HackGit

​​phoneinfoga Advanced information gathering & OSINT framework for phone numbers PhoneInfoga is one of the most advanced tools to scan international phone numbers. It allows you to first gather standard information such as country, area, carrier and line type on any international phone number, then search for footprints on search engines to try to find the VoIP provider or identify the owner. Features: ▫️ Check if phone number exists and has connectivity status with HLR lookups ▫️ Gather standard informations such as country, line type and carrier ▫️ OSINT footprinting using external APIs, Google Hacking, phone books & search engines ▫️ Check for reputation reports, social media, disposable numbers and more ▫️ Use the graphical user interface to run scans from the browser ▫️ Programmatic usage with the REST API and Go modules https://github.com/sundowndev/PhoneInfoga #osint #best

CVE-2022-24342 JetBrains TeamCity - account takeover via CSRF in GitHub authentication (PoC) https://github.com/yuriisanin/CVE-2022-24342 #cve #poc

VoIP Caller by 1vere$k This is simple 5060 port exploit that calls to a receiver VoIP device with pre-defined phrase. The app establishes a TCP connection and write a VoIP Payload with the INVITE method which initiates a call with pre-defined "caller-name" which is our phrase. https://github.com/iveresk/voip-caller

NinjaShell Golang Netcat/Socat/Ncat-like with file transfer, encrypted transfer and traffic. https://github.com/7RU7H/ninjashell

​​X-Access-Dumper Dumps everything web accessible: .git, .DS_Store, sql dumps, backups... https://github.com/tz4678/x-access-dumper

​​PEzor Open-Source PE Packer Red teamers often have the necessity of bypassing AV solutions and I recently needed a more powerful tool than x0rro in order to perform some tasks and bypass a solution that I was targeting. At the end of my development journey, I was satisfied enough with the result that I decided to open-source the design and the implementation processes that I have followed in order to build my solution. https://github.com/phra/PEzor Read the blog posts here: https://iwantmore.pizza/posts/PEzor.html https://iwantmore.pizza/posts/PEzor2.html https://iwantmore.pizza/posts/PEzor3.html https://iwantmore.pizza/posts/PEzor4.html

​​Shelltropy The more predictable you are, the less you get detected A technique of hiding malicious shellcode based on low-entropy via Shannon encoding. Entropy is the measure of the randomness in a set of data (here: shellcode). The higher the entropy, the more random the data is. Shannon Entropy is an algorithm that will produce a result between 0 and 8, where 8 means there is no pattern in the data, thereby it's very random and 0 means data follows a pattern. Note: Check out my blog article for a more detailed explanation of my research, and a simple Vanilla Shellcode Injection PoC as well. https://github.com/kleiton0x00/Shelltropy #av #edr #bypass #entropy

​​Detect hidden threats with GlassWire's Firewall 🕵🏻 Instantly see your current & past network activity. Detect malware, & block badly behaving apps. 🔎 Instantly see who or what your PC is talking to on GlassWire's network monitoring graph, plus see what your PC may have connected to in the past. 🔥 Detect spyware, malware, badly behaving apps, and bandwidth hogs, then block their connections. ❗️ GlassWire warns you of network related changes to your PC, or unusual changes to your apps that could indicate malware. 👁 Monitor other PCs on your network and get alerted when new unknown devices join your WiFi. 🔔 Keep track of your data usage on your PC or mobile phone and get alerted before going over data limits. 🕔 Go back in time with GlassWire's network time machine to see what your PC was doing while you were away. 🚨 Get alerted every time a new app accesses the network, and block it if necessary. 📊 See detailed network usage statistics broken down by IP/Host, app, network traffic types, and more. 👉🏻 Download GlassWire's Firewall Soft

​​H Y D R A Hydra is a parallelized login cracker which supports numerous protocols to attack. It is very fast and flexible, and new modules are easy to add. This tool makes it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely. It supports: Cisco AAA, Cisco auth, Cisco enable, CVS, FTP, HTTP(S)-FORM-GET, HTTP(S)-FORM-POST, HTTP(S)-GET, HTTP(S)-HEAD, HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MS-SQL, MySQL, NNTP, Oracle Listener, Oracle SID, PC-Anywhere, PC-NFS, POP3, PostgreSQL, RDP, Rexec, Rlogin, Rsh, SIP, SMB(NT), SMTP, SMTP Enum, SNMP v1+v2+v3, SOCKS5, SSH (v1 and v2), SSHKEY, Subversion, Teamspeak (TS2), Telnet, VMware-Auth, VNC and XMPP. https://github.com/vanhauser-thc/thc-hydra A Detailed Guide on Hydra: https://www.hackingarticles.in/a-detailed-guide-on-hydra/ #brute #best

​​Chameleon Mini The Chameleon Tiny Pro is a pocket friendly powerful NFC emulation & manipulation tool which is based on the open-source project ChameleonMini. It can create perfect clones of various existing commercial smart cards, including cryptographic function and UID Changeable functions. The genesis of the Chameleon Tiny is to be a smaller ChameleonMini and to be more end-consumer friendly. The Pro version adds Bluetooth connectivity for quicker interaction via the Android application. Wiki: https://github.com/iceman1001/ChameleonMini-rebooted/wiki/ Buy online: 🛒 https://bit.ly/3yzh0EK #nfc #rf #chameleon #mini

​​CodeIgniter-session-unsign Command line tool to fetch, decode and brute-force CodeIgniter session cookies by guessing secret keys. https://github.com/p0dalirius/CodeIgniter-session-unsign

​​dlinject.py Inject a shared library (i.e. arbitrary code) into a live linux process, without ptrace. Inspired by Cexigua and linux-inject, among other things. https://github.com/DavidBuchanan314/dlinject

​​goGetJS goGetJS extracts, searches, and saves JavaScript files. Includes an optional browser (playwright) for dealing with JavaScript-heavy sites. https://github.com/davemolk/goGetJS

CVE-2022-28117 Navigate CMS <= 2.9.4 - Server-Side Request Forgery (Authenticated) https://github.com/cheshireca7/CVE-2022-28117 #cve #exploit

RBCD_Abuse_Checker.ps1 Tool to check if RBCD can be abused by checking both ms-ds-machineaccountquota & SeMachineAccountPrivilege https://github.com/LuemmelSec/Pentest-Tools-Collection/blob/main/tools/RBCD_Abuse_Checker.ps1

DeFiVulnLabs This was an internal Web3 solidity security training in XREX. I want to share these materials with everyone interested in Web3 security and how to find vulnerabilities in code and exploit them. Every vulnerability testing uses Foundry. Faster and easier! https://github.com/SunWeb3Sec/DeFiVulnLabs

U-Boat The malware target Ukraine by default you can choose other countries from the macro list in header file or create new one if it does not exist . It has to be run as Administrator in order to work , the shellcodes has been modified for this task so they get executed from the very beginning. https://github.com/ZeroMemoryEx/U-Boat