HackGit

​​Prefetch Hash Cracker During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch file. While its content may not be recoverable, the filename itself is often enough to find the full path of the executable for which the prefetch file was created. https://github.com/harelsegev/prefetch-hash-cracker

​​win-ioc-detect Powershell IOC Exploit detection https://gmuisg.org/log4j-detect/ https://github.com/jake-k-38/win-ioc-detect

​​fuzzymatch Fuzzy Matching Application https://github.com/AdnanYoztyurk/fuzzymatch

​​zipslip://about A handy python script to test for zip slip vulnerabilities. https://github.com/Ch0pin/zipslip

​​RapidFuzz Rapid fuzzy string matching in Python and C++ using the Levenshtein Distance https://github.com/maxbachmann/RapidFuzz

​​CVE 2022-42889 This script is for removing the older version of Apache Commons Text 1.9 and replaces it with the newer version (1.10.0) in JMETER_HOME/lib folder. https://github.com/QAInsights/cve-2022-42889-jmeter #cve

​​Overview A python script developed to process Windows memory images based on triage type. https://github.com/CrowdStrike/SuperMem

​​Bella Bella is a pure python post-exploitation data mining tool & remote administration tool for macOS. 🍎 💻 https://github.com/00xkhaled/Bella

​​Redpill Assist reverse tcp shells in post-exploration tasks. https://github.com/r00t-3xp10it/redpill

​​malleable-c2 Cobalt Strike Malleable C2 Design and Reference Guide. This project is intended to serve as reference when designing Cobalt Strike Malleable C2 profiles. https://github.com/threatexpress/malleable-c2

​​ErebusGate A quick example of the Erebus Gate technique in Nim. https://github.com/Haunted-Banshee/ErebusGate

​​Striker C2 Striker is a simple Command and Control (C2) program. https://github.com/4g3nt47/Striker

​​Certify Certify is a C# tool to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS). @harmj0y and @tifkin_ are the primary authors of Certify and the the associated AD CS research (blog and whitepaper). https://github.com/GhostPack/Certify

​​USB Rubber Ducky 2.0 The new USB Rubber Ducky is more dangerous than ever! The beloved hacker tool can now pwn you with its own programming language :) Already, previous versions of the Rubber Ducky could carry out attacks like creating a fake Windows pop-up box to harvest a user’s login credentials or causing Chrome to send all saved passwords to an attacker’s webserver. But these attacks had to be carefully crafted for specific operating systems and software versions and lacked the flexibility to work across platforms. The newest Rubber Ducky aims to overcome these limitations. It ships with a major upgrade to the DuckyScript programming language, which is used to create the commands that the Rubber Ducky will enter into a target machine. While previous versions were mostly limited to writing keystroke sequences, DuckyScript 3.0 is a feature-rich language, letting users write functions, store variables, and use logic flow controls (i.e., if this... then that). That means, for example, the new Ducky can run a test to see if it’s plugged into a Windows or Mac machine and conditionally execute code appropriate to each one or disable itself if it has been connected to the wrong target. It also can generate pseudorandom numbers and use them to add variable delay between keystrokes for a more human effect. Perhaps most impressively, it can steal data from a target machine by encoding it in binary format and transmitting it through the signals meant to tell a keyboard when the CapsLock or NumLock LEDs should light up. With this method, an attacker could plug it in for a few seconds, tell someone, “Sorry, I guess that USB drive is broken,” and take it back with all their passwords saved. New: ▫️ Advanced DuckyScript 3.0 ▫️ Payload Studio + Hub ▫️ Extensions ▫️ OS Detection ▫️ Keystroke Reflection (NEW Side-Channel Exfiltration) ▫️ Hundreds of new features! Payload Library: https://github.com/hak5/usbrubberducky-payloads Buy online: 🛒 https://amzn.to/3Ubipt7 #usb #ducky #hak5

​​Bug bounty You can find here some resources I use to do bug bounty hunting. https://github.com/sehno/Bug-bounty

​​DNSMonitor A DNS Monitor, leveraging Apple's NEDNSProxyProvider/Network Extension Framew. https://github.com/objective-see/DNSMonitor

​​MoreImpacketExamples This repository contains a few short python scripts that were created using the Impacket library. The primary goal of this project is to help myself and others who are looking to transition from using the provided impacket examples to modifying/creating scripts of their own. These scripts are not necessarily optimized for utility or OPSEC concerns, however I've tried to make them as dynamic as possible in case anyone wants to change their default behavior. https://github.com/icyguider/MoreImpacketExamples

​​AppShark Appshark is a static taint analysis platform to scan vulnerabilities in an Android app. https://github.com/bytedance/appshark

​​CVE-2022-31692 Authorization rules can be bypassed via forward or include dispatcher types in Spring Security. https://github.com/SpindleSec/cve-2022-31692 #cve

​​Awesome-Pentest A list of awesome penetration testing tools and resources. https://github.com/Kc57/Awesome-Pentest