jadx

JADX jadx - Dex to Java decompiler Command-line and GUI tools for producing Java source code from Android Dex and APK files !WARNING Please note that in most cases jadx can't decompile 100% of the code, so errors will occur. Check the Troubleshooting guide for workarounds. Main features: decompil...

CVE202015808

CVE-2020-15808 A proof of concept of CVE-2020-15808 vulnerability exploit on STM32F4 Discovery board Requirements Firmware version older than 1.25.2 Board with VCP ex. STM32F4 discovery arm-none-eabi toolchain Steps to reproduce the exploit 1. Move to VulnerableFirmwareF4 and compile through make...

LiMEaide

LiMEaide v2.0 by Daryl Bennett - kd8bnyatgmaildotcom About LiMEaide is a python application designed to remotely or locally dump RAM of a Linux client and create a volatility profile for later analysis on your local host. I hope that this will simplify Linux digital forensics in a remote...

ShiningAppMask-ReverseEngineering

ShiningAppMask-ReverseEngineering Intro After recently buying a Shining App Mask, I was curious about the Shining Mask App and mask and how they worked. I decided to reverse engineer it to understand how it worked. The journey started with the hardware. The Android Mobile App can be found here:...

CVE-2022-31890

CVE-2022-31890 for osTicket | Support Ticketing System Nickname: python nickname.py The output of the first nickname in the table. Password: python password.py The output of the first password in the table. Output to file: python dumpFile.py cat dump.txt || nickname::password Output to console:...

ipwndfu

Open-source jailbreaking tool for many iOS devices Readdisclaimer before using this software. checkm8 permanent unpatchable bootrom exploit for hundreds of millions of iOS devices meant for researchers, this is not a jailbreak with Cydia yet allows dumping SecureROM, decrypting keybags for iOS...

Philips-PM-5139-5138A-5136-Firmware-Project

Philips PM5139 — Firmware Reverse Engineering A 20 MHz function generator from about 1994, taken apart in software: two EPROM dumps, an 8051 emulator used as a measuring instrument, and 35 sections of documentation where every single claim is backed by a listing address, an emulator measurement, ...

seccomp-tools

Seccomp Tools Powerful tools for seccomp analysis. This project is aimed primarily but not exclusively at analyzing seccomp sandboxes in CTF pwn challenges. Some features are CTF-specific, but they're just as useful for analyzing real-world seccomp filters. Features Dump - Automatically dumps...

Memory-analysis

Memory-analysis Contains tools to perform malware and forensic analysis in Memory. Plugins: Dyrescan.py - parses Dyreconfig in memory. Rat9002.py - parses 9002 rat config in memory. plugx.py - parses plugx config in memory modified to also parse config size: 0x170c. ghostrat.py - parses ghostrat...

CVE-2024-54820

Vulnerability: Unauthenticated SQL Injection - Clear Credentials Dump Author : Javier Carabantes Affected Software : XOne Web Monitor Software : https://xone.es/ Affected Version : 02.10.2024.530 framework 1.0.4.9 Description An unauthenticated SQL injection vulnerability has been discovered in t...

CVE-2022-0739

CVE-2022-0739 Python PoC Exploit for CVE-2022-0739 Features Database Metadata Lookup Wordpress User Credential Dump Arbitrary Blind Query Injection 💉 Usage usage: cve-2022-0739 -h -u URL -e EXEC options: -h, --help show this help message and exit -u URL, --url URL URL of the page containing the...

ADCSync

ADCSsync This is a tool I whipped up together quickly to DCSync utilizing ESC1. It is quite slow but otherwise an effective means of performing a makeshift DCSync attack without utilizing DRSUAPI or Volume Shadow Copy. This is the first version of the tool and essentially just automates the proce...

BackupOperatorToDA

From Backup Operator To Domain Admin If you compromise an account member of the group Backup Operators you can become the Domain Admin without RDP or WinRM on the Domain Controller. All credit from filipdragovic with his inital POC ! I build this project because I wanted to have a more generic...

keepass-exfil-forensics

KeePass Memory Exfiltration — Network Forensics Investigation Recovers exfiltrated data from PCAP traffic by reversing a hex → Base64 → XOR obfuscation chain used in a real DFIR CTF scenario TryHackMe, then exploits CVE-2023-32784 to recover a KeePass master password straight from a process memor...

CVE-2024-33901-ProofOfConcept

CVE-2024-33901-ProofOfConcept Short program that demonstrates the vulnerability CVE-2024-33901 in KeePassXC version 2.7.7 The report for the class might need the source code linked, so that's why I created the repo for this How to replicate the vulnerability 1. Open KeePassXC and authenticate the...

NtDumpBOF

NtDumpBOF BOF port of the tool https://github.com/ricardojoserf/NativeDump written by @ricardojoserf. Import NtDump.cna and run: ntdump The minidump file will be created in memory and downloaded using CALLBACKFILE and CALLBACKFILEWRITE. Once downloaded the file will be visible at View - Download...

Fortigate-Belsen-Leak-Dump-CVE-2022-40684-

Fortigate-Belsen-Leak-Dump-CVE-2022-40684 How This Script Works: 1. The script goes through all subfolders under rootfolder and looks for vpn-passwords.txt. 2.Skips any lines with the banner '-=-= Belsen Group -=-=.' 3. For lines with the username:password format Extracts the part after the colon...

CobaltStrikeParser

CobaltStrikeParser Python parser for CobaltStrike Beacon's configuration Description Use parsebeaconconfig.py for stageless beacons, memory dumps or C2 urls with metasploit compatibility mode default true. Many stageless beacons are PEs where the beacon code itself is stored in the .data section...

createdump

Windows App LSASS Dump - Proof of Concept This project demonstrates how to dump the LSASS process using the createdump.exe tool, a Microsoft signed executable, from the Windows App, leveraging a custom hook to enable process access to LSASS. Get-AuthentiCodeSignature -FilePath Join-Path -Path...

Advanced-SQL-Injection-Cheatsheet

MySQL Error based SQL Injection Cheatsheet This is probably the easiest vulnerability along the SQL Injection attack. An attacker can enumerate and dump the MySQL database by using the SQL error messages to his advantage. Detecting the vulnerability http://domain.com/index.php?id=1 Website loads...