censys-subdomain-finder

Censys subdomain finder Important note : As of late 2024, Censys does not provide API access to free accounts anymore. This is a tool to enumerate subdomains using the Certificate Transparency logs stored in Censys Search. It should return any subdomain who has ever been issued a SSL certificate ...

openssl

Welcome to the OpenSSL Project !openssl logowww.openssl.org !github actions ci badgegithub actions ci OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit for the Transport Layer Security TLS, formerly SSL, Datagram TLS DTLS, and QUIC protocols. The protocol implementations ar...

FinalRecon

Twitter - Telegram - thewhiteh4t's Blog FinalRecon is an all in one automatic web reconnaissance tool written in python. Goal of FinalRecon is to provide an overview of the target in a short amount of time while maintaining the accuracy of results. Instead of executing several tools one after...

NcStatusCheck

NcStatusCheck Centralized monitoring for multiple Nextcloud instances NcStatusCheck is a monitoring tool that lets you track the health of multiple Nextcloud servers from a single web interface: Nextcloud and PHP versions against their security floor, branch end of life, reachability, configurati...

CloudRecon

CloudRecon Finding assets from certificates! Scan the web! Tool presented @DEFCON 31 BY Gunnar Andrews @G0LDENinfosec Jason Haddix @Jhaddix Install You must have CGO enabled, and may have to install gcc to run CloudRecon sudo apt install gcc go install github.com/g0ldencybersec/CloudRecon@latest...

CVE-2022-0778

CVE-2022-0778 Description We refer to the concept of drago-96 and then rewrite a PoC based on the P12 and PEM format. You can use it to verify the CVE-2022-0778 vulns, i.e., a dangerous SSL certificate without any private password, leave it empty. If the device is affected, it may cause the CPU o...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

mkchain

mkchain Open source tool to help you build a valid SSL certificate chain. Description • How To Use • Parameters • How it works • Requirements • Other • License Description Is an open source tool to help you build a valid SSL certificate chain. Also can help you fix the incomplete chain and downlo...

Meterpreter_Paranoid_Mode-SSL

MeterpreterParanoidMode v1.4 - SSL/TLS connections Version release: v1.4 Stable Author: pedro ubuntu r00t-3xp10it Distros Supported : Linux Kali, Mint, Ubuntu Suspicious-Shell-Activity SSA RedTeam develop @2017 Description: MeterpreterParanoidMode.sh allows users to secure your staged/stageless...

CloudFlair

CloudFlair Important note: As of late 2024, Censys does not provide API access to free accounts anymore. This means CloudFlair does not work with free Censys accounts anymore. CloudFlair is a tool to find origin servers of websites protected by CloudFlare or CloudFront which are publicly exposed...

openssl-heartbleed-fix

openssl-heartbleed-fix OpenSSL Heartbleed CVE-2014-0160 Fix script Sammy Fung [email protected] OpenSSL Heartbleed CVE-2014-0160 http://www.us-cert.gov/ncas/alerts/TA14-098A bug is now discovered by network security professionals, which many systems using some OpenSSL versions are affected. ...

CVE-2024-40898-SSL-Bypass-Detection

CVE-2024-40898 SSL Certificate Validation Bypass Scanner This repository contains a Python-based proof-of-concept PoC script to detect CVE-2024-40898, a vulnerability in Apache HTTP Server that allows attackers to bypass SSL certificate verification. Overview CVE-2024-40898 is a security issue in...

CVE-2024-40898

CVE-2024-40898 This Python script checks for the presence of CVE-2024-40898, a critical vulnerability in Apache HTTP Server that may allow SSL/TLS certificate verification bypass under certain misconfigurations. It initiates an SSL connection to the target server and sends a HEAD request. It...

zeek-asyncrat-detector

A Zeek Based AsyncRAT Malware Detector Malware often hides communications with its command and control C2 server over HTTPS. The encryption in HTTPS usually conceals the compromise long enough for the malware to accomplish its goal. This makes detecting malware that uses HTTPS challenging, but on...

zeek-quasarrat-detector

A Zeek Based QuasarRAT Malware Detector Malware often hides communications with its command and control C2 server over HTTPS. The encryption in HTTPS usually conceals the compromise long enough for the malware to accomplish its goal. This makes detecting malware that uses HTTPS challenging, but...

csaf

The Cyber Security Awareness Framework CSAF is a structured approach aimed at enhancing cybersecurity awareness and understanding among individuals, organizations, and communities. It provides guidance for the development of effective cybersecurity awareness programs, covering key areas such as...

Invoke-SelfSignedWebRequest

Invoke-SelfSignedWebRequest For InfoSec work, using HTTPS is an incredibly handy mechanism for C2 and maneuver within target network space. Further PowerShell is an amazing productivity tool that can help an operator achieve dynamic results. A natural next conclusion is to combine the C2 channel...

SecAdvisory

July 2, 2019 FN21 Man-in-the-middle Vulnerability related to vCenter CVE-2019-11242 Problem Description A man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform version 5.x and 6.x prior to 6.1.1c. Cohesity clusters did not verify TLS certificates presented b...

ssl-certificate-expiry-date-checker

sslcertificateexpirydatechecker Find out which cerificate will expire and need to renew. Find various information from scan result expire date, issuer, signature, serial number... If you are ssl cerificate manager in your organization, collect the list from your coworker, teams, and check the...

moniorg

moniorg Description By looking through CT logs an attacker can gather a lot of information about organization's infrastructure i.e. internal domains,email addresses in a completly passive manner. moniorg leverage certificate transparency logs to monitor for newly issued domains based on...