HackGit

​​EasyG EasyG started out as a script that I use to automate some information gathering tasks for PenTesting and Bug Hunting, you can find it here. Now it's more than that. Here I gather all the resources about PenTesting and Bug Bounty Hunting that I find interesting: notes, payloads that I found useful and many links to blogs and articles. https://github.com/seeu-inspace/easyg

​​CVE-2022-36663-PoC Internal network scanner through Gluu IAM blind ssrf Gluu IAM is vulnerable to blind SSRF which can be exploited to scan the internal network for open ports depending on response times. https://github.com/Qeisi/CVE-2022-36663-PoC #cve #poc

CVE-2022-39197 CobaltStrike <= 4.7.1 RCE https://github.com/TheCryingGame/CVE-2022-39197-RCE #cve

​​Awesome Firmware Security A curated list of platform firmware resources, with a focus on security and testing. Created by PreOS Security. https://github.com/PreOS-Security/awesome-firmware-security

​​Pentest-Cheat-Sheets This repo has a collection of snippets of codes and commands to help our lives! The main purpose is not be a crutch, this is a way to do not waste our precious time! This repo also helps who trying to get OSCP. You'll find many ways to do something without Metasploit Framework. https://github.com/Kitsun3Sec/Pentest-Cheat-Sheets

​​Raspberry Pi 400 Computer Kit The Raspberry Pi 400 contains the Raspberry Pi 4 hardware and architecture integrated inside of the Official Raspberry Pi keyboard for a stylish and easy to use one-piece computer. Simply plug in the mouse, power supply, and connect the MicroHDMI cable to your HDMI Display. Getting up and running with the Raspberry Pi has never been more convenient. Featuring a quad-core 64-bit processor at 1.8 GHz, 4 GB of RAM, wireless networking, dual-display output and 4K video playback, Raspberry Pi 400 is a complete personal computer, built into a compact keyboard. Access to most common external ports of the Raspberry Pi 4 are available in the Raspberry Pi 400, including the 40 pin GPIO, 2 x MicroHDMI, 2 x USB 3.0, 1 x USB 2.0, Gigabit Ethernet, MicroSD card slot, and USB-C power supply - all lined up on the back side providing less clutter on your desk. Kali on Raspberry Pi400 - User Instructions Specifications: ▫️ Broadcom 1.8GHz 64-bit quad-core ARMv8 CPU ▫️ 4GM RAM LPDDR-32000 ▫️ 16GB SD Card with Raspbian OS ▫️ Official Mouse ▫️ 3 Feet MicroHDMI to HDMI Cable ▫️ US Layout Keyboard Buy online: 🛒 https://amzn.to/3sjG8LH (amazon) 🛒 https://ali.ski/-bhVqf (aliexpress) #keyboard #pc #raspberry #pi

​​Hacking Resources CTF chall write-ups, files, scripts etc https://github.com/Crypto-Cat/CTF

​​Astra A tool to check subdomain takeover vulnerabilities written in Python https://github.com/ManasHarsh/Astra

​​MHDDoS DDoS Attack Script With 56 Methods https://github.com/MatrixTM/MHDDoS t.me/hackgit

​​WOT (without a trace) Conduct forensic investigation of suspicious domains, websites and other dangerous thing without the fear of being infected! A docker image for hiding yourself using tor as a proxy :) https://github.com/lockness-Ko/wot

​​ScubaGear SCuBA M365 Security Baseline Assessment Tool Developed by CISA, this assessment tool verifies that an M365 tenant’s configuration conforms to the policies described in the SCuBA Minimum Viable Secure Configuration Baseline documents. https://github.com/cisagov/ScubaGear

​​Peirates A Kubernetes penetration tool, enables an attacker to escalate privilege and pivot through a Kubernetes cluster. It automates known techniques to steal and collect service account tokens, secrets, obtain further code execution, and gain control of the cluster. https://github.com/inguardians/peirates

​​text4shell-scan A fully automated, accurate, and extensive scanner for finding vulnerable text4shell hosts Features: ▫️ Support for lists of URLs. ▫️ Fuzzing for more than 60 HTTP request headers. ▫️ Fuzzing for HTTP POST Data parameters. ▫️ Fuzzing for JSON data parameters. ▫️ Supports DNS callback for vulnerability discovery and validation. ▫️ WAF Bypass payloads. ▫️ Support for custom DNS OOB callbacks (ex: Burpsuite Collaborator) https://github.com/securekomodo/text4shell-scan

​​KubeStalk KubeStalk is a tool to discover Kubernetes and related infrastructure based attack surface from a black-box perspective. This tool is a community version of the tool used to probe for unsecured Kubernetes clusters around the internet during Project Resonance - Wave 9. https://github.com/redhuntlabs/kubestalk

​​PatchAMSI Bypass AMSI by patching AmsiScanBuffer api memory https://github.com/D1rkMtr/PatchAMSI Details: https://rastamouse.me/memory-patching-amsi-bypass/

​​cve-2022-42889 Text4Shell affects Apache Commons Text versions 1.5 through 1.9. It has been patched as of Commons Text version 1.10. https://github.com/ClickCyber/cve-2022-42889 #cve

​​CVE-2022-27414 Exploit of College Website v1.0 CMS - SQL injection https://github.com/lus33rr/CVE-2022-27414 #cve

​​Partyloud Get your privacy back! Generate fake web browsing and mitigate tracking! PartyLoud is a highly configurable and straightforward free tool that helps you prevent tracking directly from your linux terminal, no special skills required. Once started, you can forget it is running. It provides several flags; each flag lets you customize your experience and change PartyLoud behaviour according to your needs. https://github.com/davideolgiati/PartyLoud

​​oidc-ssrf Evil OIDC server: the OpenID Configuration URL returns a 307 to cause SSRF. https://github.com/doyensec/oidc-ssrf

​​log4j-scan A fully automated, accurate, and extensive scanner for finding vulnerable log4j hosts ▫️ Support for lists of URLs. ▫️ Fuzzing for more than 60 HTTP request headers (not only 3-4 headers as previously seen tools). ▫️ Fuzzing for HTTP POST Data parameters. ▫️ Fuzzing for JSON data parameters. ▫️ Supports DNS callback for vulnerability discovery and validation. ▫️ WAF Bypass payloads. https://github.com/fullhunt/log4j-scan