antipwny

antipwny Auteurs : Rohan Vazarkar, David Bitner Un IDS/IPS basé sur l'hôte écrit en C, ciblant les charges utiles Metasploit. Consignes AntiPwny nécessite .NET Framework 4.5, qui peut être acquis ici. Un installateur hors ligne est disponible ici...

foolav

foolav Executable compiled with this code is useful during penetration tests where there is a need to execute some payload meterpreter maybe? while being certain that it will not be detected by antivirus software. The only requirement is to be able to upload two files: binary executable and paylo...

easysploit

EasySploit EasySploit v4.2 Linux - Automatisation Metasploit PLUS FACILE et PLUS RAPIDE que JAMAIS Avertissement : L'utilisation d'EASYSPLOIT pour attaquer des cibles sans consentement mutuel préalable est ILLÉGALE. Les développeurs ne sont pas responsables des dommages causés par ce script...

dropengine

by @s0lst1c3 Current release: v0.1.0-alpha Supports Python 3.7+. Overview Defense Evasion techniques tend to have a short shelf-life, and this is especially true for techniques used during initial access. Because of this, initial access payloads are often prepared on a per-engagement basis, which...

weaponised-XSS-payloads

Weaponised XSS Payloads XSS-пейлоады, созданные для превращения alert1 в P1. Статья в блоге Этот репозиторий был опубликован вместе со статьёй под названием "How to Upgrade Your XSS Bugs from Medium to Critical" https://medium.com/@hakluke/upgrade-xss-from-medium-to-critical-cb96597b6cc4 Что это...

jdam

jdam - Fuzzing JSON conscient de la structure jdam est un outil inspiré de Radamsa pour le fuzzing d'objets JSON arbitraires de manière consciente de la structure, ce qui garantit que les résultats du fuzzing seront toujours du JSON valide. De nombreux outils de fuzzing existants modifient...

Tiny-XSS-Payloads

Tiny-XSS-Payloads Une collection de courtes charges utiles XSS pouvant être utilisées dans différents contextes. La démo disponible ici : https://tinyxss.terjanq.me Charges utiles actuelles ... --...

xxexploiter

XXExploiter It generates the XML payloads, and automatically starts a server to serve the needed DTD's or to do data exfiltration. Installation install node and npm if you don't have it yet npm install -g xxexploiter Building & Running from source This is a simple Node application written with...

recollapse

REcollapse REcollapse is a helper tool for black-box regex fuzzing to bypass validations and discover normalizations in web applications. It can also be helpful to bypass WAFs and weak vulnerability mitigations. For more information, take a look at the REcollapse blog post. The goal of this tool ...

Armor

Armor Armor est un simple script Bash conçu pour créer des charges utiles macOS chiffrées capables d'échapper aux scanners antivirus. Voici un exemple gif d'Armor utilisé avec une simple charge utile Netcat. Un écouteur Netcat est démarré sur le port 4444. Le fichier "payload.txt" est lu et affic...

bradamsa

Bradamsa Bradamsa is a Burp Suite extension for Radamsa, a well-known fuzzer made by the Oulu University Secure Programming Group. Inspired by burp-radamsa, this plugin allows to generate Intruder payloads using Radamsa. Download the latest release from HERE. Mix Burp Suite + Radamsa and you get...

bradamsa

Bradamsa Bradamsa — это расширение для Burp Suite, предназначенное для работы с Radamsa — известным фаззером, разработанным Исследовательской группой по безопасному программированию Университета Оулу. Вдохновлённый burp-radamsa, этот плагин позволяет генерировать полезные нагрузки для Intruder с...

ghostcat

Этот инструмент использует уязвимость LFI внутри Apache Tomcat под названием CVE-2020-1938 не только для просмотра конфиденциальных файлов, но и для запуска вредоносных JSP-нагрузок. Его можно скачать здесь вам нужно будет запустить его из командной строки Использование: ghostcat target HTTP port...

CVE-2020-0796-Scanner

SMBGhostscanner Простой сканер для CVE-2020-0796 - SMBv3. Сканер предназначен только для проверки, уязвим ли сервер. Он не предназначен для исследований или разработки, отсюда и фиксированный payload. Он проверяет диалект SMB 3.1.1 и возможность сжатия через запрос согласования. SMBGhostscanner.e...

CVE-2026-66054

A flaw was found in the Apache Thrift C++ bindings. A remote, unauthenticated attacker could cause a Denial of Service DoS by sending specially crafted, highly compressed data payloads. Because the software does not properly restrict resource allocation during decompression, processing these...

xssless

xssless python으로 작성된 자동화된 XSS 페이로드 생성기입니다. 사용법 1. Burp proxy로 요청들을 기록합니다. 2. 생성하려는 요청들을 선택한 다음 마우스 오른쪽 버튼을 클릭하고 "Save items"를 선택합니다. 3. xssless를 사용하여 페이로드를 생성합니다: ./xssless.py burpexportfile 4. Pwn! 더 자세한 튜토리얼은 여기에서 확인할 수 있습니다. 기능 가져온 Burp 프록시 요청에서 자동화된 XSS 페이로드 생성 페이로드는 100% 비동기 방식이므로 사용자의 브라우저가...

payloads

payloads Git All the Payloads! Une collection de charges utiles d'attaque web. Les pull requests sont les bienvenues ! Utilisation exécutez ./get.sh pour télécharger les charges utiles externes et décompresser les fichiers de charges utiles qui sont compressés. Crédits des charges utiles fuzzdb -...

payloads

payloads Git All the Payloads! A collection of web attack payloads. Pull requests are welcome! Usage run ./get.sh to download external payloads and unzip any payload files that are compressed. Payload Credits fuzzdb - https://github.com/fuzzdb-project/fuzzdb SecLists -...

pe_to_shellcode

petoshellcode Converts PE so that it can be then injected just like a normal shellcode. At the same time, the output file remains to be a valid PE. Supports both 32 and 64 bit PEs Authors:@hasherezade & @hh86 Objective The goal of this project is to provide a possibility to generate PE files that...

HackTools

Bienvenue sur HackTools ! Introduction — Aperçu — Installer — Construire — Soutien !NOTE Psst... Vous aimez HackTools ? 👀 Découvrez Penflow – notre nouveau compagnon de test de sécurité ! Essayez-le sur map.penflow.sh 🚀 !NOTE Chers utilisateurs, Nous sommes ravis d'annoncer une refonte majeure de...