HackGit

​​MISP Tip of the Week A collection of tips for using MISP. Published via BelgoMISP (todo) and this repository. Available in MD and JSON. https://github.com/cudeso/misp-tip-of-the-week

​​Custom Processing Unit Custom Processing Unit is the first dynamic analysis framework able to hook, patch and trace CPU microcode at the software level. It works by leveraging undocumented instructions in Intel CPUs that allow access to the CRBUS. Using our microcode decompiler we reverse engineered how the CPU uses the CRBUS and by replicating the interactions we have full control of the CPU. https://github.com/pietroborrello/CustomProcessingUnit Ghidra Processor Module to disassemble/decompile the x86 Intel Atom microcode: https://github.com/pietroborrello/ghidra-atom-microcode

​​JA3 Fingerprint Repository JA3 is a method for creating SSL/TLS client fingerprints that should be easy to produce on any platform and can be easily shared for threat intelligence. https://github.com/LeargasSecurity/ja3-fingerprint-repository

​​DomainDouche Abusing SecurityTrails domain suggestion API to find potentially related domains by keyword and brute force. https://github.com/n0kovo/DomainDouche

​​WindowSpy 👀 WindowSpy is a #Cobalt Strike Beacon Object File meant for targetted user surveillance. The goal of this project was to trigger surveillance capabilities only on certain targets, e.g. browser login pages, confidential documents, vpn logins etc. The purpose was to increase stealth during user surveillance by preventing detection of repeated use of surveillance capabilities e.g. screenshots. It also saves the red team time in sifting through many pages of user surveillance data, which would be produced if keylogging/screenwatch was running at all times. https://github.com/CodeXTF2/WindowSpy

​​Prelude Build Prelude Build is an easy-to-use IDE - purpose built for authoring, testing and verifying security tests for use in real environments. Our goal is to provide a consistent and repeatable way to write, verify and deploy tests for any scale. https://github.com/preludeorg/build

​​The real uncrackables It seems that when it comes to mobile, real good challenges are very few out there. The real objective of a challenge is to actually learn something out of it and not keep hiding flags in the assets :). In fact some of the challenges won't have flags but real solutions as they will to be based on real scenarios like: "hey, how you exploit this ?" I'll keep adding cool crackmes in this repo, so.. penterers and CTFers stay tuned.... https://github.com/Ch0pin/uncrackable

​​Gsec Web Security Scanner & Exploitation. Passive Scan: ▫️ Find assets with shodan ▫️ RapidDNS to get subdomains ▫️ Certsh to enumerate subdomains ▫️ DNS enumeration ▫️ Waybackurls to fetch old links ▫️ Normal / Agressive Scan Domain http code: ▫️ Web port scanning ▫️ Server information ▫️ HTTP security header scanner ▫️ CMS security identifier / misconfiguration scanner ▫️ Technology scanner ▫️ Programming Language check ▫️ Path Traversal scan ▫️ Nuclei vulnerability scanning https://github.com/gotr00t0day/Gsec

​​githubreconall my methodology of Github Recon from differnt sources https://github.com/r4gh4vhx/githubreconall

​​stackrox StackRox Kubernetes Security Platform The StackRox Kubernetes Security Platform performs a risk analysis of the container environment, delivers visibility and runtime alerts, and provides recommendations to proactively improve security by hardening the environment. StackRox integrates with every stage of container lifecycle: build, deploy and runtime. The StackRox Kubernetes Security platform is built on the foundation of the product formerly known as Prevent, which itself was called Mitigate and Apollo. You may find references to these previous names in code or documentation. https://github.com/stackrox/stackrox

​​TerraformGoat TerraformGoat is HXSecurity research lab's "Vulnerable by Design" multi cloud deployment tool. Currently supported cloud vendors include Alibaba Cloud, Tencent Cloud, Huawei Cloud, Amazon Web Services, Google Cloud Platform, Microsoft Azure. https://github.com/HXSecurity/TerraformGoat

​​Python Pickle Malware Scanner Security scanner detecting Python Pickle files performing suspicious actions. https://github.com/mmaitre314/picklescan

​​Ticwatch Pro 3 Ultra Smart watch with official Kali NetHunter support. What is Kali NetHunter? Kali NetHunter is an Android ROM overlay that turns an ordinary phone into the ultimate Mobile Penetration Testing Platform. Now it's available for your smartwatch with some limitations. The overlay includes a custom kernel, a Kali Linux chroot, an accompanying Android application, which allows for easier interaction with various security tools and attacks. Beyond the penetration testing tools arsenal within Kali Linux, NetHunter also supports several additional classes, such as HID Keyboard Attacks, BadUSB attacks, WPS attacks, and much more. NetHunter is an open-source project developed by Offensive Security and the community. Installing NetHunter On the TicWatch Pro: https://www.kali.org/docs/nethunter/installing-nethunter-on-the-ticwatch-pro/ Buy online: 🛒 https://amzn.to/3VmFeeB 🛒 https://ali.ski/Zu0T3 #watch #kali #ticwatch

​​YaraTools This repo houses a large set of open-source YARA signatures that have been evaluated on a set of 284,181 legitimate and malicious portable executable files. The Get-YaraMatches PowerShell script can be used to scan new files and enrich the results with additional information such as information gain and the source text for the matching signature. This gives users more information to determine if a file is legitimate or malicious. https://github.com/pracsec/YaraTools View the documentation here: https://practicalsecurityanalytics.com/home/tools/yaratools/

​​HiveV5 file decryptor PoC The work done in the last few months has been necessary to reveal the malicious file encryption mechanism of Hive v5-5.2. The work was divided into two parts ▫️ Keystream decryption ▫️ File decryption using the decrypted keystream https://github.com/reecdeep/HiveV5_file_decryptor

​​SnapFuzz A scalable fuzzing infrastructure that finds security and stability issues in software. Google uses ClusterFuzz to fuzz all Google products and as the fuzzing backend for OSS-Fuzz. https://github.com/google/clusterfuzz An Efficient Fuzzing Framework for Network Applications: https://google.github.io/clusterfuzz/#trophies