HackGit

​Red-Teaming-TTPs Free Resources to Practice https://github.com/RoseSecurity/Red-Teaming-TTPs #redteam

​unsubscan A tool to help you find unsubscribe links in your emails I created unsubscan because I think that anyone should be able to quickly and easily look at their emails and: ▫️ Unsubscribe from whatever they want ▫️ Unsubscribe whenever they want ▫️ Unsubscribe for free ▫️ Unsubscribe without yet another subscription service ▫️ Unsubscribe without having to give another company access to their emails ▫️ Unsubscribe without having to forward emails to other companies https://github.com/LGUG2Z/unsubscan

​Gliding Sword A full fledged exploitation framework written in pure python3. https://github.com/MrSharkSpamBot/GlidingSword

​GVNG Search Command line toolkit for gathering information about person (nickname search, validate email, geolocate ip) and domain (traceroute, dns lookup, tcp port scan etc). https://github.com/ByDog3r/GvngSearch

​liffy A little python tool to perform Local file inclusion. Feature: ▫️ data:// for code execution ▫️ expect:// for code execution ▫️ input:// for code execution ▫️ filter:// for arbitrary file reads ▫️ /proc/self/environ for code execution in CGI mode ▫️ Apache access.log poisoning ▫️ Linux auth.log SSH poisoning ▫️ Direct payload delivery with no stager ▫️ Support for absolute and relative path traversal ▫️ Support for cookies for authentication https://github.com/mzfr/liffy

​Alternative Code Execution According to Microsoft, a callback function is code within a managed application that helps an unmanaged DLL function complete a task. Calls to a callback function pass indirectly from a managed application, through a DLL function, and back to the managed implementation. https://github.com/aahmad097/AlternativeShellcodeExec

Ekko A small sleep obfuscation technique that uses CreateTimerQueueTimer to queue up the ROP chain that performs Sleep obfuscation https://github.com/Cracked5pider/Ekko

​CloudBrute A tool to find a company (target) infrastructure, files, and apps on the top cloud providers (Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode). The outcome is useful for bug bounty hunters, red teamers, and penetration testers alike. Features: ▫️ Cloud detection (IPINFO API and Source Code) ▫️ Supports all major providers ▫️ Black-Box (unauthenticated) ▫️ Fast (concurrent) ▫️ Modular and easily customizable ▫️ Cross Platform (windows, linux, mac) ▫️ User-Agent Randomization ▫️ Proxy Randomization (HTTP, Socks5) ▫️ Supported Cloud Providers https://github.com/0xsha/CloudBrute Research: https://0xsha.io/blog/introducing-cloudbrute-wild-hunt-on-the-clouds

Red Team Tactics: Utilizing Syscalls in C# - Prerequisite Knowledge https://jhalon.github.io/utilizing-syscalls-in-csharp-1/

​tomcatWarDeployer Apache Tomcat auto WAR deployment & pwning penetration testing tool. This is a penetration testing tool intended to leverage Apache Tomcat credentials in order to automatically generate and deploy JSP Backdoor, as well as invoke it afterwards and provide nice shell (either via web gui, listening port binded on remote machine or as a reverse tcp payload connecting back to the adversary). In practice, it generates JSP backdoor WAR package on-the-fly and deploys it at the Apache Tomcat Manager Application, using valid HTTP Authentication credentials that pentester provided (or custom ones, in the end, we all love tomcat:tomcat ). The tool offers couple of handy features - like manager's panel lookup logic, support for CVE-2007-1860 double encoding issue, CSRF handling in newer Tomcat's. https://github.com/mgeeky/tomcatWarDeployer

PoC-CVE-2022-26809 https://github.com/s1ckb017/PoC-CVE-2022-26809 #cve #poc

DelegationBOF This tool uses LDAP to check a domain for known abusable Kerberos delegation settings. Currently, it supports RBCD, Constrained, Constrained w/Protocol Transition, and Unconstrained Delegation checks. Despite the name, I decided to add in a couple more features since the bulk of the code was already there. So now there is a get-spns command as well which can look for ASREP accounts or Kerberoastable SPNs. https://github.com/IcebreakerSecurity/DelegationBOF

​PoC for MS-DFSNM coerce authentication using NetrDfsRemoveStdRoot method Spooler service disabled, RPC filters installed to prevent PetitPotam and File Server VSS Agent Service not installed but you still want to relay DC authentication to ADCS? Don't worry MS-DFSNM have your back: ▫️ https://github.com/Wh04m1001/DFSCoerce Inspired by: ▫️ https://github.com/topotam/PetitPotam ▫️ https://github.com/ShutdownRepo/ShadowCoerce ▫️ https://github.com/leechristensen/SpoolSample #authentication #coercion #petitpotam #dfsnm

​Subscan A tool to quickly scan subdomains https://github.com/zidansec/subscan

​KDigger Kubernetes focused container assessment tool for penetration testing. Features: ▫️ try to guess your container runtime. ▫️ See your capabilities. ▫️ Scan for namespace activation and configuration. ▫️ Scan for the allowed syscalls. But you can also do more Kubernetes specific operations: ▫️ Retrieve service account token. ▫️ Scan token permissions. ▫️ List interesting environment variables. ▫️ List available devices. ▫️ Retrieve all available services in a cluster. ▫️ Scan the admission controller chain! https://github.com/quarkslab/kdigger

​UhuruOS Hackers' Linux Distribution based on Arch Linux and so on. Features: ▫️ Manjaro Repository for stable update ▫️ Sophisticated appearance (Thanks to Alter Linux) ▫️ pre-installed BlackArch Repository ▫️ Beautiful Theme (MidNight-BlueNight) Pre-Installed packages ▫️ nmap ▫️ Rustscan ▫️ masscan ▫️ sublist3r ▫️ dnsrecon ▫️ ffuf ▫️ seclists ▫️ mitmproxy ▫️ nikto ▫️ metasploit ▫️ sploitctl(searchsploit and etc) ▫️ sqlmap ▫️ wpscan ▫️ droopescan ▫️ magescan ▫️ wireshark-qt ▫️ wireshark-cli ▫️ tcpdump ▫️ hydra ▫️ john ▫️ And so on! https://github.com/infoengine1337/UhuruOS

​CogView2 Еще один аналог DALL·E но более быстрый, для преобразования любого (китайского/английского) текста в изображение. https://github.com/THUDM/CogView2 #images #chinese #english #text