Malwinx - Just A Normal Flask Web App To Understand Win32Api With Code Snippets And References

A normal flask web app to learn win32api with code snippets and references. Prerequisite You need to download the following package before starting it pip install flask pip install pefile pip install requests Usage $ python flaskapp.py Live Demo Here is the Walkthrough: 1. Upload the exe or dll. ...

ScanQLi - Scanner To Detect SQL Injection Vulnerabilities

ScanQLi is a simple SQL injection scanner with somes additionals features. This tool can't exploit the SQLi, it just detect them. Tested onDebian 9 Features Classic Blind Time based GBK soon Recursive scan follow all hrefs of the scanned web site Cookies integration Adjustable wait delay between...

[Router Password Decryptor] Tool to Recover Login/PPPoE/WEP/WPA/WPA2 Passwords from Router/Modem Config file

Router Password Decryptor is the FREE tool to instantly recover internet login/PPPoE authentication passwords, Wireless WEP keys, WPA/WPA2 Passphrases from your Router/Modem configuration file. Currently it supports password recovery from following type of Routers/Modems: --- Cisco Juniper DLink...

bucky

Bucky Bucky discovers AWS S3 buckets passively, while you browse, and checks them for misconfiguration. It has two parts: a browser addon and a backend engine. The addon watches the requests a page makes to .amazonaws.com and also scans the page markup, so it finds buckets whose URLs only ever...

autoharness

AutoHarness Created by Akshat Parikh What is this tool? AutoHarness is a tool that automatically generates fuzzing harnesses for you. This idea stems from a concurrent problem in fuzzing codebases today: large codebases have thousands of functions and pieces of code that can be embedded fairly de...

django-DefectDojo

Open-source vulnerability management, DevSecOps and ASPM Pro demo · Community demo · Docs · Slack · Community · Website DefectDojo Pro home page. Try it on the live Pro demo. The Community Edition demo is at demo.defectdojo.org. Sign-in details for both are under Demo. DefectDojo is a DevSecOps,...

witcher

witcher Implement and monitor Appsec control at scale. Requirements NodeJS 20.13 Tested on Mac Ubuntu How to install $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ npm i Build a Docker image $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ docker build ...

RootMyVivo

RootMyVivo Root for vivo and iQOO phones with a locked bootloader. No unlocking, no flashing — install the APK, press the button, wait. Built on GhostLock CVE-2026-43499, a use-after-free in futex PI plus KernelSU installed on top of the temporary root. Русский · 中文 How it goes 1. Install the APK...

r77-rootkit

r77 Rootkit Fileless ring 3 rootkit r77 is a ring 3 rootkit that hides everything: Files, directories Processes & CPU/GPU usage Registry keys & values Services TCP & UDP connections Junctions, named pipes, scheduled tasks Hiding by prefix Everything that starts with "$77" is hidden. Configuration...

pyfiscan

pyfiscan About Pyfiscan is free web-application vulnerability and version scanner and can be used to locate out-dated versions of common web-applications in Linux-servers. Example use case is hosting-providers keeping eye on their users installations to keep up with security-updates. Fingerprints...

com.altamirano.fabricio.tvbrowser

This repository does not have a README...

reternal-quickstart

RE:TERNAL Note: Still under development, only use for testing and do not expose interfaces! Current compose doesn't work yet, only try when you know what you're doing RE:TERNAL is a centralised purple team orchestration service to manage third-party C2 frameworks. Agents are installed on endpoint...

D4TA-HUNTER - GUI Osint Framework With Kali Linux

D4TA-HUNTER is a tool created in order to automate the collection of information about the employees of a company that is going to be audited for ethical hacking. In addition, in this tool we can find in the "search company" section by inserting the domain of a company, emails of employees,...

Wodat - Windows Oracle Database Attack Toolkit

Simple port of the popular Oracle Database Attack Tool ODAT https://github.com/quentinhardy/odat to C .Net Framework. Credit to https://github.com/quentinhardy/odat as lots of the functionality are ported from his code. Perform password based attacks e.g. username as password, username list again...

SharpWSUS - CSharp tool for lateral movement through WSUS

SharpWSUS is a CSharp tool for lateral movement through WSUS. There is a corresponding blog https://labs.nettitude.com/blog/introducing-sharpwsus/ which has more detailed information about the tooling, use case and detection. Credits Massive credit to the below resources that really did 90% of th...

365Inspect - A PowerShell Script That Automates The Security Assessment Of Microsoft Office 365 Environments

Further the state of O365 security by authoring a PowerShell script that automates the security assessment of Microsoft Office 365 environments. Setup 365Inspect requires the administrative PowerShell modules for Microsoft Online, Azure AD We recommend installing the AzureADPreview module, Exchan...

LoGiC.NET - A More Advanced Free And Open .NET Obfuscator Using Dnlib

LoGiC.NET is a free and open-source .NET obfuscator that uses dnlib for folks that want to see how obfuscation works with more complex obfuscations than Goldfuscator for example. Before obfuscation After obfuscation Dependencies dnlib v3.3.2 : Restore NuGet packages and it'll work if it doesn't...

