HackGit

URootkit The user-mode rootkit replaces executables and system libraries and modifies the behavior of application programming interfaces, It alters the security subsystem and displays false information . It can intercept system calls and filter output in order to hide processes, files, system drivers, network ports, registry keys and paths, and system services. the purpose of this project is to hide a process by intercepting listing tools system calls and manipulate in its structure . https://github.com/ZeroMemoryEx/URootkit t.me/hackgit

​​gohide Tunnel port to port traffic via an obfuscated channel with AES-GCM encryption. Obfuscation Modes ▫️ Session Cookie HTTP GET (http-client) ▫️ Set-Cookie Session Cookie HTTP/2 200 OK (http-server) ▫️ WebSocket Handshake "Sec-WebSocket-Key" (websocket-client) ▫️ WebSocket Handshake "Sec-WebSocket-Accept" (websocket-server) ▫️ No obfuscation, just use AES-GCM encrypted messages (none) AES-GCM is enabled by default for each of the options above. https://github.com/Potato-Industries/gohide t.me/hackgit

​​CVE-2022-22629 Proof of concept This post is about the poc for the WebGL bug that was patched in Safari 15.4 security updates. https://github.com/parsdefense/CVE-2022-22629 #cve

​​RUST_SYSCALLS Single stub direct and indirect syscalling with runtime SSN resolving for windows. Features: ▫️ One single line for all your syscalls ▫️ Function name hashing at compilation time ▫️ Direct or indirect sycalls ▫️ x86_64, WOW64 and x86 native support ▫️ Designed to allow the implementation of custom SSN fetching methods (check the end of this readme for more info) https://github.com/janoglezcampos/rust_syscalls

​​CVE-2022-31188 OpenCV CVAT (Computer Vision Annotation Tool) SSRF. CVAT is an open source Computer Vision Annotation Tool developed by Intel. Any user with "Task Create" authorization can trigger the SSRF vulnerability by sending a malicious HTTP request and gaining access to other open ports on the system. https://github.com/emirpolatt/CVE-2022-31188 #cve

​​ontgo403 A tool to bypass 40X errors. https://github.com/devploit/dontgo403

​​IPGeo A python tool to extract IP addresses from captured network traffic file (pcap/pcapng) and generate csv report containing details about the geolocation of each IP in the packets. The report contains: ▫️ Country: ▫️ Country Code. ▫️ Region ▫️ Region Name ▫️ City ▫️ Zip ▫️ Latitude ▫️ Longitude ▫️ Timezone ▫️ Isp ▫️ Org ▫️ Ip https://github.com/z-alami/IpGeo t.me/hackgit

​​Darc Darkweb Crawler Project. darc is designed as a swiss army knife for darkweb crawling. It integrates requests to collect HTTP request and response information, such as cookies, header fields, etc. It also bundles selenium to provide a fully rendered web page and screenshot of such view. https://github.com/JarryShaw/darc t.me/hackgit

​​Cloudlist A multi-cloud tool for getting Assets from Cloud Providers. This is intended to be used by the blue team to augment Attack Surface Management efforts by maintaining a centralized list of assets across multiple clouds with very little configuration efforts. Features: ▫️ List Cloud assets with multiple configurations ▫️ Multiple Cloud providers support ▫️ Multiple output format support ▫️ Multiple filters support ▫️ Highly extensible making adding new providers a breeze ▫️ stdout support to work with other tools in pipelines https://github.com/projectdiscovery/cloudlist t.me/hackgit

​​Minimalistic TCP and UDP port scanners A simple yet powerful TCP and UDP port scanners: ▫️ Detection of open, closed and filtered ports (both TCP and UDP) ▫️ Ability to scan a single host, network range or a list of hosts in a file ▫️ Adjustable timeout values for effective and reliable port scanning Despite the minimalistic design, both port scanners keep track of everything by using a simple state file (scanresults.txt) which is created in the current working directory. This allows the scanners to be easily resumed if they were interrupted or to skip already scanned hosts / ports. https://github.com/InfosecMatter/Minimalistic-offensive-security-tools Details: https://www.infosecmatter.com/port-scanner-in-powershell-tcp-udp-ps1/

​​Modules Open sourced the "assembly execute" and "powerpick" module/command. Have fun. https://github.com/HavocFramework/Modules

