cygor

Cygor General Overview Cygor is a modular asset discovery framework that brings scanning, parsing, and service enumeration together in one workflow. It replaces the patchwork of separate tools with an automated process that handles discovery, enrichment, and targeted enumeration seamlessly —...

EasyEASM

EasyEASM Zero-dollar attack surface management tool featured at Black Hat Arsenal 2023 and Recon Village @ DEF CON 2023. Description Easy EASM is just that... the easiest to set-up tool to give your organization visibility into its external facing assets. The industry is dominated by $30k vendors...

tugarecon

TugaRecon TugaRecon is an advanced reconnaissance and intelligence framework that goes beyond enumeration. It observes, interprets, remembers, and reacts — transforming subdomains into architectural intelligence. 🧭 Philosophy TugaRecon is inspired by Portuguese explorers. During the 15th and 16th...

CVE-2018-3760

CVE-2018-3760 Rails Asset Pipeline Directory Traversal Vulnerability Found by Orange Tsai Note : By default, Rails apps running in production mode are not vulnerable to this exploit. Exploit: curl -v...

NetAlertX

NetAlertX - Network Visibility & Asset Intelligence Framework !mainmain 📷 Click for more screenshots !Main screenmain| !devicedetails 1devicedetails| !Screen networknetwork ---|---|--- !presencepresence| !maintenancemaintenance| !settingssettings !synchubsynchub| !report1report1|...

cloudtoolkit

CloudToolKit English | 简体中文 Multi-cloud defensive validation toolkit for CSPM / CNAPP detection, telemetry, and investigation workflows in authorized environments. CloudToolKit gives security teams a practical way to verify whether cloud controls are discoverable, detectable, alertable, and...

SecurityManageFramwork

SecurityManageFramwork-SeMF README English | 中文 Introduction SEMF is a security management platform for enterprise intranet, which includes functions of asset management, vulnerability management, account management, knowledge base management and security scanning automation. It can be used for...

bulwark

An organizational asset and vulnerability management tool, with Jira integration, designed for generating application security reports. Features Multi-client Vulnerability Management Security Report Generation Jira Integration Team-based Roles Authorization API Key & Management Email Integration...

sightline

Sightline Geospatial infrastructure intelligence platform for discovering and analyzing physical-world assets using OpenStreetMap data. Overview Sightline enables searching, monitoring, and analyzing real-world infrastructure including: Telecommunications towers and data centers Power plants,...

AttackSurfaceManagement

ABOUT: Discover the attack surface and prioritize risks with our continuous Attack Surface Management ASM platform - Sn1per Professional. For more information, go to https://sn1persecurity.com. FEATURES: Attack Surface Discovery Easily discover the attack surface IPs, domain names, open ports, HT...

Awesome-FOFA

Awesome-FOFA Library 📒 中文 README Get Started with FOFA A Beginner’s Guide How to Get Free F-point from FOFA? FOFA and AI Next-Generation Attack Surface Inventory: Free Trial Available! Basic scenario How to use FOFA to discover free LLM resources? Elevating FOFA Search Efficiency through Novel...

gowitness

gowitness A golang, web screenshot utility using Chrome Headless. introduction gowitness is a website screenshot utility written in Golang, that uses Chrome Headless to generate screenshots of web interfaces using the command line, with a handy report viewer to process results. Both Linux and mac...

hakrawler

Hakrawler Fast golang web crawler for gathering URLs and JavaScript file locations. This is basically a simple implementation of the awesome Gocolly library. Example usages Single URL: echo https://google.com | hakrawler Multiple URLs: cat urls.txt | hakrawler Timeout for each line of stdin after...

CloudPulse

CloudPulse - AWS Cloud Landscape Search Engine During the reconnaissance phase, an attacker searches for any information about his target to create a profile that will later help him to identify possible ways to get in an organization. CloudPulse is a powerful tool that simplifies and enhances th...

sccmhunter

SCCMHunter SCCMHunter is a post-ex tool built to streamline identifying, profiling, and attacking SCCM related assets in an Active Directory domain. Please checkout the wiki for detailed usage. Please note This tool was developed and tested in a lab environment. Your mileage may vary on...

firefly

Firefly is an advanced black-box fuzzer and not just a standard asset discovery tool. Firefly provides the advantage of testing a target with a large number of built-in checks to detect behaviors in the target. Advantages Hevy use of gorutines and internal hardware for great preformance Built-in...

pacbot

Introduction Policy as Code Bot PacBot is a platform for continuous compliance monitoring, compliance reporting and security automation for the cloud. In PacBot, security and compliance policies are implemented as code. All resources discovered by PacBot are evaluated against these policies to...

AppInfoScanner

语言/Language : 简体中文 | English 该项目目前仅仅是规划项目中的冰山一角，如果您对此项目感兴趣或者想参与后续项目的开发工作或者翻译工作中，请发送邮件至[email protected]说明你的能力和诉求。 AppInfoScanner 一款适用于以HW行动/红队/渗透测试团队为场景的移动端Android、iOS、WEB、H5、静态网站信息收集扫描工具，可以帮助渗透测试工程师、攻击队成员、红队成员快速收集到移动端或者静态WEB站点中关键的资产信息并提供基本的信息输出,如：Title、Domain、CDN、状态信息等。 官网/文档站 :...

frogy2.0

Orbis - Attack Surface Intelligence Full-Spectrum Attack Surface Intelligence Orbis automatically maps your organisation's entire internet-facing attack surface, subdomains, open ports, web applications, cloud infrastructure, TLS certificates, email posture, exposed secrets, login panels, and mor...

frogy2.0

Orbis - 攻撃対象領域インテリジェンス 全スペクトル攻撃対象領域インテリジェンス Orbis は、組織全体のインターネットに面した攻撃対象領域（サブドメイン、開放ポート、Webアプリケーション、クラウドインフラ、TLS証明書、電子メールのセキュリティ状態、公開されたシークレット、ログインパネルなど）を自動的にマッピングし、発見されたすべての資産をスコアリングおよびランク付けすることで、何に最初に焦点を当てるべきかを正確に把握できます。 機能 ドメインのリストを渡すだけで、残りは自動で実行します。 ドメインのリストを渡すだけで、残りは自動で実行します。 google.com →...