FAMA - Forensic Analysis For Mobile Apps

LabCIF -Forensic Analysis for Mobile Apps Getting Started Android extraction and analysis framework with an integrated Autopsy Module. Dump easily user data from a device and generate powerful reports for Autopsy or external applications. Functionalities Extract user application data from an...

WhatTheHack - A Collection Of Challenge Based Hack-A-Thons Including Student Guide, Proctor Guide, Lecture Presentations, Sample/Instructional Code And Templates

WhatTheHack is a collection of challenge based hack-a-thons including student guide, proctor guide, lecture presentations, sample/instructional code and templates. What, Why and How "What the Hack" is a challenge based hackathon format Challenges describe high-level tasks and goals to be...

UBoat - HTTP Botnet Project

A POC HTTP Botnet designed to replicate a full weaponised commercial botnet Disclaimer This project should be used for authorized testing or educational purposes only. The main objective behind creating this offensive project was to aid security researchers and to enhance the understanding of...

Nuages - A Modular C2 Framework

Nuages is a modular C2 framework. Refer to the Wiki for documentation, do not hesitate to open issues for help, bug reports or feature requests Introduction Nuages aims at being a C2 framework in which back end elements are open source, whilst implants and handlers must be developed ad hoc by...

Faraday v3.4 - Collaborative Penetration Test and Vulnerability Management Platform

Here’s the main new features and improvements in Faraday v3.4: Services can now be tagged. With this new feature, you can now easily identify important services, geolocate them and more. New search operators OR/NOT In a previous release we added the AND operator, now with 3.4 you can also use OR...

Droidefense - Advance Android Malware Analysis Framework

Droidefense originally named atom: a nalysis t hrough o bservation m achine is the codename for android apps/malware analysis/reversing tool. It was built focused on security issues and tricks that malware researcher have on they every day work. For those situations on where the malware has...

SQLMap v1.2.9 - Automatic SQL Injection And Database Takeover Tool

SQLMap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lastin...

R0Ak (The Ring 0 Army Knife) - A Command Line Utility To Read/Write/Execute Ring Zero On For Windows 10 Systems

r0ak is a Windows command-line utility that enables you to easily read, write, and execute kernel-mode code with some limitations from the command prompt, without requiring anything else other than Administrator privileges. Quick Peek r0ak v1.0.0 -- Ring 0 Army Knife...

Aker - SSH Bastion/Jump Host/Jumpserver

Aker is a security tool that helps you configure your own Linux ssh jump/bastion host. Named after an Egyptian mythology deity who guarded the borders, Aker would act as choke point through which all your sysadmins and support staff access Linux production servers. Aker SSH gateway includes a lot...

OWASP ZAP 2.4.1 - Penetration Testing Tool for Testing Web Applications

The OWASP Zed Attack Proxy ZAP is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration...

SmartSniff - Capture TCP/IP packets on your network adapter

SmartSniff is a network monitoring utility that allows you to capture TCP/IP packets that pass through your network adapter, and view the captured data as sequence of conversations between clients and servers. You can view the TCP/IP conversations in Ascii mode for text-based protocols, like HTTP...

ezviz_lan_rce

ezvizlanrce This repository contains the slides and PoC videos for the talk SADProtocol goes to Hollywood which was presented at DEF CON 31 Hardware Hacking Village. You can also find the docker image to build binaries that run on the camera and the proof of concept exploits for CVE-2023-34551 an...

G2.5_Openssl_V_1_0_1g

OpenSSL 1.0.1g 7 Apr 2014 Copyright c 1998-2011 The OpenSSL Project Copyright c 1995-1998 Eric A. Young, Tim J. Hudson All rights reserved. DESCRIPTION The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the...

sticky_keys_hunter

Sticky Keys Hunter This POC bash script tests for sticky keys and utilman backdoors. The script will connect to an RDP server, send both the sticky keys and utilman triggers and screenshot the result. This script was written to prove a theory I had about detecting these backdoors in a blackbox...

fprobe

FProbe FProbe - Fast HTTP Probe Installation GO111MODULE=on go get -u github.com/theblackturtle/fprobe Features Take a list of domains/subdomains and probe for working http/https server. Optimize RAM and CPU in runtime. Support special ports for each domain Verbose in JSON format with some...

LetterPress-1.2.1-Open-Redirection-Via-Html-Injection-Vulnerability

Exploit Title: LetterPress CLICK THIS" in HTML Campaign Message input field and click on Save Campaign. 2. View the campaign and click on "CLICK THIS" hyperlink it will redirect to the 3rdparty site. Ex:evil.com...

fingerprintx

Features • Installation • Usage • Running fingerprintx • Using as a library • Why not nmap? • Notes • Acknowledgements fingerprintx is a utility similar to httpx that also supports fingerprinting services like as RDP, SSH, MySQL, PostgreSQL, Kafka, etc. fingerprintx can be used alongside port...

