HackGit

​​Info-Sec-Dork-List https://github.com/0xAbbarhSF/Info-Sec-Dork-List t.me/hackgit

​​Bandit Bandit is a tool designed to find common security issues in Python code. To do this Bandit processes each file, builds an AST from it, and runs appropriate plugins against the AST nodes. Once Bandit has finished scanning all the files it generates a report. Bandit was originally developed within the OpenStack Security Project and later rehomed to PyCQA. https://github.com/PyCQA/bandit

​​The Bastion Bastions are a cluster of machines used as the unique entry point by operational teams (such as sysadmins, developers, database admins, ...) to securely connect to devices (servers, virtual machines, cloud instances, network equipment, ...), usually using ssh. Bastions provides mechanisms for authentication, authorization, traceability and auditability for the whole infrastructure. Learn more by reading the blog post series that announced the release: ▫️ Part 1 - Genesis ▫️ Part 2 - Delegation Dizziness ▫️ Part 3 - Security at the Core ▫️ Part 4 - A new era https://github.com/ovh/the-bastion

​​salus Guardian of Code Safety and Security Salus (Security Automation as a Lightweight Universal Scanner), named after the Roman goddess of protection, is a tool for coordinating the execution of security scanners. You can run Salus on a repository via the Docker daemon and it will determine which scanners are relevant, run them and provide the output. Most scanners are other mature open source projects which we include directly in the container. https://github.com/coinbase/salus

​​TradecraftCON conference. ▫️ XLL Phishing ▫️ CobaltStrike External C2 Via Microsoft Teams https://github.com/Octoberfest7/Presentations

​​BountyReport Make your bug bounty report easy and fast https://github.com/khanjanny/BountyReport

​​dolibarr-rce Dolibarr ERP & CRM is a modern software package that helps manage your organization's activity (contacts, suppliers, invoices, orders, stocks, agenda…). It's an Open Source Software suite (written in PHP with optional JavaScript enhancements) designed for small, medium or large companies, foundations and freelancers. dolibarr<=15.0.3 has an arbitrary add administrator vulnerability and a backend remote code execution vulnerability. https://github.com/youncyb/dolibarr-rce

​​subparse Subparse, is a modular framework developed by Josh Strochein, Aaron Baker, and Odin Bernstein. The framework is designed to parse and index malware files and present the information found during the parsing in a searchable web-viewer. The framework is modular, making use of a core parsing engine, parsing modules, and a variety of enrichers that add additional information to the malware indices. The main input values for the framework are directories of malware files, which the core parsing engine or a user-specified parsing engine parses before adding additional information from any user-specified enrichment engine all before indexing the information parsed into an elasticsearch index. The information gathered can then be searched and viewed via a web-viewer, which also allows for filtering on any value gathered from any file. There are currently 3 parsing engine, the default parsing modules (ELFParser, OLEParser and PEParser), and 4 enrichment modules (ABUSEEnricher, CAPEEnricher, STRINGEnricher and YARAEnricher). https://github.com/jstrosch/subparse

InfoSec Black Friday Deals ~ "Hack Friday" 2022 Edition https://github.com/0x90n/InfoSec-Black-Friday

Awesome RedTeam Operation Pentest and red teams tools https://github.com/0x90n/InfoSec-Black-Friday #redteam

​​USB Killer Pro Kit v3 The only CE and FCC approved USB ESD Testing device on the market; designed to test the surge protection circuitry of electronics to their limits - and beyond. Love it or hate it, the USB Killer has firmly established itself as a reality that hardware designers have no choice but to acknowledge. For pen testers, it opens up a new vector of attacks. For LEA, a new means of target manipulation. For hardware engineers and industry, a tool with which they can harden their products. V3 was rebuilt from the ground up to be more capable, portable and stable. In conjunction with the tester & adaptor kit, the USB Killer is indispensable for HW pen testers. When plugged into a device, the USB Killer rapidly charges its capacitors from the USB power lines. When the device is charged, -200VDC is discharged over the data lines of the host device. This charge/discharge cycle is repeated many times per second until the USB Killer is removed. Simply put: used on unprotected equipment, the USB Killer instantly and permanently disables unprotected hardware❗️ Its compact size and flash-drive style housing makes it an important device in every pen-tester's toolkit. Buy online: Original 🛒 https://amzn.to/3TBaZyB Chinese clone 🛒 https://ali.ski/v_Urn0 #usb #killer

