HackGit

​​CVE-2022-40684 Metasploit Scanner An authentication bypass using an alternate path or channel in Fortinet product https://github.com/TaroballzChen/CVE-2022-40684-metasploit-scanner #cve

​​Rollter IPsec VPN server with i2p onion and yggdrasil routing WEB serfing with no limits. Open any sites: onion, i2p and yggdrasil too! https://github.com/thedmdim/rollter

​​IORI_Loader - Bypass EDRs FUD advanced Loader implementing dynamic indirect syscall with syscall number and syscall instruction Unhooking with Halosgate technic. Shellcode in UUIDs format to avoid static analysis, syscall instructions and syscall number don't exist in the binary opcode which makes it avoid static analysis and they get resolved at run time. also it gets the API addresses from the PEB by offsets and the comparison is done by hashing. https://github.com/D1rkMtr/IORI_Loader

​​Spartacus DLL Hijacking Did you really make yet another DLL Hijacking discovery tool? ...but with a twist as Spartacus is utilising the SysInternals Process Monitor and is parsing raw PML log files. You can leave ProcMon running for hours and discover 2nd and 3rd level (ie an app that loads another DLL that loads yet another DLL when you use a specific feature of the parent app) DLL Hijacking vulnerabilities. It will also automatically generate proxy DLLs with all relevant exports for vulnerable DLLs. Parsing ProcMon PML files natively. The config (PMC) and log (PML) parsers have been implemented by porting partial functionality to C# from https://github.com/eronnen/procmon-parser/. You can find the format specification here. Spartacus will create proxy DLLs for all missing DLLs that were identified. For instance, if an application is vulnerable to DLL Hijacking via version.dll, Spartacus will create a version.dll.cpp file for you with all the exports included in it. Then you can insert your payload/execution technique and compile. Able to process large PML files and store all DLLs of interest in an output CSV file. Local benchmark processed a 3GB file with 8 million events in 45 seconds. [Defence] Monitoring mode trying to identify running applications proxying calls, as in "DLL Hijacking in progress". This is just to get any low hanging fruit and should not be relied upon. https://github.com/Accenture/Spartacus

​​Viper Viper is a graphical intranet penetration tool, which modularizes and weaponizes the tactics and technologies commonly used in the process of Intranet penetration. Viper integrates basic functions such as bypass anti-virus software, intranet tunnel, file management, command line and so on. Viper has integrated 80+ modules, covering Resource Development / Initial Access / Execution / Persistence / Privilege Escalation / Defense Evasion / Credential Access / Discovery / Lateral Movement / Collection and other categories Viper's goal is to help red team engineers improve attack efficiency, simplify operation and reduce technical threshold Viper supports running native msfconsole in browser and multi - person collaboration https://github.com/FunnyWolf/Viper

​​Bash Bunny If you can physically access a device, the Bash Bunny will get you electronic access. In short - it's the world's most powerful USB Attack Platform. In detail, it is a cross-platform, multi-payload, multi-tool capable of simultaneously emulating and abusing devices trusted by devices - input devices, storage devices, network devices. Disguised as a normal USB-drive, infinitely configurable, and backed by payload repository, the Bash Bunny is a one-stop physical hacking tool. Regardless of operating system (MacOS, Linux, Windows, Android) - all modern devices implement the notion of trusted devices - that is devices that a system will automatically trust and accept without the need for confirmation or drivers. There are several categories of Trusted Devices, including: ▫️ HID ("Human Input Devices") - Keyboards, Mice, etc ▫️ Storage Devices - Flash drives, etc ▫️ Network Devices - Ethernet Adaptors, etc The Bash Bunny can emulate all these devices, simultaneously - and then abuse this trust via scriptable Payloads. Easily write or customise your own payload, or use one of the hundreds available in the Bash Bunny repository: https://github.com/hak5/bashbunny-payloads Buy online: 🛒 https://amzn.to/3CWio5i (amazon) 🛒 https://ali.ski/2ZkHbK (aliexpress) #usb #hak5

​​geacon_pro This project refactors Cobalt Strike's beacon based on the geacon project, and adapts most of the beacon's functions. The anti-kill of traditional cs is biased towards how to load and go online, but anti-software is very strict in checking the characteristics of beacon, especially the memory check of Kabbah, so it is better to rebuild one by yourself. The currently implemented functions are kill-free, and can bypass Defender, 360 core crystal (except powershell), Kaspersky (except memory operations, such as dll injected into native cs), velvet. https://github.com/H4de5-7/geacon_pro #cobalt