Ars0N-Framework - A Modern Framework For Bug Bounty Hunting

Howdy! My name is Harrison Richardson, or rs0n arson when I want to feel cooler than I really am. The code in this repository started as a small collection of scripts to help automate many of the common Bug Bounty hunting processes I found myself repeating. Over time, I built a simple web...

CredPhish - A PowerShell Script Designed To Invoke Legitimate Credential Prompts And Exfiltrate Passwords Over DNS

CredPhish is a PowerShell script designed to invoke credential prompts and exfiltrate passwords. It relies on CredentialPicker to collect user passwords, Resolve-DnsName for DNS exfiltration, and Windows Defender's ConfigSecurityPolicy.exe to perform arbitrary GET requests. For a walkthrough, see...

DeimosC2 - A Golang Command And Control Framework For Post-Exploitation

DeimosC2 is a post-exploitation Command & Control C2 tool that leverages multiple communication methods in order to control machines that have been compromised. DeimosC2 server and agents works on, and has been tested on, Windows, Darwin, and Linux. It is entirely written in Golang with a front e...

Sherloq - An Open-Source Digital Image Forensic Toolset

An open source image forensic toolset Introduction "Forensic ImageAnalysis is the application of image science and domain expertise to interpret the content of an image and/or the image itself in legal matters. Major subdisciplines of Forensic Image Analysis with law enforcement applications...

Kamerka GUI - Ultimate Internet Of Things/Industrial Control Systems Reconnaissance Tool

Ultimate Internet of Things/Industrial Control Systemsreconnaissance tool. Powered by Shodan - Supported by Binary Edge & WhoisXMLAPI writeup - https://medium.com/@wojciech/hack-the-planet-with-%EA%93%98amerka-gui-ultimate-internet-of-things-industrial-control-systems-5ff7d9686b29 Demo -...

PAKURI - Penetration Test Achieve Knowledge Unite Rapid Interface

What's PAKURI In Japanese, imitating is called “Pakuru”. ぱくる godan conjugation, hiragana and katakana パクる, rōmaji pakuru 1. eat with a wide open mouth 2. steal when one isn't looking, snatch, swipe 3. copy someone's idea or design 4. nab, be caught by the police Wiktionary:ぱくる Description...

nodeCrypto v2.0 - Ransomware Written In NodeJs

nodeCrypt is a linux Ransomware written in NodeJs that encrypt predefined files. This project was created for educational purposes, you are the sole responsible for the use of nodeCrypto. Demo video Install server Upload all file of server/ folder on your webserver. Create a sql database and impo...

UAC-A-Mola - Tool That Allows Security Researchers To Investigate New UAC Bypasses, In Addition To Detecting And Exploiting Known Bypasses

UAC-A-Mola is a tool that allows security researchers to investigate new UAC bypasses, in addition to detecting and exploiting known bypasses. UAC-A-mola has modules to carry out the protection and mitigation of UAC bypasses. The strong point of uac-a-mola is that it was created so that other...

Knock v.4.1.1 - Subdomain Scan

Knockpy is a python tool designed to enumerate subdomains on a target domain through a wordlist. It is designed to scan for DNS zone transfer and to try to bypass the wildcard DNS record automatically if it is enabled. Now knockpy supports queries to VirusTotal subdomains, you can setting the...

Syhunt ScanTools 6.5 - Console Web Vulnerability Scan Tools

Syhunt ScanTools comes with four console applications: ScanURL, ScanCode, ScanLog and ScanConf, incorporating the functionality of the scanners Syhunt Dynamic, Syhunt Code, Syhunt Insight and Syhunt Harden respectively. Whether you want to scan a live web application, source code files, a GIT...

Doork - Google Dorks Passive Vulnerability Auditor

doork is a open-source passive vulnerability auditor tool that automates the process of searching on Google information about specific website based on dorks. doork can update his own database from ghdb and use it for find flaws without even contact the target endpoint. You can provide your custo...

Hook Analyser 3.1 - Malware Analysis Tool

Hook Analyser is a freeware application which allows an investigator/analyst to perform “static & run-time / dynamic” analysis of suspicious applications, also gather analyse & co-related threat intelligence related information or data from various open sources on the Internet. Essentially it’s a...

nuclei-wordfence-cve

Nuclei + Wordfence = ♥ 88,263 Nuclei Templates for WordPress Security Scanning 🥳 Level up your WordPress security game! This project's got a treasure trove of fresh Nuclei templates for WordPress. Scan for weaknesses in Core, plugins, and themes – all based on the latest intel from Wordfence.com...

backdoor.mirai.helloworld

Dasan GPON Router URL ? when adding a string after image...

qiling

Qiling's use case, blog and related work Qiling is an advanced binary emulation framework, with the following features: Emulate multi-platforms: Windows, macOS, Linux, Android, BSD, UEFI, DOS, MBR. Emulate multi-architectures: 8086, X86, X8664, ARM, ARM64, MIPS, RISC-V, PowerPC. Support multiple...

git-alerts

GitAlerts What problem does it solve? GitHub repositories created under any organization can be controlled by the GitHub administrators. However any repository created under an organization's user account is not controllable unless the organisation has adopted the GitHub enterprise-managed user E...