HackGit

EvilURL Generate unicode evil domains for IDN Homograph Attack and detect them. https://github.com/UndeadSec/EvilURL

​​PSAsyncShell Asynchronous TCP Reverse Shell written in pure PowerShell. Unlike other reverse shells, all the communication and execution flow is done asynchronously, allowing to bypass some firewalls and some countermeasures against this kind of remote connections. Additionally, this tool features command history, screen wiping, file uploading and downloading, information splitting through chunks and reverse Base64 URL encoded traffic. https://github.com/JoelGMSec/PSAsyncShell Research: https://darkbyte.net/psasyncshell-bypasseando-firewalls-con-una-shell-tcp-asincrona/ #ad #powershell #reverse #shell

SubScan Script and a Python module that is used to find directories and subdomains of a web site using word lists, scan the ports of a machine, retrieve the route of a request. SubScan has two main functions one for listing directories of a website on Windows that does not have an anonymous mode and one for listing directories of a website. https://github.com/Negative-py/SubScan

​​ComPP Company Passwords Profiler. It helps making a bruteforce wordlist for a targeted company. The tool responds to a need to generate wordlists quickly with few inputs. The generated passwords will contain generic company informations with transformation such as APPNAME2019! or Company75000$. The main use of the generated wordlist is with remote bruteforce and password spraying attack such as a ssh service or a WordPress website. https://github.com/sec-it/ComPP

​​ShellCheck A shell script static analysis tool. https://github.com/koalaman/shellcheck

Restringer Deobfuscate Javascript and reconstruct strings. Simplify cumbersome logic where possible while adhering to scope limitations. https://github.com/PerimeterX/Restringer Defeating Javascript Obfuscation: https://www.perimeterx.com/tech-blog/2022/defeating-javascript-obfuscation

​​Detectree A data visualisation tool for #blueteams. It provides a graphical representation of detection data, which allows an analyst generate almost instant opinions about the nature of the underlying activity and to understand complex relationships between the data points. Ultimately, this can help reduce response time, reduce alert fatigue and facilitate communication between analysts within the teams. https://github.com/countercept/detectree

​​rokenSMTP Small python script to look for common #vulnerabilities on the #SMTP server. Supported Vulnerability: ▫️ Spoofing - The ability to send an email by impersonating another user. ▫️ User Enumeration - Looking for the possibility to enumerate users with the SMTP VFRY command. https://github.com/mrlew1s/BrokenSMTP

​​Swego Swiss army knife Webserver in Golang. Keep simple like the python SimpleHTTPServer but with many features Features: ▫️ HTTPS (auto generate certificate / key if no certificate / key specified) ▫️ Directory listing ▫️ Define a private folder with basic authentication ▫️ Upload multiple files ▫️ Download file as an encrypted zip (password: infected) ▫️ Download folder with a zip ▫️ Embedded files ▫️ Run embedded binary written in C# (only available on Windows) ▫️ Create a folder from the browser ▫️ Ability to execute embedded binary ▫️ Feature for search and replace (for fill the IP address in reverse shell for example) ▫️ Generate oneliners to download and execute a embedded file ▫️ Config file examples .Swego.yaml ▫️ Auto generate random certificate for TLS https://github.com/nodauf/Swego

​​CF Cloud exploitation framework, It can facilitate the work of the #redteam after obtaining access key. Currently supported features: ▫️ List OSS ▫️ List ECS ▫️ Get the STS Token in the instance metadata ▫️ Batch execution of multiple commands used to prove permission acquisition ▫️ Get intances reverse shell ▫️ Support alibaba cloud ▫️ List RDS ▫️ Takeover console ▫️ View permissions for access key ▫️ Support Tencent Cloud Functions to be implemented in the future: ▫️ Attack trail removal ▫️ Automatically detect if the current running environment is an instance, and if so, scan the local instance for credential information ▫️ Add the resulting credentials to the CF ▫️ Support other cloud providers https://github.com/teamssix/cf/blob/main/README_EN.md

