weakpass

Weakpass Here, you can find the list of tools and example of API server from weakpass.com for password and hash cracking in one place. 📂 Folder Structure tools A collection of password and hash cracking tools. Check them out: Kraker-js Lookup Passcheck Passgen libs Links to the libraries used in...

ninjasworkout

Damn Vulnerable NodeJS Application Quick Start root@kitploit: Download the Repo = run npm i Afer Installing all dependency just run the application root@kitploit: node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4...

zerologon

Zerologon Conjunto de scripts para probar y explotar la vulnerabilidad zerologon CVE-2020-1472 ¿Qué es? ZeroLogon es una vulnerabilidad que nos permite explotar una falla criptográfica en el Protocolo remoto de Netlogon de Active Directory de Microsoft MS-NRPC, que permite a los usuarios iniciar...

prismor

Prismor Runtime security for Claude Code, Codex, and other AI coding agents. Prismor is highly customizable based on user's own policies. Observe or enforce mode to see agent activity in a local self-serve dashboard Website • Onboard with Skill !Trae / Tra...

pilotprotocol

Pilot Protocol The network stack for AI agents. Addresses. Ports. Tunnels. Encryption. Trust. Docs · Wire Spec · Whitepaper · IETF Draft · Agent Skills · Polo Live Dashboard The internet was built for humans. AI agents have no address, no identity, no way to be reached. Pilot Protocol is an overl...

EDR-GhostLocker

GhostLocker: AppLocker-Based EDR Neutralization Introduction After my article on Fairy-Law , where I used kernel mitigations to disable Endpoint Detection & Response EDR solutions, diversenok pointed out that IFEO exclusions Image File Execution Options were too invasive for third-party...

PoC---CVE-2018-6389

PoC - CVE-2018-6389 WordPress 4.9.2 中 CVE-2018-6389 漏洞的概念验证。 该漏洞允许远程未认证攻击者对基于 WordPress 的 Web 应用程序发起拒绝服务（DoS）攻击。 演示文稿: docs.google.com/presentation DoSer Python 工具 root@kitploit: usage: mydoserget.py -h -t THREADS -u URL Sending unlimited requests to perform DoS attack. optional arguments: -h,...

Nimbus Vestige

Nimbus Vestige NV 面向云与身份事件响应的取证重建引擎。 面对碎片化的云、SaaS 和身份遥测数据——控制平面日志、登录事件、令牌与授权活动——NV 会重建入侵最可能在账户与服务之间的移动路径，枚举其他最可能的潜在路径，并以经过校准、可解释的置信度报告每一步。它拒绝断言证据无法支持的内容。 检测只告诉你发生了 某件事 。Nimbus Vestige 告诉你 如何发生 ——以及 还可能发生什么 。 为什么存在 现代入侵并非“破门而入”，而是“登录进入”。身份如今已成为主要攻击载体，牵涉到绝大多数云 IR 调查，而且大多数入侵跨越多个表面——身份、云、SaaS...

RemotePotato0

RemotePotato0 UPDATE 21-10-2022: The main exploit scenario RPC- LDAP of RemotePotato0 has been fixed. More details at -- https://twitter.com/splintercode/status/1583555613950255104 Just another "Won't Fix" Windows Privilege Escalation from User to Domain Admin. RemotePotato0 is an exploit that...

pydictor

pydictor README.md中文版 pydictor —— A powerful and useful hacker dictionary builder for a brute-force attack root@kitploit: | | | | ' | | | |/ | |/ | / | '| | | | || | | | | | || | | | ./ , |,|||\/|| || |/ Email: [email protected] Preface： root@kitploit: Q: Why I need to use pydictor ? A:...

Cisa-KEV-Threat-Intel-Orchestrator

CISA KEV Threat Intel Orchestrator Zero-touch pipeline that turns newly weaponized CVEs from the CISA Known Exploited Vulnerabilities KEV catalog into production-ready Sigma detection rules, automatically, every week. The problem Manually turning a new KEV entry into a usable detection is slow:...

ADOKit

ADOKit Description Azure DevOps Services Attack Toolkit - ADOKit is a toolkit that can be used to attack Azure DevOps Services by taking advantage of the available REST API. The tool allows the user to specify an attack module, along with specifying valid credentials API key or stolen...

wavecrack

Wavecrack Description A user-friendly Web interface to share an hashcat cracking box among multiple users with some pre-defined options. Screenshots The homepage Adding an hash to crack Seeing the results and some stats Outline This Web application can be used to launch asynchronous password crac...

http-request-smuggling

HTTP Request Smuggling Detection Tool HTTP request smuggling is a high severity vulnerability which is a technique where an attacker smuggles an ambiguous HTTP request to bypass security controls and gain unauthorized access to performs malicious activities, the vulnerability was discovered back ...

XSS-Catcher

XSS Catcher A blind XSS detection and XSS data capture framework that runs on Flask, VueJS and PostgreSQL. XSS Catcher is an intuitive tool that automates blind Cross-Site Scripting XSS attacks and data gathering, including screenshots. It features a user-friendly payload generator for creating...

omnisci3nt

⭐️ If you find this GitHub repo useful, please consider giving it a star! ⭐️ 🕵️‍♂️ Omnisci3nt: Unified Web Reconnaissance Toolkit Omnisci3nt is a comprehensive web reconnaissance and intelligence framework designed for cybersecurity professionals, ethical hackers, and security researchers. It...

net-Shield

net-Shield An Easy and Simple Anti-DDoS solution for VPS,Dedicated Servers and IoT devices based on iptables/ipsets Requirements Linux System with golang, iptables/ipsets Nginx Quickstart Run the bash script install.sh to install all the required dependencies. bash install.sh You will be prompted...

Antiphishing

Antiphishing — Predictive Phishing Intelligence for Suricata DONATE · DASHBOARD VECTORS · CONTRIBUTING · SUBMIT A VECTOR · REST API CTI · WIKI Predictive Phishing Intelligence for Suricata — Preemptive Defense from Day Zero Antiphishing is an open-source GPLv3 Cyber Threat Intelligence CTI...

be-a-hacker

Introduction Hacking is the art of using things in unintended ways. For example, if a software's trial is about to expire, you might be able to extend it by changing your computer's date to the previous week. That's hacking. There's no 'one right way' to learn hacking because it is a very broad...

NetworkAlarm

NetworkAlarm A command-line tool to monitor local network traffic for possible security vulnerabilities. Warns user against possible nmap scans, Nikto scans, credentials sent in-the-clear, credit card numbers sent in-the-clear, and shellshock attacks. Currently supports live monitoring and networ...