​​KernelPatchfinder An iOS Kernel Patchfinder, supporting iOS 15. Used by Fugu15. https://github.com/pinauten/KernelPatchfinder

​​pylera1n Python adaptation for palera1n. This project is very much a WIP. Currently allows to boot into ramdisk and connect to SSH on all checkm8-supported devices. https://github.com/doronz88/pylera1n

​​InvisibilityCloak Proof-of-concept obfuscation toolkit for C# post-exploitation tools. This will perform the below actions for a C# visual studio project. ▫️ Change the tool name ▫️ Change the project GUID ▫️ Obfuscate compatible strings in source code files based on obfuscation method entered by user ▫️ Removes one-line comments (e.g. // this is a comment) ▫️ Remove PDB string option for compiled release .NET assembly https://github.com/h4wkst3r/InvisibilityCloak

​​Cloud Pentest Cheatsheets This repository contains a collection of cheatsheets I have put together for tools related to pentesting organizations that leverage cloud providers. https://github.com/dafthack/CloudPentestCheatsheets #cloud

​​TokenMan Access and Refresh Token Suite. Token Man is a tool for supporting post-exploitation activities using AAD access and/or refresh tokens. https://github.com/secureworks/TokenMan

​​CVE-2022-36231 The ruby gem pdf_info <= 0.5.3 is vulnerable to OS Command Injection when executing a method on a PDF::Info object. An attacker using a specially crafted payload may execute OS commands by using command chaining. https://github.com/affix/CVE-2022-36231 #cve

​​Bug Bounty Templates A collection of templates for bug bounty reporting, with guides on how to write and fill out. Not the core standard on how to report but certainly a flow I follow personally which has been successful for me. Your milage may vary. https://github.com/ZephrFish/BugBountyTemplates

​​CRLFuzz A fast tool to scan CRLF vulnerability written in Go https://github.com/dwisiswant0/crlfuzz

​​Siphon Intercept input/output (stdin/stdout/stderr) for any process, even where said output is sent to /dev/null or elsewhere. https://github.com/liamg/siphon

​​Lan Turtle (Offline Storage) The LAN Turtle is a tiny network infiltration multi-tool masquerading as an innocent USB-to-Ethernet Adaptor. Easily configure via the inbuilt graphic shell, and deploy payloads such as MITM surveillence, network-scanning, VPN-tunneling, etc. The LAN Turtle provides a fully configurable, fully extendable payload toolkit wrapped in a covert case. Designed as a covert pivot into target networks, the device has significant functionality despite its small size. Housed in a generic "USB to Ethernet Adaptor" case, the LAN Turtle is inconspicuous, compact and designed to blend into the background when attached to a target network. Payload and system configuration are performed via a simple graphic shell, allowing the device to be (pre) configured to your specific requirements. The Offline Storage version provides MicroSD expansion - perfect for lengthy unattended sniffing / network intelligence gathering. Backed by the extensive Module/Payload repository and fully extendable via bash, python or PHP - the LAN Turtle infinitely configurable. Repository: https://github.com/scheibleit/LanTurtleScripts https://github.com/hak5/lanturtle-modules Buy online: 🛒 https://amzn.to/3CV9i94 #usb #lan #hak5

​​SSRF-Scanner SSRF(Server-side request forgery) is a trending vulnerability identified in most web applications in which attackers can cause server-side applications to make HTTP requests to arbitrary domains or subdomains. SSRF-Scanner tool is an automated tool that can find the potential SSRF issues actually from a Infrastructure prospective. SSRF-Scanner helps you detect potential SSRF headers and validates the finding it by making a HTTP request back to your server. Actually it support only headers attack but in future versions will also include scanning from an application perspective. https://github.com/Dancas93/SSRF-Scanner

​​Depthcharge Depthcharge is a toolkit designed to support security research and "jailbreaking" of embedded platforms using the U-Boot bootloader. https://github.com/nccgroup/depthcharge

​​XENA XENA is the managed remote administration platform for botnet creation & development powered by blockchain and machine learning. Favoring secrecy and resiliency over performance. Aiming to provide an ecosystem which serves the bot herders. It's micro-service oriented allowing for specialization and lower footprint. Ese of deployment is enabled via Docker containers. You interact with the botnet through an elegant dark-themed web user interface. All communication is signed with bot herder's private key, and verified by the bots using hardcoded public key. Bot clients are really diverse, powered by: Golang, Haxe, C++ and Python3. With this in mind, bots are able to run on Windows, MacOS, Linux and FreeBSD. https://github.com/zarkones/XENA