{"id":19647091,"url":"https://github.com/mtk911/khata","last_synced_at":"2025-04-28T15:31:17.250Z","repository":{"id":102357890,"uuid":"268120345","full_name":"MTK911/KHATA","owner":"MTK911","description":"WebHook for Red Team","archived":false,"fork":false,"pushed_at":"2021-02-27T06:21:04.000Z","size":90,"stargazers_count":26,"open_issues_count":0,"forks_count":7,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-04-05T09:23:17.293Z","etag":null,"topics":["hacking","hacking-tool","hackingtool","loganalyzer","logger","logger-interface","logging","offensive-security","pentest","pentesting","pentesting-tools","php","ssrf","vulnerability","vulnerability-assessment","webhook","webhook-receiver","webhooks","xss","xss-scanner"],"latest_commit_sha":null,"homepage":"http://demo.mtk911.cf/","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/MTK911.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-05-30T16:42:47.000Z","updated_at":"2025-03-21T17:09:05.000Z","dependencies_parsed_at":null,"dependency_job_id":"f05324e1-5497-47a7-83f6-ed97a8b18069","html_url":"https://github.com/MTK911/KHATA","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MTK911%2FKHATA","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MTK911%2FKHATA/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MTK911%2FKHATA/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MTK911%2FKHATA/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/MTK911","download_url":"https://codeload.github.com/MTK911/KHATA/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251338616,"owners_count":21573585,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["hacking","hacking-tool","hackingtool","loganalyzer","logger","logger-interface","logging","offensive-security","pentest","pentesting","pentesting-tools","php","ssrf","vulnerability","vulnerability-assessment","webhook","webhook-receiver","webhooks","xss","xss-scanner"],"created_at":"2024-11-11T14:42:20.710Z","updated_at":"2025-04-28T15:31:17.229Z","avatar_url":"https://github.com/MTK911.png","language":"PHP","readme":"\u003cp align=\"center\"\u003e\n\u003cimg src=\"https://i.ibb.co/NFpgqNg/1ey.png\" width=\"256\" height=\"164\"\u003e\n\u003c/p\u003e\n\n# Khata what?\nKhata is a utility designed to keep records of all incoming HTTP requests in secure fashion. Khata is designed while keeping usability, security and ease of deployment in mind, So Khata is database free and only need few minutes to setup and starts working.\n\n# Khata why?\nWhile working on my [Attiny85](https://github.com/MTK911/Attiny85) scripts I mostly rely on weebhook.site which is very useful and reliable but it's not mine. So, I always wanted to create something similar and one day I just sat and started working on it and piece by piece it turned into a complete project. So now I have my own webhook for my Attiny85 script but I can also use it to detect Cross Site Scripting (XSS) and Server-Side Request Forgery (SSRF) vulnerabilities.\n\n# Khata how?\nKhata is written in PHP (Yes, I said PHP) because PHP is easily available on all hosting platforms and doesn’t need any fancy work. For making the utility fancy I have used Bootstrap and jQuery (it was a blast [cries inside]). To make data more user friendly I have used datatable plugin which is quite good and make work easy (I found that out after writing everything myself[stupid]). Thanks to datatable all logs can be download in CSV, XLSX, PDF format \u003cbr\u003e\n\nFor data security I am encrypting received request with AES-256-OFB and keeping them in a plain text file (Now don't be so melodramatic). From where C2 (index.php) picks up all the data decrypts it and present it in readable form. For C2 security I have tried to keep up with the security measures like Anti-CSRF, Captcha, Security Headers, and other stuff I can't remember. (If you have any suggestions to improve security put them in suggestion box).\n\n# Demo\nhttp://demo.mtk911.cf/\n\n# Docker deployment\ndocker pull mtk911/khata\n\ndocker run -d -p 80:80 mtk911/khata\n\n## Getting Started\nDeploying khata is super easy you just need to have and do few things:\n1. A Server Apache/Nginx etc\n2. PHP installation (Tested it on PHP\u003e7)\n3. Copy all three php files to server root directory\u003cbr\u003e\nDone\n\n## The necessary\n1. Change Username and Password(Make sure it is SHA256 in lowercase i don't know why lowercase) in configuration file\n2. Change Key and IV in configuration file for encryption\n3. Change file name of logs and responder in configuration file\n4. Change random1 and random2 variable\n5. Make sure catch.php has permission to write in directory \n\n## The Okay I’ll do it later\n1. Change time zone in configuration file\n2. Use .htaccess to restrict access to data file and configuration.php file\n3. For security reason log file size is limited to 1 GB you can change it to whatever you want\n\n## Arming\nKhata can be use to detect XSS and SSRF using Khata as a listener. For XSS place Khata in script tag source \u003cscript src=\"http://abc.xyz/catch.php\"\u003e in case of XSS vulnerability you will be able to see a log entry in C2. For SSRF visit following [blog](https://portswigger.net/web-security/ssrf). Using responder function you can define your own response which turns KHATA into multi-function tool and sky is the limit.\n  \n## File Facts\n**index.php**: C2 where you view all data\u003cbr\u003e\n**catch.php**: Request collector where you point all your requests to\u003cbr\u003e\n**configuration.php**: It is self-explanatory\u003cbr\u003e\n\n## Credentials\n`admin/admin`\n\n## Before login\n\u003cimg src=\"https://i.imgur.com/RQlIzkt.gif\" alt=\"Login\" border=\"0\"\u003e\n\n## After login\n\u003cimg src=\"https://i.imgur.com/ye9bys4.png\" alt=\"Dash\" border=\"0\"\u003e\n \n\n## DISCLAIMER\nAll the software/scripts/applications/things in this repository are provided as is, without warranty of any kind. Use of these software/scripts/applications/things is entirely at your own risk. Creator of these softwares/scripts/applications/things is not responsible for any direct or indirect damage to your own or defiantly someone else's property resulting from the use of these software/scripts/applications/things.\n\n## License\nMIT License\n\nCopyright (c) 2020 Muhammad Talha Khan\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n# Changes\n### Ver 2.0\n + Added responder functionality to display or execute custom payloads on catch.php response\n + Captcha turned to image for better security\n + CSS changes for UI improvement\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmtk911%2Fkhata","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmtk911%2Fkhata","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmtk911%2Fkhata/lists"}