masc

masc A malware web scanner developed during CyperCamp Hackathon 2017 About homepage PyPI Features At the moment, there are some features avaiable for any type of website custom or CMS and some of them only available for specific platforms: Scan any website for malware using OWASP WebMalwareScanne...

inquisitor

Inquisitor Notice This project is only partially complete and I have yet to implement many of the features described in the following blog post I made: https://penafieljlm.com/2017/07/14/inquisitor/. Inquisitor is a simple tool for gathering information on companies and organizations through the...

InterceptSuite

InterceptSuite !IMPORTANT This repository has been archived. The active InterceptSuite codebase is now closed-source and paid-only. See below for details. About InterceptSuite was created to solve a long-standing problem in security testing - intercepting and inspecting non-HTTP traffic. While...

How-To-Secure-A-Linux-Server

리눅스 서버 보안 가이드 리눅스 서버를 보안하는 방법에 대한 진화하는 가이드입니다. 보안의 중요성과 그 이유를 조금이나마 배울 수 있기를 바랍니다. 목차 소개 가이드 목표 서버를 보안해야 하는 이유 또 다른 가이드인 이유 다른 가이드 할 일 / 추가할 내용 가이드 개요 이 가이드에 대하여 내 사용 사례 설정 파일 편집 - 게으른 사람들을 위해 기여하기 시작하기 전에 원칙 파악 리눅스 배포판 선택 리눅스 설치 설치 전/후 요구 사항 기타 중요한 사항 Ansible 플레이북을 사용하여 리눅스 서버 보안 SSH 서버 SSH 변경 전...

caido

Website • Dashboard • Docs • Roadmap • Branding • Discord 👋 Welcome Welcome to Caido! Caido aims to help security professionals and enthusiasts audit web applications with efficiency and ease. Here you can get involved with the development of our software. You can learn about upcoming Caido...

flashlight

Automated Information Gathering Tool for Penetration Testers Videos : https://www.youtube.com/watch?v=EUMKffaAxzs&list=PL1BVM6VWlmWZOv9Hv8TV2v-kAlUmvA5g7&index=4 https://www.youtube.com/watch?v=qCgW-SfYl1c&list=PL1BVM6VWlmWZOv9Hv8TV2v-kAlUmvA5g7&index=5...

bluewall

BLUEWALL Bluewall is a firewall framework designed for offensive and defensive cyber professionals. This framework allows Cybersecurity professionals to quickly setup their environment while staying within their scope. Credit Inspired by Andrew Benson's hostfw iptable generation script. Features...

bluewall

BLUEWALL Bluewall は、攻撃的および防御的なサイバー専門家向けに設計されたファイアウォールフレームワークです。 このフレームワークにより、サイバーセキュリティ専門家はスコープ内に留まりながら環境を迅速にセットアップできます。 クレジット Andrew Benson の hostfw iptable 生成スクリプト に触発されました。 機能 Bluewall ファイアウォールの設定 ホスト名の設定 インターフェースの設定 サポート対象OS Redhat/CentOS Windows の設定は生成可能ですが、実行はできません。 コマンドライン bluewall -c...

bypass-url-parser

Bypass Url Parser Tool that tests MANY url bypasses to reach a 40X protected page. If you wonder why this code is nothing but a dirty curl wrapper, here's why: Most of the python requests do url/path/parameter encoding/decoding, and I hate this. If I submit raw chars, I want raw chars to be sent...

bbrecon

This project is no longer maintained and I took the crawling infrastructure offline. The audience was not big enough to justify maintaining it. Bug Bounty Recon bbrecon is a free Recon-as-a-Service for bug bounty hunters and security researchers. The API aims to provide a continuously up-to-date...

goWAPT

GOWAPT - Go Web Application Penetration Test GOWAPT は wfuzz の弟分で、WAPT のスイスアーミーナイフです。ペネトレーションテスターは設定するだけで、クリックひとつで大規模なアクティビティをストレスなく実行できます。 インストール方法 gowapt をインストールするには、以下のコマンドを入力します： make sudo make install 使い方 -h メニューより Usage of gowapt: -H value 追加ヘッダーのリスト -a string Basic 認証 ユーザー:パスワード -c string...

socid-extractor

socidextractor Turn any public profile page into a structured account record — usernames, display names, bios, avatars, locations, joined-at dates, follower counts, external links, and the stable internal identifiers that uniquely pin an account across renames, redesigns, and deletions...

trivy-operator

Kubernetes-native security toolkit. Documentation Introduction The Trivy Operator leverages Trivy to continuously scan your Kubernetes cluster for security issues. The scans are summarised in security reports as Kubernetes Custom Resource Definitions, which become accessible through the Kubernete...

llm-security-101

LLMセキュリティ入門 LLMセキュリティの領域への探求：攻撃的・防御的ツールの調査と、その現在の能力の解明。 私たちはさまざまなアプリケーションや機能で大規模言語モデル（LLM）を受け入れていますが、関連するリスクを理解し、潜在的なセキュリティへの影響を完全に排除できないまでも、積極的に軽減することが極めて重要です。 次のセクションでは、これらの強力な言語モデルに関連する潜在的なリスク、脆弱性、倫理的考慮事項について探っていきます。すべて、この数週間における私のLLMでの経験に基づいています。 LLMとは？ OWASPのLLMアプリケーション向けTop 10とは？ LLM脆弱性の分類...

agentic-threat-hunting-framework

Agentic Threat Hunting Framework ATHF Quick Start • Installation • Documentation • Examples Give your threat hunting program memory and agency. The Agentic Threat Hunting Framework ATHF is the memory and automation layer for your threat hunting program. It gives your hunts structure, persistence,...

RTF_11882_0802

RTF118820802 CVE-2017-11882 CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882 MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-11882 研究: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about パッチ分析:...

GoTEE-example

はじめに GoTEEフレームワークは、TamaGoベースのユニカーネルを特権モードと非特権モードで同時にインスタンス化し、モニターモードとカスタムシステムコールを介して相互にやり取りします。 これらの機能により、GoTEEはTamaGoベースのTrusted Execution Environments（TEE）を実装し、ARM TrustZone Secure WorldまたはRISC-V Supervisor Execution Environments内のベアメタル実行にGoのメモリ安全性、利便性、および機能をもたらします。 GoTEEは、GoTEE...

CVE-2020-7931

CVE-2020-7931: Artifactory Pro における SSTI エクスプロイト CVE-2020-7931 は、Artifactory における意図的な設定ミスの脆弱性であり、攻撃者が FreeMarker テンプレート から サーバーサイドテンプレートインジェクション を実行することを可能にします。 この脆弱性は Atredis の Ryan Hanson によって発見され、2019年後半にすべての影響を受けるバージョンに対して修正されました。この脆弱性は Artifactory の Pro バージョンでのみ機能します。他のバージョンにはテンプレート機能がないためです...

airgorah

Airgorah A WiFi security auditing software mainly based on aircrack-ng tools suite Installation | Usage | Credits Airgorah is a WiFi security auditing software that can capture nearby WiFi traffic, discover clients connected to access points, perform deauthentication attacks, capture handshakes,...

log-horizon

Microsoft Sentinel SIEM Log Source Analyzer I've had to answer "what are we actually getting out of these logs?" or "what is the recommended logs for Microsoft Sentinel" more times than I can count. The answer always depend on so many things, but we can be generic. So I built this thingy right...