log4j-CVE-2021-44228-Public-IoCs

log4j log4shell CVE-2021-44228 Public IoCs list Public IoCs about log4j CVE-2021-44228 log4shell based on Twitter and others social networks pull requests accepted, I remove duplicates automatically IPs https://github.com/Sh0ckFR/log4j-CVE-2021-44228-Public-IoCs/raw/main/ips.txt Callbacks domains...

ThreatIntelligenceDiscordBot

Threat Intelligence Discord Bot The vx-underground Threat Intelligence Discord Bot gets updates from various clearnet domains, ransomware threat actor domains, and Telegram channels. This bot will check for updates in intervals of 1800 seconds omit Telegram bot, this is gotten in real time. Don't...

Dumb

Dumb - Dumain Bruteforcer A tool to bruteforce dumains! Dumb How DUMB works: Dumb works with a masked dumain for substitution. The dumain can have as many masks as you want as long as you pass the according wordlists. For example: Bruteforcing subdumains: Using the mask DUMB.dumain.com and the...

MOVEit-CVE-2023-34362

MOVEit-CVE-2023-34362 Repository with everything I have tracking the impact of MOVEit CVE-2023-34362 Includes possibly affected organizations and domains utilizing SFTP header and cookie discovery methods. I've also built a news ticker which tracks new stories about MOVEit, available at...

uriDeep

uriDeep Unicode encoding attacks with machine learning. Tool based on machine learning to create amazing fake domains using confusables. Some domains can deceive IDN policies Chrome & Firefox. I created the best big dictionary of confusables using neural networks. It is used in the tool and it ca...

Lumma-Stealer-dllhost-Hollowing-C2-Domains-Payload-Extraction-Analysis

1. Setup.exe – Privacy, Driver & Memory Strings Process Hacker memory analysis of the setup.exe dropper reveals that Lumma Stealer targets privacy settings, installs drivers, and manages memory. Key Strings Observed: Privacy Camera – Attempts to access or disable camera privacy settings. Privacy...

domains-from-csp

domains-from-csp A Python script to parse domain names from CSP header A script to extract domain names from Content Security PolicyCSP headers The output is print to stdout for now Demo Screenshots 3rd party package dependency requests click Setup Clone this repo $ git clone...

ct-exposer

Discover sub-domains by searching through Certificate Transparency logs What is CT? Certificate Transparency CT is an experimental IETF standard. The goal of it was to allow the public to audit which certificates were created by Certificate Authorities CA. TLS has a weakness that comes from the...

PentestingEverything

PentestingEverything A complete, searchable penetration-testing knowledge base across 23 security domains. Live website: pentesting.m14r41.in Live Website · PentestingChecklist · Contribute · Report an Issue Read it online at pentesting.m14r41.in : fully searchable, with 108 documentation pages,...

blackout-public

ZoomInfo GTM Studio: Pre-Consent Tracking Documentation "You can block the researcher. You can't block the evidence." What Happened On November 25, 2025, ZoomInfo CEO Henry Schuck posted a product demo of GTM Studio on LinkedIn — their AI-powered platform that "identifies person-level website...

mosint

Features • Installation • Services • Usage • Docker • Config • Screen Mosint is an automated email osint tool written in Go that allows you investigate for target emails in a fast and efficient manner. It consolidates numerous services, enabling security researchers to swiftly access a wealth of...

bbrecon

This project is no longer maintained and I took the crawling infrastructure offline. The audience was not big enough to justify maintaining it. Bug Bounty Recon bbrecon is a free Recon-as-a-Service for bug bounty hunters and security researchers. The API aims to provide a continuously up-to-date...

socgholish_finder

SocGholish Finder Simple script to scan website for SocGholish inject. It checks for and display inject if found, and it deonfuscates and display a shadowing URL domains usage: finder.py -h -url URL -ua USERAGENT -f FILENAME -p PROXY -s SocGholish finder options: -h, --help show this help message...

festin

FestIN the powered S3 bucket finder and content discover What is FestIn Why Festin Install Using Python Using Docker Full options Usage Configure search domains Concurrency HTTP Crawling configuration Manage results Proxy usage DNS Options Full Text Support Running as a service or watching mode...

hijagger

hijagger - check package registries for hijackable packages This tool checks every maintainer from every package in the NPM and Python Pypi registry for unregistered domains or unregistered MX records on those domains. If a domain is unregistered you can grab the domain and initiate a password...

dcrawl

dcrawl dcrawl is a simple, but smart, multi-threaded web crawler for randomly gathering huge lists of unique domain names. How it works? dcrawl takes one site URL as input and detects all links in the site's body. Each found link is put into the queue. Successively, each queued link is crawled in...

dga-collection

DGA Collection A collection of known Domain Generation Algorithms: Torpig ZeusBot Cryptolocker Necurs Symmi Ranbyus Usage For each DGA, the list of domains can be easily generated: from datetime import date from Necurs import Necurs Compute domains for the current day/period: Necurs.domains Compu...

DGA

DGA The repository that contains the algorithms for generating domain names, dictionaries of malicious domain names. Developed to research the possibility of applying machine learning and neural networks to detect and classify malicious domains. List of wordlist's alexa.csv alexa top million...

cariddi

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more Coded with 💙 by edoardottt Share on Twitter! Install • Usage • Get Started • Changelog • Contributing • License Installation 📡 Homebrew brew install cariddi Snap sudo snap install caridd...

packj

Packj flags malicious/risky open-source packages Packj pronounced package is a tool to help to mitigate software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and...