RATel

RATel Please do not upload to virustotal ! To prevent RATel from being detected by antivirus, please do not upload the payload to TOTAL VIRUS. Each month I will test myself if the payload gets detected by antivirus. So you’ll have a photo every month to prove RAtel discretion. Description RAT-el ...

faraday

Open Source Vulnerability Manager Security has two difficult tasks: designing smart ways of getting new information, and keeping track of findings to improve remediation efforts. With Faraday, you may focus on discovering vulnerabilities while we help you with the rest. Just use it in your termin...

bing-ip2hosts

Bing-ip2hosts Bing-ip2hosts is a Bing.com web scraper to discover hostnames by IP address. Description Bing-ip2hosts is a Bing.com web scraper that discovers hostnames by IP address. Bing is the flagship Microsoft search engine formerly known as MSN Search and Live Search. It provides a feature...

keimpx

Introduction keimpx is an open source tool, released under the Apache License 2.0. It can be used to quickly check for valid credentials across a network over SMB. Credentials can be: Combination of user / plain-text password. Combination of user / NTLM hash. Combination of user / NTLM logon...

domainhunter

Domain Hunter Authors Joe Vest @joevest & Andrew Chiles @andrewchiles Domain name selection is an important aspect of preparation for penetration tests and especially Red Team engagements. Commonly, domains that were used previously for benign purposes and were properly categorized can be purchas...

CVE-2024-0692-SolarWinds-SEM-RCE

CVE-2024-0692-SolarWinds-SEM-RCE 基于我在渗透测试期间的研究，详见此处 https://www.sprocketsecurity.com/blog/cve-2024-0692-building-the-exploit-that-didnt-exist。...

CICD-Goat-Vapt-Writeup

CICD-Goat VAPT 渗透测试报告 针对 OWASP CICD-Goat 的完整漏洞评估与渗透测试——一个故意设计为存在漏洞的 CI/CD 环境（Jenkins、Gitea、GitLab、CTFd）——端到端映射至 OWASP Top 10 CI/CD 安全风险 。 🧭 本仓库与其他仓库的关系...

htcap

HTCAP htcap is a web application scanner able to crawl single page application SPA recursively by intercepting ajax calls and DOM changes. KEY FEATURES Recursive DOM crawling engine Discovers ajax/fetch/jsonp/websocket requests Supports cookies, proxy, custom headers, http auth and more Heuristic...

pentest-guide

OWASP + Extraに基づくペネトレーションテストガイド このガイドは、ペネトレーションテストプロジェクト中に必要とされる適切なテストケースを求めるペネトレーションテスターを対象としています。OWASP Testing Guide...

nodexp

NodeXP - Detection and Exploitation Tool for Node.js Services! NodeXP is an intergrated tool, written in Python 2.7, capable of detecting possible vulnerabilities on Node.js services as well as exploiting them in an automated way, based on ServerSideJavascriptInjection attack! Getting Started -...

spiderfoot

SpiderFoot is an open source intelligence OSINT automation tool. It integrates with just about every data source available and utilises a range of methods for data analysis, making that data easy to navigate. SpiderFoot has an embedded web-server for providing a clean and intuitive web-based...

hardcidr

hardCIDR Background A Linux Bash script to discover the netblocks, or ranges, in CIDR notation owned by the target organization during the intelligence gathering phase of a penetration test. This information is maintained by the five Regional Internet Registries RIRs: ARIN North America RIPE...

golddigger

Gold Digger Search files for gold Gold Digger is a simple tool used to help quickly discover sensitive information in files recursively. Originally written to assist in rapidly searching files obtained during a penetration test. Installation Gold Digger requires Python3. root@kitploit: virtualenv...

automato

automato.rb automato uses native LDAP libraries to automate the collection and enumeration of various directory objects. This is incredibly useful during an internal penetration test. automato can also conduct password spraying attacks, and identify if a user is a local administrator against any...

recox

Recox v2.0 RecoX is an incredibly versatile and powerful tool that is specifically designed to aid in the identification and classification of vulnerabilities within web applications. The script is able to detect vulnerabilities that are not typically included in the OWASP top ten vulnerabilities...

WordPress-Path-Traversal-CVE-2019-11447

渗透测试报告 WordPress 路径遍历 - CVE-2019-11447 文档信息...

metasploitable-pentest-report

Metasploitable 2 — Informe de Prueba de Penetración Descargo de responsabilidad: Esta prueba de penetración se realizó en un entorno de laboratorio privado y aislado de VMware con fines educativos únicamente. No se accedió a sistemas reales. Todas las direcciones IP han sido anonimizadas. Resumen...

Vuln_Exploitation_MegaQuagga_Pentest

脆弱性の悪用 — MegaQuagga ペネトレーションテストレポート 分析者: Samuel Weiss 組織: 0x2A Security 日付: 2026年4月20日 顧客: MegaQuagga Publishing 対象: www.megaquagga.local 分類: 機密 概要 本プロジェクトは、MegaQuagga Publishing の Web 環境に対して実施された 構造化ペネトレーションテスト を文書化したものです。このエンゲージメントでは、5件の悪用可能な脆弱性が確認され、そのうち2件を連鎖させることで、認証なしのリモートコード実行 RCE...

mtechweek_04

mtechweek04 基于 Metasploit 的渗透测试，针对隔离的 Metasploitable2 实验室虚拟机 —— 通过 DistCC（CVE-2004-2687）远程利用、通过 udev netlink（CVE-2009-1185）权限提升，以及对 vsftpd 2.3.4 后门（CVE-2011-2523）的分析，并端到端验证了防火墙缓解措施。 该仓库记录了在隔离的 QEMU 实验室中针对 Metasploitable2 执行的授权渗透测试，模拟一家私有公司的服务器。本次测试遵循完整的攻击性安全方法论 —— 侦察、利用、权限提升与缓解措施验证 —— 使用 Metasplo...

Hack-The-Box-Nexus-Findings-Report

🛡️ Hack The Box - Nexus 发现报告 📋 概述 本仓库包含针对 Hack The Box 机器 Nexus 的全面渗透测试报告。 🔍 关键发现 Gitea 提交历史中泄露的凭据 - 中危 Krayin CRM 无限制文件上传 CVE-2026-38526 - 高危 Gitea 模板同步目录遍历 - 严重 用户 flag 已捕获：3290dde5fca195ea451632d54d4b60da root flag 已捕获：c25914b5b518500d1c71da5c8331ac9d 🛠️ 使用的框架 PentNote - 自动化文档 -...