spring4shell-scan

spring4shell-scan A fully automated, reliable, and accurate scanner for finding Spring4Shell and Spring Cloud RCE vulnerabilities Features Support for lists of URLs. Fuzzing for more than 10 new Spring4Shell payloads previously seen tools uses only 1-2 variants. Fuzzing for HTTP GET and POST...

SecureTea-Project

OWASP SECURETEA TOOL PROJECT Codacy Badge The OWASP SecureTea Project is an application designed to help Secure a person's laptop or computer / server with IoT Internet Of Things for notify users via various communication mechanisms, whenever someone accesses their computer / server. This...

jsql-injection

Description jSQL Injection is a lightweight application used to find database information from a server. It's free , open source and cross-platform for Windows, Linux and Mac, and it works with Java from version 21 to 25. jSQL Injection is also part of the official penetration testing distributio...

007-TheBond

007-TheBond 🕵️‍♂️ A powerful Python-based OSINT Open Source Intelligence tool for gathering information across multiple platforms and services. 007-TheBond helps security researchers, investigators, and ethical hackers collect publicly available information from various sources including social...

gerobug

Gerobug: The First Open Source Bug Bounty Platform. Gerobug The first open source self-managed bug bounty platform. Are you a company, planning to have your own bug bounty program, with minimum budget? WE GOT YOU! We are aware that some organizations have had difficulty establishing their own bug...

scrying

NCC Group Scrying A new tool for collecting RDP, web and VNC screenshots all in one place This tool is still a work-in-progress and should be mostly usable but is not yet complete. Please file any bugs or feature requests as GitHub issues Motivation Since Eyewitness recently dropped support for R...

Brute_Force

BruteForce install : sudo apt install python3 python3-pip pip3 install proxylist pip3 install mechanize Usage: BruteForce Gmail Attack python3 BruteForce.py -g [email protected] -l Filelist python3 BruteForce.py -g [email protected] -p PasswordSingle BruteForce Hotmail Attack python3...

Boomerang

Boomerang Boomerang is a tool to expose multiple internal servers to web/cloud using HTTP+TCP Tunneling. The Server will expose 2 ports on the Cloud. One will be where tools like proxychains can connect over socks, another will be for the agent to connect. The agent can be executed on any interna...

Zip-Cracker-

Zip Cracker This Script Supports Only Zip File in This Verson You Can Also Use This Script With crunch Cross-platform Supported Usage: zipcracker.py options Options: --version show program's version number and exit -h, --help show this help message and exit -f FILENAME, --file=FILENAME Please...

qiling

Qiling's use case, blog and related work Qiling is an advanced binary emulation framework, with the following features: Emulate multi-platforms: Windows, macOS, Linux, Android, BSD, UEFI, DOS, MBR. Emulate multi-architectures: 8086, X86, X8664, ARM, ARM64, MIPS, RISC-V, PowerPC. Support multiple...

OptixGate

Optix Gate is a multi-purpose secure remote administration tool for Microsoft Windows. It provides remote access to multiple Windows sessions and/or machines simultaneously. History Optix Gate was created, among other things, to maintain and further develop my Windows application programming...

nono

Built by the team that brought you Sigstore The standard for secure software attestation, used by PyPI, npm, brew, and Maven Central !NOTE In the lead-up to a 1.0 release, APIs are stabilizing. API changes may still occur where necessary, but will be kept to a minimum. nono is a complete agent...

pyFUD

pyFUD CROSS PLATFORM MULTI CLIENTS FUD RAT Note: This Project is under active development. May contains some bugs Warning: 1. Don't Upload Any Payloads To VirusTotal.com Bcz This tool will not work with Time. 2. Virustotal Share Signatures With AV Comapnies. 3. Again Don't be an Idiot!...

kubebot

Kubebot A security testing Slackbot built with a Kubernetes backend on the Google Cloud Platform NOTE: I am not actively maintaining this project anymore. I am working on v2 of Kubebot along with a couple other folks which will likely be presented at one of the upcoming security conferences...

CVE-2026-9999-Serverless-Event-Injection-to-Code-Overwrite

3. CVE-2026-9999 – Serverless Function Event Injection Path Traversal → Code Overwrite Overview A serverless platform that processes object storage events does not sanitize the object.key field, allowing an attacker to overwrite the function’s source code via path traversal. Severity: Critical RC...

xcrawl3r

xcrawl3r xcrawl3r is a command-line utility designed to recursively spider webpages for URLs. It works by actively traversing websites - following links embedded in webpages, and parsing files including sitemaps & robots.txt - to uncover every URL. Unlike xurlfind3r that doesn't interact directly...

CVE-2025-32433

Working PoC for CVE-2025-32433 Blog post: https://platformsecurity.com/blog/CVE-2025-32433-poc...

TornadoRevC2

TornadoRevC2 A lightweight, modular post-exploitation framework for authorized security research, red-team operations, and penetration testing. TornadoRevC2 manages interactive reverse shell and bind shell sessions on Linux and Windows hosts through a unified operator console, across plain TCP,...

antisquat

AntiSquat AntiSquat leverages AI techniques such as natural language processing NLP, large language models ChatGPT and more to empower detection of typosquatting and phishing domains. How to use Clone the project via git clone https://github.com/redhuntlabs/antisquat. Install all dependencies by...

merlin

Merlin Merlin is a cross-platform post-exploitation Command & Control server and agent written in Go. Highlighted features: merlin-cli command line interface over gRPC to connect to the Merlin Server facilitating multi-user support Supported Agent C2 Protocols: http/1.1 clear-text, http/1.1 over...