mailchecker

MailChecker...

mallory

mallory HTTP/HTTPS proxy over SSH. Installation Local machine: go install github.com/justmao945/mallory/cmd/mallory@latest Remote server: need our old friend sshd Configuration Config file Default path is $HOME/.config/mallory.json, can be set when start program root@kitploit: mallory -config...

DGA

DGA DGA sospechoso de PassiveDNS.cn y 360+VT Sandbox. Índice NCR: Necesita confirmación e ingeniería inversa Enlace| Estado ---|--- 50| DGA benigno de TeleRU, un DGA relacionado con un APK de Android 49| El DGA de MyDoom 48| Un DGA impredecible 39| Hecho Nuevas semillas de Banjori 38| Hecho Nuevo...

dga-collection

DGA Collection A collection of known Domain Generation Algorithms: Torpig ZeusBot Cryptolocker Necurs Symmi Ranbyus Usage For each DGA, the list of domains can be easily generated: root@kitploit: from datetime import date from Necurs import Necurs Compute domains for the current day/period:...

waybackurls

waybackurls Accept line-delimited domains on stdin, fetch known URLs from the Wayback Machine for .domain and output them on stdout. Usage example: root@kitploit: ▶ cat domains.txt | waybackurls urls Install: root@kitploit: ▶ go install github.com/tomnomnom/waybackurls@latest Credit This tool was...

Invoke-DNSteal

Invoke-DNSteal es un exfiltrador de datos DNS simple y personalizable. Esta herramienta te ayuda a exfiltrar datos a través del protocolo DNS sobre UDP y TCP, y te permite controlar el tamaño de las consultas mediante un retardo aleatorio. Además, permite evitar detecciones usando dominios...

bbrecon

This project is no longer maintained and I took the crawling infrastructure offline. The audience was not big enough to justify maintaining it. Bug Bounty Recon bbrecon is a free Recon-as-a-Service for bug bounty hunters and security researchers. The API aims to provide a continuously up-to-date...

festin

FestIN the powered S3 bucket finder and content discover What is FestIn Why Festin Install Using Python Using Docker Full options Usage Configure search domains Concurrency HTTP Crawling configuration Manage results Proxy usage DNS Options Full Text Support Running as a service or watching mode...

blackout-public

ZoomInfo GTM Studio: Pre-Consent Tracking Documentation "You can block the researcher. You can't block the evidence." What Happened On November 25, 2025, ZoomInfo CEO Henry Schuck posted a product demo of GTM Studio on LinkedIn — their AI-powered platform that "identifies person-level website...

hijagger

hijagger - check package registries for hijackable packages This tool checks every maintainer from every package in the NPM and Python Pypi registry for unregistered domains or unregistered MX records on those domains. If a domain is unregistered you can grab the domain and initiate a password...

catphish

CATPHISH Generate similar-looking domains for phishing attacks. Check expired domains and their categorized domain status to evade proxy categorization. Whitelisted domains are perfect for your C2 servers. Perfect for Red Team engagements. Installation root@kitploit: bundle install Current...

catphish

CATPHISH Genera dominios de aspecto similar para ataques de phishing. Verifica dominios expirados y su estado de categorización para evadir la categorización de proxies. Los dominios en lista blanca son perfectos para tus servidores C2. Ideal para compromisos de Red Team. Instalación root@kitploi...

uriDeep

uriDeep Ataques de codificación Unicode con aprendizaje automático. Herramienta basada en machine learning para crear asombrosos dominios falsos usando confusables. Algunos dominios pueden engañar a las políticas IDN Chrome & Firefox. Creé el mejor gran diccionario de confusables usando redes...

moniorg

moniorg Description By looking through CT logs an attacker can gather a lot of information about organization's infrastructure i.e. internal domains,email addresses in a completly passive manner. moniorg leverage certificate transparency logs to monitor for newly issued domains based on...

PentestingEverything

PentestingEverything Una base de conocimiento completa y buscable sobre pruebas de penetración en 23 dominios de seguridad. Sitio web en vivo: pentesting.m14r41.in Sitio web en vivo · PentestingChecklist · Contribuir · Reportar un problema Léelo en línea en pentesting.m14r41.in : completamente...

packj

Packj flags malicious/risky open-source packages Packj pronounced package is a tool to help to mitigate software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and...

antisquat

AntiSquat AntiSquat leverages AI techniques such as natural language processing NLP, large language models ChatGPT and more to empower detection of typosquatting and phishing domains. How to use Clone the project via git clone https://github.com/redhuntlabs/antisquat. Install all dependencies by...

cariddi

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more Coded with 💙 by edoardottt Share on Twitter! Install • Usage • Get Started • Changelog • Contributing • License Installation 📡 Homebrew root@kitploit: brew install cariddi Snap...

dcrawl

dcrawl dcrawl is a simple, but smart, multi-threaded web crawler for randomly gathering huge lists of unique domain names. How it works? dcrawl takes one site URL as input and detects all links in the site's body. Each found link is put into the queue. Successively, each queued link is crawled in...

log4j-CVE-2021-44228-Public-IoCs

Lista pública de IoCs de log4j log4shell CVE-2021-44228 IoCs públicos sobre log4j CVE-2021-44228 log4shell basados en Twitter y otras redes sociales se aceptan pull requests, elimino duplicados automáticamente IPs https://github.com/Sh0ckFR/log4j-CVE-2021-44228-Public-IoCs/raw/main/ips.txt Domini...