HackGit

CheckHooks-n-load A Windows stager-cum-PELoader focusing Dynamic EDR Evasion, when Operator wants to Know the the Underlying functions Hooks and then craft Implant based on the previous condition. https://github.com/reveng007/CheckHooks-n-load #pentesting #redteam

​​Hiding Shellcode In Plain Sight This technique is very simple, a RW memory region 2048 the size of the shellcode is allocated. This region is then filled with randomized data data (RtlGenRandom), the shellcode is then placed randomly somewhere within this massive region each time. This makes it hard for an AV/EDR solution, or an analyst, to simply see where the shellcode is in-memory. To summarize: ▫️ Allocate a large PAGE_READWRITE region, 2048 * size of the target shellcode, and align to 0x1000 ▫️ Fill this allocated region with random data ▫️ Write the shellcode to a random location within this region, save position ▫️ Change the page permissions to PAGE_EXECUTE ▫️ Execute the shellcode (page + position) ▫️ Zero the memory where the entire large region is to ensure the data does not persist after being freed, using the RtlZeroMemory macro ▫️ Free the region of memory https://github.com/LloydLabs/shellcode-plain-sight

​​Paruns-Fart Just another ntdll unhooking using Parun's Fart technique. https://github.com/MaorSabag/Paruns-Fart

​​TheSmartool 🧬 An easy to handle hacking script, SSH Forcebrute, FTP Forcebrute and many others features. https://github.com/Coroxx/TheSmartool

​​List of API endpoints & objects A list of 3203 common API endpoints and objects designed for fuzzing. https://gist.github.com/yassineaboukir/8e12adefbd505ef704674ad6ad48743d #bugbounty

​​EdgeGPT Reverse engineered API of Microsoft's Bing Chat https://github.com/acheong08/EdgeGPT #GPT

​​dexios A secure file encryption utility, written in Rust. Dexios will continue to receive updates. Things are stable for the time being and I consider none of the code broken. In the (somewhat) near future I plan to change the backend entirely and give the CLI a re-write, so that things are both easier to maintain and understand. This will regrettably not be backwards-compatible, but the performance improvements and stability guarantees will be extremely worthwhile. https://github.com/brxken128/dexios

​​osinttools A collection of random #OSINT files. https://github.com/WebBreacher/osinttools

​​KT9000 RF Detector The professional-grade KNIGHT KT9000 anti-spy detector was developed including premium German and US military technology in response to the growing need to protect oneself from many types of security threats. As electronic products become smaller and more intelligent, spy devices like hidden cameras, audio bugs, and GPS trackers are becoming more difficult to detect because of their small size and camouflage. Although these electronic spy devices do have legal uses, many people have started using them to illegally invade privacy and/or obtain sensitive information, leading to private information leaks or the theft of confidential business information. The KNIGHT KT9000 will help you to perform the 3 main functions listed below at an expert level. ▫️ Radio Frequency Detection ▫️ Magnetic Detection ▫️ Camera Discovery Scan User Manual + Instructional Video here Buy online: 🛒 https://amzn.to/3lvwllD #security #spy #detector

​​tls-scan An Internet scale, blazing fast SSL/TLS scanner ( non-blocking, event-driven ) A program to scan TLS based servers and collect X.509 certificates, ciphers and related information. It produces results in JSON format. tls-scan is a single threaded asynchronous/event-based program (powered by libevent) capable of concurrently scan thousands of TLS servers. It can be combined with other tools such as GNU parallel to vertically scale in multi-core machines. https://github.com/prbinu/tls-scan

​​Wordpress Security Checklist A simple checklist to improve the security of your WordPress installation https://github.com/RafaelFunchal/wordpress-security-checklist

​​fofax fofax is a fofa query tool written in go, positioned as a command-line tool and characterized by simplicity and speed. The following features are currently available: ▫️ Basic FOFA syntax queries ▫️ Icon Hash local/online calculation query ▫️ Asset filtering ▫️ Opening in browser ▫️ Linking other security tools ▫️ More (waiting for your feedback after using) In addition to this it is possible to customize fx syntax queries, and users can write their own specific fx query rules via a configuration file in yaml format. https://github.com/xiecat/fofax

​​Calico Calico is a widely adopted, battle-tested open source networking and network security solution for Kubernetes, virtual machines, and bare-metal workloads. Calico provides two major services for Cloud Native applications: ▫️ Network connectivity between workloads. ▫️ Network security policy enforcement between workloads. https://github.com/projectcalico/calico

​​Web Application Cheatsheet (Vulnhub) This cheatsheet is intended for CTF participants and beginners to help them understand web application vulnerability through examples. There are multiple ways to perform the same task. We have performed and compiled this list based on our experience. https://github.com/Ignitetechnologies/Web-Application-Cheatsheet

​​Inject Packet crafting, injection and sniffing tool. https://github.com/fksvs/inject #pentesting #redteam

​​Awesome Network Security A collection of awesome resources, tools, and other shiny things for Network Security. https://github.com/SubediBibek-cmd/awesome-network-security

​​CVE-2022-28368 - Dompdf RCE Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file). https://github.com/rvizx/CVE-2022-28368 #cve #poc