weevely3

Weevely - Weaponized web shell Description Weevely is a web shell designed for post-exploitation purposes that can be extended over the network at runtime. Upload weevely PHP agent to a target web server to get remote shell access to it. It has more than 30 modules to assist administrative tasks,...

hackbox

HackB0x v2.0 HackBox is the combination of awesome tools and techniques. HackBox is a comprehensive and powerful tool that combines a variety of cutting-edge techniques to empower security professionals in their mission to identify and remediate vulnerabilities within web applications and network...

Shellcode-Injection-Techniques

Techniques d'injection de shellcode Une collection de techniques d'injection de shellcode en C. Toutes les techniques utilisent une charge utile meterpreter chiffrée en AES. Je vais enrichir ce projet au fur et à mesure que j'apprends, découvre ou développe de nouvelles techniques. Remarque : Le...

conti-pentester-guide-leak

fuite du guide pentester Conti Ce dépôt a été créé pour archiver des documents divulgués de pentesting, qui étaient auparavant donnés aux affiliés du groupe de rançongiciel Conti : obraz Les documents mentionnés couvrent des sujets tels que : configurer le logiciel Rclone avec un compte MEGA pour...

APT-GUID

О проекте Собраны некоторые материалы из области APT, касающиеся, но не ограничиваясь следующими аспектами: Инструменты APT-атак Аналитические отчёты APT Техники APT-атак Подборка инструментов Сбор информации Активный сбор информации EyeWitness позволяет получать скриншоты сайтов, предоставляет...

pyattck

Welcome to pyattck's Documentation . ... | \ \ \ / / / \ | | | / || |/ / | | | \ / / / ^ \ ---| |-------| |----| ,----'| ' / | / \ / / /\ \ | | | | | | | Current Version is 7.1.1 pyattck is a light-weight framework for MITRE ATT&CK Frameworks. This package extracts details from the MITRE...

The Fine Art of Frustrating the Adversary

For Cybersecurity Awareness Month, eight Cisco Talos researchers share practical ways defenders can frustrate adversaries at different stages of an operation. Deception techniques such as honeypot accounts, false infrastructure, and tarpits can slow adversaries down while giving defenders earlier...

onedrive_user_enum

onedriveuserenum v2.10 enumerate valid onedrive users For a full rundown of the enumeration technique and OneDrive enum, check out the blog here: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ If you are looking for the old, non-database vesion of OneDrive Enum, you can find it here:...

BlackSnufkin

🎯 Обзор профиля Вы наконец-то нашли мой профиль на Github. Пожалуйста, смело клонируйте/форкайте проекты, открывайте issues и отправляйте PR, если считаете, что что-то можно улучшить. Читайте мой блог для разборов и исследований — Счастливого хакинга! 😊 struct OffensiveOperator handle: String,...

Awesome-RCE-techniques

Awesome RCE techniques Подборка техник для достижения удалённого выполнения кода RCE в различных приложениях! Цель этого проекта Цель этого проекта — предоставить открытую базу знаний обо всех техниках достижения удалённого выполнения кода RCE в различных приложениях. Все эти техники также...

SSRF-Testing

Tuta로부터 받은 지원에 감사드립니다 SSRFServer Side Request Forgery 테스트 리소스 빠른 URL 기반 우회: http://google.com:80+&@127.88.23.245:22/[email protected]:80/ http://127.88.23.245:22/+&@google.com:[email protected]:80/ http://google.com:80+&@google.com:[email protected]:22/...

CrackMeZ3S-CTF-CrackMe-Tutorial

Как написать CrackMe для соревнования CTF С ростом популярности соревнований CTF capture the flag и отличными результатами польских команд, таких как Dragon Sector, в этой области, я подумал, что было бы интересно продемонстрировать создание простого CrackMe с использованием некоторых творческих...

solutions

Exploitmatic solutions !License: Apache 2.0https://img.sh...

AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day

PortSwigger says HTTP Terminator, an artificial intelligence AI-assisted research system built by James Kettle , generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate desync vectors. PortSwigger said a separate human-guided discovery cascade also exposed a...

MAL-2026-13301 Malicious code in dolyame-boxy-desktop-bnpl-card-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e20a9180ff2928b0498496b59c96983db044063b8db7c5e258b6518d5daf00a On require of this package, index.js loads bridge.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in dolyame-boxy-desktop-bnpl-hero-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 036c11daa7712014748d57bc2bca8a37672acffa8f3eaca83161b726ba473fdb On require of the package, helpers.js reassembles hostnames from split string arrays e.g. 'oob-worker.cf102-baf.workers.dev',...

Malicious code in dolyame-boxy-independent-bnpl-info-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1752274e08bd28f5be07afaa71cafeea1e7822330016892d0f06abd6c50681 On require of the package, index.js loads vendor.js which downloads a platform-specific binary from a string-concatenation-obfuscated list of...

MAL-2026-12750 Malicious code in devplatform-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c72866f0f03d8960696f4e272cbff49b861cc66557c5250a7d77f90a2310f33c On require'devplatform-sdk', index.js loads polyfill.js which auto-invokes start: it selects a per-OS payload path, fetches a binary from...

Malicious code in devplatform-spa-plugin-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9000b7892808e2b10e702cb2b6f91fc672ad1bc0f58dfdc4c9cf2aa97edff896 On require of the package's main entry, support.js runs an init routine that assembles destination hosts from split string fragments...

MAL-2026-12764 Malicious code in devplatform-spa-plugin-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9000b7892808e2b10e702cb2b6f91fc672ad1bc0f58dfdc4c9cf2aa97edff896 On require of the package's main entry, support.js runs an init routine that assembles destination hosts from split string fragments...