​​cis-vsphere A tool to assess the compliance of a VMware vSphere environment against the CIS Benchmark for VMware vSphere. https://github.com/karimhabush/cis-vsphere

​​CrackMapExec CrackMapExec (a.k.a CME) is a post-exploitation tool that helps automate assessing the security of large Active Directory networks. Built with stealth in mind, CME follows the concept of “Living off the Land”: abusing built-in Active Directory features/protocols to achieve its functionality and allowing it to evade most endpoint protection/IDS/IPS solutions. CME makes heavy use of the Impacket library (developed by @asolino) and the PowerSploit Toolkit (developed by @mattifestation) for working with network protocols and performing a variety of post-exploitation techniques. Although meant to be used primarily for offensive purposes (e.g. red teams), CME can be used by blue teams as well to assess account privileges, find possible misconfiguration, and simulate attack scenarios. CrackMapExec is developed by @byt3bl33d3r This repository contains the following repositories as submodules: ▫️ Impacket ▫️ Pywinrm ▫️ Pywerview ▫️ PowerSploit ▫️ Invoke-Obfuscation ▫️ Invoke-Vnc ▫️ Mimikittenz ▫️ NetRipper ▫️ RandomPS-Scripts ▫️ SessionGopher ▫️ Mimipenguin https://github.com/Porchetta-Industries/CrackMapExec #best

​​Attack Simulator Simulate past supply chain attacks such as SolarWinds, Codecov, and ua-parser-js and see how Harden-Runner stops them. Harden-Runner GitHub Action installs a security agent on the GitHub-hosted runner (Ubuntu VM) to ▫️ Prevent exfiltration of credentials ▫️ Detect tampering of source code during build ▫️ Enable running jobs without sudo access https://github.com/step-security/attack-simulator

​​TelemetrySource Project created to map functions repsonsible for triggering events from various telemetry sources. https://github.com/jsecurity101/TelemetrySource Uncovering Window Security Events: https://posts.specterops.io/uncovering-window-security-events-ab72e1ec745c

​​firebaseExploiter Insecure Firebase CLI Scanner & Exploit. ▫️ Mass vulnerability scanning from list of hosts ▫️ Custom JSON data in exploit.json to upload during exploit ▫️ Custom URI path for exploit https://github.com/securebinary/firebaseExploiter

​​FISSURE Frequency Independent SDR-based Signal Understanding and Reverse Engineering. FISSURE is an open-source RF and reverse engineering framework designed for all skill levels with hooks for signal detection and classification, protocol discovery, attack execution, IQ manipulation, vulnerability analysis, automation, and AI/ML. https://github.com/ainfosec/FISSURE

​​Villain Villain is a Windows & Linux backdoor generator and multi-session handler that allows users to connect with sibling servers (other machines running Villain) and share their backdoor sessions, handy for working as a team. The main idea behind the payloads generated by this tool is inherited from HoaxShell. One could say that Villain is an evolved, steroid-induced version of it. https://github.com/t3l3machus/Villain Video Presentation: https://www.youtube.com/watch?v=NqZEmBsLCvQ

​​EDD Enumerate Domain Data is designed to be similar to PowerView but in .NET. PowerView is essentially the ultimate domain enumeration tool, and we wanted a .NET implementation that we worked on ourselves. This tool was largely put together by viewing implementations of different functionality across a wide range of existing projects and combining them into EDD. https://github.com/FortyNorthSecurity/EDD

​​DroneSploit Easily pentest drones! This CLI framework is based on sploitkit and is an attempt to gather hacking techniques and exploits especially focused on drone hacking. For the ease of use, the interface has a layout that looks like Metasploit. https://github.com/dhondta/dronesploit Details: https://hakin9.org/dronesploit-a-pentesting-console-framework-dedicated-to-drones/