RSPET

RSPET RSPET Reverse Shell and Post Exploitation Tool is a Python based reverse shell equipped with functionalities that assist in a post exploitation scenario. DISCLAIMER: This software is provided for educational and PenTesting purposes and as a proof of concept. The developers do not endorse,...

wreckuests

What is this? Wreckuests is a script, which allows you to run DDoS attacks with HTTP-floodGET/POST. It's written in pure Python and uses proxy-servers as "bots". OF COURSE, this script is not universal and you can't just drop Pentagon/NSA/whatever website with just a single mouse click. Each atta...

LaZagne

The LaZagne Project !!! Description The LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer. Each software stores its passwords using different techniques plaintext, APIs, custom algorithms, databases, etc.. This tool has been developed for...

tiktok-scraper

TikTok Scraper & Downloader Scrape and download useful information from TikTok. No login or password are required This is not an official API support and etc. This is just a scraper that is using TikTok Web API to scrape media and related meta information. Content Features To Do Contribution...

CrossC2

CrossC2 framework README | 中文文档 | READMEFULL | 中文完整文档 CobaltStrike support Support CobaltStrike's security assessment of other platforms Linux/MacOS/..., and include the development support of Unix post-penetration module | CS3.14bug fixes| CS4.0| CS4.X 4.14.8 ---|---|---|--- Master branch| ✅| |...

BeRoot

BeRoot Project BeRoot Project is a post exploitation tool to check common misconfigurations to find a way to escalate our privilege. It has been added to the pupy project as a post exploitation module so it will be executed in memory without touching the disk. This tool does not realize any...

Ghost

Ghost Framework Ghost Framework is an Android post-exploitation framework that exploits the Android Debug Bridge to remotely access an Android device. Installation pip3 install git+https://github.com/EntySec/Ghost...

HTTP-revshell

Powershell HTTP/S Reverse Shell HTTP-revshell is a tool focused on redteam exercises and pentesters. This tool provides a reverse connection through the http/s protocol. It uses a covert channel to gain control over the victim machine through web requests and thus evade solutions such as IDS, IPS...

MSSQLand

✈️ MSSQLand Land gracefully in your target Microsoft SQL Server MS SQL DBMS, as if arriving on a business-class flight with a champagne glass in hand. 🥂 MSSQLand is a C Microsoft SQL Server MSSQL / MS SQL post-exploitation tool built for red team operators. Designed to run inside the target...

hsecscan

hsecscan A security scanner for HTTP response headers. Requirements Python 2.x Python Modules os.path argparse sqlite3 urlparse urllib2 urllib json ssl Install $ pip install hsecscan Usage $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D DBFILE -d 'POST data' -x PROX...

botb

Break out the Box BOtB BOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies. What does it do? BOtB is a CLI tool which allows you to: Exploit common container vulnerabilities Perform commo...

mimipenguin

MimiPenguin 2.0 A tool to dump the login password from the current linux desktop user. Adapted from the idea behind the popular Windows tool mimikatz. This was assigned CVE-2018-20781 https://vulners.com/cve/CVE-2018-20781. Fun fact it's still not fixed after GNOME Keyring 3.27.2 and still works ...

StandIn

StandIn StandIn is a small AD post-compromise toolkit. StandIn came about because recently at xforcered we needed a .NET native solution to perform resource based constrained delegation. However, StandIn quickly ballooned to include a number of comfort features. I want to continue developing...

SCANNER-INURLBR

New repository Advanced search in search engines, enables analysis provided to exploit GET / POST capturing emails & urls, with an internal custom validation junction for each target / url found. https://github.com/MrCl0wnLab/SCANNER-INURLBR...

mose

MOSE Master Of SErvers Copyright 2020 National Technology & Engineering Solutions of Sandia, LLC NTESS. Under the terms of Contract DE-NA0003525 with NTESS, the U.S. Government retains certain rights in this software MOSE is a post-exploitation tool that helps security professionals leverage...

PowerUpSQL

PowerUpSQL includes functions that support SQL Server discovery, weak configuration auditing, privilege escalation on scale, and post exploitation actions such as OS command execution. It is intended to be used during internal penetration tests and red team engagements. However, PowerUpSQL also...

MagicArch

MagicArch: Automated Arch Linux Setup for Pentesting by MagicBytes MagicArch is a comprehensive post-installation script built with Ansible, designed to transform a basic Arch Linux installation into a fully equipped Pentesting Distro customized for pentesting and performance. With a focus on...

PoshC2

PoshC2 is a proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral movement. PoshC2 is primarily written in Python3 and follows a modular format to enable users to add their own modules and tools, allowing an extendible and flexible C2 framework...

trajan

Trajan: CI/CD Security Scanner Trajan scans CI/CD pipelines for security vulnerabilities that attackers use to compromise software supply chains. It supports GitHub Actions, GitLab CI, Azure DevOps, Jenkins, and JFrog. What it does Trajan parses workflow YAML files, builds dependency graphs, runs...

iPwn

iPwn A Framework meant for the exploitation of iOS devices. REMEMBER: THE IPHONE YOU ARE ATTEMPTING TO GET INTO USING THIS TOOL MUST BE JAILBROKEN Status - ❌ This project is still being worked on. I'm adding more extensions and options for post-exploitation for harvesting Device information and...