HackGit

​​Total Registry Replacement for the Windows built-in Regedit.exe tool. Improvements over that tool include: ▫️ Show real Registry (not just the standard one) ▫️ Sort list view by any column ▫️ Key icons for hives, inaccessible keys, and links ▫️ Key details: last write time and number of keys/values ▫️ Displays MUI and REG_EXPAND_SZ expanded values ▫️ Full search (Find All / Ctrl+Shift+F) ▫️ Enhanced hex editor for binary values ▫️ Undo/redo ▫️ Copy/paste of keys/values ▫️ Optionally replace RegEdit ▫️ Connect to remote Registry ▫️ View open key handles https://github.com/zodiacon/TotalRegistry @HackGit

​​Summary autoSSRF is your best ally for identifying SSRF vulnerabilities at scale. Different from other ssrf automation tools, this one comes with the two following original features : ▫️ Smart fuzzing on relevant SSRF GET parameters When fuzzing, autoSSRF only focuses on the common parameters related to SSRF (?url=, ?uri=, ..) and doesn’t interfere with everything else. This ensures that the original URL is still correctly understood by the tested web-application, something that might doesn’t happen with a tool which is blindly spraying query parameters. ▫️ Context-based dynamic payloads generation For the given URL : https://host.com/?fileURL=https://authorizedhost.com, autoSSRF would recognize authorizedhost.com as a potentially white-listed host for the web-application, and generate payloads dynamically based on that, attempting to bypass the white-listing validation. It would result to interesting payloads such as : http://authorizedhost.attacker.com, http://authorizedhost%252F@attacker.com, etc. Furthermore, this tool guarantees almost no false-positives. The detection relies on the great ProjectDiscovery’s interactsh, allowing autoSSRF to confidently identify out-of-band DNS/HTTP interactions. https://github.com/Th0h0/autossrf @HackGit

​​WhatWeb Next generation web scanner WhatWeb identifies websites. Its goal is to answer the question, "What is that Website?". WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 1800 plugins, each to recognise something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more. WhatWeb can be stealthy and fast, or thorough but slow. WhatWeb supports an aggression level to control the trade off between speed and reliability. When you visit a website in your browser, the transaction includes many hints of what web technologies are powering that website. Sometimes a single webpage visit contains enough information to identify a website but when it does not, WhatWeb can interrogate the website further. The default level of aggression, called 'stealthy', is the fastest and requires only one HTTP request of a website. This is suitable for scanning public websites. More aggressive modes were developed for use in penetration tests. Most WhatWeb plugins are thorough and recognise a range of cues from subtle to obvious. For example, most WordPress websites can be identified by the meta HTML tag, e.g. '', but a minority of WordPress websites remove this identifying tag but this does not thwart WhatWeb. The WordPress WhatWeb plugin has over 15 tests, which include checking the favicon, default installation files, login pages, and checking for "/wp-content/" within relative links. Features: ▫️ Over 1800 plugins ▫️ Control the trade off between speed/stealth and reliability ▫️ Performance tuning. Control how many websites to scan concurrently. ▫️ Multiple log formats: Brief (greppable), Verbose (human readable), XML, JSON, MagicTree, RubyObject, MongoDB, ElasticSearch, SQL. ▫️ Proxy support including TOR ▫️ Custom HTTP headers ▫️ Basic HTTP authentication ▫️ Control over webpage redirection ▫️ IP address ranges ▫️ Fuzzy matching ▫️ Result certainty awareness ▫️ Custom plugins defined on the command line ▫️ IDN (International Domain Name) supports https://github.com/urbanadventurer/WhatWeb Homepage: https://morningstarsecurity.com/research/whatweb Wiki: https://github.com/urbanadventurer/WhatWeb/wiki/

​​NoteThief Grab unsaved Notepad contents with a Beacon Object File https://github.com/tothi/NoteThief

​​XSS Vulnerability Scenarios (challenges) This repository is a Dockerized php application containing some XSS vulnerability challenges. The ideas behind challenges are: ▫️ Javascript validation bypass ▫️ html entities bypass ▫️ WAF bypass ▫️ Black-list validation bypass ▫️ Basic XSS validation bypass ▫️ Double encode bypass of WAF to exploit XSS ▫️ Exploiting XSS by bypassing escape characters https://github.com/moeinfatehi/xss_vulnerability_challenges @HackGit

​​OpenHaystack Framework for tracking personal Bluetooth devices via Apple's massive Find My network. Use it to create your own tracking tags that you can append to physical objects (keyrings, backpacks, ...) or integrate it into other Bluetooth-capable devices such as notebooks. https://github.com/seemoo-lab/openhaystack @HackGit

