batchql

BatchQL BatchQL is a GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations. This script is not complex, and we welcome improvements. When exploring the problem space of GraphQL batching attacks, we found that there were a few blog posts on the internet,...

hershell

Hershell Simple TCP reverse shell written in Go. It uses TLS to secure the communications, and provide a certificate public key fingerprint pinning feature, preventing from traffic interception. Supported OS are: Windows Linux Mac OS FreeBSD and derivatives Why ? Although meterpreter payloads are...

Sandman

Sandman Sandman is a backdoor that is meant to work on hardened networks during red team engagements. Sandman works as a stager and leverages NTP a protocol to sync time & date to get and run an arbitrary shellcode from a pre-defined server. Since NTP is a protocol that is overlooked by many...

android712-blueborne

android712-blueborne Android Blueborne RCE CVE-2017-0781 In November 2017 a company called Armis published a proof of concept PoC of a remote code execution vulnerability in Android via Bluetooth CVE-2017-0781, known as BlueBorne. Although BlueBorne refers to a set of 8 vulnerabilities, this PoC ...

pii-shield

PII-Shield 🛡️ Zero-code log sanitization sidecar for Kubernetes. Prevents data leaks GDPR/SOC2 by redacting PII from logs before they leave the pod. PII-Shield runs in-process — CLI, sidecar, or WASM. There is no hosted API and no server your data is sent to. "Don't let PII poison your AI models."...

memguard

MemGuard Software enclave for storage of sensitive information in memory. This package attempts to reduce the likelihood of sensitive data being exposed when in memory. It aims to support all major operating systems and is written in pure Go. Features Sensitive data is encrypted and authenticated...

waymore

About - v8.9 The idea behind waymore is to find even more links from the Wayback Machine plus other sources than other existing tools. 👉 The biggest difference between waymore and other tools is that it can also download the archived responses for URLs on wayback machine and URLScan so that you c...

adaudit

adaudit This PowerShell script is designed to conduct a comprehensive audit of Microsoft Active Directory, focusing on identifying common security vulnerabilities and weaknesses. Its execution facilitates the pinpointing of critical areas that require reinforcement, thereby fortifying your...

pycrypt

pycrypt Python Based Crypter That Can Bypass Any Kinds Of Antivirus Products Note: root@kitploit: If the stub being detected then plz use the following obfuscations:- 1. https://github.com/machine1337/fudcrypt 2. https://github.com/machine1337/pyobfuscate Important: root@kitploit: 1. Make Sure yo...

RamziRange3

🕶️ RamziRange9 A deliberately vulnerable web application bui...

cve-2021-26855

cve-2021-26855 root@kitploit: GET /ecp/x.png HTTP/1.1 Host: 192.168.170.134 Cookie: X-BEResource=localhost1942062522 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:109.0 Gecko/20100101 Firefox/110.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0...

ExtractBitlockerKeys

A system administration or post-exploitation script to automatically extract the bitlocker recovery keys from a domain. Features Automatically gets the list of all computers from the domain controller's LDAP. Multithreaded connections to extract Bitlocker keys from LDAP. Iterate on LDAP result...

security-study-plan

A Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps, and so on with free/paid resources, tools, and concepts to excel. It will cover but not limited to: Done 1. Common Skills for Security Study Plan 2. AWS Security...

JustTryHarder

JustTryHarder JustTryHarder is a cheat sheet which will aid you through the PWK course & the OSCP Exam. Inspired by PayloadAllTheThings Feel free to submit a Pull Request & leave a star to share some love if this helped you. 💖 Hacktoberfest friendly! Yes, we are open to Pull Requests for...

zappzarapp-php-security

⚡ zappzarapp/security Comprehensive PHP security library providing CSP, Security Headers, CSRF protection, Secure Cookies, Password Validation, Input Sanitization, Rate Limiting, SRI, Secrets Loading, Encryption, Session Security, TOTP two-factor authentication, Signed URLs, and Security Event...

skype-log-viewer

skype-log-viewer Download and View Skype History Without Skype This program allows you to view all of your skype chat logs and then easily export them as text files. It correctly organizes them by conversation, and makes sure that group conversations do not get jumbled with one on one chats...

excelpeek

ExcelPeek v0.2 ExcelPeek is a tool designed to help investigate potentially malicious Microsoft Excel files. Documentation Use the Installation Guide to get started. Go to the User's Guide for additional information...

IoTGoat

OFFICIAL REPO HAS BEEN MOVED TOhttps://github.com/OWASP/IoTGoat Description The IoTGoat Project is a deliberately insecure firmware based on OpenWrt and maintained by OWASP to educate users how to test for the most common vulnerabilities found in IoT devices. The vulnerability challenges are base...

ESP32-Bit-Pirate

ESP32 Bit Pirate ESP32 Bit Pirate is open-source firmware that turns your device into a multi-protocol development and analysis tool, inspired by the legendary Bus Pirate. It supports sniffing, sending, scripting, and interacting with various digital protocols I2C, UART, 1-Wire, SPI, etc. via a...

aws_pwn

AWS pwn Summary This is a collection of horribly written scripts for performing various tasks related to penetration testing AWS. Please don't be sad if it doesn't work for you. It might be that AWS has changed since a given tool was written or it might be that the code sux. Either way, please fe...