AA Discord Audit

aa-discord-audit Reconciliation audit for Alliance Auth's Discord integration. Compares the actual role assignments in the configured Discord guild against the state expressed in Alliance Auth Groups + State per user and closes the gap through which moderators can hand-assign AA-named roles to...

jdam

jdam - Structure-aware JSON fuzzing jdam is a Radamsa inspired tool for fuzzing arbitrary JSON objects in a structure-aware fashion, which ensures that fuzzing results will always be valid JSON. Many existing fuzzing tools will blindly alter the input and will often cause the result to be invalid...

subfinder

Fast passive subdomain enumeration tool. Features • Install • Usage • API Setup • Library • Join Discord subfinder is a subdomain discovery tool that returns valid subdomains for websites, using passive online sources. It has a simple, modular architecture and is optimized for speed. subfinder is...

sdk

@cosignet/sdk Thin, zero-dependency TypeScript client for Cosignet — human-in-the-loop approval for high-risk AI-agent actions, with payload-bound passkey signatures. Put a human in the loop before a dangerous action runs: pause it, get an explicit passkey approval from a person Face ID / Touch I...

foolav

foolav Executable compiled with this code is useful during penetration tests where there is a need to execute some payload meterpreter maybe? while being certain that it will not be detected by antivirus software. The only requirement is to be able to upload two files: binary executable and paylo...

awspwn

AWSPwn - AWS attack-path automation Enumerate an account's IA...

rpi-hunter

rpi-hunter Automate discovering and dropping payloads on LAN Raspberry Pi's via ssh Or, the honest title: Automating sshpass for command delivery. Rpi-hunter is useful when there are multiple Raspberry Pi's on your LAN with default or known credentials, in order to automate sending...

roca

ROCA detection tool This tool is related to ACM CCS 2017 conference paper 124 Return of the Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli. It enables you to test public RSA keys for a presence of the described vulnerability. Update 4.11.2017 : Python 2.7, 3.4+ supported...

xcat

XCat XCat is a command line tool to exploit and investigate blind XPath injection vulnerabilities. For a complete reference read the documentation here: https://xcat.readthedocs.io/en/latest/ It supports an large number of features: Auto-selects injections run xcat injections for a list Detects t...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...

flan

Flan Scan is a lightweight network vulnerability scanner. With Flan Scan you can easily find open ports on your network, identify services and their version, and get a list of relevant CVEs affecting your network. Flan Scan is a wrapper over Nmap and the vulners script which turns Nmap into a...

Arecibo

Arecibo Endpoint for Out-of-Band Exfiltration DNS & HTTP Authors Juan Manuel Fernández @TheXC3LL & Pablo Martinez @Xassiz DNS Exfiltration Create a new token: root@kitploit: curl localhost:5000/generatedns "htoken": "c008b5dd22817c50441522f917c66743" Now you can use this identificative token to d...

pi-hole

Network-wide ad blocking via your own Linux hardware The Pi-hole® is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software. Easy-to-install : our dialogs walk you through the simple installation process in less than ten minutes Resolute :...

filebuster

Filebuster An extremely fast and flexible web fuzzer What is it? Filebuster is a HTTP fuzzer / content discovery script with loads of features and built to be easy to use and fast! It uses one of the fastest HTTP classes in the world of PERL - Furl::HTTP. Also the thread modelling is optimized to...

pentest-machine

pentest-machine Automates some pentesting work via an nmap XML file. As soon as each command finishes it writes its output to the terminal and the files in output-by-service/ and output-by-host/. Runs fast-returning commands first. Please send me protocols/commands/options that you would like to...

ADRecon

Download from https://github.com/adrecon/ADRecon ADRecon: Active Directory Recon ADRecon is a tool which extracts and combines various artefacts as highlighted below out of an AD environment. The information can be presented in a specially formatted Microsoft Excel report that includes summary...

PowerPriv

PowerPriv DESCRIPTION A powershell implementation of PrivExchange by @dirkjan original code found here: https://github.com/dirkjanm/PrivExchange/blob/master/privexchange.py Useful for environments on which you cannot run python-based applications, have user credentials, or do not want to drop fil...

Revoke-Obfuscation

Revoke-Obfuscation v1.0 Introduction Revoke-Obfuscation is a PowerShell v3.0+ compatible PowerShell obfuscation detection framework. Authors Daniel Bohannon @danielhbohannon Lee Holmes @LeeHomes Research Blog Post:...

AppInfoScanner

This project is currently just the tip of the iceberg of the planned project. If you are interested in this project or want to participate in subsequent development or translation work, please send an email to [email protected] stating your skills and requests. AppInfoScanner A mobile Androi...

heapinfo

HeapInfo As pwn lovers, while playing CTF with heap exploitation, we always need a debugger e.g. gdb for tracking memory layout. But we don't really need gdb if we want to see whether the heap layout same as our imagination or not. Hope this small tool helps us exploit easier ;. Why HeapInfo is...