Tunna

Tunna Tunna is a set of tools which will wrap and tunnel any TCP communication over HTTP. It can be used to bypass network restrictions in fully firewalled environments. v1.1 Alpha version root@kitploit: | | | || | | | ' | ' \ / | | || || | | | | | | | | | || ,|| ||| ||,| Tunna 0.1, for HTTP...

StegaStamp

StegaStamp: Invisible Hyperlinks in Physical Photographs Project Page CVPR 2020 Matthew Tancik, Ben Mildenhall, Ren Ng University of California, Berkeley Introduction This repository is a code release for the ArXiv report found here. The project explores hiding data in images while maintaining...

SubDomainizer

Buy Me A Coffee SubDomainizer SubDomainizer is a tool designed to find hidden subdomains and secrets present is either webpage, Github, and external javascripts present in the given URL. This tool also finds S3 buckets, cloudfront URL's and more from those JS files which could be interesting like...

IPRotate_Burp_Extension

IPRotateBurpExtension Extension for Burp Suite which uses AWS API Gateway to change your IP on every request. More info: Bypassing IP Based Blocking Using AWS - Rhino Security Labs Note/Warning This method of using AWS API Gateways to obfuscate source IP is now considered prohibited according to...

BabyShark

INTRO This is a basic C2 generic server written in Python and Flask. This code has based ideia to GTRS, which uses Google Translator as a proxy for sending commands to the infected host. The BabyShark project aims to centralize reverse connections with agents, creating a way to centralize several...

stegano

Steganography by bzt Online demo In a nutshell, steganography is the art of hiding messages in another medium in plain sight without people realizing. This implementation reads in images in popular web formats WEBP, PNG, GIF, JPEG, hides the optionally encrypted text in them and saves the result ...

domdig

DOMDig DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications SPA recursively. Unlike other scanners, DOMDig can crawl any webapplication including gmail by keeping track of DOM modifications and XHR/fetch/websocket requests and it can...

habu

Habu Hacking Toolkit I'm developing Habu to teach and learn some concepts about Python and Network Hacking. Some techniques implemented in the current version are: ARP Poisoning and Sniffing DHCP Discover and Starvation Subdomains Identification Certificate Cloning TCP Analysis ISN, Flags Usernam...

ExtractUsnJrnl

The change journal on NTFS is a file found at $Extend$UsnJrnl. It is a system metafile that is not possible to find in a normal dir listing, or even posible to by regular means. The relevant data is found in the alternate data stream named $J. There's also another ADS called $Max which is rather...

git-hound

🐾 GitHound A pattern-matching, patch-attacking, batch-catching secret snatcher. Overview GitHound hunts down exposed API keys, secrets, and credentials across GitHub by pairing GitHub dorks with pattern matching, contextual detection, and commit-history analysis. Input a GitHub dork into GitHound...

AppInfoScanner

语言/Language : 简体中文 | English 该项目目前仅仅是规划项目中的冰山一角，如果您对此项目感兴趣或者想参与后续项目的开发工作或者翻译工作中，请发送邮件至[email protected]说明你的能力和诉求。 AppInfoScanner 一款适用于以HW行动/红队/渗透测试团队为场景的移动端Android、iOS、WEB、H5、静态网站信息收集扫描工具，可以帮助渗透测试工程师、攻击队成员、红队成员快速收集到移动端或者静态WEB站点中关键的资产信息并提供基本的信息输出,如：Title、Domain、CDN、状态信息等。 前言...

nodejsscan

nodejsscan Static security code scanner SAST for Node.js applications powered by libsast and semgrep. Made with in India...

mzap

mzap mzap is a Crystal CLI for multi-target ZAP scanning. It dispatches targets across one or more ZAP API hosts, supports optional wait mode, and can export reports. Features Scan commands: spider, ajaxspider, clientspider ZAP 2.16+, ascan, pscan API definition import for openapi, soap, graphql,...

Atlas

Atlas - Quick SQLMap Tamper Suggester v1.0 Atlas is an open source tool that can suggest sqlmap tampers to bypass WAF/IDS/IPS, the tool is based on returned status code. Screen Installation root@kitploit: $ git clone https://github.com/m4ll0k/Atlas.git atlas $ cd atlas $ python atlas.py python3+...

365Inspect

Purpose Further the state of Microsoft 365 security by authoring a PowerShell script that automates the security assessment of Microsoft 365 environments. Soteria Inspect Soteria Inspect is born from the 365Inspect project and is Soteria's SaaS solution to aid in assessing the security of a...

hakoriginfinder

hakoriginfinder Tool for discovering the origin host behind a reverse proxy. Useful for bypassing WAFs and other reverse proxies. How does it work? This tool will first make a HTTP request to the hostname/URL that you provide and store the response, then it will make a request to every IP address...

urlhunter

root@kitploit: o Utku Sen's /\o Oo |/ =- .===O- URL -O- / /U' hunter /|\ || |/ \ | utkusen.com |K || twitter.com/utkusenen urlhunter is a recon tool that allows searching on URLs that are exposed via shortener services such as bit.ly and goo.gl. The project is written in Go. How? A group named...

FFM

Freedom Fighting Mode FFM FFM is a hacking harness that you can use during the post-exploitation phase of a red-teaming engagement. The idea of the tool was derived from a 2007 conference from @thegrugq. It was presented at SSTIC 2018 video and the accompanying slide deck is available at this url...

Nightingale

Nightingale: Docker for Pentesters This project is supported by: | ---|--- Nightingale is a ready-to-use, multi-architecture Docker toolkit for pentesting and security research. It gives you a reproducible environment with curated tools for web, network, mobile, API, OSINT, and forensics workflow...

osint-brazuca

OSINT Open-source intelligence Navigation : 🏠 Main README | 📖 Practical Examples | 🔀 Flowcharts | 📊 Quick Guide | 🤝 Contribute Introduction The OSINT Brazuca Project is a repository created with the aim of gathering information, sources websites/portals and OSINT tricks within the Brazilian conte...