HackGit

​​dp_cryptomg Another tool for exploiting CVE-2017-9248, a cryptographic weakness in Telerik UI for ASP.NET AJAX dialog handler. Exploitation leads to access to a file manager utility capable up uploading arbitrary files, usually leading to remote code execution. https://github.com/blacklanternsecurity/dp_cryptomg

​​CVE-2022-41040-metasploit-ProxyNotShell the metasploit script(POC) about CVE-2022-41040. Microsoft Exchange are vulnerable to a server-side request forgery (SSRF) attack. An authenticated attacker can use the vulnerability to elevate privileges. https://github.com/TaroballzChen/CVE-2022-41040-metasploit-ProxyNotShell

​​sysmon-parser Automatically generated Sysmon parser for Azure Sentinel Sysmon-AllVersions_Parser.txt can be loaded as a function in Azure Sentinel to parse all your events. There is an Azure Devops pipeline that triggers daily to install the latest Sysmon version, extracts the schema and populates the parser with all unique fields. The PowerShell script can also be run locally on a box which has Sysmon installed https://github.com/olafhartong/sysmon-parser

​​CVE-2022-22947 Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE) Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host. https://github.com/crowsec-edtech/CVE-2022-22947 #cve

​​KASLD Kernel Address Space Layout Derandomization A collection of various techniques to bypass Linux Kernel Address Space Layout Randomization (KASLR) and retrieve the kernel base virtual address on x86/x86_64 architectures as an unprivileged local user. https://github.com/bcoles/kasld t.me/hackgit

​​Unique Subdomain Enumeration Great research regarding subdomain enumeration through permutations, unique approach that can provide good results with a smaller initial bruteforce data set in comparison to altdns. https://github.com/cramppet/regulator Research: https://cramppet.github.io/regulator/index.html

​​PHP filter chain generator A CLI to generate PHP filters chain, get your RCE without uploading a file if you control entirely the parameter passed to a require or an include in PHP! https://github.com/synacktiv/php_filter_chain_generator

​​DeJITLeak DOI This repository provides the tool for the paper "DeJITLeak: Eliminating JIT-Induced Timing Side-Channel Leaks" accepted at ECSE/FSE 2022. https://github.com/DeJITLeak/DeJITLeak

​​penguinTrace penguinTrace is intended to help build an understanding of how programs run at the hardware level. It provides a way to see what instructions compile to, and then step through those instructions and see how they affect machine state as well as how this maps back to variables in the original program. A bit more background is available on the website. penguinTrace starts a web-server which provides a web interface to edit and run code. Code can be developed in C, C++ or Assembly. The resulting assembly is then displayed and can then be stepped through, with the values of hardware registers and variables in the current scope shown. penguinTrace runs on Linux and supports the AMD64/X86-64 and AArch64 architectures. penguinTrace can run on other operating systems using Docker, a virtual machine or through the Windows Subsystem for Linux (WSL). https://github.com/penguintrace/penguintrace

​​SubEnum bash script for Subdomain Enumeration using 4 tools and 3 online services, you have to install these tools by yourself to be able to use SubEnum.sh, or use setup.sh script to install them. https://github.com/bing0o/SubEnum #Donate t.me/hackgit🍻»»»

​​rewind Rewind is a snapshot-based coverage-guided fuzzer targeting Windows kernel components. The idea is to start from a snapshot of a live running system. This snapshot is composed of the physical memory pages along with the state of the cpu. This state is used to setup the initial state of a virtual cpu. By leveraging on-demand paging only the pages needed for the execution of the target function are read from the snapshot. Because we use a dedicated virtual machine with only the physical memory pages useful for the execution of the target function, restoring a snapshot is fast. https://github.com/quarkslab/rewind

​​xnLinkFinder This is a tool used to discover endpoints (and potential parameters) for a given target. It can find them by: ▫️ crawling a target (pass a domain/URL) ▫️ crawling multiple targets (pass a file of domains/URLs) ▫️ searching files in a given directory (pass a directory name) ▫️ get them from a Burp project (pass location of a Burp XML file) ▫️ get them from an OWASP ZAP project (pass location of a ZAP ASCII message file) ▫️ processing a waymore results directory (searching archived response files from waymore -mode R and also requesting URLs from waymore.txt and the original URLs from index.txt - see waymore README.md) https://github.com/xnl-h4ck3r/xnLinkFinder

​​Symbiotic Symbiotic is an open-source framework for program analysis integrating instrumentation, static program slicing and various program analysis tools. Symbiotic is highly modular and most of its components are self-standing programs or LLVM passes that have their own repositories at https://github.com/staticafi https://github.com/staticafi/symbiotic

​​GetFGPP Get Fine Grained Password Policy You must have have read access to the FGPP Container and FGPP Objects to enumerate this. By default, only admins have this right. https://github.com/n00py/GetFGPP t.me/hackgit

CVE-2022-42889 PoC This is Proof of Concept for the vulnerability CVE-2022-42889. This code will run the JavaScript code 195 + 324. If vulnerable the output should be: PoC Output: 519 https://github.com/SeanWrightSec/CVE-2022-42889-PoC Details: https://blogs.apache.org/security/entry/cve-2022-42889 #cve #poc

​​Kunyu More Efficient Corporate Asset Collection. Application scenario: ▫️ Forgotten and isolated assets in the enterprise are identified and added to security management. ▫️ Perform quick investigation and statistics on externally exposed assets of the enterprise. ▫️ Red and blue are used against related requirements, and batch inspections of captured IPs are performed. ▫️ Collect vulnerable assets in batches (0day/1day) for equipment and terminals within the impact. ▫️ Information on sites involved in new-type cybercrime cases is quickly collected and merged for more efficient research, judgment, and analysis. ▫️ Statistic and reproduce the fragile assets on the Internet that are affected by related vulnerabilities. https://github.com/knownsec/Kunyu

Privado Privado is an open-source static code analysis tool to discover data flows in the code. It detects Personally Identifiable Information (PII) being processed and further maps the data flow from the point of collection to "sinks" such as external third parties, databases, logs, and internal APIs. https://github.com/Privado-Inc/privado