5562 matches found
SUDO_KILLER
â Star us on GitHub â to show your support! ð¡ Best Viewed in Dark Mode : The project SUDOKILLER made it to the final for the SANS Difference Award 2023 in the category open-source tool. Contributing Stargazers over time Support Credits Disclaimer License Introduction SUDOKILLER is a tool geared...
djangohunter
Djangohunter Tool designed to help identify incorrectly configured Django applications that are exposing sensitive information. https://www.reddit.com/r/django/comments/87qcf4/28165thousanddjangorunningserversareexposed/ https://twitter.com/6ix7ine/status/978598496658960384?lang=en Usage...
gixy
GIXY Overview Gixy is a tool to analyze Nginx configuration. The main goal of Gixy is to prevent security misconfiguration and automate flaw detection. Currently supported Python versions are 2.7, 3.5, 3.6 and 3.7. Disclaimer: Gixy is well tested only on GNU/Linux, other OSs may have some issues...
SCCMSecrets
SCCMSecrets SCCMSecrets.py is an SCCM policies exploitation tool. It goes beyond NAA credentials extraction, and aims to provide a comprehensive approach regarding SCCM policies exploitation. The tool can be executed from various levels of privileges, and will attempt to uncover potential...
nerve
Network Exploitation, Reconnaissance & Vulnerability Engine N.E.R.V.E Table of Contents Continuous Security About NERVE What is NERVE Features Prerequisites Installation Deployment Recommendations Installation - Docker Installation - Bare Metal Installation - Multi Node Upgrade Security Usage...
tailsnitch
Tailsnitch A security auditor for Tailscale configurations. Tailsnitch scans your tailnet for 57 misconfigurations, overly permissive access controls, and security best practice violations. Quick Start root@kitploit: 1. Set your Tailscale API credentials export TSAPIKEY="tskey-api-..." 2. Run aud...
hammer
Overview Dow Jones Hammer is a multi-account cloud security tool for AWS. It identifies misconfigurations and insecure data exposures within most popular AWS resources, across all regions and accounts. It has near real-time reporting capabilities e.g. JIRA, Slack to provide quick feedback to...
mx-takeover
mx-takeover How to works ⢠Features ⢠Installation ⢠Usage ⢠Running mx-takeover mx-takeover focuses DNS MX records and detects misconfigured MX records. It currently support three technique. These are, MX domains that will expire soon Unregistered MX domains Domains that points to not currently ...
AWSGoat
AWSGoat : A Damn Vulnerable AWS Infrastructure Compromising an organization's cloud infrastructure is like sitting on a gold mine for attackers. And sometimes, a simple misconfiguration or a vulnerability in web applications, is all an attacker needs to compromise the entire infrastructure. Since...
harbor
Team Introduction Chongqing Jiugongge Security Team is committed to sharing open-source security tools, with research directions covering red-blue confrontation, Web security, mobile security, security development, enterprise security construction, IoT/Industrial Control Security/AI/Quantum...
cloudfrunt
CloudFrunt CloudFrunt is a tool for identifying misconfigured CloudFront domains. Background CloudFront is a Content Delivery Network CDN provided by Amazon Web Services AWS. CloudFront users create "distributions" that serve content from specific sources an S3 bucket, for example. Each CloudFron...
ludus-defender-lab
Ludus Defender Lab Ludus range config and Ansible roles for a Windows security lab pre-staged for MDE and MDI, with a fully misconfigured ADCS installation for detection coverage testing. Config| VMs| Purpose ---|---|--- zsec-mde-mdi-lab.yml| DC01 + WKS01| MDE/MDI detection lab with ADCS ESC1âESC...
DIAL
DIAL Workloads on cloud provide equal opportunities for hackers as much as they do for internal teams. Cloud-native companies are open to attacks from both outside forces and from within. With ever growing risk of a security breach and cloud misconfiguration being one of the most common factor of...
CVE-2023-1326-PoC
CVE-2023-1326-PoC apport-cli 2.26.0 ã«ããã CVE-2023â1326 ã®æŠå¿µå®èšŒïŒProof of ConceptïŒ ãã®è匱æ§ã¯ãapport-cli 2.26.0 ã«ãããæš©éææ Œã§ãããCVE-2023â26604 ãšé¡äŒŒããŠããŸãããã®è匱æ§ã¯ãsudoers ã§èšå®ãããŠããå Žåã«ã®ã¿æ©èœããŸãã æš©éææ Œæ»æã apport-cli 2.26.0 ããã³ãã以åã®ããŒãžã§ã³ã§çºèŠãããŸããããã㯠CVE-2023-26604 ãšé¡äŒŒããŠããŸããã·ã¹ãã ãç¹å¥ã«æ§æãããéç¹æš©ãŠãŒã¶ãŒã sudo apport-cli...
