gau

getallurls gau getallurls gau fetches known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, Common Crawl, and URLScan for any given domain. Inspired by Tomnomnom's waybackurls. Resources Usage Installation ohmyzsh note Usage: Examples: $ printf example.com | gau $ cat domains.tx...

katana

A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...

HostileSubBruteforcer

HostileSubBruteforcer This app will bruteforce for exisiting subdomains and provide the following information: IP address Host if the 3rd party host has been properly setup. for example if site.example.com is poiting to a nonexisiting Heroku subdomain, it'll alert you - Currently only works with...

CVE-2024-32019-PoC

CVE-2024-32019-PoC Bash script for Privilege Escalation via "ndsudo" Netdata Local Exploit Netdata Affected Versions = v1.45.0, = v1.44.0-60, v1.45.0-169 Vulnerability Description The "ndsudo" tool runs a restricted set of external commands, but the search paths are supplied by the "PATH"...

BARK

BARK BARK stands for BloodHound Attack Research Kit. It is a PowerShell script built to assist the BloodHound Enterprise team with researching and continuously validating abuse primitives. BARK currently focuses on Microsoft's Azure suite of products and services. BARK requires no third party...

Firmware_Slap

Firmware Slap Firmware slap combines concolic analysis with function clustering for vulnerability discovery and function similarity in firmware. Firmware slap is built as a series of libraries and exports most information as either pickles or JSON for integration with other tools. Slides from the...

PowerSploit

Forked to add a few features to PowerView.ps1 that I commonly perform manually This project is no longer supported PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment. PowerSploit is comprised of the following...

yellow

| | | | | | |/ \ | |/ \ \ /\ / / | || | / | | \ V V / , ||||/ // |/ - Just add blue. yellow - just add blue Simple binary modifications that will trigger a canarytoken when a binary is executed. Ideal for boobytrapping production systems against attackers. Currently there are four methods:...

DylibHijackTest

DylibHijackTest Requirements Install Python3 requirements: pip3 install -r requirements.txt Compile dylib from source because don't trust compiled things from GitHub: gcc -dynamiclib DylibHijackTest.c -o DylibHijackTest.dylib How it Works ⚠️ This will spawn many processes on your machine, run this...

Cronos

Cronos This project was co-authored by Description PoC for a new sleep obfuscation technique based on Ekko leveraging waitable timers to RC4 encrypt the current process and change the permissions from RW to RX to evade memory scanners. A more detailed explanation will be available in the blog pos...

CVE-2026-81000

⚡ CVE-2026-81000 - TUNderflow Linux Kernel TUN/TAP Receive Headroom Memory Corruption A Linux kernel memory-corruption vulnerability in the TUN/TAP networking subsystem , caused by insufficient bounds on receive headroom and an integer underflow in the packet allocation path. ⚠️ Disclaimer This...

duf

duf Disk Usage/Free Utility Linux, BSD, macOS & Windows Features User-friendly, colorful output Adjusts to your terminal's theme & width Sort the results according to your needs Groups & filters devices Can conveniently output JSON Installation Packages Linux Arch Linux: pacman -S duf Ubuntu 22.0...

IP-Biter

IP-Biter - Framework The Hacker-friendly Tracking Framework IP-Biter is an open source, easy to deploy, tracking framework that generate high configurables and uniques tracking images and links to embed in e-mails, sites or chat systems and visualize, in an hacker-friendly dashboard, high detaile...

bulk_extractor

bulkextractor is a high-performance digital forensics exploitation tool. It is a "get evidence" button that rapidly scans any kind of input disk images, files, directories of files, etc and extracts structured information such as email addresses, credit card numbers, JPEGs and JSON snippets witho...

CVE-2023-25690-POC

CVE 2023 25690 - Proof of Concept Published: 7 March 2023 Base score| Confidentiality| Integrity impact| Availability impact ---|---|---|--- 9.8| High| High| High Table of contents Advisory Description Vulnerable Apache Configuration Breakdown Data Flow Lab Setup HTTP Request Splitting causing HT...

morphHTA

Disclaimer As usual, this code and tool should not be used for malicious purposes. Written by Vincent Yiu of MDSec Consulting's ActiveBreach team. Modification of code is allowed with credits to author. Explorer and SWBemLocator COM Moniker research is by @enigma0x3 morphHTA Usage : usage:...

Interlace

Interlace Easily turn single threaded command line applications into a fast, multi-threaded application with CIDR and glob support. Reviews / Howto Guides Interlace: A Tool to Easily Automate and Multithread Your Pentesting & Bug Bounty Workflow Without Any Coding Table of Contents Setup Usage -...

reflector

reflector Description Burp Suite extension is able to find reflected XSS on page in real-time while browsing on web-site and include some features as: Highlighting of reflection in the response tab. Test which symbols is allowed in this reflection. Analyze of reflection context. Content-Type...

VHostScan

VHostScan A virtual host scanner that can be used with pivot tools, detect catch-all scenarios, aliases and dynamic default pages. First presented at SecTalks BNE in September 2017 slidedeck. This is an enhanced version of the original VHostScan byCodingo with additional improvements, modernized...

CVE-2022-4174_CVE-2022-41742

CVE-2022-4174CVE-2022-41742 PoC for CVE-2022-4174CVE-2022-41742 to determine if Nginx 1.22.1 is vulnerable [email protected] This PoC allows determining if an Nginx server version 1.22.1 is vulnerable to certain known vulnerabilities, including: CVE-2022-41741 : Memory corruption in the...