​​ALFA Network AWUS036NH Clone This is not the original, but works just as well, you can read the reviews. But most importantly, it is several times cheaper! It supports monitor mode, kali linux and is made on the same chipset Ralink 3070L as the original Alfa adapter. So if you want to start doing some Wi-Fi pentesting using kali linux or just want to learn about the weaknesses of wifi this is the product to go for. It is cheap and works perfect. Buy online: 🛒 https://ali.ski/SCDz_ #wifi #adapter #kali

​​modDetective Small Python tool that chronologizes files based on modification time in order to investigate recent system activity. This can be used in CTF's in order to pinpoint where escalation and attack vectors may exist. https://github.com/itsKindred/modDetective

​​ReverseSSH A statically-linked ssh server with a reverse connection feature for simple yet powerful remote access. Catching a reverse shell with netcat is cool, sure, but who hasn't accidentally closed a reverse shell with a keyboard interrupt due to muscle memory? Besides their fragility, such shells are also often missing convenience features such as fully interactive access, TAB-completion or history. Instead, you can go the way to simply deploy the lightweight ssh server (<1.5MB) reverse-ssh onto the target, and use additional commodities such as file transfer and port forwarding! ReverseSSH tries to bridge the gap between initial foothold on a target and full local privilege escalation. Its main strengths are the following: ▫️ Fully interactive shell access (check caveats for old windows versions below) ▫️ File transfer via sftp ▫️ Local / remote / dynamic port forwarding ▫️ Can be used as bind- and reverse-shell ▫️ Supports Unix and Windows operating systems ▫️ Windows caveats https://github.com/Fahrj/reverse-ssh #ssh #backconnect #portforward #static

​​SkyRat Remote Access Trojan I wrote, but didn't finish. Although, you could use this as is without many issues. SkyRat is written in C and uses sockets for client/server connection. I do plan on updating Skyrat, but have multiple projects at the moment. Also, I am writing a tutorial on winsock2 for people who would like to create something similar. Features: ▫️ ability to have multiple connections ▫️ open shell on connected clients (e.g., run commands) ▫️ take a screenshot of a client's desktop ▫️ run shellcode on a client https://github.com/0xSegFaulted/SkyRat #rat

​​ProtectMyTooling Multi-Packer allowing to daisy-chain over 29 packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it with your implant, it does a lot of sneaky things and spits out obfuscated executable. https://github.com/mgeeky/ProtectMyTooling Research: https://mgeeky.tech/protectmytooling/

​​pivotnacci Pivot into the internal network by deploying HTTP agents. Pivotnacci allows you to create a socks server which communicates with HTTP agents. The architecture looks like the following: This tool was inspired by the great reGeorg. However, it includes some improvements: ▫️ Support for balanced servers ▫️ Customizable polling interval, useful to reduce detection rates ▫️ Auto drop connections closed by a server ▫️ Modular and cleaner code ▫️ Installation through pip ▫️ Password-protected agents https://github.com/blackarrowsec/pivotnacci

Offensive-Carbon Weaponizing Carbon Lang for #RedTeam operation https://github.com/ArchonLabs/Offensive-Carbon

​​Hook Hook exploits a parameter injection vulnerability in the WatchGuard SSH interface. The vulnerability allows a low privileged user to exfiltrate arbitrary system files to an attacker controlled FTP server. Fortunately, there is a builtin low privileged user named status that this script defaults to. It isn't unreasonable to assume that the status user will use a password of readonly, but it isn't required. https://github.com/jbaines-r7/hook

Code #obfuscation through Mixed Boolean-Arithmetic expressions. https://github.com/arnaugamez/talks/tree/master/2021/00_intent

Bashfuscator Modular and extendable Bash #obfuscation framework written in Python 3. It provides numerous different ways of making Bash one-liners or scripts much more difficult to understand. It accomplishes this by generating convoluted, randomized Bash code that at runtime evaluates to the original input and executes it. Bashfuscator makes generating highly obfuscated Bash commands and scripts easy, both from the command line and as a Python library. https://github.com/Bashfuscator/Bashfuscator