FetishCoconut

_____ _                  ___       ____                          _
|_   _(_) __ _ _ __ ___  |_ _|___  |  _ \ ___   __ _ _   _  ___  | |
  | | | |/ _` | '__/ _ \  | |/ __| | |_) / _ \ / _` | | | |/ _ \ | |
  | | | | (_| | | |  __/  | |\__ \ |  _ < (_) | (_| | |_| |  __/ |_|
  |_| |_|\__, |_|  \___| |___|___/ |_| \_\___/ \__, |\__,_|\___| (_)
         |___/                                 |___/

┌─[✗]─[lulztigre@parrot]─[~]
└──╼ $sudo bash swap_digger/swap_digger.sh -x
[sudo] password for lulztigre:

  - SWAP Digger -

 [+] Looking for swap partition
     -> Found swap at /dev/sda6
 [+] Dumping swap strings in /tmp/swap_dig/swap_dump.txt ... (this may take some time)


   ==== Linux system accounts ===

 [+] Digging linux accounts credentials... (pattern attack)
   -> lulztigre:passwordintentionallyleftblankbecausereasonsandwhatnot
 Passwords not found. Attempt dictionary based attack? (Can last from 5 minutes to several hours depending on swap usage) [y/n] n

 Passwords not found. John was detected on the system, attempt to crack /etc/shadow based on dumped swap wordlist? [y/n] y

 [+] Digging linux accounts credentials method 3... (John attack)
 [+] Cracking linux account passwords using John.
   [-] Generating wordlist file...
   [-] Cracking /etc/shadow using wordlist... (This may take some time)
Warning: detected hash type "sha512crypt", but the string is also recognized as "crypt"
Use the "--format=crypt" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 2 password hashes with 2 different salts (sha512crypt, crypt(3) $6$ [SHA512 128/128 XOP 2x])
Remaining 1 password hash
Press 'q' or Ctrl-C to abort, almost any other key for status

0g 0:00:07:33 DONE (2017-08-21 11:18) 0g/s 482.0p/s 482.0c/s 482.0C/s !!!ZZZCCCDDD..ZZZZZZZZZZZZZZZZ
Session completed
   -> lulztigre:passwordintentionallyleftblankbecausereasonsandwhatnot:17257:0:99999:7:::
   -> 1 password hash cracked, 1 left
 Do you wan to delete john pot? [y/n]

   ==== Web entered passwords and emails ===

 [+] Looking for web passwords method 1 (password in GET/POST)...
   -> =%27or+1%3D1+limit+1+%3B%23&password=%27or+1%3D1+limit+1+%3B%23
   -> username=%27or+1%3D1+limit+1+%3B%23&password=%27or+1%3D1+limit+1+%3B%23

 [+] Looking for web passwords method 2 (JSON) ...

 [+] Looking for web passwords method 3 (HTTP Basic Authentication) ...

 [+] Looking for web entered emails...
   ->  "test@mail.ru";


   ==== XML data ===

 [+] Looking for xml passwords ...


   ==== WiFi ===

 [+] Looking for wifi access points...
   [-] Potential wifi network list this computer accessed to:

 [+] Looking for potential Wifi passwords....
   [-] Potential wifi password list (use them to crack above networks)

 [+] Looking for potential Wifi passwords method 2....
   [-] Potential wifi password list (use them to crack above networks)


   ==== Mining most accessed resources ===

 [+] TOP 30 HTTP/HTTPS URLs (domains only)
   ->    3194 http://www.it-ebooks.info
   ->    2197 http://freedesktop.org # never visited
   ->     363 http://www.freedesktop.org # this either
   ->     298 http://libvirt.org  # or this
   ->     294 http://www.w3.org # nor this
   ->     244 https://www.facebook.com
   ->     221 http://creativecommons.org # tf is this
   ->     205 http://ns.adobe.com # never used adobe
   ->     163 http://127.0.0.1
   ->     158 http://purl.org # wuuuut??
   ->     133 http://udisks.freedesktop.org ###
   ->      89 https://www.google.com
   ->      86 http://www.oreilly.com # visited just once
   ->      81 http://www.inkscape.org # no idea
   ->      80 http://www.python.org
   ->      71 https://www.catcert.net # ???
   ->      63 http://cert.startcom.org # cert what?
   ->      59 https://github.com
   ->      59 http://www.packagekit.org # no idea
   ->      57 http://crl.comodoca.com # sounds like commodore
   ->      56 https://wiki.gnome.org # i am a mate dude
   ->      53 http://pki.google.com # pk what??
   ->      50 http://repository.swisssign.com # swisscoin?
   ->      50 http://www.gnome.org # once again mate dude
   ->      49 http://crl.comodo.net # comodore 65?
   ->      48 http://example.com # is this even a real thing
   ->      48 http://www.e-szigno.hu # why do i feel like this is some anime shii
   ->      48 http://www.startssl.com # ?????????????
   ->      47 http://www.chambersign.org1 # oxlade chamberlain of arsenal ?? i am a united folk
   ->      45 http://www.accv.es # ?


