HackGit

​​DC3-MWCP DC3 Malware Configuration Parser (DC3-MWCP) is a framework for parsing configuration information from malware. The information extracted from malware includes items such as addresses, passwords, filenames, and mutex names. A parser module is usually created per malware family. DC3-MWCP is designed to help ensure consistency in parser function and output, ease parser development, and facilitate parser sharing. DC3-MWCP supports both analyst directed analysis and large-scale automated execution, utilizing either the native python API, a REST API, or a provided command line tool. DC3-MWCP is authored by the Defense Cyber Crime Center (DC3). https://github.com/dod-cyber-crime-center/DC3-MWCP

​​Cairo-Fuzzer Cairo Smart Contract Fuzzer A tool designed for smart contract developers to test the security. It can be used as an independent tool or as a library. ▫️ Run cairo contract ▫️ Run cairo contract with hints implemented in cairo-rs ▫️ Replayer of fuzzing corpus ▫️ Minimizer of fuzzing corpus ▫️ Load old corpus ▫️ Handle multiple arguments ▫️ Load a folder of inputs/crashes files ▫️ CLI ▫️ Run Cairo-fuzzer using a config file instead of CLI ▫️ Workspace architecture https://github.com/FuzzingLabs/cairo-fuzzer

​​SUBJ A simple subdomain finder https://github.com/j0k-3r/SUBJ

​​Marionett Marionett is an example of an automated lambda function that runs and swaps out user data on EC2 event machine events. It is an example of how an attacker could semi-covertly backdoor EC2 instances passively on instance change events or actively on creation. The API calls will stand out, but from the user's perspective, when in passive mode, there will be no obvious changes to the instance. In active mode the instance is simply taking longer to start up, active mode requires less actions on the behalf of the victim, but may cause issues with certain provisioning tools. This is a well known attack, only change to what I've seen elsewhere is adding Event Bridge and Lambda. https://github.com/RyanJarv/marionette

​​gitSome #OSINT tool to extract email addresses and other useful info from various GitHub sources. ▫️ Provide a user account to extract emails from associated repos ▫️ Provide an org account to extract emails from associated repos ▫️ Provide a domain to extract related emails from public commits, issues, and other sources https://github.com/chm0dx/gitSome

​​SquarePhish SquarePhish is an advanced phishing tool that uses a technique combining the OAuth Device code authentication flow and QR codes. https://github.com/secureworks/squarephish

​​Copilot, for your terminal A CLI tool that generates shell scripts from a human readable description. https://github.com/m1guelpf/plz-cli

​​ctf-party A CLI tool & library to enhance and speed up script/exploit writing for CTF players (or security researchers, bug bounty hunters, pentesters but mostly focused on CTF) by patching the String class to add a short syntax of usual code patterns. The philosophy is also to keep the library to be pure ruby (no dependencies) and not to re-implement what another library is already doing well (eg. xorcist for xor). https://github.com/noraj/ctf-party

​​Golden Nuggets Burp Suite Extension to easily create Wordlists based off URI, URI Parameters and Single Words (Minus the Domain) https://github.com/GainSec/GoldenNuggets-1

​​CVE-2022-2602 PoC Kernel Privilege Escalation Linux https://github.com/kiks7/CVE-2022-2602-Kernel-Exploit #cve

​​MSI Shenanigans This repository contains Proof of Concept code and harmless weaponised packages representing various weaponisation strategies that Threat Actors abuse in Windows Installer MSI format. https://github.com/mgeeky/msi-shenanigans MSI Shenanigans. Part 1 – Offensive Capabilities Overview: https://mgeeky.tech/msi-shenanigans-part-1/

​​CVE-2022-48870 maccms admin+ xss attacks https://github.com/Cedric1314/CVE-2022-48870 #cve

​​plution Prototype pollution scanner using headless chrome https://github.com/raverrr/plution

​​CVE-2022-39253 Docker host file read https://github.com/ssst0n3/docker-cve-2022-39253-poc #cve #poc

​​Shellcode Mutator New tool to help red teamers avoid detection. Shellcode is a small piece of code that is typically used as the payload in an exploit, and can often be detected by its “signature”, or unique pattern. Shellcode Mutator mutates exploit source code without affecting its functionality, changing its signature and making it harder to reliably detect as malicious. https://github.com/nettitude/ShellcodeMutator Details: https://labs.nettitude.com/blog/shellcode-source-mutations/ #shellcode #redteam

​​Blinside Blindside is a technique for evading the monitoring of endpoint detection and response (EDR) and extended detection and response (XDR) platforms using hardware breakpoints to inject commands and perform unexpected, unwanted, or malicious operations. It involves creating a breakpoint handler, and setting a hardware breakpoint that will force the debugged process to load only ntdll to memory. This will result in a clean and unhooked ntdll which then could be copied to our process and unhook the original ntdll. https://github.com/CymulateResearch/Blindside

​​hackGPT OpenAI and #ChatGPT to do hackerish things by NoDataFound https://github.com/NoDataFound/hackGPT

​​Hacking & Cybersecurity class materials We are delighted to announce a first on Lawfare: A live online class on hacking and cybersecurity. https://github.com/lawfareblog/hacking-cybersecurity

​​chatgpt_chinese_prompt_hack Use prompt hack to bypass OpenAI's content policy restrictions by golfzert https://github.com/golfzert/chatgpt-chinese-prompt-hack