​​COOK An overpower wordlist generator, splitter, merger, finder, saver, create words permutation and combinations, apply different encoding/decoding and everything you need. https://github.com/giteshnxtlvl/cook #wordlist #dictionary #hashcat @HackGit

​​msprobe Finding all things on-prem Microsoft for password spraying and enumeration. The tool will used a list of common subdomains associated with your target apex domain to attempt to discover valid instances of on-prem Microsoft solutions. Screenshots of the tool in action are below: https://github.com/puzzlepeaches/msprobe @HackGit

CVE-2022-22980 Spring-Data-Mongodb-Example https://github.com/kuron3k0/Spring-Data-Mongodb-Example Research: https://tanzu.vmware.com/security/cve-2022-22980 #cve @HackGit

PoshC2 A proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral movement. PoshC2 is primarily written in Python3 and follows a modular format to enable users to add their own modules and tools, allowing an extendible and flexible C2 framework. Out-of-the-box PoshC2 comes PowerShell/C# and Python2/Python3 implants with payloads written in PowerShell v2 and v4, C++ and C# source code, a variety of executables, DLLs and raw shellcode in addition to a Python2/Python3 payload. These enable C2 functionality on a wide range of devices and operating systems, including Windows, *nix and OSX. https://github.com/nettitude/PoshC2 Documentation: https://poshc2.readthedocs.io/en/latest/ @HackGit

elrond Accelerating the collection, processing, analysis and outputting of digital #forensic artefacts. https://github.com/ezaspy/elrond

Mail.Rip V2.1337 Your SMTP checker / SMTP cracker for mailpass combolists including features like: proxy-support (SOCKS4 / SOCKS5) with automatic proxy-scraper and checker, e-mail delivery / inbox check and DNS lookup for unknown SMTP-hosts. Made for easy usage and always working! https://github.com/DrPython3/MailRipV2

​BeaconNotifier-Discord Cobalt strike CNA script to notify you via Discord whenever there is a new beacon. https://github.com/ScriptIdiot/BeaconNotifier-Discord Reference: https://download.cobaltstrike.com/aggressor-script/functions.html https://stackoverflow.com/questions/62731561/discord-send-message-only-from-python-app-to-discord-channel-one-way-communic #cobalt

​scan4all ▫️ Fast port scan, fingerprint detection function ▫️ Fast login password blasting function ▫️ Fast POC/CVE detection function ▫️ Fast sensitive file detection ▫️ Lightweight, open source, cross-platform use ▫️ Supports multiple types of input - STDIN/HOST/IP/CIDR/URL/TXT ▫️ Supports multiple types of output - JSON/TXT/CSV/STDOUT https://github.com/hktalent/scan4all

​GooFuzz The Power of Google Dorks. GooFuzz is a tool to perform fuzzing with an OSINT approach, managing to enumerate directories, files, subdomains or parameters without leaving evidence on the target's server and by means of advanced Google searches (Google Dorking). https://github.com/m3n0sd0n4ld/GooFuzz

​ScanT3r Web Security Scanner this is a module-based web automation tool that I made for saving my scripting time by providing some utilizes that every web pentester needs in his automation script instead of focusing on ( logger, parsers, output function, cmd args, multi-threading), just write the logic of your scanning idea with scant3r utils without caring about these things, you can find callback/parsing/logging utils and output functions, Also we will add Restful API soon what if you need to add a new Command option to scant3r for your script? easy without writing any code just open the `conf/opts.YAML file and you will find all options of scant3r so you can change and add what you want;D https://github.com/knassar702/scant3r

​Dumpy This tool dynamically calls MiniDumpWriteDump to dump lsass memory content. This process is done without opening a new process handle to lsass and using DInvoke_rs to make it harder to detect its malicious behaviour. In order to obtain a valid process handle without calling OpenProcess over lsass, all process handles in the system are analyzed using NtQuerySystemInformation, NtDuplicateObject, NtQueryObject and QueryFullProcessImageNameW. NtOpenProcess is hooked before calling MiniDumpWriteDump to avoid the opening of a new process handle over lsass. NTFS Transaction are used in order to xor the memory dump before storing it on disk. Support added for both x86 and x64. https://github.com/Kudaes/Dumpy #lsass #dump

​Spirit smart SSH tools. Spirit tries 1 USER:PASS per HOST cycling through all the hosts and removing unreachable or filtered hosts. With each password attempt, fewer hosts are being tried as the logic removes non-vulnerable hosts from the attack surface, this greatly increases the efficiency and speed of the brute-force attack. https://github.com/aogspirit/spirit

​Garud An automation tool that scans sub-domains, sub-domain takeover and then filters out xss, ssti, ssrf and more injection point parameters. https://github.com/R0X4R/Garud