FinalRecon

Twitter - Telegram - thewhiteh4t's Blog FinalRecon is an all in one automatic web reconnaissance tool written in python. Goal of FinalRecon is to provide an overview of the target in a short amount of time while maintaining the accuracy of results. Instead of executing several tools one after...

CVE-2024-40898

CVE-2024-40898 This Python script checks for the presence of CVE-2024-40898, a critical vulnerability in Apache HTTP Server that may allow SSL/TLS certificate verification bypass under certain misconfigurations. It initiates an SSL connection to the target server and sends a HEAD request. It...

Meterpreter_Paranoid_Mode-SSL

MeterpreterParanoidMode v1.4 - SSL/TLS connections Version release: v1.4 Stable Author: pedro ubuntu r00t-3xp10it Distros Supported : Linux Kali, Mint, Ubuntu Suspicious-Shell-Activity SSA RedTeam develop @2017 Description: MeterpreterParanoidMode.sh allows users to secure your staged/stageless...

censys-subdomain-finder

Censys subdomain finder Important note : As of late 2024, Censys does not provide API access to free accounts anymore. This is a tool to enumerate subdomains using the Certificate Transparency logs stored in Censys Search. It should return any subdomain who has ever been issued a SSL certificate ...

moniorg

moniorg Description By looking through CT logs an attacker can gather a lot of information about organization's infrastructure i.e. internal domains,email addresses in a completly passive manner. moniorg leverage certificate transparency logs to monitor for newly issued domains based on...

CloudFlair

CloudFlair Important note: As of late 2024, Censys does not provide API access to free accounts anymore. This means CloudFlair does not work with free Censys accounts anymore. CloudFlair is a tool to find origin servers of websites protected by CloudFlare or CloudFront which are publicly exposed...

NcStatusCheck

NcStatusCheck Centralized monitoring for multiple Nextcloud instances NcStatusCheck is a monitoring tool that lets you track the health of multiple Nextcloud servers from a single web interface: Nextcloud and PHP versions against their security floor, branch end of life, reachability, configurati...

csaf

The Cyber Security Awareness Framework CSAF is a structured approach aimed at enhancing cybersecurity awareness and understanding among individuals, organizations, and communities. It provides guidance for the development of effective cybersecurity awareness programs, covering key areas such as...

ssl-certificate-expiry-date-checker

sslcertificateexpirydatechecker Find out which cerificate will expire and need to renew. Find various information from scan result expire date, issuer, signature, serial number... If you are ssl cerificate manager in your organization, collect the list from your coworker, teams, and check the...

webscreenshot

webscreenshot 설명 웹사이트 목록을 스크린샷하는 간단한 스크립트로, url-to-image PhantomJS 스크립트를 기반으로 합니다. 기능 url-to-image의 'lazy-rendering'을 AJAX 리소스에 통합 Windows 및 Linux 시스템에서 완벽하게 작동 PhantomJS 렌더러를 위한 쿠키 및 사용자 정의 HTTP 헤더 정의 지원 멀티프로세싱 및 사용자 정의 시간 초과 후 응답하지 않는 프로세스 종료 여러 형식을 입력 대상으로 허용 스크린샷 크기너비, 높이, 형식 및 품질 사용자 정의 SSL ...

openssl

Welcome to the OpenSSL Project !openssl logowww.openssl.org !github actions ci badgegithub actions ci OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit for the Transport Layer Security TLS, formerly SSL, Datagram TLS DTLS, and QUIC protocols. The protocol implementations ar...

mkchain

mkchain Open source tool to help you build a valid SSL certificate chain. Description • How To Use • Parameters • How it works • Requirements • Other • License Description Is an open source tool to help you build a valid SSL certificate chain. Also can help you fix the incomplete chain and downlo...

zeek-asyncrat-detector

Zeek ベースの AsyncRAT マルウェア検出器 マルウェアは、そのコマンド＆コントロール（C2）サーバーとの通信をHTTPS上に隠すことがよくあります。 HTTPSの暗号化により、マルウェアは通常、その目的を達成するのに十分な期間、侵害を隠蔽します。そのため、HTTPSを使用するマルウェアの検出は困難ですが、今回のAsyncRATのように、時には幸運な突破口が得られることもあります。AsyncRATは、過去1年間に米国の重要インフラを管理する組織を標的として展開されてきたWindowsリモートアクセスツールです。 Notice.log 出力の例 separator \x09...

