HackGit

​​SideLoadingDLL Python script to generate "proxy" DLL files load unsafely by binaries on runtime, makes it super easy to perform a DLL Sideloading attack or hijacking. This implementation makes sure that all system calls still go through ntdll.dll to avoid the usage of direct systemcalls. https://github.com/MaorSabag/SideLoadingDLL t.me/hackgit

​​OrcaC2 OrcaC2 is a multi-functional C&C framework based on Websocket encrypted communication. https://github.com/Ptkatz/OrcaC2

​​cmstplua-uac-bypass This is a Cobalt Strike (CS) Beacon Object File (BOF) which exploits the CMSTPLUA COM interface. It masquerade the PEB of the current process to a Windows process, and then utilises COM Elevation Moniker on the CMSTPLUA COM object in order to execute commands in an elevated context. https://github.com/tijme/cmstplua-uac-bypass

​​linvo-scraper Here you can find secure scraping using Puppeteer for different Linkedin actions ▫️ Login ▫️ Scrape profiles: Sales Nav / Normal ▫️ Connection Request ▫️ Follow message ▫️ Endorse Profile ▫️ Visit Profile ▫️ Like posts ▫️ Random Engagement https://github.com/linvo-io/linvo-scraper

​​Firefox-Grabber Simple Firefox grabber, which grab Twitter,Discord and Paypal infos https://github.com/PL-V/Firefox-Grabber

​​NimShellcodeFluctuation ShellcodeFluctuation PoC ported to Nim https://github.com/S3cur3Th1sSh1t/NimShellcodeFluctuation

​​CVE-2022-40684 Critical Authentication Bypass in FortiOS and FortiProxy https://github.com/dickson0day/CVE-2022-40684 #cve

​​LMD Linux Malware Detection https://github.com/rfxn/linux-malware-detect

​​Aftermath Aftermath is a Swift-based, open-source incident response framework. Aftermath can be leveraged by defenders in order to collect and subsequently analyze the data from the compromised host. Aftermath can be deployed from an MDM (ideally), but it can also run independently from the infected user's command line. https://github.com/jamf/aftermath

​​CVE-2022-2992 Authenticated Remote Command Execution in Gitlab via GitHub import. https://github.com/CsEnox/CVE-2022-2992 #cve

​​BOF2Shellcode POC tool to convert a Cobalt Strike BOF into raw shellcode. https://github.com/FalconForceTeam/BOF2shellcode t.me/hackgit

​​THEDEVILSEYE Extracts information (.onion links, descriptions) from the darkweb without requiring a Tor network. https://github.com/rly0nheart/thedevilseye #OSINT

​​awesome-tunneling The purpose of this list is to track and compare tunneling solutions. This is primarily targeted toward self-hosters and developers who want to do things like exposing a local webserver via a public domain name, with automatic HTTPS, even if behind a NAT or other restricted network. https://github.com/anderspitman/awesome-tunneling

​​The Prime Hunt Browser Extension The Prime Hunt is a browser extension for threat hunting. It introduces a One UI idea to simplify and speed up the investigation process regardless of the SIEMs or EDR in use. This is useful both for threat hunters starting off their careers and for seasoned professionals. The former can master the different security platforms and query languages faster, learning the right methodology from the very beginning, while the latter benefit from a streamlined workflow. https://github.com/socprime/the-prime-hunt

​​Server Side Template Injection Payloads Server-side template injection is when an attacker is able to use native template syntax to inject a malicious payload into a template, which is then executed server-side. Template engines are designed to generate web pages by combining fixed templates with volatile data. Server-side template injection attacks can occur when user input is concatenated directly into a template, rather than passed in as data. This allows attackers to inject arbitrary template directives in order to manipulate the template engine, often enabling them to take complete control of the server. As the name suggests, server-side template injection payloads are delivered and evaluated server-side, potentially making them much more dangerous than a typical client-side template injection. https://github.com/payloadbox/ssti-payloads

​​AoratosWin A tool that removes traces of executed applications on Windows OS which can easily be listed with tools such as ExecutedProgramList by Nirsoft. https://github.com/PinoyWH1Z/AoratosWin t.me/hackgit

GitFive GitFive is an OSINT tool to investigate GitHub profiles. Features: ▫️ Usernames / names history ▫️ Usernames / names variations ▫️ Email address to GitHub account ▫️ Find GitHub's accounts from a list of email addresses ▫️ Lists identities used by the target ▫️ Clones and analyze every target's repos ▫️ Highlights emails tied to GitHub's target account ▫️ Finds local identities (UPNs, ex : jeanpierre@My-Computer.local) ▫️ Finds potential secondary GitHub accounts ▫️ Don't needs repos to work (but better) ▫️ Generates every possible email address combinations and looks for matchs ▫️ Dumps SSH public keys ▫️ JSON export https://github.com/mxrch/gitfive

​​Reverse SSH Want to use SSH for reverse shells? Now you can. ▫️ Manage and connect to reverse shells with native SSH syntax ▫️ Dynamic, local and remote forwarding ▫️ Native SCP and SFTP implementations for retrieving files from your targets ▫️ Full windows shell ▫️ Mutual client & server authentication to create high trust control channels And more! https://github.com/NHAS/reverse_ssh

​​Vichiti Vichiti is an cross-platform OSINT focused tool developed with Nodejs. It can perform several functions such as: ▫️ Gather information regarding an Instagram username ▫️ Validate the existence of an email address ▫️ Whois lookup ▫️ Geo-location lookup ▫️ Find your public IP address ▫️ Scan for ports ▫️ Expand shortened URLs ▫️ Safety check of URLs ▫️ MAC Address lookup ▫️ Crypto wallet address's balance check https://github.com/umair9747/vichiti #Donate t.me/hackgit🍻»»»

​​crimson-forge Crimson Forge intends to provide sustainable evasion capabilities for native code on the x86 and AMD64 architectures. It achieves this by rewriting the input code utilizing the following two techniques: Shuffling: Instructions are shuffled into a new order at the basic block level. This is a reliable technique and does not modify the size of resulting binary. Alterations: Instructions are swapped with functional equivalents, effectively de-optimizing them. New instructions are inserted into the same graph used by the Shuffling technique, allowing them to be reordered as well. Due to the nature of the re-writing, it is not necessary for processed shellcode to exist within writeable memory. This eliminates a very common pattern which is identified as malicious by many AV and EDR systems. https://github.com/zeroSteiner/crimson-forge