​​targetedKerberoast Kerberoast with ACL abuse capabilities. A Python script that can, like many others (e.g. GetUserSPNs.py), print "kerberoast" hashes for user accounts that have a SPN set. This tool brings the following additional feature: for each user without SPNs, it tries to set one (abuse of a write permission on the servicePrincipalName attribute), print the "kerberoast" hash, and delete the temporary SPN set for that operation. This is called targeted Kerberoasting. This tool can be used against all users of a domain, or supplied in a list, or one user supplied in the CLI. More information about this attack: The Hacker Recipes - Kerberoast The Hacker Recipes - Targeted Kerberoasting https://github.com/ShutdownRepo/targetedKerberoast t.me/hackgit

​​cURL for OSINT cURL Tool usage (with Grep) for OSINT (Open-Source Intelligence) https://github.com/C3n7ral051nt4g3ncy/cURL_for_OSINT t.me/hackgit

​​Raspberry Pi Case with Touchscreen 7 to 10 inches All-In-One Monitor for Raspberry Pi. This touchscreen monitor is specially designed for pi 3/ 3b/ 3b+/ 4/ 4b. You can directly mount the pi board in this touchscreen case. It’s beautifully designed, incredibly intuitive, and packed with comprehensive tools that let you take any idea to the next level. This wonderful monitor has 10-Point touch sensitive, touch rotation without displacing, a built-in case, cooling fan and stand, and an even more stunning resolution of 1024*600 display. 2 connection of touchscreen cable: One is to use the USB cable to connect, the other is to solder the cable on the rasp rasberry pi to connect. Just choose the way you want. Sensitive 10-point touch: This new model of raspberry pi touchscreen has sensitive 10-point touch, which makes you use the touch function like pad’s, easily and effectively. In addition to that, it also owns accurate touch rotation that other rpi monitors don’t have. Cooling fan: This raspberry pi touchscreen monitor all in one machine is built in 2 fans to get a great control of temperature and make your raspberry pi be cool so that you can use it more smooth. Dual speakers: With 2 speakers on the top of the raspberry pi touchscreen case, you can enjoy the good sound with just one machine and don't need to connect to an external one. Adjustable stand: The stand is adjustable from 15° to 50°, which can meet your needs of different angels, make you work or study more comfortable. Hear What Experts Say: https://youtu.be/h0jn21hEXcI Buy online: 🛒 https://ali.ski/4Ww5sc #raspberrypi #case #monitor

​​CVE-2022-20126 https://github.com/Trinadh465/packages_apps_Bluetooth_AOSP10_r33_CVE-2022-20126 #cve

​​Headless Strike Aggressorscript that turns the headless aggressor client into a (mostly) functional cobalt strike client. https://github.com/CodeXTF2/cobaltstrike-headless t.me/hackgit

​​Mitra A tool to generate binary polyglots (files that are valid with several file formats). https://github.com/corkami/mitra

​​OpenWRTInvasion Root shell exploit for several Xiaomi routers: 4A Gigabit, 4A 100M, 4C, 3Gv2, 4Q, miWifi 3C... https://github.com/acecilia/OpenWRTInvasion #exploit

​​EasyPen A GUI program which helps pentesters do information gathering, vulnerability scan and exploitation. It has more than 100 built-in scan scripts written in Python which covers most common vulnerabilities while at the same time it provides you some extra exploitation tools. You can easily write your own python script and apply the scan for thousands of targets. https://github.com/lijiejie/EasyPen t.me/hackgit

​​xsser Cross Site "Scripter" (aka XSSer) is an automatic -framework- to detect, exploit and report XSS vulnerabilities in web-based applications. It provides several options to try to bypass certain filters and various special techniques for code injection. XSSer has pre-installed [ > 1300 XSS ] attacking vectors and can bypass-exploit code on several browsers/WAFs: ▫️ PHP-IDS ▫️ Imperva Incapsula WAF ▫️ WebKnight WAF ▫️ F5 Big IP WAF ▫️ Barracuda WAF ▫️ Mod-Security ▫️ QuickDefense ▫️ SucuriWAF ▫️ Google Chrome ▫️ Internet Explorer ▫️ Mozilla's Gecko rendering engine, used by Firefox/Iceweasel ▫️ Netscape in IE rendering engine mode ▫️ Netscape in the Gecko rendering engine mode ▫️ Opera Browser https://github.com/epsylon/xsser Website: https://xsser.03c8.net/