HackGit

​​FirmAE FirmAE is a fully-automated framework that performs emulation and vulnerability analysis. FirmAE significantly increases the emulation success rate (From Firmadyne's 16.28% to 79.36%) with five arbitration techniques. We tested FirmAE on 1,124 wireless-router and IP-camera firmware images from top eight vendors. We also developed a dynamic analysis tool for 0-day discovery, which infers web service information based on the filesystem and kernel logs of target firmware. By running our tool on the succesfully emulation firmware images, we discovered 12 new 0-days which affect 23 devices. https://github.com/pr0v3rbs/FirmAE

​​CrazyRadio PA 2.4 GHz USB dongle Crazy.radio PA is a long range open USB radio dongle based on the nRF24LU1+ from Nordic Semiconductor. It features a 20dBm power amplifier, LNA and comes pre-programmed with Crazyflie compatible firmware. The power amplifier boosts the range, giving a range of more than 1km (line of sight) together with the Crazyflie 2.0 and above 2km Crazyradio PA to Crazyradio PA (line of sight). The Crazyradio PA is not only for usage together with the Crazy.flie and Crazy.flie 2.0. Since it’s an open project with firmware written from scratch and a Python API for usage it’s great building block for systems that require longer range than WiFi and doesn’t have the same requirements for bandwidth. The hardware comes shipped with the latest firmware as well as a bootloader that enables firmware upgrades via USB without any additional hardware needed. Features: ▫️ Radio power amplifier giving 20dBm output power ▫️ > 1km range LOS with Crazyflie 2.X ▫️ 2x5 2.54mm header for prototyping (not mounted) ▫️ Hardware support for PPM ▫️ Same mechanical footprint as the first generation Crazyradio ▫️ Open source firmware ▫️ Firmware upgrade via USB ▫️ Low latency Compatible with mousejack, keyjack, keysniffer, and JackIt projects. Firmware: https://github.com/bitcraze/crazyradio-firmware Buy online: 🛒 https://amzn.to/3g4d9cz 🛒 https://ali.ski/wA6Pa #radio #dongle #usb

​​unblob unblob is an accurate, fast, and easy-to-use extraction suite. It parses unknown binary blobs for more than 30 different archive, compression, and file-system formats, extracts their content recursively, and carves out unknown chunks that have not been accounted for. https://github.com/onekey-sec/unblob

​​Fuzzowski The idea is to be the Network Protocol Fuzzer that we will want to use. The aim of this tool is to assist during the whole process of fuzzing a network protocol, allowing to define the communications, helping to identify the "suspects" of crashing a service, and much more https://github.com/nccgroup/fuzzowski

​​laZzzy This is a shellcode loader, developed using different open-source libraries, that demonstrates different execution techniques. Features: ▫️ Direct syscalls and native functions; ▫️ Import Address Table (IAT) evasion; ▫️ Encrypted payload (XOR and AES); ▫️ PPID spoofing; ▫️ Blocking of non-Microsoft-signed DLLs; ▫️ etc. https://github.com/capt-meelo/laZzzy #maldev #loader #cpp #redteam

​​Ptrace Syscall Using Rust and Ptrace to invoke syscalls https://github.com/0xFounders/ptrace_syscalls Details: https://medium.com/@0xFounders/using-rust-and-ptrace-to-invoke-syscalls-262dc585fcd3 t.me/hackgit

​​proxybroker2 ProxyBroker is an open source tool that asynchronously finds public proxies from multiple sources and concurrently checks them. https://github.com/bluet/proxybroker2

​​GoC2 MacOS Post Exploitation C2 Framework Custom C2 for bypassing EDR and ease of use. c2 client/server/paylod👇 https://github.com/grines/goc2

​​SPY Social media scanning python tool 🕵️‍♂️ An OSINT tool to scan social media accounts by username across social networks https://github.com/CYB3R-G0D/SPY #OSINT

​​Cinject Cinject is a project that executes dll injection in the Windows kernel. It is characterized by no modules and no threads. It uses remote stretching pe to achieve no modules. It uses APC or SupendThread to replace Rip registers to hijack threads to achieve no threads. The running environment was tested in 1909. If you want to run in other versions, you need to modify and find the function signatures of KeSuspendThread and KeResumeThread. I will tell you how to modify the offset of OFFSET_KTRAP_FRAME below. The injected dll also requires attributes ->code generation ->runtime multi-threaded MT. In short, other dll modules in the import table of the dll must also exist in the target process! https://github.com/ccdescipline/CInject

