bopscrk

bopscrk Generate smart and powerful wordlists for targeted attacks Explore the docs » View Demo · Report Bug · Request Feature Table of contents 1. About the Project What's new Built with 2. Getting started Installation Run interactive mode 3. Usage How it works Tips Advanced usage Lyricpass 4...

pivotnacci

pivotnacci Pivot into the internal network by deploying HTTP agents. Pivotnacci allows you to create a socks server which communicates with HTTP agents. The architecture looks like the following: This tool was inspired by the great reGeorg. However, it includes some improvements: Support for...

pyOneNote

pyOneNote pyOneNote is a lightweight python library to read OneNote files. The main goal of this parser is to allow cybersecurity analyst to extract useful information from OneNote files. Installing the parser Installing the latest development pip install -U...

pyc2

pyc2 simple c2 written in python2 to demonstrate security concepts. use icmp echo requests and replies to trade base64 encoded commands and replies. Video explaining some of the security concepts and implementation decisions: https://www.youtube.com/watch?v=DHrEn7oK9vQ requires scapy pip install...

chronix

Chronix Self-hosted collaborative workspace for pentesters and red team operators. Captures notes, commands, outputs, and operational context during security engagements. Quick Start Install pipx install git+https://github.com/IceCubeSandwich/chronix Initialize creates account and session secret...

mi-x

Am I Exploitable? Author: 2022 - Now, Rezilion Description: Vulnerabilities validation Development: January 2022 - Now Documentation: See website, README Introduction Description ‘Am I Exploitable?’ is a python open source project that comes to meet the need of validating if your system is...

BADministration

BADministration What is BADministration? BADministration is a tool which interfaces with management or administration applications from an offensive standpoint. It attempts to provide offsec personnel a tool with the ability to identify and leverage these non-technical vulnerabilities. As always:...

CVE-2024-6387-exploit

SSH Vulnerability Scanner The SSH Vulnerability Scanner is a Python script that uses Nmap to scan a list of domains for vulnerable SSH versions. It checks multiple ports for SSH services and identifies versions that are known to have security vulnerabilities. Features Scans multiple domains from ...

copy-fail-CVE-2026-31431-pythonlower3.10

copy-fail-CVE-2026-31431-python3.10 python3.10 and below do not have os.splice, so I made a version that works on versions below 3.10 as well Based on https://github.com/theori-io/copy-fail-CVE-2026-31431...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

python-patrol

Python Patrol Scan for python installations on macOS, and run CVE-2015-20107.py script to report if patching is needed Several of these scripts need Full Disk Access permissions and must be run as root so it can scan the entire macOS filesystem except the areas restricted by macOS Make sure to ru...

nodexp

NodeXP - Detection and Exploitation Tool for Node.js Services! NodeXP is an intergrated tool, written in Python 2.7, capable of detecting possible vulnerabilities on Node.js services as well as exploiting them in an automated way, based on ServerSideJavascriptInjection attack! Getting Started -...

MikroRoot

MikroRoot Automated version of CVE-2018-14847. It will scrape shodan for vulnerable host and then try to exploit them. How to use Note that this script will NOT run with Python2.x. Use only Python 3+ MikroRoot: python3 MikroRoot.py -k SHODANKEY -p page count User: ncss Pass: ncss!@2018 IP: 1.2.3....

Centreon-CVE-2015-1560_1561

Centreon-CVE-2015-15601561 A little Python tool for exploiting CVE-2015-1560 and CVE-2015-1561 on Centreon = 2.5.4 Quick'n'dirty. Real dirty...

autoresponder

AutoResponder Carbon Black Response IR tool for hunting threats in an environment What is it? AutoResponder is a tool aimed to help people to carry out their Incident Response tasks WITH the help of Carbon Black Response's awesome capabilities and WITHOUT much bothering IT/System/Network Teams Wh...

Polkit-CVE-2021-4034-HLP

Polkit-CVE-2021-4034-HLP Polkit CVE-2021-4034 exploitation in High-Level Programming Language Build make LHOST=ip.or.domain.tld LPORT=8000 Usage Open TCP port listener, example with ncat on loopback ncat -vl 127.0.0.1 8000 Run exploit php $ARCHexploit.php python $ARCHexploit.py...

aws-inventory

Introduction This is a tool that tries to discover all AWS resources created in an account. AWS has many products a.k.a. services with new ones constantly being added and existing ones expanded with new features. The ecosystem allows users to piece together many different services to form a...

Text4ShellPayloads

Text4ShellPayloads This project includes a python script which generates malicious commands leveraging CVE-2022-42889 vulnerability The vulnerable server was set up according to the guidance of "Karthik U J" by following the step in https://github.com/karthikuj/cve-2022-42889-text4shell-docker...

zaphoxx-coldfusion

zaphoxx-coldfusion coldfusion exploit based on https://cvedetails.com/cve/CVE-2009-2265/ The main reason I setup a python script for this particular cve was that the metasploit version of the same did not work for me when I tried to solve the HTB machine Arctic. Also it was nice to get some littl...

lapith

Lapith Lapith is a Python GUI tool that presents Nessus results in a format more useful for penetration testers. Results can be viewed by issue as opposed to by host. It is therefore easier to report all the hosts affected by an issue, rather than all of the issues affecting the host. Multiple...