HackGit

​​Darkdump Search The Deep Web Straight From Your Terminal Darkdump is a simple script written in Python3.9 in which it allows users to enter a search term (query) in the command line and darkdump will pull all the deep web sites relating to that query. Darkdump wraps up the darksearch.io API - Note that darksearch.io now forbids public queries so I will be changing the new API as soon as possible. https://github.com/josh0xA/darkdump @HackGit

​​Fzshell Fuzzy shell completions you didn't know you needed. Fuzzy command line completer that fetches completions from sources predefined by a user. What does it mean? It means that now you can create custom completions for anything you want. All fzshell needs is a pattern to match and command to generate completion list. It can even insert a completion at any point in a line, not just at the end. See for yourself: https://github.com/mnowotnik/fzshell @HackGit

​​APIClarity Reconstruct Open #API Specifications from real-time workload traffic seamlessly. Microservices API challenges: ▫️ Not all applications have an OpenAPI specification available ▫️ How can we get this for legacy or external applications? ▫️ Detect whether microservices still use deprecated APIs (a.k.a. Zombie APIs) ▫️ Detect whether microservices use undocumented APIs (a.k.a. Shadow APIs) ▫️ Generate OpenAPI specifications without code instrumentation or modifying existing workloads (seamless documentation) Solution: ▫️ Capture all API traffic in an existing environment using multiple traffic sources ▫️ Construct an OpenAPI specification by observing API traffic or upload a reference OpenAPI spec ▫️ Review, modify and approve automatically generated OpenAPI specs ▫️ Alert on any differences between the approved API specification and the API calls observed at runtime; detects shadow & zombie APIs ▫️ UI dashboard to audit and monitor the findings https://github.com/openclarity/apiclarity @HackGit

​​OpenAPI fuzzer Black-box fuzzer that fuzzes APIs based on OpenAPI specification. All you need to do is to supply URL of the API and its specification. Find bugs for free! https://github.com/matusf/openapi-fuzzer @HackGit

​​brutas Wordlists and passwords handcrafted with ♥️ A pretty comprehensive set of password dictionaries and wordlists designed for quick wins in red teaming scenarios or general blackbox pentesting. https://github.com/tasooshi/brutas @HackGit

​​Recon Hunter A tool to map the attack surface discovery of any target. Features: ▫️ Sub-Domains Passive Scraping ▫️ Sub-Domains Brute Force ▫️ Sub-Domains Wildcard Removal ▫️ Sub-Domains Spidering ▫️ Sub-Domains Takeover ▫️ IPs Enumeration using Censys ▫️ Port Scanning ▫️ Websites' Screenshots ▫️ Directories & Files Brute Force ▫️ Internet Archive ▫️ AWS S3 Buckets ▫️ Github Leaked Secrets https://github.com/hassan0x/ReconHunter @HackGit

​​Mangle Mangle is a tool that manipulates aspects of compiled executables (.exe or DLL). Mangle can remove known Indicators of Compromise (IoC) based strings and replace them with random characters, change the file by inflating the size to avoid EDRs, and can clone code-signing certs from legitimate files. In doing so, Mangle helps loaders evade on-disk and in-memory scanners. https://github.com/optiv/Mangle #av #edr #memory #evasion #redteam

​​Schemathesis Schemathesis is a modern API testing tool for web applications built with Open API and GraphQL specifications. It reads the application schema and generates test cases, which will ensure that your application is compliant with its schema (read more about how it works in our research paper). The application under test could be written in any language; the only thing you need is a valid API schema in a supported format. Simple to use and yet powerful to uncover hard-to-find errors thanks to the property-based testing approach backed by state-of-the-art Hypothesis library. Features: ▫️ Open API: Schema conformance, explicit examples, stateful testing; ▫️ GraphQL: queries generation; ▫️ Multi-worker test execution; ▫️ Storing and replaying tests; ▫️ ASGI / WSGI support; ▫️ Generated code samples (cURL, Python); ▫️ Docker image; ▫️ Customizable checks & test generation https://github.com/schemathesis/schemathesis @HackGit

​​ElevatedEvents EventViewer UAC bypass via .NET Deserialization discovered by @OrangeTsai made into a Reflective DLL to use with Cobalt Strike. Supports direct execution of executables, and doesn't rely on spawning cmd.exe through mmc.exe as shown in the original POC. However due to this command agruements are not supported. As this UAC bypass is currently detected by Defender, a simple bypass is utilized that renames the file back to the original after its created to avoid detection. https://github.com/jsecu/ElevatedEvents @HackGit

Forensic Imaging quickstarts! https://github.com/jnbdz/forensic-imaging-quickstarts @HackGit

