threatbox

Threatbox - Standard Attack Platform ThreatBox is a standard and controlled Linux based attack platform. I've used a version of this for years. It started as a collection of scripts, lived as a rolling virtual machine, existed as code to build a Linux ISO, and has now been converted to a set of...

Supernova

Supernova Shellcode encryptor & obfuscator. Description Supernova is an open-source tool that empowers users to securely encrypt and/or obfuscate their raw shellcode. -red?link=https%3A%2F%2Fgithub.com%2Fnickvourd%2FSupernova%2Freleases Supernova supports various features beyond those typically...

tulpar

Tulpar is a open source web vulnerability scanner for written to make web penetration testing automated. Tulpar has the following features. -Sql Injection GET Method -XSS GET Method -Crawl -E-mail Disclosure -Credit Card Disclosure -Whois -Command Injection GET Method -Directory Traversal GET...

osint-brazuca

OSINT Open-source intelligence Navigation : 🏠 Main README | 📖 Practical Examples | 🔀 Flowcharts | 📊 Quick Guide | 🤝 Contribute Introduction The OSINT Brazuca Project is a repository created with the aim of gathering information, sources websites/portals and OSINT tricks within the Brazilian conte...

SharePointDumper

SharePointDumper SharePointDumper is a PowerShell-based extraction and auditing utility that enumerates SharePoint sites a user can access via Microsoft Graph and downloads files via SharePoint. It is designed for SOC / DLP testing, purple teaming, and non-sophisticated red-team assessments, and...

grc2

nimc2 This software is in very early development stages and you might run into many issues using it nimc2 is a very lightweight C2 written fully in nim. It's uses range from user support to employee monitoring. If you want to give it a try check out the wiki to learn how to install and use nimc2...

waybackpack

waybackpack Waybackpack is a command-line tool that lets you download the entire Wayback Machine archive for a given URL. For instance, to download every copy of the Department of Labor's homepage through 1996 which happens to be the first year the site was archived, you'd run: root@kitploit:...

certsync

certsync certsync is a new technique in order to dump NTDS remotely, but this time without DRSUAPI : it uses golden certificate and UnPAC the hash. It works in several steps: 1. Dump user list, CA informations and CRL from LDAP 2. Dump CA certificate and private key 3. Forge offline a certificate...

HazProne

Hazprone HazProne is a Cloud Pentesting Framework that emulates close to Real-World Scenarios by deploying Vulnerable-By-Demand aws resources enabling you to pentest Vulnerabilities within, and hence, gain a better understanding of what could go wrong and why!! The framework helps gain practical,...

Project-Onyx

Project Onyx Advanced EDR Evasion via AI Telemetry Spoofing & WASM Sandboxing. Project Onyx is a PoC Red Team pipeline designed to demonstrate advanced evasion techniques against modern EDR systems. It shifts away from traditional signature-based obfuscation towards behavioral camouflage and stri...

BeeLogger

BeeLogger Copyright 2017 BeeLogger Written by: Alisson Moretto - 4w4k3 Twitter: @4w4k3Official TOOL DESIGNED TO GOOD PURPOSES, PENTESTS, DON'T BE A CRIMINAL ! Only download it here, do not trust in other places. NOTE: BeeLogger just have official support for latin languages in this moment. HOW TO...

wifi_db

!Contributorshttp...

renef-skills

renef-skills A Claude Code plugin that makes AI agents operaterenef.io correctly — the dynamic-instrumentation engine for Android ARM64 : hook native & Java functions, scan/read/write/patch process memory, trace syscalls, and bypass SSL pinning / root detection through Lua 5.4 scripts memfd...

worldmonitor

World Monitor 简体中文 | 日本語 Real-time global intelligence dashboard — AI-powered news aggregation, geopolitical monitoring, and infrastructure tracking in a unified situational awareness interface. !Commodity...

smbmap

SMBMap SMBMap allows users to enumerate samba share drives across an entire domain. List share drives, drive permissions, share contents, upload/download functionality, file name auto-download pattern matching, and even execute remote commands. This tool was designed with pen testing in mind, and...

recox

Recox v2.0 RecoX is an incredibly versatile and powerful tool that is specifically designed to aid in the identification and classification of vulnerabilities within web applications. The script is able to detect vulnerabilities that are not typically included in the OWASP top ten vulnerabilities...

whalescan

Whalescan Vulnerability scanner for windows containers. Getting Started root@kitploit: git clone https://github.com/saira-h/whalescan pip install -r requirements.txt python main.py Overview Whalescan performs several benchmark checks, as well as checking for CVEs. This tool can be used as part of...

safe-npm

safe-npm A security-focused npm installer that protects your projects from newly compromised packages. Why does this exist? Supply chain attacks on npm packages are a growing threat. Attackers sometimes compromise legitimate packages by: Stealing maintainer credentials Publishing malicious update...

ShellcodeCompiler

Shellcode Compiler Shellcode Compiler is a program that compiles C/C++ style code into a small, position-independent and NULL-free shellcode for Windows x86 and x64 and Linux x86 and x64. It is possible to call any Windows API function or Linux syscall in a user-friendly way. Shellcode Compiler...

http2smugl

http2smugl This tool helps to detect and exploit HTTP request smuggling in cases it can be achieved via HTTP/2 - HTTP/1.1 conversion by the frontend server. The scheme is as follows: 1. An attacker sends a crafted HTTP/2 request to the target server, which we call frontend. 2. The request is...