Invoke-ADEnum

Invoke-ADEnum Active Directory Auditing and Enumeration Invoke-ADEnum is an auditing and enumeration tool designed to automate the collection of information from an Active Directory environment. One of the features of Invoke-ADEnum is its ability to generate an Active Directory Audit Report in HT...

filessh

FileSSH A TUI-based file explorer for SSH servers, which allows you to browse and manage files on a remote server, edit them in-place, and recursively download directories with parallel directory traversal. It also has the ability to quickly spawn SSH sessions to paths on the remote server...

CVE-2022-46604-Responsive-File-Manager

CVE 2022 46604 – Responsive File Manager ⚠️ Disclaimer This repository is intended strictly for educational and research purposes only. The information and code provided here can be used in controlled environments such as private lab machines. Unauthorized use of this code against systems you do...

CVE-2019-17662

CVE-2019-17662 Modified the CVE code Used Prepared Requests, as in python3 requests module normalize the ../ in URL such as: For code: r = requests.get"http://123.123.123.123/../../../../../../test" printstrr.statuscode Results in: GET /test HTTP/1.1 Host: 123.123.123.123 Connection: close...

scripthunter

scripthunter Scripthunter is a tool that finds javascript files for a given website. To scan Google, simply run ./scripthunter.sh https://google.com. Note that it may take a while, which is why scripthunter also implements a notification mechanism to inform you when a scan is finished via Telegra...

BigBountyRecon

BigBountyRecon BigBountyRecon tool utilises 58 different techniques using various Google dorks and open source tools to expedite the process of initial reconnaissance on the target organisation. Reconnaissance is the most important step in any penetration testing or a bug hunting process. It...

dicozorus

Dicozorus Dicozorus is a tool to generate and maintain web wordlists. It eliminates the overhead of managing multiple wordlists by storing paths enriched with metadata in a local SQLite database. Just want a great wordlist without the tool? Skip the setup and use lazy.txt. Why Dicozorus? Standard...

CVE-2025-3102-exploit

This repository does not have a README...

dirble

Introduction Dirble is a website directory scanning tool for Windows and Linux. It's designed to be fast to run and easy to use. How to Use Download one of the precompiled binaries for Linux, Windows, or Mac, or compile the source using Cargo, then run it from a terminal. The default wordlist...

dirstalk

Dirstalk Dirstalk is a multi threaded application designed to brute force paths on web servers. The tool contains functionalities similar to the ones offered by dirbuster and dirb. Here you can see it in action: Contents How to use it Scan Useful resources Dictionary generator Download Developmen...

p0wnedShell

p0wnedShell PowerShell Runspace Post Exploitation Toolkit Author: Cn33liz and Skons Version: 2.6 License: BSD 3-Clause What is it: p0wnedShell is an offensive PowerShell host application written in C that does not rely on powershell.exe but runs powershell commands and functions within a powershe...

Get-RBCD-Threaded

Get-RBCD-Threaded Tool to discover Resource-Based Constrained Delegation attack paths in Active Directory Environments Based almost entirely on wonderful blog posts "Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory" by Elad Shamir and "A Case Study in...

RiskySPN

RiskySPNs RiskySPNs is a collection of PowerShell scripts focused on detecting and abusing accounts associated with SPNs Service Principal Name. This module can assist blue teams to identify potentially risky SPNs as well as red teams to escalate privileges by leveraging Kerberos and Active...

CVE-2025-27591-PoC

CVE-2025-27591 PoC: Local Privilege Escalation in Below v0.9.0 Proof of Concept for CVE-2025-27591, a vulnerability that allows to local unprivileged users to escalate their privileges to root through symlink attacks. 🕵️‍♂️ Technical Details The vulnerability affects the Below service versions...

Invoke-BadSuccessor.ps1

Invoke-BadSuccessor Abuse Delegated Managed Service Accounts dMSA creation rights on vulnerable Organizational Units OUs to escalate privileges in Active Directory environments BadSuccessor vulnerability – CVE-2025-53779. Overview Invoke-BadSuccessor automates a privilege escalation attack chain ...

Masky

Masky Masky is a python library providing an alternative way to remotely dump domain users' credentials thanks to an ADCS. A command line tool has been built on top of this library in order to easily gather PFX, NT hashes and TGT on a larger scope. This tool does not exploit any new vulnerability...

DirDar

DirDar v1.0 Description 🏴‍☠️ bypass forbidden directories - find and identify dir listing - you can use it as directory brute-forcer as well Compatabily This tool is compatible with all kind of operating systems as long as you have GO compiler installed Install You can use this command if you have...

CVE-2018-17144_POC

This repository does not have a README...

ADLab

ADLab PowerShell Module Introduction The purpose of this module is to automate the deployment of an Active Directory lab for practicing internal penetration testing. Credits to Joe Helle and his PowerShell for Pentesters course regarding the generation of the attack vectors. Instructions...

SharpSuccessor

SharpSuccessor SharpSuccessor is a .NET Proof of Concept POC for fully weaponizing Yuval Gordon’s @YuG0rd BadSuccessor attack from Akamai. A low privilege user with CreateChild permissions over any Organizational Unit OU in the Active Directory domain with write access on a target object can...