HackGit

​​Harvis Harvis is designed to automate your C2 Infrastructure, currently using Mythic C2. Harvis is a python tool to help you create multiple hauls for a specific operation during a red team engagement. It can automatically create your C2 machine, redirector machine, setup SSL, .htaccess configuration, firewall rules and more. Harvis also has the purpose of automating the job of the operator of identifying burned domains/redirectors that may be caught during the operation. After identifying the burned domains it provides the possibility of rotating the infrastructure, setting up different redirectors and atributing a different domain. https://github.com/thiagomayllart/Harvis

​​wpBullet A static code analysis for WordPress Plugins/Themes (and PHP) https://github.com/webarx-security/wpbullet

​​PICT Post-Infection Collection Toolkit This set of scripts is designed to collect a variety of data from an endpoint thought to be infected, to facilitate the incident response process. This data should not be considered to be a full forensic data collection, but does capture a lot of useful forensic information. If you want true forensic data, you should really capture a full memory dump and image the entire drive. That is not within the scope of this toolkit. https://github.com/thomasareed/pict

​​PersistAssist PersistAssist is a fully modular persistence framework written in C#. All persistence techniques contain a cleanup method which will server to remove the persistence aside from the persistence code. This is a WIP so there are many empty classes, the main object of this project initially was to build out a fully modular framework meant to make adding new features as simple as inheriting a class and adding the code. https://github.com/FortyNorthSecurity/PersistAssist

TamperingSyscalls PoC for syscall retrieval using HWBP, and exception handling https://github.com/rad9800/TamperingSyscalls

VehApiResolve Inspired by Dridex Loader's 32 bit API obfuscation - uses Vectored Exception Handlers on Windows to resolve APIs to avoid EDR detection https://github.com/rad9800/VehApiResolve

Process-Dump Windows Tool For Dumping Malware PE Files From Memory Back To Disk For Analysis. Process Dump works for Windows 32 and 64 bit operating systems and can dump memory components from specific processes or from all processes currently running. Process Dump supports creation and use of a clean-hash database, so that dumping of all the clean files such as kernel32.dll can be skipped. It's main features include: ▫️ Dumps code from a specific process or all processes. ▫️ Finds and dumps hidden modules that are not properly loaded in processes. ▫️ Finds and dumps loose code chunks even if they aren't associated with a PE file. It builds a PE header and import table for the chunks. ▫️ Reconstructs imports using an aggressive approach. ▫️ Can run in close dump monitor mode ('-closemon'), where processes will be paused and dumped just before they terminate. ▫️ Multi-threaded, so when you are dumping all running processes it will go pretty quickly. ▫️ Can generate a clean hash database. Generate this before a machine is infected with malware so Process Dump will only dump the new malicious malware components. https://github.com/glmcdona/Process-Dump

​​Crybat Crybat (previously known as Jlaive) is an antivirus evasion tool that can convert executables to undetectable batch files .NET assemblies are not guaranteed to work. Features: ▫️ .NET/Native (x64) support ▫️ AES/XOR encryption ▫️ Compression ▫️ Anti Debug ▫️ Anti VM ▫️ Melt file (self delete) ▫️ Bind files ▫️ AMSI bypass ▫️ ETW bypass https://github.com/ch2sh/Crybat

​​Bot Bounty Python Script for Telegram Bot is specially builded for pentest & bug bounty. It's like a telegram shell. You will be notified when your task(command line) is finished with results. This bot make long time tasks by you, taking off the need of your attention if it's finished. https://github.com/Drayko/Bot-Bounty #bash #python #tools

​​RE&CT A knowledge base of actionable Incident Response techniques. The RE&CT Framework is designed for accumulating, describing and classification actionable Incident Response techniques. The main use cases: ▫️ Prioritization of Incident Response capabilities development, including skills development, technical measures acquisition/deployment, internal procedures development, etc ▫️ Gap analysis — determine "coverage" of existing Incident Response capabilities https://github.com/atc-project/atc-react

​​PSRule for Azure Rules to validate Azure resources and infrastructure as code (IaC) using PSRule. Features of PSRule for Azure include: ▫️ Ready to go - Leverage over 200 pre-built rules to validate Azure resources. ▫️ DevOps - Validate resources and infrastructure code pre or post-deployment. ▫️ Cross-platform - Run on MacOS, Linux, and Windows. https://github.com/Azure/PSRule.Rules.Azure

