scrounger

Description Scrounger - a person who borrows from or lives off others. There is no better description for this tool for two main reasons, the first is because this tool takes inspiration from many other tools that have already been published, the second reason is because it lives off mobile...

RedTeam-Physical-Tools

Red Team – Physical Security – Covert Entry – EDC A curated list of commercially available tools commonly referenced in authorized physical security assessments, red teaming, and covert entry training. Legal & Ethics: Use only with written authorization and in accordance with local laws. Many too...

DIAL

DIAL 云上的工作负载为黑客提供了与内部团队同等的机会。云原生公司既面临外部攻击，也面临内部攻击。随着安全漏洞风险的不断增长，云配置错误成为最常见的因素之一，平均检测时间应缩短到秒级而非分钟/小时/天。因此，我们推出了内部工具DIAL（我是否触发了Lambda？），它可以帮助我们在任何时间段内监控任意数量的AWS账户。 DIAL是什么？ DIAL（我是否触发了Lambda？） 是一个集中式的安全配置错误检测框架，完全运行在AWS托管服务上，例如AWS API Gateway、AWS Event Bridge和AWS Lambda。以下是DIAL的一些关键特性：...

natlas

Natlas Summary You've got a lot of maps and they are getting pretty unruly. What do you do? You put them in a book and call it an atlas. This is like that, except it's a website and it's a collection of nmaps. Natlas' objective is to make it easy to perform continuous scanning and review collecte...

ROOT-APP-NPM-CVE-2025-68429 CVE-2025-68429 in storybook - Patched by Root

Root has patched CVE-2025-68429 in the storybook package for Root:npm. Multiple fixed versions available...

CatSniffer

CatSniffer Also available at distributors: CatSniffer 😼 is an original multiprotocol, and multiband board made for sniffing, communicating, and attacking IoT Internet of Things devices. It was designed as a highly portable USB stick that integrates the new chips TI CC1352, Semtech SX1262, and an...

cfripper

CFRipper CFRipper is a Library and CLI security analyzer for AWS CloudFormation templates. You can use CFRipper to prevent deploying insecure AWS resources into your Cloud environment. You can write your own compliance checks by adding new custom plugins. Docs and more details available in...

SecLists

关于SecLists SecLists是安全测试者的伴侣。它是在安全评估过程中使用的多种类型列表的集合，集中存放在一个地方。列表类型包括用户名、密码、URL、敏感数据模式、模糊测试载荷、Web Shell等等。目标是让安全测试者能够将这个仓库克隆到一个新的测试机上，并拥有可能需要使用的每一种类型的列表。 该项目由 Daniel Miessler、Jason Haddix、Ignacio Portal 和 g0tmi1k 维护。 仓库详情 安装 Zip root@kitploit: wget -c...

graphw00f

Credits to Nick Aleks for the logo! graphw00f - GraphQL Server Fingerprinting Table of Contents How does it work? Detections GraphQL Threat Matrix Prerequisites Installation Configuration Example Usage Fingerprinting GraphQL Detecting & Fingerprinting GraphQL Support & Issues Resources How does i...

graphw00f

标志致谢 Nick Aleks！ graphw00f - GraphQL 服务器指纹识别 目录 工作原理是什么？ 检测引擎 GraphQL 威胁矩阵 前置条件 安装 配置 使用示例 指纹识别 GraphQL 检测并指纹识别 GraphQL 支持与问题 资源 工作原理是什么？ graphw00f（灵感来源于 wafw00f）是针对 GQL 端点的 GraphQL 指纹识别工具，它通过发送一系列良性和畸形的查询来识别后台运行的 GraphQL 引擎。 graphw00f 将利用 GraphQL 威胁矩阵项目，提供每项技术默认提供的安全防御措施以及它们是默认开启还是关闭的洞察。...

GhidrAssist

GhidrAssist Autor: Jason Tang Un plugin avanzado impulsado por LLM para asistencia interactiva en ingeniería inversa dentro de Ghidra. Descripción GhidrAssist integra Modelos de Lenguaje de Gran Tamaño LLMs en Ghidra para proporcionar asistencia inteligente en la exploración de binarios e...

machinae

Machinae Security Intelligence Collector Machinae is a tool for collecting intelligence from public sites/feeds about various security-related pieces of data: IP addresses, domain names, URLs, email addresses, file hashes and SSL fingerprints. It was inspired by Automater, another excellent tool...

rita

RITA Real Intelligence Threat Analytics If you get value out of RITA and would like to go a step further with hunting automation, futuristic visualizations, and data enrichment, then take a look at AC-Hunter. Brought to you by Active Countermeasures. Sponsored by BHIS. RITA is an open source...

Juiceshopgl

Juice Shop Logo OWASP Juice Shop Test Coverage Maintainability...

IMDSpoof

IMDSPOOF IMDSPOOF is a cyber deception tool that spoofs an AWS IMDS service. One way that attackers are able to escalate privileges or move laterally in a cloud environment is by retrieving AWS Access keys from the IMDS service endpoint located at...

lunasec

LunaTrace LunaTrace is an Open Source supply chain security and auditing tool. At its heart is a web console the tracks your projects and their dependencies, looking for vulnerabilities and other issues. This console is provided as a SAAS available here for free or you can deploy it and manage it...

xioc

xioc Extract indicators of compromise from text, including "escaped" ones like hxxp://banana.com, 1.1.1.1 and phish at malicious dot com. Installation Download a precompiled binary from https://github.com/assafmo/xioc/releases Or... Use go get: root@kitploit: go get -u github.com/assafmo/xioc Or...

popeye

Popeye: Kubernetes Live Cluster Linter Popeye is a utility that scans live Kubernetes clusters and reports potential issues with deployed resources and configurations. As Kubernetes landscapes grows, it is becoming a challenge for a human to track the slew of manifests and policies that orchestra...

kodex

Kodex Community Edition - CE is an open-source toolkit for privacy and security engineering. It helps you to automate data security and data protection measures in your data engineering workflows. It offers the following functionality: Read data items from a variety of sources such as files,...

selinux-notebook

The SELinux Notebook Introduction The SELinux Notebook is an Open Source book on SELinux, originally created by Richard Haines and donated to the SELinux community. The Notebook's goal is to be the most current and comprehensive book on SELinux, covering the Linux Kernel components, the userspace...