HackGit

​​W3b0s1nt #Python script to gain intelligence on a domain. https://github.com/C3n7ral051nt4g3ncy/webosint

​​Splunk Attack Range Detection development platform, which solves three main challenges in detection engineering: ▫️ The user is able to quickly build a small lab infrastructure as close as possible to a production environment. ▫️ The Attack Range performs attack simulation using different engines such as Atomic Red Team or Caldera in order to generate real attack data. ▫️ It integrates seamlessly into any Continuous Integration / Continuous Delivery (CI/CD) pipeline to automate the detection rule testing process. The deployment of Attack Range consists of: ▫️ Windows Domain Controller ▫️ Windows Server ▫️ Windows Workstation ▫️ A Kali Machine ▫️ Splunk Server ▫️ Splunk SOAR Server ▫️ Nginx Server ▫️ Linux + Sysmon ▫️ Zeek Sensor https://github.com/splunk/attack_range Research: https://www.splunk.com/en_us/blog/security/introducing-splunk-attack-range-v2-0.html

​​GraphCrawler THE GraphQL automated testing tookit Graph Crawler is an automated testing tool for any GraphQL endpoint. It will run through and check if mutation is enabled, check for any sensative queries avaliable, such as users and files, and it will also test any easy queries it find to see if authentication is required. If introspection is not enabled on the endpoint it will check if it is an Apollo Server and then can run Clairvoyance to brute force and grab the suggestions to try to build the schema ourselves. (See the Clairvoyance project for greater details on this). It will then score the findings 1-10 with 10 being the most critical. https://github.com/gsmith257-cyber/GraphCrawler

​​tokenduplicator Tool to start processes as SYSTEM using token duplication https://github.com/magnusstubman/tokenduplicator

hijagger Сheck package registries for hijackable packages. This tool checks every maintainer from every package in the NPM and #Python Pypi registry for unregistered domains or unregistered MX records on those domains. If a domain is unregistered you can grab the domain and initiate a password reset on the account if it has no 2 factor auth enabled. This enables you to hijack a package and do whatever you want with it. https://github.com/firefart/hijagger

​​Hacker Container The Swiss Army Container for Cloud Native Security. Container with all the list of useful tools/commands while hacking and securing Containers, #Kubernetes Clusters, and Cloud Native workloads. https://github.com/madhuakula/hacker-container Read more about it in the blogpost: https://blog.madhuakula.com/hacker-container-for-kubernetes-security-assessments-7d1522e96073

Graverobber PoC #Ransomware payload. Any malicious use of this code is strictly prohibited. For security, this malware does not use strong encryption since the Crypt32 algorithm can now be decoded. https://github.com/rf-peixoto/Graverobber

HiveV5 keystream decryptor PoC https://github.com/reecdeep/HiveV5_keystream_decryptor

​​CVE-2021-23017-PoC https://github.com/M507/CVE-2021-23017-PoC #cve #poc

​​S-500 G2-Pro-HVNC-Rat-Source-leaked S-500 G2 Is a Quality Remote Administration Tool + Hvnc, it offers support for 20 Hidden browsers.S-500 G2 hVNC can run a hidden desktop and can execute many browsers by copying the profile of the existing user and all this is completely hidden from the user's eyes! The same goes fot apps like outlook,foxmail, and thunderbird! S-500 G2 also offers one of the best password recoveries for all browsers! All this makes S-500 G2 one of the best tools for IT / Red Team operations slient, sneaky,powerful!S500 Rat Working All Hidden Apllications Edge Chrome Brave Firefox Hvnc https://github.com/Wotle/S-500-G2-Rat-Hvnc-Hidden-Broswers-Hidden-Apps-OperaGX-Rat-Remote-Malware

BitRAT CrackedIt is coded in C++ programming language. It is the latest version #RAT https://github.com/Wotle/Bitrat-Hvnc-Rat-Remote-Control-Av-Bypass

​​Pantheon-HVNC-V2-Source-leaked Pegasus Is a Quality Remote Administration Tool + Hvnc, it offers support for 20 Hidden browsers.Pegasus hVNC can run a hidden desktop and can execute many browsers by copying the profile of the existing user and all this is completely hidden from the user's eyes! The same goes fot apps like outlook,foxmail, and thunderbird! Pegasus also offers one of the best password recoveries for all browsers! All this makes Pegasus one of the best tools for IT / Red Team operations slient, sneaky,powerful! https://github.com/Wotle/Pegasus-Pantheon-HVNC-V2-VNC-Hidden-Browser-Remote-Administration-Rat #rat

SXSS SXSS is A CLI toolkit to detect and keep track of Blind XSS. Blind XSS is a type of Stored XSS where an attacker blindly deploys malicious scripts that will be triggered in other parts of the application. It can, for example be used to steal cookies from admin pages https://github.com/nkatasekonya/SXSS

Nft-Grabber-Stealer-Exploit-Cve-2022-Steal-BlockHain-Hack-Nft https://github.com/ChubbyPanda61/Nft-Grabber-Stealer-Exploit-Cve-2022-Steal-BlockHain-Hack-Nft

​​P2P Remote Desktop Remote Desktop P2P based - Portable, No Configuration or Installation Needed. https://github.com/miroslavpejic85/p2p #remote

​​KnockKnock KnockKnock runs a simple reverse whois lookup which returns a list of domains owned by people or companies. This tool is often used for reconnaissance or #OSINT (Open Source Intelligence) purposes. Please note that the results can also contain domains that are not owned by the particular target, whereas the target represents a whois guard. https://github.com/harleo/knockknock

​​Algo VPN Set up a personal #VPN in the cloud. Algo VPN is a set of Ansible scripts that simplifies the setup of a personal WireGuard and IPsec VPN. It uses the most secure defaults available and works with common #cloudcomputing providers. Features: ▫️ Supports only IKEv2 with strong crypto (AES-GCM, SHA2, and P-256) for #iOS, #macOS, and #Linux ▫️ Supports WireGuard for all of the above, in addition to Android and Windows 10 ▫️ Generates .conf files and QR codes for iOS, macOS, Android, and Windows WireGuard clients ▫️ Generates Apple profiles to auto-configure iOS and macOS devices for IPsec - no client software required ▫️ Includes a helper script to add and remove users ▫️ Blocks ads with a local DNS resolver (optional) ▫️ Sets up limited SSH users for tunneling traffic (optional) ▫️ Based on current versions of Ubuntu and strongSwan ▫️ Installs to DigitalOcean, #Amazon Lightsail, Amazon EC2, Vultr, Microsoft Azure, Google Compute Engine, Scaleway, OpenStack, CloudStack, Hetzner Cloud https://github.com/trailofbits/algo