a 6gb dictionary file, yet the program successfully performed its functionility. Link below for the walkthrough,
https://kenciceron45.wixsite.com/krontek/main/azrel-the-webapp-password-killer
Capt Hook- A keylogger application that record a compromised user's key stroke. The program not only featured the key stroke logs but it also shows the web application name(if a browser was utilized), PID and the application program launched(e.g. the browser name) while hitting up the keys. You can check on the link below, for further walkthroughs.
https://kenciceron45.wixsite.com/krontek/main/captain-hook-keylogger-program
WebHis- A program that generates history web cache from a user's browser. Given the browser's History db file, it will extracts the user's web history, which could be a lot of help on tracking the user's web activity. Program will parse the sql file and provide the application user the information he needed. Link below for further informations.
https://kenciceron45.wixsite.com/krontek/main/web-history-viewer
NMapper- This tool is the best way to automate nmap at its peak. With these you can't only conduct recon and investigations from a single target and transactions but you could have it as a whole. Article on the link below shows you how to do such.
https://kenciceron45.wixsite.com/krontek/main/autonmaper-automate-nmap-in-bulk
DirT-A bruteforce traversal tool to attack a certain a web application.
This tool will provide input of all the URLs or domain to be exploited in a file. Once run, program will now perform the bruteforce if any file location on a web application response a 200.
https://kenciceron45.wixsite.com/krontek/main/bruteforcing-directories-and-files-on-a-web-application
Sniffer- An exploit kit to sniff out the traffic on your target. Once user input on the target, given enough privelage, you can eavesdrop on your target's network traffic. You can check on my blog below, to find out how I made it.
https://kenciceron45.wixsite.com/krontek/main/bruteforcing-directories-and-files-on-a-web-application
Sample Screenshots on RUN>
The integration of this module, will help one achieve its goal to fully compromised the host. This tool, is so dynamic as users can provide any number of inputs, and will be able to execute the desired output. The best offense, is reading ones defense. A successful attack will comprised a well formed recon plus a perfectly executed exploit. Stay tuned for the next version, for I will be posting alot more exploits in the future.
<krontek>halt