metabigor

Metabigor - OSINT power without API key hassle What is Metabigor? Metabigor maps a target's infrastructure without asking you to register for a single API key. Network ranges, certificates, related domains, exposed ports, CDN vendors, and code leaks - all from free sources, all pipeable into each...

struts-pwn

struts-pwn An exploit for Apache Struts CVE-2017-5638 Usage Testing a single URL. python struts-pwn.py --url 'http://example.com/struts2-showcase/index.action' -c 'id' Testing a list of URLs. python struts-pwn.py --list 'urls.txt' -c 'id' Checking if the vulnerability exists against a single URL...

lulzbuster

Description A multithreaded, very fast and smart HTTPS directory and file bruteforcer written in C on top of libcurl. Given a target URL and a wordlist, it enumerates valid paths by firing concurrent HTTP requests and reporting back the responses that look like real hits i.e. status codes the use...

git-dumper

git-dumper A tool to dump a git repository from a website. Install This can be installed easily with pip: root@kitploit: pip install git-dumper Usage root@kitploit: usage: git-dumper options URL DIR Dump a git repository from a website. positional arguments: URL url DIR output directory optional...

mongoaudit

mongoaudit is a CLI tool for auditing MongoDB servers, detecting poor security settings and performing automated penetration testing. Installing Clone this repository and run the setup: root@kitploit: git clone https://github.com/stampery/mongoaudit.git cd mongoaudit python setup.py install...

bfac

BFAC Advanced Backup-File Artifacts Testing for Web-Applications BFAC Backup File Artifacts Checker is an automated tool that checks for backup artifacts that may disclose the web-application's source code. The artifacts can also lead to leakage of sensitive information, such as passwords,...

airgeddon

airgeddon This is a multi-use bash script for Linux systems to audit wireless networks. All the needed info about how to "install | use | enjoy" airgeddon is present at GitHub's Wiki. I. Content & Features Home Features Screenshots Wallpapers II. Requirements Requirements Compatibility Cards and...

evillimiter-windows

Evil Limiter for Windows A tool to limit the bandwidth upload/download of devices connected to your network without physical or administrative access. evillimiter employs ARP spoofing and traffic shaping to throttle the bandwidth of hosts on the network. This is explained in detail below. This to...

nuclei-templates

Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the which powers the actual scanning engine. This repository stores a...

aiodnsbrute

Async DNS Brute A Python 3.5+ tool that uses asyncio to brute force domain names asynchronously. Speed It's fast. Benchmarks on small VPS hosts put around 100k DNS resoultions at 1.5-2mins. An amazon M3 box was used to make 1 mil requests in just over 3 minutes. Your mileage may vary. It's probab...

ysoserial.net

A proof-of-concept tool for generating payloads that exploit unsafe .NET object deserialization. Description ysoserial.net is a collection of utilities and property-oriented programming "gadget chains" discovered in common .NET libraries that can, under the right conditions, exploit .NET...

TheFatRat

TheFatRat A Massive Exploiting Tool TheFatRat is an exploiting tool which compiles a malware with famous payload, and then the compiled maware can be executed on Linux , Windows , Mac and Android. Provides An Easy way to create Backdoors and Payload which can bypass most anti-virus...

pastego

pastego Scrape/Parse Pastebin using GO and grammar expression PEG. pastego.png Installation $ go get -u github.com/notdodo/pastego Usage Search keywords are case sensitive pastego -s "password,keygen,PASSWORD" You can use boolean operators to reduce false positive pastego -s "quake && earthquake,...

RPDscan

도구 도구 모음입니다. 모든 도구는 주의해서 사용해야 하며, 사용으로 인해 발생한 손상에 대해 당사는 책임을 지지 않습니다...

goop

goop Google Search Scraper Note: It no longer works. Google team told me it's not a legitimate issue when I reported it to them but now they just silently fixed it. Contents Introduction How it works? Usage Installation Example Legal Introduction goop can perform google searches without being...

godehashed

Godehashed A golang tool that uses the dehashed.com API to search for compromised assets. Results can then be compiled into a CSV for further analysis. Screenshot Dehashed API You must supply the tool an api key. See apikeytemplate.txt for example. Installation To install the tool in CLI run the...

widevine-l3-decryptor

Deprecation Warning This repository used to contain code to circumvent Widevine L3 DRM in Chrome on Windows machines. It's not working anymore as of May 31st 2021, but you can read the reversing writeup. Update Google issued a DMCA takedown request against most forks of this repository. The...

lockphish

Lockphish v2.0 Lockphish it's the first tool 07/04/2020 for phishing attacks on the lock screen, designed to grab Windows credentials, Android PIN and iPhone Passcode using a https link. LockPhish Tutorial: https://www.kalilinux.in/2020/05/lockphish.html Author: The Linux Choice Who deleted his...

CVE-2025-11371

면책 조항 이 프로젝트는 교육 및 연구 목적으로만 게시되었습니다. 명시적인 사전 동의 없이 대상을 공격하기 위해 이 소프트웨어를 사용하는 것은 불법 입니다. 저자는 이 코드 사용으로 인해 발생하는 오용, 손해 또는 법적 결과에 대해 책임을 지지 않습니다. 항상 책임 있는 공개 관행 을 따르고, 소유하거나 사용 권한이 있는 통제된 환경 에서만 테스트하십시오...

CVE-2025-41242

⚠️ 보안 연구 및 법적 면책 조항 📌 이 리포지토리의 목적 이 리포지토리는 교육, 학술 및 승인된 사이버 보안 연구 목적 으로만 엄격히 제공됩니다. 다음 사항에 대한 이해를 지원하기 위한 것입니다: 통제된 환경에서의 보안 취약점 및 익스플로잇 개념 샌드박스 격리 메커니즘과 그 한계 안전한 소프트웨어 설계 및 방어적 보안 관행 🚫 승인된 사용만 허용 이 리포지토리는 명시적 허가가 부여된 환경에서만 사용해야 합니다. 예를 들면 다음과 같습니다: 개인 또는 통제된 가상 머신 Docker 또는 격리된 실험실 환경 승인된 침투 테스트...