spyse.py

spyse.py Python API wrapper and command-line client for the tools hosted on spyse.com. "Spyse is a developer of complete DAAS Data-As-A-Service solutions for Internet security professionals, corporate and remote system administrators, SSL / TLS encryption certificate providers, data centers and...

badssl.com

Visit badssl.com for a list of test subdomains, including: self-signed.badssl.com expired.badssl.com mixed.badssl.com rc4.badssl.com hsts.badssl.com Server Setup Stock Ubuntu VM, DNS A records for badssl.com. and .badssl.com. pointing to the VM. Testing and development 1. Follow the instructions ...

certdepot

Certificate Depot A free online tool for generating self-signed SSL/TLS certificates in seconds. No signup required. Website: cert-depot.com Features Generate self-signed certificates with RSA 2048/4096 or ECDSA P-256/P-384 keys Download as ZIP PEM key + certificate or PFX PKCS12 Automatic SAN...

ecapture

eCapture 旁观者 Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. English · 汉字 !IMPORTANT Supports Linux on x8664 kernel 4.18+, aarch64 kernel 5.5+, and LoongArch64 loong64 kernel 6.6+. Android supports x8664 and aarch64 with the existing kernel minimums. Requires root...

openssl

Welcome to the OpenSSL Project !openssl logowww.openssl.org !github actions ci badgegithub actions ci OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit for the Transport Layer Security TLS, formerly SSL, Datagram TLS DTLS, and QUIC protocols. The protocol implementations ar...

nuclei-templates

Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the nuclei scanner which powers the actual scanning engine. This...

VPNPivot

VPN Pivot: Sometime we do external penetration testing and when we compromise the remote target we would like to explore the internal network behind and getting such compromise like owning Active directory, accessing shared files, conducting MITM attacks ... etc. There are many techniques around...

sslsplit

SSLsplit - transparent SSL/TLS interception https://www.roe.ch/SSLsplit Overview SSLsplit is a tool for man-in-the-middle attacks against SSL/TLS encrypted network connections. It is intended to be useful for network forensics, application security analysis and penetration testing. SSLsplit is...

shodan

Shodan Dorks by twitter.com/lothos612 Feel free to make suggestions Shodan Dorks Basic Shodan Filters city: Find devices in a particular city. city:"Bangalore" country: Find devices in a particular country. country:"IN" geo: Find devices by giving geographical coordinates...

WAF_buster

WAFbuster Disrupt WAF by abusing SSL/TLS Ciphers About WAFbuster This tool was created to Analyze the ciphers that are supported by the Web application firewall being used at the web server end.Reference:https://0x09al.github.io/waf/bypass/ssl/2018/07/02/web-application-firewall-bypass.html.It...

second-order

Second Order Scans web applications for second-order subdomain takeover by crawling the app, and collecting URLs and other data that match certain rules, or respond in a certain way. Installation From binary Download a prebuilt binary from the releases page and unzip it. From source Go version 1....

CRIME-poc

CRIME-poc CRIME attack : a compression oracle attacks CVE-2012-4929 discovered by Juliano Rizzo and Thai Duong; In a compression oracle attack the use of adaptive data compression on a mixture of chosen plaintext and unknown plaintext can result in content-sensitive changes in the length of the...

MITM_Intercept

MITMIntercept A little bit less hackish way to intercept and modify non-HTTP protocols through Burp and others with SSL and TLS interception support. This tool is for researchers and applicative penetration testers that perform thick clients security assesments. An improved version of the fantast...

BDFProxy

New version of BDFProxy is out! Only to sponsors! Get access here: https://github.com/sponsors/secretsquirrel BLOG: http://secureallthethings.blogspot.com/2017/08/closing-door-end-of-backdoor-factory.html The Backdoor Factory Proxy BDFProxy v0.3.8 For security professionals and researchers only...

heartbleed

HEARTBLEED : OpenSSL TLS HEARTBLEED VULNERABILITY OpenSSL TLS Heartbeat Extension - Memory Disclosure - Multiple SSL/TLS versions vulnerability scanner and exploit need: sudo apt-get install nmap lolcat java sudo apt install default-jre default-jdk...

bypass-url-parser

Bypass Url Parser Tool that tests MANY url bypasses to reach a 40X protected page. If you wonder why this code is nothing but a dirty curl wrapper, here's why: Most of the python requests do url/path/parameter encoding/decoding, and I hate this. If I submit raw chars, I want raw chars to be sent...

CVE-2022-21668-Pipenv-RCE-vulnerability

CVE-2022-21668-Pipenv-RCE-vulnerability 1. Introduction In this document the Pipenv vulnerabilityCVE-2022-21668 is discussed in detail. The following sections cover the bug code in pipenv/utils.py file which opens up the door for various RCE attacks and also about the recent fix which validates...

CVE-2014-0346

CVE-2014-0160 Heartbleed Test Script This script checks for the infamous Heartbleed vulnerability CVE-2014-0160 in SSL/TLS servers. 📜 Credits Based on the original script by Jared Stafford [email protected] Modified and updated by Songül Kızılay for educational and research purposes ⚠️...

SSLPatch

SSL Patch CVE-2014-1266 Copyright c 2014 Linus Yang Introduction CVE-2014-1266 , or known as "goto fail SSL verification exploit", is a very serious SSL/TLS vulnerability of iOS and OS X. Apple issues iOS 6.1.6 and 7.0.6 to fix this problem, but ignores some users who can't or just don't want to...

OpenSSL-1_0_1g_CVE-2015-3194

OpenSSL 1.0.1g 7 Apr 2014 Copyright c 1998-2011 The OpenSSL Project Copyright c 1995-1998 Eric A. Young, Tim J. Hudson All rights reserved. DESCRIPTION The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the...