CVE-2026-32202

Zero-click forced authentication: viewing a folder with the crafted .lnk triggers UNC resolution during icon render, coercing the victim into an attacker-directed outbound connection that leaks and enables relay of their Net-NTLMv2 credentials. Emerged due to an incomplete patch of CVE-2026-21510...

massdns

MassDNS A high-performance DNS stub resolver MassDNS is a simple high-performance DNS stub resolver targeting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per...

tilt

Tilt: Terminal Ip Lookup Tool An automatic ip lookup and reverse probing tool for passive reconnaissance ████████╗██╗██╗ ████████╗ ╚══██╔══╝██║██║ ╚══██╔══╝ ██║ ██║██║ ██║ ██║ ██║██║ ██║ ██║ ██║███████╗██║ ╚═╝ ╚═╝╚══════╝╚═╝ Description Tilt: Terminal ip lookup tool, is an easy and simple open...

PPLorer

PPLorer PPLorer is an IDA plugin that resolves PPL calls to the actual underlying PPL function. Installation 1. install ida-netnode somewhere IDA can import it 2. clone the repository and symlink /.idapro/plugins/pplorer.py to pplorer.py in the cloned repo Usage Preliminary Analysis 1. open an ID...

subscraper

SubScraper Overview :smallbluediamond: Usage :smallbluediamond: Contribute SubScraper is a subdomain enumeration tool that uses a variety of techniques to find subdomains of a given target. Subdomain enumeration is especially helpful during penetration testing and bug bounty hunting to uncover an...

CVE-2024-23653

syntax=docker.io/zdfa/evilerfile FROM alpine RUN grep Cap /proc/self/status sudo bin/buildctl build \ --frontend=dockerfile.v0 \ --local context=. \ --local dockerfile=. ➜ cp sudo bin/buildctl build \ --frontend=dockerfile.v0 \ --local context=. \ --local dockerfile=. + Building 5.3s 6/6 FINISHED...

mass3

Quickly enumerate through a pre-compiled list of AWS S3 buckets using DNS instead of HTTP with a list of DNS resolvers and multi-threading. Warning: Be aware that this is really shitty golang code. I wrote it without any prior knowledge of Go Lang but it seems to do the job. Feel free to contribu...

dnsFookup

DnsFookup v 2.0.1 DNS Rebinding freamwork containing: a dns server obviously python web api to create new subdomains and control the dns server, view logs, stuff like that shitty react app to make it more comfy Changelog API documentation What does it do? It lets you create dns bins like a burp...

CallObfuscator

CallObfuscator Obfuscate hide the PE imports from static/dynamic analysis tools. Theory This's pretty forward, let's say I've used VirtualProtect and I want to obfuscate it with Sleep, the tool will manipulate the IAT so that the thunk that points to VirtualProtect will point instead to Sleep, no...

VBA-macro-experiments

VBA macro experiments Collection of VBA macros published in our twitter / blog. If you are interested about this topic, please read our articles "Hacking in an epistolary way: implementing kerberoast in pure VBA" and "Shedding light on creating VBA macros". Also feel free to follow our twitter ;...

krbrelayx

Krbrelayx - Kerberos relaying and unconstrained delegation abuse toolkit Toolkit for abusing Kerberos. Requires impacket, ldap3, ldap3-ad-auth and dnspython to function. Requirements can be installed with pip install -r requirements.txt More info about this toolkit available in my blog...

ELFLoader

ELFLoader This is a ELF object in memory loader/runner. The goal is to create a single elf loader that can be used to run follow on capabilities across all x8664 and x86 nix operating systems. How it works The way this loader works is that it has all the code needed to build and load an ELF objec...

subfinder

Fast passive subdomain enumeration tool. Features • Install • Usage • API Setup • Library • Join Discord subfinder is a subdomain discovery tool that returns valid subdomains for websites, using passive online sources. It has a simple, modular architecture and is optimized for speed. subfinder is...

protections-artifacts

Protections Artifacts Elastic Security prevents ransomware and malware, detects advanced threats, and arms responders with vital context. It’s free and open, ready for every endpoint. Protections-Artifacts is the home of our detection logic rules, yara, etc for Elastic Security for endpoint. At...

zig-pe

zig-pe Reflective PE loader written in Zig. Loads and executes native and .NET PE files directly from memory. Features PE Loading Pipeline Parse DOS and NT headers PE32 and PE32+ at runtime Map sections into allocated memory Resolve imports name and ordinal, PE32 4-byte / PE32+ 8-byte thunks Appl...

pretender

pretender Your MitM sidekick for relaying attacks featuring DHCPv6 DNS takeover as well as mDNS, LLMNR and NetBIOS-NS spoofing pretender is a tool developed by RedTeam Pentesting to obtain machine-in-the-middle positions via spoofed local name resolution and DHCPv6 DNS takeover attacks. pretender...

AzSubEnum

AzSubEnum - Azure Service Subdomain Enumeration AzSubEnum is a specialized subdomain enumeration tool tailored for Azure services. This tool is designed to meticulously search and identify subdomains associated with various Azure services. Through a combination of techniques and queries, AzSubEnu...

HostileSubBruteforcer

HostileSubBruteforcer This app will bruteforce for exisiting subdomains and provide the following information: IP address Host if the 3rd party host has been properly setup. for example if site.example.com is poiting to a nonexisiting Heroku subdomain, it'll alert you - Currently only works with...

UnhookingPatch

UnhookingPatch Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime image How do i convert binary to MAC ? Requirements: 1. macaddress pip install macaddress ./bin2mac.py calc.bin...

cve-2024-32002-poc

💥 CVE-2024-32002 – Git Submodule Path Injection PoC Motivation While solving the Compiled machine on the Hack The Box platform, I came across a curious behavior involving Git and submodules. Upon investigating further, I found this excellent post by researcher Amal Murali, which details a path...