cloudmapper
CloudMapper 泚æ ãããã¯ãŒã¯å¯èŠåæ©èœïŒprepareã³ãã³ãïŒã¯ã¡ã³ããã³ã¹ãããªããªããŸããã CloudMapperã¯ãAmazon Web ServicesïŒAWSïŒç°å¢ã®åæãæ¯æŽããŸãã å ã ã®ç®çã¯ããããã¯ãŒã¯å³ãçæããŠãã©ãŠã¶ã«è¡šç€ºããããšã§ããïŒãã®æ©èœã¯ã¡ã³ããã³ã¹ãããªããªããŸããïŒã çŸåšã¯ãã»ãã¥ãªãã£åé¡ã®ç£æ»ãå«ããããå€ãã®æ©èœãåããŠããŸãã ãããã¯ãŒã¯ãããã³ã°ã㢠ã¬ããŒãã㢠玹ä»èšäº ãããã¯ãŒã¯ã®èšå®ãã¹ãçºèŠããæ¹æ³ã«ã€ããŠã®èšäº ç¶ç¶çç£æ»ã®å®è¡ã«ã€ããŠã®èšäº ã³ãã³ã audit: æœåšçãªèšå®ãã¹ããã§ãã¯ããŸãã...
pisc
Public OCI-Image Security Checker What is it? PISC Public OCI-Image or docker-image Security Checker is command-line tool to assess the security of OCI container images. Exits with code 1 if any of the following conditions are met: malware ð exploits ð, hack-tools ðŸ, backdoors ðŽ, crypto-miners ð°,...
kube-alien
Kube-alien ãã®ããŒã«ã¯ãk8sã¯ã©ã¹ã¿ãŒå éšããæ»æã仿ããŸããã€ãŸããå®è¡ããã«ã¯ã¯ã©ã¹ã¿ãŒå ã«Podããããã€ããæš©éãæã€ã¢ã¯ã»ã¹ããã§ã«å¿ èŠã§ããkube-alien Podãå®è¡ãããšããã®ã€ã¡ãŒãžïŒhttps://github.com/nixwizard/dockercloud-authorizedkeysïŒã䜿çšããŠãããŒãã® /root/.ssh/authorizedkeys ãã¡ã€ã«ã«ããªãã®å ¬ééµã远å ããããšã§ãã¯ã©ã¹ã¿ãŒã®ããŒããä¹ã£åãããšããŸãããã®ã€ã¡ãŒãžã¯ docker/dockercloud-authorizedkeys...
audit_couchdb
Audit CouchDB: ã·ã³ãã«ã§æç¢ºãªCouchDBã»ãã¥ãªãã£è©äŸ¡ Audit CouchDBã¯ã·ã³ãã«ãªããŒã«ã§ããã匷åãªã¡ãã»ãŒãžãæã£ãŠããŸããApache CouchDBã®URLãæå®ãããšããã®ã»ãã¥ãªãã£ã«ã€ããŠç¥ããããã¹ãŠãæããŠãããŸãã ç®ç Audit CouchDBã¯ä»¥äžã®ã¢ã¯ã·ã§ã³ãå®è¡ããŸãã 1. CouchDBã«é¢ããããããäºå®ãææ¡ããŸããäŸãã°ïŒ ãµãŒããŒã®èšå®ã¯äœãïŒ ã©ã®ãŠãŒã¶ãŒã¢ã«ãŠã³ããååšãããïŒ ã©ã®ãŠãŒã¶ãŒããŒã«ãååšãããïŒ ã©ã®ããŒã¿ããŒã¹ãååšãããïŒ åããŒã¿ããŒã¹ã®ã»ãã¥ãªãã£èšå®ã¯ïŒ...
Locksmith
Locksmith root@kitploit: | | | | |/ | | | | | | || | || | | \ | | | | | | | | .--. .--. .--. /.-. '----------. /.-. '----------. /.-. '----------. '-' .---'-''-'-' '-' .--'--''-'-' '-' .--'--'-''-' '--' '--' '--' A small tool built to find and fix common misconfigurations in Active Directory...
Grouper
Grouper DONT USE GROUPER ANY MORE. USE GROUPER2! https://github.com/l0ss/Grouper2 A PowerShell script for helping to find vulnerable settings in AD Group Policy. Photo by Jon Hanson - https://www.flickr.com/people/61952179@N00?rb=1 - https://creativecommons.org/licenses/by-sa/2.0/ Summary Grouper...