HackGit

​​SharpSphere Attacking vSphere Infrastructure. SharpSphere gives red teamers the ability to easily interact with the guest operating systems of virtual machines managed by vCenter. It uses the vSphere Web Services API and exposes the following functions: ▫️ Command & Control - In combination with F-Secure's C3, SharpSphere provides C&C into VMs using VMware Tools, with no direct. ▫️ network connectivity to the target VM required. ▫️ Code Execution - Allows arbitrary commands to be executed in the guest OS and returns the result ▫️ File Upload - Allows arbitrary files to be uploaded to the guest OS ▫️ File Download - Allows arbitrary files to be downloaded from the guest OS ▫️ List VMs - Lists the VMs managed by vCenter that have VMware Tools running ▫️ Dump Memory - Dump and download VM's memory, then manually extract credentials from LSASS offline using WinDbg and Mimikatz (Guide) https://github.com/JamesCooteUK/SharpSphere Dumping LSASS with SharpShere: https://jamescoote.co.uk/Dumping-LSASS-with-SharpShere/

​​Linux-Bash-Commands Ultimate list of Linux bash commands Bash is the Unix command-line interface (CLI). Also called the terminal, the command line, or the shell. It's a command language that allows us to work with files on our computers in a way that's far more efficient and powerful than using a GUI (graphical user interface) https://github.com/trinib/Linux-Bash-Commands

​​ICSSIM A Framework for Building Industrial Control Systems Security Simulation Testbeds. https://github.com/AlirezaDehlaghi/ICSSIM

​​KittyStager KittyStager is a simple stage 0 C2. It is made of a web server to host the shellcode and an implant, called kitten. The purpose of this project is to be able to have a web server and some implant for various usage and be able to use it with any shellcode. Features: ▫️ A simple cli to interact with the implant ▫️ Different implants for various usage ▫️ User agent whitelist to prevent unwanted connections ▫️ A basic recon to get some information about the target (hostname, ip, program files...) ▫️ A Chacha20 encryption to encrypt all the traffic with a none hardcoded key ▫️ Supports hex and bin shellcode ▫️ Shellcode Reflective DLL Injection ▫️ Halo's gate ▫️ Hell's gate ▫️ Recycle gate ▫️ ETW patching ▫️ Sandbox detection https://github.com/Enelg52/KittyStager

​​BOF-pack-1 A care package of useful bofs for red team engagments. https://github.com/jsecu/BOF-pack-1

​​excavator A plug-in passive security vulnerability scanner based on mitmproxy https://github.com/ghtwf01/excavator

​​Awesome Malware Techniques This is a repository of resource about Malware techniques. https://github.com/fr0gger/Awesome_Malware_Techniques

​​GOAD (Game Of Active Directory) A pentest active directory LAB project. The purpose of this lab is to give pentesters a vulnerable Active directory environement ready to use to practice usual attack techniques. ▫️ part 1 - reconnaissance and scan ▫️ part 2 - find users ▫️ part 3 - enumeration with user ▫️ part 4 - poison and relay ▫️ part 5 - exploit with user ▫️ part 6 - ADCS ▫️ part 7 - MSSQL ▫️ part 8 - Privilege escalation ▫️ part 9 - Lateral move https://github.com/Orange-Cyberdefense/GOAD #ad

​​VPS-web-hacking-tools Automatically install some web hacking/bug bounty tools for your VPS. https://github.com/supr4s/VPS-web-hacking-tools

​​katana A next-generation crawling and spidering framework. ▫️ Fast And fully configurable web crawling ▫️ Standard and Headless mode support ▫️ JavaScript parsing / crawling ▫️ Customizable automatic form filling ▫️ Scope control - Preconfigured field / Regex ▫️ Customizable output - Preconfigured fields ▫️ INPUT - STDIN, URL and LIST ▫️ OUTPUT - STDOUT, FILE and JSON https://github.com/projectdiscovery/katana

​​nimc2 nimc2 is a very lightweight C2 written fully in nim. It's uses range from user support to employee monitoring. If you want to give it a try check out the wiki to learn how to install and use nimc2. It's features include: ▫️ Windows & Linux implant generation ▫️ TCP socket and HTTP communication ▫️ Ability to create as many listeners as you want ▫️ nice task system ▫️ A loot system for storing screenshots and downloaded files ▫️ Customizable modules for extending implants with custom functionality ▫️ Easy to use CLI ...and a lot more features coming soon https://github.com/d4rckh/grc2

​​CS_Uploads_Tracker This is an Aggressor script for use within CobaltStrike to aid in the tracking of files that have been uploaded to target systems via the CobaltStrike upload command. https://github.com/Octoberfest7/CS_Uploads_Tracker

​​HellsGateNim A quick example of the Hells Gate technique in Nim. https://github.com/zimawhit3/HellsGateNim

​​SocialFish Phishing Tool & Information Collector. https://github.com/UndeadSec/SocialFish

​​ezXSS ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting. https://github.com/ssl/ezXSS

​​CVE-2022-2586 gcc exploit.c -o exploit -lmnl -lnftnl -no-pie -lpthread https://github.com/sniper404ghostxploit/CVE-2022-2586 #cve

​​hollows_hunter Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches). https://github.com/hasherezade/hollows_hunter

​​xx The xx file format. Turn your hex dumps into art, then into binary data. https://github.com/netspooky/xx

​​CVE-2022-43144 XSS vulnerability in Canteen Management System v.1.0 https://github.com/mudassiruddin/CVE-2022-43144-Stored-XSS #cve