Hawk

Hawk Silently intercept SSH and SU credentials in real-time Hawk monitors sshd and su processes, extracting passwords from memory via ptrace without modifying target processes. Zero writes. Pure read-only credential harvesting. Demo How It Works Hawk leverages Linux's /proc filesystem to discover...

ClipGuard

ClipGuard Real-time detection of ClickFix clipboard injection attacks on Windows. ClipGuard monitors clipboard activity and intercepts suspicious paste operations before they can execute — specifically targeting the ClickFix technique where fake verification pages trick users into pasting malicio...

htcap

HTCAP htcap is a web application scanner able to crawl single page application SPA recursively by intercepting ajax calls and DOM changes. KEY FEATURES Recursive DOM crawling engine Discovers ajax/fetch/jsonp/websocket requests Supports cookies, proxy, custom headers, http auth and more Heuristic...

MITM_Intercept

MITMIntercept A little bit less hackish way to intercept and modify non-HTTP protocols through Burp and others with SSL and TLS interception support. This tool is for researchers and applicative penetration testers that perform thick clients security assesments. An improved version of the fantast...

ratched

ratched ratched is a Man-in-the-Middle MitM proxy that specifically intercepts TLS connections. It is intended to be used in conjunction with the Linux iptabes REDIRECT target; all connections that should be intercepted can be redirected to the local ratched port. Through the SOORIGINALDST sockop...

sage

Sage Safety for Agents — Agent Detection & Response for AI coding assistants Sage is a lightweight security layer that protects AI agents from executing dangerous actions. It intercepts tool calls — shell commands, URL fetches, file writes — and checks them against multiple threat detection layer...

goBox

goBox GO sandbox to run untrusted code. goBox uses Ptrace to hook into READ syscalls, giving you the option to accept or deny syscalls before they are executed. Usage Usage of ./gobox: gobox FLAGS command flags: -h Print Usage. -n value A glob pattern for automatically blocking file reads. -y val...

androguard

Androguard Androguard: Reverse engineering and pentesting for Android applications Androguard 5 is a Python toolkit for Android reverse engineering: open an APK, inspect the manifest and DEX, disassemble or decompile code, hunt references and vulnerabilities, and optionally patch or analyze nativ...

Flutter-Reverse-Engineering-Labs

Flutter Reverse Engineering Labs This repository contains a series of progressive challenges designed to introduce the reverse engineering of Flutter applications. Since there aren't many blog posts or tutorials that explain Flutter reversing in detail, I decided to create this repo as a hands-on...

mitm-proxy

Go MITM Proxy A lightweight, developer-friendly Man‑in‑the‑Middle MITM HTTP/HTTPS proxy written in Go. It supports HTTP/1.1 and HTTP/2, CONNECT tunneling, WebSocket tunneling ws/wss, on‑disk response caching with flexible filters, and live config reloading. Badges Admin Dashboard Preview Overview...

Preferred-Network-List-Sniffer

Preferred Network List Sniffer - PNLS Preferred Network List Sniffer PNLS is a Red Team Wi-Fi auditing tool with a simple web interface that is capable of intercepting SSIDs^1 from the device's preferred network list PNL^2. This is achieved by sniffing out Probe Requests in the nearby vicinity,...

The vulnerability of the Enlogic SCADA system’s virtual controller “ENTEK”, related to the transmission of data in an open manner, allows a intruder to gain unauthorized access to protected information by intercepting network traffic.

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to the transmission of data in an open manner. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information by intercepting network traffic...

ferret

Ferret The collaborative MITM proxy for security testers. Capture HTTP traffic, annotate requests with AI, run hunt sessions, replay traffic, and track findings from one interface. Quick start · Features · Screenshots · Configuration · Security · Contributing Quick start Install git clone...

SocialFish

SocialFish v3.0 Modern Dynamic Phishing Toolkit SocialFish v3.0 brings powerful new features for cloning modern login pages, capturing cookies, and intercepting 2FA codes with a live operator panel. 🆕 What's New in v3.0 Playwright Browser Automation — Clone modern JS-heavy login pages Full Cookie...

BestEdrOfTheMarket

Best EDR Of The Market BEOTM V3 🐲🏴‍☠️ Best Edr Of The Market is an open-source lab designed to implement and understand, from a low-level perspective, the detection methods used by Endpoints Detection & Response security products and their workarounds. These techniques are mainly based on the...

qark

Quick Android Review Kit This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the...

CVE-2023-35636

CVE-2023-35636 Microsoft Outlook Information Disclosure Vulnerability leak password hash - Expect Script POC CVE-2023-35636 an exploit of the calendar sharing function in Microsoft Outlook, whereby adding two headers to an email directs Outlook to share content and contact a designated machine...

phantom-keylogger

Phantom Keylogger 🎯 MISSION BRIEF Phantom Keylogger is an advanced, stealth-enabled keystroke and visual intelligence gathering system. Built with operational security as the primary objective, this tool provides persistent surveillance capabilities while maintaining minimal footprint on target...

Hermes-Proxy

Hermes Proxy Hermes Proxy is a desktop HTTP/HTTPS interception app built with Electron and Vite. It captures requests/responses, lets you replay requests, and export/import HAR files. Features Live traffic table with request/response details Replay requests with editable URL/headers Export all...

reFlutter

Read more on the blog: https://swarm.ptsecurity.com/fork-bomb-for-flutter/ This framework helps with Flutter apps reverse engineering using the patched version of the Flutter library which is already compiled and ready for app repacking. This library has snapshot deserialization process modified ...