HackGit

​​SharpSniper Often a #RedTeam engagement is more than just achieving Domain Admin. Some clients will want to see if specific users in the domain can be compromised, for example the CEO. SharpSniper is a simple tool to find the IP address of these users so that you can target their box. It requires that you have privileges to read logs on Domain Controllers. First it queries and makes a list of Domain contollers, then search for Log-on events on any of the DCs for the user you are looking for and then reads the most recent DHCP allocated logon IP address. https://github.com/HunnicCyber/SharpSniper @HackGit

​​subDomainsBrute A fast sub domain brute tool for pentesters, works with Python3.5+ or Python2.7. https://github.com/lijiejie/subDomainsBrute @HackGit

​​Archive.org-Downloader There are many great books available on https://openlibrary.org/ and https://archive.org/, however, you can only borrow them for 1 hour to 14 days and you don't have the option to download it as a PDF to read it offline or share it with your friends. I created this program to solve this problem and retrieve the original book in pdf format for FREE ! Of course, the download takes a few minutes depending on the number of pages and the quality of the images you have selected. You must also create an account on https://archive.org/ for the script to work. https://github.com/MiniGlome/Archive.org-Downloader @HackGit

Toolies Ad hoc collection of Red Teaming & Active Directory tooling. Use at your own risk. https://github.com/expl0itabl3/Toolies #redteam

​​Mass-exploit-CVE-2022-29464 Just a Mass Exploit based on a Python PoC for # WSO2 Carbon Server CVE-2022-29464 Pre-auth RCE bug CVE-2022-29464. This is a mass-autoscan-exploit of CVE-2022-29464 based on the PoC wrote in python by a third part. The Py file is available and readable, see also the bash script that don't contain any encoded string. Massexploit will upload a shell and a reverse shell and print out the path to access it. Easy, Quick and Cool. https://github.com/electr0lulz/Mass-exploit-CVE-2022-29464 #cve #exploit

​​reverse-shell-generator Hosted Reverse Shell generator with a ton of functionality -- (great for CTFs) Features: ▫️ Generate common listeners and reverse shells ▫️ Save button to download Payloads from browser. ▫️ Raw mode to cURL shells to your machine. ▫️ Button to increment the listening port number by 1 ▫️ URI and Base64 encoding ▫️ LocalStorage to persist your configuration ▫️ Dark, Light and Meme Modes ▫️ Screenshot https://github.com/0dayCTF/reverse-shell-generator Hosted Instance: https://revshells.com

Brute-Ratel-C4-Community-Kit This repository contains scripts, configurations and deprecated payload loaders for Brute Ratel C4. Anything which is added in the deprecated folder will not be a part of the latest release of BRc4. https://github.com/paranoidninja/Brute-Ratel-C4-Community-Kit #c2 #bof #shellcode #injection

​​razorAP Bash and Python tool used to generate Fake Access Points for Wi-Fi networks with 802.1X authentication. The basic pieces for 802.1X authentication are ▫️ Applicant: software client running on the Wi-Fi workstation. ▫️ Authenticator: Wi-Fi access point ▫️ Authentication server: An authentication database, usually a RADIUS server https://github.com/migguel0/razorAP @HackGit

​​vmConsole A simple text-based Linux virtual machine application for Android. Powered by QEMU. No KVM or root required. Typical use-cases of vmConsole application: ▫️ Exploring the world of Linux 😊 ▫️ Programming ▫️ Testing software ▫️ Hacking ▫️ Running TOR hidden services ▫️ Crawling / archiving websites https://github.com/sylirre/vmConsole @HackGit

​​69phisher Simple and beginner friendly automated phishing page creator. Phishing using try.cloudflare tunnel & undetectable by chrome. A beginners friendly, Automated phishing tool with 30+ templates. Features: ▫️ Latest and updated login pages. ▫️ Mask URL support ▫️ Beginners friendly ▫️ Tunneling options ✔️ Localhost (visit 127.0.0.1:8080) ✔️ Cloudflared (default and automated) https://github.com/Akshay-Arjun/69phisher @HackGit

