cypherhound

CypherHound A Python3 terminal application that contains Neo4j cyphers for BloodHound data sets with a script to automate importing them into BloodHound CE. Output Samples Terminal HTML Report HTML Report continued Why? BloodHound is a staple tool for every penetration tester. However, there are...

conquest

Conquest is a feature-rich, extensible and malleable command & control/post-exploitation framework developed for penetration testing and adversary simulation. Conquest's team server, operator client and agent have all been developed using the Nim programming language and are designed with...

vuln-bank

Vulnerable Bank Application 🏦 A deliberately vulnerable web application for practicing application security testing of Web, APIs and LLMs, secure code review and implementing security in CI/CD pipelines. ⚠️ WARNING: This application is intentionally vulnerable and should only be used for...

tamago

TamaGo - Go sobre metal desnudo tamago | https://github.com/usbarmory/tamago Copyright c The TamaGo Authors. All Rights Reserved. Introducción TamaGo es un framework que permite la compilación y ejecución de aplicaciones Go sin restricciones en procesadores de metal desnudo AMD64, ARM, ARM64,...

ysoserial.net

A proof-of-concept tool for generating payloads that exploit unsafe .NET object deserialization. Description ysoserial.net is a collection of utilities and property-oriented programming "gadget chains" discovered in common .NET libraries that can, under the right conditions, exploit .NET...

ysoserial.net

一个用于生成利用不安全的 .NET 对象反序列化漏洞的载荷的概念验证工具。 描述 ysoserial.net 是一组在常见 .NET 库中发现的实用工具和面向属性编程的“利用链”（gadget chains），在适当条件下，它们可以利用执行不安全对象反序列化的 .NET 应用程序。主驱动程序接收用户指定的命令，并将其包装在用户指定的利用链中，然后将这些对象序列化到 stdout。当类路径上具有所需利用链的应用程序不安全地反序列化此数据时，该链将自动被调用，并导致命令在应用程序主机上执行。 应当注意，该漏洞存在于执行不安全反序列化的应用程序中，而不是在于类路径上存在利用链。 本项目受...

cowitness

CoWitness CoWitness is a tool designed to function as an HTTP, HTTPS, and DNS server. It allows you to serve web pages, log HTTP requests, and customize DNS responses. This README provides an overview of the features and instructions on how to compile and use the CoWitness tool. Features HTTP...

ache

ACHE Crawler Enfocado ACHE es un rastreador web enfocado. Recopila páginas web que cumplen con criterios específicos, por ejemplo, páginas que pertenecen a un dominio determinado o que contienen un patrón definido por el usuario. ACHE se diferencia de los rastreadores genéricos en que utiliza...

misp-galaxy

misp-galaxy MISP galaxy is a simple method to express a large object called cluster that can be attached to MISP events or attributes. A cluster can be composed of one or more elements. Elements are expressed as key-values. There are default knowledge base such as Threat Actors, Tools, Ransomware...

maskphish

👨‍💻️ Author : jaykali 🔥 MaskPhish MaskPhish is not any Phishing tool. It's just a proof of concept of "URL Making Technology". It is a simple Bash Script to hide phishing URL under a normal looking URL google.com or facebook.com. It can be integrated into Phishing tools with proper credits to look...

maskphish

👨‍💻️ Autor : jaykali 🔥 MaskPhish MaskPhish no es una herramienta de phishing. Es solo una prueba de concepto de la "Tecnología de Creación de URLs". Es un simple script de Bash para ocultar una URL de phishing bajo una URL de apariencia normal google.com o facebook.com. Se puede integrar en...

BruteForce-to-KeePass

BruteForce-to-KeePass This script complements the results obtained through the keepass-password-dumper tool when exploiting the CVE-2023-32784 vulnerability affecting KeePass. Description This script prompts the user to input a list of characters and a known suffix. It then generates a list of...

CVE-2022-23940

CVE-2022-23940 PoC for CVE-2022-23940 aka SCRMBT-187 - Authenticated Remote Code Execution through Scheduled Reports in SuiteCRM = 8.0.0. Defaults to False --help Show this message and exit. https://github.com/manuelz120/CVE-2022-23940...

ninjasworkout

Damn Vulnerable NodeJS Application Quick Start root@kitploit: Download the Repo = run npm i Afer Installing all dependency just run the application root@kitploit: node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4...

proxy

git-pkgs proxy A caching proxy for package registries. Speeds up package downloads by caching artifacts locally, reducing bandwidth usage and improving reliability. Version Cooldown Most supply chain attacks rely on speed: a malicious version gets published and consumed by automated pipelines...

Anthropic-Cybersecurity-Skills

Anthropic Cybersecurity Skills The largest open-source cybersecurity skills library for AI agents !Hermes Agenthttps://img.shields...

damn-vulnerable-log4j-app

SnapAttack Log4j / CVE-2021-44228 / log4shell Resources What's included? Damn Vulnerable Log4j App damn-vulnerable-log4j-app contains a basic vulnerable Java Servlet that logs the User Agent, HTTP GET and POST parameters with log4j. It is packaged as a .war file and can be deployed to servers lik...

attackgen

AttackGen AttackGen es una herramienta de pruebas de respuesta a incidentes de ciberseguridad que aprovecha el poder de los grandes modelos de lenguaje y los completos marcos MITRE ATT&CK y ATLAS. La herramienta genera escenarios de respuesta a incidentes personalizados basados en grupos de actor...

CVE-2019-2215

CVE-2019-2215 PoC for old Binder vulnerability based on P0 exploit Description A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the...

email-prediction-asterisks

ASTERISKS & OBELIX Email prediction asterisks es un script que te permite identificar los correos electrónicos ocultos tras asteriscos. Es una aplicación perfecta para analistas de OSINT y fuerzas de seguridad. Permite predecir de forma inteligente, utilizando filtraciones de Intelx, qué correos...