git-dumper

git-dumper A tool to dump a git repository from a website. Install This can be installed easily with pip: pip install git-dumper Usage usage: git-dumper options URL DIR Dump a git repository from a website. positional arguments: URL url DIR output directory optional arguments: -h, --help show thi...

flashlight

Automated Information Gathering Tool for Penetration Testers Videos : https://www.youtube.com/watch?v=EUMKffaAxzs&list=PL1BVM6VWlmWZOv9Hv8TV2v-kAlUmvA5g7&index=4 https://www.youtube.com/watch?v=qCgW-SfYl1c&list=PL1BVM6VWlmWZOv9Hv8TV2v-kAlUmvA5g7&index=5...

onelinepy

onelinepy Python Obfuscator for FUD Python Code. Download & Run git clone https://github.com/spicesouls/onelinepy cd onelinepy chmod +x setup.sh ./setup.sh onelinepy Usage Guide | || | . | | -| | | | -| . | | |Python |||||||||| | |Obfuscator || || usage: oneline.py -h -m M -i I --script SCRIPT...

osi.ig

Open Source Information Instagram so recently ig started sending html response insted of json to "unknown" requests. i REALLY wanted this to work without login since i don't use ig anymore, tried few ways i knew to get it working without login but it didn't work :/ anyways since lot of people are...

zmap

ZMap: The Internet Scanner ZMap is a fast stateless single packet network scanner designed for Internet-wide network surveys. On a typical desktop computer with a gigabit Ethernet connection, ZMap is capable of scanning the entire public IPv4 address space on a single port in under 45 minutes. Fo...

masc

masc A malware web scanner developed during CyperCamp Hackathon 2017 About homepage PyPI Features At the moment, there are some features avaiable for any type of website custom or CMS and some of them only available for specific platforms: Scan any website for malware using OWASP WebMalwareScanne...

recollapse

REcollapse REcollapse is a helper tool for black-box regex fuzzing to bypass validations and discover normalizations in web applications. It can also be helpful to bypass WAFs and weak vulnerability mitigations. For more information, take a look at the REcollapse blog post. The goal of this tool ...

jwt-hack

JSON Web Token Hack Toolkit A high-performance toolkit for testing, analyzing and attacking JSON Web Tokens. Installation Cargo cargo install jwt-hack Homebrew brew install jwt-hack Snapcraft Ubuntu sudo snap install jwt-hack From source git clone https://github.com/hahwul/jwt-hack cd jwt-hack...

cspparse

cspparse Description cspparse is a tool to evaluate Content Security Policies. It uses Google's API to retrieve the CSP Headers and returns them in ReconJSON format. Not only does it check for headers with Google's API, it also parses the target site's HTML to look for any CSP rules that are...

cariddi

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more Coded with 💙 by edoardottt Share on Twitter! Install • Usage • Get Started • Changelog • Contributing • License Installation 📡 Homebrew brew install cariddi Snap sudo snap install caridd...

androguard

Androguard Androguard: Reverse engineering and pentesting for Android applications Androguard 5 is a Python toolkit for Android reverse engineering: open an APK, inspect the manifest and DEX, disassemble or decompile code, hunt references and vulnerabilities, and optionally patch or analyze nativ...

social-analyzer

Social Analyzer - API, CLI, and Web App for analyzing & finding a person's profile across +1000 social media \ websites. It includes different analysis and detection modules, and you can choose which modules to use during the investigation process. The detection modules utilize a rating mechanism...

rdesktop

IMPORTANT: rdesktop is no longer maintained Please, beware that this project is no longer maintained and hadn't received a patch in many years. There are reported security vulnerabilities, yet those haven't been reviewed. Use with caution and use it at your own risk. rdesktop - A Remote Desktop...

java-remote-class-loader

This tool allows you to send Java bytecode in the form of class files to your clients or potential targets to load and execute using Java ClassLoader together with Reflect API. The client receives the class file from the server and return the respective execution output. Payloads must be written ...

gftrace

gftrace A command line Windows API tracing tool for Golang binaries. Note: This tool is a PoC and a work-in-progress prototype so please treat it as such. Feedbacks are always welcome! How it works? Although Golang programs contains a lot of nuances regarding the way they are built and their...

electronegativity

Electronegativity ⚠️ We're no longer actively maintaining this project ⚠️ What's Electronegativity? Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications. It leverages AST and DOM parsing to look for security-relevant configurations, as...

keyhacks

KeyHacks shows methods to validate different API keys found on a Bug Bounty Program or a pentest. @Gwen001 has scripted the entire process available here and it can be found here Table of Contents ABTasty API Key Algolia API key Amplitude API Keys Asana Access token AWS Access Key ID and Secret...

hacks

Hacks Hacky one-off scripts, tests etc...

web-traffic-generator

web-traffic-generator A quick and dirty HTTP/S "organic" traffic generator. About Just a simple poorly written Python script that aimlessly "browses" the internet by starting at pre-defined ROOTURLS and randomly "clicking" links on pages until the pre-defined MAXDEPTH is met. I created this as a...

xmap

XMap: The Internet Scanner XMap is a fast network scanner designed for performing Internet-wide IPv6 & IPv4 network research scanning. XMap is reimplemented and improved thoroughly from ZMap and is fully compatible with ZMap, armed with the "5 minutes" probing speed and novel scanning techniques...