​​ZMap ZMap is a fast single packet network scanner designed for Internet-wide network surveys. On a typical desktop computer with a gigabit Ethernet connection, ZMap is capable scanning the entire public IPv4 address space in under 45 minutes. With a 10gigE connection and PF_RING, ZMap can scan the IPv4 address space in under 5 minutes. ZMap operates on GNU/Linux, Mac OS, and BSD. ZMap currently has fully implemented probe modules for TCP SYN scans, ICMP, DNS queries, UPnP, BACNET, and can send a large number of UDP probes. If you are looking to do more involved scans, e.g., banner grab or TLS handshake, take a look at ZGrab 2, ZMap's sister project that performs stateful application-layer handshakes. https://github.com/zmap/zmap

​​VAST Visibility Across Space and Time The network telemetry engine for data-driven security investigations. https://github.com/tenzir/vast

​​BARK BARK stands for BloodHound Attack Research Kit. It is a PowerShell script built to assist the BloodHound Enterprise team with researching and continuously validating abuse primitives. BARK currently focuses on Microsoft's Azure suite of products and services. BARK requires no third party dependencies. BARK's functions are designed to be as simple and maintainable as possible. Most functions are very simple wrappers for making requests to various REST API endpoints. BARK's basic functions do not even require each other - you can pull almost any BARK function out of BARK and it will work perfectly as a standalone function in your own scripts. https://github.com/BloodHoundAD/BARK

​​SecretMagpie Secret detection tool that hunts out all the secrets hiding in your GitHub repositories. It uses multiple tools in one convenient package to scan every branch of every repository in an organization. It then smooshes all those results together into a lovely JSON output and reports some big ticket stats right to the screen. https://github.com/punk-security/secret-magpie-cli

​​MSR605X USB Card Reader \ Writer. MSR605X is a magnetic stripe card reader writer encoder upgrade from MSR605 ,it's using the HID USB, plug and play, users just install the MSR software then can use it but not need usb driver. Features: ▫️ 1,2, 3 TRACKS applicable, including credit card, gift cards, drivers license, ATMS, and etc. ▫️ Read/Write/Erase ▫️ All 3 tracks can set to 75 or 210 BPI ▫️ Standard: ISO7811/1~6 ▫️ Hico & Loco compatible:300~4000 OE ▫️ USB interface ▫️ Size:212(L) x 64(W) x 63(H) mm,portable ▫️ Works with Windows 7, 8, Vista, XP, 2000(32&64 bits)and Mac OS. ▫️ Built-in the new power system,not need the extra power adaptor. Credit card cloning is too easy!: https://www.youtube.com/watch?v=eyd24FlJCFg Buy online: 🛒 https://ali.ski/wYjpX #card #usb

​​PowerUpSQL A #PowerShell Toolkit for Attacking #SQL Server. PowerUpSQL includes functions that support SQL Server discovery, weak configuration auditing, privilege escalation on the scale, and post-exploitation actions such as #OS command execution. It is intended to be used during internal penetration tests and red team engagements. However, PowerUpSQL also includes many functions that can be used by administrators to quickly inventory the SQL Servers in their ADS domain and perform common threat hunting tasks related to SQL Server. https://github.com/NetSPI/PowerUpSQL

​​VolatileDataCollector During my Incident Response engagements, I have realized that dumping volatile data is always done bad (or at least in a way different than the best one). Additionally, the data is never in the same format, which makes the analysis harder (if not impossible) to automate. https://github.com/gtworek/VolatileDataCollector

​​Collect-MemoryDump Automated Creation of Windows Memory Snapshots for DFIR Collect-MemoryDump.ps1 is PowerShell script utilized to collect a Memory Snapshot from a live Windows system (in a forensically sound manner). https://github.com/evild3ad/Collect-MemoryDump

​​Lockbit3.0-MpClient-Defender-PoC Lockbit3.0 Microsoft Defender MpClient.dll DLL Hijacking PoC Based on: LockBit ransomware abuses Windows Defender to load Cobalt Strike https://github.com/Sh0ckFR/Lockbit3.0-MpClient-Defender-PoC Research: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-abuses-windows-defender-to-load-cobalt-strike/