HackGit

​​ADB-Toolkit ADB-Toolkit is a BASH Script with 28 options and an #METASPLOIT Section which has 6 options which is made to do easy penetration testing in #Android Device. You can do preety much any thing with this script and test your android device is it safe or not. https://github.com/ASHWIN990/ADB-Toolkit #pentesting #redteam

​​llm-security New ways of breaking app-integrated LLMs. https://github.com/greshake/llm-security Details: https://greshake.github.io/ #pentesting #redteam

​​Fav-up Lookups for real IP starting from the favicon icon and using #Shodan. https://github.com/pielco11/fav-up #bugbounty

​​MSR605X USB Card Reader \ Writer. The MSR605X USB Reader is a magnetic stripe card encoder and reader that supports 1, 2, and 3 tracks, including credit cards, gift cards, and driver's licenses. It can read, write, and erase data and all three tracks can be set to 75 or 210 BPI. The MSR605X is compatible with Hico and Loco with 300 to 4000 OE, and has a USB interface. It is portable with dimensions of 212(L) x 64(W) x 63(H) mm and works with Windows and Mac OS. The device has a built-in power system and does not require an extra power adapter. Buy online: 🛒 https://amzn.to/3KRmn8U 🛒 https://alii.pub/6mojc9 #usb #card #reader

​​CVE-2022-45988 StarSoftComm HP CooCare An elevation of privilege vulnerability exists. https://github.com/happy0717/CVE-2022-45988 #cve

​​user js Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening. https://github.com/arkenfox/user.js #cybersecurity #privacy

​​Timeroast and Trustroast scripts Python scripts accompanying the whitepaper Timeroasting, trustroasting and computer spraying: taking advantage of weak computer and trust account passwords in Active Directory. These support the timeroasting and trustroasting attack techniques by discovering weak computer or trust passwords within an Active Directory domain. https://github.com/SecuraBV/Timeroast

​​Enlightn A Laravel Tool To Boost Your App's Performance & Security Think of Enlightn as your performance and security consultant. Enlightn will "review" your code and server configurations, and give you actionable recommendations on improving performance, security and reliability! The Enlightn OSS (open source software) version has 64 automated checks that scan your application code, web server configurations and routes to identify performance bottlenecks, possible security vulnerabilities and code reliability issues. https://github.com/enlightn/enlightn

​​Mubeng An incredibly fast #proxy #checker & IP rotator with ease. Features: ▫️ Proxy IP rotator: Rotates your IP address for every specific request. ▫️ Proxy checker: Check your proxy IP which is still alive. ▫️ All HTTP/S methods are supported. ▫️ HTTP, SOCKS v4(A) & v5 proxy protocols apply. ▫️ All parameters & URIs are passed. ▫️ Easy to use: You can just run it against your proxy file, and choose the action you want! ▫️ Cross-platform: whether you are Windows, Linux, Mac, or even Raspberry Pi, you can run it very well. https://github.com/kitabisa/mubeng

​​Awesome Bug Bounty Tools Awesome A curated list of various #bugbounty tools. https://github.com/vavkamil/awesome-bugbounty-tools

​​Decider A tool to help analysts map adversary behavior to the MITRE ATT&CK framework. Decider makes creating ATT&CK mappings easier to get right by walking users through the mapping process. It does so by asking a series of guided questions about adversary activity to help them arrive at the correct tactic, technique, or subtechnique. Decider has a powerful search and filter functionality that enables users to focus on the parts of ATT&CK that are relevant to their analysis. Decider also has a cart functionality that lets users export results to commonly used formats, such as tables and ATT&CK Navigator™ heatmaps. https://github.com/cisagov/decider #cybersecurity

​​Malware Indicators of Compromise Here are indicators of compromise (IOCs) of our various investigations. We are doing this to help the broader security community fight malware wherever it might be. ▫️ .yar files are Yara rules ▫️ .rules files are Snort rules ▫️ samples.md5, samples.sha1 and samples.sha256 files are newline separated list of hexadecimal digests of malware samples https://github.com/eset/malware-ioc

​​Shinigami Shinigami is an experimental tool to detect and dump malware implants that are injected via process hollowing. It works by hooking common functions like CreateProcessInternal, WriteProcessMemory, and ResumeThread. It creates the target executable in a suspended state and injects a DLL library called "Ichigo," which will hook every needed function to detect and dump the implant. The library automatically kills the process once the hollow is extracted. https://github.com/buzzer-re/Shinigami

​​DroppedConnection Emulates a Cisco ASA Anyconnect VPN service, accepting any credentials (and logging them) before serving VBS to the client that gets executed in the context of the user. https://github.com/nccgroup/DroppedConnection #redteam

​​Arkime Arkime augments your current security infrastructure to store and index network traffic in standard PCAP format, providing fast, indexed access. An intuitive and simple web interface is provided for PCAP browsing, searching, and exporting. Arkime exposes APIs which allow for PCAP data and JSON formatted session data to be downloaded and consumed directly. Arkime stores and exports all packets in standard PCAP format, allowing you to also use your favorite PCAP ingesting tools, such as wireshark, during your analysis workflow. Arkime is built to be deployed across many systems and can scale to handle tens of gigabits/sec of traffic. PCAP retention is based on available sensor disk space. Metadata retention is based on the Elasticsearch cluster scale. Both can be increased at anytime and are under your complete control. https://github.com/arkime/arkime #cybersecurity

​​JumboSPOT MMDVM Hotspot The JumboSPOT Multi Mode IP Gateway is a self-contained digital hotspot that allows for DMR, D-Star, P25, and System Fusion communications. It comes fully assembled and tested in a ruggedized aluminum enclosure and only requires a mini USB power source and a WiFi-based internet connection for operation. The device supports PI-STAR's web-based digital voice dashboard and configuration tool and has a built-in OLED system status display indicating Mode, Talk Group, and Call Sign. Additionally, the device has built-in LED indicators for the status of Power, PTT, COS, and Mode, as well as a console port SSH 22 for root level access to the operating system. The JumboSPOT is pocket-sized and comes with a quad-core A7 1.2GHz processor, 512MB DDR3 RAM, and 8GB TF card. It also has a built-in WiFi 802.11b/g/n wireless LAN, and a JumboSPOT UHF (430-440) + VHF (144-146) RF extend board installed. Buy online: 🛒 https://alii.pub/6mmvxd 🛒 https://amzn.to/3KRk0TK Kit without Raspberry Pi Zero: 🛒 https://amzn.to/3IJASJ8 🛒 https://alii.pub/6mmwbd #radio #wifi #raspberry

​​Content Queries (CONQUER) Attack Artifacts of our NDSS'23 paper titled "Do Not Give a Dog Bread Every Time He Wags His Tail: Stealing Passwords through Content Queries (CONQUER) Attack" https://github.com/VoodooChild99/Conquer Details: https://www.ndss-symposium.org/wp-content/uploads/2023/02/ndss2023_f5_paper.pdf #pentesting #redteam

​​CVE 2022-22978 Authorization Bypass in RegexRequestMatcher. https://github.com/umakant76705/CVE-2022-22978 #cve

​​Schneider plc #exploit Modicon M580/M340 Safety Protection bypass and utils. https://github.com/0xedh/schneider_plc_exploit

​​Aladdin Payload generation tool, which using the specific bypass as well as the necessary header bytes of the .NET remoting protocol is able to generate initial access payloads that abuse the AddInProcess as originally documented. https://github.com/nettitude/Aladdin #redteam