wsh

wsh wsh pronounced woosh is a web shell generator and command line interface. This started off as just an http client since interacting with webshells is a pain. There's a form, to send a command you have to type in an input box and press a button. I wanted something that fits into my workflow...

BloodHound

BloodHound 是一个单体 Web 应用程序，由嵌入的 React 前端（使用 Sigma.js）和基于 Go 的 REST API 后端组成。它部署了 Postgresql 应用数据库和 Neo4j 图数据库，并由 SharpHound 和 AzureHound 数据收集器提供数据。 BloodHound 利用图论揭示身份和访问管理系统中隐藏且通常非预期的关系。由 OpenGraph 驱动，BloodHound 现已支持超越 Active Directory 和 Azure 环境的全面分析，使用户能够映射跨多种身份平台的复杂权限关系。攻击者可以利用 BloodHound...

BloodHound

BloodHound is a monolithic web application composed of an embedded React frontend with Sigma.js and a Go based REST API backend. It is deployed with a Postgresql application database and a Neo4j graph database, and is fed by the SharpHound and AzureHound data collectors. BloodHound leverages grap...

exitmap

This repository is unmaintained. Refer toThe Tor Project's fork. Overview Exitmap is a fast and modular Python-based scanner for Tor exit relays. Exitmap modules implement tasks that are run over a subset of all exit relays. If you have a background in functional programming, think of exitmap as ...

HydraDragonAntivirus openedr-v2-release-portable-9

Hydra Dragon Antivirus 📚 For detailed documentation, architecture diagrams, and component guides, visit our Project Wiki. WARNING: ACTIVE DEVELOPMENT IN PROGRESS This project is not production-ready. Breaking changes, bugs, and incomplete features should be expected. ⚠️ NOTICE: This repository is...

jwt_tool

JSON Web Token 工具包 v2 jwttool.py 是一个用于验证、伪造、扫描和篡改 JWT（JSON Web Token）的工具包。 其功能包括： 检查令牌的有效性 测试已知漏洞利用： CVE-2015-2951 alg=none 签名绕过漏洞 CVE-2016-10555 RS/HS256 公钥不匹配漏洞 CVE-2018-0114 密钥注入 漏洞 CVE-2019-20933/CVE-2020-28637 空白密码 漏洞 CVE-2020-28042 空签名 漏洞 CVE-2022-21449 Psychic Signature ECDSA 漏洞 扫描错误配置或已知弱...

purpleteam-orchestrator

purpleteam orchestrator Orchestrator component of purpleteam - Currently in alpha Clone this repository. cd to the repository root directory and run: root@kitploit: npm install Configuration...

Wynis

Wynis Just a powershell scripts for auditing security with BEST Practices Windows env You just need to run the script, it will create a directory named : AUDITCONF%MACHINENAME%DATE% Actualy, the script are : -WynisWIN2016DC-CISv1.0 : Auditing DC 2016 with CIS -Wynis-AD : Auditing Domain Security...

ssh-mitm

SSH MITM v2.3-dev Author: Joe Testa @therealjoetesta Overview This penetration testing tool allows an auditor to intercept SSH connections. A patch applied to the OpenSSH v7.5p1 source code causes it to act as a proxy between the victim and their intended SSH server; all plaintext passwords and...

yaraQA

yaraQA YARA rule Analyzer to improve rule quality and performance Why? YARA rules can be syntactically correct but still dysfunctional. yaraQA tries to find and report these issues to the author or maintainer of a YARA rule set. The issues yaraQA tries to detect are e.g.: rules that are...

arsenal

Arsenal Arsenal is just a quick inventory, reminder and launcher for pentest commands. This project written by pentesters for pentesters simplify the use of all the hard-to-remember commands In arsenal you can search for a command, select one and it's prefilled directly in your terminal. This...

GeoSentinel

🌍 GeoSentinel GeoSentinel 是一个地理空间监控平台，可实时跟踪全球动向。 它将船舶和航班路线、实时坐标以及地理数据整合到一个统一系统中，为分析、可视化和决策提供清晰的地理和地缘政治洞察。 🚀 !TIP 🚀 访问博客（Geo Sentinel 更新与见解） 🌐 打开博客 🚀 官方网站 🌍 访问网站 🚀 官方网站 🌍 访问网站 !CAUTION 🚨 Geo Sentinel AI 更新 — 及时了解最新的 Geo Sentinel AI 版本和公告。 📝 在此订阅 🎥 视频教程 — 了解如何使用 Geo Sentinel AI 。 ▶️ 观看视频 🎥 视频教程 — Ge...

parameth

parameth 该工具可用于暴力发现GET和POST参数 通常，当你在目录中爆破常见文件时，可能会识别出一些看起来需要传入未知参数的脚本（例如test.php）。该工具有望帮助你找到这些参数。 示例扫描 -off 标志允许你指定一个偏移量（有助于处理动态页面），例如，如果你得到交替的响应大小4444和4448，将偏移量设为5，工具将仅显示超出正常范围的内容。 安装 root@kitploit: virtualenv venv . ./venv/bin/activate pip install -u -r requirements.txt 用法 root@kitploit: usage:...

parameth

parameth This tool can be used to brute discover GET and POST parameters Often when you are busting a directory for common files, you can identify scripts for example test.php that look like they need to be passed an unknown parameter. This hopefully can help find them. example scan The -off flag...

vet

Quick Start • Documentation • Community !NOTE vet supports special mode for Agent Skills. Run vet scan --agent-skill to scan an Agent Skill hosted in a GitHub repository. Why vet? 70-90% of modern software is open source code — how do you know it's safe? Traditional SCA tools drown you in CVE...

ghosthound

GhostHound GhostHound es una extensión de OpenGraph de BloodHound para Active Directory. SharpHound y todos los demás recopiladores de AD omiten CN=Deleted Objects: los objetos eliminados tombstones son invisibles para el análisis de rutas de ataque estándar de BloodHound, aunque la Papelera de...

megplus

meg+ Deprecated Automated reconnaissance wrapper — TomNomNom's meg on steroids. Built by TomNomNom and EdOverflow. About This wrapper will automate numerous tasks and help you during your reconnaissance process. The script finds common issues, low hanging fruit, and assists you when approaching a...

StayKit

StayKit - Cobalt Strike persistence kit StayKit is an extension for Cobalt Strike persistence by leveraging the executeassembly function with the SharpStay .NET assembly. The aggressor script handles payload creation by reading the template files for a specific execution type. IMPORTANT: To use t...

pyrebox

================ ARCHIVED PROJECT THIS PROJECT HAS BEEN ARCHIVED AND ITS ISSUE QUEUE IS LOCKED. THE PROJECT WILL BE KEPT PUBLIC ONLY FOR REFERENCE PURPORSES. .. image:: docs/media/pyreboxlogolightbg.png .. QEMU: http://qemu.org/ .. DECAF: https://github.com/sycurelab/DECAF .. S2E:...

SourceWolf

SourceWolf ​ Tested environments: Windows, MAC, linux, and windows subsystem for linux WSL Sponsors Support this project by becoming a sponsor. Checkout these awesome sponsors: Oxylabs provides premium proxies with 100M+ IPs across 195 countries and ready-to-use Scraper APIs. You can use this...