HackGit

​​Facebook Friend List Scraper #OSINT tool to scrape names and usernames from large friend lists on #Facebook, without being rate limited. https://github.com/narkopolo/fb_friend_list_scraper

​​Building a TLS-compatible Honeypot This guide illustrates how to set up a honeypot that, next to unencrypted network traffic, is also capable of decrypting TLS traffic with the help of PolarProxy. It is part of my master's thesis that uses a version of this setup to analyze attacks on specific HTTP(S) web-based applications. https://github.com/Nirusu/how-to-setup-a-honeypot

$donate

​​💰 Donate If you like the channel please support us ❣️ https://www.buymeacoffee.com/HackGit BTC:

bc1qq2kuplw92csl0yz9xcqmrcrcmnutvvuvj3s7h7

TON:

UQAAZ1BFX5OsybSryoFunzyJN3F7oKWMbZNPlwMTcVK8mEzA

USDT – ERC20❗️:

0x1e7fa9e9c42f71e6d155aca39951f23355178163

You can buy crypto here #donate #support

​​JSshell A JavaScript reverse shell. This is used for executing JS code remotely, exploiting blind XSS, ... https://github.com/shelld3v/JSshell

​​PyRDP A Python Remote Desktop Protocol (RDP) Monster-in-the-Middle (MITM) tool and library. RDP Monster-in-the-Middle: ▫️ Logs plaintext credentials or NetNTLM hashes used when connecting ▫️ Steals data copied to the clipboard ▫️ Saves a copy of the files transferred over the network ▫️ Crawls shared drives in the background and saves them locally ▫️ Saves replays of connections so you can look at them later ▫️ Runs console commands or PowerShell payloads automatically on new connections RDP Player: ▫️ See live RDP connections coming from the MITM ▫️ View replays of RDP connections ▫️ Take control of active RDP sessions while hiding your actions ▫️ List the client's mapped drives and download files from them during active sessions Converter tool: ▫️ Convert RDP replays to videos for easier sharing ▫️ Convert RDP replays to a sequence of low-level events serialized in JSON format ▫️ Convert PCAPs to replays, videos or JSON events ▫️ Convert decrypted PCAPs (L7 PDUs) to replays, videos or JSON events ▫️ RDP Certificate Cloner: ▫️ Create a self-signed X509 certificate with the same fields as an RDP server's certificate https://github.com/GoSecure/pyrdp

​​UAParser.js JavaScript library to detect Browser, Engine, OS, CPU, and Device type/model from User-Agent data with relatively small footprint (~17KB minified, ~6KB gzipped) that can be used either in browser (client-side) or node.js (server-side). https://github.com/faisalman/ua-parser-js demo: https://faisalman.github.io/ua-parser-js/#demo

​​Vernet Network Analyzer and Monitoring Tool Features: ▫️ Shows Wi-Fi details ▫️ Scans for devices(or hosts) on network ▫️ Scans for open ports of target IP ▫️ Shows ISP details https://github.com/git-elliot/vernet

​​OctopusWAF Open-source Web application #firewall entirely created in C language that uses libevent to make multiple connections. The event-driven architecture is optimized for many parallel connections (keep-alive), vital for high-performance AJAX applications. This tool is very light. You can deploy in any, please. This resource turns perfect for protecting specific endpoints that need custom protection. Features: ▫️ Reverse proxy function. ▫️ Detect anomaly using regex using lib PCRE resources. ▫️ Detect security anomaly using algorithms for match string like DFA, horspool or karp-rabin. ▫️ Detect security anomaly using libinjection. ▫️ Options to save log. https://github.com/CoolerVoid/OctopusWAF

CVE-2022-24934 wpsupdater.exe in Kingsoft WPS Office < 11.2.0.10382 allows RCE by modifying HKEY_CURRENT_USER in the registry https://github.com/MagicPiperSec/WPS-CVE-2022-24934 #exploit

​​FTP-Inspector Simple command line tool for performing dictionary attacks in #FTP servers, with multi threading. At the moment this tool, only work with a custom [USER:PASSWORD] wordlist. If you don't have one, dont't worry, you can generate it with WORDLISTGEN script. Example of usage:

python3 FTP-Inspector.py -F USER_PASS -T 5 -S 192.169.0.177

https://github.com/alechilczenko/Inspector

CVE-2022-31138 RCE and Domain Admin privilege escalation for Mailcow https://github.com/ly1g3/Mailcow-CVE-2022-31138 #cve #poc

​​Sim card reader/writer/copy/cloner/backup GSM/CDMA ▫️ You can backup and modify even if you are using multiple SIM cards simultaneously ▫️ You can copy the SIM card contents to another SIM card ▫️ Independence computer backup different SIM cards ▫️ Information security, set to relieve, manage mobile PIN password ▫️ Support 2.0 fast read and write ▫️ Beautiful appearance, no external power supply, USB interface plug and play Buy online: 🛒 https://ali.ski/VmOawR #sim #reader

​​SysmonQuiet Reflective DLL Most of the codes come from SEKTOR7 - Windows Evasion Course. This RDLL (requires SeDebugPrivilege privilege) will automatically locate sysmon process and patch its EtwEventWrite API, causing sysmon malfunctioning while the process and its threads are still running. https://github.com/ScriptIdiot/SysmonQuiet

cgaty Hooking the GDT Installing a Call Gate. POC for Rootkit Arsenal Book https://github.com/therealdreg/cgaty

​​http redirector this is a lightweight http server that redirects requests to another http server. https://github.com/d4rckh/http-redirector

Kerberoast implemented in VBA Macro Retrieve SPNs via LDAP queries, then ask a TGS Ticket with RC4 Etype for each one. The ticket is exported in KiRBi format (like mimikatz does) https://github.com/Adepts-Of-0xCC/VBA-macro-experiments/blob/main/kerberoast.vba Research: https://adepts.of0x.cc/kerberoast-vba-macro/ #vba #kerberoast

​​Link Link is a general RL framework to find reflected XSS vulnerabilities in a black-box and fully automatic manner. It implemented on top of Wapiti a popular open source web scanner. And reinforcement learning components are implemeted based on OpenAI gym and Stable baselines. The details of Link is in our paper, "Link: Black-Box Detection of Cross-Site Scripting Vulnerabilities Using Reinforcement Learning" which appeared in The Web Conference 2022. https://github.com/WSP-LAB/Link