 [+] TOP 30 FTP URLs
   ->       5 ftp://ftp.unicode.org/


 [+] TOP 30 .onion urls
##### i do go here frequently tbh!!!


 [+] TOP 30 files
   ->     432 file:///home/lulztigre
   ->      73 file:///home/lulztigre/.cache
   ->      71 file:///usr/share
   ->      65 file:///usr/share/u3-pwn/src/banner.py
   ->      62 file:///usr/share/u3-pwn/u3-pwn.py
   ->      61 file:///home/lulztigre/DesktopBackground/naruto-uzumaki-11-nextsegment.com-.png
   ->      60 file:///media/lulztigre/FC7C61947C614B0A
   ->      56 file:///usr/share/u3-pwn/src/deviceinfo.py
   ->      54 file:///usr/share/u3-pwn/resource/hidden.vbs
   ->      54 file:///usr/share/u3-pwn/src/customexe.py
   ->      47 file:///usr/share/urlcrazy/common-misspellings.rb
   ->      45 file:///usr/share/urlcrazy/country.rb
   ->      44 file:///usr/share/urlcrazy/urlcrazy
   ->      43 file:///
   ->      40 file:///home/lulztigre/Downloads
   ->      35 file:///usr/share/sqlmap/waf/360.py
   ->      32 file:///usr/share/sqlmap/waf/cloudflare.py
   ->      30 file:///usr/share/sqlmap
   ->      29 file:///media/lulztigre/D2AA1941AA19238F
   ->      28 file:///home/lulztigre/.conky/Green%20Apple%20Desktop
   ->      25 file:///usr/share/sqlmap/sqlmap.py
   ->      24 file:///usr/share/sqlmap/lib
   ->      24 file:///usr/share/sqlmap/lib/techniques/blind/inference.py
   ->      20 file:///home/lulztigre/Cryptolocker-1.0.0/Cryptolocker-1.0.0/WindowsFormsApplication1
   ->      20 file:///usr/share/u3-pwn/src
   ->      18 file:///usr/share/sqlmap/waf
   ->      17 file:///home/lulztigre/Cryptolocker-1.0.0/Cryptolocker-1.0.0
   ->      15 file:///home/lulztigre/Cryptolocker-1.0.0/Cryptolocker-1.0.0/Generate%20RSA%20Key
   ->      15 file:///usr/share/sqlmap/extra


 [+] TOP 30 smb shares
   ->       4 smb:///
   ->       3 smb://WORKGROUP
   ->       2 smb://foo.example.com


 [+] TOP 30 IP addresses (lots of false positives, ex. file versions)
   ->    3463 46.46.46.46
   ->    2211 2.5.4.10
   ->    1996 2.5.4.3
   ->    1957 2.5.4.6
   ->    1256 2.5.4.11
   ->    1027 2.5.29.19
   ->     980 2.5.29.14
   ->     957 2.5.29.15
   ->     627 127.0.0.1
   ->     399 2.5.4.7
   ->     340 2.5.29.35
   ->     207 2.5.4.8
   ->     140 2.5.29.31
   ->     136 2.5.29.32
   ->     113 4.3.2.1
   ->      92 2.3.2.2
   ->      66 0.7.9.1
   ->      61 2.5.29.17
   ->      60 1.3.6.1
   ->      48 5.5.7.1
   ->      44 192.0.2.0
   ->      38 0.0.0.0
   ->      33 2.16.840.1
   ->      30 35.46.46.46
   ->      28 2.5.4.5
   ->      25 192.168.43.1
   ->      25 71.71.71.71
   ->      20 06.16.18.17
   ->      20 192.0.2.1
   ->      18 2.5.29.33

  SWAP Digger end, byebye!

/home/lulztigre