​​Remote Exploitation Technique For CVE 2022-31626 https://github.com/CFandR-github/PHP-binary-bugs/tree/main/cve_2022_31626_remote_exploit #php #cve

​​CVE-2022-22980 A local based poc of CVE-2022-22980 https://github.com/trganda/CVE-2022-22980 Research: https://tanzu.vmware.com/security/cve-2022-22980 #cve #poc

​​Noscrape Obfuscate text via node to make scraping your content really difficult. The key behind is to use any true-type font from which noscrape generates a new version with shuffled Unicode and nothing that one can use to calculate them back. Strings and Integers become obfuscated and are only readable by using the generated obfuscation font. https://github.com/schoenbergerb/noscrape @HackGit

​​CustomActiveScanForZAP A OWASP ZAP AddOn ActiveScan for detecting SQL injections. Real Web application page has dynamic contents such as special sale products list or CSRF token, which is not affected by input parameters. The web application vulnerability scanner manipulates input parameters to detect vulnerabilities by affecting page content. The scanner may fail to detect vulnerabilities if the dynamic content of the web page has contents which is unaffected by the input parameters. Therefore, this CustomActiveScan uses LCS (Longest Common Sequece) algorithm to remove these unnecessarily dynamic content. Due to this method, this scanner has a superior vulnerability detection capability. how to remove these dynamic contents which is not affected input parameters. LCS(Longest Common Sequence) algorighm extracts the content that is common to two array elements. For example, you have a web page that contains a CSRF token. The CSRF token has a unique value for each http request. To erase this token, this addon sends two identical http requests and computes the response LCS of the two requests. LCS remove the different token values ​​from the two responses as follows: https://github.com/gdgd009xcd/CustomActiveScanForZAP @HackGit

FLARE Obfuscated String Solver Rather than heavily protecting backdoors with hardcore packers, many malware authors evade heuristic detections by obfuscating only key portions of an executable. Often, these portions are strings and resources used to configure domains, files, and other artifacts of an infection. These key features will not show up as plaintext in output of the strings.exe utility that we commonly use during basic static analysis. The FLARE Obfuscated String Solver (FLOSS, formerly FireEye Labs Obfuscated String Solver) uses advanced static analysis techniques to automatically deobfuscate strings from malware binaries. You can use it just like strings.exe to enhance basic static analysis of unknown binaries. FLOSS extracts all the following string types: ▫️ static strings: "regular" ASCII and UTF-16LE strings ▫️ stack strings: strings constructed on the stack at run-time ▫️ tight strings: special form of stack strings, decoded on the stack ▫️ decoded strings: strings decoded in a function https://github.com/mandiant/flare-floss @HackGit

​​zphisher A beginners friendly, Automated phishing tool with 30+ templates. Features: ▫️ Latest and updated login pages. ▫️ Mask URL support ▫️ Beginners friendly ▫️ Docker support (checkout docker-legacy branch) ▫️ Multiple tunneling options ▫️ Localhost ▫️ Ngrok (With or without hotspot) ▫️ Cloudflared (Alternative of Ngrok) https://github.com/htr-tech/zphisher @HackGit

​​Thread Stack Spoofing / Call Stack Spoofing PoC A PoC implementation for an advanced in-memory evasion technique that spoofs Thread Call Stack. This technique allows to bypass thread-based memory examination rules and better hide shellcodes while in-process memory. This is an example implementation for Thread Stack Spoofing technique aiming to evade Malware Analysts, AVs and EDRs looking for references to shellcode's frames in an examined thread's call stack. The idea is to hide references to the shellcode on thread's call stack thus masquerading allocations containing malware's code. Implementation along with my ShellcodeFluctuation brings Offensive Security community sample implementations to catch up on the offering made by commercial C2 products, so that we can do no worse in our Red Team toolings. 💪 https://github.com/mgeeky/ThreadStackSpoofer @HackGit

​​WebHackUrls #Simple python #OSINT tool for urls recon thanks to the waybackmachine. https://github.com/mathis2001/WebHackUrls @HackGit

​​ASScan Attack Surface Scan, The Real Passive Scan, It's like a submarine. Functions: ▫️ API、SubDomain or other information found for JavaScript file. ▫️ AccessKey/SecretKey found for JavaScript file. ▫️ Dom Vulnerability Insertion point found for JavaScript file. ▫️ Broken Authentication Insertion point found for API. ▫️ Sensitive Data expose point found for API. ▫️ XXE or SSRF Insertion point found for API. ▫️ Website's fingerprint found for requests. ▫️ Not to stay up ... https://github.com/langu-xyz/ASScan @HackGit

​​Crypt-Cobalt-Strike-Powershell Privat crypt #Cobalt Strike and powershell https://github.com/trewisscotch/Crypt-Cobalt-Strike-Powershell @HackGit