Description

Originally designed as a word list creation tool, thad0ctor's BT5 Toolkit has become an all purpose security script to help simplify many Backtrack 5 functions to help Pentesters strengthen their systems.

The backbone of thad0ctor's Backtrack 5 Toolkit is the Wordlist Toolkit that contains a plethora of tools to create, modify, and manipulate word lists in order for end users to strengthen their systems by testing their passwords against a variety of tools designed to expose their pass phrases. In short it is the ultimate tool for those looking to make a wide variety of word lists for dictionary based and other brute force attacks.

The toolkit is designed with usability in mind for the Backtrack 5R2 linux distro but will also work on BT5 R1 and other Ubuntu based distros if configured properly. The script is constantly updated with multiple revisions to include new cutting edge features and improvements in order to provide full spectrum wordlist creation capabilities.

[Download]

Weevely is a stealth PHP web shell that provides a telnet-like console. It is an essential tool for web application post exploitation, and can be used as stealth backdoor or as a web shell to manage legit web accounts, even free hosted ones.

Weevely is currently included in Backtrack and Backbox and all the major Linux distributions oriented for penetration testing.

Start with a quick Tutorial, read about Modules and Generators.
More than 30 modules to automate administration and post exploitation tasks
Execute commands and browse remote filesystem, even with PHP security restriction
Audit common server misconfigurations
Run SQL console pivoting on target machine
Proxy your HTTP traffic through target
Mount target filesystem to local mount point
Simple file transfer from and to target
Spawn reverse and direct TCP shells
Bruteforce SQL accounts through target system
Run port scans from target machine
And so on..
Backdoor communications are hidden in HTTP Cookies
Communications are obfuscated to bypass NIDS signature detection
Backdoor polymorphic PHP code is obfuscated to avoid HIDS AV detection

[Download]