HackGit

​​Concealed Code Execution Tools and technical write-ups describing attacking techniques that rely on concealing code execution on Windows. https://github.com/huntandhackett/concealed_code_execution

​​Warbird Hook Using Microsoft WARBIRD to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard. https://github.com/KiFilterFiberContext/warbird-hook

​​CVE-2021-43811 awslabs/sockeye Code injection via unsafe YAML loading CVE-2021-43811 https://github.com/s-index/CVE-2021-43811 #cve

​​Sandman Sandman is a backdoor that meant to work on hardened networks during red team engagements. Sandman works as a stager and leverages NTP (protocol to sync time & date) to download an arbitrary shellcode from a pre defined server. Since NTP is a protocol that is overlooked by many defenders resulting wide network accessability. https://github.com/Idov31/Sandman

​​lazyParam A simple automation tool with the implementation of multi-threading to check for hidden parameters. This tool is still in testing phase and more implementations are soon to be made. note: Works with python3 Features: ▫️ Fuzz parameters for both GET and POST method ▫️ Multi-threaded (Default: 4) ▫️ Use intensive mode with characters bypassing techniques (beta) ▫️ Check for LFI, RCE and SSTI https://github.com/aniqfakhrul/lazyParam

FarsightAD A PowerShell script that aim to help uncovering (eventual) persistence mechanisms deployed by a threat actor following an Active Directory domain compromise. The script produces CSV / JSON file exports of various objects and their attributes, enriched with timestamps from replication metadata. Additionally, if executed with replication privileges, the Directory Replication Service (DRS) protocol is leveraged to detect fully or partially hidden objects. https://github.com/Qazeer/FarsightAD

​​assetfinder Find domains and subdomains potentially related to a given domain. https://github.com/tomnomnom/assetfinder Research: https://securitytrails.com/blog/assetfinder

​​ExportDumper A small tool I made to dump the export table of PE files. The primary use case was intended for use within DLL proxying. https://github.com/iilegacyyii/ExportDumper

​​GTPv1/GTPv2 Dialer This application is a GTP dialer to create sessions towards a SGW, PGW or GGSN. It can act as SGSN (gn/gp or S4), MME (S11), SGW (S5/S8), ePDG (S2b) or TWAG (S2a). The application implements not only the control plane, but also the user plane, so it's really useful to perform user plane tests for any APN, under specific conditions (IMSI, MSISDN, APN, IMEI, ULI, RAT, Charging Characteristics, Fixed IP APNs, DHCP, PDP Type, Authentication, etc...) After the PDP/PDN session is established, a tunnel is created with the IP(s) received from the GGSN/PGW. A default route is created pointing to the tunnel interface, so that applications can use the PDN/PDP established. There is an option to use Namespaces. PDP/PDN types ipv4, ipv6 and ipv4v6 are supported. https://github.com/fasferraz/gtp_dialer

​​capa capa detects capabilities in executable files. You run it against a PE, ELF, .NET module, or shellcode file and it tells you what it thinks the program can do. For example, it might suggest that the file is a backdoor, is capable of installing services, or relies on HTTP to communicate. https://github.com/mandiant/capa

​​Arsenal Offensive Security Tools Weaponized ▫️ Cloud - Using the cloud for offensive security purposes ▫️ Coding - Using different coding languages for offensive security purposes ▫️ Containers - Offensive security tools containerized ▫️ Hardware - Setting up hardware for offensive security purposes ▫️ Resources - Additional resources for offensive security use ▫️ Tools - Basic offensive security tool setup and configuration https://github.com/sneakerhax/Arsenal

​​Chepy Chepy is a python library with a handy cli that is aimed to mirror some of the capabilities of CyberChef. A reasonable amount of effort was put behind Chepy to make it compatible to the various functionalities that CyberChef offers, all in a pure Pythonic manner. There are some key advantages and disadvantages that Chepy has over Cyberchef. The Cyberchef concept of stacking different modules is kept alive in Chepy. Advantages: ▫️ Chepy is pure python with a supporting and accessible python api ▫️ Chepy has a CLI ▫️ Chepy CLI has full autocompletion. ▫️ Supports pe, elf, and other various file format specific parsing. ▫️ Extendable via plugins ▫️ Infinitely scalable as it can leverage the full Python library. ▫️ Chepy can interface with the full Cyberchef web app to a certain degree. It is easy to move from Chepy to Cyberchef if need be. ▫️ The Chepy python library is significantly faster than the Cyberchef Node library. ▫️ Works with HTTP/S requests without CORS issues. https://github.com/securisec/chepy

​​CVE-2022-1802 https://github.com/mistymntncop/CVE-2022-1802 #cve #exploit

​​W0wS3cur1tyEDR Project for people who want to know more about edr's. W0wS3cur1tyEDR consists from 2 projects : ▫️ W0wS3cur1ty, which is the dll file that will get injected to a target process ▫️ WSEdr, the enjector that will inject W0wS3cur1ty.dll into the target process the dll file, create a new console, and write data to it, it hooks (using minhook library): ▫️ NtCreateThreadEx ▫️ NtWriteVirtualMemory ▫️ NtAllocateVirtualMemory ▫️ NtProtectVirtualMemory NtProtectVirtualMemory hook can even dump the RWX sections i added a 'payload.dll' file that can be used as a test, it runs all the 4 hooked api's and can be injected automatically by the juicy edr, it runs metasploit's calc shellcode so it may be detected by your av before the demo... https://github.com/ORCx41/W0wS3cur1tyEDR

​​Pitraix Modern Cross-Platform HTTP-Based P2P Botnet over TOR that cannot be traced. Design is based off "zero-trust" even malicious peers cannot do any damage while protecting operator identity. for more techincal information check spec.txt Pitraix is able to handle millions of hosts, the limit is TOR network capacity You can run Pitraix on a toaster and it will still work just as good with said millions of hosts, as the operative is one who sending requests, not recieving it and because there is no C2. https://github.com/ThrillQuks/Pitraix

​​BARK Detections These KQL queries are designed to find use of the abuses in the BloodHound BARK toolkit in Azure AD https://github.com/reprise99/Sentinel-Queries/tree/main/Azure%20AD%20Abuse%20Detection #ad

​​YATAS A simple tool to audit your AWS infrastructure for misconfiguration or potential security issues. https://github.com/StanGirard/YATAS

​​Optik A set of symbolic execution tools that assist smart-contract fuzzers. Current limitations include: ▫️ Symbolic KECCAK hashes are not supported ▫️ CREATE2, CALLCODE, and DELEGATECALL are not yet supported ▫️ Gas is not taken into account ▫️ Some echidna options are not yet supported (see hybrid-echidna -h) https://github.com/crytic/optik

​​crAPI completely ridiculous API (crAPI) will help you to understand the ten most critical API security risks. crAPI is vulnerable by design, but you'll be able to safely run it to educate/train yourself. https://github.com/OWASP/crAPI

​​Gokart A Static Analysis Tool For Securing Go Code. GoKart is a static analysis tool for Go that finds vulnerabilities using the SSA (single static assignment) form of Go source code. It is capable of tracing the source of variables and function arguments to determine whether input sources are safe, which reduces the number of false positives compared to other Go security scanners. For instance, a SQL query that is concatenated with a variable might traditionally be flagged as SQL injection; however, GoKart can figure out if the variable is actually a constant or constant equivalent, in which case there is no vulnerability. https://github.com/praetorian-inc/gokart