cuddlephish

CuddlePhish Weaponized multi-user browser-in-the-middle BitM for penetration testers. This attack can be used to bypass multi-factor authentication on many high-value web applications. It even works for applications that do not use session tokens, and therefore would not be exploitable using...

apidetector

APIDetector is a powerful and efficient tool designed for testing exposed Swagger endpoints in various subdomains with unique smart capabilities to detect false-positives. It's particularly useful for security professionals and developers who are engaged in API testing and vulnerability scanning...

log4j2burpscanner

JUST FOR TESTING，DON'T ATTACK ANYONE JUST FOR TESTING，DON'T ATTACK ANYONE JUST FOR TESTING，DON'T ATTACK ANYONE 交流群 二维码失效请加微信f-f0ng、备注log4j2burpscanner交流 关注主页公众号（only security），回复log4j2burpscanner获取下载地址】 FAQ Frequently Asked Questions how to use? releases download the latest plugin 简体中文|English...

Logsensor

Logsensor A Powerful Sensor Tool to discover login panels, and POST Form SQLi Scanning Features login panel Scanning for multiple hosts Proxy compatibility http, https Login panel scanning are done in multiprocessing so the script is super fast at scanning many urls quick tutorial & screenshots a...

Invoke-CradleCrafter

Invoke-CradleCrafter v1.1 Introduction Invoke-CradleCrafter is a PowerShell v2.0+ compatible PowerShell remote download cradle generator and obfuscator. Background In the Fall of 2016 after releasing Invoke-Obfuscation, I continued updating my spreadsheet of PowerShell remote download cradles...

sn0int

sn0int sn0int pronounced /snoɪnt/ is a semi-automatic OSINT framework and package manager. It's used by IT security professionals, bug bounty hunters, law enforcement agencies and in security awareness trainings to gather intelligence about a given target or about yourself. sn0int is enumerating...

suricata

Suricata Introduction Suricata is a network IDS, IPS and NSM engine developed by the OISF and the Suricata community. Resources Home Page Bug Tracker User Guide Dev Guide Installation Guide User Support Forum Contributing We're happily taking patches and other contributions. Please see our...

CVE-2021-41773

CVE-2021-41773 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 CVE-2021-41773 Info A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document...

Xerror

Xerror Xerror is an automated penetration tool , which will help security professionals and non professionals to automate their pentesting tasks. Xerror will perform all tests and, at the end generate two reports for executives and analysts. Xerror provides GUI easy to use menu driven...

USBArmyKnife

🚀 USB Army Knife v2 is steeping — and its going to be a beast After two years of active development on v1, v2 is planned to turn the USB Army Knife into a full red-team platform in your pocket. A big announcement is coming this autumn but I still wanted to tease: Brand-new web UI — smaller, faste...

linux-malware-detect

Linux Malware Detect LMD Malware scanner for Linux — multi-stage threat detection MD5, SHA-256, HEX, YARA, statistical analysis, ClamAV integration, real-time inotify monitoring, quarantine/clean/restore operations, and multi-channel alerting email, Slack, Telegram, Discord. C 2002-2026, R-fx...

wappalyzer-next

Wappalyzer Next This project is a command line tool and python library that uses the Wappalyzer browser extension and its fingerprints to detect technologies. Other projects that emerged after the discontinuation of the official open-source project are using outdated fingerprints and lack accurac...

kafel

WHAT IS IT? Kafel is a language and library for specifying syscall filtering policies. The policies are compiled into BPF code that can be used with seccomp-filter. This is NOT an official Google product. Usage With verbose error reporting struct sockfprog prog; kafelctxtt ctxt = kafelctxtcreate;...

krakenhashes

KrakenHashes KrakenHashes is a distributed password cracking system designed for security professionals and red teams. The platform coordinates GPU/CPU resources across multiple agents to perform high-speed hash cracking using tools like Hashcat through a secure web interface. Think of KrakenHash...

Pentest-Cheat-Sheet

Pentest Cheat Sheet There are many cheat sheets out there, but this is mine. It's a work in progress right now, and lives as a rought draft that's updated a lot , at times. I started this while I was studying for my OSCP, but it's now evolving to include more practical things that I need as a red...

CVE-2022-24834

Improvement of CVE-2022-24834 public exploit Author Conviso Research Team Description The team at Ricerca Security @RicercaSec discovered and successfully exploited a interesting vulnerability CVE-2022-24834 in the Lua interpreter included with Redis. This vulnerability is a heap overflow in the...

iWant

iWant CLI based decentralized peer to peer file sharing Build Status What is it? A commandline tool for searching and downloading files in LAN network, without any central server. Features Decentralized : There is no central server hosting files. Therefore, no central point of failure Easy...

ChromeAlone

ChromeAlone - A Browser C2 Framework What does this get me? ChromeAlone is a browser implant that can be used in place of conventional implants like Cobalt Strike or Meterpreter. This repo provides a simple build process that will generate a management console, deploy infrastructure, and create a...

osint_toolkit

OSINT Toolkit Warning OSINT Toolkit is not production ready yet. This is an early prototype, that still needs some work to be done. A fullstack web application built for security analysts OSINT Toolkit is a self-hostable, on-demand analysis platform designed for security specialists. It...

dnsglobe

dnsglobe A global DNS propagation checker for your terminal — a Rust TUI that queries 34 public DNS resolvers around the world in parallel, compares their answers, and shows the propagation of your record on a world map. Think dnschecker.org / whatsmydns.net, but in your terminal, with watch mode...