reverse-ssh

ReverseSSH A statically-linked ssh server with a reverse connection feature for simple yet powerful remote access. Most useful during HackTheBox challenges, CTFs or similar. Has been developed and was extensively used during OSCP exam preparation. Get the latest Release Features Catching a revers...

ICMP-TransferTools

ICMP-TransferTools ICMP-TransferTools is a set of scripts designed to move files to and from Windows hosts in restricted network environments. This is accomplished using a total of 4 different files, consisting of a python server and powershell client for each transfer direction Download & Upload...

HTTP-Shell

HTTP-Shell HTTP-Shell is Multiplatform Reverse Shell. This tool helps you to obtain a shell-like interface on a reverse connection over HTTP. Unlike other reverse shells, the main goal of the tool is to use it in conjunction with Microsoft Dev Tunnels, in order to get a connection as close as...

ReverseTCPShell

ReverseTCP Shell Framework root@kitploit: | \ | / | \ / | | | | | | | | | | | | | | | | | | | || | | | | | // \ \ / / \ '/ |/ \ | | | | / \ | |/ \ | | | | \ \ /\ V / / | \ \ / | | || | | | | | / | | || \| / || |/|| || |/|| ||||| - By: @ZHacker13 - | Modules | - Show C2-Server Modules. - |...

BackDoorSim

BackdoorSim Overview BackdoorSim is a remote administration and monitoring tool designed for educational and testing purposes. It consists of two main components: ControlServer and BackdoorClient. The server controls the client, allowing for various operations like file transfer, system monitorin...

Invoke-Transfer

Invoke-Transfer PowerShell Clipboard Data Transfer Invoke-Transfer is a PowerShell tool that helps you to send files in highly restricted environments such as Citrix, RDP, VNC or Guacamole. You can send files in text format, in small Base64 encoded chunks or in plaintext. Additionally, you can...

EggShell

EggShell About EggShell is a post exploitation surveillance tool written in Python. It gives you a command line session with extra functionality between you and a target machine. EggShell gives you the power and convenience of uploading/downloading files, tab completion, taking pictures, location...

knockpy

🔍 Knockpy Subdomain Scan v9.0 ✅ Fast & Async • 🔐 Recon + Brute • 🔧 Easy to Extend KnockPy is a modular Python 3 tool to enumerate subdomains via passive reconnaissance and bruteforce, now with async/await support , enhanced performance, and modern HTTP/TLS handling. 🚀 Features v9 ✅ Async scanning...

Dnsrr

DNSrr DNSrr is a tool written in bash, used to enumerate all the juicy stuff from DNS records, it uses different techniques like DNS Forward Bruteforce DNS Reverse Bruteforce DNS Cache Snooping DNS Zone Transfer To get you all the information that you can get, from a DNS server. Installation...

dnsteal

dnsteal v 2.0 This is a fake DNS server that allows you to stealthily extract files from a victim machine through DNS requests. Below are a couple of different images showing examples of multiple file transfer and single verbose file transfer: Support for multiple files Gzip compression supported...

Shell3er

Shell3er Shell3er PowerShell Reverse Shell The Shell3er Reverse Features Get-RandomProcessName Function The Get-RandomProcessName function generates a random process name by concatenating "PS" with a new GUID. This is used to create unique and seemingly random process names, making it harder to...

penelope

Penelope is a modern shell handler for penetration testers and CTF players. It provides a more capable alternative to basic netcat listeners, adding automatic PTY upgrades, session management, logging, file transfers and helper modules. Table of Contents 📥 Installation ⚙️ Features 🖥️ Session...

Bifrost

Bifrost Command and Control What's Bifrost? Bifrost is an open-source Discord BOT that works as Command and Control C2. This C2 uses Discord API for communication between clients and server. Developed with Python, this C2 have multiples features for post-exploitation. How Bifrost works? As...

pyrdp

PyRDP PyRDP is a Python Remote Desktop Protocol RDP Monster-in-the-Middle MITM tool and library. It features a few tools: RDP Monster-in-the-Middle Logs plaintext credentials or NetNTLM hashes used when connecting Steals data copied to the clipboard Saves a copy of the files transferred over the...

shootback

shootback shootback is a reverse TCP tunnel let you access target behind NAT or firewall 反向TCP隧道, 使得NAT或防火墙后的内网机器可以被外网访问. Consumes less than 1% CPU and 8MB memory under 800 concurrency. slaver is single file and only depends on python2.7/3.4+ standard library. How it works Typical Scene 1. Access...

magic-wormhole

Magic Wormhole 安全地将文件从一台电脑传输到另一台电脑。 该软件包提供一个库和一个名为 wormhole 的命令行工具，能够将任意大小的文件和目录（或短文本）从一台电脑传输到另一台电脑。两个端点通过使用相同的“虫洞代码”进行识别：一般来说，发送方机器生成并显示该代码，然后必须在接收方机器上输入该代码。 这些代码简短且易于人类发音，使用音位区分清晰的词汇表。接收方提供对代码词的 tab 补全功能，因此通常只需键入几个字符。虫洞代码一次性使用，无需记忆。 PyCon 2016 演讲：幻灯片、视频 完整文档请参见...

NoEyes

NoEyes 🔒 Secure Terminal Chat End-to-end encrypted group chat, private messages, and file transfer in your terminal. The server is a blind forwarder: it cannot read your messages, does not know your username, does not know the room you are in, and cannot link any two messages to the same person,...

Progress-MOVEit-Transfer-2020.1-Stored-XSS-CVE-2020-28647

Progress MOVEit Transfer 2020.1 存储型XSS CVE-2020-28647 在一次近期的Web应用测试中，其中一个在测应用是MOVEit Transfer 2020 Web应用。在执行评估时，发现了一个存储型跨站脚本（XSS）漏洞。本文将介绍发现并利用该漏洞以获得Web应用管理员权限的过程。 在测试应用中多个输入字段的输入验证时，发现一个特定的输入字段在提供某些载荷时会产生意外输出。这个输入字段是上传的文件名。上传具有特定文件名的文件后，发现当尝试下载该文件时，下载按钮不起任何作用。对此行为进行了调查，如下图所示，点击下载按钮时触发了JavaScript错...

gimmeSH

gimmeSH For pentesters who don't wanna leave their terminals. Few Words gimmeSH, is a tool that generates a custom cheatsheet for Reverse Shell, File Transfer and Msfvenom within your terminal, you just need to provide the platform, your Internet protocol address and your port number. Installatio...

Apache2 - Transfer-Encoding Chunked XSS

Apache2 PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 contain a reflected cross-site scripting vulnerability caused by mishandling of chunked transfer-encoding requests in sapi/apache2handler/sapiapache2.c. Attackers can execute malicious scripts via crafted...