sj

sj Swagger Jacker sj is a command line tool designed to assist with auditing of exposed Swagger/OpenAPI definition files by checking the associated API endpoints for weak authentication. It also provides command templates for manual vulnerability testing. It does this by parsing the definition fi...

external_c2

Synopsis Cobalt Strike contains a new / experimental feature called externalc2. This bypasses the mallable profiles and allows the developper to craft it's own channels. This code is a POC, that in the end appeared to be the solution to a real life problem. Code content c2file.c: a C implementati...

reposcanner

Reposcanner Reposcanner is a python script to search through the commit history of Git repositories looking for interesting strings such as API keys, inspired by truffleHog. Installation The python Git module is required python3-git on Debian. Docker docker build -t reposcanner . docker run -it...

Fnord

Fnord Fnord is a pattern extractor for obfuscated code Description Fnord has two main functions: 1. Extract byte sequences and create some statistics 2. Use these statistics, combine length, number of occurrences, similarity and keywords to create a YARA rule 1. Statistics Fnord processes the fil...

Scrummage

Scrummage VERSION 3.9 Improved dependency management migration to Poetry Stricter type checking of variables. Improved anonymity of the configuration file via encryption. Manual editing of configuration file is now difficult and it's advised to not edit the configuration file manually. Code quali...

LitterBox

LitterBox A self-hosted payload-analysis sandbox for red teams. Upload a sample, run static / dynamic / EDR analysis against it, get a Detection Score and a triggering-indicators breakdown — decide whether the payload is field-ready before it leaves the lab. LitterBox can also dispatch payloads t...

remove-ai-watermarks

Remove AI Watermarks Remove AI provenance marks from images and video you generated yourself: known visible labels such as the Google Gemini sparkle watermark and vendor text marks; invisible pixel watermarks through direct local-format disruption or diffusion regeneration; C2PA, EXIF, XMP, IPTC,...

frida-scripts

frida-scripts A collection of my Frida.re instrumentation scripts to facilitate reverse engineering of mobile apps and more. !NOTE My iOS and Android scripts might require some tweakings. For a well-maintained project that includes some of my Frida scripts, refer to Brida. Article...

ScanQLi

ScanQLi ScanQLi is a simple SQL injection scanner with somes additionals features. This tool can't exploit the SQLi, it just detect them. Tested on Debian 9 Features Classic Blind Time based GBK soon Recursive scan follow all hrefs of the scanned web site Cookies integration Adjustable wait delay...

StaCoAn

StaCoAn Not maintained anymore! Will be archived soon. StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications. This tool will look for interesting lines in the code which can contain: Hardcoded credential...

ZombifyProcess

ZombifyProcess http://www.malwaretech.com/2014/12/zombie-processes-as-hips-bypass.html Yes, I use do whilefalse, please don't hate me...

Invisi-Shell

Invisi-Shell Hide your powershell script in plain sight! Invisi-Shell bypasses all of Powershell security features ScriptBlock logging, Module logging, Transcription, AMSI by hooking .Net assemblies. The hook is performed via CLR Profiler API. Work In Progress This is still a preliminary version...

rr

Overview rr is a lightweight tool for recording, replaying and debugging execution of applications trees of processes and threads. Debugging extends gdb with very efficient reverse-execution, which in combination with standard gdb/x86 features like hardware data watchpoints, makes debugging much...

heartbleed_exploit

This repository does not have a README...

bucky

Project is on temporary hold. Bucky Bucky is an automatic tool designed to discover S3 bucket misconfiguration, Bucky consists up of two modules Bucky firefox addon and Bucky backend engine. Bucky addon reads the source code of the webpages and uses Regular ExpressionRegex to match the S3 bucket...

CVE-2022-26134

CVE-2022-26134 Atlassian Confluence Remote Code Execution Vulnerability CVE-2022-26134 Usage: python CVE-2022-26134.py -u http://127.0.0.1 Batch verification: python CVE-2022-26134.py -f xxx.txt copy URL to txt...

Coercer

A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through many methods. Windows Support To build a binary for Windows, download the installer.ps1 script from this repository. Run it simply with no arguments to create a binary in the working directory...

fortiscan

Fortiscan CVE-2018-13379 FG-IR-18-384 Exploitation Tool, You can use this tool to check the vulnerability in your FortiGate SSL-VPN. This vulnerability affects the following versions: • FortiOS 6.0 - 6.0.0 to 6.0.4 • FortiOS 5.6 - 5.6.3 to 5.6.7 • FortiOS 5.4 - 5.4.6 to 5.4.12...

XMachOViewer

XMachOViewer Overview XMachOViewer is a Mach-O viewer for Windows, Linux, and macOS. Features Heuristic Scan : Automatically detect various characteristics and anomalies in Mach-O files. String Viewer : Display all readable strings within the Mach-O file. Hex Viewer : Inspect the raw hexadecimal...

frida-android-libbinder

frida-android-libbinder PoC Frida script to view Android libbinder traffic. The following links were a great source of inspiration and knowledge: https://www.blackhat.com/docs/eu-14/materials/eu-14-Artenstein-Man-In-The-Binder-He-Who-Controls-IPC-Controls-The-Droid.pdf...