social-analyzer

Social Analyzer - API, CLI, and Web App for analyzing & finding a person's profile across +1000 social media \ websites. It includes different analysis and detection modules, and you can choose which modules to use during the investigation process. The detection modules utilize a rating mechanism...

reposcanner

Reposcanner Reposcanner is a python script to search through the commit history of Git repositories looking for interesting strings such as API keys, inspired by truffleHog. Installation The python Git module is required python3-git on Debian. Docker root@kitploit: docker build -t reposcanner...

commix

Commix short for command injection exploiter is an open source penetration testing tool, written by Anastasios Stasinopoulos @ancst, that automates the detection and exploitation of command injection vulnerabilities. You can visit the collection of screenshots demonstrating some of the features o...

dracon-utilities

Dracon Utilities Three small Rust CLI tools that look after a Linux development machine: one keeps your git repos committed and backed up, one keeps your disk and memory from falling over, and one stops secrets from landing in your git history. They run as ordinary user-level systemd services — n...

git-remote-pqcrypt

git-remote-pqcrypt root@kitploit: THIS IS AN EXPERIMENTAL PROJECT, there hasnt been a formal security audit. DO NOT rely on this for any critical repositories. git-remote-pqcrypt is an encrypted Git remote helper similar to gcrypt. It stores Git packfiles and repository metadata encrypted at rest...

PT-2026-91832

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames...

ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

snallygaster

snallygaster Finds file leaks and other security problems on HTTP servers. what? snallygaster is a tool that looks for files accessible on web servers that shouldn't be public and can pose a security risk. Typical examples include publicly accessible git repositories, backup files potentially...

GitHacker

GitHacker A multi-threaded .git folder exploitation tool. Reconstructs the target repository in full — source code, commit history, branches, stashes, remotes, tags — even when DirectoryListings is disabled, by brute-forcing well-known refs. The accompanying research site at...

creak

creak Performs some of the most famous MITM attack on target addresses located in a local network. Among these, deny navigation and download capabilities of a target host in the local network performing an ARP poison attack and sending reset TCP packets to every request made to the router. Born a...

kurukshetra

Kurukshetra Kurukshetra is a web framework that’s developed with the aim of being the first open source framework which provides a solid foundation to host reasonably complex secure coding challenges while still providing the ability to efficiently and dynamically execute each challenge on the...

peda

peda PEDA - Python Exploit Development Assistance for GDB Key Features: Enhance the display of gdb: colorize and display disassembly codes, registers, memory information during debugging. Add commands to support debugging and exploit development for a full list of commands use peda help: aslr --...

fi6s

fi6s: Fast IPv6 scanner fi6s is an IPv6 port scanner designed to be fast, aimed at Internet scanning and discovery. This is achieved by sending and processing raw packets asynchronously. The design and goal is pretty similar to Masscan, though it is not as full-featured. Please take note of the...

darling

Darling Darling is a runtime environment for macOS applications. Please note that most GUI applications will not run at the moment. Download Packages for some distributions are available for download under releases. Build Instructions For build instructions, visit Darling Docs. Prefixes Darling h...

DotGit

DotGit 訪問したWebサイトで.gitが露出していないか確認するための拡張機能 特徴 訪問した各サイトに.git/.svn/.hgフォルダが存在するか確認 訪問した各サイトに.envファイルが存在するか確認 訪問した各サイトに.DSStoreファイルが存在するか確認 サイトがオープンソース（github/gitlab）かどうかを確認 サイトにsecurity.txtがあるか確認 フォルダが見つかった場合は通知 見つかった露出サイトの一覧 サイト上にファイルがリストされていなくても、.gitフォルダ全体をzip形式でダウンロード ワンクリックで.git/configを表示...

git-remote-gcrypt

git-remote-gcrypt GNU Privacy Guardで暗号化されたgitリモート :Manual section: 1 説明 git-remote-gcryptは、GnuPGで暗号化されたリポジトリをカスタム形式でプッシュおよびプルするためのgitリモートヘルパーです。このリモートヘルパーは、gcrypt:: で始まるURIを処理します。 サポートされているバックエンドは local、rsync://、sftp:// で、リポジトリはファイルセットとして保存されます。または、任意の...

ofrak

OFRAK OFRAK Open Firmware Reverse Analysis Konsole is a binary analysis and modification platform. OFRAK combines the ability to: Identify and Unpack many binary formats Analyze unpacked binaries with field-tested reverse engineering tools Modify and Repack binaries with powerful patching...

Exploits + Shellcode + GHDB

The Exploit Database Git リポジトリ これは、Offensive Security が後援するプロジェクトである The Exploit Database の公式リポジトリです。 私たちのリポジトリは以下の通りです: エクスプロイト & シェルコード: gitlab.com/exploit-database/exploitdb バイナリエクスプロイト: gitlab.com/exploit-database/exploitdb-bin-sploits ペーパー: gitlab.com/exploit-database/exploitdb-papers The...

truegaze

truegaze A static analysis tool for Android and iOS applications focusing on security issues outside the source code such as resource strings, third party libraries and configuration files. Requirements Python 3 is required and you can find all required modules in the requirements.txt file. Only...