HackGit

​​Slash Automated doxer tool Slash supports social media search (over 180 websites) , forum search , pastebin leak search , github commit search. New will be added soon... Also slash scrapes multiple informations from important websites as : Name , Bio , Location , Website , User Info... And it extracting Phone Number - Email Adress from Bios... Slash include threading modules. It make slash faster than others. It means, it search social media,github commit,forums,pastebin in same time. https://github.com/redc86/slash

​​D4TA-HUNTER #Osint Framework for #KALI A tool created in order to automate the collection of information about the employees of a company that is going to be audited for ethical hacking. In addition, in this tool we can find in the "search company" section by inserting the domain of a company, emails of employees, subdomains and IP's of servers. https://github.com/micro-joan/D4TA-HUNTER

​​The PenTesters Framework (PTF) A Python script designed for Debian/Ubuntu/ArchLinux based distributions to create a similar and familiar distribution for Penetration Testing. As #pentesters, we've been accustom to the /pentest/ directories or our own toolsets that we want to keep up-to-date all of the time. We have those "go to" tools that we use on a regular basis, and using the latest and greatest is important. PTF attempts to install all of your penetration testing tools (latest and greatest), compile them, build them, and make it so that you can install/update your distribution on any machine. Everything is organized in a fashion that is cohesive to the Penetration Testing Execution Standard (PTES) and eliminates a lot of things that are hardly used. PTF simplifies installation and packaging and creates an entire pentest framework for you. Since this is a framework, you can configure and add as you see fit. We commonly see internally developed repos that you can use as well as part of this framework. It's all up to you. https://github.com/trustedsec/ptf For a video tutorial on how to use PTF, check out our Vimeo page here: https://vimeo.com/137133837

​​NTFSCopy This project is based on NtfsLib. I have made the NTFSCopy tool usable with execute-assembly in Cobalt Strike. This was done using ILMerge to make a single executable without any dependencies, and removing the fancy colored progress bar which Cobalt Strike couldn't handle (seems like Console.Seek() was throwing an exception). https://github.com/RedCursorSecurityConsulting/NTFSCopy

​​MFASweep MFASweep is a PowerShell script that attempts to log in to various Microsoft services using a provided set of credentials and will attempt to identify if MFA is enabled. Depending on how conditional access policies and other multi-factor authentication settings are configured some protocols may end up being left single factor. It also has an additional check for ADFS configurations and can attempt to log in to the on-prem ADFS server if detected. Currently MFASweep has the ability to login to the following services: ▫️ Microsoft Graph API ▫️ Azure Service Management API ▫️ Microsoft 365 Exchange Web Services ▫️ Microsoft 365 Web Portal w/ 6 device types (Windows, Linux, MacOS, Android Phone, iPhone, Windows Phone) ▫️ Microsoft 365 Active Sync ▫️ ADFS https://github.com/dafthack/MFASweep

CVE-2022-21661 POC Video | WordPress Core 5.8.2 - 'WP_Query' SQL Injection. https://github.com/APTIRAN/CVE-2022-21661 #cve #poc

​​Hacktoria-CTF-WriteUps THE KILLER CLOWN: https://github.com/s1l1c0np1r4t3/Hacktoria-CTF-WriteUps/blob/main/Easy/TheKillerClown.md PRISONER OF WAR: https://github.com/s1l1c0np1r4t3/Hacktoria-CTF-WriteUps/blob/main/Easy/PrisonerOfWar.md LOST AT SEA: https://github.com/s1l1c0np1r4t3/Hacktoria-CTF-WriteUps/blob/main/Easy/LostAtSea.md Wow, that's cool.) author: @s1l1c0np1r4t3x #OSINT #RedTeam

​​Gotanda Gotanda is #OSINT(Open Source Intelligence) Web Extension for Firefox/Chrome. This Web Extension could search OSINT information from some IOC in web page.(IP,Domain,URL,SNS...etc) https://github.com/HASH1da1/Gotanda

​​VMUnprotect.Dumper A project engaged in hunting tampered VMProtect assemblies. https://github.com/void-stack/VMUnprotect.Dumper

​​Phill's Hypothetical Browser PHB is a testbed for security focused browser features built around WebView2 which is in turn a wrapper around Microsoft Edge which is a fork of Google Chrome. https://github.com/hallambaker/PhillsHypotheticalBrowser

​​Linux Kernel UAF in Bluetooth L2CAP Handshake https://github.com/google/security-research/security/advisories/GHSA-pf87-6c9q-jvm4 Infoleak in Bluetooth L2CAP Handling https://github.com/google/security-research/security/advisories/GHSA-vccx-8h74-2357 #exploit

​​Namaste! This repository contains some of the most exhaustive wordlists for enumeration, gathered from a lot of wordlists available on the Internet. https://github.com/HacktivistRO/Bug-Bounty-Wordlists

​​pycrypt Python Based Crypter That Can Bypass Any Kinds Of Antivirus Products https://github.com/machine1337/pycrypt

​​ForgeCert ForgeCert uses the BouncyCastle C# API and a stolen Certificate Authority (CA) certificate + private key to forge certificates for arbitrary users capable of authentication to Active Directory. This attack is codified as DPERSIST1 in our "Certified Pre-Owned" whitepaper. This code base was released ~45 days after the whitepaper was published. https://github.com/GhostPack/ForgeCert #ad

Get-InjectedThreadEx – Detecting Thread Creation Trampolines. https://www.elastic.co/security-labs/get-injectedthreadex-detection-thread-creation-trampolines PowerShell detection script: https://github.com/jdu2600/Get-InjectedThreadEx

​​YApi-Exploit YApi boolean-based injection exploit. https://github.com/Anthem-whisper/YApi-Exploit #cve #exploit

​​subzuf subzuf is a subdomain brute-force fuzzer coupled with an immensly simple but effective DNS reponse-guided algorithm. It utilizes a provided set of input data, like a tailored wordlist or historical DNS/TLS records, to accurately synthesize more corresponding domain names and expand them even further in a loop based on information gathered during DNS scan. This somewhat different approach to subdomain enumeration in most cases allows to discover more subdomains with significantly reduced time and resources. In short, subzuf can be summarized by the following: ▫️ Generates carefully selected candidates and uncover completely new subdomains during DNS enumeration scans ▫️ Efficient multi-threaded DNS client capable of resolving thousands of domains per second ▫️ Wildcard detection in two modes: filter (default, slightly slower but accurate) and reject (resource-saving) ▫️ Accepts wordlist or domain names or a mix of both as input ▫️ Requires essentially no configuration or fine-tuning ▫️ Works right of out the box - no external dependencies or bizzare requirements ▫️ Easily chainable with other tools https://github.com/elceef/subzuf

​​safety Safety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected. Safety can be run on developer machines, in CI/CD pipelines and on production systems. By default it uses the open Python vulnerability database Safety DB, which is licensed for non-commercial use only. https://github.com/pyupio/safety

​​katoolin Automatically install all Kali linux tools. Features: ▫️ Add Kali linux repositories ▫️ Remove kali linux repositories ▫️ Install Kali linux tools https://github.com/LionSec/katoolin

​​BugBountyTips #BugBounty (Bypasses, Payloads, y más) https://github.com/xNaughty/BugBountyTips