waf-bypass

WAF Bypass Tool WAF Bypass Tool is an open source tool to analyze the security of any WAF for False Positives and False Negatives using predefined and customizable payloads. Check your WAF before an attacker does. WAF Bypass Tool is developed by Nemesida WAF team with the participation of...

hacker-container

Hacker Container Container with all the list of useful tools/commands while hacking Kubernetes Clusters. Read more about it in the blogpost https://blog.madhuakula.com/hacker-container-for-kubernetes-security-assessments-7d1522e96073 List of the tools/commands/utilities available in container are...

crAPI

crAPI c ompletely r idiculous API crAPI will help you to understand the ten most critical API security risks. crAPI is vulnerable by design, but you'll be able to safely run it to educate/train yourself. crAPI is modern, built on top of a microservices architecture. When time has come to buy your...

Malcolm

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

packj

Packj flags malicious/risky open-source packages Packj pronounced package is a tool to help to mitigate software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and...

dirtypipe-ebpf_detection

dirtypipe-ebpfdetection -- Dirtypipe detection tool This program was made to detect Dirty Pipe exploitation attempts thanks to eBPF. It also monitors nonvulnerable kernels and docker containers. 🛫 If you want more details on how it works please read the blog post ! 🛬 How does it works? Default...

mailcow-dockerized

mailcow: dockerized - 🐮 + 🐋 = 💕 Want to support mailcow? Please consider a support contract with Servercow to support further development. We support you while you support us. : You can also get a SAL which is a one-time payment with no liabilities or returning fees. Or just spread the word: moo...

vulhub

Vulhub is an open-source collection of pre-built, ready-to-use vulnerable Docker environments. With just one command you can launch a vulnerable environment for security research, learning, or demonstration, no prior Docker experience required. 中文版本Chinese version Quick Start Install Docker examp...

vulhub

Vulhub 是一个开源的、即开即用的漏洞靶场环境集合。无需 Docker 基础，只需一条命令即可快速启动用于安全研究、学习或演示的漏洞环境。 快速开始 安装 Docker （以 Ubuntu 24.04 为例）： curl -s https://get.docker.com/ | sh systemctl start docker 其他操作系统请参考 Docker 官方文档。 虽然所有 Vulhub 环境都基于 Docker compose 制作，但你不再需要安装独立的 docker-compose，而是使用 Docker 自带的 compose 命令来启动 Vulhub 环境。...

the-bastion

🔒 The Bastion Overview Bastions are a cluster of machines used as the unique entry point by operational teams such as sysadmins, developers, database admins, ... to securely connect to devices servers, virtual machines, cloud instances, network equipment, ..., usually using ssh. The Bastion...

rekono

Automate the recon, keep your time for the part that actually needs a hacker Think about how an assessment really starts. You gather public information about the target. You discover its hosts, enumerate their ports and identify the services behind them. Then you run a more specific tool against...

ssj

SSJ - Your everyday Linux distribution gone Super Saiyan. Introduction SSJ is a silly little script that makes use of Docker installed on your everyday Linux distribution Ubuntu, Debian, etc. and magically arms it with hundreds of penetration testing and forensic tools. Technical Details SSJ pull...

ssj

SSJ - 让你的日常 Linux 发行版变身超级赛亚人。 简介 SSJ 是一个有趣的小脚本，它利用你日常 Linux 发行版（Ubuntu、Debian 等）上安装的 Docker，神奇地为其配备数百种渗透测试和取证工具。 技术细节 SSJ 拉取一个使用 Kali Linux 基础镜像的 Docker 镜像 kalilinux/kali-last-release，并在其上安装了 kali-linux-default 元包。它使用 kali.download/kali 镜像源和 kali-last-snapshot 分支。借助 SSJ，你可以在日常 Linux 发行版上的容器内运行 GU...

CVE-2021-41773

CVE-2021-41773 CVE-2021-41773 POC with Docker Configuration To customize the httpd.conf file, change line 251 in the section from Require all denied to Require all granted. AllowOverride none Require all granted Create a Dockerfile in your project FROM httpd:2.4.49 COPY ./httpd.conf...

csaf

The Cyber Security Awareness Framework CSAF is a structured approach aimed at enhancing cybersecurity awareness and understanding among individuals, organizations, and communities. It provides guidance for the development of effective cybersecurity awareness programs, covering key areas such as...

gtunnel

Documentation can be found at: https://hotnops.gitbook.io/gtunnel/...

BugBountyScanner

BugBountyScanner A Bash script and Docker image for Bug Bounty reconnaissance, intended for headless use. Low on resources, high on information output. Helpful? BugBountyScanner helped you net a bounty? Description ⚠ Note: Using the script over a VPN is highly recommended. It's recommended to run...

motionEye-RCE-through-config-parameter

RCE en MotionEye mediante bypass de validación del lado del cliente Resumen Durante las pruebas de seguridad de una instancia de MotionEye ejecutándose en Docker, se observó que la validación del lado del cliente dentro de la interfaz web puede omitirse. Esto permite enviar entradas arbitrarias,...

Viper

Getting-Started · Documentation VIPER is a powerful and flexible red team platform. It integrates the core tools and functionalities required for adversary simulation and red team operations, assisting you in efficiently completing cybersecurity assessment tasks. User-Friendly Interface Provides ...

Docker-Escape-Miner

Using a published Docker exploit to gain root access and run a bitcoin mining script This uses two open source libraries: nightminer by @ricmoo for python bitcoin mining RunC-CVE-2019-5736 by @twistlock for the docker escape System Requirements This was tested on Kali Linux, with Docker version...