exfilkit

exfilkit Data exfiltration utility for testing detection capabilities Description Data exfiltration utility used for testing detection capabilities of security products. Obviously for legal purposes only. Exfiltration How-To /etc/shadow - HTTP GET requests Server root@kitploit: ./exfilkit-cli.py ...

exfilkit

exfilkit 用于测试检测能力的数据外泄工具 描述 用于测试安全产品检测能力的数据外泄工具。显然仅用于合法目的。 外泄操作指南 /etc/shadow - HTTP GET 请求 Server root@kitploit: ./exfilkit-cli.py -m exfilkit.methods.http.paramcipher.GETServer -lp 80 -o output.log Client root@kitploit: $ ./exfilkit-cli.py -m exfilkit.methods.http.paramcipher.GETClient -rh...

GoEnumerator

ABOUT GoEnumerator GoEnumerator is a tool I'm writing for the fun of it but to also use for my own enumeration, so I will be keep adding more features to try to speed up the first steps on any CTF enumeration or profesional pentest, as I will add features and options to make the tool to not trigg...

openapi-parser

openapi-parser !UPDATE This extension has been updated to use the latest Burp Montoya Java API. The extension has undergone a complete overhaul to improve both its UI/UX and performance. These changes ensure that the extension is modern and optimised for use. openapi-parser is a extension designe...

xcavator

xcavator A network data locater using credentials obtained during penetration tests. Xcavator is a tool that scans a range of IP addresses for services that host files FTP, FTPS and SMB at the moment and for given credentials it will try to download everything it can and scan within the files for...

Vulnerable-Web-Application

Vulnerable Web Application What is Vulnerable-Web-Application Vulnerable-Web-Application is a website that is prepared for people who are interested in web penetration and who want to have information about this subject or to be working. In fact, the website is quite simple to install and use...

terragoat

TerraGoat - 易受攻击的 Terraform 基础设施 TerraGoat 是 Bridgecrew 的 "Vulnerable by Design" Terraform 仓库。 TerraGoat 是 Bridgecrew 的 "Vulnerable by Design" Terraform 仓库。 TerraGoat 是一个学习和培训项目，演示了常见配置错误如何进入生产云环境。 目录 介绍 开始使用 AWS Azure GCP 贡献 支持 介绍 TerraGoat 的构建是为了使 DevSecOps 能够设计和实施可持续的配置错误预防策略。它可以用于测试策略即代码框架，如 ...

VECTR

VECTR documentation: https://docs.vectr.io VECTR Community Discord Channel: https://discord.gg/2FRd8zf728 VECTR is a tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarios. VECTR provides the...

frida

frida 此仓库包含用于Android应用渗透测试的各种Frida脚本。我创建此项目是为了展示Frida动态分析框架的能力。你可以在Medium上阅读我的《Frida简介》博客文章，其中我解释了如何将Frida与Android结合使用。 下载 你可以直接克隆仓库，或前往发布页面下载Frida脚本。 root@kitploit: git clone https://github.com/t0thkr1s/frida 安装 你必须在系统上安装Frida。可以通过以下方式安装： root@kitploit: pip3 install frida-tools 免责声明...

pentest-tools

渗透测试工具集 一套满足快速需求的自定义安全工具集合。 重要说明 ‼ 2022年11月进行了一次大清理 ‼ 一些无用/无法使用的脚本已被归档，另一些则已移至各自独立的仓库以获得更多关注，欢迎查看： apk-analyzer cloudflare-origin-ip csp-analyzer detectify-cves extract-endpoints favicon-hashtrick google-search graphql-introspection-analyzer keyhacks.sh related-domains 安装 root@kitploit: git clone...

test-vuln

test-vuln a controlled environment to test CVE-2025-55182...

enum_shares

enumshares Shared folders enumeration tool EnumShares enumerates shared folders across the network and under a custom user account. It can check if the shared folder is writable for the current user. It can save you a lot of time when you need to discover directories allowing "write" to everyone ...

pegasus-neo

root@kitploit: | \ | \ | | | | / / |/ / | | | / | | | | / / | | | \ \ || \ \ |\ | || |, |,|/,|/| | |/ ███▄ █ ▓█████ ▒█████ ██ ▀█ █ ▓█ ▀ ▒██▒ ██▒ ▓██ ▀█ ██▒▒███ ▒██░ ██▒ ▓██▒ ▐▌██▒▒▓█ ▄ ▒██ ██░ ▒██░ ▓██░░▒████▒░ ████▓▒░ ░ ▒░ ▒ ▒ ░░ ▒░ ░░ ▒░▒░▒░ ░ ░░ ░ ▒░ ░ ░ ░ ░ ▒ ▒░ ░ ░ ░ ░ ░ ░ ░ ▒ ░ ░ ░ ░ ░...

xerosploit

Xerosploit Xerosploit is a penetration testing toolkit whose goal is to perform man in the middle attacks for testing purposes. It brings various modules that allow to realise efficient attacks, and also allows to carry out denial of service attacks and port scanning. Powered by bettercap and nma...

pentest-muse-cli

Pentest Muse Pentest Muse is an AI assistant tailored for cybersecurity professionals. It can help penetration testers brainstorm ideas, write payloads, analyze code, and perform reconnaissance. It can also take actions, execute command line codes, and iteratively solve complex tasks. Pentest Mus...

redsnarf

root@kitploit: . \ \ | / / / \ | // \ / |\ \ / \ \ \ \ | | \ // // |/ \ | / | | /| | || /\ / /| /| || / / / / / / [email protected] @redsnarf RedSnarf is a pen-testing / red-teaming tool by Ed Williams for retrieving hashes and credentials from Windows workstations, servers and...

WinPwn

Sponsored by WinPwn In many past internal penetration tests I often had problems with the existing Powershell Recon / Exploitation scripts due to missing proxy support. I also often ran the same scripts one after the other to get information about the current system and/or the domain. To automate...

sippts

What is Sippts? Sippts is a set of tools to audit VoIP servers and devices using the SIP protocol. Sippts is programmed in Python and it allows us to check the security of a VoIP server using the SIP protocol. Is it free? Yes. You can freely use, modify and distribute it. If you modify it, please...

extended-ssrf-search

Extended ssrf search This tool search for SSRF using predefined settings in different parts of a request path, host, headers, post and get parameters. First step Rename example.app-settings.conf to app-settings.conf and adjust settings. The most important setting is the callback url. I recommend ...

pumba

用于 Docker、containerd 和 Podman 的混沌测试工具 快速开始 · 用户指南 · 网络混沌 · 部署 · 贡献 Pumba 是一款用于 Docker、containerd 和 Podman 容器的混沌测试与网络模拟工具。受到 Netflix Chaos Monkey 的启发，Pumba 将混沌工程带入容器层面——杀死、停止、暂停和删除容器，注入网络延迟和数据包丢失，或对容器资源进行压力测试。 工作原理 root@kitploit: graph LR APumba CLI --|Docker API / containerd API / Podman compat...