HackGit

​​HTTP Request Smuggler This is an extension for Burp Suite designed to help you launch HTTP Request Smuggling attacks, originally created during HTTP Desync Attacks research. It supports scanning for Request Smuggling vulnerabilities, and also aids exploitation by handling cumbersome offset-tweaking for you. This extension should not be confused with Burp Suite HTTP Smuggler, which uses similar techniques but is focused exclusively bypassing WAFs. https://github.com/portswigger/http-request-smuggler

​​ocsf-schema Open Cybersecurity Schema Framework This repository defines the Open Cybersecurity Schema Framework (OCSF) schema. OCSF is a framework for creating schemas and it also delivers a cybersecurity event schema built with the framework. The framework is made up of a set of categories, event classes, data types, and an attribute dictionary. The framework is not restricted to cybersecurity nor to events, however the initial focus of the framework has been a schema for cybersecurity events. A schema browser for the cybersecurity schema can be found at https://schema.ocsf.io This is the recommended way to explore the schema. https://github.com/ocsf/ocsf-schema

​​CVE-2022-36446 A Python script to exploit CVE-2022-36446 Software Package Updates RCE (Authenticated) on Webmin < 1.997. Features: ▫️ Supports HTTP and HTTPS (even with self-signed certificates with --insecure). ▫️ Single command execution with --command option. ▫️ Interactive console with --interactive option. https://github.com/p0dalirius/CVE-2022-36446-Webmin-Software-Package-Updates-RCE #cve #exploit #RCE

​​chrome_password Steal Get username & password from Chrome. (Now Only Windows) https://github.com/justjavac/chrome_password.js

dProg 🔍 dProg is tool for Bug bounty program detection by similar keyword on bug bounty program page. https://github.com/xcapri/dProgBb

​​AzureGoat A Damn Vulnerable Azure Infrastructure. AzureGoat is a vulnerable by design infrastructure on Azure featuring the latest released OWASP Top 10 web application security risks (2021) and other misconfiguration based on services such as App Functions, CosmosDB, Storage Accounts, Automation and Identities. AzureGoat mimics real-world infrastructure but with added vulnerabilities. It features multiple escalation paths and is focused on a black-box approach. The project will be divided into modules and each module will be a separate web application, powered by varied tech stacks and development practices. It will leverage IaC through terraform to ease the deployment process. https://github.com/ine-labs/AzureGoat

​​Nuclei Fast and customisable vulnerability scanner based on simple YAML based DSL. Nuclei is used to send requests across targets based on a template, leading to zero false positives and providing fast scanning on a large number of hosts. Nuclei offers scanning for a variety of protocols, including TCP, DNS, HTTP, SSL, File, Whois, Websocket, Headless etc. With powerful and flexible templating, Nuclei can be used to model all kinds of security checks. We have a dedicated repository that houses various type of vulnerability templates contributed by more than 300 security researchers and engineers. https://github.com/projectdiscovery/nuclei #best #scanner

​​gorilla The ultimate wordlist tool. It is capable of scraping websites for words, extend existing ones using advanced mutations or compute passwords using patterns. https://github.com/d4rckh/gorilla

💰 Donate If you like the channel please support us ❣️ https://www.buymeacoffee.com/HackGit BTC:

1987zNaVX53v7tzpKRRde84uXbDYjuNykL

TON:

UQAAZ1BFX5OsybSryoFunzyJN3F7oKWMbZNPlwMTcVK8mEzA

USDT – ERC20❗️:

0x1e7fa9e9c42f71e6d155aca39951f23355178163

You can buy crypto here Every donation gives us the motivation to do better and more content!

​​WebRecon A collection of pentesting tools that perform vulnerability scans websites. https://github.com/flashnuke/WebRecon

​​genact A nonsense activity generator. Pretend to be busy or waiting for your computer when you should actually be doing real work! Impress people with your insane multitasking skills. Just open a few instances of genact and watch the show. genact has multiple scenes that pretend to be doing something exciting or useful when in reality nothing is happening at all. https://github.com/svenstaro/genact

​​FFUF Me - Target Practice For FFUF This is a simple website to get you used to using ffuf against a live target You can either run this repo locally using docker or on our live system at http://ffuf.me https://github.com/adamtlangley/ffufme

​​Packj Flags malicious/risky open-source packages. Packj (pronounced package) is a command line (CLI) tool to vet open-source software packages for "risky" attributes that make them vulnerable to supply chain attacks. This is the tool behind our large-scale security analysis platform Packj.dev that continuously vets packages and provides free reports. https://github.com/ossillate-inc/packj

​​PowerHuntShares PowerHuntShares is design to automatically inventory, analyze, and report excessive privilege assigned to SMB shares on Active Directory domain joined computers. It is intented to help IAM and other blue teams gain a better understand of their SMB Share attack surface and provides data insights to help naturally group related share to help stream line remediation efforts at scale. https://github.com/NetSPI/PowerHuntShares Attacking and Remediating Excessive Network Share Permissions in Active Directory Environments: https://www.netspi.com/blog/technical/network-penetration-testing/network-share-permissions-powerhuntshares

​​Add download_file_types.asciipb entry for DIAGCAB By now Microsoft has fixed both Follina CVE-2022-30190 and Dogwalk CVE-2022-34713 programming flaws. But please don't forget that MSDT .diagcab files BY DESIGN will run code with a single click. With a UAC bypass if logged in as an admin. This still works. https://github.com/chromium/chromium/commit/cd290e7cbed7b2f95e4c2dc805e9d175f9161fc4

CVE-2022-21894 Secure Boot Security Feature Bypass Vulnerability https://github.com/Wack0/CVE-2022-21894 #cve

​​CVE-2022-29968 Proof-of-concept exploit for CVE-2022-29968 (uninitialized memory) in the Linux Kernel, specifically the io_uring system. https://github.com/jprx/CVE-2022-29968 #cve #exploit

​​MSMAP Msmap is a Memory WebShell Generator. Compatible with various Containers, Components, Encoder, WebShell / Proxy / Killer and Management Clients. https://github.com/hosch3n/msmap

​​lfimap Local file inclusion discovery and exploitation tool Features: ▫️ data:// for remote command execution ▫️ expect:// for remote command execution ▫️ input:// for remote command execution ▫️ filter:// for arbitrary file inclusion ▫️ file:// for arbitrary file inclusion ▫️ Remote file inclusion for code execution ▫️ Path truncation for arbitrary file inclusion ▫️ Command injection for remote command execution ▫️ Reflected XSS testing ▫️ Option to test POST arguments ▫️ Option to specify custom http headers ▫️ Option to specify cookies for authenticated requests ▫️ Option to specify a web proxy to send requests through ▫️ Option for automated reverse shell attack upon code execution detection https://github.com/hansmach1ne/lfimap