​​x8 Hidden parameters discovery suite written in Rust. The tool helps to find hidden parameters that can be vulnerable or can reveal interesting functionality that other testers miss. Great accuracy is achieved thanks to the line-by-line comparison of pages, comparison of response code and reflections. https://github.com/Sh1Yo/x8

​​dns-over-ping(8) You've heard of DNS-over-HTTP, DNS-over-TLS, DNS-over-GRPC... Now get ready for DNS-over-ping(8)! Resolve names straight from the standard inetutils/iptools ping tool: https://github.com/jamespwilliams/dns-over-ping

​​MalwareDev Malware Development (The Hidden Art) A series of malware development adventures This repo will contain malware techniques both in c# and c++ for educational purposes. https://github.com/georgesotiriadis/MalwareDev

​​WeightBufs WeightBufs is a kernel r/w exploit for all Apple devices with Neural Engine support. Bugs and Exploit by @simo36, you can read my presentation slides at POC for more details about the vulnerabilities and the exploitation techniques. The exploit doesn't rely on any hardcoded address or offset, and it should work AS IS on macOS12 up to 12.4 and *OS 15 up to 15.5. The kernel vulerabilties affect all iOS 15 versions (up to 16.0), however the sandbox escape has been fixed on iOS 15.6. As a result, breaking the exploit chain and another sandbox escape is required to get things working again on iOS 15.6/15.7. Although I have another sandbox escape that works up to iOS 16.1, I'm not sure if the kernel exploit techniques are still usable on iOS 15.6+. https://github.com/0x36/weightBufs

​​ARM_mali Vulnerabilities in ARM mali gpu driver https://github.com/yanglingxi1993/ARM_mali

​​IEEEEuroSP23 Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTI This repository contains implementation fotr the paper "Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTI". https://github.com/aiforsec22/IEEEEuroSP23

​​Evil Crow Cable Evil Crow BadUSB Cable is an information security and penetration testing tool that looks and functions just like a regular USB cable (both power and data) until a wireless remote control triggers it to deliver your choice of attack payload to the host machine. In essence, Evil Crow is the next step in the evolution of BadUSB, embedding the attack in the USB cable itself. Emulating keyboard and mouse actions, payloads can be completely customized and can be highly targeted. Undetectable by firewalls, AV software (depending on payload of course) or visual inspection, the Evil Crow Cable is an ideal tool for penetration testers, police and government. For more information you can read the following repository: https://github.com/joelsernamoreno/BadUSB-Cable You can get payloads in the following repository: https://github.com/joelsernamoreno/badusb_examples/tree/master/attiny85_digispark Buy online: Micro USB 🛒https://ali.ski/NUz0mP Type C 🛒 https://ali.ski/DPHK27 #badusb #cable #usb

​​Wfuzz - The Web Fuzzer Wfuzz has been created to facilitate the task in web applications assessments and it is based on a simple concept: it replaces any reference to the FUZZ keyword by the value of a given payload. A payload in Wfuzz is a source of data. This simple concept allows any input to be injected in any field of an HTTP request, allowing to perform complex web security attacks in different web application components such as: parameters, authentication, forms, directories/files, headers, etc. Wfuzz is more than a web content scanner: ▫️ Wfuzz could help you to secure your web applications by finding and exploiting web application vulnerabilities. Wfuzz’s web application vulnerability scanner is supported by plugins. ▫️ Wfuzz is a completely modular framework and makes it easy for even the newest of Python developers to contribute. Building plugins is simple and takes little more than a few minutes. ▫️ Wfuzz exposes a simple language interface to the previous HTTP requests/responses performed using Wfuzz or other tools, such as Burp. This allows you to perform manual and semi-automatic tests with full context and understanding of your actions, without relying on a web application scanner underlying implementation. https://github.com/xmendez/wfuzz A Detailed Guide on Wfuzz: https://www.hackingarticles.in/a-detailed-guide-on-wfuzz/

​​Microsoft ICS Forensics Tools Microsoft Section52 ICS Forensics Tools is an open source forensic toolkit for analyzing Industrial PLC metadata and project files. Microsoft Section52 ICS Forensics Tools enables investigators to identify suspicious artifacts on ICS environment for detection of compromised devices during incident response or manual check. Microsoft Section52 ICS Forensics Tools is open source, which allows investigators to verify the actions of the tool or customize it to specific needs, currently support Siemens S7 via Snap7. https://github.com/microsoft/ics-forensics-tools