rustls

Rustls is a modern TLS library written in Rust. Status Rustls is used in production at many organizations and projects. We aim to maintain reasonable API surface stability but the API may evolve as we make changes to accommodate new features or performance improvements. We have a roadmap for our...

ketshash

Ketshash A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs. The tool was published as part of the "Pass-The-Hash detection" research - more details on "Pass-The-Hash detection" are in the blog post:...

BabyShark

INTRO This is a basic C2 generic server written in Python and Flask. This code has based ideia to GTRS, which uses Google Translator as a proxy for sending commands to the infected host. The BabyShark project aims to centralize reverse connections with agents, creating a way to centralize several...

CVE-2022-3168-adb-unexpected-reverse-forwards

The reverse tunnel feature in Android Debug Bridge adb was vulnerable as it allowed malicious adb daemons to open connections to arbitrary host/ports and unix domain sockets on the host. Attacker window where the rogue daemon is running: $ ./adbroguedaemon.py Victim window a GCE VM in this exampl...

snitch

snitch a friendlier ss / netstat for humans. inspect network connections with a clean tui or styled tables. install homebrew brew install snitch thanks to @bevanjkay for adding snitch to homebrew-core go go install github.com/karol-broda/snitch@latest nixpkgs nix-env -iA nixpkgs.snitch thanks to...

chisel

Chisel Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. Single executable including both client and server. Written in Go golang. Chisel is mainly useful for passing through firewalls, though it can also be used to provide a secure endpoint into your network. Table of...

tproxy

tproxy English | 简体中文 | 日本語 Why I wrote this tool When I develop backend services and write go-zero, I often need to monitor the network traffic. For example: 1. monitoring gRPC connections, when to connect and when to reconnect 2. monitoring MySQL connection pools, how many connections and figur...

systeminformer

System Informer A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc...

azurelinux

Azure Linux 4 An open-source Linux distribution built and optimized forAzure, with sources derived from Fedora Linux. Azure Linux provides a secured, reliable operating system for virtual machines, containers, and bare-metal platforms. Azure Linux is built on a robust open-source foundation from...

wifi-hacker

Shell Script For Attacking Wireless Connections Using Built-In Kali Tools. Supports All Securities WEP, WPS, WPA, WPA2 !Imagehtt...

zeek-long-connections

Long Connections Zeek normally logs connections at the end of the connection, but this can cause trouble for incident responders in the case of very long lived connections that end up being unknown to defenders until too late. This package provides a new log named connlong which will log...

winevt_logs_analysis

Winevt logs analysis Remote connections Simple script for the purpose of finding remote connections to Windows machine and ideally some public IPs. It checks for some EventIDs regarding remote logins and sessions. You should pip install -r requirements.txt so the script can work and parse some of...

PortForwarder

Windows TCP Port Forwarder A high-performance TCP port forwarder for Windows with optional IP whitelisting and verbose logging capabilities. Features ✅ Forward TCP traffic from a local port to any remote host:port ✅ Optional IP whitelisting for enhanced security ✅ Port 445 / SMB takeover mode...

HacApt

HacApt HacApt is a package manager for hackers built by hackers that focuses on the installation of information security tools. HacApt is built with security in mind so everything is done over Tor connections. First look Here's the first demo video of HacApt Helpful links Homepage User Manual...

CVE-2026-67165

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credential...

gundog

gundog gundog - PowerShell based guided hunting in Microsoft 365 Defender Gundog provides you with guided hunting in Microsoft 365 Defender. Especially if not only for Email and Endpoint Alerts at the moment. Functionality You provide an AlertID you might received via Email notification and gundo...

CVE-2026-67165

The software HCL Connections is vulnerable to a cross-site scripting (XSS) attack (CWE-79). An attacker may leverage this vulnerability to execute arbitrary script code within the browser of an unsuspecting user. The potential impact includes the theft of cookie-based authentication credentials ,...

procrustes

Procrustes A bash script that automates the exfiltration of data over dns in case we have a blind command execution on a server where all outbound connections except DNS are blocked. The script currently supports sh, bash and powershell and is compatible with exec style command execution e.g...

postshell

PostShell PostShell is a post-exploitation shell that includes both a bind and a back connect shell. It creates a fully interactive TTY which allows for job control. The stub size is around 14kb and can be compiled on any Unix like system. ScreenShots Banner and interaction with shell after a...

caronte

caronte$ Caronte is a tool to analyze the network flow during capture the flag events of type attack/defence. It reassembles TCP packets captured in pcap files to rebuild TCP connections, and analyzes each connection to find user-defined patterns. The patterns can be defined as regex or using...