​​LinkFinder LinkFinder is a python script written to discover endpoints and their parameters in JavaScript files. This way penetration testers and bug hunters are able to gather new, hidden endpoints on the websites they are testing. Resulting in new testing ground, possibility containing new vulnerabilities. It does so by using jsbeautifier for python in combination with a fairly large regular expression. The regular expressions consists of four small regular expressions. These are responsible for finding: ▫️ Full URLs (https://example.com/) ▫️ Absolute URLs or dotted URLs (/* or ../*) ▫️ Relative URLs with at least one slash (text/test.php) ▫️ Relative URLs without a slash (test.php) https://github.com/GerbenJavado/LinkFinder @HackGit

​​interactsh Interactsh is an open-source tool for detecting out-of-band interactions. It is a tool designed to detect vulnerabilities that cause external interactions. Features: ▫️ DNS/HTTP(S)/SMTP(S)/LDAP Interaction ▫️ CLI / Web / Burp / ZAP / Docker client ▫️ AES encryption with zero logging ▫️ Automatic ACME based Wildcard TLS w/ Auto Renewal ▫️ DNS Entries for Cloud Metadata service ▫️ Self-Hosted Interactsh Server ▫️ Multiple domain support (self-hosted) ▫️ NTLM/SMB/FTP/RESPONDER Listener (self-hosted) ▫️ Wildcard / Protected Interactions (self-hosted) ▫️ Customizable Payload Length (self-hosted) ▫️ Custom SSL Certificate (self-hosted) https://github.com/projectdiscovery/interactsh @HackGit

​​ChainWalker ChainWalker is a smart contract scraper which uses RCP/IPC calls to extract the information. A small tool that can help us find contracts, extract the EVM code, and disassemble the opcodes. It allows us to select specific blocks or even specific contract balances. Features: ▫️ cross-platform ▫️ concurrent and fast ▫️ It doesn't require 3rd party API ▫️ downloads contract EVM ▫️ disassemble EVM to opcode https://github.com/0xsha/ChainWalker Research: https://0xsha.io/blog/lets-walk-on-the-chains-creating-a-smart-contract-crawler @HackGit

​​SecretFinder SecretFinder is a python script based on LinkFinder, written to discover sensitive data like apikeys, accesstoken, authorizations, jwt,..etc in JavaScript files. It does so by using jsbeautifier for python in combination with a fairly large regular expression. The regular expressions consists of four small regular expressions. These are responsible for finding and search anything on js files. https://github.com/m4ll0k/SecretFinder @HackGit

​​All about bug bounty These are my bug bounty notes that I have gathered from various sources, you can contribute to this repository too! https://github.com/daffainfo/AllAboutBugBounty @HackGit

CVE-2022-31626 analysis https://github.com/CFandR-github/PHP-binary-bugs/blob/main/cve_2022_31626_remote_exploit/cve_writeup.md #cve #poc

freeBokuLoader A simple BOF that tries to free the memory region where the User Defined Reflective Loader is stored. As the name implies, it was tested against BokuLoader, but should work with most if not all UDRLs. https://github.com/S4ntiagoP/freeBokuLoader #cobalt

​​BokuLoader Cobalt Strike User-Defined Reflective Loader written in Assembly & C for advanced evasion capabilities. Features: ▫️ Direct NT Syscalls via HellsGate & HalosGate ▫️ NOHEADERCOPY - Loader will not copy headers over to beacon. Decommits the first memory page which would normally hold the headers ▫️ NoRWX - The Reflective loader writes beacon with Read & Write permissions and after resolving Beacons Import Table & Relocations, changes the .TEXT code section of Beacon to Read & Execute permissions ▫️ XGetProcAddress for resolving symbols ▫️ 100k UDRL Size ▫️ Caesar Cipher for string obfuscation https://github.com/boku7/BokuLoader @HackGit

​​CATS REST API fuzzer and negative testing tool. Run thousands of self-healing API tests within minutes with no coding effort! Comprehensive: tests are generated automatically based on a large number scenarios and cover every field and header Intelligent: tests are generated based on data types and constraints; each Fuzzer have specific expectations depending on the scenario under test Highly Configurable: high amount of customization: you can exclude specific Fuzzers, HTTP response codes, provide business context and a lot more Self-Healing: as tests are generated, any OpenAPI spec change is picked up automatically Simple to Learn: flat learning curve, with intuitive configuration and syntax Fast: automatic process for write, run and report tests which covers thousands of scenarios within minutes https://github.com/Endava/cats @HackGit