CloudRecon

CloudRecon Finding assets from certificates! Scan the web! Tool presented @DEFCON 31 BY Gunnar Andrews @G0LDENinfosec Jason Haddix @Jhaddix Install You must have CGO enabled, and may have to install gcc to run CloudRecon sudo apt install gcc go install github.com/g0ldencybersec/CloudRecon@latest...

zeek-quasarrat-detector

Zeek 기반 QuasarRAT 악성코드 탐지기 악성코드는 종종 HTTPS를 통해 명령 및 제어C2 서버와의 통신을 숨깁니다. HTTPS의 암호화는 일반적으로 악성코드가 목표를 달성할 수 있을 만큼 오랫동안 감염 사실을 은폐합니다. 이로 인해 HTTPS를 사용하는 악성코드 탐지는 어렵지만, 때때로 운이 따라주는 경우가 있습니다. 지난 1년 동안 미국의 중요 인프라를 관리하는 조직을 표적으로 삼아 배포된 Windows 원격 액세스 도구인 QuasarRAT이 바로 그런 사례입니다. Notice.log 출력 예시 separator...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

Invoke-SelfSignedWebRequest

Invoke-SelfSignedWebRequest InfoSec 작업에서 HTTPS를 사용하는 것은 C2 및 대상 네트워크 공간 내에서 기동을 위한 매우 편리한 메커니즘입니다. 또한 PowerShell은 운영자가 동적 결과를 얻을 수 있도록 도와주는 놀라운 생산성 도구입니다. 자연스러운 다음 결론은 C2 채널HTTPS과 효과 생성기PowerShell를 결합하는 것입니다. 빠른 자체 서명 인증서를 생성하면 모든 것이 순조로울까요? 불행히도 Microsoft그리고 확장하여 PowerShell는 유효성을 검사할 수 없는 인증서로...

loboguara

Lobo Guará - Cyber Threat Intelligence Platform Lobo Guará is a platform aimed at cybersecurity professionals, with various features focused on Cyber Threat Intelligence CTI. It offers tools that make it easier to identify threats, monitor data leaks, analyze suspicious domains and URLs, and much...

unwaf

Unwaf Unwafは、パッシブテクニック を用いてWAFバイパスの特定を支援するために設計されたGoツールです。複数の発見手法を組み合わせ、HTML類似度比較、SSL証明書フィンガープリント、HTTPヘッダー分析を通じて候補を検証することで、WAF/CDN背後にある実際のオリジンIPを発見するプロセスを自動化します。 Unwafは、こちらのLinkedIn投稿で説明した手順を自動化するものです: Passive WAF bypassing 現在のバージョン: 3.0.0 — バージョン履歴についてはCHANGELOG.mdを参照してください。 目次 仕組み 発見手法 検証手法...

FUCK-CDN

FUCK-CDN あらゆる手段を尽くして、CDN の下着を剥ぎ取り、真の IP を見つけ出す。 Claude Code のために作られた自動化 CDN オリジンサーバー追跡スキル（Skill）。対象ドメインを入力すると、優先度に従って 40 種類以上の OSINT 手法を自動実行し、証拠チェーンを構築して最終判定を出力します。 ╔══════════════════════════════════════════════════╗ ║ 真の IP: 103...32 ║ ║ 信頼度: 確定 95%+ ║ ║ 所在地: 中国広東深圳 · 電信 ║ ║ 証拠チェーン: S SSL証明書の完全...