git-hound

🐾 GitHound A pattern-matching, patch-attacking, batch-catching secret snatcher. Overview GitHound hunts down exposed API keys, secrets, and credentials across GitHub by pairing GitHub dorks with pattern matching, contextual detection, and commit-history analysis. Input a GitHub dork into GitHound...

Attacker-Group-Predictor

Attacker-Group-Predictor The tool predicts attacker groups from techniques and softwares used. It searches based on the MITRE ATT&CK™ framework How it works? 1- Collect data from https://attack.mitre.org/ about attacker groups 2- Get data from user about attack 3- Compare data and create result...

afot

Automation FOrensics Tool The Automation FOrensics Tool AFOT is an automation tool build in Python and used for Windows Forensics in order to combine the following tools: AnalyzePESig http://didierstevens.com/files/software/AnalyzePESigV0002.zip National Software Reference Library reduced set...

blindy

Blindy Simple script for running brute-force blind MySql injection Note: this script was created for fun, helpful in some ctf challenges : description The script will run through queries listed in sets in provided file and try to brute-force any place where placeholder is found. GET & POST http...

vulscan

vulscan - Vulnerability Scanning with Nmap Introduction Vulscan is a module which enhances nmap to a vulnerability scanner. The nmap option -sV enables version detection per service which is used to determine potential flaws according to the identified product. The data is looked up in an offline...

libc-database

Web interface libc-database now has a web service and frontend. Visit https://libc.rip/ to try it out! Read https://github.com/niklasb/libc-database/tree/master/searchengine if you are interested in the API. Building a libc offset database If you're getting errors, please check the "Requirements"...

nodejsscan

nodejsscan Static security code scanner SAST for Node.js applications powered by libsast and semgrep. Made with in India...

nuclei

English • 中文 • Korean • Indonesia • Spanish • 日本語 • Portuguese • Türkçe...

rematch

|Read The Docs| |Gitter Chat| |Build Status| |Codacy Badge| |idaplugin PyPI| |server PyPI| rematch REmatch, yet another binary comparison tool. Rematch is still a work in progress and is not as feature-rich as we'd like it to be. Basic functionality is available at this point and more advanced...

XSpear

XSpear XSpear is XSS Scanner on ruby gems !IMPORTANT XSpear Repository Archived This repository has been archived and is now read-only. XSpear is no longer actively maintained. Try Dalfox instead 🌙🦊 A faster, more powerful XSS scanner with advanced features. → https://github.com/hahwul/dalfox Key...

UltraViolet

UltraViolet Descubrimiento y búsqueda de red autoalojados: tu propio Shodan, en tu propio hardware. Escaneo TCP/UDP · sondas de 100 protocolos · huellas TLS/JARM · coincidencia de CVEs · búsqueda de texto completo · seguimiento de deltas · alertas Inicio rápido · Características · Arquitectura ·...

edge

Cloud edge - 云服务 Whois 通过查询 IP 地址，基于云服务商发布的 JSON、CSV 或文本数据，找出其所属的云服务商及其他详细信息 Cloud edge 是一款专注于探索云服务提供商的侦察工具。它可以用于云归属与取证、渗透测试、漏洞赏金、红队行动或针对云服务商的通用研发。Edge 会自动加载云服务商（CSP）已发布的 IP 地址范围文件（AWS、Azure、GCP、Cloudflare、Digital Ocean），并根据输入的 IP 地址执行前缀查询。可以与其他侦察工具集成使用。在黑盒网络渗透测试中，edge 能快速发现客户托管在哪个云 CSP...

Searpy

🥀 Searpy 🔧 批量搜索工具，可用于采集和溯源 支持py2和py3 1. Install root@kitploit: git clone https://github.com/j3ers3/Searpy pip install -r requirements.txt 配置API及账号 ./config.py python Searpy -h 2. Help root@kitploit: Searpy Engine Tookit optional arguments: -h, --help show this help message and exit ENGINE:...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue...

BSOD_bitlocker_recover

BitLocker VMK 提取工具 这个Python脚本帮助你从内存转储文件（例如蓝屏死机（BSOD）生成的文件）中提取潜在的BitLocker卷主密钥（VMK）。它是一个命令行工具，旨在协助涉及BitLocker加密的取证调查。虽然设计用于BSOD转储，但它同样适用于磁盘镜像、导出的未分配磁盘空间， 使用示例及使用密钥挂载驱动器的演示：https://www.youtube.com/watch?v=PFWVIZsGOaI&feature=youtu.be 用例...

halogen

Halogen is a tool to automate the creation of yara rules based on the image files embedded within a malicious document. This can assist cyber security professionals in writing detection rules for malicious threats as well as help responders in identifying with particular threat they are dealing...

dismap

🌀 Dismap - Asset discovery and identification tool Dismap 定位是一个资产发现和识别工具，他可以快速识别 Web/tcp/udp 等协议和指纹信息，定位资产类型，适用于内外网，辅助红队人员快速定位潜在风险资产信息，辅助蓝队人员探测疑似脆弱资产 Dismap 拥有完善的指纹规则库，目前包括 tcp/udp/tls 协议指纹和 4500+ Web 指纹规则，可以识别包括 favicon、body、header 等， 对于规则库的简介位于 RuleLab 扫描结果可直接丢给Vulmap=0.8 进行漏洞扫描。, 0.3...

AudioCaptchaBypass-CVE-2008-2019

Exploit for CVE-2008-2019 - Simple Machines Form SMF 1.1.4 and below. Simple Machines Forum SMF 使用一种音频验证码，由一个女声读出字母表中的每个字母。用户（可能为盲人）需要按顺序输入这些字母才能通过挑战响应。CVE-2008-2019 所标识的漏洞实际上绕过了为修复 CVE-2007-3308 而引入的补丁。该漏洞利用仅仅使用了简单的字符串比较（https://www.securityfocus.com/archive/1/471641/100/0/threaded）。为了防止字符串比较生效，...

Netryx-Astra-V2-Geolocation-Tool

Netryx Astra V2 最先进的AI地理定位：仅凭单张图像。 核心理念 • 工作原理 • 快速开始 • 社区中心 • 安装 核心理念 你有一张照片。可能是一段视频的截图；可能是一张从网上摘取的、被裁切或模糊的手机照片；可能只显示了一个店面、一段道路或一栋建筑的角落。你想知道它 究竟 是在哪里拍摄的。 Netryx Astra V2 回答了这个问题。 这是一款开源的地理定位系统，它通过将单张图像与街景全景图数据库进行匹配，从而找到精确的 GPS 坐标。上传你的照片，几分钟内它就能告诉你街道、城市和坐标——误差仅几米。 与最初的 Netryx（以及市面上的其他工具）相比，V2...

njsscan

njsscan njsscan 是一款静态应用测试（SAST）工具，可以使用来自 libsast 的简单模式匹配器，以及语法感知的语义代码模式搜索工具 semgrep，在您的 node.js 应用程序中查找不安全代码模式。 在印度用 打造 支持 njsscan 通过 Paypal 捐赠： 赞助本项目： 在线课程与认证 OpSecX Node.js 安全：渗透测试与利用 - NJS 安装 pip install njsscan 需要 Python 3.10+，且仅支持 Mac 和 Linux。 命令行选项 root@kitploit: $ njsscan usage: njsscan -h...