Kerbeus-BOF

Kerbeus-BOF Beacon Object Files for Kerberos abuse. This is an implementation of some important features of the Rubeus project, written in C. The project features integration with the C2 frameworks Cobalt Strike, Havoc, AdaptixC2 and Outflank C2. Ticket requests and renewals asktgt The asktgt...

checkov

Checkov is a static code analysis tool for infrastructure as code IaC and also a software composition analysis SCA tool for images and open source packages. It scans cloud infrastructure provisioned using Terraform, Terraform plan, Cloudformation, AWS SAM, Kubernetes, Helm charts, Kustomize,...

lil-pwny

Lil Pwny Fast offline auditing of Active Directory passwords using Python. About Lil Pwny Lil Pwny is a Python application to perform an offline audit of NTLM hashes of users' passwords, recovered from Active Directory, against known compromised passwords from Have I Been Pwned. Results will be...

dnscontrol

DNSControl DNSControl is Infrastructure as Code for DNS. It includes a full-featured configuration language Javascript-compatible, plus "plug-ins" that speak to DNS provider APIs such as AWS Route 53, Cloudflare, and Gandi. It can send the same DNS records to multiple providers. It runs anywhere ...

deception-as-detection

Deception-as-Detection Deception based detection techniques mapped to the MITRE’s Adversarial Tactics, Techniques, and Common Knowledge ATT&CK™: Windows Technique Matrix Linux Technique Matrix Mac Technique Matrix 📔 Deception Stories A sample deception story is created as a reference. More...

CVE-2024-0044

CVE-2024-0044/A-307532206 is a High severity vulnerability in the Android framework that allows attackers with adb access to run arbitrary code under the UID of arbitrary app. It was originally found by Tom Hebb from Meta Red Team X. You can found many articles on exploit this vulnerability on th...

intercept

!zreadhttps://img.shields.io/badge/AskZread-.svg?style=plastic&color=00b0aa&labelColor=000000&logo=data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAxNiAxNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTQuOTYxNTYgMS42MDAxSDIuMjQxNTZD...

porterminal

Give your agent any computer One command. One URL. A real terminal for your agent, a live view for you. Run Porterminal on a Windows, macOS, or Linux computer and give the generated link to your AI agent. It gets a real shell with the files, tools, and projects on that machine. Open the same link...

burpsuite-copy-as-xmlhttprequest

Copy as XMLHttpRequest إضافة BurpSuite تضيف الإضافة قائمة سياقية إلى BurpSuite تسمح لك بنسخ عدة طلبات كـ XmlHttpRequest في Javascript، مما يبسط تطوير PoC عند استغلال XSS. التثبيت قم بتنزيل أحدث JAR من الإصدارات أو قم بالبناء يدويًا أضف JAR إلى burpsuite باستخدام التبويبات: "Extender" - "Extension...

Jboss_JMXInvokerServlet_Deserialization_RCE

JbossJMXInvokerServletDeserializationRCE Exploitation de la vulnérabilité de désérialisation Java avec Burp Suite 0x01 Mise en place de la vulnérabilité de désérialisation Jboss JMXInvokerServlet Environnement de test : vulnérabilité de désérialisation JBoss JMXInvokerServlet Principe de la...

bbrecon

This project is no longer maintained and I took the crawling infrastructure offline. The audience was not big enough to justify maintaining it. Bug Bounty Recon bbrecon is a free Recon-as-a-Service for bug bounty hunters and security researchers. The API aims to provide a continuously up-to-date...

android_autorooter

Android Autorooter هذه مجرد ملاحظة ذهنية أكثر من أي شيء آخر لاستكشاف إمكانيات العمل المُنجز هنا: https://rtx.meta.security/exploitation/2024/03/04/Android-run-as-forgery.html https://tinyhack.com/2024/06/07/extracting-whatsapp-database-or-any-app-data-from-android-12-13-using-cve-2024-0044/?s=03...

cve-2024-0044

CVE-2024-0044 يسمح CVE-2024-0044 بهجوم "run-as"، مما يؤدي إلى تصعيد محلي للصلاحيات. وهذا يمكّن المهاجم من الوصول إلى الملفات الخاصة المخزنة محليًا بواسطة أي تطبيق على الجهاز المحمول، مما يخرق ضمانات الأمان التي يوفرها "صندوق حماية التطبيقات". يتطلب الوصول إلى واجهة ADB shell وتمكين وضع المطور على...

tf-mythic-azure

Terraforming Mythic This project allows operators to set up multiple Mythic C2 servers in Azure. Optionally, Azure CDN redirectors can be created as well. The idea is that you are able to create multiple "projects" that you can manage from this Terraform code. This way, operators can manage the...

binaryalert

BinaryAlert: Serverless, Real-Time & Retroactive Malware Detection .. image:: https://travis-ci.org/airbnb/binaryalert.svg?branch=master :target: https://travis-ci.org/airbnb/binaryalert :alt: Build Status .. image:: https://coveralls.io/repos/github/airbnb/binaryalert/badge.svg?branch=master...

iac-scan-runner

IaC Scan Runner Service that scans your Infrastructure as Code for common vulnerabilities. Aspect| Information ---|--- Tool name| IaC Scan Runner Docker image| xscanner/runner PyPI package| iac-scan-runner Documentation| docs Contact us| [email protected] Table of Contents Description Runnin...

iac-scan-runner

IaC Scan Runner خدمة تقوم بفحص البنية التحتية كرمز Infrastructure as Code لديك بحثًا عن الثغرات الشائعة. الجانب| المعلومات ---|--- اسم الأداة| IaC Scan Runner صورة Docker| xscanner/runner حزمة PyPI| iac-scan-runner التوثيق| docs اتصل بنا| [email protected] Table of Contents الوصف التشغيل...

cfn_nag

Contexte L'outil cfn-nag recherche des motifs dans les modèles CloudFormation qui peuvent indiquer une infrastructure non sécurisée. En gros, il recherche : Les règles IAM trop permissives caractères génériques Les règles de groupe de sécurité trop permissives caractères génériques Les journaux...

jboss-autopwn

jboss-autopwn JBoss Autopwn as featured at BlackHat Europe 2010 - this version incorporates CVE-2010-0738 the JBoss authentication bypass VERB manipulation vulnerability as discovered by Minded Security C. Papathanasiou 2010 INTRODUCTION This JBoss script deploys a JSP shell on the target JBoss A...

pacbot

مقدمة Policy as Code Bot PacBot هو منصة للمراقبة المستمرة للامتثال، وإعداد التقارير حول الامتثال، والأتمتة الأمنية للسحابة. في PacBot، يتم تنفيذ سياسات الأمن والامتثال كرمز. يتم تقييم جميع الموارد التي يكتشفها PacBot مقابل هذه السياسات لقياس مدى مطابقتها. يوفر إطار الإصلاح التلقائي في PacBot القد...