xerosploit

Xerosploit Xerosploit is a penetration testing toolkit whose goal is to perform man in the middle attacks for testing purposes. It brings various modules that allow to realise efficient attacks, and also allows to carry out denial of service attacks and port scanning. Powered by bettercap and nma...

pentest-muse-cli

Pentest Muse Pentest Muse is an AI assistant tailored for cybersecurity professionals. It can help penetration testers brainstorm ideas, write payloads, analyze code, and perform reconnaissance. It can also take actions, execute command line codes, and iteratively solve complex tasks. Pentest Mus...

redsnarf

root@kitploit: . \ \ | / / / \ | // \ / |\ \ / \ \ \ \ | | \ // // |/ \ | / | | /| | || /\ / /| /| || / / / / / / [email protected] @redsnarf RedSnarf is a pen-testing / red-teaming tool by Ed Williams for retrieving hashes and credentials from Windows workstations, servers and...

WinPwn

Sponsored by WinPwn In many past internal penetration tests I often had problems with the existing Powershell Recon / Exploitation scripts due to missing proxy support. I also often ran the same scripts one after the other to get information about the current system and/or the domain. To automate...

sippts

What is Sippts? Sippts is a set of tools to audit VoIP servers and devices using the SIP protocol. Sippts is programmed in Python and it allows us to check the security of a VoIP server using the SIP protocol. Is it free? Yes. You can freely use, modify and distribute it. If you modify it, please...

extended-ssrf-search

Extended ssrf search This tool search for SSRF using predefined settings in different parts of a request path, host, headers, post and get parameters. First step Rename example.app-settings.conf to app-settings.conf and adjust settings. The most important setting is the callback url. I recommend ...

pumba

用于 Docker、containerd 和 Podman 的混沌测试工具 快速开始 · 用户指南 · 网络混沌 · 部署 · 贡献 Pumba 是一款用于 Docker、containerd 和 Podman 容器的混沌测试与网络模拟工具。受到 Netflix Chaos Monkey 的启发，Pumba 将混沌工程带入容器层面——杀死、停止、暂停和删除容器，注入网络延迟和数据包丢失，或对容器资源进行压力测试。 工作原理 root@kitploit: graph LR APumba CLI --|Docker API / containerd API / Podman compat...

pulsar

PULSAR 协议学习、模拟与状态化模糊测试 Pulsar 是一个具备自动协议学习与模拟能力的网络模糊测试工具。该工具通过机器学习技术（如聚类和马尔可夫模型）对协议进行建模。这些模型可用于模拟 Pulsar 与真实客户端或服务器之间的通信，借助语义正确的消息，并结合一系列模糊测试原语，能够在协议状态机的更深层次测试未知协议实现的错误。 有关 Pulsar 实现方法的详细信息，可阅读以下论文： Pulsar: Stateful Black-Box Fuzzing of Proprietary Network Protocols Hugo Gascon, Christian...

network-attacker

Network-Attacker network-attacker V0.1 is a Wifi Stress Testing Bash Script Program Based on Mdk3 Beacon Flooding & Deauthentication Attack Created To Help Beginners And even Professionals For a beacon Flooding Or Deauthentication Attack On Networks Installation root@kitploit: sudo apt-get instal...

Upload_Bypass

UploadBypass v3 About Upload Bypass is a simple tool designed to assist penetration testers and bug hunters in testing file upload mechanisms. It leverages various bug bounty techniques to simplify the process of identifying and exploiting vulnerabilities, ensuring thorough assessments of web...

agartha

Agartha Payload Injection LFI, RCE, SQLi, with optional BCheck, Auth Issues Access Matrix, HTTP 403, Copy as JavaScript, and Bambdas Agartha, specializes in advance payload generation and access control assessment. It adeptly identifies vulnerabilities related to injection attacks, and...

ZX-DDoS

ZX-DDoS ZX-DDoS is a Python-based DDoS Tool for educational and testing purposes only. DISCLAIMER: This repository is strictly for educational, research, and network testing purposes only. The author is not responsible for any misuse or illegal activities. Repository:...

hacktronian

Pentesing Tools That All Hacker Needs. HACKTRONIAN Menu : Information Gathering Password Attacks Wireless Testing Exploitation Tools Sniffing & Spoofing Web Hacking Private Web Hacking Post Exploitation Install The HACKTRONIAN Information Gathering: Nmap Setoolkit Port Scanning Host To IP wordpre...

hacktronian

所有黑客需要的渗透测试工具。 HACKTRONIAN 菜单 : 信息收集 密码攻击 无线测试 利用工具 嗅探与欺骗 Web 黑客 私有 Web 黑客 后期利用 安装 HACKTRONIAN 信息收集: Nmap Setoolkit 端口扫描 主机转 IP WordPress 用户 CMS 扫描器 XSStrike Dork - Google Dork 被动漏洞审计 扫描服务器用户 Crips 密码攻击: Cupp Ncrack 无线测试: reaver pixiewps Fluxion 利用工具: ATSCAN sqlmap Shellnoob commix FTP 自动绕过...

WindowsProtocolTestSuites

Windows Protocol Test Suites Windows Protocol Test Suites provide interoperability testing against the implementation of Windows open specifications including File Services, Identity Management, Remote Desktop and etc. Originally developed for in-house testing of the Microsoft Open Specifications...

ezXSS

ezXSS is an easy way for penetration testers and bug bounty hunters to test blind Cross Site Scripting. ezXSS is a tool that is designed to help find and exploit cross-site scripting XSS vulnerabilities. One of the key features of ezXSS is its ability to identify and exploit blind XSS...

MFASweep

MFASweep MFASweep is a PowerShell script that attempts to log in to various Microsoft services using a provided set of credentials and will attempt to identify if MFA is enabled. Depending on how conditional access policies and other multi-factor authentication settings are configured some...

discover

root@kitploit: Custom bash scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload creation using Metasploit. For use with Kali Linux or Ubuntu. Lee Baird @discoverscripts Jay "L1ghtn1ng" Townsend @jaytownsend1 Jason Ashton @ninewir...

sslyze

Note Current development of SSLyze now takes place on a separate repository: https://github.com/nabla-c0d3/sslyze. This repository will periodically be updated from this new parent repository, but for the most current version, please check the new repo. If you cloned the repository but wish to...

tactical-exploitation

tactical-exploitation "渗透测试的另一种方式" -- HD Moore & Valsmith 我一直大力提倡战术化渗透测试方法，它不专注于利用已知的软件漏洞，而是依赖信息收集和暴力破解等老派技术。尽管我能够理解适时使用 0day 漏洞偶尔会有的用处，但作为资深渗透测试人员，我更喜欢无漏洞利用（exploit-less）的方法。战术化利用通过利用流程漏洞，提供了一种更顺畅、更可靠地攻陷目标的方式，同时最大限度地减少攻击检测和其他不良副作用。 本仓库旨在提供一套战术化利用工具包，以协助渗透测试人员完成其任务。目前已发布的工具描述如下。另请参阅...